WO2023066210A1 - 鉴权方法及装置 - Google Patents

鉴权方法及装置 Download PDF

Info

Publication number
WO2023066210A1
WO2023066210A1 PCT/CN2022/125734 CN2022125734W WO2023066210A1 WO 2023066210 A1 WO2023066210 A1 WO 2023066210A1 CN 2022125734 W CN2022125734 W CN 2022125734W WO 2023066210 A1 WO2023066210 A1 WO 2023066210A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
application
information
network element
application information
Prior art date
Application number
PCT/CN2022/125734
Other languages
English (en)
French (fr)
Inventor
孙海洋
朱方园
李岩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023066210A1 publication Critical patent/WO2023066210A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications

Definitions

  • the present application relates to the communication field, and in particular to an authentication method and device.
  • PDU packet data unit
  • NSSAA network slice-specific authentication and authorization
  • APP1 can communicate with network slice 1 through newly created PDU session 1
  • APP2 can be associated with network slice 1 through PDU session 1 without performing any authentication operation on APP2.
  • Embodiments of the present application provide an authentication method and device, which can solve the problem that APP information is easily stolen or tampered with, thereby improving network security and operating efficiency.
  • an authentication method is provided, which is applied to a first network element.
  • the method includes: receiving application information from a terminal device, sending the application information to an authentication device, and then receiving an authentication result from the authentication device.
  • the authentication result is determined according to the application information, and the authentication result is used to generate a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the authentication device can perform authentication operations on applications corresponding to any application information one by one according to the application information.
  • the first network element can customize the detection rules for each application one by one, and instruct each network node on the data transmission path to, based on the customized detection rules, separately analyze the data of each application corresponding to different application information.
  • Perform forwarding or discarding operations such as forwarding data of applications that succeed in authentication and discarding data of applications that fail authentication, to ensure that even if application information is stolen or tampered with, network resources will not be abused, thereby improving network security and operating efficiency .
  • the application information includes application identification information
  • the authentication result includes application identification information.
  • the application identification information may include one or more of the following: application identification, Internet protocol (internet protocol, IP) quintuple, application name, etc., which can be used to perform authentication operations on the application, and based on the authentication result for the application Customize detection rules one by one to implement differentiated data transmission services for data of different applications, such as forwarding data of authenticated applications or discarding data of unauthenticated applications, thereby improving network security and operating efficiency.
  • the application information also includes application authentication information.
  • the application authentication information may include one or more of the following: user name, password, certificate information, etc., which can be used together with the application identification information for the authentication device to perform authentication operations on the application, so as to improve the reliability of the authentication result performance, thereby further improving network security and operational efficiency.
  • the authentication result can be indicated implicitly or explicitly.
  • the following example illustrates.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the authentication result does not include authentication indication information, but includes application identification information.
  • the application identification information in the authentication result can be understood as one of the following: all applications corresponding to the application identification information default to pass the authentication, all applications corresponding to the application identification information default to fail the authentication, or The applications corresponding to part of the application identification information pass the authentication by default, and the applications corresponding to the other part of the application identification information fail the authentication by default.
  • the two parts of application identification information can be carried in different positions in the authentication result, such as different fields (fields) or information elements (information element, IE), to be distinguished.
  • the first network element may be an access and mobility management network element.
  • the method described in the first aspect may further include: the access and mobility management network element sends the authentication result to the session management network element, so that the session management network element can determine the detection rule by itself, or request the policy control network element to determine Detection rules, so as to provide differentiated data transmission services for applications corresponding to different application information.
  • the first network element may be a session management network element.
  • the method described in the first aspect may further include: the session management network element determines the detection rule according to the authentication result, and sends the detection rule to the user plane network element.
  • the session management network element can determine the detection rules by itself, or request the policy control network element to determine the detection rules, so as to provide differentiated data transmission services for applications corresponding to different application information.
  • the session management network element determines the detection rule according to the authentication result, which specifically includes: the session management network element sends the authentication result to the policy control network element, and receives the detection rule from the policy control network element, so as to implement different application information
  • the session management network element determines the detection rule according to the authentication result, which specifically includes: the session management network element sends the authentication result to the policy control network element, and receives the detection rule from the policy control network element, so as to implement different application information
  • the corresponding application provides differentiated data transmission services.
  • an authentication method is provided, which is applied to an authentication device.
  • the method includes: acquiring application information.
  • the application information is used to determine the authentication result.
  • the authentication result is used to determine a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • acquiring application information specifically includes: receiving application information from a first network element.
  • an authentication method is provided, which is applied to a terminal device.
  • the method includes: sending application information to a first network element.
