WO2022194262A1 - 安全通信的方法和装置 - Google Patents

安全通信的方法和装置 Download PDF

Info

Publication number
WO2022194262A1
WO2022194262A1 PCT/CN2022/081583 CN2022081583W WO2022194262A1 WO 2022194262 A1 WO2022194262 A1 WO 2022194262A1 CN 2022081583 W CN2022081583 W CN 2022081583W WO 2022194262 A1 WO2022194262 A1 WO 2022194262A1
Authority
WO
WIPO (PCT)
Prior art keywords
security group
group
security
communication
network element
Prior art date
Application number
PCT/CN2022/081583
Other languages
English (en)
French (fr)
Inventor
韩文勇
谢春生
刁文波
赵军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022194262A1 publication Critical patent/WO2022194262A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/76—Group identity

Definitions

  • the present application relates to the field of communication technology, and more particularly, to a method and apparatus for secure communication.
  • a local area network is a computer communication network that connects various computers, external devices, and databases within a local geographic range (such as a school, factory, and agency).
  • the virtual local area network intercommunication of communication devices in the mobile network can be realized through a virtual network (virtual network, VN) group.
  • VN virtual network
  • device interworking security there is no further definition for the interworking permissions of devices in the VN group, and there is a lack of security access control mechanisms.
  • the present application provides a method and apparatus for secure communication, which can realize secure access of devices in a virtual network group.
  • a method for secure communication is provided, which can be executed by a network device, or can also be executed by a chip or circuit used for a network device, which is not limited in this application.
  • a network device or can also be executed by a chip or circuit used for a network device, which is not limited in this application.
  • the following uses The execution of the first network element device is taken as an example for description.
  • the method may include: the first network element receives information of service data sent by the first communication device to the second communication device; the first network element obtains a communication policy between the first security group and the second security group, and the first security group is the security group corresponding to the first communication device, and the second security group is the security group corresponding to the second communication device; according to the communication policy between the first security group and the second security group, the first network element formulates forwarding rules for service data ; wherein, the first communication device and the second communication device are devices in the same virtual network VN group, the VN group includes multiple security groups, and the multiple security groups include the first security group and the second security group.
  • the above method can be performed by a core network element (ie, the first network element) (such as a session management function (session management function, SMF) network element or a user plane function (user plane function, UPF) network element), or, can also be performed by Chip or circuit execution for core network elements.
  • a core network element ie, the first network element
  • SMF session management function
  • UPF user plane function
  • the first network element can determine the security group to which the source address of the service data (that is, the address of the first communication device) belongs and the destination address (that is, the address of the second communication device) ) communication strategy between security groups to which they belong, and formulating service data forwarding rules according to the communication strategy can not only improve the security of communication between devices, but also facilitate management.
  • the communication policy between the first security group and the second security group includes: allowing communication between the first security group and the second security group, or, the first Communication between the security group and the second security group is prohibited.
  • the communication policies between security groups may include two types: allowing communication and prohibiting communication, which not only enables secure access, but also is simple and easy to implement.
  • the first network element is a session management function network element.
  • the method further includes: when the communication policy between the first security group and the second security group is to allow communication, a forwarding rule is used to indicate the forwarding of service data path; or; when the communication policy between the first security group and the second security group is to prohibit communication, the forwarding rule is used to instruct to discard the service data.
  • the receiving, by the first network element, information about service data sent by the first communication device to the second communication device includes: the first network element receiving information from the second network element Forwarding rule unknown message, the forwarding rule unknown message includes source address information and destination address information of the service data, the source address corresponds to the first security group, and the destination address corresponds to the second security group; according to the relationship between the first security group and the second security group.
  • Communication policy the first network element formulates forwarding rules for service data, including: the first network element formulates forwarding rules for service data according to the communication policy between the first security group corresponding to the source address and the second security group corresponding to the destination address ; The first network element sends the forwarding rule to the second network element.
  • the first network element determines the source address and the destination address based on the relevant information of the service data in the unknown message of forwarding rule, such as the source address and the destination address
  • the corresponding security group can then formulate a forwarding rule for the service data according to the communication policy between the security groups corresponding to the source address and the destination address, and then send the forwarding rule to the second network element, so that the second network element can
  • the forwarding rules process business data.
  • the method before the first network element receives the forwarding rule unknown message from the second network element, the method further includes: the first network element sends a first indication to the second network element information, the first indication information is used to indicate that the information of which the forwarding rule is unknown is reported.
  • the forwarding rule is unknown, it means that the forwarding rule cannot be matched according to the source address and the destination address.
  • the first network element may configure an unknown forwarding rule packet reporting indication to the second network element.
  • the second network element may report the unknown forwarding rule of the service data to the first network element after receiving the unknown packet, so that the first network element can formulate a forwarding rule for the service data.
  • the method further includes: the first network element sends second indication information to the second network element, where the second indication information is used to instruct deletion of the forwarding rule.
  • the security group can be updated in time, thereby not only improving resource utilization, but also ensuring data transmission performance.
  • the first network element sends the second indication information to the second network element, including: determining the session release of the first communication device or determining the address aging related to the forwarding rule In the case of , the first network element sends the second indication information to the second network element.
  • the first network element may also periodically send the second indication information to the second network element.
  • the second network element is a user plane function network element.
  • the first network element is a user plane function network element.
  • the method further includes: the first network element receives information of multiple security groups from the second network element, the information of the multiple security groups includes: multiple security groups Information on the communication policy between any two security groups.
  • the first network element may obtain relevant information of the multiple security groups in advance.
  • the receiving, by the first network element, information of service data sent by the first communication device to the second communication device includes: the first network element receiving the information sent by the first communication device to the second communication device.
  • Service data of the second communication device; the first network element acquiring the communication policy between the first security group and the second security group includes: determining, by the first network element, that the first communication device belongs to the VN group corresponding to the first security group A communication device, when the second communication device belongs to the communication device corresponding to the second security group in the VN group, the first network element obtains the communication policy between the first security group and the second security group from information of multiple security groups .
  • the forwarding rule when the communication policy between the first security group and the second security group is to allow communication, the forwarding rule is used to indicate the forwarding path of the service data, and the first The network element forwards the service data according to the forwarding path of the service data indicated by the forwarding rule; or, when the communication policy between the first security group and the second security group is to prohibit communication, the forwarding rule is used to indicate that the service data is discarded, and the third A network element discards service data according to the forwarding rule.
  • the method further includes: the first network element sends third indication information to the second network element, where the third indication information is used to indicate address aging related to the forwarding rule.
  • the first network element may indicate the address ageing to the second network element, so that the first network element can delete the forwarding rule corresponding to the address and save storage space.
  • the method further includes: the first network element receives fourth indication information from the second network element, where the fourth indication information is used to instruct deletion of the forwarding rule.
  • the second network element is a session management function network element.
  • each security group includes one or more of the following information: the data network corresponding to the security group, the external identifier of the VN group to which the security group belongs, and the identifier of the security group , the name of the security group, the communication device corresponding to the security group, and the communication policy between the security group and other security groups in the multiple security groups in the VN group.
  • a method for secure communication is provided, which can be executed by a network device, or can also be executed by a chip or circuit used for a network device, which is not limited in this application.
  • the execution of the third network element is described as an example.
  • the method may include: the third network element receives a first request message from the fourth network element, where the first request message is used to request the creation of a security group for the virtual network VN group; the third network element, based on the first request message, is the VN group Create multiple security groups; wherein, the VN group includes multiple security groups, each security group corresponds to one or more communication devices, and the multiple security groups include the first security group, the first security group and the multiple security groups in the multiple security groups.
  • a communication policy exists between other security groups, and the communication policy is used to control the communication between the communication device corresponding to the first security group and the communication device corresponding to the other security group.
  • a VN group may include multiple security groups.
  • the third network element may be, for example, a capability exposure function (network exposure function, NEF), and the fourth network element may be, for example, an application function (application function, AF).
  • NEF network exposure function
  • AF application function
  • VN virtual network
  • communication policies between security groups are configured respectively.
  • Communication devices in the network (such as communication devices in a VN group) ) are respectively added to the corresponding security groups, so that the access control of communication devices can be implemented according to the group granularity. In this way, not only the security of communication between devices can be improved, but also management can be facilitated.
  • the communication policy is to allow communication or prohibit communication.
  • the communication policies between security groups may include two types: allowing communication and prohibiting communication, which not only enables secure access, but also is simple and easy to implement.
  • the first request message includes one or more of the following information: the external identifier of the VN group to which the security group to be created belongs, the corresponding ID of the security group to be created The data network, the identifier of the security group to be created, the name of the security group to be created, and the communication policy between the security groups to be created.
  • the first request message includes a communication policy between the security groups to be created
  • the method further includes: according to the communication policy between the security groups to be created, the third The three network elements set a communication policy for the security group to be created, and the communication policy is to allow communication or prohibit communication.
  • the method further includes: the third network element receives a second request message from the fourth network element, where the second request message is used to request to add a second request message to the first security group or multiple communication devices.
  • the second request message includes one or more of the following information: the data network corresponding to the first security group, the external identifier of the VN group to which the first security group belongs , the identifier of the first security group, the name of the first security group, and the information of one or more communication devices to be added.
  • each security group includes one or more of the following information: the data network corresponding to the security group, the external identifier of the VN group to which the security group belongs, and the identifier of the security group , the name of the security group, the communication device corresponding to the security group, and the communication policy between the security group and other security groups in the multiple security groups of the VN group.
  • the third network element is a capability opening function network element
  • the fourth network element is an application function network element
  • a method for secure communication is provided, and the method can be executed by a network device, or can also be executed by a chip or circuit used for a network device, which is not limited in this application.
  • the following uses The execution of the first network element is taken as an example for description.
  • the method may include: the first network element receives a session establishment request from the first communication device, where the session establishment request includes an identifier of the virtual network VN group; the security group corresponding to the first communication device is the first security group; The communication policy between the first security group and other security groups, formulating forwarding rules for the first communication device; the first network element sends the forwarding rules to the second network element; wherein, the VN group includes multiple security groups, each security group The group corresponds to one or more communication devices, the multiple security groups include the first security group, and there is a communication policy between the first security group and other security groups in the multiple security groups, and the communication policy is used to control the corresponding Communication between communication devices and communication devices corresponding to other security groups.
  • the above method may be performed by a core network element (ie, the first network element) (eg, an SMF network element), or may also be performed by a chip or circuit for a core network element.
  • a core network element ie, the first network element
  • SMF network element eg, an SMF network element
  • the first network element is an SMF network element
  • the second network element is a UPF network element
  • the first network element determines that the first communication device belongs to a communication device corresponding to the first security group.
  • a core network element (such as an SMF network element) can formulate forwarding rules for the communication device based on the communication policy between the security group where the communication device is located and other security groups, and The data is sent to the second network element, so that the second network element can perform data forwarding based on the forwarding rule.
  • the method further includes: the first network element requests the sixth network element for VN group session subscription information; the first network element receives the VN group session from the sixth network element Subscription information, the VN group session subscription information includes the information of the multiple security groups, and the information of the multiple security groups includes: the information of the communication policy between any two security groups in the multiple security groups.
  • the sixth network element is a core network element, such as a unified data management (unified data management, UDM) network element or a unified data repository (unified data repository, UDR) network element.
  • a unified data management unified data management, UDM
  • UDR unified data repository
  • the first network element sends second indication information to the second network element, where the second indication information is used to instruct deletion of the forwarding rule formulated for the first communication device.
  • the first network element sends the second indication information to the second network element, including: determining the session release of the first communication device or determining the address aging related to the forwarding rule In the case of , the first network element sends the second indication information to the second network element.
  • the first network element may also periodically send the second indication information to the second network element.
  • the method further includes: the first network element receives an address aging message from the second network element, and releases the address-related association according to the address aging message.
  • disassociate the address from the session of the terminal device For example, disassociate the address from the session of the terminal device, and disassociate the address from the UPF.
  • a method for secure communication is provided, which can be executed by a network device, or can also be executed by a chip or circuit used for a network device, which is not limited in this application.
  • the implementation of two network elements is taken as an example for description.
  • the method may include: the second network element receives a forwarding rule corresponding to the first communication device from the first network element, the security group corresponding to the first communication device is the first security group, and the forwarding rule corresponding to the first communication device is based on the first communication device.
  • the communication policy between a security group and other security groups is formulated; the second network element receives the service data from the first communication device; the second network element processes the service data according to the forwarding rule corresponding to the first communication device.
  • the above method may be performed by a core network element (ie, a second network element) (eg, a UPF network element), or may also be performed by a chip or circuit for a core network element.
  • a core network element ie, a second network element
  • a chip or circuit for a core network element ie, a UPF network element
  • the second network element is a UPF network element
  • the first network element is an SMF network element
  • the core network element (such as the UPF network element) executes the security group policy to complete the control of the communication device message intercommunication, thereby improving the security of the communication between the devices.
  • the multiple security groups include a second security group, and the service data is data sent by the first communication device to the communication device corresponding to the second security group;
  • the second network element Processing the service data according to the forwarding rule corresponding to the first communication device includes: when the communication policy between the first security group and the second security group is to allow communication, the forwarding rule is used to indicate the forwarding path of the service data, the second The network element forwards the service data according to the forwarding path of the service data indicated by the forwarding rule; or, when the communication policy between the first security group and the second security group is to prohibit communication, the forwarding rule is used to indicate that the service data is discarded, and the third The second NE discards the service data according to the forwarding rules.
  • the method further includes: the second network element receives second indication information from the first network element, where the second indication information is used to instruct to delete the formula for the first communication device forwarding rules.
  • the method further includes: determining that the address corresponding to the first communication device is aging; deleting all forwarding rules corresponding to the aged address, or deleting the security corresponding to the aged address group information.
  • a communication apparatus configured to perform the methods provided in the above-mentioned first to fourth aspects.
  • the apparatus may include units and/or modules for performing the methods provided in the first to fourth aspects, such as a processing unit and/or a communication unit.
  • the apparatus is a network device.
  • the communication unit may be a transceiver, or an input/output interface;
  • the processing unit may be a processor.
  • the apparatus is a chip, a system of chips, or a circuit used in a network device.
  • the communication unit may be an input/output interface, interface circuit, output circuit, input circuit, pin or Related circuits, etc.;
  • the processing unit may be a processor, a processing circuit, a logic circuit, or the like.
  • the above transceiver may be a transceiver circuit.
  • the above-mentioned input/output interface may be an input/output circuit.
  • a communication device comprising: a memory for storing a program; a processor for executing a program stored in the memory, and when the program stored in the memory is executed, the processor is used for executing the above-mentioned first aspect to The method provided by the fourth aspect.
  • the apparatus is a terminal device or a network device.
  • the apparatus is a chip, a chip system or a circuit used in terminal equipment or network equipment.
  • the present application provides a processor for executing the methods provided by the above aspects.
  • the process of sending the above-mentioned information and obtaining/receiving the above-mentioned information in the above-mentioned methods can be understood as the process of outputting the above-mentioned information by the processor and the process of receiving the above-mentioned input information by the processor.
  • the processor When outputting the above-mentioned information, the processor outputs the above-mentioned information to the transceiver for transmission by the transceiver. After the above-mentioned information is output by the processor, other processing may be required before reaching the transceiver.
  • the transceiver obtains/receives the above-mentioned information, and inputs it into the processor. Furthermore, after the transceiver receives the above-mentioned information, the above-mentioned information may need to perform other processing before being input to the processor.
  • obtaining the communication policy between the first security group and the second security group mentioned in the foregoing method can be understood as the processor receiving the input information.
  • the above-mentioned processor may be a processor specially used to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor.
  • the above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (Read Only Memory, ROM), which can be integrated with the processor on the same chip, or can be set on different chips respectively.
  • ROM read-only memory
  • the embodiment does not limit the type of the memory and the setting manner of the memory and the processor.
  • a computer-readable storage medium stores program codes for execution by a device, the program codes including methods for executing the above-mentioned first to fourth aspects.
  • a computer program product containing instructions, when the computer program product is run on a computer, the computer program product causes the computer to execute the methods provided in the first to fourth aspects above.
  • a tenth aspect provides a chip, the chip includes a processor and a communication interface, the processor reads an instruction stored in a memory through the communication interface, and executes the methods provided in the first to fourth aspects.
  • the chip may further include a memory, in which instructions are stored, the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the The processor is configured to execute the methods provided in the first to fourth aspects above.
  • a communication system including the above-mentioned network equipment, such as a first network element and a second network element (eg, SMF and UPF); in another example, a third network element and a fourth network element (such as NEF and AF).
  • a first network element and a second network element eg, SMF and UPF
  • a third network element and a fourth network element such as NEF and AF
  • FIG. 1 shows a schematic diagram of a network architecture suitable for the method provided by this embodiment of the present application.
  • FIG. 2 shows a schematic diagram of a PDU connection suitable for this embodiment of the present application.
  • FIG. 3 shows a schematic diagram of data packet forwarding applicable to this embodiment of the present application.
  • FIG. 4 and FIG. 5 show schematic diagrams of user plane architecture for data interaction of terminal devices in the 5G LAN group applicable to the embodiment of the present application.
  • 6 and 7 show schematic diagrams of UPF forwarding in a 5G LAN scenario applicable to this embodiment of the present application.
  • Figure 8 shows a schematic diagram of AF configuration management 5G VN group.
  • FIG. 9 shows a schematic interaction diagram of a method 900 for secure communication provided by an embodiment of the present application.
  • FIG. 10 shows a schematic interaction diagram of a method 1000 for secure communication provided by an embodiment of the present application.
  • FIG. 11 shows a schematic flow chart of secure communication suitable for this embodiment of the present application.
  • FIG. 12 shows another schematic flowchart of the secure communication suitable for the embodiment of the present application.
  • (1) and (2) in FIG. 13 show a schematic flowchart of the execution of the security group policy applicable to an embodiment of the present application.
  • FIG. 15 shows a schematic flowchart of a security group policy execution applicable to another embodiment of the present application.
  • FIG. 16 shows another schematic flowchart of the security group policy execution applicable to another embodiment of the present application.
  • FIG. 17 shows a schematic flowchart of the security group update applicable to this embodiment of the present application.
  • FIG. 18 shows another schematic flowchart of the security group update applicable to this embodiment of the present application.
  • FIG. 19 is a schematic block diagram of an apparatus for secure communication provided according to an embodiment of the present application.
  • Fig. 20 is another schematic block diagram of an apparatus for secure communication provided according to an embodiment of the present application.
  • FIG. 21 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • the technical solutions provided in this application can be applied to various communication systems, for example, a fifth generation (5th Generation, 5G) mobile communication system or a new radio access technology (NR).
  • the 5G mobile communication system may include a non-standalone (NSA, NSA) and/or an independent network (standalone, SA).
  • the technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system.
  • the technical solutions of the embodiments of the present application can also be applied to machine type communication (MTC), long term evolution-machine (LTE-M), device-to-device (D2D) ) network, machine to machine (M2M) network, internet of things (IoT) network, or other network.
  • the IoT network may include, for example, the Internet of Vehicles.
  • V2X vehicle to other devices
  • V2X vehicle to other devices
  • the V2X may include: vehicle to vehicle (vehicle to vehicle, V2V) communication, vehicle and vehicle Infrastructure (V2I) communication, vehicle to pedestrian (V2P) or vehicle to network (V2N) communication, etc.
  • V2V vehicle to vehicle
  • V2I vehicle and vehicle Infrastructure
  • V2P vehicle to pedestrian
  • V2N vehicle to network
  • FIG. 1 To facilitate understanding of the embodiments of the present application, a network architecture applicable to the embodiments of the present application is first described in detail with reference to FIG. 1 .
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.
  • the network architecture is, for example, the 5G networking architecture defined by the 3rd Generation Partnership Project (3GPP).
  • the network architecture may include, but is not limited to, the following: user equipment (UE), access network (AN), access and mobility management function (AMF) network elements, session Management function (session management function, SMF) network element, user plane function (user plane function, UPF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element , Unified Data Repository (UDR), Application Function (AF) or Capability Exposure Function (Network Exposure Function, NEF), Data Network (DN), etc.
  • UE user equipment
  • AN access network
  • AMF mobility management function
  • SMF session Management function
  • user plane function user plane function
  • UPF policy control function
  • PCF policy control function
  • UDM Unified Data Repository
  • UDR Unified Data Re
  • Each network element shown in FIG. 1 is briefly introduced below.
  • Terminal equipment can be called user equipment (UE), access terminal, subscriber unit, subscriber station, mobile station, mobile station (MS), mobile terminal (MT), remote station , remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user equipment.
  • the terminal device may be a device that provides voice/data connectivity to the user, such as a handheld device with a wireless connection function, a vehicle-mounted device, and the like.
  • terminals can be: mobile phone (mobile phone), tablet computer (pad), computer with wireless transceiver function (such as notebook computer, palmtop computer, etc.), mobile internet device (mobile internet device, MID), virtual reality (virtual reality, VR) equipment, augmented reality (augmented reality, AR) equipment, wireless terminal in industrial control (industrial control), wireless terminal in unmanned driving (self driving), wireless terminal in remote medical (remote medical) Terminal, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, cellular phone, cordless Telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital assistant (PDA), handheld device, computing device or connection with wireless communication capabilities
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the terminal device may also be a terminal device in the IoT system.
  • IoT is an important part of the future development of information technology. Its main technical feature is to connect items to the network through communication technology, so as to realize the intelligent network of human-machine interconnection and interconnection of things. IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrow band (NB) technology.
  • NB narrow band
  • terminal equipment can also include sensors such as smart printers, train detectors, and gas stations.
  • the main functions include collecting data (part of terminal equipment), receiving control information and downlink data of network equipment, and sending electromagnetic waves to transmit uplink data to network equipment. .
  • the terminal device may be any device that can access the network.
  • a certain air interface technology can be used to communicate with each other between the terminal device and the access network device.
  • a terminal device may be used to act as a base station.
  • terminal devices may act as scheduling entities that provide sidelink signals between terminal devices in V2X or D2D, etc.
  • terminal devices may act as scheduling entities that provide sidelink signals between terminal devices in V2X or D2D, etc.
  • cell phones and automobiles communicate with each other using sidelink signals. Communication between cell phones and smart home devices without relaying communication signals through base stations.
  • Access network can provide network access functions for authorized users in a specific area, including radio access network (RAN) equipment and AN equipment.
  • the RAN device is mainly a 3GPP network wireless network device, and the AN device may be a non-3GPP (non-3GPP) defined access network device.
  • the access network may be an access network using different access technologies.
  • 3GPP access technologies such as those employed in 3G, 4G or 5G systems
  • non-3GPP (non-3GPP) access technologies 3GPP access technology refers to the access technology that conforms to the 3GPP standard specifications.
  • the access network equipment in the 5G system is called the next generation Node Base station (gNB) or RAN.
  • Non-3GPP access technologies refer to access technologies that do not conform to 3GPP standards, such as air interface technologies represented by access points (APs) in wireless fidelity (WiFi), global interconnection microwave access (worldwide interoperability for microwave access, WiMAX), code division multiple access (code division multiple access, CDMA) networks, etc.
  • the access network equipment (AN equipment) can allow the terminal equipment and the 3GPP core network to use non-3GPP technology for interconnection and intercommunication.
  • An access network that implements an access network function based on a wireless communication technology may be referred to as a RAN.
  • the radio access network can be responsible for functions such as radio resource management, quality of service (QoS) management, data compression and encryption on the air interface side.
  • QoS quality of service
  • the wireless access network provides access services for terminal equipment, and then completes the forwarding of control signals and user data between the terminal and the core network.
  • a radio access network may include, but is not limited to, a macro base station, a micro base station (also called a small cell), a radio network controller (RNC), a Node B (Node B, NB), a base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), AP in WiFi systems, wireless Relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc. It can also be a gNB or a transmission point (TRP or TRP) in a 5G (eg, NR) system.
  • RNC radio network controller
  • Node B Node B
  • BSC base station controller
  • base transceiver station base transceiver station
  • BTS home base station
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • TP one or a group (including multiple antenna panels) antenna panels of a base station in a 5G system, or, it can also be a network node that constitutes a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit ( distributed unit, DU), or the base station in the next-generation communication 6G system, etc.
  • BBU baseband unit
  • DU distributed unit
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the wireless access network device.
  • the access network can provide services to the cell.
  • the terminal device may communicate with the cell through transmission resources (eg, frequency domain resources, or spectrum resources) allocated by the access network device.
  • transmission resources eg, frequency domain resources, or spectrum resources
  • AMF network element mainly responsible for the functions of mobility management and access authentication/authorization for the UE. In addition, it can also be responsible for transferring user policies between UE and PCF.
  • SMF network element It is mainly responsible for the management of the protocol data unit (PDU) session for the UE, the execution of the control policy issued by the PCF, the selection of the UPF, and the PDU type (PDU Type) is the Internet Protocol (Internet Protocol, IP ) type, UE IP address allocation and other functions.
  • PDU protocol data unit
  • IP Internet Protocol
  • UPF network element As the interface with the data network, UPF can be used to complete functions such as user plane data forwarding, session/flow-level charging statistics, and bandwidth limitation.
  • PCF network element It is mainly responsible for policy control functions such as charging for sessions and service flow levels, QoS bandwidth guarantee and mobility management, and UE policy decision-making.
  • AF network element It mainly conveys the requirements of the application side to the network side, such as QoS requirements or user status event subscription.
  • the AF network element may be a third-party functional entity, or may be an application service deployed by an operator, such as an IP multimedia service (IP multi-media service, IMS) voice call service.
  • IP multimedia service IP multi-media service, IMS
  • IMS IP multi-media service
  • the application function entity of the third-party application it can also perform authorization processing through the NEF when interacting with the core network.
  • the third-party application function directly sends a request message to the NEF, and the NEF determines whether the AF is allowed to send the request message. If passed, the request message will be forwarded to the corresponding PCF or UDM.
  • UDM network element mainly responsible for the management of contract data, user access authorization and other functions.
  • UDR network element It is mainly responsible for the access function of contract data, policy data, application data and other types of data.
  • Data Network A service network for providing data services to users.
  • Internet Internet
  • third-party service network IMS network
  • IMS network IMS network
  • DNN data network name
  • each network element or function shown in FIG. 1 can be understood as network elements for implementing different functions, for example, can be combined into network slices as required.
  • These network elements may be separate devices, or integrated in the same device to implement different functions, or may be network elements in hardware devices, software functions running on dedicated hardware, or platforms (eg, cloud The virtualization function instantiated on the platform), the present application does not limit the specific form of the above network element.
  • the signaling plane interface between AMF and UE can be used to exchange signaling messages between the core network and UE, such as UE registration and access to the network, UE establishment of PDU sessions, and UE policy configuration on the network side.
  • N2 The interface between the AMF and the RAN, which can be used to transmit radio bearer control information from the core network to the RAN.
  • N3 The interface between (R)AN and UPF, which can be used to transfer UE service data between RAN and UPF.
  • N4 The interface between the SMF and the UPF, which can be used to transmit information between the control plane and the user plane, including controlling the distribution of forwarding rules for the user plane, QoS control rules, traffic statistics rules, etc., and reporting of information on the user plane.
  • N5 The interface between the AF and the PCF, which can be used to issue application service requests and report network events.
  • N6 The interface between UPF and DN, which can be used to transfer UE service data between UPF and DN.
  • N7 The interface between PCF and SMF, which can be used to deliver PDU session granularity and business data flow granularity control policies.
  • N8 The interface between the AMF and the UDM, which can be used by the AMF to obtain the subscription data and authentication data related to access and mobility management from the UDM, and to register the UE's current mobility management related information to the UDM.
  • N9 The interface between UPF and UPF, such as the interface between the visited-policy control function (V-PCF) and the home-policy control function (H-PCF), or the interface between the visited-policy control function (V-PCF) and the home-policy control function (H-PCF).
  • V-PCF visited-policy control function
  • H-PCF home-policy control function
  • H-PCF home-policy control function
  • N10 An interface between the SMF and the UDM, which can be used by the SMF to obtain the subscription data related to session management from the UDM, and the SMF to register the current session related information of the UE with the UDM.
  • N11 The interface between the SMF and the AMF, which can be used to transfer the PDU session tunnel information between the RAN and the UPF, the control message sent to the UE, and the radio resource control information sent to the RAN.
  • N15 The interface between PCF and AMF, which can be used to deliver UE policies and access control related policies.
  • N35 the interface between the UDM and the UDR, which can be used by the UDM to obtain user subscription data information from the UDR.
  • N36 an interface between the PCF and the UDR, which can be used by the PCF to obtain policy-related subscription data and application data-related information from the UDR.
  • the name of the interface between each network element in FIG. 1 is just an example, and the name of the interface in the specific implementation may be other names, which are not specifically limited in this application.
  • the names of the messages (or signaling) transmitted between the above network elements are only an example, and do not constitute any limitation on the functions of the messages themselves.
  • a network (such as a 5G network) provides a data exchange service for the UE and the DN network, which may be called a PDU connection service, for example.
  • the UE obtains the PDU connection service by initiating a PDU session establishment request to the mobile network.
  • the network side provides the PDU connection service by maintaining the PDU session for the UE.
  • FIG. 2 shows a schematic diagram of a PDU connection applicable to this embodiment of the present application.
  • the network involved in the PDU connection may include, for example, network elements: network slice specific authentication and authorization function (NSSAAF), network slice selection function (NSSF) ), authentication server function (AUSF), UDM, AMF, SMF, PCF, AF, UE, (R)AN, UPF, DN.
  • NSSAAF network slice specific authentication and authorization function
  • NSSF network slice selection function
  • AUSF authentication server function
  • the data plane path represents the service data exchange path between the UE and the DN network, and the path is the data service path of the UE in the mobile network.
  • the UE needs to use the PDU connection service provided by the mobile network to establish a DNN-based PDU session, that is, the signaling plane process.
  • the establishment of a PDU session generally includes two processes: the process of the UE registering with the mobile network to access the network, and the process of the UE requesting the network to establish a PDU session. These two processes belong to the signaling plane interaction process between the UE and the mobile network. plane path.
  • the terminal device as a UE as an example, a general process of registering and accessing a network of a terminal device is briefly introduced.
  • the UE sends a registration request to the AMF through the (R)AN, and the AMF obtains the subscription data from the UDM according to the UE identity.
  • the network side After a series of authentication and authorization operations, the network side finally confirms that the UE is allowed to access the network.
  • the AMF responds to the UE registration request and delivers relevant policy information to the UE, and the UE completes the network registration and residency.
  • the AMF on the network side maintains the registration and access information of the UE and performs mobility management on the UE. It should be understood that the above is only an exemplary description, and the embodiment of the present application does not limit the specific process of the UE registering and accessing the network.
  • the UE After the UE completes the registration and access to the network, it can initiate a PDU session establishment request to obtain the PDU connection service of the network.
  • a general PDU session establishment process is briefly introduced.
  • the UE sends a PDU session establishment request to the AMF through the RAN.
  • the AMF Based on the PDU session establishment request of the UE, the AMF selects the SMF to provide session services for the UE, saves the correspondence between the SMF and the PDU session, and sends the PDU session establishment request to the SMF.
  • the SMF selects the corresponding UPF to establish a user plane transmission path for the UE, and assigns an IP address to it. It should be understood that the above is only an exemplary description, and the embodiment of the present application does not limit the specific process for the UE to obtain the PDU connection service of the network.
  • the SMF interacts with the UPF through the N4 interface, and controls the UPF to create, modify, and delete the corresponding UE N4 session (session) (N4 session or packet forwarding control protocol (PFCP) session) to control the processing of data packets by the UPF.
  • the SMF issues various data packet processing rules to the UE N4 session in the UPF to complete the control of the UPF processing data packets.
  • the UPF receives the external data packet, it matches the packet according to the matching rules (such as packet detection rule (PDR)) issued by SMF, and matches the packets according to the forwarding rules (such as forwarding action rule (FAR)) Forward the message.
  • PDR packet detection rule
  • FAR forwarding action rule
  • the PDR can be delivered to the UPF during the PDU session management process by the SMF, and the UPF executes the corresponding data packet matching rules according to the PDR delivered by the SMF, and thus obtains the corresponding FAR to complete the data packet forwarding.
  • a PDR can contain a packet detection information (PDI) parameter, and the PDI parameter contains one or several matching fields, which are used to match the data packets received by the UPF, identify the packets, and complete the data packets and data packets. Association of N4 sessions.
  • the PDI information provided by the SMF to the UPF mainly includes a data packet entry (ie, a source interface) and a series of parameters for matching the entry packet.
  • a series of parameters for matching ingress packets may include, but are not limited to, tunnel endpoints (such as fully qualified tunnel endpoint identifier (F-TEID) (Local F-TEID)), network instance (network instance), UE IP address, service data flow (service data flow, SDF) filter (SDF Filter(s)) or application ID (application ID), etc.
  • F-TEID fully qualified tunnel endpoint identifier
  • SDF service data flow
  • SDF Filter(s) service data flow
  • application ID application ID
  • UPF After receiving a data packet, UPF matches the fields of the data packet header with the parameters defined by the PDI in the PDR, and finds the N4 session to which the packet belongs and the PDR with the highest priority matching relationship with the data packet in the N4 session. rules to complete packet matching. After the PDR matching is completed, the PDR rule contains the corresponding FAR indication, and the UPF will complete the data packet forwarding according to the FAR indication.
  • the FAR mainly instructs UPF to process data packets through the following information: apply action parameters and forwarding, caching, and replication parameters.
  • the application action parameter is mainly used to indicate whether the UPF needs to forward, duplicate, or discard the message, or buffer the downlink message with or without notifying the control plane (such as SMF), or indicate whether the UPF allows the UE to join the IP group. broadcast group.
  • the application action instructs the UPF to forward, buffer or replicate the data packet, the UPF needs to use the forwarding, buffering, and replication parameters.
  • the SMF can issue various data packet processing rules to the UPF through the N4 interface to control the processing of the data packets by the UPF.
  • the PDR is used to match the data packets
  • the FAR is used to indicate the packet forwarding mode.
  • the definition in the protocol for example, you can refer to the standard 3GPP 29.244.
  • the external data packet enters the UPF, and the UPF matches the N4 session information (N4 session/PFCP session) according to the PDR matching conditions, and then matches the PDR with the highest priority in the N4 session, and completes the packet forwarding according to its corresponding FAR.
  • FIG. 3 shows a schematic diagram of data packet forwarding applicable to this embodiment of the present application.
  • the upstream and downstream data enter the UPF interface, and the UPF completes the data packet forwarding process according to the rule matching, as follows.
  • Uplink traffic UE uplink packets reach the N3 interface through the RAN, and obtain the source UE N4 session by matching the data packet source port and tunnel identifier (such as F-TEID). According to the service data flow filter (SDF) ) to perform PDR matching, and the corresponding FAR forwarding rule indicates how to forward the packet.
  • SDF service data flow filter
  • Figure 3 shows that the UE uplink message is forwarded to the DN network side through the N6 interface.
  • Downlink traffic DN downlink packets enter the UPF through the N6 interface, and match the destination UE N4 session and PDR rules by matching the source port, network instance, and destination IP address of the data packet, and the corresponding FAR forwarding rule packets. Indicates how to forward the message.
  • Figure 3 shows that the DN downlink message is forwarded to the UE through the N3 interface.
  • 5G local area network (5G LAN) data plane architecture.
  • a local area network is a computer communication network that connects various computers, external devices, and databases within a local geographic range (such as a school, factory, and agency). It can be connected with a remote local area network, database or processing center through a data communication network or a dedicated data circuit to form a large-scale information processing system.
  • 5G LAN wireless local access network
  • 5G LAN can be used in a wider range of mobile network coverage, that is, regardless of whether the terminal equipment is in the same region, as long as the same 5G LAN is added, LAN-based data exchange and communication can be realized.
  • 5G LAN can be customized on demand, and different 5G LANs are safely isolated from each other.
  • the mobile network builds a virtual mobile private network for terminal devices through 5G LAN services.
  • the terminal device can solve the data exchange problem between the terminal device and the DN by establishing a traditional PDU connection.
  • 5G LAN adds the concept of group, such as 5G LAN group.
  • Terminal devices belonging to the same 5G LAN group can not only complete data exchange with the DN corresponding to the 5G LAN group, but also directly exchange data with other terminal devices in the 5G LAN group through UPF. end devices are isolated from each other.
  • Virtual private network communication can be realized through 5G LAN.
  • Multiple 5G LAN groups can be supported in the mobile network at the same time, terminal devices under the same 5G LAN group can communicate with each other, and terminal devices under different 5G LAN groups can be isolated from each other.
  • FIG. 4 and FIG. 5 show a schematic diagram of a user plane architecture for data interaction of terminal devices in a 5G LAN group applicable to this embodiment of the present application.
  • Figure 4 is a user plane architecture in which multiple UEs under the same 5G LAN group are registered in the same PDU session anchor (PSA) UPF.
  • PSA PDU session anchor
  • the network can select the UPF that accesses the DN as the anchor point (anchor) according to the network policy, such as denoted as PSA.
  • PSA UPF not only completes data exchange with DN for UE1 and UE2, but because UE1 and UE2 belong to the same 5G LAN group, The PSA UPF can also be used as the local switch of the 5G LAN group to complete the data exchange between UE1 and UE2.
  • Figure 5 is a user plane architecture in which multiple UEs under the same 5G LAN group are registered in multiple PSA UPFs. Taking UE1 and UE2 belonging to the same 5G LAN group as an example, under the architecture shown in Figure 5, an N19 interface is added between PSA UPFs. When UE1 and UE2 belonging to the same 5G LAN group exchange data, the Its corresponding PSA UPF completes data transmission through the N19 channel.
  • FIG. 4 and FIG. 5 are only two examples, which are not limited thereto.
  • FIG. 6 and FIG. 7 show schematic diagrams of UPF forwarding in a 5G LAN scenario applicable to this embodiment of the present application.
  • Figure 6 shows the UPF forwarding model in the 5G LAN scenario.
  • the UPF forwarding model in the 5G LAN scenario can include the following features.
  • the 5G virtual network (5G virtual network, 5G VN) internal interface (such as 5G VN Internal) is added inside the UPF, and the group-level N4 session is added on the basis of the PDU session.
  • UPF Increase the N19 interface between them.
  • the packets may be exchanged locally in the UPF and sent to the destination UE in the same UPF, may be sent to the DN network side device through the N6 interface, or may be sent through the N19 interface to other UPFs.
  • FIG 7 shows the UPF forwarding process in the 5G LAN scenario.
  • the matching and forwarding process of data packets in the same group of 5G LAN is as follows.
  • a set of terminal devices that use proprietary communication is recorded as a 5G VN group (5G VN group).
  • multiple UEs belong to the same 5G VN group, and the multiple UEs are all under the same PSA UPF.
  • the UPF uses local switching to complete data exchange between UEs in the group.
  • the specific process is as follows: UPF receives the data message sent from the source UE to the destination UE through the N3 interface, and after the first PDR matching (based on the message general packet radio service (GPRS) user plane tunnel protocol (GPRS tunnelling protocol user plane, GTP-U) packet header completes matching) to obtain the source UE N4 session.
  • the corresponding FAR instructs to forward the message to 5G VN Internal to enter the second PDR matching (complete matching based on the destination IP of the message) to obtain the destination UE N4 session, and the corresponding FAR instructs to forward the message to the destination UE through the N3 port.
  • GPRS general packet radio service
  • GTP-U GPRS tunnelling protocol user plane
  • the UPF receives the data packet sent by UE1 to UE2 through the N3 interface, and obtains the UE1N4 session after the first PDR matching.
  • the corresponding FAR instructs to forward the message to 5G VN Internal to enter the second PDR match to obtain the UE2N4 session, and the corresponding FAR instructs to forward the message to UE2 through the N3 port.
  • two UEs communicating with each other in the same 5G VN group are not under the same PSA UPF.
  • the data interface can be completed through the N19 interface.
  • SMF creates a corresponding group-level N4 session for the 5G LAN group on the involved PSA UPF to enable N9 forwarding and N6 forwarding capabilities.
  • the packet After the packet is forwarded to UPF 5G VN Internal after the first match, it may eventually be matched to the session of group N4 after PDR rule matching (based on the destination IP or the default rule matching all (match-all) conditions, etc.), and the corresponding FAR
  • the instruction message is sent to the DN network side device through N6 or sent to the UPF where the destination UE is located through N19.
  • SMF creates a corresponding group-level N4 session for the 5G LAN group on the involved PSA UPF to enable N9 forwarding and N6 forwarding capabilities.
  • the packet After the packet is forwarded to the UPF 5G VN Internal after the first match, it may eventually be matched to the N4 session for group after the PDR rule matching, and the corresponding FAR indicates that the packet is sent to the UPF where UE4 is located through N19.
  • the network instance in the matching and forwarding rule attribute fields in the N4 session is assigned the unique identifier of the 5G VN group (for example, using the internal group ID). )) to indicate that the packet belongs to the specified 5G VN group.
  • the network instance is correspondingly set to the specified 5G VN group.
  • a PDR whose source interface is set to the 5G VN group
  • its network instance is also set to the specified 5G VN group accordingly.
  • the 5G system supports the management of 5G VN groups through operation administration and maintenance (OAM), and also supports the interaction of AF and NEF to complete 5G VN group management.
  • the management of 5G VN group mainly includes creating, modifying, and deleting 5G VN group.
  • a 5G VN group may include, but is not limited to, one or more of the following: 5G VN group identifier, 5G VN group membership, and 5G VN group data.
  • the identification of 5G VN group includes external group identification (external group ID) and internal group ID.
  • the external group ID can be defined by the AF side to uniquely identify a 5G VN group.
  • the internal group ID can be defined by the UDM network element on the mobile network side, and uniquely identifies a 5G VN group within the network.
  • the mapping relationship between external group ID and internal group ID can be automatically generated by UDM when AF creates a 5G VN group, and the mapping between internal group ID and external group ID is completed.
  • 5G VN group data contains several attribute fields, which are used to define parameters of various aspects of a 5G VN group, such as: PDU session type, data network information (such as DNN), slice information (such as network slice selection assistance information (single network slice selection assistance) information, S-NSSAI)), application descriptor (application descriptor), etc.
  • 5G VN group data can also contain information related to secondary authentication/authorization, such as enabling authentication, authorization, and accounting (AAA) server (server) (such as DN-AAA) IP address assignment, etc.
  • AAA authentication, authorization, and accounting
  • the capability exposure network element NEF has opened a series of interfaces (such as: create, modify, delete, etc.) to complete the management of 5G VN group, 5G VN group members and 5G VN group data.
  • the operator network opens some network capabilities to the application function entity through the NEF, so as to support the application function entity to realize more flexible control of users.
  • the currently supported open capabilities include: allowing AF to subscribe to the network side through NEF for event information such as user location, terminal reachability events, connection status, roaming status, and the number of terminals in the area, and through NEF to the network side through UDM or UDR or PCF Configure and deliver messages such as parameter configuration requests, application routing requests, and service authorization requests.
  • FIG. 8 shows a schematic diagram of AF configuration management 5G VN group.
  • AF calls Nnef_ParameterProvision_Create/Update/Delete opened by NEF to manage the 5G VN group.
  • the Nnef interface is a service interface provided by NEF externally.
  • the AF may send a Nnef interface parameter preparation (Nnef_ParameterProvision_Create) message to the NEF to create a 5G VN group.
  • Nnef_ParameterProvision_Create Nnef interface parameter preparation
  • AF can carry the external group ID to uniquely identify a 5G VN group.
  • the AF may send an Nnef interface parameter preparation update (Nnef_ParameterProvision_Update) message to the NEF to update or modify the 5G VN group.
  • Nnef_ParameterProvision_Update Nnef interface parameter preparation update
  • the information carried by the AF may include the following information: external group ID and 5G VN Group data (ie, 5G VN configuration parameters) (as shown in Table 1), or may include 5G VN group member management parameters ( As shown in table 2).
  • the AF may send an Nnef interface parameter preparation delete (Nnef_ParameterProvision_Delete) message to the NEF to request the NEF to delete the 5G VN group.
  • Nnef_ParameterProvision_Delete Nnef interface parameter preparation delete
  • Table 1 and Table 2 are only exemplary descriptions for easy understanding, and are not limited thereto.
