WO2022155915A1 - 网络互通的方法及装置 - Google Patents

网络互通的方法及装置 Download PDF

Info

Publication number
WO2022155915A1
WO2022155915A1 PCT/CN2021/073378 CN2021073378W WO2022155915A1 WO 2022155915 A1 WO2022155915 A1 WO 2022155915A1 CN 2021073378 W CN2021073378 W CN 2021073378W WO 2022155915 A1 WO2022155915 A1 WO 2022155915A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
network element
network
slice
access management
Prior art date
Application number
PCT/CN2021/073378
Other languages
English (en)
French (fr)
Inventor
强鹂
杨林平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21920313.0A priority Critical patent/EP4274310A4/en
Priority to PCT/CN2021/073378 priority patent/WO2022155915A1/zh
Priority to CN202180075753.7A priority patent/CN116391397A/zh
Publication of WO2022155915A1 publication Critical patent/WO2022155915A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/12—Mobility data transfer between location registers or mobility servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and apparatus for network interworking.
  • the present application provides a network interworking method and apparatus, which are used to enhance the first network's control of terminal equipment accessing the second network under the framework of the first network and the second network interworking.
  • a first aspect provides a method for network interworking, the method comprising: a first access management network element in a first network receiving identification information of a first slice sent by a terminal device, where the first slice is connected to a second network The first access management network element requests the second access management network element in the second network to access the second network according to the identification information of the first slice.
  • the first access management network element receives the identification information of the first slice sent by the terminal device. Since the first slice is a slice related to the service of the second network, the first access management network element can learn that the terminal device wants to access the second network according to the identification information of the first slice. Therefore, the first access management network element in the first network requests the second access management network element in the second network to access the second network. It can be seen that the first access management network element in the first network can learn that the terminal device wants to access the second network, and can also control the terminal device to access the second network.
  • the technical solution provided by the present application can enhance the first network's control of the terminal device accessing the second network.
  • the terminal device and the second network can directly exchange information, while the first network is only responsible for transparently transmitting the information exchanged between the terminal device and the second network, so the terminal device needs to communicate with the security gateway (for example, a non-3GPP interworking function (N3IWF) network element) establishes an internet protocol security (IPsec) tunnel to ensure communication security.
  • N3IWF non-3GPP interworking function
  • IPsec internet protocol security
  • the first access management network element acts as a proxy for the terminal device to request access to the second network, and the terminal device does not directly exchange information with the second network, so the terminal device does not need to establish a connection with the security gateway (eg N3IWF). IPsec tunneling, so the end device does not need to support the IPsec protocol stack, thereby reducing the manufacturing cost of the end device.
  • the method further includes: the first access management network element obtains the first identity information; the first access management network element sends the second identity information to the second access management network element, the first identity information Used to identify the terminal device in the first network, the first identity information is different from the second identity information. It should be understood that since the first identity information is used to identify the terminal device in the first network, the network elements in the second network may not be able to identify the first identity information. Therefore, the first access management network element communicates with the second access management network element using the second identity information by sending the second identity information to the second access management network element. Correspondingly, the second access management network element may regard the first access management network element using the second identity information as a common terminal device to perform access management.
  • the first identity information is an international mobile subscriber identity (IMSI), a subscriber permanent identifier (SUPI), a subscriber concealed identifier (SUCI) or A globally unique temporary user equipment (UE) identity (globally unique temporary UE identity, GUTI);
  • IMSI international mobile subscriber identity
  • SUPI subscriber permanent identifier
  • SUCI subscriber concealed identifier
  • UE identity globally unique temporary user equipment
  • GUTI globally unique temporary UE identity
  • the method further includes: establishing an association relationship between the first identity information and the second identity information by the first access management network element.
  • the first access management network element can achieve the purpose of proxying the terminal device to communicate with the second network. For example, based on the association relationship between the first identity information and the second identity information, the first access management network element receives information from a related network element (eg, the second access management network element) in the second network with the second After the message A related to the identity information, the message A can be parsed to obtain the content carried by the message A, and all or part of the content carried by the message A can be encapsulated as the message B and sent to the terminal device.
  • a related network element eg, the second access management network element
  • the first access management network element can parse the message C to Obtain the content carried by the message C, encapsulate all or part of the content carried by the message C into a message D, and use the second identity information to send the message D to a relevant network element in the second network (for example, a second access management network element) ).
  • the first slice is a slice in the first network
  • the first access management network element requests access to the second access management network element in the second network according to the identification information of the first slice.
  • the second network includes: the first access management network element requests the second access management network element in the second network to access the second slice of the second network according to the identification information of the first slice, the second slice and the first slice All slices are associated.
  • the first access management network element acts as a proxy for the terminal device to access the second slice, so that the terminal device can use the service provided by the second slice.
  • the identification information of the first slice is included in the first message, and the first message is used to request registration to the first network.
  • the first message includes the first requested (requested) network slice selection assistance information (network slice selection assistance information, NSSAI), and the first requested NSSAI includes the single network slice selection assistance information of the first slice ( single network slice selection assistance information, S-NSSAI).
  • NSSAI network slice selection assistance information
  • S-NSSAI single network slice selection assistance information
  • the first access management network element requests the second access management network element in the second network to access the second network according to the identification information of the first slice, including: the first access management The network element sends a second message to the second access management network element in the second network according to the identification information of the first slice, where the second message is used to request to register with the second network.
  • the method further includes: the first access management network element receives a third message sent by the second access management network element, where the third message is used to indicate that the registration is successful; In the third message, a fourth message is sent to the terminal device, where the fourth message is used to indicate that the terminal device is allowed to have the right to access the first slice.
  • the fourth message is used to allow the terminal device to have the right to access the first slice, including: the fourth message includes identification information of the first slice.
  • the fourth message is used to allow the terminal device to have the right to access the first slice, including: the fourth message includes the first allowed (allowed) NSSAI, and the first allowed NSSAI includes the first slice of S-NSSAI.
  • the method further includes: the first access management network element receives a fifth message sent by the second access management network element, where the fifth message is used to indicate that the service of the second network is not allowed; An access management network element sends a sixth message to the terminal device according to the fifth message, where the sixth message is used to indicate that the terminal device is not allowed to access the first slice.
  • the sixth message is used to indicate that the terminal device is not allowed to access the first slice, which may be implemented as: the sixth message includes identification information of the first slice.
  • the sixth message is used to indicate that the terminal device is not allowed to access the first slice, which may be implemented as: the sixth message includes a first rejected (rejected) NSSAI, and the first rejected NSSAI includes the S-NSSAI of the first slice.
  • the identification information of the first slice is included in the first message, and the first message is used to request the establishment of a first protocol data unit (protocol data unit, PDU) session associated with the first slice.
  • PDU protocol data unit
  • the first access management network element requests the second access management network element in the second network to access the second network according to the identification information of the first slice, including: the first access management network The element sends a second message to the second access management network element in the second network according to the identification information of the first slice, where the second message is used to request the establishment of a second PDU session related to the first slice.
  • the first message includes the identifier of the first PDU session
  • the second message includes the identifier of the second PDU session.
  • the method further includes: the first access management network element receives a seventh message sent by the second access management network element, where the seventh message is used to indicate that the second PDU session is successfully established; the first access management network element The management network element sends a ninth message to the terminal device according to the seventh message, where the ninth message is used to indicate that the first PDU session is successfully established.
  • the method further includes: the first access management network element obtains the IP address of the second PDU session from the second access management network element; A user plane network element sends the IP address of the second PDU session.
  • the first user plane network element can learn the IP address of the second PDU session, and then can implement data forwarding between the first PDU session and the second PDU session.
  • the method further includes: the first access management network element receives a tenth message sent by the second access management network element, where the tenth message is used to indicate that the establishment of the second PDU session fails; The incoming management network element sends an eleventh message to the terminal device according to the tenth message, where the eleventh message is used to indicate that the establishment of the first PDU session fails.
  • the method further includes: the first access management network element determines the permission to enable the terminal device to access the first slice; the first access management network element sends a twelfth message to the terminal device, the tenth The second message is used to indicate that the permission of the terminal device to access the first slice is enabled. Based on this design, the management and control of the authority of the terminal device to access the second network through the first network is indirectly realized.
  • the twelfth message is used to indicate the permission to open the first slice, including: the twelfth message includes identification information of the first slice.
  • the twelfth message is used to indicate the permission to enable the first slice, including: the twelfth message includes the second allowed NSSAI, and the second allowed NSSAI includes the S-NSSAI of the first slice.
  • the method further includes: the first access management network element determines to disable the authority of the terminal equipment to access the first slice; the first access management network element sends a thirteenth message to the terminal equipment, the tenth The three messages are used to instruct to close the authority of the terminal device to access the first slice. Based on this design, the management and control of the authority of the terminal device to access the second network through the first network is indirectly realized.
  • the thirteenth message is used to indicate closing the access authority of the first slice, including: the thirteenth message includes identification information of the first slice.
  • the thirteenth message is used to indicate that the access authority of the first slice is closed, including: the thirteenth message includes the second rejected NSSAI, and the second rejected NSSAI includes the NSSAI of the first slice.
  • the first network is a public network
  • the second network is a non-public network
  • the first network is a non-public network
  • the second network is a public network
  • a method for network interworking including: in the process of establishing a second PDU session for a terminal device by a second network, the N3IWF obtains routing rules, and the routing rules are used to forward data packets of the second PDU session; Routing rule to forward the data packets of the second PDU session.
  • the N3IWF can forward the data packets of the second PDU session by acquiring the routing rules of the second PDU session, thereby ensuring normal communication between the first network and the second network.
  • the routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the second PDU session to the second user plane network element serving the second PDU session.
  • the N3IWF forwards the data packets of the second PDU session according to the routing rule, including: the N3IWF receives the uplink of the second PDU session from the first user plane network element or the first access management network element of the first network. data packet; the N3IWF sends the uplink data packet of the second PDU session to the second user plane network element serving the second PDU session according to the routing rule.
  • the routing rule is further used to instruct to forward the downlink data packet whose destination address is the IP address of the second PDU session to the first access management network element or the first user plane network element in the first network.
  • the N3IWF forwards the data packets of the second PDU session according to the routing rule, including: the N3IWF receives the downlink data packets of the second PDU session from the second user plane network element serving the second PDU session;
  • the routing rule is to send the uplink data packet of the second PDU session to the first user plane network element or the first access management network element of the first network.
  • a communication apparatus configured to deploy in a first network, and the communication apparatus includes a communication module and a processing module; the communication module is configured to receive identification information of a first slice sent by a terminal device, and the first slice is a slice related to the service of the second network; the processing module is configured to control the communication module to request the second access management network element in the second network to access the second network according to the identification information of the first slice.
  • the processing module is further configured to acquire the first identity information; the communication module is further configured to send the second identity information to the second access management network element, and the first identity information is used in the first network Identify the terminal device, the first identity information is different from the second identity information.
  • the first identity information is IMSI, SUPI, SUCI or GUTI;
  • the second identity information is IMSI, SUPI, SUCI or GUTI.
  • the processing module is further configured to establish an association relationship between the first identity information and the second identity information.
  • the first slice is a slice in the first network; the processing module is specifically configured to control the communication module to access the management network element to the second network element in the second network according to the identification information of the first slice. Access to a second slice of the second network is requested, and the second slice is associated with the first slice.
  • the identification information of the first slice is included in the first message, and the first message is used to request registration to the first network.
  • the first message includes the first requested NSSAI
  • the first requested NSSAI includes the S-NSSAI of the first slice.
  • the processing module is specifically configured to control the communication module to send a second message to the second access management network element in the second network according to the identification information of the first slice, and the second message is used to request registration. to the second network.
  • the communication module is further configured to receive a third message sent by the second access management network element, where the third message is used to indicate that the registration is successful; according to the third message, send a fourth message to the terminal device, the third message is The four messages are used to indicate that the terminal device is allowed to have the right to access the first slice.
  • the fourth message is used to allow the terminal device to have the right to access the first slice, including: the fourth message includes identification information of the first slice.
  • the fourth message is used to allow the terminal device to have the right to access the first slice, including: the fourth message includes the first allowed NSSAI, and the first allowed NSSAI includes the S-NSSAI of the first slice.
  • the communication module is further configured to receive a fifth message sent by the second access management network element, where the fifth message is used to indicate that the service of the second network is not allowed; according to the fifth message, to the terminal The device sends a sixth message, where the sixth message is used to indicate that the terminal device is not allowed to access the first slice.
  • the sixth message is used to indicate that the terminal device is not allowed to access the first slice, which may be implemented as: the sixth message includes identification information of the first slice.
  • the sixth message is used to indicate that the terminal device is not allowed to access the first slice, which may be implemented as: the sixth message includes a first rejected (rejected) NSSAI, and the first rejected NSSAI includes the S-NSSAI of the first slice.
  • the identification information of the first slice is included in the first message, and the first message is used to request the establishment of a first PDU session associated with the first slice.
  • the processing module is specifically configured to control the communication module to send a second message to the second access management network element in the second network according to the identification information of the first slice, and the second message is used to request the establishment of Second PDU session.
  • the first message includes the identifier of the first PDU session
  • the second message includes the identifier of the second PDU session.
  • the communication module is further configured to receive the seventh message sent by the second access management network element, where the seventh message is used to indicate that the second PDU session is successfully established; according to the seventh message, send the seventh message to the terminal device.
  • the ninth message is used to indicate that the first PDU session is established successfully.
  • the communication module is further configured to obtain the IP address of the second PDU session from the second access management network element; send the IP address of the second PDU session to the first user plane network element in the first network .
  • the communication module is further configured to receive the tenth message sent by the second access management network element, where the tenth message is used to indicate that the establishment of the second PDU session fails; send the eleventh message to the terminal device, The eleventh message is used to indicate that the establishment of the first PDU session fails.
  • the processing module is further configured to determine the permission to enable the terminal device to access the first slice; the communication module is further configured to send a twelfth message to the terminal device, and the twelfth message is used to instruct the terminal device to be enabled. Permission for the device to access the first slice.
  • the twelfth message is used to indicate the permission to open the first slice, including: the twelfth message includes identification information of the first slice.
  • the twelfth message is used to indicate the permission to open the first slice, including: the twelfth message includes the second allowed NSSAI, and the second allowed NSSAI includes the S-NSSAI of the first slice.
  • the processing module is further configured to determine the authority to close the terminal device to access the first slice; the communication module is further configured to send a thirteenth message to the terminal device, where the thirteenth message is used to instruct the terminal to be closed. Permission for the device to access the first slice.
  • the thirteenth message is used to indicate closing the access authority of the first slice, including: the thirteenth message includes identification information of the first slice.
  • the thirteenth message is used to indicate that the access authority of the first slice is closed, including: the thirteenth message includes the second rejected NSSAI, and the second rejected NSSAI includes the NSSAI of the first slice.
  • the first network is a public network
  • the second network is a non-public network
  • the first network is a non-public network
  • the second network is a public network
  • a communication device in a fourth aspect, includes a processing module and a communication module.
  • the processing module is configured to acquire routing rules in the process of establishing the second PDU session for the terminal device by the second network.
  • the communication module is used for forwarding the data packet of the second PDU session according to the routing rule.
  • the routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the second PDU session to the second user plane network element serving the second PDU session.
  • the communication module is specifically configured to receive the uplink data packet of the second PDU session from the first user plane network element or the first access management network element of the first network;
  • the second user plane network element of the two-PDU session sends the uplink data packet of the second PDU session.
  • the routing rule is further used to instruct to forward the downlink data packet whose destination address is the IP address of the second PDU session to the first access management network element or the first user plane network element in the first network.
  • the communication module is specifically configured to receive downlink data packets of the second PDU session from the second user plane network element serving the second PDU session; The network element or the first access management network element sends the uplink data packet of the second PDU session.
  • a fifth aspect provides a communication device, the communication device includes a processor and a memory, the memory stores computer program instructions, and when the processor executes the computer program instructions stored in the memory, the processor is used to implement the first aspect or the first aspect.
  • the method provided by any one of the two aspects.
  • a computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer executes the design provided by any one of the first aspect or the second aspect. method.
  • a seventh aspect provides a computer program product comprising computer instructions that, when the computer instructions are executed on a computer, cause the computer to perform the method provided by any one of the first aspect or the second aspect.
  • a chip including: a processing circuit and a transceiver pin, where the processing circuit and the transceiver pin are used to implement the method provided by any one of the first aspect or the second aspect.
  • the processing circuit is used for executing the processing actions in the corresponding method
  • the transceiver pins are used for executing the actions of receiving/transmitting in the corresponding method.
  • a communication system in a ninth aspect, includes a first access management network element in the first network and an N3IWF in the second network.
  • the first access management network element is configured to execute the method provided by any one of the designs in the first aspect.
  • the N3IWF is used to perform the method provided by any of the designs in the second aspect.
  • FIG. 1 is a schematic diagram of a registration process provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of the architecture of a 5G network according to an embodiment of the present application.
  • Figure 3 is a schematic diagram of the architecture of the SNPN
  • Figure 4 is a schematic diagram of the architecture of PNI-NPN
  • FIG. 5 is a schematic diagram of a public-private network interworking architecture provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • FIG. 7(a) is a schematic diagram of a public-private network interworking architecture provided by an embodiment of the present application.
  • FIG. 7(b) is a schematic diagram of another public-private network interworking architecture provided by an embodiment of the present application.
  • FIG. 7(c) is a schematic diagram of another public-private network interworking architecture provided by an embodiment of the present application.
  • FIG. 7(d) is a schematic diagram of another public-private network interworking architecture provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of a method for network interworking provided by an embodiment of the present application.
  • FIG. 9 is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 11 is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 13(a) is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 13(b) is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 15(a) is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 15(b) is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • 16 is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • 17 is a flowchart of another method for network interworking provided by an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 21 is a schematic structural diagram of another communication apparatus provided by an embodiment of the present application.
  • a network slice is a network used to support the logical isolation of specific network capabilities and network characteristics. It can include the entire end-to-end (E2E) network, or some network functions can be shared among multiple network slices.
  • the 5th generation (5G) mobile communication technology proposed by the 3rd generation partnership project (3GPP) is the key technology for network differentiation requirements.
  • S-NSSAI Network slices can be identified by S-NSSAI.
  • S-NSSAI consists of the following two parts: (1) slice/service type (SST), which is used to anticipate the behavior of network slices in terms of functions or services; (2) slice differentiator (SD), Is optional information used to distinguish multiple network slices with the same SST.
  • SST slice/service type
  • SD slice differentiator
  • network slices are also referred to as slices.
  • NSSAI is a collection of S-NSSAI. That is, one NSSAI may include at least one S-NSSAI.
  • NSSAI exists in the following categories:
  • the requested (requested) NSSAI including the S-NSSAI that one or more terminal devices request to access;
  • Allowed NSSAI including one or more S-NSSAIs that are allowed to be accessed by the network side;
  • Security context refers to information that can be used to implement security protection (eg, encryption/decryption, and/or integrity protection/checking) of data.
  • security protection eg, encryption/decryption, and/or integrity protection/checking
  • the security context may include encryption keys, integrity protection passwords, and the like.
  • the encryption key is a parameter input when the sender encrypts the plaintext according to the encryption algorithm to generate the ciphertext. If symmetric encryption is used, the encryption key and decryption key are the same.
  • the receiver can decrypt the ciphertext according to the same encryption algorithm and encryption key. In other words, the sender and receiver can encrypt and decrypt based on the same key.
  • the integrity protection key is a parameter input by the sender when the plaintext or ciphertext is integrity protected according to the integrity protection algorithm.
  • the receiving end can perform integrity verification on the integrity-protected data according to the same integrity-protection algorithm and integrity-protection key.
  • the registration process is used to establish a connection between the terminal device and the network side, so that the terminal device can access the network.
  • the registration process can be divided into:
  • Initial registration process the first registration process initiated by the terminal device due to some reasons (such as power-on).
  • Periodic registration process a registration process initiated by a terminal device according to a preset time interval. It should be understood that the periodic registration process is similar to the heartbeat mechanism, so that the network side can know that the terminal is still in the service area.
  • Emergency registration process a registration process initiated by the terminal device in order to use the emergency service.
  • the terminal device may be a limited terminal device, for example, a terminal device without a SIM card installed.
  • emergency services may include making an emergency call, and the like.
  • the registration process may include the following steps:
  • the terminal device sends a registration request to the access network device.
  • the access network device performs an access and mobility management function (core access and mobility management function, AMF) selection process.
  • AMF core access and mobility management function
  • the access network device sends a registration request to the first AMF.
  • the first AMF determines the second AMF according to the registration request, and sends a context transmission request to the second AMF.
  • the first AMF is the AMF that currently provides services for the terminal device.
  • the second AMF is the AMF that previously served the terminal device.
  • the second AMF sends a response message of the context transmission request to the first AMF.
  • the first AMF sends an identification request (eg, an Identity Request message) to the terminal device.
  • an identification request eg, an Identity Request message
  • the terminal device sends a response message (for example, an Identity Response message) of the identity request to the first AMF.
  • a response message for example, an Identity Response message
  • the first AMF performs an authentication function (authentication server function, AUSF) selection process.
  • authentication function authentication server function, AUSF
  • the first AMF should perform the following step S9.
  • the first AMF sends a registration status update message (for example, a Namf_Communication RegistrationStatusUpdate message) to the second AMF.
  • a registration status update message for example, a Namf_Communication RegistrationStatusUpdate message
  • the first AMF initiates an identity acquisition process to the UE.
  • the first AMF performs an equipment identity check with an equipment identity register (equipment identity register, EIR).
  • equipment identity register equipment identity register
  • the first AMF performs a unified data management (unified data management, UDM) selection process.
  • UDM unified data management
  • the first AMF and the UDM perform AMF registration and UE subscription subscription acquisition procedures.
  • the first AMF determines that the policy control function (policy control function, PCF) information provided by the second AMF is unavailable, the first AMF executes a PCF selection process.
  • policy control function policy control function, PCF
  • the first AMF determines that the PCF information provided by the second AMF is available, and the PCF indicated by the PCF information is the PCF used by the second AMF, the first AMF sends a control policy acquisition request to the PCF.
  • the first AMF sends a registration reception message (for example, a Registration Accept message) to the terminal device.
  • a registration reception message for example, a Registration Accept message
  • the registration reception message is used to instruct the network side to accept the registration of the terminal device.
  • the terminal device sends a registration complete message (for example, a Registration complete message) to the first AMF.
  • a registration complete message for example, a Registration complete message
  • the registration complete message is used to indicate the completion of the registration process.
  • steps S4-S16 and S18 are optional steps, which can be selected to be executed or not executed according to the actual situation.
  • the registration process may further include other steps, and the embodiment of the present application is not limited thereto.
  • the 5G core network supports the PDU connection service.
  • the PDU connection service is the service of exchanging PDU data packets between the terminal device and the data network (DN).
  • the PDU connection service is realized through the establishment of a PDU session initiated by the terminal device.
  • the terminal device establishes a PDU session, that is, a data transmission channel between the terminal device and the DN is established.
  • terminal device may initiate the establishment of one or more PDU sessions to connect to the same DN or different DNs.
  • Terminal equipment can be composed of a set of core network elements (such as session management function (SMF) network elements, policy control function (PCF) network elements and user plane function (UPF) network elements. etc.) services, these core network elements coordinate and manage the PDU session resources of the terminal equipment.
  • SMF session management function
  • PCF policy control function
  • UPF user plane function
  • a 5G network may include terminal equipment, a radio access network (RAN) or an access network (AN) (hereinafter, RAN and AN are collectively referred to as (R)AN), a core network (core network, CN), and data network (data network, DN).
  • RAN radio access network
  • AN access network
  • R radio access network
  • CN core network
  • DN data network
  • the terminal device may be a device with a wireless transceiver function.
  • the terminal equipment may have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless communication device, terminal agent or terminal device, etc.
  • Terminals can be deployed on land, including indoor or outdoor, handheld or vehicle; can also be deployed on water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • Terminal devices include handheld devices, vehicle-mounted devices, wearable devices or computing devices with wireless communication functions.
  • the terminal device may be a mobile phone (mobile phone), a tablet computer or a computer with a wireless transceiver function.
  • the terminal device may also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, intelligent Wireless terminals in power grids, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • VR virtual reality
  • AR augmented reality
  • wireless terminal in industrial control a wireless terminal in unmanned driving
  • wireless terminal in telemedicine intelligent Wireless terminals in power grids, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • An access network device is a device that provides wireless communication functions for terminal devices.
  • An access network device may also be referred to as a base station.
  • the base station may include various forms of base stations, such as: a macro base station, a micro base station (also called a small station), a relay station, an access point, and the like.
  • an access point in a wireless local area network (WLAN), a global system for mobile communications (GSM) or a code division multiple access (code division multiple access) Base Transceiver Station (BTS) in multiple access (CDMA), base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), or Long Term Evolution (Long Term Evolution) evolution, LTE) in the evolved Node B (evolved Node B, eNB or eNodeB), or relay station or access point, or in-vehicle equipment, wearable equipment and the next generation Node B (the next generation Node B in the future 5G network, gNB) or a base station in a future evolved Public Land Mobile Network (Public Land Mobile Network, PLMN) network, etc.
  • AP access point
  • WLAN wireless local area network
  • GSM global system for mobile communications
  • BTS code division multiple access
  • CDMA code division multiple access
  • NodeB, NB base station
  • WCDMA Wideband Code Division Multiple Access
  • LTE
  • the core network includes multiple core network network elements (or network function network elements), such as: access and mobility management function (AMF) network elements, session management function (session management function, SMF) network elements element, policy control function (PCF) network element, user plane function (UPF) network element, AUSF network element, and UDM network element.
  • core network may also include some other network elements not shown, which are not described in detail in this embodiment of the present application.
  • the core network may further include some network elements not shown in FIG. 2 , such as a security anchor function (security anchor function, SEAF) network element, etc., which will not be repeated in this embodiment of the present application.
  • a security anchor function security anchor function, SEAF
  • the above network elements or equipment can still use their names in the 5G communication system, or have other names; the functions of the above network elements or equipment can be completed by an independent network element, or can be It is jointly completed by several network elements, which is not limited in this embodiment of the present application.
  • network elements in the core network can be co-located.
  • access and mobility management functions can be co-located with session management functions; session management functions can be co-located with user plane functions.
  • session management functions can be co-located with user plane functions.
  • a public land mobile network is a public network established and operated to provide land mobile communication services to the public.
  • PLMN public land mobile network
  • NPN non-public network
  • NPNs can be classified into two categories: stand-alone NPNs (SNPNs) and PLMN-dependent NPNs (PLMN-integrated NPNs, PNI-NPNs).
  • SNPNs stand-alone NPNs
  • PLMN-dependent NPNs PLMN-dependent NPNs
  • PNI-NPNs PLMN-integrated NPNs
  • the SNPN has independent access network equipment and core network, and does not rely on the PLMN established by the network operator to provide functions.
  • the SNPN may have independent AMF, AUSF, UPF and gNB.
  • PNI-NPN is an NPN deployed with PLMN support.
  • the PNI-NPN can be fully or partially hosted on the PLMN infrastructure, relying on the PLMN to provide some network functions.
  • the UE needs to use the gNB and UPF in the PLMN to access the private network DN1.
  • the UE needs to use the gNB and UPF in the PLMN to access the private network DN2.
  • the NPN is a private network built by the enterprise, and the NPN can be isolated from the public network (that is, the PLMN).
  • the PLMN public network
  • enterprises still have the need for NPN and PLMN interworking. For example, if the employees of the enterprise need to work from home, the employees need to access the NPN through the PLMN.
  • a device in the enterprise fails at night, the employee needs to use the enterprise communication software to notify the administrator, that is, the device of the enterprise needs to access the PLMN through the NPN.
  • an enterprise established an SNPN in the Beijing park, and later established a branch in Shanghai and another SNPN in the Shanghai park as the scale expanded. The two SNPNs need to be interconnected through PLMN.
  • FIG. 5 shows a public-private network interworking architecture.
  • the core network of the PLMN includes AMF, SMF and UPF.
  • the core network of SNPN includes AMF, SMF, UPF and N3IWF.
  • the core network of the PLMN may also set a corresponding N3IWF (not shown in FIG. 5 ) to ensure the security of the connection between the UE and the PLMN.
  • the terminal device can access the core network of the SNPN through the access network and the core network of the PLMN.
  • the PLMN since the messages between the terminal equipment and the SNPN are transparently transmitted in the PLMN, the PLMN cannot sense whether the terminal equipment accesses the SNPN, nor can it control the terminal equipment to access the SNPN.
  • N3IWF needs to establish a secure tunnel with terminal equipment.
  • the secure tunnel is generally implemented based on a complex IPsec protocol stack. This leads to the need for the terminal device to support the IPsec protocol stack, which complicates the protocol stack of the terminal device and increases the manufacturing cost of the terminal device.
  • an embodiment of the present application provides a communication system 10 , where the communication system 10 includes: a first access management network element 101 and a second access management network element 102 . It should be understood that the first access management network element 101 and the second access management network element 102 may communicate directly or communicate through forwarding by other devices, which is not limited thereto.
  • the first access management network element 101 belongs to the first network
  • the second access management network element belongs to the second network.
  • the first network and the second network are two different networks.
  • the first network may be a public network or a non-public network
  • the second network may be a public network or a non-public network.
  • the first network is a public network and the second network is a non-public network.
  • the first network is a non-public network
  • the second network is a public network.
  • the first network and the second network may adopt the same communication standard or different communication standard.
  • the first network adopts the 5G communication standard
  • the second network also adopts the 5G communication standard.
  • the first access management network element 101 is configured to receive the identification information of the first slice sent by the terminal device, where the first slice is a slice related to the service of the second network; according to the identification information of the first slice, to the first slice
  • the second access management network element in the second network requests to access the second network.
  • the first access management network element can learn that the terminal device wants to access the second network according to the identification information of the first slice. Therefore, the first access management network element in the first network requests the second access management network element in the second network to access the second network. It can be seen that the first access management network element in the first network can learn that the terminal device wants to access the second network, and can also control the terminal device to access the second network.
  • the technical solution provided by the present application can enhance the first network's control of the terminal device accessing the second network.
  • the first access management network element acts as a proxy for the terminal device to request access to the second network, and the terminal device does not directly exchange information with the second network, so the terminal device does not need to establish an IPsec tunnel with the security gateway (such as N3IWF), so the terminal device does not need to establish an IPsec tunnel.
  • the security gateway such as N3IWF
  • the communication system 10 shown in FIG. 6 may be applied to the architecture of the intercommunication between the first network and the second network shown in FIG. 7( a )- FIG. 7( d ).
  • the first access management network element 101 in the communication system 10 may be implemented as an AMF in the first network
  • the second access management network element may be implemented as an AMF in the second network.
  • FIG. 7(a) shows an architecture for interworking between a first network and a second network.
  • the first network may include AMF and UPF
  • the second network may include AMF, N3IWF and UPF.
  • a security tunnel is established between the AMF of the first network and the N3IWF of the second network
  • a security tunnel is established between the UPF of the first network and the N3IWF of the second network.
  • the N3IWF forwards the message from the second network according to whether the message is a data plane message or a control plane message.
  • the N3IWF sends the control plane message to the AMF of the first network through the tunnel used for communication with the AMF of the first network.
  • the N3IWF sends the data plane message to the UPF of the first network through the tunnel used for communication with the UPF of the first network.
  • the information between the AMF in the first network and the AMF in the second network can be transferred through the N3IWF.
  • the transmission path of the message sent by the AMF in the first network to the AMF in the second network may be: AMF->N3IWF->AMF in the second network.
  • -> indicates the transmission direction.
