WO2022170911A1 - Procédé d'authentification et d'autorisation et équipement de communication - Google Patents

Procédé d'authentification et d'autorisation et équipement de communication Download PDF

Info

Publication number
WO2022170911A1
WO2022170911A1 PCT/CN2022/071841 CN2022071841W WO2022170911A1 WO 2022170911 A1 WO2022170911 A1 WO 2022170911A1 CN 2022071841 W CN2022071841 W CN 2022071841W WO 2022170911 A1 WO2022170911 A1 WO 2022170911A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
authentication
network
authorization
indication information
Prior art date
Application number
PCT/CN2022/071841
Other languages
English (en)
Chinese (zh)
Inventor
张成晨
邢玮俊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022170911A1 publication Critical patent/WO2022170911A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H04W72/04—Wireless resource allocation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H04W72/20—Control channels or signalling for resource management
    • H04W72/23—Control channels or signalling for resource management in the downlink direction of a wireless link, i.e. towards a terminal

Definitions

  • the present application relates to the field of communication, and, more particularly, to the field of methods and communication devices for authentication and authorization.
  • the drone networking requires a series of authentication and authorization.
  • the UAV's authentication and authorization is rejected, it may need to be re-authenticated and authorized, that is, re-authentication and authorization.
  • re-authentication and authorization At present, how to re-authenticate and authorize drones in a timely and successful manner according to their own needs is an urgent problem to be solved.
  • the present application provides a method and device for authentication and authorization. After the authentication and authorization of a terminal device fails, an indication that the terminal device can request network resources for communicating with another terminal device in the same system is sent to the terminal device through the core network. , so that the terminal device can perform re-authentication and authorization according to its own needs, thereby improving the success rate of the terminal device's re-authentication and authorization, and reducing the terminal device's request to the core network for re-authentication and authorization when the core network does not allow re-authentication and authorization. Signaling waste caused by the rejection of network resources when another terminal device in the system communicates.
  • an authentication and authorization method including: a first network device determines that authentication and authorization of a terminal device fails; the first network device receives first indication information, where the first indication information indicates that the terminal device can request a network resource, the network resource is used for the terminal device to communicate with another terminal device in the same system; the first network device sends second indication information to the terminal device according to the first indication information, and the second indication information indicates the The terminal device can request this network resource.
  • the authentication and authorization is the authentication and authorization performed by the third-party network device on the terminal device.
  • the authentication authorization may be the authentication authorization of the UAV itself, the UAV flight plan authentication authorization, and the pairing authentication between the UAV and the UAV controller.
  • the authorization, or other types of authentication authorization, is not limited in this application.
  • the first indication information indicates that the terminal device can request network resources for the drone operation.
  • the "drone operation” mentioned in this application may also be a drone service, or may also be other expressions, which is not limited in this application.
  • the same system here can be an unmanned aerial vehicle system. Specifically, for the unmanned aerial vehicle system, the current unmanned aerial vehicle system only includes one unmanned aerial vehicle and one unmanned aerial vehicle controller. Network resources are used to communicate with the UAV controller in the UAV system.
  • another terminal device in the same system this application does not limit the system name or the number of terminals in the system. For example, if there are multiple terminal devices in a system, the terminal device can be instructed to communicate with a certain terminal device in the system.
  • the requesting network resources refers to that the terminal device obtains the network resources from the network through various channels, including but not limited to the registration process, the service request process, the session establishment process, and the session modification process. This is not limited.
  • the first indication information indicates that the first network device can initiate authentication and authorization for the terminal device. After receiving the first indication information, if the first network device receives a network resource request from the terminal device for communicating with another terminal device in the same system, the first network device may be the terminal device The device initiates authentication and authorization.
  • can mentioned in this application can also be “may”, “permit” or other possible expressions. For convenience, this application only uses “can” as an example for description, but it does not limit it. .
  • the first network device sends an indication that the terminal device can request network resources for communicating with another terminal device in the same system to the terminal device, so that the terminal device can follow the Re-authentication and authorization based on its own needs, thus improving the success rate of terminal equipment re-authentication and authorization, and reducing the terminal equipment's request to the core network for use with another terminal in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by the rejection of network resources for device communication.
  • the method further includes: the first network device sends a first request message to the second network device, where the first request message subscribes to the change of the authentication authorization state; or , the first request message queries the authentication and authorization state; wherein, the authentication and authorization state is whether the terminal device can request the network resource.
  • authentication and authorization status can also be whether the terminal device can perform re-authentication and authorization.
  • this application only uses the “authentication and authorization status as whether the terminal device can request the network resource". An example will be described, but this is not limited.
  • the first network device subscribes the terminal device to change the authentication and authorization state or queries the authentication and authorization state, so that the core network obtains the authentication and authorization state of the terminal device, and when the first network device learns that the terminal device can request the network resource , notify the terminal equipment; enable the terminal equipment to perform re-authentication and authorization according to its own needs, thereby improving the success rate of the terminal equipment re-authentication and authorization, and reducing the terminal equipment when the core network does not allow re-authentication and authorization. Signaling waste caused by network resources being rejected when communicating with another terminal device in the same system.
  • the method further includes: the first network device receiving a third request message from the terminal device, where the third request message requests the network resource.
  • the first network device may receive the third request message from the terminal device after the first network device sends the second indication information to the terminal device, or before the first network device sends the first request message to the second network device .
  • the terminal device can know that it can request the network service according to the second indication information, then when the terminal device needs to request the above network service, it will send the first The network device sends a third request message.
  • the terminal device when it needs to request the above-mentioned network service, it sends a third request message to the first network device, and the first network device queries the authentication and authorization state for the terminal device according to the received third request message.
  • the above technical solution enables the terminal device to request the network resources according to its own needs by querying the authentication and authorization status of the core network when the terminal device needs to request the above-mentioned network service, thereby improving the success rate of the terminal device re-authentication and authorization, and reducing the Signal waste caused by the terminal equipment being rejected when it requests the core network for network resources for communicating with another terminal equipment in the same system when the core network does not allow re-authentication and authorization.
  • the method further includes: the third request message includes third indication information, where the third indication information indicates that the terminal device requests to obtain the authentication authorization state.
  • the third indication information indicates that the terminal device requests resources for the operation of the drone.
  • the terminal device independently initiates an authentication and authorization status query request, and then the first network device performs an authentication and authorization status query for the terminal device, so that the terminal device can query the authentication and authorization status in a timely and autonomous manner, thereby improving the performance of the terminal device.
  • the success rate of re-authentication and authorization also reduces the signaling caused by the terminal device being rejected when it requests the core network for network resources for communicating with another terminal device in the same system when the core network does not allow re-authentication and authorization. waste.
  • the method further includes: the first network device sends a fourth request message to the second network device or the third network device according to the third request message, the first network device sending a fourth request message to the second network device or the third network device according to the third request message.
  • the fourth request message requests to initiate authentication and authorization.
  • the method further includes: the first network device deletes the first information according to the first indication information, wherein the first information is stored by the first network device,
  • the first information indicates at least one of the following: the authentication and authorization of the terminal device fails, and the terminal device cannot request the network resource.
  • the first network device determines that the terminal device can request the network resource and deletes the first information, so that the first network device does not receive the network resource request from the terminal device again.
  • a third-party network device is requested to perform authentication and authorization for the terminal device, so that the terminal device can timely request network resources without directly rejecting the terminal device's request because the first network device stores the first information.
  • the method further includes: the first network device stops a first timer according to the first indication information, wherein before the first timer stops or expires The first network device rejects second information from the terminal device, the second information requesting the network resource.
  • the first network device determines that the terminal device can request the network resource and stops the first timer, so that the first network device does not receive the network resource request from the terminal device again. Then directly reject it, but request the third-party network device to perform authentication and authorization for the terminal device, so that the terminal device can request network resources in time before the first timer stops or expires without the first network device starting the first timer.
  • the server directly rejects the request of the terminal device.
  • the terminal device is a drone.
  • the terminal device in this application includes an unmanned aerial vehicle that can access the 3GPP system, and the unmanned aerial vehicle here may be an unmanned aerial vehicle, an unmanned vehicle, an unmanned ship, etc., which is not limited in this application.
  • a communication method including: a terminal device determines that authentication and authorization of the terminal device fails; the terminal device receives second indication information from a first network device, where the second indication information can request network resources, the Network resources are used for the terminal device to communicate with another terminal device in the same system.
  • the terminal device can request network resources for communicating with another terminal device in the same system according to the received instruction from the first network device, so as to Requires re-authentication and authorization, thereby improving the success rate of terminal device re-authentication and authorization, and reducing the need for terminal devices to request the core network to communicate with another terminal device in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by rejection of network resources.
  • the method further includes: the terminal device sends a third request message to the first network device, where the third request message requests the network resource.
  • the terminal device may send the third request message after receiving the second indication information or before receiving the second indication information.
  • the terminal device learns that it can request the above-mentioned network resources, and then sends a third request message according to its own needs.
  • the terminal device actively requests the above-mentioned network resources from the core network or requests to obtain the authentication authorization state according to its own needs, and then receives the second indication information.
