WO2022062889A1 - 一种切片管理方法、装置及通信设备 - Google Patents

一种切片管理方法、装置及通信设备 Download PDF

Info

Publication number
WO2022062889A1
WO2022062889A1 PCT/CN2021/116792 CN2021116792W WO2022062889A1 WO 2022062889 A1 WO2022062889 A1 WO 2022062889A1 CN 2021116792 W CN2021116792 W CN 2021116792W WO 2022062889 A1 WO2022062889 A1 WO 2022062889A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice
nssai
authentication
network element
terminal device
Prior art date
Application number
PCT/CN2021/116792
Other languages
English (en)
French (fr)
Inventor
张艳平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022062889A1 publication Critical patent/WO2022062889A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a slice management method, apparatus, and communication device.
  • third-party services can be issued to users for customized terminal equipment of operators, and various types of slices can be rented from operators.
  • Different types of slices provide users with different business experiences.
  • These terminal devices can obtain the network connection service provided by the operator by signing a contract with the operator, but the subscription of which slice the user uses is not managed and controlled by the operator network, but is managed and controlled by a third party, that is, the user accesses the mobile network.
  • the third party authorizes the user to determine which slice to use. If the user wants to change the slice subscription at a later time, for example, to obtain higher service quality, he can purchase it from the third party, and then the third party interacts with the operator's mobile network. , to update the slice used by the user.
  • a third party submits the slice signed by the user to the operator , and then the operator's staff updates the UDM maintained by the operator, so as to realize the update management of the user's slice subscription data.
  • Embodiments of the present application provide a slice management method, an apparatus, and a communication device, which are used to improve slice management efficiency and enhance a third party's slice control capability on a terminal device.
  • a first aspect provides a method for managing slices.
  • a mobility management network element can receive a first S-NSSAI from a third-party application server, where the first S-NSSAI is used to identify The third-party application server is the slice authorized by the terminal device, and then sends the first S-NSSAI to the terminal device.
  • slices directly authorized by the third party can be directly allocated to the terminal device through the third-party application server, that is, the user's subscription data can be directly stored in the third-party application server.
  • the slices that the user really authorizes in the third party are directly obtained from the third-party application server, instead of being obtained from the UDM maintained by the operator, which can reduce the steps of updating from the third party to the operator.
  • Slices are managed, which improves the efficiency of slice management and enhances the third-party's ability to control the slice service of terminal devices.
  • the third-party application server is the authentication network element
  • the mobility management network element initiates a slice authentication request, where the slice authentication request includes the second S-NSSAI and the terminal identifier of the terminal device, the second S-NSSAI
  • the NSSAI is used to identify the slice subscribed for the terminal device in the data management network element; correspondingly, the mobility management network element receives the authentication result indication information and the first S-NSSAI from the authentication network element.
  • the slice subscribed for the terminal device in the data management network element (such as UDM) is not the same as the slice actually authorized by the third party for the terminal device, it is possible to obtain the subscribed slice from the UDM (that is, the slice identified by the second S-NSSAI). Slice) for verification, and finally returns the S-NSSAI (ie the first S-NSSAI) that the third-party application server actually authorizes for the terminal device, so that the slice can be directly managed by the third-party application server.
  • the mobility management network element receives slice selection indication information from the terminal device or the data management network element, where the slice selection indication information is used to instruct a third-party application to determine a slice for the terminal device.
  • the slice selection indication information can be used to instruct the mobility management network element which terminal device slices need to be directly determined by the third-party application, which is convenient for the mobility management network element to clarify which terminal device slices need to be obtained from the third-party application. fetch, which improves the accuracy of slice assignment.
  • a method for slice management receives a slice request from a mobility management network element, where the slice request includes a terminal identifier of a terminal device; and then determines the first slice according to the terminal identifier.
  • slices directly authorized by the third party can be directly allocated to the terminal device through the third-party application server, that is, the user's subscription data can be directly stored in the third-party application server.
  • the slices that the user really authorizes in the third party are directly obtained from the third-party application server, instead of being obtained from the UDM maintained by the operator, which can reduce the steps of updating from the third party to the operator.
  • Slices are managed, which improves the efficiency of slice management and enhances the third-party's ability to control the slice service of terminal devices.
  • the third-party application server is an authentication network element
  • the authentication network element receives a slice authentication request from the mobility management network element, where the slice authentication request includes the second S-NSSAI and the terminal identifier of the terminal device,
  • the second S-NSSAI is used to identify the slice subscribed for the terminal device in the data management network element; further, the authentication network element sends the authentication result indication information and the first S-NSSAI to the mobility management network element.
  • the mobility management network element can authenticate the second S-NSSAI subscribed in the UDM, and finally receive the first S-NSSAI sent from the third-party application server that is actually authorized by the third-party application server.
  • the local application server can directly manage the slice, which enhances the third party's ability to control the slice service of the terminal device.
  • the authentication result indication information is used to indicate that the authentication is successful.
  • the second S-NSSAI is the same as the first S-NSSAI, or the second S-NSSAI is different from the first S-NSSAI.
  • a third aspect provides a slice management method, in which an authentication network element receives a slice authentication request sent from a mobility management network element, where the slice authentication request includes an EAP identification response message of a terminal device and a first S-NSSAI , the first S-NSSAI is used to identify one of the at least two slices subscribed for the terminal device in the data management network element;
  • the authentication result indication information is generated, and the authentication result indication information includes the EAP success message. Or the EAP failure message; further, send authentication result indication information to the mobility management network element.
  • a fourth aspect provides a slice management method, in which a mobility management network element initiates a slice authentication request, where the slice authentication request includes an EAP identification response message of a terminal device and a first S-NSSAI, the first S-NSSAI uses In order to identify one of the at least two slices subscribed for the terminal device in the data management network element; the mobility management network element then receives the authentication result indication information from the authentication network element, and the authentication result indication information is the authentication network element according to the EAP identification information. Whether the response message passes the authentication and whether the slice identified by the first S-NSSAI is a slice that the third-party application server allows the terminal device to access is generated by the judgment result.
  • the AMF can determine whether the slice of the S-NSSAI identifier to be verified is actually a slice that the third-party application server actually allows the terminal device to access , so that the third party participates in the authentication of the slice by means of double verification, and the authentication result obtained in this way takes into account the actual authorization of the slice to be verified by the third party, and realizes the direct management and control of the slice by the third party.
  • a slice management method in which the third-party application server determines that the slice that the terminal device is allowed to access is changed from the first slice to the second slice;
  • the element sends slice update information, where the slice update information includes the second S-NSSAI, and the second S-NSSAI is used to identify the second slice.
  • the third-party application server can directly initiate the slice update process for the terminal device, that is to say, the third-party application server can directly update and control the slice without interacting with the UDM maintained by the operator.
  • Slice update improves the efficiency of slice update, enhances the third-party's ability to control slice services, improves the experience of third-party and operator business cooperation, and helps operators expand services.
  • a sixth aspect provides a slice management method, in which a mobility management network element receives slice update information from a third-party application server, where the slice update information includes a second S-NSSAI, and the second S-NSSAI uses for identifying the second slice; further, the mobility management network element sends the second S-NSSAI to the terminal device.
  • the third-party application server is an authentication network element, and the mobility management network element may also initiate a process of authenticating the second S-NSSAI;
  • the terminal device sends configuration update information, where the configuration update information is used to update the slices that the terminal device is allowed to access.
  • the updated slice (that is, the slice identified by the second S-NSSAI) can also be authenticated, which can improve the security and effectiveness of the terminal device accessing the slice.
  • the slice update information is a slice re-authentication message, for example, a re-authentication message in the process of slice re-authentication in the related art.
  • the re-authentication process in the related art can be reused to realize the authentication of the second S-NSSAI. Because the re-authentication process in the related art is to re-authenticate the S-NSSAI that has been authenticated before, in the embodiment of the present application, the re-authentication process of the related technology can be reused to realize the S-NSSAI that has not been authenticated before. For authentication, a new slice update and slice authentication method is provided, which improves the flexibility of slice management.
  • the slice update information further includes a first S-NSSAI for identifying the first slice, and the first slice is not currently allowed to access the terminal device.
  • the terminal device can also be notified of the expired slice, so that when the expired slice has an impact on the access-allowed slice of the terminal device, it is convenient for the terminal device to accurately update the access-allowed slice, so as to realize the Accurate update of slices to improve the effectiveness of slice updates.
  • a slice management apparatus may be a mobility management network element, or a chip arranged inside the mobility management network element, and the slice management apparatus includes a device for performing the first aspect or the first aspect.
  • a slice management device may be an authentication network element or a third-party application server, or a chip set in the authentication network element or a third-party application server, and the slice management device includes an authentication network element or a third-party application server.
  • a ninth aspect provides a slice management device, the slice management device may be an authentication network element or a third-party application server, or a chip set in the authentication network element or a third-party application server, and the slice management device includes an authentication network element or a third-party application server.
  • a slice management apparatus may be a mobility management network element, or a chip arranged inside the mobility management network element. Modules of the method described in any possible implementation manner of the four aspects.
  • a slice management apparatus may be an authentication network element or a third-party application server, or a chip set in the authentication network element or the third-party application server, and the slice management apparatus includes: A module for performing the method described in the fifth aspect or any possible implementation manner of the fifth aspect.
  • a twelfth aspect provides a slice management apparatus, where the slice management apparatus may be a mobility management network element, or a chip disposed inside the mobility management network element, and the slice management apparatus includes a device for executing the sixth aspect or Modules of the method described in any possible implementation manner of the sixth aspect.
  • a thirteenth aspect provides a communication device, comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor The method as described in the first aspect or any possible implementation manner of the first aspect is performed through the communication interface.
  • a fourteenth aspect provides a communication device, comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor The method as described in the second aspect or any possible implementation manner of the second aspect is performed through the communication interface.
  • a fifteenth aspect provides a communication device, comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor The method as described in the third aspect or any possible implementation manner of the third aspect is performed through the communication interface.
  • a sixteenth aspect provides a communication device, comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor The method as described in the fourth aspect or any possible implementation manner of the fourth aspect is performed through the communication interface.
  • a seventeenth aspect provides a communication device, comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor The method as described in the fifth aspect or any possible implementation manner of the fifth aspect is performed through the communication interface.
  • a communication device comprising: at least one processor; and a communication interface communicatively connected to the at least one processor; the at least one processor causes the communication apparatus to execute instructions stored in a memory by the at least one processor
  • the method as described in the sixth aspect or any possible implementation manner of the sixth aspect is performed through the communication interface.
  • a nineteenth aspect provides a computer-readable storage medium, comprising a program or an instruction, when the program or instruction is run on a computer, the first aspect or any possible implementation manner of the first aspect is as described in the first aspect. method is executed.
  • a computer-readable storage medium comprising a program or an instruction, which, when the program or instruction is run on a computer, makes the second aspect or any possible implementation of the second aspect as described in the second aspect method is executed.
  • a twenty-first aspect provides a computer-readable storage medium, comprising a program or an instruction, which, when the program or instruction is executed on a computer, makes the third aspect or any possible implementation of the third aspect as described in the third aspect. The described method is executed.
  • a twenty-second aspect provides a computer-readable storage medium, comprising a program or an instruction, when the program or instruction is run on a computer, the fourth aspect or any of the possible implementations of the fourth aspect is provided. The described method is executed.
  • a twenty-third aspect provides a computer-readable storage medium, comprising a program or an instruction, which, when the program or instruction is executed on a computer, causes the fifth aspect or any of the possible implementations of the fifth aspect to be implemented. The described method is executed.
  • a twenty-fourth aspect provides a computer-readable storage medium, comprising a program or an instruction, which, when the program or instruction is run on a computer, makes the sixth aspect or any of the possible implementations of the sixth aspect possible. The described method is executed.
  • a twenty-fifth aspect provides a chip, which is coupled to a memory and configured to read and execute program instructions stored in the memory, so that the first aspect or any of the possible implementations of the first aspect is The described method is executed.
  • a twenty-sixth aspect provides a chip, which is coupled to a memory and configured to read and execute program instructions stored in the memory, so that the second aspect or any of the possible implementations of the second aspect is The described method is executed.
  • a twenty-seventh aspect provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the third aspect or any of the possible implementations of the third aspect is The described method is executed.
  • a twenty-eighth aspect provides a chip, which is coupled to a memory for reading and executing program instructions stored in the memory, so that the fourth aspect or any of the possible implementations of the fourth aspect is The described method is executed.
  • a twenty-ninth aspect provides a chip, which is coupled to a memory for reading and executing program instructions stored in the memory, so that the fifth aspect or any of the possible implementations of the fifth aspect is The described method is executed.
  • a thirtieth aspect provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the sixth aspect or any of the possible implementations of the sixth aspect method is executed.
  • a thirty-first aspect provides a computer program product comprising instructions, which when run on a computer, cause the method described in the first aspect or any of the possible implementations of the first aspect to be performed.
  • a thirty-second aspect provides a computer program product comprising instructions, which when run on a computer, cause the method described in the second aspect or any of the possible implementations of the second aspect to be performed.
  • a thirty-third aspect provides a computer program product comprising instructions that, when run on a computer, cause the method described in the third aspect or any of the possible implementations of the third aspect to be performed.
  • a computer program product comprising instructions which, when run on a computer, cause the method described in the fourth aspect or any of the possible implementations of the fourth aspect to be performed.
  • a thirty-fifth aspect provides a computer program product comprising instructions, which when run on a computer, cause the method described in the fifth aspect or any of the possible implementations of the fifth aspect to be performed.
  • a computer program product comprising instructions, which, when executed on a computer, cause the method described in the sixth aspect or any of the possible implementations of the sixth aspect to be performed.
  • Figure 1 is a schematic diagram of a 5G network architecture based on a service-oriented architecture
  • Figure 2 is a schematic diagram of a 5G network architecture based on a point-to-point interface
  • Fig. 3 is a kind of schematic diagram of network slice
  • FIG. 4 is a schematic diagram of a registration process of a terminal device
  • 5 is a schematic diagram of determining whether to perform an NSSAA process
  • FIG. 8 is an interactive flowchart of the slice management method in the embodiment of the present application.
  • FIG. 9 is another interactive flowchart of the slice management method in the embodiment of the present application.
  • FIG. 10 is another interactive flowchart of the slice management method in the embodiment of the present application.
  • FIG. 11 is another interactive flowchart of the slice management method in the embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a slice management apparatus in an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of another slice management apparatus in an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of another slice management apparatus in an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of another slice management apparatus in an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of another slice management apparatus in an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of another slice management apparatus in an embodiment of the present application.
  • 19 is a schematic structural diagram of a communication device in an embodiment of the application.
  • FIG. 20 is a schematic structural diagram of another communication device in an embodiment of the present application.
  • Terminal devices including devices that provide voice and/or data connectivity to users, may include, for example, handheld devices with wireless connectivity, or processing devices connected to wireless modems.
  • the terminal equipment may communicate with the core network via a radio access network (RAN), and exchange voice and/or data with the RAN.
  • RAN radio access network
  • the terminal equipment may include user equipment (UE), terminal, wireless terminal equipment, mobile terminal equipment, device-to-device (D2D) terminal equipment, vehicle-to-everything (vehicle-to-everything, V2X) terminal equipment, machine-to-machine/machine-type communications (M2M/MTC) terminal equipment, Internet of things (IoT) terminal equipment, subscriber unit (subscriber unit), Subscriber station (subscriber station), mobile station (mobile station), remote station (remote station), access point (access point, AP), remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent, or user device, etc.
  • IoT Internet of things
  • these may include mobile telephones (or "cellular" telephones), computers with mobile terminal equipment, portable, pocket-sized, hand-held, computer-embedded mobile devices, and the like.
  • mobile telephones or "cellular" telephones
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • constrained devices such as devices with lower power consumption, or devices with limited storage capacity, or devices with limited computing power, etc.
  • it includes information sensing devices such as barcodes, radio frequency identification (RFID), sensors, global positioning system (GPS), and laser scanners.
  • RFID radio frequency identification
  • GPS global positioning system
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices, etc. It is a general term for the application of wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes. Wait.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable device is not only a hardware device, but also realizes powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-scale, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, which needs to cooperate with other devices such as smart phones.
  • Use such as all kinds of smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the various terminal devices described above if they are located on the vehicle (for example, placed in the vehicle or installed in the vehicle), can be considered as on-board terminal equipment.
  • the on-board terminal equipment is also called on-board unit (OBU). ).
  • network slice and “slice” are the same concept, referring to the same content, and one of them is used in different places, and the two are interchangeable.
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, sequence, priority or priority of multiple objects. Importance.
  • the first information and the second information are only for distinguishing different signaling, and do not indicate the difference in content, priority, transmission order, or importance of the two kinds of information.
  • FIG. 1 is a schematic diagram of a fifth generation (5th generation, 5G) network architecture based on a server architecture, which is also a schematic diagram of an application scenario of an embodiment of the present application.
  • the 5G network architecture shown in Figure 1 may include three parts, namely the terminal equipment part, the data network (DN) part and the operator network part.
  • the operator network part may include one or more of the following network elements: an authentication server function (AUSF) network element, a network exposure function (NEF) network element, a policy control function (policy control function) control function, PCF) network element, unified data management (unified data management, UDM) network element, unified database (Unified Data Repository, UDR) network element, NRF network element, application function (application function, AF) network element, AMF network element elements, SMF network elements, radio access network (RAN) network elements, and user plane function (UPF) network elements, etc.
  • AUSF authentication server function
  • NEF network exposure function
  • policy control function policy control function
  • PCF policy control function
  • UDM unified data management
  • UDR Unified Data Repository
  • Nnssf network slice selection function
  • NRF network exposure function
  • PCF policy control function
  • UDM unified data management
  • AF application function
  • AUSF authentication server function
  • AMF authentication server function
  • SMF SMF network element
  • Nnef is the service interface of NEF
  • Npcf is the service interface of PCF
  • Nudm is the service interface of UDM
  • Uudr is the service interface of UDR
  • Naf is the service interface of AF
  • Nausf is the service interface of AUSF
  • Namf is the service interface of AMF
  • Nsmf is the service interface of SMF.
  • AMF and terminal equipment can communicate through N1 interface
  • AMF and RAN can communicate through N2 interface
  • SMF and UPF can communicate through N4 interface
  • RAN and UPF can communicate through N3 interface
  • UPF It can communicate with DN through the N6 interface.
  • the mobility management function network element is, for example, a mobility management entity (mobility management entity, MME) network element in the 4th generation (4th generation, 4G) system, and is, for example, an AMF network element in a 5G system, of course, the embodiment of the present application It is not limited to this, and can also be implemented by other network elements in other communication systems, for example, in future communication systems, it may be a network element having the function of the above-mentioned AMF network element.
  • MME mobility management entity
  • the AMF network element is mainly responsible for interfacing with the radio, terminating the RAN control plane (CP) interface, that is, the N2 interface, and terminating the non-access stratum (non-access- stratum, NAS) and NAS encryption and integrity protection, registration management, connection management, reachability management, mobility management, transfer of session management (session management, SM) messages between user equipment (UE) and SMF, or UE's mobility notification and other functions.
  • CP RAN control plane
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • NAS non-access- stratum
  • the storage function network element in the 5G system, is, for example, an NRF network element, and can also be implemented by other network elements in other communication systems. For example, in future communication systems, it may be a network element with the functions of the above NRF network element.
  • the NRF network element can be responsible for the registration and discovery functions of the network element, and maintain the information of the network element, for example, maintain the instance ID, type, public land mobile network (public land mobile network) of the network element.
  • land mobile network, PLMN public land mobile network
  • network slice-related identifiers IP addresses
  • capabilities of the network element and supported services.
  • the authentication and authorization function network elements NSSAAF related to network slicing, NSSAAF interacts with AAA-S, which is not shown in FIG. 1 .
  • the authentication, authorization, and accounting function network elements such as authentication, authorization, and accounting servers (authentication, authorization, accounting-service, AAA-S) in the 5G system, can also be implemented by other network elements in other communication systems, such as in The future communication system may be a network element having the above-mentioned AAA-S function.
  • AAA-S as an example of the authentication, authorization, and accounting function network element.
  • the main purpose of AAA-S is to manage which users can access the network server, which services can users with access rights obtain, and how to perform operations on users who are using network resources. billing processing, etc.
  • the AAA-S is not shown in Figure 1, where the AAA-S can communicate directly with the NSSAAF, or the AAA-S can communicate with the NSSAAF through an AAA-proxy (proxy-P).
  • AAA-S can be deployed by the operator or by a third party. In the roaming scenario, the AAA-S is located in the home PLMN (home PLMN, HPLMN).
  • NSSF network element responsible for determining network slice instances, selecting AMF network elements, etc.
  • the SMF network element can provide session management functions such as session establishment, modification or release, including the tunnel maintenance function between the UPF network element and the access network (AN) node, and the UE's Internet Protocol (IP) address allocation.
  • session management functions such as session establishment, modification or release, including the tunnel maintenance function between the UPF network element and the access network (AN) node, and the UE's Internet Protocol (IP) address allocation.
  • IP Internet Protocol
  • DHCP dynamic host control protocol
  • UP user plane
  • configuration of UPF routing functions configuration of UPF routing functions
  • termination policy control function interfaces billing, roaming functions, or policy control and other functions.
  • PCF network element including policy control decision-making and flow-based charging control functions, including user subscription data management function, policy control function, charging policy control function, quality of service (quality of service, QoS) control, etc.;
  • the UDM network element is responsible for managing the subscription data, and is responsible for notifying the corresponding network element when the subscription data is modified.
  • the UDR network element stores and retrieves subscription data, policy data and public architecture data, etc., for the UDM network element, PCF network element or NEF network element to obtain related data.
  • the UDR network element should be able to have different data access authentication mechanisms for different types of data, such as subscription data and policy data, to ensure the security of data access.
  • the UDR network element should be able to return a failure response with an appropriate cause value to an illegal service operation or data access request.
  • the AF network element the application server, provides a certain application layer service to the terminal device.
  • an AF network element provides a service to a terminal device, it has certain requirements on a QoS policy (policy) and a charging (charging) policy, and needs to notify the network.
  • policy QoS policy
  • charging charging
  • the NEF network element mainly supports the function of opening network capabilities and exposes network capabilities and services to the outside world.
  • 3GPP NFs publish functions and events to other NFs through NEF network elements.
  • the capabilities and events opened by NEF network elements can be safely opened to third-party applications.
  • NEF network elements use UDR's standardized interface (Nudr) to store/retrieve structured data.
  • Nudr UDR's standardized interface
  • DNN data network name
  • S-NSSAI S-NSSAI
  • the AUSF network element is responsible for the authentication function and for executing the network slice authentication and authorization process.
  • the UPF network element is the entity that forwards data on the user plane.
  • PDU protocol data unit
  • the abbreviations are used for each network element in the following text, and the word "network element" is omitted.
  • AMF AMF
  • NRF NRF
  • RAN access network element
  • SMF SMF
  • the network elements of the control plane can interact through a service-based method, and the network elements of the user plane Between elements, the interaction can be based on a point-to-point method.
  • the NRF can open some service methods, and other devices can interact with the NRF through these service methods.
  • FIG. 2 is a schematic diagram of a 5G network architecture based on a point-to-point interface, which is also a schematic diagram of another application scenario of the embodiment of the present application.
  • FIG. 1 is a schematic diagram of a 5G network architecture based on a point-to-point interface
  • FIG. 1 is also a schematic diagram of another application scenario of the embodiment of the present application.
  • 5G network slicing technology provides mutually isolated network environments for different application scenarios by virtualizing independent logical networks on the same network infrastructure, so that different application scenarios can customize network functions and Features, can effectively guarantee the QoS requirements of different services.
  • FIG. 3 it is a schematic diagram of network slicing.
  • FIG. 3 includes three network slices, namely critical (machine type of communication, MTC) slices, massive (massive) MTC slices, and mobile broadband (mobile broadband, MBB) slices.
  • MTC machine type of communication
  • MBB mobile broadband
  • the terminal equipment corresponding to the critical MTC slice may include vehicles, etc.
  • the terminal equipment corresponding to the massive MTC slice may include some measurement meters, such as electricity meters or gas meters
  • the terminal equipment corresponding to the MBB slice may include mobile phones or personal computers ( personal computer, PC), etc.
  • 3GPP 3rd generation partnership project
  • the selection process of network slices is triggered when a terminal device initially attaches to the network.
  • the selection process of network slices depends on one or more of the parameters such as user subscription data, local configuration information, roaming agreements, or operator policies.
  • the end device chooses the best slice type.
  • the terminal device can provide the requested (requested) network slice selection assistance information (NSSAI) to the core network device for the core network device to select a network slice for the terminal device instance.
  • NSSAI network slice selection assistance information
  • the terminal device may provide the requested NSSAI consisting of a set of parameters to the core network, and select a network slice instance for the terminal device.
  • This set of parameters includes, for example, one or more S-NSSAIs, and one of the S-NSSAIs may represent a network slice that the terminal device requests to access.
  • the terminal device may initiate the registration process in the following scenarios:
  • the terminal device registers to the 5G network for the first time
  • the terminal device performs periodic registration and update.
  • the establishment of one or more PDU sessions may be triggered.
  • the terminal device performs a mobility registration update
  • the terminal device has uplink data to send, and a PDU session is created in the registration process at this time.
  • FIG. 4 Please refer to FIG. 4 below for the process of registering a terminal device.
  • the terminal device sends a registration request (registration request) message to the RAN, and the RAN receives the registration request message from the terminal device.
  • registration request registration request
  • the registration request message is sent to the RAN, for example, through an AN message (message).
  • the RAN selects the AMF according to the radio access technology (radio access technology, RAT) and the identifier of the network slice requested by the registration request message.
  • radio access technology radio access technology, RAT
  • the RAN can The RAT supported by the device and the identification of the network slice requested by the registration request message select the AMF. Or, if the terminal device is in a radio resource control (radio resource control, RRC) connected (connected) state, the RAN may directly forward the registration request message to the corresponding AMF according to the existing RRC connection, that is, without performing S402, Instead, S403 may be performed.
  • RRC radio resource control
  • the identifier of the network slice is, for example, S-NSSAI.
  • the registration request message may carry one or more S-NSSAIs, and one of the S-NSSAIs may indicate a network slice.
  • the network slice indicated by the one or more S-NSSAIs is the network slice that the terminal device requests to access.
  • the RAN sends the registration request message to the AMF, and the AMF receives the registration request message from the RAN.
  • the registration request message is, for example, an N2 message (message).
  • the N2 message may include information such as N2 parameters, a registration message, access information of the terminal device, PDU session information, and a context request of the terminal device.
  • the new-side AMF invokes the service operation Namf_communication_UE context (context) transfer (Transfer) to send a message to the old-side AMF, and the old-side AMF receives the message from the new-side AMF.
  • the message transmitted by calling the service operation Namf_Communication_UE Context Transfer is called UE context transfer message. This message is used to obtain the context of the terminal device.
  • S404 is an optional step. If the AMF serving the terminal device is changed, S404 may be executed. If the AMF serving the terminal device has not changed, it is not necessary to perform S404.
  • the old-side AMF invokes the service operation Namf_Communication_UE Context Transfer response (response) to send a message to the new-side AMF, and the new-side AMF receives the message from the old-side AMF.
  • the message transmitted by calling the service operation Namf_Communication_UE Context Transferresponse is called the UE context transfer response message.
  • the message includes the context of the terminal device.
  • S404 and S405 are optional steps, and if the AMF serving the terminal device is changed, S404 and S405 may be performed. If the AMF serving the terminal device has not changed, it is unnecessary to perform S404 and S405.
  • the new-side AMF sends an identity request (identity request) message to the terminal device, and the terminal device receives the identity request message from the newly-added AMF.
  • the new-side AMF can send an identity request message to the terminal device to obtain the SUCI from the terminal device.
  • SUCI subscription concealed identifier
  • the terminal device sends an identity response (identity response) message to the new-side AMF, and the new-side AMF receives the identity response message from the terminal device.
  • the identity response message includes SUCI.
  • S406 and S407 are optional steps.
  • the authentication process is the main authentication process of the UE permanent identification.
  • the AMF selects an AUSF to authenticate the terminal device according to SUPI or SUCI.
  • the AMF may skip the authentication process, that is, S408 is also an optional step.
  • the new-side AMF invokes the service operation Namf_Communication_registration complete notification (registration complete notify) to send a message to the old-side AMF, and the old-side AMF receives the message from the new-side AMF.
  • Namf_Communication_registration complete notification registration complete notify
  • This message is used to notify the old AMF that the terminal device has completed the registration on the new AMF.
  • the message transmitted by calling the service operation Namf_Communication_Registration Complete Notify is called the registration complete message.
  • the new-side AMF sends an identity request (identity request) message to the terminal device, and the terminal device receives the identity request message from the new-side AMF. And, the terminal device sends an identity response (identity response) message to the new-side AMF, and the new-side AMF receives the identity response message from the terminal device.
  • identity request identity request
  • identity response identity response
  • the new-side AMF if the new-side AMF does not obtain a permanent equipment identifier (permanent equipment identifier, PEI) from the context of the terminal device and the old-side AMF, the new-side AMF sends an identity request message to the terminal device to request to obtain the PEI.
