WO2022068541A1 - 一种鉴权方法及其装置 - Google Patents

一种鉴权方法及其装置 Download PDF

Info

Publication number
WO2022068541A1
WO2022068541A1 PCT/CN2021/117151 CN2021117151W WO2022068541A1 WO 2022068541 A1 WO2022068541 A1 WO 2022068541A1 CN 2021117151 W CN2021117151 W CN 2021117151W WO 2022068541 A1 WO2022068541 A1 WO 2022068541A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
request
remote device
access
target
Prior art date
Application number
PCT/CN2021/117151
Other languages
English (en)
French (fr)
Inventor
周润泽
杨明月
陈中平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21874202.1A priority Critical patent/EP4210368A4/en
Publication of WO2022068541A1 publication Critical patent/WO2022068541A1/zh
Priority to US18/192,222 priority patent/US20230232318A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/14—Access restriction or access information delivery, e.g. discovery data delivery using user query or user detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/73—Access point logical identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/04—Terminal devices adapted for relaying to or from another terminal or user

Definitions

  • the present application relates to the field of communication technologies, and in particular, to an authentication method and device thereof.
  • FIG. 1a is a schematic diagram of a relay communication scenario.
  • a device outside the network coverage referred to as a remote device
  • the remote device can obtain various communication services.
  • the dotted circle represents the coverage of the base station.
  • the relay device With the continuous development of the relay technology, more and more remote devices are connected to the network through the relay device, which will make the network security low. For example, if the remote device wants to access a network service through the relay device, the network that provides this service will verify whether all the access devices have access rights, but the remote device is accessed through the relay device and can bypass the verified by the network.
  • the embodiments of the present application provide an authentication method and a device thereof, which can determine whether a target remote device has the right to access a network, which is beneficial to improving network security.
  • an embodiment of the present application provides an authentication method, the method includes: a first device receives a first request from a second device, where the first request includes an identifier of a target remote device, where the second device is In the case of a terminal device, the first request is used for the target remote device to request access to the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has access to the network. the right to access the network; the first device sends first information to the second device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the method may further include: the first device determining whether the target remote device has the right to access the network.
  • the specific implementation manner of the first device determining whether the target remote device has the right to access the network may be: if the identifier of the target remote device exists in the target identifier list, the first device determines the The target remote device has the right to access the network; the target identifier list includes one or more target identifiers, and the target identifiers are used to indicate the remote device that has the right to access the network.
  • the first request further includes a network identifier, and the aforementioned first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier; if the second device is a terminal device In this case, the first request is specifically used for the target remote device to request access to the network indicated by the network identifier; in the case that the second device is a network element, the first request is specifically used for requesting to determine the target remote device. Whether the end device has the right to connect to the network indicated by the network ID.
  • the method may further include: the first device sends an authentication request to the third device, where the authentication request includes an identifier of the target remote device, and the authentication request is used to request to determine the target remote device Whether the device has the right to access the network; the first device receives authentication result information from the third device, where the authentication result information is used to indicate whether the target remote device has the right to access the network.
  • the authentication result information is used to indicate that the target remote device has the right to access the network
  • the target identifier list includes One or more target identifiers, where the target identifiers are used to indicate remote devices that have access rights to the network.
  • the first request and the authentication request further include a network identifier
  • the authentication request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier
  • the first request information and the authentication result information are specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier
  • the first request is specifically used for the The target remote device requests to access the network indicated by the network identifier
  • the second device is a network element
  • the first request is specifically used to request to determine whether the target remote device has access to the network indicated by the network identifier network permissions.
  • the first request is further used for requesting to assign a network address to the target remote device; in the case that the target remote device has the right to access the network, the aforementioned first information may include a network address for the target remote device The target network address assigned by the device.
  • the method may further include: the first device sends a network address allocation request to the fourth device, where the network address allocation request is used for requesting to acquire a first number of network addresses; the first device obtains a network address from the fourth device; The device receives a first number of network addresses; the first number of network addresses is sent when the first number is less than or equal to the second number; wherein the second number is a remote device with the right to access the network
  • the first number of network addresses includes the aforementioned target network address.
  • the fourth device when the fourth device is the device responsible for allocating network addresses and the first number is multiple, the fourth device can avoid the following situation by allocating multiple network addresses at one time: In the case of an incoming request, the first device needs to re-request to the fourth device for each remote device to assign a network address to the remote device. Therefore, by allocating multiple network addresses at one time, unnecessary interaction between the first device and the fourth device can be reduced, thereby saving resources.
  • an embodiment of the present application provides another authentication method.
  • the method includes: a second device sends a first request to a first device, where the first request includes an identifier of a target remote device, where the second device is In the case of a terminal device, the first request is used for the target remote device to request access to the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has access to the network. the right to access the network; the second device receives the first information from the first device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the first request further includes an identifier of the network, and the foregoing first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier; where the second device is a terminal device
  • the first request is specifically used for the target remote device to request access to the network indicated by the network identifier; in the case that the second device is a network element, the first request is specifically used for requesting to determine the target Whether the remote device has the right to access the network indicated by the network identifier.
  • the first request is further used to request to allocate a network address to the target remote device; in the case that the target remote device has the right to access the network, the first information includes the allocation of a network address to the target remote device. destination network address.
  • an embodiment of the present application provides a communication device, the communication device has some or all of the functions of the first device in the method example described in the first aspect.
  • the function of the communication device may have the Some or all of the functions in the embodiments may also have the functions of independently implementing any one of the embodiments in this application.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the structure of the communication apparatus may include a processing unit and a communication unit, and the processing unit is configured to support the communication apparatus to perform the corresponding functions in the above method.
  • the communication unit is used to support communication between the communication device and other devices.
  • the communication device may also include a storage unit for coupling with the processing unit and the sending unit, which stores computer programs and data necessary for the communication device.
  • the communication apparatus includes: a processing unit for invoking the communication unit to receive a first request from a second device, where the first request includes an identifier of a target remote device, where the second device is a terminal
  • the first request is used for the target remote device to request access to the network
  • the second device is a network element
  • the first request is used to request to determine whether the target remote device has access to the network network authority
  • the processing unit is further configured to call the communication unit to send first information to the second device, where the first information is used to indicate whether the target remote device has the authority to access the network.
  • the processing unit may be a processor
  • the communication unit may be a transceiver or a communication interface
  • the storage unit may be a memory.
  • the communication apparatus includes: a processor for invoking the transceiver to receive a first request from a second device, where the first request includes an identifier of a target remote device, where the second device is a terminal
  • the first request is used for the target remote device to request access to the network
  • the second device is a network element
  • the first request is used to request to determine whether the target remote device has access to the network network authority
  • the processor is further configured to call the transceiver to send first information to the second device, where the first information is used to indicate whether the target remote device has the authority to access the network.
  • an embodiment of the present application provides another communication device, the communication device having to implement part or all of the functions of the second device in the method example described in the second aspect above, for example, the function of the communication device may have the functions of the Some or all of the functions in the embodiments may also have the functions of independently implementing any one of the embodiments in this application.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the structure of the communication apparatus may include a processing unit and a communication unit, and the processing unit is configured to support the communication apparatus to perform the corresponding functions in the above method.
  • the communication unit is used to support communication between the communication device and other devices.
  • the communication device may also include a storage unit for coupling with the processing unit and the sending unit, which stores computer programs and data necessary for the communication device.
  • the communication apparatus includes: a processing unit for invoking the communication unit to send a first request to the first device, where the first request includes an identifier of the target remote device, where the communication apparatus is a terminal device
  • the first request is used for the target remote device to request access to the network
  • the processing unit is further configured to call the communication unit to receive the first information from the first device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the processing unit may be a processor
  • the communication unit may be a transceiver or a communication interface
  • the storage unit may be a memory.
  • the communication apparatus includes: a processor for invoking the transceiver to send a first request to the first device, where the first request includes an identifier of the target remote device, where the communication apparatus is a terminal device
  • the first request is used for the target remote device to request access to the network
  • the communication device is a device in a network element
  • the first request is used to request to determine whether the target remote device is Having the right to access the network
  • the processor is further configured to call the transceiver to receive first information from the first device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • an embodiment of the present invention provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and the computer program includes program instructions that, when executed by a communication device, cause the communication device to The method of the first aspect above is performed.
  • an embodiment of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and the computer program includes program instructions that, when executed by a communication device, cause the communication device to The method of the second aspect above is performed.
  • the present application further provides a computer program product comprising a computer program, which, when run on a computer, causes the computer to execute the method described in the first aspect.
  • the present application further provides a computer program product comprising a computer program, which, when run on a computer, causes the computer to execute the method described in the second aspect above.
  • the present application provides a chip system
  • the chip system includes at least one processor and an interface for supporting the first device to implement the functions involved in the first aspect, for example, determining or processing the functions involved in the above method. at least one of data and information.
  • the chip system further includes a memory for storing necessary computer programs and data of the first device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the present application provides a chip system
  • the chip system includes at least one processor and an interface for supporting the second device to implement the functions involved in the second aspect, for example, determining or processing the functions involved in the above method. at least one of data and information.
  • the chip system further includes a memory for storing necessary computer programs and data of the second device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • FIG. 1a is a schematic diagram of a relay communication scenario provided by an embodiment of the present application.
  • FIG. 1b is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application.
  • FIG. 2a is a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • FIG. 2b is a schematic diagram of a process in which a first device requests a fourth device to allocate an IP address according to an embodiment of the present application
  • 2c is a schematic diagram of a process in which a first device requests a fifth device to allocate an IP address according to an embodiment of the present application
  • 3a is a schematic flowchart of another authentication method provided by an embodiment of the present application.
  • 3b is a schematic diagram of a scenario in which an IP address is pre-allocated to a remote device (including a target remote device) provided by an embodiment of the present application;
  • 4a is a schematic flowchart of another authentication method provided by an embodiment of the present application.
  • 4b is a schematic diagram of a scenario in which a device responsible for authentication and a device responsible for allocating an IP address to a target remote device provided by an embodiment of the present application are both third devices;
  • 4c is a schematic diagram of a scenario in which a device responsible for authentication and a device responsible for allocating an IP address for a target remote device provided by an embodiment of the present application are different devices;
  • FIG. 5 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • FIG. 1b is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • the communication system may include, but is not limited to, a network device, a first device, and a second device.
  • the number and form of devices shown in FIG. 1b are used as examples and do not constitute limitations to the embodiments of the present application.
  • the communication system shown in FIG. 1b is taken as an example including a network device, a first device and a second device.
  • the second device may be a terminal device or a network element.
  • the terminal device may refer to a target remote device that wishes to access the network; or the terminal device may refer to a relay device, which is a relay device that receives a network access request from the target remote device.
  • the network element may refer to a session management function (session management function, SMF) network element or other core network network elements.
  • SMF session management function
  • This embodiment of the present application does not limit the specific technology and specific device form used by the network element.
  • SMF can be used to be responsible for session management in mobile networks, such as session establishment, modification, and release. Specifically, the SMF can be used to assign an Internet Protocol (IP) address to a user, select a user plane function (user plane function, UPF) network element that provides a packet forwarding function, and the like.
  • IP Internet Protocol
  • UPF user plane function
  • the first device may be a relay device.
  • the first request sent by the second device to the first device is used by the target remote device to request access to the network, that is, the first request sent by the target remote device to the relay device is used by the target remote device to request access to the network .
  • the first device may be a network element (eg, SMF) serving the relay device.
  • SMF network element
  • the first request sent by the second device to the first device is used for the target remote device to request access to the network, that is, the first request sent by the relay device to the network element (such as SMF) serving the relay device Used by the target remote device to request access to the network.
  • the first device may be a rights management device.
  • the rights management device may be used to record whether a certain remote device has the right to access the network, or whether a certain remote device has the right to access the network through the relay device.
  • the rights management device may be an authentication, authorization, and accounting (authentication, authorization, accounting, AAA) server, referred to as a 3A server for short.
  • the rights management device may be an application function (application function, AF) network element.
  • the remote device in the embodiment of the present application is a terminal device outside the network coverage, and the relay device is a terminal device within the network coverage.
  • the terminal device is an entity on the user side for receiving or transmitting signals, such as a mobile phone.
  • a terminal device may also be referred to as a terminal (terminal), a user equipment (UE), a mobile station (mobile station, MS), a mobile terminal (mobile terminal, MT), and the like.
  • the terminal device can be a mobile phone (mobile phone), a wearable device, a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, industrial Wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grid, transportation security Wireless terminals in safety), wireless terminals in smart cities, wireless terminals in smart homes, wireless terminals in the Internet of Things, and so on.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device. It should be noted that, in this embodiment of the present application, the relay device may only be used to assist the remote device to access the network. Alternatively, the relay device may also have the function of a common terminal device.
  • the first device is used as the relay device and the second device is used as the target remote device as an example for introduction, which does not constitute a limitation to the embodiments of the present application.
  • the first device may be configured to receive a first request from a second device and send first information to the second device.
  • the first request includes the identifier of the target remote device, and when the second device is a terminal device (such as the target remote device in FIG. 1b ), the first request is used by the target remote device to request a connection access the network; the first information is used to indicate whether the target remote device has the right to access the network.
  • the target remote device is the remote device that wishes to access the network.
  • the identifier of the target remote device is used to uniquely identify the target remote device, and this application does not limit the form of the identifier.
  • the circular area is the network coverage of the network device, and in this embodiment of the present application, the circular area may be used to indicate the coverage of the network that the target remote device wishes to access.
  • the first device When the first device receives the first request, it indicates that the target remote device wishes to access the network. After receiving the first request, the first device can determine whether the target remote device has the right to access the network, and send the first information to the second device. By implementing the embodiments of the present application, it can be determined whether the target remote device has the right to access the network, thereby helping to improve network security.
  • the network involved in the embodiments of the present application may refer to a data network, a local area network (LAN), a core network (such as a 4G core network, a 5G core network) network, etc.) or other types of networks, which are not limited in this embodiment of the present application.
  • a data network may refer to a data network, a local area network (LAN), a core network (such as a 4G core network, a 5G core network) network, etc.) or other types of networks, which are not limited in this embodiment of the present application.
  • the target remote device can use the target network address to send to the network Send information to obtain network service.
  • the target remote device sends information to the network through the target network address means: the target remote device sends information to the relay device through the target network address, and the relay device sends the information to the network.
  • the first device may also send the target network address allocated for the target remote device to the second device. In this way, when the target remote device has the right to access the network, assigning a network address to the target remote device can prevent the remote device that cannot be accessed from accessing the network, thereby helping to improve network security .
  • the network address mentioned in the embodiments of the present application may refer to an internet protocol (internet protocol, IP) address or a media access control address (media access control address, MAC).
  • IP internet protocol
  • MAC media access control address
  • the network address is an IP address as an example for description, which does not constitute an embodiment of the present application.
  • the contents related to assigning IP addresses also apply to assigning MAC addresses.
  • the target remote device may access the network through a relay device.
  • the authentication request mentioned in this embodiment of the present application may be used to request to determine whether the target remote device has the right to access the network through the relay device.
  • the authentication result information to be mentioned in this embodiment of the present application may be used to indicate whether the target remote device has the right to access the network through the relay device.
  • the first request may be used to request to determine whether the target remote device has the right to access the network, that is, the first request may be used to request to authenticate the target remote device .
  • the first request may be specifically used to request to determine whether the target remote device has the right to access the network through the relay device.
  • the response information corresponding to the first request ie, the first information
  • the right to access the network mentioned in the embodiments of this application may refer to: the right to access the network through the relay device.
  • the right to access the network may be described as the right to access the network.
  • the remote device and the relay device may communicate through a proximity service (proximity service, ProSe) communication technology.
  • the short-range communication technology may include, but is not limited to, device to device (device to device, D2D) communication, wireless fidelity (wireless fidelity, WiFi) communication, and Bluetooth (blueteeth) communication.
  • the second device when the second device is not the target remote device, after receiving the first information, the second device can also send the first information to the target remote device.
  • the second device when the second device is a relay device and the first device is an SMF network element, after receiving the first information, the relay device may also send the first information to the target remote device. If the second device is not the target remote device, after receiving the target IP address, the second device may also send the target IP address to the target remote device.
  • the network device in this embodiment of the present application is an entity on the network side that is used to transmit or receive signals.
  • the network device may be an evolved NodeB (eNB), a transmission reception point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or Access nodes in wireless fidelity (wireless fidelity, WiFi) systems, etc.
  • eNB evolved NodeB
  • TRP transmission reception point
  • gNB next generation NodeB
  • gNB next generation NodeB
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the network device.
  • FIG. 2a is a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • the execution body of step S201 is the second device or a chip in the second device
  • the execution body of step S202 is the first device or a chip in the first device
  • the first device and the second device are hereinafter referred to as
  • the execution subject of the authentication method is taken as an example for description.
  • the method may include but is not limited to the following steps:
  • Step S201 The second device sends a first request to the first device, where the first request includes the identifier of the target remote device, and in the case that the second device is a terminal device, the first request is used for the target remote device Request to access the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network.
  • the target remote device when it needs to access the network (or the target remote device needs to access the network through the relay device), it can send a request to the relay device to request to access the network.
  • the purpose of sending the request is to access the network, rather than actively requesting the network or other devices (such as relay devices) to authenticate the target remote device.
  • requesting to authenticate the target remote device refers to requesting to determine whether the target remote device has the right to access the network.
  • the purpose of sending the first request by the second device may be to request to connect the target remote device to the network .
  • the first device in order to improve network security, when the first request is received, it can be determined whether the target remote device has the right to access the network, and then when it is determined that it has the right to access the network The target remote device is only allowed to access.
  • the second device When the second device is a network element (such as SMF) serving the relay device, and the first device may be a rights management device, the second device sends a first request to request to determine whether the target remote device has access network permissions. It is possible to prevent a remote device that does not have the right to access the network from accessing the network, thereby helping to improve the security of the network.
  • the second device When the second device is a network element (such as SMF) serving the relay device, and the first device may be a rights management device, the second device sends a first request to request to determine whether the target remote device has access network permissions. It is possible to prevent a remote device that does not have the right to access the network from accessing the network, thereby helping to improve the security of the network.
  • SMF network element
  • Step S202 The first device sends first information to the second device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the first device may trigger an authentication process for the target remote device.
  • the authentication process for the target remote device is used to determine whether the target remote device has the right to access the network. If the target remote device has the right to access the network, the first information sent by the first device to the second device is used to indicate that the target remote device has the right to access the network. If the target remote device does not have the right to access the network, the first information is used to indicate that the target remote device does not have the right to access the network.
  • the authentication mechanism for the target remote device to access the network is added (that is, to determine whether the target remote device has the right to access the network), which can prevent the remote device that cannot access the network from accessing the network, which is beneficial to Improve network security.
  • the foregoing first request may also be used to request to assign a network address to the target remote device; in the case that the target remote device has the right to access the network, the first information may include a request for the target remote device to be assigned a network address.
  • the target network address assigned by the remote device if the target remote device has the right to access the network, the first device can send the target network address allocated for the target remote device to the second device.
  • the target remote device does not have the right to access the network, the first device may not send the target network address to the second device. In this way, when the target remote device has the right to access the network, assigning a network address to the target remote device can prevent the remote device that cannot be accessed from accessing the network, thereby helping to improve network security .
  • the first information can include explicit indication information or implicit indication information, and the indication information is used for It is used to indicate whether the target remote device has the right to access the network. For example, if the first information includes the target network address, after receiving the first information, the second device may determine that the target remote device has the right to access the network. In this case, the indication information in the first information is implicit indication information. If the first information does not include the target network address, after receiving the first information, the second device may determine that the target remote device does not have the right to access the network. In this case, the indication information in the first information is implicit indication information.
