WO2022068669A1 - 会话建立方法、装置、接入网设备及存储介质 - Google Patents

会话建立方法、装置、接入网设备及存储介质 Download PDF

Info

Publication number
WO2022068669A1
WO2022068669A1 PCT/CN2021/119919 CN2021119919W WO2022068669A1 WO 2022068669 A1 WO2022068669 A1 WO 2022068669A1 CN 2021119919 W CN2021119919 W CN 2021119919W WO 2022068669 A1 WO2022068669 A1 WO 2022068669A1
Authority
WO
WIPO (PCT)
Prior art keywords
session
request
client
response message
security
Prior art date
Application number
PCT/CN2021/119919
Other languages
English (en)
French (fr)
Inventor
乾春燕
谢辉
赵路
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US18/029,429 priority Critical patent/US20230370292A1/en
Priority to EP21874330.0A priority patent/EP4224748A4/en
Publication of WO2022068669A1 publication Critical patent/WO2022068669A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/06—Answer-back mechanisms or circuits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the embodiments of the present application relate to the field of network communication technologies, and in particular, to a session establishment method, apparatus, access network device, and storage medium.
  • 5G 5th Generation Mobile Communication Technology
  • NR New Radio
  • the user terminal needs to send a session request to the access network device such as the base station.
  • the access network device allocates the session resources received from the core network device to the user terminal, and after security activation with the user terminal, the success A session is established, so that data interaction and service processing can be performed between the client and the network core network device.
  • the session establishment technology has the following problems: if the access network device first allocates session resources to the client, and then performs security activation with the client, after the client receives the session resource, it initiates the next session request, which will cause the client to send The next session request of the server conflicts with the security activation, resulting in the failure of the security activation and the failure of the session establishment.
  • An embodiment of the present application provides a session establishment method, which is applied to an access network device, including: receiving a session request from a client, and sending the session request to a core network device; receiving a request response message returned by the core network device; wherein the request The response message carries the session resource; initiates the security activation of the access layer to the client; after confirming that the security activation is successful, the session resource is sent to the client for the client to establish a session based on the session resource.
  • Embodiments of the present application further provide a session establishment device, including: a request receiving module, configured to receive a session request from a client; a forwarding module, configured to send the session request to a core network device; a response receiving module, configured to receive a core network device The request response message returned by the network device; wherein, the request response message carries the session resources; the security activation module is used to initiate the security activation of the access layer to the client; the sending module, after confirming that the security activation is successful, sends the session resources to the The client side is used for the client side to establish a session based on session resources.
  • Embodiments of the present application also provide an access network device, including: at least one processor; a memory communicatively connected to the at least one processor; the memory stores instructions that can be executed by the at least one processor, and the instructions are processed by the at least one processor The processor executes, so that at least one processor can execute the above-mentioned session establishment method.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned session establishment method is implemented.
  • FIG. 1 is a flowchart of a session establishment method provided according to a first embodiment of the present application
  • FIG. 2 is an interactive flowchart of a session establishment method provided according to the first embodiment of the present application
  • FIG. 3 is a flowchart of a session establishment method provided according to a second embodiment of the present application.
  • FIG. 4 is an interactive flowchart of a session establishment method provided according to a second embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a session establishment apparatus provided according to a third embodiment of the present application.
  • FIG. 6 is a schematic diagram of an access network device provided according to a fourth embodiment of the present application.
  • the main purpose of the embodiments of the present application is to provide a session establishment method, apparatus, access network device and storage medium, which can improve the success rate of session establishment.
  • the first embodiment of the present application relates to a session establishment method, which is applied to an access network device, and specifically includes: receiving a session request from a client, and sending the session request to a core network device; receiving a request response message returned by the core network device; wherein , the request response message carries the session resource; initiates the security activation of the access layer to the client; after confirming that the security activation is successful, the session resource is sent to the client for the client to establish a session based on the session resource.
  • the session establishment method in this embodiment is used to establish a session between the user terminal and the core network device when a user using a mobile device surfs the Internet, so as to perform data interaction to implement service processing on the user terminal.
  • the session establishment in this embodiment The method can be implemented by access network equipment, such as a public mobile communication base station.
  • the network scenario where the user terminal and the core network device are located may be a single NR cell, a single core network or a multi-core network and other network scenarios.
  • An access network device is a network element structure of an access network ("AN" for short) in wireless communication, and a radio access network (NG-RAN) can be formed by a gNB base station or an ng-eNB base station.
  • AN access network
  • NG-RAN radio access network
  • a session request may be initiated to the core network device.
  • the base station When receiving the session request sent by the UE, the base station sends the session request to the core network equipment that provides network services for the user terminal, such as implementing the access and mobility management function (Access and Mobility Management Function, "AMF") for the operator.
  • AMF Access and Mobility Management Function
  • the base station When receiving the session resources sent by the AMF, the base station first performs security activation with the user terminal. After the security activation is successful, it allocates session resources to the user terminal to complete the session establishment between the user terminal and the core network equipment. For the session connection service with the core network equipment, at this time, the UE enters the connection management connection CM-CONNECTED state.
  • the NAS process is a process of performing mobility management and session management between the UE and a mobility management entity (Mobility Management Entity, "MME" for short).
  • MME Mobility Management Entity
  • the base station If the base station first performs security activation with the user terminal, and after the security activation is successful, it allocates session resources to the user terminal, which can avoid the failure of session recovery caused by the conflict between the NAS process and the security activation process when the UE initiates a session request, and the failure to exit the CM-IDLE state.
  • the Service Request process triggers the security activation of the Access Stratum (AS), resulting in a security failure caused by conflict with the Service Request process in the CM-CONNECTED state, thus ensuring the establishment of the session.
  • AS Access Stratum
  • a session request sent by a user terminal is received by the base station, and the session request may be a session establishment request, a session resumption request, or the like.
  • the user terminal may send a session request to the base station in the form of a message, and the base station encapsulates the session request and sends it to a core network device, such as an AMF.
  • the session may be a Protocol Data Unit (Protocol Data Unit, "PDU" for short) session, and the PDU session establishment request is used to request a core network device such as AMF to initiate a PDU session, so as to establish a PDU session between the client and the core network device.
  • PDU Protocol Data Unit
  • the session resumption request is used to request the core network device to reinstate a previously established but unused session.
  • the base station encapsulates the PDU session request in the Initial UE Message, and sends it to the core network device through the N2 interface.
  • One user terminal can establish multiple PDU sessions, and the information of one PDU session can include: user number, mobile subscriber identity code IMSI, international mobile equipment identity code IMEI, user location information, PDU session ID and other related information.