  • the third request message includes third indication information
  • the third indication information indicates that the terminal device requests to obtain an authentication and authorization state
  • the authentication and authorization state is the terminal device Whether the device can request this network resource.
  • the third indication information indicates that the terminal device requests resources for the operation of the drone.
  • the method further includes: the terminal device deletes the second information according to the second indication information, wherein the second information is stored by the terminal device, and the second information Indicates at least one of the following: the authentication and authorization of the terminal device fails, and the terminal device cannot request the network resource.
  • the method further includes: the terminal device stops a second timer according to the first indication information, wherein the terminal stops or expires before the second timer The device cannot request this network resource.
  • the terminal device stops the second timer after receiving the first indication information, so that the terminal device is no longer restricted by the second timer and cannot request the network resource, but can request the network resource according to its own The demand requests the network resource, so that the terminal device can request the network resource in time before the second timer expires.
  • the terminal device is a drone.
  • a method for authentication and authorization including: a second network device receiving fourth indication information, where the fourth indication information indicates that a terminal device can request network resources, and the network resources are used for the terminal device and the same system
  • the second network device sends first indication information to the first network device, where the first indication information indicates that the terminal device can request the network resource.
  • the second network device stores the relevant information after receiving the fourth indication information, and sends it to the first network device, so that the first network device can receive the terminal device after receiving the information.
  • the resource request it is determined whether the resource can be requested, so that the first network device that interacts with the terminal device will not directly reject the resource request, causing the terminal device to fail to request resources in time.
  • the method further includes: the second network device receives a first request message from the first network device, and the first request message subscribes to the change of the authentication authorization state , the authentication and authorization state is whether the terminal device can request the network resource; or, the first request message queries the authentication and authorization state, and the authentication and authorization state is whether the terminal device can request the network resource.
  • the method further includes: the second network device sends a fifth request message to the third network device, where the fifth request message subscribes to the change of the authentication authorization state; Or, the fifth request message queries the authentication and authorization status.
  • the second network device may not obtain the authentication and authorization state in advance, so after receiving the first request message, it needs to request the authentication and authorization state from the third network device or other network devices.
  • the second network device requesting the authentication and authorization state equipment which is not limited in this application.
  • the second network device has obtained the authentication and authorization state before receiving the first request message, then after receiving the first request message, it can directly feed back the authentication and authorization state to the first network device.
  • the terminal device is a drone.
  • an authentication and authorization method comprising: a third network device determining that authentication and authorization of a terminal device fails; and the third network device determining fifth indication information, the fifth indication information indicating that the terminal device can request the network resource, the network resource is used for the terminal device to communicate with another terminal device in the same system; the third network device sends the fifth indication information.
  • the determination of the fifth indication information by the third network device may be by receiving the fifth indication information, or by directly determining by itself, which is not limited in this application.
  • the third network device may directly send the fifth indication information to the first network device, or may send the fifth indication information to the first network device through other network devices. Or, more simply and directly, the third network device may directly send the fifth indication information to the terminal device, which is not limited in this application.
  • the third network device determines that the terminal device can request the above-mentioned network resources, and actively sends relevant indication information to the core network or the terminal device, so that the terminal device can request network resources according to its own needs. , thereby improving the success rate of re-authentication and authorization of the terminal device, and also reducing the possibility that the terminal device requests the core network for network resources for communicating with another terminal device in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by rejection.
  • the method further includes: the third network device receives a sixth request message, and the sixth request message subscribes to the change of the authentication and authorization state, and the authentication and authorization state is the terminal Whether the device can request the network resource; or, the sixth request message queries the authentication and authorization status.
  • the terminal device is a drone.
  • an authentication and authorization device comprising: a processing module for determining that authentication and authorization of a terminal device fails; a transceiver module for receiving first indication information, where the first indication information indicates that the terminal device can request network resources, the network resources are used for the terminal device to communicate with another terminal device in the same system; the transceiver module is also used to send second indication information to the terminal device according to the first indication information, the second indication The information indicates that the terminal device can request the network resource.
  • the first network device sends an indication that the terminal device can request network resources for communicating with another terminal device in the same system to the terminal device, so that the terminal device can follow the Re-authentication and authorization based on its own needs, thus improving the success rate of terminal equipment re-authentication and authorization, and reducing the terminal equipment's request to the core network for use with another terminal in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by the rejection of network resources for device communication.
  • the transceiver module is further configured to: send a first request message to the second network device, where the first request message subscribes to the change of the authentication authorization state; or, the The first request message queries the authentication and authorization state; wherein, the authentication and authorization state is whether the terminal device can request the network resource.
  • the transceiver module is further configured to: receive a third request message from the terminal device, where the third request message requests the network resource.
  • the third request message includes third indication information, where the third indication information indicates that the terminal device requests to obtain the authentication authorization state.
  • the processing module is further configured to: delete the first information according to the first indication information, wherein the first information is stored by the first network device, and the first information is stored by the first network device.
  • a piece of information indicates at least one of the following: the authentication and authorization of the terminal device fails, and the terminal device cannot request the network resource.
  • the processing module is further configured to: stop the first timer according to the first indication information, wherein, before the first timer is stopped, the first network The device rejects second information from the terminal device requesting the network resource.
  • the transceiver module is further configured to: send a fourth request message to the second network device or the third network device according to the third request message, the fourth request message The message requests to perform authentication authorization for the terminal device.
  • the terminal device is a drone.
  • an authentication and authorization device comprising: a processing module for determining that the authentication and authorization of the terminal device fails; a transceiver module for receiving second indication information from a first network device, the second indication The information indicates that the terminal device is able to request network resources for the terminal device to communicate with another terminal device in the same system.
  • the terminal device can request network resources for communicating with another terminal device in the same system according to the received instruction from the first network device, so as to Requires re-authentication and authorization, thereby improving the success rate of terminal device re-authentication and authorization, and reducing the need for terminal devices to request the core network to communicate with another terminal device in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by rejection of network resources.
  • the transceiver module is further configured to: send a third request message to the first network device, where the third request message requests the network resource.
  • the third request message includes third indication information, and the third indication information indicates that the terminal device requests to obtain an authentication and authorization state, and the authentication and authorization state is the terminal device Whether the device can request this network resource.
  • the processing module is further configured to: stop the second timer according to the second indication information, wherein the terminal device cannot stop the second timer before the second timer is stopped. Request this network resource.
  • the terminal device is a drone.
  • an authentication and authorization device comprising: a transceiver module for receiving fourth indication information, where the fourth indication information indicates that a terminal device can request network resources, and the network resources are used for the terminal device and the same communicates with another terminal device in the system; the transceiver module is further configured to send first indication information to the first network device, where the first indication information indicates that the terminal device can request the network resource.
  • the second network device stores the relevant information after receiving the fourth indication information, and sends it to the first network device, so that the first network device can receive the terminal device after receiving the information.
  • the resource request it is determined whether the resource can be requested, so that the first network device that interacts with the terminal device will not directly reject the resource request, causing the terminal device to fail to request resources in time.
  • the transceiver module is further configured to: receive a first request message from the first network device, the first request message subscribes to the change of the authentication authorization state, the The authentication and authorization state is whether the terminal device can request the network resource; or, the first request message queries the authentication and authorization state, and the authentication and authorization state is whether the terminal device can request the network resource.
  • the transceiver module is further configured to: send a fifth request message to the third network device, where the fifth request message subscribes to the change of the authentication authorization state; or, The fifth request message queries the authentication and authorization status.
  • the terminal device is an unmanned aerial vehicle.
  • an authentication and authorization device comprising: a processing module configured to determine that authentication and authorization of a terminal device fails; the processing module is further configured to determine fifth indication information, where the fifth indication information indicates the terminal device A network resource can be requested, and the network resource is used for the terminal device to communicate with another terminal device in the same system; the transceiver module is used for sending the fifth indication information.
  • the third network device determines that the terminal device can request the above-mentioned network resources, and actively sends relevant indication information to the core network or the terminal device, so that the terminal device can request network resources according to its own needs. , thereby improving the success rate of re-authentication and authorization of the terminal device, and also reducing the possibility that the terminal device requests the core network for network resources for communicating with another terminal device in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by rejection.
  • the transceiver module is further configured to: receive a sixth request message, where the six request message subscribes to a change in an authentication authorization state, where the authentication authorization state is whether the terminal device is The network resource can be requested; or, the sixth request message queries the authentication and authorization state.
  • the terminal device is an unmanned aerial vehicle.