  • the application information is used to determine the authentication result
  • the authentication result is used to generate a detection rule
  • the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the method described in the third aspect further includes: receiving an authentication result from the first network element.
  • the technical effect of the authentication method described in the second aspect to the third aspect can refer to the technical effect of the authentication method described in the first aspect, and will not be repeated here.
  • an authentication device which can be applied to a first network element.
  • the device includes: a receiving module and a sending module.
  • the receiving module is used for receiving the application information from the terminal equipment.
  • a sending module configured to send application information to the authentication device.
  • the receiving module is also used to receive the authentication result from the authentication device.
  • the authentication result is determined according to the application information, and the authentication result is used to generate a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the first network element may be an access and mobility management network element.
  • the sending module is further configured to send the authentication result to the session management network element.
  • the first network element may be a session management network element.
  • the device according to the fourth aspect further includes: a processing module. Wherein, the processing module is used to determine the detection rule according to the authentication result. The sending module is also used to send the detection rule to the user plane network element.
  • the sending module is also configured to send the authentication result to the policy control network element.
  • the receiving module is also used to receive detection rules from policy control network elements.
  • the receiving module and the sending module can also be integrated into one module, such as a transceiver module.
  • the transceiving module is used to realize the transceiving function of the device described in the fourth aspect.
  • the authentication device described in the fourth aspect may further include a storage module, where computer programs or instructions are stored in the storage module.
  • the processing module executes the computer program or instruction
  • the authentication device can execute the authentication method described in the first aspect.
  • the authentication device described in the fourth aspect may be a first network element, such as an access and mobility management network element, or a session management network element, or a chip ( system) or other components or components, and may also be a device or system including the first network element, which is not limited in this application.
  • a first network element such as an access and mobility management network element, or a session management network element, or a chip ( system) or other components or components, and may also be a device or system including the first network element, which is not limited in this application.
  • an authentication device which is applied to an authentication device.
  • the device includes: an acquisition module and a sending module.
  • the obtaining module is used for obtaining application information.
  • the application information is used to determine the authentication result.
  • a sending module configured to send the authentication result to the first network element.
  • the authentication result is used to determine a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the device described in the fifth aspect further includes: a receiving module.
  • the receiving module is configured to receive the application information from the first network element.
  • the acquisition module may have a receiving function, and the receiving function and the sending module may also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the transceiver function of the device described in the fifth aspect.
  • the acquisition module may also have a processing function, such as accessing a local storage space, and this processing function may also be integrated with other processing functions of the device described in the fifth aspect, such as a processing module.
  • the processing module is used to realize the processing function of the device.
  • the authentication device may further include a storage module, where computer programs or instructions are stored in the storage module.
  • the processing module executes the computer program or instruction
  • the authentication device can execute the authentication method described in the second aspect.
  • the authentication device described in the fifth aspect can be an authentication device, or a chip (system) or other components or components that can be set in the authentication device, or a device or device that includes the authentication device. system, which is not limited in this application.
  • an authentication device which can be applied to a terminal device.
  • the device includes: a sending module.
  • the sending module is configured to send the application information to the first network element.
  • the application information is used to determine the authentication result, and the authentication result is used to generate a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the device described in the sixth aspect further includes: a receiving module.
  • the receiving module is configured to receive the authentication result from the first network element.
  • the receiving module and the sending module can also be integrated into one module, such as a transceiver module.
  • the transceiver module is used to realize the transceiver function of the device described in the sixth aspect.
  • the device described in the sixth aspect may further include a processing module.
  • the processing module is used to realize the processing function of the device.
  • the authentication device described in the sixth aspect may further include a storage module, where computer programs or instructions are stored in the storage module.
  • the processing module executes the computer program or instruction
  • the authentication device can execute the authentication method described in the third aspect.
  • the authentication device described in the sixth aspect may be a terminal device, or a chip (system) or other components or components that may be installed in the terminal device, or a device or system that includes the terminal device. Applications are not limited to this.
  • an authentication device is provided.
  • the authentication device is used to execute the authentication method described in any one of the first aspect to the third aspect.
  • the authentication device described in the seventh aspect includes corresponding modules, units, or means (means) for implementing the authentication method described in any one of the first to third aspects above, and the modules, units, or means It can be realized by hardware, by software, or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules or units for performing the functions involved in the above authentication method.
  • an authentication device includes: a processor configured to execute the authentication method described in any one of the first aspect to the third aspect.
  • the authentication device described in the eighth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the authentication device described in the eighth aspect to communicate with other devices.
  • the authentication device described in the eighth aspect may further include a memory.
  • the memory can be integrated with the processor or set separately.