  • the PDU session ID is used to identify the ID of the PDU session established by the application. The ID is unique to each client, and the scope of the ID number is limited to this client. If the user terminal sends a session resumption request, before the base station receives the session request sent by the user terminal, the base station, the user terminal, and the core network equipment need to perform an initial access procedure to establish a PDU session.
  • the base station receives a request response message returned by the core network device through the N2 interface, where the request response message includes a processing result after the core network device responds to the session request of the client.
  • the processing result may be to accept the request or to reject the request.
  • the core network device selects a session management function entity (Session Management Function, referred to as "SMF" that performs policy control on the session for the client that initiates the session request, assigns an IP address to the client, and processes these processes.
  • SMF Session Management Function
  • the result is carried in the initial context establishment request INITIAL CONTEXT SETUP REQUEST message as a session resource, and returned to the base station as a request response message.
  • the base station receives the request response message returned by the core network device, and obtains session resources from it.
  • step 103 the base station detects whether there is a security key field in the received request response message, so as to confirm whether the request response message carries the security key. If the base station detects that the request response message carries the security key, it initiates AS security activation to the user terminal, so as to encrypt and protect the integrity of the data transmission at the access layer, that is, perform step 104; if the request response message does not carry the security key If there is a security key, the data transmission at the access layer is not encrypted and integrity protected, and the base station directly sends the session resource to the client, that is, the AS security activation in step 104 is not performed, and step 105 is directly performed.
  • the base station If the base station detects that the request response message carries the security key, it stores the session resources extracted from the request response message in the cache area. After the security activation of the access layer is completed, the session resources stored in the cache area are sent to the to the user.
  • step 104 the base station initiates the AS security activation of the access layer to the user terminal to ensure the transmission security of control plane Radio Resource Control (Radio Resource Control, "RRC") messages and user plane data packets between the base station and the user terminal
  • RRC Radio Resource Control
  • AS security includes integrity protection of RRC signaling and encryption of RRC information and user data.
  • the base station and the user end first establish a signaling connection, and then activate and configure the encryption algorithm and integrity protection with the user end.
  • the base station may send a security activation command to the user terminal, wherein the security activation command includes an AS security mode command (Security Mode Command, "SMC" for short) message.
  • AS security mode command Security Mode Command
  • the base station sends the AS SMC message to the user end. If the user end confirms the AS security activation, the base station will receive the AS SMC completion message replied by the user end.
  • the AS SMC message should contain the RRC and UP encryption and integrity algorithms selected by the base station for the user end.
  • the AS SMC Complete message shall be integrity protected using the selected RRC algorithm indicated in the AS SMC message.
  • the base station After sending the AS SMC message, the base station can perform RRC downlink encryption, and after receiving and successfully verifying the AS SMC complete message, the base station can perform RRC uplink decryption; after sending the AS SMC complete message, the user can perform RRC Uplink encryption, ie, the security activation of the AS layer is successful.
  • the AS security activation initiated by the base station to the user terminal includes configuring a data radio bearer (Data Radio Bearer, "DRB" for short) for the session and negotiating AS layer security parameters.
  • DRB Data Radio Bearer
  • the base station and the user end negotiate to select the AS integrity protection and encryption algorithm, and send an RRC connection configuration message to the user end for UP integrity protection and UP encryption activation for the DRB, so that the base station and the user end Data transmission between clients is encrypted and integrity protected. Since UP integrity protection and UP encryption are activated for the DRB, the DRB data traffic between the base station and the user terminal can be completely encrypted and protected.
  • the base station after confirming that the security activation is successful, the base station also determines whether there are session resources in the cache area. If there are session resources in the cache area, the base station sends the session resources to the client. Then, the request response confirmation message is directly returned to the core network device.
  • step 105 when the base station receives the reply of the AS SMC completion message sent by the user terminal and confirms that the AS security activation is successful, the base station encrypts the session resources obtained from the request response message and cached in the buffer area and sends it to the user
  • the user terminal uses the received session resources to connect with the core network equipment; or, when the base station detects that the security key is not carried in the request response message, it directly sends the session resources carried in the request response message to the user terminal. Therefore, the user terminal can successfully establish a PDU session between the user terminal and the core network device based on the received session resources.
  • the base station after allocating session resources to the client, the base station returns a request response confirmation message to the core network device to remind the core network that the session resources allocated to the client have been sent. Before the session ends, the session resources cannot be Reassign to other sessions.
  • the UE initially accesses the network, establishes a PDU session, and does not transmit service data.
  • the access network node device NG-RAN node informs the UE to enter the CM-IDLE state.
  • the Initiate a session request Service Request to the NG-RAN node and the NG-RAN node sends the Service Request to the core network device AMF in the initial UE information.
  • the session resources are carried in the request response message and sent to the NG -RAN node, NG-RAN node initiates security activation to the UE, and after confirming that the security activation is successful, sends the session resources carried in the request response message to the UE. Since the security of this PDU session has been activated, there will be no conflict between the service Request of the next PDU session and the AS security mode SMC command of this security activation.
  • the UE initially accesses the network, establishes multiple PDU sessions, and does not transmit service data.
  • the NG-RAN node informs the UE to enter the CM-IDLE state.
  • the UE performs service processing on one of the PDU sessions, it initiates
  • the Service Request in the IDLE state is returned, the NG-RAN node sends the Service Request to the core network device AMF in the initial UE information. If the AMF determines that the PDU session needs to be restored, the session resources are carried in the request response message and sent to the NG-RAN node.
  • the NG-RAN node initiates security activation to the UE, and after confirming that the security activation is successful, sends the session resources carried in the request response message to the UE.
  • the UE initiates the service Request in the connection state again. Since the security of the previous PDU session has been activated, the service Request in the connection state and the AS security mode SMC command message of the security activation are activated. There will be no conflict.
  • the session establishment process is shown in FIG. 2 .
  • a PDU session established when a UE at the user end is initially accessed is restored.
  • the UE sends the session request Service Request to the network access device NG-RAN node.
  • the NG-RAN node After receiving the Service Request, the NG-RAN node encapsulates it in the initial user message Initial UE Message and sends it to the core network device AMF.
  • AMF receives the Initial UE Message, it sends a request response message N2 Request to the NG-RAN node from the N2 interface, obtains the session resource NAS-PDU from the N2 Request received, and stores it in the cache area.
  • the NG-RAN node also responds to the N2 Request message.
  • the N2 Request carries the security key Security Key, send the AS security mode command Security Mode Command to the UE according to the Security Key.
  • the UE receives the AS Security Mode Command and replies to the NG-RAN node with the AS security mode completion message Security Mode Complete, the NG-RAN node receives the AS Security Mode Complete, and the AS layer security activation is completed; if the N2 Request does not carry the Security Key, skip it. AS layer security activation process.
  • the NG-RAN node judges whether there is a NAS-PDU in the cache area. If so, it sends the NAS-PDU to the UE, and judges the cache area again. If it does not exist, it returns a request response confirmation message N2 to the AMF through the N2 interface. Request Ack.