  • AMF in the first network->N3IWF indicates that the AMF in the first network sends a message to the N3IWF, which is described here uniformly and will not be repeated below.
  • the messages sent by the AMF in the second network to the AMF in the first network may be: AMF in the second network->N3IWF->AMF in the first network.
  • the user plane data of the UE may be transmitted through the access network device in the first network, the UPF of the first network, the N3IWF, and the UPF of the second network.
  • the transmission path of the downlink user plane data of the UE may be: UPF in the second network->N3IWF->UPF in the first network->access of the first network network device -> UE.
  • the transmission path of the UE's uplink user plane data may be: UE->access network device of the first network->UPF in the first network->N3IWF->the first network Two UPFs in the network.
  • FIG. 7(b) shows another schematic diagram of the architecture of the intercommunication between the first network and the second network.
  • the core network of the first network may include AMF and UPF
  • the core network of the second network may include AMF, N3IWF and UPF.
  • the AMF of the first network and the N3IWF of the second network do not establish a secure tunnel
  • the UPF of the first network and the N3IWF of the second network establish a secure tunnel.
  • the N3IWF since the N3IWF has established a tunnel with the UPF of the first network, but has not established a tunnel with the AMF of the first network. Therefore, for a message from the second network, whether the message is a data plane message or a control plane message, the N3IWF forwards the message to the UPF of the first network through the tunnel used to communicate with the UPF of the first network.
  • the information between the AMF in the first network and the AMF in the second network can be transferred through the N3IWF and some other network elements.
  • the transmission path of the message sent by the AMF in the first network to the AMF in the second network may be: AMF->SMF in the first network->UPF in the first network->N3IWF->AMF in the second network.
  • the messages sent by the AMF in the second network to the AMF in the first network may be: AMF in the second network->N3IWF->UPF in the first network->SMF in the first network->AMF in the first network.
  • the user plane data of the UE may be transmitted through the access network device in the first network, the UPF of the first network, the N3IWF, and the UPF of the second network.
  • the transmission path of the downlink user plane data of the UE may be: UPF in the second network->N3IWF->UPF in the first network->access of the first network network device -> UE.
  • the transmission path of the uplink user plane data of the UE may be: UE->access network device of the first network->UPF in the first network->N3IWF->the first network Two UPFs in the network.
  • FIG. 7( c ) shows another schematic diagram of the architecture of the intercommunication between the first network and the second network.
  • the core network of the first network may include AMF and UPF
  • the core network of the second network may include AMF, N3IWF and UPF.
  • the AMF of the first network and the N3IWF of the second network have established a secure tunnel
  • the UPF of the first network and the N3IWF of the second network have not established a secure tunnel.
  • the N3IWF since the N3IWF has established a tunnel with the AMF of the first network, but has not established a tunnel with the UPF of the first network. Therefore, for a message from the second network, whether the message is a data plane message or a control plane message, the N3IWF forwards the message to the AMF of the first network through the tunnel used to communicate with the AMF of the first network.
  • the information between the AMF in the first network and the AMF in the second network can be transferred through the N3IWF.
  • the transmission path of the message sent by the AMF in the first network to the AMF in the second network may be: AMF->N3IWF->AMF in the second network.
  • the messages sent by the AMF in the second network to the AMF in the first network may be: AMF in the second network->N3IWF->AMF in the first network.
  • the user plane data of the UE can be transmitted through the access network device in the first network, the AMF in the first network, the N3IWF and the AMF in the second network.
  • the transmission path of the downlink user plane data of the UE may be: AMF in the second network->N3IWF->AMF in the first network->access of the first network network device -> UE.
  • the transmission path of the uplink user plane data of the UE may be: UE->access network device of the first network->AMF in the first network->N3IWF->the first network AMF in two networks.
  • the architecture shown in FIG. 7( c ) only supports the transmission of some types of messages (such as small packet data) in the data plane messages of the UE between the two networks.
  • FIG. 7(d) shows another schematic diagram of the architecture of the first network and the second network. As shown in FIG. 7( d ), the AMF in the first network is directly connected with the AMF in the second network, and the UPF in the first network is directly connected with the UPF in the second network.
  • the AMF in the first network can communicate directly with the AMF in the second network.
  • the UPF in the first network can communicate directly with the UPF in the second network.
  • the N3IWF can be replaced with other devices, which is not limited.
  • the N3IWF can be replaced with an access network device, and the access network device can establish a connection with the AMF and/or UPF in the first network.
  • a method for network interworking provided by an embodiment of the present application will be introduced in detail below. As shown in Figure 8, the method includes:
  • a terminal device sends identification information of a first slice to a first access management network element.
  • the first access management network element receives the identification information of the first slice sent by the terminal device.
  • the first access management network element belongs to the first network.
  • the first access management network element is used for the access management of the first network.
  • the first access management network element may be a mobility management entity (mobility management entity, MME) in a 4G network, or an AMF in a 5G network, or a device that undertakes functions such as access management in a future network.
  • MME mobility management entity
  • the first slice is the slice in the first network.
  • the first slice is a slice related to the traffic of the second network. In other words, the first slice is associated with all or part of the services of the second network.
  • the identification information of the first slice indicates that the terminal equipment requests to access the first slice; or the identification information of the first slice indicates that the terminal equipment requests to access the second network; or the identification information of the first slice indicates that the terminal equipment requests to use the first slice.
  • step S101 may be specifically implemented as: the terminal device sends a first message to the first access management network element, where the first message includes identification information of the first slice.
  • the identification information of the first slice may be the S-NSSAI of the first slice, which is not limited.
  • the first access management network element obtains the identifier of the first network.
  • the first message received by the first access management network element and sent by the terminal device may further include the identifier of the first network.
  • the identifier of the first network indicates that the first message is used for a related procedure in the first network (for example, a registration procedure or a PDU session establishment procedure, etc.).
  • the first access management network element obtains the first identity information.
  • the first message includes first identity information, where the first identity information is used to identify the terminal device in the first network. Therefore, the first access management network element can know the terminal device sending the first message according to the first identity information.
  • the form of the first identity information may be IMSI, SUPI, SUCI, or GUTI, etc., which is not limited.
  • the identity information may also have other names, such as terminal identification information, device identification information, user information, etc., which are not limited.
  • the first message may be a non-access stratum (non-access stratum, NAS) message.
  • the first message may be a registration request message, a PDU session establishment request message, a service request message, or the like.
  • the first access management network element requests the second access management network element to access the second network according to the identification information of the first slice.
  • the second access management network element receives the request for accessing the second network sent by the first access management network element.
  • the second access management network element belongs to the second network.
  • the second access management network element is used for the access management of the second network.
  • the second access management network element may be an MME in a 4G network, or an AMF in a 5G network, or a device that undertakes functions such as access management in a future network.
  • accessing the second network may refer to registering with the second network, or establishing a PDU session in the second network, etc., which is not specifically limited.
  • step S102 may be specifically implemented as: the first access management network element sends a second message to the second access management network element according to the identification information of the first slice, where the second message is used to request access to the first access management network element. Second network.
  • the second message may be a NAS message.
  • the second message may be a registration request message, a PDU session establishment request message, or a service request message, or the like.
  • the first access management network element requests the second access management network element to access the second slice of the second network according to the identification information of the first slice.
  • the first slice is associated with the second slice.
  • the first access management network element may also obtain the association relationship between the identification information of the first slice and the identification information of one or more second slices from other network elements (for example, a unified data management network element). ; or, the association relationship may be configured on the first access management network element.
  • the second slice is a slice in the second network.
  • a second slice is associated with a service in the second network.
  • the identification information of the second slice may be carried in the second message.
  • the first access management network element obtains the identification information of the second network; the first access management network element sends the identification information of the second network to the second access management network element.
  • the first access management network element may obtain the association relationship between the identification information of the first slice and the identification information of the second network from other network elements (for example, a unified data management network element); or, the association The relationship may be configured on the first access management network element. Therefore, after receiving the identification information of the first slice, the first access management network element can determine the network (that is, the second network) associated with the first slice.
  • the identification information of the second network may be a PLMN ID.
  • the identification information of the second network may be an SNPN ID.
  • the identification information of the second network may be carried in the second message to indicate that the second message is used for related processes (eg, registration process, PDU session establishment process) of the second network.
  • the first access management network element may further acquire second identity information; the first access management network element sends the second identity information to the second access management network element.
  • the second identity information is used to identify the terminal device in the second network.
  • the second identity information is different from the first identity information. For example, assuming that the first message includes SUCI#1, the second message may include SUCI#2, which is different from SUCI#2.
  • the second identity information may be in the form of IMSI, SUPI, SUCI, or GUTI, etc., which is not limited thereto.
  • the second identity information may be carried in the second message. It should be understood that since the first identity information is used to identify the terminal device in the first network, the network elements in the second network may not be able to identify the first identity information. Therefore, the second message includes the second identity information that can be identified by the second network, so that the first access management network element can act as a proxy for the terminal device and the related network elements (for example, the second access management network element) in the second network to function normally communication.
  • the first access management network element can establish and store an association relationship between the first identity information and the second identity information, so that the first access management network element can implement the communication between the proxy terminal device and the second network. Purpose.
  • the first access management network element receives information from a related network element (eg, the second access management network element) in the second network with the second
  • a related network element eg, the second access management network element
  • the message A can be parsed to obtain the content carried by the message A, and all or part of the content carried by the message A can be encapsulated as the message B and sent to the terminal device.
  • the first access management network element can parse the message C to The content carried by the message C is acquired, and all or part of the content carried by the message C is encapsulated as a message D and sent to a relevant network element (eg, a second access management network element) in the second network.
  • a relevant network element eg, a second access management network element
  • the following describes an implementation manner in which the first access management network element acquires the second identity information.
  • Implementation Mode 1-1 The first access management network element acquires the second identity information from the terminal device.
  • the first access management network element acquires the third identity information from the terminal device; then, the first access management network element generates the second identity information according to the third identity information.
  • the third identity information is used to derive the second identity information.
  • the third identity information is the identity information after decrypting the second identity information.
  • the second identity information is identity information obtained by encrypting the third identity information.
  • the third identity information is SUPI
  • the second identity information is SUCI
  • SUCI is obtained by encrypting SUPI.
  • the first access management network element obtains the second identity information locally.
  • the first access management network element establishes a first correspondence in advance, and the first correspondence includes a correspondence between the identification information of the first slice and the second identity information. Therefore, the first access management network element can find the second identity information according to the first correspondence and the identification information of the first slice.
  • the above-mentioned first correspondence relationship may be a one-to-one correspondence relationship or a one-to-many correspondence relationship, which is not limited thereto.
  • the first access management network element pre-establishes a second correspondence relationship, and the second correspondence relationship includes a correspondence relationship between the first identity information and the second identity information. Therefore, the first access management network element can find the corresponding second identity information according to the second correspondence and the first identity information obtained from the terminal device.
  • the first access management network element prestores multiple pieces of identity information for the second network. After that, in the case of receiving the identification information of the first slice, the first access management network element may select one piece of identity information from a plurality of pre-stored pieces of identity information for the second network according to certain rules or in a random manner as the second identity information.
  • the first access management network element obtains the third identity information locally; then, the first access management network element generates the second identity information according to the third identity information.
  • the first access management network element may establish a third correspondence in advance, and the third correspondence may be a correspondence between the identification information of the first slice and the third identity information. Therefore, the first access management network element can find the third identity information according to the third correspondence and the identification information of the first slice.
  • the above-mentioned third correspondence relationship may be a one-to-one correspondence relationship or a one-to-many correspondence relationship, which is not limited.
  • the first access management network element may establish a fourth correspondence in advance, and the fourth correspondence may be a correspondence between the fourth identity information and the third identity information, wherein the fourth identity information for deriving the first identity information. Therefore, the first access management network element finds the corresponding third identity information according to the fourth correspondence and the first identity information.
  • the first identity information is SUCI#1, the second identity information is SUCI#2, the third identity information is SUPI#2, and the fourth identity information is SUPI#1.
  • SUPI#1 can generate SUCI#1, and SUPI#2 can generate SUCI#2.
  • the first access management network element determines the SUPI#1 corresponding to the SUCI#1 according to the received SUCI#1.
  • the first access management network element determines SUPI#2 according to the correspondence between SUPI#1 and SUPI#2 and SUPI#1.
  • the first access management network element may determine SUCI#2 according to SUPI#2.
  • the first access management network element pre-stores multiple pieces of identity information for the second network. After that, in the case of receiving the identification information of the first slice, the first access management network element may select one piece of identity information from a plurality of pre-stored pieces of identity information for the second network according to certain rules or in a random manner as third identity information.
  • the first access management network element acquires the second identity information from other network elements (eg, the first data management network element) in the first network.
  • the first access management network element sends a first request message to the first data management network element; after that, the first access management network element receives the first response message sent by the first data management network element, and the first response The message includes second identity information.
  • the first request message may include first identity information or identification information of the first slice.
  • the first request message may be Nudm_SDM_GET Request
  • the first response message may be Nudm_SDM_GET Response, which is not limited.
  • Implementation modes 1-6 The first access management network element obtains the third identity information from other network elements in the first network (for example, the first data management network element); after that, the first access management network element obtains the third identity information according to the third identity information to generate second identity information.
  • the first access management network element sends a second request message to the first data management network element; after that, the first access management network element receives the first response message sent by the unified data management network element, where the first response message includes the first response message.
  • Three identity information are provided.
  • the second request message may include fourth identity information, first identity information or an identifier of the first slice.
  • the second request message may be Nudm_SDM_GET Request
  • the second response message may be Nudm_SDM_GET Response, which is not limited.
  • the foregoing implementation manners 1-1 to 1-6 are only examples, and the first access management network element may also adopt other implementation manners to obtain the second identity information, which is not limited thereto.
  • the first access management network element may further acquire subscription information associated with the second identity information, and generate the second message based on the subscription information associated with the second identity information.
  • the first access management network element acquires subscription information associated with the second identity information from the first data management network element; or, the subscription information is configured on the first access management network element.
  • the subscription information associated with the second identity information may include one or more of the following parameters: an identifier of the second network, an identifier of the second slice, a security algorithm (such as an encryption algorithm or an integrity protection algorithm), a non-access Layer (non-access stratum, NAS) counter value (NAS counter), PDU session ID, IP address or MAC address of the PDU session, etc., and the data network name (DNN) associated with the PDU session.
  • the subscription information associated with the second identity information may also include a closed access group information list (closed access group information list, CAG information list), which is not limited.
  • the first access management network element may perform security protection on the second message according to the security algorithm and the NAS counter in the subscription information associated with the second identity information.
  • the first access management network element may determine the identifier of the second slice included in the second message according to the identifier of the second slice in the subscription information associated with the second identity information.
  • the first access management network element sends the second message to the N3IWF; the N3IWF forwards the second message to the second access management network element.
  • the first access management network element sends the second message to the first session management network element; the first session management network element sends the second message to the first user plane network element message; the first user plane network element sends the second message to the N3IWF; the N3IWF sends the second message to the second access management network element.
  • the first access management network element sends the second message to the N3IWF; the N3IWF forwards the second message to the second access management network element.
  • the first access management network element is directly connected to the second access management network element, so the first access management network element directly sends a message to the second access management network element. Second message.
  • the first access management network element receives the identification information of the first slice sent by the terminal device. Since the first slice is a slice related to the service of the second network, the first access management network element can learn that the terminal device wants to access the second network according to the identification information of the first slice. Thus, the first access management network element in the first network requests the second access management network element in the second network to access the second network. It can be seen that the first access management network element in the first network can learn that the terminal device wants to access the second network, and can also control the terminal device to access the second network. The technical solution provided by the present application can enhance the first network's control of the terminal device accessing the second network.
  • the first access management network element acts as a proxy for the terminal device to request access to the second network, and the terminal device does not directly communicate with the second network, so the terminal device does not need to establish with the security gateway in the second network IPsec tunneling, so the end device does not need to support the IPsec protocol stack, thereby reducing the manufacturing cost of the end device.
  • the method includes:
  • S101 Refer to the description of S101 in FIG. 8 .
  • step S101 may be specifically implemented as: the terminal device sends a first message to the first access management network element.
  • the first message is used to request registration to the first network.
  • the first message may be a registration request message.
  • the first message includes the identification information of the first slice, which may be specifically implemented as follows: the first message includes the requested NSSAI, and the requested NSSAI includes the S-NSSAI of the first slice.
  • the requested NSSAI may also include S-NSSAI of other network slices, which is not limited.
  • the terminal device may perform some steps in the registration process of the first network with other network elements in the first network, such as the registration process shown in FIG. 1 . All or part of steps S4 to S14 in . In the process of performing steps S4-S14 shown in FIG. 1 , the terminal device performs the operation performed by the communication device shown in FIG. 1 , and the first access management network element performs the operation performed by the first AMF shown in FIG. 1 . .
  • the terminal device and the network element in the first network perform operations such as authentication and identification request.
  • both the first access management network element and the terminal device can acquire the first security context associated with the first identity information. Therefore, the first security context can be used between the terminal device and the first access management network element to ensure communication security (eg, encryption protection, integrity protection, etc.) between the terminal device and the first access management network element.
  • step S102 may be specifically implemented as: the first access management network element sends a second message to the second access management network element.
  • the second message is used to request access to the second network, which may be specifically implemented as: the second message is used to request to register with the second network.
  • the second message may specifically be a registration request message.
  • the second access management network element can regard the first access management network element as a common terminal device according to the second message. Based on this manner, the first access management network element achieves the purpose of proxying the terminal device to access the second network.
  • the first access management network element may also store an association relationship between the identification information of the first slice and the identification information of the m second slices.
  • the second message may include identification information of n second slices.
  • the n second slices are subsets of the above m second slices.
  • the above m and n are both integers greater than or equal to zero, and n is less than or equal to m.
  • the second message includes identification information of n second slices, which may be specifically implemented as: the second message includes the requested NSSAI, and the requested NSSAI includes the S-NSSAI of the n second slices.
  • the first access management network element may perform some steps of the registration process of the second network with the network elements in the second network, such as the one shown in FIG. 1 . All or part of steps S4-S16.
  • the first access management network element performs the operations performed by the communication device shown in FIG. 1
  • the second access management network element performs the first access management network element shown in FIG. 1 . Action performed by AMF.
  • the first access management network element and the second access management network element may acquire the second security context associated with the second identity information. Therefore, the first access management network element and the second access management network element can use the second security context to ensure the communication security between the first access management network element and the second access management network element (for example, encryption is performed). protection, integrity protection, etc.).
  • the method for network interworking may further include steps S201-S202 after step S102.
  • the second access management network element sends a third message to the first access management network element.
  • the first access management network element receives the third message sent by the second access management network element.
  • the third message is used to indicate that access to the second network is permitted. Or, the third message is used to indicate that the registration in the second network is successful.
  • the third message may be a registration complete (registration accept) message.
  • the third message is used to indicate that access to the second network is allowed, which may be specifically implemented as: the third message is used to indicate that the first access management network element is allowed to access the second network.
  • the third message may further include an allowed NSSAI, where the allowed NSSAI includes the identifiers of the p second slices.
  • the p second slices may be a subset of the above n second slices, p is an integer greater than or equal to 0, and p is less than or equal to n.
  • the first access management network element may perform the remaining steps in the registration process of the first network (for example, steps S15-S18 in FIG. 1 ). Part or all to complete the process of registering the terminal device to the first network.
  • the first access management network element may establish a correspondence between the identification information of the first slice and the second identity information (or other identity information derived from the second identity information).
  • the first access management network element may establish an association relationship between the second security context and the first security context, so as to ensure the security of the communication between the terminal device and the second network.
  • the association relationship between the second security context and the first security context may be based on the association relationship between the first identity information and the second identity information, the association relationship between the first identity information and the first security context, and The association relationship between the second identity information and the second security context is determined.
  • the first access management network element can parse the message A to obtain the content carried by the message A, and send the message A to the All or part of the carried content is encapsulated as message B, the first security context is used to secure the message B, and the security-protected message B is sent to the terminal device.
  • a related network element for example, a second access management network element
  • the first access management network element can parse the message A to obtain the content carried by the message A, and send the message A to the All or part of the carried content is encapsulated as message B, the first security context is used to secure the message B, and the security-protected message B is sent to the terminal device.
  • the first access management network element can parse the message C to obtain the content carried by the message C, and convert all or part of the content carried by the message C.
  • the content is encapsulated into a message D
  • the second security context is used to secure the message D
  • the security-protected message D is sent to a relevant network element (eg, a second access management network element) in the second network.
  • the following describes a specific implementation manner for the second access management network element to send the third message to the first access management network element with reference to the architectures shown in FIG. 7( a )- FIG. 7 ( b ).
  • the second access management network element sends the third message to the N3IWF; the N3IWF sends the third message to the first access management network element.
  • the second access management network element sends the third message to the N3IWF; the N3IWF sends the third message to the first user plane network element; the first user plane network element sends the third message to the first user plane network element.
  • a session management network element sends the third message; the first session management network element sends the third message to the first access management network element.
  • the second access management network element sends the third message to the N3IWF; the N3IWF sends the third message to the first access management network element.
  • the second access management network element directly sends the third message to the first access management network element.
  • the first access management network element sends a fourth message to the terminal device according to the third message.
  • the terminal device receives the fourth message sent by the first access management network element.
  • the fourth message is used to indicate that the terminal device is allowed to have the right to access the first slice.
  • the fourth message includes an allowed NSSAI
  • the allowed NSSAI includes the S-NSSAI of the first slice.
  • the fourth message may also be used to indicate that the terminal device successfully registers with the first network.
  • the fourth message may be a registration accept message.
  • the first access management network element receives the identification information of the first slice sent by the terminal device, and acts as a proxy for the terminal device to request access to the second network.
  • the first access management network element makes the terminal device know that it has the right to access the first slice through the fourth message.
  • the terminal device does not directly communicate with the second network, so the terminal device does not need to establish an IPsec tunnel with the security gateway in the second network, so the terminal device does not need to support the IPsec protocol stack, thereby reducing the manufacturing cost of the terminal device.
  • the method includes:
  • S101 Refer to the description of S101 in FIG. 9 .
  • S102 Refer to the description of S102 in FIG. 9 .
  • the method may further include steps S301-S302.
  • the second access management network element sends a fifth message to the first access management network element.
  • the first access management network element receives the fifth message sent by the second access management network element.
  • the fifth message is used to indicate that the service of the second network is not allowed to be used.
  • the fifth message may adopt any one of the following designs:
  • the fifth message is used to indicate that the registration in the second network fails.
  • the fifth message may be a registration rejection message.
  • the fifth message may include the rejected NSSAI, and the rejected NSSAI may include the S-NSSAI of the n second slices.
  • the fifth message is used to indicate that the registration in the second network is successful, but the permission to access the second slice has not been obtained.
  • the fifth message may be a registration accept message, and the fifth message includes the rejected NSSAI, and the rejected NSSAI may include the S-NSSAI of the n second slices.
  • the second access management network element sends the fifth message to the N3IWF; the N3IWF sends the fifth message to the first access management network element.
  • the second access management network element sends the fifth message to the N3IWF; the N3IWF sends the fifth message to the first user plane network element; the first user plane network element sends the fifth message to the first user plane network element.
  • a session management network element sends the fifth message; the first session management network element sends the fifth message to the first access management network element.
  • the second access management network element directly sends the fifth message to the first access management network element.
  • the first access management network element sends a sixth message to the terminal device according to the fifth message.
  • the terminal device receives the sixth message sent by the first access management network element.
  • the sixth message is used to indicate that the terminal device is not allowed to access the first slice. It should be understood that the above-mentioned disallowance can be described in other ways, such as not provide (not provide), abolish/revoke (revoke), reject (reject), disable (disable), deactivate (disactivate), etc., to which the embodiments of the present application No restrictions apply.
  • the sixth message may include the rejected NSSAI, and the rejected NSSAI includes the S-NSSAI of the first slice.
  • the first access management network element receives the identification information of the first slice sent by the terminal device, and acts as a proxy for the terminal device to request access to the second network.
  • the first access management network element makes the terminal device know through the sixth message It does not have permission to access the first slice.
  • the terminal device does not directly communicate with the second network, so the terminal device does not need to establish an IPsec tunnel with the security gateway, so the terminal device does not need to support the IPsec protocol stack, thereby reducing the manufacturing cost of the terminal device.
  • the method includes:
  • S101 Refer to the description of S101 in FIG. 8 .
  • step S101 may be specifically implemented as: the terminal device sends a first message to the first access management network element.
  • the first message may be used to request the first PDU session associated with the first slice to be established.
  • the first message is the first PDU session establishment request message. Therefore, the first message includes the identifier of the first slice, that is, the first PDU session establishment request message includes the identifier of the first slice.
  • the first message may include identification information of the first slice and a first PDU session establishment request message.
  • the above-mentioned first PDU session establishment request message is used for requesting establishment of the first PDU session.
  • the first PDU session establishment request message may include an identification of the first PDU session.
  • the first PDU session may be a user plane-based PDU session or a control plane-based PDU session, so as to adapt to different intercommunication architectures of the first network and the second network.
  • the first user plane network element in the first network has the ability to communicate with related network elements in the second network. tunnel (or connection), so the first user plane network element can be responsible for forwarding data packets between the first PDU session and the second PDU session, so the first PDU session can be established as a user plane-based PDU session.
  • the first user plane network element in the first network does not have a tunnel (or connection) for communicating with the relevant network element in the second network, so the first The user plane network element cannot be responsible for forwarding data packets between the first PDU session and the second PDU session, so the first PDU session needs to be established as a control plane-based PDU session. That is, the first access management network element is responsible for data packet forwarding between the first PDU session and the second PDU session.
  • the uplink transmission path of the data packets in the first PDU session is: UE->first access management Network element->N3IWF; the downlink transmission path of the data packet in the first PDU session is: N3IWF->first access management network element->UE.
  • step S102 may be specifically implemented as: the first access management network element sends a second message to the second access management network element.
  • the second message is used to request access to the second network, which may be specifically implemented as: the second message is used to request to establish a second PDU session.
  • the second message may include a second PDU session establishment request message, or the second message is a second PDU session establishment request message.
  • the second PDU session establishment request message is used to request the establishment of the second PDU session, and the second PDU session establishment request message may include an identifier of the second PDU session.
  • the identity of the second PDU session is different from the identity of the first PDU session.
  • the identifier of the second PDU session may be configured by the first access management network element.
  • the first access management network element may acquire the IP address of the first PDU session, and send the address of the first PDU session to the second access management network element.
  • the first access management network element may obtain the IP address of the first PDU session from the first session management network element, where the first session management network element is a session management device in the first network that is responsible for managing the first PDU session. network element. Therefore, the first access management network element can encapsulate the IP address of the first PDU session into the second message, so that the second access management network element can obtain the IP address of the first PDU session according to the second message.
  • the IP address of the first PDU session may be carried in the second message.
  • the second message may be processed (eg, encryption protection, integrity protection, etc.) using the second security context acquired by the first access network device during the process of registering with the second network.
  • the second access management network element may execute the procedure for establishing the second PDU session.
  • the second message includes the IP address of the first PDU session.
  • the second access management network element may acquire the IP address of the first PDU session from the first access management network element.
  • the second access management network element may send the IP address of the first PDU session to the second user plane network element through the second session management network element.
  • the second session management network element and the second user plane network element belong to the second network.
  • the second session management network element will configure the IP address of the second PDU session, and send the IP address of the second PDU session to the second user plane network element.
  • the second user plane network element can learn the association relationship between the IP address of the first PDU session and the IP address of the second PDU session, so that the second user plane network element can be responsible for data packets between the first PDU session and the second PDU session. Forwarding between PDU sessions.
  • the second message may also not include the IP address of the first PDU session.
  • the N3IWF is connected to a first user plane network element in the first network, so that the N3IWF is connected to the second user plane network element through the first user plane network element.
  • Data forwarding is performed between the PDU session and the first PDU session.
  • the N3IWF forwards the downlink user plane data transmitted by the second user plane network element to the first user plane network element, and the first user plane network element forwards the downlink user plane data to the terminal device.
  • the connection between the N3WIF and the second user plane network element needs to be configured to ensure that the data Normal forwarding of packets between the first PDU session and the second PDU session.
  • the second user plane network element is a user plane network element in the second network that serves the second PDU session.
  • the N3IWF obtains the first routing rule, and the first routing rule is used to forward the data packets of the second PDU session; according to the first routing rule, the N3IWF, Forward the packets of the second PDU session.
  • the first routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the second PDU session to the second user plane network element serving the second PDU session. Therefore, the N3IWF forwards the data packets of the second PDU session according to the first routing rule, which may be specifically implemented as: the N3IWF receives the uplink of the second PDU session from the first user plane network element or the first access management network element of the first network. data packet; the N3IWF sends the uplink data packet of the second PDU session to the second user plane network element serving the second PDU session according to the first routing rule.
  • the first routing rule which may be specifically implemented as: the N3IWF receives the uplink of the second PDU session from the first user plane network element or the first access management network element of the first network. data packet; the N3IWF sends the uplink data packet of the second PDU session to the second user plane network element serving the second PDU session according to the first routing rule.
  • the first routing rule is further used to instruct to forward the downlink data packet whose destination address is the IP address of the second PDU session to the first access management network element or the first user plane network element in the first network. Therefore, the N3IWF forwards the data packets of the second PDU session according to the first routing rule, including: the N3IWF receives the downlink data packets of the second PDU session from the second user plane network element serving the second PDU session; the N3IWF according to the first routing According to the rule, the uplink data packet of the second PDU session is sent to the first user plane network element or the first access management network element of the first network.
  • the method may further include the following steps:
  • the second access management network element sends a seventh message to the first access management network element.