  • 5G VN group data information and 5G VN group member management parameters you can refer to the definitions in the standard, or when the 5G VN group data information or 5G VN group member management parameters are adjusted in the future, the adjusted 5G VN group data Information and 5G VN group member management parameters are also applicable to the embodiments of this application.
  • the NEF requests the UDM to create, update, store or delete the corresponding subscription data according to the request of the AF.
  • the NEF After the NEF receives the authorized AF request, the NEF requests the UDM to create, update, store or delete the corresponding subscription data through the Nudm_ParameterProvision_Create/Update/Delete interface provided by the UDM.
  • the Nudm interface is a service interface provided by UDM externally.
  • the NEF can directly return a response to the AF through step (6) and inform the reason for the failure.
  • the UDM can initiate a data query through the Uudr_DM_Query interface provided by the UDR to complete the relevant verification and authorization of the corresponding update request of the AF.
  • UDM assigns an internal group ID to the request to uniquely identify the 5G VN group within the mobile network.
  • the UDM can also send the internal group ID to the UDR through the Nudr_DM_Create interface provided by the UDR.
  • the UDM can call the interface provided by the UDR to complete the corresponding information change according to the AF request.
  • the UDM For a network element that has subscribed to the subscription information change notification from the UDM, when the corresponding subscription data is changed, the UDM will notify the responding network element.
  • UDM sends a response to NEF.
  • the UDM responds to the Nudm_ParameterProvision_Create/Update/Delete request sent by the NEF. If there is an error in the process, the reason for the error is returned.
  • NEF sends a response to AF.
  • the NEF responds to the Nnef_ParameterProvision_Create/Update/Delete request sent by the AF. If there is an error in the process, the reason for the error is returned.
  • the virtual local area network intercommunication of communication devices in the mobile network can be realized through the 5G VN group.
  • device interworking security only a whitelist of media access control (MAC) addresses of devices that are allowed to access by customer access equipment (CPE) or UE in the Ethernet (Ethernet) scenario is defined.
  • CPE customer access equipment
  • Ethernet Ethernet
  • the present application provides a method, that is, a security group-based network access control method, such as security group-based network access control in a 5G LAN network.
  • a security group-based network access control method such as security group-based network access control in a 5G LAN network.
  • communication policies or access policies
  • FIG. 9 is a schematic interaction diagram of a method 900 for secure communication provided by an embodiment of the present application.
  • Method 900 may include the following steps.
  • the first communication device and the second communication device are devices in the same VN group, the VN group includes multiple security groups, and the multiple security groups include the first security group and the second security group.
  • multiple security groups are created for the VN group, any two security groups have a communication policy, and the communication policy is used to control the secure communication between the communication devices corresponding to the two security groups.
  • the first security group is the security group corresponding to the first communication device, which can also be understood as the first security group is the security group corresponding to the source address, or the first security group is the security group to which the source address belongs.
  • the second security group is the security group corresponding to the second communication device. It can also be understood that the second security group is the security group corresponding to the destination address, or the second security group is the security group to which the destination address belongs.
  • the address for example, may be a MAC address or an IP address, etc., which is not limited.
  • the communication policy between the security group corresponding to the first communication device and the security group corresponding to the second communication device is determined, or in other words, the security group to which the source address of the service data belongs and the security group to which the destination address belongs is determined.
  • Communication strategy between groups according to the communication strategy to formulate business data forwarding rules, not only can improve the security of communication between devices, but also facilitate management.
  • the communication strategy is mentioned many times, and the communication strategy refers to the communication strategy.
  • the communication policy may represent a policy for communication between two security groups, or may also represent a policy for communication between devices or addresses belonging to two security groups.
  • the communication policy may include, for example, allowing communication (or allowing access) and prohibiting communication (or prohibiting access).
  • allowing communication or allowing access
  • prohibiting communication or prohibiting access
  • a communication policy may also be referred to as a security group policy, or may be referred to as an access policy, or may be referred to as an access authority, or may be referred to as a transmission policy, etc., and the names thereof are not within the scope of protection of the embodiments of the present application. cause limitation.
  • the forwarding rule may indicate the forwarding path of data or packets, or in some cases, the forwarding rule may also indicate the discarding of data or packets.
  • the communication device corresponding to the first security group sends service data to the communication device corresponding to the second security group.
  • the forwarding rule formulated for the service data can be used to indicate the forwarding path of the service data; the first security group and the second security group
  • the forwarding rule formulated for the service data may be used to instruct the service data to be discarded.
  • the first network element is the SMF, that is, the SMF executes the security group policy.
  • the SMF obtains the communication policy between the first security group and the second security group, and formulates forwarding rules for service data according to the communication policy between the first security group and the second security group.
  • the SMF sends the forwarding rule of the service data to the second network element (eg, UPF).
  • the second network element eg, UPF
  • the second network element processes the service data according to the forwarding rule of the service data.
  • the service data forwarding rule formulated by the SMF is used to indicate the forwarding path of the service data, or to forward the service data.
  • the UPF After receiving the forwarding rule of the service data, the UPF sends the service data to the second communication device according to the forwarding rule.
  • the forwarding rule for service data formulated by the SMF is used to instruct to discard the service data.
  • the UPF discards or ignores the service data according to the forwarding rule.
  • the SMF may interact with the UDM or the DN-AAA to obtain the communication policy between the first security group and the second security group.
  • the SMF may also send indication information to the second network element (such as UPF), which is marked as indication information #1 for distinction, and the indication information #1 is used to indicate that the forwarding rule unknown message is reported.
  • the second network element such as the UPF
  • the SMF may also send indication information to the second network element (such as UPF), which is marked as indication information #1 for distinction, and the indication information #1 is used to indicate that the forwarding rule unknown message is reported.
  • the second network element such as the UPF
  • the SMF can send a message of unknown forwarding rule to the SMF, so that the SMF can formulate a forwarding rule for the message.
  • the first network element is the UPF, that is, the UPF executes the security group policy.
  • the UPF obtains the communication policy between the first security group and the second security group, and determines the forwarding rule of the service data according to the communication policy between the first security group and the second security group.
  • the UPF determines the forwarding rule of the service data according to the communication policy between the first security group and the second security group, and processes the service data according to the forwarding rule of the service data.
  • the UPF when the communication policy between the first security group and the second security group is to allow communication, the UPF sends the service data to the second communication device.
  • the UPF discards or ignores the service data.
  • the UPF may locally read the communication policy between the first security group and the second security group, or the UPF may also obtain the communication policy between the first security group and the second security group from the SMF.
  • the first network element may determine whether the first security group and the second security group exist.
  • the first network element determines that the first security group and the second security group exist. In this case, the first network element may formulate a forwarding rule for the service data according to the communication policy between the first security group and the second security group.
  • the first network element determines that the first security group and/or the second security group does not exist.
  • the first network element may formulate a forwarding rule for the service data according to the source address and/or the destination address of the service data. For example, the network segment to which the destination address of the service data belongs is on the DN side, and there is no second security group, then, when the first security group exists, the UPF forwards the service data to the destination address of the service data, or the SMF sends the service data to the UPF
  • the forwarding rule for sending the service data the forwarding rule for the service data is used to indicate the forwarding of the service data; or, when the first security group does not exist, the UPF discards the service data, or, the SMF sends the service data to the UPF
  • the forwarding rule for data The forwarding rule of service data is used to instruct to discard service data. Specifically, the following description will be made with reference to different situations in the embodiments shown in FIG. 15 to FIG. 16 .
  • the security group can be updated in time, so that not only the resource utilization rate can be improved, but also the data transmission performance can be guaranteed.
  • the conditions for triggering the update of the security group can be set according to the actual communication situation, which is not limited.
  • a possible triggering condition is the release of the terminal device session.
  • the session release of the terminal device may trigger the SMF to send an instruction to the UPF, instructing to delete all forwarding rules corresponding to the terminal device.
  • the session release of the terminal device may trigger the SMF to send an instruction to the UPF, instructing to delete the security group information corresponding to the terminal device.
  • Another possible trigger condition is the aging of addresses learned by the UPF.
  • the aging of the address learned by UPF can trigger UPF to delete all forwarding rules corresponding to the address.
  • the aging of the address learned by the UPF can trigger the UPF to delete the security group information to which the address belongs.
  • SMF actively deletes.
  • the SMF may periodically send an instruction to the UPF, instructing to delete all forwarding rules of the specified address, or instruct to delete the security group information to which the specified address belongs.
  • FIG. 10 is a schematic interaction diagram of a method 1000 for secure communication provided by an embodiment of the present application.
  • Method 1000 may include the following steps.
  • the third network element receives a first request message from the fourth network element, where the first request message is used to request to create a security group for the VN group.
  • the third network element creates multiple security groups for the VN group based on the first request message.
  • the VN group includes multiple security groups, each security group corresponds to one or more communication devices, the multiple security groups include a first security group, and the first security group and other security groups in the multiple security groups have A communication policy, where the communication policy is used to control the communication between the communication device corresponding to the first security group and the communication device corresponding to other security groups.
  • the second security group among the multiple security groups Take the second security group among the multiple security groups as an example. There is a communication policy between the first security group and the second security group, and the communication policy is used to control the secure communication between the communication device corresponding to the first security group and the communication device corresponding to the second security group.
  • multiple security groups are defined in the VN group, and communication policies between the security groups are configured respectively.
  • Implement access control for communication devices at group granularity In this way, not only the security of communication between devices can be improved, but also management can be facilitated.
  • the third network element may be, for example, NEF, and the fourth network element may be, for example, AF.
  • the third network element may also send a request to the fifth network element to request to update the VN group subscription data.
  • the fifth network element is the UDM/UDR, and the third network element sends a request to the UDM/UDR to request to update the VN group subscription data.
  • the first request message is used to request the creation of a security group.
  • the first request message may include information related to the security group to be created.
  • the first request message may also include one or more of the following information: the external identifier of the VN group to which the security group to be created belongs, the data network corresponding to the security group to be created, the security group to be created , the name of the security group to be created, and the communication policy between the security groups to be created.
  • Example 1 the first request message includes: the external identifier of the VN group to which the security group to be created belongs.
  • the third network element may determine that a security group needs to be created for the VN group according to the external identifier of the VN group to which the security group to be created belongs, or to determine the VN group to which the created security group belongs.
  • the specific information on how to obtain the security group is not limited.
  • the number of security groups, the name of the security group, etc. may be determined according to default rules. For example, by default, P security groups are created in a VN group (P is an integer greater than 1), and the P security groups can be numbered sequentially, such as security group 1, security group 2, security group 3, and so on.
  • the communication policy between security groups may be default.
  • communication between different security groups may be pre-agreed or not allowed by default, and communication between the same security group may be allowed.
  • the first request message may include specific information of the security group to be created.
  • the data network corresponding to the security group to be created the identifier of the security group to be created, the name of the security group to be created, and the communication policy between the security groups to be created.
  • Example 2 the first request message includes: the data network corresponding to the security group to be created.
  • the third network element may determine the home data network to which the security group to be created belongs according to the data network corresponding to the security group to be created.
  • Example 1 For the specific information about obtaining the security group, you can refer to the description in Example 1.
  • the information about the VN group may be searched through information on the data network, or may be pre-agreed, such as pre-agreed to create a security group for one or some specific VN groups.
  • the information of the VN group may also be carried in the first request message.
  • Example 3 the first request message includes: the identifier or name of the security group to be created.
  • the third network element may determine which security groups to create according to the identifier or name of the security group to be created.
  • Example 1 For obtaining other information about a security group, such as a communication policy between security groups, reference may be made to the description in Example 1.
  • the first request message includes: a communication policy between the security groups to be created.
  • the third network element may determine which security groups to create and the communication policy between the security groups according to the communication policy between the security groups to be created.
  • the third network element may also receive a second request message from the fourth network element, where the second request message is used to request to add one or more communication devices to the security group.
  • the second request message is used to request to add device members to the security group.
  • the second request message may include information related to the security group of the device to be added.
  • the second request message includes one or more of the following information: the data network corresponding to the security group of the device to be added, the external identifier of the VN group to which the security group of the device to be added belongs, the security of the device to be added The identifier of the group, the name of the security group of the device to be added, and the information of the communication device to be added.
  • the second request message includes: the external identifier of the VN group to which the security group of the device to be added belongs.
  • the third network element may determine, according to the external identifier of the VN group to which the security group of the device to be added belongs, a device member (that is, a communication device) needs to be added to the security group in the VN group, or to add The VN group to which the security group of the device member belongs.
  • the number of communication devices to be added, etc. may be determined according to default rules.
  • L communication devices are added to each security group (L is an integer greater than 1 or equal to 1).
  • the second request message may include relevant information of the communication device to be added.
  • Example 2 the second request message includes: the identifier or name of the security group of the device to be added.
  • the third network element can determine in which security groups the communication device is to be added according to the identifier or name of the security group to be created.
  • Example 1 For obtaining the specific information of the communication device to be added, reference may be made to the description in Example 1.
  • Example 3 the second request message includes: information of the communication device to be added.
  • the third network element may determine which communication devices to add according to the communication devices to be added.
  • communication devices can be added to certain security groups by default.
  • the communication device in the second request message is added to the security group with the smallest security group identifier.
  • the same number of communication devices are added to multiple security groups in sequence according to the security group identification sequence, and so on.
  • the second request message may include relevant information of the communication device to be added.
  • the communication policy is recorded as a security group policy, and the security group policy includes access permission and access prohibition.
  • the VN group (VN group) in the following can be a VN group used in 5G, for example, the VN group in the following can be replaced by a 5G VN group.
  • FIG. 11 is a schematic flowchart of secure communication applicable to the embodiment of the present application.
  • the method 1100 is mainly illustrated by taking the interaction among AF, NEF, UDM or UDR as an example.
  • the third network element may be, for example, NEF
  • the fourth network element may be, for example, AF.
  • the method 1100 shown in FIG. 11 can be used for the process of creating a security group.
  • the method 1100 shown in Figure 11 may include the following steps.
  • the AF requests the NEF to create a security group.
  • the AF can call the NEF interface and configure the VN group security group on the network side through the capability open interface provided by the NEF. For example, the AF can provide security group information to the mobile operator network through the NEF in order to create a VN group security group.
  • the AF may provide one or more of the following information to the NEF in order to create a security group: DNN, external group ID, security group list, security group policy list.
  • Table 3 lists the pieces of information exemplarily.
  • each entry in the security group list may include parameters as shown in Table 4, that is, the security group list may include but not limited to: a security group identifier (the unique identifier of a security group in the VN group) and/or a security group name.
  • Each entry in the security group policy list may include parameters as shown in Table 5, that is, the security group policy list may include, but is not limited to: security group identification, and/or, access rights between security groups (indicating two security Whether mutual visits are available between groups).
  • first security group and the second security group in Table 5 are only names for distinguishing different security groups, and their names do not limit the protection scope of the embodiments of the present application. It should also be understood that, in Table 5, two security groups are used as an example for illustrative description, and the number of security groups is not limited in this embodiment of the present application. It should also be understood that the security group is indicated by the security group identifier in Table 5, which is not limited. For example, the security group may be indicated by the security group name.
  • Security Group Policy List description first security group ID First security group ID second security group ID Second security group ID permission Permissions, allow access or deny access
  • the NEF requests the UDM/UDR to add security group information.
  • the NEF can send a request to the UDM/UDR to save the security group information configuration in the VN group subscription data.
  • the UDM/UDR can modify the VN group subscription data and add security group information to the VN group.
  • the AF can configure the security group of the VN group on the network side through the capability opening interface provided by the NEF.
  • FIG. 12 is another schematic flowchart of the secure communication applicable to the embodiment of the present application.
  • the method 1200 is mainly illustrated by taking the interaction among AF, NEF, UDM or UDR as an example.
  • the third network element may be, for example, NEF
  • the fourth network element may be, for example, AF.
  • the method 1200 shown in FIG. 12 can be used in the process of adding device members to a security group.
  • the method 1200 shown in FIG. 12 may include the following steps.
  • the AF requests the NEF to add device members to the security group.
  • the AF can call the NEF interface to add device members to the specified security group.
  • the AF provides security group membership information to the mobile operator network through the NEF in order to add device members to a specified security group.
  • the AF may provide one or more of the following information to the NEF in order to add device members: DNN, external group ID, security group ID, device member list.
  • Table 6 lists the pieces of information exemplarily.
  • each entry in the device member list may include the parameters shown in Table 7, that is, the device member list may include but not limited to one or more of the following: GPSI, MAC address (MAC address), IP address (IP address) ). Generally, one of MAC address and IP address can be selected.
  • Device Member List description GPSI Indicates the terminal device to which the device member belongs MAC address
  • MAC address Indicates the MAC address of the device member
  • IP address Indicates the IP address of the device member
  • Table 7 is only an exemplary description, which is not limited, and any deformation belonging to Table 7 falls within the protection scope of the embodiments of the present application.
  • any method that can indicate the terminal device to which a device member belongs is applicable to this embodiment of the present application.
  • the NEF requests the UDM/UDR to add a member list to the security group.
  • the NEF After receiving the security group member information from the AF, the NEF can send a request to the UDM/UDR to save the configuration of the security group device member information into the VN group subscription data. After the UDM/UDR receives the security group member information, it can modify the VN group subscription data and add the member list.
  • the following takes the MAC address as an example to list a specific application.
  • security groups, security group policies, and member information in the security groups are defined through security group management and member management.
  • MAC1 and MAC4 belong to security group 1, MAC2 belongs to security group 2, and MAC3 belongs to security group 3; communication between security group 1 and security group 2 is allowed, communication between security group 1 and security group 3 is prohibited, and security group 2 and Security group 3 allows communication, and members in the same security group allow communication by default.
  • MAC1 sends a communication message to MAC2 communication is allowed, when MAC1 sends a message to MAC3, communication is prohibited, and when MAC1 sends a message to MAC4, communication is allowed.
  • the members of the security group manage and define the security group to which the MAC/IP of the communication device under the VN group belongs.
  • the security group belonging information of the communication device can be stored on the DN-AAA, or can be configured to the network side by invoking the NEF through the AF.
  • the security group membership information of the communication device is stored on the DN-AAA
  • the management of security group members can be maintained by the DN side.
  • the communication device initiates communication, the network side interacts with the DN-AAA to obtain the security group information to which the device belongs, and completes the device. communication permission control.
  • FIG. 13 is a schematic flowchart of a security group policy execution applicable to an embodiment of the present application.
  • the method 1300 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, DN-AAA, UPF, and DN as an example.
  • the first network element is, for example, SMF
  • the second network element is, for example, UPF.
  • the method 1300 shown in FIG. 13 can be used in a scenario where the PDU session type is IP, and the security group policy of the VN group is executed through the SMF, that is, the SMF formulates the forwarding rules based on the security group policy, and completes the control of the communication device message exchange. process.
  • the method 1300 shown in FIG. 13 may include the following steps.
  • the SMF creates a VN group session.
  • the conditions for triggering the SMF to create a VN group session are not limited in this embodiment of the present application.
  • the 5G LAN terminal such as CPE/UE accesses the network and triggers the SMF to create a 5G VN group session.
  • the manner of creating a 5G VN group session is as in steps 1311 to 1313.
  • the SMF requests the UDM for 5G VN group session subscription information.
  • the UDM returns the 5G VN group session subscription information to the SMF.
  • the 5G VN group session subscription information may include the security group information configured for the 5G VN group.
  • the configured security group information may include: a configured security group (such as a security group ID/name, etc.), and a security group policy.
  • SMF completes the 5G VN group session creation, and saves the corresponding security group information in the 5G VN group session, such as the security group list (such as security group ID/name, etc.) and security group policy information.
  • security group list such as security group ID/name, etc.
  • security group policy information such as security group policy information
  • the UE under the VN can establish one or more PDU sessions, and then the UE can access the DN through the PDU session established between the UE and the DN.
  • the UE may exchange service data packets between the UPF and the DN through the PDU session established between the UE and the DN.
  • steps 1310 and 1320 do not have a strict sequence.
  • steps 1310 and 1320 may be performed simultaneously.
  • the UE initiates a PDU session establishment request, and the SMF selects a UPF for the session, that is, the SMF selects a UPF that provides a message forwarding function for the UE.
  • the SMF may first establish a VN group session for the UPF, and after completing the creation of the VN group session, the SMF may continue to create a PDU session for the UE. Or when the UPF has established a VN group session, the SMF creates a PDU session for the UE. Understandably, SMF can create a VN group session per UPF.
  • the UPF receives the service data packet, and performs rule matching on the source address and the destination address.
  • the service data packet received by the UPF may be an uplink data packet sent by a CPE/UE or a device, or may also be a downlink data packet sent by the DN side network, which is not limited.
  • the UPF can determine how to process the service data packet by performing rule matching on the source address and destination address of the service data packet.
  • UPF performs rule matching on the source address and destination address of the service data packet. If the matching fails, step 1330a in FIG. 13(1) is performed; if the matching is successful, step 1330b in FIG. 13(2) is performed, that is, according to The matching forwarding rules forward or discard service data packets.
  • Step 1330b The matching is successful.
  • the source address and destination address of the service data packet are matched by rules. If the match is successful, the service data packet can be forwarded or discarded according to the matched forwarding rules.
  • specific matching and forwarding for example, reference may be made to the content explained in the previous terminology, which will not be repeated here.
  • Step 1330a will be described in detail below with reference to FIG. 13(1).
  • Step 1330a Matching failure case. As shown in FIG. 13(1), when the UPF receives the service data packet and fails to perform rule matching on the source address and destination address of the service data packet, the method 1300 may include steps 1330a1 and 1330a2.
  • the UPF reports the message that the packet forwarding rule is unknown to the SMF.
  • the unknown message of the packet forwarding rule may include, but is not limited to, one or more of the following information: DNN, VN group, source IP address, destination IP address, and security group to which the source IP address belongs.
  • DNN represents the DNN to which the message belongs.
  • VN group indicates the VN group to which the message belongs.
  • the source IP address indicates the source address of the service data packet.
  • the destination IP address indicates the destination address of the service data packet.
  • the unknown forwarding rule message of the packet carries the information of the security group to which the source IP address belongs.
  • the SMF determines the message forwarding rule, that is, the forwarding rule of the service data message, according to the above-mentioned information received, and issues the forwarding rule of the service data message to the UPF.
  • the SMF sends a packet forwarding rule to the UPF.
  • the SMF delivers the forwarding rule of the service data packet to the UPF, and the UPF processes the service data packet according to the forwarding rule. For example, if the packet forwarding rule includes forwarding the service data packet, the UPF forwards the service data packet to the destination address according to the packet forwarding rule. For another example, if the packet forwarding rule includes discarding the service data packet, the UPF discards or ignores the service data packet according to the packet forwarding rule.
  • Steps 1330a1 and 1330a2 will be described in detail below in conjunction with different situations.
  • the unknown message of the packet forwarding rule reported by the UPF includes the destination IP address, and the destination IP address is the IP address of the DN side.
  • SMF interacts with UDM or DN-AAA to obtain the security group information to which the source IP address belongs.
  • the SMF may also obtain information about the security group to which the destination IP address belongs.
  • the SMF can determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs, and determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs. Whether to implement the security group policy, that is, whether to formulate forwarding rules according to the security group policy.
  • the SMF For example, if the SMF obtains information about the security group to which the source IP address belongs and the security group to which the destination IP address belongs, then the SMF performs a security group policy check. For another example, if SMF obtains the information of the security group to which the destination IP address belongs, but cannot obtain the security group to which the source IP address belongs, then SMF lacks the information of the security group to which the source IP address belongs, and does not perform security group execution on the source IP address and the destination IP address. Policy check.
  • SMF obtains the information of the security group to which the source IP address belongs, but cannot obtain the security group to which the destination IP address belongs, then SMF lacks the information of the security group to which the destination IP address belongs, and does not perform the security group execution on the source IP address and the destination IP address. Policy check.
  • the security group information is maintained by the mobile operator network, and the SMF can obtain the security group information to which the source IP address belongs from the UDM. Information about the security group to which the source IP address belongs. For packets whose destination IP address is the DN address, UDM does not have information about the security group to which the destination IP address belongs. Therefore, in this mode, SMF does not enforce security group policies.
  • the security group information is maintained by DN-AAA, and SMF can obtain the security group information to which the source IP address belongs from DN-AAA, that is, if there is a security group to which the source IP address belongs, then SMF and DN-AAA Interaction can obtain the security group information to which the source IP address belongs. Whether the SMF obtains the security group information to which the destination IP address belongs through DN-AAA can be determined by the operator's policy.
  • step 1330a2 is described in conjunction with two scenarios.
  • Scenario 1 SMF performs a security group policy check on the source IP address and destination IP address.
  • SMF performs security group policy check on the source IP address and destination IP address (for example, according to the operator policy, SMF performs security group policy check on the source IP address and Group information, security group information to which the destination IP address belongs, implement security group policies, issue packet forwarding rules to UPF, and allow or prohibit packet sending.
  • the tunnel packet may carry information about the security group to which the source IP address belongs.
  • the security group information to which the source IP address belongs the DN network can apply the security policy. For example, whether to carry the security group information to which the source IP address belongs may be determined by an operation policy.
  • Table 7 is taken as an example for illustration. For example, if the security group to which the source IP address belongs is security group 1, and the security group to which the destination IP address belongs is security group 2, the SMF can issue a packet forwarding rule to the UPF, allowing the service data packet to be sent from the N6 port of the UPF. . As another example, assuming that the security group to which the source IP address belongs is security group 1, and the security group to which the destination IP address belongs is security group 3, the SMF can issue a packet forwarding rule to the UPF to prohibit the service data packet from being sent from the UPF N6 port. issue.
  • SMF does not perform security group policy checks on the source and destination IP addresses.
  • SMF does not perform security group policy checks on source IP addresses and destination IP addresses (for example, according to operator policies, SMF does not perform security group policy checks on source IP addresses and destination IP addresses), then a possible implementation, SMF can also perform security group policy checks according to Whether the source IP address is a valid address, the packet forwarding rule is sent to the UPF, and the packet is allowed or prohibited.
  • the SMF may determine whether the source IP address is a legitimate address according to whether there is security group information of the source IP address.
  • the SMF can determine that the source IP address is a legitimate address. At this time, the SMF can issue a packet forwarding rule to the UPF to allow the packet to be sent, for example, to allow the packet to be sent from the UPF N6 port.
  • the SMF may determine that the source IP address is not a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to prohibit the sending of packets, such as prohibiting the sending of packets from the N6 port of the UPF.
  • the tunnel packet may carry information about the security group to which the source IP address belongs.
  • the security group information to which the source IP address belongs the DN network can apply the security policy. For example, whether to carry the security group information to which the source IP address belongs may be determined by an operation policy.
  • the SMF determines whether the source IP address is a legal address, which is not limited. For example, if the SMF does not perform security group policy checking on the source IP address and destination IP address, it can also issue a packet forwarding rule to the UPF to prohibit the sending of packets.
  • case 1 is illustrated by taking the message of the unknown message forwarding rule reported by the UPF including the destination IP address as an example, and it does not limit that the unknown message of the message forwarding rule can only include the destination IP address.
  • the forwarding rule unknown message may also include other information, which is not limited.
  • the packet forwarding rule unknown message reported by the UPF includes the source IP address, and the source IP address is the DN side IP address.
  • the SMF interacts with the UDM or DN-AAA to obtain the security group information to which the destination IP address belongs.
  • the SMF may also obtain information about the security group to which the source IP address belongs.
  • the SMF can determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs, and determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs. Whether to enforce security group policy. For example, if the SMF obtains information about the security group to which the source IP address belongs and the security group to which the destination IP address belongs, then the SMF performs a security group policy check.
  • SMF For another example, if SMF obtains the information of the security group to which the destination IP address belongs, but cannot obtain the security group to which the source IP address belongs, then SMF lacks the information of the security group to which the source IP address belongs, and does not perform security group execution on the source IP address and the destination IP address. Policy check. For another example, if SMF obtains the information of the security group to which the source IP address belongs, but cannot obtain the security group to which the destination IP address belongs, then SMF lacks the information of the security group to which the destination IP address belongs, and does not perform the security group execution on the source IP address and the destination IP address. Policy check.
  • the security group information is maintained by the mobile operator network, and the SMF can obtain the security group information to which the destination IP address belongs from the UDM.
  • Information about the security group to which the destination IP address belongs For packets whose source IP address is the DN side address, UDM does not have information about the security group to which the source IP address belongs. If the downlink packets on the DN side are configured to carry the security group information to which the source IP address belongs in the operation policy, the packets reported by UPF are forwarded.
  • the rule unknown message may carry information about the security group to which the source IP address belongs.
  • the security group information is maintained by DN-AAA, and SMF can obtain the security group information to which the destination IP address belongs from DN-AAA, that is, if there is a security group to which the destination IP address belongs, then SMF and DN-AAA Interaction can obtain the security group information to which the destination IP address belongs. If SMF is configured in the operation policy to obtain the information of the security group to which the source IP address belongs through DN-AAA, then the SMF can obtain the information of the security group to which the source IP address belongs from DN-AAA. Alternatively, if the unknown message of the packet forwarding rule reported by the UPF carries the information about the security group to which the source IP address belongs.
  • the packets reported by the UPF are forwarded.
  • the rule unknown message carries the information of the security group to which the source IP address belongs, then the SMF can obtain the information of the security group to which the source IP address belongs from the unknown message of the packet forwarding rule.
  • step 1330a2 is described in conjunction with two scenarios.
  • Scenario 1 SMF performs a security group policy check on the source IP address and destination IP address.
  • SMF performs security group policy check on the source IP address and destination IP address (for example, according to the operator policy, SMF performs security group policy check on the source IP address and Group information, security group information to which the destination IP address belongs, implement security group policies, issue packet forwarding rules to UPF, and allow or prohibit packet sending.
  • Table 7 is taken as an example for illustration. For example, assuming that the security group to which the source IP address belongs is security group 2, and the security group to which the destination IP address belongs is security group 3, the SMF can issue a packet forwarding rule to the UPF, allowing the service data packets to be sent from the N6 port of the UPF. issue. For another example, assuming that the security group to which the source IP address belongs is security group 1, and the security group to which the destination IP address belongs is security group 2, the SMF can issue a packet forwarding rule to the UPF to prohibit the service data packet from being sent from the UPF N6. Out of the mouth.
  • SMF does not perform security group policy checks on the source and destination IP addresses.
  • SMF does not perform security group policy checks on source IP addresses and destination IP addresses (for example, according to operator policies, SMF does not perform security group policy checks on source IP addresses and destination IP addresses), then a possible implementation, SMF can also perform security group policy checks according to Whether the destination IP address is a valid address, the packet forwarding rule is sent to the UPF, and the packet is allowed or prohibited.
  • the SMF may determine whether the destination IP address is a legitimate address according to whether there is security group information of the destination IP address.
  • the SMF may determine that the destination IP address is a legitimate address.
  • SMF can issue packet forwarding rules to UPF to allow packets to be sent, such as allowing packets to be sent from UPF N6 port.
  • the SMF may determine that the destination IP address is not a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to prohibit the sending of packets, such as prohibiting the sending of packets from the N6 port of the UPF.
  • the SMF determines whether the destination IP address is a legal address is only a possible implementation manner, which is not limited. For example, if the SMF does not perform security group policy checking on the source IP address and destination IP address, it can also issue a packet forwarding rule to the UPF to prohibit the sending of packets.
  • the source IP address is included in the unknown message of the message forwarding rule reported by the UPF as an example to illustrate, which does not limit the unknown message of the message forwarding rule to only include the source IP address.
  • the forwarding rule unknown message may also include other information, which is not limited.
  • the unknown message of the packet forwarding rule reported by the UPF includes the source IP address and the destination IP address, and the source IP address and the destination IP address are both network side device addresses.
  • the SMF interacts with the UDM or the DN-AAA to obtain the security group information to which the source IP address belongs and the security group information to which the destination IP address belongs.
  • the SMF can determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs, and determine whether there is information about the security group to which the source IP address belongs and information about the security group to which the destination IP address belongs. Packet forwarding rules.
  • the security group member information is maintained by the mobile operator network, and the SMF interacts with the UDM to obtain the security group information to which the source IP address belongs and the security group information to which the destination IP address belongs.
  • the security group member information is maintained by the DN-AAA, and the SMF interacts with the DN-AAA to obtain the security group information to which the source IP address belongs and the security group information to which the destination IP address belongs.
  • step 1330a2 is described in conjunction with two scenarios.
  • the SMF sends a packet forwarding rule to the UPF, and discards the packets with the source IP address as the source or destination address.
  • a possible implementation method is that the SMF sends a packet forwarding rule to the UPF, and discards the packets whose source address or destination address is the destination IP address.
  • case 3 is illustrated by taking the source IP address and the destination IP address as an example in the unknown message of the packet forwarding rule reported by the UPF, and it is not limited that the unknown message of the packet forwarding rule can only include the source IP address and the destination IP address. Destination IP address.
  • the unknown message of the packet forwarding rule may also include other information, which is not limited.
  • the source address can be in the form of an IP address, and the source address and source IP address above are sometimes used interchangeably. address or the source address of the packet.
  • the destination address can be in the form of an IP address.
  • the destination address and destination IP address are sometimes used interchangeably above. It should be understood that they have the same meaning and are both used to indicate the destination address of the packet.
  • a possible process when the SMF executes the security group policy is exemplified above with reference to steps 1310-1330 shown in FIG. 13 , such as a scenario in which the PDU session type is IP. It should be understood that the above steps are only exemplary descriptions and are not strictly limited. In addition, the size of the sequence numbers of the above processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the VN group security group policy is implemented through the SMF, that is, the SMF formulates the forwarding rules according to the security group policy, and completes the control of the communication device message exchange, thereby improving the security of communication between devices.
  • FIG. 14 is another schematic flowchart of the execution of the security group policy applicable to an embodiment of the present application.
  • the method 1400 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, DN-AAA, UPF, and DN as an example.
  • the first network element is, for example, SMF
  • the second network element is, for example, UPF.
  • the method 1400 shown in FIG. 14 can be used in a scenario where the PDU session type is Ethernet (Ethernet), and the VN group security group policy is executed through the SMF, that is, the SMF formulates the forwarding rule based on the security group policy, and completes the communication device reporting The flow of document intercommunication control.
  • the method 1400 shown in FIG. 14 may include the following steps.
  • the SMF creates a VN group session.
  • step 1410 for example, reference may be made to the description of the above-mentioned step 1310, which will not be described here.
  • step 1420 for example, reference may be made to the description of the foregoing step 1320, which will not be described here.
  • UPF may receive packets from different interfaces, and the types of received packets may be different. The following description will be combined with different situations.
  • the UPF N3 interface receives an upstream packet, and the source MAC address of the upstream packet is unknown.
  • the UPF receives an uplink packet from the UE from the N3 interface, and the source MAC address of the uplink packet is unknown.
  • the method 1400 may also include steps 1431 and 1432.
  • the UPF reports a MAC address learning message to the SMF.
  • the MAC address learning message may include one or more of the following parameters: DNN, VN group, UE SUPI, source MAC address, and N3 interface.
  • the DNN represents the DNN to which the MAC address belongs.
  • VN group indicating the VN group to which the MAC address belongs.
  • UE SUPI indicating the CPE/UE to which the MAC address belongs.
  • N3 interface indicating MAC address learning, address source interface.
  • the SMF After receiving the N3 interface MAC address learning message reported by the UPF, the SMF can associate the MAC address with the corresponding UE session and the corresponding UPF.
  • the SMF associates the MAC address with the corresponding UE session and the corresponding UPF.
  • the device corresponding to the MAC address may have changed (such as moving to another UPF, or moving to another UPF). to other CPE/UE, etc.). In this case, it is possible to trigger the SMF to actively age the forwarding rule of the MAC address in the UPF, and refresh the learning of the MAC address in the SMF.
  • the UPF N6 interface receives a downlink packet, and the source MAC address of the downlink packet is unknown.
  • the method 1400 may also include steps 1441 and 1442.
  • the UPF reports a MAC address learning message to the SMF.
  • the MAC address learning message may include one or more of the following parameters: DNN, VN group, source MAC address, and N6 interface.
  • the DNN represents the DNN to which the MAC address belongs.
  • VN group indicating the VN group to which the MAC address belongs.
  • N6 interface indicating MAC address learning, address source interface.
  • the SMF After receiving the MAC address learning message of the N6 interface reported by the UPF, the SMF can associate the MAC address with the corresponding DNN and VN group sessions.
  • the SMF associates the MAC address with the corresponding DNN and VN group session.
  • the device corresponding to the MAC address may have changed (such as moving from the network side to the DN network side).
  • the UPF receives the service data packet and performs rule matching on the source address and destination address.
  • the service data packet received by the UPF may be an uplink data packet sent by a CPE/UE or a device, or may also be a downlink data packet sent by the DN side network, which is not limited.
  • the UPF can determine how to process the service data packet by performing rule matching on the source address and destination address of the service data packet.
  • UPF performs rule matching on the source address and destination address of the service data packet. If the matching fails, step 1450a in FIG. 14(1) is performed; if the matching is successful, step 1450b in FIG. 14(2) is performed, that is, according to The matching forwarding rules forward or discard service data packets.
  • Step 1450b The matching is successful.
  • the source address and destination address of the service data packet are matched by rules. If the match is successful, the service data packet can be forwarded or discarded according to the matched forwarding rules.
  • specific matching and forwarding for example, reference may be made to the content explained in the previous terminology, which will not be repeated here.
  • Step 1450a will be described in detail below with reference to FIG. 14(1).
  • Step 1450a Match failure case. As shown in FIG. 14(1), when the UPF receives the service data message and fails to perform rule matching on the source address and destination address of the service data message, the method 1400 may include steps 1450a1 and 1450a2.
  • the UPF reports the message that the packet forwarding rule is unknown to the SMF.
  • the unknown message of the packet forwarding rule may include, but is not limited to, one or more of the following information: DNN, VN group, source MAC address, destination MAC address, and security group information to which the source MAC belongs.
  • DNN represents the DNN to which the message belongs.
  • VN group indicates the VN group to which the message belongs.
  • the source MAC address indicates the source address of the service data packet.
  • the destination MAC address indicates the destination address of the service data packet.
  • the SMF determines the message forwarding rule, that is, the forwarding rule of the service data message, according to the above-mentioned information received, and issues the forwarding rule of the service data message to the UPF.
  • the SMF sends a packet forwarding rule to the UPF.
  • the SMF delivers the forwarding rule of the service data packet to the UPF, and the UPF processes the service data packet according to the forwarding rule. For example, if the packet forwarding rule includes forwarding the service data packet, the UPF forwards the service data packet to the destination address according to the packet forwarding rule. For another example, if the packet forwarding rule includes discarding the service data packet, the UPF discards or ignores the service data packet according to the packet forwarding rule.
  • Steps 1450a1 and 1450a2 will be described in detail below in conjunction with different situations.
  • the unknown message of the packet forwarding rule reported by the UPF includes a destination MAC address, and the destination MAC address is a multicast or broadcast address.
  • the SMF can obtain information about the security group to which the source MAC address belongs.
  • the source MAC address is the address on the network side of the mobile operator
  • the SMF interacts with the UDM or DN-AAA to obtain the security group information to which the source MAC address belongs.
  • the security group member information is maintained by the mobile operator network
  • the SMF interacts with the UDM to obtain the security group information to which the source MAC address belongs.
  • the security group member information is maintained by the DN-AAA
  • the SMF interacts with the DN-AAA to obtain the security group information to which the source MAC address belongs.
  • the source MAC address is the DN side address
  • the security group information is maintained by the mobile operator network
  • the UDM lacks the security group information to which the source MAC address belongs.
  • the operator configures the DN downlink data packet tunnel packet to carry the security group information to which the source MAC address belongs
  • the unknown message of the packet forwarding rules reported by the UPF may carry the security group information to which the source MAC address belongs.
  • SMF checks the source MAC address. The validity of the MAC address, otherwise SMF does not check the validity of the source MAC address.
  • the source MAC address is the DN side address
  • the security group information is maintained by DN-AAA
  • SMF and DNAAA interact to obtain the security group information to which the source MAC address belongs, and determine the validity of the MAC address.
  • the SMF can check the validity of the source MAC address according to step 1450a1, and issue the packet forwarding rules to the UPF according to the multicast and broadcast forwarding policies configured in the operation to allow or prohibit the sending of packets.
  • case 1 is illustrated by taking the example that the unknown message of the message forwarding rule reported by the UPF includes the destination MAC address as an example, and it is not limited that the unknown message of the message forwarding rule can only include the destination MAC address.
  • the rule-unknown message may also include other information, which is not limited.
  • step 1450a1 the unknown message of the packet forwarding rule reported by the UPF includes the destination MAC address, and the destination MAC address is the DN side address.
  • the SMF interacts with the UDM or DN-AAA to obtain the security group information to which the source MAC address belongs.
  • the SMF may also acquire information about the security group to which the destination MAC address belongs.
  • the SMF may determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs, and determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs.
  • Whether to implement the security group policy that is, whether to formulate forwarding rules according to the security group policy. For example, if the SMF obtains information about the security group to which the source MAC address belongs and the security group to which the destination MAC address belongs, then the SMF performs a security group policy check.
  • the SMF For another example, if the SMF obtains the security group information to which the destination MAC address belongs, but cannot obtain the security group to which the source MAC address belongs, then the SMF lacks the information of the security group to which the source MAC address belongs, and does not perform the security group execution on the source MAC address and the destination MAC address. Policy check. For another example, if the SMF obtains the security group information to which the source MAC address belongs, but cannot obtain the security group to which the destination MAC address belongs, then the SMF lacks the information of the security group to which the destination MAC address belongs, and does not perform the security group execution on the source MAC address and the destination MAC address. Policy check.
  • the security group information is maintained by the mobile operator network, and the SMF can obtain the security group information to which the source MAC address belongs from the UDM. Information about the security group to which the source MAC address belongs. For packets whose destination MAC address is the DN side address, UDM does not have information about the security group to which the destination MAC address belongs. Therefore, in this mode, SMF does not enforce security group policies.
  • the security group information is maintained by DN-AAA, and SMF can obtain the security group information to which the source MAC address belongs from DN-AAA, that is, if there is a security group to which the source MAC address belongs, then SMF and DN-AAA Interaction can obtain the security group information to which the source MAC address belongs. Whether the SMF obtains the security group information to which the destination MAC address belongs through DN-AAA can be determined by the operator's policy.
  • step 1450a2 is described in conjunction with two scenarios.
  • Scenario 1 SMF performs a security group policy check on the source MAC address and destination MAC address.
  • SMF performs security group policy check on the source MAC address and destination MAC address (for example, according to the operator policy, SMF performs security group policy check on the source MAC address and Group information, security group information to which the destination MAC address belongs, implement security group policies, issue packet forwarding rules to UPF, and allow or prohibit packet sending.
  • the tunnel packet may carry information about the security group to which the source MAC address belongs.
  • the DN network can apply the security policy. For example, whether to carry the security group information to which the source MAC address belongs may be determined by an operation policy.