  • the session establishment method of the present application can improve the success rate of session establishment between the client and the core network device.
  • the second embodiment of the present application relates to a session establishment method.
  • the second embodiment is substantially the same as the first embodiment, and the main difference is that: in the second embodiment of the present application, the request response message carries the security key.
  • FIG. 3 The specific flow of this embodiment is shown in FIG. 3 .
  • Step 301 Receive a session request from a client, and send the session request to a core network device;
  • Step 302 Receive a request response message returned by the core network device; wherein the request response message carries the session resource and the security key;
  • Step 303 extracting the session resource from the request response message, and storing the extracted session resource in the cache area;
  • Step 304 initiate the security activation of the access layer to the client
  • Step 305 After confirming that the security activation is successful, the session resource stored in the cache area is sent to the client for the client to establish a session based on the session resource.
  • step 301 and step 304 are substantially the same as step 101 and step 104 in the first embodiment, and will not be repeated here.
  • the request response message carries the security key, wherein the core network device brings the security key to the base station in the context establishment request message.
  • the base station can select the RRC and UP encryption and integrity protection algorithms for the user terminal according to the security key, and indicate the RRC and UP encryption and integrity algorithms selected for the user terminal in the AS security mode command, so as to perform security activation.
  • the base station stores the session resources extracted from the request response message in a cache area, wherein the cache area may be a storage area inside the base station dedicated to storing session resources, or may be a storage area capable of storing other communication resources storage area.
  • step 305 after the base station confirms that the security activation is successful, the data transmission between the AS layers is encrypted and integrity protected.
  • the base station can encrypt the session resources stored in the cache area and send them to the client to establish an AS layer security communication session. .
  • the session request sent by the user terminal also carries a request identifier value used to identify the session request
  • the security activation command sent by the base station to the user also carries the same request identifier value, so that the user terminal can confirm the security sent by the base station.
  • the activation command is a secure activation command for the session request corresponding to this request identifier.
  • the request identifier value may be a NAS uplink COUNTS value
  • the NAS uplink COUNTS value is also used in the security key carried in the request response message sent by the core network device.
  • the session establishment process is shown in Figure 4.
  • the user-end UE sends a session request Service Request to the network access device NG-RAN node.
  • the NG-RAN node After receiving the Service Request, the NG-RAN node encapsulates it in an Initial UE Message and sends it to the core network equipment AMF.
  • the AMF After receiving the Initial UE Message, the AMF sends a request response message N2 Request from the N2 interface to the NG-RAN node, and the N2 Request carries the Security Key.
  • the NG-RAN node obtains the Security Key and session resource NAS-PDU from the received N2 Request, and stores the NAS-PDU in the cache area.
  • the NG-RAN node sends the AS security mode command Security Mode Command to the UE according to the Security Key, the UE receives the AS Security Mode Command and replies to the NG-RAN node with the AS security mode completion message Security Mode Complete, and the NG-RAN node receives the AS Security Mode Complete, The AS layer security activation is completed.
  • the NG-RAN node judges whether there is a NAS-PDU in the cache area, if so, it sends the NAS-PDU to the UE, and returns a request response confirmation message N2 Request Ack to the AMF through the N2 interface.
  • the security activation with the user terminal is implemented first, and then the session resources are allocated to the user terminal. Avoid the conflict between the security activation and the next session request, and improve the success rate of session establishment between the client and the core network device.
  • the third embodiment of the present application relates to a session establishment apparatus, the specific structure of which is shown in FIG. 5 .
  • a request receiving module 501 configured to receive a session request from a client
  • a forwarding module 502 configured to send the session request to the core network device
  • a response receiving module 503 configured to receive a request response message returned by the core network device; wherein the request response message carries session resources;
  • a security activation module 504 configured to initiate security activation of the access layer to the client;
  • the sending module 505 after confirming that the security activation is successful, sends the session resource to the client for the client to establish a session based on the session resource.
  • the response receiving module 503 is further configured to, after the response receiving module 503 receives the request response message returned by the core network device, before the security activation module 504 initiates the security activation of the access layer to the client, detect whether the request response message carries Have a security key. If the response receiving module 503 detects that the request response message carries the security key, it notifies the security activation module 504 to initiate security activation; if the response receiving module 503 detects that the request response message does not carry the security key, it notifies the sending module 505 Direct execution sends session resources to the client.
  • the session establishment apparatus also has a cache module 506 for storing session resources extracted from the request response message.
  • the response receiving module 503 is further configured to extract the session resource from the request response message before the security activation module 504 initiates the security activation of the access layer to the client when it is detected that the request response message carries the security key. , and store the extracted session resources in the cache module 506, and the sending module 505 is further configured to send the session resources stored in the cache module 506 to the client.
  • the request response message carries the security key
  • the response receiving module 503 is further configured to extract the session resource from the request response message, and store the extracted session resource in the cache module 506 .
  • the security activation module 504 is further configured to send a security activation command to the user terminal based on the security key.
  • the session request carries a request identifier value for identifying the session request
  • the security activation module 504 is further configured to send a security activation command carrying the request identifier value for the user terminal to confirm that the security activation command is a command for the session request.
  • response receiving module 503 is further configured to return a request response confirmation message to the core network device.
  • this embodiment is an apparatus embodiment corresponding to the foregoing method embodiment, and this embodiment may be implemented in cooperation with the foregoing embodiments.
  • the related technical details mentioned in the foregoing embodiments are still valid in this embodiment, and are not repeated here in order to reduce repetition.
  • the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned embodiments.
  • a logical unit may be a physical unit, a part of a physical unit, or multiple physical units.
  • a composite implementation of the unit in order to highlight the innovative part of the present application, this embodiment does not introduce units that are not closely related to solving the technical problem raised by the present application, but this does not mean that there are no other units in this embodiment.
  • the fourth embodiment of the present application relates to an access network device, as shown in FIG. 6 , including: at least one processor 601 ; and a memory 602 communicatively connected to the at least one processor; The instructions are executed by the processor 601, and the instructions are executed by at least one processor 601 to execute the above-mentioned session establishment method.
  • the memory 602 and the processor 601 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 601 and various circuits of the memory 602 together.
  • the bus may also connect together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein.
  • the bus interface provides the interface between the bus and the transceiver.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a means for communicating with various other devices over a transmission medium.
  • the information processed by the processor 601 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the information and transmits the information to the processor 601 .
  • Processor 601 is responsible for managing the bus and general processing, and may also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory 602 may be used to store information used by the processor in performing operations.
  • the fifth embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Abstract