  • the first access management network element receives the seventh message sent by the second access management network element.
  • the seventh message is used to indicate that the second PDU session is successfully established.
  • the following describes a specific implementation manner for the second access management network element to send the seventh message to the first access management network element with reference to the architectures shown in FIG. 7(a)-FIG. 7(b).
  • the second access management network element sends the fifth message to the N3IWF; the N3IWF sends the seventh message to the first access management network element.
  • the second access management network element sends the seventh message to the N3IWF; the N3IWF sends the seventh message to the first user plane network element; the first user plane network element sends the seventh message to the first user plane network element.
  • a session management network element sends the seventh message; the first session management network element sends the seventh message to the first access management network element.
  • the second access management network element directly sends the seventh message to the first access management network element.
  • the first access management network element executes the process of establishing the first PDU session according to the seventh message.
  • the first access management network element may acquire the IP address of the second PDU session from the second access management network element.
  • the first access management network element may send the IP address of the second PDU session to the first user plane network element.
  • the first session management network element will configure the IP address of the first PDU session, and send the IP address of the first PDU session to the first user plane network element. Therefore, the first user plane network element can learn the association relationship between the IP address of the first PDU session and the IP address of the second PDU session.
  • the first user plane network element forwards the data packets of the terminal device between the first PDU session and the second PDU session according to the association relationship.
  • the first access management network element may send the IP address of the second PDU session to the first user plane network element, which may be specifically implemented as: the first access management network element sends the eighth message to the first session management network element.
  • the eighth message includes the IP address of the second PDU session.
  • the first session management network element obtains the IP address of the second PDU session according to the eighth message, and then sends the IP address of the second PDU session to the first user plane network element.
  • the eighth message further includes an identifier of the first PDU session and an identifier of the second PDU session.
  • the above-mentioned eighth message may be a PDU session context creation request message, such as Nsmf_PDUSession_CreateSMContext Request.
  • the first session management network element may send a second routing rule to the first user plane network element, where the second routing rule includes the IP address of the first PDU session and the IP address of the second PDU session, so as to realize the The purpose of a user plane network element sending the IP address of the first PDU session and the IP address of the second PDU session.
  • the first session management network element may send the second routing rule to the first user plane network element, which may be specifically implemented as: the first session management network element sends an N4 session creation/modification message to the first user plane network element,
  • the N4 session create/modify message includes a second routing rule.
  • the above-mentioned second routing rule may include a packet detection rule (packet detection rule, PDR) and a forwarding action rule (forwarding action rule, FAR).
  • PDR packet detection rule
  • FAR forwarding action rule
  • the second routing rule is used to instruct to modify the source address of the upstream data packet from the IP address of the first PDU session to the IP address of the second PDU session, and send the modified upstream data packet to the second network (for example, the second user plane network element).
  • the PDR in the second routing rule may include the IP address of the first PDU session
  • the FAR corresponding to the PDR may include the IP address of the second PDU session.
  • the first user plane network element assigns the source address of the uplink data packet to the FAR corresponding to the PDR. Modify it to the IP address of the second PDU session, and send the modified uplink data packet to the second network.
  • the second routing rule is also used to instruct to modify the destination address of the downlink data packet from the IP address of the second PDU session to the IP address of the first PDU session, and send the modified uplink data packet to the service terminal.
  • the access network device of the device is also used to instruct to modify the destination address of the downlink data packet from the IP address of the second PDU session to the IP address of the first PDU session, and send the modified uplink data packet to the service terminal.
  • the PDR in the second routing rule may include the IP address of the second PDU session
  • the FAR corresponding to the PDR may include the IP address of the first PDU session.
  • the first user plane network element assigns the destination IP address of the downlink data packet to the FAR corresponding to the PDR.
  • the address is modified to the IP address of the first PDU session, and the modified downlink data packet is sent to the access network device serving the terminal device.
  • the access network device forwards the downlink data packet to the terminal device.
  • the above-mentioned first user plane network element and the first session management network element belong to the first network.
  • the first user plane network element may be a UPF or a network element that undertakes a user plane function in a future network.
  • the first session management network element may be an SMF or a network element in a future network that undertakes a session management function.
  • the first access management network element may perform the following step S403.
  • the first access management network element sends a ninth message to the terminal device.
  • the terminal device receives the ninth message sent by the first access management network element.
  • the ninth message is used to indicate that the first PDU session is successfully established.
  • the first access management network element initiates the establishment process of the first PDU session to establish the first PDU session. Therefore, it is possible to associate the first PDU session with the second PDU session, thereby opening up a data channel from the terminal device to the second network.
  • the following describes a specific implementation of the network interworking method shown in FIG. 11 applied to the interworking architecture of the first network and the second network shown in FIG. 7( a ) or FIG. 7( b ).
  • the network interworking method includes the following steps:
  • step S501 reference may be made to step S101 in FIG. 11 .
  • step S102 in FIG. 11 may be referred to.
  • the second access management network element selects a second session management network element.
  • the second access management network element sends a PDU session context creation request message to the second session management network element.
  • the second session management network element receives the PDU session context creation request message from the second access management network element.
  • the PDU session context creation request message includes the identifier of the second PDU session.
  • the PDU session context creation request message may have other names, such as Nsmf_PDUSession_CreateSMContext Request, which is not limited.
  • the second session management network element may create the context of the second PDU session.
  • the second session management network element sends a PDU session context creation response message to the second access management network element.
  • the second access management network element receives the PDU session context creation response message from the second session management network element.
  • the second session management network element selects a second user plane network element.
  • the second session management network element may configure the IP address of the second PDU session.
  • the second session management network element sends an N4 session establishment/modification request (N4 Session Establishment/Modification Request) message to the second user plane network element.
  • N4 Session Establishment/Modification Request N4 Session Establishment/Modification Request
  • the second user plane network element receives the N4 session establishment/modification request message from the second session management network element.
  • the N4 session establishment/modification request message is used to establish the context of the N4 session of the second PDU session.
  • the N4 session establishment/modification request message includes the IP address of the second PDU session.
  • the N4 session establishment/modification request message may include a third routing rule.
  • the third routing rule is used to send the downlink data packet of the second PDU session to the N3IWF; in other words, the third routing rule is used to send the downlink data packet whose destination address is the IP address of the second PDU session to the N3IWF.
  • the second user plane network element sends an N4 session establishment/modification response (N4 Session Establishment/Modification Response) message to the second session management network element.
  • the second session management network element receives the N4 session establishment/modification response message from the second user plane network element.
  • the second session management network element sends a Namf_Communication_N1N2MessageTransfer message to the second access management network element.
  • the second access management network element receives the Namf_Communication_N1N2MessageTransfer message sent by the second session management network element.
  • the Namf_Communication_N1N2MessageTransfer message includes the identifier of the second PDU session, the N2 session management (session management, SM) information, and the N1 SM container (container).
  • the N2 SM information may include an identifier of the second PDU session, quality of service (quality of service, QoS) configuration information, core network (core network, CN) tunnel information, and the type of the second PDU session. It should be understood that the N2 SM information may also directly include the above-mentioned first routing rule, or parameters for configuring the first routing rule (such as the IP address of the second PDU session, etc.).
  • the N1 SM container may include a PDU session establishment accept message.
  • the PDU session establishment accept message may include the QoS rule, the type of the second PDU session and the IP address of the second PDU session. It should be understood that the N1 SM container may also include other parameters, which are not listed one by one here.
  • the second access management network element sends an N2 PDU session establishment request message to the N3IWF.
  • the N3IWF receives the N2 PDU session establishment request message sent by the second access management network element.
  • the N2 PDU session establishment request message includes N2 SM information and NAS message.
  • the NAS message includes the identification of the second PDU session and the N1 SM container.
  • the N3IWF may obtain the first routing rule from the N2 SM message.
  • the N3IWF may configure the first routing rule according to the parameters included in the N2 SM information for configuring the first routing rule.
  • the first routing rule is used to instruct to forward the upstream data packet whose source address is the IP address of the second PDU session to the second user plane network. Yuan. Or, the first routing rule is used to instruct to forward the downlink data packet whose destination address is the IP address of the second PDU session to the first user plane network element.
  • the N3IWF sends a NAS message to the first access management network element.
  • the first access management network element receives the NAS message sent by the N3IWF.
  • the N3IWF sends the NAS message to the first access management network element.
  • the N3IWF sends the NAS message to the first user plane network element, the first user plane network element sends the NAS message to the first session management network element, and the first session management network element sends the NAS message to the first session management network element.
  • the network element sends the NAS message to the first access management network element.
  • step S510 and step S511 can cause the second access management network element to send a PDU session establishment accept message to the first access management network element, which is equivalent to implementing step S401 in FIG. 11 .
  • the N3IWF may send an N2 PDU session establishment response message to the second access management network element.
  • steps S502-S511 only describe some steps in the second PDU session establishment process, and the second PDU session establishment process may also include other steps, which are not limited thereto.
  • the first access management network element selects a first session management network element.
  • the first access management network element sends a PDU session context creation request message to the first session management network element.
  • the first session management network element receives the PDU session context creation request message from the first access management network element.
  • the PDU session context creation request message includes the identifier of the first PDU session and the IP address of the second PDU session.
  • the first session management network element may create the context of the first PDU session.
  • the first session management network element sends a PDU session context creation response message to the first access management network element.
  • the first access management network element receives the PDU session context creation response message from the first session management network element.
  • the first session management network element selects the first user plane network element.
  • the first session management network element configures the IP address of the first PDU session.
  • the first session management network element sends an N4 session establishment/modification request message to the first user plane network element.
  • the first user plane network element receives the N4 session establishment/modification request message from the first session management network element.
  • the N4 session establishment/modification request message is used to establish the context of the N4 session of the first PDU session.
  • the N4 session establishment/modification request message includes the IP address of the first PDU session and the IP address of the second PDU session.
  • the N4 session establishment/modification request message includes the second routing rule.
  • the second routing rule For the specific description of the second routing rule, reference may be made to the foregoing specific introduction, which will not be repeated here.
  • S517 The first user plane network element sends an N4 session establishment/modification response message to the first session management network element.
  • the second session management network element receives the N4 session establishment/modification response message from the second user plane network element.
  • the first session management network element sends a Namf_Communication_N1N2MessageTransfer message to the first access management network element.
  • the first access management network element receives the Namf_Communication_N1N2MessageTransfer message sent by the first session management network element.
  • the Namf_Communication_N1N2MessageTransfer message includes the identifier of the first PDU session, the N2 session management (session management, SM) information, and the N1 SM container (container).
  • the N2 SM information may include an identifier of the first PDU session, quality of service (quality of service, QoS) configuration information, core network (core network, CN) tunnel information and the type of the first PDU session. It should be understood that the N2 SM information may further include a fourth routing rule, or a parameter for configuring the fourth routing rule (eg, the IP address of the first PDU session). The fourth routing rule is used by the first access network device to forward the data packets of the first PDU session.
  • the N1 SM container may include a PDU session establishment accept message.
  • the PDU session establishment accept message may include the QoS rule, the type of the first PDU session and the IP address of the first PDU session. It should be understood that the N1 SM container may also include other parameters, which are not listed one by one here.
  • the first access management network element sends an N2 PDU session establishment request message to the first access network device.
  • the first access network device receives the N2 PDU session establishment request message sent by the first access management network element.
  • the N2 PDU session establishment request message includes N2 SM information and NAS message.
  • the NAS message includes the identification of the first PDU session and the N1 SM container.
  • the first access network device may obtain the fourth routing rule from the N2 SM information; or, the first access network device is configured to configure Fourth routing rule.
  • the fourth routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the first PDU session to the first user plane network element.
  • the fourth routing rule is further used to instruct to forward the downlink data packet whose destination address is the IP address of the first PDU session to the terminal device.
  • the first access network device sends a NAS message to the terminal device.
  • the terminal device receives the NAS message from the first access network device.
  • the NAS message includes an N1 SM container, and the N1 SM container includes a PDU session establishment accept message.
  • steps S519 and S520 can cause the first access management network element to send a PDU session establishment accept message to the terminal device, which is equivalent to implementing S402 in FIG. 11 .
  • the first access network device may send an N2 PDU session establishment response message to the first access management network element.
  • steps S512-S520 only describe a part of the steps in the establishment process of the first PDU session, and the establishment process of the first PDU session may also have other steps, which are not limited.
  • the terminal device can transmit data to the second network through the first network, or the terminal device can receive data delivered by the second network through the first network.
  • the method includes the following steps:
  • a terminal device sends a first data packet to a first access network device.
  • the first data packet may include the IP address of the first PDU session.
  • the first access network device sends a first data packet to the first user plane network element.
  • the first access network device forwards the first data packet to the first user plane network element based on the routing rule configured in the first PDU session establishment process.
  • the first user plane network element sends the second data packet to the N3IWF based on the first data packet.
  • the first user plane network element replaces the IP address of the first PDU session in the first data packet with the IP address of the second PDU to generate a second data packet; the first user plane network element passes The preset security tunnel with the N3IWF sends the second data packet to the N3IWF.
  • the N3IWF sends the second data packet to the second user plane network element.
  • the N3IWF forwards the second data packet to the second user plane network element based on the routing rule configured in the second PDU session establishment process.
  • the second user plane network element may forward the second data packet to a corresponding data network.
  • the terminal device can send data to the second network through the first network.
  • the method includes the following steps:
  • the second user plane network element sends a third data packet to the N3IWF.
  • the third data packet includes the IP address of the second PDU session.
  • the third data packet may be sent by the data network to the second user plane network element.
  • the N3IWF sends a third data packet to the first user plane network element.
  • the N3IWF sends the third data packet to the first user plane network element through a pre-established security tunnel with the first user plane network element.
  • the N3IWF forwards the third data packet to the first user plane network element according to the first routing rule configured in the second PDU session establishment process.
  • the first user plane network element sends a fourth data packet to the first access network device based on the third data packet.
  • the first user plane network element replaces the IP address of the second PDU session in the third data packet with the IP address of the first PDU session to generate a fourth data packet; the first user plane network element Based on the second routing rule configured in the first PDU session establishment process, a fourth data packet is sent to the first access network device.
  • the first access network device sends a fourth data packet to the terminal device.
  • the terminal device may acquire data from the second network through the first network.
  • the network interworking method includes the following steps:
  • S801-S814 are similar to steps S510-S514, and the specific description can refer to the embodiment shown in FIG. 12, and details are not repeated here.
  • the N3IWF may acquire the first routing rule from the N2 SM message.
  • the N3IWF may configure the first routing rule according to the parameters included in the N2 SM information for configuring the first routing rule.
  • the first routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the second PDU session to the second user plane network element.
  • the first routing rule is used to instruct to forward the downlink data packet whose destination address is the IP address of the second PDU session to the first access management network element.
  • the PDU session context creation request message sent by the first access management network element to the first session management network element may include third indication information, and the third indication information is used to indicate that the first access The management network element is responsible for transmitting the data packets of the first PDU session. Therefore, the first session management network element may not need to select the first user plane network element, nor perform interactive operations with the first user plane network element (for example, sending an N4 session establishment/modification request message to the first user plane network element, or Receive N4 session establishment/modification response message from the first user plane network element).
  • the first session management network element may also select the first user plane network element, and perform an interactive operation with the first user plane network element. It should be understood that, in the architecture shown in Figure 7(c), even if the first session management network element selects the first user plane network element, the first user plane network element cannot actually be used to be responsible for data packets between the first PDU session and the first user plane network element. Transmission between second PDU sessions.
  • the first session management network element sends a Namf_Communication_N1N2MessageTransfer message to the first access management network element.
  • the first access management network element receives the Namf_Communication_N1N2MessageTransfer message sent by the first session management network element.
  • the Namf_Communication_N1N2MessageTransfer message includes the identifier of the first PDU session, the N2 session management (session management, SM) information, and the N1 SM container (container).
  • the first access management network element may configure a fifth routing rule, and the fifth routing rule is used for the first access management network element to be responsible for data packets in the first PDU session and the second PDU. Forwarding between sessions.
  • the fifth routing rule is used to modify the source address of the uplink data packet from the IP address of the first PDU session to the IP address of the second PDU session, and forward the modified uplink data packet to the second network (for example, N3IWF). or the second user plane network element).
  • the second network for example, N3IWF. or the second user plane network element.
  • the fifth routing rule is also used to modify the target IP address of the downlink data packet from the IP address of the second PDU session to the IP address of the first PDU session, and forward the modified downlink data packet to the first connection. access equipment.
  • S812-S815 are optional.
  • S816-S817, steps S519-S520 in FIG. 11 may be referred to.
  • a first PDU session based on the control plane is established in the first network
  • a second PDU session based on the user plane is established in the second network . Therefore, the terminal device can transmit data to the second network through the first network, and the terminal device can receive data delivered by the second network through the first network.
  • the method includes the following steps:
  • the terminal device sends a NAS message to the first access network device.
  • the NAS message includes the identifier of the first PDU session and the first data packet.
  • the first access network device sends a NAS message to the first access management network element.
  • the first access network device only performs transparent transmission between the terminal device and the first access management network element, and will not perform other processing on the NAS message.
  • the first access management network element sends the second data packet to the N3IWF according to the NAS message.
  • the first access management network element replaces the IP address of the first PDU session in the first data packet with the IP address of the second PDU to generate the second data packet.
  • the first access management network element sends the second data packet to the N3IWF through the secure tunnel with the N3IWF.
  • the N3IWF sends the second data packet to the second user plane network element.
  • the N3IWF forwards the second data packet to the second user plane network element based on the routing rule configured in the second PDU session establishment process.
  • the second user plane network element may forward the second data packet to a corresponding data network.
  • the terminal device can send data to the second network through the first network.
  • the method includes the following steps:
  • the second user plane network element sends a third data packet to the N3IWF.
  • the third data packet includes the IP address of the second PDU session.
  • the third data packet may be sent by the data network to the second user plane network element.
  • the N3IWF sends a third data packet to the first access management network element.
  • the N3IWF sends the third data packet to the first access management network element through a pre-established security tunnel with the first access management network element.
  • the N3IWF forwards the third data packet to the first access management network element according to the first routing rule configured in the second PDU session establishment process.
  • the first access management network element sends a downlink NAS transport (downlink NAS transport) message to the first access network device based on the third data packet.
  • downlink NAS transport downlink NAS transport
  • the downlink NAS transport (downlink NAS transport) message includes the identifier of the first PDU session and the fourth data packet.
  • the first access management network element replaces the IP address of the second PDU session in the third data packet with the IP address of the first PDU session to generate a fourth data packet.
  • the first access network device sends a radio resource control (radio resource control, RRC) downlink message to the terminal device.
  • RRC radio resource control
  • the RRC downlink message includes a fourth data packet.
  • the terminal device can receive data under the second network through the first network.
  • the method includes:
  • S101 Refer to the description of S101 in FIG. 11 .
  • S102 Refer to the description of S102 in FIG. 11 .
  • the method may further include the following steps:
  • the second access management network element sends a tenth message to the first access management network element.
  • the first access management network element receives the tenth message sent by the second access management network element.
  • the tenth message is used to indicate that the establishment of the second PDU session fails.
  • the first access management network element sends an eleventh message to the terminal device according to the tenth message.
  • the terminal device receives the eleventh message sent by the first access management network element.
  • the eleventh message is used to indicate that the establishment of the first PDU session fails.
  • the first access management network element only needs to send the eleventh message to the terminal device, instead of executing the process of establishing the PDU session in the related art. some other steps, thereby helping to save signaling overhead and corresponding resource consumption.
  • the terminal device needs to have the authority to access the second network through the first network to use the services provided by the second network.
  • the terminal device used by the employee needs to have the authority to access the public network from the company's private network.
  • the terminal device used by the employee needs to have the authority to access the public network from the company's private network.
  • the terminal device used by the employee needs to have the authority to access the public network from the company's private network.
  • the terminal equipment used by the customer through the public network.
  • the terminal device does not need to have the authority to access the second network through the first network to ensure privacy.
  • the first network as a private network and the second network as an example, when employees are developing technologies, it is necessary to prohibit the terminal devices used by employees from accessing the public network through the company's private network to avoid technology leakage. .
  • the embodiments of the present application provide technical solutions as shown in FIG. 17 and FIG. 19 below.
  • the technical solution shown in FIG. 17 is used to enable the terminal device to access the first slice.
  • the technical solution shown in FIG. 19 is used to disable the permission of the terminal device to access the first slice. In this way, the management and control of the terminal device's right to access the second network through the first network can be indirectly realized by controlling the right of the terminal device to access the first slice.
  • FIG. 17 or FIG. 19 can be used in combination with any one of the technical solutions shown in the foregoing FIG. 8 to FIG. 16 .
  • a method for network interworking provided by an embodiment of the present application includes the following steps:
  • the first access management network element determines to enable the authority of the terminal device to access the first slice.
  • opening can also be replaced with descriptions such as provide, grant, accept, enable, activate, etc., which are not limited thereto.
  • step S601 may adopt any one of the following implementation manners:
  • the first access management network element receives the first indication information sent by the management system, where the first indication information is used to instruct the terminal device to open the authority to access the first slice.
  • the above management system may be an operation and maintenance management (operation administration and maintenance) system.
  • the first access management network element determines, according to a locally configured policy, the permission to enable the terminal device to access the first slice.
  • the above-mentioned locally configured policy may be determined based on time or the location where the terminal device is located.
  • the first access management network element receives the fourteenth message sent by the second access management network element.
  • the fourteenth message is used to instruct to open the access authority of one or more second slices corresponding to the first slice.
  • the first access management network element sends a twelfth message to the terminal device.
  • the terminal device receives the twelfth message sent by the first access management network element.
  • the twelfth message is used to indicate to enable the permission of the terminal device to access the first slice.
  • the twelfth message includes the allowed NSSAI
  • the allowed NSSAI includes the S-NSSAI of the first slice.
  • the twelfth message may be a user equipment configuration update command (UE configuration update command) message or a downlink NAS transport message (DL NAS transport message) or other NAS messages.
  • UE configuration update command user equipment configuration update command
  • DL NAS transport message downlink NAS transport message
  • the first access management network element may also send a registration request message to the second access management network element, and the specific implementation of the registration request message may refer to the second message in the above-mentioned registration scenario. . Afterwards, after the first access management network element receives the registration acceptance message sent by the second access management network element, the first access management network element performs step S602 again.
  • the first access management network element makes the terminal device know that it has the right to access the first slice through the twelfth message. Therefore, the allowed NSSAI maintained locally by the terminal device includes the S-NSSAI of the first slice. Furthermore, when the terminal device needs to use related services of the second network, the terminal device may initiate a related process of accessing the first slice (eg, step S101 in FIG. 8 ).
  • the method includes:
  • S1301 Refer to the description of S1201 in FIG. 17 .
  • the first access management network element determines to enable the terminal device to access the first slice
  • the first access management network element first requests the second access management network element to access the first slice.
  • Second network In the case of allowing access to the second network, the first access management network element sends a twelfth message to the terminal device to enable the terminal device to access the first slice. In this way, it is ensured that the terminal device can access the first slice when the terminal device needs to access the first slice subsequently.
  • the first access management network element does not send the twelfth message to the terminal device, so as to avoid the terminal device from initiating unnecessary procedures (for example, a procedure related to accessing the first slice), thereby reducing unnecessary signaling overhead.
  • a method for network interworking provided by an embodiment of the present application includes the following steps:
  • the first access management network element determines to disable the authority of the terminal device to access the first slice.
  • shutdown may adopt other description methods, such as not provide (Not provide), abolish/revoke (revoke), reject (reject), disable (disable), and deactivate (disactivate), which is not made in this embodiment of the present application. limit.
  • step S1401 may adopt any one of the following implementation manners:
  • the first access management network element receives second indication information sent by the management system, where the second indication information is used to instruct the terminal device to close the authority to access the first slice.
  • Implementation mode 2 The first access management network element determines, according to a locally configured policy, to disable the authority of the terminal device to access the first slice.
  • the above-mentioned locally configured policy may be determined based on time or the location where the terminal device is located.
  • Implementation Mode 3 The first access management network element receives a fifteenth message sent by the second access management network element, where the fifteenth message is used to disable the permissions of all second slices corresponding to the first slice.
  • the first access management network element needs to perform a corresponding PDU session release process, to release the first PDU session and the second PDU session.
  • the first access management network element may initiate a de-registration process associated with the second identity information in the second network.
  • the first access management network element sends a deregistration request message to the second access management network element; after that, the first access management network element receives the deregistration complete message sent by the second access management network element.
  • the first access management The network element should not initiate a deregistration procedure associated with the second identity information in the second network. In this way, the normal use of the terminal device that has the right to access the first slice is avoided.
  • the first access management network element deletes the security context information related to the second identity information and the like. In this way, the first access management network element can be prevented from storing unnecessary information, and the storage space of the first access management network element can be saved.
  • the first access management network element may also delete the association relationship between the second identity information and the identification information of the first slice. This is equivalent to decoupling the second identity information from the first slice, and the first access management network element can use the second identity information to bind other network slices.
  • the first access management network element may also delete the association relationship between the second identity information and the first identity information. This is equivalent to recycling the second identity information, and the first access management network element can use the second identity information to proxy other terminal devices in the first network to access the second network.
  • the first access management network element sends a thirteenth message to the terminal device.
  • the terminal device receives the thirteenth message sent by the first access management network element.
  • the thirteenth message is used to instruct to close the authority of the terminal device to access the first slice.
  • the thirteenth message includes the rejected NSSAI, and the rejected NSSAI includes the S-NSSAI of the first slice.
  • the thirteenth message may be a user equipment configuration update command (UE configuration update command) message or a downlink NAS transport message (DL NAS transport message) or other NAS messages.
  • UE configuration update command user equipment configuration update command
  • DL NAS transport message downlink NAS transport message
  • the first access management network element may disable the access authority of the terminal device to the first slice through the thirteenth message, so as to realize the management and control of the terminal device accessing the first slice.
  • the first access management network element and the terminal device include corresponding hardware structures and/or software modules for performing each function.
  • the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present application.
  • the first access management network element and the terminal device may be divided into functional units according to the foregoing method examples.
  • each functional unit may be divided corresponding to each function, or two or more functions may be integrated in in a processing unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and other division methods may be used in actual implementation.
  • a communication apparatus provided by an embodiment of the present application includes a processing module 201 and a communication module 202 .
  • the processing module 201 is configured to parse a message (such as a first message, etc.), and generate a message (such as a second message, etc.), step S402 in FIG. 11 , Step S512 in FIG. 12 , step S1201 in FIG. 17 , step S1301 in FIG. 18 , step S1401 in FIG. 19 , and other processing operations that the first access management network element needs to perform.
  • the communication module 202 is configured to execute steps S101-S102 in FIG. 8, steps S201-S202 in FIG. 9, steps S301-S302 in FIG. 10, steps S401 and S403 in FIG. 11, steps S501 and S502 in FIG.
  • the processing module 201 is configured to generate a message (eg, a first message, etc.), parse a message (eg, a sixth message, etc.), and/or other processing operations that the terminal device needs to perform.
  • the communication module 202 is configured to perform step S101 in FIG. 8 , step S202 in FIG. 9 , step S302 in FIG. 10 , step S403 in FIG. 11 , steps S501 and S520 in FIG. Step S601, Step S704 in Fig. 13(b), Steps S801 and S812 in Fig. 14, Step S901 in Fig. 15(a), Step S1004 in Fig. 15(b), Step S1102 in Fig. 16, Fig. Step S1202 in 17, step S1304 in FIG. 18, step S1402 in FIG. 19, and/or other communication operations that the terminal device needs to perform.
  • the processing module 201 is configured to obtain a first routing rule in the process of establishing a second PDU session for the terminal device in the second network, and the first routing rule is used to forward the second PDU. session packets.
  • the communication module 202 is configured to forward the data packets of the second PDU session according to the first routing rule.
  • the first routing rule is used to instruct to forward the uplink data packet whose source address is the IP address of the second PDU session to the second user plane network element serving the second PDU session.
  • the communication module 202 is specifically configured to receive the uplink data packet of the second PDU session from the first user plane network element or the first access management network element of the first network; The second user plane network element serving the second PDU session sends the uplink data packet of the second PDU session.
  • the first routing rule is also used to indicate that the downlink data packet whose destination address is the IP address of the second PDU session is forwarded to the first access management network element or the first user plane network in the first network. Yuan.
  • the communication module is specifically configured to receive the downlink data packet of the second PDU session from the second user plane network element serving the second PDU session;
  • the user plane network element or the first access management network element sends the uplink data packet of the second PDU session.
  • the communication device may further include a storage module 203 for storing program codes and data of the communication device, and the data may include but not limited to original data or intermediate data and the like.
  • the processing module 201 may be a processor or a controller, such as a central processing unit (Central Processing Unit, CPU), a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application-Specific Integrated Circuit) Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute the various exemplary logical blocks, modules and circuits described in connection with this disclosure.
  • a processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.
  • the communication module 202 may be a communication interface, a transceiver or a transceiver circuit, or the like. The following description will be given by taking the communication module 202 as the communication interface as an example.
  • the communication interface may include multiple interfaces, for example, may include an interface between a base station and a terminal and/or other interfaces.
  • the storage module 203 may be a memory.
  • the processing module 201 is a processor
  • the communication module 202 is a communication interface
  • the storage module 203 is a memory
  • the communication apparatus involved in the embodiment of the present application may be as shown in FIG. 21 .
  • the communication device includes: a processor 301 , a communication interface 302 , and a memory 303 .
  • the communication device may further include a bus 304 .
  • the communication interface 302, the processor 301 and the memory 303 can be connected to each other through a bus 304;
  • the bus 304 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus etc.
  • the bus 304 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is shown in FIG. 21, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present application further provides a computer program product carrying computer instructions, when the computer instructions are executed on the computer, the computer can execute the methods in the above-mentioned FIGS. 8-19 .
  • an embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, and when the computer instructions are executed on the computer, the computer is made to execute the above-mentioned FIG. 8-FIG. 19 . method.
  • an embodiment of the present application further provides a chip, including: a processing circuit and a transceiver pin, where the processing circuit and the transceiver pin are used to implement the methods in the foregoing FIG. 8 to FIG. 19 .
  • the processing circuit is used for executing the processing actions in the corresponding method
  • the transceiver pins are used for executing the actions of receiving/transmitting in the corresponding method.
  • an embodiment of the present application further provides a communication system, where the communication system includes a first access management network element and an N3IWF.
  • the first access management network element is configured to execute any of the methods shown in the above-mentioned FIG. 8 to FIG. 19 .
  • the N3IWF is used to perform any of the methods shown in Figures 12 to 15(b).
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, digital video disc (DVD)), or semiconductor media (eg, solid state disk (SSD)) Wait.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple devices. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each functional unit may exist independently, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.
  • the present application can be implemented by means of software plus necessary general-purpose hardware, and of course hardware can also be used, but in many cases the former is a better implementation manner .
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that make contributions to the prior art.
  • the computer software products are stored in a readable storage medium, such as a floppy disk of a computer. , a hard disk or an optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种网络互通的方法及装置，涉及通信技术领域，用于在第一网络和第二网络互通的架构下，增强第一网络对终端设备接入第二网络的控制。该方法包括：第一网络中的第一接入管理网元接收终端设备发送的第一切片的标识信息，第一切片是与第二网络的业务相关的切片；第一接入管理网元根据第一切片的标识信息，向第二网络中的第二接入管理网元请求接入第二网络。