  • a communication device in a ninth aspect, includes: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the communication
  • the apparatus performs the methods and embodiments described in any one of the first to fourth aspects and implementations thereof.
  • a computer-readable storage medium wherein a computer program is stored on the computer-readable storage medium, and when the computer program runs on a computer, the computer is made to execute the first to fourth aspects.
  • a chip system which is characterized by comprising: a processor for calling and running a computer program from a memory, so that a communication device installed with the chip system executes any of the first to fourth aspects.
  • a twelfth aspect provides a communication system, characterized in that the communication system includes a terminal device and a third network device, wherein the terminal device is configured to execute the methods and embodiments described in the second aspect and implementations thereof, The third network device is configured to execute the methods and embodiments described in the fourth aspect and its implementation.
  • a thirteenth aspect provides a communication system, characterized in that the communication system includes a terminal device, a third network device and a first network device, wherein the terminal device is configured to execute the second aspect and its implementation manners.
  • the terminal device is configured to execute the second aspect and its implementation manners.
  • the third network device is used for the methods and embodiments described in the fourth aspect and its implementations
  • the first network device is used for executing the methods and embodiments described in the first aspect and its implementations.
  • a fourteenth aspect provides a communication system, characterized in that the communication system includes a terminal device, a third network device, a first network device, and a second network device, wherein the terminal device is configured to perform the second aspect and its
  • the terminal device is configured to perform the second aspect and its
  • the third network device is used for the methods and embodiments described in the fourth aspect and its implementation manners
  • the first network device is used for executing the first aspect and its implementation manners.
  • the second network device is configured to execute the methods and embodiments described in the third aspect and implementations thereof.
  • FIG. 1 shows a network architecture suitable for this embodiment of the present application.
  • FIG. 2 shows another network architecture suitable for this embodiment of the present application.
  • FIG. 3 shows a schematic diagram of an example of an application scenario to which the embodiments of the present application are applied.
  • FIG. 4 shows a schematic interaction diagram of an example of the authentication and authorization method of the present application.
  • FIG. 5 shows a schematic interaction diagram of yet another example of the authentication and authorization method of the present application.
  • FIG. 6 shows a schematic interaction diagram of another example of the authentication and authorization method of the present application.
  • FIG. 7 shows a schematic interaction diagram of another example of the authentication and authorization method of the present application.
  • FIG. 8 shows a schematic interaction diagram of yet another example of the authentication and authorization method of the present application.
  • FIG. 9 shows a schematic interaction diagram of yet another example of the authentication and authorization method of the present application.
  • FIG. 10 shows a schematic block diagram of an example of a communication device for authentication and authorization of the present application.
  • FIG. 11 shows a schematic block diagram of yet another example of the communication device for authentication and authorization of the present application.
  • GSM global system for mobile communications
  • CDMA code division multiple access
  • CDMA wideband code division multiple access
  • WCDMA wideband code division multiple access
  • general packet radio service general packet radio service, GPRS
  • long term evolution long term evolution
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G 5th generation
  • NR new radio
  • V2V Vehicle-to-vehicle
  • V2I vehicle-to-infrastructure
  • V2P Vehicle to pedestrian
  • V2N vehicle to network
  • FIG. 1 provides a network architecture, and each network element that may be involved in the network architecture will be described below with reference to FIG. 1 .
  • User equipment can be called terminal equipment, terminal, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, wireless communication equipment, User Agent or User Device.
  • the UE may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a wireless communication capability handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks or future evolution of public land mobile networks (PLMN) or non-terrestrial
  • the terminal equipment of the network Non-Terrestrial Networks, NTN
  • Internet-connected devices such as sensors, electricity meters, water meters and other Internet of things (IoT) devices. It can also be a drone with communication capabilities (Unmanned Aerial Vehicle or Uncrewed Aerial Vehicle, UAV). This embodiment of the present application does not limit this.
  • Universal mobile telecommunications system (UMTS) terrestrial radio access network such as the third generation (3rd generation, 3G)/second generation (2nd generation, 2G) connection access the network.
  • GSM Global system for mobile communication
  • EDGE enhanced data rate for GSM evolution
  • GERAN Global system for mobile communication
  • 3G /2G access network 3G /2G access network.
  • Evolved universal terrestrial radio access network such as the fourth generation (4th generation, 4G) access network.
  • S-GW Serving gateway
  • Public data network gateway PDN gateway, P-GW
  • entity user plane data link anchor point between the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) and non-3GPP networks , which can be responsible for managing data routing between 3GPP and non-3GPP.
  • Mobility Management Entity It is mainly responsible for functions such as mobility management, bearer management, user authentication and authentication, and selection of S-GW and P-GW.
  • IP IP multimedia subsystem
  • PSS packet switching service
  • PCRF Policy and charging rules function
  • HSS Home subscriber server
  • the HSS can include user profiles, perform user authentication and authorization, and provide information about Information about the user's physical location.
  • Serving general packet radio service (GPRS) support node can complete routing and forwarding of packet data packets, mobility management, session management, logical link management, authentication and encryption, CDR generation and output functions.
  • GPRS general packet radio service
  • the LTE-Uu interface is the reference point between the terminal and the E-UTRAN;
  • the S1-U interface is the reference point between the E-UTRAN and the S-GW entity;
  • the N5 interface is the S-GW entity and the P-GW entity.
  • Control plane interface S1-MME connects MME with E-UTRAN, similar to the control part of the wireless network layer in UMTS network, etc.;
  • S11 interface is the reference point between MME and S-GW entity;
  • S12 interface is UTRAN/GERAN The reference point with the S-GW entity;
  • the S4 interface is the reference point between the SGSN and the S-GW entity;
  • the S6a interface is the reference point between the MME and the HSS;
  • the S3 interface is the reference point between the MME and the SGSN.
  • FIG. 2 provides another network architecture, and each network element that may be involved in the network architecture will be described below with reference to FIG. 2 .
  • UE It has been introduced above with reference to FIG. 1 , and it is not repeated here for brevity.
  • Access network It provides network access functions for authorized users in a specific area, and can use different quality transmission tunnels according to user levels and business needs.
  • the access network may be an access network using different access technologies.
  • 3GPP access technologies such as those employed in 3G, 4G or 5G systems
  • non-3GPP non-3rd Generation Partnership Project
  • 3GPP access technology refers to the access technology that conforms to 3GPP standard specifications.
  • the access network using 3GPP access technology is called Radio Access Network (RAN).
  • RAN Radio Access Network
  • gNB Next generation Node Base station
  • a non-3GPP access technology refers to an access technology that does not conform to 3GPP standard specifications, for example, an air interface technology represented by an access point (AP) in wifi.
  • AP access point
  • An access network that implements access network functions based on wireless communication technology can be called a radio access network (RAN).
  • the radio access network can manage radio resources, provide access services for terminals, and then complete the forwarding of control signals and user data between the terminal and the core network.
  • the radio access network can be, for example, a base station (NodeB), an evolved NodeB (evolved NodeB, eNB or eNodeB), a base station (gNB) in a 5G mobile communication system, a base station in a future mobile communication system, or an AP in a WiFi system, etc., It can also be a wireless controller in a cloud radio access network (CRAN) scenario, or the access network device can be a relay station, an access point, an in-vehicle device, a wearable device, and a network in the future 5G network equipment or network equipment in a future evolved PLMN network, etc.
  • CRAN cloud radio access network
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the wireless access network device.
  • Access and mobility management function (AMF) entity mainly used for mobility management and access management, etc., and can be used to implement mobility management entity (mobility management entity, MME) functions in addition to sessions Other functions other than management, such as lawful interception, or access authorization (or authentication) functions.
  • MME mobility management entity
  • Session management function (SMF) entity mainly used for session management, UE IP address allocation and management, selection of manageable user plane functions, policy control, or termination point of charging function interface and downlink data notification, etc. .
  • User Plane Function User Plane Function
  • UPF User Plane Function
  • DN data network
  • Data Network A network for providing data transmission.
  • DN A network for providing data transmission.
  • an operator's service network an Internet (Internet) network, a third-party service network, and the like.
  • AUSF Authentication server function
  • Network exposure function (NEF) entity used to securely open services and capabilities provided by the 3GPP network function to the outside.
  • Network storage function ((NF) repository function, NRF) entity used to store the description information of the network function entity and the services it provides, and to support service discovery, network element entity discovery, etc.
  • PCF Policy control function
  • Unified data management (UDM) entity used to handle user identification, access authentication, registration, or mobility management, etc.
  • Application function (AF) entity used to perform data routing affected by applications, access network open function network elements, or interact with the policy framework to perform policy control, etc.
  • AF application function
  • it may be a V2X application server, a V2X application enabling server, or a drone server (which may include a drone monitoring server, or a drone application service server).
  • the N1 interface is the reference point between the terminal and the AMF entity; the N2 interface is the reference point between the AN and the AMF entity, and is used for non-access stratum (NAS) messages.
  • Sending, etc. N3 interface is the reference point between (R)AN and UPF entity, used to transmit user plane data, etc.
  • N4 interface is the reference point between SMF entity and UPF entity, used to transmit tunnels such as N3 connections Identification information, data buffer indication information, and downlink data notification messages and other information;
  • the N6 interface is the reference point between the UPF entity and the DN, and is used to transmit data on the user plane.
  • FIG. 1 and FIG. 2 can be applied to the embodiments of the present application.
  • the network architecture applicable to the embodiments of the present application is not limited to this, and any network architecture that can implement the functions of the above network elements All are applicable to the embodiments of the present application.
  • the AMF entity, the SMF entity, the UPF entity, the NEF entity, the AUSF entity, the NRF entity, the PCF entity, and the UDM entity shown in FIG. 1 or FIG. 2 can be understood as network elements in the core network for implementing different functions. , for example, can be combined into network slices on demand. These core network elements may be independent devices, or may be integrated into the same device to implement different functions, which is not limited in this application. It should be noted that the above-mentioned "network element" may also be referred to as an entity, a device, an apparatus, or a module, etc., which is not particularly limited in this application.
  • FIG. 3 shows a schematic diagram of an application scenario of an embodiment of the present application.
  • the UAS 300 can perform information exchange and wireless communication with the network system with the UTM traffic management entity UTM303.
  • the UAV controller 301 or the UAV 302 can exchange information with an access network (radio access network, RAN) 304 and a core network (core network, CN) 305, and can also exchange information through the access network 304 or the core network 305 conducts information interaction with UTM303;
  • UAV controller 301 can also conduct information exchange with UAV 302 through access network 304 or core network 305, and can also conduct information interaction with UAV 302 through UTM303.
  • the UAV controller 301 and the UAV 302 may be in the same access network or core network, or may be in different access networks or core networks, which is not limited in this embodiment of the present application.