本申请实施例涉及网络通信技术领域，提出了一种会话建立方法，应用于接入网设备，包括：接收用户端的会话请求，将会话请求发送给核心网设备；接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源；向用户端发起接入层的安全激活；确认安全激活成功后，将会话资源发送给用户端，供用户端基于会话资源建立会话。

Description

会话建立方法、装置、接入网设备及存储介质
相关申请的交叉引用
本申请基于申请号为“202011062979.7”、申请日为2020年09月30日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请的实施例涉及网络通信技术领域，特别涉及一种会话建立方法、装置、接入网设备及存储介质。
背景技术
在第五代移动通信技术(5th Generation Mobile Communication Technology，简称：5G)新空口(New Radio，简称：NR)协议栈中，对用户端与网络核心网设备建立会话过程进行了详细的描述，其中包括对用户终端如何建立会话以及安全激活的过程描述。
在会话建立过程中，需要用户端向接入网设备如基站发送会话请求，由接入网设备将从核心网设备接收的会话资源，分配给用户端，并与用户端进行安全激活后，成功建立会话，使得用户端与网络核心网设备之间可以进行数据交互、业务处理。
然而，会话建立技术存在以下问题：若接入网设备先将会话资源分配给用户端，再与用户端进行安全激活，用户端在接收会话资源后，发起下一次会话请求，会导致用户端发送的下一次会话请求与安全激活冲突，导致安全激活失败，进而导致会话建立失败。
发明内容
本申请的实施例提供了一种会话建立方法，应用于接入网设备，包括：接收用户端的会话请求，将会话请求发送给核心网设备；接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源；向用户端发起接入层的安全激活；确认安全激活成功后，将会话资源发送给用户端，供用户端基于会话资源建立会话。
本申请的实施例还提供了一种会话建立装置，包括：请求接收模块，用于接收用户端的会话请求；转发模块，用于将会话请求发送给核心网设备；响应接收模块，用于接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源；安全激活模块，用于向用户端发起接入层的安全激活；发送模块，在确认安全激活成功后，将会话资源发送给用户端，供用户端基于会话资源建立会话。
本申请的实施例还提供了一种接入网设备，包括：至少一个处理器；与至少一个处理器通信连接的存储器；存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行，以使至少一个处理器能够执行上述的会话建立方法。
本申请的实施例还提供了一种计算机可读存储介质，存储有计算机程序，计算机程序被处理器执行时实现上述的会话建立方法。
附图说明
图1是根据本申请第一实施例提供的会话建立方法流程图；
图2是根据本申请第一实施例提供的会话建立方法的交互流程图；
图3是根据本申请第二实施例提供的会话建立方法流程图；
图4是根据本申请第二实施例提供的会话建立方法的交互流程图；
图5是根据本申请第三实施例提供的会话建立装置结构示意图；
图6是根据本申请第四实施例提供的接入网设备示意图。
具体实施方式
本申请的实施例的主要目的在于提出一种会话建立方法、装置、接入网设备及存储介质，能够提高会话建立的成功率。
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的第一实施例涉及一种会话建立方法，应用于接入网设备，具体包括：接收用户端的会话请求，将会话请求发送给核心网设备；接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源；向用户端发起接入层的安全激活；确认安全激活成功后，将会话资源发送给用户端，供用户端基于会话资源建立会话。
本实施例的会话建立方法，用于使用移动设备的用户上网时，在用户端与核心网设备之间建立会话，从而进行数据交互，以实现对用户端进行业务处理，本实施例的会话建立方法可以由接入网设备，如公用移动通信基站实现。其中，用户端与核心网设备所处的网络场景可以是单NR小区和单核心网或多核心网等网络场景。接入网设备在无线通信中是接入网(Access Network，简称“AN”)的网元结构，可以由gNB基站或ng-eNB基站组成无线接入网(NG-RAN)。当用户端(User Equipment，简称“UE”)处于连接管理空闲CM-IDLE态时，可以向核心网设备发起会话请求。当接收到UE发送的会话请求，基站将会话请求发送给为用户端提供网络服务的核心网设备，例如为运营商实现接入和移动性管理功能(Access and Mobility Management Function，简称“AMF”)的功能实体，当接收到AMF发送的会话资源，基站先与用户端进行安全激活，安全激活成功后，向用户端分配会话资源，完成用户端与核心网设备之间的会话建立，实现用户端与核心网设备之间的会话连接业务，此时，UE进入连接管理连接CM-CONNECTED态。随着5G协议的演进，UE在CM-CONNECTED态时，并且当前没有NAS过程的情况下，也可以发起会话请求，以向AMF请求恢复会话的用户面资源。其中，NAS过程是在UE和移动管理实体(Mobility Management Entity，简称“MME”)间进行移动性管理与会话管理的过程。若基站先与用户端进行安全激活，安全激活成功后，向用户端分配会话资源，可以避免UE发起会话请求的NAS过程与安全激活过程的冲突导致的会话恢复失败、及退CM-IDLE态的Service Request流程触发接入层(Access Stratum，简称“AS”)的安全激活导致与CM-CONNECTED态的Service Request流程冲突造成的安全失败，从而保证了会话的建立。
下面对本实施例的会话建立方法的实现细节进行具体的说明，以下内容仅为方便理解提 供的实现细节，并非实施本方案的必须，具体如图1所示：
在步骤101中，由基站接收用户端发送的会话请求，会话请求可以是会话建立请求、会话恢复请求等。用户端可以消息的形式向基站发送会话请求，基站将会话请求封装后发送给核心网设备，例如为AMF。具体地，会话可以是协议数据单元(Protocol Data Unit，简称“PDU”)会话，PDU会话建立请求用于向AMF等核心网设备请求发起一个PDU会话，从而在用户端与核心网设备之间建立连接进行通讯；会话恢复请求用于向核心网设备请求恢复一个先前已建立但未使用的会话。基站将PDU会话请求封装在初始用户消息Initial UE Message中，通过N2接口发送给核心网设备。其中，一个用户端可以建立多个PDU会话，一个PDU会话的信息可以包括：用户号码、移动用户识别码IMSI、国际移动设备识别码IMEI、用户位置信息、PDU会话ID等相关信息。PDU会话ID于用标识申请建立的PDU会话的ID，ID对于每个用户端来说是唯一的，ID编号的使用范围仅限于此用户端。若用户端发送的是会话恢复请求，则在基站接收用户端发送的会话请求前，基站、用户端、核心网设备需要执行初始接入流程以建立PDU会话。
在步骤102中，基站通过N2接口接收核心网设备返回的请求响应消息，请求响应消息包括核心网设备对用户端的会话请求进行响应处理后的处理结果。具体地，处理结果可以是接受请求，也可以是拒绝请求。若核心网设备接受请求，则为发起会话请求的用户端选择对会话进行策略控制的会话管理功能实体(Session Management Function，简称“SMF”)、为用户端分配IP地址等处理，并将这些处理结果作为会话资源携带在初始上下文建立请求INITIAL CONTEXT SETUP REQUEST消息中，作为请求响应消息返回给基站。基站接收核心网设备返回的请求响应消息，从中获取会话资源。