Description

网络互通的方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种网络互通的方法及装置。
背景技术
目前，在第一网络和第二网络互通的架构下，位于第一网络覆盖区域内的终端设备可以通过第一网络接入第二网络。但是，第一网络无法获知终端设备是否接入网络，也无法控制终端设备是否可以接入网络。针对这一问题，业界尚未给出相应的解决方案。
发明内容
本申请提供一种网络互通的方法及装置，用于在第一网络和第二网络互通的架构下，用于增强第一网络对终端设备接入第二网络的控制。
第一方面，提供一种网络互通的方法，该方法包括：第一网络中的第一接入管理网元接收终端设备发送的第一切片的标识信息，第一切片是与第二网络的业务相关的切片；第一接入管理网元根据第一切片的标识信息，向第二网络中的第二接入管理网元请求接入第二网络。
基于上述技术方案，第一接入管理网元接收到终端设备发送的第一切片的标识信息。由于第一切片是与第二网络的业务相关的切片，因此第一接入管理网元能够根据第一切片的标识信息，获知终端设备想要接入第二网络。从而，第一网络中的第一接入管理网元向第二网络中的第二接入管理网元请求访问第二网络。可见，第一网络中的第一接入管理网元可以获知终端设备要接入第二网络，也能控制终端设备接入第二网络。本申请提供的技术方案能够增强第一网络对终端设备接入第二网络的控制。
另外，现有技术中终端设备和第二网络可以直接交互信息，而第一网络仅负责透传终端设备和第二网络之间交互的信息，因此终端设备需要与第二网络中的安全网关(例如非3GPP互通功能(non-3GPP interworking function，N3IWF)网元)建立互联网安全协议(internet protocol security，IPsec)隧道，以保证通信安全。本申请提供的技术方案中，由第一接入管理网元代理终端设备请求接入第二网络，而终端设备不直接与第二网络交互信息，因此终端设备无需与安全网关(例如N3IWF)建立IPsec隧道，因此终端设备无需支持IPsec协议栈，从而减少终端设备的制造成本。
一种可能的设计中，该方法还包括：第一接入管理网元获取第一身份信息；第一接入管理网元向第二接入管理网元发送第二身份信息，第一身份信息用于在第一网络中标识终端设备，第一身份信息不同于第二身份信息。应理解，由于第一身份信息用于在第一网络中标识终端设备，因此第二网络中的网元可能不能识别第一身份信息。从而，第一接入管理网元通过向第二接入管理网元发送第二身份信息，以使用第二身份信息与第二接入管理网元进行通信。相应的，第二接入管理网元可以视使用第二身份信息的第一接入管理网元作为普通终端设备进行接入管理。
一种可能的设计中，第一身份信息为国际移动用户识别码(international mobile subscriber identity，IMSI)、用户永久标识符(subscriber permanent identifier，SUPI)、 用户隐藏标识符(subscriber concealed identifier，SUCI)或者全局唯一的临时用户设备(user equipment，UE)标识(globally unique temporary UE identity，GUTI)；第二身份信息为IMSI、SUPI、SUCI或者GUTI。
一种可能的设计中，该方法还包括：第一接入管理网元建立第一身份信息和第二身份信息之间的关联关系。这样一来，第一接入管理网元可以实现代理终端终端设备与第二网络进行通信的目的。例如，基于第一身份信息和第二身份信息之间的关联关系，第一接入管理网元在从第二网络中的相关网元(例如第二接入管理网元)接收到与第二身份信息有关的消息A之后，可以对消息A进行解析以获取消息A携带的内容，并将消息A携带的全部或者部分内容封装为消息B发送给终端设备。又例如，基于第一身份信息和第二身份信息之间的关联关系，第一接入管理网元在接收到终端设备发送的、与第一切片相关的消息C之后，可以解析消息C以获取消息C所携带的内容，将消息C所携带的全部或者部分内容封装为消息D，使用第二身份信息将消息D发送给第二网络中的相关网元(例如第二接入管理网元)。
一种可能的设计中，第一切片是第一网络中的切片，第一接入管理网元根据第一切片的标识信息向第二网络中的第二接入管理网元请求接入第二网络，包括：第一接入管理网元根据第一切片的标识信息向第二网络中的第二接入管理网元请求接入第二网络的第二切片，第二切片与第一切片相关联。这样一来，第一接入管理网元代理终端设备接入第二切片，从而使得终端设备能够使用第二切片提供的服务。
一种可能的设计中，第一切片的标识信息包括在第一消息中，第一消息用于请求注册到第一网络。
一种可能的设计中，第一消息包括第一请求的(requested)网络切片选择辅助信息(network slice selection assistance information，NSSAI)，第一requested NSSAI包括第一切片的单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)。
一种可能的设计中，第一接入管理网元根据第一切片的标识信息，向第二网络中的第二接入管理网元请求接入第二网络，包括：第一接入管理网元根据第一切片的标识信息向第二网络中的第二接入管理网元发送第二消息，第二消息用于请求注册到第二网络。
一种可能的设计中，该方法还包括：第一接入管理网元接收第二接入管理网元发送的第三消息，第三消息用于表示注册成功；第一接入管理网元根据第三消息，向终端设备发送第四消息，第四消息用于表示允许终端设备具有接入第一切片的权限。
一种可能的设计中，第四消息用于允许终端设备具有接入第一切片的权限，包括：第四消息包括第一切片的标识信息。
一种可能的设计中，第四消息用于允许终端设备具有接入第一切片的权限，包括：第四消息包括第一允许的(allowed)NSSAI，第一allowed NSSAI包括第一切片的S-NSSAI。
一种可能的设计中，该方法还包括：第一接入管理网元接收第二接入管理网元发送的第五消息，该第五消息用于表示不允许使用第二网络的业务；第一接入管理网元根据第五消息，向终端设备发送第六消息，第六消息用于表示不允许终端设备接入第 一切片。
一种可能的设计中，第六消息用于表示不允许终端设备接入第一切片，可以实现为：第六消息包括第一切片的标识信息。
一种可能的设计中，第六消息用于表示不允许终端设备接入第一切片，可以实现为：第六消息包括第一拒绝的(rejected)NSSAI，所述第一rejected NSSAI包括所述第一切片的S-NSSAI。
一种可能的设计中，第一切片的标识信息包括在第一消息中，第一消息用于请求建立第一切片关联的第一协议数据单元(protocol data unit，PDU)会话。
一种可能的设计中，第一接入管理网元根据第一切片的标识信息向第二网络中的第二接入管理网元请求接入第二网络，包括：第一接入管理网元根据第一切片的标识信息，向第二网络中的第二接入管理网元发送第二消息，第二消息用于请求建立第一切片相关的第二PDU会话。
一种可能的设计中，第一消息包括第一PDU会话的标识，第二消息包括第二PDU会话的标识。
一种可能的设计中，该方法还包括：第一接入管理网元接收第二接入管理网元发送的第七消息，第七消息用于表示第二PDU会话建立成功；第一接入管理网元根据第七消息，向终端设备发送第九消息，第九消息用于表示第一PDU会话建立成功。
一种可能的设计中，该方法还包括：第一接入管理网元从第二接入管理网元获取第二PDU会话的IP地址；第一接入管理网元向第一网络中的第一用户面网元发送第二PDU会话的IP地址。这样一来，第一用户面网元可以获知第二PDU会话的IP地址，继而可以实现在第一PDU会话和第二PDU会话之间的数据转发。
一种可能的设计中，该方法还包括：第一接入管理网元接收第二接入管理网元发送的第十消息，该第十消息用于表示第二PDU会话建立失败；第一接入管理网元根据第十消息，向终端设备发送第十一消息，该第十一消息用于表示第一PDU会话建立失败。
一种可能的设计中，该方法还包括：第一接入管理网元确定开启终端设备接入第一切片的权限；第一接入管理网元向终端设备发送第十二消息，第十二消息用于指示开启终端设备接入第一切片的权限。基于该设计，间接实现了对终端设备通过第一网络接入第二网络的权限的管控。
一种可能的设计中，第十二消息用于指示开启第一切片的权限，包括：第十二消息包括第一切片的标识信息。
一种可能的设计中，第十二消息用于指示开启第一切片的权限，包括：第十二消息包括第二allowed NSSAI，第二allowed NSSAI包括第一切片的S-NSSAI。
一种可能的设计中，该方法还包括：第一接入管理网元确定关闭终端设备接入第一切片的权限；第一接入管理网元向终端设备发送第十三消息，第十三消息用于指示关闭终端设备接入第一切片的权限。基于该设计，间接实现了对终端设备通过第一网络接入第二网络的权限的管控。
一种可能的设计中，第十三消息用于指示关闭第一切片的访问权限，包括：第十三消息包括第一切片的标识信息。
一种可能的设计中，第十三消息用于指示关闭第一切片的访问权限，包括：第十三消息包括第二rejected NSSAI，第二rejected NSSAI包括第一切片的NSSAI。
一种可能的设计中，第一网络为公共网络，第二网络为非公共网络；或者，第一网络为非公共网络，第二网络为公共网络。
第二方面，提供一种网络互通的方法，包括：在第二网络为终端设备建立第二PDU会话的过程中，N3IWF获取路由规则，路由规则用于转发第二PDU会话的数据包；N3IWF根据路由规则，转发第二PDU会话的数据包。
基于上述技术方案，N3IWF通过获取第二PDU会话的路由规则，可以转发第二PDU会话的数据包，从而保证第一网络和第二网络之间的正常通信。
一种可能的设计中，路由规则用于指示将源地址为第二PDU会话的IP地址的上行数据包转发给服务于第二PDU会话的第二用户面网元。
一种可能的设计中，N3IWF根据路由规则，转发第二PDU会话的数据包，包括：N3IWF从第一网络的第一用户面网元或者第一接入管理网元接收第二PDU会话的上行数据包；N3IWF根据路由规则，向服务于第二PDU会话的第二用户面网元发送第二PDU会话的上行数据包。
一种可能的设计中，路由规则还用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一网络中的第一接入管理网元或第一用户面网元。
一种可能的设计中，N3IWF根据路由规则，转发第二PDU会话的数据包，包括：N3IWF从服务于第二PDU会话的第二用户面网元接收第二PDU会话的下行数据包；N3IWF根据路由规则，向第一网络的第一用户面网元或者第一接入管理网元发送第二PDU会话的上行数据包。
第三方面，提供一种通信装置，通信装置部署在第一网络中，通信装置包括通信模块和处理模块；通信模块，用于接收终端设备发送的第一切片的标识信息，第一切片是与第二网络的业务相关的切片；处理模块，用于根据第一切片的标识信息，控制通信模块向第二网络中的第二接入管理网元请求接入第二网络。
一种可能的设计中，处理模块，还用于获取第一身份信息；通信模块，还用于向第二接入管理网元发送第二身份信息，第一身份信息用于在第一网络中标识终端设备，第一身份信息不同于第二身份信息。
一种可能的设计中，第一身份信息为IMSI、SUPI、SUCI或者GUTI；第二身份信息为IMSI、SUPI、SUCI或者GUTI。
一种可能的设计中，处理模块，还用于建立第一身份信息和第二身份信息之间的关联关系。
一种可能的设计中，第一切片是第一网络中的切片；处理模块，具体用于根据第一切片的标识信息，控制通信模块向第二网络中的第二接入管理网元请求接入第二网络的第二切片，第二切片与第一切片相关联。
一种可能的设计中，第一切片的标识信息包括在第一消息中，第一消息用于请求注册到第一网络。
一种可能的设计中，第一消息包括第一requested NSSAI，第一requested NSSAI包括第一切片的S-NSSAI。
一种可能的设计中，处理模块，具体用于根据第一切片的标识信息，控制通信模块向第二网络中的第二接入管理网元发送第二消息，第二消息用于请求注册到第二网络。
一种可能的设计中，通信模块，还用于接收第二接入管理网元发送的第三消息，第三消息用于表示注册成功；根据第三消息，向终端设备发送第四消息，第四消息用于表示允许终端设备具有接入第一切片的权限。
一种可能的设计中，第四消息用于允许终端设备具有接入第一切片的权限，包括：第四消息包括第一切片的标识信息。
一种可能的设计中，第四消息用于允许终端设备具有接入第一切片的权限，包括：第四消息包括第一allowed NSSAI，第一allowed NSSAI包括第一切片的S-NSSAI。
一种可能的设计中，通信模块，还用于接收第二接入管理网元发送的第五消息，该第五消息用于表示不允许使用第二网络的业务；根据第五消息，向终端设备发送第六消息，第六消息用于表示不允许终端设备接入第一切片。
一种可能的设计中，第六消息用于表示不允许终端设备接入第一切片，可以实现为：第六消息包括第一切片的标识信息。
一种可能的设计中，第六消息用于表示不允许终端设备接入第一切片，可以实现为：第六消息包括第一拒绝的(rejected)NSSAI，所述第一rejected NSSAI包括所述第一切片的S-NSSAI。
一种可能的设计中，第一切片的标识信息包括在第一消息中，第一消息用于请求建立第一切片关联的第一PDU会话。
一种可能的设计中，处理模块，具体用于根据第一切片的标识信息，控制通信模块向第二网络中的第二接入管理网元发送第二消息，第二消息用于请求建立第二PDU会话。
一种可能的设计中，第一消息包括第一PDU会话的标识，第二消息包括第二PDU会话的标识。
一种可能的设计中，通信模块，还用于接收第二接入管理网元发送的第七消息，第七消息用于表示第二PDU会话建立成功；根据第七消息，向终端设备发送第九消息，第九消息用于表示第一PDU会话建立成功。
一种可能的设计中，通信模块，还用于从第二接入管理网元获取第二PDU会话的IP地址；向第一网络中的第一用户面网元发送第二PDU会话的IP地址。
一种可能的设计中，通信模块，还用于接收第二接入管理网元发送的第十消息，该第十消息用于表示第二PDU会话建立失败；向终端设备发送第十一消息，该第十一消息用于表示第一PDU会话建立失败。
一种可能的设计中，处理模块，还用于确定开启终端设备接入第一切片的权限；通信模块，还用于向终端设备发送第十二消息，第十二消息用于指示开启终端设备接入第一切片的权限。
一种可能的设计中，第十二消息用于指示开启第一切片的权限，包括：第十二消息包括第一切片的标识信息。
一种可能的设计中，第十二消息用于指示开启第一切片的权限，包括：第十二消 息包括第二allowed NSSAI，第二allowed NSSAI包括第一切片的S-NSSAI。
一种可能的设计中，处理模块，还用于确定关闭终端设备接入第一切片的权限；通信模块，还用于向终端设备发送第十三消息，第十三消息用于指示关闭终端设备接入第一切片的权限。
一种可能的设计中，第十三消息用于指示关闭第一切片的访问权限，包括：第十三消息包括第一切片的标识信息。
一种可能的设计中，第十三消息用于指示关闭第一切片的访问权限，包括：第十三消息包括第二rejected NSSAI，第二rejected NSSAI包括第一切片的NSSAI。
一种可能的设计中，第一网络为公共网络，第二网络为非公共网络；或者，第一网络为非公共网络，第二网络为公共网络。
第四方面，提供一种通信装置，通信装置包括处理模块和通信模块。其中，处理模块，用于在第二网络为终端设备建立第二PDU会话的过程中获取路由规则。通信模块，用于根据路由规则，转发第二PDU会话的数据包。
一种可能的设计中，路由规则用于指示将源地址为第二PDU会话的IP地址的上行数据包转发给服务于第二PDU会话的第二用户面网元。
一种可能的设计中，通信模块，具体用于从第一网络的第一用户面网元或者第一接入管理网元接收第二PDU会话的上行数据包；根据路由规则，向服务于第二PDU会话的第二用户面网元发送第二PDU会话的上行数据包。
一种可能的设计中，路由规则还用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一网络中的第一接入管理网元或第一用户面网元。
一种可能的设计中，通信模块，具体用于从服务于第二PDU会话的第二用户面网元接收第二PDU会话的下行数据包；根据路由规则，向第一网络的第一用户面网元或者第一接入管理网元发送第二PDU会话的上行数据包。
第五方面，提供一种通信装置，所述通信装置包括处理器和存储器，存储器存储有计算机程序指令，当处理器执行存储器所存储的计算机程序指令时，处理器用于实现上述第一方面或第二方面中任一设计提供的方法。
第六方面，提供一种计算机可读存储介质，所述计算机可读存储介质存储计算机指令，当该计算机指令在计算机上运行时，使得计算机执行第一方面或第二方面中任一设计提供的方法。
第七方面，提供一种包含计算机指令的计算机程序产品，当该计算机指令在计算机上运行时，使得计算机执行第一方面或第二方面中任一设计提供的方法。
第八方面，提供一种芯片，包括：处理电路和收发管脚，处理电路和收发管脚用于实现上述第一方面或第二方面中任一设计提供的方法。其中，处理电路用于执行相应方法中的处理动作，收发管脚用于执行相应方法中的接收/发送的动作。
第九方面，提供一种通信系统，该通信系统包括第一网络中第一接入管理网元和第二网络中的N3IWF。其中，第一接入管理网元用于执行第一方面中任一设计提供的方法。N3IWF用于执行第二方面中任一设计提供的方法。
需要说明的是，上述第三方面至第九方面中任一种设计所带来的技术效果可以参见第一方面中对应设计所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种注册流程的示意图；
图2为本申请实施例提供的一种5G网络的架构示意图；
图3为SNPN的架构示意图；
图4为PNI-NPN的架构示意图；
图5为本申请实施例提供的一种一种公私网互通架构的示意图；
图6为本申请实施例提供的一种通信系统的示意图；
图7(a)为本申请实施例提供的一种公私网互通架构的示意图；
图7(b)为本申请实施例提供的另一种公私网互通架构的示意图；
图7(c)为本申请实施例提供的另一种公私网互通架构的示意图；
图7(d)为本申请实施例提供的另一种公私网互通架构的示意图；
图8为本申请实施例提供的一种网络互通的方法的流程图；
图9为本申请实施例提供的另一种网络互通的方法的流程图；
图10为本申请实施例提供的另一种网络互通的方法的流程图；
图11为本申请实施例提供的另一种网络互通的方法的流程图；
图12为本申请实施例提供的另一种网络互通的方法的流程图；
图13(a)为本申请实施例提供的另一种网络互通的方法的流程图；
图13(b)为本申请实施例提供的另一种网络互通的方法的流程图；
图14为本申请实施例提供的另一种网络互通的方法的流程图；
图15(a)为本申请实施例提供的另一种网络互通的方法的流程图；
图15(b)为本申请实施例提供的另一种网络互通的方法的流程图；
图16为本申请实施例提供的另一种网络互通的方法的流程图；
图17为本申请实施例提供的另一种网络互通的方法的流程图；
图18为本申请实施例提供的另一种网络互通的方法的流程图；
图19为本申请实施例提供的另一种网络互通的方法的流程图；
图20为本申请实施例提供的一种通信装置的结构示意图；
图21为本申请实施例提供的另一种通信装置的结构示意图。
具体实施方式
在本申请的描述中，除非另有说明，“/”表示“或”的意思，例如，A/B可以表示A或B。本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。此外，“至少一个”是指一个或多个，“多个”是指两个或两个以上。“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
为了便于本领域技术人员的理解，下面先对一些技术术语进行介绍。
1、网络切片(network slice)
网络切片是一个用于支持特定网络能力与网络特性的逻辑隔离的网络，可以包括端到端(end to end，E2E)的整个网络，也可以部分网络功能在多个网络切片中共享，是满足第三代合作伙伴项目(3rd generation partnership project，3GPP)提出的第五代(5th generation，5G)移动通信技术关于网络差异化需求的关键技术。
网络切片可以由S-NSSAI来标识。S-NSSAI包括如下两部分：(1)切片/服务类型(slice/service type，SST)，用于在功能或者服务方面预期网络切片的行为；(2)切片差分器(slice differentiator，SD)，属于可选的信息，用于区分具有相同的SST的多个网络切片。在本申请中，网络切片也称为切片。
2、NSSAI
NSSAI是S-NSSAI的集合。也就是说，一个NSSAI可以包括至少一个S-NSSAI。
可选的，NSSAI存在以下多种类别：
(1)请求的(requested)NSSAI，包括一个或多个终端设备请求接入的S-NSSAI；
(2)允许的(allowed)NSSAI，包括一个或多个被网络侧允许接入的S-NSSAI；
(3)拒绝的(rejected)NSSAI，包括一个或多个被网络侧拒绝接入的S-NSSAI。
3、安全上下文
安全上下文是指可以用于实现数据的安全保护(例如，加密/解密，和/或完整性保护/校验)的信息。示例性的，安全上下文可以包括加密密钥、完整性保护密码等。
其中，加密密钥为发送端根据加密算法对明文进行加密以生成密文时输入的参数。若使用对称加密的方法，加密密钥和解密密钥是相同的。接收端可以根据相同的加密算法和加密密钥对密文进行解密。换句话说，发送端和接收端可以基于同一个密钥去加密和解密。
完整性保护密钥为发送端根据完整性保护算法对明文或密文进行完整性保护时输入的参数。接收端可以根据相同的完整性保护算法和完整性保护密钥对进行了完整性保护的数据进行完整性验证。
4、注册流程
注册流程用于建立终端设备与网络侧之间的连接，以使得终端设备能够接入到网络中。注册流程可以分为：
1)初始注册流程：终端设备由于某些原因(例如开机)而发起的第一次注册流程。
2)移动更新注册流程：终端设备移动出原先的服务区域而发起的注册流程。
3)周期性注册流程：终端设备按照预设时间间隔而发起的注册流程。应理解，周期性注册流程类似于心跳机制，以便于网络侧获知终端还处于服务区域内。
4)紧急注册流程：终端设备为了使用紧急服务而发起的注册流程。其中，终端设备可以是受限的终端设备，例如未安装SIM卡的终端设备。示例性的，紧急服务可以包括拔打急救电话等。
示例性的，如图1所示，注册流程可以包括以下步骤：
S1、终端设备向接入网设备发送注册请求。
S2、接入网设备执行接入和移动性管理功能(core access and mobility management function，AMF)选择流程。
S3、接入网设备向第一AMF发送注册请求。
S4、第一AMF根据注册请求，确定第二AMF，并向第二AMF发送上下文传输请求。
其中，第一AMF是当前为终端设备提供服务的AMF。第二AMF是之前为终端设备提供服务的AMF。
S5、第二AMF向第一AMF发送上下文传输请求的响应消息。
S6、第一AMF向终端设备发送标识请求(例如Identity Request消息)。
S7、终端设备向第一AMF发送标识请求的响应消息(例如Identity Response消息)。
S8、第一AMF执行鉴权功能(authentication server function，AUSF)选择流程。
如果第一AMF无法从本地或者第二AMF中查找到安全上下文，或者第一AMF对终端设备发送的信息进行完整性校验失败，则第一AMF应执行下述步骤S9。
S9、终端设备和网络侧之间执行认证和安全流程。
S10、第一AMF向第二AMF发送注册状态更新消息(例如Namf_Communication RegistrationStatusUpdate消息)。
S11、第一AMF向UE发起标识获取流程。
S12、第一AMF与设备标识寄存器(equipment identity register，EIR)执行设备标识检查。
S13、第一AMF执行统一数据管理(unified data management，UDM)选择流程。
S14、第一AMF与UDM执行AMF注册、UE签约订阅获取流程。
S15、若第一AMF确定第二AMF提供的策略控制功能(policy control function，PCF)信息不可用，第一AMF执行PCF选择流程。
S16、若第一AMF确定第二AMF提供的PCF信息可用，且PCF信息指示的PCF是第二AMF使用的PCF时，第一AMF向该PCF发送控制策略获取请求。
S17、第一AMF向终端设备发送注册接收消息(例如Registration Accept消息)。
其中，注册接收消息用于指示网络侧接受终端设备的注册。
S18、终端设备向第一AMF发送注册完成消息(例如Registration complete消息)。
可以理解的是，注册完成消息用于指示完成注册流程。
其中，上述步骤S4-S16、以及S18均是可选的步骤，可以根据实际情况选择执行或者不执行。
以上是对注册流程中的各个步骤的一些介绍，注册流程还可以包括其他步骤，本申请实施例不限于此。
5、协议数据单元(protocol data unit，PDU)会话
5G核心网支持PDU连接业务，PDU连接业务就是终端设备和数据网络(data network，DN)之间交换PDU数据包的业务。PDU连接业务通过终端设备发起PDU会话的建立来实现。终端设备建立PDU会话，也就是建立了一条终端设备和DN之间的数据传输通道。
需要说明的是，终端设备可以发起建立一个或多个PDU会话，来连接到相同的DN或者不同的DN。终端设备可以由一组核心网网元(如会话管理功能(session management function，SMF)网元、策略控制功能(policy control function，PCF)网元和用户面功能(user plane function，UPF)网元等)服务，这些核心网网元协调着管 理终端设备的PDU会话资源。
6、5G系统架构
如图2所示，5G网络可以包括终端设备、无线接入网络(radio access network，RAN)或者接入网络(access network，AN)(下文中将RAN和AN统称为(R)AN)、核心网(core network，CN)、以及数据网(data network，DN)。
其中，终端设备可以是一种具有无线收发功能的设备。所述终端设备可以有不同的名称，例如用户设备(user equipment，UE)、接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。终端可以被部署在陆地上，包括室内或室外、手持或车载；也可以被部署在水面上(如轮船等)；还可以被部署在空中(例如飞机、气球和卫星上等)。终端设备包括具有无线通信功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，终端设备可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
接入网设备是一种为终端设备提供无线通信功能的设备。接入网设备也可以称为基站。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。具体可以为：是无线局域网(wireless local area network，WLAN)中的接入点(access point，AP)，全球移动通信系统(global system for mobile Communications，GSM)或码分多址接入(code division multiple access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)中的基站(NodeB，NB)，还可以是长期演进(long term evolution，LTE)中的演进型基站(evolved Node B，eNB或eNodeB)，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G网络中的下一代节点B(the next generation Node B，gNB)或者未来演进的公用陆地移动网(Public Land Mobile Network，PLMN)网络中的基站等。
核心网包括多个核心网网元(或者称为网络功能网元)，例如：接入和移动管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、策略控制功能(policy control function，PCF)网元、用户面功能(user plane function，UPF)网元、AUSF网元、以及UDM网元。此外，核心网还可以包括一些其他未示出的网元，本申请实施例在此不予赘述。
此外，核心网还可以包括一些图2中未示出的网元，例如安全锚功能(security anchor function，SEAF)网元等，本申请实施例在此不予赘述。
在未来的通信系统如6G通信系统中，上述网元或设备仍可以使用其在5G通信系统中的名称，或者有其它名称；上述网元或设备的功能可以由一个独立网元完成，也可以由若干个网元共同完成，本申请实施例对此不作限定。
在实际部署中，核心网中的网元可以合设。例如，接入和移动管理功能可以与会话管理功能合设；会话管理功能可以与用户面功能合设。当两个网元合设的时候，本申请实施例提供的这两个网元之间的交互就成为该合设网元的内部操作或者可以省略。
以上是对本申请所涉及的技术术语的介绍，以下不再赘述。
公共陆地移动网络(public land mobile network，PLMN)是为公众提供陆地移动通信业务而建立和经营的公共网络。随着网络业务的发展，一些企业或者个人为了自身业务的安全考虑，也存在建立自用的非公共网络(non-public network，NPN)的需求。
根据部署方式的不同，目前NPN可以为两类：独立部署的NPN(stand-alone NPN，SNPN)和依赖于PLMN的NPN(PLMN-integrated NPN，PNI-NPN)。
如图3所示，SNPN具有独立的接入网设备和核心网，不依赖网络运营商建立的PLMN提供功能。例如，如图3所示，SNPN可以有独立的AMF、AUSF、UPF以及gNB。
如图4所示，PNI-NPN是在PLMN支持下部署的NPN。PNI-NPN可以完全或者部分托管在PLMN的基础设施上，依赖PLMN提供部分网络功能。例如，如图4所示，对于PNI-NPN1，UE需要使用PLMN中的gNB和UPF才能接入私网DN1。对于PNI-NPN2，UE需要使用PLMN中的gNB和UPF才能接入私网DN2。
应理解，NPN是企业自建的私网，NPN可以和公网(也即PLMN)隔离。但是，在一些情况下，企业仍存在NPN和PLMN互通的需求。例如，企业的员工需要在家办公，则员工需要通过PLMN接入NPN。又例如，企业内的设备在夜间发生故障，员工需要使用企业通讯软件通知管理员，也就是企业的设备需要通过NPN接入PLMN。又例如，企业在北京园区建立了一个SNPN，后来随着规模扩大在上海建立分公司并在上海园区又建立了另一个SNPN，两个SNPN需要通过PLMN互联起来。
以NPN为SNPN为例，图5示出一种公私网互通架构。如图5所示，PLMN的核心网包括AMF、SMF和UPF。SNPN的核心网包括AMF、SMF、UPF和N3IWF。相应的，PLMN的核心网也可以设置相应的N3IWF(图5中未示出)，以保证UE与PLMN之间连接的安全。
基于图5所示的架构，终端设备可以通过PLMN的接入网和核心网，接入SNPN的核心网。但是，一方面，由于终端设备与SNPN的消息在PLMN中是透传的，因此PLMN无法感知终端设备是否接入SNPN，也无法控制终端设备接入SNPN。另外一方面，为了保障安全，N3IWF需要与终端设备建立安全隧道。该安全隧道一般是基于复杂的IPsec协议栈来实现的。这就导致需要终端设备支持IPsec协议栈，从而使得终端设备的协议栈变得复杂，增大了终端设备的制造成本。
因此，在第一网络和第二网络互通的架构下，如何增强第一网络对终端设备接入第二网络的控制，是亟待解决的技术问题。
对此，如图6所示，本申请实施例提供一种通信系统10，该通信系统10包括：第一接入管理网元101和第二接入管理网元102。应理解，第一接入管理网元101和第二接入管理网元102之间可以直接通信，也可以通过其他设备的转发进行通信，对此不作限定。
其中，第一接入管理网元101属于第一网络，第二接入管理网元属于第二网络。第一网络和第二网络是不同的两个网络。第一网络可以是公共网络或者非公共网络，第二网络可以是公共网络或者非公共网络。例如，第一网络为公共网络，第二网络为 非公共网络。或者，第一网络为非公共网络，第二网络为公共网络。第一网络和第二网络可以采用相同的通信制式或者不同的通信制式。例如，第一网络采用5G通信制式，第二网络也采用5G通信制式。
第一接入管理网元101，用于接收终端设备发送的第一切片的标识信息，第一切片是与第二网络的业务相关的切片；根据第一切片的标识信息，向第二网络中的第二接入管理网元请求接入第二网络。
上述第一接入管理网元101和第二接入管理网元102所执行的操作的具体描述可以参考下文中相应的方法实施例，在此不予赘述。
应理解，由于第一切片是与第二网络的业务相关的切片，因此第一接入管理网元能够根据第一切片的标识信息，获知终端设备想要接入第二网络。从而，第一网络中的第一接入管理网元向第二网络中的第二接入管理网元请求接入第二网络。可见，第一网络中的第一接入管理网元可以获知终端设备要接入第二网络，也能控制终端设备接入第二网络。本申请提供的技术方案能够增强第一网络对终端设备接入第二网络的控制。
另外，由第一接入管理网元代理终端设备请求接入第二网络，而终端设备不直接与第二网络交互信息，因此终端设备无需与安全网关(例如N3IWF)建立IPsec隧道，因此终端设备无需支持IPsec协议栈，从而减少终端设备的制造成本。
示例性的，图6所示的通信系统10可以适用于以下图7(a)-图7(d)所示的第一网络和第二网络互通的架构中。其中，通信系统10中的第一接入管理网元101可以实现为第一网络中的AMF，第二接入管理网元可以实现为第二网络中的AMF。
架构一
图7(a)示出一种第一网络和第二网络互通的架构。如图7(a)所示，第一网络可以包括AMF和UPF，第二网络包括AMF、N3IWF和UPF。其中，第一网络的AMF和第二网络的N3IWF建立有安全隧道，第一网络的UPF和第二网络的N3IWF建立有安全隧道。
应理解，由于N3IWF和第一网络中的AMF和UPF分别建立了隧道，因此对来自第二网络的消息，N3IWF根据该消息是数据面消息还是控制面消息进行转发。对于控制面消息，N3IWF通过用于与第一网络的AMF通信的隧道将控制面消息发送给第一网络的AMF。对于数据面消息，N3IWF通过用于与第一网络的UPF通信的隧道将数据面消息发送给第一网络的UPF。
基于图7(a)所示的架构，第一网络中的AMF和第二网络中的AMF之间的信息可以通过N3IWF进行中转。
例如，基于图7(a)所示的架构，第一网络中的AMF发送给第二网络中的AMF的消息(例如下文中的第二消息等)的传输路径可以为：第一网络中的AMF->N3IWF->第二网络中的AMF。其中，->表示传输方向，例如第一网络中的AMF->N3IWF即表示第一网络中的AMF将消息发送给N3IWF，在此统一说明，以下不再赘述。