  • the indication information in the first information is a field or a binary bit including 1 bit (represented as 0 or 1).
  • the indication information in the first information is explicit indication information.
  • the indication information in the first information is explicit indication information.
  • the first device itself can authenticate the target remote device, and for details of the authentication process, refer to the description in the embodiment of FIG. 3a.
  • the first device may request the third device to authenticate the target remote device. For details of the authentication process, refer to the description in the embodiment of FIG. 4a.
  • the remote device can access the network through a certain designated relay device, or can access the network through any one of multiple designated relay devices, or can use any supported relay technology devices are connected to the network.
  • the embodiment of the present application may not limit the specific relay device through which the target remote device accesses the network.
  • the authentication process for the target remote device can be used to: determine whether the target remote device has the right to access the network through the relay technology.
  • the target remote device can only access the network through one or some designated relay devices.
  • the authentication process for the target remote device can be used to: determine whether the relay device involved in the process of requesting access to the network by the target remote device is the aforementioned designated relay device, and whether the target remote device is Has the right to access the network through relay technology. If the relay device involved in the process of requesting access to the network by the target remote device is the aforementioned designated relay device, and the target remote device has the authority to access the network through the relay technology, it means that the target remote device authenticates The right to pass means that the target remote device has the right to access the network through the relay device.
  • the relay device involved in the process of requesting access to the network by the target remote device is not the aforementioned designated relay device, and/or the target remote device does not have the authority to access the network through the relay technology, it means that If the authentication of the target remote device fails, it means that the target remote device does not have the right to access the network through the relay device.
  • one relay device may assist one or more remote devices to access the network.
  • a relay device can assist a limited number of remote devices to access the network.
  • the remote devices that a relay device can assist in accessing the network are some designated remote devices, and the remote devices that different relay devices can assist in accessing the network may be the same or different.
  • the authentication process for the target remote device can be used to determine whether the relay device involved in the process of requesting access to the network by the target remote device can assist the remote device accessing the network, and whether the target remote device. If it is included, it means that the authentication of the target remote device has passed, which means that the target remote device has the right to access the network through the relay device. If it is not included, it means that the authentication of the target remote device fails, which means that the target remote device does not have the right to access the network through the relay device.
  • the target remote device may be allocated a target network address by the first device.
  • the first device may request other devices (eg, the fourth device or the fifth device) to assign a target network address to the target remote device.
  • the SMF or 3A server may be requested to assign a target network address to the target remote device.
  • the device responsible for allocating the network address may pre-allocate the network address to each remote device having access to the network.
  • multiple network addresses can be assigned at one time.
  • the remote device can also be assigned a network address. It should be noted that, after a remote device initiates a network access request, it needs to pass the authentication of the remote device and the remote device has a network address before it can successfully access the network to obtain network services.
  • the device responsible for allocating the network address may assign the network address to the remote device that has the right to access the network and has initiated a network access request.
  • a network address can be allocated to the remote device under the condition that the remote device needs to access the network.
  • the process of assigning a network address by the first device is as follows: the first device assigns a target network address to the target remote device, and sends the target network address to the second device.
  • the second device may send the target network address to the target remote device.
  • the relay device can send the target network address to the target remote device.
  • the SMF can send the target network address to the relay device.
  • the relay device can send the target network address from the SMF to the target remote device.
  • the first device assigns a network address as follows: the first device assigns network addresses (including target network addresses) to multiple remote devices (including target remote devices) respectively, and assigns the assigned network addresses to the The network address is sent to the second device.
  • the second device may send the received and The network address corresponding to the remote device is sent to the remote device.
  • the first device assigns network address 1 to remote device 1, assigns network address 2 to remote device 2, assigns network address 3 to remote device 3, and assigns the assigned network addresses (ie network address 1, network address 2 and network address 3) to the second device.
  • the second device may send the network address 1 to the remote device 1 when the remote device 1 initiates a network access request.
  • the second device may send the network address 2 to the remote device 2 when the remote device 2 initiates a network access request.
  • the second device may send the network address 3 to the remote device 3 when the remote device 3 initiates a network access request.
  • the two devices may communicate directly or indirectly through other devices or network elements, and the embodiments of the present application do not limit the communication mode between the two devices.
  • the first device is an SMF and the second device is a relay device
  • the relay device after receiving the network address, the relay device can directly send the network address to the corresponding remote device.
  • the SMF can send the network address to the corresponding remote device through the relay device.
  • the process of the first device requesting the fourth device to allocate a network address may be as shown in FIG. 2b, including but not limited to steps s1 to s2:
  • Step s1 The first device sends a network address allocation request (also referred to as a first network address allocation request) to the fourth device, and the network address allocation request is used to request to obtain a first number of network addresses; where the first number may be one or more;
  • Step s2 In the case that the first number is less than or equal to the second number, the fourth device sends the network address of the first number to the first device; wherein, the second number is the right to access the network.
  • the number of remote devices; the first number of network addresses includes the aforementioned target network addresses.
  • the second number is the number of remote devices that have the right to access the network, that is, a maximum of the second number of remote devices can access the network.
  • the second number is the number of remote devices that have the right to access the network through the relay device, that is, a maximum of the second number of remote devices can access the network through the relay device. It should be noted that, at this time, it is not limited which relay device each remote device uses to access the network.
  • the fourth device sends the first number of network addresses to the first device.
  • the fourth device is the device responsible for allocating network addresses and the first number is multiple, the fourth device can avoid the following situation by allocating multiple network addresses at one time: In the case of an incoming request, the first device needs to re-request to the fourth device for each remote device to assign a network address to the remote device. Therefore, by allocating multiple network addresses at one time, unnecessary interaction between the first device and the fourth device can be reduced, thereby saving resources.
  • the first quantity may be configured by the network (for example, delivered in a system message or proprietary signaling), or may be agreed by a protocol, or may be set by default by the first device, or may be set by a user and modifications, which are not limited in the embodiments of the present application.
  • the sixth device may inform the fourth device in advance of the second quantity, or the fourth device may request the sixth device for acquisition.
  • the sixth device may be a unified data management (unified data management, UDM) network element, or the aforementioned rights management network element.
  • the second quantity may be determined by the configuration information corresponding to the foregoing network, or may be configured by the network (for example, delivered in a system message or proprietary signaling), or may be agreed by a protocol, or It may be set by default by the fourth device, or may be set and changed by a user, which is not limited in this embodiment of the present application.
  • the configuration information corresponding to the network may indicate the number (ie, the second number) of remote devices that can access the network.
  • the aforementioned network address allocation request may include indication information for indicating a target relay device; the target relay device may be a middle-of-the-road device involved in the process of requesting access to the network by the aforementioned target remote device. follow the device.
  • the aforementioned second number may specifically be the number of remote devices that have the right to access the network through the target relay device.
  • the number of remote devices that different relay devices can assist in accessing the network may be the same or different. In other words, taking the relay device including relay device 1 and relay device 2 as an example, the number of remote devices that have the right to access the network through relay device 1 is the same as the number of remote devices that have the right to access the network through relay device 2.
  • the number of remote devices can be the same or different.
  • the network address assignment request may be included in a session establishment request, and the session establishment request may be used to request the creation of a session with the first device.
  • the session with the first device may be used to transmit information sent by the first device.
  • the session mentioned in the embodiments of this application may refer to a protocol data unit (protocol data unit, PDU) session.
  • the embodiment of the present application does not limit the order in which the first device receives the foregoing first request and performs step s1.
  • the first device may perform step s1 after receiving the first request; or, may perform step s1 before receiving the first request; or, may perform step s1 before receiving the first request and receive the aforementioned the first number of network addresses; alternatively, step s1 and receiving the first request may be performed simultaneously.
  • the process of the first device requesting the fifth device to allocate a network address may be as shown in Figure 2c, including but not limited to steps s1' to s2':
  • Step s1' the first device sends a second network address allocation request to the fifth device, and the second network address allocation request is used to request to allocate a network address for the aforementioned target remote device;
  • Step s2' the fifth device sends the target network address (such as the target IP address) allocated to the target remote device to the first device.
  • the target network address such as the target IP address
  • the first device may send the second network address allocation request to the fifth device when the target remote device has the right to access the network.
  • the fifth device is requested to assign the target network address. Even if the fifth device assigns the target network address, the first device will not send the target network address to the target remote device. Therefore, when the target remote device has the right to access the network, sending the second network address allocation request to the fifth device is beneficial to avoid unnecessary communication processes between the first device and the fifth device, and thus is beneficial to Avoid wasting resources.
  • the second network address allocation request may be included in a session establishment request, and the session establishment request may be used to request the creation of a session with the first device.
  • the second network address assignment request may be included in the session update request.
  • the network has already created a session with the first device, so after receiving the second network address assignment request, the SMF does not need to create a session A new session on the first device.
  • the fourth device and the fifth device may be the same device or different devices.
  • the first device receives the first data packet from the second device, and the first data packet is related to the first device. If the session is established successfully, the first device can process the first data packet to obtain a second data packet; and transmit the second data packet through the session.
  • the source IP address of the first data packet is the IP address (ie, the target IP address) allocated to the target remote device, and the source IP address of the second data packet is the IP address of the first device.
  • a specific implementation manner in which the first device may process the first data packet may be: the first device changes the source IP address of the first data packet from the destination IP address to the IP address of the first device . Or, the first device performs encapsulation processing on the first data packet, and the source IP address added to the first data packet in the encapsulation processing is the IP address of the first device.
  • the first data packet (ie, the second data packet) after the encapsulation process carries two source IP addresses, wherein the source IP address of the outer layer encapsulation is the IP address of the first device, and the source IP address of the inner layer encapsulation is the IP address of the first device. is the target IP address.
  • the feedback data packet can be sent to the remote device whose IP address is the target IP address (ie, the target remote device) according to the target IP address encapsulated in the inner layer.
  • the transmission of the second data packet by the first device through the session refers to: the first device transmits the second data packet to a user plane function (user plane function, UPF) network element through the session.
  • the IP address (including the target IP address) allocated to the remote device may be a public network IP address or a private network IP address.
  • the IP address (including the target IP address) assigned to the remote device can be an IPv4 address or an IPv6 address. This embodiment of the present application does not limit this.
  • the device responsible for allocating the network address may also send the network address allocated for the remote device to the UPF after allocating the network address to the remote device.
  • the UPF can configure the network address as the information for sending and receiving packets on the N6 interface.
  • the N6 interface can successfully identify the information to be sent to the remote device, and then send the information to be sent to the remote device to the remote device.
  • the N6 interface protocol in the 5G protocol corresponds to the interface protocol between the UPF and the data network (DN).
  • the UPF may also store the correspondence between the network address of the remote device and the network address of the relay device (corresponding to the remote device).
  • the relay device corresponding to the remote device may refer to: the remote device accesses the network through the relay device.
  • the UPF stores the corresponding relationship, so that the information that needs to be sent to the remote device is routed to the relay device corresponding to the remote device according to the corresponding relationship, and then the information to be sent to the remote device is sent through the relay device. to the remote device.
  • an authentication mechanism for the target remote device to access the network is added, and it can be determined whether the target remote device has the right to access the network, so as to prevent the remote device that cannot access the network from accessing the network, thereby preventing the remote device from accessing the network. Helps to improve network security.
  • FIG. 3a is a schematic flowchart of another authentication method provided by an embodiment of the present application, and the method describes in detail how the first device authenticates the target remote device.
  • the execution subject of step S301 is the second device or a chip in the second device
  • the execution subject of steps S302 to S303 is the first device or a chip in the first device.
  • the second device is the execution subject of the authentication method as an example for description.
  • the method may include but is not limited to the following steps:
  • Step S301 The second device sends a first request to the first device, where the first request includes the identifier of the target remote device, and in the case that the second device is a terminal device, the first request is used for the target remote device Request to access the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network.
  • step S301 for the execution process of step S301, reference may be made to the specific description of step S201 in FIG. 2a, which will not be repeated here.
  • Step S302 if the identifier of the target remote device exists in the target identifier list, the first device determines that the target remote device has the right to access the network; wherein, the target identifier list includes one or more target identifiers, The target identifier is used to indicate the remote device that has the right to access the network.
  • the authentication process for the target remote device may be completed locally on the first device.
  • the authentication process is specifically as follows: after receiving the first request, the first device determines whether the target remote device has the right to access the network.
  • the first device may determine whether the target remote device has the right to access the network through but not limited to the following methods: (1) According to whether the current location of the target remote device is allowing access to the network Within the location area of the target remote device, determine whether the target remote device has the right to access the network. If it is, it can be determined that the target remote device has the right to access the network; if it is not, it can be determined that the target remote device does not have the right to access the network.
  • the location area that allows access to the network may be the first tracking area, and the first tracking area may be determined by a tracking area code (tracking area code, TAC).
  • TAC tracking area code
  • the target remote device may be allowed to access the network.
  • the target remote device may be allowed to access the network if the target remote device is not located in the first tracking area.
  • the capabilities of the target remote device may include: whether it has the Ethernet communication capability, whether it has the switch capability, and the like.
  • the target remote device has the right to access the network; if it does not have the capability, it can be determined that the target remote device does not have the right to access the network.
  • the network subscription for the target remote device determines whether the target remote device has the right to access the network. Wherein, whether the subscription of the network for the target remote device is valid can represent whether the target remote device is allowed to access the network. If the network subscription for the target remote device is valid, it can be determined that the target remote device has the right to access the network; if the network subscription for the target remote device is invalid, it can be determined that the target remote device does not have access to the network. access to the network.
  • the target remote device determines whether the target remote device has the right to access the network. If it exists, it indicates that the target remote device has the right to access the network. If it does not exist, it means that the target remote device does not have the right to access the network.
  • the target identification list may be stored locally in the first device.
  • the target identification list in the first device may be pre-configured for the first device by the aforementioned rights management device (eg, 3A server, AF).
  • the target identification list may be pre-sent to the first device by the rights management device.
  • each network may correspond to an identification list.
  • the identification list corresponding to the network can be used to indicate each remote device having the right to access the network.
  • the relay device stores an identification list 1 and an identification list 2, and the identification list 1 corresponds to the network 1 and is used to indicate each remote device that has the authority to access the network 1; the identification list 2 corresponds to the network 2 and is used to indicate that it has Each remote device that has access rights to the network 2 . If remote device 1 requests to access network 1 and remote device 2 requests to access network 2, the authentication process of the relay device for remote device 1 is as follows: the relay device determines whether the identifier of remote device 1 exists in the identifier list 1, if it exists, it indicates that the remote device 1 has the right to access the network 1.
  • the authentication process of the relay device for the remote device 2 is as follows: the relay device 1 determines whether the identifier of the remote device 2 exists in the identifier list 2 . If it does not exist, it indicates that the remote device 2 does not have the right to access the network 2 .
  • an identification list corresponding to the network may be used to indicate each remote device that has the right to access the network through the relay device.
  • different remote devices may request to access different networks through the same relay device. For example, remote device 1 may request to access network 1 through relay device 1, and remote device 2 may request to access network 2 through relay device 1 or relay device 2.
  • the aforementioned network may refer to a data network, a local area network (LAN), a core network (such as a 4G core network, a 5G network core network, etc.) or other types of networks, which are not limited in this embodiment of the present application.
  • the relay device can broadcast the network identifier that the relay device can access on the sidelink (SL) interface, so that the remote device can access the network according to the network it wants to access.
  • a relay device of the network initiates a network access request.
  • a side link may also be referred to as a side link or a pass-through link.
  • the aforementioned first request may further include a network identifier, and in this case, the aforementioned first information may be specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier.
  • the second device is a terminal device (such as a target remote device or a terminal device)
  • the first request is specifically used by the target remote device to request access to the network indicated by the network identifier; when the second device is In the case of a network element, the first request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier.
  • the network identifier is used to uniquely identify a network.
  • the network identifier can be an identifier of a data network, an identifier of a local area network (LAN), an identifier of a core network (such as a 4G core network, a 5G core network, etc.), or an identifier of other types of networks.
  • LAN local area network
  • core network such as a 4G core network, a 5G core network, etc.
  • the target identifier list can be associated with the network identifier.
  • the target The identifier can be specifically used to indicate a remote device that has the right to access the network indicated by the network identifier.
  • a network identifier can be associated with an identifier list, and for a certain network, the identifier list associated with the network identifier can be used to indicate each remote device that has the right to access the network indicated by the network identifier. Therefore, after the first device receives the first request, the authentication process for the target remote device is as follows: obtain a list of target identifiers associated with the network identifier in the first request, and determine whether the identifier of the target remote device exists. In the target ID list, if it exists, it indicates that the target remote device has the right to access the network (indicated by the network ID). If it does not exist, it means that the target remote device does not have the right to access the network.
  • the network identifier is the identifier of the LAN, members who do not belong to the LAN can be prevented from joining the LAN session.
  • Step S303 The first device sends first information to the second device, where the first information is used to indicate that the target remote device has the right to access the network.
  • the first information that the first device can send to the second device is used to indicate that the target remote device has access network permissions. If the target remote device does not have the right to access the network (such as a data network or a LAN), the first information sent by the first device to the second device is used to indicate that the target remote device does not have access to the network. permissions. In an implementation manner, if the target remote device has the right to access a network (such as a data network or a LAN), the first device can send the target network address allocated for the target remote device to the second device .
  • a network such as a data network or a LAN
  • the first device may not send the target network address to the second device.
  • a network such as a data network or a LAN
  • the first device may not send the target network address to the second device.
  • the device that assigns a network address to the remote device may be the first device, or the first device may request another device (eg, a fourth device or a fifth device) to assign a network address to the remote device.
  • the network address of the remote device may be pre-allocated and stored in the first device.
  • the remote device eg, the target remote device
  • the first device may send the network address (ie, the target network address) assigned to the target remote device to the second device.
  • passing the authentication of a certain device described in the embodiments of this application refers to determining that the device has the right to access the network.
  • the failure of authentication of a device described in the embodiments of this application refers to determining that the device does not have the right to access the network.
  • the remote devices (including the target remote device) are pre-determined.
  • a schematic diagram of a scenario where the device) allocates a network address may be as shown in Figure 3b.
  • the target remote device sends a first request to the relay device, indicating that the target remote device wishes to access the network.
  • the first request is used for the target remote device to request to access the network, and also to request to allocate a network address to the target remote device.
  • the relay device before receiving the first request, can send a network address allocation request to the SMF to pre-request the SMF for multiple (ie the first number) remote devices (including the target remote device) respectively. Assign a network address.
  • the SMF can obtain the second quantity from the UDM, and when the first quantity is less than or equal to the second quantity, allocate a network address to each of the foregoing multiple remote devices , and send the network address assigned to each remote device to the relay device.
  • the relay device when the relay device receives the first request and passes the authentication of the target remote device (for example, the target remote device's ID exists in the target ID list), it can obtain the SMF from the local storage as the target remote device
  • the assigned target network address, and the target network address is carried in the first information (the first information is used to indicate that the target remote device has the right to access the network) and sent to the target remote device.
  • the first device may trigger the process of allocating a network address to the target remote device after determining that the authentication of the target remote device has passed. For example, when the device that allocates the network address to the remote device is the first device, the first device may allocate the network address to the target remote device after determining that the target remote device has passed the authentication. For another example, when the first device requests another device (such as the fourth device or the fifth device) to assign a network address to the remote device, the first device may request the other device after determining that the target remote device has passed the authentication (eg, the fourth device or the fifth device) assigns a network address to the remote device. In this way, it is possible to avoid a situation where the process of allocating a network address to a remote device is triggered, but the authentication result of the remote device is an authentication failure, thereby helping to avoid waste of resources.
  • the authentication result of the remote device is an authentication failure
  • an authentication mechanism for the target remote device to access the network is added, and it can be determined whether the target remote device has the right to access the network, so as to prevent the remote device that cannot access the network from accessing the network, thereby preventing the remote device from accessing the network. Helps to improve network security.
  • FIG. 4a is a schematic flowchart of another authentication method provided by an embodiment of the present application.
  • the method describes in detail how the third device authenticates the target remote device.
  • the execution subject of step S401 is the second device or a chip in the second device
  • the execution subject of steps S402 and S404 is the first device or a chip in the first device
  • the execution subject of step S403 is the first device.
  • the following description takes the first device, the second device, and the third device as the execution subjects of the authentication method as an example.
  • the method may include but is not limited to the following steps:
  • Step S401 The second device sends a first request to the first device, where the first request includes the identifier of the target remote device, and in the case that the second device is a terminal device, the first request is used for the target remote device Request to access the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network.