  • the memory may be used to store computer programs and/or data involved in the authentication method described in any one of the first aspect to the third aspect.
  • an authentication device in a ninth aspect, includes: a processor, the processor is coupled with the memory, and the processor is used to execute the computer program stored in the memory, so that the authentication device performs the authentication described in any one of the first aspect to the third aspect. right method.
  • the authentication device described in the ninth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the authentication device described in the ninth aspect to communicate with other devices.
  • the authentication device described in the ninth aspect may further include a memory.
  • the memory can be integrated with the processor or set separately.
  • the memory may be used to store computer programs and/or data involved in the authentication method described in any one of the first aspect to the third aspect.
  • an authentication device including: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the authentication device executes the first to third aspects.
  • the memory can be integrated with the processor, or can be set separately.
  • the memory may be used to store computer programs and/or data involved in the authentication method described in any one of the first aspect to the third aspect.
  • the authentication device described in the tenth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the authentication device described in the tenth aspect to communicate with other authentication devices.
  • an authentication device including: a processor; the processor is configured to be coupled with a memory, and after reading the computer program in the memory, execute the steps of the first to third aspects according to the computer program.
  • the memory can be integrated with the processor, or can be set separately.
  • the memory may be used to store computer programs and/or data involved in the authentication method described in any one of the first aspect to the third aspect.
  • the authentication device described in the eleventh aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver can be used for the authentication device described in the eleventh aspect to communicate with other devices.
  • the authentication devices described in the seventh to eleventh aspects above may be the above-mentioned first network element or authentication device or terminal device, or may be set in the first network element or authentication device or
  • the chip (system) or other components or components in the terminal device may also be an apparatus or system including the first network element or the authentication device or the terminal device, which is not limited in this application.
  • a communication system in a twelfth aspect, includes a first network element, an authentication device and a terminal device.
  • a computer-readable storage medium storing computer programs or instructions; when the computer programs or instructions are run on a computer, the computer is made to execute any one of the first to third aspects. authentication method.
  • a computer program product including a computer program or an instruction.
  • the computer program or instruction When the computer program or instruction is run on a computer, the computer performs the authentication described in any one of the first to third aspects. method.
  • Fig. 1 is an example diagram of existing PDU session selection
  • FIG. 2 is a flow diagram 1 of an existing secondary authentication based on a network slice authentication flow
  • FIG. 3 is a second schematic flow diagram of the existing secondary authentication based on the network slice authentication flow
  • FIG. 4 is a schematic flow diagram of an existing secondary authentication based on a PDU session flow
  • FIG. 5 is a first schematic diagram of the architecture of the communication system provided by the embodiment of the present application.
  • FIG. 6 is a first schematic diagram of a 5G system architecture
  • FIG. 7 is a second schematic diagram of the architecture of the 5G system.
  • Figure 8 is a schematic diagram 3 of the architecture of the 5G system
  • FIG. 9 is a schematic diagram 4 of the architecture of the 5G system.
  • Figure 10 is a schematic diagram 5 of the architecture of the 5G system
  • Figure 11 is a schematic diagram of the architecture of the 5G system VI.
  • FIG. 12 is a first schematic flow diagram of the authentication method provided by the embodiment of the present application.
  • FIG. 13 is a schematic flow diagram II of the authentication method provided by the embodiment of the present application.
  • FIG. 14 is a third schematic flow diagram of the authentication method provided by the embodiment of the present application.
  • FIG. 15 is a schematic flowchart 4 of the authentication method provided by the embodiment of the present application.
  • FIG. 16 is a schematic flow diagram five of the authentication method provided by the embodiment of the present application.
  • FIG. 17 is a first structural schematic diagram of an authentication device provided by an embodiment of the present application.
  • Fig. 18 is a schematic structural diagram II of the authentication device provided by the embodiment of the present application.
  • FIG. 19 is a schematic structural diagram III of the authentication device provided by the embodiment of the present application.
  • FIG. 20 is a fourth structural schematic diagram of the authentication device provided by the embodiment of the present application.
  • policy information related to user equipment is introduced, such as user equipment route selection policy (URSP), and UE is used as the policy
  • URSP user equipment route selection policy
  • the executor selects an appropriate PDU session for the service flow.
  • some services have certain requirements on the data network (data network, DN), network slice (network slice), session and service continuity mode (session and service continuity mode, SSC) using PDU sessions, and UE can use this
  • the policy determines whether the detected application (application, APP) can be associated with an established PDU session, whether it can be offloaded to non-3GPP access outside the PDU session, or whether it can trigger the establishment of a new PDU session and other operations.
  • URSP is usually delivered to UE based on the following path: PCF->AMF->UE.