  • the terminal device replies the identity response message to the new side AMF, and the identity response message can carry the PEI.
  • PEI permanent equipment identifier
  • the new-side AMF calls the service operation N5g-eir_equipment identity check_get (Get) to send a message to an equipment identity register (EIR), and the EIR receives the message from the new-side AMF. This message is used to initiate the verification of mobile equipment identity (ME identity).
  • the message transmitted by calling the service operation N5g-eir_Equipment Identity Check_Get is called the device authentication get message.
  • the new-side AMF selects the UDM based on the SUPI.
  • the UDM may select a UDR instance.
  • S409 to S412 are all optional steps.
  • the new-side AMF invokes the servitization operation Nudm_UECM_Registration to register with the UDM, for example, the new-side AMF invokes the servitization operation Nudm_UECM_Registration to send a message to the UDM, and the UDM receives the message from the new-side AMF, and the message is used for the new-side AMF to register with the UDM.
  • the UDM sends a registration response message to the new-side AMF, that is, the message indicated by the arrow pointing from the UDM to the new-side AMF in S413a.
  • the message transmitted by invoking the servitization operation Nudm_UECM_Registration is called a registration message.
  • the new-side AMF invokes the service operation Nudm_SDM_Get to send a message to the UDM, and the UDM receives the message from the new-side AMF, where the message is used to request to obtain the subscription data of the terminal device.
  • the UDM sends an acquisition response message to the new-side AMF, that is, the message indicated by the arrow from the UDM to the new-side AMF in S413b, and the acquisition response message may include subscription data of the terminal device.
  • the message transmitted by invoking the servitization operation Nudm_SDM_Get is called a subscription data acquisition message.
  • the new-side AMF invokes the service operation Nudm_SDM_subscribe (subscribe) to send a message to the UDM, and the UDM receives the message from the AMF, where the message is used to subscribe to the service of subscription data change notification.
  • the message transmitted by calling the servitization operation Nudm_SDM_Subscribe is called a subscription data change subscription message.
  • the UDM sends a subscription response message to the new side AMF, that is, the message indicated by the arrow pointed by the UDM to the new side AMF in S413c, and the subscription response message may include notification information that the subscription data has been changed.
  • the UDM invokes the service operation Nudm_UECM_deregistration notification (deregistration notification) to send a message to the old-side AMF, and the old-side AMF receives the message from the UDM, and the message can be used for deregistration.
  • the message transmitted by calling the servitization operation Nudm_UECM_Deregistration Notification is called the deregistration notification message.
  • the UDM can send a message to the old AMF through the service operation Nudm_UECM_Deregistration Notification to notify the old AMF to delete the context of the terminal device.
  • the old-side AMF can also initiate a service operation Nsmf_PDU Session_ to the SMF to release the session management context (release SM context) to notify the SMF that the terminal device has been deregistered from the network.
  • release SM context session management context
  • the old side AMF invokes the service operation Nudm_SDM_unsubscribe (unsubscribe) to send a message to the UDM, and the UDM receives the message from the old side AMF, and the message is used for subscription, that is, used to cancel the subscription data of the terminal device. subscription.
  • the message transmitted by calling the service operation Nudm_SDM_unsubscribe is called an unsubscribe message.
  • S413d and S413e are optional steps.
  • the new side AMF selects the PCF.
  • the new-side AMF decides to establish a policy relationship with the PCF, for example, when the new-side AMF has not obtained the access and mobility policies of the terminal device, or the new-side AMF has no legal access and mobility policies, the new-side AMF will PCF will be selected. At this time, if the new-side AMF has obtained the PCF identity number (ID) from the old-side AMF, the new-side AMF can directly locate the PCF without performing S414.
  • ID PCF identity number
  • S414 is an optional step.
  • the new-side AMF establishes an AM policy association with the selected PCF.
  • the new-side AMF establishes an AM policy association with the PCF.
  • S415 is an optional step.
  • the new-side AMF invokes the serving operation Nsmf_PDU Session_update session management context request (update SM context request) to send a message to the SMF, and the SMF receives the message from the new-side AMF.
  • This message may request activation of the user plane connection for the PDU session.
  • the message transmitted by calling the service operation Nsmf_PDU Session_Update SM Context Request is called the update session management context request message.
  • the AMF sends a message to the SMF through the service operation Nsmf_PDUSession_UpdateSMContext Request, which is used to activate the user plane connection of the PDU session. If the PDU session status indicates that it has been released at the UE, the AMF informs the SMF to release the network resources related to the PDU session. If the SMF subscribes to UE-related mobility event notifications, the AMF sends notifications to the SMF as needed.
  • the new side AMF sends an N2AMF mobility request (N2 AMF mobility request) message to the (non-3GPP interworking function, N3IWF), and the N3IWF receives the N2 AMF mobility request message from the new side AMF.
  • the N2 AMF mobility request message is used to request the creation of a UE connection to the NG interface of the N3IWF.
  • the N2 AMF mobility request message is referred to as a mobility request message.
  • the N3IWF sends an N2AMF mobility response (N2 AMF mobility response) message to the new-side AMF, and the new-side AMF receives the N2 AMF mobility response message from the N3IWF.
  • N2 AMF mobility response message is referred to as a mobility response message.
  • the new side AMF will send the N2 AMF mobility request message to the N3IWF network element.
  • the new-side AMF does not send the N2 AMF mobility request message to the N3IWF network element. Therefore, S417 and S418 are optional steps.
  • the old-side AMF sends an AMF-initiated policy association termination message to the PCF, and the PCF receives the AMF-initiated policy association termination message from the old-side AMF.
  • the AMF-initiated policy association termination message is used to delete the connection between the old side AMF and the PCF.
  • S419 is an optional step.
  • the new-side AMF sends a registration accept (registration accept) message to the terminal device, and the terminal device receives the registration accept message from the new-side AMF.
  • the registration accept message is used to notify the terminal device that the registration request of the terminal device is accepted.
  • the Registration Accept message may include local area data network (LADN) information and a mobile initiated connection only (MICO) mode and the like.
  • LADN local area data network
  • MICO mobile initiated connection only
  • the terminal device sends a registration complete (registration complete) message to the new-side AMF, and the new-side AMF receives the registration complete message from the terminal device.
  • the terminal device may send a registration complete message to the new-side AMF.
  • the new-side AMF invokes the serving operation Nudm_SDM_Info to send a message to the UDM, and the UDM receives the message from the new-side AMF.
  • the message transmitted by calling the servitization operation Nudm_SDM_Info is called SDM information message.
  • the AMF sends a Nudm_SDM_Info message to the UDM to trigger the UDM to perform corresponding operations.
  • a roaming information identifier which is a confirmation identifier of the UE information requested by the UDM
  • the AMF sends a Nudm_SDM_Info message to the UDM to trigger the UDM to perform corresponding operations.
  • the subsequent steps please refer to the current processing of the roaming scene.
  • NSSAAF network slice specific authentication and authorization procedure
  • FIG. 5 is a schematic diagram of the NSSAAF process. The process includes the following steps.
  • S501 the terminal device initiates a registration process, for example, S501 means that the terminal device sends a registration request message to the AMF, and the AMF receives the registration request message from the terminal device.
  • the Registration Request message can carry the requested NSSAI (requested NSSAI) and the UE 5G mobility management core network capability (5GS mobility management core network capability, 5GMM Core Network Capability), where the UE 5GMM Core Network Capability indicates whether the terminal device supports the NSSAA process.
  • NSSAI requested NSSAI
  • 5GMM Core Network Capability 5GS mobility management core network capability, 5GMM Core Network Capability
  • the AMF executes the main authentication process of the UE permanent identity, for example, this process is called a security process PLMN access (security procedures PLMN access).
  • security process PLMN access security procedures PLMN access
  • the AMF obtains the UE's subscription data from the UDM.
  • the subscription data includes information indicating whether each S-NSSAI subscribed by the terminal device needs to execute the NSSAA process.
  • S502 is represented as a security procedure PLMN access (security procedures PLMN access), where AMF is an authenticator (authenticator), and NSSAAF can be understood as an authentication server (auth server).
  • the S-NSSAI subscribed by the terminal equipment can refer to Table 1, that is, the subscribed S-NSSAI and the corresponding indication information in the UE's subscription data are shown in Table 1:
  • the AMF determines, according to the subscription data of the terminal device, whether the S-NSSAI that needs to perform the NSSAAF process is included in the Requested NSSAI.
  • AMF determines that the S-NSSAI in the requested NSSAI needs to execute NSSAAF, which can have two meanings:
  • the first type if the terminal device indicates support for NSSAAF in the Registration Request message, then further, the AMF determines whether the S-NSSAI that needs to perform the NSSAA process is included in the requested NSSAI according to the subscription data of the terminal device. If the S-NSSAI that needs to perform the NSSAA process is included in the Requested NSSAI (corresponding to the requested NSSAI contains the slice type of the home domain network (HPLMN S-NSSAI)), then the AMF can determine that the terminal device needs to be Execute NSSAAF. If the S-NSSAI that needs to perform the NSSAA process is not included in the requested NSSAI, then the AMF can determine that the terminal device does not need to perform the NSSAA process after this registration process.
  • the S-NSSAI that needs to perform the NSSAA process is included in the requested NSSAI according to the subscription data of the terminal device. If the S-NSSAI that needs to perform the NSSAA process is included in the Requested NSSAI (corresponding to the requested NSSA
  • Example 1 for example, the requested NSSAI carried in the registration request message includes S-NSSAI-1 and S-NSSAI-2.
  • S-NSSAI-1 needs to implement NSSAAF
  • S-NSSAI-2 does not need to implement NSSAAF
  • AMF It can be determined that the terminal device needs to perform NSSAAF for S-NSSAI-1 after this registration process.
  • the second type If the terminal device indicates in the registration request message to support NSSAAF, a certain S-NSSAI in the requested NSSAI can be mapped to the contracted S-NSSAI, and the contracted S-NSSAI needs to execute NSSAA, then the AMF determines the requested S-NSSAI. S-NSSAI in NSSAI needs to perform NSSAAF.
  • the AMF determines that a certain S-NSSAI contained in the requested NSSAI can be mapped to the HPLMN S-NSSAI, and the HPLMN S-NSSAI needs to execute NSSAAF, then the AMF determines that the terminal device is after this registration process. NSSAAF needs to be performed.
  • the requested NSSAI carried by the terminal device includes S-NSSAI-A and S-NSSAI-B, where S-NSSAI-A is mapped to S-NSSAI-1, and S-NSSAI-B is mapped to S-NSSAI-2.
  • S-NSSAI-1 needs to execute NSSAAF
  • S-NSSAI-2 does not need to execute NSSAA process. Then the AMF determines that the terminal device needs to perform NSSAAF on S-NSSAI-1 after this registration process.
  • mapping relationship between S-NSSAI-A and S-NSSAI-1, and mapping between S-NSSAI-B and S-NSSAI-2 can be understood as the mapping relationship between S-NSSAI-A and S-NSSAI-1, and the mapping relationship between S-NSSAI-A and S-NSSAI-1.
  • -NSSAI-B has a mapping relationship with S-NSSAI-2; or it can be understood that there is a mapping relationship between the network slice identified by S-NSSAI-A and the network slice identified by S-NSSAI-1, and the network slice identified by S-NSSAI-B has a mapping relationship.
  • S-NSSAI-A is taken as an example for description.
  • S-NSSAI-A may be VPLMN S-NSSAI or HPLMN S-NSSAI, which is not limited in this embodiment of the present application.
  • S-NSSAI-A is VPLMN S-NSSAI, it means that the type of network slice identified by S-NSSAI-A belongs to the visited PLMN (visit PLMN), then there is a mapping relationship between S-NSSAI-A and S-NSSAI-1 That is, there is a mapping relationship between VPLMN S-NSSAI-A and HPLMN S-NSSAI-1, or there is a mapping relationship between the network slice identified by VPLMN S-NSSAI-A and the network slice identified by HPLMN S-NSSAI-1.
  • S-NSSAI-A is HPLMN S-NSSAI indicates that the type of network slice identified by S-NSSAI-A belongs to HPLMN network
  • the mapping relationship between S-NSSAI-A and S-NSSAI-1 is HPLMN S-NSSAI-
  • the AMF sends a registration accept (registration accept) message to the terminal device, and the terminal device receives the registration accept message from the AMF.
  • the Registration Accept message can carry the allowed NSSAI (allowed NSSAI), where the allowed NSSAI contains the S-NSSAI that does not require the NSSAA process.
  • the AMF also sends a pending NSSAI (pending NSSAI) to the terminal device, and the terminal device receives the pending NSSAI from the AMF.
  • the pending NSSAI may include one or more S-NSSAIs that need to perform the NSSAA process, and the pending NSSAI is used to indicate the terminal device that these S-NSSAIs that need to perform the NSSAA process are in the pending state.
  • the registration acceptance message sent by the AMF to the terminal device carries the allowed NSSAI (allowed NSSAI), the pending NSSAI (pending NSSAI) and the pending cause value.
  • allowed NSSAI only includes S-NSSAI that does not need NSSAA
  • pending NSSAI includes S-NSSAI that needs NSSAA
  • the pending cause value is waiting for NSSAA, which is used to indicate the UE: these S-NSSAIs that need NSSAA are Pending state.
  • a pending NSSAI can also be called a pending NSSAI.
  • the embodiments of the present application are described by taking a pending NSSAI called a pending NSSAI as an example.
  • the AMF After sending the registration accept message, the AMF performs NSSAAF on the S-NSSAI in the pending state.
  • the pending NSSAI includes S-NSSAI-1, then the AMF can perform NSSAAF on S-NSSAI-1.
  • the specific steps of NSSAAF please refer to the flow to be introduced in the following FIG. 6 .
  • NSSAA by the AMF to the S-NSSAI in the NSSAI to be determined can have two meanings:
  • the first type a certain S-NSSAI in the pending NSSAI belongs to the contracted S-NSSAI, and the contracted S-NSSAI needs to execute NSSAA, then the AMF executes NSSAA for the S-NSSAI.
  • pending NSSAI S-NSSAI-1
  • S-NSSAI-1 is HPLMN S-NSSAI
  • the AMF performs NSSAA on S-NSSAI-1.
  • the second type a certain S-NSSAI in the pending NSSAI is mapped with the contracted S-NSSAI, and the contracted S-NSSAI needs to execute NSSAA, then the AMF executes NSSAA on the contracted S-NSSAI.
  • pending NSSAI S-NSSAI-A
  • S-NSSAI-A since S-NSSAI-A is mapped with S-NSSAI-1, the AMF performs the NSSAA process on S-NSSAI-1.
  • Step 505 is an optional step. When there is an S-NSSAI that needs to execute the NSSAA process, step 505 is executed, otherwise, step 505 is not executed.
  • step 505 may be performed multiple times.
  • S506 After the NSSAA process is executed, the AMF updates the allowed NSSAI according to the authentication result of the NSSAA process.
  • S506 is represented as a UE configuration update procedure (UE configuration update procedure), that is, the AMF can update the Allowed NSSAI for the UE.
  • UE configuration update procedure UE configuration update procedure
  • the S-NSSAI will be added to the new allowed NSSAI.
  • the authentication result of performing the NSSAA process on an S-NSSAI is an authentication failure, and the S-NSSAI is included in the requested NSSAI, the S-NSSAI will be added to the rejected NSSAI, and the AMF does not need to update the terminal device
  • the allowed NSSAI that is, the AMF does not generate the new allowed NSSAI, nor does it have to send the new allowed NSSAI to the end device.
  • the S-NSSAI contained in the requested NSSAI will be added to the new allowed in NSSAI.
  • the authentication result of performing the NSSAA process on an S-NSSAI is an authentication failure, and the S-NSSAI can be mapped to the S-NSSAI contained in the requested NSSAI, the S-NSSAI contained in the requested NSSAI will be added to the rejected In NSSAI, AMF does not need to update the allowed NSSAI of the terminal device, that is, AMF does not generate new allowed NSSAI, nor does it need to send new allowed NSSAI to the terminal device.
  • the AMF performs the NSSAA procedure on S-NSSAI-1. Then, if the authentication result of the NSSAA process of S-NSSAI-1 is successful, or the NSSAA process of S-NSSAI-1 is successfully executed, the AMF can add S-NSSAI-1 to the allowed NSSAI to obtain a new (new) allowed NSSAI, and AMF can send new allowed NSSAI to terminal equipment, new allowed NSSAI can include S-NSSAI-1 and S-NSSAI-2.
  • the AMF sends the rejected NSSAI to the terminal device, where the rejected NSSAI includes S-NSSAI- 1. At the same time, AMF will not update the allowed NSSAI of the terminal device.
  • This step 506 is an optional step. When the above step 505 is performed and the Allowed NSSAI of the UE needs to be updated, the step 506 is performed.
  • the NSSAA process can be performed on the S-NSSAI, and the allowed NSSAI of the UE can be updated.
  • FIG. 6 is a flowchart of the steps involved in the NSSAA process.
  • the main idea is: when the AMF decides to trigger the NSSAA process, the AMF will interact with the AAA-S to transfer the authentication information of the terminal device through the NSSAAF.
  • the AAA-S is located in a third party and the NSSAAF cannot directly interact with the AAA-S, the NSSAAF can indirectly interact with the AAA-S through the AAA-proxy (proxy-P).
  • the AMF triggers the NSSAA process for the S-NSSAI in the pending NSSAI.
  • the AMF performs NSSAA on the S-NSSAI included in the pending NSSAI, which may have two meanings:
  • the first type A certain S-NSSAI in the pending NSSAI belongs to the contracted S-NSSAI, and the contracted S-NSSAI needs to execute NSSAA, then the AMF executes NSSAA for the S-NSSAI.
  • pending NSSAI S-NSSAI-1
  • S-NSSAI-1 is HPLMN S-NSSAI
  • the AMF performs the NSSAA process on S-NSSAI-1.
  • the second type A certain S-NSSAI in the pending NSSAI is mapped with the contracted S-NSSAI, and the contracted S-NSSAI needs to execute NSSAA, then the AMF executes NSSAA on the contracted S-NSSAI.
  • pending NSSAI S-NSSAI-A
  • S-NSSAI-A since S-NSSAI-A is mapped with S-NSSAI-1, the AMF performs the NSSAA process on S-NSSAI-1.
  • the S-NSSAI involved in the following steps S602 to S617 is the S-NSSAI subscribed by the terminal device, and the subscribed S-NSSAI needs to execute the NSSAA process.
  • the AMF sends a non-access stratum (non-access stratum, NAS) mobility management (mobile management, MM) message to the terminal device, and the terminal device receives the NAS MM message from the AMF.
  • NAS non-access stratum
  • MM mobility management
  • the NAS MM message may include S-NSSAI, and the NAS MM message is used to request the terminal device for the ID of the terminal device to perform Extensible Authentication Protocol (EAP) authentication.
  • EAP Extensible Authentication Protocol
  • the terminal device sends a NAS MM message to the AMF, and the AMF receives the NAS MM message from the terminal device.
  • the NAS MM message includes the EAP ID response (response) and the S-NSSAI, where the EAP ID Response can be understood as the EAP ID.
  • the S-NSSAI in S603 is the same as the S-NSSAI in S602.
  • the AMF sends a message (represented as EAP message transmission message 1 in FIG. 6 ) to the NSSAAF, and the NSSAAF receives the EAP message transmission message 1 from the AMF.
  • the EAP messaging message 1 may include an EAP ID Response, an AAA-S address, a generic public subscription identifier (GPSI), and an S-NSSAI.
  • the GPSI is an external identifier of the terminal device, such as a mobile phone number or an e-mail address of the terminal device.
  • AAA-S address is the address of the AAA-S, which can be pre-configured on the AMF or the AMF obtains the address of the AAA-S from the UDM.
  • the S-NSSAI is the identifier of the network slice that performs the NSSAA process this time, and the S-NSSAI is the HPLMN S-NSSAI.
  • the NSSAAF sends the EAP message transmission message 2 to the AAA-P, for example, by invoking the service operation Naaa_Communication_EAPmessageTranfser to send the EAP message transmission message 2 to the AAA-P, and the AAA-P receives the EAP message transmission message 2 from the NSSAAF.
  • the EAP messaging message 2 includes EAP ID Response, AAA-S address, GPSI and S-NSSAI.
  • AAA-S is located in a third-party network
  • NSSAAF needs to interact with AAA-S through AAA-P. Otherwise, if the AAA-S is in the operator's network, the NSSAAF can interact directly with the AAA-S without going through the AAA-P.
  • S605 is described by taking the example that the NSSAAF communicates with the AAA-S through the AAA-P, that is, the AAA-S is located in the third-party network. Therefore, in the specific implementation process, the AAA-P does not necessarily exist, and the corresponding step S605 is not necessarily performed. Therefore, S605 and AAA-P are represented by dotted lines in FIG. 6 .
  • AAA-P sends an authentication request (auth request) message to AAA-S according to the AAA-S address, and correspondingly, AAA-S receives the auth request message from AAA-P.
  • the auth request message may include EAP ID Response, GPSI and S-NSSAI.
  • the EAP-message may include information such as EAP ID Response, GPSI, and S-NSSAI.
  • the EAP-message is passed to perform EAP authentication (authentication) on the terminal device.
  • AAA-S sends an authentication response (auth response) message to AAA-P, and AAA-P receives the authentication response message from AAA-S.
  • the authentication response message may include information such as EAP-success/failure message, GPSI and S-NSSAI. Or, if AAA-S and NSSAAF can interact directly, AAA-S sends EAP-Success/Failure message, GPSI and S-NSSAI to NSSAAF, NSSAAF receives EAP-Success/Failure message, GPSI and S from AAA-S - NSSAI.
  • the AAA-S saves the corresponding relationship between the GSPI and the S-NSSAI of the network slice that is authenticated successfully.
  • the AAA-P sends the EAP information transmission message 3 to the NSSAAF.
  • the EAP information transmission message 3 may include information such as EAP-Success/Failure message, S-NSSAI, and GPSI.
  • NSSAAF sends information such as EAP-Success/Failure message, S-NSSAI and GPSI to AMF, and AMF receives information such as EAP-Success/Failure message, S-NSSAI and GPSI from NSSAAF.
  • the AMF sends a NAS MM message to the terminal device, and the terminal device receives the NAS MM message from the AMF.
  • the NAS MM message carries the EAP-Success/Failure message (ie, the EAP success/failure message).
  • the AMF sends the new allowed NSSAI to the terminal device through the UE configuration update procedure, and the terminal device receives the new allowed NSSAI from the AMF.
  • the AMF sends a rejected NSSAI (rejected NSSAI) to the terminal device through the UE configuration update procedure.
  • the S-NSSAI executing the NSSAA process If the authentication result of the S-NSSAI executing the NSSAA process is that the authentication is successful, and the S-NSSAI is included in the requested NSSAI, the S-NSSAI will be added to the new allowed NSSAI. Or, if the authentication result of the NSSAA process performed by the S-NSSAI is an authentication failure, and the S-NSSAI is included in the requested NSSAI, the S-NSSAI will be added to the rejected NSSAI, and the AMF does not need to update the allowed terminal device. NSSAI, that is, AMF does not generate new allowed NSSAI, nor does it have to send new allowed NSSAI to end devices.
  • the authentication result of the S-NSSAI performing the NSSAA process is that the authentication is successful, and the S-NSSAI can be mapped to the S-NSSAI contained in the requested NSSAI, the S-NSSAI contained in the requested NSSAI will be added to the new allowed NSSAI.
  • the authentication result of the S-NSSAI executing the NSSAA process is an authentication failure, and the S-NSSAI can be mapped to the S-NSSAI contained in the requested NSSAI, the S-NSSAI contained in the requested NSSAI will be added to the rejected NSSAI , and AMF does not need to update the allowed NSSAI of the terminal device, that is, AMF does not generate a new allowed NSSAI, nor does it need to send a new allowed NSSAI to the terminal device.
  • AMF If AMF decides that it needs to send new allowed NSSAI or rejected NSSAI to terminal equipment, AMF can send it through UE configuration update procedure.
  • the AMF sends new allowed NSSAI to the terminal device, where new allowed NSSAI includes S-NSSAI-1 and S-NSSAI-2. Or, if the NSSAA execution of S-NSSAI-1 fails, the AMF sends the rejected NSSAI to the terminal device, where the rejected NSSAI includes S-NSSAI-1, that is, the AMF will not update the allowed NSSAI to the terminal device, nor will it send it to the terminal device. new allowed NSSAI.
  • the AMF sends new allowed NSSAI to the terminal device, where new allowed NSSAI includes S-NSSAI-A and S-NSSAI-B. Or, if the NSSAA execution of S-NSSAI-1 fails, the AMF sends the rejected NSSAI to the terminal device, where the rejected NSSAI includes S-NSSAI-A, that is, the AMF will not update the rlowed NSSAI to the terminal device, nor will it send the rejected NSSAI to the terminal device. new allowed NSSAI.
  • AAA-S may also re-authenticate a slice that has been authenticated successfully before by the terminal device at a certain time, such as re-authentication when the authentication duration exceeds a predetermined duration, or re-authenticate according to a certain Period of re-authentication, that is, AAA-S can initiate re-authentication process, please refer to the slice re-authentication process shown in Figure 7.
  • AAA-S triggers a re-authentication process, sends an AAA protocol re-authentication message to AAA-P, and correspondingly, AAA-P receives the AAA protocol re-authentication message.
  • the AAA protocol re-authentication message includes the GPSI and the identifier corresponding to the slice that needs to be re-authenticated, that is, S-NSSAI.
  • the AAA protocol re-authentication message may also be referred to as a slice re-authentication message.
  • AAA-P sends an AAA protocol re-authentication message to NSSAAF, and correspondingly, NSSAAF receives the AAA protocol re-authentication message sent by AAA-P.
  • the NSSAAF queries the UDM for the address of the AMF of the serving terminal device (not shown in FIG. 7 ), and sends an NSSAA notification message (represented in FIG. 7 is the AAA protocol re-authentication message) to the corresponding AMF, where the NAASS notification message contains Include GPSI and S-NSSAI from step 1.
  • the AMF initiates a re-authentication process for the S-NSSAI to be authenticated included in the AAA protocol re-authentication message.
  • the AMF initiates a re-authentication process for the S-NSSAI to be authenticated included in the AAA protocol re-authentication message.
  • the AMF sends a configuration update message to the terminal device to trigger the terminal device to perform a configuration update process, and then update the Allowed NSSAI of the terminal device.
  • which slices a terminal device can access is managed and controlled by the operator, which is embodied in the following: (1) As the subscription data of the terminal device, it is stored in the UDM maintained by the operator; (2) It is configured on the AMF. On this basis, for the NSSAI that the user has subscribed to, the operator supports the third party to authenticate and authorize the terminal device to use the slice, that is, the above-mentioned NSSAA process. Only when the terminal device has passed the AAA-S authentication and authorization related to the slice, the terminal device is allowed to access the slice, that is, it is allowed to access the network service provided by the slice.
  • third-party services can be issued to users for customized terminal equipment of operators, and various types of slices can be rented from operators.
  • Different types of slices provide users with different business experiences. For example, by renting gold, silver, and copper slices, gold users can obtain exclusive bandwidth and network services with lower latency.
  • These terminal devices can obtain the network connection service provided by the operator by signing a contract with the operator, but the subscription of which slice the user uses is not managed and controlled by the operator network, but is managed and controlled by a third party, that is, the user accesses the mobile network. After that, the third party authorizes the user to determine which slice to use.
  • the user wants to change the slice subscription at a later time, for example, to obtain higher service quality, he can purchase it from the third party, and then the third party interacts with the operator's mobile network. , to update the slice used by the user. Since the data stored on the UDM maintained by the operator is relatively important and also involves user privacy, in the related art, a third party submits the slices signed by the user to the operator, and then the operator's staff updates the operator Maintained UDM to realize update management of user's slice subscription data. However, this management method is inefficient, may not meet the needs of frequently and dynamically changing user slice subscriptions, and is not conducive to the third party's own control of slice services, so corresponding solutions are required.
  • the embodiments of the present application provide a slice management solution, which can directly manage and control the slices of the terminal device through a third party, and can directly store the slice subscription data of the terminal device in the third party, so that there is no need to report to the operator
  • the maintained UDM requests the slice subscription data of the terminal device, so when the slice subscription of the terminal device changes, the third party directly updates and manages the slice of the terminal device, without the need for the operator's operation and maintenance personnel to update through operations.
  • UDM data which can reduce user operations and communication costs, thereby improving the management efficiency of slicing, and can also enhance the third-party's business control capability over terminal equipment, improve the experience of third-party and operator business cooperation, and facilitate operation. business expansion.
  • the technical solutions of the embodiments of the present application may be applied to various communication systems, for example, a fifth generation (5th generation, 5G) communication system, a sixth generation (6th generation, 6G) communication system, or other future evolution systems, or other various A wireless communication system using a wireless access technology, etc., as long as there is network slice management in the communication system, the technical solutions of the embodiments of the present application can be adopted.
  • 5th generation, 5G fifth generation
  • 6th generation, 6G sixth generation
  • future evolution systems or other various A wireless communication system using a wireless access technology, etc.
  • the mobility management network element described in the embodiments of the present application may be the AMF network element shown in FIG. 1 , or may be a network element having the functions of the above-mentioned AMF network element in a future communication system.
  • the authentication network element described in this embodiment of the present application may be the AAA-S or NSSAAF mentioned above, and may also be a network element with the function of the AAA-S or a network element with the function of the NSSAAF in the future communication system. Yuan.
  • the data management network element described in the embodiment of the present application may be the UDM mentioned above, or may be a network element having the function of the UDM in the future communication system.
  • FIG. 8 Please refer to the flow interaction diagram of a slice management method provided by an embodiment of the present application shown in FIG. 8 .
  • the flow shown in FIG. 8 is described as follows.
  • the mobility management network element (represented by AMF in FIG. 8 ) obtains slice selection indication information.
  • the slice selection indication information is used to indicate that the slice subscription data of the terminal device is stored in the third-party application server, or the slice selection indication information is used to instruct the third-party application to determine the slice for the terminal device, or the slice selection indication information is used for The slice used to indicate the terminal device is determined by the third-party application. Through the indication of the slice selection indication information, it can be clarified that the slice of the terminal device needs to be determined by a third party.
  • the slice selection indication information may be carried in a registration request message sent by the terminal device to the AMF; or, the AMF may request slice subscription data of the terminal device from the UDM maintained by the operator, and the slice selection indication information may be It is carried in the slice subscription data requested by the AMF to the UDM.
  • the slice selection indication information may reuse the authentication and authorization indication information in the related art, or may also be new indication information.
  • the slice selection indication information received by the AMF from the terminal device and the slice selection indication information obtained from the UDM may exist at the same time, or there may be only one, that is, the AMF may obtain the slice selection indication information from the terminal device and the UDM at the same time , or the slice selection indication information may be obtained only from the terminal device, or the slice selection indication information may also be obtained only from the UDM.
  • the third-party application server can be understood as a server serving third-party applications.
  • the third-party application server provides services independent of the operator and maintained by the third party. Therefore, the third-party application server is different from that maintained by the operator. UDM's.
  • the third-party application server and the authentication network element may be in the same network structure (for example, the same functional network element or the same physical device), that is, the third-party application server at this time is the authentication network element, and Alternatively, the third-party application server and the authentication network element have different network structures, and the third-party application server and the authentication network element are two independent functional network elements or different physical devices at this time.
  • the third-party application server is shown independently of the AAA-S, so the illustration is based on a network structure in which the authentication network element and the third-party application server are different.
  • Step S801 is an optional step, so S801 is represented by a dotted line in FIG. 8 . That is, in the specific implementation process, S801 may or may not be performed, which is not limited in this embodiment of the present application.
  • the mobility management network element initiates a slice request.
  • slice request information may be sent to a third-party application server, where the slice request information includes a user identifier, such as GPSI.
  • the third-party application server receives the mobility management network Slice request information sent by the meta.
  • Step S802 is only a schematic interaction process between the mobility management network element and the third-party application server.
  • the mobility management network element can directly interact with the third-party application server, and can also interact with the third-party application server through other network elements such as NEF.
  • the AMF sends the slice request information to the AAA-S through NSSAAF and AAA-P, specifically:
  • the NSSAAF sends the slice request information to the AAA-P, and correspondingly, the AAA-P receives the slice request information sent by the NSSAAF. Further, the AAA-P sends the slice request information to the authentication network element (ie, the AAA-S), and correspondingly, the AAA-S receives the slice request information sent by the AAA-P.
  • the AAA-P sends the slice request information to the authentication network element (ie, the AAA-S), and correspondingly, the AAA-S receives the slice request information sent by the AAA-P.
  • the actual network structure may not include AAA-P.
  • NSSAAF and AAA-S can communicate directly.
  • AAA-P is included, NSSAAF and AAA-S communicate with each other through AAA-P. communication.
  • the third-party application server determines the slice authorized by the terminal device corresponding to the GPSI according to the user identifier (GPSI) in the slice request information, for example, the determined slice is the first slice, and the third-party application server generates a slice including the first S-
  • the slice response information of the NSSAI is sent to the mobility management network element.
  • the mobility management network element receives the slice response information sent by the third-party application server.
  • the first S-NSSAI is the S-NSSAI used to identify the first slice.
  • Step S803 is only used to illustrate the interaction between the mobility management network element and the third-party application server.
  • the mobility management network element can directly interact with the third-party application server, and can also interact with the third-party application server through other network elements such as NSSAAF or NEF.
  • the AMF network element exchanges information with the AAA-S through NSSAAF, AAA-P. specific:
  • the AAA-S After obtaining the first S-NSSAI corresponding to the first slice authorized by the third-party application for the terminal device from the third-party service server, the AAA-S generates slice response information including the first S-NSSAI, and sends the slice response information For AAA-P, correspondingly, AAA-P receives the slice response information sent by AAA-S.
  • the AAA-P sends the slice response information to the NSSAAF, and correspondingly, the NSSAAF receives the slice response information sent by the AAA-P.
  • the NSSAAF sends the slice response information to the AMF.
  • the AMF receives the slice response information sent by the NSSAAF, and then can obtain the first S-NSSAI carried in the slice response information, that is, the AMF obtains the S-NSSAI from the third-party application server. First S-NSSAI.
  • the third party can manage and control the user subscription data, so the slice subscription data of the terminal device can be stored in the third-party application server in advance, and then allocated to the terminal device.
  • the slice that has been authorized by the third party can be directly allocated to the terminal device, so that there is no need to request the slice subscription data of the terminal device from the UDM maintained by the operator, so when the slice subscription of the terminal device changes, the first The third party directly updates and manages the third-party application server maintained by itself, without the need for the operator's operation and maintenance personnel to update the UDM data through operations, which can reduce user operations and communication costs, thereby improving the management efficiency of slices , and can also enhance the third party's ability to control the service of the terminal device, improve the experience of the third party and the operator's business cooperation, and help the operator to expand services.
  • the AMF may further initiate an NSSAA procedure on the first S-NSSAI, that is, perform NSSAA on the first S-NSSAI.
  • the process of performing NSSAA on the first S-NSSAI may be performed according to NSSAAF in the related art, and the description will not be repeated here.
  • step S804 is an optional step, S804 is represented by a dotted line in FIG. 8 .
  • the AMF sends the first S-NSSAI to the terminal device, and correspondingly, the terminal device receives the first S-NSSAI sent by the AMF. For example, when the result of performing the NSSAA procedure on the first S-NSSAI is that the authentication is successful, the AMF sends the first S-NSSAI to the terminal device.
  • the terminal device may perform slice configuration update, that is, update the S-NSSAI that the terminal device is allowed to access with the received first S-NSSAI.
