WO2022037619A1 - 鉴权失败的处理方法、装置、终端及网络侧设备 - Google Patents

鉴权失败的处理方法、装置、终端及网络侧设备 Download PDF

Info

Publication number
WO2022037619A1
WO2022037619A1 PCT/CN2021/113280 CN2021113280W WO2022037619A1 WO 2022037619 A1 WO2022037619 A1 WO 2022037619A1 CN 2021113280 W CN2021113280 W CN 2021113280W WO 2022037619 A1 WO2022037619 A1 WO 2022037619A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication failure
terminal
cause value
onboarding
network
Prior art date
Application number
PCT/CN2021/113280
Other languages
English (en)
French (fr)
Inventor
张鹏飞
柯小婉
康艳超
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2022037619A1 publication Critical patent/WO2022037619A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service

Definitions

  • the present invention requires the priority of a Chinese patent application with an application number of 202010847188.9 and an invention title of "Method, Apparatus, Terminal, and Network-side Equipment for Authentication Failure" submitted to the Chinese Patent Office on August 21, 2020. The entire contents are incorporated herein by reference.
  • the present application belongs to the technical field of wireless communication, and in particular relates to a method, apparatus, terminal and network side equipment for processing authentication failure.
  • Configuring onboarding means that the terminal obtains information such as the certificate of the target Stand-alone Non-Public Network (SNPN) by accessing the current network.
  • SNPN Stand-alone Non-Public Network
  • the terminal selects an independent non-public network (onboarding-SNPN, O-SNPN) configured to access the network
  • O-SNPN independent non-public network
  • the user can manually select or the terminal can randomly select one of the O-SNPNs for onboarding , initiates a registration request to the O-SNPN, and the network side needs to authenticate the terminal in the process, and the authentication may fail in the authentication process.
  • the cause value (cause value) sent by the network side to the terminal includes: #3, #74, #75 and so on.
  • these cause values specified in the current protocol cannot cover the authentication failure during the onboarding process.
  • the terminal determines that the list of subscriber data of the terminal matches the current service
  • the entry corresponding to the SNPN is invalid.
  • the currently serving SNPN only fails to authenticate the UE as an onboarding network, not that the terminal's subscription information in the SNPN is invalid. Therefore, it is inappropriate to invalidate the corresponding subscription information of the currently serving SNPN.
  • the embodiments of the present application provide an authentication failure processing method, apparatus, terminal, and network-side device, which can solve the problem that the network-side device cannot return a corresponding authentication failure reason value to the terminal according to whether the current network is used for onboarding.
  • a method for processing authentication failure includes: in the case that the authentication of the terminal fails, the access and mobility management function entity determines the authentication returned to the terminal according to the first message Failure cause value, wherein the first message indicates whether the current network is used for the terminal's configuration onboarding; send a second message to the terminal, wherein the second message carries the authentication The right failure reason value.
  • an authentication failure processing device includes: a determination module configured to determine, according to a first message, that the authentication failure returned to the terminal in the case of a terminal authentication failure Reason value, where the first message indicates whether the current network is used for the terminal's configuration onboarding; the first transceiver module is configured to send a second message to the terminal, where the second message carries There is the authentication failure reason value.
  • a method for processing an authentication failure includes: a terminal receives a second message, wherein the authentication failure cause value carried in the second message; if the authentication failure cause is determined If the authentication failure indicated by the value is the authentication failure of the onboarding process of the terminal, the SNPN of the currently accessed independent non-public network is marked as a network prohibited from being selected as onboarding.
  • an authentication failure processing device comprising: a second transceiver module for receiving a second message, wherein the authentication failure reason value carried in the second message; processing module , for marking the currently accessed independent non-public network SNPN as a network prohibited from being selected for onboarding if it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the terminal's onboarding process.
  • a network-side device in a fifth aspect, includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor, the program or instruction being executed by the The processor implements the steps of the method as described in the first aspect when executed.
  • a terminal in a sixth aspect, includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor, when the program or instruction is executed by the processor.
  • a readable storage medium is provided, and a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect, or the The steps of the method described in the third aspect.
  • a chip in an eighth aspect, includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a network-side device program or instruction, and implements the method described in the first aspect.
  • the method described above, or the processor is used to run a terminal program or instruction to implement the method described in the third aspect.
  • a computer program product comprising a processor, a memory, and a program or instruction stored on the memory and executable on the processor, the program or instruction being executed by the When executed by the processor, the steps of the method described in the first aspect or the steps of the method described in the third aspect are realized.
  • the access and mobility management function entity determines the authentication failure cause value returned to the terminal according to the first message indicating whether the current network is used for the onboarding of the terminal , and send the authentication failure reason value to the terminal, so that the onboarding network can select the corresponding reason value after the terminal authentication fails.
  • FIG. 1 shows a block diagram of a wireless communication system to which an embodiment of the present application can be applied
  • FIG. 2 shows a schematic flowchart of a method for processing an authentication failure provided by an embodiment of the present application
  • FIG. 3 shows another schematic flowchart of the processing method for authentication failure provided by an embodiment of the present application
  • FIG. 4 shows another schematic flowchart of the processing method for authentication failure provided by an embodiment of the present application
  • FIG. 5 shows another schematic flowchart of the processing method for authentication failure provided by an embodiment of the present application
  • FIG. 6 shows another schematic flowchart of the processing method for authentication failure provided by an embodiment of the present application
  • FIG. 7 shows a schematic structural diagram of an authentication failure processing apparatus provided by an embodiment of the present application.
  • FIG. 8 shows another schematic structural diagram of an authentication failure processing apparatus provided by an embodiment of the present application.
  • FIG. 9 shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 10 shows a schematic diagram of a hardware structure of a terminal provided by an embodiment of the present application.
  • FIG. 11 shows a schematic diagram of a hardware structure of a network side device provided by an embodiment of the present application.
  • first, second and the like in the description and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the present application can be practiced in sequences other than those illustrated or described herein, and "first”, “second” distinguishes Usually it is a class, and the number of objects is not limited.
  • the first object may be one or multiple.
  • “and/or” in the description and claims indicates at least one of the connected objects, and the character “/" generally indicates that the associated objects are in an "or” relationship.
  • LTE Long Term Evolution
  • LTE-Advanced LTE-Advanced
  • LTE-A Long Term Evolution-Advanced
  • CDMA Code Division Multiple Access
  • TDMA Time Division Multiple Access
  • FDMA Frequency Division Multiple Access
  • OFDMA Orthogonal Frequency Division Multiple Access
  • SC-FDMA Single-carrier Frequency-Division Multiple Access
  • system and “network” in the embodiments of the present application are often used interchangeably, and the described technology can be used not only for the above-mentioned systems and radio technologies, but also for other systems and radio technologies.
  • NR New Radio
  • the following description describes a New Radio (NR) system for example purposes, and uses NR terminology in most of the description below, but these techniques can also be applied to applications other than NR system applications, such as 6th generation (6 th Generation, 6G) communication system.
  • 6th generation 6 th Generation, 6G
  • FIG. 1 shows a block diagram of a wireless communication system to which the embodiments of the present application can be applied.
  • the wireless communication system includes a terminal 11 and a network-side device 12 .
  • the terminal 11 may also be called a terminal device or a user terminal (User Equipment, UE), and the terminal 11 may be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer) or a notebook computer, a personal digital computer Assistant (Personal Digital Assistant, PDA), handheld computer, netbook, ultra-mobile personal computer (ultra-mobile personal computer, UMPC), mobile Internet device (Mobile Internet Device, MID), wearable device (Wearable Device) or vehicle-mounted device (VUE), pedestrian terminal (PUE) and other terminal-side devices, wearable devices include: bracelets, headphones, glasses, etc.
  • PDA Personal Digital Assistant
  • the network side device 12 may be a base station or a core network, wherein the base station may be referred to as a Node B, an evolved Node B, an access point, a Base Transceiver Station (BTS), a radio base station, a radio transceiver, a basic service Set (Basic Service Set, BSS), Extended Service Set (Extended Service Set, ESS), Node B, Evolved Node B (eNB), Home Node B, Home Evolved Node B, WLAN Access Point, WiFi Node, Send Transmitting Receiving Point (TRP) or some other suitable term in the field, as long as the same technical effect is achieved, the base station is not limited to a specific technical vocabulary.
  • the core network may include an access and mobility management function (Access and Mobility Management Function, AMF) entity, a session management function (Session Management Function, SMF) entity, an authentication service function (Authentication Server Function, AUSF) entity, digital certificate service ( Digital Certificate Solution, DCS) entity and other functional entities.
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • AUSF authentication Server Function
  • DCS Digital Certificate Solution
  • FIG. 2 shows a schematic flowchart of a method for processing an authentication failure in an embodiment of the present application.
  • the method 200 may be executed by a network-side device (for example, an AMF entity of a core network).
  • the method can be executed by software or hardware installed on the network side device.
  • the method may include the following steps.
  • the AMF entity determines an authentication failure cause value returned to the terminal according to a first message, where the first message indicates whether the current network is used for onboarding of the terminal.
  • the current network refers to the network currently accessed by the terminal.
  • configuring onboarding refers to that the terminal obtains information such as a certificate of a target standalone non-public network (Stand-alone Non-Public Network, SNPN) by accessing the current network.
  • SNPN Session Initiation Network
  • the information carried in the first message includes but is not limited to: the registration type of the terminal and/or the authentication parameter of the terminal.
  • the first message may also carry other information, as long as the network side can determine whether the current network is used for the onboarding of the terminal according to the information. This is an embodiment of the present application. is not limited.
  • the first message may be sent by the terminal. Therefore, in this possible implementation manner, before S210, the method may further include: receiving the first message sent by the terminal.
  • the first message may include: a registration request message.
  • a registration request message for onboarding initiated by the terminal.
  • the AMF can determine whether the current network is used for terminal onboarding.
  • the authentication failure cause value determined by the AMF may be the newly added cause value, that is, the first target cause value
  • the The first target cause value is used in the system to indicate the authentication failure in the onboarding process of the terminal, wherein the first target cause value can be used exclusively to indicate the authentication failure in the onboarding process of the terminal. It can directly indicate that the authentication fails during the onboarding process of the terminal.
  • the terminal can determine that the authentication fails when the current network is used as the onboarding network, and can identify the current network as a network not suitable for onboarding.