  • Unmanned aerial vehicle controller (UAVC) 301 used to control the drone 302, such as controlling the flight state or flight action of the drone.
  • the drone controller can be a smartphone, tablet, laptop, smart watch or smart remote control, traditional remote control, dedicated remote control, etc. It can also be a bracelet, ring, gloves, armband, watch, etc. Can be used for gestures
  • the device for controlling the drone can also be a headgear such as a headgear that can be used to control the drone with a mind, or a device such as a smart jacket or jacket that can be used to control the drone by the user's body movements.
  • the specific type of the UAV controller is not limited herein.
  • the name and form of the device with the function of the drone controller may be different.
  • the above-mentioned devices capable of having the function of a drone controller or capable of controlling the drone are collectively referred to as a drone controller.
  • the drone controller 201 can control the flight state of the drone 202.
  • the drone controller can control the direction, aileron, lift, tilt, speed, throttle, flaps, etc. of the drone, and can also control Actions such as turning, climbing, diving, rolling, hovering, taking off, and landing of the UAV are not limited in this embodiment of the present application.
  • Unmanned aerial vehicle (UAV) 302 Or, it can also be (uncrewed aerial vehicle, UAV), also known as unmanned aerial vehicle, aerial robot, which is controlled by radio remote control equipment and self-provided program
  • UAV uncrewed aerial vehicle
  • the unmanned aircraft of the device can complete aerial flight tasks and various load tasks under unmanned conditions.
  • the UAVs in the embodiments of the present application may be unmanned helicopters, fixed-wing aircraft, multi-rotor aircraft, unmanned airships, and unmanned paragliders; and may also include near-space vehicles, such as stratospheric airships, high-altitude balloons, solar-powered drones Human-machine, etc.; it can also be four-axis, six-axis, single-axis, vector control and other forms of drones.
  • the drones in the embodiments of the present application can be used in the fields of military, industry, civil use, agriculture, construction, film and television, environmental protection, etc., as well as special industries that use drones for operations, such as using drones for military reconnaissance, patrol, Aerial photography, environmental monitoring, border monitoring, express delivery, power inspection, confirmation of rights, flood control and drought relief, post-disaster rescue, etc.
  • This embodiment of the present application does not limit this.
  • unmanned aerial vehicles the specific type of the drone is not limited herein.
  • the names of devices with unmanned aircraft functions may be different in order to be applied to different scenarios or to complete different aerial missions.
  • unmanned aerial vehicles the above-mentioned devices capable of unmanned aircraft functions are collectively referred to as unmanned aerial vehicles.
  • the UAV 202 may be equipped with various sensors or functional modules, such as gyroscopes (flight attitude perception), accelerometers, geomagnetic induction, barometric pressure sensors (rough hover height control), ultrasonic sensors (low altitude precision control or obstacle avoidance) , optical flow sensor (hovering horizontal position is accurately determined), global positioning system (global positioning system, GPS) module (horizontal position height rough positioning), control circuit, compass, etc., by collecting the angular rate, attitude, position of the UAV , acceleration, altitude and airspeed, etc., can automatically maintain the normal flight attitude of the drone.
  • sensors or functional modules such as gyroscopes (flight attitude perception), accelerometers, geomagnetic induction, barometric pressure sensors (rough hover height control), ultrasonic sensors (low altitude precision control or obstacle avoidance) , optical flow sensor (hovering horizontal position is accurately determined), global positioning system (global positioning system, GPS) module (horizontal position height rough positioning), control circuit, compass, etc.,
  • each functional module may also have other names, which are not limited in the embodiments of the present application.
  • the unmanned aerial vehicle in the embodiment of the present application may also have more or less functional modules, and may also implement more or less functions, etc., and the embodiment of the present application does not limit this in any way.
  • an unmanned aerial system (UAS) 300 may include one or more drone controllers 201 and one or more drones 202 .
  • a drone controller can control one or more drones
  • a drone can also be controlled by one or more drone controllers
  • multiple drone controllers can cooperate to control multiple drones.
  • Human-machine which is not limited in this embodiment of the present application.
  • the UAV 202 in the UAV system 200 can be any one or more types mentioned above, and the UAV controller 201 can also be any one or more types mentioned above.
  • the embodiment does not make any limitation on this.
  • this application also includes:
  • UAS service provider An entity that supports the safe and efficient use of airspace by providing services to the operator or pilot of the drone to meet the operational requirements of the drone. USS can provide any subset of functionality to meet the provider's business objectives. It should be noted that this name is only for convenience to express its function, and should not constitute any limitation to this application, and this application does not exclude the possibility of adopting other names in subsequent standards.
  • Unmanned aerial system traffic management A set of functions and services for managing a range of automated device operations (e.g., drone certification, drone business authorization, drone policy management, unmanned airspace machine flow control). It should be noted that this name is only for convenience to express its function, and should not constitute any limitation to this application, and this application does not exclude the possibility of adopting other names in subsequent standards.
  • the entities of the USS and the UTM may be one entity, may be in an inclusive relationship, or may be in a parallel relationship, which is not limited in this application.
  • TPAE Third-party authorized entity
  • UAS application function network element UAS application function, UAS AF
  • UAV flight enablement subsystem UAV flight enablement subsystem
  • UFES UAS application function network element
  • UAS AF or UFES provides a separate interface for USS or UTM, executes commands issued by USS or UTM, and is responsible for information transmission inside and outside the 3GPP system. It should be noted that this name is only for convenience to express its function, and should not constitute any limitation to this application, and this application does not exclude the possibility of adopting other names in subsequent standards.
  • UAS AF or UFES may be an existing network element, such as NEF/SCEF, or a new network element, or may be deployed together with NEF or service capability exposure function (SCEF).
  • SCEF service capability exposure function
  • the entities of UAS AF and UFES may be one entity, may be in an inclusive relationship, or may be in a parallel relationship, which is not limited in this application.
  • drones In recent years, the application of drones has gradually become popular. Especially in the civilian field, from small drones for personal entertainment to a variety of drones that bring economic value, such as plant protection drones, disaster relief drones, firefighting drones, express delivery Drones and more. However, while drones bring various economic benefits and entertainment to people, they also bring about the problem of how to manage drones.
  • UAVs suitable for remote control scenarios have more and more demands for networking.
  • 3GPP system in order to better manage UAVs, the application of 3GPP system in the entire UAV field is also getting more and more attention.
  • 5G system Take the 5G system as an example.
  • 3GPP is studying connected drones, and the system improves the management of drones through the network.
  • the UAV and the UAV controller are respectively connected to the 3GPP network, and the two communicate through the 3GPP network. Specifically, after the drone is connected to the Internet, UAS services can be obtained.
  • the drone controller can remotely control the flight of the drone through the network, the drone can send data information to the cloud through the network, and the drone can also Get timely obstacle avoidance assistance and more through the network.
  • the drone in order to control the flight of the drone through networking, the drone will request to establish a session to connect with its controller, which is called a command and control (command and control, C2) communication-related session.
  • UAV networking requires authentication and authorization of the UAV itself. If a session related to C2 communication needs to be established, C2 communication authentication and authorization are also required. These authentication authorizations need to be carried out in a third-party entity, namely USS or UTM.
  • UAV authentication and authorization can be performed in the registration process or in the process of establishing a protocol data unit (PDU) session.
  • PDU protocol data unit
  • the UE To implement authentication and authorization, the UE must enforce UAV authentication and authorization in the registration process and in the process of establishing a PDU session, and the network side must enforce UAV authentication and authorization in the process of establishing a PDU session.
  • the UAV certification authorization in this application includes the certification authorization related to UAV, such as whether the UAV itself is legal (UAV certification authorization), whether the UAV flight plan is legal (the flight path certification authorization), whether the UAV can It communicates with a specific UAVC (paired authentication authorization), etc., or may also include other UAV-related authentication authorizations, which are not limited in this application.
  • the UE may perform authentication and authorization again, that is, re-authentication and authorization.
  • the re-authentication authorization is only for the scenario where the UAV authentication and authorization is performed during the registration, and more importantly, the UE cannot perform the re-authentication and authorization in time and on demand.
  • FIG. 4 shows a schematic interaction diagram of a method 400 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 4, method 400 is described below.
  • the terminal device, the first network device, the second network device and the third network device can all determine that the authentication and authorization of the terminal device fails.
  • the terminal device receives indication information from the first network device, where the indication information is used to indicate that the authentication and authorization of the terminal device fails.
  • the first network device may directly reject the registration request or session establishment request of the terminal device, without sending indication information to the terminal device, and the terminal device may also determine that the authentication and authorization fails, which is not limited in this application. Similarly, this application does not limit how other devices determine that the authentication and authorization of the terminal device fails.
  • terminal equipment and "UE” in this application include a UAV that can access the 3GPP system, such as a UAV that is internally configured with a universal subscriber identity module (USIM).
  • USIM universal subscriber identity module
  • the first network device receives the first indication information.
  • the first indication information indicates that the terminal device can request network resources, and the network resources are used for the terminal device to communicate with another terminal device in the same system.
  • the first indication information here may be re-authentication authorization indication information, and the re-authentication authorization indication information indicates that the first network device can initiate authentication and authorization for the terminal device again.
  • the requesting network resource here may refer to a registration request for drone operation, or a PDU session establishment request for drone operation, etc., which is not limited.
  • the first indication information indicates that the terminal device can request network resources from the first network device, and from the perspective of the first network device, the first indication information indicates that the first network device requests for the terminal device Authorized.
  • the authentication and authorization of the first network device is requested by the terminal device, and when the terminal device requests resources, the first network terminal device will request the authentication and authorization.
  • the first network device when the first network device receives the first indication information, or in other words, after receiving the re-authentication authorization indication information, it means that the terminal device is allowed to request network resources, that is, when the first network device receives the request from the terminal, it will go to the Request authentication authorization for the end device. Otherwise, if the first network device does not receive an instruction to allow the terminal device to re-authenticate and authorize, even if the terminal device requests network resources, it will be rejected by the first network device, resulting in waste of signaling.
  • the first network device will determine whether network resources can be allocated for the drone operation. If the authentication and authorization fails, the first network device will definitely not operate for the drone. Allocate network resources.
  • the first indication information indicates that the terminal device can request network resources for UAV operation.
  • the drone operation here may also be referred to as drone service, or other expressions that can express similar meanings, which are not limited in this application.
  • step S402 may be in various manners, for example, S402a or S402b below.
  • the first network device may receive the first indication information from the second network device, and before that, the second network device may also receive one or more indication information from the third network device.
