WO2022155913A1 - 一种接入控制的方法、装置和系统 - Google Patents

一种接入控制的方法、装置和系统 Download PDF

Info

Publication number
WO2022155913A1
WO2022155913A1 PCT/CN2021/073371 CN2021073371W WO2022155913A1 WO 2022155913 A1 WO2022155913 A1 WO 2022155913A1 CN 2021073371 W CN2021073371 W CN 2021073371W WO 2022155913 A1 WO2022155913 A1 WO 2022155913A1
Authority
WO
WIPO (PCT)
Prior art keywords
session
access
network element
restricted
request
Prior art date
Application number
PCT/CN2021/073371
Other languages
English (en)
French (fr)
Inventor
丁辉
陆长奇
时书锋
周晓云
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2021/073371 priority Critical patent/WO2022155913A1/zh
Publication of WO2022155913A1 publication Critical patent/WO2022155913A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/06—Access restriction performed under specific conditions based on traffic conditions

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method, apparatus and system for access control.
  • access control methods can be used to prohibit some terminal devices from initiating access, such as prohibiting specific data networks, network slicing, or initiating specific applications, so as to limit network load and relieve network congestion.
  • the terminal device determines whether the access request can be initiated according to the restriction information broadcast by the network side and the access configuration information delivered by the core network.
  • the core network side cannot know whether the terminal device complies with the restriction, so that the access request initiated by the terminal device cannot be rejected when the terminal device violates the access restriction information.
  • the restricted access information configured by the operator network and/or the access type configuration information sent by the core network to the terminal device is updated, the updated information will only be executed when the terminal device re-initiates the access request. Increased time to respond to updates.
  • the present application provides an access control method, apparatus and system, which can prevent terminal equipment from accessing the network during restricted access.
  • a method for access control comprising: a first network element receiving restricted access information, where the restricted access information is used to indicate a service type of restricted access; the first network element according to the restriction
  • the access information and the access type configuration information determine whether to accept the access request of the first session, the access request of the first session includes the session parameters of the first session, and the access type configuration information is used to indicate the service type and session parameters. corresponding relationship.
  • the first network element is a core network element.
  • the first network element after receiving the access restriction information, the first network element obtains the session parameters for restricting access according to the access restriction information and the access type configuration information, so as to determine whether to accept the access restriction information of the first session.
  • An access request to prevent the access request of the first session from accessing the network during the restricted period.
  • the "session” described in this application may be a protocol data unit (protocol data unit, PDU) session, or may be other sessions, which are not limited in this application.
  • PDU protocol data unit
  • the access restriction information includes an operator-defined access type number corresponding to the service type with access restriction and/or a standard corresponding to the service type with access restriction Access type number.
  • the access type configuration information includes a data network name, a single network slice selection auxiliary information, a matching rule represented by at least one parameter in the application identifier, and the matching rule corresponding The access type number defined by the operator and/or the standard access type number corresponding to the matching rule.
  • the access request is a session establishment request
  • the first network element determines whether to receive the access request of the first session , including: the mobility management network element determines a restricted access request list according to the restricted access information and the access type configuration information, where the list includes the session parameters corresponding to the access requests that cannot be initiated; if the session parameters of the first session exist In the restricted service request list, the mobility management network element sends the establishment rejection of the first session to the terminal device; or if the session parameters of the first session do not exist in the restricted service request list, the mobility management network element sends the request to the terminal device.
  • the session management network element device serving the first session sends a context establishment request for the first session.
  • the mobility management network element of the core network can determine the access request list for restricted access according to the restricted access information and the access type configuration information, so as to determine whether to accept the access request of the first session, so as to avoid Access under the condition that the access request of the first session is restricted.
  • the restricted service request list further includes an application identifier
  • the context establishment request of the first session further includes the application identifier
  • the application identifier is used to generate the A gating policy corresponding to the application identifier is used to restrict the service flow corresponding to the application identifier from transmitting data on the first session.
  • the core network side generates a corresponding gating policy according to the application identifier to prevent the service flow corresponding to the application identifier from transmitting data on the current session.
  • the method further includes, the mobility management network element receiving updated access restriction information and/or updated access type configuration information; the mobility management network element Determine whether to release the first session according to the updated access restriction information and/or the updated access type configuration information.
  • the mobility management network element can determine whether to release the access type configuration information and/or the updated restricted access information according to the updated access type configuration information and/or the updated restricted access information. established sessions to reduce the time to respond to this update.
  • the mobility management network element determines an update list of restricted service requests according to the updated access type configuration information and/or the updated restricted access information; The mobility management network element judges whether the session parameters of the first session exist in the restricted service request update list; if the session parameters of the first session exist in the restricted service request update list, send the message to the session management network element Session release request; or if the session parameter of the first session does not exist in the restricted service request update list, and the restricted service request update list also includes the updated application identifier, the mobility management network element sends the first session management network element to the session management network element.
  • a context update request for a session where the context update request for the first session includes the updated application identifier.
  • the session release request includes information used to indicate a reason value for releasing the first session.
  • the access request is a policy association establishment request
  • the policy association establishment request includes access restriction information
  • the policy control network The element determines whether to accept the access request of the first session, including: the policy control network element determines the restricted service request list according to the restricted access information and the access type configuration information, and the restricted service request list includes the corresponding access requests that cannot be initiated.
  • the policy control network element determines whether the session parameter of the first session exists in the restricted service request list; if the session parameter of the first session exists in the restricted service request list, the policy control network element sends the A policy association establishment response, the policy association establishment response includes information used to indicate that the access request of the first session is rejected; or if the session parameter of the first session does not exist in the restricted service request list, and the restricted service request list is If the application identifier is also included, the policy control network element sends a policy association establishment response, and the policy association establishment response further includes the gating policy corresponding to the application identifier.
  • the policy control network element of the core network can determine the access request list of restricted access according to the restricted access information and the access type configuration information, so as to judge whether to accept the access request of the first session, and avoid the first session. Access when the access request for a session is restricted access. If the current network restricts access to some specific applications, the core network side generates a corresponding gating policy according to the application identifier, so as to prevent the service flow corresponding to the application identifier from transmitting data on the current session.
  • the information used for indicating rejection of the access request of the first session further includes information used to indicate a reason value for rejecting the access request of the first session.
  • the policy control network element receives updated access type configuration information and/or a policy association update request, where the policy association update request includes the updated restricted access information ; the policy control network element determines whether to release the first session based on the updated access type configuration information and/or the updated restricted access information.
  • the mobility management network element can determine whether to release the access type configuration information and/or the updated restricted access information according to the updated access type configuration information and/or the updated restricted access information. established sessions to reduce the time to respond to this update.
  • the policy control network element determines whether to release the first session, including the policy control network element according to the updated access type configuration information and/or the updated access restriction information , determine the restricted service request update list; the policy controls the network element to determine whether the session parameter of the first session exists in the restricted service request update list; if the session parameter of the first session exists in the restricted service request update list, then the policy The control network element sends a policy association update response, and the policy association update response includes information used to indicate the release of the first session; or if the session parameters of the first session do not exist in the restricted service request update list, and the restricted service request update If the updated application identifier is included in the list, the policy control network element sends a policy association update response, where the policy association update response includes the gating policy corresponding to the updated application identifier.
  • the information used to indicate the release of the first session includes information used to indicate a reason value for releasing the first session.
  • the session parameters of the first session include the first data network name and/or the first single network slice selection assistance information, which are used to establish the first data network name and /or the first session under the first single network slice selection auxiliary information.
  • the access type configuration information is configured on the first network element or acquired by the first network element.
  • an access control method including: a first network element receiving restricted access information, where the restricted access information is used to indicate a service type of restricted access; the first network element according to the restricted access information information and the access type configuration information to determine not to accept the access request of the first session, the access request of the first session includes the session parameters of the first session, and the access type configuration information is used to indicate the correspondence between the service type and the session parameters relation.
  • the first network element after the first network element receives the restricted access information, it can obtain the access request for restricted access according to the restricted access information and the access type configuration information, so as to determine that the session is not to be accepted. access request.
  • the access request is a session establishment request
  • the first network element determines not to receive the access request of the first session , including: the mobility management network element determines a restricted access request list according to the restricted access information and the access type configuration information, where the list includes session parameters corresponding to the access requests that cannot be initiated by the terminal device; if the session of the first session If the parameter exists in the restricted service request list, the mobility management network element sends the establishment rejection of the first session to the terminal device.
  • the access request is a policy association establishment request
  • the policy association establishment request includes access restriction information
  • the policy control network The element determines not to accept the access request of the first session, including: the policy control network element determines the restricted service request list according to the restricted access information and the access type configuration information, and the restricted service request list includes the corresponding access requests that cannot be initiated.
  • the policy control network element determines whether the session parameter of the first session exists in the restricted service request list; if the session parameter of the first session exists in the restricted service request list, the policy control network element sends the A policy association establishment response, where the policy association establishment response includes information for indicating rejection of the access request of the first session.
  • the process of judging not to accept the access request of the first session is the same as the execution process of the method of the above-mentioned first aspect, and will not be repeated here.
  • an access control method comprising: a first network element receiving restricted access information, where the restricted access information is used to indicate a service type of restricted access; the first network element according to the restricted access information information and the access type configuration information to determine to accept the access request of the first session, where the access request of the first session includes the session parameters of the first session, and the access type configuration information is used to indicate the correspondence between the service type and the session parameters .
  • the first network element after the first network element receives the restricted access information, it can obtain the access request for restricted access according to the restricted access information and the access type configuration information, so as to determine the access request of the session. input request.
  • the access request is a session establishment request
  • the first network element determines to receive the access request of the first session
  • It includes: the mobility management network element determines a restricted access request list according to the restricted access information and the access type configuration information, where the list includes session parameters corresponding to the access requests that cannot be initiated by the terminal device; if the session parameters of the first session If it does not exist in the restricted service request list, the mobility management network element sends the context establishment request of the first session to the session management network element device that provides the service for the first session.
  • the access request is a policy association establishment request
  • the policy association establishment request includes access restriction information
  • the policy control network The element determines to accept the access request of the first session, including: the policy control network element determines the restricted service request list according to the restricted access information and the access type configuration information, and the restricted service request list includes the corresponding access requests that cannot be initiated.
  • the policy control network element judges whether the session parameters of the first session exist in the restricted service request list; if the session parameters of the first session do not exist in the restricted service request list, and the restricted service If the request list further includes the application identifier, the policy control network element sends a policy association establishment response, and the policy association establishment response further includes the gating policy corresponding to the application identifier.
  • an embodiment of the present application provides a communication apparatus, and the apparatus may be a core network device or a chip used for the core network device.
  • the apparatus has the function of implementing the method in any of the above-mentioned aspects or any possible implementation manner of any of the aspects. This function can be realized by hardware, or can be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • a communication system comprising: a first network element and a second network element; the second network element is configured to send access restriction information, where the access restriction information is used to indicate a restricted access service type; the first network element is configured to receive the restricted access information, and judge whether to accept the access request of the first session according to the restricted access information and the access type configuration information, where the access request of the first session includes the first session A session parameter of a session, where the access type configuration information is used to indicate the correspondence between the service type and the session parameter.
  • the second network element is an access network device
  • the access request is a session establishment request
  • the mobility The property management network element is used to determine a restricted service request list according to the restricted access information and the access type configuration information, where the restricted service request list includes the session parameters corresponding to the access requests that cannot be initiated; determine the first session Whether the session parameter of the first session exists in the restricted service request list; if the session parameter of the first session exists in the restricted service request list, the mobility management network element sends the establishment rejection of the first session to the terminal device; If the session parameters of the session do not exist in the restricted service request list, the mobility management network element sends a context establishment request for the first session to the session management network element serving the first session.
  • the device further includes a policy control network element; the policy control network element is configured to receive a policy association establishment request, and the policy association establishment request carries an application identifier; used for A policy association establishment response is sent, where the policy association establishment response carries a gating policy, where the gating policy is used to restrict the service flow corresponding to the application identifier from transmitting data on the first session.
  • the policy control network element can determine whether there is an update according to the updated access type configuration information and/or the updated restricted access information
  • the application identifier of the application identifier is generated, so as to generate a gating policy corresponding to the application identifier, so as to reduce the time for responding to the update.
  • the policy control network element is further configured to receive a policy association update request, where the policy association update request carries an updated application identifier; and is used to send a policy association update response, so The policy association update response carries the updated gating policy.
  • the access request is a policy association establishment request
  • the policy association The establishment request includes the restricted access information
  • the policy control network element is used to determine the restricted service request list according to the restricted access information and the access type configuration information, and the restricted service request list includes the corresponding access requests that the terminal cannot initiate. determine whether the session parameter of the first session exists in the restricted service request list; if the session parameter of the first session exists in the restricted service request list, the policy control network element sends a policy association establishment response, The policy association establishment response includes information indicating that the access request of the first session is rejected.
  • an apparatus in a sixth aspect, includes a processor and a transceiver.
  • the processor is connected to the transceiver.
  • the processor is used to execute instructions, and the transceiver is used to communicate with other network elements under the control of the processor.
  • the processor executes the instructions, the execution causes the apparatus to perform any of the above aspects or a method in any possible implementation of any of the aspects.
  • the apparatus also includes a memory for storing the instructions.
  • a computer-readable medium stores a computer program (also referred to as code, or instruction), when it runs on a computer, causing the computer to execute any aspect or any of the above A method in any possible implementation of an aspect.
  • a computer program also referred to as code, or instruction
  • a communication chip in which instructions are stored that, when executed on a computer device, cause the communication chip to execute the method in any of the above-mentioned aspects or any possible implementation manner of any of the aspects.
  • a computer program product comprising instructions, the instructions, when run on a computer, cause the computer to perform the method in any of the above-mentioned aspects or any possible implementations of any of the aspects.
  • the access request of the terminal device can be prevented from accessing the network during the restricted access period.
  • FIG. 1 is a schematic diagram of a system architecture applying an embodiment of the present application
  • FIG. 2 is a schematic diagram of the architecture of a 5G system applying the present application
  • FIG. 3 is a schematic diagram of a service-oriented architecture applying a 5G system of the present application.
  • FIG. 5 is a schematic flowchart of a specific example of an access control method provided by the present application.
  • FIG. 6 is a schematic flowchart of a specific example of an access control method provided by the present application.
  • FIG. 7 is a schematic block diagram of applying the computer equipment provided by the present application.
  • FIG. 8 is a schematic block diagram of a communication apparatus provided according to the present application.
  • the current access control method is that the wireless access network broadcasts the access restriction information, and the restricted access information includes the access type of the restricted access.
  • the terminal device according to the access type configuration information sent by the core network side, The incoming request is mapped to the access type, and the access restriction information broadcast by the current wireless access network is monitored to determine whether the access request of the terminal device is restricted. If the access type corresponding to the access request is monitored in the broadcast information, the service request process is terminated.
  • the wireless access network only broadcasts the restricted access information to the terminal equipment in its serving cell, that is, the core network side cannot receive the restricted access information, so it cannot judge whether the terminal equipment complies with the restricted access information. information.
  • the embodiment of the present application provides an access control method, which is used by the core network to determine whether to accept an access request from a terminal device or not, so as to control the access of the terminal device and prevent the access request from being received during the restricted access period. into the network.
  • FIG. 1 is a schematic diagram of an access control system provided by the present application.
  • the system 100 includes a first network element 110 and a second network element 120 .
  • the first network element 110 may be a mobility management network element, a policy control network element, and the like
  • the second network element 120 may be a wireless access network device, a session management network element, and the like.
  • the system 100 may further include a terminal device 130 .
  • the system 100 may be used to perform an access control method according to this embodiment of the present application.
  • the second network element 120 is configured to: send restricted access information to the first network element 110, where the restricted access information is used to indicate a service type of restricted access.
  • the first network element 110 is configured to: receive the restricted access information sent by the second network element 120, and determine whether to accept the access request of the first session according to the restricted access information and the access type configuration information.