  • Table 7 is taken as an example for illustration. For example, assuming that the source MAC address is MAC1, the security group to which MAC1 belongs is security group 1, the destination MAC address is MAC2, and the security group to which MAC2 belongs is security group 2, then SMF can issue a packet forwarding rule to UPF to allow The service data message is sent from the N6 port of the UPF. As another example, assuming that the source MAC address is MAC1, the security group to which MAC1 belongs is security group 1, the destination MAC address is MAC3, and the security group to which MAC3 belongs is security group 3, then SMF can issue packet forwarding rules to UPF, It is forbidden to send this service data message from the N6 port of the UPF.
  • Scenario 2 SMF does not perform security group policy checks on the source and destination MAC addresses.
  • SMF does not perform security group policy checking on the source MAC address and destination MAC address (for example, according to the operator's policy, SMF does not perform security group policy checking on the source MAC address and destination MAC address), then a possible implementation, SMF can also perform security group policy checking according to Check whether the source MAC address is a valid address, and issue a packet forwarding rule to the UPF to allow or prohibit the sending of packets.
  • the SMF may determine whether the source MAC address is a legitimate address according to whether the security group information of the source MAC address exists.
  • the SMF can determine that the source MAC address is a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to allow the packet to be sent, for example, to allow the packet to be sent from the UPF N6 port.
  • the SMF may determine that the source MAC address is not a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to prohibit the sending of packets, such as prohibiting the sending of packets from the N6 port of the UPF.
  • the tunnel packet may carry information about the security group to which the source MAC address belongs.
  • the DN network can apply the security policy. For example, whether to carry the security group information to which the source MAC address belongs may be determined by an operation policy.
  • the SMF judging whether the source MAC address is a legal address is only a possible implementation manner, which is not limited. For example, if the SMF does not perform security group policy checking on the source MAC address and destination MAC address, it can also issue a packet forwarding rule to the UPF to prohibit packet sending.
  • case 2 is illustrated by taking the message of the unknown message forwarding rule reported by the UPF including the destination MAC address as an example, and it does not limit that the unknown message of the message forwarding rule can only include the destination MAC address.
  • the forwarding rule unknown message may also include other information, which is not limited.
  • step 1450a1 the packet forwarding rule unknown message reported by the UPF includes the source MAC address, and the source MAC address is the DN side address.
  • the SMF interacts with the UDM or DN-AAA to obtain the security group information to which the destination MAC address belongs.
  • the SMF may also obtain information about the security group to which the source MAC address belongs.
  • the SMF may determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs, and determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs. Whether to enforce security group policy. For example, if the SMF obtains information about the security group to which the source MAC address belongs and the security group to which the destination MAC address belongs, then the SMF performs a security group policy check.
  • the SMF For another example, if the SMF obtains the security group information to which the destination MAC address belongs, but cannot obtain the security group to which the source MAC address belongs, then the SMF lacks the information of the security group to which the source MAC address belongs, and does not perform the security group execution on the source MAC address and the destination MAC address.
  • Another example is the policy check. If the SMF obtains the security group information to which the source MAC address belongs, but cannot obtain the security group to which the destination MAC address belongs, then the SMF lacks the information of the security group to which the destination MAC address belongs, and does not perform the execution on the source MAC address and the destination MAC address.
  • the security group information is maintained by the mobile operator network, and the SMF can obtain the security group information to which the destination MAC address belongs from the UDM.
  • Information about the security group to which the destination MAC address belongs For packets whose source MAC address is the DN side address, UDM does not have information about the security group to which the source MAC address belongs. If the downlink packets on the DN side are configured to carry the security group information to which the source MAC address belongs in the operation policy, the packets reported by UPF are forwarded.
  • the rule unknown message may carry information about the security group to which the source MAC address belongs.
  • the security group information is maintained by DN-AAA, and SMF can obtain the security group information to which the destination MAC address belongs from DN-AAA, that is, if there is a security group to which the destination MAC address belongs, then SMF and DN-AAA Interaction can obtain the security group information to which the destination MAC address belongs.
  • SMF is configured in the operation policy to obtain the information of the security group to which the source MAC address belongs through DN-AAA
  • the SMF can obtain the information of the security group to which the source MAC address belongs from DN-AAA.
  • the unknown message of the packet forwarding rule reported by the UPF carries the information about the security group to which the source MAC address belongs.
  • the rule unknown message carries the information of the security group to which the source MAC address belongs, then the SMF can obtain the information of the security group to which the source MAC address belongs from the unknown message of the packet forwarding rule.
  • step 1450a2 is described in conjunction with two scenarios.
  • Scenario 1 SMF performs a security group policy check on the source MAC address and destination MAC address.
  • SMF performs security group policy check on the source MAC address and destination MAC address (for example, according to the operator policy, SMF performs security group policy check on the source MAC address and Group information, security group information to which the destination MAC address belongs, implement security group policies, issue packet forwarding rules to UPF, and allow or prohibit packet sending.
  • Table 7 is taken as an example for illustration. For example, assuming that the source MAC address is MAC2, the security group to which MAC2 belongs is security group 2, the destination MAC address is MAC3, and the security group to which MAC3 belongs is security group 3, then SMF can issue a packet forwarding rule to UPF to allow The service data message is sent from the N6 port of the UPF. As another example, assuming that the source MAC address is MAC1, the security group to which MAC1 belongs is security group 1, the destination MAC address is MAC2, and the security group to which MAC2 belongs is security group 2, then SMF can issue packet forwarding rules to UPF, It is forbidden to send this service data message from the N6 port of the UPF.
  • Scenario 2 SMF does not perform security group policy checks on the source and destination MAC addresses.
  • SMF does not perform security group policy checking on the source MAC address and destination MAC address (for example, according to the operator's policy, SMF does not perform security group policy checking on the source MAC address and destination MAC address), then a possible implementation, SMF can also perform security group policy checking according to Whether the destination MAC address is a valid address, the packet forwarding rule is sent to the UPF, and the packet is allowed or prohibited.
  • the SMF may determine whether the destination MAC address is a legal address according to whether there is security group information of the destination MAC address.
  • the SMF may determine that the destination MAC address is a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to allow the packet to be sent, for example, to allow the packet to be sent from the UPF N6 port.
  • the SMF may determine that the destination MAC address is not a legal address. At this time, the SMF can issue a packet forwarding rule to the UPF to prohibit the sending of packets, such as prohibiting the sending of packets from the N6 port of the UPF.
  • the SMF determines whether the destination MAC address is a legal address, which is not limited. For example, if the SMF does not perform security group policy checking on the source MAC address and destination MAC address, it can also issue a packet forwarding rule to the UPF to prohibit packet sending.
  • case 3 is exemplified by the fact that the source MAC address is included in the unknown message of the message forwarding rule reported by the UPF as an example, and it is not limited that the unknown message of the message forwarding rule can only include the source MAC address.
  • the forwarding rule unknown message may also include other information, which is not limited.
  • the unknown message of the packet forwarding rule reported by the UPF includes the source MAC address and the destination MAC address, the destination MAC address is a unicast address, and the source MAC address and the destination MAC address are the network side device addresses.
  • the SMF interacts with the UDM or the DN-AAA to obtain the security group information to which the source MAC address belongs and the security group information to which the destination MAC address belongs.
  • the SMF may determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs, and determine whether there is information about the security group to which the source MAC address belongs and information about the security group to which the destination MAC address belongs. Packet forwarding rules.
  • the security group member information is maintained by the mobile operator network, and the SMF interacts with the UDM to obtain the security group information to which the source MAC address belongs and the security group information to which the destination MAC address belongs.
  • the security group member information is maintained by the DN-AAA, and the SMF interacts with the DN-AAA to obtain the security group information to which the source MAC address belongs and the security group information to which the destination MAC address belongs.
  • step 1450a2 is described in conjunction with two scenarios.
  • Scenario 1 the source MAC address has no associated security group information.
  • the SMF sends a packet forwarding rule to the UPF, and discards the packets with the source MAC address as the source or destination address.
  • the destination MAC address has no associated security group information.
  • a possible implementation method is that the SMF sends a packet forwarding rule to the UPF, and discards the packets with the destination MAC address as the source address or destination address.
  • Case 4 is illustrated by taking the source MAC address and the destination MAC address as an example in the unknown message of the packet forwarding rule reported by the UPF, which does not limit that the unknown message of the packet forwarding rule can only include the source MAC address and the destination MAC address. Destination MAC address.
  • the unknown message of the packet forwarding rule may also include other information, which is not limited.
  • the source address can be in the form of a MAC address.
  • the source address and source MAC address above are sometimes used interchangeably. It should be understood that they have the same meaning and are used to indicate sending a message. address or the source address of the packet.
  • the destination address can be in the form of a MAC address.
  • the destination address and destination MAC address are sometimes used interchangeably above. It should be understood that they have the same meaning and are used to indicate the destination address of the message.
  • a possible process when the SMF executes the security group policy is exemplified above with reference to steps 1410-1450 shown in FIG. 14 , such as a scenario where the PDU session type is Ethernet.
  • the above steps are only exemplary descriptions and are not strictly limited.
  • the size of the sequence numbers of the above processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the above steps 1431 and 1432 may exist concurrently with step 1450, or may exist independently.
  • the VN group security group policy is implemented through SMF, that is, the SMF formulates the forwarding rules according to the security group policy, and completes the communication control of communication devices, thereby improving the security of communication between devices.
  • FIG. 15 is a schematic flowchart of a security group policy execution applicable to another embodiment of the present application.
  • the method 1500 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, DN-AAA, UPF, and DN as an example.
  • the first network element is, for example, UPF
  • the second network element is, for example, SMF.
  • the method 1500 shown in FIG. 15 can be used in a scenario where the PDU session type is IP, and the VN group security group policy is executed by the UPF, that is, the UPF determines the forwarding rule based on the security group policy, and completes the control of the communication device message exchange. process.
  • the method 1500 shown in FIG. 15 may include the following steps.
  • the SMF creates a VN group session.
  • the conditions for triggering the SMF to create a VN group session are not limited in this embodiment of the present application.
  • the 5G LAN terminal such as CPE/UE accesses the network and triggers the SMF to create a 5G VN group session.
  • the manner of creating a 5G VN group session is as in steps 1511 to 1513.
  • the SMF requests the UDM for 5G VN group session subscription information.
  • the UDM returns the 5G VN group session subscription information to the SMF.
  • the 5G VN group session subscription information may include the security group information configured for the 5G VN group.
  • the configured security group information may include: a configured security group (such as a security group ID/name, etc.), and a security group policy.
  • SMF completes the 5G VN group session creation, and saves the corresponding security group information (such as security group (such as security group ID/name, etc.) and security group policy) in the 5G VN group session.
  • security group information such as security group (such as security group ID/name, etc.) and security group policy
  • SMF can deliver 5G VN security group information to UPF, such as security group (such as security group ID/name, etc.) and security group policy.
  • security group such as security group ID/name, etc.
  • security group policy such as security group policy.
  • the SMF interacts with the UDM/DN-AAA to obtain the security group information corresponding to the UE IP address. For example, if the security group information is maintained by the mobile operator network, the SMF can interact with the UDM to obtain the security group information to which the UE IP address belongs. For another example, if the security group information is maintained by the DN-AAA, the SMF can interact with the DN-AAA to obtain the security group information to which the UE IP address belongs.
  • the SMF may deliver information related to the security group to which the UE belongs to all UPFs under the VN group, for example, may include but not limited to one or more of the following information: UE SUPI, UE IP address, security group, UPF ID, UPF N19 IP address.
  • the UE IP address indicates the IP address allocated for the UE.
  • Security group indicating the security group information to which the UE belongs.
  • UPF ID indicating the UPF currently accessed by the UE.
  • UPF N19 IP address indicating the UPF accessed by the UE, its N19 interface address.
  • the UE can exchange service data packets between the UPF and the DN through the PDU session established between the UE and the DN.
  • UPF After UPF receives service data packets, it can process them according to the forwarding rules. The following description will be combined with different situations.
  • both the source address and the destination address of the service data packet received by the UPF are the device addresses on the network side.
  • the method 1500 may also include step 1531.
  • the UPF processes the service data packet according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs.
  • UPF can obtain the information of the security group to which the source address belongs according to the source address, obtain the information of the security group to which the destination address belongs according to the destination address, and obtain the information of the security group to which the source address belongs and the security group to which the destination address belongs according to the source address. between the security group policies, processing business data packets.
  • Table 7 is taken as an example for illustration. For example, assuming that the security group to which the source address belongs is security group 1 and the security group to which the destination address belongs is security group 2, the UPF forwards the service data packet according to the security group policy between security group 1 and security group 2, that is, Forward the service data packet to the destination address. For another example, suppose that the security group to which the source address belongs is security group 1, and the security group to which the destination address belongs is security group 3, then UPF discards or ignores the service datagram according to the security group policy between security group 1 and security group 3. message, that is, the service data message is not forwarded to the destination address.
  • the UPF may directly discard the service data packet. It should be understood that this is not limited. For example, when the security group information to which the source address belongs and the security group information to which the destination address belongs cannot be queried, different processing methods can be adopted according to the actual situation.
  • the destination address of the service data packet received by the UPF belongs to the network segment on the DN side.
  • the method 1500 may also include step 1532.
  • the UPF forwards the packet to the DN network through the N6 interface.
  • the UPF can index the security group information to which the source address belongs according to the source address.
  • the tunnel packets sent by the UPF to the DN side through the N6 interface can carry the security group information to which the source address belongs, so that the DN network can apply security policies. For example, whether the tunnel packet sent by the UPF to the DN side carries the security group information to which the source address belongs may be determined by the operation policy, which is not limited.
  • the source address of the service data packet received by the UPF belongs to the network segment on the DN side.
  • the method 1500 may also include step 1533.
  • the UPF processes the service data packet according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs, or according to the operator's policy.
  • the UPF processes the service data packets according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs. If the downlink tunnel packet carries the security group information corresponding to the source address, the UPF can index the security group information to which the destination address belongs according to the destination address, and calculate the security group between the security group to which the source address belongs and the security group to which the destination address belongs. Policies to process service data packets, such as discarding packets or forwarding packets.
  • the UPF processes the service data packets according to the operator's policy. If the carrier's policy is not to control the security group policy on downlink packets, the UPF can directly forward the packets.
  • the source address can be in the form of an IP address, and the source address and source IP address above are sometimes used interchangeably. address or the source address of the packet.
  • the destination address can be in the form of an IP address.
  • the destination address and destination IP address are sometimes used interchangeably above. It should be understood that they have the same meaning and are used to indicate the destination address of the packet.
  • a possible process when the UPF executes the security group policy is exemplified above in conjunction with steps 1510-1533 shown in FIG. 15 , such as a scenario where the PDU session type is IP. It should be understood that the above steps are only exemplary descriptions and are not strictly limited. In addition, the size of the sequence numbers of the above processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the VN group security group policy is implemented through the UPF, that is, the UPF determines the forwarding rules according to the security group policy, and completes the control of the communication device message exchange, thereby improving the security of communication between devices.
  • the security group policy through the UPF can also save the signaling overhead caused by the UPF asking the SMF for the forwarding rules, and improve the data transmission performance.
  • FIG. 16 is another schematic flowchart of the execution of a security group policy applicable to another embodiment of the present application.
  • the method 1600 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, DN-AAA, UPF, and DN as an example.
  • the first network element is, for example, UPF
  • the second network element is, for example, SMF.
  • the method 1600 shown in FIG. 16 can be used in a scenario where the PDU session type is Ethernet, and the VN group security group policy is executed by the UPF, that is, the UPF determines the forwarding rule based on the security group policy, and completes the control of the communication device message exchange. process.
  • the method 1600 shown in FIG. 16 may include the following steps.
  • SMF creates a 5VN group session.
  • step 1610 for example, reference may be made to the description of the above step 1510, which will not be described here.
  • step 1620 for example, reference may be made to the description of the above-mentioned step 1520, which will not be described here.
  • UPF may receive packets from different interfaces, and the types of received packets may be different. The following description will be combined with different situations.
  • the UPF N3 interface receives an upstream packet, and the source MAC address of the upstream packet is unknown.
  • the UPF receives an uplink packet from the UE from the N3 interface, and the source MAC address of the uplink packet is unknown.
  • the method 1600 may also include steps 1631-1633.
  • the UPF reports the MAC address unknown message to the SMF.
  • the MAC address unknown message may include one or more of the following parameters: DNN, VN group, UE SUPI, source MAC address.
  • the DNN represents the DNN to which the MAC address belongs.
  • VN group indicating the VN group to which the MAC address belongs.
  • UE SUPI indicating the CPE/UE to which the MAC address belongs.
  • the SMF obtains information about the security group to which the MAC address belongs.
  • the SMF After the SMF receives the MAC address unknown message from the N3 interface reported by the UPF, the SMF obtains the information about the security group to which the MAC address belongs.
  • the SMF interacts with the UDM to obtain the security group information to which the MAC address belongs.
  • the SMF interacts with the DN-AAA to obtain the security group information to which the MAC address belongs.
  • the SMF After the SMF queries the information about the security group to which the MAC address belongs, it can deliver the information about the security group to which the MAC address belongs to the UPF.
  • the SMF delivers the information of the security group to which the MAC address belongs to the UPF.
  • the SMF may deliver the queried information related to the security group to which the MAC address belongs to all UPFs under the VN group, for example, may include but not limited to one or more of the following information: DNN, VN Group, MAC Address, Security Group ID, UPF ID, N19 address.
  • DNN indicates the DNN to which the MAC address belongs.
  • VN group indicating the VN group to which the MAC address belongs.
  • Security group ID indicating the security group to which the MAC address belongs.
  • UPF ID indicating the UPF to which the current MAC belongs.
  • N19 address indicating the UPF N19 interface address.
  • the destination address of the packet received by the UPF is a broadcast address or a multicast address.
  • the method 1600 may further include step 1641.
  • the UPF processes the packet according to the security group information to which the source address belongs.
  • the UPF obtains the information about the security group to which the source MAC address belongs, and decides to forward or discard the packet according to the policy configured by the operator. If the UPF fails to obtain the security group information to which the source MAC address belongs, for example, the UPF may discard the packet.
  • the method 1600 may further include step 1642.
  • the UPF processes the packet according to the information of the security group to which the source address belongs or the policy of the operator.
  • the UPF checks the validity of the security group information and decides to forward or discard the packet according to the policy configured by the operator. Otherwise, UPF does not check the validity of the source MAC address of downlink packets, and decides to forward or discard packets according to the policy configured by the operator.
  • the source address and destination address of the packet received by the UPF are both network-side device addresses.
  • the method 1600 may also include step 1651.
  • the UPF processes the packet according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs.
  • UPF can find the security group to which the source address belongs and the security group to which the destination address belongs, and process packets, such as forwarding or discarding packets, according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs.
  • the UPF receives a downlink packet, and the destination address is a unicast address and is unknown.
  • the method 1600 may also include step 1661.
  • UPF discards the packet.
  • the UPF receives an uplink packet, and the destination address is a unicast address and is unknown.
  • the method 1600 may also include step 1671.
  • the UPF sends the message to the DN.
  • the packet is sent to the DN network through the N6 interface, and the tunnel packet may carry the security group information to which the source address belongs, so that the DN network can apply the security policy.
  • whether the tunnel packet carries the security group information to which the source address belongs may be determined by, for example, an operation policy, which is not limited.
  • the source address of the packet received by the UPF is the DN side address.
  • the method 1600 may also include step 1681.
  • the UPF processes the packet according to the security group policy between the security group to which the source address belongs and the security group to which the destination address belongs, or according to the operator policy, and sends the packet to the DN.
  • the UPF can search for the security group to which the destination MAC address belongs. information, and according to the security group policy between the security group to which the source MAC address belongs and the security group to which the destination MAC address belongs, the packet is processed, such as deciding to forward or discard the packet.
  • the packets can also be directly forwarded.
  • the source address can be in the form of a MAC address.
  • the above source address and source MAC address are sometimes used interchangeably. It should be understood that they have the same meaning and are used to indicate sending a message. address or the source address of the packet.
  • the destination address can be in the form of a MAC address.
  • the destination address and destination MAC address are sometimes used interchangeably above. It should be understood that they have the same meaning and are both used to indicate the destination address of the message.
  • a possible process when the UPF executes the security group policy is exemplified above with reference to steps 1610-1681 shown in FIG. 16 , such as a scenario where the PDU session type is Ethernet. It should be understood that the above steps are only exemplary descriptions and are not strictly limited. In addition, the size of the sequence numbers of the above processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the VN group security group policy is implemented through the UPF, that is, the UPF determines the forwarding rules according to the security group policy, and completes the control of the communication device message exchange, thereby improving the security of communication between devices.
  • the security group policy through the UPF can also save the signaling overhead caused by the UPF asking the SMF for the forwarding rules, and improve the data transmission performance.
  • a possible process for implementing the security group policy applicable to this embodiment of the present application is described above with reference to FIG. 13 to FIG. 16 .
  • the following describes a schematic process for updating a security group used in this embodiment of the present application with reference to FIG. 17 and FIG. 18 .
  • FIG. 17 is a schematic flowchart of a security group update applicable to this embodiment of the present application.
  • the method 1700 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, and UPF as an example.
  • the method 1700 shown in FIG. 17 can be used for the aging process of the forwarding rule corresponding to the UPF security group policy.
  • Condition 1 the CPE/UE session is released, triggering the deletion of all forwarding rules corresponding to the CPE/UE.
  • method 1700 may include steps 1711-1713.
  • the CPE/UE requests the SMF to release the CPE/UE session.
  • the SMF delivers a forwarding rule deletion instruction to the UPF, instructing the UPF to delete the forwarding rule corresponding to the CPE/UE.
  • the SMF may deliver a forwarding rule deletion instruction to all UPFs under the VN group, instructing the UPF to delete all forwarding rules corresponding to all MAC/IP addresses under the CPE/UE.
  • the forwarding rule deletion instruction issued by the SMF to the UPF may be used to instruct the UPF to delete the security groups corresponding to all MAC/IP addresses under the CPE/UE. After the UPF receives the instruction, it can delete all forwarding rules corresponding to all MAC/IP addresses under the CPE/UE.
  • Condition 2 The MAC address learned by the UPF is aging, triggering the deletion of all forwarding rules corresponding to the MAC address.
  • method 1700 may include steps 1721-1723.
  • the MAC address aging time expires and the UPF is triggered to age the learned MAC address.
  • the aging time of the MAC address is not strictly limited in this embodiment of the present application.
  • the aging time of the MAC address can be configured by the operator.
  • the aging times corresponding to different MAC addresses may be the same or different, which is not limited.
  • the UPF deletes all forwarding rules corresponding to the aged MAC address.
  • the UPF reports the MAC address aging message to the SMF.
  • the aged MAC address originates from the UPF N3 interface.
  • the MAC address aging message reported by the UPF to the SMF may include one or more of the following information: DNN, VN group, aged MAC address, and N3 interface.
  • DNN indicates the DNN to which the aged MAC address belongs.
  • VN group indicating the VN group to which the aged MAC address belongs.
  • N3 interface indicating that the MAC address originates from the N3 interface.
  • the method 1700 may also include step 17231.
  • the SMF releases the association between the MAC address and the CPE/UE session and the MAC address and the UPF.
  • the SMF After the SMF receives the MAC address aging message reported by the UPF, the SMF can index its associated CPE/UE session according to the MAC address, and the SMF can release the association between the MAC address and the CPE/UE session and the MAC address and the UPF.
  • the aged MAC address originates from the UPF N6 interface.
  • the MAC address aging message reported by the UPF to the SMF may include one or more of the following information: DNN, VN group, aged MAC address, and N6 interface.
  • DNN indicates the DNN to which the aged MAC address belongs.
  • VN group indicating the VN group to which the aged MAC address belongs.
  • N6 interface indicating that the MAC address originates from the N6 interface.
  • the method 1700 may also include step 17232.
  • the SMF disassociates the MAC address with the DNN and the group session.
  • the SMF After the SMF receives the MAC address aging message reported by the UPF, the SMF can index its associated VN group session according to the MAC address, and the SMF disassociates the MAC address with the DNN and the group session.
  • the triggering condition for the SMF to delete the forwarding rule there is no limitation on the triggering condition for the SMF to delete the forwarding rule.
  • the forwarding rules may be actively deleted periodically.
  • method 1700 may include step 1731.
  • the SMF delivers a MAC/IP address forwarding rule deletion instruction to the UPF, instructing the UPF to delete all forwarding rules of the specified MAC/IP address.
  • the SMF may deliver a specified MAC/IP address forwarding rule deletion instruction to all UPFs in the VN group, instructing the UPF to delete all forwarding rules of the specified MAC/IP address.
  • the MAC/IP address of the forwarding rule to be deleted may be indicated by carrying the MAC/IP identifier.
  • method 1700 may be used in a scenario where the SMF enforces the security group policy.
  • method 1700 can be used in conjunction with method 1300 (or method 1400 ), as SMF can enforce security group policy according to the scheme described in method 1300 (or method 1400 ), and SMF or UPF can be timely according to the scheme described in method 1700 Delete aging forwarding rules (such as the forwarding rules corresponding to SMF based on security group policies).
  • the aged forwarding rules can be deleted in time, which can not only save storage space and improve resource utilization, but also update the conversion rules in time (such as updating the security Group Policy) to improve communication performance.
  • FIG. 18 is another schematic flowchart of the security group update applicable to this embodiment of the present application.
  • the method 1800 is mainly illustrated by taking the interaction among the device, CPE/UE, RAN, AMF, SMF, UDM, and UPF as an example.
  • the method 1800 shown in FIG. 18 can be used for the process of the security group to which the UPF aging device belongs.
  • the following describes the process of the security group to which the UPF aging device belongs based on the possible conditions that trigger the deletion of the security group.
  • Condition 1 the CPE/UE session is released, triggering deletion of the security group information corresponding to the CPE/UE.
  • method 1800 may include steps 1811-1813.
  • the CPE/UE requests the SMF to release the CPE/UE session.
  • the SMF delivers a security group information deletion instruction to the UPF, instructing the UPF to delete the security group information corresponding to the CPE/UE.
  • the SMF may deliver a security group information deletion instruction to all UPFs under the VN group, instructing the UPF to delete the security group information corresponding to all MAC/IP addresses under the CPE/UE.
  • Condition 2 The MAC address learned by the UPF is aging, triggering the deletion of the security group information to which the MAC address belongs.
  • method 1800 may include steps 1821-1824.
  • the MAC address aging time expires and the UPF is triggered to age the learned MAC address.
  • the aging of the MAC address learned by the UPF can be understood as, for example, that the UPF deletes the information associated with the MAC address, such as deleting the forwarding rule corresponding to the MAC address.
  • the aging time of the MAC address is not strictly limited in this embodiment of the present application.
  • the aging time of the MAC address can be configured by the operator.
  • the aging times corresponding to different MAC addresses may be the same or different, which is not limited.
  • the UPF reports the MAC address aging message to the SMF.
  • the MAC address aging message reported by the UPF to the SMF may include one or more of the following information: DNN, VN group, aged MAC address, and UE SUPI.
  • DNN indicates the DNN to which the aged MAC address belongs.
  • VN group indicating the VN group to which the aged MAC address belongs.
  • UE SUPI indicating the UE session to which the aged MAC address belongs.
  • the SMF sends an instruction to delete the security group information to which the MAC address belongs to the UPF.
  • UPF can delete the security group information to which the MAC address belongs according to the instruction.
  • the SMF can deliver information indicating deletion of the security group information to which the MAC address belongs to all UPFs under the VN group, where the information is used to instruct the UPF to delete the security group information to which the specified MAC address belongs. group information.
  • method 1800 may be used in a scenario where the UPF enforces the security group policy.
  • method 1800 can be used in conjunction with method 1500 (or method 1600 ), as UPF can enforce security group policy according to the scheme described in method 1500 (or method 1600 ), and SMF or UPF can be timely according to the scheme described in method 1800 Aged security group information.
  • the aged security group information can be deleted in time, which can not only save storage space, improve resource utilization, but also update the security group in time. information and improve communication performance.
  • the communication policy includes allowing access and prohibiting access as an example for illustrative description, and it should be understood that other forms of communication policies are applicable to the embodiments of the present application.
  • the implementation of the security group policy is repeatedly mentioned, which means that the forwarding rule is determined according to the communication policy between the security groups, or the security group policy is considered when formulating the forwarding rule.
  • VN groups for a 5G VN group
  • VN groups under the 6G architecture
  • VN groups can also use the implementation of Secure communication based on security groups.
  • the description is mainly given by taking the SMF or UPF formulating forwarding rules according to the communication policy between security groups after receiving the service data as an example, which is not limited.
  • the solutions for implementing the forwarding rules in the communication policy between the two are all applicable to the embodiments of the present application.
  • the SMF can formulate forwarding rules for the UE, that is, how the data between the UE and other group members is forwarded (or discarded), or the correspondence between the UE and other security groups How to forward (or discard) data between UEs.
  • the SMF After obtaining the information of the security group, the SMF generates forwarding rules (such as PDR and FAR) according to the communication policy between the security group where the UE is located and other security groups, and sends the formulated forwarding rules (such as PDR and FAR) to the UPF, so that the UPF can perform data forwarding according to the forwarding rules (such as PDR and FAR).
  • forwarding rules such as PDR and FAR
  • the SMF receives the session establishment request from UE1, and the session establishment request includes the identifier of the VN group. Assume that UE1 is a device in the first security group in the VN group.
  • the SMF formulates forwarding rules for UE1 according to the communication policy between the first security group and other security groups in the VN group, and sends the forwarding rules formulated for the UE1 to the UPF.
  • the communication policy between the first security group and the second security group is to allow communication.
  • the forwarding rule is used to indicate the forwarding path of the first data.
  • the first data is data exchanged between UE1 and UE2, wherein UE1 belongs to the first security group, and UE2 is any member of the VN group belonging to the second security group.
  • the communication policy between the first security group and the second security group is to prohibit communication.
  • the forwarding rule is used to instruct to discard the first data.
  • the first data is data exchanged between UE1 and UE2, wherein UE1 belongs to the first security group, UE2 belongs to any member of the second security group, and both UE2 and UE1 belong to the same VN group.
  • the UPF After receiving the data sent by the UE1, the UPF can perform data forwarding according to the forwarding rule corresponding to the UE1.
  • the communication policy between the first security group and the second security group is to allow communication.
  • the UPF can forward the data according to the forwarding path indicated by the forwarding rule.
  • the communication policy between the first security group and the second security group is to prohibit communication.
  • the UPF can discard or ignore the data sent by UE1 to UE2 according to the forwarding rule.
  • the above solution is used in combination with the solution shown in FIG. 13 as an example.
  • the SMF can formulate forwarding rules for the UE and send the forwarding rules to the UPF.
  • the UPF After the UPF receives the data sent by the UE, it can perform rule matching based on the source address and destination address of the data packet.
  • the solution of step 1330a in the method 1300 can be executed; when the matching is successful, it can The solution of step 1330b in the method 1300 is performed, ie, the data is processed based on the forwarding rule.
  • the SMF can formulate forwarding rules for the UE and send the forwarding rules to the UPF.
  • the UPF After the UPF receives the data sent by the UE, it can perform rule matching based on the source address and destination address of the data packet. When the matching fails, it can use the solution of method 1500 and the security corresponding to the source address and destination address of the data. Communication policy between groups, which determines how data is handled.
  • the SMF can formulate forwarding rules for the UE and send the forwarding rules to the UPF. After the UPF receives the data sent by the UE, it can perform rule matching based on the source address and destination address of the data packet. And the security group can also be updated in time based on the scheme as shown in method 1700 or method 1800 .
  • the methods and operations implemented by the terminal device may also be implemented by a component (such as a chip or circuit) that can be used in the terminal device, and implemented by a network device (such as a core network element).
  • the methods and operations may also be implemented by components (eg, chips or circuits) that may be used in a network device.
  • FIG. 19 is a schematic block diagram of an apparatus for secure communication provided by an embodiment of the present application.
  • the apparatus 1900 includes a transceiver unit 1910 and a processing unit 1920 .
  • the transceiver unit 1910 can implement corresponding communication functions, and the processing unit 1920 is used for data processing.
  • the transceiving unit 1910 may also be referred to as a communication interface or a communication unit.
  • the apparatus 1900 may further include a storage unit, which may be used to store instructions and/or data, and the processing unit 1920 may read the instructions and/or data in the storage unit, so that the apparatus implements the foregoing method embodiments .
  • a storage unit which may be used to store instructions and/or data
  • the processing unit 1920 may read the instructions and/or data in the storage unit, so that the apparatus implements the foregoing method embodiments .
  • the apparatus 1900 may be configured to perform the actions performed by the network device in the above method embodiments.
  • the apparatus 1900 may be a network device or a component that can be configured in the network device, and the transceiver unit 1910 is configured to perform the above method embodiments.
  • the processing unit 1920 is configured to perform the operations related to the processing on the network device side in the above method embodiments.
  • the transceiver unit 1910 is used to receive the information of the service data sent by the first communication device to the second communication device; the transceiver unit 1910 is also used to obtain the information between the first security group and the second security group.
  • Communication strategy the first security group is the security group corresponding to the first communication device, and the second security group is the security group corresponding to the second communication device; the processing unit 1920 is used for according to the relationship between the first security group and the second security group.
  • Communication policy formulating forwarding rules for service data; wherein, the first communication device and the second communication device are devices in the same virtual network VN group, the VN group includes multiple security groups, and the multiple security groups include the first communication device.
  • Security Group and Second Security Group are devices in the same virtual network VN group, the VN group includes multiple security groups, and the multiple security groups include the first communication device.
  • the communication policy between the first security group and the second security group is to allow communication, or the communication policy between the first security group and the second security group is to prohibit communication.
  • the first network element is a session management function network element.
  • the forwarding rule when the communication policy between the first security group and the second security group is to allow communication, the forwarding rule is used to indicate the forwarding path of the service data; or; the communication between the first security group and the second security group is When the communication policy is to prohibit communication, the forwarding rule is used to instruct to discard service data.
  • the transceiver unit 1910 is specifically configured to receive a forwarding rule unknown message from the second network element, where the forwarding rule unknown message includes source address information and destination address information of the service data, the source address corresponds to the first security group, and the destination address Corresponding to the second security group; the processing unit 1920 is specifically configured to formulate forwarding rules for the service data according to the communication strategy between the first security group corresponding to the source address and the second security group corresponding to the destination address; the transceiver unit 1910 is also used for to send the forwarding rule to the second network element.
  • the transceiver unit 1910 is further configured to: send first indication information to the second network element, where the first indication information is used to indicate that information of which the forwarding rule is unknown is reported.
  • the transceiver unit 1910 is further configured to: send second indication information to the second network element, where the second indication information is used to instruct deletion of the forwarding rule.
  • the transceiver unit 1910 is specifically configured to: send the second indication information to the second network element when it is determined that the session of the first communication device is released or the address related to the forwarding rule is determined to be aging.
  • the second network element is a user plane function network element.
  • the first network element is a user plane function network element.
  • the transceiver unit 1910 is further configured to: receive information from multiple security groups of the second network element, where the information of the multiple security groups includes: a communication policy between any two security groups in the multiple security groups information.
  • the transceiver unit 1910 is specifically configured to: receive service data sent by the first communication device to the second communication device; determine that the first communication device belongs to the communication device corresponding to the first security group in the VN group, and the second communication device belongs to In the case of a communication device corresponding to the second security group in the VN group, the communication policy between the first security group and the second security group is acquired from information of multiple security groups.
  • the forwarding rule when the communication policy between the first security group and the second security group is to allow communication, the forwarding rule is used to indicate the forwarding path of service data, and the transceiver unit 1910 is further configured to: according to the service indicated by the forwarding rule The forwarding path of the data, which forwards the service data; or, when the communication policy between the first security group and the second security group is to prohibit communication, the forwarding rule is used to instruct the discarding of the service data, and the processing unit 1920 is used for according to the forwarding rule Discard business data.
  • the transceiver unit 1910 is further configured to: send third indication information to the second network element, where the third indication information is used to indicate address aging related to the forwarding rule.
  • the transceiver unit 1910 is further configured to: receive fourth indication information from the second network element, where the fourth indication information is used to instruct deletion of the forwarding rule.
  • the second network element is a session management function network element.
  • each security group includes one or more of the following information: the data network corresponding to the security group, the external identifier of the VN group to which the security group belongs, the identifier of the security group, the name of the security group, and the communication device corresponding to the security group. , the communication policy between the security group and other security groups in multiple security groups in the VN group.
  • the apparatus 1900 may implement the steps or processes corresponding to the network equipment (such as the core network element SMF or UPF) in the method embodiments according to the embodiments of the present application. Elements of a method performed by a network device (such as a core network element SMF or UPF) in FIG. 18 . Moreover, the units in the apparatus 1900 and the other operations and/or functions mentioned above are respectively to implement the corresponding processes of the method embodiments of the network device (eg, core network element SMF or UPF) in FIG. 9 , FIG. 13 to FIG. 18 .
  • the transceiver unit 1910 is configured to receive a first request message from the fourth network element, where the first request message is used to request the creation of a security group for the virtual network VN group;
  • the processing unit 1920 is configured to A request message to create multiple security groups for the VN group; wherein, the VN group includes multiple security groups, each security group corresponds to one or more communication devices, the multiple security groups include a first security group, and the first security group
  • the communication policy between the first security group and the second security group is to allow communication, or the communication policy between the first security group and the second security group is to prohibit communication.
  • the first request message includes one or more of the following information: the external identifier of the VN group to which the security group to be created belongs, the data network corresponding to the security group to be created, the identifier of the security group to be created, the The name of the security group to be created, and the communication policy between the security groups to be created.
  • the first request message includes a communication policy between the security groups to be created
  • the processing unit 1920 is specifically configured to set a communication policy for the security group to be created according to the communication policy between the security groups to be created,
  • the communication policy is to allow communication or to prohibit communication.
  • the transceiver unit 1910 is further configured to receive a second request message from the fourth network element, where the second request message is used to request to add one or more communication devices to the first security group.
  • the second request message includes one or more of the following information: the data network corresponding to the first security group, the external identifier of the VN group to which the first security group belongs, the identifier of the first security group, the first security group name, information of one or more communication devices to be added.
  • each security group includes one or more of the following information: the data network corresponding to the security group, the external identifier of the VN group to which the security group belongs, the identifier of the security group, the name of the security group, and the communication device corresponding to the security group. , the communication policy between the security group and other security groups in the multiple security groups of the VN group.
  • the apparatus 1900 is a capability openness function network element
  • the fourth network element is an application function network element.
  • the apparatus 1900 may implement steps or processes corresponding to those performed by a network device (eg, a third network element) in the method embodiments according to the embodiments of the present application.
  • a unit of the method performed by the network device (such as a third network element).
  • the units in the apparatus 1900 and the other operations and/or functions mentioned above are respectively for implementing the corresponding flow of the method embodiment of the network device in FIG. 10 , FIG. 11 , and FIG. 12 .
  • the processing unit 1920 in the above embodiments may be implemented by at least one processor or processor-related circuits.
  • the transceiver unit 1910 may be implemented by a transceiver or a transceiver-related circuit.
  • the storage unit may be implemented by at least one memory.
  • an embodiment of the present application further provides an apparatus 2000 for secure communication.
  • the apparatus 2000 includes a processor 2010 coupled with a memory 2020 for storing computer programs or instructions and/or data, and the processor 2010 for executing the computer programs or instructions and/or data stored in the memory 2020 such that The methods in the above method embodiments are performed.
  • the apparatus 2000 includes one or more processors 2010 .
  • the apparatus 2000 may further include a memory 2020 .
  • the device 2000 may include one or more memories 2020 .
  • the memory 2020 may be integrated with the processor 2010, or provided separately.
  • the apparatus 2000 may further include a transceiver 2030, and the transceiver 2030 is used for signal reception and/or transmission.
  • the processor 2010 is configured to control the transceiver 2030 to receive and/or transmit signals.
  • the apparatus 2000 is configured to implement the operations performed by the network device in the above method embodiments.
  • the processor 2010 is configured to implement the processing-related operations performed by the SMF in the above method embodiments
  • the transceiver 2030 is configured to implement the transceiving-related operations performed by the SMF in the above method embodiments.
  • the processor 2010 is configured to implement the processing-related operations performed by the UPF in the method embodiments above
  • the transceiver 2030 is configured to implement the transceiving-related operations performed by the UPF in the method embodiments above.
  • the processor 2010 is configured to implement the processing-related operations performed by the AF in the above method embodiments
  • the transceiver 2030 is configured to implement the transceiving-related operations performed by the AF in the above method embodiments.
  • the processor 2010 is configured to implement the processing-related operations performed by the NEF in the above method embodiments
  • the transceiver 2030 is configured to implement the transceiving-related operations performed by the NEF in the above method embodiments.
  • This embodiment of the present application further provides a communication apparatus 2100, where the communication apparatus 2100 may be a network device or a chip.
  • the communication apparatus 2100 may be configured to perform the operations performed by the network device in the foregoing method embodiments.
  • FIG. 21 shows a simplified schematic diagram of the structure of the network device.
  • the network device includes part 2110 and part 2120.
  • the 2110 part is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; the 2120 part is mainly used for baseband processing and control of network equipment.
  • the 2110 part may generally be referred to as a transceiver unit, a transceiver, a transceiver circuit, or a transceiver.
  • the 2120 part is usually a control center of the network device, which can be usually called a processing unit, and is used to control the network device to perform the processing operations in the foregoing method embodiments.
  • the transceiver unit of the 2110 part which may also be called a transceiver or a transceiver, etc., includes an antenna and a radio frequency circuit, where the radio frequency circuit is mainly used for radio frequency processing.
  • the device used for implementing the receiving function in part 2110 may be regarded as a receiving unit
  • the device used for implementing the sending function may be regarded as a sending unit, that is, part 2110 includes a receiving unit and a sending unit.
  • the receiving unit may also be referred to as a receiver, a receiver, or a receiving circuit, and the like
  • the transmitting unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, and the like.
  • the 2120 portion may include one or more single boards, each of which may include one or more processors and one or more memories.
  • the processor is used to read and execute the program in the memory to realize the baseband processing function and control the base station. If there are multiple boards, each board can be interconnected to enhance the processing capability.
  • one or more processors may be shared by multiple boards, or one or more memories may be shared by multiple boards, or one or more processors may be shared by multiple boards at the same time. device.
  • FIG. 21 is only an example and not a limitation, and the above-mentioned network device including a transceiver unit and a processing unit may not depend on the structure shown in FIG. 21 .
  • the chip When the device 2100 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the apparatus 2100 may also be a chip system or a processing system, so that a device on which the apparatus 2100 is installed can implement the methods and functions of the embodiments of the present application.
  • the processing unit 2120 can be a chip system or a processing circuit in the processing system, and can control the device on which the chip system or the processing system is installed, and can also be coupled and linked to the storage unit to call the instructions in the storage unit, so that the device can implement
  • the transceiver unit 2110 may be an input and output circuit in a chip system or a processing system, which outputs information processed by the chip system, or inputs data or signaling information to be processed into the chip system for processing. .
  • Embodiments of the present application further provide a computer-readable storage medium, on which computer instructions for implementing the method executed by the network device in the foregoing method embodiments are stored.
  • the computer program when executed by a computer, the computer can implement the method executed by the network device in the above method embodiments.
  • Embodiments of the present application further provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the network device in the above method embodiments.
  • An embodiment of the present application further provides a communication system, where the communication system includes the network device in the above embodiment, a first network element and a second network element, or a third network element and a fourth network element.
  • the communication system includes SMF and UPF in the above embodiment, or AF and NEF.
  • processors mentioned in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits ( application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory and/or a non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM may include the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • Direct memory bus random access memory direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module
  • memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.
  • the disclosed apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to implement the solution provided in this application.
  • each functional unit in each embodiment of the present application may be integrated into one unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the computer may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer may be a personal computer, a server, or a network device or the like.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs), etc.
  • the aforementioned usable media may include But not limited to: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种安全通信的方法和装置。该方法可以包括：第一网元接收第一通信设备发送给第二通信设备的业务数据的信息，第一通信设备和第二通信设备为同一个VN组内的设备；第一网元获取第一安全组与第二安全组之间的通信策略，第一安全组为第一通信设备对应的安全组，第二安全组为第二通信设备对应的安全组；根据第一安全组与第二安全组之间的通信策略，第一网元为业务数据制定转发规则；VN组中包括多个安全组，多个安全组包括第一安全组和第二安全组。通过本申请，可通过定义多个安全组，并分别配置安全组之间的通信策略，网络中的通信设备(如虚拟网络组内的通信设备)分别加入相应的安全组，从而可实现通信设备按组粒度进行访问控制。