  • step S401 for the execution process of step S401, reference may be made to the specific description of step S201 in FIG. 2a, which will not be repeated here.
  • Step S402 The first device sends an authentication request to the third device, where the authentication request includes the identifier of the target remote device, and the authentication request is used to request to determine whether the target remote device has the right to access the network.
  • the first device may request the third device to authenticate the target remote device.
  • the process (or method) of authenticating the target remote device by the third device is the same as the process (or method) of authenticating the target remote device by the first device in the embodiment of FIG.
  • a device acts as an authentication subject
  • a third device acts as an authentication subject.
  • step S402 reference may be made to the relevant content of the first device as the authentication subject in the embodiment of FIG. 3a, which will not be repeated here.
  • Step S403 The third device sends authentication result information to the first device, where the authentication result information is used to indicate whether the target remote device has the right to access the network.
  • the third device can determine whether the target remote device has the right to access the network.
  • the third device can determine whether the target remote device has the right to access the network through, but is not limited to, the following methods: (1) According to whether the current location of the target remote device is within a location area that allows access to the network, determine the Whether the target remote device has permission to access the network. (2) According to the capability of the target remote device, determine whether the target remote device has the right to access the network. (3) According to whether the network subscription for the target remote device is valid, determine whether the target remote device has the right to access the network. (4) According to whether the identifier of the target remote device exists in the target identifier list, determine whether the target remote device has the right to access the network.
  • step S302 in the embodiment of FIG. 3a, which is not repeated here.
  • the third device when the third device is used as the authentication subject, in order to inform the first device whether the target remote device has passed the authentication, the third device may send an authentication message to the first device after completing the authentication of the target remote device.
  • the right result information is used to indicate whether the target remote device has passed the authentication (that is, whether the target remote device has the right to access the network). Specifically, if the authentication of the target remote device is passed, the authentication result information sent to the first device is used to indicate that the target remote device has the right to access the network; The authentication result information sent by the device is used to indicate that the target remote device does not have the right to access the network.
  • the network that the remote device wishes to access may be a data network, a local area network, or other types of networks.
  • the foregoing first request and the authentication request may further include a network identifier, and the authentication request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier; the The first information and the authentication result information are specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier.
  • the first request is specifically used by the target remote device to request access to the network indicated by the network identifier; in the second request
  • the device is a network element (such as an SMF network element)
  • the first request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier.
  • the target identifier list is associated with the network identifier.
  • the target identifier list The target identifier in can be specifically used to indicate a remote device that has the right to access the network indicated by the network identifier.
  • Step S404 The first device sends first information to the second device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the first device may send the first information to the second device.
  • the authentication result information and the content indicated by the first information are consistent, that is, the authentication result information and the first information are both used to indicate that the target remote device has the right to access the network, or the authentication result information and the first information are used to indicate that the target remote device has the right to access the network.
  • a message is used to indicate that the target remote device does not have the right to access the network.
  • the first device may also send the target network address assigned to the target remote device to the second device, So that the second device sends the target network address to the target remote device.
  • the target network address may be sent together with the first information (for example, the target network address is carried in the first information), or sent separately, which is not limited in this embodiment of the present application.
  • the first device may not send the target network address to the second device, or may not trigger an allocation for the target remote device The flow of network addresses.
  • the process of allocating a network address to the target remote device may be triggered after it is determined that the target remote device has passed the authentication.
  • the process of allocating a network address to the target remote device can be triggered by the first device; or, a device responsible for authentication (such as a third device) can trigger the allocation of a network address to the target remote device. process.
  • the device responsible for authentication and the device responsible for allocating network addresses to the target remote device may be the same device; or may be different devices, which are not limited in this embodiment of the present application.
  • the authentication request sent by the first device to the third device may also be used to request to assign a network address to the target remote device; correspondingly, the foregoing authentication result information may include assigning a network address to the target remote device. destination network address.
  • the third device in addition to authenticating the target remote device, the third device can also be used to assign a network address to the target remote device.
  • FIG. 4b it is a schematic diagram of a scenario in which the device responsible for authentication and the device responsible for allocating network addresses to the target remote device are both third devices.
  • Fig. 4b takes the first device as the relay device, the second device as the target remote device, and the third device as the SMF as an example.
  • the target remote device sends a first request to the relay device, indicating that the target remote device wishes to access the network.
  • the first request is used for the target remote device to request access to the network, and is also used to request to assign a network address to the target remote device.
  • the relay device after receiving the first request, sends an authentication request to the SMF to request the SMF to authenticate the target remote device, and if the authentication is passed, it is the target remote device.
  • the device assigns a network address.
  • the SMF authenticates the target remote device (for example, the identifier of the target remote device exists in the target identifier list)
  • it can assign a target network address to the target remote device, and carry the target network address in the
  • the authentication result information (the authentication result information is used to indicate that the target remote device has the right to access the network) is sent to the first device.
  • the first device may carry the target network address in first information (the first information is used to indicate that the target remote device has the right to access the network) and send it to the target remote device.
  • the SMF is used not only to authenticate the target remote device, but also to assign a network address to the target remote device.
  • the authentication request sent by the first device to the third device is also used for requesting to assign a network address to the target remote device, the authentication result information sent by the third device to the first device ( The authentication result information is used to indicate that the target remote device has the right to access the network) and can also be used to instruct the first device to assign a network address to the target remote device.
  • the first device can assign a network address to the remote device.
  • FIG. 4c it is a schematic diagram of a scenario in which the device responsible for authentication and the device responsible for allocating network addresses to the target remote device are different devices.
  • Fig. 4c takes the first device as an SMF, the second device as a relay device, and the third device as an authority management device as an example.
  • the target remote device sends a network address allocation request 1 to the relay device, where the network address allocation request 1 includes the identifier of the target remote device, and the network address allocation request 1 is used to request to allocate a network address to the target remote device. That is, the target remote device sends a network address allocation request 1 to the relay device, indicating that the target remote device wishes to access the network.
  • the relay device after receiving the network address allocation request 1, the relay device sends a first request (including the identifier of the target remote device) to the SMF to instruct the target remote terminal to request access to the network and request Assign a network address to the target remote device.
  • the SMF can send an authentication request to the rights management device to request the rights management device to authenticate the target remote device.
  • the authentication result information sent by the rights management device to the SMF can be used to indicate The target remote device is authenticated and instructs the SMF to assign a network address to the target remote device.
  • the SMF can assign a target network address to the target remote device, and carry the target network address in the first information (the first information is used to indicate that the target remote device has an access point).
  • the network access right is fed back to the relay device, and then the relay device feeds back the target network address to the target remote device.
  • the authentication request in FIG. 4c can also be used to request the rights management device to assign a network address to the target remote device after passing the authentication on the target remote device.
  • the rights management device may continue to assign a network address to the target remote device, or may authorize or instruct the SMF to assign a network address to the target remote device.
  • the device that authenticates the target remote device is the authority management device
  • the device that assigns the network address to the target remote device is the SMF.
  • step S404 reference may be made to the specific description of step S202 in FIG. 2a, which will not be repeated here.
  • an authentication mechanism for the target remote device to access the network is added, and it is possible to determine whether the target remote device has the authority to access the network, so as to prevent the remote device that cannot be accessed from accessing the network, thereby preventing the remote device from accessing the network. Helps to improve network security.
  • the methods provided in the embodiments of the present application are respectively introduced from the perspectives of the first device and the second device.
  • the first device and the second device may include hardware structures and software modules, and implement the above functions in the form of hardware structures, software modules, or hardware structures plus software modules .
  • a certain function among the above functions may be implemented in the form of a hardware structure, a software module, or a hardware structure plus a software module.
  • FIG. 5 is a schematic structural diagram of a communication apparatus 50 according to an embodiment of the present application.
  • the communication device 50 shown in FIG. 5 may include a processing unit 501 and a communication unit 502 .
  • the communication unit 502 may include a sending unit and/or a receiving unit, the sending unit is used to implement the sending function, the receiving unit is used to implement the receiving function, and the communication unit 502 may implement the sending function and/or the receiving function.
  • the communication unit may also be described as a transceiving unit.
  • the communication device 50 may be a first device, a device in the first device, or a device that can be matched and used with the first device.
  • the communication device 50 may be a second device, a device in the second device, or a device that can be matched with the second device.
  • the communication device 50 is a first device: the processing unit 501 is configured to call the communication unit 502 to receive a first request from a second device, where the first request includes the identifier of the target remote device, in the case that the second device is a terminal device , the first request is used for the target remote device to request access to the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network ;
  • the processing unit 501 is further configured to call the communication unit 502 to send first information to the second device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the processing unit 501 may be further configured to: determine whether the target remote device has the right to access the network.
  • the processing unit 501 may also be configured to: if the identifier of the target remote device exists in the target identifier list, determine that the target remote device has the right to access the network; the target identifier list includes one or more Multiple target identifiers, where the target identifiers are used to indicate remote devices that have access rights to the network.
  • the first request further includes a network identifier, and the aforementioned first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier; if the second device is a terminal device In this case, the first request is specifically used for the target remote device to request access to the network indicated by the network identifier; in the case that the second device is a network element, the first request is specifically used for requesting to determine the target remote device. Whether the end device has the right to connect to the network indicated by the network ID.
  • the processing unit 501 is further configured to call the communication unit 502 to send an authentication request to the third device, where the authentication request includes the identifier of the target remote device, and the authentication request is used to request to determine the target remote device Whether the terminal device has the right to access the network; the processing unit 501 is also used to call the communication unit 502 to receive the authentication result information from the third device, the authentication result information is used to indicate whether the target remote device has access network permissions.
  • the authentication result information is used to indicate that the target remote device has the right to access the network
  • the target identifier list includes One or more target identifiers, where the target identifiers are used to indicate remote devices that have access rights to the network.
  • the first request and the authentication request further include a network identifier
  • the authentication request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier
  • the first request information and the authentication result information are specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier
  • the first request is specifically used for the The target remote device requests to access the network indicated by the network identifier
  • the second device is a network element
  • the first request is specifically used to request to determine whether the target remote device has access to the network indicated by the network identifier network permissions.
  • the first request is further used for requesting to assign a network address to the target remote device; in the case that the target remote device has the right to access the network, the aforementioned first information may include a network address for the target remote device The target network address assigned by the device.
  • the processing unit 501 is further configured to call the communication unit 502 to send a network address allocation request to the fourth device, where the network address allocation request is used to request to obtain the first number of network addresses; the processing unit 501 is also configured to use to call the communication unit 502 to receive a first number of network addresses from the fourth device; the first number of network addresses is sent when the first number is less than or equal to the second number; wherein the second number is a The number of remote devices authorized to access the network; the first number of network addresses includes the aforementioned target network address.
  • the communication device 50 is a second device: the processing unit 501 is used to call the communication unit 502 to send a first request to the first device, where the first request includes the identifier of the target remote device, and the communication device 50 is a device in the terminal device
  • the first request is used for the target remote device to request access to the network
  • the communication device 50 is a device in a network element
  • the first request is used to request to determine whether the target remote device has The right to access the network
  • the processing unit 501 is further configured to call the communication unit 502 to receive the first information from the first device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the first request further includes a network identifier, and the foregoing first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier; where the communication apparatus 50 is a terminal device In the case of the device in the network element, the first request is specifically used for the target remote device to request access to the network indicated by the network identifier; in the case where the communication device 50 is a device in a network element, the first request is specifically used In the request to determine whether the target remote device has the right to access the network indicated by the network identifier.
  • the first request is further used to request to allocate a network address to the target remote device; in the case that the target remote device has the right to access the network, the first information includes the allocation of a network address to the target remote device. destination network address.
  • FIG. 6 is a schematic structural diagram of another communication apparatus 60 provided by an embodiment of the present application.
  • the communication device 60 may be a first device or a second device, or a chip, a chip system, or a processor that supports the first device to implement the above method, or a chip, a chip system, or a chip that supports the second device to implement the above method. or processor etc.
  • the apparatus can be used to implement the methods described in the foregoing method embodiments, and for details, reference may be made to the descriptions in the foregoing method embodiments.
  • the Communication device 60 may include one or more processors 601 .
  • the processor 601 may be a general-purpose processor or a special-purpose processor, or the like.
  • it may be a baseband processor or a central processing unit.
  • the baseband processor can be used to process communication protocols and communication data
  • the central processing unit can be used to process communication devices (such as remote devices, remote device chips, relay devices, relay device chips, SMF, SMF chips, DU or CU, etc.) to control, execute computer programs, and process data of computer programs.
  • the communication device 60 may further include a transceiver 602 and an antenna 603 .
  • the transceiver 602 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function.
  • the transceiver 602 may include a receiver and a transmitter, the receiver may be called a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be called a transmitter or a transmitting circuit, etc., for implementing a transmitting function.
  • the communication device 60 may include one or more memories 604, and a computer program 605 may be stored thereon, and the computer program may be executed on the communication device 60, so that the communication device 60 executes the methods described in the above method embodiments. method.
  • the memory 604 may also store data.
  • the communication device 60 and the memory 604 can be provided separately or integrated together.
  • the communication apparatus 60 is a first device: the processor 601 is configured to execute step S302 in FIG. 3a.
  • the transceiver 602 is configured to perform step S202 in Fig. 2a; or step s1 in Fig. 2b; or step s1' in Fig. 2c; or step S303 in Fig. 3a; or steps S402 and S404 in Fig. 4a.
  • the communication apparatus 60 is a second device: the transceiver 602 is configured to perform step S201 in FIG. 2a; or step S301 in FIG. 3a; or step S401 in FIG. 4a.
  • the processor 601 may include a transceiver for implementing receiving and transmitting functions.
  • the transceiver may be a transceiver circuit, or an interface, or an interface circuit.
  • Transceiver circuits, interfaces or interface circuits used to implement receiving and transmitting functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface or interface circuit can be used for code/data reading and writing, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transmission.
  • the processor 601 may store a computer program 606, and the computer program 606 runs on the processor 601 to enable the communication device 60 to execute the methods described in the above method embodiments.
  • the computer program 606 may be embodied in the processor 601, in which case the processor 601 may be implemented by hardware.
  • the communication apparatus 60 may include a circuit, and the circuit may implement the functions of sending or receiving or communicating in the foregoing method embodiments.
  • the processors and transceivers described in this application can be implemented in integrated circuits (ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board, PCB), electronic equipment, etc.
  • the processor and transceiver can also be fabricated using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), nMetal-oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS nMetal-oxide-semiconductor
  • PMOS P-type Metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the communication device described in the above embodiments may be the first device or the second device, but the scope of the communication device described in this application is not limited thereto, and the structure of the communication device may not be limited by FIG. 6 .
  • the communication apparatus may be a stand-alone device or may be part of a larger device.
  • the communication means may be:
  • the IC set can also include a storage component for storing data and computer programs;
  • ASIC such as modem (Modem);
  • the communication device may be a chip or a chip system
  • the chip shown in FIG. 7 includes a processor 701 and an interface 702 .
  • the number of processors 701 may be one or more, and the number of interfaces 702 may be multiple.
  • the processor 701 is configured to call the interface 702 to receive a first request from the second device, where the first request includes the identifier of the target remote device, and in the case that the second device is a terminal device, the first request is used for the The target remote device requests to access the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network; the processor 701 is further configured to call The interface 702 sends first information to the second device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the processor 701 may also be configured to: determine whether the target remote device has the right to access the network.
  • the processor 701 may also be configured to: if the identifier of the target remote device exists in the target identifier list, determine that the target remote device has the right to access the network; the target identifier list includes one or more A target identifier, the target identifier is used to indicate a remote device that has the right to access the network.
  • the first request further includes a network identifier, and the aforementioned first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier; if the second device is a terminal device In this case, the first request is specifically used for the target remote device to request access to the network indicated by the network identifier; in the case that the second device is a network element, the first request is specifically used for requesting to determine the target remote device. Whether the end device has the right to connect to the network indicated by the network ID.
  • the processor 701 is further configured to call the interface 702 to send an authentication request to the third device, where the authentication request includes an identifier of the target remote device, and the authentication request is used to request to determine the target remote device Whether the device has the right to access the network; the processor 701 is further configured to call the interface 702 to receive the authentication result information from the third device, the authentication result information is used to indicate whether the target remote device has access to the network permissions.
  • the authentication result information is used to indicate that the target remote device has the right to access the network
  • the target identifier list includes One or more target identifiers, where the target identifiers are used to indicate remote devices that have access rights to the network.
  • the first request and the authentication request further include a network identifier
  • the authentication request is specifically used to request to determine whether the target remote device has the right to access the network indicated by the network identifier
  • the first request information and the authentication result information are specifically used to indicate whether the target remote device has the right to access the network indicated by the network identifier
  • the first request is specifically used for the The target remote device requests to access the network indicated by the network identifier
  • the second device is a network element
  • the first request is specifically used to request to determine whether the target remote device has access to the network indicated by the network identifier network permissions.
  • the first request is further used for requesting to assign a network address to the target remote device; in the case that the target remote device has the right to access the network, the aforementioned first information may include a network address for the target remote device The target network address assigned by the device.
  • the processor 701 is further configured to call the interface 702 to send a network address assignment request to the fourth device, where the network address assignment request is used to request to obtain the first number of network addresses; the processor 701 is further configured to The calling interface 702 receives a first number of network addresses from the fourth device; the first number of network addresses is sent under the condition that the first number is less than or equal to the second number; wherein the second number has access The number of remote devices authorized by the network; the first number of network addresses includes the aforementioned target network address.
  • the processor 701 is configured to call the interface 702 to send a first request to the first device, where the first request includes the identifier of the target remote device, and in the case that the second device is a terminal device, the first request is used for the target
  • the remote device requests to access the network; in the case that the second device is a network element, the first request is used to request to determine whether the target remote device has the right to access the network; the processor 701 is further configured to call an interface 702 Receive first information from the first device, where the first information is used to indicate whether the target remote device has the right to access the network.
  • the first request further includes the identification of the network indicated by the network identification of the local area network, and the foregoing first information is specifically used to indicate whether the target remote device has the right to access the network indicated by the network identification;
  • the first request is specifically used for the target remote device to request access to the network indicated by the network identifier;
  • the second device is a network element, the first request is specifically It is used to request to determine whether the target remote device has the right to access the network indicated by the network identifier.
  • the first request is further used to request to allocate a network address to the target remote device; in the case that the target remote device has the right to access the network, the first information includes the allocation of a network address to the target remote device. destination network address.
  • the chip further includes a memory 703 for storing necessary computer programs and data.
  • the present application also provides a computer-readable storage medium on which a computer program is stored, where the computer program includes program instructions, and when the program instructions are executed by a computer, the functions of any of the foregoing method embodiments are implemented.
  • the above-mentioned computer-readable storage medium includes, but is not limited to, flash memory, hard disk, and solid-state disk.
  • the present application also provides a computer program product, which implements the functions of any of the above method embodiments when the computer program product is executed by a computer.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer program may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks, SSD)) etc.
  • At least one in this application may also be described as one or more, and the multiple may be two, three, four or more, which is not limited in this application.
  • the technical feature is distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc.
  • the technical features described in the “first”, “second”, “third”, “A”, “B”, “C” and “D” described technical features in no order or order of magnitude.
  • the corresponding relationships shown in each table in this application may be configured or predefined.
  • the values of the information in each table are only examples, and can be configured with other values, which are not limited in this application.
  • the corresponding relationships shown in some rows may not be configured.
  • appropriate deformation adjustments can be made based on the above table, for example, splitting, merging, and so on.
  • the names of the parameters shown in the headings in the above tables may also adopt other names that can be understood by the communication device, and the values or representations of the parameters may also be other values or representations that the communication device can understand.
  • other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables, or hash tables. Wait.
  • Predefined in this application may be understood as defining, predefining, storing, pre-storing, pre-negotiating, pre-configuring, curing, or pre-firing.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种鉴权方法及其装置，可以应用于中继接入场景。该方法包括：第一设备接收来自第二设备的第一请求，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定目标远端设备是否具有接入网络的权限；该第一设备发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。在本申请实施例中，可以确定目标远端设备是否具有接入网络的权限，有利于提高网络安全性。