  • the access request includes the session parameters of the first session, and the access type configuration information is used to indicate the correspondence between the service type and the session parameters.
  • access request of the first session is only used to represent different session access requests, and different session access requests may be initiated by the same terminal device, or may be initiated by different terminal devices.
  • the first network element and the second network element are only for distinguishing different network elements, and do not limit the functions of the network elements themselves.
  • the first network element may also send restricted access information to the second network element, where the restricted access information is used to indicate a service type for which access is restricted.
  • the second network element may also receive the restricted access information sent by the first network element, and determine whether to accept the access request of the first session according to the restricted access information and the access type configuration information, where the access request of the first session includes The session parameter of the first session, and the access type configuration information is used to indicate the correspondence between the service type and the session parameter.
  • the first network element can know the service type of the current network restricted access according to the restricted access information provided by the first network element, and then the restricted access can be obtained according to the access type configuration information.
  • the service type corresponding to the access-restricted session parameter, so whether to accept the access request of the first session is determined by the session participation of the first session.
  • the system 100 shown in FIG. 1 can be applied to the fifth generation (5th generation, 5G) network architecture shown in FIG. 2 or FIG. 3, and of course can also be used in future network architectures, such as the sixth generation (6th generation, 6G)
  • the network architecture and the like are not specifically limited in this embodiment of the present application.
  • the above-mentioned mobility management network element may be an access and mobility management network element (access and mobility management function) in 5G. , AMF), the policy management network element can be the session management policy control network element (policy control function for session management, SM PCF) in 5G.
  • AMF access and mobility management network element
  • policy management network element can be the session management policy control network element (policy control function for session management, SM PCF) in 5G.
  • FIG. 2 shows a schematic diagram of the architecture of a basic 5G system 200 .
  • the system 200 includes: AMF, session management function (session management function, SMF), radio access network (radio access network, RAN), unified data management (unified data management, UDM), PCF, data network (data network, DN), user plane function (user plane function, UPF), UE, application function (application function, AF), and unified data repository (unified data repository, UDR).
  • FIG. 2 may further include the following functions (not shown in FIG. 2 ): network slice selection function (NSSF), authentication server function (authentication server function, AUSF), capability opening function (network slice selection function, NSSF) exposure function, NEF), network storage function (NF repository function, NRF).
  • NSF network slice selection function
  • authentication server function authentication server function
  • AUSF capability opening function
  • NEF network slice selection function
  • NRF network storage function
  • the terminal device in this embodiment of the present application may be a device for implementing a wireless communication function.
  • the terminal equipment may be a user equipment (UE), an access terminal, a terminal unit, a terminal station, a mobile station, a mobile station in a 5G network or a public land mobile network (PLMN) evolved in the future.
  • PLMN public land mobile network
  • the access terminal may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices or wearable devices, virtual reality (VR) end devices, augmented reality (AR) end devices, industrial control (industrial) wireless terminal in control), wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • Terminal equipment can be mobile or fixed.
  • RAN wireless access network, corresponding to different access networks in 5G, such as wired access and wireless base station access.
  • the RAN equipment in this application includes but is not limited to: next-generation base station (g nodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B in 5G (node B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center, etc.
  • next-generation base station g nodeB, gNB
  • evolved node B evolved node B
  • eNB radio network controller
  • RNC radio network controller
  • node B in 5G node B, NB
  • BSC base station controller
  • the application function network element mainly conveys the requirements of the application side to the network side, for example, quality of service (quality of service, QoS) requirements and the like.
  • the AF may be a third-party functional entity or an application service deployed by an operator, such as an IP Multimedia Subsystem (IP Multimedia Subsystem, IMS) voice call service.
  • IP Multimedia Subsystem IP Multimedia Subsystem
  • UDM It can be understood as the naming of unified data management network elements in the 5G architecture.
  • the unified data management network element mainly includes the following functions: unified data management, supporting authentication credential processing in 3GPP authentication and key agreement mechanism, user identity processing, access authorization, registration and mobility management, subscription management, short message management, etc.
  • UDR It can be understood as the naming of unified data storage network elements in the 5G architecture.
  • the unified data storage network element mainly includes the following functions: an access function for data such as subscription data, policy data, and application data.
  • PCF It can be understood as the naming of policy control function network elements in the 5G architecture. Among them, the policy control function network element is mainly responsible for policy control functions such as charging for sessions and service flow levels, quality of service (QoS) bandwidth guarantee, mobility management, and UE policy decision-making.
  • the PCFs connected to AMF and SMF are access and mobility control PCF (PCF for access and mobility control, AM PCF) and SM PCF respectively.
  • AM PCF and SM PCF may not be the same PCF entity.
  • SMF It can be understood as the naming of session management network elements in the 5G architecture. Among them, the session management network element mainly performs functions such as session management, execution of control policies issued by PCF, selection of UPF, and allocation of UE IP addresses.
  • the mobility management network element mainly includes the following functions: connection management, mobility management, registration management, access authentication and authorization, reachability management, security context management and other functions related to access and mobility.
  • UPF It can be understood as the naming of user plane functional network elements in the 5G architecture.
  • the user plane function network elements mainly include the following functions: data packet routing and transmission, packet detection, service consumption reporting, QoS processing, legal interception, uplink packet detection, downlink data packet storage and other user plane related functions.
  • DN Data network, used to identify the operator's network access point name.
  • the DN may also include authentication, authorization, and accounting (AAA) server functions, which are responsible for performing secondary authentication on the user.
  • AAA authentication, authorization, and accounting
  • the above network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • a platform eg, a cloud platform
  • the above network element or function may be implemented by one device, or may be implemented jointly by multiple devices, or may be a functional module in one device, which is not specifically limited in this embodiment of the present application.
  • N7 The interface between the PCF and the SMF, used for delivering PDU session granularity and business data flow granularity control policies.
  • N15 The interface between the PCF and the AMF, used for delivering UE policies and access control related policies.
  • N5 The interface between the AF and the PCF, used for application service request delivery and network event reporting.
  • N4 The interface between the SMF and the UPF, used to transmit information between the control plane and the user plane, including controlling the distribution of forwarding rules for the user plane, QoS control rules, traffic statistics rules, etc., and reporting of information on the user plane.
  • N11 The interface between the SMF and the AMF, used to transfer the PDU session tunnel information between the RAN and the UPF, the control message sent to the UE, the radio resource control information sent to the RAN, and the like.
  • N2 The interface between the AMF and the RAN, used to transmit radio bearer control information from the core network side to the RAN, etc.
  • N1 The interface between the AMF and the UE, irrespective of access, used to deliver QoS control rules to the UE, etc.
  • N8 The interface between the AMF and the UDM, used by the AMF to obtain the subscription data and authentication data related to access and mobility management from the UDM, and to register the UE's current mobility management related information to the UDM.
  • N10 an interface between the SMF and the UDM, for the SMF to obtain the session management-related subscription data from the UDM, and the SMF to register the UE's current session-related information with the UDM.
  • N35 an interface between UDM and UDR, used for UDM to obtain user subscription data information from UDR.
  • N36 an interface between the PCF and the UDR, used by the PCF to obtain policy-related subscription data and application data-related information from the UDR.
  • N3 The interface between the RAN and the UPF, used to transfer user plane data between the RAN and the UPF.
  • N6 The interface between UPF and DN connection, used for transferring user plane data between UPF and DN.
  • N9 The interface between UPF and UPF, such as the interface between the visited-policy control function (V-PCF) and the home-policy control function (H-PCF), or the interface between the visited-policy control function (V-PCF) and the home-policy control function (H-PCF).
  • V-PCF visited-policy control function
  • H-PCF home-policy control function
  • H-PCF home-policy control function
  • each network element such as PCF, AMF, etc.
  • the name of each network element included in FIG. 2 is only a name, and the name does not limit the function of the network element itself.
  • the above-mentioned network elements may also have other names, which are not specifically limited in this embodiment of the present application.
  • some or all of the above-mentioned network elements may use the terminology in 5G, or other names, etc., which will be uniformly described here, and will not be repeated below.
  • FIG. 2 is only exemplary descriptions. In practice, the 5G system may also include other network elements that interact with the network elements illustrated in the figure, which will not be repeated here.
  • each network element of the control plane function in FIG. 2 can also communicate through a service interface.
  • the service interface provided by AMF can be Namf
  • the service interface provided by SMF can be Nsmf
  • UDM The service interface provided externally can be Nudm
  • the service interface provided by AF can be Naf
  • the service interface provided by PCF can be Npcf and so on.
  • FIG. 2 above is a reference point-based architecture, which does not constitute a limitation to the embodiment of the present application.
  • Figure 3 shows a schematic diagram of the architecture based on the service interface. As shown in Fig. 3, the per-architecture includes: NSSF, AUSF, UDM, NEF, NRF, PCF, AF, AMF, SMF, UE, RAN, UPF, DN.
  • the service interface provided by NSSF can be Nnssf
  • the service interface provided by NEF can be Nnef
  • the service interface provided by NRF can be Nnrf
  • the service interface provided by AMF can be Namf
  • SMF The service interface provided can be Nsmf
  • the service interface provided by UDM can be Nudm
  • the service interface provided by AF can be Naf
  • the service interface provided by PCF can be Npcf
  • the service interface provided by AUSF can be Nausf
  • the service interface provided by CHF externally can be Nchf
  • the interface between the control plane function and the RAN and UPF is a non-service interface.
  • the UE is connected to the AMF through the N1 interface, the UE is connected to the RAN through the radio resource control (RRC) protocol; the RAN is connected to the AMF through the N2 interface, and the RAN is connected to the UPF through the N3 interface; the UPF is connected to the DN through the N6 interface, and at the same time , UPF is connected with SMF through N4 interface.
  • RRC radio resource control
  • the access control method provided by the present application will be described by taking the method provided by the present application applied to a 5G system as an example. It should be understood that the method can also be applied to other systems, and corresponding network elements should also be replaced with network elements with the same or similar functions in the system. It should also be noted that the signaling involved in the interaction between the network elements described in this document all adopts the corresponding signaling in the prior art or in the existing protocol. In practice, these signaling can also be replaced For other names, as long as the corresponding functions can be achieved.
  • the PDU session can also be replaced with other sessions. It can also be replaced with other terminal equipment, which is not limited in this application.
  • FIG. 4 shows a schematic flowchart of an access control method 400 provided by the present application. Combining the steps below, the access control method 400 is applied to the 5G network architecture shown in FIG. 2 and FIG. 3 .
  • the first network element receives the access restriction information.
  • the restricted access information is used to indicate the service type of restricted access.
  • the restricted access information includes the type of service for which access is restricted.
  • the access restriction information is sent to the first network element through the RAN.
  • the access restriction information is sent to the first network element through SMF.
  • the first network element determines whether to accept the access request of the first session according to the restricted access information and the access type configuration information.
  • the access request of the first session includes session parameters of the first session.
  • the access type configuration information is used to indicate the correspondence between service types and session parameters.
  • the first network element may be an AMF.
  • the first network element may be an SM PCF.
  • the first network element can know the service type of the current network restricted access according to the restricted access information provided by the first network element, and then the restricted access can be obtained according to the access type configuration information.
  • the service type corresponds to the session parameter of restricted access, so whether to accept the access request of the first session is judged by the session parameter of the first session.
  • the following takes the first network element as an AMF or an SM PCF as an example to describe the method in detail, wherein FIG. 5 shows the first network element is AMF, a detailed introduction of the access control method; FIG. 6 is a detailed introduction of the access control method when the first network element is an SM PCF.
  • FIG. 5 shows a schematic flowchart of a specific example method 500 of an access control method provided by the present application.
  • the AMF sends access type configuration information to the UE. Accordingly, the UE receives access type configuration information.
  • the access type configuration information includes a data network name (data network name, DNN), a single network slice selection assistance information (single network slice selection assistance information, S-NSSAI), an application identification (application identification, APP ID)
  • the matching rule represented by at least one parameter in and the operator-defined access type number ODAC Number corresponding to the matching rule and/or the standard access type number AC Number corresponding to the matching rule.
  • the access type configuration information may refer to the format of Table 1.
  • the matching rule is the information matched for various parameters (such as session parameters, etc.); ODAC Number is the access type number or number defined by the operator corresponding to the matching rule, and the range of the ODAC Number is 32 to 63; the standard The AC Number is the standard access type number or number corresponding to the matching rule; the priority represents the priority order for selecting the matching rule or AC Number, that is, if the matching rule and/or AC Number are the same, the matching rule and/or AC Number The lower the corresponding priority number, the higher the priority. For example, when the DNN is xrservice, its ODAC Number is 40 and the standard AC Number is 15.
  • access type configuration information may also be in other forms than tables, and other forms should also include the above information.
  • a possible implementation manner may be that the AMF performs an access type configuration information configuration process based on information such as user location and/or subscription data.
  • the access type configuration information also involves AM PCF participation in decision-making, for example, AM PCF is based on RAN operation and maintenance management (operation administration and maintenance, OAM) and/or network data analysis function (Network Data Analytics Function, NWDAF), etc.
  • AM PCF is based on RAN operation and maintenance management (operation administration and maintenance, OAM) and/or network data analysis function (Network Data Analytics Function, NWDAF), etc.
  • OAM operation administration and maintenance
  • NWDAF Network Data Analytics Function
  • the AM PCF is a policy control functional entity directly connected to the AMF, and the AM PCF is responsible for implementing the policy rule decision function of the access control policy and the UE policy.
  • the RAN broadcasts access restriction information to the UE.
  • the restricted access information is used to indicate a service type of restricted access.
  • the restricted access information includes the ODAC Number and/or the standard AC Number corresponding to the restricted access service type.
  • At least one of AMF, RAN, and RAN OAM triggers the RAN to broadcast the restriction information based on the current regional network load and/or local service logic, or the AMF based on input information such as quota status of a specific user group, user level, etc.
  • the RAN adds and/or cancels the ODAC Number and/or the standard AC Number corresponding to the specific access restricted service type in the restricted access information, and then broadcasts the restricted access information to the UE.
  • the UE determines whether a session access request can be initiated according to the restricted access information broadcast by the RAN and the access type configuration information sent by the AMF.
  • the RAN will also use the restricted access information. It is sent to the core network side to assist the core network side in deciding whether to receive the session access request initiated by the UE.
  • the RAN sends the restricted access information to the AMF.
  • the AMF receives the restricted access information sent by the RAN.
  • the RAN may send the restricted access information to the AMF in a node-level message in an incremental or full manner.
  • the UE sends a PDU session establishment request to the AMF.
  • the AMF receives the PDU session establishment request sent by the UE.
  • the PDU session establishment request carries the session parameters DNN and/or S-NSSAI of the PDU session, and is used to establish a PDU session under the DNN and/or S-NSSAI.
  • the PDU session establishment request is a non-access stratum (non-access stratum, NAS) message between the UE and the AMF, which is transparently transmitted to the AMF through the RAN.
  • NAS non-access stratum
  • the PDU session establishment request is an example of a specific expression form of the access request of the first session in the method 400 . That is, in other examples, the access request of the first session may also be in other specific forms.
  • the AMF determines whether to accept the PDU session establishment request.
  • the AMF determines whether to accept the PDU session establishment request according to the restricted access information and the access type configuration information.
  • the configuration information determines a restricted service request list, where the restricted service request list includes session parameters corresponding to access requests that cannot be initiated by the UE.
  • the AMF determines whether the DNN and/or S-NSSAI carried in the PDU session establishment request exists in the service acceptance request list, and if not in the service acceptance request list, triggers step S506.
  • the accepted service request list may be an AMF decision Allowed NSSAI list and/or a subscribed DNN list.
  • S506 is triggered; or the DNN requested by the UE is not included In the subscribed DNN, that is, the UE has not subscribed to access the target DNN, S506 is also triggered.
  • the AMF may also reject the session establishment request based on other information, which is not limited in this application.
  • step S507 is performed.
  • the AMF determines whether to accept the PDU session establishment request according to the restricted access information and the access type configuration information.
  • the session parameter DNN and/or S-NSSAI carried in the session establishment request determines the ODACNumber and/or standard ACNumber corresponding to the session parameter.
  • step S506 is triggered.
  • the AMF determines whether the DNN and/or S-NSSAI carried in the PDU session establishment request exists in the service request acceptance list, and if not in the service request acceptance list, triggers step S506.
  • step S507 is triggered.
  • the AMF may determine whether the application will be transmitted on the current DNN and/or S-NSSAI based on the user equipment routing policy (URSP, UE Route Selection Policy) currently configured for the UE. If the AMF determines based on the URSP that the application will not be transmitted on the current DNN and/or S-NSSAI, the application identifier may not be carried as the restricted access application list in the PDU session context establishment request sent to the SMF.
  • URSP user equipment routing policy
  • the AMF sends a PDU session establishment rejection to the UE. Accordingly, the UE receives the PDU session establishment rejection.
  • the PDU session establishment rejection means rejecting the access request of the PDU session.
  • the PDU session establishment rejection may include information for indicating a reason value for rejecting the PDU session establishment request.
  • the AMF sends a PDU session context establishment request to the SMF. Accordingly, the SMF receives the PDU session context establishment request.
  • the AMF sending the PDU session context establishment request to the SMF means accepting the access request of the PDU session.
  • the PDU session context establishment request includes the application identifier.
  • the AMF sends the access type configuration information shown in Table 1 to the UE, and the restricted access information sent by the RAN to the AMF includes Number 60, then the AMF can configure the access type and restricted access information according to the access type configuration information and restricted access information in Table 1.
  • Number 60 in, the list of restricted service requests is: S-NSSAI: 123; APP ID: AXM.
  • the AMF rejects the PDU session establishment request, that is, sends a PDU session establishment rejection to the UE.
  • the AMF sends the PDU session up and down establishment request and the application identifier AXM to the SMF.
  • the application identifier AXM is used by the SM PCF to generate a gating policy related to AXM. Policies are used to restrict AXM's traffic flow on this session.
  • the AMF sends the access type configuration information shown in Table 1 to the UE, and the PDU session establishment request initiated by the UE carries the session parameter DNN: xxservice, then the AMF knows the session according to the access type configuration information and the session parameter.
  • the ODAC Number corresponding to the parameter is 70, and the standard AC Number is 16.
  • the AMF knows that the PDU session establishment request is not restricted, and the AMF sends the PDU session context establishment request to the SMF.
  • the AMF knows that there is a restricted application identifier AXM, and the AMF carries the application identifier AXM when sending the PDU session context establishment request.
  • the AMF knows that the PDU session establishment request is restricted, and the AMF sends a PDU session establishment rejection to the UE.
  • this embodiment may further include steps S508 to S510.
  • the SMF sends a policy association establishment request to the SM PCF. Accordingly, the SM PCF receives the policy management establishment request.
  • the policy association establishment request includes the application identifier.
  • the SM PCF sends a policy association establishment response to the SMF.
  • the SMF receives the policy association establishment response sent by the SM PCF.
  • the policy association establishment response includes policy charging control rules.
  • the policy association establishment response further includes the gating policy corresponding to the application identifier.
  • the SMF sends a PDU session establishment response to the UE. Accordingly, the UE receives the PDU session establishment response.
  • the PDU session establishment response represents acceptance of the PDU session establishment request.
  • the SMF sends the gating policy to the UPF.
  • the SMF performs corresponding gating control according to the gating policy in the policy association establishment response, including sending the packet filter corresponding to the gating policy and the corresponding gating control state to the UPF, so that the UPF receives the packet filtering