Description

安全通信的方法和装置
本申请要求于2021年03月19日提交中国专利局、申请号为202110295551.5、申请名称为“安全通信的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，并且更具体地，涉及一种安全通信的方法和装置。
背景技术
局域网(local area network，LAN)是在一个局部的地理范围内(如一个学校、工厂和机关内)，将各种计算机，外部设备和数据库等互相联接起来组成的计算机通信网。
在当前LAN技术中，如第五代(5th Generation，5G)LAN技术中，通过虚拟网络(virtual network，VN)组(group)可以实现移动网络内通信设备的虚拟局域网互通。在设备互通安全方面，对于VN组内设备的互通权限没有做进一步的定义，缺少安全访问控制机制。
发明内容
本申请提供一种安全通信的方法和装置，可以实现虚拟网络组内设备的安全访问。
第一方面，提供了一种安全通信的方法，该方法可以由网络设备执行，或者，也可以由用于网络设备的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由第一网元设备执行为例进行说明。
该方法可以包括：第一网元接收第一通信设备发送给第二通信设备的业务数据的信息；第一网元获取第一安全组与第二安全组之间的通信策略，第一安全组为第一通信设备对应的安全组，第二安全组为第二通信设备对应的安全组；根据第一安全组与第二安全组之间的通信策略，第一网元为业务数据制定转发规则；其中，第一通信设备和第二通信设备为同一个虚拟网络VN组内的设备，VN组中包括多个安全组，多个安全组包括第一安全组和第二安全组。
上述方法可以由核心网网元(即第一网元)(如会话管理功能(session management function，SMF)网元或者用户面功能(user plane function，UPF)网元)执行，或者，也可以由用于核心网网元的芯片或电路执行。
基于上述技术方案，可以通过定义多个安全组，并分别配置安全组之间的通信策略(或者也可以说访问策略)，网络中的通信设备(如虚拟网络组内的通信设备)分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。具体地，例如，第一网元接收到来自终端设备的业务数据后，可以确定业务数据的源地址(即第一通信设备的地址)归属的安全组与目的地址(即第二通信设备的地址)归属的安全组之间的通信策略，根据该通信策略来制定业务数据的转发规则，不仅可以提高设备之间通信的安全性，还可以便于 管理。
结合第一方面，在第一方面的某些实现方式中，第一安全组与第二安全组之间的通信策略包括：第一安全组与第二安全组之间允许通信，或者，第一安全组与第二安全组之间禁止通信。
基于上述技术方案，安全组之间的通信策略可以包括允许通信和禁止通信两种，这样不仅可以实现安全访问，还简单易行。
结合第一方面，在第一方面的某些实现方式中，第一网元为会话管理功能网元。
结合第一方面，在第一方面的某些实现方式中，方法还包括：第一安全组与第二安全组之间的通信策略为允许通信的情况下，转发规则用于指示业务数据的转发路径；或者；第一安全组与第二安全组之间的通信策略为禁止通信的情况下，转发规则用于指示丢弃业务数据。
结合第一方面，在第一方面的某些实现方式中，第一网元接收第一通信设备发送给第二通信设备的业务数据的信息，包括：第一网元接收来自第二网元的转发规则未知消息，转发规则未知消息包括业务数据的源地址信息和目的地址信息，源地址对应第一安全组，目的地址对应第二安全组；根据第一安全组与第二安全组之间的通信策略，第一网元为业务数据制定转发规则，包括：第一网元根据源地址对应的第一安全组和目的地址对应的第二安全组之间的通信策略，为业务数据制定转发规则；第一网元将转发规则发送给第二网元。
基于上述技术方案，第一网元接收到第二网元发送的转发规则未知消息后，基于该转发规则未知消息中的业务数据的相关信息，如源地址和目的地址，确定源地址和目的地址对应的安全组，进而可以根据源地址和目的地址对应的安全组之间的通信策略，为该业务数据制定转发规则，进而再向第二网元发送该转发规则，使得第二网元可以根据该转发规则处理业务数据。
结合第一方面，在第一方面的某些实现方式中，第一网元接收来自第二网元的转发规则未知消息之前，方法还包括：第一网元向第二网元发送第一指示信息，第一指示信息用于指示上报转发规则未知的信息。
示例地，转发规则未知，即表示不能根据源地址、目的地址匹配转发规则。
基于上述技术方案，第一网元可以向第二网元配置未知转发规则报文上报指示。这样，可以便于第二网元在接收到未知报文后，向第一网元上报业务数据的转发规则未知，从而第一网元可以为该业务数据制定转发规则。
结合第一方面，在第一方面的某些实现方式中，方法还包括：第一网元向第二网元发送第二指示信息，第二指示信息用于指示删除转发规则。
基于上述技术方案，可以及时更新安全组，从而不仅可以提高资源利用率，还可以保证数据传输性能。
结合第一方面，在第一方面的某些实现方式中，第一网元向第二网元发送第二指示信息，包括：确定第一通信设备的会话释放或者确定与转发规则相关的地址老化的情况下，第一网元向第二网元发送第二指示信息。
示例地，第一网元也可以周期性地向第二网元发送该第二指示信息。
结合第一方面，在第一方面的某些实现方式中，第二网元为用户面功能网元。
结合第一方面，在第一方面的某些实现方式中，第一网元为用户面功能网元。
结合第一方面，在第一方面的某些实现方式中，方法还包括：第一网元接收来自第二网元的多个安全组的信息，多个安全组的信息包括：多个安全组中任两个安全组之间的通信策略的信息。
基于上述技术方案，第一网元可以预先获取该多个安全组的相关信息。
结合第一方面，在第一方面的某些实现方式中，第一网元接收第一通信设备发送给第二通信设备的业务数据的信息，包括：第一网元接收第一通信设备发送给第二通信设备的业务数据；第一网元获取第一安全组与第二安全组之间的通信策略，包括：在第一网元判断第一通信设备属于VN组中第一安全组对应的通信设备，第二通信设备属于VN组中第二安全组对应的通信设备的情况下，第一网元从多个安全组的信息中获取第一安全组与第二安全组之间的通信策略。
结合第一方面，在第一方面的某些实现方式中，第一安全组与第二安全组之间的通信策略为允许通信的情况下，转发规则用于指示业务数据的转发路径，第一网元根据转发规则指示的业务数据的转发路径，转发业务数据；或者，第一安全组与第二安全组之间的通信策略为禁止通信的情况下，转发规则用于指示丢弃业务数据，第一网元根据转发规则丢弃业务数据。
结合第一方面，在第一方面的某些实现方式中，方法还包括：第一网元向第二网元发送第三指示信息，第三指示信息用于指示与转发规则相关的地址老化。
基于上述技术方案，当地址老化后，第一网元可以向第二网元指示地址老化，以便第一网元可以删除与该地址对应当转发规则，节省存储空间。
结合第一方面，在第一方面的某些实现方式中，方法还包括：第一网元接收来自第二网元的第四指示信息，第四指示信息用于指示删除转发规则。
结合第一方面，在第一方面的某些实现方式中，第二网元为会话管理功能网元。
结合第一方面，在第一方面的某些实现方式中，每个安全组包括以下一项或多项信息：安全组对应的数据网络、安全组所属的VN组的外部标识、安全组的标识、安全组的名称、安全组对应的通信设备、安全组与VN组中的多个安全组中的其他安全组之间的通信策略。
第二方面，提供了一种安全通信的方法，该方法可以由网络设备执行，或者，也可以由用于网络设备的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由第三网元执行为例进行说明。
该方法可以包括：第三网元接收来自第四网元的第一请求消息，第一请求消息用于请求为虚拟网络VN组创建安全组；第三网元基于第一请求消息，为VN组创建多个安全组；其中，VN组中包括多个安全组，每个安全组对应一个或多个通信设备，多个安全组包括第一安全组，第一安全组和多个安全组中的其它安全组之间具有通信策略，通信策略用于控制第一安全组对应的通信设备与其它安全组对应的通信设备之间的通信。
示例地，一个VN组中可以包括多个安全组。
示例地，第三网元例如可以为能力开放功能(network exposure function，NEF)，第四网元例如可以为应用功能(application function，AF)。
基于上述技术方案，在一个虚拟网络(virtual network，VN)组(group)中定义多个安全组，并且分别配置安全组之间的通信策略，网络中的通信设备(如VN组内的通信设 备)分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。这样，不仅可以提高设备之间通信的安全性，还可以便于管理。
结合第二方面，在第二方面的某些实现方式中，通信策略为允许通信或禁止通信。
基于上述技术方案，安全组之间的通信策略可以包括允许通信和禁止通信两种，这样不仅可以实现安全访问，还简单易行。
结合第二方面，在第二方面的某些实现方式中，第一请求消息中包括以下一项或多项信息：待创建的安全组所属的VN组的外部标识、待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
结合第二方面，在第二方面的某些实现方式中，第一请求消息中包括待创建的安全组之间的通信策略，方法还包括：根据待创建的安全组之间的通信策略，第三网元为待创建的安全组设置通信策略，通信策略为允许通信或禁止通信。
结合第二方面，在第二方面的某些实现方式中，方法还包括：第三网元接收来自第四网元的第二请求消息，第二请求消息用于请求为第一安全组添加一个或多个通信设备。
结合第二方面，在第二方面的某些实现方式中，第二请求消息中包括以下一项或多项信息：第一安全组对应的数据网络、第一安全组所属的VN组的外部标识、第一安全组的标识、第一安全组的名称、待添加的一个或多个通信设备的信息。
结合第二方面，在第二方面的某些实现方式中，每个安全组包括以下一项或多项信息：安全组对应的数据网络、安全组所属的VN组的外部标识、安全组的标识、安全组的名称、安全组对应的通信设备、安全组与VN组的多个安全组中的其他安全组之间的通信策略。
结合第二方面，在第二方面的某些实现方式中，第三网元为能力开放功能网元，第四网元为应用功能网元。
第三方面，提供了一种安全通信的方法，该方法可以由网络设备执行，或者，也可以由用于网络设备的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以由第一网元执行为例进行说明。
该方法可以包括：第一网元接收来自第一通信设备的会话建立请求，会话建立请求包括虚拟网络VN组的标识；第一通信设备对应的安全组为第一安全组；第一网元根据第一安全组和其它安全组之间的通信策略，为第一通信设备制定转发规则；第一网元向第二网元发送转发规则；其中，VN组中包括多个安全组，每个安全组对应一个或多个通信设备，多个安全组包括第一安全组，第一安全组和多个安全组中的其它安全组之间具有通信策略，通信策略用于控制第一安全组对应的通信设备与其它安全组对应的通信设备之间的通信。
上述方法可以由核心网网元(即第一网元)(如SMF网元)执行，或者，也可以由用于核心网网元的芯片或电路执行。
示例地，第一网元为SMF网元，第二网元为UPF网元。
示例地，第一网元判断第一通信设备属于第一安全组对应的通信设备。
关于通信策略，可以参考第一方面或第二方面的描述。
基于上述技术方案，可以通过定义多个安全组，并分别配置安全组之间的通信策略，网络中的通信设备分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。此外，核心网网元(如SMF网元)收到通信设备的会话建立请求后，可以基于该通 信设备所在的安全组与其他安全组之间的通信策略，为该通信设备制定转发规则，并发送给第二网元，从而可以使得第二网元基于该转发规则执行数据转发。
结合第三方面，在第三方面的某些实现方式中，方法还包括：第一网元向第六网元请求VN组会话签约信息；第一网元接收来自第六网元的VN组会话签约信息，该VN组会话签约信息中包括该多个安全组的信息，多个安全组的信息包括：多个安全组中任两个安全组之间的通信策略的信息。
示例地，第六网元为核心网网元，如统一数据管理(unified data management，UDM)网元或统一数据存储(unified data repository，UDR)网元。
结合第三方面，在第三方面的某些实现方式中，第一网元向第二网元发送第二指示信息，第二指示信息用于指示删除为第一通信设备制定的转发规则。
结合第三方面，在第三方面的某些实现方式中，第一网元向第二网元发送第二指示信息，包括：确定第一通信设备的会话释放或者确定与转发规则相关的地址老化的情况下，第一网元向第二网元发送第二指示信息。
示例地，第一网元也可以周期性地向第二网元发送该第二指示信息。
结合第三方面，在第三方面的某些实现方式中，方法还包括：第一网元接收来自第二网元的地址老化消息，根据地址老化消息，解除与地址相关的关联关系。
示例地，解除地址与终端设备会话的关联关系，以及地址与UPF的关联关系。
示例地，解除地址与数据网络名称以及组会话的关联关系。
第四方面，提供了一种安全通信的方法，该方法可以由网络设备执行，或者，也可以由用于网络设备的芯片或电路执行，本申请对此不作限定，为了便于描述，下面以第二网元执行为例进行说明。
该方法可以包括：第二网元接收来自第一网元的第一通信设备对应的转发规则，第一通信设备对应的安全组为第一安全组，第一通信设备对应的转发规则是根据第一安全组和其它安全组之间的通信策略制定的；第二网元接收来自第一通信设备的业务数据；第二网元根据第一通信设备对应的转发规则，处理业务数据。
上述方法可以由核心网网元(即第二网元)(如UPF网元)执行，或者，也可以由用于核心网网元的芯片或电路执行。
示例地，第二网元为UPF网元，第一网元为SMF网元。
关于通信策略，可以参考第一方面或第二方面的描述。
基于上述技术方案，可以通过定义多个安全组，并分别配置安全组之间的通信策略，网络中的通信设备分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。此外，通过核心网网元(如UPF网元)执行安全组策略，完成通信设备报文互通控制，从而可以提高设备之间通信的安全性。
结合第四方面，在第四方面的某些实现方式中，多个安全组包括第二安全组，业务数据为第一通信设备发送给第二安全组对应的通信设备的数据；第二网元根据第一通信设备对应的转发规则，处理业务数据，包括：第一安全组与第二安全组之间的通信策略为允许通信的情况下，转发规则用于指示业务数据的转发路径，第二网元根据转发规则指示的业务数据的转发路径，转发业务数据；或者，第一安全组与第二安全组之间的通信策略为禁止通信的情况下，转发规则用于指示丢弃业务数据，第二网元根据转发规则丢弃业务数据。
结合第四方面，在第四方面的某些实现方式中，方法还包括：第二网元接收来自第一网元的第二指示信息，第二指示信息用于指示删除为第一通信设备制定的转发规则。
结合第四方面，在第四方面的某些实现方式中，方法还包括：确定第一通信设备对应地址老化；删除被老化的地址对应的全部转发规则，或者，删除被老化的地址对应的安全组信息。
第五方面，提供一种通信装置，该装置用于执行上述第一方面至第四方面提供的方法。具体地，该装置可以包括用于执行第一方面至第四方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
在一种实现方式中，该装置为网络设备。当该装置为网络设备时，所述通信单元可以是收发器，或，输入/输出接口；所述处理单元可以是处理器。
在另一种实现方式中，该装置为用于网络设备中的芯片、芯片系统或电路。当该装置为用于通信设备中的芯片、芯片系统或电路时，所述通信单元可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等；所述处理单元可以是处理器、处理电路或逻辑电路等。
可选地，上述收发器可以为收发电路。可选地，上述输入/输出接口可以为输入/输出电路。
第六方面，提供一种通信装置，该装置包括：存储器，用于存储程序；处理器，用于执行存储器存储的程序，当存储器存储的程序被执行时，处理器用于执行上述第一方面至第四方面提供的方法。
在一种实现方式中，该装置为终端设备或网络设备。
在另一种实现方式中，该装置为用于终端设备或网络设备中的芯片、芯片系统或电路。
第七方面，本申请提供一种处理器，用于执行上述各方面提供的方法。在执行这些方法的过程中，上述方法中有关发送上述信息和获取/接收上述信息的过程，可以理解为由处理器输出上述信息的过程，以及处理器接收输入的上述信息的过程。在输出上述信息时，处理器将该上述信息输出给收发器，以便由收发器进行发射。该上述信息在由处理器输出之后，还可能需要进行其他的处理，然后才到达收发器。类似的，处理器接收输入的上述信息时，收发器获取/接收该上述信息，并将其输入处理器。更进一步的，在收发器收到该上述信息之后，该上述信息可能需要进行其他的处理，然后才输入处理器。
基于上述原理，举例来说，前述方法中提及的获取第一安全组与第二安全组之间的通信策略，可以理解为处理器接收输入的信息。
对于处理器所涉及的发射、发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则均可以更加一般性的理解为处理器输出和接收、输入等操作，而不是直接由射频电路和天线所进行的发射、发送和接收操作。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器。上述存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(Read Only Memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第八方面，提供一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述第一方面至第四方面提供的方法。
第九方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面至第四方面提供的方法。
第十方面，提供一种芯片，所述芯片包括处理器与通信接口，所述处理器通过所述通信接口读取存储器上存储的指令，执行上述第一方面至第四方面提供的方法。
可选地，作为一种实现方式，所述芯片还可以包括存储器，所述存储器中存储有指令，所述处理器用于执行所述存储器上存储的指令，当所述指令被执行时，所述处理器用于执行上述第一方面至第四方面提供的方法。
第十一方面，提供一种通信系统，包括上文所述的网络设备，如第一网元和第二网元(如SMF和UPF)；又如，第三网元和第四网元(如NEF和AF)。
附图说明
图1示出了适用于本申请实施例提供的方法的网络架构的示意图。
图2示出了适用于本申请实施例的PDU连接的一示意图。
图3示出了适用于本申请实施例的数据包转发的一示意图。
图4和图5示出了适用于本申请实施例的5G LAN group中终端设备数据交互的用户面架构示意图。
图6和图7示出了适用于本申请实施例的5G LAN场景UPF转发的示意图。
图8示出了AF配置管理5G VN group的示意图。
图9示出了本申请实施例提供的一种安全通信的方法900的示意性交互图。
图10示出了本申请实施例提供的一种安全通信的方法1000的示意性交互图。
图11示出了适用于本申请实施例的安全通信的一示意性流程图。
图12示出了适用于本申请实施例的安全通信的另一示意性流程图。
图13中的(1)和(2)示出了适用于本申请一实施例的安全组策略执行的一示意性流程图。
图14中的(1)和(2)示出了适用于本申请一实施例的安全组策略执行的另一示意性流程图。
图15示出了适用于本申请另一实施例的安全组策略执行的一示意性流程图。
图16示出了适用于本申请另一实施例的安全组策略执行的另一示意性流程图。
图17示出了适用于本申请实施例的安全组更新的一示意性流程图。
图18示出了适用于本申请实施例的安全组更新的另一示意性流程图。
图19是根据本申请实施例提供的安全通信的装置的示意性框图。
图20是根据本申请实施例提供的安全通信的装置的另一示意性框图。
图21是本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请提供的技术方案可以应用于各种通信系统，例如：第五代(5th Generation，5G) 移动通信系统或新无线接入技术(new radio access technology，NR)。其中，5G移动通信系统可以包括非独立组网(non-standalone，NSA)和/或独立组网(standalone，SA)。本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统。本申请实施例的技术方案还可以应用于机器类通信(machine type communication，MTC)、机器间通信长期演进技术(Long Term Evolution-machine，LTE-M)、设备到设备(device-to device，D2D)网络、机器到机器(machine to machine，M2M)网络、物联网(internet of things，IoT)网络或者其他网络。其中，IoT网络例如可以包括车联网。其中，车联网系统中的通信方式统称为车到其他设备(vehicle to X，V2X，X可以代表任何事物)，例如，该V2X可以包括：车辆到车辆(vehicle to vehicle，V2V)通信，车辆与基础设施(vehicle to infrastructure，V2I)通信、车辆与行人之间的通信(vehicle to pedestrian，V2P)或车辆与网络(vehicle to network，V2N)通信等。
为便于理解本申请实施例，首先结合图1详细说明适用于本申请实施例的网络架构。
图1是适用于本申请实施例提供的方法的网络架构的示意图。如图1所示，该网络架构例如是第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)定义的5G组网架构。该网络架构例如可以包括但不限于以下：用户设备(user equipment，UE)、接入网(access network，AN)、接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、统一数据存储(unified data repository，UDR)、应用功能(application function，AF)或能力开放功能(network exposure function，NEF)、数据网络(data network，DN)等。
下面对图1中示出的各网元做简单介绍。
1、终端设备：可以称为用户设备(user equipment，UE)、接入终端、用户单元、用户站、移动站、移动台(mobile station，MS)、移动终端(mobile terminal，MT)、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备可以是一种向用户提供语音/数据连通性的设备，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端的举例可以为：手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑(如笔记本电脑、掌上电脑等)、移动互联网设备(mobile internet device，MID)、虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备(如5G局域网中的终端设备)或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。
此外，终端设备还可以是IoT系统中的终端设备。IoT是未来信息技术发展的重要组 成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。IoT技术可以通过例如窄带(narrow band，NB)技术，做到海量连接，深度覆盖，终端省电。
此外，终端设备还可以包括智能打印机、火车探测器、加油站等传感器，主要功能包括收集数据(部分终端设备)、接收网络设备的控制信息与下行数据，并发送电磁波，向网络设备传输上行数据。
应理解，终端设备可以是任何可以接入网络的设备。终端设备与接入网设备之间可以采用某种空口技术相互通信。
可选地，终端设备可以用于充当基站。例如，终端设备可以充当调度实体，其在V2X或D2D等中的终端设备之间提供侧行链路信号。比如，蜂窝电话和汽车利用侧行链路信号彼此通信。蜂窝电话和智能家居设备之间通信，而无需通过基站中继通信信号。
2、接入网(access network，AN)：接入网可以为特定区域的授权用户提供入网功能，包含无线接入网(radio access network，RAN)设备和AN设备。RAN设备主要是3GPP网络无线网络设备，AN设备可以是非3GPP(non-3GPP)定义的接入网设备。
接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：3GPP接入技术(例如3G、4G或5G系统中采用的无线接入技术)和非3GPP(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，例如，5G系统中的接入网设备称为下一代基站节点(next generation Node Base station，gNB)或者RAN。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以无线保真(wireless fidelity，WiFi)中的接入点(access point，AP)为代表的空口技术、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)、码分多址(code division multiple access，CDMA)网络等。接入网设备(AN设备)可以允许终端设备和3GPP核心网之间采用非3GPP技术互连互通。
基于无线通信技术实现接入网络功能的接入网可以称为RAN。无线接入网能够负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。无线接入网为终端设备提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网例如可以包括但不限于：宏基站、微基站(也称为小站)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，WiFi系统中的AP、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G(如，NR)系统中的gNB或传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)，或者下一代通信6G系统中的基站等。本申请实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
接入网可以为小区提供服务。终端设备可以通过接入网设备分配的传输资源(例如，频域资源，或者说，频谱资源)与小区通信。
3、AMF网元：主要负责对UE进行移动性管理、接入鉴权/授权等功能。此外，还可以负责在UE与PCF间传递用户策略。
4、SMF网元：主要负责对UE进行协议数据单元(protocol data unit，PDU)会话管理、PCF下发控制策略的执行、UPF的选择、PDU类型(PDU Type)为网际协议(Internet Protocol，IP)类型时UE IP地址分配等功能。
5、UPF网元：作为和数据网络的接口，UPF可用于完成用户面数据转发、基于会话/流级的计费统计，带宽限制等功能。
6、PCF网元：主要负责针对会话、业务流级别进行计费、QoS带宽保障及移动性管理、UE策略决策等策略控制功能。
7、AF网元：主要传递应用侧对网络侧的需求，例如，QoS需求或用户状态事件订阅等。AF网元可以是第三方功能实体，也可以是运营商部署的应用服务，如IP多媒体服务业务(IP multi-media service，IMS)语音呼叫业务。对于第三方应用的应用功能实体，其与核心网进行交互时还可经由NEF进行授权处理，例如第三方应用功能直接向NEF发送请求消息，NEF判断该AF是否被允许发送该请求消息，若验证通过，则将转发该请求消息至对应PCF或UDM。
8、UDM网元：主要负责管理签约数据、用户接入授权等功能。
9、UDR网元：主要负责签约数据、策略数据、应用数据等类型数据的存取功能。
10、数据网络(DN)：用于为用户提供数据服务的服务网络。例如，因特网(Internet)、第三方的业务网络、IMS网络等。数据网络可以以数据网络名称(data network name，DNN)为标识。
应理解，图1中所示的各个网元或者功能，如AMF、SMF、UPF、PCF、UDM等，可以理解为用于实现不同功能的网络元件，例如可以按需组合成网络切片。这些网络元件可以各自独立的设备，也可以集成于同一设备中实现不同的功能，或者可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。
作为示例，其中，各接口功能描述如下。
N1：AMF与UE之间的信令面接口，接入无关，可用于核心网与UE之间交换信令消息，如UE注册入网、UE建立PDU会话、网络侧配置UE策略等。
N2：AMF与RAN之间的接口，可用于传递核心网至RAN的无线承载控制信息等。
N3:(R)AN与UPF之间的接口，可用于在RAN和UPF之间传递UE业务数据。
N4：SMF与UPF之间的接口，可用于控制面与用户面之间传递信息，包括控制面向用户面的转发规则、QoS控制规则、流量统计规则等的下发以及用户面的信息上报。
N5：AF与PCF之间的接口，可用于应用业务请求下发以及网络事件上报。
N6：UPF与DN之间的接口，可用于在UPF和DN之间传递UE业务数据。
N7：PCF与SMF之间的接口，可用于下发PDU会话粒度以及业务数据流粒度控制策略。
N8：AMF与UDM间的接口，可用于AMF向UDM获取接入与移动性管理相关签约数据与鉴权数据，以及AMF向UDM注册UE当前移动性管理相关信息等。
N9：UPF与UPF间的接口，如拜访地策略控制功能(visited-policy control function，V-PCF)与归属地策略控制功能(home-policy control function，H-PCF)间的接口，或是与DN相连的UPF与RAN相连的UPF间的接口，用于在UPF间传递用户面数据。
N10：SMF与UDM间的接口，可用于SMF向UDM获取会话管理相关签约数据，以及SMF向UDM注册UE当前会话相关信息等。
N11：SMF与AMF之间的接口，可用于传递RAN和UPF之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给RAN的无线资源控制信息等。
N15：PCF与AMF之间的接口，可用于下发UE策略及接入控制相关策略。
N35：UDM与UDR间的接口，可用于UDM从UDR中获取用户签约数据信息。
N36：PCF与UDR间的接口，可用于PCF从UDR中获取策略相关签约数据以及应用数据相关信息。
其他接口与各网元之间的关系如图1中所示，为了简洁，这里不一一详述。
应理解，图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
还应理解，上述应用于本申请实施例的网络架构仅是示例性说明，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
为便于理解本申请实施例，首先对本申请中涉及到的术语做简单说明。
1、PDU连接，会话管理。
网络(如5G网络)为UE和DN网络提供数据交换服务，该服务例如可称为PDU连接服务。UE通过向移动网络发起PDU会话建立请求获得PDU连接服务。网络侧通过为UE维护PDU会话以提供PDU连接服务。
作为示例性说明，图2示出了适用于本申请实施例的PDU连接的一示意图。如图2所示，PDU连接中所涉及的网络例如可以包括网元：基于网络切片特定认证与授权功能(network slice specific authentication and authorization function，NSSAAF)、网络切片选择功能(network slice selection function，NSSF)、鉴权服务功能(authentication server function，AUSF)、UDM、AMF、SMF、PCF、AF、UE、(R)AN、UPF、DN。具体描述，可以参考标准中的介绍或者也可以参考图1中的描述，此处不再赘述。
如图2所示，数据面路径表示UE和DN网络之间的业务数据交换路径，该路径为UE在移动网络中的数据业务路径。为实现UE与DN网络之间的数据交换，UE需要使用移动网络提供的PDU连接服务，建立基于DNN的PDU会话，即信令面流程。PDU会话的建立一般包括两个过程：UE向移动网络注册入网流程、UE向网络请求建立PDU会话流程，这两个过程属于UE与移动网络的信令面交互流程，即图2所示的信令面路径。
作为示例性说明，以终端设备为UE为例，简单介绍通用的终端设备注册入网流程。UE通过(R)AN发送注册请求至AMF，AMF根据UE标识向UDM获取签约数据。网络侧经过一系列鉴权、授权操作，最终确认允许UE接入网络。AMF响应UE注册请求，并向 UE下发相关策略信息，UE完成网络注册驻留。网络侧AMF维护UE的注册入网信息，对UE进行移动性管理。应理解，上述仅是示例性说明，关于UE注册入网的具体流程，本申请实施例不作限定。
UE完成注册入网后，可发起PDU会话建立请求，获取网络的PDU连接服务。作为示例性说明，以终端设备为UE为例，简单介绍通用的PDU会话建立流程。UE通过RAN发送PDU会话建立请求到AMF。基于UE的PDU会话建立请求，AMF选择SMF为UE提供会话服务，保存SMF与PDU会话的对应关系，并将PDU会话建立请求发送至SMF。SMF为UE选择相应UPF建立用户面传输路径，并为其分配IP地址。应理解，上述仅是示例性说明，关于UE获取网络的PDU连接服务的具体流程，本申请实施例不作限定。
在对UE进行PDU会话管理过程中，SMF通过N4接口与UPF交互，控制UPF创建、修改、删除相应的UE N4会话(session)(N4 session或报文转发控制协议(packet forwarding control protocol，PFCP)session)，实现对UPF处理数据报文的控制。SMF对UPF内的UE N4会话下发各类数据包处理规则，完成对UPF处理数据包的控制。UPF收到外部数据报文后，根据SMF下发的匹配规则(如包检测规则(packet detection rule，PDR))进行报文匹配，根据转发规则(如转发动作规则(forwarding action rule，FAR))转发报文。关于匹配、转发规则，下文详细描述。
为便于理解，下面对PDR、FAR进行简单介绍。
PDR可以由SMF进行PDU会话管理过程中下发给UPF，UPF根据SMF下发的PDR执行对应的数据包匹配规则，并由此获得对应的FAR完成数据包转发。一个PDR内可以包含一个包探测信息(packet detection information，PDI)参数，PDI参数包含一个或若干个匹配字段，用于与UPF收到的数据报文进行匹配，识别报文，完成数据报文与N4会话的关联。SMF向UPF提供的PDI信息主要包括数据报文入口(即源端口(source interface))和对入口报文进行匹配的一系列参数。其中，对入口报文进行匹配的一系列参数，例如可以包括但不限于：隧道端点(如本地全称隧道端点标识(fully qualified tunnel endpoint identifier，F-TEID)(Local F-TEID))，网络实例(network instance)，UE IP地址，业务数据流(service data flow，SDF)过滤器(SDF Filter(s))或应用ID(application ID)等。
UPF收到一个数据报文后，将数据报文头各字段与PDR内PDI定义的参数项进行匹配，找到报文归属的N4会话以及N4会话内与数据报文具有最高优先级匹配关系的PDR规则，完成报文匹配。完成PDR匹配后，PDR规则包含相应的FAR指示，UPF将根据FAR指示完成数据报文转发。
FAR主要通过如下信息指示UPF进行数据报文处理：应用动作参数(apply action parameter)和转发、缓存、复制参数。其中，应用动作参数主要用于指示UPF是否需要对报文进行转发、复制、丢弃，或以通知或不通知控制面(如SMF)的方式缓存下行报文，或指示UPF是否允许UE加入IP组播组。当应用动作指示UPF对数据包进行转发、缓存或复制时，UPF需要使用转发、缓存、复制参数。
2、用户面管理，匹配、转发规则。
SMF可通过N4接口向UPF下发各类数据包处理规则，控制UPF对数据包的处理。其中，PDR用于对数据包进行匹配，FAR用于指示报文转发方式。关于UPF对数据包处理的流程，可以参考协议中的定义(如可参考标准3GPP 29.244)。外部数据报文进入UPF， UPF根据PDR匹配条件匹配N4会话信息(N4 session/PFCP session)，然后再在N4会话中匹配优先级最高的PDR，根据其对应的FAR完成数据包转发。
作为示例性说明，图3示出了适用于本申请实施例的数据包转发的一示意图。
如图3所示，上下行数据进入UPF接口，UPF根据规则匹配完成数据包转发流程，具体如下。
(1)上行流(uplink traffic)：UE上行报文通过RAN到达N3接口，通过匹配数据报文源端口、隧道标识(如F-TEID)获得源UE N4会话，根据业务数据流过滤器(SDF)进行PDR匹配，相应的FAR转发规则指示如何转发报文。图3所示为将UE上行报文通过N6接口转发到DN网络侧。
(2)下行流(downlink traffic)：DN下行报文通过N6接口进入UPF，通过匹配数据报文源端口、网络实例、目的IP地址匹配目的UE N4会话及PDR规则，相应的FAR转发规则报文指示如何转发报文。图3所示为将DN下行报文通过N3接口转发到UE。
应理解，上述仅是示例性说明，关于数据包的具体转发流程，本申请实施例不作限定。
3、5G局域网(5G local area network，5G LAN)数据面架构。
作为示例而非限定，本申请提供的技术方案可以应用于5G LAN中的通信。局域网(local area network，LAN)是在一个局部的地理范围内(如一个学校、工厂和机关内)，将各种计算机，外部设备和数据库等互相联接起来组成的计算机通信网。它可以通过数据通信网或专用数据电路，与远方的局域网、数据库或处理中心相连接，构成一个大范围的信息处理系统。
随着新兴企业办公模式及智能居家模式的出现，有线局域网和无线局域网(wireless local access network，WLAN)显现了其在部署复杂、灵活性、移动性、覆盖范围等方面的不足，这促使局域网技术再发展以适应未来应用对LAN的需求。利用移动网络其本身的广覆盖特点，来直接提供LAN服务，可称之为5G LAN。5G LAN可以在更广泛的移动网络覆盖范围内使用，即无论终端设备是否在同一地域，只要加入同一5G LAN，即可实现基于LAN的数据交换和通信。利用已经广覆盖的移动网络，5G LAN服务的创建及其伸缩迁移调整均可由移动网络自动完成，不需要人工干预。此外，5G LAN可按需定制，不同5G LAN间互相安全隔离。
移动网络通过5G LAN服务为终端设备构建一个虚拟移动专网。终端设备通过建立传统的PDU连接，可以解决终端设备与DN之间的数据交换问题。5G LAN在传统PDU连接的基础上，增加了组(group)的概念，如记为5G LAN group。归属于同一个5G LAN group的终端设备既能与该5G LAN group对应的DN完成数据交换，又能通过UPF直接同该5G LAN group内的其他终端设备完成数据交换，两个5G LAN group之间的终端设备相互隔离。通过5G LAN可实现虚拟专网通信。移动网络内可同时支持多个5G LAN group,同一个5G LAN group下的终端设备可相互通信，不同5G LAN group下的终端设备之间可相互隔离。
作为示例性说明，图4和图5示出了适用于本申请实施例的5G LAN group中终端设备数据交互的用户面架构示意图。
如图4所示，图4为同一个5G LAN group下的多个UE注册在同一个PDU会话锚点(PDU session anchor，PSA)UPF的用户面架构。一般地，根据UE访问的DN不同，网 络可以根据网络策略选择接入DN的UPF作为锚点(anchor)，如记为PSA。以UE1和UE2归属于同一个5G LAN group为例，在图4所示架构下，PSA UPF除为UE1、UE2完成与DN的数据交换之外，由于UE1、UE2归属于同一个5G LAN group，PSA UPF还可作为5G LAN group的本地交换(local switch)完成UE1与UE2之间的数据交换。
如图5所示，图5为同一个5G LAN group下的多个UE注册在多个PSA UPF的用户面架构。以UE1和UE2归属于同一个5G LAN group为例，在图5所示架构下，PSA UPF之间增加了N19接口，归属于同一个5G LAN group的UE1、UE2在进行数据交换时，可将由其对应的PSA UPF通过N19通道完成数据的传输。
应理解，上述图4和图5仅是两种示例，对此不作限定。
4、5G LAN数据面匹配、转发规则。
5G LAN场景下，网络侧在UPF内部可采用两次匹配、转发模型。作为示例性说明，图6和图7示出了适用于本申请实施例的5G LAN场景UPF转发的示意图。
图6示出了5G LAN场景UPF转发模型，如图6所示，5G LAN场景UPF转发模型可以包括如下特点。
(1)UPF内部增加5G虚拟网络(5G virtual network，5G VN)内部(internal)接口(如记为5G VN Internal)，在PDU会话基础上增加了组N4会话(group-level N4 session)，UPF之间增加N19接口。
(2)根据UPF收到的用户业务数据包目的地址的不同，报文可能在UPF进行本地交互发到同UPF内的目的UE，可能经过N6接口发送到DN网络侧设备，也可能经过N19发送到其他UPF上。
图7示出了5G LAN场景UPF转发过程，如图7所示，5G LAN同组内数据报文匹配转发过程如下。5G LAN服务中，将使用专有通信的一组终端设备集合记为5G VN组(5G VN group)。
一可能场景，多个UE属于同一个5G VN group，且该多个UE均在同一个PSA UPF下。
在该场景下，UPF采用本地交换完成组内UE之间的数据交换。具体过程例如为：UPF通过N3接口收到源UE发往目的UE的数据报文，经过第一次PDR匹配后(基于报文通用分组无线业务(general packet radio service，GPRS)用户面隧道协议(GPRS tunnelling protocol user plane，GTP-U)报文头完成匹配)获得源UE N4会话。对应的FAR指示将报文转发到5G VN Internal进入第二次PDR匹配(基于报文目的IP完成匹配)获得目的UE N4会话，对应的FAR指示将报文通过N3口转发到目的UE。如图7所示，假设源UE为UE1，目标UE为UE2，UPF通过N3接口收到UE1发往UE2的数据报文，经过第一次PDR匹配后获得UE1N4会话。对应的FAR指示将报文转发到5G VN Internal进入第二次PDR匹配获得UE2N4会话，对应的FAR指示将报文通过N3口转发到UE2。
又一可能场景，同一个5G VN group内的两个相互通信的UE不在同一个PSA UPF下。
在该场景下，可以通过N19接口完成数据接口。具体过程例如为：SMF在涉及到的PSA UPF上为该5G LAN group创建对应的组级别的N4会话，以启用N9转发和N6转发能力。当报文经过第一次匹配转发到UPF 5G VN Internal后，经过PDR规则匹配(基于 目的IP或条件为匹配所有(match-all)的默认规则等)最终可能匹配到组N4会话，对应的FAR指示报文通过N6发送到DN网络侧设备或通过N19发送到目的UE所在UPF上。如图7所示，假设源UE为UE1，目标UE为UE4，SMF在涉及到的PSA UPF上为该5G LAN group创建对应的组级别的N4会话，以启用N9转发和N6转发能力。当报文经过第一次匹配转发到UPF 5G VN Internal后，经过PDR规则匹配最终可能匹配到组N4会话(N4session for group)，对应的FAR指示报文通过N19发送到UE4所在UPF上。
上述结合两种场景进行了示例性说明，对此不作限定。
5G网络存在多个5G VN group的场景下，对于5G VN Internal报文，N4会话内的匹配、转发规则属性字段网络实例被赋值为5G VN group唯一标识符(如使用内部组标识(internal group ID))，用于指示该报文归属于指定的5G VN group。例如，对于目的接口被设置为5G VN Internal的FAR，其网络实例也相应的被设置为指定的5G VN group。又如，对于源接口被设置为5G VN group的PDR，其网络实例也相应的被设置为指定的5G VN group。
5、5G VN group管理。
5G系统支持通过操作维护管理(operation administration and maintenance，OAM)管理5G VN group，也支持通过AF与NEF交互完成5G VN group管理。5G VN group的管理主要包括创建、修改、删除5G VN group等。一个5G VN group可以包括但不限于以下一项或多项：5G VN group标识符、5G VN group成员关系、5G VN group数据。
(1)5G VN group标识符。5G VN group的标识包括外部组标识(external group ID)和internal group ID。其中，external group ID可由AF侧定义，唯一标识一个5G VN group。internal group ID可由移动网络侧UDM网元定义，在网络内部唯一标识一个5G VN group。external group ID到internal group ID的映射关系可在AF创建5G VN group时，由UDM自动生成internal group ID，并完成internal group ID与external group ID的映射。
(2)5G VN group成员关系。归属于同一个5G VN group的UE成员列表。每个成员通过其通用公共订阅标识(generic public subscription identifier，GPSI)唯一标识。
(3)5G VN group数据。5G VN group数据包含若干属性字段，用于定义一个5G VN group各个方面的参数，如：PDU会话类型、数据网络信息(如DNN)、切片信息(如网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI))，应用描述符(application descriptor)等。此外，5G VN group数据还可包含二次鉴权/授权相关的信息，如使能认证、授权、计费(authentication，authorization,and accounting，AAA)服务器(server)(如记为DN-AAA)进行IP地址分配等。
为了支持动态管理5G VN group，能力开放网元NEF对外开放了一系列接口(如：创建、修改、删除等)用于完成5G VN group、5G VN group成员以及5G VN group数据的管理。
6、能力开放。
为实现应用功能实体与运营商网络的协同处理，运营商网络通过NEF向应用功能实体开放部分网络能力，以支撑应用功能实体对用户实现更灵活的控制。当前支持开放的能力包括：允许AF通过NEF向网络侧订阅用户位置、终端可达性事件、连接状态、漫游状态、区域内终端数量等事件信息，以及通过NEF经由UDM或UDR或PCF向网络侧配置 下发参数配置请求、应用路由请求、业务授权请求等消息。此处结合5G LAN组管理场景，简单介绍AF通过网络能力开放进行5G VN group管理流程。
作为示例性说明，图8示出了AF配置管理5G VN group的示意图。
如图8所示，针对5G VN group管理场景，其过程如下。
(1)AF调用NEF开放的接口，实现对5G VN group的管理。
示例地，AF调用NEF开放的Nnef_ParameterProvision_Create/Update/Delete，实现对5G VN group的管理。其中，Nnef接口为NEF对外提供的服务化接口。
例如，AF可以向NEF发送Nnef接口参数准备创建(Nnef_ParameterProvision_Create)消息，以创建5G VN group。对于创建5G VN group的请求，AF可以携带external group ID用于唯一标识一个5G VN group。
又如，AF可以向NEF发送Nnef接口参数准备更新(Nnef_ParameterProvision_Update)消息，以更新或者说修改5G VN group。对于更新5G VN group请求，AF携带的信息可包含如下信息：external group ID和5G VN Group数据(即5G VN配置参数)(如表1所示)，或者，可以包含5G VN group成员管理参数(如表2所示)。
又如，AF可以向NEF发送Nnef接口参数准备删除(Nnef_ParameterProvision_Delete)消息，以要求NEF删除5G VN group。