Description

一种鉴权方法及其装置
本申请要求于2020年9月30日提交中国专利局、申请号为202011070319.3、申请名称为“一种鉴权方法及其装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种鉴权方法及其装置。
背景技术
中继(relay)技术是现代无线通信系统中的关键技术之一。采用中继技术，有利于提升系统容量。图1a是中继通信的场景示意图，由图1a可知，在网络覆盖范围外的设备(称为远端设备)，可以通过在网络覆盖范围内的设备(称为中继设备)接入网络。进一步的，远端设备可以获取各种通信业务。在图1a中，虚线圆表示基站的覆盖范围。
但是，随着中继技术的不断发展，通过中继设备接入网络的远端设备越来越多，会使得网络安全性较低。例如：远端设备希望通过中继设备接入一种网络业务，提供这种业务的网络会验证所有接入设备是否有权限接入，但是远端设备是通过中继设备接入的，可以绕过网络的验证。
发明内容
本申请实施例提供一种鉴权方法及其装置，可以确定目标远端设备是否具有接入网络的权限，有利于提高网络安全性。
第一方面，本申请实施例提供一种鉴权方法，该方法包括：第一设备接收来自第二设备的第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该第一设备发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在该技术方案中，可以确定目标远端设备是否具有接入网络的权限，以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
在一种实现方式中，该方法还可以包括：第一设备确定该目标远端设备是否具有接入网络的权限。
在一种实现方式中，第一设备确定该目标远端设备是否具有接入网络的权限的具体实施方式可以为：若目标远端设备的标识存在于目标标识列表中，则第一设备确定该目标远端设备具有接入网络的权限；该目标标识列表包括一个或多个目标标识，目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求还包括网络标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接该网络标识所指示的网络的权限。
在一种实现方式中，该方法还可以包括：该第一设备向第三设备发送鉴权请求，该鉴权请求包括目标远端设备的标识，该鉴权请求用于请求确定该目标远端设备是否具有接入网络的权限；该第一设备接收来自该第三设备的鉴权结果信息，该鉴权结果信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，在该目标远端设备的标识存在于目标标识列表中的情况下，该鉴权结果信息用于指示该目标远端设备具有接入网络的权限，该目标标识列表包括一个或多个目标标识，该目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求和鉴权请求还包括网络标识，该鉴权请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限；该第一信息和该鉴权结果信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在该第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，前述第一信息可以包括为该目标远端设备分配的目标网络地址。
在一种实现方式中，该方法还可以包括：第一设备向第四设备发送网络地址分配请求，该网络地址分配请求用于请求获取第一数量的网络地址；该第一设备从该第四设备接收第一数量的网络地址；该第一数量的网络地址是在第一数量小于或等于第二数量的情况下发送的；其中，该第二数量为具有接入网络的权限的远端设备的数量；该第一数量的网络地址包括前述目标网络地址。
在该技术方案中，一方面，可以避免分配大于第二数量的网络地址用于中继接入，即可以避免分配的网络地址数量大于所需的网络地址数量的情况，有利于避免浪费网络地址。另一方面，当第四设备为负责分配网络地址的设备，且第一数量为多个时，第四设备通过一次性分配多个网络地址，可以避免以下情况：不同远端设备在发起网络接入请求的情况下，第一设备针对每个远端设备需要重新向第四设备请求为该远端设备分配网络地址。因此，通过一次性分配多个网络地址，有利于减少第一设备与第四设备之间不必要的交互，从而有利于节省资源。
第二方面，本申请实施例提供另一种鉴权方法，该方法包括：第二设备向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该第二设备接收来自该第一设备的第一信息，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在该技术方案中，可以确定目标远端设备是否具有接入网络的权限，以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
在一种实现方式中，第一请求还包括网络的标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端 设备具有接入网络的权限的情况下，第一信息包括为该目标远端设备分配的目标网络地址。
第三方面，本申请实施例提供了一种通信装置，该通信装置具有实现上述第一方面所述的方法示例中第一设备的部分或全部功能，比如通信装置的功能可具备本申请中的部分或全部实施例中的功能，也可以具备单独实施本申请中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种实现方式中，该通信装置的结构中可包括处理单元和通信单元，所述处理单元被配置为支持通信装置执行上述方法中相应的功能。所述通信单元用于支持通信装置与其他设备之间的通信。所述通信装置还可以包括存储单元，所述存储单元用于与处理单元和发送单元耦合，其保存通信装置必要的计算机程序和数据。
在一种实现方式中，所述通信装置包括：处理单元，用于调用通信单元接收来自第二设备的第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理单元还用于调用通信单元发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
作为示例，处理单元可以为处理器，通信单元可以为收发器或通信接口，存储单元可以为存储器。
在一种实现方式中，所述通信装置包括：处理器，用于调用收发器接收来自第二设备的第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理器还用于调用收发器发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
第四方面，本申请实施例提供了另一种通信装置，该通信装置具有实现上述第二方面所述的方法示例中第二设备的部分或全部功能，比如通信装置的功能可具备本申请中的部分或全部实施例中的功能，也可以具备单独实施本申请中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种实现方式中，该通信装置的结构中可包括处理单元和通信单元，所述处理单元被配置为支持通信装置执行上述方法中相应的功能。所述通信单元用于支持通信装置与其他设备之间的通信。所述通信装置还可以包括存储单元，所述存储单元用于与处理单元和发送单元耦合，其保存通信装置必要的计算机程序和数据。
在一种实现方式中，所述通信装置包括：处理单元，用于调用通信单元向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该通信装置为终端设备中的装置的情况下，该第一请求用于该目标远端设备请求接入网络；在该通信装置为网元中的装置的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理单元还用于调用通信单元接收来自第一设备的第一信息，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
作为示例，处理单元可以为处理器，通信单元可以为收发器或通信接口，存储单元可以为存储器。
在一种实现方式中，所述通信装置包括：处理器，用于调用收发器向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该通信装置为终端设备中的装置的情况下， 该第一请求用于该目标远端设备请求接入网络；在该通信装置为网元中的装置的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理器还用于调用收发器接收来自第一设备的第一信息，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
第五方面，本发明实施例提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令被通信装置执行时使该通信装置执行上述第一方面的方法。
第六方面，本发明实施例提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令被通信装置执行时使该通信装置执行上述第二方面的方法。
第七方面，本申请还提供了一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第八方面，本申请还提供了一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
第九方面，本申请提供了一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持第一设备实现第一方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存第一设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十方面，本申请提供了一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持第二设备实现第二方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存第二设备必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1a是本申请实施例提供的一种中继通信的场景示意图；
图1b是本申请实施例提供的一种通信系统的架构示意图；
图2a是本申请实施例提供的一种鉴权方法的流程示意图；
图2b是本申请实施例提供的一种第一设备请求第四设备分配IP地址的过程的示意图；
图2c是本申请实施例提供的一种第一设备请求第五设备分配IP地址的过程的示意图；
图3a是本申请实施例提供的另一种鉴权方法的流程示意图；
图3b是本申请实施例提供的一种预先为远端设备(包括目标远端设备)分配IP地址的场景示意图；
图4a是本申请实施例提供的又一种鉴权方法的流程示意图；
图4b是本申请实施例提供的一种负责鉴权的设备、负责为目标远端设备分配IP地址的设备均为第三设备的场景示意图；
图4c是本申请实施例提供的一种负责鉴权的设备、负责为目标远端设备分配IP地址的设备为不同设备的场景示意图；
图5是本申请实施例提供的一种通信装置的结构示意图；
图6是本申请实施例提供的另一种通信装置的结构示意图；
图7是本申请实施例提供的一种芯片的结构示意图。
具体实施方式
为了更好的理解本申请实施例公开的一种鉴权方法，下面首先对本申请实施例适用的通信系统进行描述。
请参见图1b，图1b为本申请实施例提供的一种通信系统的架构示意图。该通信系统可包括但不限于一个网络设备、一个第一设备和一个第二设备，图1b所示的设备数量和形态用于举例并不构成对本申请实施例的限定，实际应用中可以包括两个或两个以上的网络设备、两个或两个以上的第一设备，两个或两个以上的第二设备。图1b所示的通信系统以包括一个网络设备、一个第一设备和一个第二设备为例。
在本申请实施例中，第二设备可以为终端设备或者网元。其中，该终端设备可以指希望接入网络的目标远端设备；或者该终端设备可以指中继设备，该中继设备为接收到该目标远端设备的网络接入请求的中继设备。其中，该网元可以指会话管理功能(session management function，SMF)网元或者其他核心网网元。本申请实施例对该网元所采用的具体技术和具体设备形态不做限定。SMF可以用于负责移动网络中的会话管理，如会话建立、修改、释放。具体的，SMF可以用于为用户分配网际协议(internet protocol，IP)地址、选择提供报文转发功能的用户面功能(user plane function，UPF)网元等。
第二设备为该目标远端设备时，第一设备可以为中继设备。此时，第二设备向第一设备发送的第一请求用于目标远端设备请求接入网络，即目标远端设备向中继设备发送的第一请求用于目标远端设备请求接入网络。
第二设备为中继设备时，第一设备可以为服务于该中继设备的网元(如SMF)。此时，第二设备向第一设备发送的第一请求用于目标远端设备请求接入网络，即中继设备向服务于该中继设备的网元(如SMF)，发送的第一请求用于目标远端设备请求接入网络。
第二设备为服务于该中继设备的网元(如SMF)时，第一设备可以为权限管理设备。其中，权限管理设备可以用于记录某远端设备是否具有接入网络的权限，或者用于记录某远端设备是否具有通过中继设备接入网络的权限。该权限管理设备可以为鉴权、授权和计费(authentication、authorization、accounting，AAA)服务器，简称3A服务器。或者，该权限管理设备可以为应用功能(application function，AF)网元。
本申请实施例中的远端设备为处于网络覆盖范围外的终端设备，中继设备为处于网络覆盖范围内的终端设备。其中，终端设备是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端(terminal)、用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)等。终端设备可以是手机(mobile phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self-driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、物联网中的无线终端等等。本申请的实施例对终端设备所采用的具体技术和具体设备形态不做限定。需要说明的是，在本申请实施例中，中继设备可以仅用于辅助远端设备接入网络。或者，中继设备 还可以具有普通终端设备的功能。
需要说明的是，图1b中以第一设备为中继设备、第二设备为目标远端设备为例进行介绍，并不构成对本申请实施例的限定。
在图1b中，第一设备可以用于接收来自第二设备的第一请求，并向该第二设备发送第一信息。其中，该第一请求包括目标远端设备的标识，在该第二设备为终端设备(如图1b中的目标远端设备)的情况下，该第一请求用于该目标远端设备请求接入网络；该第一信息用于指示该目标远端设备是否具有接入网络的权限。目标远端设备为希望接入网络的远端设备。目标远端设备的标识用于唯一标识该目标远端设备，本申请对于标识的形式不做限定。
在图1b中，圆形区域为网络设备的网络覆盖范围，应用于本申请实施例中，该圆形区域可以用于指示目标远端设备希望接入的网络的覆盖范围。
第一设备接收到该第一请求表示：目标远端设备希望接入网络。第一设备接收到第一请求后，可以确定该目标远端设备是否具有接入网络的权限，并向该第二设备发送第一信息。通过实施本申请实施例，可以确定目标远端设备是否具有接入网络的权限，从而有利于提高网络安全性。
本申请实施例所涉及的网络(即远端设备(包括目标远端设备)希望接入的网络)可以指数据网络、局域网(local area network，LAN)、核心网(如4G核心网、5G核心网等)或者其他类型的网络，本申请实施例对此不做限定。
在一种实现方式中，若目标远端设备具有接入网络的权限，且该目标远端设备具有网络地址(如目标网络地址)，则该目标远端设备可以通过该目标网络地址向该网络发送信息，以获取网络服务。目标远端设备通过该目标网络地址向该网络发送信息是指：目标远端设备通过该目标网络地址向中继设备发送信息，该中继设备将该信息发送至该网络。在另一种实现方式中，若目标远端设备具有接入网络的权限，该第一设备还可以向第二设备发送为该目标远端设备分配的目标网络地址。通过这种方式，在目标远端设备具有接入网络的权限的情况下，为该目标远端设备分配网络地址，可以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
需要说明的是，本申请实施例提及的网络地址可以指网际协议(internet protocol，IP)地址或者媒体访问控制(media access control address，MAC)。本申请实施例中以网络地址为IP地址为例进行介绍，并不构成对本申请实施例。与分配IP地址相关的内容中，也适用于分配MAC地址。
需要说明的是，在本申请实施例中，目标远端设备可以通过中继设备接入网络。相应的，本申请实施例中将提及的鉴权请求可以用于请求确定目标远端设备是否具有通过中继设备接入网络的权限。同理，本申请实施例中将提及的鉴权结果信息可以用于指示目标远端设备是否具有通过中继设备接入网络的权限。在该第二设备为网元的情况下，该第一请求可以用于请求确定该目标远端设备是否具有接入网络的权限，即该第一请求用于请求对目标远端设备进行鉴权。在此情况下，可选的，该第一请求具体可以用于请求确定目标远端设备是否具有通过中继设备接入网络的权限。同理，第一请求对应的响应信息(即第一信息)可以用于指示目标远端设备是否具有通过中继设备接入网络的权限。换言之，在本申请实施例中提及的接入网络的权限可以指：通过中继设备接入网络的权限。另外，在本申请实施例中，接入网络的权限可以描述为接入网络权限。
还需要说明的是，在本申请实施例中，远端设备和中继设备之间可以通过近距离业务(proximity service，ProSe)通信技术进行通信。近距离通信技术可以包括但不限于：设备到 设备(device to device，D2D)通信、无线保真(wireless fidelity，WiFi)通信、蓝牙(blueteeth)通信。
可以理解的是，第二设备不为目标远端设备的情况下，第二设备在接收到该第一信息之后，还可以将该第一信息发送至该目标远端设备。例如，第二设备为中继设备，第一设备为为SMF网元的情况下，该中继设备在接收到该第一信息之后，还可以将该第一信息发送至目标远端设备。第二设备不为目标远端设备的情况下，第二设备在接收该目标IP地址之后，还可以将该目标IP地址发送至该目标远端设备。
本申请实施例中的网络设备是网络侧的一种用于发射或接收信号的实体。例如，网络设备可以为演进型基站(evolved NodeB，eNB)、传输点(transmission reception point，TRP)、NR系统中的下一代基站(next generation NodeB，gNB)、其他未来移动通信系统中的基站或无线保真(wireless fidelity，WiFi)系统中的接入节点等。本申请的实施例对网络设备所采用的具体技术和具体设备形态不做限定。
需要说明的是，本申请实施例的技术方案可以应用于各种通信系统。例如：长期演进(long term evolution，LTE)系统、第五代(5th generation，5G)移动通信系统、5G新空口(new radio，NR)系统。可选的，本申请实施例的方法还适用于未来演进的各种通信系统。
可以理解的是，本申请实施例描述的通信系统是为了更加清楚的说明本申请实施例的技术方案，并不构成对本申请实施例提供的技术方案的限定，本领域技术人员可知，随着系统架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
下面结合附图对本申请提供的鉴权方法及其装置进行详细地介绍。
请参见图2a，图2a是本申请实施例提供的一种鉴权方法的流程示意图。其中，步骤S201的执行主体为第二设备，或者为第二设备中的芯片，步骤S202的执行主体为第一设备，或者为第一设备中的芯片，以下以第一设备、第二设备为鉴权方法的执行主体为例进行说明。如图2a所示，该方法可以包括但不限于如下步骤：
步骤S201：第二设备向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限。
在本申请实施例中，目标远端设备在需要接入网络(或者目标远端设备在需要通过中继设备接入网络)的情况下，可以向中继设备发送请求以请求接入网络。对于该目标远端设备而言，其发送请求的目的在于接入网络，而并非主动请求网络或者其他设备(如中继设备)对该目标远端设备进行鉴权。需要说明的是，在本申请实施例中，请求对该目标远端设备进行鉴权指的是：请求确定该目标远端设备是否具有接入网络的权限。
在第二设备为中继设备，第一设备为服务于该中继设备的网元(如SMF)的情况下，第二设备发送第一请求的目的可以在于请求将目标远端设备接入网络。对于第一设备而言，为了提高网络安全性，在接收到该第一请求的情况下，可以确定该目标远端设备是否具有接入网络的权限，进而在确定其具有网络接入权限的情况下，才允许该目标远端设备接入。
在第二设备为服务于该中继设备的网元(如SMF)，第一设备可以为权限管理设备的情况下，第二设备发送第一请求以请求确定该目标远端设备是否具有接入网络的权限。可以避免不具有接入网络的权限的远端设备接入网络，从而有利于提高网络的安全性。
步骤S202：第一设备发送第一信息至该第二设备，该第一信息用于指示该目标远端设备 是否具有接入网络的权限。
在本申请实施例中，第一设备在接收到该第一请求之后，可以触发针对该目标远端设备的鉴权流程。针对目标远端设备的鉴权流程，用于确定该目标远端设备是否具有接入网络的权限。若该目标远端设备具有接入网络的权限，则该第一设备向该第二设备发送的第一信息用于指示该目标远端设备具有接入网络的权限。若该目标远端设备不具有接入网络的权限，则该第一信息用于指示该目标远端设备不具有接入网络的权限。通过这种方式，增加了目标远端设备接入网络的鉴权机制(即确定目标远端设备是否具有接入网络的权限)，可以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
在一种实现方式中，前述第一请求还可以用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，该第一信息可以包括为该目标远端设备分配的目标网络地址。换言之，若该目标远端设备具有接入网络的权限，则该第一设备可以向该第二设备发送为该目标远端设备分配的目标网络地址。可选的，若该目标远端设备不具有接入网络的权限，则该第一设备可以不向该第二设备发送目标网络地址。通过这种方式，在目标远端设备具有接入网络的权限的情况下，为该目标远端设备分配网络地址，可以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
在一种实现方式中，在前述第一请求还可以用于请求为目标远端设备分配网络地址的情况下，第一信息可以包括显式的指示信息或者隐式的指示信息，该指示信息用于指示该目标远端设备是否具有接入网络的权限。例如，若该第一信息中包括目标网络地址，第二设备在接收到该第一信息后，可以确定目标远端设备具有接入网络的权限。此时，该第一信息中的指示信息为隐式指示信息。若该第一信息中不包括目标网络地址，第二设备在接收到该第一信息后，可以确定目标远端设备不具有接入网络的权限。此时，该第一信息中的指示信息为隐式指示信息。