  • the authentication failure cause value determined by the AMF may also be the second target cause value, where the second The target cause value is used to indicate the authentication failure of the terminal, that is, the second target cause value is not specifically used to indicate the authentication failure in the onboarding process of the terminal.
  • the second target cause value may be the existing #3, #74 and #75 in the system. Of course, it is not limited to this. In practical applications, the second target cause value may also be other specific values. It is the reason value indicating the authentication failure of the terminal in other cases in the system. With this possible implementation, the terminal side can determine the reason for the authentication failure in combination with the registration type.
  • the AMF may send a registration rejection message to the terminal, where the registration rejection message carries the authentication failure reason value.
  • the AMF may also send the authentication failure reason value to the terminal through other messages, which is not specifically limited in this embodiment of the present application.
  • the access and mobility management function entity determines whether to send the terminal to the terminal according to the first message indicating whether the current network is used for onboarding of the terminal. Returns the authentication failure reason value, and sends the authentication failure reason value to the terminal, so that the onboarding network can select the corresponding reason value after the terminal authentication fails.
  • FIG. 3 shows another schematic flowchart of a method for processing an authentication failure in an embodiment of the present application, and the method 300 may be executed by a terminal.
  • the method may be performed by software or hardware installed on the terminal.
  • the method may include the following steps.
  • the terminal receives a second message, where the authentication failure reason value carried in the second message.
  • the second message is the same as the second message in the method 200 , and the authentication failure cause value carried in the second message is the same as that in the method 200 .
  • the description in the method 200 please refer to the description in the method 200 .
  • the terminal can determine the authentication indicated by the authentication failure cause value according to the first target cause value
  • the failure is the authentication failure of the terminal's onboarding process. Therefore, in this possible implementation, it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, including: if the authentication failure cause value is the first target cause value, then it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the first target cause value is used to indicate that the authentication failed in the onboarding process of the terminal. Reason value.
  • the terminal may determine the authentication failure cause in combination with whether the current registration purpose is for onboarding
  • the authentication failure indicated by the value is the authentication failure of the onboarding process of the terminal. Therefore, in this possible implementation, it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, including: if the authentication failure cause value is the second target cause value, and it is determined that the purpose of the current registration is for onboarding, then it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the second target cause value is used to indicate The authentication of the terminal failed.
  • the second target cause value may include any one of the following: 3, 74, and 75. That is, the second target cause value may be one of #3, #74 or #75 in the existing system, of course, it is not limited to this, and the second target cause value may also be other cause values in the existing system.
  • the terminal's subscription information list (list of subscriber data) may be the SNPN corresponding to the current service. The entry is set to unavailable.
  • the second target reason value is #74 or #75
  • the SNPN ID of the current access network can be stored in the temporary forbidden SNPN (temporarily forbidden SNPNs) list, where #75
  • #74 The difference from #74 is that if the second target cause value is #74, the stored SNPN ID is the globally unique identifier of the SNPN network.
  • marking the currently accessed SNPN as a network that is prohibited from being selected for onboarding may include: recording the SNPN identifier of the currently accessed SNPN into a target list, where the target list is used to record the prohibited network The SNPN identifier of the network selected by the terminal as onboarding. Through the target list, the network that is prohibited from being selected by the terminal as onboarding can be managed uniformly.
  • the target list if it is determined that the authentication failure indicated by the authentication failure reason value is the authentication failure of the onboarding process of the terminal, if the target list currently exists, the SNPN identifier of the currently accessed SNPN is used It is added to the target list. If the target list does not currently exist, the target list can be created, and the SNPN identifier of the currently accessed SNPN is recorded in the target list.
  • the terminal after marking the currently accessed SNPN as a network prohibited from being selected for onboarding, in the case of being set to the automatic network selection mode, the terminal prohibits selection of the SNPN recorded in the target list Identifies the corresponding SNPN network as the onboarding network.
  • the terminal when the terminal is set to the automatic network selection mode, it is prohibited to use the SNPN network corresponding to the SNPN identifier recorded in the target list as the onboarding network.
  • the method may further include: after the terminal is set to the manual network selection mode In the case of the selection mode, one of the following (1) to (3) is executed in response to the inputted network selection command.
  • the SNPN identifier recorded in the target list can be displayed, so that the user can select the SNPN network recorded in the target list as the network for other purposes except onboarding.
  • the terminal when the terminal receives the second message carrying the authentication failure cause value, if the terminal determines that the authentication failure indicated by the authentication failure cause value is the onboarding of the terminal If the authentication of the process fails, the currently accessed SNPN is marked as a network that is prohibited from being selected for onboarding, so that the terminal can no longer select the currently accessed SNPN as the onboarding network when performing onboarding in the subsequent process. Improve the success rate of onboarding.
  • FIG. 4 is a schematic flowchart of a method for processing an authentication failure provided by an embodiment of the present application.
  • the method 400 may be executed by a terminal and a network side device.
  • the method can be executed by software or hardware installed on the terminal and the network side device.
  • the network side device may include: AMF entity, AUSF entity and DCS entity.
  • the method may include the following steps.
  • the UE initiates a registration request for onboarding.
  • the AMF initiates an authentication request (Nausf_UEAuthentication_Aunthenticate Request) to the AUSF.
  • the AUSF authenticates the UE through the DCS.
  • the UE is authenticated using default credentials.
  • the authentication result is failure.
  • the DCS does not have the authentication information of the UE and so on.
  • the AMF sends a registration rejection message to the UE that includes cause: #X.
  • X is a reason value specially used to indicate an authentication failure in the onboarding process of the terminal, for example, a newly defined authentication failure reason value.
  • the UE After receiving the registration rejection message including cause: #X, the UE stores the SNPN ID. This stored procedure can be implemented by creating or updating a list of SNPN IDs for storing forbidden onboarding SNPN IDs (forbidden onboarding SNPN IDs).
  • the UE selects other O-SNPNs for registration.
  • the UE selects other available onboarding networks for registration.
  • the SNPN IDs can be indicated as forbidden onboarding SNPN IDs.
  • FIG. 5 is a schematic flowchart of a method for processing an authentication failure provided by an embodiment of the present application, and the method 500 may be executed by a terminal and a network side device.
  • the method can be executed by software or hardware installed on the terminal and the network side device.
  • the network side device may include: AMF entity, AUSF entity and DCS entity.
  • the method may include the following steps.
  • S510-S540 are the same as S410-S440 in the method 400, and are not repeated here.
  • S570 store the SNPN ID
  • the storage process may be implemented by creating or updating a list of SNPN IDs, where the list is used to store forbidden onboarding SNPN IDs, instead of setting the SNPN ID to be unavailable.
  • the entry of "list of subscriber data" corresponding to the current SNPN is set as unavailable Use, that is, the entry corresponding to the SNPN currently serving in the subscription information list of the terminal is set as unavailable, that is, the SNPN ID is set as unavailable.
  • FIG. 6 is a schematic flowchart of a method for processing an authentication failure provided by an embodiment of the present application.
  • the method 600 may be executed by a terminal and a network side device.
  • the method can be executed by software or hardware installed on the terminal and the network side device.
  • the network side device may include: AMF entity, AUSF entity and DCS entity.
  • the method may include the following steps.
  • S610-S640 are the same as S410-S440 in the method 400, and are not repeated here.
  • the AMF sends cause value#75 to the UE, otherwise, the AMF sends cause value#74 to the UE.
  • S670 store the SNPN ID
  • the storage process can be implemented by creating or updating a list of SNPN IDs, where the list is used to store forbidden onboarding SNPN IDs, instead of setting the SNPN ID to be unavailable.
  • the SNPN ID is stored in a list of temporarily forbidden SNPN networks (temporarily forbidden SNPNs) .
  • the execution subject may be the authentication failure processing device, or, in the authentication failure processing device, the processing method for executing the authentication failure processing method may be executed. control module.
  • an authentication failure processing device provided by the embodiment of the present application is described by taking the processing method of the authentication failure processing device for performing the authentication failure as an example.
  • FIG. 7 is a schematic structural diagram of an authentication failure processing apparatus provided by an embodiment of the present application.
  • the authentication failure processing apparatus mainly includes: a determination module 701 and a first transceiver module 702 .
  • the determining module 701 is configured to determine, according to a first message, an authentication failure reason value returned to the terminal in the case of a terminal authentication failure, where the first message indicates the current Whether the network is used for the configuration of the terminal for onboarding; the first transceiver module 702 is configured to send a second message to the terminal, where the second message carries the authentication failure reason value.
  • the first message carries the registration type of the terminal and/or the authentication parameter of the terminal.
  • the determining module 701 determines the authentication failure cause value returned to the terminal according to the first message, including: if the first message indicates that the current network is used for onboarding of the terminal , then it is determined that the authentication failure cause value is a first target cause value, where the first target cause value is used to indicate an authentication failure in the onboarding process of the terminal.
  • the determining module 701 determines the authentication failure cause value returned to the terminal according to the first message, including: if the first message indicates that the current network is used for onboarding of the terminal , then it is determined that the authentication failure cause value is a second target cause value, where the second target cause value is used to indicate that the authentication of the terminal fails.
  • the first transceiver module 702 is further configured to receive the first message sent by the terminal before determining the authentication failure cause value returned to the terminal according to the first message. a message.
  • the determining module 701 determines the authentication returned to the terminal according to the first message indicating whether the current network is used for the terminal's onboarding For the failure cause value, the first transceiver module 702 sends the authentication failure cause value to the terminal, so that the onboarding network can select a corresponding cause value after the terminal fails to be authenticated.
  • the apparatus for processing authentication failure in the embodiment of the present application may be an apparatus, or may be a component, an integrated circuit, or a chip in a network-side device.
  • the apparatus may be a network side device.
  • the network side device may include but is not limited to the above-mentioned AMF entity, which is not specifically limited in this embodiment of the present application.
  • the network-side device in this embodiment of the present application may be a device having an operating system.