表1. AF提供给NEF的5G VN group数据信息
Figure PCTCN2022081583-appb-000001
表2. 5G VN group成员管理参数
Figure PCTCN2022081583-appb-000002
Figure PCTCN2022081583-appb-000003
应理解，表1和表2仅是为便于理解做的示例性说明，对此不作限定。例如，关于5G VN group数据信息和5G VN group成员管理参数可以参考标准中的定义，或者在未来当对5G VN group数据信息或者5G VN group成员管理参数进行了调整，调整后的5G VN group数据信息和5G VN group成员管理参数也适用于本申请实施例。
(2)NEF根据AF的请求，请求UDM创建、更新、存储或删除对应的签约数据。
NEF收到已授权的AF请求后，NEF通过UDM提供的Nudm_ParameterProvision_Create/Update/Delete接口，请求UDM创建、更新、存储或删除对应的签约数据。其中，Nudm接口为UDM对外提供的服务化接口。
对于未授权的AF请求，NEF可直接通过第(6)步向AF返回响应，并告知失败原因。
(3)UDM发起数据查询。
UDM可通过UDR提供的Uudr_DM_Query接口发起数据查询，以完成对AF相应更新请求的相关检验与授权。
(4)UDM根据请求，进行处理。
例如，对于创建5G VN group请求，UDM为该请求分配一个internal group ID用于在移动网络内部唯一标识该5G VN group。UDM还可以通过UDR提供的Nudr_DM_Create接口将internal group ID发送给UDR。
又如，对于更新5G VN group请求，如5G VN group成员变更、5G VN group数据变动，UDM可根据AF请求，调用UDR提供的接口完成相应的信息变更。
对向UDM订阅了签约信息变更通知的网元，当对应的签约数据发生变更时，UDM将通知响应的网元。
(5)UDM向NEF发送响应。
即UDM响应NEF发送的Nudm_ParameterProvision_Create/Update/Delete请求。如果流程有错，则返回错误原因。
(6)NEF向AF发送响应。
即NEF响应AF发送的Nnef_ParameterProvision_Create/Update/Delete请求。如果流程有错，则返回错误原因。
应理解，上述仅是示例性说明，关于5G VN group的管理，本申请实施例不作限定。
上文为便于理解，简单介绍了本申请中涉及的术语，应理解，关于各个术语具体的含义，本申请实施例不作限定。例如，可以参考现有技术。
如前所述，在当前5G LAN技术中，通过5G VN group可以实现移动网络内通信设备的虚拟局域网互通。在设备互通安全方面，仅定义了以太网(Ethernet)场景下客户接入设备(customer provided equipment，CPE)或UE允许接入的设备媒体接入控制(medium access control，MAC)地址白名单。对于5G VN group内设备的互通权限没有做进一步的定义，缺少安全访问控制机制。
有鉴于此，本申请提供一种方法，即基于安全组的网络访问控制方法，如在5G LAN网络内基于安全组的网络访问控制。具体地，例如可以通过定义多个安全组，并分别配置安全组之间的通信策略(或者也可以说访问策略)，网络中的通信设备(如5G VN group 内的通信设备)分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。
下面将结合附图详细说明本申请提供的各个实施例。
图9是本申请实施例提供的一种安全通信的方法900的示意性交互图。方法900可以包括如下步骤。
910，接收第一通信设备发送给第二通信设备的业务数据的信息。
920，获取第一安全组与第二安全组之间的通信策略，第一安全组为第一通信设备对应的安全组，第二安全组为第二通信设备对应的安全组。
930，根据第一安全组与第二安全组之间的通信策略，为业务数据制定转发规则。
其中，第一通信设备和第二通信设备为同一个VN组内的设备，VN组中包括多个安全组，多个安全组包括第一安全组和第二安全组。
在本申请实施例中，为VN组创建多个安全组，任两个安全组之间具有通信策略，通信策略用于控制两个安全组对应的通信设备之间的安全通信。
第一安全组为第一通信设备对应的安全组，也可以理解为，第一安全组为源地址对应的安全组，或者说第一安全组为源地址所属的安全组。第二安全组为第二通信设备对应的安全组，也可以理解为，第二安全组为目的地址对应的安全组，或者说第二安全组为目的地址所属的安全组。地址，例如可以是MAC地址或者IP地址等等，对此不作限定。
在本申请实施例中，确定第一通信设备对应的安全组和第二通信设备对应的安全组之间的通信策略，或者说，确定业务数据的源地址归属的安全组与目的地址归属的安全组之间的通信策略，根据该通信策略来制定业务数据的转发规则，不仅可以提高设备之间通信的安全性，还可以便于管理。
在本申请实施例中，多次提及通信策略，通信策略，即表示通信的策略。在本申请实施例中，通信策略可以表示两个安全组之间通信的策略，或者也可以表示属于两个安全组内的设备或者地址之间通信的策略。
一种可能的设计，通信策略例如可以包括：允许通信(或者说允许访问)和禁止通信(或者说禁止访问)两种。当两个安全组之间的通信策略为允许通信(或者说允许访问)时，表示两个安全组之间可以相互通信或者说相互传输数据；当两个安全组之间的通信策略为禁止通信(或者说禁止访问)时，表示两个安全组之间可以禁止传输数据。
应理解，允许通信(或者说允许访问)和禁止通信(或者说禁止访问)仅是两种简单的通信策略，对此不作限定。只要定义了两个安全组之间相同通信的策略，都落入本申请实施例保护的范围。
还应理解，通信策略，例如也可以称为安全组策略，或者可以称为访问策略，或者可以称为访问权限，或者可以称为传输策略，等等，其命名不对本申请实施例的保护范围造成限定。
在本申请实施例中，多次提及制定转发规则，本领域技术人员应理解其含义。转发规则可以指示数据或报文的转发路径，或者在有些情况下，转发规则还可以指示丢弃数据或报文。
以第一安全组和第二安全组为例，假设第一安全组对应的通信设备向第二安全组对应的通信设备发送业务数据。作为示例，第一安全组和第二安全组之间的通信策略为允许通信的情况下，为该业务数据制定的转发规则可以用于指示该业务数据的转发路径；第一安 全组和第二安全组之间的通信策略为禁止通信的情况下，为该业务数据制定的转发规则可以用于指示丢弃该业务数据。
以第一网元执行方法900为例，结合第一网元的不同形式，下面介绍适用于本申请实施例的两种可能的方案。
方案1，第一网元为SMF，即由SMF执行安全组策略。
基于该方案1，SMF获取第一安全组与第二安全组之间的通信策略，并根据第一安全组与第二安全组之间的通信策略，为业务数据制定转发规则。
可选地，在该方案下，SMF向第二网元(如UPF)发送该业务数据的转发规则。第二网元(如UPF)接收到该业务数据的转发规则后，根据该业务数据的转发规则处理业务数据。
为便于理解，以允许通信和禁止通信为例。
一示例，第一安全组与第二安全组之间的通信策略为允许通信的情况下，SMF制定的业务数据的转发规则用于指示业务数据的转发路径，或者用于指示转发该业务数据。UPF接收到该业务数据的转发规则后，根据该转发规则，将业务数据发送给第二通信设备。
又一示例，第一安全组与第二安全组之间的通信策略为禁止通信的情况下，SMF制定的业务数据的转发规则用于指示丢弃该业务数据。UPF接收到该业务数据的转发规则后，根据该转发规则，丢弃或者忽略该业务数据。
可选地，SMF可以与UDM或DN-AAA交互，获取第一安全组与第二安全组之间的通信策略。
可选地，在该方案下，SMF还可以向第二网元(如UPF)发送指示信息，为区分，记为指示信息#1，该指示信息#1用于指示上报转发规则未知消息。这样，在第二网元(如UPF)收到转发规则未知的报文后，可以向SMF发送转发规则未知消息，以便SMF为该报文制定转发规则。
下文结合图13至图14所示的实施例，详细说明方案1。
方案2，第一网元为UPF，即由UPF执行安全组策略。
基于该方案2，UPF获取第一安全组与第二安全组之间的通信策略，并根据第一安全组与第二安全组之间的通信策略，确定该业务数据的转发规则。
可选地，在该方案下，UPF根据第一安全组与第二安全组之间的通信策略，确定该业务数据的转发规则，并根据该业务数据的转发规则处理业务数据。
为便于理解，以允许通信和禁止通信为例。
一示例，第一安全组与第二安全组之间的通信策略为允许通信的情况下，UPF将业务数据发送给第二通信设备。
又一示例，第一安全组与第二安全组之间的通信策略为禁止通信的情况下，UPF丢弃或者忽略该业务数据。
可选地，UPF可以本地读取第一安全组与第二安全组之间的通信策略，或者，UPF也可以从SMF处获取第一安全组与第二安全组之间的通信策略。
下文结合图15至图16所示的实施例，详细说明方案2。
上文简单介绍了两种可能的方案，下文结合图13至图16详细介绍。
可选地，第一网元可以判断是否存在第一安全组和第二安全组。
一可能的情况，第一网元判断存在第一安全组和第二安全组。在该情况下，第一网元可以根据第一安全组与第二安全组之间的通信策略，制定该业务数据的转发规则。
又一可能的情况，第一网元判断不存在第一安全组和/或第二安全组。在该情况下，第一网元可以根据业务数据的源地址和/或目的地址，制定该业务数据的转发规则。例如，业务数据的目的地址所属网段在DN侧，且不存在第二安全组，那么，当存在第一安全组的情况下，UPF向业务数据的目的地址转发业务数据，或，SMF向UPF发送业务数据的转发规则，业务数据的转发规则用于指示转发该业务数据；或者，当不存在第一安全组的情况下，UPF丢弃业务数据，或，SMF向UPF发送业务数据的转发规则，业务数据的转发规则用于指示丢弃业务数据。具体地，下文结合图15至图16所示实施例中的不同情况进行介绍。
可选地，在本申请实施例中，还提出了可以及时更新安全组，从而不仅可以提高资源利用率，还可以保证数据传输性能。
触发更新安全组的条件可以根据实际通信情况进行设置，对此不作限定。
一可能的触发条件，终端设备会话释放。
例如，终端设备会话释放，可以触发SMF向UPF发送指示，指示删除终端设备对应的全部转发规则。又如，终端设备会话释放，可以触发SMF向UPF发送指示，指示删除终端设备对应的安全组信息。
又一可能的触发条件，UPF学习到的地址老化。
例如，UPF学习到的地址老化，可以触发UPF删除该地址对应的全部转发规则。又如，UPF学习到的地址老化，可以触发UPF删除该地址所属的安全组信息。
又一可能的触发条件，SMF主动删除。
例如，SMF可以周期性地向UPF发送指示，指示删除指定地址的全部转发规则，或者指示删除指定地址所属的安全组信息。
上述几种可能的触发条件，仅是示例性说明，对此不作限定。
下文结合图17至图18所示实施例中详细介绍上述几种可能的触发条件。
图10是本申请实施例提供的一种安全通信的方法1000的示意性交互图。方法1000可以包括如下步骤。
1010，第三网元接收来自第四网元的第一请求消息，该第一请求消息用于请求为VN组创建安全组。
1020，第三网元基于第一请求消息，为VN组创建多个安全组。
其中，VN组中包括多个安全组，每个安全组对应一个或多个通信设备，多个安全组包括第一安全组，第一安全组和多个安全组中的其它安全组之间具有通信策略，通信策略用于控制第一安全组对应的通信设备与其它安全组对应的通信设备之间的通信。以多个安全组中的第二安全组为例。第一安全组和第二安全组之间具有通信策略，通信策略用于控制第一安全组对应的通信设备与第二安全组对应的通信设备之间的安全通信。
基于本申请实施例，在VN组中定义多个安全组，并且分别配置安全组之间的通信策略，网络中的通信设备(如VN组内的通信设备)分别加入相应的安全组，从而可以实现通信设备按组粒度进行访问控制。这样，不仅可以提高设备之间通信的安全性，还可以便于管理。
作为示例，第三网元例如可以为NEF，第四网元例如可以为AF。示例地，第三网元还可以向第五网元发送请求，以请求更新VN组签约数据。例如，第五网元为UDM/UDR，第三网元向UDM/UDR发送请求，以请求更新VN组签约数据。
应理解，关于第三网元、第四网元的具体形式，本申请实施例不作限定。
第一请求消息用于请求创建安全组。该第一请求消息中可以包括与待创建的安全组相关的信息。作为示例而非限定，第一请求消息中还可以包括以下一项或多项信息：待创建的安全组所属的VN组的外部标识、待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
示例1，第一请求消息中包括：待创建的安全组所属的VN组的外部标识。
在该示例下，第三网元可以根据该待创建的安全组所属的VN组的外部标识，确定需要为该VN组创建安全组，或者说确定创建的安全组所属的VN组。
在该示例下，关于如何获取安全组的具体信息不作限定。
例如，安全组的数量、安全组的名称等，可以是根据默认规则确定的。如默认在一个VN组中创建P个安全组(P为大于1的整数)，该P个安全组可以是按顺序编号，如安全组1，安全组2，安全组3，等等。
又如，安全组之间的通信策略可以是默认的。作为示例而非限定，可以预先约定或默认不同安全组之间不允许通信，同一安全组之间可以通信。
又如，第一请求消息中可以包括待创建的安全组的具体信息。如待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
示例2，第一请求消息中包括：待创建的安全组对应的数据网络。
在该示例下，第三网元根据该待创建的安全组对应的数据网络，可以确定待创建的安全组所属的归属的数据网络。
在该示例下，关于获取安全组的具体信息，可以参考示例1中的描述。
在该示例下，关于VN组的信息，可以是通过数据网络的信息查找，或者也可以是预先约定的，如预先约定为某个或某些特定VN组创建安全组。或者，也可以是第一请求消息中携带该VN组的信息。
在该示例下，关于安全组的具体信息，如安全组的数量、安全组的名称等，可以参考示例1中的描述。
示例3，第一请求消息中包括：待创建的安全组的标识或名称。
在该示例下，第三网元根据该待创建的安全组的标识或名称，可以确定创建哪些安全组。
在该示例下，关于获取安全组的其他信息，如安全组之间的通信策略，可以参考示例1中的描述。
在该示例下，关于VN组的信息，可以参考示例2中的描述。
示例4，第一请求消息中包括：待创建的安全组之间的通信策略。
在该示例下，第三网元根据该待创建的安全组之间的通信策略，可以确定创建哪些安全组，以及安全组之间的通信策略。
在该示例下，关于VN组的信息，可以参考示例2中的描述。
应理解，上述几种示例仅是示例性说明，对此不作限定，任何可以使得第三网元获取到与待创建的安全组相关的信息的方式，都适用于本申请实施例。
可选地，第三网元还可以接收来自第四网元的第二请求消息，第二请求消息用于请求为安全组添加一个或多个通信设备。
可以理解，该第二请求消息用于请求为安全组添加设备成员。该第二请求消息中可以包括与待添加设备的安全组相关的信息。作为示例而非限定，第二请求消息中包括以下一项或多项信息：待添加设备的安全组对应的数据网络、待添加设备的安全组所属的VN组的外部标识、待添加设备的安全组的标识、待添加设备的安全组的名称、待添加的通信设备的信息。
示例1，第二请求消息中包括：待添加设备的安全组所属的VN组的外部标识。
在该示例下，第三网元可以根据该待添加设备的安全组所属的VN组的外部标识，确定需要为该VN组中的安全组添加设备成员(即通信设备)，或者说确定要添加设备成员的安全组所属的VN组。
在该示例下，关于如何获取待添加的通信设备的具体信息不作限定。
例如，待添加的通信设备的数量等，可以是根据默认规则确定的。如默认在每个安全组中添加L个通信设备(L为大于1或等于1的整数)。
又如，第二请求消息中可以包括待添加的通信设备的相关信息。
示例2，第二请求消息中包括：待添加设备的安全组的标识或名称。
在该示例下，第三网元根据该待创建的安全组的标识或名称，可以确定在哪些安全组中添加通信设备。
在该示例下，关于获取待添加的通信设备的具体信息，可以参考示例1中的描述。
示例3，第二请求消息中包括：待添加的通信设备的信息。
在该示例下，第三网元根据待添加的通信设备，可以确定添加哪些通信设备。
在该示例下，关于在哪些安全组中添加通信设备不作限定。
例如，可以默认在某些安全组中添加通信设备。如默认在安全组标识最小的安全组中添加第二请求消息中的通信设备。或者，默认按照安全组标识顺序，依次在多个安全组中添加相同数量的通信设备，等等。
又如，第二请求消息中可以包括待添加的通信设备的相关信息。
应理解，上述几种示例仅是示例性说明，对此不作限定，任何可以使得第三网元获取到与待添加的通信设备的相关的信息的方式，都适用于本申请实施例。
下面将结合图11和图12，详细说明可适用于方法1000的具体流程。
为便于理解，以通信策略记为安全组策略，且安全组策略包括允许访问和禁止访问，为例，结合图11至图18介绍可能的具体流程进行示例性说明。应理解，下文中的VN组(VN group)可以是用于5G中的VN组，如下文中的VN组均可以替换为5G VN组。
首先，结合图11至图12介绍适用于本申请实施例的方法1000的可能的流程。
图11是适用于本申请实施例的安全通信的一示意性流程图。
如图11所示，方法1100主要以AF、NEF、UDM或UDR之间的交互为例进行示例性说明。在方法1100中，第三网元例如可以为NEF，第四网元例如可以为AF。作为示例而非限定，图11所示的方法1100可以用于创建安全组的流程。图11所示的方法1100可 以包括如下步骤。
1110，AF向NEF请求创建安全组。
AF可以调用NEF接口，通过NEF提供的能力开放接口向网络侧配置VN组安全组。例如，AF可以通过NEF向移动运营商网络提供安全组信息，以便创建VN组安全组。
示例地，AF可以向NEF提供以下一项或多项信息，以便创建安全组：DNN、external group ID、安全组列表、安全组策略列表。表3示例地列出了各项信息。
表3. AF提供给NEF的安全组信息
Figure PCTCN2022081583-appb-000004
其中，安全组列表每个表项可以包括如表4所示的参数，即安全组列表中可以包括但不限于：安全组标识(VN组内安全组唯一标识)和/或安全组名称。
安全组策略列表每个表项可以包括如表5所示的参数，即安全组策略列表中可以包括但不限于：安全组标识，和/或，安全组之间的访问权限(指示两个安全组之间是否可用互访)。
应理解，表5中的第一安全组和第二安全组，仅是为区分不同安全组做的命名，其名称不对本申请实施例的保护范围造成限定。还应理解，表5中以两个安全组为例进行了示例性说明，关于安全组的数量，本申请实施例不作限定。还应理解，表5以安全组标识来指示安全组，对此不作限定，例如可以是通过安全组名称来指示安全组。
表4.安全组列表
安全组列表 description
security group ID 安全组标识
security group name 安全组名称
表5.安全组策略列表
安全组策略列表 description
first security group ID 第一安全组标识
second security group ID 第二安全组标识
permission 权限，允许访问或禁止访问
1120，NEF向UDM/UDR请求添加安全组信息。
NEF接收到来自AF的安全组信息后，可以向UDM/UDR发送请求，将安全组信息配置保存到VN组签约数据中。UDM/UDR接收到安全组信息后，可以修改VN组签约数据，为VN组添加安全组信息。
基于上述方案，AF可以通过NEF提供的能力开放接口向网络侧配置VN组的安全组。
图12是适用于本申请实施例的安全通信的另一示意性流程图。
如图12所示，方法1200主要以AF、NEF、UDM或UDR之间的交互为例进行示例性说明。在方法1200中，第三网元例如可以为NEF，第四网元例如可以为AF。作为示例而非限定，图12所示的方法1200可以用于安全组添加设备成员的流程。图12所示的方法1200可以包括如下步骤。
1210，AF向NEF请求为安全组添加设备成员。
AF可以调用NEF接口，为指定安全组添加设备成员。例如，AF通过NEF向移动运营商网络提供安全组成员信息，以便为指定安全组添加设备成员。
示例地，AF可以向NEF提供以下一项或多项信息，以便添加设备成员：DNN、external group ID、安全组ID、设备成员列表。表6示例地列出了各项信息。
表6. AF提供给NEF的安全组成员信息
Figure PCTCN2022081583-appb-000005
其中，设备成员列表每个表项可以包括如表7所示的参数，即设备成员列表中可以包括但不限于以下一项或多项：GPSI、MAC地址(MAC address)、IP地址(IP address)。一般地，MAC address和IP address可以选择一个。
表7.设备成员列表
设备成员列表 description
GPSI 指示设备成员归属的终端设备
MAC address 指示设备成员的MAC地址
IP address 指示设备成员的IP地址
应理解，表7仅是一种示例性说明，对此不作限定，任何属于表7的变形，都落入本申请实施例的保护范围。例如，任何可以指示设备成员归属的终端设备的方式都适用于本申请实施例。
1220，NEF向UDM/UDR请求安全组添加成员列表。
NEF接收到来自AF的安全组成员信息后，可以向UDM/UDR发送请求，将安全组设备成员信息配置保存到VN组签约数据中。UDM/UDR接收到安全组成员信息后，可以修 改VN组签约数据，添加成员列表。
下面以MAC地址为例，列举一具体应用。
表8.安全组应用举例
Figure PCTCN2022081583-appb-000006
如表8示例所示，通过安全组管理及成员管理定义了安全组、安全组策略以及安全组内成员信息。MAC1、MAC4归属于安全组1，MAC2归属于安全组2，MAC3归属于安全组3；安全组1与安全组2之间允许通信，安全组1与安全组3禁止通通信，安全组2与安全组3允许通信，同一安全组内的成员默认允许通信。当MAC1向MAC2发送通信报文时通信被允许，MAC1向MAC3发送报文时通信被禁止，MAC1向MAC4发送报文时通信被允许。
基于上述方案，安全组成员管理定义VN组下通信设备MAC/IP归属的安全组。通信设备的安全组归属信息可保存在DN-AAA上，或者可以通过AF调用NEF配置到网络侧。当通信设备的安全组归属信息保存在DN-AAA上时，安全组成员管理可以由DN侧维护，在通信设备发起通信时，网络侧与DN-AAA交互获取设备归属的安全组信息，完成设备的通信权限控制。
下面，结合图13至图16介绍适用于本申请实施例的方法900的可能的流程。
图13是适用于本申请一实施例的安全组策略执行的一示意性流程图。
如图13所示，方法1300主要以设备、CPE/UE、RAN、AMF、SMF、UDM、DN-AAA、UPF、DN之间的交互为例进行示例性说明。在方法1300中，第一网元例如为SMF，第二网元例如为UPF。作为示例而非限定，图13所示的方法1300可以用于PDU会话类型为IP场景，通过SMF执行VN组的安全组策略，即SMF基于安全组策略制定转发规则，完成通信设备报文互通控制的流程。图13所示的方法1300可以包括如下步骤。
1310，SMF创建VN组会话。
关于触发SMF创建VN组会话的条件，本申请实施例不作限定。例如，对于5G LAN场景，完成5G LAN网络侧配置后，5G LAN终端(如CPE/UE)入网触发SMF创建5G VN组会话。作为示例而非限定，创建5G VN组会话的方式如步骤1311至1313。
1311，SMF向UDM请求5G VN组会话签约信息。
1312，UDM向SMF返回5G VN组会话签约信息。
其中，5G VN组会话签约信息中可以包括为5G VN组配置的安全组信息。配置的安全组信息，例如可以包括：配置的安全组(如安全组标识/名称等)、以及安全组策略。
1313，完成5G VN组会话创建。
SMF完成5G VN组会话创建，并在5G VN组会话中保存对应的安全组信息，如安全组列表(如安全组标识/名称等)和安全组策略信息。
应理解，上述仅是示例性说明，关于创建VN组会话的具体方式，本申请实施例不作限定。例如可以参考现有方式，或者未来任何可以实现创建VN组会话的方式都适用于本申请实施例。
1320，创建VN下的UE会话。
如前所述，VN下的UE可以建立一个或多个PDU会话，进而UE可以通过UE到DN之间建立的PDU会话，来访问DN。例如，UE可以通过UE到DN之间建立的PDU会话，通过UPF与DN之间交换业务数据报文。
应理解，上述步骤1310和步骤1320，并没有严格的先后顺序。例如，步骤1310和步骤1320可以同步进行。
示例地，UE发起PDU会话建立请求，SMF为会话选择UPF，即SMF选择择为该UE提供报文转发功能的UPF。
当该UPF还未建立VN组会话时，SMF可以先为该UPF建立VN组会话，当完成VN组会话创建后，SMF可以继续为UE创建PDU会话。或者当该UPF已建立VN组会话时，SMF为UE创建PDU会话。可以理解，SMF可以为每个UPF创建一个VN组会话。
应理解，上述仅是示例性说明，关于创建VN组会话的方式，以及创建UE会话的方式，可以参考现有流程，或者未来任何可以实现创建VN组会话、以及创建UE会话的方式都适用于本申请实施例。
1330，UPF收到业务数据报文，对源地址、目的地址进行规则匹配。
例如，UPF收到的业务数据报文可能是CPE/UE或者设备发送的上行数据包，或者也可能是DN侧网络发送的下行数据包，对此不作限定。UPF收到业务数据报文，可以通过对业务数据报文的源地址和目的地址进行规则匹配，以确定如何处理该业务数据报文。
UPF对业务数据报文的源地址和目的地址进行规则匹配，如果匹配失败，则执行图13(1)中的步骤1330a；如果匹配成功，则执行图13(2)中的步骤1330b，即根据匹配的转发规则对业务数据报文进行转发或丢弃。
步骤1330b：匹配成功的情况。UPF进行VN组会话匹配过程中，对业务数据报文的源地址和目的地址进行规则匹配，且匹配成功，那么可以根据匹配的转发规则对该业务数据报文进行转发或丢弃。关于具体的匹配以及转发，例如可以参考前面术语解释的内容，此处不再赘述。
下面结合图13(1)详细介绍步骤1330a。
步骤1330a：匹配失败的情况。如图13(1)所示，UPF收到业务数据报文，对业务数据报文的源地址和目的地址进行规则匹配失败的情况下，方法1300可以包括步骤1330a1和步骤1330a2。
1330a1，UPF向SMF上报报文转发规则未知消息。
该报文转发规则未知消息中例如可以包括但不限于以下一项或多项信息：DNN、VN组、源IP地址、目的IP地址、源IP地址所属的安全组。其中，DNN表示该消息归属的DNN。VN组表示该消息所属的VN组。源IP地址表示业务数据报文的源地址。目的IP 地址表示业务数据报文的目的地址。可选地，如果运营策略配置了DN侧下行隧道报文中携带源IP地址所属的安全组信息，则该报文未知转发规则消息中携带源IP地址所属的安全组的信息。
SMF根据接收到的上述信息，确定报文转发规则，即该业务数据报文的转发规则，并且向UPF下发该业务数据报文的转发规则。
1330a2，SMF向UPF下发报文转发规则。
也就是说，SMF向UPF下发该业务数据报文的转发规则，UPF根据该转发规则处理该业务数据报文。例如，报文转发规则包括转发该业务数据报文，那么UPF根据该报文转发规则，将该业务数据报文转发至目的地址。又如，报文转发规则包括丢弃该业务数据报文，那么UPF根据该报文转发规则，将该业务数据报文丢弃或者忽略。
下面结合不同情况详细介绍步骤1330a1和步骤1330a2。
情况1，在步骤1330a1中，UPF上报的报文转发规则未知消息中包括目的IP地址，且该目的IP地址为DN侧IP地址。
在该情况1下，SMF与UDM或DN-AAA交互，获取源IP地址所属的安全组信息。可选地，SMF还可以获取目的IP地址所属的安全组信息。
可选地，SMF可以判断是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，并且根据是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，确定是否执行安全组策略，即是否根据安全组策略来制定转发规则。
例如，如果SMF获取源IP地址所属的安全组和目的IP地址所属的安全组信息，那么SMF执行安全组策略检查。又如，如果SMF获取到目的IP地址所属的安全组信息，获取不到源IP地址所属的安全组，那么SMF缺少源IP地址归属的安全组信息，不对源IP地址和目的IP地址执行安全组策略检查。又如，如果SMF获取到源IP地址所属的安全组信息，获取不到目的IP地址所属的安全组，那么SMF缺少目的IP地址归属的安全组信息，不对源IP地址和目的IP地址执行安全组策略检查。
一可能的实现方式，安全组信息由移动运营商网络维护，SMF可以从UDM处获取源IP地址所属的安全组信息，即如果存在源IP地址所属的安全组，那么SMF与UDM交互可以获取到源IP地址所属的安全组信息。对于目的IP地址为DN侧地址的报文，UDM没有目的IP地址所属的安全组信息。因此，在该方式下，SMF不执行安全组策略。
又一可能的实现方式，安全组信息由DN-AAA维护，SMF可以从DN-AAA处获取源IP地址所属的安全组信息，即如果存在源IP地址所属的安全组，那么SMF与DN-AAA交互可以获取源IP地址所属的安全组信息。SMF是否通过DN-AAA获取目的IP地址所属的安全组信息，可以由运营商策略决定。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源IP地址所属的安全组信息或目的IP地址所属的安全组信息的方式，都适用于本申请实施例。
在该情况1下，结合两种场景说明步骤1330a2。
场景1，SMF对源IP地址和目的IP地址执行安全组策略检查。
如果SMF对源IP地址和目的IP地址执行安全组策略检查(如根据运营商策略，SMF对源IP地址和目的IP地址执行安全组策略检查)，则SMF根据获取到的源IP地址所属的安全组信息、目的IP地址所属的安全组信息，执行安全组策略，向UPF下发报文转发 规则，允许或禁止报文发出。
可选地，如果报文允许发出，隧道报文可以携带源IP地址所属的安全组信息。通过携带该源IP地址所属的安全组信息，可以供DN网络应用安全策略。示例地，是否携带源IP地址所属的安全组信息可以由运营策略而定。
以表7为例进行示例性说明。例如，假设源IP地址所属的安全组为安全组1，目的IP地址所属的安全组为安全组2，那么SMF可以向UPF下发报文转发规则，允许该业务数据报文从UPF N6口发出。又如，假设源IP地址所属的安全组为安全组1，目的IP地址所属的安全组为安全组3，那么SMF可以向UPF下发报文转发规则，禁止该业务数据报文从UPF N6口发出。
场景2，SMF不对源IP地址和目的IP地址执行安全组策略检查。
如果SMF不对源IP地址和目的IP地址执行安全组策略检查(如根据运营商策略，SMF不对源IP地址和目的IP地址执行安全组策略检查)，那么一种可能的实现方式，SMF还可以根据源IP地址是否为合法地址，向UPF下发报文转发规则，允许或禁止报文发出。
示例地，SMF可以根据是否存在源IP地址的安全组信息，确定源IP地址是否为合法地址。
例如，当SMF获取到源IP地址的安全组信息的情况下，SMF可以确定源IP地址为合法地址。此时，SMF可以向UPF下发报文转发规则，允许报文发出，如允许报文从UPF N6口发出。
又如，当SMF查询不到源IP地址的安全组信息的情况下，SMF可以确定源IP地址不是合法地址。此时，SMF可以向UPF下发报文转发规则，禁止报文发出，如禁止报文从UPF N6口发出。
可选地，如果报文允许发出，隧道报文可以携带源IP地址所属的安全组信息。通过携带该源IP地址所属的安全组信息，可以供DN网络应用安全策略。示例地，是否携带源IP地址所属的安全组信息可以由运营策略而定。
应理解，在上述场景2下，SMF判断源IP地址是否为合法地址仅是一种可能的实现方式，对此不作限定。例如，如果SMF不对源IP地址和目的IP地址执行安全组策略检查，那么也可以向UPF下发报文转发规则，禁止报文发出。
还应理解，情况1以UPF上报的报文转发规则未知消息中包括目的IP地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括目的IP地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
情况2，在步骤1330a1中，UPF上报的报文转发规则未知消息中包括源IP地址，且该源IP地址为DN侧IP地址。
在该情况2下，SMF与UDM或DN-AAA交互，获取目的IP地址所属的安全组信息。可选地，SMF还可以获取源IP地址所属的安全组信息。
可选地，SMF可以判断是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，并且根据是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，确定是否执行安全组策略。例如，如果SMF获取源IP地址所属的安全组和目的IP地址所属的安全组信息，那么SMF执行安全组策略检查。又如，如果SMF获取到目的IP地址所属的安全组信息，获取不到源IP地址所属的安全组，那么SMF缺少源IP地址归 属的安全组信息，不对源IP地址和目的IP地址执行安全组策略检查。又如，如果SMF获取到源IP地址所属的安全组信息，获取不到目的IP地址所属的安全组，那么SMF缺少目的IP地址归属的安全组信息，不对源IP地址和目的IP地址执行安全组策略检查。
一可能的实现方式，安全组信息由移动运营商网络维护，SMF可以从UDM处获取目的IP地址所属的安全组信息，即如果存在目的IP地址所属的安全组，那么SMF与UDM交互可以获取到目的IP地址所属的安全组信息。对于源IP地址为DN侧地址的报文，UDM没有源IP地址所属的安全组信息，如果运营策略中配置DN侧下行报文携带源IP地址所属的安全组信息，则UPF上报的报文转发规则未知消息中可能携带源IP地址所属的安全组信息。
又一可能的实现方式，安全组信息由DN-AAA维护，SMF可以从DN-AAA处获取目的IP地址所属的安全组信息，即如果存在目的IP地址所属的安全组，那么SMF与DN-AAA交互可以获取目的IP地址所属的安全组信息。如果运营策略中配置SMF通过DN-AAA获取源IP地址所属的安全组信息，那么SMF可以从DN-AAA处获取源IP地址所属的安全组信息。或者，如果UPF上报的报文转发规则未知消息中携带源IP地址所属的安全组信息，如运营策略中配置DN侧下行报文携带源IP地址所属的安全组信息，则UPF上报的报文转发规则未知消息中携带源IP地址所属的安全组信息，那么SMF可以从该报文转发规则未知消息中获取到源IP地址所属的安全组信息。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源IP地址所属的安全组信息或目的IP地址所属的安全组信息的方式，都适用于本申请实施例。
在该情况2下，结合两种场景说明步骤1330a2。
场景1，SMF对源IP地址和目的IP地址执行安全组策略检查。
如果SMF对源IP地址和目的IP地址执行安全组策略检查(如根据运营商策略，SMF对源IP地址和目的IP地址执行安全组策略检查)，则SMF根据获取到的源IP地址所属的安全组信息、目的IP地址所属的安全组信息，执行安全组策略，向UPF下发报文转发规则，允许或禁止报文发出。
以表7为例进行示例性说明。例如，假设源IP地址所属的安全组为安全组2，目的IP地址所属的安全组为安全组3，那么SMF可以向UPF下发报文转发规则，允许该业务数据报文从从UPF N6口发出。又如，假设源IP地址所属的安全组为安全组1，目的IP地址所属的安全组为安全组2，那么SMF可以向UPF下发报文转发规则，禁止该业务数据报文从从UPF N6口发出。
场景2，SMF不对源IP地址和目的IP地址执行安全组策略检查。
如果SMF不对源IP地址和目的IP地址执行安全组策略检查(如根据运营商策略，SMF不对源IP地址和目的IP地址执行安全组策略检查)，那么一种可能的实现方式，SMF还可以根据目的IP地址是否为合法地址，向UPF下发报文转发规则，允许或禁止报文发出。
示例地，SMF可以根据是否存在目的IP地址的安全组信息，确定目的IP地址是否为合法地址。
例如，当SMF获取到目的IP地址的安全组信息的情况下，SMF可以确定目的IP地址为合法地址。此时，SMF可以向UPF下发报文转发规则，允许报文发出，如允许报文 从UPF N6口发出。
又如，当SMF查询不到目的IP地址的安全组信息的情况下，SMF可以确定目的IP地址不是合法地址。此时，SMF可以向UPF下发报文转发规则，禁止报文发出，如禁止报文从UPF N6口发出。
应理解，在上述场景2下，SMF判断目的IP地址是否为合法地址仅是一种可能的实现方式，对此不作限定。例如，如果SMF不对源IP地址和目的IP地址执行安全组策略检查，那么也可以向UPF下发报文转发规则，禁止报文发出。
还应理解，情况2以UPF上报的报文转发规则未知消息中包括源IP地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括源IP地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
情况3，在步骤1330a1中，UPF上报的报文转发规则未知消息中包括源IP地址和目的IP地址，且该源IP地址和目的IP地址均为网络侧设备地址。
在该情况3下，SMF与UDM或DN-AAA交互，获取源IP地址所属的安全组信息以及目的IP地址所属的安全组信息。
可选地，SMF可以判断是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，并且根据是否存在源IP地址所属的安全组信息和目的IP地址所属的安全组信息，确定报文转发规则。
一可能的实现方式，安全组成员信息由移动运营商网络维护，SMF与UDM交互获取源IP地址所属的安全组信息以及目的IP地址所属的安全组信息。
又一可能的实现方式，安全组成员信息由DN-AAA维护，SMF与DN-AAA交互获取获取源IP地址所属的安全组信息以及目的IP地址所属的安全组信息。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源IP地址所属的安全组信息和目的IP地址所属的安全组信息的方式，都适用于本申请实施例。
在该情况3下，结合两种场景说明步骤1330a2。
场景1，源IP地址没有关联的安全组信息。
如果源IP地址没有关联的安全组信息，那么一种可能的实现方式，SMF向UPF下发报文转发规则，丢弃以源IP地址为源地址或目的地址的报文。
场景2，目的IP地址没有关联的安全组信息。
如果目的IP地址没有关联的安全组信息，那么一种可能的实现方式，SMF向UPF下发报文转发规则，丢弃以目的IP地址为源地址或目的地址的报文。
应理解，情况3以UPF上报的报文转发规则未知消息中包括源IP地址和目的IP地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括源IP地址和目的IP地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
还应理解，上述仅是示例性说明，对此不作限定。只要可以实现SMF可以执行本申请实施例的安全组策略的方案，都适用于本申请实施例。还应理解，在实际通信中，可以根据不同的通信环境或场景，灵活调整。
还应理解，在图13所示的场景中，源地址的形式可以为IP地址，上文源地址和源IP地址有时交替使用，应理解，其表示相同的含义，均用于表示发报文的地址或者说报文的源地址。在图13所示的场景中，目的地址的形式可以为IP地址，上文目的地址和目的IP 地址有时交替使用，应理解，其表示相同的含义，均用于表示报文的目的地址。
上文结合图13所示的步骤1310-1330示例地介绍了SMF执行安全组策略时的一可能流程，如PDU会话类型为IP的场景。应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
基于上述方案，对于PDU会话类型为IP场景，通过SMF执行VN组安全组策略，即由SMF根据安全组策略制定转发规则，完成通信设备报文互通控制，从而可以提高设备之间通信的安全性。
图14是适用于本申请一实施例的安全组策略执行的另一示意性流程图。
如图14所示，方法1400主要以设备、CPE/UE、RAN、AMF、SMF、UDM、DN-AAA、UPF、DN之间的交互为例进行示例性说明。在方法1400中，第一网元例如为SMF，第二网元例如为UPF。作为示例而非限定，图14所示的方法1400可以用于PDU会话类型为以太网(Ethernet)场景，通过SMF执行VN组安全组策略，即SMF基于安全组策略制定转发规则，完成通信设备报文互通控制的流程。图14所示的方法1400可以包括如下步骤。
1410，SMF创建VN组会话。
对于步骤1410，例如可以参考上述步骤1310的描述，此处不再介绍。
1420，创建VN下的UE会话。
对于步骤1420，例如可以参考上述步骤1320的描述，此处不再介绍。
UPF可能会从不同接口接收到报文，且接收到的报文类型可能不同。下面结合不同情况进行说明。
情况A，UPF N3接口收到上行报文，且该上行报文的源MAC地址未知。
也就是说，UPF从N3接口接收到来自UE的上行报文，且该上行报文的源MAC地址未知。在该情况下，方法1400还可以包括步骤1431和1432。
1431，UPF向SMF上报MAC地址学习消息。
例如，该MAC地址学习消息中可以包括以下一项或多项参数：DNN、VN组、UE SUPI、源MAC地址、N3接口。其中，DNN，表示MAC地址归属的DNN。VN组，表示MAC地址归属的VN组。UE SUPI，表示MAC地址所属CPE/UE。N3接口，指示MAC地址学习，地址来源接口。
SMF收到UPF上报的N3接口MAC地址学习消息后，可以将该MAC地址关联到对应的UE会话及对应的UPF。
1432，SMF将MAC地址关联到对应的UE会话及对应的UPF。
如果SMF的MAC地址学习列表中已学习到UPF上报的MAC地址，且和当前收到的UPF上报信息不一致，那么说明该MAC地址对应的设备可能发生了变动(如移动到其他UPF上，或移动到其他CPE/UE下等)。在该情况下，可以触发SMF主动老化UPF内该MAC地址的转发规则，并刷新SMF内对该MAC地址的学习。
情况B，UPF N6接口收到下行报文，且该下行报文的源MAC地址未知。
在该情况下，方法1400还可以包括步骤1441和1442。
1441，UPF向SMF上报MAC地址学习消息。
例如，该MAC地址学习消息中可以包括以下一项或多项参数：DNN、VN组、源MAC地址、N6接口。其中，DNN，表示MAC地址归属的DNN。VN组，表示MAC地址归属的VN组。N6接口，指示MAC地址学习，地址来源接口。
SMF收到UPF上报的N6接口MAC地址学习消息后，可以将该MAC地址关联到对应的DNN及VN组会话。
1442，SMF将MAC地址关联到对应的DNN及VN组会话。
如果SMF的MAC地址学习列表中已学习到UPF上报的MAC地址，且和当前收到的UPF上报信息不一致，那么说明该MAC地址对应的设备可能发生了变动(如从网络侧移动到DN网络侧)。在该情况下，可以触发SMF主动老化UPF内该MAC地址的转发规则，并刷新SMF内对该MAC地址的学习。
情况C，UPF收到业务数据报文，对源地址、目的地址进行规则匹配。
例如，UPF收到的业务数据报文可能是CPE/UE或者设备发送的上行数据包，或者也可能是DN侧网络发送的下行数据包，对此不作限定。UPF收到业务数据报文，可以通过对业务数据报文的源地址和目的地址进行规则匹配，以确定如何处理该业务数据报文。
UPF对业务数据报文的源地址和目的地址进行规则匹配，如果匹配失败，则执行图14(1)中的步骤1450a；如果匹配成功，则执行图14(2)中的步骤1450b，即根据匹配的转发规则对业务数据报文进行转发或丢弃。
步骤1450b：匹配成功的情况。UPF进行VN组会话匹配过程中，对业务数据报文的源地址和目的地址进行规则匹配，且匹配成功，那么可以根据匹配的转发规则对该业务数据报文进行转发或丢弃。关于具体的匹配以及转发，例如可以参考前面术语解释的内容，此处不再赘述。
下面结合图14(1)详细介绍步骤1450a。
步骤1450a：匹配失败的情况。如图14(1)所示，UPF收到业务数据报文，对业务数据报文的源地址和目的地址进行规则匹配失败的情况下，方法1400可以包括步骤1450a1和步骤1450a2。
1450a1，UPF向SMF上报报文转发规则未知消息。
该报文转发规则未知消息中例如可以包括但不限于以下一项或多项信息：DNN、VN组、源MAC地址、目的MAC地址、源MAC归属的安全组信息。其中，DNN表示该消息归属的DNN。VN组表示该消息所属的VN组。源MAC地址表示业务数据报文的源地址。目的MAC地址表示业务数据报文的目的地址。
SMF根据接收到的上述信息，确定报文转发规则，即该业务数据报文的转发规则，并且向UPF下发该业务数据报文的转发规则。
1450a2，SMF向UPF下发报文转发规则。
也就是说，SMF向UPF下发该业务数据报文的转发规则，UPF根据该转发规则处理该业务数据报文。例如，报文转发规则包括转发该业务数据报文，那么UPF根据该报文转发规则，将该业务数据报文转发至目的地址。又如，报文转发规则包括丢弃该业务数据报文，那么UPF根据该报文转发规则，将该业务数据报文丢弃或者忽略。
下面结合不同情况详细介绍步骤1450a1和步骤1450a2。
情况1，在步骤1450a1中，UPF上报的报文转发规则未知消息中包括目的MAC地址， 且该目的MAC地址为组播、广播地址。
可选地，SMF可以获取源MAC地址所属的安全组信息。
一可能的实现方式，源MAC地址为移动运营商网络侧地址，SMF与UDM或DN-AAA交互获取源MAC地址所属的安全组信息。例如，如果安全组成员信息由移动运营商网络维护，SMF与UDM交互获取源MAC地址所属的安全组信息。又如，如果安全组成员信息由DN-AAA维护，SMF与DN-AAA交互获取源MAC地址所属的安全组信息。
又一可能的实现方式，源MAC地址为DN侧地址，且安全组信息由移动运营商网络维护，则UDM缺少源MAC地址所属的安全组信息。该情况下，若运营商配置DN下行数据包隧道报文携带源MAC地址所属的安全组信息，那么UPF上报的报文转发规则未知消息中可能携带源MAC地址所属的安全组信息，SMF检查源MAC地址的合法性，否则SMF不检查源MAC地址的合法性。
又一可能的情况，源MAC地址为DN侧地址，且安全组信息由DN-AAA维护，则SMF与DNAAA交互获取源MAC地址归属的安全组信息，确定MAC地址的合法性。
应理解，上述实现方式仅是示例性说明，对此不作限定。
在该情况1下，SMF可以根据步骤1450a1检查源MAC地址合法性，根据运营配置的组播、广播转发策略，向UPF下发报文转发规则，允许或禁止报文发出。
应理解，情况1以UPF上报的报文转发规则未知消息中包括目的MAC地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括目的MAC地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
情况2，在步骤1450a1中，UPF上报的报文转发规则未知消息中包括目的MAC地址，且该目的MAC地址为DN侧地址。
在该情况2下，SMF与UDM或DN-AAA交互，获取源MAC地址所属的安全组信息。可选地，SMF还可以获取目的MAC地址所属的安全组信息。
可选地，SMF可以判断是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，并且根据是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，确定是否执行安全组策略，即是否根据安全组策略制定转发规则。例如，如果SMF获取源MAC地址所属的安全组和目的MAC地址所属的安全组信息，那么SMF执行安全组策略检查。又如，如果SMF获取到目的MAC地址所属的安全组信息，获取不到源MAC地址所属的安全组，那么SMF缺少源MAC地址归属的安全组信息，不对源MAC地址和目的MAC地址执行安全组策略检查。又如，如果SMF获取到源MAC地址所属的安全组信息，获取不到目的MAC地址所属的安全组，那么SMF缺少目的MAC地址归属的安全组信息，不对源MAC地址和目的MAC地址执行安全组策略检查。
一可能的实现方式，安全组信息由移动运营商网络维护，SMF可以从UDM处获取源MAC地址所属的安全组信息，即如果存在源MAC地址所属的安全组，那么SMF与UDM交互可以获取到源MAC地址所属的安全组信息。对于目的MAC地址为DN侧地址的报文，UDM没有目的MAC地址所属的安全组信息。因此，在该方式下，SMF不执行安全组策略。
又一可能的实现方式，安全组信息由DN-AAA维护，SMF可以从DN-AAA处获取源MAC地址所属的安全组信息，即如果存在源MAC地址所属的安全组，那么SMF与 DN-AAA交互可以获取源MAC地址所属的安全组信息。SMF是否通过DN-AAA获取目的MAC地址所属的安全组信息，可以由运营商策略决定。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源MAC地址所属的安全组信息或目的MAC地址所属的安全组信息的方式，都适用于本申请实施例。
在该情况2下，结合两种场景说明步骤1450a2。
场景1，SMF对源MAC地址和目的MAC地址执行安全组策略检查。