  • the operation corresponding to the state of the gating strategy is performed.
  • the restricted access information configured by the operator's network and/or the access type configuration information sent by the core network side to the UE may be updated at any time, and the established PDU may be updated at any time.
  • the session may be restricted in access by the updated information, so the PDU session needs to be released immediately to quickly respond to the update request.
  • the AMF when the AMF receives the updated access restriction information sent by the RAN and/or when the access type configuration information sent by the AMF to the UE is updated, the AMF shall, according to the updated access restriction information and/or the updated access restriction information The access type configuration information, determine whether to release the PDU session.
  • the AMF determines the access restriction service request update list according to the updated access restriction information and/or the updated access type configuration information; Whether DNN and/or S-NSSAI exists in the restricted service request update list.
  • Manner 1 The AMF determines an update list of restricted access service requests according to the updated access restriction information and the original access type configuration information.
  • the AMF determines the update list of the access restriction service request according to the original access restriction information and the updated access type configuration information.
  • the AMF determines the access restriction service request update list according to the updated access restriction information and the updated access type configuration information.
  • the original access type configuration information and the original access restriction information refer to the access type configuration information and the access restriction information before the update occurs.
  • the AMF sends a PDU session release request to the SMF.
  • the SMF receives the PDU session release request sent by the AMF.
  • the SMF receives the PDU session release request, it triggers S512.
  • the PDU session release request includes information used to indicate a reason value for releasing the PDU session.
  • the SMF sends a PDU session release indication to the UE. Accordingly, the UE releases the PDU session.
  • the AMF sends a PDU session context update request to the SMF. Accordingly, the SMF receives the PDU session context update request.
  • the PDU session context update request further includes the updated application identifier.
  • the SMF sends a policy association update request to the SM PCF. Accordingly, the SM PCF receives the policy association update request sent by the SMF. Wherein, the policy association update request includes the updated application identifier.
  • the SM PCF sends a policy association update response to the SMF. Accordingly, the SMF receives the Policy Association Update Response sent by the SM PCF. Wherein, the policy association update response includes the gating policy corresponding to the updated application identifier.
  • the SMF sends a PDU session modification request to the UE.
  • the SMF sends the gating policy corresponding to the updated application identifier to the UPF. Specifically, the SMF performs corresponding gating control according to the updated gating policy in the policy association update response, including sending the packet filter corresponding to the updated gating policy and the corresponding gating control state to the UPF, so that the UPF is receiving When the packet corresponding to the packet filter arrives, the operation corresponding to the state of the gate control strategy is performed to discard or release.
  • the core network element AMF can determine the access request list for restricted access according to the restricted access information and the access type configuration information, so as to determine whether to accept the access request of the PDU session, so as to prevent the PDU session from being restricted Access the current network during access. If the current network restricts access to some specific applications, the core network side generates a corresponding gating policy according to the application identifier, so as to prevent the service flow corresponding to the application identifier from transmitting data on the current session. In addition, when the access type configuration information and/or the restricted access information are updated, the AMF can also judge whether to release the established PDU session according to the updated access type configuration information and/or the updated restricted access information, to reduce the time to respond to this update.
  • FIG. 6 shows a schematic flowchart of a specific example method 600 of an access control method provided by the present application.
  • the SM PCF is a policy control functional entity connected to the SMF, and the SM PCF is responsible for executing the session management policy rule decision function.
  • the AM PCF sends access type configuration information to the UE.
  • the UE receives the access type configuration information sent by the AM PCF.
  • the access type configuration information includes the matching rule represented by at least one of the parameters in DNN, S-NSSAI, and APP ID, and the matching rule corresponds to the ODAC Number and/or the standard AC Number.
  • the AM PCF executes the access type configuration information configuration rule, and sends the access type configuration information to the UE via the AMF.
  • the configuration rules in the access type configuration information can also be decided by the AMF, and then reported to the AM PCF.
  • the RAN broadcasts access restriction information to the UE.
  • the restricted access information is used to indicate a service type of restricted access.
  • the restricted access information includes the ODAC Number and/or the standard AC Number corresponding to the service type of restricted access.
  • the RAN sends the restricted access information to the AMF. Accordingly, the AMF receives the restricted access information.
  • the UE sends a PDU session establishment request to the AMF. Accordingly, the AMF receives the PDU session establishment request.
  • the PDU session establishment request carries the DNN and/or S-NSSAI corresponding to the session parameters of the PDU session.
  • the AMF sends a PDU session context establishment request to the SMF. Accordingly, the SMF receives the PDU session context establishment request.
  • the PDU session context establishment request includes access restriction information, and the DNN and/or S-NSSAI carried in the PDU session establishment request.
  • the SMF sends a policy association establishment request to the SM PCF.
  • the SM PCF receives the policy association establishment request sent by the SMF.
  • the policy association establishment request includes access restriction information and the DNN and/or S-NSSAI carried in the PDU session establishment request.
  • the AM PCF sends the access type configuration information to the SM PCF. Accordingly, the SM PCF receives the access type configuration information.
  • the SM PCF can subscribe the access type configuration information to the AM PCF, or, after receiving the policy association establishment request, the SM PCF requests the AM PCF for the access type configuration information; or, the AM PCF actively requests the SM PCF for the access type configuration information. Send access type configuration information.
  • the SM PCF sends a policy association establishment response to the SMF.
  • the SMF receives the policy association establishment response sent by the SM PCF.
  • the SM PCF may determine a restricted service request list according to the restricted access information and the access type configuration information, where the restricted service request list includes session parameters corresponding to service requests that cannot be initiated; determine the PDU session context Whether the DNN and/or S-NSSAI carried in the establishment request exists in the restricted service request list.
  • the DNN and/or the S-NSSAI exists in the restricted service request list, it indicates that the PDU session establishment request is rejected, and the policy association establishment response includes information for indicating rejection of the PDU session establishment request.
  • the SM PCF determines whether the DNN and/or S-NSSAI carried in the PDU session establishment request exist in the service acceptance request list, and if not in the service acceptance request list, it means that the PDU session establishment request is rejected, and the PDU session establishment request is rejected.
  • the Policy Association Establishment Response includes information indicating rejection of the PDU Session Establishment Request.
  • the SM PCF may also reject the session establishment request based on other information, which is not limited in this application.
  • the DNN and/or the S-NSSAI does not exist in the restricted service request list, it means that the PDU session establishment request is accepted. Further, it is judged whether there is an application identifier in the restricted service request list.
  • the policy association establishment response includes first indication information, which is used to indicate that the policy association corresponding to the PDU session is successfully established.
  • the first indication information may be a 201created status code to indicate that the policy context resource corresponding to the PDU session has been successfully created.
  • the SM PCF If there is an application identifier in the restricted service request list, the SM PCF generates a gating policy corresponding to the application identifier, and the policy association establishment response carries the first indication information and the gating policy.
  • the SMF sends a PDU session establishment response to the UE. Accordingly, the UE receives the PDU session establishment response.
  • the PDU session establishment response represents the rejection of the PDU session establishment, that is, the PDU session establishment rejection response; if the policy association establishment response received by the SMF includes the first If there is an indication message, the PDU session establishment response represents the acceptance of the PDU session establishment, that is, the PDU session establishment acceptance response.
  • the SMF also sends the gating policy to the UPF.
  • the UE If the UE receives the PDU session establishment acceptance response sent by the SMF, it means that the PDU session establishment is successful.
  • the restricted access information configured by the operator's network and/or the access type configuration information sent by the core network side to the UE may be updated at any time.
  • the PDU session may be limited by the updated information, so the PDU session needs to be released immediately to quickly respond to the update request.
  • the method further includes steps S610 to S614.
  • the AM PCF sends the updated access type configuration information to the SM PCF. Accordingly, the SM PCF receives the updated access type configuration information.
  • the SM PCF subscribes the updated access type configuration information to the AM PCF.
  • the AMF sends a PDU session context update request to the SMF. Accordingly, the SMF receives the PDU session context update request.
  • the PDU session context update request includes updated restricted access information.
  • the SMF sends a policy association update request to the SM PCF. Accordingly, the SM PCF receives the policy association update request.
  • the policy association update request includes the updated restricted access information.
  • the SM PCF sends a policy association update response to the sending SMF. Accordingly, the SMF receives the policy association update response.
  • the SM PCF determines whether to release the PDU session according to the updated access restriction information and/or the updated access type configuration information, and sends a policy association update response.
  • the SM PCF determines whether to release the PDU session. For example, it can be implemented in the following possible implementation manners: The SM PCF determines the restricted service request update according to the updated restricted access information and/or the updated access type configuration information. list, and determine whether the session parameters DNN and/or S-NSSAI of the PDU session exist in the restricted access service request update list.
  • the PDU session is released, and the policy association update response includes information for indicating release of the PDU session.
  • the information for instructing to release the PDU session further includes information for instructing a reason value for releasing the PDU session.
  • the policy association update response carries the gating policy.
  • Mode 1 The SM PCF determines an update list of restricted access service requests according to the updated access restriction information and the original access type configuration information.
  • Mode 2 The SM PCF determines an update list of restricted access service requests according to the original access restriction information and the updated access type configuration information.
  • the SM PCF determines an update list of restricted access service requests according to the updated access restriction information and the updated access type configuration information.
  • the SMF sends a PDU session modification request/release indication to the UE. Accordingly, the UE receives the PDU session modification request/release indication.
  • the SMF receives the policy association update response sent by the SMPCF and includes the information used to indicate the release of the PDU session, it sends the PDU session release indication to the UE; if the SMF receives the policy association update response sent by the SMPCF, it includes the updated application ID corresponding to the gating policy , the SMF sends a PDU session modification indication to the UE, and sends the gating policy to the UPF.
  • the core network element SMPCF can determine the access request list of restricted access according to the restricted access information and the access type configuration information, so as to determine whether to accept the access request of the PDU session, so as to avoid the PDU session being restricted in the Access the current network during access. If the current network restricts access to some specific applications, the core network side generates a corresponding gating policy according to the application identifier, so as to prevent the service flow corresponding to the application identifier from transmitting data on the current session. In addition, when the access type configuration information and/or the restricted access information are updated, the SM PCF can determine whether to release the established PDU session according to the updated access type configuration information and/or the updated restricted access information, to reduce the time to respond to this update.
  • FIG. 7 shows a schematic block diagram of a communication apparatus 700 to which an embodiment of the present application is applied.
  • Any network element involved in any of the foregoing methods 400 to 600 such as a mobility management network element, a policy control network element, etc., may be implemented by the communication device shown in FIG. 7 .
  • the communication apparatus 700 may be a physical device, may also be a component of the physical device (eg, an integrated circuit, a chip, etc.), or may be a functional module in the physical device.
  • the communication apparatus 700 includes: one or more processors 701 .
  • the processor 701 may store execution instructions for executing the methods of the embodiments of the present application.
  • the processor 701 may call an interface to implement the receiving and sending functions.
  • the interface may be a logical interface or a physical interface, which is not limited.
  • the interface may be a transceiver circuit, or an interface circuit.
  • Transceiver circuits or interface circuits for realizing receiving and transmitting functions may be separate or integrated.
  • the above-mentioned transceiver circuit or interface circuit can be used for code/data reading and writing, or the above-mentioned transceiver circuit or interface circuit can be used for signal transmission or transmission.
  • the interface can be implemented by a transceiver.
  • the communication device 700 may further include a transceiver 703 .
  • the transceiver 703 may be referred to as a transceiver unit, a transceiver, a transceiver circuit or a transceiver, etc., and is used to implement a transceiver function.
  • the communication device 700 may further include a memory 702 .
  • This embodiment of the present application does not specifically limit the specific deployment location of the memory 702, and the memory may be integrated in the processor, or may be independent of the processor.
  • the communication device 700 does not include a memory, it is only necessary that the communication device 700 has a processing function, and the memory can be deployed in other locations (for example, a cloud system).
  • the processor 701, the memory 702 and the transceiver 703 communicate with each other through an internal connection path to transmit control and/or data signals.
  • the communication device 700 may also include other devices, such as input devices, output devices, batteries, and the like.
  • the memory 702 may store execution instructions for executing the methods of the embodiments of the present application.
  • the processor 701 can execute the instructions stored in the memory 702 in combination with other hardware (eg, the transceiver 703 ) to complete the steps of the method shown below.
  • the specific working process and beneficial effects can be referred to the descriptions in the method embodiments below.
  • the methods disclosed in the embodiments of the present application may be applied to the processor 703 or implemented by the processor 703 .
  • the processor 703 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the method can be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (field programmable gate array, FPGA), or other possible solutions. Programming logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • Software modules can be located in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory or electrically erasable programmable memory, registers, etc. in the storage medium.
  • the storage medium is located in the memory, and the processor reads the instructions in the memory, and completes the steps of the above method in combination with its hardware.
  • memory 702 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be a read-only memory ROM, a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an electrically erasable programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory RAM, which acts as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • FIG. 8 shows a schematic block diagram of a communication apparatus 800 according to an embodiment of the present application.
  • the specific form of the communication apparatus 800 may be a general-purpose computer device or a chip in a general-purpose computer device, which is not limited in this embodiment of the present application.
  • the communication device 800 includes a transceiver unit 810 and a processing unit 820 .
  • the communication apparatus 800 may be any network element involved in this application, and may implement the functions that the network element can implement. It should be understood that the communication apparatus 800 may be a physical device, may also be a component of the physical device (eg, an integrated circuit, a chip, etc.), or may be a functional module in the physical device.
  • the communication apparatus 800 may be a physical device, may also be a component of the physical device (eg, an integrated circuit, a chip, etc.), or may be a functional module in the physical device.
  • the communication apparatus 800 may be used to implement the function of the first network element in this application.
  • the transceiver unit 810 is configured to receive restricted access information, where the restricted access information is used to indicate the service type of restricted access;
  • the processing unit 820 is configured to determine whether to accept or not according to the restricted access information and the access type configuration information
  • the access request of the first session where the access request of the first session includes the session parameters of the first session, and the access type configuration information is used to indicate the corresponding relationship between the service type and the session parameters.
  • the communication device 800 is a mobility management network element, and the access request is a session establishment request; the processing unit 820 is configured to determine a restricted service request list according to the restricted access information and the access type configuration information, and the restricted service request The list includes the session parameter corresponding to the access request; it is used to judge whether the session parameter of the first session exists in the restricted service request list; if the session parameter of the first session exists in the restricted service request list, the transceiver unit 810 is configured to send the establishment rejection of the first session to the terminal device; or if the session parameters of the first session do not exist in the restricted service request list, the transceiver unit 810 is configured to send the request to the first session.
  • a session management network element serving a session sends a context establishment request for the first session.
  • the communication device 800 is a policy control network element
  • the access request is a policy association establishment request
  • the policy association establishment request includes the restricted access information
  • the processing unit 820 is configured to configure according to the restricted access information and the access type. information, determine a restricted service request list, and the restricted service request list includes the session parameters corresponding to the access request; determine whether the session parameters of the first session exist in the restricted service request list; if the session parameters of the first session exist In the restricted service request list, the transceiver unit 810 is configured to send a policy association establishment response, where the policy association establishment response includes information used to indicate that the access request of the first session is rejected.
  • the communication device 800 may correspond to the AMF in the foregoing method embodiments, and the above-mentioned and other management operations and/or functions of the various modules in the communication device 800 are respectively for realizing the method shown in FIG. 5 .
  • the apparatus 800 may correspond to the SM PCF in the foregoing method embodiments, and the above-mentioned and other management operations and/or functions of the various modules in the communication apparatus 800 are respectively for realizing the method shown in FIG. 6 .
  • the corresponding steps of the SM PCF in 600 can also achieve the beneficial effects in the foregoing method embodiments, which are not repeated here for the sake of brevity.
  • the apparatus 800 may also be used to implement the functions of network elements such as PCF, SMF, and UE in the foregoing method embodiments, wherein the transceiver unit 810 may be used to implement operations related to reception and transmission, and the processing unit 820 may be used to For other operations other than receiving and sending, reference may be made to the descriptions in the foregoing method embodiments, which are not listed one by one here.
  • the communication apparatus 800 is presented in the form of functional modules.
  • a “module” herein may refer to an application-specific integrated circuit ASIC, a circuit, a processor and memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that may provide the functions described above.
  • the apparatus 800 may take the form shown in FIG. 8 .
  • the processing unit 820 may be implemented by the processor 701 shown in FIG. 7 .
  • the computer device shown in FIG. 7 includes the memory 702
  • the processing unit 820 may be implemented by the processor 701 and the memory 702 .
  • the transceiver unit 810 may be implemented by the transceiver 703 shown in FIG. 7 .
  • the transceiver 703 includes a receive function and a transmit function.
  • the processor is implemented by executing a computer program stored in the memory.
  • the function and/or implementation process of the transceiver unit 810 may also be implemented by pins or circuits.
  • the memory may be a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the computer device, as shown in FIG. 7 .
  • the memory 702 alternatively, may also be a storage unit deployed in other systems or devices that are not within the computer device.
  • computer readable media may include, but are not limited to: magnetic storage devices (eg, hard disks, floppy disks, or magnetic tapes, etc.), optical disks (eg, compact discs (CDs), digital versatile discs (DVDs) etc.), smart cards and flash memory devices (eg, erasable programmable read-only memory (EPROM), card, stick or key drives, etc.).
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • machine-readable medium may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.
  • the present application also provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a computer, implements the functions of any of the foregoing method embodiments.
  • the present application also provides a computer program product, which implements the functions of any of the above method embodiments when the computer program product is executed by a computer.
  • a computer may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • When implemented in software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks, SSD)) etc.
  • system and “network” are often used interchangeably herein.
  • the term “and/or” in this article is only an association relationship to describe the associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, A and B exist at the same time, and A and B exist independently B these three cases.
  • At least one of or “at least one of” herein mean all or any combination of the listed items, eg, "at least one of A, B, and C", It can be expressed that there are six cases of A alone, B alone, C alone, A and B at the same time, B and C at the same time, and A, B and C at the same time.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B according to A does not mean that B is only determined according to A, and B may also be determined according to A and/or other information.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种接入控制的方法、装置和系统，避免终端设备发起的接入请求在限制接入期间接入网络。具体地，第一网元接收限制接入信息，该限制接入信息被用于指示限制接入的业务类型；第一网元根据该限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，所述第一会话的接入请求包括所述第一会话的会话参数，所述接入类型配置信息用于指示业务类型与会话参数的对应关系。