  • the first slice indicated by the first S-NSSAI sent by the AMF to the terminal device is the slice authorized to the terminal device in the third-party application server.
  • the third party can directly subscribe to the slice data of the terminal device. Management can improve the management efficiency of slices, and can also enhance the third party's ability to control the service of terminal devices.
  • the third-party application server is used to directly allocate slices directly authorized by the third party to the terminal device, that is, the user's subscription data can be directly stored in the third-party application server.
  • the slices that the user really authorizes in the third party are directly obtained from the third-party application server, instead of being obtained from the UDM maintained by the operator, which can reduce the steps of updating from the third party to the operator.
  • Slice management improves the efficiency of slice management and enhances the third party's ability to control the business of terminal devices.
  • the first S-NSSAI can also be sent to the terminal device according to the process shown in FIG. for the same network structure) as an example to illustrate.
  • the flow shown in FIG. 9 is described as follows.
  • the AMF obtains slice selection indication information.
  • the slice selection indication information in S901 has the same meaning as the slice selection indication information in S801, and the implementation of step S901 may be described with reference to the embodiment of step S801.
  • the AMF initiates a slice authentication request. Specifically, the AMF may first send a slice authentication request to the NSSAAF.
  • the slice authentication request sent by the AMF includes the terminal identifier (eg GPSI) of the terminal device and the second S-NSSAI, and the second S-NSSAI is used to identify the terminal device in the data management network element (eg UDM maintained by the operator)
  • the subscribed slice assuming that the second S-NSSAI identifies the second slice, then the second slice is the slice subscribed for the terminal device in the UDM maintained by the operator.
  • the second S-NSSAI may be called as the slice.
  • the AMF may request the subscription data of the terminal device from the UDM in advance, and then obtain the second S-NSSAI from the subscription data.
  • the NSSAAF sends the slice authentication request to the AAA-P.
  • the AAA-P receives the slice authentication request sent by the NSSAAF.
  • AAAA-P sends the slice authentication request to AAA-S, and correspondingly, AAA-S receives the slice authentication request sent by AAA-P.
  • the AAA-S After receiving the slice authentication request, the AAA-S can obtain the terminal identifier and the second S-NSSAI therein.
  • the second slice corresponding to the second S-NSSAI is subscribed to the terminal device in the UDM, but it is not necessarily the slice actually authorized by the third party to the terminal device.
  • the terminal device subscribes to the default second S-NSSAI in the UDM to reuse the authentication process in the related art. In this way, the authentication process can be executed after obtaining the second S-NSSAI.
  • the second S-NSSAI signed for the terminal device in the UDM is not necessarily the S-NSSAI actually authorized by the third party for the terminal device. Therefore, when performing slice authentication, the AMF can first query the third-party application server whether the second S-NSSAI The S-NSSAI is authorized to the terminal device. If the second S-NSSAI has not been authorized for the terminal device at the third-party application server, query the S-NSSAI that has been authorized for the terminal device from the third-party application server. If the first S-NSSAI is authorized for the terminal device, the first S-NSSAI can be used as the S-NSSAI that has passed the authentication of the terminal device.
  • the second S-NSSAI can be directly determined to be the S-NSSAI authorized at the third-party application server, and the third-party application server can be downloaded from the third-party application server.
  • the other S-NSSAI for example, the first S-NSSAI
  • the second S-NSSAI that has been queried for the terminal device authorized by the server is used as the S-NSSAI that has passed the authentication of the terminal device.
  • the S-NSSAI at the third-party application server that has passed the authorization and authentication is called the first S-NSSAI
  • the first S-NSSAI may be the second S-NSSAI, that is, the first S-NSSAI and the second S-NSSAI.
  • the NSSAIs are the same, or the first S-NSSAI and the second S-NSSAI are different S-NSSAIs.
  • the authentication process it can be judged whether there is an S-NSSAI authorized by the terminal device in the third-party application server. If so, it can be determined that the authentication has passed, and an S-NSSAI (called the first S-NSSAI) can be selected ) as the authenticated S-NSSAI, that is to say, the first slice corresponding to the first S-NSSAI is the slice actually authorized by the third-party application server for the terminal device.
  • an S-NSSAI called the first S-NSSAI
  • the AAA-S obtains the first S-NSSAI corresponding to the first slice actually authorized by the third-party application server for the terminal device, that is to say, the first slice identified by the first S-NSSAI is created by the third-party authorized by the terminal device.
  • the AAA-S can generate the authentication result indication information, and use the generated authentication
  • the result indication information and the first S-NSSAI are sent to the AAA-P.
  • the authentication result indication information and the first S-NSSAI may be carried in the authentication response information at the same time and sent to the AAA-P.
  • the AAA-P receives the authentication result indication information sent by the AAA-S. and the first S-NSSAI.
  • the AAA-P sends the authentication result indication information and the first S-NSSAI to the NSSAAF.
  • the NSSAAF receives the authentication result indication information and the first S-NSSAI sent by the AAA-P.
  • the NSSAAF sends the authentication result indication information and the first S-NSSAI to the AMF, and correspondingly, the AMF receives the authentication result indication information and the first S-NSSAI sent by the NSSAAF.
  • the AMF After receiving the authentication result indication information and the first S-NSSAI, the AMF can determine that the authentication is successful, and then can send the first S-NSSAI to the terminal device. Correspondingly, the terminal device receives the first S-NSSAI sent by the AMF. NSSAI.
  • the terminal device may determine that the first S-NSSAI is an S-NSSAI authorized by a third party, and may perform slice configuration update, that is, update the terminal with the received first S-NSSAI The S-NSSAI that the device is allowed to access.
  • the slice authorized by the third party is implemented, which facilitates the third party to directly manage and maintain the slice used by the user without submitting it to the operator for management and maintenance, and enhances the third party's business control over the terminal device It improves the experience of business cooperation between third parties and operators, and is beneficial for operators to expand their services.
  • FIG. 10 Please refer to the flow interaction diagram of another slice management method shown in FIG. 10 .
  • the flow shown in FIG. 10 is described as follows.
  • the AMF initiates a slice authentication request. Specifically, the AMF may send the slice authentication request to the NSSAAF.
  • the slice authentication request includes the EAP identification response message of the terminal device and the first S-NSSAI that needs to be authenticated.
  • the slice authentication request may further include a terminal identifier corresponding to the terminal device, such as the GPSI of the terminal device.
  • the EAP identification response message is, for example, the EAP message transmission message 1 in S604 in FIG. 6 , and the EAP identification response message includes information such as the EAP ID.
  • the embodiment of the present application is to authenticate the slices signed by the UDM, and all slices of the operator rented by the third party can be pre-signed and stored in the UDM as the S-NSSAI for the terminal device.
  • slice-specific authentication and authorization (slice-specific authentication and authorization) instructions can be configured, that is, each S-NSSAI signed in the UDM needs to be authenticated. In this way, for each S-NSSAI in the UDM, the AMF will initiate the authentication process.
  • the NSSAAF sends the slice authentication request to the AAA-P, and correspondingly, the AAA-P receives the slice authentication request sent by the NSSAAF.
  • the AAA-P sends the slice authentication request to the AAA-S, and correspondingly, the AAA-S receives the slice authentication request sent by the AAA-P.
  • the AAA-S After receiving the slice authentication request, the AAA-S obtains the EAP identity response message included therein and the first S-NSSAI that needs to be authenticated.
  • the AMF initiates authentication of the EAP identification response message, that is, determines whether the EAP identification response message passes the authentication.
  • S1004 may authenticate the EAP identification response message of the terminal device according to the authentication process in the related art, for example, determine whether the user credential information corresponding to the EAP identification response message is legal, etc., and then obtain the first authentication result.
  • the AMF determines whether the slice identified by the first S-NSSAI is a slice that the third-party application server allows the terminal device to access, that is, it can determine whether the slice identified by the first S-NSSAI is actually authorized by the third party, and then Obtain the second authentication result.
  • the third party determines whether the third party has carried out double verification on the actual authorization of the second S-NSSAI, so that the double verification can not only ensure the accuracy of the verification, but also ensure that the third party is authorized by the third party.
  • the application server participates in the authentication process, so that when the verification is passed, it indicates that the corresponding first S-NSSAI is indeed an S-NSSAI pre-authorized by a third party, and the management of slices is realized through the third party's verification of the first S-NSSAI and control.
  • both the first authentication result and the second authentication result are yes, that is, when the authentication of the EAP identification response message is successful and the slice of the first S-NSSAI identifier is a slice that the third-party application server allows the terminal device to access, it is possible to The authentication is considered successful, and as long as there is one authentication failure in the first authentication result and the second authentication result, the final authentication can be considered as a failure.
  • the corresponding authentication result indication information may be generated according to the final authentication result, so the authentication result indication information may indicate that the EAP authentication succeeds, or may indicate that the EAP authentication fails.
  • AAA-S sends the generated authentication result indication information to AAA-P, and correspondingly, AAA-P receives the authentication result indication information sent by AAA-S.
  • the AAA-P sends the authentication result indication information to the NSSAAF, and correspondingly, the NSSAAF receives the authentication result indication information sent by the AAA-P.
  • the NSSAAF sends the authentication result indication information to the AMF, and correspondingly, the AMF receives the authentication result indication information sent by the NSSAAF.
  • the AMF can confirm that the EAP authentication succeeds or the EAP authentication fails according to the indication of the authentication result indication information.
  • an access-allowed S-NSSAI including the first S-NSSAI may be sent to the terminal device, so that the terminal device updates its slice configuration according to the access-allowed S-NSSAI.
  • the terminal device may perform slice configuration update, that is, update the S-NSSAI of the terminal device that is allowed to access with the received first S-NSSAI.
  • the AMF can determine whether the slice of the S-NSSAI identifier to be verified is actually a slice that the third-party application server actually allows the terminal device to access, so that the double verification is passed.
  • the third party participates in the authentication of the slice, and the authentication result obtained in this way takes into account the actual authorization of the slice to be verified by the third party, and realizes the direct management and control of the slice by the third party.
  • FIG. 11 Referring again to the flow interaction diagram of another slice management method shown in FIG. 11 , the flow shown in FIG. 11 is described as follows.
  • the third-party application server determines that the slice accessed by the terminal device is changed from the first slice to the second slice.
  • the first slice accessed by the terminal device is a bronze-type slice.
  • the slice accessed by the terminal device is switched from the first slice to the second slice, and the slice data subscribed by the user can be changed at the third-party application server, that is, the second slice is configured as the slice that allows the terminal device to access, and all the first slices can be changed.
  • the slice is configured as a slice that terminal equipment is not allowed to access. It can be seen that the slice subscription data of the terminal equipment can be stored in the third-party application server and can be directly managed by the third-party application, so that the third party can directly manage the slice.
  • the S-NSSAI corresponding to the first slice is called the first S-NSSAI
  • the S-NSSAI corresponding to the second slice is called the second S-NSSAI.
  • the third-party application server sends slice update information to a mobility management network element (eg, AMF).
  • AMF receives the slice update information sent by the third-party application server.
  • the third-party application server may generate slice update information, and the slice update information includes the slice update information that needs to be switched.
  • the slice update information may indicate that the second S-NSSAI needs to be authenticated.
  • the slice update information may also include a terminal identifier corresponding to the terminal device, such as GPSI and other information.
  • the slice update information may further include the first S-NSSAI, that is, the S-NSSAI corresponding to the second slice that has expired may also be carried in the slice update information, where " Has expired" means that the terminal device is no longer allowed to access.
  • the second slice may be, for example, a slice corresponding to the first S-NSSAI that has been authorized and authenticated in FIG. 8 to FIG. 10 .
  • the third-party application server sends it to the mobility management network element to trigger the mobility management network element to perform slice update.
  • Step S1102 only serves as a schematic interaction between the mobility management network element and the third-party application server.
  • the mobility management network element can directly interact with the third-party application server, and can also interact with the third-party application server through other network elements such as NSSAAF or NEF.
  • the third-party application server network element is the authentication network element AAA-S
  • the third-party application server (AAA-S) exchanges information with the mobility management network element through NSSAAF and AAA-P. specific:
  • the AAA-S sends the slice update information to the AAA-P, and correspondingly, the AAA-P receives the slice update information sent by the AAA-S. Then, the AAA-P sends the slice update information to the NSSAAF, and correspondingly, the NSSAAF receives the slice update information sent by the AAA-P. Further, the NSSAAF sends the slice update information to the AMF, and correspondingly, the AMF receives the slice update information sent by the NSSAAF, so that the AMF receives the slice update information from the third-party application server.
  • the third-party application server can directly initiate the slice update process for the terminal device, that is, the third-party application server can directly update and control the slice without interacting with the UDM maintained by the operator. Realize slice update, improve slice update efficiency, enhance the third party's ability to control slice services, improve the experience of third-party and operator business cooperation, and help operators expand services.
  • the AMF may initiate an authentication process for the second S-NSSAI, that is, perform an NSSAA process for the second S-NSSAI, so as to authenticate the second S-NSSAI.
  • the AMF can initiate an authentication process for the second S-NSSAI.
  • the NSSAAF process in the related art may be used to authenticate and authorize the second S-NSSAI.
  • the authentication method described in FIG. 6 may be used to authenticate the second S-NSSAI.
  • the authentication process corresponding to step S1103 is an optional step.
  • the AMF may also consider that the AAA-S delivery slice has been authenticated and authorized, and choose to skip S1103 and directly execute step S1104.
  • the AMF sends configuration update information to the terminal device, and correspondingly, the terminal device receives the configuration update information sent by the AMF.
  • the manner in which the terminal performs slice configuration update may be performed according to the configuration update process in the related art.
  • the configuration update information may be sent to the terminal device when the authentication of the second S-NSSAI succeeds.
  • the terminal device may update the slice configuration according to the configuration update information, that is, update the S-NSSAI of the terminal device that is allowed to access with the received second S-NSSAI, thereby completing the slice authentication and updating the locally saved slice.
  • the first S-NSSAI is the switched S-NSSAI and the second S-NSSAI is the S-NSSAI to be switched
  • the first S-NSSAI may be called the old S-NSSAI
  • the second S-NSSAI may be called the old S-NSSAI
  • the second S-NSSAI may be called the old S-NSSAI. Called the new S-NSSAI.
  • the AMF can send configuration update information to the terminal device, and carry the new S-NSSAI (ie the second S-NSSAI) in the configuration update The information is sent to the terminal device, so that the terminal device can update the slice configuration and add a new S-NSSAI to the S-NSSAI that is allowed to access. And, if the old S-NSSAI will cause the S-NSSAI of the terminal equipment to be changed, the AMF can also send configuration update information to the terminal equipment to delete the old S-NSSAI from the S-NSSAI of the terminal equipment.
  • the old slices that have expired can also be notified to the terminal equipment, so that when the expired slices have an impact on the slices allowed to be accessed by the terminal equipment, it is convenient for the terminal equipment to accurately update the slices allowed to access, so as to achieve Accurate updates to slices to improve the effectiveness of slice updates.
  • the slice update information may be, for example, a slice re-authentication message in the re-authentication process of the related art.
  • the re-authentication process in the related art may be reused to realize the - NSSAI certification.
  • FIG. 12 the third-party application server is an authentication network element (AAA-S) as an example for description, and the flow shown in FIG. 12 is described as follows.
  • AAA-S authentication network element
  • the authentication network element determines that the slice accessed by the terminal device is changed from the first slice to the second slice.
  • step S1201 can be understood with reference to the embodiment of step S1201, and the description is not repeated here.
  • the second slice may be an unauthorized authenticated slice, that is, NSSAA has not been performed on the second S-NSSAI corresponding to the second slice before, that is, the slice to be switched by the terminal device is an unauthorized slice.
  • Authorized certified slices that is, NSSAA has not been performed on the second S-NSSAI corresponding to the second slice before, that is, the slice to be switched by the terminal device is an unauthorized slice.
  • the authentication network element generates a slice re-authentication message, and sends the slice re-authentication message to the AAA-P.
  • the AAA-P receives the slice re-authentication message sent by the authentication network element.
  • the slice re-authentication message in S1202 is equivalent to the slice update information in Fig. 11.
  • the reason why the authentication network element generates the slice re-authentication message is to reuse the process of re-authentication for slices in the related art to realize the re-authentication of slices. Second S-NSSAI certification.
  • the slice re-authentication message in this embodiment of the present application includes the second S-NSSAI. And, in an optional implementation manner, the slice re-authentication message may further include the old S-NSSAI used to identify the first slice, that is, the first S-NSSAI.
  • the AAA-P sends the slice re-authentication message to the NSSAAF.
  • the NSSAAF receives the slice re-authentication message sent by the AAA-P.
  • the NSSAAF sends the slice re-authentication message to the AMF, and correspondingly, the AMF receives the slice re-authentication message sent by the NSSAAF.
  • the AMF After receiving the slice re-authentication message, the AMF obtains the second S-NSSAI in it. Further, NSSAA can be performed on the second S-NSSAI, that is, authorization and authentication can be performed on the second S-NSSAI. Specifically, the authentication method in the related art can be used to authenticate the second S-NSSAI, and the description will not be repeated here. .
  • the AMF sends configuration update information to the terminal device, and correspondingly, the terminal device receives the second S-NSSAI sent by the AMF.
  • the terminal device may perform slice configuration update, that is, update the S-NSSAI of the terminal device that is allowed to access with the received second S-NSSAI, thereby completing slice authentication.
  • steps S1206 to S1207 can be understood with reference to the embodiments of steps S1104 to S1105, and the description is not repeated here.
  • the re-authentication process in the related art is to re-authenticate the S-NSSAI that has been authenticated before
  • the re-authentication process of the related technology can be reused to realize the S-NSSAI that has not been authenticated before.
  • a new slice update and slice authentication method is provided, which improves the flexibility of slice management.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be a mobility management network element (eg, AMF) or a chip disposed inside the mobility management network element.
  • the slice management apparatus has the function of implementing the mobility management network elements in the embodiments shown in FIG. 8 to FIG. 9 .
  • the slice management apparatus includes the implementation of the mobility management network elements in the embodiments shown in FIG. 8 to FIG. 9 .
  • the modules or units or means corresponding to the steps executed by the element, the functions, units or means may be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes an initiating unit 1301, a receiving unit 1302, and a sending unit 1303, where:
  • an initiating unit 1301, configured to initiate a slice request, where the slice request includes a terminal identifier of a terminal device
  • the receiving unit 1302 is used to receive the first S-NSSAI from the third-party application server, and the first S-NSSAI is used to identify the slice authorized by the third-party application server for the terminal device;
  • the sending unit 1303 is configured to send the first S-NSSAI to the terminal device.
  • the third-party application server is an authentication network element
  • the initiating unit 1301 is configured to initiate a slice authentication request, where the slice authentication request includes the second S-NSSAI and the terminal identifier, and the second S-NSSAI is used to identify the
  • the data management network element is the slice subscribed by the terminal device; correspondingly, the receiving unit 1302 is configured to receive the authentication result indication information and the first S-NSSAI from the authentication network element.
  • the receiving unit 1302 is further configured to receive slice selection indication information from a terminal device or a data management network element, where the slice selection indication information is used to instruct a third-party application to determine a slice for the terminal device.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be a third-party application server or an authentication network element (eg, AAA-S), or be set inside a third-party application server or an authentication network element chip.
  • the slice management apparatus has the functions of implementing the third-party application server and the authentication network element in the embodiments shown in FIG. 8 to FIG. 9.
  • the slice management apparatus includes executing the first step in the embodiments shown in FIG. 8 to FIG.
  • the modules or units or means corresponding to the steps performed by the third-party application server and the authentication network element, the functions, units or means can be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes a receiving unit 1401, a determining unit 1402, and a sending unit 1403, where:
  • a receiving unit 1401 configured to receive a slicing request from a mobility management network element, where the slicing request includes a terminal identifier of a terminal device;
  • a determining unit 1402 configured to determine the slice authorized by the third-party application server for the terminal device according to the terminal identifier
  • the sending unit 1403 is configured to send the first S-NSSAI to the mobility management network element, where the first S-NSSAI is used to identify the slice authorized by the third-party application server for the terminal device.
  • the third-party application server is an authentication network element
  • the receiving unit 1401 is configured to receive a slice authentication request from a mobility management network element, where the slice authentication request includes the second S-NSSAI and the terminal identifier, the second The S-NSSAI is used to identify the slice subscribed for the terminal device in the data management network element; correspondingly, the sending unit 1403 is used to send the authentication result indication information and the first S-NSSAI to the mobility management network element.
  • the authentication result indication information is used to indicate that the authentication is successful.
  • the second S-NSSAI is the same as the first S-NSSAI, or the second S-NSSAI is different from the first S-NSSAI.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be an authentication network element (eg, AAA-S), or a chip set inside the authentication network element.
  • the slice management apparatus has the function of implementing the authentication network element in the embodiment shown in FIG. 10 .
  • the slice management apparatus includes a module corresponding to the steps performed by the authentication network element in the embodiment shown in FIG. 10 or Units or means, the functions or units or means may be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes a receiving unit 1501, an authentication unit 1502, and a sending unit 1503, where:
  • the receiving unit 1501 is configured to receive a slice authentication request sent from a mobility management network element, where the slice authentication request includes an EAP identification response message of the terminal device and a first S-NSSAI, and the first S-NSSAI is used to identify the data management network element in the is one of the at least two slices subscribed to by the terminal device;
  • the authentication unit 1502 is configured to generate authentication result indication information according to the judgment result of whether the EAP identity response message is authenticated and whether the slice of the first S-NSSAI identity is a slice that the third-party application server allows the terminal device to access. Including EAP success message or EAP failure message;
  • the sending unit 1503 is configured to send the authentication result indication information to the mobility management network element.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be a mobility management network element (eg, AMF), or a chip disposed inside the mobility management network element.
  • the slice management apparatus has the function of implementing the mobility management network element in the embodiment shown in FIG. 10.
  • the slice management apparatus includes the steps required to perform the steps performed by the mobility management network element in the embodiment shown in FIG. 10.
  • the functions or units or means may be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes an initiating unit 1601 and a receiving unit 1602, where:
  • the initiating unit 1601 is configured to initiate a slice authentication request, where the slice authentication request includes an EAP identification response message of the terminal device and a first information S-NSSAI, and the first S-NSSAI is used to identify the at least one subscribed terminal device in the data management network element. one of the two slices;
  • the receiving unit 1602 is configured to receive the authentication result indication information from the authentication network element, wherein the authentication result indication information is whether the authentication network element passes the authentication according to the EAP identification response message and whether the slice of the first S-NSSAI identification is a third-party application server It is generated from the judgment result of the slice that the terminal device is allowed to access.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be a third-party application server or an authentication network element (eg, AAA-S), or be set inside a third-party application server or an authentication network element chip.
  • the slice management apparatus has the function of implementing the third-party application server or the authentication network element in the embodiments shown in FIG. 11 to FIG. 12 .
  • the slice management apparatus includes executing the first step in the embodiments shown in FIGS. 11 to 12 .
  • the modules or units or means corresponding to the steps performed by the third-party application server or the authentication network element, the functions, units or means can be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes a determining unit 1701 and a sending unit 1702, where:
  • a determining unit 1701 configured to determine that the slice that allows the terminal device to access is changed from the first slice to the second slice;
  • the sending unit 1702 is configured to send slice update information to the mobility management network element, where the slice update information includes a second S-NSSAI, and the second S-NSSAI is used to identify the second slice.
  • an embodiment of the present application provides a slice management apparatus, where the slice management apparatus may be a mobility management network element (eg, AMF), or a chip disposed inside the mobility management network element.
  • the slice management apparatus has the function of implementing the mobility management network elements in the embodiments shown in FIG. 11 to FIG. 12 .
  • the slice management apparatus includes the implementation of the mobility management network elements in the embodiments shown in FIG. 11 to FIG. 12 .
  • the modules or units or means corresponding to the steps executed by the element, the functions, units or means may be implemented by software, or by hardware, or by executing corresponding software by hardware.
  • the slice management apparatus in this embodiment of the present application includes a receiving unit 1801 and a sending unit 1802, where:
  • a receiving unit 1801 configured to receive slice update information from a third-party application server, where the slice update information includes a second S-NSSAI, and the second S-NSSAI is used to identify the second slice;
  • the sending unit 1802 is configured to send the second S-NSSAI to the terminal device.
  • the third-party application server is an authentication network element
  • the second slice is an unauthorized slice.
  • the slice management apparatus in this embodiment of the present application may further include an authentication unit 1803 for initiating an authentication of the first slice.
  • the second S-NSSAI performs the authentication process, and when the second S-NSSAI authentication is passed, the configuration update information is sent to the terminal device, and the configuration update information is used to update the slice that the terminal device is allowed to access.
  • the slice update information is a slice re-authentication message.
  • the slice update information further includes the first S-NSSAI used to identify the first slice, and the first slice currently does not allow the terminal device access.
  • an embodiment of the present application further provides a communication device, where the communication device is, for example, a mobility management network element (such as an AMF), and the communication device includes:
  • At least one processor 1901 and a communication interface 1903 communicatively connected to the at least one processor 1901; at least one processor 1901 executes the instructions stored in the memory 1902 by executing the instructions stored in the memory 1902, so that the communication device executes the above-mentioned operations shown in FIG. 8 to FIG. 11 through the communication interface 1903 Method steps performed by the mobility management network element in the embodiment.
  • memory 1902 is external to the communication device.
  • the communication device includes a memory 1902, the memory 1902 is connected to the at least one processor 1901, and the memory 1902 stores instructions executable by the at least one processor 1901.
  • the memory 1902 is optional to the communication device as indicated by dashed lines in FIG. 19 .
  • processor 1901 and the memory 1902 may be coupled through an interface circuit, or may be integrated together, which is not limited here.
  • the specific connection medium between the processor 1901, the memory 1902, and the communication interface 1903 is not limited in the embodiments of the present application.
  • the processor 1901, the memory 1902, and the communication interface 1903 are connected through a bus 1904 in FIG. 19.
  • the bus is represented by a thick line in FIG. 19, and the connection between other components is only for schematic illustration. , is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is shown in FIG. 19, but it does not mean that there is only one bus or one type of bus.
  • an embodiment of the present application further provides a communication device, where the communication device is, for example, an authentication network element (such as AAA-S) or a third-party application server, and the communication device includes:
  • AAA-S authentication network element
  • the communication device includes:
  • At least one processor 2001 and a communication interface 2003 communicatively connected to the at least one processor 2001; at least one processor 2001 executes the instructions stored in the memory 2002 by executing the instructions stored in the memory 2002, so that the communication device executes the above shown in FIG. 8 to FIG. 11 through the communication interface 2003
  • the memory 2002 is located outside the communication device.
  • the communication device includes a memory 2002 , the memory 2002 is connected to the at least one processor 2001 , and the memory 2002 stores instructions executable by the at least one processor 2001 .
  • the memory 2002 is optional to the communication device as indicated by dashed lines in FIG. 20 .
  • processor 2001 and the memory 2002 may be coupled through an interface circuit, or may be integrated together, which is not limited here.
  • the specific connection medium between the processor 2001 , the memory 2002 , and the communication interface 2003 is not limited in the embodiments of the present application.
  • the processor 2001, the memory 2002, and the communication interface 2003 are connected through a bus 2004 in FIG. 20.
  • the bus is represented by a thick line in FIG. 20.
  • the connection between other components is only for schematic illustration. , is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is shown in FIG. 20, but it does not mean that there is only one bus or one type of bus.
  • the processor mentioned in the embodiments of the present application may be implemented by hardware or software.
  • the processor When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor When implemented in software, the processor may be a general-purpose processor implemented by reading software codes stored in memory.
  • the processor may be a central processing unit (central processing unit, CPU), or other general-purpose processors, digital signal processors (digital signal processors, DSP), application specific integrated circuits (application specific integrated circuit, ASIC) , off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • CPU central processing unit
  • DSP digital signal processors
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Eate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • synchronous link dynamic random access memory Synchlink DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module
  • memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.
  • an embodiment of the present application also provides a communication system, the communication system includes the communication device in FIG. 13 and the communication device in FIG. 14 , or includes the communication device in FIG. 15 and the communication device in FIG. 16 , Either the communication device in FIG. 17 and the communication device in FIG. 18 are included, or the communication device in FIG. 19 and the communication device in FIG. 20 are included.
  • an embodiment of the present application further provides a computer-readable storage medium, including a program or an instruction, when the program or instruction is run on a computer, the movement in the above-mentioned embodiments shown in FIG. 8 to FIG. 12 is enabled.
  • the method performed by the performance management network element eg AMF
  • AMF performance management network element
  • an embodiment of the present application further provides a computer-readable storage medium, including a program or an instruction, when the program or instruction is run on a computer, the authentication in the embodiments shown in the foregoing FIG. 8 to FIG. 12 is enabled.
  • the method performed by the network element eg AAA-S
  • AAA-S AAA-S
  • an embodiment of the present application further provides a computer-readable storage medium, including a program or an instruction, when the program or instruction is run on a computer, the first embodiment of the above-mentioned FIG. 8 to FIG.
  • the method executed by the third-party application server is executed.
  • an embodiment of the present application also provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the A method performed by a mobility management network element (eg AMF) is performed.
  • a mobility management network element eg AMF
  • an embodiment of the present application also provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the The method performed by the authentication network element (eg AAA-S) is performed.
  • the authentication network element eg AAA-S
  • an embodiment of the present application also provides a chip, which is coupled to a memory and used to read and execute program instructions stored in the memory, so that the The method executed by the third method application server is executed.
  • an embodiment of the present application also provides a computer program product, including instructions, which, when running on a computer, enable the mobility management network element (eg, AMF) in the embodiments shown in FIG. 8 to FIG. 12 above.
  • the executed method is executed.
  • an embodiment of the present application also provides a computer program product, including instructions, when running on a computer, the authentication network element (eg, AAA-S) in the embodiments shown in the above-mentioned FIG. 8 to FIG. 12 is enabled.
  • the executed method is executed.
  • an embodiment of the present application also provides a computer program product, including instructions, when running on a computer, the method executed by the third-party application server in the embodiments shown in FIG. 8 to FIG. 12 can be implement.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another, for example, from a website site, computer, server, or data center via Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, fiber optic, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, digital versatile disc (DVD)), or semiconductor media (eg, solid state disk (SSD) ))Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及一种切片管理方法、装置及通信设备，涉及通信技术领域，用于提高对切片的管理效率，增强第三方对终端设备的切片控制能力。所述方法包括：移动性管理网元发起切片请求，所述切片请求包括终端设备的终端标识；所述移动性管理网元接收来自第三方应用服务器的第一S-NSSAI，所述第一S-NSSAI用于标识第三方应用服务器为所述终端设备授权的切片；所述移动性管理网元向所述终端设备发送所述第一S-NSSAI。