  • the operating system may be an Android (Android) operating system, an ios operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.
  • the network-side device provided in the embodiments of the present application can implement each process implemented by the network-side device in each method embodiment in FIG. 2 to FIG. 6 , and achieve the same technical effect. To avoid repetition, details are not described here.
  • FIG. 8 is another schematic structural diagram of an authentication failure processing apparatus provided by an embodiment of the present application.
  • the authentication failure processing apparatus may include: a second transceiver module 801 and a processing module 802 .
  • the second transceiver module 801 is configured to receive a second message, wherein the authentication failure cause value carried in the second message; and the processing module 802 is configured to determine the authentication failure cause if it is determined
  • the authentication failure indicated by the value is the authentication failure of the onboarding process of the terminal, and the currently accessed SNPN is marked as a network that is prohibited from being selected for onboarding.
  • the processing module 802 determines that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, including: if the authentication failure cause value is the first a target cause value, then it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the first target cause value is used to indicate the authentication failure in the onboarding process of the terminal The reason value for the authorization failure.
  • the processing module 802 determines that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, including:
  • the authentication failure cause value is the second target cause value, and it is determined that the purpose of the current registration is for onboarding, then it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal , wherein the second target cause value is used to indicate that the authentication of the terminal fails.
  • the processing module 802 marks the currently accessed independent non-public network SNPN as a network prohibited from being selected for onboarding, including: recording the SNPN identifier of the currently accessed SNPN into the target list , wherein the target list is used to record the SNPN identifier of the network that is prohibited from being selected by the terminal as onboarding.
  • the processing module 802 is further configured to, after marking the currently accessed independent non-public network SNPN as a network prohibited from being selected for onboarding, in the case of being set to the automatic network selection mode, prohibiting The SNPN network corresponding to the SNPN identifier recorded in the target list is selected as the onboarding network.
  • the processing module 802 is further configured to, after marking the currently accessed independent non-public network SNPN as a network prohibited from being selected for onboarding, in the case of being set to the manual network selection mode, respond For the entered network selection command, perform one of the following processes:
  • the SNPN identifiers recorded in the target list are displayed, and the SNPN identifiers recorded in the target list are identified as the identifiers of the SNPN networks that are prohibited from being selected as onboarding.
  • the device for processing authentication failure in the embodiment of the present application may be a device, or may be a component, an integrated circuit, or a chip in a terminal.
  • the device may be a mobile terminal or a non-mobile terminal.
  • the mobile terminal may include, but is not limited to, the types of terminals 11 listed above, and the non-mobile terminal may be a server, a network attached storage (NAS), a personal computer (personal computer, PC), a television ( television, TV), teller machine, or self-service machine, etc., which are not specifically limited in the embodiments of the present application.
  • the authentication failure processing device may be a device having an operating system.
  • the operating system may be an Android (Android) operating system, an ios operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.
  • the authentication failure processing apparatus provided in the embodiment of the present application can implement the various processes implemented by the terminal in the method embodiment of FIG. 2 to FIG. 6 , and achieve the same technical effect.
  • an embodiment of the present application further provides a communication device 900, including a processor 901, a memory 902, a program or instruction stored in the memory 902 and executable on the processor 901,
  • a communication device 900 including a processor 901, a memory 902, a program or instruction stored in the memory 902 and executable on the processor 901,
  • the communication device 900 is a terminal
  • the program or instruction is executed by the processor 901
  • each process of the above-mentioned embodiment of the authentication failure processing method can be implemented, and the same technical effect can be achieved.
  • the communication device 900 is a network-side device
  • the program or instruction is executed by the processor 901
  • each process implemented by the AMF or the network-side device in the above-mentioned embodiment of the authentication failure processing method can be realized, and the same technical effect can be achieved, In order to avoid repetition, details are not repeated here.
  • the communication device 900 is a terminal
  • the program or instruction is executed by the processor 901
  • FIG. 10 is a schematic diagram of a hardware structure of a terminal implementing an embodiment of the present application.
  • the terminal 1000 includes but is not limited to: a radio frequency unit 1001, a network module 1002, an audio output unit 1003, an input unit 1004, a sensor 1005, a display unit 1006, a user input unit 1007, an interface unit 1008, a memory 1009, a processor 1010 and other components .
  • the terminal 1000 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 1010 through a power management system, so as to manage charging, discharging, and power consumption through the power management system management and other functions.
  • a power source such as a battery
  • the terminal structure shown in FIG. 10 does not constitute a limitation on the terminal, and the terminal may include more or less components than shown, or combine some components, or arrange different components, which will not be repeated here.
  • the input unit 1004 may include a graphics processor (Graphics Processing Unit, GPU) 10041 and a microphone 10042. Such as camera) to obtain still pictures or video image data for processing.
  • the display unit 1006 may include a display panel 10061, which may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like.
  • the user input unit 1007 includes a touch panel 10071 and other input devices 10072 .
  • the touch panel 10071 is also called a touch screen.
  • the touch panel 10071 may include two parts, a touch detection device and a touch controller.
  • Other input devices 10072 may include, but are not limited to, physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, and joysticks, which will not be repeated here.
  • the radio frequency unit 1001 receives the downlink data from the network side device, and then processes it to the processor 1010; in addition, sends the uplink data to the network side device.
  • the radio frequency unit 1001 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.
  • Memory 1009 may be used to store software programs or instructions as well as various data.
  • the memory 1009 may mainly include a stored program or instruction area and a storage data area, wherein the stored program or instruction area may store an operating system, an application program or instruction required for at least one function (such as a sound playback function, an image playback function, etc.) and the like.
  • the memory 1009 may include a high-speed random access memory, and may also include a non-volatile memory, wherein the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM) ), erasable programmable read-only memory (ErasablePROM, EPROM), electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • ROM Read-Only Memory
  • PROM programmable read-only memory
  • ErasablePROM ErasablePROM
  • EPROM electrically erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory for example at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • the processor 1010 may include one or more processing units; optionally, the processor 1010 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs or instructions, etc. Modem processors mainly deal with wireless communications, such as baseband processors. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the processor 1010.
  • the radio frequency unit 1001 is configured to receive a second message, wherein the authentication failure reason value carried in the second message.
  • the processor 1010 is configured to mark the currently accessed independent non-public network SNPN as prohibited from being selected for onboarding if it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal The internet.
  • the terminal when the terminal receives the second message carrying the authentication failure cause value, if the terminal determines that the authentication failure indicated by the authentication failure cause value is the onboarding of the terminal If the authentication of the process fails, the currently accessed SNPN is marked as a network that is prohibited from being selected for onboarding, so that the terminal can no longer select the currently accessed SNPN as the onboarding network when performing onboarding in the subsequent process. Improve the success rate of onboarding.
  • the terminal when the terminal receives the second message carrying the authentication failure cause value, if the terminal determines that the authentication failure indicated by the authentication failure cause value is the onboarding of the terminal If the authentication of the process fails, the currently accessed SNPN is marked as a network that is prohibited from being selected for onboarding, so that the terminal can no longer select the currently accessed SNPN as the onboarding network when performing onboarding in the subsequent process. Improve the success rate of onboarding.
  • the network device 1100 includes: an antenna 1101 , a radio frequency device 1102 , and a baseband device 1103 .
  • the antenna 1101 is connected to the radio frequency device 1102.
  • the radio frequency device 1102 receives information through the antenna 1101, and sends the received information to the baseband device 1103 for processing.
  • the baseband device 1103 processes the information to be sent and sends it to the radio frequency device 1102
  • the radio frequency device 1102 processes the received information and sends it out through the antenna 1101 .
  • the above-mentioned frequency band processing apparatus may be located in the baseband apparatus 1103 , and the method performed by the network side device in the above embodiments may be implemented in the baseband apparatus 1103 , and the baseband apparatus 1103 includes a processor 1104 and a memory 1105 .
  • the baseband device 1103 may include, for example, at least one baseband board on which multiple chips are arranged, as shown in FIG. 11 , one of the chips is, for example, the processor 1104 , which is connected to the memory 1105 to call the program in the memory 1105 to execute The network devices shown in the above method embodiments operate.
  • the baseband device 1103 may further include a network interface 1106 for exchanging information with the radio frequency device 1102, and the interface is, for example, a common public radio interface (CPRI for short).
  • CPRI common public radio interface
  • the network-side device in this embodiment of the present invention further includes: instructions or programs that are stored in the memory 1105 and run on the processor 1104, and the processor 1104 invokes the instructions or programs in the memory 1105 to execute the modules shown in FIG. 7 .
  • Embodiments of the present application further provide a readable storage medium, where a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, each process of the above-mentioned embodiment of the method for processing an authentication failure is implemented, and The same technical effect can be achieved, and in order to avoid repetition, details are not repeated here.
  • the processor may be the processor in the terminal described in the foregoing embodiment, or the processor in the network side device described in the foregoing embodiment.
  • the readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and the like.
  • An embodiment of the present application further provides a chip, where the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a program or instruction of a network-side device or terminal to implement the above-mentioned
  • the chip includes a processor and a communication interface
  • the communication interface is coupled to the processor
  • the processor is used to run a program or instruction of a network-side device or terminal to implement the above-mentioned
  • the embodiments of the present application also provide a computer program product, the computer program product includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor, the program or instruction being When the processor is executed, each process of the above-mentioned embodiment of the authentication failure processing method can be realized, and the same technical effect can be achieved. In order to avoid repetition, details are not repeated here.
  • the chip mentioned in the embodiments of the present application may also be referred to as a system-on-chip, a system-on-chip, a system-on-chip, or a system-on-a-chip, or the like.