又例如，基于图7(a)所示的架构，第二网络中的AMF发送给第一网络中的AMF的消息(例如下文中的第三消息、第五消息、第七消息、第十消息等)的传输路径可以为：第二网络中的AMF->N3IWF->第一网络中的AMF。
基于图7(a)所示的架构，UE的用户面数据可以通过第一网络中的接入网设备、第一网络的UPF、N3IWF、以及第二网络的UPF来传输。
例如，基于图7(a)所示的架构，UE的下行用户面数据的传输路径可以为：第二网络中的UPF->N3IWF->第一网络中的UPF->第一网络的接入网设备->UE。
例如，基于图7(a)所示的架构，UE的上行用户面数据的传输路径可以为：UE->第一网络的接入网设备->第一网络中的UPF->N3IWF->第二网络中的UPF。
架构二
图7(b)示出另一种第一网络和第二网络互通的架构示意图。如图7(b)所示，第一网络的核心网可以包括AMF和UPF，第二网络的核心网包括AMF、N3IWF和UPF。其中，第一网络的AMF和第二网络的N3IWF未建立安全隧道，第一网络的UPF和第二网络的N3IWF建立有安全隧道。
应理解，由于N3IWF与第一网络的UPF建立有隧道，而与第一网络的AMF未建立隧道。因此，对于来自第二网络的消息，无论该消息是数据面消息还是控制面消息，N3IWF均通过用于与第一网络的UPF通信的隧道将该消息转发给第一网络的UPF。
基于图7(b)所示架构中，第一网络中的AMF和第二网络中的AMF之间的信息可以通过N3IWF以及一些其他网元进行中转。
例如，基于图7(b)所示架构中，第一网络中的AMF发送给第二网络中的AMF的消息(例如下文中的第二消息等)的传输路径可以为：第一网络中的AMF->第一网络中的SMF->第一网络中的UPF->N3IWF->第二网络中的AMF。
又例如，基于图7(b)所示架构中，第二网络中的AMF发送给第一网络中的AMF的消息(例如下文中的第三消息、第五消息、第七消息、第十消息等)的传输路径可以为：第二网络中的AMF->N3IWF->第一网络中的UPF->第一网络中的SMF->第一网络中的AMF。
基于图7(b)所示的架构，UE的用户面数据可以通过第一网络中的接入网设备、第一网络的UPF、N3IWF、以及第二网络的UPF来传输。
例如，基于图7(b)所示的架构，UE的下行用户面数据的传输路径可以为：第二网络中的UPF->N3IWF->第一网络中的UPF->第一网络的接入网设备->UE。
例如，基于图7(b)所示的架构，UE的上行用户面数据的传输路径可以为：UE->第一网络的接入网设备->第一网络中的UPF->N3IWF->第二网络中的UPF。
架构三
图7(c)示出另一种第一网络和第二网络互通的架构示意图。如图7(c)所示，第一网络的核心网可以包括AMF和UPF，第二网络的核心网包括AMF、N3IWF和UPF。其中，第一网络的AMF和第二网络的N3IWF建立有安全隧道，第一网络的UPF和第二网络的N3IWF未建立安全隧道。
应理解，由于N3IWF与第一网络的AMF建立有隧道，而与第一网络的UPF未建立隧道。因此，对于来自第二网络的消息，无论该消息是数据面消息还是控制面消息，N3IWF均通过用于与第一网络的AMF通信的隧道将该消息转发给第一网络的AMF。
基于图7(c)所示的架构，第一网络中的AMF和第二网络中的AMF之间的信息可以通过N3IWF进行中转。
例如，基于图7(c)所示的架构，第一网络中的AMF发送给第二网络中的AMF的消息(例如下文中的第二消息等)的传输路径可以为：第一网络中的AMF->N3IWF->第二网络中的AMF。
又例如，基于图7(c)所示的架构，第二网络中的AMF发送给第一网络中的AMF的消息(例如下文中的第三消息、第五消息、第七消息、第十消息等)的传输路径可以为：第二网络中的AMF->N3IWF->第一网络中的AMF。
基于图7(c)所示的架构，UE的用户面数据可以通过第一网络中的接入网设备、第一网络中的AMF、N3IWF和第二网络中的AMF来传输。
例如，基于图7(c)所示的架构，UE的下行用户面数据的传输路径可以为：第二网络中的AMF->N3IWF->第一网络中的AMF->第一网络的接入网设备->UE。
例如，基于图7(c)所示的架构，UE的上行用户面数据的传输路径可以为：UE->第一网络的接入网设备->第一网络中的AMF->N3IWF->第二网络中的AMF。
可选的，图7(c)所示的架构仅支持UE的数据面消息中部分类型的消息(例如小包数据)在两个网络之间传输。
架构四
图7(d)示出另一种第一网络和第二网络的架构示意图。如图7(d)所示，第一网络中的AMF和第二网络中的AMF直接连接，第一网络中的UPF和第二网络中的UPF直接连接。
基于图7(d)所示的架构，第一网络中的AMF可以和第二网络中的AMF直接通信。第一网络中的UPF可以和第二网络中的UPF直接通信。
在图7(a)-图7(d)所示架构中，第一网络和第二网络均存在未标示出的网元，例如SMF、AUSF等，对此不作限定。
在图7(a)-图7(c)所示架构中，N3IWF可以换成其他设备，对此不作限定。例如，在图7(a)-图7(c)所示架构中，N3IWF可以替换为接入网设备，该接入网设备可以和第一网络中的AMF和/或UPF建立连接。
下面结合说明书附图对本申请实施例进行介绍。应理解，下述实施例中提及的各种消息、信息、参数的名称仅是示例，不构成具体限定。各种消息、信息和参数在不同应用场景下可以有不同的名称。
以下对本申请实施例提供的一种网络互通的方法进行详细介绍。如图8所示，该方法包括：
S101、终端设备向第一接入管理网元发送第一切片的标识信息。相应的，第一接入管理网元接收终端设备发送的第一切片的标识信息。
其中，第一接入管理网元属于第一网络。第一接入管理网元用于负责第一网络的接入管理。示例性的，第一接入管理网元可以为4G网络中的移动管理实体(mobility management entity，MME)，或者5G网络中的AMF，或者未来网络中承担接入管理等功能的设备。
第一切片是第一网络中的切片。第一切片是与第二网络的业务相关的切片。或者说，第一切片关联第二网络的全部或者部分业务。
第一切片的标识信息表示终端设备请求接入第一切片；或者第一切片的标识信息 表示终端设备请求接入第二网络；或者第一切片的标识信息表示终端设备请求使用第二网络的业务。
作为一种可能的实现方式，步骤S101可以具体实现为：终端设备向第一接入管理网元发送第一消息，该第一消息包括第一切片的标识信息。示例性的，第一切片的标识信息可以为第一切片的S-NSSAI，对此不作限定。
可选的，第一接入管理网元获取第一网络的标识。示例性的，第一接入管理网元接收终端设备发送的第一消息中还可以包括第一网络的标识。该第一网络的标识表明该第一消息用于第一网络中的相关流程(例如注册流程或者PDU会话建立流程等)。
可选的，第一接入管理网元获取第一身份信息。示例性的，第一消息包括第一身份信息，第一身份信息用于在第一网络中标识终端设备。从而，第一接入管理网元可以根据第一身份信息，获知发送第一消息的终端设备。示例性的，第一身份信息的形式可以为IMSI、SUPI、SUCI或者GUTI等，对此不作限定。
在本申请实施例中，身份信息还可以有其他名称，例如终端标识信息、设备标识信息、用户信息等，对此不作限定。
在本申请实施例中，第一消息可以为非接入层(non-access stratum，NAS)消息。示例性的，第一消息可以为注册请求消息、PDU会话建立请求消息或服务请求消息等。
S102、第一接入管理网元根据第一切片的标识信息，向第二接入管理网元请求接入第二网络。相应的，第二接入管理网元接收第一接入管理网元发送的接入第二网络的请求。
其中，第二接入管理网元属于第二网络。第二接入管理网元用于负责第二网络的接入管理。示例性的，第二接入管理网元可以为4G网络中的MME，或者5G网络中的AMF，或者未来网络中承担接入管理等功能的设备。
在本申请实施例中，接入第二网络，可以是指注册到第二网络，或者在第二网络中建立PDU会话等，对此不作具体限定。
可选的，步骤S102可以具体实现为：第一接入管理网元根据第一切片的标识信息，向第二接入管理网元发送第二消息，该第二消息用于请求接入第二网络。
可选的，第二消息可以为NAS消息。示例性的，第二消息可以为注册请求消息、PDU会话建立请求消息或服务请求消息等。
一种可能的设计中，第一接入管理网元根据第一切片的标识信息，向第二接入管理网元请求接入第二网络的第二切片。第一切片与第二切片相关联。
可选的，第一接入管理网元还可以从其他网元(例如统一数据管理网元)获取到第一切片的标识信息与一个或多个第二切片的标识信息之间的关联关系；或者，该关联关系可以配置在第一接入管理网元上。其中，第二切片为第二网络中的切片。一个第二切片关联第二网络中的一种业务。
可选的，第二切片的标识信息可以承载于第二消息中。
可选的，第一接入管理网元获取第二网络的标识信息；第一接入管理网元向第二接入管理网元发送第二网络的标识信息。示例性的，第一接入管理网元可以从其他网元(例如统一数据管理网元)获取到第一切片的标识信息与第二网络的标识信息之间的关联关系；或者，该关联关系可以配置在第一接入管理网元上。因此，第一接入管 理网元在接收到第一切片的标识信息之后，能够确定第一切片所关联的网络(也即第二网络)。
示例性的，以第二网络为PLMN为例，第二网络的标识信息可以为PLMN ID。或者，以第二网络为SNPN为例，第二网络的标识信息可以为SNPN ID。
可选的，第二网络的标识信息可以承载于第二消息中，以表明该第二消息用于第二网络的相关流程(例如注册流程、PDU会话建立流程)。
可选的，第一接入管理网元还可以获取第二身份信息；第一接入管理网元向第二接入管理网元发送第二身份信息。其中，第二身份信息用于在第二网络中标识终端设备。第二身份信息不同于第一身份信息。举例来说，假设第一消息包括SUCI#1，第二消息可以包括SUCI#2，SUCI#1不同于SUCI#2。
示例性的，第二身份信息的形式可以为IMSI、SUPI、SUCI或者GUTI等，对此不作限定。
可选的，第二身份信息可以承载于第二消息中。应理解，由于第一身份信息用于在第一网络中标识终端设备，因此第二网络中的网元可能不能识别第一身份信息。从而，第二消息包括第二网络能够识别的第二身份信息，以使得第一接入管理网元可以代理终端设备与第二网络中的相关网元(例如第二接入管理网元)正常通信。
可选的，第一接入管理网元可以建立并存储第一身份信息和第二身份信息之间的关联关系，从而第一接入管理网元可以实现代理终端设备与第二网络进行通信的目的。
例如，基于第一身份信息和第二身份信息之间的关联关系，第一接入管理网元在从第二网络中的相关网元(例如第二接入管理网元)接收到与第二身份信息有关的消息A之后，可以对消息A进行解析以获取消息A携带的内容，并将消息A携带的全部或者部分内容封装为消息B发送给终端设备。
又例如，基于第一身份信息和第二身份信息之间的关联关系，第一接入管理网元在接收到终端设备发送的、与第一切片相关的消息C之后，可以解析消息C以获取消息C所携带的内容，并将消息C所携带的全部或者部分内容封装为消息D发送给第二网络中的相关网元(例如第二接入管理网元)。
下面对第一接入管理网元获取第二身份信息的实现方式进行介绍。
实现方式1-1、第一接入管理网元从终端设备获取第二身份信息。
实现方式1-2、第一接入管理网元从终端设备获取第三身份信息；之后，第一接入管理网元根据第三身份信息，生成第二身份信息。
应理解，第三身份信息用于推导出第二身份信息。
一种可能的设计中，第三身份信息是对第二身份信息进行解密后的身份信息。相应的，第二身份信息是对第三身份信息进行加密后的身份信息。
例如，第三身份信息为SUPI，第二身份信息为SUCI。SUCI是将SUPI通过加密后得到的。
实现方式1-3、第一接入管理网元从本地获取第二身份信息。
作为一种可能的实现方式，第一接入管理网元预先建立第一对应关系，第一对应关系包括第一切片的标识信息与第二身份信息之间的对应关系。从而，第一接入管理网元可以根据第一对应关系以及第一切片的标识信息，查找到第二身份信息。应理解， 上述第一对应关系可以是一对一的对应关系，或者一对多的对应关系，对此不作限定。
作为另一种可能的实现方式，第一接入管理网元预先建立第二对应关系，第二对应关系包括第一身份信息与第二身份信息之间的对应关系。从而，第一接入管理网元可以根据第二对应关系以及从终端设备获取的第一身份信息，查找到对应的第二身份信息。
作为再一种可能的实现方式，第一接入管理网元预先存储多个用于第二网络的身份信息。之后，在接收到第一切片的标识信息的情况下，第一接入管理网元可以按照一定规则或者随机方式从预先存储的多个用于第二网络的身份信息中，选取一个身份信息作为第二身份信息。
实现方式1-4、第一接入管理网元从本地获取第三身份信息；之后，第一接入管理网元根据第三身份信息，生成第二身份信息。
作为一种可能的实现方式，第一接入管理网元可以预先建立第三对应关系，第三对应关系可以为第一切片的标识信息与第三身份信息之间的对应关系。从而，第一接入管理网元可以根据第三对应关系以及第一切片的标识信息，查找到第三身份信息。应理解，上述第三对应关系可以是一对一的对应关系，或者一对多的对应关系，对此不作限定。
作为另一种可能的实现方式，第一接入管理网元可以预先建立第四对应关系，第四对应关系可以为第四身份信息与第三身份信息之间的对应关系，其中第四身份信息用于推导出第一身份信息。从而，第一接入管理网元根据第四对应关系，以及第一身份信息，查找到对应的第三身份信息。
示例性的，假设第一身份信息为SUCI#1，第二身份信息为SUCI#2，第三身份信息为SUPI#2，第四身份信息为SUPI#1。其中，SUPI#1可以生成SUCI#1，SUPI#2可以生成SUCI#2。第一接入管理网元根据接收到的SUCI#1，确定SUCI#1对应的SUPI#1。第一接入管理网元再根据SUPI#1与SUPI#2之间的对应关系，以及SUPI#1，确定出SUPI#2。第一接入管理网元根据SUPI#2可以确定出SUCI#2。
作为再一种可能的实现方式，第一接入管理网元预先存储了多个用于第二网络的身份信息。之后，在接收到第一切片的标识信息的情况下，第一接入管理网元可以按照一定规则或者随机方式从预先存储的多个用于第二网络的身份信息中，选取一个身份信息作为第三身份信息。
实现方式1-5、第一接入管理网元从第一网络中的其他网元(例如第一数据管理网元)获取到第二身份信息。
示例性的，第一接入管理网元向第一数据管理网元发送第一请求消息；之后，第一接入管理网元接收第一数据管理网元发送的第一响应消息，第一响应消息包括第二身份信息。
可选的，第一请求消息可以包括第一身份信息或者第一切片的标识信息。
示例性的，第一请求消息可以为Nudm_SDM_GET Request，第一响应消息可以为Nudm_SDM_GET Response，对此不作限定。
实现方式1-6、第一接入管理网元从第一网络中的其他网元(例如第一数据管理网元)获取到第三身份信息；之后，第一接入管理网元根据第三身份信息，生成第二身 份信息。
例如，第一接入管理网元向第一数据管理网元发送第二请求消息；之后，第一接入管理网元接收统一数据管理网元发送的第一响应消息，第一响应消息包括第三身份信息。
可选的，第二请求消息可以包括第四身份信息、第一身份信息或者第一切片的标识。示例性的，第二请求消息可以为Nudm_SDM_GET Request，第二响应消息可以为Nudm_SDM_GET Response，对此不作限定。
上述实现方式1-1至实现方式1-6仅是示例，第一接入管理网元获取第二身份信息还可以采用其他实现方式，对此不作限定。
可选的，第一接入管理网元还可以获取第二身份信息关联的签约信息，并以第二身份信息关联的签约信息，生成第二消息。示例性的，第一接入管理网元从第一数据管理网元获取第二身份信息关联的签约信息；或者，该签约信息配置在第一接入管理网元上。
其中，第二身份信息关联的签约信息可以包括以下参数中的一项或者多项：第二网络的标识、第二切片的标识、安全算法(例如加密算法或者完整性保护算法)、非接入层(non-access stratum，NAS)计数值(NAS counter)、PDU session ID、PDU session的IP地址或MAC地址等、PDU session相关联的数据网络名称(data network name，DNN)。可选的，在第二网络为PNI-NPN的情况下，第二身份信息关联的签约信息还可以包括封闭接入组信息列表(closed access group information list，CAG information list)，对此不作限定。
应理解，上述签约信息还可以被称为上下文信息等，对此不作限定。
例如，第一接入管理网元可以根据第二身份信息关联的签约信息中的安全算法和NAS counter，对第二消息进行安全保护。
又例如，第一接入管理网元可以根据第二身份信息关联的签约信息中的第二切片的标识，确定第二消息所包括的第二切片的标识。
下面结合图7(a)-图7(d)所示的架构来具体说明第一接入管理网元向第二接入管理网元发送第二消息的具体实现方式。
例如，基于图7(a)所示的架构中，第一接入管理网元向N3IWF发送第二消息；N3IWF向第二接入管理网元转发第二消息。
又例如，基于图7(b)所示的架构中，第一接入管理网元向第一会话管理网元发送第二消息；第一会话管理网元向第一用户面网元发送第二消息；第一用户面网元向N3IWF发送第二消息；N3IWF向第二接入管理网元发送第二消息。
又例如，基于图7(c)所示的架构中，第一接入管理网元向N3IWF发送第二消息；N3IWF向第二接入管理网元转发第二消息。
又例如，基于图7(d)所示架构中，第一接入管理网元直接与第二接入管理网元连接，因此第一接入管理网元直接向第二接入管理网元发送第二消息。
基于图8所示的实施例，第一接入管理网元接收到终端设备发送的第一切片的标识信息。由于第一切片是与第二网络的业务相关的切片，因此第一接入管理网元能够根据第一切片的标识信息，获知终端设备想要接入第二网络。从而，第一网络中的第 一接入管理网元向第二网络中的第二接入管理网元请求访问第二网络。可见，第一网络中的第一接入管理网元可以获知终端设备要接入第二网络，也能控制终端设备接入第二网络。本申请提供的技术方案能够增强第一网络对终端设备接入第二网络的控制。
另外，在本申请实施例中，第一接入管理网元代理终端设备请求接入第二网络，而终端设备不直接与第二网络通信，因此终端设备无需与第二网络中的安全网关建立IPsec隧道，因此终端设备无需支持IPsec协议栈，从而减少终端设备的制造成本。
以下结合图9，举例说明注册场景下一种网络互通的方法。如图9所示，该方法包括：
S101：可以参考图8中S101的描述。
在注册场景下，上述步骤S101可以具体实现为：终端设备向第一接入管理网元发送第一消息。
第一消息用于请求注册到第一网络。示例性的，第一消息可以为注册请求消息。
从而，第一消息包括第一切片的标识信息，可以具体实现为：第一消息包括requested NSSAI，该requested NSSAI包括第一切片的S-NSSAI。可选的，该requested NSSAI还可以包括其他网络切片的S-NSSAI，对此不作限定。
应理解，在第一接入管理网元接收到第一消息之后，终端设备可以和第一网络中的其他网元执行第一网络的注册流程中的部分步骤，例如图1所示的注册流程中的步骤S4～S14中的全部或者部分。在执行图1所示的步骤S4-S14的过程中，终端设备执行图1所示的通信设备所执行的操作，第一接入管理网元执行图1所示的第一AMF所执行的操作。
示例性的，终端设备和第一网络中的网元执行鉴权、标识请求等操作。另外，基于注册流程中的鉴权等相关步骤，第一接入管理网元和终端设备均可以获取第一身份信息关联的第一安全上下文。从而，终端设备和第一接入管理网元之间可以使用第一安全上下文，来保证终端设备和第一接入管理网元之间的通信安全(例如进行加密保护、完整性保护等)。
S102：可以参考图8中S102的描述。
上述步骤S102可以具体实现为：第一接入管理网元向第二接入管理网元发送第二消息。
第二消息用于请求接入第二网络，可以具体实现为：第二消息用于请求注册到第二网络。相应的，第二消息可以具体为注册请求消息。
这样一来，第二接入管理网元根据第二消息，可以把第一接入管理网元作为一个普通终端设备来看待。基于这样的方式，第一接入管理网元实现代理终端设备接入第二网络的目的。
可选的，第一接入管理网元还可以存储第一切片的标识信息与m个第二切片的标识信息之间的关联关系。从而，第二消息可以包括n个第二切片的标识信息。其中，n个第二切片是上述m个第二切片的子集。上述m、n均为大于或等于零的整数，n小于等于m。
示例性的，第二消息包括n个第二切片的标识信息，可以具体实现为：第二消息包括requested NSSAI，该requested NSSAI包括n个第二切片的S-NSSAI。
应理解，在第二接入管理网元接收到第二消息之后，第一接入管理网元可以和第二网络中的网元执行第二网络的注册流程的部分步骤，例如图1中的步骤S4-S16中的全部或者部分。在执行图1所示的步骤S4-S16的过程中，第一接入管理网元执行图1所示的通信设备所执行的操作，第二接入管理网元执行图1所示的第一AMF所执行的操作。
基于注册流程中的鉴权等相关步骤，第一接入管理网元和第二接入管理网元可以获取到与第二身份信息关联的第二安全上下文。从而，第一接入管理网元和第二接入管理网元可以使用第二安全上下文，来保证第一接入管理网元和第二接入管理网元之间的通信安全(例如进行加密保护、完整性保护等)。
可选的，该网络互通的方法在步骤S102之后还可以包括步骤S201-S202。
S201、第二接入管理网元向第一接入管理网元发送第三消息。相应的，第一接入管理网元接收第二接入管理网元发送的第三消息。
其中，第三消息用于表示允许接入第二网络。或者，第三消息用于表示在第二网络注册成功。示例性的，第三消息可以为注册完成(registration accept)消息。
一种可能的实现方式中，第三消息用于表示允许接入第二网络，可以具体实现为：第三消息用于表示允许第一接入管理网元接入第二网络。
可选的，第三消息还可以包括allowed NSSAI，该allowed NSSAI包括p个第二切片的标识。示例性的，p个第二切片可以为上述n个第二切片的子集，p为大于或等于0的整数，p小于等于n。
可选的，在第一接入管理网元接收到第三消息之后，第一接入管理网元可以执行第一网络的注册流程中剩下的步骤(例如图1中步骤S15-S18)的部分或全部，以完成终端设备注册到第一网络的流程。
可选的，第一接入管理网元可以建立第一切片的标识信息与第二身份信息(或者由第二身份信息推演得到的其他身份信息)之间对应关系。
可选的，第一接入管理网元可以建立第二安全上下文与第一安全上下文之间的关联关系，以保证终端设备和第二网络之间通信的安全性。可选的，第二安全上下文与第一安全上下文之间的关联关系可以基于第一身份信息和第二身份信息之间的关联关系、第一身份信息和第一安全上下文之间的关联关系和第二身份信息和第二安全上下文之间的关联关系确定。
例如，对于第二网络中的相关网元(例如第二接入管理网元)发送的消息A，第一接入管理网元可以解析消息A以获取消息A所携带的内容，并将消息A所携带的全部或者部分内容封装为消息B，使用第一安全上下文对消息B进行安全保护，将安全保护后的消息B发送给终端设备。
又例如，对于终端设备发送的、与第一切片相关的消息C，第一接入管理网元可以解析该消息C以获取消息C所携带的内容，并将消息C所携带的全部或者部分内容封装为消息D，使用第二安全上下文对消息D进行安全保护，将安全保护后的消息D发送给第二网络中的相关网元(例如第二接入管理网元)。
下面结合图7(a)-图7(b)所示的架构，具体说明第二接入管理网元向第一接入管理网元发送第三消息的具体实现方式。
例如，基于图7(a)所示的架构中，第二接入管理网元向N3IWF发送第三消息；N3IWF向第一接入管理网元发送第三消息。
又例如，基于图7(b)所示的架构中，第二接入管理网元向N3IWF发送第三消息；N3IWF向第一用户面网元发送第三消息；第一用户面网元向第一会话管理网元发送第三消息；第一会话管理网元向第一接入管理网元发送第三消息。
又例如，基于图7(c)所示的架构中，第二接入管理网元向N3IWF发送第三消息；N3IWF向第一接入管理网元发送第三消息。
又例如，基于图7(d)所示的架构中，第二接入管理网元直接向第一接入管理网元发送第三消息。
S202、第一接入管理网元根据第三消息，向终端设备发送第四消息。相应的，终端设备接收第一接入管理网元发送的第四消息。
其中，第四消息用于表示允许终端设备具有接入第一切片的权限。可选的，一种可能的实现方式中，第四消息包括allowed NSSAI，该allowed NSSAI包括第一切片的S-NSSAI。
可选的，在注册场景下，第四消息还可以用于表示终端设备成功注册到第一网络。示例性的，第四消息可以为注册接受消息。
基于图9所示的实施例，第一接入管理网元接收到终端设备发送的第一切片的标识信息，代理终端设备请求接入第二网络。在第二网络注册成功的情况下，第一接入管理网元通过第四消息，使得终端设备获知自身具备接入第一切片的权限。在这一过程中，终端设备不直接与第二网络通信，因此终端设备无需与第二网络中的安全网关建立IPsec隧道，因此终端设备无需支持IPsec协议栈，从而减少终端设备的制造成本。
以下结合图10，举例说明注册场景下另一种网络互通的方法。如图10所示，该方法包括：
S101：可以参考图9中S101的描述。
S102：可以参考图9中S102的描述。
可选的，该方法还可以包括步骤S301-S302。
S301、第二接入管理网元向第一接入管理网元发送第五消息。相应的，第一接入管理网元接收第二接入管理网元发送的第五消息。
其中，第五消息用于表示不允许使用第二网络的业务。
可选的，第五消息可以采用以下设计中的任意一种：
设计1、第五消息用于表示在第二网络中注册失败。
基于该设计1，第五消息可以为注册拒绝消息。
可选的，基于设计1，第五消息可以包括rejected NSSAI，rejected NSSAI可以包括上述n个第二切片的S-NSSAI。
设计2、第五消息用于表示在第二网络中注册成功，但未获取到接入第二切片的权限。
基于设计2，第五消息可以为注册接受消息，并且第五消息包括rejected NSSAI，rejected NSSAI可以包括上述n个第二切片的S-NSSAI。
下面结合图7(a)-图7(b)所示的架构，具体说明第二接入管理网元向第一接 入管理网元发送第五消息的具体实现方式。
例如，基于图7(a)或图7(c)所示的架构中，第二接入管理网元向N3IWF发送第五消息；N3IWF向第一接入管理网元发送第五消息。
又例如，基于图7(b)所示的架构中，第二接入管理网元向N3IWF发送第五消息；N3IWF向第一用户面网元发送第五消息；第一用户面网元向第一会话管理网元发送第五消息；第一会话管理网元向第一接入管理网元发送第五消息。
又例如，基于图7(d)所示的架构中，第二接入管理网元直接向第一接入管理网元发送第五消息。
S302、第一接入管理网元根据第五消息，向终端设备发送第六消息。相应的，终端设备接收第一接入管理网元发送的第六消息。
其中，第六消息用于表示不允许终端设备接入第一切片。应理解，上述不允许可以采用其他描述方式，例如不提供(not provide)，废除/撤销(revoke)，拒绝(reject)，禁用(disable)，去激活(disactivate)等，本申请实施例对此不作限制。
一种可能的实现方式中，第六消息可以包括rejected NSSAI，rejected NSSAI包括所述第一切片的S-NSSAI。
基于图10所示的实施例，第一接入管理网元接收到终端设备发送的第一切片的标识信息，代理终端设备请求接入第二网络。在第二网络注册失败的情况下，或者在第二网络注册成功但未获取到任一第二切片的接入权限的情况下，第一接入管理网元通过第六消息，使得终端设备获知自身不具备接入第一切片的权限。在这一过程中，终端设备不直接与第二网络通信，因此终端设备无需与安全网关建立IPsec隧道，因此终端设备无需支持IPsec协议栈，从而减少终端设备的制造成本。
以下结合图11，举例说明PDU会话建立场景下网络互通的方法。如图11所示，该方法包括：
S101：可以参考图8中S101的描述。
在PDU会话建立场景下，上述步骤S101可以具体实现为：终端设备向第一接入管理网元发送第一消息。第一消息可以用于请求在建立第一切片关联的第一PDU会话。
一种可能的设计中，第一消息即为第一PDU会话建立请求消息。从而，第一消息包括第一切片的标识，即为第一PDU会话建立请求消息包括第一切片的标识。
另一种可能的设计中，第一消息可以包括第一切片的标识信息和第一PDU会话建立请求消息。
其中，上述第一PDU会话建立请求消息用于请求建立第一PDU会话。第一PDU会话建立请求消息可以包括第一PDU会话的标识。
应理解，第一PDU会话可以是基于用户面的PDU会话，或者是基于控制面的PDU会话，以适应不同的第一网络和第二网络的互通架构。
例如，在图7(a)、图7(b)或图7(d)所示的架构中，第一网络中的第一用户面网元具有和第二网络中的相关网元进行通信的隧道(或者说连接)，因此第一用户面网元可以负责数据包在第一PDU会话和第二PDU会话之间的转发，因此第一PDU会话可以建立为基于用户面的PDU会话。
又例如，在图7(c)所示的架构中，第一网络中的第一用户面网元不具有和第二 网络中的相关网元进行通信的隧道(或者说连接)，因此第一用户面网元不能够负责数据包在第一PDU会话和第二PDU会话之间的转发，因此第一PDU会话需要建立为基于控制面的PDU会话。也即，第一接入管理网元负责数据包在第一PDU会话和第二PDU会话之间的转发。
基于图7(c)所示的架构中，在第一PDU会话为基于控制面的PDU会话的情况下，第一PDU会话中的数据包的上行传输路径为：UE->第一接入管理网元->N3IWF；第一PDU会话中的数据包的下行传输路径为：N3IWF->第一接入管理网元->UE。
S102：可以参考图8中S102的描述。
在PDU会话建立场景下，上述步骤S102可以具体实现为：第一接入管理网元向第二接入管理网元发送第二消息。
第二消息用于请求接入第二网络，可以具体实现为：第二消息用于请求建立第二PDU会话。示例性的，第二消息可以包括第二PDU会话建立请求消息，或者第二消息即为第二PDU会话建立请求消息。
其中，第二PDU会话建立请求消息用于请求建立第二PDU会话，第二PDU会话建立请求消息可以包括第二PDU会话的标识。第二PDU会话的标识不同于第一PDU会话的标识。可选的，第二PDU会话的标识可以由第一接入管理网元来配置。
可选的，第一接入管理网元可以获取第一PDU会话的IP地址，并向第二接入管理网元发送第一PDU会话的地址。
示例性的，第一接入管理网元可以从第一会话管理网元获取第一PDU会话的IP地址，第一会话管理网元为第一网络中用于负责管理第一PDU会话的会话管理网元。从而，第一接入管理网元可以将第一PDU会话的IP地址封装到第二消息中，以使得第二接入管理网元可以根据第二消息，获取到第一PDU会话的IP地址。
可选的，第一PDU会话的IP地址可以承载于第二消息中。
应理解，第二消息可以用第一接入网设备在注册到第二网络的过程中获取到的第二安全上下文进行处理(例如加密保护、完整性保护等)。
第二接入管理网元在接收到用于请求建立第二PDU会话的第二消息之后，可以执行第二PDU会话的建立流程。
可选的，第二消息包括第一PDU会话的IP地址。第二接入管理网元可以从第一接入管理网元获取到第一PDU会话的IP地址。第二接入管理网元可以通过第二会话管理网元向第二用户面网元发送第一PDU会话的IP地址。其中，第二会话管理网元和第二用户面网元属于第二网络。并且，在第二PDU会话建立的过程中，第二会话管理网元会配置第二PDU会话的IP地址，并将第二PDU会话的IP地址发送给第二用户面网元。从而，第二用户面网元可以获知第一PDU会话的IP地址和第二PDU会话的IP地址之间的关联关系，从而第二用户面网元可以负责数据包在第一PDU会话和第二PDU会话之间的转发。
可选的，第二消息也可以不包括第一PDU会话的IP地址。例如，针对上述图7(a)、图7(b)或者其他类似的架构，N3IWF与第一网络中的一个第一用户面网元有连接，从而N3IWF通过第一用户面网元在第二PDU会话和第一PDU会话之间进行数据转发。示例性的，N3IWF将第二用户面网元传输的下行用户面数据转发到第一用 户面网元，第一用户面网元将该下行用户面数据通过转发给终端设备。
可选的，基于图7(a)-图7(c)所示的架构中，在第二PDU会话的建立流程中，需要配置N3WIF和第二用户面网元之间的连接，以保证数据包在第一PDU会话和第二PDU会话之间的正常转发。其中，第二用户面网元为第二网络中服务于第二PDU会话的用户面网元。
示例性的，在第二网络为终端设备建立第二PDU会话的过程中，N3IWF获取第一路由规则，该第一路由规则用于转发第二PDU会话的数据包；N3IWF根据第一路由规则，转发第二PDU会话的数据包。
可选的，第一路由规则用于指示将源地址为第二PDU会话的IP地址的上行数据包转发给服务于第二PDU会话的第二用户面网元。从而，N3IWF根据第一路由规则，转发第二PDU会话的数据包，可以具体实现为：N3IWF从第一网络的第一用户面网元或者第一接入管理网元接收第二PDU会话的上行数据包；N3IWF根据第一路由规则，向服务于第二PDU会话的第二用户面网元发送第二PDU会话的上行数据包。
可选的，第一路由规则还用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一网络中的第一接入管理网元或第一用户面网元。从而，N3IWF根据第一路由规则，转发第二PDU会话的数据包，包括：N3IWF从服务于第二PDU会话的第二用户面网元接收第二PDU会话的下行数据包；N3IWF根据第一路由规则，向第一网络的第一用户面网元或者第一接入管理网元发送第二PDU会话的上行数据包。
可选的，在第二PDU会话建立成功的情况下，该方法还可以包括以下步骤：
S401、第二接入管理网元向第一接入管理网元发送第七消息。相应的，第一接入管理网元接收第二接入管理网元发送的第七消息。
其中，第七消息用于表示第二PDU会话建立成功。
下面结合图7(a)-图7(b)所示的架构，具体说明第二接入管理网元向第一接入管理网元发送第七消息的具体实现方式。
例如，基于图7(a)或图7(c)所示的架构中，第二接入管理网元向N3IWF发送第五消息；N3IWF向第一接入管理网元发送第七消息。
又例如，基于图7(b)所示的架构中，第二接入管理网元向N3IWF发送第七消息；N3IWF向第一用户面网元发送第七消息；第一用户面网元向第一会话管理网元发送第七消息；第一会话管理网元向第一接入管理网元发送第七消息。
又例如，基于图7(d)所示的架构中，第二接入管理网元直接向第一接入管理网元发送第七消息。
S402、第一接入管理网元根据第七消息，执行第一PDU会话的建立流程。
在第二PDU会话建立的流程中，第一接入管理网元可以从第二接入管理网元获取到第二PDU会话的IP地址。在第一PDU会话的建立流程中，第一接入管理网元可以向第一用户面网元发送第二PDU会话的IP地址。并且，在第一PDU会话的建立流程中，第一会话管理网元会配置第一PDU会话的IP地址，并将第一PDU会话的IP地址发送给第一用户面网元。从而，第一用户面网元可以获知第一PDU会话的IP地址和第二PDU会话的IP地址之间的关联关系。第一用户面网元根据该关联关系对终端设备的数据包在第一PDU会话和第二PDU会话之间进行转发。
示例性的，第一接入管理网元可以向第一用户面网元发送第二PDU会话的IP地址可以具体实现为：第一接入管理网元向第一会话管理网元发送第八消息，第八消息包括第二PDU会话的IP地址。之后，第一会话管理网元根据第八消息，获取到第二PDU会话的IP地址，再将第二PDU会话的IP地址发送给第一用户面网元。可选的，第八消息还包括第一PDU会话的标识和第二PDU会话的标识。