如果SMF对源MAC地址和目的MAC地址执行安全组策略检查(如根据运营商策略，SMF对源MAC地址和目的MAC地址执行安全组策略检查)，则SMF根据获取到的源MAC地址所属的安全组信息、目的MAC地址所属的安全组信息，执行安全组策略，向UPF下发报文转发规则，允许或禁止报文发出。
可选地，如果报文允许发出，隧道报文可以携带源MAC地址所属的安全组信息。通过携带该源MAC地址所属的安全组信息，可以供DN网络应用安全策略。示例地，是否携带源MAC地址所属的安全组信息可以由运营策略而定。
以表7为例进行示例性说明。例如，假设源MAC地址为MAC1，该MAC1所属的安全组为安全组1，目的MAC地址为MAC2，该MAC2所属的安全组为安全组2，那么SMF可以向UPF下发报文转发规则，允许该业务数据报文从UPF N6口发出。又如，假设源MAC地址为MAC1，该MAC1所属的安全组为安全组1，目的MAC地址为MAC3，该MAC3所属的安全组为安全组3，那么SMF可以向UPF下发报文转发规则，禁止该业务数据报文从UPF N6口发出。
场景2，SMF不对源MAC地址和目的MAC地址执行安全组策略检查。
如果SMF不对源MAC地址和目的MAC地址执行安全组策略检查(如根据运营商策略，SMF不对源MAC地址和目的MAC地址执行安全组策略检查)，那么一种可能的实现方式，SMF还可以根据源MAC地址是否为合法地址，向UPF下发报文转发规则，允许或禁止报文发出。
示例地，SMF可以根据是否存在源MAC地址的安全组信息，确定源MAC地址是否为合法地址。
例如，当SMF获取到源MAC地址的安全组信息的情况下，SMF可以确定源MAC地址为合法地址。此时，SMF可以向UPF下发报文转发规则，允许报文发出，如允许报文从UPF N6口发出。
又如，当SMF查询不到源MAC地址的安全组信息的情况下，SMF可以确定源MAC地址不是合法地址。此时，SMF可以向UPF下发报文转发规则，禁止报文发出，如禁止报文从UPF N6口发出。
可选地，如果报文允许发出，隧道报文可以携带源MAC地址所属的安全组信息。通过携带该源MAC地址所属的安全组信息，可以供DN网络应用安全策略。示例地，是否携带源MAC地址所属的安全组信息可以由运营策略而定。
应理解，在上述场景2下，SMF判断源MAC地址是否为合法地址仅是一种可能的实现方式，对此不作限定。例如，如果SMF不对源MAC地址和目的MAC地址执行安全组策略检查，那么也可以向UPF下发报文转发规则，禁止报文发出。
还应理解，情况2以UPF上报的报文转发规则未知消息中包括目的MAC地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括目的MAC地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
情况3，在步骤1450a1中，UPF上报的报文转发规则未知消息中包括源MAC地址，且该源MAC地址为DN侧地址。
在该情况3下，SMF与UDM或DN-AAA交互，获取目的MAC地址所属的安全组信息。可选地，SMF还可以获取源MAC地址所属的安全组信息。
可选地，SMF可以判断是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，并且根据是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，确定是否执行安全组策略。例如，如果SMF获取源MAC地址所属的安全组和目的MAC地址所属的安全组信息，那么SMF执行安全组策略检查。又如，如果SMF获取到目的MAC地址所属的安全组信息，获取不到源MAC地址所属的安全组，那么SMF缺少源MAC地址归属的安全组信息，不对源MAC地址和目的MAC地址执行安全组策略检查又如，如果SMF获取到源MAC地址所属的安全组信息，获取不到目的MAC地址所属的安全组，那么SMF缺少目的MAC地址归属的安全组信息，不对源MAC地址和目的MAC地址执行安全组策略检查。
一可能的实现方式，安全组信息由移动运营商网络维护，SMF可以从UDM处获取目的MAC地址所属的安全组信息，即如果存在目的MAC地址所属的安全组，那么SMF与UDM交互可以获取到目的MAC地址所属的安全组信息。对于源MAC地址为DN侧地址的报文，UDM没有源MAC地址所属的安全组信息，如果运营策略中配置DN侧下行报文携带源MAC地址所属的安全组信息，则UPF上报的报文转发规则未知消息中可能携带源MAC地址所属的安全组信息。
又一可能的实现方式，安全组信息由DN-AAA维护，SMF可以从DN-AAA处获取目的MAC地址所属的安全组信息，即如果存在目的MAC地址所属的安全组，那么SMF与DN-AAA交互可以获取目的MAC地址所属的安全组信息。如果运营策略中配置SMF通过DN-AAA获取源MAC地址所属的安全组信息，那么SMF可以从DN-AAA处获取源MAC地址所属的安全组信息。或者，如果UPF上报的报文转发规则未知消息中携带源MAC地址所属的安全组信息，如运营策略中配置DN侧下行报文携带源MAC地址所属的安全组信息，则UPF上报的报文转发规则未知消息中携带源MAC地址所属的安全组信息，那么SMF可以从该报文转发规则未知消息中获取到源MAC地址所属的安全组信息。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源MAC地址所属的安全组信息或目的MAC地址所属的安全组信息的方式，都适用于本申请实施例。
在该情况3下，结合两种场景说明步骤1450a2。
场景1，SMF对源MAC地址和目的MAC地址执行安全组策略检查。
如果SMF对源MAC地址和目的MAC地址执行安全组策略检查(如根据运营商策略，SMF对源MAC地址和目的MAC地址执行安全组策略检查)，则SMF根据获取到的源MAC地址所属的安全组信息、目的MAC地址所属的安全组信息，执行安全组策略，向UPF下发报文转发规则，允许或禁止报文发出。
以表7为例进行示例性说明。例如，假设源MAC地址为MAC2，该MAC2所属的安全组为安全组2，目的MAC地址为MAC3，该MAC3所属的安全组为安全组3，那么SMF可以向UPF下发报文转发规则，允许该业务数据报文从从UPF N6口发出。又如，假设源MAC地址为MAC1，该MAC1所属的安全组为安全组1，目的MAC地址为MAC2，该MAC2所属的安全组为安全组2，那么SMF可以向UPF下发报文转发规则，禁止该业务数据报文从从UPF N6口发出。
场景2，SMF不对源MAC地址和目的MAC地址执行安全组策略检查。
如果SMF不对源MAC地址和目的MAC地址执行安全组策略检查(如根据运营商策略，SMF不对源MAC地址和目的MAC地址执行安全组策略检查)，那么一种可能的实现方式，SMF还可以根据目的MAC地址是否为合法地址，向UPF下发报文转发规则，允许或禁止报文发出。
示例地，SMF可以根据是否存在目的MAC地址的安全组信息，确定目的MAC地址是否为合法地址。
例如，当SMF获取到目的MAC地址的安全组信息的情况下，SMF可以确定目的MAC地址为合法地址。此时，SMF可以向UPF下发报文转发规则，允许报文发出，如允许报文从UPF N6口发出。
又如，当SMF查询不到目的MAC地址的安全组信息的情况下，SMF可以确定目的MAC地址不是合法地址。此时，SMF可以向UPF下发报文转发规则，禁止报文发出，如禁止报文从UPF N6口发出。
应理解，在上述场景2下，SMF判断目的MAC地址是否为合法地址仅是一种可能的实现方式，对此不作限定。例如，如果SMF不对源MAC地址和目的MAC地址执行安全组策略检查，那么也可以向UPF下发报文转发规则，禁止报文发出。
还应理解，情况3以UPF上报的报文转发规则未知消息中包括源MAC地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括源MAC地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
情况4，在步骤1450a1中，UPF上报的报文转发规则未知消息中包括源MAC地址和目的MAC地址，目的MAC地址为单播地址，且该源MAC地址和目的MAC地址为网络侧设备地址。
在该情况4下，SMF与UDM或DN-AAA交互，获取源MAC地址所属的安全组信息以及目的MAC地址所属的安全组信息。
可选地，SMF可以判断是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，并且根据是否存在源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息，确定报文转发规则。
一可能的实现方式，安全组成员信息由移动运营商网络维护，SMF与UDM交互获取源MAC地址所属的安全组信息以及目的MAC地址所属的安全组信息。
又一可能的实现方式，安全组成员信息由DN-AAA维护，SMF与DN-AAA交互获取获取源MAC地址所属的安全组信息以及目的MAC地址所属的安全组信息。
上述两种实现方式仅是示例性说明，对此不作限定。只要SMF可以获取到源MAC地址所属的安全组信息和目的MAC地址所属的安全组信息的方式，都适用于本申请实施 例。
在该情况4下，结合两种场景说明步骤1450a2。
场景1，源MAC地址没有关联的安全组信息。
如果源MAC地址没有关联的安全组信息，那么一种可能的实现方式，SMF向UPF下发报文转发规则，丢弃以源MAC地址为源地址或目的地址的报文。
场景2，目的MAC地址没有关联的安全组信息。
如果目的MAC地址没有关联的安全组信息，那么一种可能的实现方式，SMF向UPF下发报文转发规则，丢弃以目的MAC地址为源地址或目的地址的报文。
应理解，情况4以UPF上报的报文转发规则未知消息中包括源MAC地址和目的MAC地址为例进行示例性说明，其并不限定该报文转发规则未知消息中只能包括源MAC地址和目的MAC地址，该报文转发规则未知消息中还可以包括其他信息，对此不作限定。
还应理解，上述仅是示例性说明，对此不作限定。只要可以实现SMF可以执行本申请实施例的安全组策略的方案，都适用于本申请实施例。还应理解，在实际通信中，可以根据不同的通信环境或场景，灵活调整。
还应理解，在图14所示的场景中，源地址的形式可以为MAC地址，上文源地址和源MAC地址有时交替使用，应理解，其表示相同的含义，均用于表示发报文的地址或者说报文的源地址。在图14所示的场景中，目的地址的形式可以为MAC地址，上文目的地址和目的MAC地址有时交替使用，应理解，其表示相同的含义，均用于表示报文的目的地址。
上文结合图14所示的步骤1410-1450示例地介绍了SMF执行安全组策略时的一可能流程，如PDU会话类型为Ethernet的场景。应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。例如，上述步骤1431和1432，可以与步骤1450可以同时存在，或者也可以单独存在。
基于上述方案，对于PDU会话类型为Ethernet场景，通过SMF执行VN组安全组策略，即由SMF根据安全组策略制定转发规则，完成通信设备报文互通控制，从而可以提高设备之间通信的安全性。
图15是适用于本申请另一实施例的安全组策略执行的一示意性流程图。
如图15所示，方法1500主要以设备、CPE/UE、RAN、AMF、SMF、UDM、DN-AAA、UPF、DN之间的交互为例进行示例性说明。在方法1500中，第一网元例如为UPF，第二网元例如为SMF。作为示例而非限定，图15所示的方法1500可以用于PDU会话类型为IP场景，通过UPF执行VN组安全组策略，即UPF基于安全组策略确定转发规则，完成通信设备报文互通控制的流程。图15所示的方法1500可以包括如下步骤。
1510，SMF创建VN组会话。
关于触发SMF创建VN组会话的条件，本申请实施例不作限定。例如，对于5G LAN场景，完成5G LAN网络侧配置后，5G LAN终端(如CPE/UE)入网触发SMF创建5G VN组会话。作为示例而非限定，创建5G VN组会话的方式如步骤1511至1513。
1511，SMF向UDM请求5G VN组会话签约信息。
1512，UDM向SMF返回5G VN组会话签约信息。
其中，5G VN组会话签约信息中可以包括为5G VN组配置的安全组信息。配置的安全组信息，例如可以包括：配置的安全组(如安全组标识/名称等)、以及安全组策略。
1513，完成5G VN组会话创建。
SMF完成5G VN组会话创建，并在5G VN组会话中保存对应的安全组信息(如安全组(如安全组标识/名称等)以及安全组策略)。
此外，SMF可以向UPF下发5G VN安全组信息，如安全组(如安全组标识/名称等)以及安全组策略。
应理解，上述仅是示例性说明，关于创建VN组会话的具体方式，本申请实施例不作限定。例如可以参考现有方式，或者未来任何可以实现创建VN组会话的方式都适用于本申请实施例。
1520，创建VN下的UE会话。
对于PDU会话类型为Ethernet类型的UE会话，SMF与UDM/DN-AAA交互获取UE IP地址对应的安全组信息。例如，如果安全组信息由移动运营商网络维护，SMF可以与UDM交互可以获取到UE IP地址所属的安全组信息。又如，如果安全组信息由DN-AAA维护，SMF可以与DN-AAA交互可以获取到UE IP地址所属的安全组信息。
在创建VN下的UE会话过程中，SMF可以向VN组下的全部UPF下发与该UE所属的安全组相关的信息，例如，可以包括但不限于以下一项或多项信息：UE SUPI、UE IP地址、安全组、UPF ID、UPF N19IP地址。其中，UE IP地址，指示为UE分配的IP地址。安全组，指示UE归属的安全组信息。UPF ID，指示UE当前接入的UPF。UPF N19IP地址，指示UE接入的UPF，其N19接口地址。
创建VN下的UE会话完成后，UE可以通过UE到DN之间建立的PDU会话，通过UPF与DN之间交换业务数据报文。
UPF接收到业务数据报文后，可以根据转发规则进行处理。下面结合不同情况进行说明。
情况1，UPF收到的业务数据报文的源地址和目的地址均为网络侧设备地址。
在该情况1下，方法1500还可以包括步骤1531。
1531，UPF根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理业务数据报文。
一种可能的实现方式，UPF可以根据源地址获取该源地址所属的安全组信息，根据目的地址获取该目的地址所属的安全组信息，并根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理业务数据报文。
以表7为例进行示例性说明。例如，假设源地址所属的安全组为安全组1，目的地址所属的安全组为安全组2，那么UPF根据安全组1与安全组2之间的安全组策略，转发该业务数据报文，即向目的地址转发该业务数据报文。又如，假设源地址所属的安全组为安全组1，目的地址所属的安全组为安全组3，那么UPF根据安全组1与安全组3之间的安全组策略，丢弃或忽略该业务数据报文，即不向目的地址转发该业务数据报文。
示例地，当查询不到源地址所属的安全组信息和目的地址所属的安全组信息中的任何一个的情况下，UPF可以直接丢弃该业务数据报文。应理解，对此不作限定。例如，当查询不到源地址所属的安全组信息和查询不到目的地址所属的安全组信息的情况下，可以根 据实际情况有不同的处理方式。
情况2，UPF收到的业务数据报文的目的地址所属网段在DN侧。
在该情况2下，方法1500还可以包括步骤1532。
1532，UPF将报文通过N6接口转发到DN网络。
UPF可以根据源地址索引该源地址所属的安全组信息。UPF通过N6接口发往DN侧的隧道报文可以携带源地址所属的安全组信息，从而可供DN网络应用安全策略。示例地，UPF发往DN侧的隧道报文是否携带源地址所属的安全组信息，可以由运营策略而定，对此不作限定。
情况3，UPF收到的业务数据报文的源地址所属网段在DN侧。
在该情况3下，方法1500还可以包括步骤1533。
1533，UPF根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，或者根据运营商策略，处理业务数据报文。
一种可能的实现方式，UPF根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理业务数据报文。如果下行隧道报文携带了源地址对应的安全组信息，UPF可以根据目的地址索引该目的地址所属的安全组信息，并根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理业务数据报文，如丢弃报文或转发报文。
或者，一种可能的实现方式，UPF根据运营商策略处理业务数据报文。如果运营商策略是对下行报文不做安全组策略控制，那么UPF可以直接转发报文。
应理解，上述仅是示例性说明，对此不作限定。只要可以实现UPF可以执行本申请实施例的安全组策略的方案，都适用于本申请实施例。还应理解，在实际通信中，可以根据不同的通信环境或场景，灵活调整。
还应理解，在图15所示的场景中，源地址的形式可以为IP地址，上文源地址和源IP地址有时交替使用，应理解，其表示相同的含义，均用于表示发报文的地址或者说报文的源地址。在图15所示的场景中，目的地址的形式可以为IP地址，上文目的地址和目的IP地址有时交替使用，应理解，其表示相同的含义，均用于表示报文的目的地址。
上文结合图15所示的步骤1510-1533示例地介绍了UPF执行安全组策略时的一可能流程，如PDU会话类型为IP的场景。应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
基于上述方案，对于PDU会话类型为IP场景，通过UPF执行VN组安全组策略，即由UPF根据安全组策略确定转发规则，完成通信设备报文互通控制，从而可以提高设备之间通信的安全性。此外，通过UPF来执行安全组策略，还可以节省UPF向SMF询问转发规则带来的信令开销，提高数据传输性能。
图16是适用于本申请另一实施例的安全组策略执行的另一示意性流程图。
如图16所示，方法1600主要以设备、CPE/UE、RAN、AMF、SMF、UDM、DN-AAA、UPF、DN之间的交互为例进行示例性说明。在方法16500中，第一网元例如为UPF，第二网元例如为SMF。作为示例而非限定，图16所示的方法1600可以用于PDU会话类型为Ethernet场景，通过UPF执行VN组安全组策略，即UPF基于安全组策略确定转发规则，完成通信设备报文互通控制的流程。图16所示的方法1600可以包括如下步骤。
1610，SMF创建5VN组会话。
对于步骤1610，例如可以参考上述步骤1510的描述，此处不再介绍。
1620，创建VN下的UE会话。
对于步骤1620，例如可以参考上述步骤1520的描述，此处不再介绍。
UPF可能会从不同接口接收到报文，且接收到的报文类型可能不同。下面结合不同情况进行说明。
情况1，UPF N3接口收到上行报文，且该上行报文的源MAC地址未知。
在该情况1下，对于PDU类型为Ethernet的VN组，UPF从N3接口接收到来自UE的上行报文，且该上行报文的源MAC地址未知。在该情况下，方法1600还可以包括步骤1631至1633。
1631，UPF向SMF上报MAC地址未知消息。
例如，该MAC地址未知消息中可以包括以下一项或多项参数：DNN、VN组、UE SUPI、源MAC地址。其中，DNN，表示MAC地址归属的DNN。VN组，表示MAC地址归属的VN组。UE SUPI，表示MAC地址所属CPE/UE。
1632，SMF获取MAC地址所属的安全组信息。
SMF收到UPF上报的N3接口收到MAC地址未知消息后，SMF获取MAC地址所属的安全组信息。
例如，如果安全组信息由移动运营商网络维护，那么SMF与UDM交互，获取MAC地址所属的安全组信息。又如，如果安全组信息由DN-AAA维护，那么SMF与DN-AAA交互，获取MAC地址所属的安全组信息。
SMF查询到MAC地址所属的安全组信息后，可以向UPF下发MAC地址所属的安全组信息。
1633，SMF向UPF下发MAC地址所属的安全组信息。
示例地，SMF可以将查询到的与MAC地址所属的安全组相关的信息，下发到VN组下的全部的UPF上，例如，可以包括但不限于以下一项或多项信息：DNN、VN组、MAC地址、安全组ID、UPF ID、N19 address。其中，DNN，指示MAC地址归属的DNN。VN组，指示MAC地址归属的VN组。安全组ID，指示MAC地址归属的安全组。UPF ID，指示当前MAC归属的UPF。N19 address，指示UPF N19接口地址。
情况2，UPF收到的报文的目的地址为广播地址或组播地址。
在该情况2下，如果是上行报文，方法1600还可以包括步骤1641。
1641，UPF根据源地址所属的安全组信息，处理报文。
如果是上行报文，则UPF获取源MAC地址所属的安全组信息，并根据运营商配置的策略决定转发或丢弃报文。如果UPF获取源MAC地址所属的安全组信息失败，那么示例地，UPF可以丢弃报文。
在该情况2下，如果是下行报文，方法1600还可以包括步骤1642。
1642，UPF根据源地址所属的安全组信息或者运营商策略，处理报文。
如果是下行报文，如果运营商配置了下行隧道报文中携带源MAC地址所属的安全组信息，则UPF检查安全组信息合法性，并根据运营商配置的策略决定转发或丢弃报文。否则UPF不检查下行报文源MAC地址合法性，根据运营商配置的策略决定转发或丢弃报 文。
情况3，UPF收到的报文的源地址和目的地址均为网络侧设备地址。
在该情况3下，方法1600还可以包括步骤1651。
1651，UPF根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理报文。
UPF可以查找源地址所属的安全组和目的地址所属的安全组，并根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，处理报文，如转发或丢弃报文。
情况4，UPF收到下行报文，且目的地址为单播地址，且未知。
在该情况4下，方法1600还可以包括步骤1661。
1661，UPF丢弃报文。
情况5，UPF收到上行报文，且目的地址为单播地址，且未知。
在该情况5下，方法1600还可以包括步骤1671。
1671，UPF将报文发送到DN。
示例地，报文通过N6接口发送到DN网络，隧道报文可以携带源地址所属的安全组信息，以便DN网络应用安全策略。其中，隧道报文是否携带源地址所属的安全组信息，例如可以由运营策略而定，对此不作限定。
情况6，UPF收到的报文的源地址为DN侧地址。
在该情况6下，方法1600还可以包括步骤1681。
1681，UPF根据源地址所属的安全组和目的地址所属的安全组之间的安全组策略，或者，根据运营商策略，处理报文将报文发送到DN。
示例地，如果下行隧道报文携带了源MAC地址所属的安全组信息(如根据运营商策略，下行隧道报文携带源地址对应的安全组信息)，那么UPF可以查找目的MAC地址所属的安全组信息，并根据源MAC地址所属的安全组和目的MAC地址所属的安全组之间的安全组策略，处理报文，如决定转发或丢弃报文。
或者，如果运营商策略是对下行报文不做安全组策略控制，则也可以直接转发报文。
应理解，上述仅是示例性说明，对此不作限定。只要可以实现UPE可以执行本申请实施例的安全组策略的方案，都适用于本申请实施例。还应理解，在实际通信中，可以根据不同的通信环境或场景，灵活调整。
还应理解，在图16所示的场景中，源地址的形式可以为MAC地址，上文源地址和源MAC地址有时交替使用，应理解，其表示相同的含义，均用于表示发报文的地址或者说报文的源地址。在图16所示的场景中，目的地址的形式可以为MAC地址，上文目的地址和目的MAC地址有时交替使用，应理解，其表示相同的含义，均用于表示报文的目的地址。
上文结合图16所示的步骤1610-1681示例地介绍了UPF执行安全组策略时的一可能流程，如PDU会话类型为Ethernet的场景。应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
基于上述方案，对于PDU会话类型为IP场景，通过UPF执行VN组安全组策略，即由UPF根据安全组策略确定转发规则，完成通信设备报文互通控制，从而可以提高设备 之间通信的安全性。此外，通过UPF来执行安全组策略，还可以节省UPF向SMF询问转发规则带来的信令开销，提高数据传输性能。
上文结合图13至图16介绍了适用于本申请实施例的安全组策略执行的可能流程。下面结合图17和图18介绍用于本申请实施例的关于安全组更新的示意性流程。
图17是适用于本申请实施例的安全组更新的一示意性流程图。
如图17所示，方法1700主要以设备、CPE/UE、RAN、AMF、SMF、UDM、UPF之间的交互为例进行示例性说明。作为示例而非限定，图17所示的方法1700可以用于UPF安全组策略对应的转发规则老化的流程。
下面结合触发删除转发规则(如安全组策略对应的转发规则)的可能的条件，介绍UPF转发规则老化的流程。
条件1，CPE/UE会话释放，触发删除CPE/UE对应的全部转发规则。
基于该条件1，方法1700可以包括步骤1711-1713。
1711，CPE/UE向SMF请求释放CPE/UE会话。
1712，SMF向UPF下发转发规则删除指示，指示UPF删除CPE/UE对应的转发规则。
示例地，SMF可以向VN组下全部UPF下发转发规则删除指示，指示UPF删除CPE/UE下全部MAC/IP地址对应的全部转发规则。例如，SMF向UPF下发的转发规则删除指示，可以用于指示UPF删除CPE/UE下全部MAC/IP地址对应的安全组。UPF收到该指示后，可以删除CPE/UE下全部MAC/IP地址对应的全部转发规则。
1713，完成CPE/UE会话释放。
应理解，上述仅是示例性说明，关于CPE/UE会话释放的具体方式，本申请实施例不作限定。例如可以参考现有方式，或者未来任何可以实现CPE/UE会话释放的方式都适用于本申请实施例。
条件2，UPF学习到的MAC地址老化，触发删除MAC地址对应的全部转发规则。
对于PDU会话类型为Ethernet的场景，UPF学习到的MAC地址到达老化时间，可以触发MAC地址老化。基于该条件2，方法1700可以包括步骤1721-1723。
1721，MAC地址老化时间超时触发UPF老化学习到的MAC地址。
关于MAC地址的老化时间，本申请实施例不作严格限定。例如，可以由运营商配置MAC地址的老化时间。又如，不同MAC地址对应的老化时间可以相同也可以不同，对此不作限定。
1722，UPF删除被老化的MAC地址对应的全部转发规则。
1723，UPF向SMF上报MAC地址老化消息。
下面结合两种情况来说，
情况1，被老化的MAC地址来源于UPF N3接口。
在该情况下，UPF向SMF上报的MAC地址老化消息可以包括以下一项或多项信息：DNN、VN组、被老化的MAC地址、N3接口。其中，DNN，指示被老化的MAC地址归属的DNN。VN组，指示被老化的MAC地址所属的VN组。N3接口，指示被MAC地址来源于N3接口。
在该情况1下，方法1700还可以包括步骤17231。
17231，SMF解除MAC地址与CPE/UE会话以及MAC地址与UPF的关联关系。
SMF收到UPF上报的MAC地址老化消息后，SMF可以根据MAC地址索引其关联的CPE/UE会话，SMF可以解除该MAC地址与CPE/UE会话以及MAC地址与UPF的关联关系。
情况2，被老化的MAC地址来源于UPF N6接口。
在该情况下，UPF向SMF上报的MAC地址老化消息可以包括以下一项或多项信息：DNN、VN组、被老化的MAC地址、N6接口。其中，DNN，指示被老化的MAC地址归属的DNN。VN组，指示被老化的MAC地址所属的VN组。N6接口，指示被MAC地址来源于N6接口。
在该情况2下，方法1700还可以包括步骤17232。
17232，SMF解除MAC地址与DNN及组会话的关联关系。
SMF收到UPF上报的MAC地址老化消息后，SMF可以根据MAC地址索引其关联的VN组会话，SMF解除该MAC地址与DNN及组会话的关联关系。
条件3，SMF主动删除转发规则。
关于SMF删除转发规则的触发条件不作限定。例如，可以是周期性地主动删除转发规则。
基于该条件3，方法1700可以包括步骤1731。
1731，SMF向UPF下发MAC/IP地址转发规则删除指示，指示UPF删除指定MAC/IP地址的全部转发规则。
例如，SMF可以向VN组内全部UPF下发指定的MAC/IP地址转发规则删除指示，指示UPF删除指定MAC/IP地址的全部转发规则。例如可以通过携带MAC/IP的标识以指示将删除转发规则的MAC/IP地址。
应理解，上述仅是示例性说明，对此不作限定。
作为示例而非限定，上述方法1700可以用于SMF执行安全组策略的场景。例如，方法1700可以与方法1300(或方法1400)结合使用，如SMF可以根据如方法1300(或方法1400)所述的方案执行安全组策略，SMF或者UPF可以根据如方法1700所述的方案及时删除老化的转发规则(如SMF基于安全组策略对应的转发规则)。
应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
基于上述方案，转发规则老化后(如安全组策略对应的转发规则老化)，可以及时删除老化的转发规则，不仅可以节省存储空间，提高资源利用率，还可以及时更新转化规则(如及时更新安全组策略)，提高通信性能。
图18是适用于本申请实施例的安全组更新的另一示意性流程图。
如图18所示，方法1800主要以设备、CPE/UE、RAN、AMF、SMF、UDM、UPF之间的交互为例进行示例性说明。作为示例而非限定，图18所示的方法1800可以用于UPF老化设备所属的安全组的流程。
下面结合触发删除安全组的可能的条件，介绍UPF老化设备所属的安全组的流程。
条件1，CPE/UE会话释放，触发删除CPE/UE对应的安全组信息。
基于该条件1，方法1800可以包括步骤1811-1813。
1811，CPE/UE向SMF请求释放CPE/UE会话。
1812，SMF向UPF下发安全组信息删除指示，指示UPF删除CPE/UE对应的安全组信息。
示例地，SMF可以向VN组下全部UPF下发安全组信息删除指示，指示UPF删除CPE/UE下全部MAC/IP地址对应的安全组信息。
1813，完成CPE/UE会话释放。
应理解，上述仅是示例性说明，关于CPE/UE会话释放的具体方式，本申请实施例不作限定。例如可以参考现有方式，或者未来任何可以实现CPE/UE会话释放的方式都适用于本申请实施例。
条件2，UPF学习到的MAC地址老化，触发删除MAC地址所属的安全组信息。
对于PDU会话类型为Ethernet的场景，UPF学习到的MAC地址到达老化时间，可以触发MAC地址老化。基于该条件2，方法1800可以包括步骤1821-1824。
1821，MAC地址老化时间超时触发UPF老化学习到的MAC地址。
一种可能的实现方式，UPF老化学习到的MAC地址，例如可以理解为UPF删除与该MAC地址关联的信息，如删除与该MAC地址对应的转发规则。
关于MAC地址的老化时间，本申请实施例不作严格限定。例如，可以由运营商配置MAC地址的老化时间。又如，不同MAC地址对应的老化时间可以相同也可以不同，对此不作限定。
1822，UPF向SMF上报MAC地址老化消息。
UPF向SMF上报的MAC地址老化消息可以包括以下一项或多项信息：DNN、VN组、被老化的MAC地址、UE SUPI。其中，DNN，指示被老化的MAC地址所属的DNN。VN组，指示被老化的MAC地址所属的VN组。UE SUPI，指示被老化的MAC地址所属的UE会话。
1823，SMF向UPF下发指示删除MAC地址所属的安全组信息。
UPF收到该指示后，可以根据指示删除MAC地址所属的安全组信息。
示例地，SMF收到UPF上报的MAC地址老化消息后，可以向VN组下的全部UPF下发指示删除MAC地址所属的安全组信息的信息，该信息用于指示UPF删除指定MAC地址所属的安全组信息。
应理解，上述仅是示例性说明，对此不作限定。
作为示例而非限定，上述方法1800可以用于UPF执行安全组策略的场景。例如，方法1800可以与方法1500(或方法1600)结合使用，如UPF可以根据如方法1500(或方法1600)所述的方案执行安全组策略，SMF或者UPF可以根据如方法1800所述的方案及时老化的安全组信息。
应理解，上述各个步骤仅是示例性说明，对此不作严格限定。此外，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
基于上述方案，安全组信息老化后(如MAC地址或IP地址对应的安全组信息老化)，可以及时删除老化的安全组信息，不仅可以节省存储空间，提高资源利用率，还可以及时更新安全组信息，提高通信性能。
应理解，在上述一些实施例中，涉及到一些消息名称，如报文转发规则未知消息等等，应理解，其命名不对本申请实施例的保护范围造成限定。
还应理解，在上述一些实施例中，主要以通信策略包括允许访问和禁止访问为例进行了示例性说明，应理解，其他形式的通信策略，都适用于本申请实施例。
还应理解，在上述一些实施例中，多次提及执行安全组策略，其表示根据安全组之间的通信策略来确定转发规则，或者说在制定转发规则时考虑安全组策略。
还应理解，在上述一些实施例中，主要以为5G VN组定义安全组为例进行了示例性说明，应理解，其他VN组，如6G架构下的VN组，也可以使用本申请实施提供的基于安全组进行安全通信。
还应理解，在上述一些实施例中，主要以SMF或UPF在收到业务数据后，根据安全组之间都通信策略制定转发规则为例进行的说明，对此不作限定，任何通过安全组之间的通信策略执行转发规则的方案，都适用于本申请实施例。
一可能的实现方式，SMF获取到安全组的信息后，可以为UE制定转发规则，即UE与其他群组成员之间的数据是如何转发(或丢弃)的，或者UE与其他安全组对应的UE之间的数据的如何转发(或丢弃)。例如，SMF获取到安全组的信息后，根据UE所在的安全组与其他安全组之间的通信策略生成转发规则(如PDR和FAR)，并将制定的转发规则(如PDR和FAR)发送给UPF，从而UPF可以根据该转发规则(如PDR和FAR)执行数据的转发。下面，以UE、SMF和UPF为例，简单列举一具体示例。
SMF接收到来自UE1的会话建立请求，会话建立请求中包括VN组的标识。假设UE1为VN组中第一安全组中的设备。SMF根据该第一安全组和VN组中的其它安全组之间的通信策略，为UE1制定转发规则，并且向UPF发送为该UE1制定的转发规则。
一可能的情况，第一安全组与第二安全组之间的通信策略为允许通信。在该情况下，转发规则用于指示第一数据的转发路径。该第一数据为UE1和UE2之间交互的数据，其中，UE1归属于第一安全组，UE2为归属于第二安全组的任何一个VN群组成员。
又一可能的情况，第一安全组与第二安全组之间的通信策略为禁止通信。在该情况下，转发规则用于指示丢弃第一数据。该第一数据为UE1和UE2之间交互的数据，其中，UE1归属于第一安全组，UE2为归属于第二安全组的任意一个成员，且UE2与UE1均属于同一个VN组。
UPF在收到UE1发送的数据后，可以根据UE1对应的转发规则，执行数据的转发。
一可能的情况，第一安全组与第二安全组之间的通信策略为允许通信。在该情况下，UPF可以根据该转发规则指示的转发路径，转发该数据。
又一可能的情况，第一安全组与第二安全组之间的通信策略为禁止通信。在该情况下，UPF可以根据该转发规则，丢弃或忽略UE1发送给UE2的数据。
应理解，上述仅为示例性说明，具体地，如SMF如何根据安全组之间的通信策略制定转发规则，等等，可以参考上文的描述。
还应理解，上述方案可以与图9至图18中的任一方案单独使用，或者也可以结合使用。
一示例，以上述方案与图13所示的方案结合使用为例。SMF可以为UE制定转发规则，并且将该转发规则发送给UPF。UPF收到UE发送的数据后，可以基于数据报文的源地址和目的地址进行规则匹配，当匹配失败的情况下，可以执行方法1300中的步骤1330a的方案；当匹配成 功的情况下，可以执行方法1300中的步骤1330b的方案，即基于转发规则处理数据。
又一示例，以上述方案与图15所示的方案结合使用为例。SMF可以为UE制定转发规则，并且将该转发规则发送给UPF。UPF收到UE发送的数据后，可以基于数据报文的源地址和目的地址进行规则匹配，当匹配失败的情况下，可以基于方法1500的方案，基于该数据的源地址和目的地址对应的安全组之间的通信策略，确定如何处理数据。
又一示例，以上述方案与图17或图18所示的方案结合使用为例。SMF可以为UE制定转发规则，并且将该转发规则发送给UPF。UPF收到UE发送的数据后，可以基于数据报文的源地址和目的地址进行规则匹配。并且也可以基于如方法1700或方法1800所示的方案，及时更新安全组。
本文中描述的各个实施例可以为独立的方案，也可以根据内在逻辑进行组合，这些方案都落入本申请的保护范围中。
可以理解的是，上述各个方法实施例中，由终端设备实现的方法和操作，也可以由可用于终端设备的部件(例如芯片或者电路)实现，由网络设备(如核心网网元)实现的方法和操作，也可以由可用于网络设备的部件(例如芯片或者电路)实现。
以上，结合图9至图18详细说明了本申请实施例提供的方法。以下，结合图19至图21详细说明本申请实施例提供的安全通信的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
图19是本申请实施例提供的安全通信的装置的示意性框图。该装置1900包括收发单元1910和处理单元1920。收发单元1910可以实现相应的通信功能，处理单元1920用于进行数据处理。收发单元1910还可以称为通信接口或通信单元。
可选地，该装置1900还可以包括存储单元，该存储单元可以用于存储指令和/或数据，处理单元1920可以读取存储单元中的指令和/或数据，以使得装置实现前述方法实施例。
该装置1900可以用于执行上文方法实施例中网络设备所执行的动作，这时，该装置1900可以为网络设备或者可配置于网络设备的部件，收发单元1910用于执行上文方法实施例中网络设备侧的收发相关的操作，处理单元1920用于执行上文方法实施例中网络设备侧的处理相关的操作。
一种可能的实现方式，收发单元1910，用于接收第一通信设备发送给第二通信设备的业务数据的信息；收发单元1910，还用于获取第一安全组与第二安全组之间的通信策略，第一安全组为第一通信设备对应的安全组，第二安全组为第二通信设备对应的安全组；处理单元1920，用于根据第一安全组与第二安全组之间的通信策略，为业务数据制定转发规则；其中，其中，第一通信设备和第二通信设备为同一个虚拟网络VN组内的设备，VN组中包括多个安全组，多个安全组包括第一安全组和第二安全组。
一示例，第一安全组与第二安全组之间的通信策略为允许通信，或者，第一安全组与第二安全组之间的通信策略为禁止通信。
又一示例，第一网元为会话管理功能网元。
又一示例，第一安全组与第二安全组之间的通信策略为允许通信的情况下，转发规则用于指示业务数据的转发路径；或者；第一安全组与第二安全组之间的通信策略为禁止通信的情况下，转发规则用于指示丢弃业务数据。
又一示例，收发单元1910，具体用于元接收来自第二网元的转发规则未知消息，转发规则未知消息包括业务数据的源地址信息和目的地址信息，源地址对应第一安全组，目的地址对应第二安全组；处理单元1920，具体用于根据源地址对应的第一安全组和目的地址对应的第二安全组之间的通信策略，为业务数据制定转发规则；收发单元1910，还用于将转发规则发送给第二网元。
又一示例，收发单元1910，还用于：向第二网元发送第一指示信息，第一指示信息用于指示上报转发规则未知的信息。
又一示例，收发单元1910，还用于：向第二网元发送第二指示信息，第二指示信息用于指示删除转发规则。
又一示例，收发单元1910，具体用于：确定第一通信设备的会话释放或者确定与转发规则相关的地址老化的情况下，向第二网元发送第二指示信息。
又一示例，第二网元为用户面功能网元。
又一示例，第一网元为用户面功能网元。
又一示例，收发单元1910，还用于：接收来自第二网元的多个安全组的信息，多个安全组的信息包括：多个安全组中任两个安全组之间的通信策略的信息。
又一示例，收发单元1910，具体用于：接收第一通信设备发送给第二通信设备的业务数据；判断第一通信设备属于VN组中第一安全组对应的通信设备，第二通信设备属于VN组中第二安全组对应的通信设备的情况下，从多个安全组的信息中获取第一安全组与第二安全组之间的通信策略。
又一示例，第一安全组与第二安全组之间的通信策略为允许通信的情况下，转发规则用于指示业务数据的转发路径，收发单元1910，还用于：根据转发规则指示的业务数据的转发路径，转发业务数据；或者，第一安全组与第二安全组之间的通信策略为禁止通信的情况下，转发规则用于指示丢弃业务数据，处理单元1920，用于根据转发规则丢弃业务数据。
又一示例，收发单元1910，还用于：向第二网元发送第三指示信息，第三指示信息用于指示与转发规则相关的地址老化。
又一示例，收发单元1910，还用于：接收来自第二网元的第四指示信息，第四指示信息用于指示删除转发规则。
又一示例，第二网元为会话管理功能网元。
又一示例，每个安全组包括以下一项或多项信息：安全组对应的数据网络、安全组所属的VN组的外部标识、安全组的标识、安全组的名称、安全组对应的通信设备、安全组与VN组中的多个安全组中的其他安全组之间的通信策略。
该装置1900可实现对应于根据本申请实施例的方法实施例中的网络设备(如核心网网元SMF或UPF)执行的步骤或者流程，该装置1900可以包括用于执行图9、图13至图18中的网络设备(如核心网网元SMF或UPF)执行的方法的单元。并且，该装置1900中的各单元和上述其他操作和/或功能分别为了实现图9、图13至图18中的网络设备(如核心网网元SMF或UPF)的方法实施例的相应流程。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
又一种可能的实现方式，收发单元1910，用于接收来自第四网元的第一请求消息，第一请求消息用于请求为虚拟网络VN组创建安全组；处理单元1920，用于基于第一请求消息，为VN组创建多个安全组；其中，VN组中包括多个安全组，每个安全组对应一个或多个通信设备，多个安全组包括第一安全组，第一安全组和多个安全组中的其它安全组之间具有通信策略，通信策略用于控制第一安全组对应的通信设备与其它安全组对应的通信设备之间的通信。
一示例，第一安全组与第二安全组之间的通信策略为允许通信，或者，第一安全组与第二安全组之间的通信策略为禁止通信。
又一示例，第一请求消息中包括以下一项或多项信息：待创建的安全组所属的VN组的外部标识、待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
又一示例，第一请求消息中包括待创建的安全组之间的通信策略，处理单元1920，具体用于根据待创建的安全组之间的通信策略，为待创建的安全组设置通信策略，通信策略为允许通信或禁止通信。
又一示例，收发单元1910，还用于接收来自第四网元的第二请求消息，第二请求消息用于请求为第一安全组添加一个或多个通信设备。
又一示例，第二请求消息中包括以下一项或多项信息：第一安全组对应的数据网络、第一安全组所属的VN组的外部标识、第一安全组的标识、第一安全组的名称、待添加的一个或多个通信设备的信息。
又一示例，每个安全组包括以下一项或多项信息：安全组对应的数据网络、安全组所属的VN组的外部标识、安全组的标识、安全组的名称、安全组对应的通信设备、安全组与VN组的多个安全组中的其他安全组之间的通信策略。
又一示例，装置1900为能力开放功能网元，第四网元为应用功能网元。
该装置1900可实现对应于根据本申请实施例的方法实施例中的网络设备(如第三网元)执行的步骤或者流程，该装置1900可以包括用于执行图10、图11、图12中的网络设备(如第三网元)执行的方法的单元。并且，该装置1900中的各单元和上述其他操作和/或功能分别为了实现图10、图11、图12中的网络设备的方法实施例的相应流程。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
上文实施例中的处理单元1920可以由至少一个处理器或处理器相关电路实现。收发单元1910可以由收发器或收发器相关电路实现。存储单元可以通过至少一个存储器实现。
如图20所示，本申请实施例还提供一种安全通信的装置2000。该装置2000包括处理器2010，处理器2010与存储器2020耦合，存储器2020用于存储计算机程序或指令和/或数据，处理器2010用于执行存储器2020存储的计算机程序或指令和/或数据，使得上文方法实施例中的方法被执行。
可选地，该装置2000包括的处理器2010为一个或多个。
可选地，如图20所示，该装置2000还可以包括存储器2020。
可选地，该装置2000包括的存储器2020可以为一个或多个。
可选地，该存储器2020可以与该处理器2010集成在一起，或者分离设置。
可选地，如图20所示，该装置2000还可以包括收发器2030，收发器2030用于信号的接收和/或发送。例如，处理器2010用于控制收发器2030进行信号的接收和/或发送。
作为一种方案，该装置2000用于实现上文方法实施例中由网络设备执行的操作。
例如，处理器2010用于实现上文方法实施例中由SMF执行的处理相关的操作，收发器2030用于实现上文方法实施例中由SMF执行的收发相关的操作。
又如，处理器2010用于实现上文方法实施例中由UPF执行的处理相关的操作，收发器2030用于实现上文方法实施例中由UPF执行的收发相关的操作。
又如，处理器2010用于实现上文方法实施例中由AF执行的处理相关的操作，收发器2030用于实现上文方法实施例中由AF执行的收发相关的操作。
又如，处理器2010用于实现上文方法实施例中由NEF执行的处理相关的操作，收发器2030用于实现上文方法实施例中由NEF执行的收发相关的操作。
本申请实施例还提供一种通信装置2100，该通信装置2100可以是网络设备也可以是芯片。该通信装置2100可以用于执行上述方法实施例中由网络设备所执行的操作。
当该通信装置2100为网络设备时，图21示出了一种简化的网络设备结构示意图。网络设备包括2110部分以及2120部分。2110部分主要用于射频信号的收发以及射频信号与基带信号的转换；2120部分主要用于基带处理，对网络设备进行控制等。2110部分通常可以称为收发单元、收发机、收发电路、或者收发器等。2120部分通常是网络设备的控制中心，通常可以称为处理单元，用于控制网络设备执行上述方法实施例中的处理操作。
2110部分的收发单元，也可以称为收发机或收发器等，其包括天线和射频电路，其中射频电路主要用于进行射频处理。可选地，可以将2110部分中用于实现接收功能的器件视为接收单元，将用于实现发送功能的器件视为发送单元，即2110部分包括接收单元和发送单元。接收单元也可以称为接收机、接收器、或接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
2120部分可以包括一个或多个单板，每个单板可以包括一个或多个处理器和一个或多个存储器。处理器用于读取和执行存储器中的程序以实现基带处理功能以及对基站的控制。若存在多个单板，各个单板之间可以互联以增强处理能力。作为一种可选的实施方式，也可以是多个单板共用一个或多个处理器，或者是多个单板共用一个或多个存储器，或者是多个单板同时共用一个或多个处理器。
应理解，图21仅为示例而非限定，上述包括收发单元和处理单元的网络设备可以不依赖于图21所示的结构。
当该装置2100为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路、通信接口；处理单元为该芯片上集成的处理器或者微处理器或者集成电路。当然装置2100还可以为一个芯片系统或处理系统，使得安装该装置2100的设备可以实现本申请实施例的方法和功能。例如，处理单元2120可以为芯片系统或处理系统中的处理电路，实现对安装了该芯片系统或处理系统的设备的控制，还可以耦合链接存储单元，调用存储单元中的指令，使得设备可以实现本申请实施例的方法和功能，收发单元2110，可以为芯片系统或处理系统中的输入输出电路，将芯片系统处理好的信息输出，或将待处理的数据或信令信息输入芯片系统进行处理。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例 中由网络设备执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由网络设备执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被计算机执行时使得该计算机实现上述方法实施例中由网络设备执行的方法。
本申请实施例还提供一种通信系统，该通信系统包括上文实施例中的网络设备，第一网元和第二网元，或者，第三网元和第四网元。
示例地，该通信系统包括上文实施例中的SMF和UPF，或者，AF和NEF。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器和/或非易失性存储器。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM可以包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的保护范围。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅 仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元实现本申请提供的方案。
另外，在本申请各个实施例中的各功能单元可以集成在一个单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，所述计算机可以是个人计算机，服务器，或者网络设备等。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD)等。例如，前述的可用介质可以包括但不限于：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (54)