Description

一种切片管理方法、装置及通信设备
相关申请的交叉引用
本申请要求在2020年09月22日提交中国国家知识产权局、申请号为202011004194.4、申请名称为“一种切片管理方法、装置及通信设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种切片管理方法、装置及通信设备。
背景技术
目前，为更好的支持第三方的切片业务，运营商提出了新的场景需求：第三方业务可以向运营商定制终端设备发放给用户使用，并且向运营商租用了多种类型的切片，不同类型的切片为用户提供的业务体验不同。这些终端设备和运营商进行签约能够获得运营商提供的网络连接服务，但用户具体使用哪一个切片的签约并不在运营商网络管理控制，而是由第三方管理和控制，即用户接入移动网络后，由第三方授权确定用户具体使用哪个切片，后续某个时刻如果用户想要更改切片签约，比如获得更高的服务质量，则可以向第三方购买，然后第三方跟运营商的移动网络交互，以更新用户使用的切片。
由于运营商维护的统一数据管理(unified data management，UDM)网元上存储的数据是比较重要的，并且也是涉及到用户隐私，因此相关技术中是由第三方将用户签约的切片提交给运营商，再由运营商的工作人员更新运营商维护的UDM，以实现对用户的切片签约数据的更新管理。
然而，这种管理方式效率低下，可能并不能适应频繁动态更改用户切片签约的需求，也不利于第三方自身对切片业务进行控制，因此需要相应的解决方案。
发明内容
本申请实施例提供一种切片管理方法、装置及通信设备，用于提高切片管理效率，增强第三方对终端设备的切片控制能力。
第一方面，提供一种管理切片的方法，该方法中，移动性管理网元在发起切片请求后，可以接收来自第三方应用服务器的第一S-NSSAI，该第一S-NSSAI用于标识第三方应用服务器为终端设备授权的切片，进而再将第一S-NSSAI向终端设备发送。
在上述方案中，可以通过第三方应用服务器直接为终端设备分配经第三方直接授权的切片，也就是说，用户的签约数据可以直接存放在第三方应用服务器中，这样，注册分配切片时，可以直接从第三方应用服务器处获得用户在第三方中真正授权的切片，而无需再从运营商维护的UDM中去获取，这样可以减少从第三方到运营商进行更新的步骤，由第三方直接对切片进行管理，提高了切片管理效率，增强了第三方对终端设备的切片业务控制能力。
在一种可能的实现方式中，第三方应用服务器为认证网元，移动性管理网元发起切片 认证请求，该切片认证请求包括第二S-NSSAI和终端设备的终端标识，该第二S-NSSAI用于标识在数据管理网元中为终端设备签约的切片；对应的，移动性管理网元接收来自认证网元的认证结果指示信息和第一S-NSSAI。
由于在数据管理网元(例如UDM)中为终端设备签约的切片与第三方实际为终端设备授权的切片并不相同，所以可以对从UDM中获取签约的切片(即第二S-NSSAI标识的切片)进行验证，最终返回第三方应用服务器实际为终端设备授权的S-NSSAI(即第一S-NSSAI)，这样，可以通过第三方应用服务器直接对切片进行管理。
在一种可能的实现方式中，移动性管理网元接收来自终端设备或数据管理网元的切片选择指示信息，该切片选择指示信息用于指示由第三方应用为终端设备确定切片。
在上述方案中，可以通过切片选择指示信息来指示移动性管理网元哪些终端设备的切片是需要由第三方应用直接确定的，便于移动性管理网元明确哪些终端设备的切片是需要从第三方获取，提高了切片分配的准确性。
第二方面，提供一种切片管理的方法，在该方法中，第三方应用服务器接收来自移动性管理网元的切片请求，该切片请求包括终端设备的终端标识；再根据所述终端标识确定第三方应用服务器为终端设备授权的切片；然后向移动性管理网元发送第一S-NSSAI，该第一S-NSSAI用于标识第三方应用服务器为所述终端设备授权的切片。
在上述方案中，可以通过第三方应用服务器直接为终端设备分配经第三方直接授权的切片，也就是说，用户的签约数据可以直接存放在第三方应用服务器中，这样，注册分配切片时，可以直接从第三方应用服务器处获得用户在第三方中真正授权的切片，而无需再从运营商维护的UDM中去获取，这样可以减少从第三方到运营商进行更新的步骤，由第三方直接对切片进行管理，提高了切片管理效率，增强了第三方对终端设备的切片业务控制能力。
在一种可能的实现方式中，第三方应用服务器为认证网元，认证网元接收来自移动性管理网元的切片认证请求，该切片认证请求包括第二S-NSSAI和终端设备的终端标识，该第二S-NSSAI用于标识在数据管理网元中为终端设备签约的切片；进一步地，认证网元向移动性管理网元发送认证结果指示信息和第一S-NSSAI。
在上述方案中，移动性管理网元可以对在UDM中签约的第二S-NSSAI进行认证，最后接收来自第三方应用服务器发送的通过第三方应用服务器实际授权的第一S-NSSAI，这样，通过地方应用服务器可以实现对切片的直接管理，增强了第三方对终端设备的切片业务控制能力。
在上述第一方面和第二方面的各个方案中，认证结果指示信息用于指示认证成功。
在上述第一方面和第二方面的各个方案中，第二S-NSSAI与第一S-NSSAI相同，或者，第二S-NSSAI与第一S-NSSAI不同。
第三方面，提供一种切片管理方法，在该方法中，认证网元接收来自移动性管理网元发送的切片认证请求，该切片认证请求包括终端设备的EAP标识响应消息和第一S-NSSAI，该第一S-NSSAI用于标识在数据管理网元中为终端设备签约的至少两个切片中的一个切片；
再根据EAP标识响应消息是否通过认证且第一S-NSSAI标识的切片是否是第三方应用服务器允许终端设备接入的切片的判断结果，生成认证结果指示信息，该认证结果指示信息包括EAP成功消息或者EAP失败消息；进一步地，向移动性管理网元发送认证结果指示 信息。
第四方面，提供一种切片管理方法，在该方法中，移动管理网元发起切片认证请求，该切片认证请求包括终端设备的EAP标识响应消息和第一S-NSSAI，第一S-NSSAI用于标识在数据管理网元中为终端设备签约的至少两个切片中的一个切片；移动管理网元再接收来自认证网元的认证结果指示信息，该认证结果指示信息是认证网元根据EAP标识响应消息是否通过认证且第一S-NSSAI标识的切片是否是第三方应用服务器允许终端设备接入的切片的判断结果生成的。
在第三方面和第四方面的方案中，在相关技术中的认证流程的基础上，AMF可以判断待验证的S-NSSAI标识的切片到底是否是第三方应用服务器实际允许终端设备接入的切片，这样通过二重验证的方式让第三方参与了切片的认证，这样得到的认证结果是考虑了第三方对待验证切片的实际授权情况，实现了第三方对切片的直接管理和控制。
第五方面，提供一种切片管理方法，在该方法中，第三方应用服务器确定允许终端设备接入的切片由第一切片变为第二切片；进而，第三方应用服务器向移动性管理网元发送切片更新信息，该切片更新信息包括第二S-NSSAI，该第二S-NSSAI用于标识第二切片。
在该方案中，可以由第三方应用服务器直接发起对终端设备的切片更新流程，也就是说，第三方应用服务器可以直接对切片进行更新控制，无需再通过与运营商维护的UDM进行交互才能实现切片更新，提高了切片更新效率，增强了第三方对切片的业务控制能力，提高了第三方和运营商业务合作的体验，有利于运营商拓展业务。
第六方面，提供一种切片管理方法，在该方法中，移动性管理网元接收来自第三方应用服务器的切片更新信息，该切片更新信息包括第二S-NSSAI，该第二S-NSSAI用于标识第二切片；进一步地，移动性管理网元向终端设备发送第二S-NSSAI。
第六方面的技术方案的技术效果可以参见第五方面的技术效果描述。
在一种可能的实现方式中，第三方应用服务器为认证网元，移动性管理网元还可以发起对第二S-NSSAI进行认证的流程；并在对第二S-NSSAI认证通过时，向终端设备发送配置更新信息，该配置更新信息用于更新终端设备允许接入的切片。
在上述方案中，还可以对更新的切片(即第二S-NSSAI所标识的切片)进行认证，这样可以提高终端设备接入切片的安全性和有效性。
在一种可能的实现方式中，切片更新信息为切片重认证消息，例如为相关技术中进行切片重认证过程中的重认证消息。
在该方案中，可以复用相关技术中的重认证流程来实现对第二S-NSSAI的认证。因为相关技术中的重认证流程是对之前已经进行过认证的S-NSSAI进行重认证，而本申请实施例中，通过复用相关技术的重认证流程可以实现对之前未认证过的S-NSSAI进行认证，提供了一种新的切片更新和切片认证方式，提高了切片管理的灵活性。
在一种可能的实现方式中，切片更新信息还包括用于标识第一切片的第一S-NSSAI，第一切片当前不允许终端设备接入。
在该方案中，可以将已经失效的切片也告知终端设备，这样在失效的切片对终端设备的允许接入的切片有影响时，可便于终端设备准确地更新允许接入的切片，以实现对切片的准确更新，提高切片更新的有效性。
第七方面，提供一种切片管理装置，该切片管理装置可以是移动性管理网元，或者是设置在移动性管理网元内部的芯片，该切片管理装置包括用于执行上述第一方面或第一方 面任一种可能的实现方式中所述方法的模块。
第八方面，提供一种切片管理装置，该切片管理装置可以是认证网元或者是第三方应用服务器，或者是设置在认证网元或者是第三方应用服务器内部的芯片，该切片管理装置包括用于执行上述第二方面或第二方面任一种可能的实现方式中所述方法的模块。
第九方面，提供一种切片管理装置，该切片管理装置可以是认证网元或者是第三方应用服务器，或者是设置在认证网元或者是第三方应用服务器内部的芯片，该切片管理装置包括用于执行上述第三方面或第三方面任一种可能的实现方式中所述方法的模块。
第十方面，提供一种切片管理装置，该切片管理装置可以是移动性管理网元，或者是设置在移动性管理网元内部的芯片，该切片管理装置包括用于执行上述第四方面或第四方面任一种可能的实现方式中所述方法的模块。
第十一方面，提供一种切片管理装置，该切片管理装置可以是认证网元或者是第三方应用服务器，或者是设置在认证网元或者是第三方应用服务器内部的芯片，该切片管理装置包括用于执行上述第五方面或第五方面任一种可能的实现方式中所述方法的模块。
第十二方面，提供一种切片管理装置，该切片管理装置可以是移动性管理网元，或者是设置在移动性管理网元内部的芯片，该切片管理装置包括用于执行上述第六方面或第六方面任一种可能的实现方式中所述方法的模块。
第十三方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第一方面或第一方面任一种可能的实现方式中所述的方法。
第十四方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第二方面或第二方面任一种可能的实现方式中所述的方法。
第十五方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第三方面或第三方面任一种可能的实现方式中所述的方法。
第十六方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第四方面或第四方面任一种可能的实现方式中所述的方法。
第十七方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第五方面或第五方面任一种可能的实现方式中所述的方法。
第十八方面，提供一种通信设备，包括：至少一个处理器；以及与所述至少一个处理器通信连接的通信接口；所述至少一个处理器通过执行存储器存储的指令，使得所述通信装置通过所述通信接口执行如第六方面或第六方面任一种可能的实现方式中所述的方法。
第十九方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第一方面或第一方面任一种可能的实现方式中所述的方法被执行。
第二十方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第二方面或第二方面任一种可能的实现方式中所述的方法被执行。
第二十一方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第三方面或第三方面任一种可能的实现方式中所述的方法被执 行。
第二十二方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第四方面或第四方面任一种可能的实现方式中所述的方法被执行。
第二十三方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第五方面或第五方面任一种可能的实现方式中所述的方法被执行。
第二十四方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得如第六方面或第六方面任一种可能的实现方式中所述的方法被执行。
第二十五方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第一方面或第一方面任一种可能的实现方式中所述的方法被执行。
第二十六方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第二方面或第二方面任一种可能的实现方式中所述的方法被执行。
第二十七方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第三方面或第三方面任一种可能的实现方式中所述的方法被执行。
第二十八方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第四方面或第四方面任一种可能的实现方式中所述的方法被执行。
第二十九方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第五方面或第五方面任一种可能的实现方式中所述的方法被执行。
第三十方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得第六方面或第六方面任一种可能的实现方式中所述的方法被执行。
第三十一方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第一方面或第一方面任一种可能的实现方式中所述的方法被执行。
第三十二方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第二方面或第二方面任一种可能的实现方式中所述的方法被执行。
第三十三方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第三方面或第三方面任一种可能的实现方式中所述方法的被执行。
第三十四方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第四方面或第四方面任一种可能的实现方式中所述方法的被执行。
第三十五方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第五方面或第五方面任一种可能的实现方式中所述方法的被执行。
第三十六方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述第六方面或第六方面任一种可能的实现方式中所述方法的被执行。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
图1为基于服务化架构的5G网络架构示意图；
图2为基于点对点接口的5G网络架构示意图；
图3为网络切片的一种示意图；
图4为终端设备的注册流程的示意图；
图5为确定是否要执行NSSAA流程的示意图；
图6为NSSAA流程所涉及的步骤的流程图；
图7为切片重认证流程所涉及的步骤的流程图；
图8为本申请实施例中的切片管理方法的交互流程图；
图9为本申请实施例中的切片管理方法的另一交互流程图；
图10为本申请实施例中的切片管理方法的另一交互流程图；
图11为本申请实施例中的切片管理方法的另一交互流程图；
图12为本申请实施例中的切片管理方法的另一交互流程图；
图13为本申请实施例中的切片管理装置的结构示意图；
图14为本申请实施例中的另一切片管理装置的结构示意图；
图15为本申请实施例中的另一切片管理装置的结构示意图；
图16为本申请实施例中的另一切片管理装置的结构示意图；
图17为本申请实施例中的另一切片管理装置的结构示意图；
图18为本申请实施例中的另一切片管理装置的结构示意图；
图19为本申请实施例中的通信设备的结构示意图；
图20为本申请实施例中的另一通信设备的结构示意图。
具体实施方式
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)终端设备，包括向用户提供语音和/或数据连通性的设备，例如可以包括具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音和/或数据。该终端设备可以包括用户设备(user equipment，UE)、终端、无线终端设备、移动终端设备、设备到设备通信(device-to-device，D2D)终端设备、车到一切(vehicle-to-everything，V2X)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)终端设备、物联网(internet of things，IoT)终端设备、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、远程站(remote station)、接入点(access point，AP)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、或用户装备(user device)等。例如，可以包括移动电话(或称为“蜂窝”电话)，具有移动终端设备的计算机，便携式、袖珍式、手持式、计算机内置的移动装置等。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、等设备。还包括受限设备，例如功耗较低的设备，或存储能力有限的设备，或计算能力有限的设备等。例如包括条码、射频识别(radio frequency identification，RFID)、传感器、全球定位系统(global positioning system，GPS)、激光扫描器等信息传感设备。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
而如上介绍的各种终端设备，如果位于车辆上(例如放置在车辆内或安装在车辆内)，都可以认为是车载终端设备，车载终端设备例如也称为车载单元(on-board unit，OBU)。
(2)本申请实施例中，“网络切片”和“切片”是同一概念，指的是同一内容，在不同的地方使用其中一种描述，二者可以互换。
(3)“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A、B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。
以及，除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。例如，第一信息和第二信息，只是为了区分不同的信令，而并不是表示这两种信息的内容、优先级、发送顺序或者重要程度等的不同。
如上介绍了本申请实施例涉及的一些概念，下面介绍本申请实施例的技术特征。
请参考图1，为基于服务器架构的第五代(5th generation，5G)网络架构示意图，也是本申请实施例的一种应用场景的示意图。图1所示的5G网络架构可包括三部分，分别是终端设备部分、数据网络(data network，DN)部分和运营商网络部分。其中，运营商网络部分可包括以下网元中的一个或多个：鉴权服务器功能(authentication server function，AUSF)网元、网络开放功能(network exposure function，NEF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、统一数据库(Unified Data Repository，UDR)网元、NRF网元、应用功能(application function，AF)网元、AMF网元、SMF网元、无线接入网(radio access network，RAN)网元以及用户面功能(user plane function，UPF)网元等。上述运营商网络部分中，除无线接入网部分之外的部分可以称为核心网部分。
在该网络架构中，网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、NRF网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、应用功能(application function，AF)网元、鉴权服务功能(authentication server function，AUSF)网元、AMF网元和SMF网元，这些网元两两之间，都可以基于服务的方法进行通信，当然，其中的两个网元要进行通信，需要一个网元向另一个网元开放了相应的服务方法。图1中，Nnssf可视为NSSF的服务接口，同理，Nnef为NEF的服务接口，Npcf为PCF的服务接口，Nudm为UDM的服务接口，Uudr为UDR的服务接口，Naf为AF的服务接口，Nausf为AUSF的服务接口，Namf为AMF的服务接口，Nsmf为SMF的服务接口。另外， AMF与终端设备可通过N1接口通信，AMF与RAN可通过N2接口通信，SMF与UPF可通过N4接口通信，终端设备与RAN之间进行空口通信，RAN和UPF可通过N3接口通信，UPF与DN可通过N6接口通信。
为了更易于理解，下面对图1所示的部分功能网元进行简单的介绍。
移动性管理功能网元，在第四代(4th generation，4G)系统中例如为移动性管理实体(mobility management entity，MME)网元，在5G系统中例如为AMF网元，当然本申请实施例不限于此，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述AMF网元的功能的网元。以移动性管理功能网元是AMF网元为例，AMF网元主要负责与无线对接，终结RAN控制面(control plane，CP)接口，也就是N2接口，终结非接入层(non-access-stratum，NAS)及NAS加密和完整性保护，注册管理，连接管理，可达性管理，移动性管理，传递用户设备(user equipment，UE)和SMF间的会话管理(session management，SM)消息，或UE的移动性通知等功能。
存储功能网元，在5G系统中，例如为NRF网元，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述NRF网元的功能的网元。以存储功能网元是NRF网元为例，NRF网元可负责网元的注册和发现功能，并维护网元的信息，例如，维护该网元的实例标识、类型、公共陆地移动网(public land mobile network，PLMN)、网络切片相关的标识、IP地址、该网元的能力、及支持的服务等。
网络切片相关的认证和授权功能网元NSSAAF，NSSAAF和AAA-S交互，在图1中并未画出。
认证授权计费功能网元，在5G系统中例如为验证、授权和记账服务器(authentication、authorization、accounting-service，AAA-S)，在其他通信系统中也可以通过其他网元实现，例如在未来通信系统中可以是具有上述AAA-S的功能的网元。以认证授权计费功能网元是AAA-S为例，AAA-S的主要目的是管理哪些用户可以访问网络服务器，具有访问权的用户可以得到哪些服务，以及如何对正在使用网络资源的用户进行计费处理等。AAA-S在图1中并未画出，其中AAA-S可以与NSSAAF直接通信，或者AAA-S通过AAA-代理(proxy-P)与NSSAAF进行通信。AAA-S可以由运营商部署或者由第三方部署。在漫游场景中，AAA-S位于归属地PLMN(home PLMN，HPLMN)。
NSSF网元，负责确定网络切片实例，选择AMF网元等。
SMF网元，可以提供会话建立、修改或释放等会话管理功能，包含UPF网元和接入网(access network，AN)节点间的隧道维护功能、UE的互联网协议(internet protocol，IP)地址分配和管理、动态主机控制协议(dynamic host control protocol，DHCP)、选择和控制用户面(user plane，UP)功能、配置UPF路由功能、终结策略控制功能接口、计费、漫游功能、或策略控制相关等功能。
PCF网元，包含策略控制决策和基于流计费控制的功能，包含用户签约数据管理功能，策略控制功能，计费策略控制功能，服务质量(quality of service，QoS)控制等等；
UDM网元，负责管理签约数据，当签约数据有修改时，负责通知相应的网元。
UDR网元，存储和检索签约数据、策略数据和公共架构数据等，供UDM网元、PCF网元或NEF网元获取相关数据。UDR网元要能够针对不同类型的数据如签约数据、策略数据有不同的数据接入鉴权机制，以保证数据接入的安全性。UDR网元对于非法的服务化操作或者数据接入请求要能够返回携带合适原因值的失败响应。
AF网元，应用服务器，向终端设备提供某种应用层服务。AF网元在向终端设备提供服务时，对QoS策略(policy)和计费(charging)策略有一定要求，且需要通知网络。同时，AF网元也需要核心网反馈应用的相关信息。
NEF网元，主要支持网络能力开放功能，对外开放网络能力和服务。3GPP NF通过NEF网元向其他NF发布功能和事件。NEF网元开放的能力和事件可以安全地开放给第三方应用。NEF网元使用UDR的标准化接口(Nudr)将结构化数据进行存储/检索。将AF网元的交换信息与内部网络功能的交换信息进行翻译。例如，它将在AF-服务(Service)-标识符(Identifier)和内部5G核心信息(如数据网络名称(data network name，DNN)或S-NSSAI等)之间进行转换。
AUSF网元，负责鉴权功能以及负责执行网络切片鉴权授权流程。
UPF网元，是用户面数据转发的实体，作为数据网络互联的外部协议数据单元(protocol data unit，PDU)会话(session)，具有报文路由和转发、报文检测、用户面部分策略执行、合法监听、流量使用报告、或QoS处理等功能。
为使得行文更简洁，在后文中对于各个网元均使用简称，省掉“网元”两个字。例如，将AMF网元简称为AMF，NRF网元简称为NRF，接入网网元简称为RAN，SMF网元简称为SMF，等等。
另外，在介绍图1所示的网络架构时提到了服务方法的概念，具体的，在5G系统中，目前认为控制面的网元之间，可以通过基于服务的方法进行交互，用户面的网元之间，可以基于点对点的方法进行交互。例如在5G系统中，NRF作为控制面的网元，可以开放一些服务方法，其他设备可以通过这些服务方法来与NRF进行交互。
请再参考图2，为基于点对点接口的5G网络架构示意图，也是本申请实施例的另一种应用场景的示意图。图2中的各个网元的功能介绍等可以参考对于图1中对应的网元的介绍，不再赘述。图1与图2的主要区别在于，图2中的各个网元之间的接口是点对点的接口，而图1中的各个网元之间的接口是服务化的接口。
在5G时代，将有数以千亿计的物联网设备接入网络，不同类型的应用场景对网络的需求是差异化的，有的甚至是相互冲突的。通过单一网络同时为不同类型的应用场景提供服务，会导致网络架构异常复杂、网络管理效率和资源利用效率低下。为此提出了网络切片技术，5G网络切片技术通过在同一网络基础设施上虚拟独立逻辑网络的方式为不同的应用场景提供相互隔离的网络环境，使得不同应用场景可以按照各自的需求定制网络功能和特性，能够切实保障不同业务的QoS需求。5G网络切片要实现的目标是将终端设备、接入网资源、核心网资源以及网络运维和管理系统等进行有机组合，为不同商业场景或者业务类型提供能够独立运维的、相互隔离的完整网络。可参考图3，为网络切片的一种示意图。图3包括三个网络切片，分别为关键(critical)机器类通信(machine type of communication，MTC)切片、海量(massive)MTC切片以及移动宽带(mobile broadband，MBB)切片。在图3中，critical MTC切片对应的终端设备可以包括车辆等；massive MTC切片对应的终端设备可以包括一些测量表等，例如电表或燃气表；MBB切片对应的终端设备可以包括手机或个人计算机(personal computer，PC)等。
多种多样的场景对第三代合作伙伴计划(3rd generation partnership project，3GPP)生态系统提出了不同的需要：计费、策略、安全、移动性等。3GPP强调了网络切片之间不相互影响，例如突发的大量的抄表业务不应该影响正常的移动宽带业务。为了满足多样性 需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同类型业务的实例部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。
当核心网部署了网络切片，在终端设备初始附着到网络时，就会触发网络切片的选择过程。网络切片的选择过程取决于用户的签约数据、本地配置信息、漫游协议、或运营商的策略等参数中的一种或多种，在网络切片的选择过程中，需要综合考虑以上参数，才能为终端设备选择最佳的切片类型。