Description

一种接入控制的方法、装置和系统 技术领域
本申请涉及通信技术领域，尤其涉及一种接入控制的方法、装置和系统。
背景技术
当前，网络侧在负载较大时，可以通过接入控制方法，禁止一些终端设备发起接入，如禁止特定数据网络、网络切片，或者发起特定应用，从而达到限制网络负载，缓解网络拥塞的目的。终端设备在发起接入请求前根据网络侧广播的限制信息及核心网下发的接入配置信息判断是否可以发起该接入请求。
但上述方法中，核心网侧无法得知终端设备是否遵循该限制，从而无法在终端设备违反上述限制接入信息时拒绝终端设备所发起的接入请求。此外，当运营商网络所配置的限制接入信息和/或核心网发送给终端设备的接入类型配置信息发生更新时，该更新后的信息仅当终端设备重新发起接入请求才会执行，延长了响应更新的时间。
发明内容
本申请提供一种接入控制的方法、装置和系统，能够避免终端设备在限制接入期间接入网络。
第一方面，提供了一种接入控制的方法，该方法包括：第一网元接收限制接入信息，该限制接入信息用于指示限制接入的业务类型；该第一网元根据限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，该第一会话的接入请求包括第一会话的会话参数，该接入类型配置信息用于指示业务类型与会话参数的对应关系。
可选地，该第一网元是核心网网元。
根据本申请提供的方法，第一网元接收到限制接入信息后，根据该限制接入信息和接入类型配置信息，得出限制接入的会话参数，从而判断是否接受该第一会话的接入请求，避免该第一会话的接入请求在限制期间接入网络。
可选地，本申请所描述的“会话”可以是协议数据单元(protocol data unit，PDU)会话，也可以是其他会话，本申请对此不作限定。
结合第一方面，在第一方面的某些实现方式中，该限制接入信息包括限制接入的业务类型对应的运营商定义的接入类型号码和/或限制接入的业务类型对应的标准接入类型号码。
结合第一方面，在第一方面的某些实现方式中，该接入类型配置信息包括数据网络名称、单个网络切片选择辅助信息、应用标识中至少一种参数表示的匹配规则及该匹配规则对应的运营商定义的接入类型号码和/或该匹配规则对应的标准接入类型号码。
结合第一方面，在第一方面的某些实现方式中，第一网元是移动性管理网元时，接入请求为会话建立请求，第一网元判断是否接收第一会话的接入请求，包括：该移动性管理 网元根据限制接入信息和接入类型配置信息确定限制接入请求列表，该列表包括无法发起的接入请求所对应的会话参数；若第一会话的会话参数存在于该限制业务请求列表中，则移动性管理网元向终端设备发送第一会话的建立拒绝；或若第一会话的会话参数不存在于该限制业务请求列表中，则移动性管理网元向为第一会话提供服务的会话管理网元设备发送第一会话的上下文建立请求。
该实现方式中，核心网的移动性管理网元可以根据限制接入信息和接入类型配置信息，确定限制接入的接入请求列表，从而判断是否接受该第一会话的接入请求，避免第一会话的接入请求被限制接入的情况下接入。
结合第一方面，在第一方面的某些实现方式中，若限制业务请求列表中还包括应用标识，则第一会话的上下文建立请求还包括该应用标识，该应用标识用于生成与所述应用标识相应的门控策略，所述门控策略用于限制所述应用标识对应的业务流在所述第一会话上传输数据。
通过该实现方式，若当前网络限制接入某些特定应用，核心网侧根据该应用标识生成对应的门控策略，以避免该应用标识所对应的业务流在当前会话上传输数据。
结合第一方面，在第一方面的某些实现方式中，该方法还包括，移动性管理网元接收更新的接入限制信息和/或更新的接入类型配置信息；该移动性管理网元根据更新的接入限制信息和/或更新的接入类型配置信息，判断是否释放所述第一会话。
通过该实施方式，当接入类型配置信息和/或限制接入信息发生更新时，移动性管理网元可以根据该更新的接入类型配置信息和/或更新的限制接入信息，判断是否释放已建立的会话，以减少响应该更新的时间。
结合第一方面，在第一方面的某些实现方式中，移动性管理网元根据所述更新的接入类型配置信息和/或所述更新的限制接入信息，确定限制业务请求更新列表；该移动性管理网元判断所述第一会话的会话参数是否存在于所述限制业务请求更新列表中；若第一会话的会话参数存在于限制业务请求更新列表中，则向会话管理网元发送会话释放请求；或若第一会话的会话参数不存在于限制业务请求更新列表中，且限制业务请求更新列表还包括更新的应用标识，则所移动性管理网元向会话管理网元发送第一会话的上下文更新请求，该第一会话的上下文更新请求包括更新的应用标识。
结合第一方面，在第一方面的某些实现方式中，该会话释放请求包括用于指示释放该第一会话的原因值的信息。
结合第一方面，在第一方面的某些实现方式中，第一网元是策略控制网元时，接入请求为策略关联建立请求，该策略关联建立请求包括限制接入信息，策略控制网元判断是否接受第一会话的接入请求，包括：策略控制网元根据该限制接入信息和接入类型配置信息，确定限制业务请求列表，限制业务请求列表包括无法发起的接入请求所对应的会话参数；策略控制网元判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；若第一会话的会话参数存在于该限制业务请求列表中，则策略控制网元发送策略关联建立响应，该策略关联建立响应包括用于指示拒绝第一会话的接入请求的信息；或若第一会话的会话参数不存在于该限制业务请求列表中，且该限制业务请求列表中还包括应用标识，则策略控制网元发送策略关联建立响应，该策略关联建立响应还包括该应用标识对应的门控策略。
该实现方式中，核心网的策略控制网元可以根据限制接入信息和接入类型配置信息， 确定限制接入的接入请求列表，从而判断是否接受该第一会话的接入请求，避免第一会话的接入请求被限制接入的情况下接入。若当前网络限制接入某些特定应用时，核心网侧根据该应用标识生成对应的门控策略，以避免该应用标识所对应的业务流在当前会话上传输数据。
结合第一方面，在第一方面的某些实现方式中，该用于指示拒绝第一会话的接入请求的信息还包括用于指示拒绝第一会话的接入请求的原因值的信息。
结合第一方面，在第一方面的某些实现方式中，策略控制网元接收更新的接入类型配置信息和/或策略关联更新请求，该策略关联更新请求包括所述更新的限制接入信息；该策略控制网元基于更新的接入类型配置信息和/或更新的限制接入信息，判断是否释放所述第一会话。
通过该实施方式，当接入类型配置信息和/或限制接入信息发生更新时，移动性管理网元可以根据该更新的接入类型配置信息和/或更新的限制接入信息，判断是否释放已建立的会话，以减少响应该更新的时间。
结合第一方面，在第一方面的某些实现方式中，策略控制网元判断是否释放第一会话，包括，策略控制网元根据更新的接入类型配置信息和/或更新的限制接入信息，确定限制业务请求更新列表；该策略控制网元判断第一会话的会话参数是否存在于该限制业务请求更新列表中；若第一会话的会话参数存在于该限制业务请求更新列表中，则策略控制网元发送策略关联更新响应，该策略关联更新响应包括用于指示释放第一会话的信息；或若第一会话的会话参数不存在于该限制业务请求更新列表中，且该限制业务请求更新列表中包括更新的应用标识，则策略控制网元发送策略关联更新响应，该策略关联更新响应包括所述更新的应用标识对应的门控策略。
结合第一方面，在第一方面的某些实现方式中，该用于指示释放第一会话的信息包括用于指示释放该第一会话的原因值的信息。
结合第一方面，在第一方面的某些实现方式中，第一会话的会话参数包括第一数据网络名称和/或第一单个网络切片选择辅助信息，用于建立该第一数据网络名称和/或该第一单个网络切片选择辅助信息下的第一会话。
结合第一方面，在第一方面的某些实现方式中，接入类型配置信息配置在第一网元上或由第一网元获取。
第二方面，提供了一种接入控制的方法，包括：第一网元接收限制接入信息，该限制接入信息用于指示限制接入的业务类型；该第一网元根据限制接入信息和接入类型配置信息判断不接受第一会话的接入请求，该第一会话的接入请求包括第一会话的会话参数，该接入类型配置信息用于指示业务类型与会话参数的对应关系。
根据本申请提供的方法，第一网元接收到限制接入信息后，根据该限制接入信息和接入类型配置信息，可以得出限制接入的接入请求，从而判断不接受该会话的接入请求。
结合第二方面，在第二方面的某些实现方式中，第一网元是移动性管理网元时，接入请求为会话建立请求，第一网元判断不接收第一会话的接入请求，包括：该移动性管理网元根据限制接入信息和接入类型配置信息确定限制接入请求列表，该列表包括终端设备无法发起的接入请求所对应的会话参数；若第一会话的会话参数存在于该限制业务请求列表 中，则移动性管理网元向终端设备发送第一会话的建立拒绝。
结合第二方面，在第二方面的某些实现方式中，第一网元是策略控制网元时，接入请求为策略关联建立请求，该策略关联建立请求包括限制接入信息，策略控制网元判断不接受第一会话的接入请求，包括：策略控制网元根据该限制接入信息和接入类型配置信息，确定限制业务请求列表，限制业务请求列表包括无法发起的接入请求所对应的会话参数；策略控制网元判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；若第一会话的会话参数存在于该限制业务请求列表中，则策略控制网元发送策略关联建立响应，所述策略关联建立响应包括用于指示拒绝所述第一会话的接入请求的信息。
应理解，第二方面的接入控制方法中判断不接受第一会话的接入请求过程与上述第一方面的方法执行过程相同，此处不再赘述。
第三方面，提供了一种接入控制的方法，包括：第一网元接收限制接入信息，该限制接入信息用于指示限制接入的业务类型；该第一网元根据限制接入信息和接入类型配置信息判断接受第一会话的接入请求，该第一会话的接入请求包括第一会话的会话参数，该接入类型配置信息用于指示业务类型与会话参数的对应关系。
根据本申请提供的方法，第一网元接收到限制接入信息后，根据该限制接入信息和接入类型配置信息，可以得出限制接入的接入请求，从而判断接受该会话的接入请求。
结合第三方面，在第三方面的某些实现方式中，第一网元是移动性管理网元时，接入请求为会话建立请求，第一网元判断接收第一会话的接入请求，包括：该移动性管理网元根据限制接入信息和接入类型配置信息确定限制接入请求列表，该列表包括终端设备无法发起的接入请求所对应的会话参数；若第一会话的会话参数不存在于该限制业务请求列表中，则移动性管理网元向为第一会话提供服务的会话管理网元设备发送第一会话的上下文建立请求。
结合第三方面，在第三方面的某些实现方式中，第一网元是策略控制网元时，接入请求为策略关联建立请求，该策略关联建立请求包括限制接入信息，策略控制网元判断接受第一会话的接入请求，包括：策略控制网元根据该限制接入信息和接入类型配置信息，确定限制业务请求列表，限制业务请求列表包括无法发起的接入请求所对应的会话参数；策略控制网元判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；若所述第一会话的会话参数不存在于该限制业务请求列表中，且该限制业务请求列表中还包括应用标识，则策略控制网元发送策略关联建立响应，所述策略关联建立响应还包括所述应用标识对应的门控策略。
应理解，第三方面的接入控制方法中判断接受第一会话的接入请求过程与上述第一方面的方法执行过程相同，此处不再赘述。
第四方面，本申请实施例提供了一种通信装置，该装置可以是核心网设备,还可以是用于核心网设备的芯片。该装置具有实现上述任一方面或任一方面中任意可能的实现方式中的方法的功能。该功能可以是通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第五方面，提供了一种通信系统，包括：第一网元，第二网元；该第二网元用于发送限制接入信息，所述限制接入信息用于指示限制接入的业务类型；该第一网元用于接收所述限制接入信息，根据该限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，该第一会话的接入请求包括第一会话的会话参数，该接入类型配置信息用于指示业务类型与会话参数的对应关系。
结合第五方面，在第五方面的某些实现方式中，该第一网元为移动性管理网元时，该第二网元为接入网设备，该接入请求为会话建立请求，移动性管理网元用于根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括无法发起的接入请求所对应的会话参数；判断第一会话的会话参数是否存在于该限制业务请求列表中；若第一会话的会话参数存在于该限制业务请求列表中，则移动性管理网元向终端设备发送第一会话的建立拒绝；或若第一会话的会话参数不存在于该限制业务请求列表中，则所述移动性管理网元向为所述第一会话提供服务的会话管理网元发送第一会话的上下文建立请求。
结合第五方面，在第五方面的某些实现方式中，该装置还包括策略控制网元；该策略控制网元用于接收策略关联建立请求，该策略关联建立请求中携带应用标识；用于发送策略关联建立响应，该策略关联建立响应中携带门控策略，所述门控策略用于限制所述应用标识对应的业务流在第一会话上传输数据。
通过该实施方式，当接入类型配置信息和/或限制接入信息发生更新时，策略控制网元可以根据该更新的接入类型配置信息和/或更新的限制接入信息，判断是否存在更新的应用标识，从而生成该应用标识对应的门控策略，以减少响应该更新的时间。
结合第五方面，在第五方面的某些实现方式中，策略控制网元还用于接收策略关联更新请求，该策略关联更新请求中携带更新的应用标识；用于发送策略关联更新响应，所述策略关联更新响应中携带更新的门控策略。
结合第五方面，在第五方面的某些实现方式中，该第一网元为策略控制网元时，该第二网元为会话管理网元，接入请求为策略关联建立请求，策略关联建立请求包括所述限制接入信息；该策略控制网元用于根据限制接入信息和接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括终端无法发起的接入请求所对应的会话参数；判断第一会话的会话参数是否存在于该限制业务请求列表中；若所述第一会话的会话参数存在于该限制业务请求列表中，则策略控制网元发送策略关联建立响应，该策略关联建立响应包括用于指示拒绝第一会话的接入请求的信息。
第六方面，提供了一种装置，该装置包括处理器和收发器。处理器与收发器连接。处理器用于执行指令，收发器用于在处理器的控制下与其他网元进行通信。该处理器执行指令时，该执行使得该装置执行上述任一方面或任一方面中任意可能的实现方式中的方法。该装置还包括存储器，该存储器用于存储指令。
第七方面，提供了一种计算机可读介质，该计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述任一方面或任一方面中任意可能的实现方式中的方法。
第八方面，提供了一种通信芯片，其中存储有指令，当其在计算机设备上运行时，使得所述通信芯片执行上述任一方面或任一方面中任意可能的实现方式中的方法。
第九方面，提供了一种包含指令的计算机程序产品，其指令在计算机上运行时，使得计算机执行上述任一方面或任一方面中任意可能的实现方式中的方法。
基于上述技术方案，可以避免终端设备的接入请求在被限制接入期间接入网络。
附图说明
图1是应用本申请实施例的一种系统架构的示意图；
图2是应用本申请的一个5G系统的架构示意图；
图3是应用本申请的一个5G系统的服务化架构示意图；
图4是本申请提供的一种接入控制方法的示意性流程图；
图5是本申请提供的一种接入控制方法的具体示例的示意性流程图；
图6是本申请提供的一种接入控制方法的具体示例的示意性流程图；
图7是应用本申请提供的计算机设备的示意性框图；
图8是根据本申请提供的通信装置的示意性框图。
具体实施方式
目前的接入控制方法是无线接入网广播限制接入信息，该限制接入信息包括限制接入的接入类型，终端设备根据核心网侧发送的接入类型配置信息，将其发起的接入请求映射为接入类型，并监听当前无线接入网广播的限制接入信息，确定终端设备的接入请求是否被限制。若在广播的信息中监听到接入请求对应的接入类型，则终止该业务请求流程。
然而，上述方法中无线接入网只会将限制接入信息广播于其服务小区中的终端设备，即核心网侧无法接收到该限制接入信息，从而无法判断终端设备是否遵循该限制接入信息。
本申请实施例提供了一种接入控制的方法，用于核心网判断是否接受终端设备的接入请求是否被限制，从而能够控制终端设备的接入，避免接入请求在限制接入期间接入网络。
下面将结合附图，对本申请中的技术方案进行描述。
图1是本申请提供的一个接入控制系统的示意图。如图1所示，该系统100包括第一网元110和第二网元120。例如该第一网元110可以是移动性管理网元、策略控制网元等，该第二网元120可以是无线接入网设备、会话管理网元等。可选地，该系统100还可以包括终端设备130。系统100可以用于执行本申请实施例的一个接入控制的方法。
所述第二网元120用于：向第一网元110发送限制接入信息，该限制接入信息用于指示限制接入的业务类型。
所述第一网元110用于：接收第二网元120发送的限制接入信息，根据该限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，该第一会话的接入请求包括该第一会话的会话参数，接入类型配置信息用于指示业务类型与会话参数的对应关系。
应理解，“第一会话的接入请求”仅用于表示不同的会话接入请求，不同的会话接入请求可以是同一终端设备发起的，也可以是不同的终端设备发起的。
还应理解，第一网元和第二网元仅是为了区分不同的网元，对网元本身的功能不构成限定。比如，第一网元也可以向第二网元发送限制接入信息，该限制接入信息用于指示限制接入的业务类型。第二网元也可以接收第一网元发送的限制接入信息，根据该限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，该第一会话的接入请求包括该第一会话的会话参数，接入类型配置信息用于指示业务类型与会话参数的对应关系。
示例性的，根据本申请提供的通信系统，第一网元可以根据第一网元提供的限制接入信息获知当前网络限制接入的业务类型，然后根据接入类型配置信息将该限制接入的业务类型对应为限制接入的会话参数，从而由第一会话的会话参出判断出是否接受第一会话的接入请求。
图1所示的系统100可以应用于图2或图3所示的第五代(5th generation，5G)网络架构中，当然也可以用在未来网络架构,比如第六代(6th generation，6G)网络架构等，本申请实施例对此不作具体限定。
示例性的，假设图1所示的通信系统应用于图2或图3所示5G网络时，上述移动性管理网元可以为5G中的接入和移动性管理网元(access and mobility management function，AMF)，策略管理网元可以为5G中的会话管理策略控制网元(policy control function for session management，SM PCF)。
下面将结合图2和图3，举例说明不同场景下的5G系统。应理解，本文中描述的5G系统仅是示例，不应对本申请构成任何限定。
图2示出了一个基本的5G系统200的架构示意图。如图2所示，系统200包括：AMF、会话管理功能(session management function，SMF)、无线接入网(radio access network，RAN)、统一数据管理(unified data management，UDM)、PCF、数据网络(data network，DN)、用户面功能(user plane function，UPF)、UE、应用功能(application function，AF)、和统一数据存储(unified data repository，UDR)。可选地，图2中还可以包括以下功能(图2中未示出)：网络切片选择功能(network slice selection function，NSSF)、认证服务器功能(authentication server function，AUSF)、能力开放功能(network exposure function，NEF)、网络存储功能(NF repository function，NRF)。
其中，各网元主要功能描述如下：