  • PCF is a policy control function (policy control function) network element
  • AMF is an access and mobility management function (access and mobility management function) network element.
  • the PCF can use subscription information (whether the slice/DNN needs secondary authentication, whether an application needs the Authentication, whether an application needs slice/DNN secondary authentication, etc.), generate the above URSP rules, and send them to AMF.
  • Execution of URSP Executed by the UE, it may trigger the establishment or modification of the PDU session. For example, when there is no PDU session that meets the requirements, the UE will initiate the PDU session establishment process; when there is a session that meets the requirements, it may directly use the existing PDU session.
  • a URSP consists of one or more URSP rules.
  • a URSP rule mainly includes two parts: traffic descriptor (traffic descriptor) and route selection descriptor (route selection descriptor).
  • the traffic descriptor includes the names or identifiers of multiple APPs, etc.
  • the routing descriptor includes the network slice selection information corresponding to each APP, as well as the wildcard network slice selection information, such as APPs not included in the traffic descriptor can use network slice selection information and so on.
  • URSP can refer to Table 1
  • URSP rules can refer to Table 2
  • routing descriptors can refer to Table 3.
  • the UE determines the route selection descriptor (RSD) corresponding to the APP according to the URSP, and determines whether there is a PDU session satisfying the route selection description information among the established PDU sessions. If yes, the UE associates the detected new APP with the PDU session satisfying the routing description information, and transmits the data of the new APP through the PDU session. If not, the UE establishes a PDU session that satisfies the routing description information.
  • RSD route selection descriptor
  • Fig. 1 is an example of an existing PDU session selection.
  • the UE establishes PDU session 1 for application B, and selects an existing PDU session for applications A, C, D, E, and F, such as selecting PDU session 2 for application A.
  • the 5G communication system includes operator networks.
  • the UE accesses the operator's network, it needs to authenticate the UE (operator network authentication, first-level authentication, first-level authentication, first-time authentication, first-time authentication, primary authentication) to determine Whether the UE has access rights to the operator's network, such as the UE is a subscriber of the operator's network, or the operator the UE subscribes to and the owner of the operator's network that the UE wants to access (another operator) There is a roaming service agreement signed between them.
  • the 5G communication system may also include a provider network, that is, the application content may be provided by a third-party application provider.
  • the provider network also needs to authenticate the UE (provider network authentication, second-level authentication, second-level authentication , second authentication, secondary authentication, secondary authentication), to determine whether the UE has the access right to the provider network, for example, the UE is a subscriber of the provider network.
  • the second authentication can be entrusted to the operator network, such as the following network slice authentication performed by the operator network, or it can be performed by the provider network, such as the following data network deployed by the provider.
  • DN such as AAA-S in DN, performs PDU session authentication.
  • Network slicing is to virtualize multiple end-to-end networks on a common hardware basis through slicing technology. Each network has different network functions to adapt to different types of service requirements.
  • network slicing can be understood as a logical network based on some resources of a physical network to implement one or more specific functions. For example, after deploying physical resources, operators can use physical resources to virtualize an enhanced mobile broadband (eMBB) slice for public Internet services, and can also meet the smart meter reading needs of some manufacturers in vertical industries.
  • eMBB enhanced mobile broadband
  • mMTC massive machine type of communication
  • uRLLC ultra-high reliability and low-latency communication
  • a network slice can be identified by single network slice selection assistance information (single network slice selection Assistance information, S-NSSAI).
  • S-NSSAI single network slice selection Assistance information
  • one S-NSSAI can be associated with one or more network slice instances
  • one network slice instance can be associated with one or more S-NSSAI.
  • S-NSSAI includes two parts: SST and SD: slice/service type (slice/servicetype, SST) and slice difference (slice differentiator, SD).
  • SST refers to the expected network slicing behavior in terms of features and services.
  • the standard value range of SST is 1, 2, 3, and the value 1 means eMBB, 2 means URLLC, and 3 means massive internet of things (MIoT).
  • SD is an optional information used to supplement SST to distinguish multiple network slices of the same slice/service type.
  • the two parts of SST and SD are combined to represent the slice type and multiple slices of the same slice type.
  • the values of S-NSSAI are 0x01000000, 0x02000000, and 0x03000000 respectively representing eMBB type slices, uRLLC type slices, and MIoT type slices.
  • the values of S-NSSAI are 0x01000001 and 0x01000002, which represent eMBB type slices, serving user group 1 and user group 2 respectively.
  • NSSAI Network slice selection assistance information
  • the NSSAI used in the 5G network includes requested NSSAI (requested NSSAI), authorized NSSAI (allowed NSSAI), and configured NSSAI (configured NSSAI). Their specific definitions are shown in Table 4.