Abstract

本申请公开了一种鉴权失败的处理方法、装置、终端及网络侧设备，属于无线通信技术领域。其中，一种鉴权失败的处理方法包括：在对终端鉴权失败的情况下，接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的配置入网(onboarding)；向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。

Description

鉴权失败的处理方法、装置、终端及网络侧设备
交叉引用
本发明要求在2020年8月21日提交中国专利局、申请号为202010847188.9、发明名称为“鉴权失败的处理方法、装置、终端及网络侧设备”的中国专利申请的优先权，该申请的全部内容通过引用结合在本发明中。
技术领域
本申请属于无线通信技术领域，具体涉及一种鉴权失败的处理方法、装置、终端及网络侧设备。
背景技术
配置入网(onboarding)是指终端通过接入当前网络获取目标独立非公共网络(Stand-alone Non-Public Network，SNPN)的证书等信息。
目前，终端在进行配置入网的独立非公共网络(onboarding-SNPN，O-SNPN)选择时，如果有多个O-SNPN，则可以通过用户手动选择或终端随机选择其中一个O-SNPN用于onboarding，向该O-SNPN发起注册请求，而网络侧在该过程中需要对终端进行鉴权，在鉴权过程中，可能存在鉴权失败的情况。在相关技术中，终端在网络中鉴权失败时，网络侧向终端发送的原因值(cause value)包含：#3、#74、#75等。但当前协议中规定的这些原因值并不能覆盖onboarding过程中的鉴权失败，例如，如果接收到的原因值为#3，则终端确定终端的签约信息列表(list of subscriber data)中与当前服务的SNPN对应的表项无效。但是当前服务的SNPN只是作为onboarding网络对UE鉴权失败，并不是终端在该SNPN中的签约信息无效，因此，将当前服 务的SNPN的对应的签约信息无效是不恰当的。
由此可见，在相关技术中，终端在进行onboarding时，网络对终端进行鉴权失败后，不能根据当前网络是否被用于onboarding而向终端返回相应的鉴权失败原因值，进而可能导致终端根据网络侧返回的鉴权失败原因值所执行的操作错误。
发明内容
本申请实施例提供一种鉴权失败的处理方法、装置、终端及网络侧设备，能够解决网络侧设备不能根据当前网络是否被用于onboarding而向终端返回相应的鉴权失败原因值的问题。
第一方面，提供了一种鉴权失败的处理方法，该方法包括：在对终端鉴权失败的情况下，接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的配置入网(onboarding)；向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
第二方面，提供了一种鉴权失败的处理装置，所述装置包括：确定模块，用于在对终端鉴权失败的情况下，根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的配置入网onboarding；第一收发模块，用于向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
第三方面，提供了一种鉴权失败的处理方法，所述方法包括：终端接收第二消息，其中，所述第二消息中携带的鉴权失败原因值；若确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
第四方面，提供了一种鉴权失败的处理装置，所述装置包括：第二收发模块，用于接收第二消息，其中，所述第二消息中携带的鉴权失败原因值； 处理模块，用于若确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
第五方面，提供了一种网络侧设备，该网络侧设备包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤。
第六方面，提供了一种终端，该终端包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤。
第七方面，提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面所述的方法的步骤，或者实现如第三方面所述的方法的步骤。
第八方面，提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行网络侧设备程序或指令，实现如第一方面所述的方法，或所述处理器用于运行终端程序或指令，实现如第三方面所述的方法。
第九方面，提供了一种计算机程序产品，该计算机程序产品包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤，或者实现如第三方面所述的方法的步骤。
在本申请实施例中，在对终端鉴权失败的情况下，接入和移动管理功能实体根据指示当前网络是否被用于终端的onboarding的第一消息，确定向终端返回的鉴权失败原因值，并将该鉴权失败原因值发送给终端，从而使得作为onboarding的网络，在对终端鉴权失败以后，可以选择相应的原因值。
附图说明
图1示出本申请实施例可应用的一种无线通信系统的框图；
图2示出本申请实施例提供的鉴权失败的处理方法的一种流程示意图；
图3示出本申请实施例提供的鉴权失败的处理方法的另一种流程示意图；
图4示出本申请实施例提供的鉴权失败的处理方法的又一种流程示意图；
图5示出本申请实施例提供的鉴权失败的处理方法的又一种流程示意图；
图6示出本申请实施例提供的鉴权失败的处理方法的又一种流程示意图；
图7示出本申请实施例提供的鉴权失败的处理装置的一种结构示意图；
图8示出本申请实施例提供的鉴权失败的处理装置的又一种结构示意图；
图9示出本申请实施例提供的一种通信设备的结构示意图；
图10示出本申请实施例提供的一种终端的硬件结构示意图；
图11示出本申请实施例提供的一种网络侧设备的硬件结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”所区别的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”一般表示前后关联对象是一种“或”的关系。
值得指出的是，本申请实施例所描述的技术不限于长期演进型(Long Term Evolution，LTE)/LTE的演进(LTE-Advanced，LTE-A)系统，还可用于其他无线通信系统，诸如码分多址(Code Division Multiple Access，CDMA)、时分多址(Time Division Multiple Access，TDMA)、频分多址(Frequency Division Multiple Access，FDMA)、正交频分多址(Orthogonal Frequency Division Multiple Access，OFDMA)、单载波频分多址(Single-carrier Frequency-Division Multiple Access，SC-FDMA)和其他系统。本申请实施例中的术语“系统”和“网络”常被可互换地使用，所描述的技术既可用于以上提及的系统和无线电技术，也可用于其他系统和无线电技术。然而，以下描述出于示例目的描述了新空口(NewRadio，NR)系统，并且在以下大部分描述中使用NR术语，但是这些技术也可应用于NR系统应用以外的应用，如第6代(6 thGeneration，6G)通信系统。
图1示出本申请实施例可应用的一种无线通信系统的框图。无线通信系统包括终端11和网络侧设备12。其中，终端11也可以称作终端设备或者用户终端(User Equipment，UE)，终端11可以是手机、平板电脑(Tablet Personal Computer)、膝上型电脑(Laptop Computer)或称为笔记本电脑、个人数字助理(Personal Digital Assistant，PDA)、掌上电脑、上网本、超级移动个人计算机(ultra-mobile personal computer，UMPC)、移动上网装置(Mobile Internet Device，MID)、可穿戴式设备(Wearable Device)或车载设备(VUE)、行人终端(PUE)等终端侧设备，可穿戴式设备包括：手环、耳机、眼镜等。需要说明的是，在本申请实施例并不限定终端11的具体类型。网络侧设备12可以是基站或核心网，其中，基站可被称为节点B、演进节点B、接入点、基收发机站(Base Transceiver Station，BTS)、无线电基站、无线电收发机、基本服务集(Basic Service Set，BSS)、扩展服务集(Extended Service Set，ESS)、B节点、演进型B节点(eNB)、家用B节点、家用演进型B节点、WLAN接入点、WiFi节点、发送接收点(TransmittingReceivingPoint，TRP) 或所述领域中其他某个合适的术语，只要达到相同的技术效果，所述基站不限于特定技术词汇。
核心网可以包括接入和移动管理功能(Access and Mobility Management Function，AMF)实体、会话管理功能(Session Management Function，SMF)实体、鉴权服务功能(Authentication Server Function，AUSF)实体、数字证书服务(Digital Certificate Solution，DCS)实体等功能实体。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的鉴权失败的处理方法进行详细地说明。
图2示出本申请实施例中的鉴权失败的处理方法的一种流程示意图，该方法200可以由网络侧设备(例如，核心网的AMF实体)执行。换言之，所述方法可以由安装在网络侧设备上的软件或硬件来执行。如图2所示，该方法可以包括以下步骤。
S210，在对终端鉴权失败的情况下，AMF实体根据第一消息，确定向终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的onboarding。
其中，当前网络是指终端当前接入的网络。
在本申请实施例中，配置入网(onboarding)是指终端通过接入当前网络获取目标独立非公共网络(Stand-alone Non-Public Network，SNPN)的证书等信息。
在一个可能的实现方式中，第一消息中携带的信息包括但不限于：终端的注册类型和/或终端的鉴权参数。当然，并不限于此，在实际应用中，第一消息中还可以携带其它信息，只要网络侧根据该信息可以确定出当前网络是否被用于所述终端的onboarding即可，具体本申请实施例中不作限定。
在一个可能的实现方式中，第一消息可以是终端发送的，因此，在该可能的实现方式中，在S210之前，该方法还可以包括：接收所述终端发送的所述第一消息。
在上述可能的实现方式中，第一消息可以包括：注册请求消息。例如，终端发起的用于onboarding的注册请求消息。通过该注册请求消息，AMF可以确定当前网络是否被用于终端的onboarding。
在一个可能的实现方式中，若所述第一消息指示当前网络被用于所述终端的onboarding，AMF确定的鉴权失败原因值可以在新增的原因值，即第一目标原因值，该第一目标原因值在系统中用于指示终端的onboarding过程中的鉴权失败，其中，该第一目标原因值可以专用于指示终端的onboarding过程中的鉴权失败，通过该第一目标原因值可以直接指示终端的onboarding过程中的鉴权失败，终端根据该第一目标原因值可以确定将当前网络作为onboarding网络时鉴权失败，可以将当前网络标识为不适用于onboarding的网络。
或者，在另一个可能的实现方式中，若所述第一消息指示当前网络被用于所述终端的onboarding，AMF确定的鉴权失败原因值也可以为第二目标原因值，其中，第二目标原因值用于指示终端的鉴权失败，即第二目标原因值并不是专用于指示终端的onboarding过程中的鉴权失败。例如，第二目标原因值可以为系统中已有的#3、#74和#75，当然，并不限于此，在实际应用中，第二目标原因值也可以是其它具体值，该值可以是系统中在其它情况下指示终端的鉴权失败的原因值。采用该可能的实现方式，终端侧可以结合注册类型，确定鉴权失败的原因。