当终端设备需要接入某个网络切片，终端设备可以提供请求(requested)网络切片选择辅助信息(network slice selection assistance information，NSSAI)给核心网设备，用于核心网设备为该终端设备选择网络切片实例。具体地，终端设备可以向核心网提供由一组参数组成的requested NSSAI，为该终端设备选择网络切片实例。这一组参数例如包括一个或多个S-NSSAI，其中的一个S-NSSAI就可以表示终端设备请求接入的一个网络切片。
在5G网络中，当终端设备需要使用网络服务，需要先向网络进行注册。终端设备可能会在如下几种场景中发起注册流程：
(1)终端设备初次注册到5G网络；
(2)当终端设备移动出原来注册的区域时，需要进行移动性注册更新；
(3)终端设备进行周期性注册更新。
在注册过程中，可能会触发一个或多个PDU会话的建立。例如在终端设备进行移动性注册更新的场景下，终端设备有上行数据需要发送，此时在注册流程中会创建PDU会话。下面请参考图4，为终端设备进行注册的流程。
S401、终端设备向RAN发送注册请求(registration request)消息，RAN接收来自终端设备的注册请求消息。
该注册请求消息例如通过AN消息(message)发送至RAN。
S402、RAN根据无线接入技术(radio access technology，RAT)和注册请求消息所请求的网络切片的标识选择AMF。
如果注册请求消息未携带5G全球唯一UE临时标识(globally unique temporary UE identity，GUTI)，或者虽然注册请求消息中携带了5G GUTI，但该5G GUTI不能指示一个合法的AMF，则RAN可以根据该终端设备支持的RAT和注册请求消息所请求的网络切片的标识选择AMF。或者，如果终端设备处于无线资源控制(radio resource control，RRC)连接(connected)态，则RAN可以根据已有的RRC连接，将该注册请求消息直接转发给对应的AMF，即，无需执行S402，而是可以执行S403。
网络切片的标识例如为S-NSSAI。注册请求消息可以携带一个或多个S-NSSAI，其中的一个S-NSSAI可以指示一个网络切片。这一个或多个S-NSSAI所指示的网络切片就是终端设备请求接入的网络切片。
S403、RAN将注册请求消息发送给AMF，AMF接收来自RAN的注册请求消息。
即，RAN将注册请求消息转发给AMF。注册请求消息例如为N2消息(message)。在N2消息中，可以包括N2参数、注册消息、该终端设备的接入信息、PDU会话信息以及该终端设备的上下文请求等信息。
S404、新侧AMF调用服务化操作Namf_通信(communication)_UE上下文(context)传输(Transfer)向旧侧AMF发送消息，旧侧AMF接收来自新侧AMF的该消息。在图4 中，将调用服务化操作Namf_Communication_UE Context Transfer传输的消息称为UE上下文传输消息。该消息用于获取该终端设备的上下文。
S404是可选的步骤，如果服务于该终端设备的AMF发生了改变，则可以执行S404。如果服务于该终端设备的AMF未发生改变，可以不必执行S404。
S405、旧侧AMF调用服务化操作Namf_Communication_UE Context Transfer响应(response)向新侧AMF发送消息，新侧AMF接收来自旧侧AMF的该消息。在图4中，将调用服务化操作Namf_Communication_UE Context Transferresponse传输的消息称为UE上下文传输响应消息。该消息包括该终端设备的上下文。
S404和S405是可选的步骤，如果服务于该终端设备的AMF发生了改变，则可以执行S404和S405。如果服务于该终端设备的AMF未发生改变，可以不必执行S404和S405。
S406、新侧AMF向终端设备发送身份请求(identity request)消息，终端设备接收来自新增AMF的身份请求消息。
如果终端设备未提供订阅隐藏标识(subscription concealed identifier，SUCI)，并且新侧AMF从旧侧AMF也未获取到SUCI，则新侧AMF可以向终端设备发送identity request消息，以从终端设备获取SUCI。
S407、终端设备向新侧AMF发送身份响应(identity response)消息，新侧AMF接收来自终端设备的identity response消息。该identity response消息包括SUCI。
S406和S407是可选的步骤。
S408、执行鉴权流程。该鉴权流程是UE永久标识的主鉴权流程。
例如，AMF根据SUPI或SUCI选择一个AUSF为终端设备进行鉴权。其中，在紧急注册时，AMF可跳过鉴权过程，即，S408也是可选的步骤。
S409、新侧AMF调用服务化操作Namf_Communication_注册完成通知(registration complete notify)向旧侧AMF发送消息，旧侧AMF接收来自新侧AMF的该消息。
该消息用于通知旧侧AMF，终端设备已经在新侧AMF上完成注册。在图4中，将调用服务化操作Namf_Communication_Registration Complete Notify传输的消息称为注册完成消息。
S410、新侧AMF向终端设备发送身份请求(identity request)消息，终端设备接收来自新侧AMF的identity request消息。以及，终端设备向新侧AMF发送身份响应(identity response)消息，新侧AMF接收来自终端设备的identity response消息。
其中，如果新侧AMF从终端设备的上下文和旧侧AMF中都未获取到永久设备标识(permanent equipment identifier，PEI)，则新侧AMF向终端设备发送identity request消息以请求获取PEI。终端设备向新侧AMF回复identity response消息，identity response消息可携带PEI。
S411、新侧AMF调用服务化操作N5g-eir_设备身份验证(equipment identity check)_获取(Get)向设备识别寄存器(equipment identity register，EIR)发送消息，EIR接收来自新侧AMF的该消息。该消息用于发起移动设备标识(mobile equipment identity，ME identity)的核查。在图4中将调用服务化操作N5g-eir_Equipment Identity Check_Get传输的消息称为设备身份验证获取消息。
S412、新侧AMF基于SUPI选择UDM。该UDM可以选择一个UDR实例。
其中，S409～S412均为可选的步骤。
S413a、新侧AMF调用服务化操作Nudm_UECM_Registration向UDM进行注册，例如新侧AMF调用服务化操作Nudm_UECM_Registration向UDM发送消息，UDM接收来自新侧AMF的该消息，该消息用于新侧AMF注册到UDM。之后UDM向新侧AMF发送注册响应消息，即S413a中由UDM指向新侧AMF的箭头所表示的消息。在图4中，将调用服务化操作Nudm_UECM_Registration传输的消息称为注册消息。
S413b、新侧AMF调用服务化操作Nudm_SDM_Get向UDM发送消息，UDM接收来自新侧AMF的该消息，该消息用于请求获得终端设备的签约数据。之后UDM向新侧AMF发送获取响应消息，即S413b中由UDM指向新侧AMF的箭头所表示的消息，获取响应消息可以包括终端设备的签约数据。在图4中，将调用服务化操作Nudm_SDM_Get传输的消息称为签约数据获取消息。
S413c、新侧AMF调用服务化操作Nudm_SDM_订阅(subscribe)向UDM发送消息，UDM接收来自AMF的该消息，该消息用于订阅签约数据变更通知的服务。在图4中，将调用服务化操作Nudm_SDM_Subscribe传输的消息称为签约数据变更订阅消息。之后，当订阅的签约数据发生变更时，UDM向新侧AMF发送订阅响应消息，即S413c中由UDM指向新侧AMF的箭头所表示的消息，订阅响应消息可以包括签约数据已变更的通知信息。
S413d、UDM调用服务化操作Nudm_UECM_去注册通知(deregistration notification)向旧侧AMF发送消息，旧侧AMF接收来自UDM的该消息，该消息可用于去注册。在图4中，将调用服务化操作Nudm_UECM_Deregistration Notification传输的消息称为去注册通知消息。
如果UDM存储了与旧侧AMF之间的联系，则UDM可以通过服务化操作Nudm_UECM_Deregistration Notification向旧侧AMF发送消息，以通知旧侧AMF删除该终端设备的上下文。旧侧AMF在接收该消息后，还可以向SMF发起服务化操作Nsmf_PDU Session_释放会话管理上下文(release SM context)，以通知SMF，该终端设备已经从网络中去注册。SMF收到该服务化操作Nsmf_PDU Session_Release SM Context的通知后，将释放PDU会话。
S413e、旧侧AMF调用服务化操作Nudm_SDM_去订阅(unsubscribe)向UDM发送消息，UDM接收来自旧侧AMF的该消息，该消息用去订阅，即，用于取消对该终端设备的签约数据的订阅。在图4中，将调用服务化操作Nudm_SDM_unsubscribe传输的消息称为去订阅消息。
其中，S413d和S413e是可选的步骤。
S414、新侧AMF选择PCF。
如果新侧AMF决定与PCF建立策略联系，例如当新侧AMF还没有获取到终端设备的接入和移动性策略，或者新侧AMF没有合法的接入和移动性策略等场景下，新侧AMF会选择PCF。此时，如果新侧AMF已从旧侧的AMF处获取了PCF身份号(ID)，则新侧AMF可以直接定位到该PCF，而无需执行S414。或者，如果新侧AMF已从旧侧的AMF处获取了PCF ID，但新侧AMF无法定位到该PCF ID所对应的PCF，或者新侧AMF没有从旧侧AMF获取到PCF ID，则新侧AMF会选择一个新PCF，即，执行S414。因此，S414是可选的步骤。
S415、新侧AMF与选择的PCF建立AM策略关联。
在选择PCF后，新侧AMF与该PCF建立AM策略关联。S415是可选的步骤。
S416、新侧AMF调用服务化操作Nsmf_PDU Session_更新会话管理上下文请求(update SM context request)向SMF发送消息，SMF接收来自新侧AMF的该消息。该消息可请求激活PDU会话的用户面连接。在图4中，将调用服务化操作Nsmf_PDU Session_Update SM Context Request传输的消息称为更新会话管理上下文请求消息。
若在注册请求消息中包含需要被激活的PDU会话，AMF通过服务化操作Nsmf_PDUSession_UpdateSMContext Request向SMF发送消息，该消息用于激活PDU会话的用户面连接。若PDU会话状态指示它在UE已经被释放，则AMF通知SMF释放PDU会话相关网络资源。若SMF订阅了UE相关的移动性事件通知，AMF根据需要向SMF发送通知。
S417、新侧AMF向(non-3GPP interworking function，N3IWF)发送N2AMF移动请求(N2 AMF mobility request)消息，N3IWF接收来自新侧AMF的N2 AMF mobility request消息。N2 AMF mobility request消息用于请求创建一个指向N3IWF的NG接口的UE连接。在图4中，将N2 AMF mobility request消息称为移动请求消息。
S418、N3IWF向新侧AMF发送N2AMF移动响应(N2 AMF mobility response)消息，新侧AMF接收来自N3IWF的N2 AMF mobility response消息。在图4中，将N2 AMF mobility response消息称为移动响应消息。
其中，如果旧侧AMF与N3IWF网元存在NG接口的UE连接，则新侧AMF会向N3IWF网元发送N2 AMF mobility request消息。而如果旧侧AMF与N3IWF网元不存在NG接口的UE连接，则新侧AMF不向N3IWF网元发送N2 AMF mobility request消息。因此，S417和S418是可选的步骤。
S419、旧侧AMF向PCF发送AMF-初始策略关联终止(initiated policy association termination)消息，PCF接收来自旧侧AMF的AMF-initiated policy association termination消息。AMF-initiated policy association termination消息用于删除旧侧AMF与PCF之间的连接。
其中，如果旧侧AMF之前发起了与PCF的策略联系，则旧侧AMF向PCF发送AMF-initiated policy association termination消息，而如果旧侧AMF之前未发起与PCF的策略联系，则旧侧AMF不必向PCF发送AMF-initiated policy association termination消息。因此S419为可选的步骤。
S420、新侧AMF向终端设备发送注册接受(registration accept)消息，终端设备接收来自新侧AMF的registration accept消息。registration accept消息用于通知终端设备，该终端设备的注册请求被接受。在Registration Accept消息中可包含局域数据网络(local area data network，LADN)信息以及仅移动初始化连接(mobile initiated connection only，MICO)模式等。
S421、终端设备向新侧AMF发送注册完成(registration complete)消息，新侧AMF接收来自终端设备的registration complete消息。
当registration accept消息包括网络切片订阅改变标识，终端设备成功更新该终端设备时，或者当registration accept消息包括新的5G-GUTI时，终端设备可向新侧AMF发送registration complete消息。
S422、新侧AMF调用服务化操作Nudm_SDM_Info向UDM发送消息，UDM接收来自新侧AMF的该消息。在图4中，将调用服务化操作Nudm_SDM_Info传输的消息称为 SDM信息消息。
如果在S413b中UDM发送给新侧AMF的签约数据中包含漫游信息标识，该标识是UDM所请求的收到UE信息的一个确认标识，则AMF向UDM发送Nudm_SDM_Info消息，以触发UDM进行相应操作。关于后续的步骤，可参考目前对于漫游场景的处理。
目前，当终端设备注册到网络中时，除了执行UE永久标识的主鉴权流程(即，图4中所示的流程中的S408所表示的鉴权过程，也称为一次鉴权流程)之外，可能还会根据终端设备请求的NSSAI(requested NSSAI)以及终端设备的签约数据判断是否需要执行网络切片特定的鉴权和授权流程(network slice specific authentication and authorization procedure，NSSAAF)，NSSAAF也可以称为网络切片的二次鉴权流程。
请参考图5，为NSSAAF流程示意图。该流程包括以下步骤。
S501、终端设备发起注册流程，例如S501表示为终端设备向AMF发送registration request消息，AMF接收来自终端设备的registration request消息。
Registration Request消息可以携带请求NSSAI(requested NSSAI)和UE 5G移动性管理核心网能力(5GS mobility management core network capability，5GMM Core Network Capability)，其中UE 5GMM Core Network Capability指示该终端设备是否支持NSSAA流程。
S502、AMF执行UE永久标识的主鉴权流程，该流程例如称为安全流程PLMN接入(security procedures PLMN access)。当该流程成功之后，AMF向UDM获取UE的签约数据。其中，签约数据包含了该终端设备签约的每一个S-NSSAI是否需要执行NSSAA流程的指示信息。在图5中将S502表示为安全流程PLMN接入(security procedures PLMN access)，其中AMF是认证方(authenticator)，NSSAAF可以理解为是认证服务器(auth server)。
例如终端设备签约的S-NSSAI可参考表1，即，UE的签约数据中的签约的S-NSSAI和对应的指示信息如表1所示：
表1
Figure PCTCN2021116792-appb-000001
S503、AMF根据终端设备的签约数据判断需要执行NSSAAF流程的S-NSSAI是否包含在Requested NSSAI中。
需要注意的是，AMF确定请求的NSSAI中的S-NSSAI需要执行NSSAAF，可以有两种含义：
第一种：如果终端设备在Registration Request消息中指示支持NSSAAF，那么进一步地，AMF根据终端设备的签约数据判断需要执行NSSAA流程的S-NSSAI是否包含在requested NSSAI中。如果需要执行NSSAA流程的S-NSSAI包含在Requested NSSAI中(对应requested NSSAI中包含的是归属域网络的切片类型(HPLMN S-NSSAI))，那么AMF可以确定该终端设备在本次注册流程之后需要执行NSSAAF。如果需要执行NSSAA流程 的S-NSSAI未包含在requested NSSAI中，那么AMF可以确定该终端设备在本次注册流程之后无需执行NSSAA流程。
举例1，例如registration request消息携带的requested NSSAI包括S-NSSAI-1和S-NSSAI-2，根据表1可知，S-NSSAI-1需要执行NSSAAF，S-NSSAI-2不需要执行NSSAAF，那么AMF可以确定该终端设备在本次注册流程之后针对S-NSSAI-1需要执行NSSAAF。
第二种：如果终端设备在registration request消息中指示支持NSSAAF，requested NSSAI中的某个S-NSSAI可以映射为签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA，那么AMF确定请求的NSSAI中的S-NSSAI需要执行NSSAAF。
具体地，AMF根据终端设备的签约数据，判断requested NSSAI包含的某个S-NSSAI可以映射到HPLMN S-NSSAI，且该HPLMN S-NSSAI需要执行NSSAAF，则AMF确定终端设备在本次注册流程之后需要执行NSSAAF。
举例2，例如终端设备携带的requested NSSAI包括S-NSSAI-A和S-NSSAI-B，其中S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，且S-NSSAI-1需要执行NSSAAF，S-NSSAI-2不需要执行NSSAA流程。则AMF确定终端设备在本次注册流程之后需要对S-NSSAI-1执行NSSAAF。
其中，上述的S-NSSAI-A与S-NSSAI-1映射，S-NSSAI-B与S-NSSAI-2映射，可以理解为，S-NSSAI-A与S-NSSAI-1存在映射关系，S-NSSAI-B与S-NSSAI-2存在映射关系；或者理解为，S-NSSAI-A所标识的网络切片与S-NSSAI-1所标识的网络切片存在映射关系，S-NSSAI-B所标识的网络切片与S-NSSAI-2所标识的网络切片存在映射关系。
具体地，以S-NSSAI-A为例说明。S-NSSAI-A可以是VPLMN S-NSSAI或者HPLMN S-NSSAI，本申请实施例不做限定。当S-NSSAI-A是VPLMN S-NSSAI时，表示S-NSSAI-A所标识的网络切片的类型属于拜访地PLMN(visit PLMN)，则S-NSSAI-A与S-NSSAI-1存在映射关系即为VPLMN S-NSSAI-A与HPLMN S-NSSAI-1存在映射关系，或者，VPLMN S-NSSAI-A所标识的网络切片与HPLMN S-NSSAI-1所标识的网络切片存在映射关系。当S-NSSAI-A是HPLMN S-NSSAI说明S-NSSAI-A所标识的网络切片的类型属于HPLMN网络，则S-NSSAI-A与S-NSSAI-1存在映射关系即为HPLMN S-NSSAI-A所标识的网络切片与HPLMN S-NSSAI-1所标识的网络切片存在映射关系。
S504、AMF向终端设备发送注册接受(registration accept)消息，终端设备接收来自AMF的registration accept消息。
Registration Accept消息可携带允许的NSSAI(allowed NSSAI)，其中allowed NSSAI包含不需要进行NSSAA流程的S-NSSAI。同时，AMF还向终端设备发送待定NSSAI(pending NSSAI)，终端设备接收来自AMF的pending NSSAI。pending NSSAI可包括一个或多个需要执行NSSAA流程的S-NSSAI，pending NSSAI用于指示终端设备，这些需要进行NSSAA流程的S-NSSAI处于pending状态。
也就是说，AMF向终端设备发送的注册接受消息携带允许的NSSAI(allowed NSSAI)、待定的NSSAI(pending NSSAI)以及待定原因值。其中，allowed NSSAI只包含不需要进行NSSAA的S-NSSAI，pending NSSAI包含需要进行NSSAA的S-NSSAI，待定原因值为等待NSSAA，该原因值用来指示UE：这些需要进行NSSAA的S-NSSAI是待定(pending)状态。
原因值：等待NSSAA。针对前面的例子中的举例2，Allowed NSSAI＝S-NSSAI-B， Pending NSSAI＝S-NSSAI-A，原因值：等待NSSAA。
需要说明的是，pending NSSAI也可以称为挂起的NSSAI。本申请实施例以pending NSSAI称为待定的NSSAI为例进行说明。
S505、在发送registration accept消息之后，AMF对处于pending状态的S-NSSAI执行NSSAAF。
例如，pending NSSAI包括S-NSSAI-1，那么AMF可以对S-NSSAI-1执行NSSAAF。关于NSSAAF的具体步骤，可参考接下来的图6即将介绍的流程。
需要注意的是，AMF对待定的NSSAI中的S-NSSAI执行NSSAA可以有两种含义：
第一种：待定的NSSAI中的某个S-NSSAI属于签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该S-NSSAI执行NSSAA。
例如，接着上述示例中的举例1，pending NSSAI＝S-NSSAI-1，由于S-NSSAI-1是HPLMN S-NSSAI，则AMF对S-NSSAI-1执行NSSAA。
第二种：待定的NSSAI中的某个S-NSSAI与签约的S-NSSAI映射，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该签约的S-NSSAI执行NSSAA。
接着上述示例中的举例2，pending NSSAI＝S-NSSAI-A，由于S-NSSAI-A与S-NSSAI-1映射，则AMF对S-NSSAI-1执行NSSAA流程。
该步骤505为可选步骤，当有需要执行NSSAA流程的S-NSSAI存在时，则执行步骤505，否则不执行步骤505。
需要注意的是，如果需要执行NSSAA流程的S-NSSAI存在多个，步骤505可以多次执行。
S506、当NSSAA流程执行完成之后，AMF根据NSSAA流程的鉴权结果更新allowed NSSAI。在图5中将S506表示为UE配置更新流程(UE configuration update procedure)，即，AMF可以为UE更新Allowed NSSAI。
如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI包含在Requested NSSAI里面，则该S-NSSAI会被添加到new allowed NSSAI中。或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI包含在requested NSSAI里面，则该S-NSSAI会被添加到rejected NSSAI中，同时AMF无需更新终端设备的allowed NSSAI，也就是说，AMF不会生成new allowed NSSAI，也不必向终端设备发送new allowed NSSAI。
或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI可以映射到requested NSSAI所包含的S-NSSAI，则requested NSSAI包含的该S-NSSAI会被添加到new allowed NSSAI中。或者，如果对一个S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI可以映射到requested NSSAI包含的S-NSSAI，则requested NSSAI包含的该S-NSSAI会被添加到rejected NSSAI中，同时AMF无需更新终端设备的allowed NSSAI，也就是说，AMF不会生成new allowed NSSAI，也不必向终端设备发送new allowed NSSAI。
例如继续前述的示例，AMF对S-NSSAI-1执行了NSSAA流程。那么，如果S-NSSAI-1的NSSAA流程的鉴权结果为鉴权成功，或者说S-NSSAI-1的NSSAA流程执行成功，则AMF可以将S-NSSAI-1添加到allowed NSSAI中，得到新(new)allowed NSSAI，且AMF可以向终端设备发送new allowed NSSAI，new allowed NSSAI可包括S-NSSAI-1和 S-NSSAI-2。而如果S-NSSAI-1的NSSAA流程的鉴权结果为鉴权失败，或者说S-NSSAI-1的NSSAA流程执行失败，则AMF向终端设备发送rejected NSSAI，其中，rejected NSSAI包括S-NSSAI-1，同时AMF不会更新该终端设备的allowed NSSAI。
该步骤506为可选步骤，当执行上述步骤505且需要更新UE的Allowed NSSAI时，执行步骤506。
通过上述实施例，可以实现在UE的注册流程之后，如有需要，可对S-NSSAI执行NSSAA流程，并更新UE的allowed NSSAI。
接下来请参考图6，为NSSAA流程所涉及的步骤的流程图。主要思想是：当AMF决定触发NSSAA流程后，AMF会通过NSSAAF与AAA-S交互传递终端设备的鉴权信息。其中，如果AAA-S位于第三方，NSSAAF无法直接跟AAA-S交互，那么NSSAAF可以间接通过AAA-代理(proxy-P)与AAA-S交互。
S601、AMF对pending NSSAI中的S-NSSAI触发NSSAA流程。
需要注意的是，本申请实施例中，AMF对pending NSSAI包括的S-NSSAI执行NSSAA，可以有两种含义：
第一种：pending NSSAI中的某个S-NSSAI属于签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该S-NSSAI执行NSSAA。
例如，继续上述的举例1，pending NSSAI＝S-NSSAI-1，由于S-NSSAI-1是HPLMN S-NSSAI，则AMF对S-NSSAI-1执行NSSAA流程。
第二种：pending NSSAI中的某个S-NSSAI与签约的S-NSSAI映射，且该签约的S-NSSAI需要执行NSSAA，那么AMF对该签约的S-NSSAI执行NSSAA。
继续上述的举例2，pending NSSAI＝S-NSSAI-A，由于S-NSSAI-A与S-NSSAI-1映射，则AMF对S-NSSAI-1执行NSSAA流程。
以下步骤S602至S617中涉及的S-NSSAI为终端设备签约的S-NSSAI，且该签约的S-NSSAI需要执行NSSAA流程。
S602、AMF向终端设备发送非接入层(non-access stratum，NAS)移动性管理(mobile management，MM)消息，终端设备接收来自AMF的NAS MM消息。
S602为可选的步骤。NAS MM消息可包括S-NSSAI，NAS MM消息用于向终端设备请求该终端设备的ID，以进行可扩展认证协议(extensible authentication protocol，EAP)认证。
S603、终端设备向AMF发送NAS MM消息，AMF接收来自终端设备的NAS MM消息。
该NAS MM消息包括EAP ID响应(response)以及S-NSSAI，其中的EAP ID Response可以理解为是EAP ID。其中，S603中的S-NSSAI与S602中的S-NSSAI是相同的。
S604、AMF向NSSAAF发送消息(图6中表示为EAP消息传输消息1)，NSSAAF接收来自AMF的该EAP消息传输消息1。该EAP消息传输消息1可包括EAP ID Response、AAA-S地址(address)、通用公共订阅标识(generic public subscription identifier，GPSI)以及S-NSSAI。