UE：可以理解为终端设备在5G架构中的命名。在具体实现中，本申请实施例中的终端设备，可以是用于实现无线通信功能的设备。其中，终端设备可以是5G网络或者未来演进的公共陆地移动网络(public land mobile network，PLMN)中的用户设备(user equipment，UE)、接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。接入终端可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备或可穿戴设备，虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业 控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。终端设备可以是移动的，也可以是固定的。
(R)AN：(无线)接入网，对应5G中的不同接入网，如有线接入、无线基站接入等多种方式。本申请中的RAN设备包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
AF：可以理解为应用功能网元在5G架构中的命名。其中，应用功能网元主要传递应用侧对网络侧的需求，例如，服务质量(quality of service，QoS)需求等。AF可以是第三方功能实体，也可以是运营商部署的应用服务，如IP多媒体子系统(IP Multimedia Subsystem，IMS)语音呼叫业务。
UDM：可以理解为统一数据管理网元在5G架构中的命名。其中，统一数据管理网元主要包括以下功能：统一数据管理，支持3GPP认证和密钥协商机制中的认证信任状处理，用户身份处理，接入授权，注册和移动性管理，签约管理，短消息管理等。
UDR：可以理解为统一数据存储网元在5G架构中的命名。其中，统一数据存储网元主要包括以下功能：签约数据、策略数据、应用数据等类型数据的存取功能。
PCF：可以理解为策略控制功能网元在5G架构中的命名。其中，策略控制功能网元主要负责针对会话、业务流级别进行计费、服务质量(quality of service，QoS)带宽保障及移动性管理、UE策略决策等策略控制功能。该系统中，AMF与SMF所连接的PCF分别是接入和移动控制PCF(PCF for access and mobility control，AM PCF)和SM PCF，在实际部署中AM PCF和SM PCF可能不是同一个PCF实体。
SMF：可以理解为会话管理网元在5G架构中的命名。其中，会话管理网元主要进行会话管理、PCF下发控制策略的执行、UPF的选择、UE IP地址分配等功能。
AMF：可以理解为移动性管理网元在5G架构中的命名。其中，移动性管理网元主要包括以下功能：连接管理、移动性管理、注册管理、接入认证和授权、可达性管理、安全上下文管理等接入和移动性相关的功能。
UPF：可以理解为用户面功能网元在5G架构中的命名。其中，用户面功能网元主要包括以下功能：数据包路由和传输、包检测、业务用量上报、QoS处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
DN：数据网络，用于标识运营商网络接入点名称。在本申请中，DN还可包括验证、授权和记账(authentication、authorization、accounting，AAA)服务器功能，负责对用户执行二次鉴权。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，上述网元或者功能可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内 的一个功能模块，本申请实施例对此不作具体限定。
其中，各接口功能描述如下：
N7：PCF与SMF之间的接口，用于下发PDU会话粒度以及业务数据流粒度控制策略。
N15：PCF与AMF之间的接口，用于下发UE策略及接入控制相关策略。
N5：AF与PCF之间的接口，用于应用业务请求下发以及网络事件上报。
N4：SMF与UPF之间的接口，用于控制面与用户面之间传递信息，包括控制面向用户面的转发规则、QoS控制规则、流量统计规则等的下发以及用户面的信息上报。
N11：SMF与AMF之间的接口，用于传递RAN和UPF之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给RAN的无线资源控制信息等。
N2：AMF与RAN之间的接口，用于传递核心网侧至RAN的无线承载控制信息等。
N1：AMF与UE之间的接口，接入无关，用于向UE传递QoS控制规则等。
N8：AMF与UDM间的接口，用于AMF向UDM获取接入与移动性管理相关签约数据与鉴权数据，以及AMF向UDM注册UE当前移动性管理相关信息等。
N10：SMF与UDM间的接口，用于SMF向UDM获取会话管理相关签约数据，以及SMF向UDM注册UE当前会话相关信息等。
N35：UDM与UDR间的接口，用于UDM从UDR中获取用户签约数据信息。
N36：PCF与UDR间的接口，用于PCF从UDR中获取策略相关签约数据以及应用数据相关信息。
N3：RAN与UPF间的接口，用于在RAN与UPF间传递用户面数据。
N6：UPF与DN连接间的接口，用于在UPF与DN间传递用户面数据。
N9：UPF与UPF间的接口，如拜访地策略控制功能(visited-policy control function，V-PCF)与归属地策略控制功能(home-policy control function，H-PCF)间的接口，或是与DN相连的UPF与RAN相连的UPF间的接口，用于在UPF间传递用户面数据。
需要说明的是，图2中包括的各个网元(比如PCF、AMF等)的命名仅是一个名字，名字对网元本身的功能不构成限定。在5G网络以及未来其它的网络中，上述各个网元也可以是其他的名字，本申请实施例对此不作具体限定。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能是其他命名，等等，在此进行统一说明，以下不再赘述。
本领域技术人员可以理解，图2中的网元只是示例性地描述，实践上5G系统还可以包括其他与图中示意的网元进行交互的网元，在此不予赘述。
还需要说明的是，图2中控制面功能的各个网元之间的通信是以非服务化接口为例进行描述，但是并不对本申请实施例的保护范围构成限定的。本领域技术人员可以理解，图2中控制面功能的各个网元也可以通过服务化接口进行通信，比如，AMF对外提供的服务化接口可以为Namf；SMF提供的服务化接口可以为Nsmf；UDM对外提供的服务化接口可以为Nudm，AF提供的服务化接口可以为Naf；PCF对外提供的服务化接口可以为Npcf等等。
上述图2中的网元是基于参考点的架构，并不对本申请实施例构成限定。图3给出了基于服务化接口的架构示意图。如图3所示，该按架构包括：NSSF、AUSF、UDM、NEF、 NRF、PCF、AF、AMF、SMF、UE、RAN、UPF、DN。在图3中，NSSF对外提供的服务化接口可以为Nnssf，NEF对外提供的服务化接口可以为Nnef，NRF对外提供的服务化接口可以为Nnrf，AMF对外提供的服务化接口可以为Namf；SMF提供的服务化接口可以为Nsmf；UDM对外提供的服务化接口可以为Nudm，AF提供的服务化接口可以为Naf；PCF对外提供的服务化接口可以为Npcf，AUSF对外提供的服务化接口可以为Nausf，CHF对外提供的服务化接口可以为Nchf；控制面功能与RAN和UPF间的接口是非服务化接口。UE通过N1接口与AMF连接，UE通过无线资源控制(radio resource control，RRC)协议与RAN连接；RAN通过N2接口与AMF连接，RAN通过N3接口与UPF连接；UPF通过N6接口与DN连接，同时，UPF通过N4接口与SMF连接。相关描述可以参考标准中的5G系统架构(5G system architecture)，为了简洁，这里对架构300的连接关系不作赘述。
图1系统中网元的具体工作过程和有益效果可以参见下文方法实施例中的描述。下面，以本申请提供的方法应用于5G系统为例，对本申请提供的接入控制方法进行说明。应理解，该方法还可以应用于其他系统，那么相应地网元也应替换为该系统中功能相同或类似的网元。还需要说明的是，本文中所描述的网元之间的交互所涉及的信令均采用的是现有技术中或者现有协议中相应地信令，在实践中，这些信令也可以替换为其他的名称，只要能实现相应地功能即可。下文以本申请中的“会话”为PDU会话为例，以本申请中的“终端设备”为UE为例，对各方法进行说明，实践中，PDU会话也可以被替换为其他的会话，UE也可以被替换成其他的终端设备，本申请对此不做限定。
图4示出了本申请提供的一种接入控制方法400的示意性流程图。以下结合各步骤，将该接入控制方法400应用于图2和图3所示的5G网络架构中。
S410，第一网元接收限制接入信息。
其中，限制接入信息用于指示限制接入的业务类型。该限制接入信息包括限制接入的业务类型。
可选地，该限制接入信息是通过RAN发送给第一网元的。
可选地，该限制接入信息是通过SMF发送给第一网元的。
S420，该第一网元根据限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求。
具体地，第一会话的接入请求包括所述第一会话的会话参数。接入类型配置信息用于指示业务类型与会话参数的对应关系。
可选地，第一网元可以为AMF。
可选地，第一网元可以为SM PCF。
示例性的，根据本申请提供的通信系统，第一网元可以根据第一网元提供的限制接入信息获知当前网络限制接入的业务类型，然后根据接入类型配置信息将该限制接入的业务类型对应为限制接入的会话参数，从而由第一会话的会话参数判断是否接受第一会话的接入请求。
为了便于理解本申请提供的接入控制方法400，以下，作为示例而非限定，以第一网元为AMF或SM PCF为例，对该方法进行详细说明，其中，图5是第一网元为AMF，该 接入控制方法的详细介绍；图6是第一网元为SM PCF，该接入控制方法的详细介绍。
图5示出了本申请提供的一种接入控制方法的具体示例方法500示意性流程图。
S501，AMF向UE发送接入类型配置信息。相应地，UE接收接入类型配置信息。
可选地，该接入类型配置信息包含数据网络名称(data network name，DNN)、单个网络切片选择辅助信息(single network slice selection assistance information,S-NSSAI)、应用标识(application identification，APP ID)中至少一个参数所表示的匹配规则及该匹配规则对应的运营商定义的接入类型号码ODAC Number和/或该匹配规则对应的标准接入类型号码AC Number。
例如，该接入类型配置信息可参考表1的格式。其中，匹配规则是为各类参数(如会话参数等)匹配的信息；ODAC Number为该匹配规则对应的运营商定义的接入类型号码或编号，该ODAC Number的范围是32～63；该标准AC Number为该匹配规则对应的标准接入类型号码或编号；优先级代表选择匹配规则或AC Number的优先级顺序，即若匹配规则和/或AC Number相同时，该匹配规则和/或AC Number对应的优先级数字越小，优先级越高。例如，当DNN为xrservice时，其ODAC Number为40，标准AC Number为15。
应理解，该接入类型配置信息还可以是除了表格以外的其他形式，其他形式也应包括上述信息。
表1
Figure PCTCN2021073371-appb-000001
可选地，在AMF向UE发送该接入类型配置信息的具体实现中，一种可能实现方式可以是，AMF基于用户位置和/或签约数据等信息，执行接入类型配置信息配置流程。可选地，该接入类型配置信息还涉及AM PCF参与决策，如AM PCF基于来自RAN操作维护管理(operation administration and maintenance，OAM)和/或网络数据分析功能(Network Data Analytics Function，NWDAF)等网元的当前区域负荷信息，执行策略决策得到更新后的接入类型配置信息，并经由AMF将该接入类型配置信息发送给UE。
应理解，AM PCF是与AMF直接相连的策略控制功能实体，AM PCF负责执行接入控制策略及UE策略的策略规则决策功能。
S502，RAN向UE广播限制接入信息。
可选地，该限制接入信息用于指示限制接入的业务类型。该限制接入信息中包含限制 接入的业务类型所对应的ODAC Number和/或标准AC Number。
可选地，AMF、RAN、RAN OAM中至少一个基于当前区域网络负荷和/或本地业务逻辑，或AMF基于特定用户群组配额状态、用户等级等输入信息，触发RAN广播该限制信息。
可选地，RAN在限制接入信息中新增和/或取消特定限制接入的业务类型对应的ODAC Number和/或标准AC Number，然后向UE广播该限制接入信息。
在现有接入控制方法中，UE根据RAN广播的限制接入信息和AMF发送的接入类型配置信息判断是否可以发起会话接入请求，而本申请中，RAN还会将该限制接入信息发送给核心网侧，辅助核心网侧决策是否接收UE发起的会话接入请求。
S503，RAN向AMF发送该限制接入信息。相应地，AMF接收RAN发送的该限制接入信息。
可选地，RAN可以以节点级消息通过增量或全量方式向AMF发送该限制接入信息。
S504，UE向AMF发送PDU会话建立请求。相应地，AMF接收UE发送的该PDU会话建立请求。
其中，该PDU会话建立请求携带该PDU会话的会话参数DNN和/或S-NSSAI，用于建立该DNN和/或S-NSSAI下的PDU会话。该PDU会话建立请求为UE和AMF之间的非接入层(non-access stratum，NAS)消息，通过RAN透传给AMF。
应理解的是，该PDU会话建立请求为方法400中第一会话的接入请求的具体表现形式的示例。即在其他示例中，该第一会话的接入请求也可以是其他的具体表现形式。
S505，AMF判断是否接受PDU会话建立请求。
在具体实现中，AMF根据该限制接入信息和接入类型配置信息，判断是否接受该PDU会话建立请求，比如可以通过如下可能的实现方式1实施：AMF基于限制接入信息中和接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括UE无法发起的接入请求所对应的会话参数。
在一种实现方式中，若该PDU会话建立请求携带的DNN和/或S-NSSAI存在于该限制业务请求列表中，则触发S506。
可选地，AMF判断该PDU会话建立请求携带的DNN和/或S-NSSAI是否存在于接受业务请求列表中，若不存在于接受业务请求列表中，则触发步骤S506。其中，接受业务请求列表可以是AMF决策Allowed NSSAI列表和/或签约subscribed DNN列表。例如，UE所请求的S-NSSAI未包含在AMF所决策的Allowed NSSAI中，即UE请求的S-NSSAI不被当前网络授权允许接入，则触发S506；或是UE所请求的DNN未被包含在签约subscribed DNN中，即UE并未签约接入目标DNN，则同样触发S506。
应理解，上述接受业务请求列表与限制业务请求列表互补，即PDU会话的建立请求携带的DNN和/或S-NSSAI存在于该两种列表中的一个列表中。
还应理解，AMF还可能基于其他信息拒绝该会话建立请求，本申请不做限定。
在另一种实现方式中，若该DNN和/或S-NSSAI不存在于限制业务请求列表中，则执行步骤S507。
在具体实现中，AMF根据该限制接入信息和接入类型配置信息，判断是否接受该PDU会话建立请求，比如还可以通过如下可能的实现方式2实施：AMF基于该接入类型配置信息和PDU会话建立请求携带的会话参数DNN和/或S-NSSAI，确定该会话参数所对应的ODACNumber和/或标准ACNumber。
若该会话参数所对应的Number存在于限制接入信息中的ODACNumber和/或标准Number中，则拒绝该PDU会话建立请求，触发步骤S506。
可选地，AMF判断该PDU会话建立请求携带的DNN和/或S-NSSAI是否存在于业务请求接受列表中，若不存在于该业务请求接受列表中，则触发步骤S506。
若该DNN和/或S-NSSAI不存在于限制接入信息中的ODACNumber和/或标准Number中，则触发步骤S507。
可选地，AMF在判断前，可基于当前为UE配置的用户设备路由选择策略(URSP，UE Route Selection Policy)判断该应用是否会在当前DNN和/或S-NSSAI上传输。若AMF基于URSP判断该应用不会在当前DNN和/或S-NSSAI上传输，则在发送至SMF的PDU会话上下文建立请求中可无需携带该应用标识作为限制接入应用列表。
S506，AMF向UE发送PDU会话建立拒绝。相应地，UE接收该PDU会话建立拒绝。其中，PDU会话建立拒绝即表示拒绝该PDU会话的接入请求。
可选地，该PDU会话建立拒绝可以包括用于指示拒绝该PDU会话建立请求的原因值的信息。
S507，AMF向SMF发送PDU会话上下文建立请求。相应地，SMF接收该PDU会话上下文建立请求。其中，AMF向SMF发送PDU会话上下文建立请求即代表接受该PDU会话的接入请求。
进一步地，若限制业务请求列表中包括应用标识，则该PDU会话上下文建立请求包括该应用标识。
下面将对上述两种可能的判断是否接受该PDU会话建立请求的具体实现进行举例说明。
对于实现方式1，举例如下。
例如，AMF向UE发送如表1所示的接入类型配置信息，RAN发送给AMF的限制接入信息中包含Number 60，则AMF可根据表1中的接入类型配置信息和限制接入信息中的Number 60，得出限制业务请求列表为：S-NSSAI:123；APP ID:AXM。
若该PDU会话建立请求携带的S-NSSAI为123时，则AMF拒绝该PDU会话建立请求，即向UE发送PDU会话建立拒绝。
若该PDU会话建立请求携带的S-NSSAI不是123时，则AMF向SMF发送PDU会话上下建立请求和应用标识AXM，该应用标识AXM用于SM PCF生成与AXM相关的门控策略，该门控策略用以限制AXM的业务流在该会话上传输。
对于实现方式2，举例如下。
例如，AMF向UE发送了如表1所示的接入类型配置信息，UE发起的PDU会话建立请求携带了会话参数DNN：xxservice，则AMF根据该接入类型配置信息和该会话参数可知该会话参数对应的ODAC Number为70，标准AC Number为16。
若RAN发送的限制接入信息中包含Number60，AMF可知，该PDU会话建立请求未 被限制，则AMF向SMF发送PDU会话上下文建立请求。此外，AMF根据接入类型配置信息和限制接入信息可知，存在限制的应用标识AXM，则在发送该PDU会话上下文建立请求时携带该应用标识AXM。
若RAN发送的限制接入信息中包含Number 70或16，AMF可知，该PDU会话建立请求被限制，则AMF向UE发送PDU会话建立拒绝。
作为一种可选的实现方式，该实施例还可以包括步骤S508到S510。
S508，SMF向SM PCF发送策略关联建立请求。相应地，SM PCF接收该策略管理建立请求。
可选地，若SMF接收的PDU会话上下文建立请求包括应用标识，则该策略关联建立请求中包括该应用标识。
S509，SM PCF向SMF发送策略关联建立响应。相应地，SMF接收SM PCF发送的策略关联建立响应。其中，策略关联建立响应包括策略计费控制规则。
可选地，若策略关联建立请求中包括应用标识，则该策略关联建立响应还包括该应用标识所对应的门控策略。
S510，SMF向UE发送PDU会话建立响应。相应地，UE接收该PDU会话建立响应。该PDU会话建立响应代表接受该PDU会话建立请求。
可选地，若SMF接收的策略关联建立响应中包括应用标识对应的门控策略，SMF向UPF发送该门控策略。具体地，SMF根据策略关联建立响应中的门控策略执行相应门控控制，包括发送该门控策略所对应的包过滤器及对应的门控控制状态至UPF，以使得UPF在收到包过滤器所对应的报文时执行所述门控策略状态所对应的操作进行丢弃或放行。
若执行S510，则说明该PDU会话建立成功。