S220，向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
例如，AMF可以向终端发送注册拒绝消息，在该注册拒绝消息中携带所述鉴权失败原因值。当然，并不限于此，AMF还可以通过其它消息向终端发送所述鉴权失败原因值，具体本申请实施例中不作限定。
通过本申请实施例提供的鉴权失败的处理方法，在对终端鉴权失败的情况下，接入和移动管理功能实体根据指示当前网络是否被用于终端的 onboarding的第一消息，确定向终端返回的鉴权失败原因值，并将该鉴权失败原因值发送给终端，从而使得作为onboarding的网络，在对终端鉴权失败以后，可以选择相应的原因值。
图3示出本申请实施例中的鉴权失败的处理方法的另一种流程示意图，该方法300可以由终端执行。换言之，所述方法可以由安装在终端上的软件或硬件来执行。如图3所示，该方法可以包括以下步骤。
S310，终端接收第二消息，其中，所述第二消息中携带的鉴权失败原因值。
其中，第二消息与方法200中的第二消息相同，第二消息中携带的鉴权失败原因值与方法200中的相同，具体可以参见方法200中的描述。
S320，若确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
在一个可能的实现方式中，如果鉴权失败原因值为方法200中所述的第一目标原因值，则终端根据该第一目标原因值即可以确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败。因此，在该可能的实现方式中，确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：若所述鉴权失败原因值为第一目标原因值，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败的原因值。
或者，在另一个可能的实现方式中，如果鉴权失败原因值为方法200中所述的第二目标原因值，则终端可以结合当前注册的目的是否是为了onboarding来确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败。因此，在该可能的实现方式中，确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括： 若所述鉴权失败原因值为第二目标原因值，且确定当前注册的目的是为了onboarding，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第二目标原因值用于指示终端的鉴权失败。
可选地，所述第二目标原因值可以包括以下任一项：3、74、75。即第二目标原因值可以为现有系统中的#3、#74或#75中的一个，当然，并不限于此，第二目标原因值也可以是现有系统中的其它原因值。
在一个可能的实现方式中，如果第二目标原因值为#3，如果当前注册类型的目的不是为了onboarding，则可以将终端的签约信息列表(list of subscriber data)中与当前服务的SNPN对应的表项设为不可用。如果第二目标原因值为#74或#75，如果当前注册类型的目的不是为了onboarding，则可以将当前接入网络的SNPN ID存储到临时禁止SNPN(temporarily forbidden SNPNs)列表中，其中，#75与#74的不同在于，如果第二目标原因值为#74，则存储的SNPN ID为SNPN网络的全球唯一标识。
在一个可能的实现方式中，标记当前接入的SNPN为禁止被选作onboarding的网络可以包括：将当前接入的SNPN的SNPN标识记录到目标列表中，其中，所述目标列表用于记录禁止被所述终端选作onboarding的网络的SNPN标识。通过目标列表，可以对禁止被所述终端选作onboarding的网络进行统一管理。
在具体应用中，在确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败之后，如果当前存在所述目标列表，则将当前接入的SNPN的SNPN标识增加到该目标列表中，如果当前未存在所述目标列表，则可以创建该目标列表，并将当前接入的SNPN的SNPN标识记录到该目标列表中。
在一个可能的实现方式中，在标记当前接入的SNPN为禁止被选作onboarding的网络之后，在被设置为自动网络选择模式的情况下，所述终端 禁止选择所述目标列表中记录的SNPN标识对应的SNPN网络作为onboarding的网络。通过该可能的实现方式，在终端被设置为自动网络选择模式的情况下，禁止将目标列表中记录的SNPN标识对应的SNPN网络作为onboarding的网络。
或者，另一个可能的实现方式中，如果终端被设置为手动网络选择模式，在标记当前接入的SNPN为禁止被选作onboarding的网络之后，所述方法还可以包括：在被设置为手动网络选择模式的情况下，响应输入的网络选择命令，执行以下(1)至(3)之一的处理。
(1)不显示所述目标列表中记录的SNPN标识。例如，如果输入的网络选择命令选择的是作为onboarding的网络，则不显示所述目标列表中记录的SNPN标识，从而使得用户不会选择目标列表中记录的SNPN网络作为onboarding的网络。
(2)显示所述目标列表中记录的SNPN标识。例如，如果输入的网络选择命令选择的不是作为onboarding的网络，则可以显示所述目标列表中记录的SNPN标识，从而使得用户可以选择目标列表中记录的SNPN网络作为除onboarding以外的其它用途的网络。
(3)显示所述目标列表中记录的SNPN标识，并标识所述目标列表中记录的SNPN标识为禁止被选作onboarding的SNPN网络的标识。通过该可能的实现方式，可以在显示目标列表中记录的SNPN标识时，提示用户这些SNPN标识对应的SNPN网络是被禁止被选作onboarding的，从而可以使得用户在选择onboarding网络时，不会选择目标列表中记录的SNPN。
通过本申请实施例提供的鉴权失败的处理方法，终端在接收到携带鉴权失败原因值的第二消息时，如果确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的SNPN为禁止被选作onboarding的网络，从而使得终端在后续过程中，在进行onboarding时，可以不再选择所述当前接入的SNPN作为onboarding网络，提高onboarding 的成功率。
图4是本申请实施例提供的鉴权失败的处理方法的一种流程示意图，该方法400可以由终端和网络侧设备执行。换言之，所述方法可以由安装在终端和网络侧设备上的软件或硬件来执行。其中，网络侧设备可以包括：AMF实体、AUSF实体及DCS实体。如图4所示，该方法可以包括以下步骤。
S410、UE发起用于onboarding的注册请求。
S420、AMF向AUSF发起鉴权请求(Nausf_UEAuthentication_Aunthenticate Request)。
S430、AUSF通过DCS对该UE进行鉴权。例如，使用默认凭据对UE进行鉴权。
S440、鉴权结果为失败。例如，该DCS没有该UE的鉴权信息等。
S450、AMF向UE发送注册拒绝消息中包含cause：#X。其中，X为专用于指示终端的onboarding过程中的鉴权失败的原因值，例如，即新定义的鉴权失败原因值。
S460、UE接收到包含cause：#X的注册拒绝消息以后，存储该SNPN ID。该存储过程可以通过创建或者更新SNPN IDs列表的形式来实现，该列表用于存储禁止选作onboarding的SNPN标识(forbidden onboarding SNPN IDs)。
S470、UE选择其他O-SNPN进行注册。
其中，在自动网络选择模式下，根据存储的forbidden onboarding SNPN IDs信息和支持onboarding的SNPN IDs信息，UE选择其他可用的onboarding网络进行注册。
在手动网络选择模式下：对于forbidden onboarding SNPN IDs，可以有以下几种处理方法：
不展示给用户，或者
展示给用户，或者
展示给用户时，可以指示该SNPN IDs为forbidden onboarding的SNPN  IDs。
图5是本申请实施例提供的鉴权失败的处理方法的一种流程示意图，该方法500可以由终端和网络侧设备执行。换言之，所述方法可以由安装在终端和网络侧设备上的软件或硬件来执行。其中，网络侧设备可以包括：AMF实体、AUSF实体及DCS实体。如图5所示，该方法可以包括以下步骤。
S510-S540、与方法400中的S S410-S440相同，在此不再赘述。
S550、在注册拒绝中发送cause value#3表示鉴权失败。
S560，当UE收到cause value#3，判断当前的注册类型是为了onboarding。
S570，存储该SNPN ID，该存储过程可以通过创建或者更新SNPN IDs列表的形式来实现，该列表用于存储forbidden onboarding SNPN IDs，而不是将该SNPN ID设为不可用。
在该实施例中，如果当前注册类型的目的是为了初始注册等(即注册请求不是为了onboarding)，则在一种实施方式中，将当前SNPN对应的entry of"list of subscriber data"设为不可用，即将终端的签约信息列表中与当前服务的SNPN对应的表项设为不可用，即将该SNPN ID设为不可用。
S580，与S470相同，在此不再赘述。
图6是本申请实施例提供的鉴权失败的处理方法的一种流程示意图，该方法600可以由终端和网络侧设备执行。换言之，所述方法可以由安装在终端和网络侧设备上的软件或硬件来执行。其中，网络侧设备可以包括：AMF实体、AUSF实体及DCS实体。如图6所示，该方法可以包括以下步骤。
S610-S640、与方法400中的S S410-S440相同，在此不再赘述。
S650、在注册拒绝中发送cause value#74或#75表示鉴权失败。
其中，如果UE当前尝试接入的onboarding SNPN有全球唯一的SNPN标识，如果鉴权失败，则AMF发送cause value#75给UE，否则，AMF发送cause value#74给UE。
S660，当UE收到cause value#74或75时，判断当前的注册类型是为了 onboarding。
S670，存储该SNPN ID，该存储过程可以通过创建或者更新SNPN IDs列表的形式来实现，该列表用于存储forbidden onboarding SNPN IDs，而不是将该SNPN ID设为不可用。
在该实施例中，如果当前注册类型的目的不是为了onboarding等(即注册请求不是为了onboarding)，则在一种实施方式中，将该SNPN ID存储到临时禁止SNPN网络(temporarily forbidden SNPNs)列表中。
S680，与S470相同，在此不再赘述。
需要说明的是，本申请实施例提供的鉴权失败的处理方法，执行主体可以为鉴权失败的处理装置，或者，该鉴权失败的处理装置中的用于执行鉴权失败的处理方法的控制模块。本申请实施例中以鉴权失败的处理装置执行鉴权失败的处理方法为例，说明本申请实施例提供的鉴权失败的处理装置。
图7为本申请实施例提供的鉴权失败的处理装置的一种结构示意图，如图3所示，该鉴权失败的处理装置主要包括：确定模块701和第一收发模块702。
在本申请实施例中，确定模块701，用于在对终端鉴权失败的情况下，根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的配置入网onboarding；第一收发模块702，用于向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
在一个可能的实现方式中，所述第一消息中携带有所述终端的注册类型和/或所述终端的鉴权参数。
在一个可能的实现方式中，所述确定模块701根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第一目标原因值，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败。