在步骤103中，基站在接收的请求响应消息中检测是否有安全密钥字段，从而确认请求响应消息中是否携带有安全密钥。若基站检测到请求响应消息中携带有安全密钥，则向用户端发起AS安全激活，从而对接入层的数据传输进行加密及完整性保护，即执行步骤104；若请求响应消息中未携带有安全密钥，则不对接入层的数据传输进行加密及完整性保护，基站直接将会话资源发送给用户端，即不执行步骤104的AS安全激活，直接执行步骤105。
若基站检测到请求响应消息中携带有安全密钥，则将请求响应消息中提取出的会话资源储存在缓存区域中，当接入层的安全激活完成后，将缓存区域中存储的会话资源发送给用户端。
在步骤104中，基站向用户端发起接入层的AS安全激活是为了确保基站与用户端之间控制面无线资源控制(Radio Resource Control，简称“RRC”)消息和用户面数据包的传输安全，即，AS安全包括RRC信令的完整性保护以及RRC信息和用户数据的加密。AS安全激活时，基站与用户端之间先建立信令连接，再与用户端进行激活和配置加密算法和完整性保护。
具体地，进行AS安全激活可以由基站对用户端发送安全激活命令，其中，安全激活命令包括AS安全模式命令(Security Mode Command，简称“SMC”)消息。基站将AS SMC消息发送到用户端，若用户端确认进行AS安全激活，基站会接收到用户端回复的AS SMC完成消息。其中，AS SMC消息应包含基站为用户端所选的RRC和UP加密和完整性算法。AS SMC完成消息应使用AS SMC消息中指示的所选RRC算法进行完整性保护。在发送AS SMC消息之后，基站可以进行RRC下行链路加密，在接收并成功验证到AS SMC完成消息之后，基站可以进行RRC上行链路解密；在发送AS SMC完成消息之后，用户端可以进行RRC上 行链路加密，即，AS层的安全激活成功。
在一个例子中，基站向用户端发起的AS安全激活包括为会话配置数据无线承载(Data Radio Bearer，简称“DRB”)和进行AS层安全参数的协商。具体地，在AS安全激活中，基站和用户端协商选取AS完整性保护和加密算法、向用户端发送RRC连接配置消息用于为DRB进行UP完整性保护和UP加密的激活，从而使得基站与用户端之间的数据传输得到加密和完整性保护。由于为DRB进行了UP完整性保护和UP加密的激活，因此基站与用户端之间的DRB数据流量可以被完整地加密和保护。
在一个例子中，基站在确认安全激活成功后，还对缓存区域中是否存在会话资源进行判断，若缓存区域中存在会话资源，则向用户端发送会话资源，若缓存区域中不存在会话资源，则直接向核心网设备返回请求响应确认消息。
在步骤105中，当基站收到用户端发送AS SMC完成消息的回复，确认AS安全激活成功后，基站将从请求响应消息中获取的并缓存中缓存区中的会话资源进行加密后发送给用户端，用户端利用接收的会话资源与核心网设备进行连接；或者，当基站检测到在请求响应消息中未携带有安全密钥后，直接将请求响应消息中携带的会话资源发送给用户端，从而用户端可以基于接收到的会话资源，在用户端与核心网设备间成功建立PDU会话。
在一个例子中，基站将会话资源分配给用户端后，向核心网设备返回请求响应确认消息，以提示核心网其为用户端分配的会话资源已发出，在此会话结束前，此会话资源不能再分配给其他会话。
在一个例子中，用户端UE初始接入网络，建立一个PDU会话，不进行业务数据传输，接入网节点设备NG-RAN node通知UE进入CM-IDLE态，当UE有需要上传的业务，则向NG-RAN node发起会话请求Service Request，NG-RAN node在初始UE信息中将Service Request带给核心网设备AMF，若AMF判断需要恢复PDU会话，将会话资源携带在请求响应消息中发送给NG-RAN node，NG-RAN node向UE发起安全激活，当确认安全激活成功后，将请求响应消息中携带的会话资源发送给UE。由于此PDU会话的安全已经被激活，下一个PDU会话的service Request和此安全激活的AS安全模式SMC命令不会发生冲突。
在一个例子中，用户端UE初始接入网络，建立多个PDU会话，不进行业务数据传输，NG-RAN node通知UE进入CM-IDLE态，当UE在其中一个PDU会话上进行业务处理，发起退IDLE态的Service Request，NG-RAN node在初始UE信息中将Service Request带给核心网设备AMF，若AMF判断需要恢复PDU会话，将会话资源携带在请求响应消息中发送给NG-RAN node，NG-RAN node向UE发起安全激活，当确认安全激活成功后，将请求响应消息中携带的会话资源发送给UE。此时若UE在另一个PDU会话上进行业务处理，则UE再发起连接态的service Request，由于前一个PDU会话的安全已经被激活，连接态的service Request和安全激活的AS安全模式SMC命令消息不会发生冲突。
在一个例子中，会话建立流程如图2所示，本实施例中，对一个用户端UE初始接入时建立的一个PDU会话进行恢复。由UE向入网设备NG-RAN node发送会话请求Service Request，NG-RAN node接收Service Request后，将其封装在初始用户消息Initial UE Message中发送给核心网设备AMF。AMF接收Initial UE Message后，向NG-RAN node从N2接口发送请求响应消息N2 Request，根据接收的N2 Request从中获取会话资源NAS-PDU，并储存在缓存区域中，NG-RAN node还对N2 Request进行判断，若N2 Request中携带安全密钥 Security Key，则根据Security Key向UE发送AS安全模式命令Security Mode Command。UE接收AS Security Mode Command并向NG-RAN node回复AS安全模式完成消息Security Mode Complete，NG-RAN node接收AS Security Mode Complete，AS层安全激活完成；若N2 Request中未携带Security Key，则跳过AS层安全激活过程。NG-RAN node在判断缓存区域中是否存在NAS-PDU，若存在，则将NAS-PDU发送给UE，并再次对缓存区域进行判断若不存在，则向AMF通过N2接口返回请求响应确认消息N2 Request Ack。
本实施例中，通过接收用户的会话请求，将会话请求发送给核心网设备，接收核心网设备返回的请求响应消息，向用户端发起安全激活，确认安全激活成功后，向用户端分配请求响应消息中携带的会话资源，由于在向用户端分配会话资源前先进行安全激活，再进行会话资源的分配，即在安全激活的过程中，用户端此次会话建立流程未结束，不会发起下一次会话请求，避免了安全激活与下一次会话请求冲突的情况，从而导致的会话无法成功建立，因此，本申请的会话建立方法可以提高用户端与核心网设备之间会话建立的成功率。
上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本专利的保护范围内；对算法中或者流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其算法和流程的核心设计都在该专利的保护范围内。