又如，该第一信息中的指示信息为一字段或者包括1比特的二进制位(表示为0或1)。该指示信息的值为1的情况下，该指示信息用于指示该目标远端设备具有接入网络的权限；该指示信息的值为0的情况下，该第二指示信息用于指示该目标远端设备不具有接入网络的权限。此时，该第一信息中的指示信息为显式指示信息。或者，该指示信息的值为0的情况下，该指示信息用于指示该目标远端设备具有接入网络的权限；该指示信息的值为1的情况下，该第二指示信息用于指示该目标远端设备不具有接入网络的权限。此时，该第一信息中的指示信息为显式指示信息。
在一种实现方式中，第一设备自身可以对该目标远端设备进行鉴权，其鉴权流程具体可参见图3a实施例中的描述。在另一种实现方式中，第一设备可以请求第三设备对该目标远端设备进行鉴权，其鉴权流程具体可参见图4a实施例中的描述。
在本申请实施例中，远端设备可以通过某一个指定的中继设备接入网络，或者可以通过多个指定的中继设备中的任一个接入网络，或者，可以通过任意支持中继技术的设备接入网络。在一种实现方式中，本申请实施例可以不限定目标远端设备具体通过哪个中继设备接入网络。此时，针对目标远端设备的鉴权流程可以用于：确定该目标远端设备是否具有通过中继技术接入网络的权限。在另一种实现方式中，目标远端设备仅能通过某个或者某些指定中继设备接入网络。此时，针对目标远端设备的鉴权流程可以用于：确定目标远端设备在请求接入网络的过程中所涉及的中继设备是否为前述指定中继设备，以及该目标远端设备是否具有通过中继技术接入网络的权限。若目标远端设备在请求接入网络的过程中所涉及的中继设备为前述指定中继设备，且该目标远端设备具有通过中继技术接入网络的权限，则表示目标 远端设备鉴权通过，即表示目标远端设备具有通过中继设备接入网络的权限。若目标远端设备在请求接入网络的过程中所涉及的中继设备不为前述指定中继设备，和/或，该目标远端设备不具有通过中继技术接入网络的权限，则表示目标远端设备鉴权失败，即表示目标远端设备不具有通过中继设备接入网络的权限。
在本申请实施例中，一个中继设备可以辅助一个或多个远端设备接入网络。可选的，一个中继设备可以辅助有限数量的远端设备接入网络。在一种实现方式中，一个中继设备所能辅助接入网络的远端设备是指定的某一些远端设备，不同中继设备所能辅助接入网络的远端设备可以相同也可以不同。在此情况下，针对目标远端设备的鉴权流程可以用于：确定目标远端设备在请求接入网络的过程中所涉及的中继设备能辅助接入网络的远端设备，是否包括该目标远端设备。若包括，则表示目标远端设备鉴权通过，即表示目标远端设备具有通过该中继设备接入网络的权限。若不包括，则表示目标远端设备鉴权失败，即表示目标远端设备不具有通过该中继设备接入网络的权限。
在一种实现方式中，可以由该第一设备为该目标远端设备分配目标网络地址。例如，当第一设备为SMF或者3A服务器时，可以为该目标远端设备分配目标网络地址。在另一种实现方式中，第一设备可以请求其他设备(如第四设备或第五设备)为目标远端设备分配目标网络地址。例如，当第一设备为中继设备时，可以请求SMF或者3A服务器为目标远端设备分配目标网络地址。
在一种实现方式中，负责分配网络地址的设备(第一设备、第四设备或第五设备)可以预先为具有接入网络权限的各个远端设备分配网络地址。换言之，可一次性分配多个网络地址。在此情况下，在分配网络地址时，可能具有接入网络权限的所有远端设备或者部分远端设备还未发起网络接入请求。换言之，在远端设备不具有接入网络的需求的情况下，也可以为该远端设备分配网络地址。需要说明的是，远端设备在发起网络接入请求后，需要在该远端设备鉴权通过，且该远端设备具有网络地址的情况下，才能成功接入网络，以获取网络服务。还需要说明的是，远端设备是否具有网络地址与该远端设备是否鉴权通过可以解耦(或者相互独立)。在另一种实现方式中，负责分配网络地址的设备(第一设备、第四设备或第五设备)可以为具有接入网络权限、且已发起网络接入请求的远端设备分配网络地址。换言之，可以在该远端设备具有接入网络的需求的情况下，为该远端设备分配网络地址。需要说明的是，在第二设备为目标远端设备的情况下，该第二设备发送的第一请求即为上述网络接入请求。在本申请实施例中提及的网络接入请求，用于该网络接入请求的发送方请求接入网络。
在一种实现方式中，第一设备分配网络地址的过程如下：第一设备为该目标远端设备分配目标网络地址，并将该目标网络地址发送至第二设备。相应的，第二设备在接收到该目标网络地址之后，可以将该目标网络地址发送至目标远端设备。例如，第一设备为SMF，第二设备为中继设备时，该中继设备在接收到目标网络地址后，可以将该目标网络地址发送至目标远端设备。又如，第一设备为3A服务器，第二设备为SMF时，SMF在接收到目标网络地址后，可以将该目标网络地址发送至中继设备。相应的，中继设备可以将来自SMF的目标网络地址发送至目标远端设备。
在另一种实现方式中，第一设备分配网络地址的过程如下：第一设备为多个远端设备(包括目标远端设备)分别分配网络地址(包括为目标网络地址)，并将分配的网络地址发送至第二设备。相应的，第二设备可以在该多个远端设备中的某个远端设备需要接入网络的情况下(例如该远端设备发起网络接入请求的情况下)，将接收到的且与该远端设备对应的网络地址发送至该远端设备。例如，第一设备为远端设备1分配网络地址1，为远端设备2分配网络 地址2，为远端设备3分配网络地址3，并将分配的网络地址(即网络地址1、网络地址2和网络地址3)发送至第二设备。相应的，第二设备可以在远端设备1发起网络接入请求的情况下，将网络地址1发送至该远端设备1。同理，第二设备可以在远端设备2发起网络接入请求的情况下，将网络地址2发送至该远端设备2。第二设备可以在远端设备3发起网络接入请求的情况下，将网络地址3发送至该远端设备3。需要说明的是，在本申请实施例中，两设备间可以直接通信，也可以通过其他设备或网元间接通信，本申请实施例对两设备之间的通信方式不做限定。例如，第一设备为SMF，第二设备为中继设备时，该中继设备在接收到网络地址后，可以将该网络地址直接发送至相应的远端设备。又如，第一设备为3A服务器，第二设备为SMF时，SMF在接收到网络地址后，可以通过中继设备将该网络地址发送至对应的远端设备。
在一种实现方式中，第一设备请求第四设备分配网络地址的过程可以如图2b所示，包括但不限于步骤s1～步骤s2：
步骤s1：第一设备向第四设备发送网络地址分配请求(也可以称为第一网络地址分配请求)，该网络地址分配请求用于请求获取第一数量的网络地址；其中第一数量可以为一个或多个；
步骤s2：在该第一数量小于或等于第二数量的情况下，该第四设备将第一数量的网络地址发送至该第一设备；其中，该第二数量为具有接入网络的权限的远端设备的数量；该第一数量的网络地址包括前述目标网络地址。
第二数量为具有接入网络的权限的远端设备的数量，即最多有第二数量个远端设备可以接入网络。或者，第二数量为具有通过中继设备接入网络的权限的远端设备的数量，即最多有第二数量个远端设备可以通过中继设备接入网络。需要说明的是，此时不限定各个远端设备具体通过哪个中继设备接入网络。在该第一数量小于或等于第二数量的情况下，该第四设备将第一数量的网络地址发送至该第一设备，一方面，可以避免分配大于第二数量的网络地址用于中继接入，即可以避免分配的网络地址数量大于所需的网络地址数量的情况，有利于避免浪费网络地址。另一方面，当第四设备为负责分配网络地址的设备，且第一数量为多个时，第四设备通过一次性分配多个网络地址，可以避免以下情况：不同远端设备在发起网络接入请求的情况下，第一设备针对每个远端设备需要重新向第四设备请求为该远端设备分配网络地址。因此，通过一次性分配多个网络地址，有利于减少第一设备与第四设备之间不必要的交互，从而有利于节省资源。
在一种实现方式中，第一数量可以由网络配置(例如，在系统消息或专有信令中下发)，或者可以由协议约定，或者可以由第一设备默认设置，或者可以由用户设置以及更改，本申请实施例对此不做限定。在一种实现方式中，第二数量可以由第六设备预先告知第四设备，或者，可以由第四设备向第六设备请求获取。该第六设备可以为统一数据管理(unified data management，UDM)网元，或者前述权限管理网元。在另一种实现方式中，第二数量可以由前述网络对应的配置信息确定，或者，可以由网络配置(例如，在系统消息或专有信令中下发)，或者可以由协议约定，或者可以由第四设备默认设置，或者可以由用户设置以及更改，本申请实施例对此不做限定。网络对应的配置信息可以指示可接入该网络的远端设备的数量(即第二数量)。
在另一种实现方式中，前述网络地址分配请求可以包括用于指示目标中继设备的指示信息；该目标中继设备可以为前述目标远端设备在请求接入网络的过程中所涉及的中继设备。此时，前述第二数量具体可以为具有通过该目标中继设备接入网络的权限的远端设备的数量。 在一种实现方式中，不同中继设备所能辅助接入网络的远端设备的数量可以相同也可以不同。换言之，以中继设备包括中继设备1和中继设备2为例，具有通过中继设备1接入网络的权限的远端设备的数量，与具有通过中继设备2接入网络的权限的远端设备的数量，可以相同也可以不同。
在一种实现方式中，当第四设备为SMF时，该网络地址分配请求可以包含于会话建立请求中，该会话建立请求可以用于请求创建关于第一设备的会话。关于第一设备的会话可以用于传输第一设备发送的信息。本申请实施例中提及的会话可以指协议数据单元(protocol data unit，PDU)会话。
需要说明的是，本申请实施例对第一设备接收前述第一请求和执行步骤s1的顺序不做限定。例如，第一设备可以在接收到该第一请求之后执行步骤s1；或者，可以在接收到该第一请求之前执行步骤s1；或者，可以在接收到该第一请求之前执行步骤s1以及接收前述第一数量的网络地址；或者，可以同时执行步骤s1和接收该第一请求。
在一种实现方式中，第一设备请求第五设备分配网络地址的过程可以如图2c所示，包括但不限于步骤s1’～步骤s2’：
步骤s1’：第一设备向第五设备发送第二网络地址分配请求，该第二网络地址分配请求用于请求为前述目标远端设备分配网络地址；
步骤s2’：该第五设备将为该目标远端设备分配的目标网络地址(如目标IP地址)发送至该第一设备。
在一种实现方式中，第一设备可以在该目标远端设备具有接入网络的权限的情况下，向第五设备发送第二网络地址分配请求。通过这种方式，可以避免如下情况：在目标远端设备不具有接入网络的权限的情况下，请求第五设备分配目标网络地址。即使第五设备分配了目标网络地址，第一设备也不会将该目标网络地址发送至目标远端设备。因此，在目标远端设备具有接入网络的权限的情况下，向第五设备发送第二网络地址分配请求，有利于避免第一设备与第五设备之间不必要的通信过程，从而有利于避免资源浪费。
在一种实现方式中，当第五设备为SMF时，该第二网络地址分配请求可以包含于会话建立请求中，该会话建立请求可以用于请求创建关于第一设备的会话。或者，该第二网络地址分配请求可以包含于会话更新请求中，在此情况下，网络中已经创建有关于第一设备的会话，因此SMF在接收到该第二网络地址分配请求后，无需创建新的关于第一设备的会话。在本申请实施例中，第四设备和第五设备可以为相同设备或者不同设备。
在一种实现方式中，若第一设备为中继设备，且第二设备为目标远端设备，在该第一设备接收到来自该第二设备的第一数据包，且关于该第一设备的会话建立成功的情况下，该第一设备可以对该第一数据包进行处理，得到第二数据包；并通过该会话传输该第二数据包。其中，该第一数据包的源IP地址为前述为目标远端设备分配的IP地址(即目标IP地址)，该第二数据包的源IP地址为该第一设备的IP地址。
在一种实现方式中，第一设备可以对该第一数据包进行处理的具体实施方式可以为：第一设备将第一数据包的源IP地址从目标IP地址更改为第一设备的IP地址。或者，第一设备对第一数据包进行封装处理，封装处理中为该第一数据包添加的源IP地址为第一设备的IP地址。此时，封装处理后的第一数据包(即第二数据包)携带有两个源IP地址，其中，外层封装的源IP地址为第一设备的IP地址，内层封装的源IP地址为目标IP地址。这样便于在接收到针对该第二数据包的反馈数据包(携带两个目的IP地址，外层封装的目的IP地址为第一设备的IP地址，内层封装的目的IP地址为目标IP地址)的情况下，可以根据内层封装的 目标IP地址，将该反馈数据包发送至IP地址为该目标IP地址的远端设备(即目标远端设备)。在本申请实施例中，第一设备通过该会话传输该第二数据包是指：第一设备通过该会话将该第二数据包传输至用户面功能(user plane function，UPF)网元。
需要说明的是，在本申请实施例中，为远端设备分配的IP地址(包括目标IP地址)可以为公网IP地址或者私网IP地址。为远端设备分配的IP地址(包括目标IP地址)可以为IPv4地址或者IPv6地址。本申请实施例对此不做限定。
在一种实现方式中，负责分配网络地址的设备(如SMF或者3A服务器)在为远端设备分配网络地址后，还可以将为远端设备分配的网络地址发送至UPF。UPF在接收到该网络地址后，可以配置该网络地址作为N6接口报文收发的信息。这样使得N6接口可以成功识别需要发送给远端设备的信息，进而将需要发送给远端设备的信息发送至远端设备。其中，5G协议中的N6接口协议对应的是UPF和数据网络(data network，DN)之间的接口协议。在一种实现方式中，UPF还可以存储有远端设备的网络地址与(与该远端设备对应的)中继设备的网络地址之间的对应关系。其中，与远端设备对应的中继设备可以指：该远端设备通过该中继设备接入网络。UPF存储有该对应关系，以便根据该对应关系将需要发送给远端设备的信息，路由至与该远端设备对应的中继设备，进而通过中继设备将需要发送给远端设备的信息发送至该远端设备。
通过实施本申请实施例，增加了目标远端设备接入网络的鉴权机制，可以确定目标远端设备是否具有接入网络的权限，以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
请参见图3a，图3a是本申请实施例提供的另一种鉴权方法的流程示意图，该方法详细描述了第一设备如何对目标远端设备进行鉴权。其中，步骤S301的执行主体为第二设备，或者为第二设备中的芯片，步骤S302～步骤S303的执行主体为第一设备，或者为第一设备中的芯片，以下以第一设备、第二设备为鉴权方法的执行主体为例进行说明。如图3a所示，该方法可以包括但不限于如下步骤：
步骤S301：第二设备向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限。
需要说明的是，步骤S301的执行过程可参见图2a中步骤S201的具体描述，此处不再赘述。
步骤S302：若该目标远端设备的标识存在于目标标识列表中，则该第一设备确定该目标远端设备具有接入网络的权限；其中，该目标标识列表包括一个或多个目标标识，目标标识用于指示具有接入网络的权限的远端设备。
在本申请实施例中，针对目标远端设备的鉴权流程可以在第一设备本地完成。其鉴权流程具体如下：第一设备在接收到第一请求后，确定该目标远端设备是否具有接入网络的权限。在一种实现方式中，第一设备可以通过但不限于如下方式确定该目标远端设备是否具有接入网络的权限：(1)根据该目标远端设备当前所处位置是否在允许接入网络的位置区域内，确定该目标远端设备是否具有接入网络的权限。若处于，则可以确定该目标远端设备具有接入网络的权限；若不处于，则可以确定该目标远端设备不具有接入网络的权限。其中，允许接入网络的位置区域可以为第一跟踪区域，该第一跟踪区域可以通过跟踪域的代码(tracking area code，TAC)确定。目标远端设备处于该第一跟踪区域的情况下可以允许该目标远端设 备接入网络。目标远端设备不处于该第一跟踪区域的情况下可以允许该目标远端设备接入网络。(2)根据该目标远端设备的能力，确定该目标远端设备是否具有接入网络的权限。其中，目标远端设备的能力可以包括：是否具备以太通信能力，是否具备交换机能力等。若具有能力，则可以确定该目标远端设备具有接入网络的权限；若不具有能力，则可以确定该目标远端设备不具有接入网络的权限。(3)根据网络针对该目标远端设备的签约是否有效，确定该目标远端设备是否具有接入网络的权限。其中，网络针对该目标远端设备的签约是否有效可以表征该目标远端设备是否被允许接入该网络。若网络针对该目标远端设备的签约有效，则可以确定该目标远端设备具有接入网络的权限；若网络针对该目标远端设备的签约无效，则可以确定该目标远端设备不具有接入网络的权限。(4)根据目标远端设备的标识是否存在于目标标识列表中，确定该目标远端设备是否具有接入网络的权限。若存在，则表明目标远端设备具有接入网络的权限。若不存在，则表明目标远端设备不具有接入网络的权限。
其中，目标标识列表可以存储于第一设备本地。在一种实现方式中，第一设备中的目标标识列表可以由前述权限管理设备(如3A服务器、AF)预先为第一设备配置。或者，目标标识列表可以由权限管理设备预先发送给第一设备。
在一种实现方式中，每个网络可以对应一个标识列表。针对某网络，与该网络对应的标识列表可以用于指示具有接入该网络的权限的各个远端设备。中继设备存储有标识列表1和标识列表2，标识列表1与网络1对应，用于指示具有接入该网络1的权限的各个远端设备；标识列表2与网络2对应，用于指示具有接入该网络2的权限的各个远端设备。若远端设备1请求接入网络1，远端设备2请求接入网络2，中继设备针对远端设备1的鉴权流程为：中继设备判断远端设备1的标识是否存在于标识列表1中，若存在，则表明远端设备1具有接入网络1的权限。若不存在，则表明远端设备1不具有接入网络1的权限。中继设备针对远端设备2的鉴权流程为：中继设备1判断远端设备2的标识是否存在于标识列表2中，若存在，则表明远端设备2具有接入网络2的权限。若不存在，则表明远端设备2不具有接入网络2的权限。在一种实现方式中，针对某网络，与该网络对应的标识列表可以用于指示具有通过中继设备接入该网络的权限的各个远端设备。在一种实现方式中，不同远端设备可以请求通过同一中继设备接入不同的网络。例如，远端设备1可以请求通过中继设备1接入网络1，远端设备2可以请求通过该中继设备1或者中继设备2接入网络2。
在本申请实施例中，前述网络(即远端设备(包括目标远端设备)希望接入的网络)可以指数据网络、局域网(local area network，LAN)、核心网(如4G核心网、5G核心网等)或者其他类型的网络，本申请实施例对此不做限定。需要说明的是，中继设备可以在侧行链路(sidelink，SL)接口上广播该中继设备能够接入的网络标识，以便远端设备可以根据自身希望接入的网络，向能够接入该网络的中继设备发起网络接入请求。侧链路还可以称为侧链路或直通链路。
在一种实现方式中，前述第一请求还可以包括网络标识，此时，前述第一信息具体可以用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限。在第二设备为终端设备(如目标远端设备或者终端设备)的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。其中，网络标识用于唯一标识一个网络。可以理解的是，该网络标识可以为数据网络的标识、局域网(local area network，LAN)的标识、核心网(如4G核心网、5G核心网等)的标识或者其他类型的网络的标识，本申请实施例对此不做限定。
若第一设备根据目标远端设备的标识是否存在于目标标识列表中，确定该目标远端设备是否具有接入网络的权限，那么该目标标识列表可以与该网络标识关联，此时，该目标标识具体可以用于指示具有接入该网络标识所指示的网络的权限的远端设备。
结合前述内容可知，一个网络标识可以关联一个标识列表，针对某网络，与该网络标识关联的标识列表可以用于指示具有接入该网络标识所指示的网络的权限的各个远端设备。因此，第一设备在接收到该第一请求后，针对目标远端设备的鉴权流程为：获取与该第一请求中的网络标识关联的目标标识列表，判断目标远端设备的标识是否存在于该目标标识列表中，若存在，则表明目标远端设备具有接入(该网络标识所指示的)网络的权限。若不存在，则表明目标远端设备不具有接入该网络的权限。
通过这种方式，可以避免不具有接入该网络的权限的设备接入该网络。当该网络标识为LAN的标识的情况下，可以避免不属于该LAN的成员加入LAN会话。
步骤S303：第一设备发送第一信息至该第二设备，该第一信息用于指示该目标远端设备具有接入网络的权限。
具体的，若该目标远端设备具有接入网络(如数据网络或者LAN)的权限，则该第一设备可以向该第二设备发送的第一信息用于指示该目标远端设备具有接入网络的权限。若该目标远端设备不具有接入网络(如数据网络或者LAN)的权限，则该第一设备向该第二设备发送的第一信息用于指示该目标远端设备不具有接入网络的权限。在一种实现方式中，若该目标远端设备具有接入网络(如数据网络或者LAN)的权限，则该第一设备可以向该第二设备发送为该目标远端设备分配的目标网络地址。若该目标远端设备不具有接入网络(如数据网络或者LAN)的权限，则该第一设备可以不向该第二设备发送该目标网络地址。需要说明的是，关于第一设备如何获取为远端设备分配的网络地址(包括目标网络地址)的内容可参见图2a实施例中的相关描述，此处不再赘述。还需要说明的是，步骤S303的执行过程可参见图2a中步骤S202的具体描述，此处不再赘述。
在本申请实施例中，为远端设备分配网络地址的设备可以为第一设备，或者，第一设备可以请求其他设备(如第四设备或第五设备)为远端设备分配网络地址。
在一种实现方式中，远端设备的网络地址可以预先分配好，且存储于第一设备中。在远端设备(如目标远端设备)鉴权通过后，该第一设备可以将为该目标远端设备分配的网络地址(即目标网络地址)发送至第二设备。需要说明的是，本申请实施例中所描述的某设备鉴权通过，指的是确定该设备具有接入网络的权限。同理，本申请实施例中所描述的某设备鉴权失败，指的是确定该设备不具有接入网络的权限。
以第一设备为中继设备，第二设备为目标远端设备，第四设备为SMF，第六设备为UDM，且第一数量为多个为例，预先为远端设备(包括目标远端设备)分配网络地址的场景示意图可以如图3b所示。其中，目标远端设备向中继设备发送第一请求，表示该目标远端设备希望接入网络。此时该第一请求用于该目标远端设备请求接入网络，还用于请求为目标远端设备分配网络地址。由图3b可知，中继设备可以在接收到第一请求之前，通过向SMF发网络地址分配请求，以预先请求SMF为多个(即第一数量)远端设备(包括目标远端设备)分别分配网络地址。SMF在接收到该网络地址分配请求后，可以从UDM中获取第二数量，并在第一数量小于或等于第二数量的情况下，为前述多个远端设备中各个远端设备分配网络地址，并将为各个远端设备分配的网络地址发送至中继设备。这样当中继设备接收到第一请求，且对目标远端设备鉴权通过(如目标远端设备的标识存在于目标标识列表中)后，即可从本地存储器中获取SMF为该目标远端设备分配的目标网络地址，并将该目标网络地址携带于第一 信息(该第一信息用于指示该目标远端设备具有接入网络的权限)中发送至该目标远端设备。
在另一种实现方式中，第一设备可以在确定目标远端设备鉴权通过后，再触发为该目标远端设备分配网络地址的流程。例如，当为远端设备分配网络地址的设备为第一设备时，该第一设备可以在确定目标远端设备鉴权通过后，再为该目标远端设备分配网络地址。又如，当第一设备请求其他设备(如第四设备或第五设备)为远端设备分配网络地址时，该第一设备可以在确定目标远端设备鉴权通过后，再请求该其他设备(如第四设备或第五设备)为远端设备分配网络地址。通过这种方式，可以避免触发了为远端设备分配网络地址的流程，但是该远端设备的鉴权结果为鉴权失败的情况，从而有利于避免资源浪费。