在一个可能的实现方式中，所述确定模块701根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第二目标原因值，其中，第二目标原因值用于指示终端的鉴权失败。
在一个可能的实现方式中，所述第一收发模块702，还用于在根据所述第一消息，确定向所述终端返回的鉴权失败原因值之前，接收所述终端发送的所述第一消息。
通过本申请实施例提供的鉴权失败的处理装置，确定模块701在对终端鉴权失败的情况下，根据指示当前网络是否被用于终端的onboarding的第一消息，确定向终端返回的鉴权失败原因值，第一收发模块702将该鉴权失败原因值发送给终端，从而使得作为onboarding的网络，在对终端鉴权失败以后，可以选择相应的原因值。
本申请实施例中的鉴权失败的处理装置可以是装置，也可以是网络侧设备中的部件、集成电路、或芯片。该装置可以是网络侧设备。示例性的，网络侧设备可以包括但不限于上述AMF实体，本申请实施例不作具体限定。
本申请实施例中的网络侧设备可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为ios操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的网络侧设备能够实现图2至图6的各个方法实施例中网络侧设备实现的各个过程，并达到相同的技术效果，为避免重复，这里不再赘述。
图8为本申请实施例提供的鉴权失败的处理装置的另一种结构示意图，如图8所示，该鉴权失败的处理装置可以包括：第二收发模块801和处理模块802。
在本申请实施例中，第二收发模块801，用于接收第二消息，其中，所述第二消息中携带的鉴权失败原因值；处理模块802，用于若确定所述鉴权 失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的SNPN为禁止被选作onboarding的网络。
在一个可能的实现方式中，所述处理模块802确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：若所述鉴权失败原因值为第一目标原因值，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败的原因值。
在一个可能的实现方式中，所述处理模块802确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：
若所述鉴权失败原因值为第二目标原因值，且确定当前注册的目的是为了onboarding，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第二目标原因值用于指示终端的鉴权失败。
在一个可能的实现方式中，所述处理模块802标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络，包括：将所述当前接入的SNPN的SNPN标识记录到目标列表中，其中，所述目标列表用于记录禁止被所述终端选作onboarding的网络的SNPN标识。
在一个可能的实现方式中，所述处理模块802还用于在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，在被设置为自动网络选择模式的情况下，禁止选择所述目标列表中记录的SNPN标识对应的SNPN网络作为onboarding的网络。
在一个可能的实现方式中，所述处理模块802还用于在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，在被设置为手动网络选择模式的情况下，响应输入的网络选择命令，执行以下之一的处理：
不显示所述目标列表中记录的SNPN标识；
显示所述目标列表中记录的SNPN标识；
显示所述目标列表中记录的SNPN标识，并标识所述目标列表中记录的SNPN标识为禁止被选作onboarding的SNPN网络的标识。
本申请实施例中的鉴权失败的处理装置可以是装置，也可以是终端中的部件、集成电路、或芯片。该装置可以是移动终端，也可以为非移动终端。示例性的，移动终端可以包括但不限于上述所列举的终端11的类型，非移动终端可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的鉴权失败的处理装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为ios操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的鉴权失败的处理装置能够实现图2至图6的方法实施例终端实现的各个过程，并达到相同的技术效果，为避免重复，这里不再赘述。
可选的，如图9所示，本申请实施例还提供一种通信设备900，包括处理器901，存储器902，存储在存储器902上并可在所述处理器901上运行的程序或指令，例如，该通信设备900为终端时，该程序或指令被处理器901执行时实现上述鉴权失败的处理装方法实施例的各个过程，且能达到相同的技术效果。该通信设备900为网络侧设备时，该程序或指令被处理器901执行时实现上述鉴权失败的处理装方法实施例中AMF或网络侧设备实现的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。该通信设备900为终端时，该程序或指令被处理器901执行时实现上述鉴权失败的处理装方法实施例中终端实现的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
图10为实现本申请实施例的一种终端的硬件结构示意图。
该终端1000包括但不限于：射频单元1001、网络模块1002、音频输出 单元1003、输入单元1004、传感器1005、显示单元1006、用户输入单元1007、接口单元1008、存储器1009、以及处理器1010等部件。
本领域技术人员可以理解，终端1000还可以包括给各个部件供电的电源(比如电池)，电源可以通过电源管理系统与处理器1010逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图10中示出的终端结构并不构成对终端的限定，终端可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
应理解的是，本申请实施例中，输入单元1004可以包括图形处理器(Graphics Processing Unit，GPU)10041和麦克风10042，图形处理器10041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元1006可包括显示面板10061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板10061。用户输入单元1007包括触控面板10071以及其他输入设备10072。触控面板10071，也称为触摸屏。触控面板10071可包括触摸检测装置和触摸控制器两个部分。其他输入设备10072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。
本申请实施例中，射频单元1001将来自网络侧设备的下行数据接收后，给处理器1010处理；另外，将上行的数据发送给网络侧设备。通常，射频单元1001包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器、双工器等。
存储器1009可用于存储软件程序或指令以及各种数据。存储器1009可主要包括存储程序或指令区和存储数据区，其中，存储程序或指令区可存储操作系统、至少一个功能所需的应用程序或指令(比如声音播放功能、图像播放功能等)等。此外，存储器1009可以包括高速随机存取存储器，还可以包括非易失性存储器，其中，非易失性存储器可以是只读存储器(Read-OnlyMemory，ROM)、可编程只读存储器(ProgrammableROM，PROM)、 可擦除可编程只读存储器(ErasablePROM，EPROM)、电可擦除可编程只读存储器(ElectricallyEPROM，EEPROM)或闪存。例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。
处理器1010可包括一个或多个处理单元；可选的，处理器1010可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序或指令等，调制解调处理器主要处理无线通信，如基带处理器。可以理解的是，上述调制解调处理器也可以不集成到处理器1010中。
其中，射频单元1001，用于接收第二消息，其中，所述第二消息中携带的鉴权失败原因值。
处理器1010，用于若确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
通过本申请实施例提供的鉴权失败的处理方法，终端在接收到携带鉴权失败原因值的第二消息时，如果确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的SNPN为禁止被选作onboarding的网络，从而使得终端在后续过程中，在进行onboarding时，可以不再选择所述当前接入的SNPN作为onboarding网络，提高onboarding的成功率。
通过本申请实施例提供的鉴权失败的处理方法，终端在接收到携带鉴权失败原因值的第二消息时，如果确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的SNPN为禁止被选作onboarding的网络，从而使得终端在后续过程中，在进行onboarding时，可以不再选择所述当前接入的SNPN作为onboarding网络，提高onboarding的成功率。
具体地，本申请实施例还提供了一种网络侧设备。如图11所示，该网络设备1100包括：天线1101、射频装置1102、基带装置1103。天线1101与射 频装置1102连接。在上行方向上，射频装置1102通过天线1101接收信息，将接收的信息发送给基带装置1103进行处理。在下行方向上，基带装置1103对要发送的信息进行处理，并发送给射频装置1102，射频装置1102对收到的信息进行处理后经过天线1101发送出去。
上述频带处理装置可以位于基带装置1103中，以上实施例中网络侧设备执行的方法可以在基带装置1103中实现，该基带装置1103包括处理器1104和存储器1105。
基带装置1103例如可以包括至少一个基带板，该基带板上设置有多个芯片，如图11所示，其中一个芯片例如为处理器1104，与存储器1105连接，以调用存储器1105中的程序，执行以上方法实施例中所示的网络设备操作。
该基带装置1103还可以包括网络接口1106，用于与射频装置1102交互信息，该接口例如为通用公共无线接口(common public radio interface，简称CPRI)。
具体地，本发明实施例的网络侧设备还包括：存储在存储器1105上并可在处理器1104上运行的指令或程序，处理器1104调用存储器1105中的指令或程序执行图7所示各模块执行的方法，并达到相同的技术效果，为避免重复，故不在此赘述。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述鉴权失败的处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器可以为上述实施例中所述的终端中的处理器，或者上述实施例中所述的网络侧设备中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行网络侧设备或终端的程 序或指令，实现上述鉴权失败的处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本申请实施例还提供了一种计算机程序产品，该计算机程序产品包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现上述鉴权失败的处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片，系统芯片，芯片系统或片上系统芯片等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (28)