其中GPSI是终端设备的外部标识，例如为终端设备的手机号码或者电子邮箱等。AAA-S address是AAA-S的地址，该地址可以预先配置在AMF上或者AMF从UDM获取AAA-S的地址。S-NSSAI是本次执行NSSAA流程的网络切片的标识，且该S-NSSAI 是HPLMN S-NSSAI。
S605、NSSAAF向AAA-P发送EAP消息传输消息2，例如通过调用服务化操作Naaa_Communication_EAPmessageTranfser向AAA-P发送该EAP消息传输消息2，AAA-P接收来自NSSAAF的该EAP消息传输消息2。该EAP消息传输消息2包括EAP ID Response、AAA-S address、GPSI和S-NSSAI。
需要说明的是，如果AAA-S位于第三方网络中，NSSAAF需要通过AAA-P与AAA-S交互。否则，如果AAA-S位于运营商网络中，NSSAAF无需通过AAA-P而是可以直接与AAA-S交互。在图6中S605是以NSSAAF通过AAA-P与AAA-S通信为例，即以AAA-S位于第三方网络中为例进行说明。所以，在具体实施过程中，AAA-P并不是必须存在的，对应的S605也不是必须执行的步骤，所以在图6中是以虚线表示S605和AAA-P的。
S606、AAA-P根据AAA-S address，向AAA-S发送认证请求(auth request)消息，对应的，AAA-S接收来自AAA-P的auth request消息。auth request消息可包括EAP ID Response、GPSI和S-NSSAI。
S607～S614、终端设备与AAA-S之间传递EAP信息(EAP-message)，该过程可能需要交互多次。
其中，EAP-message可以包括EAP ID Response、GPSI和S-NSSAI等信息。传递EAP-message是为了对该终端设备进行EAP认证(authentication)。
S615、EAP认证结束，AAA-S向AAA-P发送认证响应(auth response)消息，AAA-P接收来自AAA-S的认证响应消息。认证响应消息可包括EAP-成功(success)/失败(failure)message、GPSI和S-NSSAI等信息。或者，如果AAA-S和NSSAAF能够直接交互，则AAA-S将EAP-Success/Failure message、GPSI和S-NSSAI发送给NSSAAF，NSSAAF接收来自AAA-S的EAP-Success/Failure message、GPSI和S-NSSAI。
如果NSSAA的鉴权结果为鉴权成功，即，AAA-S发送的是EAP-Success message，则AAA-S保存GSPI和鉴权成功的网络切片的S-NSSAI的对应关系。
S616、AAA-P向NSSAAF发送EAP信息传输消息3，如图6中的S616中所示的，EAP信息传输消息3可以包括EAP-Success/Failure message、S-NSSAI和GPSI等信息。
S617、NSSAAF向AMF发送EAP-Success/Failure message、S-NSSAI和GPSI等信息，AMF接收来自NSSAAF的EAP-Success/Failure message、S-NSSAI和GPSI等信息。
S618、AMF向终端设备发送NAS MM消息，终端设备接收来自AMF的该NAS MM消息。该NAS MM消息携带EAP-Success/Failure message(即EAP成功/失败消息)。
S619、AMF通过UE配置更新流程(UE configuration update procedure)向终端设备发送new allowed NSSAI，终端设备接收来自AMF的new allowed NSSAI。或者，AMF通过UE configuration update procedure向终端设备发送拒绝的NSSAI(rejected NSSAI)。
如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI包含在requested NSSAI里面，则该S-NSSAI会添加到new allowed NSSAI中。或者，如果S-NSSAI执行的NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI包含在requested NSSAI里面，则该S-NSSAI会添加到rejected NSSAI中，同时AMF无需更新终端设备的allowed NSSAI，也就是说，AMF不会生成new allowed NSSAI，也不必向终端设备发送new allowed NSSAI。
如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权成功，且该S-NSSAI可以映射到requested NSSAI包含的S-NSSAI，则requested NSSAI包含的该S-NSSAI会被添加到new  allowed NSSAI中。或者，如果S-NSSAI执行NSSAA流程的鉴权结果为鉴权失败，且该S-NSSAI可以映射到requested NSSAI包含的S-NSSAI，则requested NSSAI包含的该S-NSSAI会被添加到rejected NSSAI中，同时AMF无需更新终端设备的allowed NSSAI，也就是说，AMF不会生成new allowed NSSAI，也不必向终端设备发送new allowed NSSAI。
如果AMF决定需要向终端设备发送new allowed NSSAI或rejected NSSAI，则AMF可通过UE configuration update procedure发送。
针对前述的举例1，如果S-NSSAI-1的NSSAA执行成功，AMF向终端设备发送new allowed NSSAI，其中new Allowed NSSAI包括S-NSSAI-1和S-NSSAI-2。或者，如果S-NSSAI-1的NSSAA执行失败，AMF向终端设备发送rejected NSSAI，其中，rejected NSSAI包括S-NSSAI-1，即AMF不会向终端设备更新allowed NSSAI，也不会向终端设备发送new allowed NSSAI。
针对前述的举例2，如果S-NSSAI-1的NSSAA执行成功，AMF向终端设备发送new allowed NSSAI，其中new Allowed NSSAI包括S-NSSAI-A和S-NSSAI-B。或者，如果S-NSSAI-1的NSSAA执行失败，AMF向终端设备发送rejected NSSAI，其中，rejected NSSAI包括S-NSSAI-A，即AMF不会向终端设备更新rllowed NSSAI，也不会向终端设备发送new allowed NSSAI。
需注意的是，在图4～图6中的任一个附图所示的流程中，用虚线表示的步骤均为可选的步骤。
在对某个切片进行鉴权之后，AAA-S在某个时刻还可能对终端设备之前已经认证成功的切片(slice)进行重认证，比如在认证时长超过预定时长时进行重认证，或者按照一定的周期进行重认证，也就是说，AAA-S可以发起重认证流程，请参见图7所示的切片重认证流程。
S701、AAA-S触发重认证流程，向AAA-P发送AAA协议重认证消息，对应的，AAA-P接收该AAA协议重认证消息。其中，AAA协议重认证消息中包括GPSI和需要重认证的切片对应的标识，即S-NSSAI。AAA协议重认证消息例如又可以称作切片重认证消息。
S702、AAA-P向NSSAAF发送AAA协议重认证消息，对应的，NSSAAF接收AAA-P发送的该AAA协议重认证消息。
S703、NSSAAF向UDM查询服务终端设备的AMF的地址(图7中未示出)，并向对应的AMF发送NSSAA通知消息(图7中表示的是AAA协议重认证消息)，该NAASS通知消息中包括GPSI和步骤1中的S-NSSAI。
S704、AMF发起针对AAA协议重认证消息中包括的待认证的S-NSSAI的重认证流程，具体的认证步骤可以参照图6中的认证过程。
S705、如果重认证过程导致终端设备的allowed NSSAI发生改变，AMF向终端设备发送配置更新消息，以触发终端设备进行配置更新流程，继而更新终端设备的Allowed NSSAI。
根据前文的介绍可知，终端设备可以接入哪些切片是由运营商管理控制的，具体表现在：①作为终端设备的签约数据存放在运营商维护的UDM中；②在AMF上配置。在此基础上，对用户已经签约的NSSAI，运营商支持第三方对终端设备使用切片进行鉴权和授权，即上述的NSSAA流程。只有当终端设备通过了AAA-S对切片相关的鉴权和授权，终端设备才被允许接入切片，即才被允许接入切片所提供的网络服务。
目前，为更好的支持第三方的切片业务，运营商提出了新的场景需求：第三方业务可 以向运营商定制终端设备发放给用户使用，并且向运营商租用了多种类型的切片，不同类型的切片为用户提供的业务体验不同，比如租用金、银、铜三种类型切片，金牌用户可以获得专有的带宽，更低时延的网络服务等。这些终端设备和运营商进行签约能够获得运营商提供的网络连接服务，但用户具体使用哪一个切片的签约并不在运营商网络管理控制，而是由第三方管理和控制，即用户接入移动网络后，由第三方授权确定用户具体使用哪个切片，后续某个时刻如果用户想要更改切片签约，比如获得更高的服务质量，则可以向第三方购买，然后第三方跟运营商的移动网络交互，以更新用户使用的切片。由于运营商维护的UDM上存储的数据是比较重要的，并且也是涉及到用户隐私，因此相关技术中是由第三方将用户签约的切片提交给运营商，再由运营商的工作人员更新运营商维护的UDM，以实现对用户的切片签约数据的更新管理。然而，这种管理方式效率低下，可能并不能适应频繁动态更改用户切片签约的需求，也不利于第三方自身对切片业务进行控制，因此需要相应的解决方案。
鉴于此，本申请实施例提供一种切片管理方案，可以通过第三方直接对终端设备的切片进行管理和控制，可以将终端设备的切片签约数据直接存储在第三方，这样也就无需向运营商维护的UDM去请求终端设备的切片签约数据，所以在终端设备的切片签约发生改变时，第三方直接对终端设备的切片进行更新和管理，而无需再由运营商的运维人通过操作来更新UDM数据，这样可以减少用户操作，降低沟通成本，从而提高对切片的管理效率，并且也可以增强第三方对终端设备的业务控制能力，提高了第三方和运营商业务合作的体验，有利于运营商拓展业务。
本申请实施例的技术方案可以应用于各种通信系统，例如：第五代(5th generation，5G)通信系统、第六代(6th generation，6G)通信系统或未来的其他演进系统、或其他各种采用无线接入技术的无线通信系统等，只要该通信系统中存在网络切片的管理，则均可以采用本申请实施例的技术方案。
在下文的实施例介绍中，本申请实施例所述的移动性管理网元可以是图1所示的AMF网元，也可以是未来通信系统中的具有上述AMF网元的功能的网元。以及，本申请实施例所述的认证网元可以是前文所述的AAA-S或者NSSAAF，也可以是未来通信系统中的具有上述AAA-S的功能的网元或者具有上述NSSAAF的功能的网元。以及，本申请实施例所述的数据管理网元可以是前文中提到的UDM，也可以是未来通信系统中的具有上述UDM的功能的网元。
为便于理解，以下结合附图对本申请实施例中的切片管理方案进行说明。
请参见图8所示的本申请实施例提供的一种切片管理方法的流程交互图，图8所示的流程描述如下。
S801、移动性管理网元(图8中以AMF表示)获得切片选择指示信息。
该切片选择指示信息用于指示终端设备的切片签约数据保存在第三方应用服务器中，或者，该切片选择指示信息用于指示由第三方应用为终端设备确定切片，或者，该切片选择指示信息用于指示终端设备的切片由第三方应用确定。通过切片选择指示信息的指示，可以明确终端设备的切片需要由第三方确定。
在具体实施过程中，该切片选择指示信息可以携带在终端设备向AMF发送的注册请求消息中；或者，AMF可以向运营商维护的UDM请求终端设备的切片签约数据，而该切片选择指示信息可以携带在AMF向UDM请求的切片签约数据中，在该实施方式中，切 片选择指示信息可以重用相关技术中的鉴权和授权指示信息，或者也可以是新的指示信息。
另外，AMF从终端设备接收的切片选择指示信息和从UDM获得的切片选择指示信息可以同时存在，或者也可以只存在一个，也就是说，AMF可以同时从终端设备和UDM处获得切片选择指示信息，或者也可以仅从终端设备处获得切片选择指示信息，或者也可以仅从UDM处获得切片选择指示信息。
其中的第三方应用服务器可以理解为是服务于第三方应用的服务器，第三方应用服务器提供独立于运营商而由第三方自己维护的服务，所以，第三方应用服务器是不同于运营商所维护的UDM的。在具体实现中，第三方应用服务器与认证网元(例如AAA-S)可以是同一网络结构(例如同一功能网元或者同一实体设备)，即此时的第三方应用服务器就是认证网元，又或者，第三方应用服务器与认证网元是不同的网络结构，此时的第三方应用服务器与认证网元是两个相互独立的功能网元或者是不同的实体设备。在图8中是将第三方应用服务器独立于AAA-S表示，所以是以认证网元与第三方应用服务器是不同的网络结构进行的图示说明。
步骤S801是可选的步骤，所以在图8中以虚线表示S801。也就是说，在具体实施过程中可能执行S801也可能并不执行S801，本申请实施例对此不作限制。
S802、移动性管理网元发起切片请求，具体地，可以向第三方应用服务器发送切片请求信息，该切片请求信息中包括用户标识，例如GPSI，对应的，第三方应用服务器接收到移动性管理网元发送的切片请求信息。
步骤S802仅作为示意的移动性管理网元和第三方应用服务器的交互过程。移动性管理网元可以直接和第三方应用服务器交互，也可以通过其他网元比如NEF同第三方应用服务器交互。
当第三方应用服务器网元为认证网元AAA-S时，AMF通过NSSAAF，AAA-P将切片请求信息发送到AAA-S，具体的：
NSSAAF将切片请求信息发送给AAA-P，对应的，AAA-P接收到NSSAAF发送的切片请求信息。进一步地，AAA-P将切片请求信息发送给认证网元(即AAA-S)，对应的，AAA-S接收到AAA-P发送的切片请求信息。
需要说明的是，在实际网络结构中可能并不包括AAA-P，此时NSSAAF与AAA-S之间可以直接通信，而当包括AAA-P时，NSSAAF与AAA-S之间通过AAA-P通信。
S803、第三方应用服务器根据切片请求信息中的用户标识(GPSI)确定为GPSI对应的终端设备所授权的切片，例如确定出的切片是第一切片，第三方应用服务器生成包括第一S-NSSAI的切片响应信息，并将切片响应信息发送给移动性管理网元，对应的，移动性管理网元接收第三方应用服务器发送的切片响应信息。其中的第一S-NSSAI是用于标识第一切片的S-NSSAI。
步骤S803仅作为示意移动性管理网元和第三方应用服务器的交互。移动性管理网元可以直接和第三方应用服务器交互，也可以通过其他网元比如NSSAAF或者NEF同第三方应用服务器交互。
当第三方应用服务器网元为认证网元AAA-S时，AMF网元通过NSSAAF，AAA-P与AAA-S进行信息交互。具体的：
AAA-S在从第三方业务服务器处获得第三方应用为终端设备授权的第一切片对应的第一S-NSSAI之后，生成包括第一S-NSSAI的切片响应信息，并将切片响应信息发送给 AAA-P，对应的，AAA-P接收到AAA-S发送的切片响应信息。
进一步地，AAA-P将切片响应信息发送给NSSAAF，对应的，NSSAAF接收到AAA-P发送的切片响应信息。
然后，NSSAAF将切片响应信息发送给AMF，对应的，AMF接收到NSSAAF发送的切片响应信息，进而可以得到切片响应信息中携带的第一S-NSSAI，即，AMF获得来自于第三方应用服务器的第一S-NSSAI。
因为目前为了更好的支持第三方的切片业务，可以由第三方自行对用户签约数据进行管理和控制，所以终端设备的切片签约数据可以预先保存在第三方应用服务器中，进而在为终端设备分配切片时，可以将已经由第三方真实授权的切片直接分配给终端设备，这样也就无需向运营商维护的UDM去请求终端设备的切片签约数据，所以在终端设备的切片签约发生改变时，第三方直接在自身维护的第三方应用服务器中进行更新和管理，而无需再由运营商的运维人通过操作来更新UDM数据，这样可以减少用户操作，降低沟通成本，从而提高对切片的管理效率，并且也可以增强第三方对终端设备的业务控制能力，提高了第三方和运营商业务合作的体验，有利于运营商拓展业务。
S804、可选的，AMF还可以发起对第一S-NSSAI的NSSAA流程，即对第一S-NSSAI进行NSSAA。
对第一S-NSSAI进行NSSAA的流程可以按照相关技术中的NSSAAF执行，此处就不再重复说明了。
另外，由于步骤S804是可选的步骤，所以在图8中以虚线表示S804。
S805、AMF将第一S-NSSAI发送给终端设备，对应的，终端设备接收到AMF发送的第一S-NSSAI。例如，在对第一S-NSSAI执行NSSAA流程的结果是认证成功时，AMF将第一S-NSSAI发送给终端设备。终端设备可以进行切片配置更新，即以接收到的第一S-NSSAI来更新终端设备允许接入的S-NSSAI。
也就是说，AMF发送给终端设备的第一S-NSSAI所指示的第一切片是在第三方应用服务器中授权给终端设备的切片，这样，可以直接由第三方对终端设备的切片签约数据进行管理，可以提高对切片的管理效率，并且也可以增强第三方对终端设备的业务控制能力。
本申请实施例中，通过第三方应用服务器直接为终端设备分配经第三方直接授权的切片，也就是说，用户的签约数据可以直接存放在第三方应用服务器中，这样，注册分配切片时，可以直接从第三方应用服务器处获得用户在第三方中真正授权的切片，而无需再从运营商维护的UDM中去获取，这样可以减少从第三方到运营商进行更新的步骤，由第三方直接对切片进行管理，提高了切片管理效率，增强了第三方对终端设备的业务控制能力。
在具体实施过程中，还可以按照图9所示的流程将第一S-NSSAI发送给终端设备，在图9中是将第三方应用服务器是认证网元(即认证网元和第三方应用服务器为同一网络结构)为例进行说明。图9所示的流程描述如下。
S901、AMF获得切片选择指示信息。
S901中的切片选择指示信息与S801中的切片选择指示信息的含义一样，步骤S901的实施可以参照步骤S801的实施例描述。
S902、AMF发起切片认证请求，具体地，可以先向NSSAAF发送切片认证请求。
AMF发送的切片认证请求包括终端设备的终端标识(例如GPSI)和第二S-NSSAI，第二S-NSSAI用于标识在数据管理网元(例如运营商维护的UDM)中为所述终端设备签 约的切片，假设第二S-NSSAI标识第二切片，那么第二切片是在运营商维护的UDM中为终端设备签约的切片，在本申请实施例中，可以将第二S-NSSAI称作缺省的(default)S-NSSAI，由于第二S-NSSAI签约在UDM中，AMF可以预先向UDM请求终端设备的签约数据，进而从签约数据中获得第二S-NSSAI。
S903、NSSAAF将切片认证请求发送给AAA-P，对应的，AAA-P接收到NSSAAF发送的切片认证请求。
S904、AAAA-P将切片认证请求发送给AAA-S，对应的，AAA-S接收到AAA-P发送的切片认证请求。
S905、AAA-S在接收到切片认证请求之后，可以获得其中的终端标识和第二S-NSSAI。
如前所述的，第二S-NSSAI所对应的第二切片是在UDM中签约给终端设备的，但是其并不一定是第三方实际授权给终端设备的切片，本申请实施例通过预先为终端设备在UDM签约缺省的第二S-NSSAI来复用相关技术中的认证流程，如此，在获得第二S-NSSAI之后即可执行认证流程。
在UDM中为终端设备签约的第二S-NSSAI并不一定是第三方实际为终端设备授权的S-NSSAI，所以，在进行切片认证时，AMF可以先向第三方应用服务器查询是否将第二S-NSSAI授权给该终端设备，若第二S-NSSAI未在第三方应用服务器处为终端设备授权过，则从第三方应用服务器处查询已经为终端设备授权过的S-NSSAI，例如查询出的是为终端设备授权过第一S-NSSAI，则可以将第一S-NSSAI作为终端设备认证通过的S-NSSAI。或者，若第二S-NSSAI在第三方应用服务器处授权过，则可以直接将第二S-NSSAI确定为是在第三方应用服务器处经过授权的S-NSSAI，此时可以将从第三方应用服务器处查询到的为终端设备授权过的其它S-NSSAI(例如第一S-NSSAI)或者第二S-NSSAI作为终端设备认证通过的S-NSSAI。
为便于描述，将第三方应用服务器处通过授权认证的S-NSSAI称作第一S-NSSAI，那么第一S-NSSAI可能就是第二S-NSSAI，即第一S-NSSAI和第二S-NSSAI相同，或者，第一S-NSSAI和第二S-NSSAI是不同的S-NSSAI。
在认证过程中，可以先判断第三方应用服务器中是否有为终端设备已经授权过的S-NSSAI，若有，则可以确定认证通过，并且可以选择一个S-NSSAI(称作第一S-NSSAI)作为通过认证的S-NSSAI，也就是说，第一S-NSSAI对应的第一切片是第三方应用服务器为终端设备实际授权的切片。
S906、AAA-S获得由第三方应用服务器为终端设备实际授权的第一切片对应的第一S-NSSAI，也就是说，第一S-NSSAI所标识的第一切片是由第三方为终端设备授权的。
S907、在获得由第三方应用服务器为终端设备实际授权的第一切片对应的第一S-NSSAI之后，即表明认证成功，此时AAA-S可以生成认证结果指示信息，并将生成的认证结果指示信息和第一S-NSSAI发送给AAA-P。
在具体实施过程中，可以将认证结果指示信息和第一S-NSSAI同时携带在认证响应信息中一并发送给AAA-P，对应的，AAA-P接收到AAA-S发送的认证结果指示信息和第一S-NSSAI。
S908、AAA-P将认证结果指示信息和第一S-NSSAI发送给NSSAAF，对应的，NSSAAF接收到AAA-P发送的认证结果指示信息和第一S-NSSAI。
S909、NSSAAF将认证结果指示信息和第一S-NSSAI发送给AMF，对应的，AMF接 收到NSSAAF发送的认证结果指示信息和第一S-NSSAI。
S910、AMF在接收到认证结果指示信息和第一S-NSSAI之后，可以确定认证成功，进而可以将第一S-NSSAI发送给终端设备，对应的，终端设备接收到AMF发送的第一S-NSSAI。
S911、终端设备在接收到第一S-NSSAI之后，可以确定第一S-NSSAI是由第三方授权的S-NSSAI，可以进行切片配置更新，即以接收到的第一S-NSSAI来更新终端设备允许接入的S-NSSAI。
在本申请实施例中，实现了第三方授权的切片，这样便于第三方直接管理和维护用户使用的切片，而无需再提交给运营商进行管理和维护，增强了第三方对终端设备的业务控制能力，提高了第三方和运营商业务合作的体验，有利于运营商拓展业务。
请参见图10所示的另一切片管理方法的流程交互图，图10所示的流程描述如下。
S1001、AMF发起切片认证请求，具体地，AMF可以向NSSAAF发送切片认证请求。
该切片认证请求包括终端设备的EAP标识响应消息和需要认证的第一S-NSSAI，该第一S-NSSAI用于标识在数据管理网元(即运营商维护的UDM)中为终端设备签约的至少两个切片中的一个切片。此外，切片认证请求中还可以包括终端设备对应的终端标识，例如终端设备的GPSI。其中的EAP标识响应消息例如是图6中S604中的EAP消息传输消息1，EAP标识响应消息包括EAP ID等信息。
也就是说，本申请实施例是对UDM签约的切片进行认证，第三方租用的运营商的所有切片都可以作为S-NSSAI为终端设备预先签约存放在UDM中，对于UDM中的每个S-NSSAI，都可以配置切片相关的鉴权和授权(slice-specific authentication and authorization)指示，即UDM中签约的每个S-NSSAI均需要进行授权认证。这样，对于UDM中的每个S-NSSAI，AMF都会发起认证流程。
S1002、NSSAAF将切片认证请求发送给AAA-P，对应的，AAA-P接收到NSSAAF发送的切片认证请求。
S1003、AAA-P将切片认证请求发送给AAA-S，对应的，AAA-S接收到AAA-P发送的切片认证请求。
在接收到切片认证请求之后，AAA-S获得其中包括的EAP标识响应消息和需要进行认证的第一S-NSSAI。
S1004、AMF发起对EAP标识响应消息的认证，即，判断EAP标识响应消息是否通过认证。
S1004可以按照相关技术中的认证流程对终端设备的EAP标识响应消息进行认证，例如判断EAP标识响应消息对应的用户凭证信息是否合法等，进而得到第一认证结果。
S1005、AMF确定第一S-NSSAI标识的切片是否是第三方应用服务器允许终端设备接入的切片，也就是说，可以判断第一S-NSSAI标识的切片是否是第三方实际授权的切片，进而得到第二认证结果。
也就是说，在S1004的基础上，还通过第三方是否对第二S-NSSAI实际授权进行了二重验证，这样可以通过双重验证的方式不仅可以确保验证的准确性，同时可以保证由第三方应用服务器参与了认证过程，这样在验证通过时表明是对应的第一S-NSSAI确实是由第三方预先授权的S-NSSAI，通过第三方对第一S-NSSAI的验证实现了对切片的管理和控制。
S1006、在第一认证结果和第二认证结果均为是时，即在EAP标识响应消息认证成功 且第一S-NSSAI标识的切片是第三方应用服务器允许终端设备接入的切片时，即可以认为认证成功，而只要第一认证结果和第二认证结果中存在一个认证失败时，则可以认为最终认证失败。进而，可以根据最终的认证结果生成对应的认证结果指示信息，所以，认证结果指示信息有可能指示EAP认证成功，也有可能指示EAP认证失败。
S1007、AAA-S将生成的认证结果指示信息发送给AAA-P，对应的，AAA-P接收到AAA-S发送的认证结果指示信息。
S1008、AAA-P将认证结果指示信息发送给NSSAAF，对应的，NSSAAF接收到AAA-P发送的认证结果指示信息。
S1009、NSSAAF将认证结果指示信息发送给AMF，对应的，AMF接收到NSSAAF发送的认证结果指示信息。
S1010、AMF在接收到认证结果指示信息之后，根据认证结果指示信息的指示可以确认EAP认证成功或者EAP认证失败。在确定EAP认证成功时，可以向终端设备发送包括第一S-NSSAI的允许接入的S-NSSAI，以使终端设备根据允许接入的S-NSSAI来更新自身的切片配置。终端设备可以进行切片配置更新，即以接收到的第一S-NSSAI来更新终端设备的允许接入的S-NSSAI。
本申请实施例中，在相关技术中的认证流程的基础上，AMF可以判断待验证的S-NSSAI标识的切片到底是否是第三方应用服务器实际允许终端设备接入的切片，这样通过二重验证的方式让第三方参与了切片的认证，这样得到的认证结果是考虑了第三方对待验证切片的实际授权情况，实现了第三方对切片的直接管理和控制。
再请参见图11所示的另一切片管理方法的流程交互图，图11所示的流程描述如下。
S1101、第三方应用服务器确定终端设备接入的切片由第一切片变为第二切片。
在用户的切片签约发生改变时，例如，终端设备之前接入的第一切片是铜牌类型的切片，为了加速，用户付费购买了金牌类型的切片(例如称作第二切片)，则需要将终端设备接入的切片由第一切片切换为第二切片，在第三方应用服务器处可以更改用户签约的切片数据，即将第二切片配置为允许终端设备接入的切片，以及将第一切片配置为不允许终端设备接入的切片，可见，终端设备的切片签约数据可保存在第三方应用服务器中，可以由第三方应用直接管理，从而实现第三方对切片的直接管理。
假设，将第一切片对应的S-NSSAI称作第一S-NSSAI，将第二切片对应的S-NSSAI称作第二S-NSSAI。
S1102、第三方应用服务器向移动性管理网元(例如AMF)发送切片更新信息，对应的，AMF接收到第三方应用服务器发送的切片更新信息。
在满足切片切换触发条件时，例如上述的检测到需要将终端设备的切片由第一切片变为第二切片时，第三方应用服务器可以生成切片更新信息，该切片更新信息中包括需要切换的第二切片对应的第二S-NSSAI，通过切片更新信息可以指示需要对第二S-NSSAI进行认证。切片更新信息中还可以包括终端设备对应的终端标识，例如GPSI等信息。
在一种可选的实施方式中，切片更新信息中还可以包括第一S-NSSAI，也就是说，还可以在切片更新信息中携带已经失效的第二切片对应的S-NSSAI，其中的“已经失效”表示不再允许终端设备接入。该第二切片例如可以是图8～图10中经过授权认证的第一S-NSSAI对应的切片。
在生成切片更新信息之后，第三方应用服务器将其向移动性管理网元发送，以触发移 动性管理网元进行切片更新。
步骤S1102仅作为示意性的移动性管理网元和第三方应用服务器之间的交互。移动性管理网元可以直接和第三方应用服务器交互，也可以通过其他网元比如NSSAAF或者NEF同第三方应用服务器交互。当第三方应用服务器网元为认证网元AAA-S时，第三方应用服务器(AAA-S)通过NSSAAF、AAA-P与移动性管理网元进行信息交互。具体的：
AAA-S向AAA-P发送切片更新信息，对应的，AAA-P接收到AAA-S发送的切片更新信息。然后，AAA-P向NSSAAF发送切片更新信息，对应的，NSSAAF接收到AAA-P发送的切片更新信息。进一步地，NSSAAF向AMF发送切片更新信息，对应的，AMF接收到NSSAAF发送的切片更新信息，从而，AMF接收来自第三方应用服务器的切片更新信息。
本申请实施例中，可以由第三方应用服务器直接发起对终端设备的切片更新流程，也就是说，第三方应用服务器可以直接对切片进行更新控制，无需再通过与运营商维护的UDM进行交互才能实现切片更新，提高了切片更新效率，增强了第三方对切片的业务控制能力，提高了第三方和运营商业务合作的体验，有利于运营商拓展业务。