例如，上述第八消息可以为PDU会话上下文创建请求消息，例如Nsmf_PDUSession_CreateSMContext Request。
示例性的，第一会话管理网元可以向第一用户面网元发送第二路由规则，该第二路由规则包括第一PDU会话的IP地址和第二PDU会话的IP地址，以实现向第一用户面网元发送第一PDU会话的IP地址和第二PDU会话的IP地址的目的。
示例性的，第一会话管理网元可以向第一用户面网元发送第二路由规则，可以具体实现为：第一会话管理网元向第一用户面网元发送N4会话创建/修改消息，该N4会话创建/修改消息包括第二路由规则。
例如，上述第二路由规则可以包括分组检测规则(packet detection rule，PDR)，转发动作规则(forwarding action rule，FAR)。
可选，第二路由规则用于指示将上行数据包的源地址从第一PDU会话的IP地址修改为第二PDU会话的IP地址，并将修改后的上行数据包发送给第二网络(例如第二用户面网元)。
例如，对于上行数据包，第二路由规则中的PDR可以包括第一PDU会话的IP地址，PDR对应的FAR可以包括第二PDU会话的IP地址。基于该第二路由规则，当上行数据包的源地址与PDR所包括的第一PDU会话的IP地址相匹配时，第一用户面网元根据该PDR对应的FAR，将上行数据包的源地址修改为第二PDU会话的IP地址，并将修改后的上行数据包发送给第二网络。
可选的，第二路由规则还用于指示将下行数据包的目的地址从第二PDU会话的IP地址修改为第一PDU会话的IP地址，并将修改后的上行数据包发送给服务于终端设备的接入网设备。
又例如，对于下行数据包，第二路由规则中的PDR可以包括第二PDU会话的IP地址，PDR对应的FAR可以包括第一PDU会话的IP地址。基于该第二路由规则，当下行数据包的目的地址与PDR所包括的第二PDU会话的IP地址相匹配时，第一用户面网元根据该PDR对应的FAR，将下行数据包的目的IP地址修改为第一PDU会话的IP地址，并将修改后的下行数据包发送给服务于终端设备的接入网设备。接入网设备将下行数据包转发给终端设备。
上述第一用户面网元和第一会话管理网元属于第一网络。示例性的，第一用户面网元可以为UPF或者未来网络中承担用户面功能的网元。第一会话管理网元可以为SMF或者未来网络中承担会话管理功能的网元。
在第一PDU会话建立成功的情况下，第一接入管理网元可以执行下述步骤S403。
S403、第一接入管理网元向终端设备发送第九消息。相应的，终端设备接收第一接入管理网元发送的第九消息。
其中，第九消息用于表示第一PDU会话建立成功。
基于图11所示的实施例，在第二PDU会话建立成功的情况下，第一接入管理网元发起第一PDU会话的建立流程，以建立第一PDU会话。从而，可以实现将第一PDU会话和第二PDU会话进行关联，从而打通终端设备到第二网络的数据通道。
以下针对图11所示的网络互通方法应用在图7(a)或图7(b)所示的第一网络和第二网络的互通架构下的具体实现进行说明。
如图12所示，该网络互通方法包括以下步骤：
S501、可以参考图11中的步骤S101。
S502、可以参考图11中的步骤S102。
S503、第二接入管理网元选择第二会话管理网元。
S504、第二接入管理网元向第二会话管理网元发送PDU会话上下文创建请求消息。相应的，第二会话管理网元从第二接入管理网元接收PDU会话上下文创建请求消息。
其中，PDU会话上下文创建请求消息包括第二PDU会话的标识。
示例性的，PDU会话上下文创建请求消息可以有其他名称，例如Nsmf_PDUSession_CreateSMContext Request，对此不作限定。
基于PDU会话上下文创建请求消息，第二会话管理网元可以创建第二PDU会话的上下文。
S505、第二会话管理网元向第二接入管理网元发送PDU会话上下文创建响应消息。相应的，第二接入管理网元从第二会话管理网元接收PDU会话上下文创建响应消息。
S506、第二会话管理网元选择第二用户面网元。
第二会话管理网元会配置第二PDU会话的IP地址。
S507、第二会话管理网元向第二用户面网元发送N4会话建立/修改请求(N4 Session Establishment/Modification Request)消息。相应的，第二用户面网元从第二会话管理网元接收N4会话建立/修改请求消息。
其中，N4会话建立/修改请求消息用于建立第二PDU会话的N4会话的上下文。
在本申请实施例中，N4会话建立/修改请求消息包括第二PDU会话的IP地址。
应理解，N4会话建立/修改请求消息可以包括第三路由规则。第三路由规则用于将第二PDU会话的下行数据包发送给N3IWF；或者说，第三路由规则用于将目的地址为第二PDU会话的IP地址的下行数据包发送给N3IWF。
S508、第二用户面网元向第二会话管理网元发送N4会话建立/修改响应(N4 Session Establishment/Modification Response)消息。相应的，第二会话管理网元从第二用户面网元接收N4会话建立/修改响应消息。
S509、第二会话管理网元向第二接入管理网元发送Namf_Communication_N1N2MessageTransfer消息。相应的，第二接入管理网元接收第二会话管理网元发送的Namf_Communication_N1N2MessageTransfer消息。
其中，Namf_Communication_N1N2MessageTransfer消息包括第二PDU会话的标识、N2会话管理(session management，SM)信息，以及N1 SM容器(container)。
示例性的，N2 SM信息可以包括第二PDU会话的标识，服务质量(quality of service，QoS)配置信息，核心网(core network，CN)隧道信息和第二PDU会话的类型。应理解，N2 SM信息还可以直接包括上述第一路由规则，或者用于配置第一路由规则的 参数(如第二PDU会话的IP地址等)。
示例性的，N1 SM容器可以包括PDU会话建立接受(PDU session establishment accept)消息。其中，PDU会话建立接受消息可以包括QoS规则、第二PDU会话的类型和第二PDU会话的IP地址。应理解，N1 SM容器还可以包括其他参数，在此不一一列举。
S510、第二接入管理网元向N3IWF发送N2 PDU会话建立请求消息。相应的，N3IWF接收第二接入管理网元发送的N2 PDU会话建立请求消息。
其中，N2 PDU会话建立请求消息包括N2 SM信息以及NAS消息。NAS消息包括第二PDU会话的标识以及N1 SM容器。
可选的，基于N2 SM信息，N3IWF可以从N2 SM消息中获取第一路由规则。或者，N3IWF可以根据N2 SM信息所包括的用于配置第一路由规则的参数，配置第一路由规则。
示例性的，在图7(a)或图7(b)所示架构中，第一路由规则用于指示将源地址为第二PDU会话的IP地址的上行数据包转发给第二用户面网元。或者，第一路由规则用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一用户面网元。
S511、N3IWF向第一接入管理网元发送NAS消息。相应的，第一接入管理网元接收N3IWF发送的NAS消息。
示例性的，基于图7(a)所示的架构，N3IWF向第一接入管理网元发送该NAS消息。
示例性的，基于图7(b)所示的架构，N3IWF向第一用户面网元发送该NAS消息，第一用户面网元向第一会话管理网元发送该NAS消息，第一会话管理网元向第一接入管理网元发送该NAS消息。
应理解，步骤S510和步骤S511可以使得第二接入管理网元向第一接入管理网元发送PDU会话建立接受消息，相当于实现了图11中的步骤S401。
在完成步骤S511之后，N3IWF可以向第二接入管理网元发送N2 PDU会话建立响应消息。
应理解，上述步骤S502-S511仅是介绍了第二PDU会话建立流程中的一些步骤，第二PDU会话建立流程还可以包括其他步骤，对此不作限定。
S512、第一接入管理网元选择第一会话管理网元。
S513、第一接入管理网元向第一会话管理网元发送PDU会话上下文创建请求消息。相应的，第一会话管理网元从第一接入管理网元接收PDU会话上下文创建请求消息。
其中，PDU会话上下文创建请求消息包括第一PDU会话的标识和第二PDU会话的IP地址。
基于PDU会话上下文创建请求消息，第一会话管理网元可以创建第一PDU会话的上下文。
S514、第一会话管理网元向第一接入管理网元发送PDU会话上下文创建响应消息。相应的，第一接入管理网元从第一会话管理网元接收PDU会话上下文创建响应消息。
S515、第一会话管理网元选择第一用户面网元。
第一会话管理网元配置第一PDU会话的IP地址。
S516、第一会话管理网元向第一用户面网元发送N4会话建立/修改请求消息。相应的，第一用户面网元从第一会话管理网元接收N4会话建立/修改请求消息。
其中，N4会话建立/修改请求消息用于建立第一PDU会话的N4会话的上下文。
在本申请实施例中，该N4会话建立/修改请求消息包括第一PDU会话的IP地址和第二PDU会话的IP地址。
示例性的，N4会话建立/修改请求消息包括第二路由规则。其中，第二路由规则的具体描述可以参考前文的具体介绍，在此不再赘述。
S517、第一用户面网元向第一会话管理网元发送N4会话建立/修改响应消息。相应的，第二会话管理网元从第二用户面网元接收N4会话建立/修改响应消息。
S518、第一会话管理网元向第一接入管理网元发送Namf_Communication_N1N2MessageTransfer消息。相应的，第一接入管理网元接收第一会话管理网元发送的Namf_Communication_N1N2MessageTransfer消息。
其中，Namf_Communication_N1N2MessageTransfer消息包括第一PDU会话的标识、N2会话管理(session management，SM)信息，以及N1 SM容器(container)。
示例性的，N2 SM信息可以包括第一PDU会话的标识，服务质量(quality of service，QoS)配置信息，核心网(core network，CN)隧道信息和第一PDU会话的类型。应理解，N2 SM信息还可以包括第四路由规则，或者用于配置第四路由规则的参数(例如第一PDU会话的IP地址)。第四路由规则用于第一接入网设备转发第一PDU会话的数据包。
示例性的，N1 SM容器可以包括PDU会话建立接受(PDU session establishment accept)消息。其中，PDU会话建立接受消息可以包括QoS规则、第一PDU会话的类型和第一PDU会话的IP地址。应理解，N1 SM容器还可以包括其他参数，在此不一一列举。
S519、第一接入管理网元向第一接入网设备发送N2 PDU会话建立请求消息。相应的，第一接入网设备接收第一接入管理网元发送的N2 PDU会话建立请求消息。
其中，N2 PDU会话建立请求消息包括N2 SM信息以及NAS消息。NAS消息包括第一PDU会话的标识以及N1 SM容器。
基于N2 SM信息，第一接入网设备可以从N2 SM信息获取第四路由规则；或者，第一接入网设备用于根据N2 SM信息所包括的用于配置第四路由规则的参数，配置第四路由规则。
其中，第四路由规则用于指示将源地址为第一PDU会话的IP地址的上行数据包转发给第一用户面网元。
第四路由规则还用于指示将目的地址为第一PDU会话的IP地址的下行数据包转发给终端设备。
S520、第一接入网设备向终端设备发送NAS消息。相应的，终端设备从第一接入网设备接收NAS消息。
其中，NAS消息包括N1 SM容器，N1 SM容器包括PDU会话建立接受消息。
应理解，步骤S519和S520可以使得第一接入管理网元向终端设备发送PDU会话 建立接受消息，相当于实现了图11中的S402。
在步骤S520之后，第一接入网设备可以向第一接入管理网元发送N2 PDU会话建立响应消息。
应理解，上述步骤S512-S520仅介绍了第一PDU会话的建立流程中的一部分步骤，第一PDU会话的建立流程还可以有其他步骤，对不作限定。
基于图12所示的实施例，基于图7(a)或图7(b)所示的架构下，通过在第一网络中建立第一PDU会话，在第二网络中建立第二PDU会话，并将第一PDU会话和第二PDU会话关联起来(例如第一用户面网元获取第一PDU会话的IP地址和第二PDU会话的IP地址)。从而，终端设备可以通过第一网络传输数据到第二网络，或者终端设备可以通过第一网络接收到第二网络下发的数据。
基于图12所示的实施例，以下结合图13(a)来具体说明上行数据在图7(a)或图7(b)所示的架构下的传输流程。如图13(a)所示，该方法包括以下步骤：
S601、终端设备向第一接入网设备发送第一数据包。
其中，该第一数据包可以包括第一PDU会话的IP地址。
S602、第一接入网设备向第一用户面网元发送第一数据包。
作为一种可能的实现方式，第一接入网设备基于第一PDU会话建立流程中配置的路由规则，将第一数据包转发给第一用户面网元。
S603、第一用户面网元基于第一数据包，向N3IWF发送第二数据包。
作为一种可能的实现方式，第一用户面网元将第一数据包中的第一PDU会话的IP地址替换为第二PDU的IP地址，生成第二数据包；第一用户面网元通过与N3IWF之间预设的安全隧道向N3IWF发送第二数据包。
S604、N3IWF向第二用户面网元发送第二数据包。
作为一种可能的实现方式，N3IWF基于第二PDU会话建立流程中配置的路由规则，将第二数据包转发给第二用户面网元。
可选的，第二用户面网元接收到第二数据包之后，可以将第二数据包转发到相应的数据网络中。
基于图13(a)所示实施例，终端设备可以通过第一网络向第二网络发送数据。
基于图12所示的实施例，以下结合图13(b)来具体说明下行数据在图7(a)或图7(b)所示的架构下的传输流程。如图13(b)所示，该方法包括以下步骤：
S701、第二用户面网元向N3IWF发送第三数据包。
其中，第三数据包包括第二PDU会话的IP地址。
可选的，第三数据包可以是数据网络发送给第二用户面网元的。
S702、N3IWF向第一用户面网元发送第三数据包。
作为一种可能的实现方式，N3IWF通过与第一用户面网元之间预先建立的安全隧道，向第一用户面网元发送第三数据包。
可选的，N3IWF根据第二PDU会话建立流程中配置的第一路由规则，将第三数据包转发给第一用户面网元。
S703、第一用户面网元基于第三数据包，向第一接入网设备发送第四数据包。
作为一种可能的实现方式，第一用户面网元将第三数据包中的第二PDU会话的IP 地址替换为第一PDU会话的IP地址，生成第四数据包；第一用户面网元基于第一PDU会话建立流程中配置的第二路由规则，向第一接入网设备发送第四数据包。
S704、第一接入网设备向终端设备发送第四数据包。
基于图13(b)所示实施例，终端设备可以通过第一网络从第二网络获取到数据。
以下针对图11所示的网络互通方法应用在图7(c)所示的第一网络和第二网络的互通架构下的具体实现进行说明。如图14所示，该网络互通方法包括以下步骤：
S801-S814、与步骤S510-S514相似，其具体描述可以参考图12所示的实施例，在此不再赘述。
可选的，S810中，基于N2 SM信息，N3IWF可以从N2 SM消息中获取第一路由规则。或者，N3IWF可以根据N2 SM信息所包括的用于配置第一路由规则的参数，配置第一路由规则。
示例性的，在图7(c)所示架构中，第一路由规则则用于指示将源地址为第二PDU会话的IP地址的上行数据包转发给第二用户面网元。或者，第一路由规则用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一接入管理网元。
可选的，在步骤S813中，第一接入管理网元向第一会话管理网元发送的PDU会话上下文创建请求消息可以包括第三指示信息，第三指示信息用于指示由第一接入管理网元来负责传输第一PDU会话的数据包。从而，第一会话管理网元可以不用选择第一用户面网元，以及不用执行与第一用户面网元的交互操作(例如向第一用户面网元发送N4会话建立/修改请求消息，或者从第一用户面网元接收N4会话建立/修改响应消息)。
可选的，在步骤S813之后，第一会话管理网元也可以选择第一用户面网元，并执行与第一用户面网元的交互操作。应理解，在图7(c)所示架构中，即使第一会话管理网元选择第一用户面网元，第一用户面网元实际上并不能用于负责数据包在第一PDU会话和第二PDU会话之间的传输。
S815、第一会话管理网元向第一接入管理网元发送Namf_Communication_N1N2MessageTransfer消息。相应的，第一接入管理网元接收第一会话管理网元发送的Namf_Communication_N1N2MessageTransfer消息。
其中，Namf_Communication_N1N2MessageTransfer消息包括第一PDU会话的标识、N2会话管理(session management，SM)信息，以及N1 SM容器(container)。
可选的，在接收到Namf_Communication_N1N2MessageTransfer消息之后，第一接入管理网元可以配置第五路由规则，第五路由规则用于第一接入管理网元负责数据包在第一PDU会话和第二PDU会话之间的转发。
示例性的，第五路由规则用于上行数据包的源地址从第一PDU会话的IP地址修改为第二PDU会话的IP地址，并将修改后的上行数据包转发给第二网络(例如N3IWF或者第二用户面网元)。
示例性的，第五路由规则还用于将下行数据包的目标IP地址从第二PDU会话的IP地址修改为第一PDU会话的IP地址，并将修改后的下行数据包转发给第一接入网设备。
S812-S815可选。S816-S817、可以参考图11中的步骤S519-S520。
基于图14所示的实施例，在图7(c)所示的架构下，在第一网络中建立基于控制面的第一PDU会话，在第二网络中建立基于用户面的第二PDU会话。从而，终端设备可以通过第一网络传输数据到第二网络，以及终端设备可以通过第一网络接收到第二网络下发的数据。
基于图14所示的实施例，以下结合图15(a)来具体说明上行数据在图7(c)所示的架构下的传输流程。如图15(a)所示，该方法包括以下步骤：
S901、终端设备向第一接入网设备发送NAS消息。
其中，NAS消息包括第一PDU会话的标识和第一数据包。
S902、第一接入网设备向第一接入管理网元发送NAS消息。
应理解，对于NAS消息，第一接入网设备仅在终端设备和第一接入管理网元之间进行透传，不会对NAS消息进行其他处理。
S903、第一接入管理网元根据NAS消息，向N3IWF发送第二数据包。
作为一种可能的实现方式，第一接入管理网元将第一数据包中的第一PDU会话的IP地址替换为第二PDU的IP地址，生成第二数据包。第一接入管理网元通过与N3IWF之间的安全隧道，向N3IWF发送第二数据包。
S904、N3IWF向第二用户面网元发送第二数据包。
作为一种可能的实现方式，N3IWF基于第二PDU会话建立流程中配置的路由规则，将第二数据包转发给第二用户面网元。
可选的，第二用户面网元接收到第二数据包之后，可以将第二数据包转发到相应的数据网络中。
基于图15(a)所示实施例，终端设备可以通过第一网络向第二网络发送数据。
基于图14所示的实施例，以下结合图15(b)来具体说明下行数据在图7(c)所示的架构下的传输流程。如图15(b)所示，该方法包括以下步骤：
S1001、第二用户面网元向N3IWF发送第三数据包。
其中，第三数据包包括第二PDU会话的IP地址。
可选的，第三数据包可以是数据网络发送给第二用户面网元的。
S1002、N3IWF向第一接入管理网元发送第三数据包。
作为一种可能的实现方式，N3IWF通过与第一接入管理网元之间预先建立的安全隧道，向第一接入管理网元发送第三数据包。
可选的，N3IWF根据第二PDU会话建立流程中配置的第一路由规则，将第三数据包转发给第一接入管理网元。
S1003、第一接入管理网元基于第三数据包，向第一接入网设备发送下行NAS传输(downlink NAS transport)消息。
其中，下行NAS传输(downlink NAS transport)消息包括第一PDU会话的标识以及第四数据包。
可选的，第一接入管理网元将第三数据包中的第二PDU会话的IP地址替换为第一PDU会话的IP地址，生成第四数据包。
S1004、第一接入网设备向终端设备发送无线资源控制(radio resource control，RRC)下行消息。
其中，RRC下行消息包括第四数据包。
基于图15(b)所示的实施例，终端设备能够通过第一网络接收第二网络下的数据。
以下结合图16，举例说明PDU会话建立场景下的另一种网络互通的方法。如图12所示，该方法包括：
S101：可以参考图11中S101的描述。
S102：可以参考图11中S102的描述。
可选的，在第二PDU会话建立失败的情况下，该方法还可以包括以下步骤：
S1101、第二接入管理网元向第一接入管理网元发送第十消息。相应的，第一接入管理网元接收第二接入管理网元发送的第十消息。
其中，第十消息用于表示第二PDU会话建立失败。
S1102、第一接入管理网元根据第十消息，向终端设备发送第十一消息。相应的，终端设备接收第一接入管理网元发送的第十一消息。
其中，第十一消息用于表示第一PDU会话建立失败。
基于图16所示的实施例，在第二PDU会话建立失败的情况下，第一接入管理网元仅需要向终端设备发送第十一消息，而不用执行相关技术中PDU会话建立流程中的一些其他步骤，从而有利于节省信令开销以及相应的资源消耗。
可选的，在实际应用中，一些情况下，终端设备需要具备通过第一网络接入第二网络的权限，以使用第二网络提供的服务。示例性的，以第一网络为私网，第二网络为公网为例，在员工需要与客户进行视频会议时，员工使用的终端设备需要具备从公司的私网接入公网的权限，以便于通过公网与客户使用的终端设备建立视频会议的相关连接。
在另一些情况下，终端设备不需要具备通过第一网络接入第二网络的权限，以保证私密性。示例性的，以第一网络为私网，第二网络为公网为例，在员工在进行技术开发时，需要禁止员工使用的终端设备通过公司的私网接入公网，以避免技术泄露。
可见，在实际应用中，有必要对终端设备是否具备通过第一网络接入第二网络的权限进行管控，以满足在不同场景下的使用需求。
对此，本申请实施例提供如下图17和图19所示的技术方案。其中，图17所示的技术方案用于开启终端设备接入第一切片的权限。图19所示的技术方案用于关闭终端设备接入第一切片的权限。这样一来，可以通过对终端设备接入第一切片的权限进行管控，来间接实现对终端设备具备通过第一网络接入第二网络的权限的管控。
应理解，图17或图19所示的技术方案可以和前述图8-图16所示的技术方案中的任意一个相互结合使用。
如图17所示，为本申请实施例提供的一种网络互通的方法，该方法包括以下步骤：
S1201、第一接入管理网元确定开启终端设备接入第一切片的权限。
应理解，开启还可以替换为提供(provide)，授予(grant)，接受(accept)，使能(able)、激活(activate)等类似描述，对此不作限定。
可选的，步骤S601可以采用以下实现方式中的任意一种：
实现方式一、第一接入管理网元接收管理系统发送的第一指示信息，第一指示信 息用于指示开启终端设备接入第一切片的权限。
示例性的，上述管理系统可以为操作维护管理(operation administration and maintenance)系统。
实现方式二、第一接入管理网元根据本地配置的策略，确定开启终端设备接入第一切片的权限。
示例性的，上述本地配置的策略可以基于时间或者终端设备所处的位置来确定。
实现方式三、第一接入管理网元接收第二接入管理网元发送的第十四消息。其中，第十四消息用于指示开启第一切片对应的一个或多个第二切片的接入权限。
S1202、第一接入管理网元向终端设备发送第十二消息。相应的，终端设备接收第一接入管理网元发送的第十二消息。
其中，第十二消息用于指示开启终端设备接入第一切片的权限。
一种可能的实现方式中，第十二消息包括allowed NSSAI，allowed NSSAI包括第一切片的S-NSSAI。
示例性的，第十二消息可以为用户设备配置更新命令(UE configuration update command)消息或者下行NAS传输消息(DL NAS transport message)或者其它的NAS消息。
可选的，在执行步骤S602之前，第一接入管理网元还可以先向第二接入管理网元发送注册请求消息，该注册请求消息的具体实现可以参考上述注册场景中的第二消息。之后，在第一接入管理网元接收到第二接入管理网元发送的注册接受消息之后，第一接入管理网元再执行步骤S602。
基于图17所示的实施例，第一接入管理网元通过第十二消息，使得终端设备获知自身具备接入第一切片的权限。从而，终端设备在本地维护的allowed NSSAI包括第一切片的S-NSSAI。进而，在终端设备需要使用第二网络的相关业务的情况下，终端设备可以发起接入第一切片的相关流程(例如图8中的步骤S101)。
以下结合图18，举例说明注册场景下另一种网络互通的方法。如图18所示，该方法包括：
S1301：可以参考图17中的S1201的描述。
S1302、可以参考图9中的S102的描述。
S1303、可以参考图9中的S201的描述。
S1304、可以参考图17中的S1202的描述。
基于图18所示，在第一接入管理网元确定开启终端设备接入第一切片的权限的情况下，第一接入管理网元先向第二接入管理网元请求接入第二网络。在允许接入第二网络的情况下，第一接入管理网元向终端设备发送第十二消息，以开启终端设备接入第一切片的权限。这样一来，保证终端设备在后续需要接入第一切片的情况下，终端设备可以接入第一切片。
可选的，在注册流程中，若第二接入管理网元向第一接入管理网元指示不允许接入第二网络，或者不允许使用第二网络的业务，则第一接入管理网元不向终端设备发送第十二消息，以避免终端设备发起不必要的流程(例如接入第一切片的相关流程)，从而减少不必要的信令开销。
如图19所示，为本申请实施例提供的一种网络互通的方法，该方法包括以下步骤：
S1401、第一接入管理网元确定关闭终端设备接入第一切片的权限。
应理解，上述关闭可以采用其他描述方式，例如不提供(Not provide)，废除/撤销(revoke)，拒绝(reject)，禁用(disable)，去激活(dis activate)，本申请实施例对此不作限制。
可选的，步骤S1401可以采用以下实现方式中的任意一种：
实现方式一、第一接入管理网元接收管理系统发送的第二指示信息，该第二指示信息用于指示关闭终端设备接入第一切片的权限。
实现方式二、第一接入管理网元根据本地配置的策略，确定关闭终端设备接入第一切片的权限。
示例性的，上述本地配置的策略可以基于时间或者终端设备所处的位置来确定。
实现方式三、第一接入管理网元接收第二接入管理网元发送的第十五消息，该第十五消息用于关闭第一切片对应的所有第二切片的权限。
可选的，在确定关闭终端设备接入第一切片的权限之后，若终端设备在第一切片上建立有第一PDU会话，第一接入管理网元需要执行相应的PDU会话释放流程，以释放第一PDU会话和第二PDU会话。
可选的，在确定关闭终端设备接入第一切片的权限之后，第一接入管理网元可以发起第二网络中与第二身份信息关联的去注册流程。示例性的，第一接入管理网元向第二接入管理网元发送去注册请求消息；之后，第一接入管理网元接收第二接入管理网元发送的去注册完成消息。
可选的，在多个终端设备的身份信息关联同一个第二身份信息的情况下，若多个终端设备中存在至少一个终端设备具备接入第一切片的权限，则第一接入管理网元不应该发起第二网络中与第二身份信息关联的去注册流程。这样一来，避免影响到具备接入第一切片权限的终端设备的正常使用。
可选的，在接收到去注册完成消息之后，第一接入管理网元删除第二身份信息相关的安全上下文信息等。这样可以避免第一接入管理网元存储不必要的信息，节省第一接入管理网元的存储空间。
可选的，在接收到去注册完成消息之后，第一接入管理网元还可以删除第二身份信息与第一切片的标识信息之间的关联关系。这样相当于将第二身份信息与第一切片进行解耦，第一接入管理网元可以使用第二身份信息绑定其他网络切片。
可选的，在接收到去注册完成消息之后，第一接入管理网元还可以删除第二身份信息与第一身份信息之间的关联关系。这样相当于将第二身份信息进行回收，第一接入管理网元可以使用第二身份信息来代理第一网络中的其他终端设备去接入第二网络。
S1402、第一接入管理网元向终端设备发送第十三消息。相应的，终端设备接收第一接入管理网元发送的第十三消息。
其中，第十三消息用于指示关闭终端设备接入第一切片的权限。
一种可能的实现方式中，第十三消息包括rejected NSSAI，该rejected NSSAI包括第一切片的S-NSSAI。
示例性的，第十三消息可以为用户设备配置更新命令(UE configuration update  command)消息或者下行NAS传输消息(DL NAS transport message)或者其它的NAS消息。
基于图19所示的实施例，第一接入管理网元可以通过第十三消息，关闭终端设备接入第一切片的权限，实现对终端设备接入第一切片的管控。
上述主要从方法的角度对本申请实施例提供的方案进行了介绍。可以理解的是，第一接入管理网元和终端设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。结合本申请中所公开的实施例描述的各示例的单元及算法步骤，本申请实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以对每个特定的应用来使用不同的方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的技术方案的范围。
本申请实施例可以根据上述方法示例对第一接入管理网元和终端设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
如图20所示，为本申请实施例提供的一种通信装置，该通信装置包括处理模块201和通信模块202。
示例性的，以通信装置为第一接入管理网元为例，处理模块201用于解析消息(例如第一消息等)，生成消息(例如第二消息等)，图11中的步骤S402，图12中的步骤S512，图17中的步骤S1201，图18中的步骤S1301，图19中的步骤S1401，以及第一接入管理网元需要执行的其他处理操作。通信模块202用于执行图8中的步骤S101-S102，图9中的步骤S201-S202，图10中的步骤S301-S302，图11中的步骤S401和S403，图12中的步骤S501、S502、S511、S513、S514、S518和S519，图14中的步骤S801、S802、S811和S812，图15(a)中的步骤S902和S903，图15(b)中的步骤S1002和S1003，图16中的步骤S1101和S1102，图17中的步骤S1202，图18中的步骤S1302-S1304，图19中的步骤S1402，和/或第一接入管理网元需要执行的其他通信操作。
示例性的，以通信装置为终端设备为例，处理模块201用于生成消息(例如第一消息等)，解析消息(例如第六消息等)，和/或终端设备需要执行的其他处理操作。通信模块202用于执行图8中的步骤S101，图9中的步骤S202，图10中的步骤S302，图11中的步骤S403，图12中的步骤S501和S520，图13(a)中的步骤S601，图13(b)中的步骤S704，图14中的步骤S801和S812，图15(a)中的步骤S901，图15(b)中的步骤S1004，图16中的步骤S1102，图17中的步骤S1202，图18中的步骤S1304，图19中的步骤S1402，和/或终端设备需要执行的其他通信操作。
示例性的，以通信装置为N3IWF为例，处理模块201用于在在第二网络为终端设备建立第二PDU会话的过程中，获取第一路由规则，第一路由规则用于转发第二PDU会话的数据包。通信模块202用于根据第一路由规则，转发第二PDU会话的数据包。
一种可能的设计中，第一路由规则用于指示将源地址为第二PDU会话的IP地址 的上行数据包转发给服务于第二PDU会话的第二用户面网元。
一种可能的设计中，通信模块202，具体用于从第一网络的第一用户面网元或者第一接入管理网元接收第二PDU会话的上行数据包；根据第一路由规则，向服务于第二PDU会话的第二用户面网元发送第二PDU会话的上行数据包。
一种可能的设计中，第一路由规则还用于指示将目的地址为第二PDU会话的IP地址的下行数据包转发给第一网络中的第一接入管理网元或第一用户面网元。
一种可能的设计中，通信模块，具体用于从服务于第二PDU会话的第二用户面网元接收第二PDU会话的下行数据包；根据第一路由规则，向第一网络的第一用户面网元或者第一接入管理网元发送第二PDU会话的上行数据包。
可选，该通信装置还可以包括存储模块203，用于存储通信装置的程序代码和数据，数据可以包括不限于原始数据或者中间数据等。
其中，处理模块201可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
通信模块202可以是通信接口、收发器或收发电路等。以下以通信模块202为通信接口为例进行说明。在具体实现中，该通信接口可以包括多个接口，例如可以包括：基站和终端之间的接口和/或其他接口。
存储模块203可以是存储器。
当处理模块201为处理器，通信模块202为通信接口，存储模块203为存储器时，本申请实施例所涉及的通信装置可以为图21所示。
参阅图21所示，该通信装置包括：处理器301、通信接口302、存储器303。可选的，通信装置还可以包括总线304。其中，通信接口302、处理器301以及存储器303可以通过总线304相互连接；总线304可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线304可以分为地址总线、数据总线、控制总线等。为便于表示，图21中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
可选的，本申请实施例还提供一种携带计算机指令的计算机程序产品，当该计算机指令在计算机上运行时，使得计算机执行上述图8-图19中的方法。
可选的，本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储计算机指令，当该计算机指令在计算机上运行时，使得计算机执行上述图8-图19中的方法。
可选的，本申请实施例还提供一种芯片，包括：处理电路和收发管脚，处理电路和收发管脚用于实现上述图8-图19中的方法。其中，处理电路用于执行相应方法中的处理动作，收发管脚用于执行相应方法中的接收/发送的动作。
可选的，本申请实施例还提供一种通信系统，该通信系统包括第一接入管理网元和N3IWF。第一接入管理网元用于执行上述图8-图19所示的任一方法。N3IWF用于执行图12至图15(b)所示的任一方法。
本领域普通技术人员可以理解：在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD))、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个设备上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个功能单元独立存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (38)