  • the second network device in this application may correspond to the UDM in the 5G system, may also correspond to the HSS in the 4G system, or may be other network devices with similar functions, and this application does not do this. limited.
  • the first network device may also receive the first indication information from the third network device.
  • the third network device in this application may correspond to USS or UTM, or UAS AF, or may also be NEF in 5G system or SCEF in 4G system, which is not limited in this application.
  • the first network device sends second indication information to the terminal device according to the first indication information.
  • the second indication information indicates that the terminal device can request the above-mentioned network resource. It should be understood that the first indication information and the second indication information may be the same indication information, or may be different indication information. The present application does not limit the representation of the first indication information and/or the second indication information.
  • the network device after the network device sends the indication information that allows the terminal device to request the above network resource to the terminal device, the network device will trigger the next authentication and authorization only after the terminal device requests the above network resource from the core network.
  • the failure of the UE's UAV authentication and authorization may be because there are many UEs requesting access to the 3GPP network, and the USS or UTM cannot supervise more than a certain number of UEs at the same time, or does not allow a certain number of UEs at the same time.
  • the USS or UTM can notify the UE through the core network and can now provide the UE with the requested If the network resources are available, the UE requests to establish a session for communication with the UAV controller at this time, and the core network initiates authentication and authorization for the UE.
  • the first network device in this application may be an SMF and/or AMF in a 5G system, or an MME in a 4G system, or may be other network devices with similar functions, which are not covered in this application. limited.
  • an indication that the terminal device can request network resources for communicating with another terminal device in the same system is sent to the terminal device through the core network, so that the UE can follow its own needs.
  • Perform re-authentication and authorization thereby improving the success rate of UE re-authentication and authorization, and reducing the UE's request to the core network for network resources for communicating with another terminal device in the same system when the core network does not allow re-authentication and authorization. Signaling waste caused by rejection.
  • FIG. 5 shows a schematic flowchart of a method 500 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 5, the method 500 is described below.
  • the UE sends a registration request message to the AMF.
  • the registration request message is used to register the UE in the 3GPP system.
  • the AMF sends a subscription request message to the UDM.
  • this message is used to indicate the update of the re-authentication status of the subscription UAV.
  • the UAV re-authentication authorization status refers to whether the UAV can initiate re-authentication and authorization again after authentication and authorization fails.
  • the subscription request message is used to request the UDM to notify the AMF when the UAV authentication and authorization status of the UE changes.
  • the default state of the core network side is that the UE is not allowed to perform re-authentication and authorization again, and the subsequent state may be changed to allow the UE to perform re-authentication and authorization again, which is the state that has occurred. renew. Then the UDM will notify the AMF when the re-authentication status changes.
  • the AMF determines that the UE has an aviation subscription (aerial subscription)
  • it sends a subscription request message to the UDM.
  • the AMF may determine that the UE has an aviation subscription in various ways. For example, the AMF may first query the UDM whether the UE has an aviation subscription, and the UDM returns the UE's aviation subscription information; or, the UE includes indication information in the registration request message.
  • the indication information is used to indicate that the registration of the UE is used for UAV operation. In other words, if the UE performs the registration process as a UAV, the network side needs to check whether the UE has relevant subscription information.
  • the UDM returns a subscription response message to the AMF.
  • the AMF can determine that the UDM has confirmed the subscription request according to the subscription response message.
  • step S502 and step S503 may be performed before step S504, or may be performed after step S505, which is not limited in this application.
  • the AMF returns a registration response to the UE.
  • the UE may determine that the UE has been registered in the 3GPP system according to the registration response message.
  • the UAV performs authentication and authorization in the process of establishing the PDU session.
  • the USS/UTM rejects the UAV's authentication authorization for some reason.
  • the SMF receives the indication of rejecting the UAV authentication and authorization sent by the USS/UTM, and the SMF notifies the AMF of the failure of the UAV authentication and authorization, so that the AMF determines not to register the UAV.
  • the UDM after receiving the subscription request message, the UDM sends a subscription request to the UAS AF/NEF.
  • the subscription request is used to request the UAV re-authentication authorization status request.
  • the UAS AF/NEF after receiving the subscription request message, the UAS AF/NEF sends a subscription request to the USS/UTM.
  • the USS/UTM after receiving the subscription request, sends a subscription response message to the UAS AF/NEF to confirm that the subscription has been accepted.
  • the UAS AF/NEF after receiving the subscription response message, the UAS AF/NEF sends a subscription response message to the UDM.
  • steps S506 to S509 are only an optional solution, which is not limited in this application.
  • the USS/UTM sends a UAV re-authentication authorization instruction to the UAS AF/NEF.
  • the USS/UTM determines that the UE can perform the UAV authentication and authorization again, and can send the UAV re-authentication authorization indication.
  • this application does not limit it.
  • the UE may obtain the permission of the USS/UTM offline, or the UE may establish a session with the USS/UTM, and the UAV and the USS/UTM may obtain the permission after interacting with the USS/UTM through the user plane of the session.
  • the UAS AF/NEF forwards the UAV re-authentication authorization instruction to the UDM.
  • step S510 and step S511 are only an optional solution, which is not limited in this application.
  • the UDM sends a UAV re-authentication authorization state update notification to the AMF.
  • the UDM determines that the UE can perform UAV re-authentication authorization, and then sends the above notification to the AMF.
  • the AMF sends a configuration update command to the UE.
  • the configuration update command may contain a UAV re-authentication authorization indication.
  • the UE After receiving the UAV re-authentication authorization instruction, the UE can initiate session establishment or modification again as required, and perform UAV authentication and authorization in it.
  • the AMF deletes information related to the UAV authentication and authorization failure.
  • the AMF stores the result of the UAV authentication and authorization failure.
  • the form of storing the result can be an indicator (Flag), which indicates that the authentication and authorization of the UE has failed, or that the UE cannot request network resources for the UAV operation; or it can be a timer, before the timer stops.
  • the AMF will reject the request sent by the UE to request network resources for the UAV operation; or it may be in other ways. In the case that the AMF has stored the result, the UE will be rejected when sending a request to the AMF to request network resources for the UAV operation.
  • the AMF deletes the information related to the failure of the UAV authentication and authorization.
  • the AMF subscribes to the UDM to update the UAV authentication and authorization state.
  • the core network informs the UE of the update of the authentication and authorization state.
  • this embodiment is specifically applied to a scenario where the UE does not perform de-registration of the 3GPP system after the UAV authentication and authorization fails.
  • the update of the UAV authentication and authorization status is provided to the UE through the core network in a timely manner, and the UE can perform re-authentication and authorization according to its own needs according to the status update information provided by the core network. Therefore, the success rate of UE re-authentication and authorization is improved, and the signaling waste caused by the rejection of UE's request for UAV operation to request network resources when the core network does not allow re-authentication and authorization to the core network is reduced.
  • FIG. 6 shows a schematic flowchart of a method 600 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 6, method 600 is described below.
  • the UE performs a registration process.
  • the UE registers with the 3GPP system, and the specific process is the same as steps S501 and S504 in the method 500 .
  • the UE sends a session establishment request to the SMF.
  • the UE may also send a session modification request to the SMF.
  • the SMF sends a UAV authentication authorization request message to the UAS AF/NEF.
  • the SMF may directly send the UAV authentication authorization request message to the USS/UTM.
  • Which network device the SMF sends the request message to and how to send the request message are not limited in this application.
  • the UAS AF/NEF forwards the UAV authentication authorization request message to the USS/UTM.
  • the USS/UTM sends a UAV authentication authorization rejection response message to the UAS AF/NEF.
  • the USS/UTM authenticates and authorizes the UAV, for some reason the USS/UTM determines that the UAV authentication and authorization failed, and further, the USS/UTM may include the reason for the UAV authentication and authorization failure in the reject response message.
  • This application does not limit the reasons for the failure of authentication and authorization.
  • the UAS AF/NEF forwards the UAV authentication authorization rejection response message to the SMF.
  • the SMF sends a subscription message to the UDM.
  • the SMF after receiving the UAV authentication and authorization rejection response, the SMF sends a subscription message to the UDM for subscribing to the update of the UAV re-authentication and authorization state.
  • the SMF decides to allow the establishment/modification of the session, and then sends the subscription message to the UDM.
  • the UDM sends a subscription response to the SMF to confirm that the subscription has been accepted.
  • the SMF allows the establishment of the session, and sends a session establishment acceptance response message to the UE.
  • the SMF allows the modification of the session and sends a session modification accept response message to the UE.
  • an indication of UAV authentication and authorization failure is included in the session establishment/modification acceptance response message.
  • S610 to S613 are the same as steps S506 to S509 in the method 500, and are not repeated here.
  • S614 to S616 are the same as steps S510 and S511 in the method 500, and are not repeated here.
  • the SMF sends a PDU session update command to the UE.
  • the SMF indicates the UAV re-authentication authorization to the UE through the PDU session update procedure, that is, the UAV re-authentication authorization indication is included in the PDU session update command.
  • the SMF deletes information related to the UAV authentication and authorization failure.
  • the SMF stores the result of the UAV authentication and authorization failure.
  • the form of storing the result can be an indicator (Flag), which indicates that the authentication and authorization of the UE has failed, or that the UE cannot request network resources for the UAV operation; or it can be a timer, before the timer stops.
  • the SMF will reject the request sent by the UE to request network resources for the UAV operation; or it may be in other ways. In the case that the SMF has stored the result, the UE will be rejected when sending a request to the AMF to request network resources for UAV operation.
  • the SMF deletes the information related to the failure of the UAV authentication and authorization.
  • the SMF may also notify the AMF that the UAV authentication and authorization fails, and the AMF sends a configuration update command to the UE, where the configuration update command includes the UAV re-authentication and authorization indication.
  • the UE After receiving the configuration update command, the UE can initiate session establishment/modification again as required, and perform authentication and authorization therein.
  • the SMF subscribes to the UDM to update the UAV authentication and authorization state.
  • the core network informs the UE of the update of the authentication and authorization state.
  • this embodiment is specifically applied to a scenario where the PDU session is not released after the UAV authentication and authorization fails.
  • the update of the UAV authentication and authorization status is provided to the UE through the core network in a timely manner, and the UE can perform re-authentication and authorization according to its own needs according to the status update information provided by the core network. Therefore, the success rate of UE re-authentication and authorization is improved, and the signaling waste caused by the rejection of UE's request for UAV operation to request network resources when the core network does not allow re-authentication and authorization to the core network is reduced.
  • FIG. 7 shows a schematic flowchart of a method 700 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 7, method 700 is described below.