本申请的第二实施例涉及一种会话建立方法。第二实施例与第一实施例大致相同，主要区别之处在于：在本申请第二实施例中，请求响应消息中携带安全密钥。
本实施例具体流程如图3所示。
步骤301，接收用户端的会话请求，将会话请求发送给核心网设备；
步骤302，接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源、安全密钥；
步骤303，从请求响应消息中提取出会话资源，并将提取的会话资源储存在缓存区域中；
步骤304，向用户端发起接入层的安全激活；
步骤305，确认安全激活成功后，将缓存区域中存储的会话资源发送给用户端，供用户端基于会话资源建立会话。
其中，步骤301、步骤304与第一实施例中的步骤101、步骤104大致相同，不再赘述。
在步骤302中，请求响应消息中携带安全密钥，其中，核心网设备在上下文建立请求信息中将安全密钥带给基站。具体地，基站可以根据安全密钥，为用户端选取RRC和UP加密及完整性保护算法，并在AS安全模式命令中指示为用户端所选的RRC和UP加密和完整性算法，以进行安全激活。
在步骤303中，基站将从请求响应消息中提取的会话资源储存在缓存区域中，其中，缓存区域可以是基站内部一个专用于储存会话资源的储存区域，也可以是一个能储存其他通信资源的储存区域。
在步骤305中，基站在确认安全激活成功后，AS层间的数据传输得到加密及完整性保护，基站可以将缓存区域中存储的会话资源进行加密后发送给用户端，建立AS层安全通信会话。
在一个例子中，用户端发送的会话请求中还携带用于标识会话请求的请求标识值，基站向用户发送的安全激活命令中也携带相同的请求标识值，以供用户端确认基站发送的安全激 活命令是针对此请求标识对应的会话请求的安全激活命令。具体地，此请求标识值可以是一个NAS uplink COUNTS值，核心网设备发送的请求响应消息中携带的安全密钥中也使用NAS uplink COUNTS值。当用户端接收到基站发送的安全激活命令，会验证安全激活命令中携带的NAS uplink COUNTS值与自己请求的会话的NAS uplink COUNTS值是否一致，若一致，则进行安全激活，若不一致，则安全激活失败。
在一个例子中，会话建立流程如图4所示，用户端UE向入网设备NG-RAN node发送会话请求Service Request，NG-RAN node接收Service Request后，将其封装在Initial UE Message中发送给核心网设备AMF。AMF接收Initial UE Message后，向NG-RAN node从N2接口发送请求响应消息N2 Request，N2 Request中携带安全密钥Security Key。NG-RAN node根据接收的N2 Request从中获取Security Key和会话资源NAS-PDU，并将NAS-PDU储存在缓存区域中。NG-RAN node根据Security Key向UE发送AS安全模式命令Security Mode Command，UE接收AS Security Mode Command并向NG-RAN node回复AS安全模式完成消息Security Mode Complete，NG-RAN node接收AS Security Mode Complete，AS层安全激活完成。NG-RAN node判断缓存区域中是否存在NAS-PDU，若存在，则将NAS-PDU发送给UE，并向AMF通过N2接口返回请求响应确认消息N2 Request Ack。
本实施例中，通过先将会话资源储存在缓存区域中，在安全激活成功后，再将会话资源发送给用户端，实现了先与用户端进行的安全激活，再向用户端分配会话资源，避免安全激活与下一次会话请求冲突的情况，提高用户端与核心网设备之间的会话建立成功率。
上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本专利的保护范围内；对算法中或者流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其算法和流程的核心设计都在该专利的保护范围内。
本申请的第三实施例涉及一种会话建立装置，具体结构如图5所示。
请求接收模块501，用于接收用户端的会话请求；
转发模块502，用于将会话请求发送给核心网设备；
响应接收模块503，用于接收核心网设备返回的请求响应消息；其中，请求响应消息中携带会话资源；
安全激活模块504，用于向用户端发起接入层的安全激活；
发送模块505，在确认安全激活成功后，将会话资源发送给用户端，供用户端基于会话资源建立会话。
进一步地，响应接收模块503还用于在响应接收模块503接收核心网设备返回的请求响应消息后，在安全激活模块504向用户端发起接入层的安全激活前，检测请求响应消息中是否携带有安全密钥。若响应接收模块503检测到请求响应消息中携带有安全密钥，则通知安全激活模块504发起安全激活，若响应接收模块503检测到请求响应消息中未携带有安全密钥，则通知发送模块505直接执行将会话资源发送给用户端。
进一步地，会话建立装置还有缓存模块506，用于存储从请求响应消息中提取出的会话资源。
进一步地，响应接收模块503还用于在检测到请求响应消息中携带有安全密钥时，在安 全激活模块504向用户端发起接入层的安全激活前，从请求响应消息中提取出会话资源，并将提取的会话资源储存在缓存模块506中，发送模块505还用于将缓存模块506中存储的会话资源发送给用户端。
进一步地，请求响应消息中携带安全密钥，响应接收模块503还用于从请求响应消息中提取出会话资源，并将提取的会话资源储存在缓存模块506中。
进一步地，安全激活模块504还用于基于安全密钥向用户端发送安全激活命令。
进一步地，会话请求携带用于标识会话请求的请求标识值，安全激活模块504还用于发送携带请求标识值的安全激活命令，供用户端确认安全激活命令为针对会话请求的命令。
进一步地，响应接收模块503还用于向核心网设备返回请求响应确认消息。
不难发现，本实施例为与上述方法实施例相对应的装置实施例，本实施例可与上述各实施例互相配合实施。上述各实施例中提到的相关技术细节在本实施例中依然有效，为了减少重复，这里不再赘述。相应地，本实施例中提到的相关技术细节也可应用在上述各实施例中。
值得一提的是，本实施例中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施例中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施例中不存在其它的单元。
本申请第四实施例涉及一种接入网设备，如图6所示，包括：至少一个处理器601；与至少一个处理器通信连接的存储器602；其中，存储器602存储有可被至少一个处理器601执行的指令，指令被至少一个处理器601执行上述的会话建立方法。
其中，存储器602和处理器601采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器601和存储器602的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器601处理的信息通过天线在无线介质上进行传输，进一步，天线还接收信息并将信息传送给处理器601。
处理器601负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器602可以被用于存储处理器在执行操作时所使用的信息。
本申请第五实施例涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施例是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (10)