作为一种可选的实现方式，当PDU会话建立成功后，运营商网络配置的限制接入信息和/或核心网侧发送给UE的接入类型配置信息可能随时发生更新，该建立好的PDU会话可能被更新的信息限制接入，从而需要立即释放该PDU会话，以快速响应该更新要求。
具体来说，AMF接收到RAN发送的更新的接入限制信息时和/或AMF发送给UE的接入类型配置信息发生更新时，AMF根据所述更新的接入限制信息和/或所述更新的接入类型配置信息，判断是否释放该PDU会话。
在AMF判断是否释放该PDU会话的具体实现中，首先AMF根据更新的接入限制信息和/或更新的接入类型配置信息，确定限制接入业务请求更新列表；然后，AMF判断该PDU会话的DNN和/或S-NSSAI是否存在于该限制业务请求更新列表内。
在一种实现方式中，若该DNN和/或S-NSSAI存在于该限制业务请求更新列表中，则触发S511。
在另一种实现方式中，若该DNN和/或S-NSSAI不存在于该限制业务请求更新列表中，且所述限制业务请求更新列表中包括更新的应用标识，则触发S513。
其中，在确定限制接入业务请求更新列表的具体实现中，可以通过以下方式一到三实现，当然也不限于这些方式。
方式一：AMF根据更新的接入限制信息和原接入类型配置信息，确定限制接入业务 请求更新列表。
方式二：AMF根据原接入限制信息和更新的接入类型配置信息，确定限制接入业务请求更新列表。
方式三：AMF根据更新的接入限制信息和更新的接入类型配置信息，确定限制接入业务请求更新列表。
应理解，原接入类型配置信息和原接入限制信息指的是发生更新前的接入类型配置信息和接入限制信息。
S511，AMF向SMF发送PDU会话释放请求。相应地，SMF接收AMF发送的该PDU会话释放请求。SMF接收到该PDU会话释放请求时，触发S512。
可选地，该PDU会话释放请求包括用于指示释放PDU会话的原因值的信息。
S512，SMF向UE发送PDU会话释放指示。相应地，UE释放该PDU会话。
S513，AMF向SMF发送PDU会话上下文更新请求。相应地，SMF接收该PDU会话上下文更新请求。其中，该PDU会话上下文更新请求中还包括更新的应用标识。
S514，SMF向SM PCF发送策略关联更新请求。相应地，SM PCF接收SMF发送的策略关联更新请求。其中，该策略关联更新请求中包括更新的应用标识。
S514，SM PCF向SMF发送策略关联更新响应。相应地，SMF接收SM PCF发送的策略关联更新响应。其中，该策略关联更新响应中包括更新的应用标识对应的门控策略。
S515，SMF向UE发送PDU会话修改请求。
进一步地，SMF向UPF发送该更新的应用标识对应的门控策略。具体地，SMF根据策略关联更新响应中更新的门控策略执行相应门控控制，包括发送该更新的门控策略所对应的包过滤器及对应的门控控制状态至UPF，以使得UPF在收到包过滤器所对应的报文时执行所述门控策略状态所对应的操作进行丢弃或放行。
通过方法500，核心网网元AMF可以根据限制接入信息和接入类型配置信息，确定限制接入的接入请求列表，从而判断是否接受PDU会话的接入请求，避免该PDU会话在被限制接入期间接入当前网络。若当前网络限制接入某些特定应用，核心网侧根据该应用标识生成对应的门控策略，以避免该应用标识所对应的业务流在当前会话上传输数据。此外，当接入类型配置信息和/或限制接入信息发生更新时，AMF还可以根据该更新的接入类型配置信息和/或更新的限制接入信息，判断是否释放已建立的PDU会话，以减少响应该更新的时间。
图6示出了本申请提供的一种接入控制方法的具体示例方法600的示意性流程图。
应理解，SM PCF是与SMF相连的策略控制功能实体，SM PCF负责执行会话管理策略规则决策功能。
需要说明的是，下面提到的某些步骤与上述方法500相同，此处对于相关细节不再赘述，具体过程可参考方法500相关步骤。
S601，AM PCF向UE发送接入类型配置信息。相应地，UE接收AM PCF发送的该接入类型配置信息。
可选地，接入类型配置信息包含DNN、S-NSSAI、APP ID中至少一中参数所表示的 匹配规则及该匹配规则对应ODAC Number和/或标准AC Number。
可选地，AM PCF执行该接入类型配置信息配置规则，并经由AMF将该接入类型配置信息发送至UE。
可选地，该接入类型配置信息中的配置规则也可由AMF完成决策，然后上报至AM PCF。
S602，RAN向UE广播限制接入信息。
可选地，该限制接入信息用于指示限制接入的业务类型。该限制接入信息中包含限制接入的业务类型所对应的ODAC Number和/或标准AC Number。
S603，RAN向AMF发送该限制接入信息。相应地，AMF接收该限制接入信息。
S604，UE向AMF发送PDU会话建立请求。相应地，AMF接收该PDU会话建立请求。
可选地，PDU会话建立请求携带该PDU会话的会话参数对应的DNN和/或S-NSSAI。
S605，AMF向SMF发送PDU会话上下文建立请求。相应地，SMF接收该PDU会话上下文建立请求。
可选地，PDU会话上下文建立请求包括限制接入信息，及PDU会话建立请求所携带的DNN和/或S-NSSAI。
S606，SMF向SM PCF发送策略关联建立请求。相应地，SM PCF接收SMF发送的策略关联建立请求。
可选地，该策略关联建立请求包括限制接入信息及PDU会话建立请求所携带的DNN和/或S-NSSAI。
S607，AM PCF向SM PCF发送接入类型配置信息。相应地，SM PCF接收该接入类型配置信息。
在具体实现中，SM PCF可以向AM PCF订阅该接入类型配置信息，或者，SM PCF在收到策略关联建立请求后，向AM PCF请求接入类型配置信息；或者，AM PCF主动向SM PCF发送接入类型配置信息。
S608，SM PCF向SMF发送策略关联建立响应。相应地，SMF接收SM PCF发送的策略关联建立响应。
具体实现中，SM PCF可以根据该限制接入信息和该接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括无法发起的业务请求所对应的会话参数；判断所述PDU会话上下文建立请求所携带的DNN和/或S-NSSAI是否存在于该限制业务请求列表内。
若该DNN和/或S-NSSAI存在于限制业务请求列表中，则表示拒绝该PDU会话建立请求，该策略关联建立响应包括用于指示拒绝PDU会话建立请求的信息。
可选地，SM PCF判断该PDU会话建立请求携带的DNN和/或S-NSSAI是否存在于接受业务请求列表中，若不存在于接受业务请求列表中，则表示拒绝该PDU会话建立请求，该策略关联建立响应包括用于指示拒绝PDU会话建立请求的信息。
应理解，SM PCF还可能基于其他信息拒绝该会话建立请求，本申请不做限定。
又若该DNN和/或S-NSSAI不存在于该限制业务请求列表中，则表示接受该PDU会话建立请求。进一步地，判断该限制业务请求列表中是否有应用标识。
若该限制业务请求列表中无应用标识，则该策略关联建立响应包括第一指示信息，用于指示PDU会话所对应的策略关联建立成功。例如，该第一指示信息可以是201created状态码，用以指示该PDU会话所对应的策略上下文资源已创建成功。
若该限制业务请求列表中有应用标识，则SM PCF生成该应用标识相应的门控策略，该策略关联建立响应携带该第一指示信息和该门控策略。
S609，SMF向UE发送PDU会话建立响应。相应地，UE接收该PDU会话建立响应。
若SMF接收的策略关联建立响应包括用于指示拒绝PDU会话建立请求的信息，则该PDU会话建立响应代表拒绝该PDU会话建立，即PDU会话建立拒绝响应；若SMF接收的策略关联建立响应包括第一指示信息，则该PDU会话建立响应代表该接受PDU会话建立，即PDU会话建立接受响应。
进一步地，若SMF接收的策略关联建立响应包括门控策略，SMF还要向UPF发送该门控策略。
若UE接收到SMF发送的PDU会话建立接受响应，即代表该PDU会话建立成功。
作为一种可选的实现方式，当PDU会话建立成功后，运营商网络配置的限制接入信息和/或核心网侧发送给UE的接入类型配置信息可能会随时发生更新，该建立好的PDU会话可能被更新的信息限制，从而需要立即释放该PDU会话，以快速响应该更新要求。以下是当限制接入信息和/或接入类型配置信息发生更新时，该方法还包括步骤S610到S614。
S610，AM PCF向SM PCF发送的更新的接入类型配置信息。相应地，SM PCF接收该更新的接入类型配置信息。
可选地，SM PCF向AM PCF订阅更新的接入类型配置信息。
S611，AMF向SMF发送PDU会话上下文更新请求。相应地，SMF接收该PDU会话上下文更新请求。
可选地，该PDU会话上下文更新请求包括更新的限制接入信息。
S612，SMF向SM PCF发送策略关联更新请求。相应地，SM PCF接收该该策略关联更新请求。其中，该策略关联更新请求包括更新的限制接入信息。
S613，SM PCF向发送SMF发送策略关联更新响应。相应地，SMF接收该策略关联更新响应。
具体地，SM PCF根据所述更新的接入限制信息和/或所述更新的接入类型配置信息，判断是否释放该PDU会话，并发送策略关联更新响应。
具体实现方式中，SM PCF判断是否释放该PDU会话，比如可以通过如下可能的实现方式进行实施：SM PCF根据更新的限制接入信息和/或更新的接入类型配置信息，确定限制业务请求更新列表，判断该PDU会话的会话参数DNN和/或S-NSSAI是否存在于该限制接入业务请求更新列表内。
在一种实现方式中，若该DNN和/或S-NSSAI存在于该限制业务请求更新列表中，则释放该PDU会话，策略关联更新响应包括用于指示释放该PDU会话的信息。可选地，该用于指示释放该PDU会话的信息还包括用于指示释放该PDU会话的原因值的信息。
在另一种实现方式中，若DNN和/或S-NSSAI不存在于该限制业务请求更新列表中， 且该限制业务请求更新列表中有更新的应用标识，则生成该更新的应用标识相应的门控策略，该策略关联更新响应携带该门控策略。
在确定限制接入业务请求更新列表的具体实现中，可以通过以下方式一到三实现，当然也不限于这些方式。
方式一：SM PCF根据更新的接入限制信息和原接入类型配置信息，确定限制接入业务请求更新列表。
方式二：SM PCF根据原接入限制信息和更新的接入类型配置信息，确定限制接入业务请求更新列表。
方式三：SM PCF根据更新的接入限制信息和更新的接入类型配置信息，确定限制接入业务请求更新列表。
S614，SMF向UE发送PDU会话修改请求/释放指示。相应地，UE接收该PDU会话修改请求/释放指示。
若SMF接收SMPCF发送的策略关联更新响应包括用于指示释放该PDU会话的信息，则向UE发送PDU会话释放指示；若SMF接收SMPCF发送的策略关联更新响应包括更新的应用标识相应的门控策略，则SMF向UE发送PDU会话修改指示，并向UPF发送该门控策略。
通过方法600，核心网网元SMPCF可以根据限制接入信息和接入类型配置信息，确定限制接入的接入请求列表，从而判断是否接受PDU会话的接入请求，避免该PDU会话在被限制接入期间接入当前网络。若当前网络限制接入某些特定应用，核心网侧根据该应用标识生成对应的门控策略，以避免该应用标识所对应的业务流在当前会话上传输数据。此外，当接入类型配置信息和/或限制接入信息发生更新时，SM PCF可以根据该更新的接入类型配置信息和/或更新的限制接入信息，判断是否释放已建立的PDU会话，以减少响应该更新的时间。
图7示出了应用本申请实施例的通信装置700的示意性框图。上述方法400至方法600中任一方法所涉及的任一网元，如移动性管理网元、策略控制网元等都可以由图7所示的通信装置来实现。
应理解，通信装置700可以是实体设备，也可以是实体设备的部件(例如，集成电路，芯片等等)，还可以是实体设备中的功能模块。
如图7所示，该通信装置700包括：一个或多个处理器701。处理器701可以存储用于执行本申请实施例的方法的执行指令。可选地，处理器701中可以调用接口实现接收和发送功能。所述接口可以是逻辑接口或物理接口，对此不作限定。例如，接口可以是收发电路，或是接口电路。用于实现接收和发送功能的收发电路、或接口电路可以是分开的，也可以集成在一起。上述收发电路或接口电路可以用于代码/数据的读写，或者，上述收发电路或接口电路可以用于信号的传输或传递。
可选地，接口可以通过收发器实现。可选地，该通信装置700还可以包括收发器703。所述收发器703可以称为收发单元、收发机、收发电路或者收发器等，用于实现收发功能。
可选地，该通信装置700还可以包括存储器702。本申请实施例对存储器702的具体部署位置不作具体限定，该存储器可以集成于处理器中，也可以是独立于处理器之外。对 于该通信装置700不包括存储器的情形，该通信装置700具备处理功能即可，存储器可以部署在其他位置(如，云系统)。
处理器701、存储器702和收发器703之间通过内部连接通路互相通信，传递控制和/或数据信号。
可以理解的是，尽管并未示出，通信装置700还可以包括其他装置，例如输入装置、输出装置、电池等。
可选的，在一些实施例中，存储器702可以存储用于执行本申请实施例的方法的执行指令。处理器701可以执行存储器702中存储的指令结合其他硬件(例如收发器703)完成下文所示方法执行的步骤，具体工作过程和有益效果可以参见下文方法实施例中的描述。
本申请实施例揭示的方法可以应用于处理器703中，或者由处理器703实现。处理器703可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(random access memory，RAM)、闪存、只读存储器(read-only memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的指令，结合其硬件完成上述方法的步骤。
可以理解，存储器702可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器ROM、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器RAM，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
图8示出了根据本申请实施例的通信装置800的示意性框图。可选地，所述通信装置800的具体形态可以是通用计算机设备或通用计算机设备中的芯片，本申请实施例对此不作限定。如图8所示，该通信装置800包括收发单元810和处理单元820。
具体而言，通信装置800可以是本申请涉及的任一网元，并且可以实现该网元所能实 现的功能。应理解，通信装置800可以是实体设备，也可以是实体设备的部件(例如，集成电路，芯片等等)，还可以是实体设备中的功能模块。
在一种实现方式中，通信装置800可以用于实现本申请中的第一网元的功能。收发单元810，用于接收限制接入信息，所述限制接入信息用于指示限制接入的业务类型；处理单元820，用于根据所述限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，所述第一会话的接入请求包括所述第一会话的会话参数，所述接入类型配置信息用于指示业务类型与会话参数的对应关系。
示例性的，通信装置800为移动性管理网元，接入请求为会话建立请求；处理单元820，用于根据限制接入信息和接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括该接入请求所对应的会话参数；用于判断第一会话的会话参数是否存在于该限制业务请求列表中；若第一会话的会话参数存在于该限制业务请求列表中，则收发单元810用于向所述终端设备发送第一会话的建立拒绝；或若所述第一会话的会话参数不存在于所述限制业务请求列表中，则所述收发单元810用于向为所述第一会话提供服务的会话管理网元发送第一会话的上下文建立请求。
示例性的，通信装置800为策略控制网元，接入请求为策略关联建立请求，策略关联建立请求包括所述限制接入信息；处理单元820，用于根据限制接入信息和接入类型配置信息，确定限制业务请求列表，该限制业务请求列表包括该接入请求所对应的会话参数；判断第一会话的会话参数是否存在于该限制业务请求列表中；若该第一会话的会话参数存在于该限制业务请求列表中，则收发单元810用于发送策略关联建立响应，该策略关联建立响应包括用于指示拒绝所述第一会话的接入请求的信息。
应理解，在此实现方式中，通信装置800可对应于前述方法实施例中的AMF，并且通信装置800中的各个模块的上述和其它管理操作和/或功能分别为了实现图5所示的方法500中AMF的相应步骤，因此也可以实现前述方法实施例中的有益效果，为了简洁，这里不作赘述。
应理解，在此实现方式中，装置800可对应于前述方法实施例中的SM PCF，并且通信装置800中的各个模块的上述和其它管理操作和/或功能分别为了实现图6所示的方法600中SM PCF的相应步骤，因此也可以实现前述方法实施例中的有益效果，为了简洁，这里不作赘述。
还应理解，装置800还可以用于实现上述方法实施例中的PCF、SMF、UE等网元的功能，其中收发单元810可以用于实现与接收和发送相关的操作，处理单元820可以用于实现除接收和发送以外的其他操作，具体可以参见上述方法实施例中的描述，这里不再一一列出。
另外，在本申请中，通信装置800是以功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路ASIC、电路、执行一个或多个软件或固件程序的处理器和存储器、集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到装置800可以采用图8所示的形式。处理单元820可以通过图7所示的处理器701来实现。可选地，如果图7所示的计算机设备包括存储器702，处理单元820可以通过处理器701和存储器702来实现。收发单元810可以通过图7所示的收发器703来实现。所述收发器703包括接收功能和发送功能。具体的，处理器通过执行存储器中存 储的计算机程序来实现。可选地，当所述装置800是芯片时，那么收发单元810的功能和/或实现过程还可以通过管脚或电路等来实现。可选地，所述存储器可以为所述芯片内的存储单元，比如寄存器、缓存等，所述存储单元还可以是所述计算机设备内的位于所述芯片外部的存储单元，如图7所的存储器702，或者，也可以是部署在其他系统或设备中的存储单元，不在所述计算机设备内。本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于:磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
本申请还提供了一种计算机可读介质，其上存储有计算机程序，该计算机程序被计算机执行时实现上述任一方法实施例的功能。
本申请还提供了一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
应理解，说明书通篇中提到的“实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各个实施例未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
还应理解，在本申请中，“当…时”、“若”以及“如果”均指在某种客观情况下UE或者基站会做出相应的处理，并非是限定时间，且也不要求UE或基站实现时一定要有判断的动作，也不意味着存在其它限定。
另外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。
本文中术语“……中的至少一个”或“……中的至少一种”，表示所列出的各项的全部或任意组合，例如，“A、B和C中的至少一种”，可以表示：单独存在A，单独存在B，单独存在C，同时存在A和B，同时存在B和C，同时存在A、B和C这六种情况。
本申请中，若无特殊说明，“至少一个”指一个或多个，“多个”指两个或大于两个。
应理解，在本申请各实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟 悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (20)