通过实施本申请实施例，增加了目标远端设备接入网络的鉴权机制，可以确定目标远端设备是否具有接入网络的权限，以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
请参见图4a，图4a是本申请实施例提供的又一种鉴权方法的流程示意图，该方法详细描述了第三设备如何对目标远端设备进行鉴权。其中，步骤S401的执行主体为第二设备，或者为第二设备中的芯片，步骤S402和步骤S404的执行主体为第一设备，或者为第一设备中的芯片，步骤S403的执行主体为第三设备，或者为第三设备中的芯片。以下以第一设备、第二设备、第三设备为鉴权方法的执行主体为例进行说明。如图4a所示，该方法可以包括但不限于如下步骤：
步骤S401：第二设备向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限。
需要说明的是，步骤S401的执行过程可参见图2a中步骤S201的具体描述，此处不再赘述。
步骤S402：该第一设备向第三设备发送鉴权请求，该鉴权请求包括该目标远端设备的标识，该鉴权请求用于请求确定该目标远端设备是否具有接入网络的权限。
在本申请实施例中，第一设备可以请求第三设备对目标远端设备进行鉴权。第三设备对目标远端设备进行鉴权的流程(或方法)与图3a实施例中第一设备对目标远端设备进行鉴权的流程(或方法)相同，区别在于图3a实施例中第一设备作为鉴权主体，而在图4a实施例中第三设备作为鉴权主体。步骤S402的执行过程可参见图3a实施例中第一设备作为鉴权主体的相关内容，此处不再赘述。
步骤S403：该第三设备向该第一设备发送鉴权结果信息，该鉴权结果信息用于指示该目标远端设备是否具有接入网络的权限。
具体的，该第三设备接收到鉴权请求后，可以确定该目标远端设备是否具有接入网络的权限。第三设备可以通过但不限于如下方式确定该目标远端设备是否具有接入网络的权限：(1)根据该目标远端设备当前所处位置是否在允许接入网络的位置区域内，确定该目标远端设备是否具有接入网络的权限。(2)根据该目标远端设备的能力，确定该目标远端设备是否具有接入网络的权限。(3)根据网络针对该目标远端设备的签约是否有效，确定该目标远端设备是否具有接入网络的权限。(4)根据目标远端设备的标识是否存在于目标标识列表中，确定该目标远端设备是否具有接入网络的权限。其详细过程可参见图3a实施例中步骤S302中的具体描述，此处不再赘述。
需要说明的是，当第三设备作为鉴权主体时，为了告知第一设备目标远端设备是否鉴权 通过，第三设备在对目标远端设备鉴权完成后，可以向第一设备发送鉴权结果信息，以指示该目标远端设备是否鉴权通过(即该目标远端设备是否具有接入网络的权限)。具体的，若目标远端设备鉴权通过，则向第一设备发送的鉴权结果信息用于指示目标远端设备具有接入网络的权限；若目标远端设备鉴权失败，则向第一设备发送的鉴权结果信息用于指示该目标远端设备不具有接入网络的权限。
在本申请实施例中，远端设备希望接入的网络可以为数据网络、局域网或者其他类型的网络。在一种实现方式中，前述第一请求和鉴权请求还可以包括网络标识，该鉴权请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限；该第一信息和该鉴权结果信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限。在该第二设备为终端设备(如目标远端设备或者中继设备)的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元(如SMF网元)的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
若第三设备根据目标远端设备的标识是否存在于目标标识列表中，确定该目标远端设备是否具有接入网络的权限，那么该目标标识列表与该网络标识关联，此时，目标标识列表中的目标标识具体可以用于指示具有接入该网络标识所指示的网络的权限的远端设备。
步骤S404：第一设备发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
具体的，第一设备接收到鉴权结果信息后，可以向第二设备发送第一信息。此时，鉴权结果信息和第一信息所指示的内容一致，即鉴权结果信息和第一信息均用于指示该目标远端设备具有接入网络的权限，或者，鉴权结果信息和第一信息均用于指示该目标远端设备不具有接入网络的权限。
在一种实现方式中，若鉴权结果信息用于指示该目标远端设备具有接入网络的权限，则第一设备还可以将为目标远端设备分配的目标网络地址发送至第二设备，以便第二设备将该目标网络地址发送至该目标远端设备。其中，该目标网络地址可以与第一信息一起发送(如目标网络地址携带于第一信息中)，或者分开发送，本申请实施例对此不做限定。若鉴权结果信息用于指示该目标远端设备不具有接入网络的权限，则第一设备可以不向该第二设备发送该目标网络地址，或者，可以不触发为该目标远端设备分配网络地址的流程。
在一种实现方式中，可以在确定目标远端设备鉴权通过后，再触发为该目标远端设备分配网络地址的流程。在一种实现方式中，可以由第一设备触发为该目标远端设备分配网络地址的流程；或者，可以由负责鉴权的设备(如第三设备)触发为该目标远端设备分配网络地址的流程。在一种实现方式中，负责鉴权的设备、负责为目标远端设备分配网络地址的设备可以为同一设备；或者，可以为不同设备，本申请实施例对此不做限定。
在一种实现方式中，第一设备向第三设备发送的鉴权请求还可以用于请求为目标远端设备分配网络地址；相应的，前述鉴权结果信息可以包括为该目标远端设备分配的目标网络地址。换言之，第三设备除了用于对目标远端设备进行鉴权，还可以用于为该目标远端设备分配网络地址。
参见图4b，为负责鉴权的设备、负责为目标远端设备分配网络地址的设备均为第三设备的场景示意图。图4b以第一设备为中继设备，第二设备为目标远端设备，第三设备为SMF为例。其中，目标远端设备向中继设备发送第一请求，表示该目标远端设备希望接入网络。此时该第一请求用于该目标远端设备请求接入网络，还用于请求为目标远端设备分配网络地 址。由图4b可知，中继设备在接收到第一请求之后，通过向SMF发送鉴权请求，以请求该SMF对目标远端设备进行鉴权，以及在鉴权通过的情况下为该目标远端设备分配网络地址。相应的，SMF对目标远端设备鉴权通过(如目标远端设备的标识存在于目标标识列表中)后，即可为该目标远端设备分配目标网络地址，并将该目标网络地址携带于鉴权结果信息(该鉴权结果信息用于指示该目标远端设备具有接入网络的权限)中发送至第一设备。然后第一设备可以将该目标网络地址携带于第一信息(该第一信息用于指示该目标远端设备具有接入网络的权限)发送至目标远端设备。在此过程中，SMF既用于对目标远端设备进行鉴权，还用于为该目标远端设备分配网络地址。
在另一种实现方式中，第一设备向第三设备发送的鉴权请求还用于请求为目标远端设备分配网络地址的情况下，第三设备发送给第一设备的鉴权结果信息(该鉴权结果信息用于指示该目标远端设备具有接入网络的权限)还可以用于指示第一设备为目标远端设备分配网络地址。相应的，第一设备接收到该鉴权结果信息后，可以为该远端设备分配网络地址。
参见图4c，为负责鉴权的设备、负责为目标远端设备分配网络地址的设备为不同设备的场景示意图。图4c以第一设备为SMF，第二设备为中继设备，第三设备为权限管理设备为例。其中，目标远端设备向中继设备发送网络地址分配请求1，该网络地址分配请求1包括目标远端设备的标识，该网络地址分配请求1用于请求为该目标远端设备分配网络地址。即目标远端设备向中继设备发送网络地址分配请求1表示该目标远端设备希望接入网络。由图4c可知，中继设备在接收到网络地址分配请求1之后，通过向SMF发送第一请求(包括目标远端设备的标识)，以用于指示目标远端终端请求接入网络，并请求为目标远端设备分配网络地址。此时，SMF可以向权限管理设备发送鉴权请求，以请求该权限管理设备对目标远端设备进行鉴权，在鉴权通过后，权限管理设备向SMF发送的鉴权结果信息可以用于指示目标远端设备鉴权通过以及指示SMF为该目标远端设备分配网络地址。可以理解的是，SMF接收到鉴权结果信息即可为目标远端设备分配目标网络地址，并将该目标网络地址携带于第一信息(该第一信息用于指示该目标远端设备具有接入网络的权限)中反馈给中继设备，然后由中继设备将该目标网络地址反馈给目标远端设备。
在一种实现方式中，图4c中的鉴权请求还可以用于请求权限管理设备在对目标远端设备鉴权通过后，为该远端设备分配网络地址。权限管理设备在对该目标远端设备鉴权通过后，可以继续为该目标远端设备分配网络地址，或者，也可以授权或指示SMF为目标远端设备分配网络地址。在此过程中，对目标远端设备进行鉴权的设备为权限管理设备，为目标远端设备分配网络地址的设备为SMF。
需要说明的是，步骤S404的其余执行过程可参见图2a中步骤S202的具体描述，此处不再赘述。
通过实施本申请实施例，增加了目标远端设备接入网络的鉴权机制，可以过确定目标远端设备是否具有接入网络的权限，以防止不能接入的远端设备接入网络，从而有利于提高网络安全性。
上述本申请提供的实施例中，分别从第一设备和第二设备的角度对本申请实施例提供的方法进行了介绍。为了实现上述本申请实施例提供的方法中的各功能，第一设备和第二设备可以包括硬件结构、软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能可以以硬件结构、软件模块、或者硬件结构加软件模块的方式来执行。
请参见图5，为本申请实施例提供的一种通信装置50的结构示意图。图5所示的通信装置50可包括处理单元501和通信单元502。通信单元502可包括发送单元和/或接收单元，发送单元用于实现发送功能，接收单元用于实现接收功能，通信单元502可以实现发送功能和/或接收功能。通信单元也可以描述为收发单元。
通信装置50可以是第一设备，也可以第一设备中的装置，还可以是能够与第一设备匹配使用的装置。或者，通信装置50可以是第二设备，也可以第二设备中的装置，还可以是能够与第二设备匹配使用的装置。
通信装置50为第一设备：处理单元501，用于调用通信单元502接收来自第二设备的第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理单元501还用于调用通信单元502发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，处理单元501还可以用于：确定该目标远端设备是否具有接入网络的权限。
在一种实现方式中，处理单元501还可以用于：若目标远端设备的标识存在于目标标识列表中，则确定该目标远端设备具有接入网络的权限；该目标标识列表包括一个或多个目标标识，目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求还包括网络标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接该网络标识所指示的网络的权限。
在一种实现方式中，该处理单元501还用于调用通信单元502向第三设备发送鉴权请求，该鉴权请求包括目标远端设备的标识，该鉴权请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理单元501还用于调用通信单元502接收来自该第三设备的鉴权结果信息，该鉴权结果信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，在该目标远端设备的标识存在于目标标识列表中的情况下，该鉴权结果信息用于指示该目标远端设备具有接入网络的权限，该目标标识列表包括一个或多个目标标识，该目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求和鉴权请求还包括网络标识，该鉴权请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限；该第一信息和该鉴权结果信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在该第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，前述第一信息可以包括为该目标远端设备分配的目标网络地址。
在一种实现方式中，该处理单元501还用于调用通信单元502向第四设备发送网络地址分配请求，该网络地址分配请求用于请求获取第一数量的网络地址；该处理单元501还用于调用通信单元502从该第四设备接收第一数量的网络地址；该第一数量的网络地址是在第一 数量小于或等于第二数量的情况下发送的；其中，该第二数量为具有接入网络的权限的远端设备的数量；该第一数量的网络地址包括前述目标网络地址。
通信装置50为第二设备：处理单元501，用于调用通信单元502向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该通信装置50为终端设备中的装置的情况下，该第一请求用于该目标远端设备请求接入网络；在该通信装置50为网元中的装置的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理单元501还用于调用通信单元502接收来自第一设备的第一信息，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，第一请求还包括网络标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在通信装置50为终端设备中的装置的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该通信装置50为网元中的装置的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，第一信息包括为该目标远端设备分配的目标网络地址。
请参见图6，图6是本申请实施例提供的另一种通信装置60的结构示意图。通信装置60可以是第一设备或第二设备，也可以是支持第一设备实现上述方法的芯片、芯片系统、或处理器等，也可以是支持第二设备实现上述方法的芯片、芯片系统、或处理器等。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
通信装置60可以包括一个或多个处理器601。处理器601可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，远端设备、远端设备芯片，中继设备、中继设备芯片，SMF、SMF芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
通信装置60还可以包括收发器602、天线603。收发器602可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器602可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，通信装置60中可以包括一个或多个存储器604，其上可以存有计算机程序605，该计算机程序可在通信装置60上被运行，使得通信装置60执行上述方法实施例中描述的方法。可选的，该存储器604中还可以存储有数据。通信装置60和存储器604可以单独设置，也可以集成在一起。
通信装置60为第一设备：处理器601用于执行图3a中的步骤S302。收发器602用于执行图2a中的步骤S202；或者图2b中的步骤s1；或者图2c中的步骤s1’；或者图3a中的步骤S303；或图4a中的步骤S402和S404。
通信装置60为第二设备：收发器602用于执行图2a中的步骤S201；或者图3a中的步骤S301；或图4a中的步骤S401。
在一种实现方式中，处理器601中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可 以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，处理器601可以存有计算机程序606，计算机程序606在处理器601上运行，可使得通信装置60执行上述方法实施例中描述的方法。计算机程序606可能固化在处理器601中，该种情况下，处理器601可能由硬件实现。
在一种实现方式中，通信装置60可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。本申请中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的通信装置可以是第一设备或第二设备，但本申请中描述的通信装置的范围并不限于此，而且通信装置的结构可以不受图6的限制。通信装置可以是独立的设备或者可以是较大设备的一部分。例如所述通信装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端、智能终端、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于通信装置可以是芯片或芯片系统的情况，可参见图7所示的芯片的结构示意图。图7所示的芯片包括处理器701和接口702。其中，处理器701的数量可以是一个或多个，接口702的数量可以是多个。
对于芯片用于实现本申请实施例中第一设备的功能的情况：
处理器701，用于调用接口702接收来自第二设备的第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理器701还用于调用接口702发送第一信息至该第二设备，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，处理器701还可以用于：确定该目标远端设备是否具有接入网络的权限。
在一种实现方式中，处理器701还可以用于：若目标远端设备的标识存在于目标标识列表中，确定该目标远端设备具有接入网络的权限；该目标标识列表包括一个或多个目标标识，目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求还包括网络标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的 情况下，该第一请求具体用于请求确定该目标远端设备是否具有接该网络标识所指示的网络的权限。
在一种实现方式中，该处理器701还用于调用接口702向第三设备发送鉴权请求，该鉴权请求包括目标远端设备的标识，该鉴权请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理器701还用于调用接口702接收来自该第三设备的鉴权结果信息，该鉴权结果信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，在该目标远端设备的标识存在于目标标识列表中的情况下，该鉴权结果信息用于指示该目标远端设备具有接入网络的权限，该目标标识列表包括一个或多个目标标识，该目标标识用于指示具有接入网络的权限的远端设备。
在一种实现方式中，第一请求和鉴权请求还包括网络标识，该鉴权请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限；该第一信息和该鉴权结果信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在该第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，前述第一信息可以包括为该目标远端设备分配的目标网络地址。
在一种实现方式中，该处理器701还用于调用接口702向第四设备发送网络地址分配请求，该网络地址分配请求用于请求获取第一数量的网络地址；该处理器701还用于调用接口702从该第四设备接收第一数量的网络地址；该第一数量的网络地址是在第一数量小于或等于第二数量的情况下发送的；其中，该第二数量为具有接入网络的权限的远端设备的数量；该第一数量的网络地址包括前述目标网络地址。
对于芯片用于实现本申请实施例中第二设备的功能的情况：
处理器701，用于调用接口702向第一设备发送第一请求，该第一请求包括目标远端设备的标识，在该第二设备为终端设备的情况下，该第一请求用于该目标远端设备请求接入网络；在该第二设备为网元的情况下，该第一请求用于请求确定该目标远端设备是否具有接入网络的权限；该处理器701还用于调用接口702接收来自该第一设备的第一信息，该第一信息用于指示该目标远端设备是否具有接入网络的权限。
在一种实现方式中，第一请求还包括局域网网络标识所指示的网络的标识，前述第一信息具体用于指示该目标远端设备是否具有接入该网络标识所指示的网络的权限；在第二设备为终端设备的情况下，该第一请求具体用于该目标远端设备请求接入该网络标识所指示的网络；在该第二设备为网元的情况下，该第一请求具体用于请求确定该目标远端设备是否具有接入该网络标识所指示的网络的权限。
在一种实现方式中，第一请求还用于请求为目标远端设备分配网络地址；在该目标远端设备具有接入网络的权限的情况下，第一信息包括为该目标远端设备分配的目标网络地址。
可选的，芯片还包括存储器703，存储器703用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本申请实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本 申请实施例保护的范围。
本申请还提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序包括程序指令，该程序指令被计算机执行时实现上述任一方法实施例的功能。
上述计算机可读存储介质包括但不限于快闪存储器、硬盘、固态硬盘。
本申请还提供了一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行所述计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解：本申请中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。
本申请中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本申请不做限制。在本申请实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。
本申请中各表所示的对应关系可以被配置，也可以是预定义的。各表中的信息的取值仅仅是举例，可以配置为其他值，本申请并不限定。在配置信息与各参数的对应关系时，并不一定要求必须配置各表中示意出的所有对应关系。例如，本申请中的表格中，某些行示出的对应关系也可以不配置。又例如，可以基于上述表格做适当的变形调整，例如，拆分，合并等等。上述各表中标题示出参数的名称也可以采用通信装置可理解的其他名称，其参数的取值或表示方式也可以通信装置可理解的其他取值或表示方式。上述各表在实现时，也可以采用其他的数据结构，例如可以采用数组、队列、容器、栈、线性表、指针、链表、树、图、结构体、类、堆、散列表或哈希表等。
本申请中的预定义可以理解为定义、预先定义、存储、预存储、预协商、预配置、固化、或预烧制。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (17)