  1. 一种会话建立方法，应用于接入网设备，包括：
    接收用户端的会话请求，将所述会话请求发送给核心网设备；
    接收所述核心网设备返回的请求响应消息；其中，所述请求响应消息中携带会话资源；
    向所述用户端发起接入层的安全激活；
    确认所述安全激活成功后，将所述会话资源发送给所述用户端，供所述用户端基于所述会话资源建立会话。
  2. 根据权利要求1所述的会话建立方法，其中，在所述接收所述核心网设备返回的请求响应消息后，在所述向所述用户端发起接入层的安全激活前，还包括：
    检测所述请求响应消息中是否携带有安全密钥；
    若所述请求响应消息中携带有所述安全密钥，则再执行所述向所述用户端发起接入层的安全激活；若所述请求响应消息中未携带有所述安全密钥，则直接执行所述将所述会话资源发送给所述用户端。
  3. 根据权利要求2所述的会话建立方法，其中，还包括：
    若所述请求响应消息中携带有所述安全密钥，则在向所述用户端发起接入层的安全激活前，从所述请求响应消息中提取出所述会话资源，并将提取的所述会话资源储存在缓存区域中；
    所述将所述会话资源发送给所述用户端，包括：
    将所述缓存区域中存储的所述会话资源发送给所述用户端。
  4. 根据权利要求1所述的会话建立方法，其中，所述请求响应消息中携带安全密钥；
    在向所述用户端发起接入层的安全激活前，还包括：
    从所述请求响应消息中提取出所述会话资源，并将提取的所述会话资源储存在缓存区域中；
    所述将所述会话资源发送给所述用户端，包括：
    将所述缓存区域中存储的所述会话资源发送给所述用户端。
  5. 根据权利要求2至4中任一项所述的会话建立方法，其中，所述向所述用户端发起接入层的安全激活，包括：
    基于所述安全密钥向所述用户端发送安全激活命令。
  6. 根据权利要求5所述的会话建立方法，其中，所述会话请求携带用于标识所述会话请求的请求标识值；
    所述安全激活命令中携带所述请求标识值，供所述用户端确认所述安全激活命令为针对所述会话请求的命令。
  7. 根据权利要求1至6中任一项所述的会话建立方法，其中，在所述将所述会话资源发送给所述用户端后，还包括：
    向所述核心网设备返回请求响应确认消息。
  8. 一种会话建立装置，包括：
    请求接收模块，用于接收用户端的会话请求；
    转发模块，用于将所述会话请求发送给核心网设备；
    响应接收模块，用于接收所述核心网设备返回的请求响应消息；其中，所述请求响应消息中携带会话资源；
    安全激活模块，用于向所述用户端发起接入层的安全激活；
    发送模块，在确认所述安全激活成功后，将所述会话资源发送给所述用户端，供所述用户端基于所述会话资源建立会话。
  9. 一种接入网设备，包括：
    至少一个处理器；
    与所述至少一个处理器通信连接的存储器；
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至7中任一所述的会话建立方法。
  10. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至7中任一所述的会话建立方法。
PCT/CN2021/119919 2020-09-30 2021-09-23 会话建立方法、装置、接入网设备及存储介质 WO2022068669A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US18/029,429 US20230370292A1 (en) 2020-09-30 2021-09-23 Session establishment method and apparatus, access network device and storage medium
EP21874330.0A EP4224748A4 (en) 2020-09-30 2021-09-23 SESSION ESTABLISHMENT METHOD AND APPARATUS, ACCESS NETWORK APPARATUS AND STORAGE MEDIUM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011062979.7 2020-09-30
CN202011062979.7A CN113572801B (zh) 2020-09-30 2020-09-30 会话建立方法、装置、接入网设备及存储介质