  1. 一种接入控制的方法，其特征在于，所述方法包括：
    第一网元接收限制接入信息，所述限制接入信息用于指示限制接入的业务类型；
    所述第一网元根据所述限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，所述第一会话的接入请求包括所述第一会话的会话参数，所述接入类型配置信息用于指示业务类型与会话参数的对应关系。
  2. 如权利要求1所述的方法，其特征在于，所述限制接入信息包括所述限制接入的业务类型对应的运营商定义的接入类型号码和/或所述限制接入的业务类型对应的标准接入类型号码。
  3. 如权利要求1或2所述的方法，其特征在于，所述接入类型配置信息，包括：
    数据网络名称、单个网络切片选择辅助信息、应用标识中至少一种参数表示的匹配规则及所述匹配规则对应的运营商定义的接入类型号码和/或所述匹配规则对应的标准接入类型号码。
  4. 如权利要求1至3中任一项所述的方法，其特征在于，所述第一网元为移动性管理网元，所述接入请求为会话建立请求，所述第一网元判断是否接受所述第一会话的接入请求，包括：
    所述移动性管理网元根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括无法发起的接入请求所对应的会话参数；
    所述移动性管理网元判断所述第一会话的会话参数是否存在于所述限制业务请求列表中，
    若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述移动性管理网元向终端设备发送第一会话的建立拒绝；或
    若所述第一会话的会话参数不存在于所述限制业务请求列表中，则所述移动性管理网元向为所述第一会话提供服务的会话管理网元发送第一会话的上下文建立请求。
  5. 如权利要求4所述的方法，其特征在于，
    若所述限制业务请求列表中还包括应用标识，则所述第一会话的上下文建立请求还包括所述应用标识，所述应用标识用于生成与所述应用标识相应的门控策略，所述门控策略用于限制所述应用标识对应的业务流在所述第一会话上传输数据。
  6. 如权利要求4所述的方法，其特征在于，所述方法还包括，
    所述移动性管理网元接收更新的接入限制信息和/或更新的接入类型配置信息；
    所述移动性管理网元根据所述更新的接入限制信息和/或所述更新的接入类型配置信息，判断是否释放所述第一会话。
  7. 如权利要求6所述的方法，其特征在于，所述移动性管理网元判断是否释放所述第一会话，包括:
    所述移动性管理网元根据所述更新的接入类型配置信息和/或所述更新的限制接入信息，确定限制业务请求更新列表；
    所述移动性管理网元判断所述第一会话的会话参数是否存在于所述限制业务请求更 新列表中；
    若所述第一会话的会话参数存在于所述限制业务请求更新列表中，则向所述会话管理网元发送会话释放请求；或
    若所述第一会话的会话参数不存在于所述限制业务请求更新列表中，且所述限制业务请求更新列表还包括更新的应用标识，则所述移动性管理网元向会话管理网元发送第一会话的上下文更新请求，所述第一会话的上下文更新请求包括所述更新的应用标识。
  8. 如权利要求1至3中任一项所述的方法，其特征在于，所述第一网元为策略控制网元，所述接入请求为策略关联建立请求，所述策略关联建立请求包括所述限制接入信息，所述第一网元判断是否接受所述第一会话的接入请求，包括：
    所述策略控制网元根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括终端无法发起的接入请求所对应的会话参数；
    所述策略控制网元判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；
    若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述策略控制网元发送策略关联建立响应，所述策略关联建立响应包括用于指示拒绝所述第一会话的接入请求的信息。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    所述策略控制网元接收更新的接入类型配置信息和/或策略关联更新请求，所述策略关联更新请求包括所述更新的限制接入信息；
    所述策略控制网元基于所述更新的接入类型配置信息和/或所述更新的限制接入信息，判断是否释放所述第一会话。
  10. 如权利要求1-9中任一项所述的方法，其特征在于，所述第一会话的会话参数包括第一数据网络名称和/或第一单个网络切片选择辅助信息，用于建立所述第一数据网络名称和/或所述第一单个网络切片选择辅助信息下的所述第一会话。
  11. 如权利要求1-9中任一项所述的方法，其特征在于，所述接入类型配置信息配置在所述第一网元上或由所述第一网元获取。
  12. 一种通信装置，其特征在于，包括：
    收发单元，用于接收限制接入信息，所述限制接入信息用于指示限制接入的业务类型；
    处理单元，用于根据所述限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，所述第一会话的接入请求包括所述第一会话的会话参数，所述接入类型配置信息用于指示业务类型与会话参数的对应关系。
  13. 如权利要求12所述的装置，其特征在于，所述限制接入信息包括所述限制接入的业务类型对应的运营商定义的接入类型号码和/或所述限制接入的业务类型对应的标准接入类型号码。
  14. 如权利要求12或13所述的装置，其特征在于，所述接入类型配置信息，包括：
    数据网络名称、单个网络切片选择辅助信息、应用标识中至少一种参数表示的匹配规则及所述匹配规则对应的运营商定义的接入类型号码和/或所述匹配规则对应的标准接入类型号码。
  15. 如权利要求12至14中任一项所述的装置，其特征在于，所述装置为移动性管理 网元，所述接入请求为会话建立请求；
    所述处理单元，用于根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括所述终端设备无法发起的接入请求所对应的会话参数；用于判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述收发单元用于向所述终端设备发送第一会话的建立拒绝；或若所述第一会话的会话参数不存在于所述限制业务请求列表中，则所述收发单元用于向为所述第一会话提供服务的会话管理网元发送第一会话的上下文建立请求。
  16. 如权利要求12至14中任一项所述的装置，其特征在于，所述装置为策略控制网元，所述接入请求为策略关联建立请求，所述策略关联建立请求包括所述限制接入信息；
    所述处理单元，用于根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括终端无法发起的接入请求所对应的会话参数；判断所述第一会话的会话参数是否存在于所述限制业务请求列表中；若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述收发单元用于发送策略关联建立响应，所述策略关联建立响应包括用于指示拒绝所述第一会话的接入请求的信息。
  17. 一种通信系统，其特征在于，所述通信系统包括第一网元，第二网元；
    所述第二网元用于发送限制接入信息，所述限制接入信息用于指示限制接入的业务类型；
    所述第一网元用于接收所述限制接入信息，根据所述限制接入信息和接入类型配置信息判断是否接受第一会话的接入请求，所述第一会话的接入请求包括所述第一会话的会话参数，所述接入类型配置信息用于指示业务类型与会话参数的对应关系。
  18. 如权利要求17所述的系统，其特征在于，所述第一网元为移动性管理网元，所述第二网元为接入网设备，所述系统还包括会话管理网元，所述接入请求为会话建立请求，
    所述移动性管理网元用于根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括无法发起的接入请求所对应的会话参数；判断所述第一会话的会话参数是否存在于所述限制业务请求列表中，若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述移动性管理网元向所述终端设备发送第一会话的建立拒绝；或若所述第一会话的会话参数不存在于所述限制业务请求列表中，则所述移动性管理网元向为所述第一会话提供服务的所述会话管理网元发送第一会话的上下文建立请求；
    所述会话管理网元用于接收所述第一会话的上下文建立请求，并向所述策略控制网元发送策略关联建立请求。
  19. 如权利要求18所述的系统，其特征在于，还包括所述策略控制网元，
    所述策略控制网元用于接收策略关联建立请求，所述策略关联建立请求包括所述应用标识；发送包括策略计费控制规则的策略关联建立响应，所述策略计费控制规则包括所述应用标识相应的门控策略，所述门控策略用于限制所述应用标识对应的业务流在所述第一会话上传输数据。
  20. 如权利要求17所述的系统，其特征在于，所述第一网元为策略控制网元，所述第二网元为会话管理网元，所述接入请求为策略关联建立请求，所述策略关联建立请求包 括所述限制接入信息；
    所述策略控制网元用于根据所述限制接入信息和所述接入类型配置信息，确定限制业务请求列表，所述限制业务请求列表包括终端无法发起的接入请求所对应的会话参数，判断所述第一会话的会话参数是否存在于所述限制业务请求列表中，若所述第一会话的会话参数存在于所述限制业务请求列表中，则所述策略控制网元发送策略关联建立响应，所述策略关联建立响应包括用于指示拒绝所述第一会话的接入请求的信息。
PCT/CN2021/073371 2021-01-22 2021-01-22 一种接入控制的方法、装置和系统 WO2022155913A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/073371 WO2022155913A1 (zh) 2021-01-22 2021-01-22 一种接入控制的方法、装置和系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/073371 WO2022155913A1 (zh) 2021-01-22 2021-01-22 一种接入控制的方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2022155913A1 true WO2022155913A1 (zh) 2022-07-28