  1. 一种网络互通的方法，其特征在于，所述方法包括：
    第一网络中的第一接入管理网元接收终端设备发送的第一切片的标识信息，所述第一切片是与第二网络的业务相关的切片；
    所述第一接入管理网元根据所述第一切片的标识信息，向所述第二网络中的第二接入管理网元请求接入所述第二网络。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元获取第一身份信息；
    所述第一接入管理网元向所述第二接入管理网元发送第二身份信息，所述第一身份信息用于在所述第一网络中标识所述终端设备，所述第一身份信息不同于所述第二身份信息。
  3. 根据权利要求2所述的方法，其特征在于，所述第一身份信息为国际移动用户识别码IMSI、用户永久标识符SUPI、用户隐藏标识符SUCI和全局唯一的临时用户设备标识GUTI中的至少一项；第二身份信息为以下中的至少一项：IMSI、SUPI、SUCI和GUTI中的至少的一项。
  4. 根据权利要求2或3所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元建立所述第一身份信息和所述第二身份信息之间的关联关系。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述第一切片是所述第一网络中的切片，所述第一接入管理网元根据所述第一切片的标识信息向所述第二网络中的第二接入管理网元请求接入所述第二网络，包括：
    所述第一接入管理网元根据所述第一切片的标识信息向所述第二网络中的第二接入管理网元请求接入所述第二网络的第二切片，所述第二切片与所述第一切片相关联。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述第一切片的标识信息包括在第一消息中，所述第一消息用于请求注册到所述第一网络。
  7. 根据权利要求6所述的方法，其特征在于，所述第一接入管理网元根据所述第一切片的标识信息，向所述第二网络中的第二接入管理网元请求接入所述第二网络，包括：
    所述第一接入管理网元根据所述第一切片的标识信息向所述第二网络中的第二接入管理网元发送第二消息，所述第二消息用于请求注册到所述第二网络。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元接收所述第二接入管理网元发送的第三消息，所述第三消息用于表示注册成功；
    所述第一接入管理网元根据所述第三消息，向所述终端设备发送第四消息，所述第四消息用于表示允许所述终端设备具有接入所述第一切片的权限。
  9. 根据权利要求8所述的方法，其特征在于，所述第四消息用于允许所述终端设备具有接入所述第一切片的权限，包括：
    所述第四消息包括所述第一切片的标识信息。
  10. 根据权利要求1至6任一项所述的方法，其特征在于，所述第一切片的标识 信息包括在第一消息中，所述第一消息用于请求建立所述第一切片关联的第一协议数据单元PDU会话。
  11. 根据权利要求10所述的方法，其特征在于，所述第一接入管理网元根据所述第一切片的标识信息向所述第二网络中的第二接入管理网元请求接入所述第二网络，包括：
    所述第一接入管理网元根据所述第一切片的标识信息，向所述第二网络中的第二接入管理网元发送第二消息，所述第二消息用于请求建立与第一切片相关的第二PDU会话。
  12. 根据权利要求11所述的方法，其特征在于，所述第一消息包括所述第一PDU会话的标识，所述第二消息包括所述第二PDU会话的标识。
  13. 根据权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元接收所述第二接入管理网元发送的第七消息，所述第七消息用于表示所述第二PDU会话建立成功；
    所述第一接入管理网元根据所述第七消息，向所述终端设备发送第九消息，所述第九消息用于表示所述第一PDU会话建立成功。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元从所述第二接入管理网元获取所述第二PDU会话的IP地址；
    所述第一接入管理网元向所述第一网络中的第一用户面网元发送所述第二PDU会话的IP地址。
  15. 根据权利要求1至14任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入管理网元确定开启所述终端设备接入所述第一切片的权限；
    所述第一接入管理网元向所述终端设备发送第十二消息，所述第十二消息用于指示开启所述终端设备接入所述第一切片的权限。
  16. 根据权利要求15所述的方法，其特征在于，所述第十二消息用于指示开启所述第一切片的权限，包括：
    所述第十二消息包括所述第一切片的标识信息。
  17. 根据权利要求1至16任一项所述的方法，其特征在于，所述第一网络为公共网络，所述第二网络为非公共网络；或者，所述第一网络为非公共网络，所述第二网络为公共网络。
  18. 一种通信装置，其特征在于，所述通信装置部署在第一网络中，所述通信装置包括通信模块和处理模块；
    所述通信模块，用于接收终端设备发送的第一切片的标识信息，所述第一切片是与第二网络的业务相关的切片；
    所述处理模块，用于根据所述第一切片的标识信息，控制所述通信模块向所述第二网络中的第二接入管理网元请求接入所述第二网络。
  19. 根据权利要求18所述的装置，其特征在于，
    所述处理模块，还用于获取第一身份信息；
    所述通信模块，还用于向所述第二接入管理网元发送第二身份信息，所述第一身 份信息用于在所述第一网络中标识所述终端设备，所述第一身份信息不同于所述第二身份信息。
  20. 根据权利要求19所述的装置，其特征在于，所述第一身份信息为国际移动用户识别码IMSI、用户永久标识符SUPI、用户隐藏标识符SUCI和全局唯一的临时用户设备标识GUTI中的至少一项；第二身份信息为IMSI、SUPI、SUCI和GUTI中的至少一项。
  21. 根据权利要求19或20所述的装置，其特征在于，
    所述处理模块，还用于建立所述第一身份信息和所述第二身份信息之间的关联关系。
  22. 根据权利要求18至21任一项所述的装置，其特征在于，所述第一切片是所述第一网络中的切片；
    所述处理模块，具体用于根据所述第一切片的标识信息，控制所述通信模块向所述第二网络中的第二接入管理网元请求接入所述第二网络的第二切片，所述第二切片与所述第一切片相关联。
  23. 根据权利要求18至22任一项所述的装置，其特征在于，所述第一切片的标识信息包括在第一消息中，所述第一消息用于请求注册到所述第一网络。
  24. 根据权利要求23所述的装置，其特征在于，
    所述处理模块，具体用于根据所述第一切片的标识信息，控制所述通信模块向所述第二网络中的第二接入管理网元发送第二消息，所述第二消息用于请求注册到所述第二网络。
  25. 根据权利要求24所述的装置，其特征在于，
    所述通信模块，还用于接收所述第二接入管理网元发送的第三消息，所述第三消息用于表示注册成功；根据所述第三消息，向所述终端设备发送第四消息，所述第四消息用于表示允许所述终端设备具有接入所述第一切片的权限。
  26. 根据权利要求25所述的装置，其特征在于，所述第四消息用于允许所述终端设备具有接入所述第一切片的权限，包括：
    所述第四消息包括所述第一切片的标识信息。
  27. 根据权利要求18至22任一项所述的装置，其特征在于，所述第一切片的标识信息包括在第一消息中，所述第一消息用于请求建立所述第一切片关联的第一协议数据单元PDU会话。
  28. 根据权利要求27所述的装置，其特征在于，
    所述处理模块，具体用于根据所述第一切片的标识信息，控制所述通信模块向所述第二网络中的第二接入管理网元发送第二消息，所述第二消息用于请求建立第二PDU会话。
  29. 根据权利要求28所述的装置，其特征在于，所述第一消息包括所述第一PDU会话的标识，所述第二消息包括所述第二PDU会话的标识。
  30. 根据权利要求28或29所述的装置，其特征在于，
    所述通信模块，还用于接收所述第二接入管理网元发送的第七消息，所述第七消息用于表示所述第二PDU会话建立成功；根据所述第七消息，向所述终端设备发送第 九消息，所述第九消息用于表示所述第一PDU会话建立成功。
  31. 根据权利要求30所述的装置，其特征在于，
    所述通信模块，还用于从所述第二接入管理网元获取所述第二PDU会话的IP地址；向所述第一网络中的第一用户面网元发送所述第二PDU会话的IP地址。
  32. 根据权利要求18至31任一项所述的装置，其特征在于，
    所述处理模块，还用于确定开启所述终端设备接入所述第一切片的权限；
    所述通信模块，还用于向所述终端设备发送第十二消息，所述第十二消息用于指示开启所述终端设备接入所述第一切片的权限。
  33. 根据权利要求32所述的装置，其特征在于，所述第十二消息用于指示开启所述第一切片的权限，包括：
    所述第十二消息包括所述第一切片的标识信息。
  34. 根据权利要求18至33任一项所述的装置，其特征在于，所述第一网络为公共网络，所述第二网络为非公共网络；或者，所述第一网络为非公共网络，所述第二网络为公共网络。
  35. 一种通信装置，其特征在于，包括处理器和存储器，所述存储器存储有计算机程序指令，所述处理器读取所述计算机程序指令时执行权利要求1至17任一项所述的方法。
  36. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行如权利要求1至17任一项所述的方法。
  37. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机指令，当所述计算机程序产品在计算机上运行时，使得计算机执行如权利要求1至17任一项所述的方法。
  38. 一种芯片，其特征在于，所述芯片包括处理电路和收发管脚；所述处理电路用于执行权利要求1至17中任一项所述的方法中的处理操作，所述收发管脚用于执行权利要求1至17中任一项所述的方法中的通信操作。
PCT/CN2021/073378 2021-01-22 2021-01-22 网络互通的方法及装置 WO2022155915A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21920313.0A EP4274310A4 (en) 2021-01-22 2021-01-22 METHOD AND DEVICE FOR NETWORK COMMUNICATION
PCT/CN2021/073378 WO2022155915A1 (zh) 2021-01-22 2021-01-22 网络互通的方法及装置
CN202180075753.7A CN116391397A (zh) 2021-01-22 2021-01-22 网络互通的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/073378 WO2022155915A1 (zh) 2021-01-22 2021-01-22 网络互通的方法及装置