  1. 一种鉴权方法，其特征在于，所述方法包括：
    第一设备接收来自第二设备的第一请求，所述第一请求包括目标远端设备的标识；在所述第二设备为终端设备的情况下，所述第一请求用于所述目标远端设备请求接入网络；在所述第二设备为网元的情况下，所述第一请求用于请求确定所述目标远端设备是否具有接入网络的权限；
    所述第一设备发送第一信息至所述第二设备，所述第一信息用于指示所述目标远端设备是否具有接入网络的权限。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一设备确定所述目标远端设备是否具有接入网络的权限。
  3. 如权利要求2所述的方法，其特征在于，所述第一设备确定所述目标远端设备是否具有接入网络的权限，包括：
    若所述目标远端设备的标识存在于目标标识列表中，则第一设备确定所述目标远端设备具有接入网络的权限；所述目标标识列表包括一个或多个目标标识，所述目标标识用于指示具有接入网络的权限的远端设备。
  4. 如权利要求1～3中任一项所述的方法，其特征在于，所述第一请求还包括网络标识；所述第一信息具体用于指示所述目标远端设备是否具有接入所述网络标识所指示的网络的权限；在所述第二设备为终端设备的情况下，所述第一请求具体用于所述目标远端设备请求接入所述网络标识所指示的网络；在所述第二设备为网元的情况下，所述第一请求具体用于请求确定所述目标远端设备是否具有接入所述网络标识所指示的网络的权限。
  5. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一设备向第三设备发送鉴权请求，所述鉴权请求包括所述目标远端设备的标识，所述鉴权请求用于请求确定所述目标远端设备是否具有接入网络的权限；
    所述第一设备接收来自所述第三设备的鉴权结果信息，所述鉴权结果信息用于指示所述目标远端设备是否具有接入网络的权限。
  6. 如权利要求5所述的方法，其特征在于，在所述目标远端设备的标识存在于目标标识列表中的情况下，所述鉴权结果信息用于指示所述目标远端设备具有接入网络的权限，所述目标标识列表包括一个或多个目标标识，所述目标标识用于指示具有接入网络的权限的远端设备。
  7. 如权利要求5或6所述的方法，其特征在于，所述第一请求和所述鉴权请求还包括网络标识，所述鉴权请求具体用于请求确定所述目标远端设备是否具有接入所述网络标识所指示的网络的权限；所述第一信息和所述鉴权结果信息具体用于指示所述目标远端设备是否具有接入所述网络标识所指示的网络的权限；在所述第二设备为终端设备的情况下，所述第一请求具体用于所述目标远端设备请求接入所述网络标识所指示的网络；在所述第二设备为网元的情况下，所述第一请求具体用于请求确定所述目标远端设备是否具有接入所述网络标识所指示的网络的权限。
  8. 如权利要求1～7中任一项所述的方法，其特征在于，所述第一请求还用于请求为所述目标远端设备分配网络地址；在所述目标远端设备具有接入网络的权限的情况下，所述第一信息包括为所述目标远端设备分配的目标网络地址。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    所述第一设备向第四设备发送网络地址分配请求，所述网络地址分配请求用于请求获取第一数量的网络地址；
    所述第一设备从所述第四设备接收所述第一数量的网络地址；所述第一数量的网络地址是在所述第一数量小于或等于第二数量的情况下发送的；其中，所述第二数量为具有接入网络的权限的远端设备的数量；所述第一数量的网络地址包括所述目标网络地址。
  10. 一种鉴权方法，其特征在于，所述方法包括：
    第二设备向第一设备发送第一请求，所述第一请求包括目标远端设备的标识；在所述第二设备为终端设备的情况下，所述第一请求用于所述目标远端设备请求接入网络；在所述第二设备为网元的情况下，所述第一请求用于请求确定所述目标远端设备是否具有接入网络的权限；
    所述第二设备接收来自所述第一设备的第一信息，所述第一信息用于指示所述目标远端设备是否具有接入网络的权限。
  11. 如权利要求10所述的方法，其特征在于，所述第一请求还包括网络标识，所述第一信息具体用于指示所述目标远端设备是否具有接入所述网络标识所指示的网络的权限；在所述第二设备为终端设备的情况下，所述第一请求具体用于所述目标远端设备请求接入所述网络标识所指示的网络；在所述第二设备为网元的情况下，所述第一请求具体用于请求确定所述目标远端设备是否具有接入所述网络标识所指示的网络的权限。
  12. 如权利要求10或11所述的方法，其特征在于，所述第一请求还用于请求为所述目标远端设备分配网络地址；在所述目标远端设备具有接入网络的权限的情况下，所述第一信息包括为所述目标远端设备分配的目标网络地址。
  13. 一种通信装置，其特征在于，包括用于执行如权利要求1～9中任一项所述的方法的单元。
  14. 一种通信装置，其特征在于，包括用于执行如权利要求10～12中任一项所述的方法的单元。
  15. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有程序指令，所述处理器执行所述存储器中存储的程序指令，以使所述装置执行如权利要求1～9中任一项所述的方法。
  16. 一种通信装置，其特征在于，所述装置包括处理器和存储器，所述存储器中存储有程序指令，所述处理器执行所述存储器中存储的程序指令，以使所述装置执行如权利要求10～12中任一项所述的方法。
  17. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令被通信装置执行时使所述通信装置执行如权利要求1～9或10～12中任一项所述的方法。
PCT/CN2021/117151 2020-09-30 2021-09-08 一种鉴权方法及其装置 WO2022068541A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21874202.1A EP4210368A4 (en) 2020-09-30 2021-09-08 AUTHENTICATION METHOD AND DEVICE THEREOF
US18/192,222 US20230232318A1 (en) 2020-09-30 2023-03-29 Authentication method and apparatus therefor