Family

ID=82548383

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/073371 WO2022155913A1 (zh) 2021-01-22 2021-01-22 一种接入控制的方法、装置和系统

Country Status (1)

Country Link
WO (1) WO2022155913A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115568036A (zh) * 2022-10-14 2023-01-03 荣耀终端有限公司 一种应用连接方法及电子设备
CN117134848A (zh) * 2023-01-20 2023-11-28 荣耀终端有限公司 通道建立方法、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1756405A (zh) * 2004-09-27 2006-04-05 华为技术有限公司 一种移动网过载控制的方法
CN101686461A (zh) * 2008-09-23 2010-03-31 华为技术有限公司 接入控制的方法、系统及网元
WO2017028288A1 (zh) * 2015-08-20 2017-02-23 华为技术有限公司 无线通信接入方法、通信装置、无线终端及系统
US20180124254A1 (en) * 2016-11-01 2018-05-03 At&T Intellectual Property I, L.P. Method and apparatus for adaptive charging and performance in a software defined network
CN108347746A (zh) * 2017-01-23 2018-07-31 中兴通讯股份有限公司 接入控制方法、接入网网元及用户设备
CN111556533A (zh) * 2020-05-15 2020-08-18 Oppo广东移动通信有限公司 一种小区驻留控制方法及相关设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1756405A (zh) * 2004-09-27 2006-04-05 华为技术有限公司 一种移动网过载控制的方法
CN101686461A (zh) * 2008-09-23 2010-03-31 华为技术有限公司 接入控制的方法、系统及网元
WO2017028288A1 (zh) * 2015-08-20 2017-02-23 华为技术有限公司 无线通信接入方法、通信装置、无线终端及系统
US20180124254A1 (en) * 2016-11-01 2018-05-03 At&T Intellectual Property I, L.P. Method and apparatus for adaptive charging and performance in a software defined network
CN108347746A (zh) * 2017-01-23 2018-07-31 中兴通讯股份有限公司 接入控制方法、接入网网元及用户设备
CN111556533A (zh) * 2020-05-15 2020-08-18 Oppo广东移动通信有限公司 一种小区驻留控制方法及相关设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115568036A (zh) * 2022-10-14 2023-01-03 荣耀终端有限公司 一种应用连接方法及电子设备
CN115568036B (zh) * 2022-10-14 2023-10-20 荣耀终端有限公司 一种应用连接方法、电子设备、芯片及存储介质
CN117134848A (zh) * 2023-01-20 2023-11-28 荣耀终端有限公司 通道建立方法、设备及存储介质

Similar Documents

Publication Publication Date Title
US11706606B2 (en) Network repository function (NRF) discovery control
KR102369596B1 (ko) Nas 메시지의 보안 보호를 위한 시스템 및 방법
AU2023201180B2 (en) Systems and method for secure updates of configuration parameters provisioned in user equipment
US12058139B2 (en) Method for implementing user plane security policy, apparatus, and system
CN107615732B (zh) 将会话接纳至虚拟网络中的方法和移动性管理功能实体
WO2020224622A1 (zh) 一种信息配置方法及装置
US20160100353A1 (en) Method of dynamic admission control applicable to prose server and user equipment and related apparatuses using the same
US11457359B2 (en) User data transported over non-access stratum
WO2014084760A1 (en) System for handling access by wireless devices in wi-fi network
KR20210055546A (ko) 무선 통신 시스템에서 mbs 서비스 제공에 대한 mbs 서비스 세션의 설정을 위한 장치 및 방법
US11102696B1 (en) Systems and methods for handover with dynamic quality of service (QoS) in a 5th generation (5G) network
WO2022021971A1 (zh) 通信方法、第一策略控制网元及通信系统
WO2022155913A1 (zh) 一种接入控制的方法、装置和系统
US20230379704A1 (en) Method for slice-specific authentication and authorization status transmission
US11388602B2 (en) Network slicing with a radio access network node
US8874079B2 (en) Control method for home base station access and home base station gateway
US20220256395A1 (en) Communication method, apparatus, and system
CN114982284B (zh) 通信方法及装置
CN113596909B (zh) 通信方法、装置及系统
WO2023007537A1 (ja) 通信制御装置、通信制御システムおよび通信制御方法
WO2022174411A1 (zh) 一种业务流的处理方法及装置
US20220353340A1 (en) Communication Method and Communication Apparatus
WO2023040728A1 (zh) 一种网元的选择方法、通信装置及通信系统
RU2783383C1 (ru) Системы и способ для безопасных обновлений параметров конфигурации, обеспеченных в оборудовании пользователя
WO2023011069A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21920311

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21920311

Country of ref document: EP

Kind code of ref document: A1