  • the UE performs the registration process, and then performs UAV authentication and authorization in the PDU session establishment/modification process, and the UAV authentication and authorization fails.
  • the specific steps are the same as the steps S01 to S606 and S609 in the method 600, and are not repeated here.
  • S702 and S703 are the same as steps S510 and S511 in the method 500, and are not repeated here.
  • the UE initiates a registration request or a service request.
  • the above request message may include a re-authentication authorization indication, where the re-authentication indication is used to instruct to request network resources for the UAV operation.
  • the registration in this step belongs to the mobile registration, while the registration in the method 500 and the method 600 belongs to the initial registration.
  • the AMF sends a subscription query request message to the UDM, which is used to request to query the re-authentication authorization status.
  • the AMF determines that the UE needs to initiate authentication and authorization again after the UAV authentication and authorization fails, so as to send a subscription query request message to the UDM .
  • the AMF may store the failure of the previous UAV authentication and authorization of the UE, so as to determine that the registration request or the service request this time is used for the UAV operation.
  • the AMF determines, according to the re-authentication authorization indication included in the request message received in step S704, that the UE needs to initiate authentication and authorization again after the UAV authentication and authorization fails, thereby sending a subscription query request message to the UDM.
  • the UDM sends a subscription query response message to the AMF, and the query response includes the queried re-authentication status of the UE.
  • the AMF sends a registration response or a service response to the UE.
  • the UE determines to allow the UAV re-authentication and authorization, or allows the UE to request network resources for the UAV operation after the authentication and authorization fails.
  • the above-mentioned response indicates that UAV re-authentication authorization is allowed, and after receiving the response, the UE may initiate session establishment/modification again as required, and perform authentication and authorization therein.
  • the AMF deletes information related to the UAV authentication and authorization failure.
  • the related example is the same as the example in step S513 in the method 500 .
  • the authentication and authorization can also be initiated by the SMF. Specifically, if the re-authentication and authorization status indicates that the UAV can authenticate and authorize again after the UAV authentication and authorization fails, the AMF can send a re-authentication and authorization instruction to the SMF, and the SMF sends an authentication and authorization request to the USS/UTM after receiving the instruction.
  • the UAV re-authentication authorization state is actively configured to the UDM through the USS/UTM, the UE initiates a registration request/service request after the UAV authentication and authorization fails, and the AMF queries the UDM for the re-authentication authorization state, and then feeds it back to the UE.
  • this embodiment is applicable to a scenario in which the UE is allowed to query the re-authentication and authorization status before performing re-authentication and authorization.
  • the UE actively obtains the re-authentication and authorization status, so that the UE can perform the re-authentication and authorization according to its own needs, thereby improving the success rate of the UE's re-authentication and authorization, and reducing the UE's re-authentication and authorization.
  • Signal waste caused by the rejection of a request for network resources for UAV operation to be sent to the core network when the core network does not allow re-authentication authorization.
  • FIG. 8 shows a schematic flowchart of a method 800 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 8, method 800 is described below.
  • S801 to S803 are the same as steps S701 to S703 in the method 700 .
  • the UE sends a session establishment/modification request message to the SMF.
  • the request message may include a re-authentication authorization indication, where the re-authentication indication is used to instruct to request network resources for the UAV operation.
  • the SMF sends a subscription query request message to the UDM, which is used to request to query the re-authentication authorization status.
  • the SMF determines that the UE needs to initiate the authentication and authorization again after the UAV authentication and authorization fails, so as to send a subscription query request message to the UDM .
  • the SMF may store the failure of the previous UAV authentication and authorization of the UE, so as to determine that the registration request or the service request is used for the UAV operation.
  • the UDM sends a subscription query response message to the SMF, and the query response includes the queried re-authentication authorization state of the UE.
  • the SMF sends a session modification command to the UE.
  • the UE determines to allow the UAV re-authentication and authorization, or allows the UE to request network resources for the UAV operation after the authentication and authorization fails. Then, after receiving the session modification command, the UE can initiate session establishment/modification again as required, and perform authentication and authorization therein.
  • the session modification command may include a re-authentication authorization state.
  • the states here can be divided into two types, namely, allowing the UE to perform re-authentication and authorization and not allowing the UE to perform re-authentication and authorization. If the re-authentication authorization status received by the UE is to allow the UE to perform re-authentication and authorization, the UE may initiate session establishment/modification again as required after receiving the session modification command, and perform authentication and authorization therein.
  • the SMF deletes information related to the UAV authentication and authorization failure.
  • the related example is the same as the example in step S617 in the method 600 .
  • the authentication and authorization can also be initiated by the SMF. Specifically, if the re-authentication and authorization status indicates that the UAV can authenticate and authorize again after the UAV authentication and authorization fails, the AMF can send a re-authentication and authorization instruction to the SMF, and the SMF sends an authentication and authorization request to the USS/UTM after receiving the instruction.
  • the UAV re-authentication authorization state is actively configured to the UDM through the USS/UTM, the UE initiates a registration request/service request after the UAV authentication and authorization fails, and the SMF queries the UDM for the re-authentication authorization state, and then feeds it back to the UE.
  • this embodiment is applicable to a scenario in which the UE is allowed to query the re-authentication and authorization status before performing re-authentication and authorization.
  • the UE actively obtains the re-authentication and authorization status, so that the UE can perform the re-authentication and authorization according to its own needs, thereby improving the success rate of the UE's re-authentication and authorization, and reducing the UE's re-authentication and authorization.
  • Signal waste caused by the rejection of a request for network resources for UAV operation to be sent to the core network when the core network does not allow re-authentication authorization.
  • FIG. 9 shows a schematic flowchart of a method 900 for authentication and authorization provided by an embodiment of the present application. As shown in FIG. 9, method 900 is described below.
  • step S901 which is consistent with step S701 in the method 700.
  • the USS/UTM sends a UAV re-authentication authorization instruction to the AMF.
  • multiple network devices may pass between USS/UTM and AMF/SMF, such as UDM, UAS AF/NEF mentioned in this application, or direct transmission, which is not limited in this application .
  • the USS/UTM may send the indication directly to the UE.
  • the AMF/SMF After receiving the UAV re-authentication authorization instruction, the AMF/SMF indicates the re-authentication authorization to the UE.
  • the configuration update command message is used to carry the above indication in the message; for the SMF scenario, as an example, the PDU session update command message is used to carry the above indication in the message. If the re-authentication and authorization status indicates that the authentication and authorization can be performed again after the UAV authentication and authorization fails, the UE can initiate session establishment/modification again as required after receiving, and perform authentication and authorization therein.
  • AMF/SMF deletes information related to UAV authentication and authorization failure.
  • the AMF/SMF stores the result of the UAV authentication and authorization failure.
  • the form of storing the result can be an indicator (Flag), which indicates that the authentication and authorization of the UE has failed, or that the UE cannot request network resources for the UAV operation; or it can be a timer, before the timer stops.
  • the AMF/SMF will reject the request sent by the UE to request network resources for the UAV operation; or it may be in other ways. In case the AMF/SMF has already stored the result, the UE will be rejected when sending a request to the AMF/SMF to request network resources for the UAV operation.
  • the AMF/SMF deletes the information related to the UAV authentication and authorization failure.
  • the USS/UTM sends the re-authentication authorization indication to the core network, and then sends it to the UE, and the UE simply and directly obtains the re-authentication authorization state. It enables the UE to perform re-authentication and authorization according to its own needs, thereby improving the success rate of the UE's re-authentication and authorization, and reducing the UE's request for network resources for UAV operations when the core network does not allow re-authentication and authorization. Signaling waste caused by rejected requests.
  • FIG. 10 is a schematic block diagram of a communication apparatus for authentication and authorization provided by an embodiment of the present application.
  • the communication device 10 may include a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 may be used to receive information sent by other devices, and may also be used to send information to other devices. For example, receiving the second indication information or sending the first indication information.
  • the processing module 12 can be used to process the content of the device, for example, to determine that the authentication and authorization of the terminal device fails.
  • the communication apparatus 10 may correspond to the terminal device in the above method embodiment.
  • the communication apparatus 10 may correspond to a terminal device in any one of the methods 400 to 900 according to the embodiments of the present application, and the communication apparatus 10 may include a device for performing operations performed by the terminal device in the corresponding method. modules, and each unit in the communication apparatus 10 is respectively to implement the operations performed by the terminal device in the corresponding method.
  • the transceiver module 11 is configured to execute step S403
  • the processing module 12 is configured to instruct step S401.
  • the transceiver module 11 is configured to perform steps S501, S504 and S513, and the processing module 12 is configured to perform step S505.
  • the transceiver module 11 is configured to perform steps S602, S609, and S617, and the processing module 12 is configured to perform step S601.
  • the transceiver module 11 is configured to perform steps S704 and S707
  • the processing module 12 is configured to perform step S701.
  • the transceiver module 11 is configured to perform steps S804 and S807
  • the processing module 12 is configured to perform step S801.
  • the transceiver module 11 is configured to perform step S903
  • the processing module 12 is configured to perform step S901.
  • the processing module 12 is configured to determine that the authentication and authorization of the terminal device fails; the transceiver module 11 is configured to receive second indication information from the first network device, where the second indication information indicates that the terminal device can request network resources, The network resources are used for the terminal device to communicate with another terminal device in the same system.
  • the transceiver module 11 is further configured to: send a third request message to the first network device, where the third request message requests the network resource.
  • the third request message includes third indication information, where the third indication information indicates that the terminal device requests to obtain an authentication and authorization state, and the authentication and authorization state is whether the terminal device can request the network resource.
  • the processing module 12 is further configured to: stop the second timer according to the second indication information, wherein the terminal device cannot request the network resource before the second timer is stopped.
  • the terminal equipment is a drone.
  • the communication apparatus 10 may correspond to the first network device or AMF or SMF in the above method embodiment.
  • the communication apparatus 10 may correspond to the first network device or AMF or SMF in any one of the methods 400 to 900 according to the embodiments of the present application, and the communication apparatus 10 may include a method for executing A module of operations performed by a network device or AMF or SMF, and each unit in the communication apparatus 10 is respectively to implement the operations performed by the first network device or AMF or SMF in the corresponding method.
  • the transceiver module 11 is configured to execute step S402a or S402b, and the processing module 12 is configured to instruct step S401.
  • the transceiver module 11 is configured to execute steps S501, S502, S503, S504, S512, and S513, and the processing module 12 is configured to execute step S505.