  1. 一种安全通信的方法，其特征在于，包括：
    第一网元接收第一通信设备发送给第二通信设备的业务数据的信息；
    所述第一网元获取第一安全组与第二安全组之间的通信策略，所述第一安全组为所述第一通信设备对应的安全组，所述第二安全组为所述第二通信设备对应的安全组；
    根据所述第一安全组与第二安全组之间的通信策略，所述第一网元为所述业务数据制定转发规则；
    其中，所述第一通信设备和所述第二通信设备为同一个虚拟网络VN组内的设备，所述VN组中包括多个安全组，所述多个安全组包括所述第一安全组和所述第二安全组。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一安全组与第二安全组之间的通信策略为允许通信，或者，
    所述第一安全组与第二安全组之间的通信策略为禁止通信。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一网元为会话管理功能网元。
  4. 根据权利要求3所述的方法，其特征在于，
    所述第一安全组与所述第二安全组之间的通信策略为允许通信的情况下，所述转发规则用于指示所述业务数据的转发路径；或者，
    所述第一安全组与所述第二安全组之间的通信策略为禁止通信的情况下，所述转发规则用于指示丢弃所述业务数据。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一网元接收第一通信设备发送给第二通信设备的业务数据的信息，包括：
    所述第一网元接收来自第二网元的转发规则未知消息，所述转发规则未知消息包括所述业务数据的源地址信息和目的地址信息，所述源地址对应所述第一安全组，所述目的地址对应所述第二安全组；
    所述根据所述第一安全组与第二安全组之间的通信策略，所述第一网元为所述业务数据制定转发规则，包括：
    所述第一网元根据所述源地址对应的所述第一安全组和所述目的地址对应的所述第二安全组之间的通信策略，为所述业务数据制定转发规则；
    所述第一网元将所述转发规则发送给所述第二网元。
  6. 根据权利要求5所述的方法，其特征在于，所述第一网元接收来自第二网元的转发规则未知消息之前，所述方法还包括：
    所述第一网元向所述第二网元发送第一指示信息，所述第一指示信息用于指示上报转发规则未知的信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    所述第一网元向所述第二网元发送第二指示信息，所述第二指示信息用于指示删除所述转发规则。
  8. 根据权利要求7所述的方法，其特征在于，所述第一网元向所述第二网元发送第 二指示信息，包括：
    确定所述第一通信设备的会话释放或者确定与所述转发规则相关的地址老化的情况下，所述第一网元向所述第二网元发送所述第二指示信息。
  9. 根据权利要求5至8中任一项所述的方法，其特征在于，所述第二网元为用户面功能网元。
  10. 根据权利要求1或2所述的方法，其特征在于，所述第一网元为用户面功能网元。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述第一网元接收来自第二网元的所述多个安全组的信息，所述多个安全组的信息包括：所述多个安全组中任两个安全组之间的通信策略的信息。
  12. 根据权利要求11所述的方法，其特征在于，
    所述第一网元接收第一通信设备发送给第二通信设备的业务数据的信息，包括：
    所述第一网元接收所述第一通信设备发送给所述第二通信设备的所述业务数据；
    所述第一网元获取第一安全组与第二安全组之间的通信策略，包括：
    在所述第一网元判断所述第一通信设备属于所述VN组中所述第一安全组对应的通信设备，所述第二通信设备属于所述VN组中第二安全组对应的通信设备的情况下，所述第一网元从所述多个安全组的信息中获取所述第一安全组与所述第二安全组之间的通信策略。
  13. 根据权利要求12所述的方法，其特征在于，
    所述第一安全组与所述第二安全组之间的通信策略为允许通信的情况下，所述转发规则用于指示所述业务数据的转发路径，所述第一网元根据所述转发规则指示的所述业务数据的转发路径，转发所述业务数据；或者，
    所述第一安全组与所述第二安全组之间的通信策略为禁止通信的情况下，所述转发规则用于指示丢弃所述业务数据，所述第一网元根据所述转发规则丢弃所述业务数据。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    所述第一网元向第二网元发送第三指示信息，所述第三指示信息用于指示与所述转发规则相关的地址老化。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    所述第一网元接收来自所述第二网元的第四指示信息，所述第四指示信息用于指示删除所述转发规则。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第二网元为会话管理功能网元。
  17. 根据权利要求1至16中任一项所述的方法，其特征在于，每个安全组包括以下一项或多项信息：
    所述安全组对应的数据网络、所述安全组所属的所述VN组的外部标识、所述安全组的标识、所述安全组的名称、所述安全组对应的通信设备、所述安全组与所述VN组中的所述多个安全组中的其他安全组之间的通信策略。
  18. 一种安全通信的方法，其特征在于，包括：
    第三网元接收来自第四网元的第一请求消息，所述第一请求消息用于请求为虚拟网络VN组创建安全组；
    所述第三网元基于所述第一请求消息，为所述VN组创建多个安全组；
    其中，所述VN组中包括多个安全组，每个安全组对应一个或多个通信设备，所述多个安全组包括第一安全组，所述第一安全组和所述多个安全组中的其它安全组之间具有通信策略，所述通信策略用于控制所述第一安全组对应的通信设备与所述其它安全组对应的通信设备之间的通信。
  19. 根据权利要求18所述的方法，其特征在于，所述第一请求消息中包括以下一项或多项信息：
    待创建的安全组所属的所述VN组的外部标识、待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
  20. 根据权利要求19所述的方法，其特征在于，所述第一请求消息中包括所述待创建的安全组之间的通信策略，所述方法还包括：
    根据所述待创建的安全组之间的通信策略，所述第三网元为所述待创建的安全组设置通信策略，所述通信策略为允许通信或禁止通信。
  21. 根据权利要求18至20中任一项所述的方法，其特征在于，所述方法还包括：
    所述第三网元接收来自所述第四网元的第二请求消息，所述第二请求消息用于请求为所述第一安全组添加一个或多个通信设备。
  22. 根据权利要求21所述的方法，其特征在于，所述第二请求消息中包括以下一项或多项信息：
    所述第一安全组对应的数据网络、所述第一安全组所属的所述VN组的外部标识、所述第一安全组的标识、所述第一安全组的名称、待添加的所述一个或多个通信设备的信息。
  23. 根据权利要求18至22中任一项所述的方法，其特征在于，每个安全组包括以下一项或多项信息：
    所述安全组对应的数据网络、所述安全组所属的所述VN组的外部标识、所述安全组的标识、所述安全组的名称、所述安全组对应的通信设备、所述安全组与所述VN组的多个安全组中的其他安全组之间的通信策略。
  24. 根据权利要求18至23中任一项所述的方法，其特征在于，
    所述第三网元为能力开放功能网元，所述第四网元为应用功能网元。
  25. 一种安全通信的装置，其特征在于，包括：收发单元和处理单元，
    所述收发单元，用于接收第一通信设备发送给第二通信设备的业务数据的信息；
    所述收发单元，还用于获取第一安全组与第二安全组之间的通信策略，所述第一安全组为所述第一通信设备对应的安全组，所述第二安全组为所述第二通信设备对应的安全组；
    所述处理单元，用于根据所述第一安全组与第二安全组之间的通信策略，为所述业务数据制定转发规则；
    其中，所述第一通信设备和所述第二通信设备为同一个虚拟网络VN组内的设备，所述VN组中包括多个安全组，所述多个安全组包括所述第一安全组和所述第二安全组。
  26. 根据权利要求25所述的装置，其特征在于，
    所述第一安全组与第二安全组之间的通信策略为允许通信，或者，
    所述第一安全组与第二安全组之间的通信策略为禁止通信。
  27. 根据权利要求25或26所述的装置，其特征在于，所述装置为会话管理功能网元。
  28. 根据权利要求27所述的装置，其特征在于，
    所述第一安全组与所述第二安全组之间的通信策略为允许通信的情况下，所述转发规则用于指示所述业务数据的转发路径；或者，
    所述第一安全组与所述第二安全组之间的通信策略为禁止通信的情况下，所述转发规则用于指示丢弃所述业务数据。
  29. 根据权利要求27或28所述的装置，其特征在于，所述收发单元，具体用于接收来自第二网元的转发规则未知消息，所述转发规则未知消息包括所述业务数据的源地址信息和目的地址信息，所述源地址对应所述第一安全组，所述目的地址对应所述第二安全组；
    所述处理单元，具体用于根据所述源地址对应的所述第一安全组和所述目的地址对应的所述第二安全组之间的通信策略，为所述业务数据制定转发规则；
    所述收发单元，还用于将所述转发规则发送给所述第二网元。
  30. 根据权利要求29所述的装置，其特征在于，
    所述收发单元，还用于向所述第二网元发送第一指示信息，所述第一指示信息用于指示上报转发规则未知的信息。
  31. 根据权利要求29或30所述的装置，其特征在于，
    所述收发单元，还用于向所述第二网元发送第二指示信息，所述第二指示信息用于指示删除所述转发规则。
  32. 根据权利要求31所述的装置，其特征在于，所述收发单元，具体用于确定所述第一通信设备的会话释放或者确定与所述转发规则相关的地址老化的情况下，向所述第二网元发送所述第二指示信息。
  33. 根据权利要求29至32中任一项所述的装置，其特征在于，所述第二网元为用户面功能网元。
  34. 根据权利要求25或26所述的装置，其特征在于，所述装置为用户面功能网元。
  35. 根据权利要求34所述的装置，其特征在于，
    所述收发单元，还用于接收来自第二网元的所述多个安全组的信息，所述多个安全组的信息包括：所述多个安全组中任两个安全组之间的通信策略的信息。
  36. 根据权利要求35所述的装置，其特征在于，
    所述收发单元，具体用于接收所述第一通信设备发送给所述第二通信设备的所述业务数据；在判断所述第一通信设备属于所述VN组中所述第一安全组对应的通信设备，所述第二通信设备属于所述VN组中第二安全组对应的通信设备的情况下，从所述多个安全组的信息中获取所述第一安全组与所述第二安全组之间的通信策略。
  37. 根据权利要求36所述的装置，其特征在于，
    所述第一安全组与所述第二安全组之间的通信策略为允许通信的情况下，所述转发规则用于指示所述业务数据的转发路径，所述处理单元，具体用于根据所述转发规则指示的所述业务数据的转发路径，转发所述业务数据；或者，
    所述第一安全组与所述第二安全组之间的通信策略为禁止通信的情况下，所述转发规则用于指示丢弃所述业务数据，所述处理单元，具体用于根据所述转发规则丢弃所述业务数据。
  38. 根据权利要求36或37所述的装置，其特征在于，
    所述收发单元，还用于向第二网元发送第三指示信息，所述第三指示信息用于指示与所述转发规则相关的地址老化。
  39. 根据权利要求38所述的装置，其特征在于，
    所述收发单元，还用于接收来自所述第二网元的第四指示信息，所述第四指示信息用于指示删除所述转发规则。
  40. 根据权利要求38或39所述的装置，其特征在于，所述第二网元为会话管理功能网元。
  41. 根据权利要求25至40中任一项所述的装置，其特征在于，每个安全组包括以下一项或多项信息：
    所述安全组对应的数据网络、所述安全组所属的所述VN组的外部标识、所述安全组的标识、所述安全组的名称、所述安全组对应的通信设备、所述安全组与所述VN组中的所述多个安全组中的其他安全组之间的通信策略。
  42. 一种安全通信的装置，其特征在于，包括：收发单元和处理单元，
    所述收发单元，用于接收来自第四网元的第一请求消息，所述第一请求消息用于请求为虚拟网络VN组创建安全组；
    所述处理单元，用于基于所述第一请求消息，为所述VN组创建多个安全组；
    其中，所述VN组中包括多个安全组，每个安全组对应一个或多个通信设备，所述多个安全组包括第一安全组，所述第一安全组和所述多个安全组中的其它安全组之间具有通信策略，所述通信策略用于控制所述第一安全组对应的通信设备与所述其它安全组对应的通信设备之间的通信。
  43. 根据权利要求42所述的装置，其特征在于，所述第一请求消息中包括以下一项或多项信息：
    待创建的安全组所属的所述VN组的外部标识、待创建的安全组对应的数据网络、待创建的安全组的标识、待创建的安全组的名称、待创建的安全组之间的通信策略。
  44. 根据权利要求43所述的装置，其特征在于，所述第一请求消息中包括所述待创建的安全组之间的通信策略，
    所述处理单元，还用于根据所述待创建的安全组之间的通信策略，为所述待创建的安全组设置通信策略，所述通信策略为允许通信或禁止通信。
  45. 根据权利要求42至44中任一项所述的装置，其特征在于，
    所述收发单元，还用于接收来自所述第四网元的第二请求消息，所述第二请求消息用于请求为所述第一安全组添加一个或多个通信设备。
  46. 根据权利要求45所述的装置，其特征在于，所述第二请求消息中包括以下一项或多项信息：
    所述第一安全组对应的数据网络、所述第一安全组所属的所述VN组的外部标识、所述第一安全组的标识、所述第一安全组的名称、待添加的所述一个或多个通信设备的信息。
  47. 根据权利要求45或46所述的装置，其特征在于，每个安全组包括以下一项或多项信息：
    所述安全组对应的数据网络、所述安全组所属的所述VN组的外部标识、所述安全组 的标识、所述安全组的名称、所述安全组对应的通信设备、所述安全组与所述VN组的多个安全组中的其他安全组之间的通信策略。
  48. 根据权利要求45至47中任一项所述的装置，其特征在于，
    所述装置为能力开放功能网元，所述第四网元为应用功能网元。
  49. 一种安全通信的装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行：如权利要求1至24中任一项所述的方法。
  50. 根据权利要求49所述的装置，其特征在于，所述装置还包括所述存储器。
  51. 根据权利要求49或50所述的装置，其特征在于，所述装置还包括通信接口，所述通信接口与所述处理器耦合，
    所述通信接口，用于输入和/或输出信息。
  52. 根据权利要求49至51中任一项所述的装置，其特征在于，所述装置为芯片。
  53. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序被计算机执行时，以使得实现如权利要求1至24中任一项所述的方法。
  54. 一种计算机程序产品，所述计算机程序产品包括计算机程序，当所述计算机程序在计算机上运行时，使得计算机执行如权利要求1至24中任一项所述的方法。
PCT/CN2022/081583 2021-03-19 2022-03-18 安全通信的方法和装置 WO2022194262A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110295551.5 2021-03-19
CN202110295551.5A CN115175194A (zh) 2021-03-19 2021-03-19 安全通信的方法和装置