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011070319.3A CN114339748A (zh) 2020-09-30 2020-09-30 一种鉴权方法及其装置
CN202011070319.3 2020-09-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/192,222 Continuation US20230232318A1 (en) 2020-09-30 2023-03-29 Authentication method and apparatus therefor

Publications (1)

Publication Number Publication Date
WO2022068541A1 true WO2022068541A1 (zh) 2022-04-07

Family

ID=80951189

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/117151 WO2022068541A1 (zh) 2020-09-30 2021-09-08 一种鉴权方法及其装置

Country Status (4)

Country Link
US (1) US20230232318A1 (zh)
EP (1) EP4210368A4 (zh)
CN (1) CN114339748A (zh)
WO (1) WO2022068541A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115801733A (zh) * 2023-02-02 2023-03-14 天翼云科技有限公司 一种网络地址分配方法、装置、电子设备及可读介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106162803A (zh) * 2015-04-02 2016-11-23 中兴通讯股份有限公司 一种中继ue接入控制方法及装置
CN107690165A (zh) * 2016-08-05 2018-02-13 北京信威通信技术股份有限公司 一种网络连接的方法、基站、中继用户设备及系统
CN109246688A (zh) * 2017-07-11 2019-01-18 华为技术有限公司 设备接入方法、设备及系统
WO2019033920A1 (zh) * 2017-08-15 2019-02-21 华为技术有限公司 网络侧对远端用户设备的识别和控制方法以及设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8855138B2 (en) * 2008-08-25 2014-10-07 Qualcomm Incorporated Relay architecture framework
CN104469695B (zh) * 2013-09-12 2019-02-05 华为技术有限公司 网络接入方法、近距离通信服务器、中继终端及终端
US10924975B2 (en) * 2015-09-24 2021-02-16 Samsung Electronics Co., Ltd Method for supporting lawful interception of remote prose UE in network
US11297660B2 (en) * 2016-10-06 2022-04-05 Convida Wireless, Llc Session management with relaying and charging for indirect connection for internet of things applications in 3GPP network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106162803A (zh) * 2015-04-02 2016-11-23 中兴通讯股份有限公司 一种中继ue接入控制方法及装置
CN107690165A (zh) * 2016-08-05 2018-02-13 北京信威通信技术股份有限公司 一种网络连接的方法、基站、中继用户设备及系统
CN109246688A (zh) * 2017-07-11 2019-01-18 华为技术有限公司 设备接入方法、设备及系统
WO2019033920A1 (zh) * 2017-08-15 2019-02-21 华为技术有限公司 网络侧对远端用户设备的识别和控制方法以及设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4210368A4

Also Published As

Publication number Publication date
EP4210368A4 (en) 2024-01-17
EP4210368A1 (en) 2023-07-12
US20230232318A1 (en) 2023-07-20
CN114339748A (zh) 2022-04-12

Similar Documents

Publication Publication Date Title
US11528770B2 (en) Session management method, apparatus, and system
WO2022012310A1 (zh) 一种通信方法及装置
WO2021218595A1 (zh) 一种地址获取方法及装置
WO2021136211A1 (zh) 授权结果的确定方法及装置
CN116325845A (zh) 一种安全通信方法、装置及系统
CN113811025A (zh) 一种释放中继连接的方法、设备及系统
US20230232318A1 (en) Authentication method and apparatus therefor
WO2021204277A1 (zh) 通信方法、装置及系统
WO2022012176A1 (zh) 临近服务通信方法、管理网元、终端设备和通信系统
WO2021163901A1 (zh) 一种会话处理方法及其装置
WO2024092577A1 (zh) 一种组定位方法、装置、设备及存储介质
US11658866B2 (en) Remotely configuring ethernet layer functionality
WO2022007657A1 (zh) 一种域名系统请求的发送方法及装置
CN114830606B (zh) 组播通信方法及其装置
US20200137726A1 (en) Communications device and communication method
WO2023115487A1 (zh) 一种人工智能会话的创建方法及其装置
WO2024145902A1 (zh) 密钥获取方法、装置、设备及芯片系统
WO2024138581A1 (zh) 一种网络切片的授权方法、装置、设备及存储介质
WO2023147708A1 (zh) 一种人工智能会话的更新方法及其装置
WO2022033491A1 (zh) 用于鉴权的方法和通信装置
WO2024065706A1 (zh) 一种构建连接的方法及装置
WO2024065131A1 (zh) 一种多路径传输方法/装置/设备及存储介质
WO2024145875A1 (zh) 一种授权方法、装置、设备及存储介质
WO2024040411A1 (zh) 一种实现多接入的方法及其装置
WO2024065339A1 (zh) 一种网络卫星覆盖数据的授权方法、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21874202

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021874202

Country of ref document: EP

Effective date: 20230406

NENP Non-entry into the national phase

Ref country code: DE