  • the transceiver module 11 is configured to execute steps S602, S603, S606, S607, S608, S609, S606, and S617, and the processing module 12 is configured to execute step S601.
  • the transceiver module 11 is configured to execute steps S704, S705, S706, and S707, and the processing module 12 is configured to execute step S701.
  • the transceiver module 11 is configured to execute steps S804, S805, S806, and S807, and the processing module 12 is configured to execute step S801.
  • the transceiver module 11 is configured to execute step S903
  • the processing module 12 is configured to execute step S901.
  • the processing module 12 is used to determine that the authentication and authorization of the terminal device fails; the transceiver module 11 is used to receive first indication information, where the first indication information indicates that the terminal device can request network resources, and the network resources are used for the terminal The device communicates with another terminal device in the same system; the transceiver module 11 is also used to send second indication information to the terminal device according to the first indication information, and the second indication information indicates that the terminal device can request the network resource.
  • the transceiver module 11 is further configured to: send a first request message to the second network device, the first request message subscribes to the change of the authentication and authorization state; or, the first request message queries the authentication and authorization state; wherein, the authentication and authorization state Whether the terminal device can request the network resource.
  • the transceiver module 11 is further configured to: receive a third request message from the terminal device, where the third request message requests the network resource.
  • the third request message includes third indication information, and the third indication information indicates that the terminal device requests to obtain the authentication authorization state.
  • the processing module 12 is further configured to: delete the first information according to the first indication information, wherein the first information is stored by the first network device, and the first information indicates at least one of the following: the authentication and authorization of the terminal device fails, The terminal device cannot request the network resource.
  • the processing module 12 is further configured to: stop the first timer according to the first indication information, wherein the first network device rejects the second information from the terminal device before the stop of the first timer, the second information Request this network resource.
  • the transceiver module 11 is further configured to: send a fourth request message to the second network device or the third network device according to the third request message, where the fourth request message requests to perform authentication and authorization on the terminal device.
  • the terminal equipment is a drone.
  • the communication apparatus 10 may correspond to the second network device or UDM in the above method embodiment.
  • the communication apparatus 10 may correspond to the second network device or UDM in any one of the methods 400 to 800 according to the embodiments of the present application, and the communication apparatus 10 may include a method for executing the corresponding method by the second network It is a module of operations performed by the device or UDM, and each unit in the communication apparatus 10 is respectively in order to implement the operations performed by the second network device or UDM in the corresponding method.
  • the transceiver module 11 is configured to execute step S402a
  • the processing module 12 is configured to instruct step S401.
  • the transceiver module 11 is configured to execute steps S502, S503, S506, S509, S510, S511, and S512, and the processing module 12 is configured to execute step S505.
  • the transceiver module 11 is configured to execute steps S607, S608, S610, S613, S615, and S616, and the processing module 12 is configured to execute step S601.
  • the transceiver module 11 is configured to execute steps S703, S705, S705, and S706, and the processing module 12 is configured to execute step S701.
  • the transceiver module 11 is configured to execute steps S803, S805, S806, and S807, and the processing module 12 is configured to execute step S801.
  • the transceiver module 11 is configured to receive fourth indication information, where the fourth indication information indicates that the terminal device can request network resources, and the network resources are used for the terminal device to communicate with another terminal device in the same system; the transceiver Module 11 is further configured to send first indication information to the first network device, where the first indication information indicates that the terminal device can request the network resource.
  • the transceiver module 11 is further configured to receive a first request message from the first network device, where the first request message subscribes to a change in an authentication authorization state, where the authentication authorization state is whether the terminal device can request the network resource; or, The first request message queries an authentication and authorization state, where the authentication and authorization state is whether the terminal device can request the network resource.
  • the transceiver module 11 is further configured to: send a fifth request message to the third network device, where the fifth request message subscribes to the change of the authentication and authorization state; or, the fifth request message queries the authentication and authorization state.
  • the terminal equipment is a drone.
  • the communication apparatus 10 may correspond to the third network equipment or UAS AF or NEF or USS or UTM in the above method embodiment.
  • the communication apparatus 10 may correspond to the third network device or UAS AF or NEF or USS or UTM in any one of the methods 400 to 900 according to the embodiments of the present application, and the communication apparatus 10 may include a device for executing Modules of operations performed by the third network device or UAS AF or NEF or USS or UTM in the corresponding method, and each unit in the communication device 10 is respectively implemented by the third network device or UAS AF or NEF in the corresponding method. Or what USS or UTM does.
  • the transceiver module 11 is configured to execute step S402b, and the processing module 12 is configured to instruct step S401.
  • the transceiver module 11 is configured to execute steps S506, S507, S508, S509, S510, and S511, and the processing module 12 is configured to execute step S505.
  • the transceiver module 11 is configured to perform steps S507, S508, and S510, and the processing module 12 is configured to perform step S505.
  • the transceiver module 11 is configured to perform steps S603, S604, S605, S606, S610, S611, S612, S613, S614, and S615.
  • the transceiver module 11 is configured to perform steps S604, S605, S611, S612, and S614.
  • the transceiver module 11 is configured to execute steps S702 and S703
  • the processing module 12 is configured to execute step S701.
  • the transceiver module 11 is configured to perform step S702
  • the processing module 12 is configured to perform step S701.
  • the transceiver module 11 is configured to execute steps S802 and S803 and the processing module 12 is configured to execute step S801.
  • the transceiver module 11 is configured to perform step S802
  • the processing module 12 is configured to perform step S801.
  • the transceiver module 11 is configured to execute step S902
  • the processing module 12 is configured to execute step S901.
  • the processing module 12 is configured to determine that the authentication and authorization of the terminal device fails; the processing module 12 is further configured to determine fifth indication information, where the fifth indication information indicates that the terminal device can request network resources, and the network resources are used for The terminal device communicates with another terminal device in the same system; the transceiver module 11 is configured to send the fifth indication information.
  • the transceiver module 12 is further configured to: receive a sixth request message, where the sixth request message subscribes to the change of the authentication and authorization state, and the authentication and authorization state is whether the terminal device can request the network resource; or, the sixth request message queries the Authentication authorization status.
  • the terminal equipment is a drone.
  • FIG. 11 is a schematic diagram of an apparatus 20 for information transmission provided by an embodiment of the present application.
  • the apparatus 20 may be a terminal device, including various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices, or other processing devices connected to a wireless modem, as well as various forms of
  • the terminal, mobile station, terminal, user equipment, soft terminal, etc. can also be a chip or a chip system located on the terminal equipment.
  • the apparatus 20 may be AMF, SMF or MME, including various devices for mobility management and access management and/or for session management functions, etc. Chip or system on chip on SMF or MME etc.
  • the apparatus 20 may be a UDM, including various devices for processing user identification, access authentication, registration, or mobility management, or may be a chip or a chip system located on the UDM.
  • the device 20 may be a UAS AF or NEF, or a chip or a chip system or the like located on the UAS AF or NEF.
  • the device 20 may be a USS or a UTM, or a chip or a chip system or the like located on the USS or UTM.
  • the apparatus 20 may include a processor 21 (ie, an example of a processing module) and a memory 22 .
  • the memory 22 is used for storing instructions
  • the processor 21 is used for executing the instructions stored in the memory 22, so that the apparatus 20 implements the execution of the devices in the various possible designs described above in the methods corresponding to FIG. 4 to FIG. 9 . step.
  • the device 20 may further include an input port 23 (ie, an example of a transceiver module) and an output port 24 (ie, another example of a transceiver module).
  • the processor 21, the memory 22, the input port 23 and the output port 24 can communicate with each other through an internal connection path to transmit control and/or data signals.
  • the memory 22 is used to store a computer program, and the processor 21 can be used to call and run the computer program from the memory 22 to control the input port 23 to receive signals, control the output port 24 to send signals, and complete the process of the terminal device in the above method. step.
  • the memory 22 may be integrated in the processor 21 or may be provided separately from the processor 21 .
  • the input port 23 is a receiver
  • the output port 24 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 23 is an input interface
  • the output port 24 is an output interface
  • the functions of the input port 23 and the output port 34 can be considered to be implemented by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 21 can be considered to be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer may be used to implement the device provided by the embodiments of the present application.
  • the program codes that will implement the functions of the processor 21 , the input port 23 and the output port 24 are stored in the memory 22 , and the general-purpose processor implements the functions of the processor 21 , the input port 23 and the output port 24 by executing the codes in the memory 22 .
  • each module or unit in the apparatus 20 may be used to perform each action or process performed by the device (eg, terminal device) performing random access in the above method, and detailed description thereof is omitted here to avoid redundant description.
  • the processor may be a central processing unit (CPU, central processing unit), and the processor may also be other general-purpose processors, digital signal processors (DSP, digital signal processors), dedicated integrated circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processors
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • DDR SDRAM Double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination.
  • the above-described embodiments may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server or data center by wire (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that contains one or more sets of available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • a computer device which may be a personal computer, a server, or a network device, etc.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Un procédé et un équipement d'authentification et d'autorisation sont divulgués dans la présente demande. Le procédé fait appel à l'étape suivante : lorsque l'authentification et l'autorisation d'un dispositif terminal échouent, un côté réseau central transmet des informations d'indication au dispositif terminal, les informations d'indication indiquant que le dispositif terminal est apte à demander une ressource de réseau, la ressource de réseau étant utilisée par le dispositif terminal pour communiquer avec un autre dispositif terminal dans un même système. Un premier dispositif de réseau du côté réseau central s'abonne à ou interroge un état d'authentification et d'autorisation pour le dispositif terminal, puis notifie le dispositif terminal, ou un troisième dispositif de réseau transmet activement un état d'authentification et d'autorisation au dispositif terminal. Le procédé et l'équipement divulgués dans la présente demande permettent au dispositif terminal d'effectuer une réauthentification et une réautorisation selon une exigence de lui-même, ce qui permet d'augmenter le taux de réussite de la réauthentification et de la réautorisation du dispositif terminal, réduisant également le gaspillage de signalisation provoqué par la demande de la ressource de réseau qui est rejetée lorsque le dispositif terminal n'est pas autorisé par le réseau central à effectuer une réauthentification et une réautorisation.
PCT/CN2022/071841 2021-02-10 2022-01-13 Procédé d'authentification et d'autorisation et équipement de communication WO2022170911A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110183980.3 2021-02-10
CN202110183980.3A CN114915968A (zh) 2021-02-10 2021-02-10 认证授权的方法与通信装置