  1. 一种鉴权失败的处理方法，包括：
    在对终端鉴权失败的情况下，接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的配置入网onboarding；
    向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
  2. 根据权利要求1所述的方法，其中，所述第一消息中携带有所述终端的注册类型和/或所述终端的鉴权参数。
  3. 根据权利要求1所述的方法，其中，接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：
    若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第一目标原因值，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败。
  4. 根据权利要求1所述的方法，其中，接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：
    若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第二目标原因值，其中，第二目标原因值用于指示终端的鉴权失败。
  5. 根据权利要求4所述的方法，其中，所述第二目标原因值包括以下任一项：3、74、75。
  6. 根据权利要求1至5任一项所述的方法，其中，在接入和移动管理功能实体根据第一消息，确定向所述终端返回的鉴权失败原因值之前，所述方法还包括：
    接收所述终端发送的所述第一消息。
  7. 根据权利要求6所述的方法，其中，所述第一消息包括：注册请 求消息。
  8. 一种鉴权失败的处理方法，包括：
    终端接收第二消息，其中，所述第二消息中携带的鉴权失败原因值；
    若确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
  9. 根据权利要求8所述的方法，其中，确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：
    若所述鉴权失败原因值为第一目标原因值，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败的原因值。
  10. 根据权利要求8所述的方法，其中，确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：
    若所述鉴权失败原因值为第二目标原因值，且确定当前注册的目的是为了onboarding，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第二目标原因值用于指示终端的鉴权失败。
  11. 根据权利要求10所述的方法，其中，所述第二目标原因值包括以下任一项：3、74、75。
  12. 根据权利要求8至11任一项所述的方法，其中，标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络，包括：
    将所述当前接入的SNPN的SNPN标识记录到目标列表中，其中，所述目标列表用于记录禁止被所述终端选作onboarding的网络的SNPN标识。
  13. 根据权利要求12所述的方法，其中，在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，所述方法还包括：
    在被设置为自动网络选择模式的情况下，所述终端禁止选择所述目标 列表中记录的SNPN标识对应的SNPN网络作为onboarding的网络。
  14. 根据权利要求12所述的方法，其中，在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，所述方法还包括：
    在被设置为手动网络选择模式的情况下，响应输入的网络选择命令，执行以下之一的处理：
    不显示所述目标列表中记录的SNPN标识；
    显示所述目标列表中记录的SNPN标识；
    显示所述目标列表中记录的SNPN标识，并标识所述目标列表中记录的SNPN标识为禁止被选作onboarding的SNPN网络的标识。
  15. 一种鉴权失败的处理装置，包括：
    确定模块，用于在对终端鉴权失败的情况下，根据第一消息，确定向所述终端返回的鉴权失败原因值，其中，所述第一消息指示当前网络是否被用于所述终端的onboarding；
    第一收发模块，用于向所述终端发送第二消息，其中，所述第二消息中携带有所述鉴权失败原因值。
  16. 根据权利要求15所述的装置，其中，所述第一消息中携带有所述终端的注册类型和/或所述终端的鉴权参数。
  17. 根据权利要求15所述的装置，其中，所述确定模块根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：
    若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第一目标原因值，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败。
  18. 根据权利要求15所述的装置，其中，所述确定模块根据第一消息，确定向所述终端返回的鉴权失败原因值，包括：
    若所述第一消息指示当前网络被用于所述终端的onboarding，则确定所述鉴权失败原因值为第二目标原因值，其中，第二目标原因值用于指示 终端的鉴权失败。
  19. 根据权利要求15至18任一项所述的装置，其中，所述第一收发模块，还用于在根据所述第一消息，确定向所述终端返回的鉴权失败原因值之前，接收所述终端发送的所述第一消息。
  20. 一种鉴权失败的处理装置，包括：
    第二收发模块，用于接收第二消息，其中，所述第二消息中携带的鉴权失败原因值；
    处理模块，用于若确定所述鉴权失败原因值指示的鉴权失败为终端的onboarding过程的鉴权失败，则标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络。
  21. 根据权利要求20所述的装置，其中，所述处理模块确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：
    若所述鉴权失败原因值为第一目标原因值，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第一目标原因值用于指示终端的onboarding过程中的鉴权失败的原因值。
  22. 根据权利要求20所述的装置，其中，所述处理模块确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，包括：
    若所述鉴权失败原因值为第二目标原因值，且确定当前注册的目的是为了onboarding，则确定所述鉴权失败原因值指示的鉴权失败为所述终端的onboarding过程的鉴权失败，其中，所述第二目标原因值用于指示终端的鉴权失败。
  23. 根据权利要求20至22任一项所述的装置，其中，所述处理模块标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络，包括：
    将所述当前接入的SNPN的SNPN标识记录到目标列表中，其中，所述目标列表用于记录禁止被所述终端选作onboarding的网络的SNPN标识。
  24. 根据权利要求23所述的装置，其中，所述处理模块还用于在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，在被设置为自动网络选择模式的情况下，禁止选择所述目标列表中记录的SNPN标识对应的SNPN网络作为onboarding的网络。
  25. 根据权利要求23所述的装置，其中，所述处理模块还用于在标记当前接入的独立非公共网络SNPN为禁止被选作onboarding的网络之后，在被设置为手动网络选择模式的情况下，响应输入的网络选择命令，执行以下之一的处理：
    不显示所述目标列表中记录的SNPN标识；
    显示所述目标列表中记录的SNPN标识；
    显示所述目标列表中记录的SNPN标识，并标识所述目标列表中记录的SNPN标识为禁止被选作onboarding的SNPN网络的标识。
  26. 一种网络侧设备，包括处理器，存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1至7任一项所述的鉴权失败的处理方法的步骤。
  27. 一种终端，包括处理器，存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求8至14任一项所述的鉴权失败的处理方法的步骤。
  28. 一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1至7任一项所述的鉴权失败的处理方法，或者实现如权利要求8至14任一项所述的鉴权失败的处理方法的步骤。
PCT/CN2021/113280 2020-08-21 2021-08-18 鉴权失败的处理方法、装置、终端及网络侧设备 WO2022037619A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010847188.9A CN114173336A (zh) 2020-08-21 2020-08-21 鉴权失败的处理方法、装置、终端及网络侧设备
CN202010847188.9 2020-08-21