Publications (1)

Publication Number Publication Date
WO2022155915A1 true WO2022155915A1 (zh) 2022-07-28

Family

ID=82548388

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/073378 WO2022155915A1 (zh) 2021-01-22 2021-01-22 网络互通的方法及装置

Country Status (3)

Country Link
EP (1) EP4274310A4 (zh)
CN (1) CN116391397A (zh)
WO (1) WO2022155915A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019076273A1 (zh) * 2017-10-17 2019-04-25 华为技术有限公司 一种切换的方法、移动性管理网元和通信系统
CN111225420A (zh) * 2018-11-27 2020-06-02 华为技术有限公司 一种用户接入控制方法、信息发送方法及装置
CN111263424A (zh) * 2018-12-04 2020-06-09 维沃移动通信有限公司 一种接入网络的控制方法及通信设备
WO2020200254A1 (zh) * 2019-04-01 2020-10-08 华为技术有限公司 一种通信方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10791508B2 (en) * 2016-11-18 2020-09-29 Lg Electronics Inc. Method for selecting network node in wireless communication system and device therefor
WO2018205147A1 (zh) * 2017-05-09 2018-11-15 华为技术有限公司 一种基于切片的通信方法和设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019076273A1 (zh) * 2017-10-17 2019-04-25 华为技术有限公司 一种切换的方法、移动性管理网元和通信系统
CN111225420A (zh) * 2018-11-27 2020-06-02 华为技术有限公司 一种用户接入控制方法、信息发送方法及装置
CN111263424A (zh) * 2018-12-04 2020-06-09 维沃移动通信有限公司 一种接入网络的控制方法及通信设备
WO2020200254A1 (zh) * 2019-04-01 2020-10-08 华为技术有限公司 一种通信方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
QUALCOMM INCORPORATED: "Adding support for SNPNs (Stand-alone Non-Public Networks)", 3GPP DRAFT; C1-192126, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. CT WG1, no. Xi'an, P.R. of China; 20190408 - 20190412, 1 April 2019 (2019-04-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051705324 *
See also references of EP4274310A4 *

Also Published As

Publication number Publication date
EP4274310A1 (en) 2023-11-08
CN116391397A (zh) 2023-07-04
EP4274310A4 (en) 2024-02-28

Similar Documents

Publication Publication Date Title
EP3735018B1 (en) Security negotiation method and apparatus
WO2020029938A1 (zh) 安全会话方法和装置
WO2022257549A1 (zh) 网络切片方法、设备及存储介质
US20200252862A1 (en) Method and device for transmitting or receiving information in wireless communication system supporting network slicing
US11871223B2 (en) Authentication method and apparatus and device
CN107105458B (zh) 一种信息处理方法及装置
WO2023279776A1 (zh) 多模终端接入控制方法、装置、电子设备及存储介质
US20220272607A1 (en) Network Access Method and Communication Apparatus
WO2017209367A1 (ko) 무선통신 시스템에서 서비스 별로 단말의 인증을 수행하기 위한 방법 및 이를 위한 장치
WO2021026704A1 (zh) 一种无线通信的方法和装置
CN116325845A (zh) 一种安全通信方法、装置及系统
WO2020253408A1 (zh) 二级认证的方法和装置
WO2022253083A1 (zh) 一种公私网业务的隔离方法、装置及系统
WO2022222745A1 (zh) 一种通信方法及装置
CN113841366B (zh) 通信方法及装置
TWI799064B (zh) 一種金鑰標識的生成方法以及相關裝置
WO2022095047A1 (zh) 无线通信的方法、终端设备和网络设备
WO2022027476A1 (zh) 密钥管理方法及通信装置
WO2023246942A1 (zh) 通信方法及装置
WO2016078375A1 (zh) 数据传送方法及装置
WO2023185880A9 (zh) 一种接入网设备的确定方法
WO2022148469A1 (zh) 一种安全保护方法、装置和系统
WO2022155915A1 (zh) 网络互通的方法及装置
CN107925874B (zh) 超密集网络安全架构和方法
WO2022094976A1 (zh) 密钥生成方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21920313

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021920313

Country of ref document: EP

Effective date: 20230802

NENP Non-entry into the national phase

Ref country code: DE