Publications (1)

Publication Number Publication Date
WO2022170911A1 true WO2022170911A1 (fr) 2022-08-18

Family

ID=82761739

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/071841 WO2022170911A1 (fr) 2021-02-10 2022-01-13 Procédé d'authentification et d'autorisation et équipement de communication

Country Status (2)

Country Link
CN (1) CN114915968A (fr)
WO (1) WO2022170911A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118120269A (zh) * 2022-09-30 2024-05-31 北京小米移动软件有限公司 应用功能授权方法及装置
CN116669042B (zh) * 2023-07-26 2023-11-14 中国电信股份有限公司 语音无线局域网的重鉴权方法、装置和通信设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107615815A (zh) * 2015-06-23 2018-01-19 华为技术有限公司 免授权传输的切换方法、终端设备和网络设备
CN111031605A (zh) * 2017-08-04 2020-04-17 Oppo广东移动通信有限公司 资源调度的方法、终端设备和网络设备
WO2020088603A1 (fr) * 2018-11-02 2020-05-07 中国信息通信研究院 Procédé de planification de liaison montante sans autorisation dynamique, appareil terminal, appareil de réseau et système mettant en oeuvre ledit procédé
US20200162919A1 (en) * 2018-11-16 2020-05-21 Lenovo (Singapore) Pte. Ltd. Accessing a denied network resource

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107615815A (zh) * 2015-06-23 2018-01-19 华为技术有限公司 免授权传输的切换方法、终端设备和网络设备
CN111031605A (zh) * 2017-08-04 2020-04-17 Oppo广东移动通信有限公司 资源调度的方法、终端设备和网络设备
WO2020088603A1 (fr) * 2018-11-02 2020-05-07 中国信息通信研究院 Procédé de planification de liaison montante sans autorisation dynamique, appareil terminal, appareil de réseau et système mettant en oeuvre ledit procédé
US20200162919A1 (en) * 2018-11-16 2020-05-21 Lenovo (Singapore) Pte. Ltd. Accessing a denied network resource

Also Published As

Publication number Publication date
CN114915968A (zh) 2022-08-16

Similar Documents

Publication Publication Date Title
US20210345117A1 (en) Wireless Network Communication Method, Network Device, and Terminal
US20240196261A1 (en) Prioritization procedures for nr v2x sidelink shared channel data transmission
US20220116814A1 (en) Meeting strict qos requirements through network control of device route and location
US10712743B2 (en) Augmentative control of drones
JP2022071196A (ja) 仮想化されたモバイルコアネットワークへの接続
KR20210082224A (ko) 새로운 라디오 차량 사이드링크 발견
WO2022170911A1 (fr) Procédé d'authentification et d'autorisation et équipement de communication
EP4274360A2 (fr) Demande de connexion de données pour exploitation d'uav
WO2020156127A1 (fr) Procédé de communication sans fil et appareil de communication
US20210197968A1 (en) Unmanned aerial vehicle
JP7535067B2 (ja) マルチユーザモバイル端末のためのサービス配信を実行するための装置、システム、方法、およびコンピュータ可読媒体
US20220295337A1 (en) Operation method of ue related to pfi in wireless communication system, and apparatus therefor
EP3952599A1 (fr) Procédé d'établissement de support de communication, dispositif et système
US20240214365A1 (en) Communication method and apparatus
WO2022156627A1 (fr) Procédé et appareil de gestion de communication de véhicule aérien sans pilote
WO2022193903A1 (fr) Procédé de découverte d'entité de service et appareil de communication
WO2022206532A1 (fr) Procédé, appareil et système de mise à jour de la qualité de service (qos)
US20240171968A1 (en) Reduced capacity ues and 5th generation core network interactions
EP4451648A1 (fr) Procédé et appareil d'autorisation
WO2023065826A1 (fr) Procédé de communication et appareil de communication
WO2023165425A1 (fr) Procédé et appareil de communication, et dispositif
US20240365272A1 (en) Application interaction for network slicing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22752073

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22752073

Country of ref document: EP

Kind code of ref document: A1