Publications (1)

Publication Number Publication Date
WO2022037619A1 true WO2022037619A1 (zh) 2022-02-24

Family

ID=80322559

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/113280 WO2022037619A1 (zh) 2020-08-21 2021-08-18 鉴权失败的处理方法、装置、终端及网络侧设备

Country Status (2)

Country Link
CN (1) CN114173336A (zh)
WO (1) WO2022037619A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180183765A1 (en) * 2015-07-07 2018-06-28 Aducid S.R.O. Method of securing authentication in electronic communication
CN110225045A (zh) * 2019-06-18 2019-09-10 平安科技（深圳）有限公司 全链路数据鉴权方法、装置、设备及存储介质
CN111031538A (zh) * 2018-10-09 2020-04-17 华为技术有限公司 一种鉴权的方法及装置
CN111031571A (zh) * 2018-10-09 2020-04-17 华为技术有限公司 一种网络切片接入控制的方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10360362B2 (en) * 2014-04-30 2019-07-23 Qualcomm Incorporated Apparatuses and methods for fast onboarding an internet-enabled device
CN111464306B (zh) * 2019-01-18 2022-12-02 中兴通讯股份有限公司 认证处理方法、装置、存储介质及电子装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180183765A1 (en) * 2015-07-07 2018-06-28 Aducid S.R.O. Method of securing authentication in electronic communication
CN111031538A (zh) * 2018-10-09 2020-04-17 华为技术有限公司 一种鉴权的方法及装置
CN111031571A (zh) * 2018-10-09 2020-04-17 华为技术有限公司 一种网络切片接入控制的方法及装置
CN110225045A (zh) * 2019-06-18 2019-09-10 平安科技（深圳）有限公司 全链路数据鉴权方法、装置、设备及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Submission for information on Commonalities in solutions for Non-Public Network developments", 3GPP TSG-RAN WG2 #106 TDOC R2-1907313, 17 May 2019 (2019-05-17), XP051711598 *

Also Published As

Publication number Publication date
CN114173336A (zh) 2022-03-11

Similar Documents

Publication Publication Date Title
US11310239B2 (en) Network connection method, hotspot terminal and management terminal
EP3151628B1 (en) Method, device and system for accessing a wireless network
WO2022089565A1 (zh) 辅小区组信息的配置、获取方法及通信设备
EP3648488B1 (en) Methods, devices, system and computer-readable storage medium for acquiring identifier of terminal device
WO2022166743A1 (zh) 连接建立方法、装置和用户设备
US20160316368A1 (en) Method, apparatus, and system for selecting authentication algorithm
WO2022095850A1 (zh) 策略关联的建立方法及装置、终端及网络侧设备
WO2016165674A1 (zh) 一种终端可信环境运行方法及装置
WO2022037619A1 (zh) 鉴权失败的处理方法、装置、终端及网络侧设备
WO2022068813A1 (zh) 拥塞控制方法、装置、终端及网络侧设备
WO2022068903A1 (zh) 网络选择方法、信息发送方法、信息获取方法及装置
WO2022127769A1 (zh) 中继通信方法及装置
EP3318077B1 (en) Circumventing wireless device spatial tracking based on wireless device identifiers
WO2016112706A1 (zh) 一种热点接入方法、装置及终端
CN114173337A (zh) 电子设备及其执行的方法以及计算机可读介质
CN114302492A (zh) 切片请求方法、终端及网络侧设备
WO2023138525A1 (zh) 网络选择接入信息的传输方法、获取方法、装置及相关设备
WO2023179571A1 (zh) 非公共网络接入方法、装置及终端
WO2022214064A1 (zh) 接入网络的方法、网络侧设备及终端
WO2022257878A1 (zh) 密钥材料的发送方法、获取方法、信息传输方法及设备
WO2022218224A1 (zh) 信息处理方法、装置、终端及网络侧设备
WO2023005898A1 (zh) 多终端联合会话管理方法、网络侧设备及终端
WO2022007927A1 (zh) 获取紧急服务的控制方法及装置、终端及可读存储介质
WO2022095849A1 (zh) 连接态建立方法、终端、核心网功能及接入网设备
EP4319230A1 (en) Key material processing method, acquisition method, information transmission method, and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21857711

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21857711

Country of ref document: EP

Kind code of ref document: A1