S1103、可选的，AMF可以发起针对第二S-NSSAI进行认证的流程，即针对第二S-NSSAI进行NSSAA流程，以对第二S-NSSAI进行认证。
AMF在收到来自第三方应用服务器的切片更新信息之后，即可发起对第二S-NSSAI的认证流程。具体地，可以采用相关技术中的NSSAAF流程来对第二S-NSSAI进行鉴权和授权认证，例如采用前述图6中介绍的认证方式对第二S-NSSAI进行认证。
步骤S1103所对应的认证流程是可选的步骤。在另一种实施方式中，AMF也可以认为AAA-S传递切片已经经过认证授权，而选择跳过S1103而直接执行步骤S1104。
S1104、AMF向终端设备发送配置更新信息，对应的，终端设备接收到AMF发送的该配置更新信息。终端进行切片配置更新的方式可以按照相关技术中的配置更新流程执行。
例如若执行S1103的认证步骤的话，则可以在对第二S-NSSAI认证成功时向终端设备发送配置更新信息。
S1105、终端设备根据配置更新信息可以进行切片配置更新，即以接收到的第二S-NSSAI来更新终端设备的允许接入的S-NSSAI，从而完成切片认证，并更新本地保存的切片。
由于第一S-NSSAI是被切换的S-NSSAI以及第二S-NSSAI是需要切换的S-NSSAI，例如可以将第一S-NSSAI称作旧的S-NSSAI，以及将第二S-NSSAI称作新的S-NSSAI。若新的S-NSSAI会导致终端设备的允许接入的S-NSSAI发生改变，AMF则可以向终端设备发送配置更新信息，将新的S-NSSAI(即第二S-NSSAI)携带在配置更新信息中发送给终端设备，以使终端设备进行切片配置更新，在允许接入的S-NSSAI中添加上新的S-NSSAI。以及，若旧的S-NSSAI会导致终端设备的允许接入的S-NSSAI发生改变，AMF也可以向终端设备发送配置更新信息，在允许接入的S-NSSAI中删除旧的S-NSSAI。
也就是说，可以将已经失效的旧的切片也告知终端设备，这样在失效的切片对终端设备的允许接入的切片有影响时，可便于终端设备准确地更新允许接入的切片，以实现对切片的准确更新，提高切片更新的有效性。
在一种可能的实施方式中，切片更新信息例如可以是相关技术的重认证流程中的切片重认证消息，在该实施方式中，可以复用相关技术中的重认证流程来实现对第二S-NSSAI 的认证。为便于理解该实施方式，以下结合图12进行说明，在图12的描述中，以第三方应用服务器是认证网元(AAA-S)为例进行说明，图12所示的流程描述如下。
S1201、认证网元确定终端设备接入的切片由第一切片变化第二切片。
步骤S1201的实施可以参照步骤S1201的实施例理解，在此不重复说明了。
此外，本申请实施例中第二切片可以是未经授权认证的切片，即，之前未对第二切片对应的第二S-NSSAI进行过NSSAA，也就是说，终端设备需要切换的切片是未经过授权认证的切片。
S1202、认证网元生成切片重认证消息，并将该切片重认证消息发送给AAA-P，对应的，AAA-P接收认证网元发送的切片重认证消息。
对比图11理解，S1202中的切片重认证消息相当于是图11中的切片更新信息，认证网元之所以生成切片重认证消息，是为了复用相关技术中对切片进行重认证的流程来实现对第二S-NSSAI的认证。
与图11中的切片更新信息类似的，本申请实施例中的切片重认证消息中包括第二S-NSSAI。以及，在一种可选的实施方式中，切片重认证消息中还可以包括用于标识第一切片的旧的S-NSSAI，即第一S-NSSAI。
S1203、AAA-P将切片重认证消息发送给NSSAAF，对应的，NSSAAF接收到AAA-P发送的切片重认证消息。
S1204、NSSAAF将切片重认证消息发送给AMF，对应的，AMF接收到NSSAAF发送的切片重认证消息。
S1205、AMF在收到切片重认证消息后，获得其中的第二S-NSSAI。进一步地，可以针对第二S-NSSAI进行NSSAA，即对第二S-NSSAI进行授权认证，具体可以采用相关技术中的认证方式来对第二S-NSSAI进行认证，此处就不再重复说明了。
S1206、在对第二S-NSSAI认证成功时，AMF向终端设备发送配置更新信息，对应的，终端设备接收到AMF发送的第二S-NSSAI。
S1207、终端设备收到配置更新信息之后，可以进行切片配置更新即以接收到的第二S-NSSAI来更新终端设备的允许接入的S-NSSAI，从而完成切片认证。
步骤S1206～S1207的实施可以参照步骤S1104～S1105的实施例进行理解，此处就不再重复说明了。
因为相关技术中的重认证流程是对之前已经进行过认证的S-NSSAI进行重认证，而本申请实施例中，通过复用相关技术的重认证流程可以实现对之前未认证过的S-NSSAI进行认证，提供了一种新的切片更新和切片认证方式，提高了切片管理的灵活性。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是移动性管理网元(例如AMF)或者设置在移动性管理网元内部的芯片。该切片管理装置具备实现上述图8～图9所示实施例中的移动性管理网元的功能，比如，该切片管理装置包括执行上述图8～图9所示实施例中的移动性管理网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图13所示，本申请实施例中的切片管理装置包括发起单元1301、接收单元1302和发送单元1303，其中：
发起单元1301，用于发起切片请求，切片请求包括终端设备的终端标识；
接收单元1302，用于接收来自第三方应用服务器的第一S-NSSAI，第一S-NSSAI用 于标识第三方应用服务器为终端设备授权的切片；
发送单元1303，用于向终端设备发送第一S-NSSAI。
在一种可能的实施方式中，第三方应用服务器为认证网元，发起单元1301用于发起切片认证请求，切片认证请求包括第二S-NSSAI和终端标识，第二S-NSSAI用于标识在数据管理网元中为终端设备签约的切片；对应的，接收单元1302用于接收来自认证网元的认证结果指示信息和第一S-NSSAI。
在一种可能的实施方式中，接收单元1302还用于接收来自终端设备或数据管理网元的切片选择指示信息，切片选择指示信息用于指示由第三方应用为终端设备确定切片。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是第三方应用服务器或者认证网元(例如AAA-S)，或者是设置在第三方应用服务器或者认证网元内部的芯片。该切片管理装置具备实现上述图8～图9所示实施例中的第三方应用服务器和认证网元的功能，比如，该切片管理装置包括执行上述图8～图9所示实施例中的第三方应用服务器和认证网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图14所示，本申请实施例中的切片管理装置包括接收单元1401、确定单元1402和发送单元1403，其中：
接收单元1401，用于接收来自移动性管理网元的切片请求，切片请求包括终端设备的终端标识；
确定单元1402，用于根据终端标识确定第三方应用服务器为终端设备授权的切片；
发送单元1403，用于向移动性管理网元发送第一S-NSSAI，第一S-NSSAI用于标识第三方应用服务器为终端设备授权的切片。
在一种可能的实施方式中，第三方应用服务器为认证网元，接收单元1401用于接收来自移动性管理网元的切片认证请求，切片认证请求包括第二S-NSSAI和终端标识，第二S-NSSAI用于标识在数据管理网元中为终端设备签约的切片；对应的，发送单元1403用于向移动性管理网元发送认证结果指示信息和第一S-NSSAI。
对于图13～图14所示的切片管理装置，在一种可能的实施方式中，认证结果指示信息用于指示认证成功。
对于图13～图14所示的切片管理装置，在一种可能的实施方式中，第二S-NSSAI与第一S-NSSAI相同，或者，第二S-NSSAI与第一S-NSSAI不同。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是认证网元(例如AAA-S)，或者是设置在认证网元内部的芯片。该切片管理装置具备实现上述图10所示实施例中的认证网元的功能，比如，该切片管理装置包括执行上述图10所示实施例中的认证网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图15所示，本申请实施例中的切片管理装置包括接收单元1501、认证单元1502和发送单元1503，其中：
接收单元1501，用于接收来自移动性管理网元发送的切片认证请求，切片认证请求包括终端设备的EAP标识响应消息和第一S-NSSAI，第一S-NSSAI用于标识在数据管理网元中为终端设备签约的至少两个切片中的一个切片；
认证单元1502，用于根据EAP标识响应消息是否通过认证且第一S-NSSAI标识的切 片是否是第三方应用服务器允许终端设备接入的切片的判断结果，生成认证结果指示信息，认证结果指示信息包括EAP成功消息或者EAP失败消息；
发送单元1503，用于向移动性管理网元发送认证结果指示信息。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是移动性管理网元(例如AMF)，或者是设置在移动性管理网元内部的芯片。该切片管理装置具备实现上述图10所示实施例中的移动性管理网元的功能，比如，该切片管理装置包括执行上述图10所示实施例中的移动性管理网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图16所示，本申请实施例中的切片管理装置包括发起单元1601和接收单元1602，其中：
发起单元1601，用于发起切片认证请求，切片认证请求包括终端设备的EAP标识响应消息和第一息S-NSSAI，第一S-NSSAI用于标识在数据管理网元中为终端设备签约的至少两个切片中的一个切片；
接收单元1602，用于接收来自认证网元的认证结果指示信息，其中，认证结果指示信息是认证网元根据EAP标识响应消息是否通过认证且第一S-NSSAI标识的切片是否是第三方应用服务器允许终端设备接入的切片的判断结果生成的。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是第三方应用服务器或者认证网元(例如AAA-S)，或者是设置在第三方应用服务器或者认证网元内部的芯片。该切片管理装置具备实现上述图11～图12所示实施例中的第三方应用服务器或者认证网元的功能，比如，该切片管理装置包括执行上述图11～图12所示实施例中的第三方应用服务器或者认证网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图17所示，本申请实施例中的切片管理装置包括确定单元1701和发送单元1702，其中：
确定单元1701，用于确定允许终端设备接入的切片由第一切片变为第二切片；
发送单元1702，用于向移动性管理网元发送切片更新信息，切片更新信息包括第二S-NSSAI，第二S-NSSAI用于标识第二切片。
基于同一技术构思，本申请实施例提供一种切片管理装置，该切片管理装置可以是移动性管理网元(例如AMF)，或者是设置在移动性管理网元内部的芯片。该切片管理装置具备实现上述图11～图12所示实施例中的移动性管理网元的功能，比如，该切片管理装置包括执行上述图11～图12所示实施例中的移动性管理网元所执行的步骤所对应的模块或单元或手段(means)，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。例如，参见图18所示，本申请实施例中的切片管理装置包括接收单元1801和发送单元1802，其中：
接收单元1801，用于接收来自第三方应用服务器的切片更新信息，切片更新信息包括第二S-NSSAI，第二S-NSSAI用于标识第二切片；
发送单元1802，用于向终端设备发送第二S-NSSAI。
在一种可能的实施方式中，第三方应用服务器为认证网元，第二切片为未经过授权认证的切片，本申请实施例中的切片管理装置还可以包括认证单元1803，用于发起对第二S-NSSAI进行认证的流程，并在对第二S-NSSAI认证通过时，向终端设备发送配置更新信 息，配置更新信息用于更新终端设备允许接入的切片。
在一种可能的实施方式中，切片更新信息为切片重认证消息。
对于图17～图18所示的切片管理装置，在一种可能的实施方式中，切片更新信息还包括用于标识第一切片的第一S-NSSAI，第一切片当前不允许终端设备接入。
基于同一技术构思，参见图19所示，本申请实施例还提供一种通信设备，该通信设备例如是移动性管理网元(例如AMF)，该通信设备包括：
至少一个处理器1901；以及与至少一个处理器1901通信连接的通信接口1903；至少一个处理器1901通过执行存储器1902存储的指令，使得该通信设备通过通信接口1903执行上述图8～图11所示实施例中的移动性管理网元所执行的方法步骤。
可选的，存储器1902位于通信设备之外。
可选的，通信设备包括存储器1902，存储器1902与至少一个处理器1901相连，存储器1902存储有可被至少一个处理器1901执行的指令。图19中用虚线表示存储器1902对于通信设备是可选的。
其中，至少一个处理器1901和存储器1902可以通过接口电路耦合，也可以集成在一起，这里不做限制。
本申请实施例中不限定上述处理器1901、存储器1902以及通信接口1903之间的具体连接介质。本申请实施例在图19中以处理器1901、存储器1902以及通信接口1903之间通过总线1904连接，总线在图19中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图19中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
基于同一技术构思，参见图20所示，本申请实施例还提供一种通信设备，该通信设备例如是认证网元(例如AAA-S)或者第三方应用服务器，该通信设备包括：
至少一个处理器2001；以及与至少一个处理器2001通信连接的通信接口2003；至少一个处理器2001通过执行存储器2002存储的指令，使得该通信设备通过通信接口2003执行上述图8～图11所示实施例中的认证网元或第三方应用服务器所执行的方法步骤。
可选的，存储器2002位于通信设备之外。
可选的，通信设备包括存储器2002，存储器2002与至少一个处理器2001相连，存储器2002存储有可被至少一个处理器2001执行的指令。图20中用虚线表示存储器2002对于通信设备是可选的。
其中，至少一个处理器2001和存储器2002可以通过接口电路耦合，也可以集成在一起，这里不做限制。
本申请实施例中不限定上述处理器2001、存储器2002以及通信接口2003之间的具体连接介质。本申请实施例在图20中以处理器2001、存储器2002以及通信接口2003之间通过总线2004连接，总线在图20中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图20中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
应理解，本申请实施例中提及的处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
示例性的，处理器可以是中央处理单元(central processing unit，CPU)，还可以是其 他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic rAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Eate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
基于同一技术构思，本申请实施例还提供一种通信系统，该通信系统包括图13中的通信装置和图14中的通信装置，或者包括图15中的通信装置和图16中的通信装置，或者包括图17中的通信装置和图18中的通信装置，或者包括图19中的通信设备和图20中的通信设备。
基于同一技术构思，本申请实施例还提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得上述图8～图12所示实施例中的移动性管理网元(例如AMF)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得上述图8～图12所示实施例中的认证网元(例如AAA-S)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，使得上述图8～图12所示实施例中的第三方应用服务器所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得上述图8～图12所示实施例中的移动性管理网元(例如AMF)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得上述图8～图12所示实施例中的认证网元(例如AAA-S)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，使得上述图8～图12所示实施例中的第三法应用 服务器所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述图8～图12所示实施例中的移动性管理网元(例如AMF)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述图8～图12所示实施例中的认证网元(例如AAA-S)所执行的方法被执行。
基于同一技术构思，本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得上述图8～图12所示实施例中的第三方应用服务器所执行的方法被执行。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种切片管理方法，其特征在于，所述方法包括：
    移动性管理网元发起切片请求，所述切片请求包括终端设备的终端标识；
    所述移动性管理网元接收来自第三方应用服务器的第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识所述第三方应用服务器为所述终端设备授权的切片；
    所述移动性管理网元向所述终端设备发送所述第一S-NSSAI。
  2. 如权利要求1所述的方法，其特征在于，所述第三方应用服务器为认证网元，所述移动性管理网元发起切片请求，包括：
    所述移动性管理网元发起切片认证请求，所述切片认证请求包括第二S-NSSAI和所述终端标识，所述第二S-NSSAI用于标识在数据管理网元中为所述终端设备签约的切片；
    对应的，所述移动性管理网元接收来自第三方应用服务器的第一S-NSSAI，包括：
    所述移动性管理网元接收来自所述认证网元的认证结果指示信息和所述第一S-NSSAI。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述移动性管理网元接收来自所述终端设备或数据管理网元的切片选择指示信息，所述切片选择指示信息用于指示由第三方应用为所述终端设备确定切片。
  4. 一种切片管理方法，其特征在于，所述方法包括：
    第三方应用服务器接收来自移动性管理网元的切片请求，所述切片请求包括终端设备的终端标识；
    所述第三方应用服务器根据所述终端标识确定所述第三方应用服务器为所述终端设备授权的切片；
    所述第三方应用服务器向所述移动性管理网元发送第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识所述第三方应用服务器为所述终端设备授权的切片。
  5. 如权利要求4所述的方法，其特征在于，所述第三方应用服务器为认证网元，第三方应用服务器接收来自移动性管理网元的切片请求，包括：
    所述认证网元接收来自所述移动性管理网元的切片认证请求，所述切片认证请求包括第二S-NSSAI和所述终端标识，所述第二S-NSSAI用于标识在数据管理网元中为所述终端设备签约的切片；
    对应的，所述第三方应用服务器向所述移动性管理网元发送第一S-NSSAI，包括：
    所述认证网元向所述移动性管理网元发送认证结果指示信息和所述第一S-NSSAI。
  6. 如权利要求2或5所述的方法，其特征在于，所述认证结果指示信息用于指示认证成功。
  7. 如权利要求2或5所述的方法，其特征在于，所述第二S-NSSAI与所述第一S-NSSAI相同，或者，所述第二S-NSSAI与所述第一S-NSSAI不同。
  8. 一种切片管理方法，其特征在于，所述方法包括：
    认证网元接收来自移动性管理网元发送的切片认证请求，所述切片认证请求包括终端设备的可扩展认证协议EAP标识响应消息和第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识在数据管理网元中为所述终端设备签约的至少两个切片中的一个切片；
    所述认证网元根据所述EAP标识响应消息是否通过认证且所述第一S-NSSAI标识的 切片是否是第三方应用服务器允许所述终端设备接入的切片的判断结果，生成认证结果指示信息，所述认证结果指示信息包括EAP成功消息或者EAP失败消息；
    所述认证网元向所述移动性管理网元发送所述认证结果指示信息。
  9. 一种切片管理方法，其特征在于，所述方法包括：
    移动管理网元发起切片认证请求，所述切片认证请求包括终端设备的可扩展认证协议EAP标识响应消息和第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识在数据管理网元中为所述终端设备签约的至少两个切片中的一个切片；
    所述移动管理网元接收来自认证网元的认证结果指示信息，其中，所述认证结果指示信息是所述认证网元根据所述EAP标识响应消息是否通过认证且所述第一S-NSSAI标识的切片是否是第三方应用服务器允许所述终端设备接入的切片的判断结果生成的。
  10. 一种切片管理方法，其特征在于，所述方法包括：
    第三方应用服务器确定允许终端设备接入的切片由第一切片变为第二切片；
    所述第三方应用服务器向移动性管理网元发送切片更新信息，所述切片更新信息包括第二单一网络切片选择辅助信息S-NSSAI，所述第二S-NSSAI用于标识所述第二切片。
  11. 一种切片管理方法，其特征在于，所述方法包括：
    移动性管理网元接收来自第三方应用服务器的切片更新信息，所述切片更新信息包括第二单一网络切片选择辅助信息S-NSSAI，所述第二S-NSSAI用于标识第二切片；
    所述移动性管理网元向终端设备发送所述第二S-NSSAI。
  12. 如权利要求11所述的方法，其特征在于，所述第三方应用服务器为认证网元，所述第二切片为未经过授权认证的切片，所述方法还包括：
    所述移动性管理网元发起对所述第二S-NSSAI进行认证的流程；
    在对所述第二S-NSSAI认证通过时，所述移动性管理网元向终端设备发送配置更新信息，所述配置更新信息用于更新所述终端设备允许接入的切片。
  13. 如权利要求12所述的方法，其特征在于，所述切片更新信息为切片重认证消息。
  14. 如权利要求10-13任一所述的方法，其特征在于，所述切片更新信息还包括用于标识所述第一切片的第一S-NSSAI，所述第一切片当前不允许所述终端设备接入。
  15. 一种切片管理装置，其特征在于，所述装置包括：
    发起单元，用于发起切片请求，所述切片请求包括终端设备的终端标识；
    接收单元，用于接收来自第三方应用服务器的第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识所述第三方应用服务器为所述终端设备授权的切片；
    发送单元，用于向所述终端设备发送所述第一S-NSSAI。
  16. 如权利要求15所述的装置，其特征在于，所述第三方应用服务器为认证网元，所述发起单元用于：
    发起切片认证请求，所述切片认证请求包括第二S-NSSAI和所述终端标识，所述第二S-NSSAI用于标识在数据管理网元中为所述终端设备签约的切片；
    对应的，所述接收单元用于：
    接收来自所述认证网元的认证结果指示信息和所述第一S-NSSAI。
  17. 如权利要求15或16所述的装置，其特征在于，所述接收单元还用于：
    接收来自所述终端设备或数据管理网元的切片选择指示信息，所述切片选择指示信息用于指示由第三方应用为所述终端设备确定切片。
  18. 一种切片管理装置，其特征在于，所述装置包括：
    接收单元，用于接收来自移动性管理网元的切片请求，所述切片请求包括终端设备的终端标识；
    确定单元，用于根据所述终端标识确定第三方应用服务器为所述终端设备授权的切片；
    发送单元，用于向所述移动性管理网元发送第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识所述第三方应用服务器为所述终端设备授权的切片。
  19. 如权利要求18所述的装置，其特征在于，所述第三方应用服务器为认证网元，所述接收单元用于：
    接收来自所述移动性管理网元的切片认证请求，所述切片认证请求包括第二S-NSSAI和所述终端标识，所述第二S-NSSAI用于标识在数据管理网元中为所述终端设备签约的切片；
    对应的，所述发送单元用于：
    向所述移动性管理网元发送认证结果指示信息和所述第一S-NSSAI。
  20. 如权利要求16或19所述的装置，其特征在于，所述认证结果指示信息用于指示认证成功。
  21. 如权利要求16或19所述的装置，其特征在于，所述第二S-NSSAI与所述第一S-NSSAI相同，或者，所述第二S-NSSAI与所述第一S-NSSAI不同。
  22. 一种切片管理装置，其特征在于，所述装置包括：
    接收单元，用于接收来自移动性管理网元发送的切片认证请求，所述切片认证请求包括终端设备的可扩展认证协议EAP标识响应消息和第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识在数据管理网元中为所述终端设备签约的至少两个切片中的一个切片；
    认证单元，用于根据所述EAP标识响应消息是否通过认证且所述第一S-NSSAI标识的切片是否是第三方应用服务器允许所述终端设备接入的切片的判断结果，生成认证结果指示信息，所述认证结果指示信息包括EAP成功消息或者EAP失败消息；
    发送单元，用于向所述移动性管理网元发送所述认证结果指示信息。
  23. 一种切片管理装置，其特征在于，所述装置包括：
    发起单元，用于发起切片认证请求，所述切片认证请求包括终端设备的可扩展认证协议EAP标识响应消息和第一单一网络切片选择辅助信息S-NSSAI，所述第一S-NSSAI用于标识在数据管理网元中为所述终端设备签约的至少两个切片中的一个切片；
    接收单元，用于接收来自认证网元的认证结果指示信息，其中，所述认证结果指示信息是所述认证网元根据所述EAP标识响应消息是否通过认证且所述第一S-NSSAI标识的切片是否是第三方应用服务器允许所述终端设备接入的切片的判断结果生成的。
  24. 一种切片管理装置，其特征在于，所述装置包括：
    确定单元，用于确定允许终端设备接入的切片由第一切片变为第二切片；
    发送单元，用于向移动性管理网元发送切片更新信息，所述切片更新信息包括第二单一网络切片选择辅助信息S-NSSAI，所述第二S-NSSAI用于标识所述第二切片。
  25. 一种切片管理装置，其特征在于，所述装置包括：
    接收单元，用于接收来自第三方应用服务器的切片更新信息，所述切片更新信息包括第二单一网络切片选择辅助信息S-NSSAI，所述第二S-NSSAI用于标识第二切片；
    发送单元，用于向终端设备发送所述第二S-NSSAI。
  26. 如权利要求25所述的装置，其特征在于，所述第三方应用服务器为认证网元，所述第二切片为未经过授权认证的切片，所述装置还包括认证单元，用于：
    发起对所述第二S-NSSAI进行认证的流程，并在对所述第二S-NSSAI认证通过时，向终端设备发送配置更新信息，所述配置更新信息用于更新所述终端设备允许接入的切片。
  27. 如权利要求26所述的装置，其特征在于，所述切片更新信息为切片重认证消息。
  28. 如权利要求24-27任一所述的装置，其特征在于，所述切片更新信息还包括用于标识所述第一切片的第一S-NSSAI，所述第一切片当前不允许所述终端设备接入。
  29. 一种通信设备，其特征在于，包括：
    至少一个处理器；以及与所述至少一个处理器通信连接的存储器、通信接口；
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，使得所述装置执行如权利要求1-14中任一项所述的方法。
  30. 一种计算机可读存储介质，其特征在于，包括程序或指令，当所述程序或指令在计算机上运行时，使得如权利要求1-14中任一项所述的方法被执行。
PCT/CN2021/116792 2020-09-22 2021-09-06 一种切片管理方法、装置及通信设备 WO2022062889A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011004194.4A CN114301788B (zh) 2020-09-22 2020-09-22 一种切片管理方法、装置及通信设备
CN202011004194.4 2020-09-22