Publications (1)

Publication Number Publication Date
WO2022194262A1 true WO2022194262A1 (zh) 2022-09-22

Family

ID=83321896

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/081583 WO2022194262A1 (zh) 2021-03-19 2022-03-18 安全通信的方法和装置

Country Status (2)

Country Link
CN (1) CN115175194A (zh)
WO (1) WO2022194262A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115550288B (zh) * 2022-11-29 2023-02-28 广东省新一代通信与网络创新研究院 一种以太网数据流转发的方法及系统
WO2024183070A1 (zh) * 2023-03-09 2024-09-12 Oppo广东移动通信有限公司 设备管理方法和网关

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160234234A1 (en) * 2015-02-05 2016-08-11 Cisco Technology, Inc. Orchestrating the Use of Network Resources in Software Defined Networking Applications
CN107995144A (zh) * 2016-10-26 2018-05-04 北京金山云网络技术有限公司 一种基于安全组的访问控制方法及装置
CN109076028A (zh) * 2016-05-19 2018-12-21 思科技术公司 异构软件定义网络环境中的微分段
CN109587065A (zh) * 2017-09-28 2019-04-05 北京金山云网络技术有限公司 转发报文的方法、装置、交换机、设备及存储介质
CN111010340A (zh) * 2019-12-19 2020-04-14 华云数据有限公司 数据报文转发控制方法、装置及计算装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160234234A1 (en) * 2015-02-05 2016-08-11 Cisco Technology, Inc. Orchestrating the Use of Network Resources in Software Defined Networking Applications
CN109076028A (zh) * 2016-05-19 2018-12-21 思科技术公司 异构软件定义网络环境中的微分段
CN107995144A (zh) * 2016-10-26 2018-05-04 北京金山云网络技术有限公司 一种基于安全组的访问控制方法及装置
CN109587065A (zh) * 2017-09-28 2019-04-05 北京金山云网络技术有限公司 转发报文的方法、装置、交换机、设备及存储介质
CN111010340A (zh) * 2019-12-19 2020-04-14 华云数据有限公司 数据报文转发控制方法、装置及计算装置

Also Published As

Publication number Publication date
CN115175194A (zh) 2022-10-11

Similar Documents

Publication Publication Date Title
WO2023284584A1 (zh) 通信方法和装置
CN113133079B (zh) 路由配置方法及装置
US20230171672A1 (en) Route configuration method and apparatus
WO2023279776A1 (zh) 多模终端接入控制方法、装置、电子设备及存储介质
WO2022048394A1 (zh) 网络连接方法、网络去连接方法及通信装置
WO2022033558A1 (zh) 一种中继管理方法及通信装置
WO2022194262A1 (zh) 安全通信的方法和装置
EP4187856A1 (en) Communication method, device and system
WO2021104484A1 (zh) 通信方法、装置以及系统
WO2020150876A1 (zh) 会话建立方法、终端设备和网络设备
WO2022170798A1 (zh) 确定策略的方法和通信装置
CN113595911B (zh) 数据转发方法、装置、电子设备及存储介质
WO2020097928A1 (zh) 网络接入方法和设备
WO2024051313A1 (zh) 通信资源管理方法、装置、系统及存储介质
WO2023124875A1 (zh) 一种通信方法及装置
WO2023001003A1 (zh) 通信的方法和通信装置
WO2022237857A1 (zh) 确定安全保护开启方式的方法、通信方法及通信装置
WO2023197737A1 (zh) 报文发送方法、pin管理方法、通信装置及通信系统
WO2023133871A1 (zh) 通信方法和装置
WO2024012230A1 (zh) 通信方法及装置
WO2023160394A1 (zh) 通信的方法和装置
WO2023020046A1 (zh) 一种通信方法及通信装置
WO2023040728A1 (zh) 一种网元的选择方法、通信装置及通信系统
WO2023051427A1 (zh) 通信的方法和装置
WO2023185620A1 (zh) 通信的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22770614

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22770614

Country of ref document: EP

Kind code of ref document: A1