Publications (1)

Publication Number Publication Date
WO2022068669A1 true WO2022068669A1 (zh) 2022-04-07

Family

ID=78158756

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/119919 WO2022068669A1 (zh) 2020-09-30 2021-09-23 会话建立方法、装置、接入网设备及存储介质

Country Status (4)

Country Link
US (1) US20230370292A1 (zh)
EP (1) EP4224748A4 (zh)
CN (1) CN113572801B (zh)
WO (1) WO2022068669A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584387A (zh) * 2022-03-11 2022-06-03 深圳明心科技有限公司 一种5g上网行为管理方法、装置及5g网关

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110351722A (zh) * 2018-04-08 2019-10-18 华为技术有限公司 一种信息发送方法、密钥生成方法以及装置
CN110447252A (zh) * 2017-03-17 2019-11-12 瑞典爱立信有限公司 5g中用于开启和关闭ue和ran之间的up数据安全的安全解决方案
WO2020050138A1 (ja) * 2018-09-03 2020-03-12 日本電気株式会社 コアネットワーク装置、アクセスネットワーク装置、通信端末、通信システム、及び通信方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100088698A1 (en) * 2008-10-03 2010-04-08 Ravishankar Krishnamurthy Techniques for managing communication sessions
KR102246671B1 (ko) * 2016-11-11 2021-05-03 텔레호낙티에볼라게트 엘엠 에릭슨(피유비엘) 제5세대 코어 네트워크에 대한 비-3gpp 액세스를 위한 사용자 평면 모델
US10728952B2 (en) * 2017-01-09 2020-07-28 Huawei Technologies Co., Ltd. System and methods for session management
CN108400997A (zh) * 2017-02-06 2018-08-14 电信科学技术研究院 会话管理方法、终端、管理功能实体及接入网节点
WO2018201506A1 (zh) * 2017-05-05 2018-11-08 华为技术有限公司 一种通信方法及相关装置
CN109104448B (zh) * 2017-06-20 2021-10-01 华为技术有限公司 会话管理方法、及装置
US11129017B2 (en) * 2017-09-28 2021-09-21 Futurewei Technologies, Inc. System and method for security activation with session granularity

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110447252A (zh) * 2017-03-17 2019-11-12 瑞典爱立信有限公司 5g中用于开启和关闭ue和ran之间的up数据安全的安全解决方案
CN110351722A (zh) * 2018-04-08 2019-10-18 华为技术有限公司 一种信息发送方法、密钥生成方法以及装置
WO2020050138A1 (ja) * 2018-09-03 2020-03-12 日本電気株式会社 コアネットワーク装置、アクセスネットワーク装置、通信端末、通信システム、及び通信方法

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Correction of security aspects in Registration and Service Request procedures", 3GPP DRAFT; S2-183795-AS SECURITY SETUP, vol. SA WG2, 10 April 2018 (2018-04-10), Sanya, China, pages 1 - 15, XP051438096 *
HUAWEI, HISILICON: "TS 23.502: Update to PDU session establishment procedure and PDU session establishment authentication&authorization via the NEF", 3GPP DRAFT; S2-174436 - TS502 - PDU SESSION ESTABLISHMENT AUTHENTICATIONAUTHORIZATION VIA THE NEF, vol. SA WG2, 20 June 2017 (2017-06-20), San Jose Del Cabo, Mexico, pages 1 - 11, XP051309496 *
See also references of EP4224748A4 *

Also Published As

Publication number Publication date
CN113572801B (zh) 2022-08-12
EP4224748A4 (en) 2024-03-06
EP4224748A1 (en) 2023-08-09
CN113572801A (zh) 2021-10-29
US20230370292A1 (en) 2023-11-16

Similar Documents

Publication Publication Date Title
KR102164823B1 (ko) 통합 코어 망 서비스 이용방법과 이를 위한 통합 제어장치 및 그 시스템
WO2016155298A1 (zh) 一种中继ue接入控制方法及装置
US11405830B2 (en) Information transmission method and apparatus
JP2007060314A (ja) 移動局、無線アクセスネットワーク装置および移動交換局並びに通信サービスアクセス方法
CN114342439A (zh) 用于无线网络中的集成接入和回程(iab)节点的认证的方法和装置
US20130042316A1 (en) Method and apparatus for redirecting data traffic
KR20190103382A (ko) 라우팅 방법 및 장치
CN109936515B (zh) 接入配置方法、信息提供方法及装置
US20230254695A1 (en) Method and apparatus for network security
US11323931B2 (en) Communication method and apparatus for a terminal device moving from a first access node to a second access node
WO2022068669A1 (zh) 会话建立方法、装置、接入网设备及存储介质
US11653395B2 (en) Method for establishing a connection of a mobile terminal to a mobile radio communication network and radio access network component
EP3547787B1 (en) Methods, device and system for link re-establishment
KR102280286B1 (ko) 마스터 노드 및 마스터 노드의 동작 방법
WO2014047923A1 (zh) 接入网络的方法和装置
WO2011120466A2 (zh) 一种网络接入方法和装置
CN109587756B (zh) 用于网络接入的方法和设备
CA2980952A1 (en) Ip address allocation method in d2d communication and user equipment
CN113438646B (zh) 业务建立方法、装置、终端及网络侧设备
US20200053564A1 (en) Method for establishing a connection of a mobile terminal to a mobile radio communication network and communication network device
CN114208240B (zh) 数据传输方法、装置及系统
CN117715040B (zh) Dplc模组的配网通信方法及装置
WO2023246086A1 (zh) 一种基于物联网的无线接入、信息处理方法及网络系统
WO2024067641A1 (zh) 一种通信方法及装置、计算机可读存储介质和通信系统
CN106937385B (zh) 一种进入双传输模式请求无线资源的方法和装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021874330

Country of ref document: EP

Effective date: 20230502