Publications (1)

Publication Number Publication Date
WO2022062889A1 true WO2022062889A1 (zh) 2022-03-31

Family

ID=80844891

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/116792 WO2022062889A1 (zh) 2020-09-22 2021-09-06 一种切片管理方法、装置及通信设备

Country Status (2)

Country Link
CN (1) CN114301788B (zh)
WO (1) WO2022062889A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117296373A (zh) * 2022-04-25 2023-12-26 北京小米移动软件有限公司 跨网络的切换认证方法和装置
WO2023225878A1 (zh) * 2022-05-24 2023-11-30 北京小米移动软件有限公司 一种ai网络功能的重新认证授权方法/装置/设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110476447A (zh) * 2017-03-21 2019-11-19 诺基亚技术有限公司 在支持网络切片的移动系统中的增强的注册过程
WO2020056611A1 (zh) * 2018-09-18 2020-03-26 Oppo广东移动通信有限公司 用于网络切片鉴权的方法和设备
WO2020146211A1 (en) * 2019-01-11 2020-07-16 Idac Holdings, Inc. Methods and apparatuses for slice-specific authentication
WO2020168310A1 (en) * 2019-02-15 2020-08-20 Qualcomm Incorporated Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111356207A (zh) * 2020-02-18 2020-06-30 中国联合网络通信集团有限公司 一种业务的切片选择方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110476447A (zh) * 2017-03-21 2019-11-19 诺基亚技术有限公司 在支持网络切片的移动系统中的增强的注册过程
WO2020056611A1 (zh) * 2018-09-18 2020-03-26 Oppo广东移动通信有限公司 用于网络切片鉴权的方法和设备
WO2020146211A1 (en) * 2019-01-11 2020-07-16 Idac Holdings, Inc. Methods and apparatuses for slice-specific authentication
WO2020168310A1 (en) * 2019-02-15 2020-08-20 Qualcomm Incorporated Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZTE, ERICSSON, NOKIA, NOKIA SHANGHAI BELL.: "Replacing AUSF by NSSAAF to support NSSAA", 3GPP DRAFT; C4-203460.ZIP S2-2003744, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. E e-meeting; 20200601 - 20200605, 8 June 2020 (2020-06-08), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051894169 *

Also Published As

Publication number Publication date
CN114301788A (zh) 2022-04-08
CN114301788B (zh) 2023-09-08

Similar Documents

Publication Publication Date Title
US11032710B2 (en) Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization
EP3694181B1 (en) Session establishment method, device and system
US11451950B2 (en) Indirect registration method and apparatus
JP6768976B2 (ja) サブスクリプション更新方法、装置、及びシステム
WO2019196699A1 (zh) 一种获取安全策略的方法及设备
WO2012122920A1 (zh) 机器通信的私密性保护方法、系统和机器通信业务管理实体及相关设备
WO2020253701A1 (zh) 管理背景数据传输策略的方法、装置和系统
EP3962136A1 (en) Management of access tokens in communication networks
WO2022062889A1 (zh) 一种切片管理方法、装置及通信设备
WO2021203947A1 (zh) 一种通信方法及装置
WO2020147030A1 (zh) 一种小区注册方法及终端设备
WO2021047403A1 (zh) 一种多个nrf场景下的授权方法及装置
EP2304980B1 (en) A method and apparatus for a subscriber database
EP3759955B1 (en) Methods, devices, and computer programs for provisioning or controlling operator profiles in terminals
WO2021168829A1 (zh) 一种用户标识的验证方法及相关设备
US20240089735A1 (en) Roaming in cellular communication networks
WO2021204065A1 (zh) 一种通信方法及装置
WO2023066210A1 (zh) 鉴权方法及装置
EP4027678A1 (en) Authorization in cellular communication systems
US20230137283A1 (en) Systems and methods to optimize registration and session establishment in a wireless network
US20240073745A1 (en) Systems and methods for network-based slice access authorization
WO2024060894A1 (zh) 一种通信方法及装置
WO2023216879A1 (zh) 通信方法及装置
EP4044504A1 (en) User data privacy
Rajpal Framework for enabling machine‐type communication services

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21871261

Country of ref document: EP

Kind code of ref document: A1