  • the network slice selection policy (network slice selection policy, NSSP) is sent by the PCF as part of the UE route selection policy (UE route selection policy, URSP) rule to the UE through the AMF, and the UE is used to associate the APP ID with the S -NSSAI.
  • UE route selection policy UE route selection policy, URSP
  • URSP UE route selection policy
  • the specific implementation of network slice selection reference may be made to existing solutions, such as implementing network slice selection in an attachment procedure (attachment procedure).
  • the 5G standard also summarizes the requirements of different services for network functions into three typical scenarios.
  • the types of network slices corresponding to these three typical scenarios are eMBB slices, mMTC slices, and (ultra reliable low latency communication, uRLLC) slices.
  • 5G can provide a transmission rate that is more than 10 times faster than 4G.
  • 5G ultra-high speed can meet the demand, and the transmission rate of 4G cannot support it.
  • VR when using VR to watch high-definition video or play large-scale interactive games, it is necessary to drag the network cable to obtain data.
  • wireless connection through the 5G network will allow VR/AR to obtain a fast experience.
  • 5G Through technologies such as multi-user shared access and ultra-dense heterogeneous networks, 5G can support access to 1 million devices per square kilometer, which is 10 times that of 4G. With the rapid development of smart cities recently, street lights, manhole covers, water meters and other public facilities already have network connection capabilities and can be managed remotely, but 5G will bring greater innovation. Based on the powerful connection capabilities of the 5G network, public facilities in various industries in the city can be connected to the intelligent management platform. These public facilities work together through the 5G network, and only need a small number of maintenance personnel to manage them in a unified manner, greatly improving the operational efficiency of the city.
  • uRRLC scenario The most typical application in the 5G scenario is autonomous driving.
  • the most commonly used scenarios for autonomous driving such as sudden braking, vehicle-to-vehicle, vehicle-to-person, vehicle-to-infrastructure, etc. Data processing and decision making. Therefore, the network needs to have large bandwidth, low latency, and high reliability at the same time, and the 5G network has the ability to cope with this scenario.
  • application providers such as various vertical industries, can purchase network slicing services from operators to provide users with network services through the operator's network.
  • the application provider can entrust the operator to perform network slice authentication on the user. In other words, if the user is authenticated through the network slice, it can be understood that the user has the right to use the network service provided by the application provider.
  • the UE when the UE registers in the network, in addition to performing an authentication process of the UE permanent identity, it may also judge whether to perform authentication and authorization at the granularity of network slices according to the NSSAI requested by the UE and the subscription data of the UE.
  • the process network slice specific authentication and authorization, NSSAA
  • this process can also be simply referred to as the secondary authentication process of the network slice, and the steps of this process are shown in Figure 2 and Figure 3 below.
  • FIG. 2 is a first schematic flow diagram of the existing secondary authentication based on the network slice authentication flow.
  • the secondary authentication process includes the following steps:
  • the UE sends a registration request message to the AMF.
  • the registration request (registration request) message carries the requested NSSAI.
  • the UE may request the network to perform network slice authentication for a specific NSSAI during the registration procedure initiated by it.
  • the AMF performs an authentication process.
  • the authentication server function (authentication server function, AUSF) is used for one authentication of the permanent identity of the UE.
  • the AMF After successfully performing the permanent identification of the UE, the AMF obtains the subscription data (subscription data) of the UE from the UDM.
  • the subscription data includes indication information whether each S-NSSAI subscribed by the UE needs to perform secondary authentication.
  • the S-NSSAI subscribed by the UE is shown in Table 5.
  • the AMF determines the S-NSSAI that needs to perform the second authentication.
  • the AMF judges, according to the subscription data of the UE, whether the S-NSSAI that needs to perform the second authentication is included in the requested NSSAI. If yes, the AMF judges that the UE needs to perform a second authentication process after the current registration process.
  • Example 1 if the requested NSSAI carried by the UE includes S-NSSAI-1 and S-NSSAI-2 shown in Table 5, then S-NSSAI-1 needs to perform a second authentication process, and S-NSSAI-2 does not A second authentication process is required.
  • the AMF sends a registration acceptance message to the UE.
  • the registration accept (registration accept) message carries the authorized NSSAI, and/or, the rejected NSSAI and its rejection reason value.
  • the authorized NSSAI only includes the S-NSSAI that does not require secondary authentication, while the rejection reason value of the rejected NSSAI is usually in a pending state, and secondary authentication needs to be performed.
  • the authorized NSSAI includes S-NSSAI-2
  • the rejected S-NSSAI includes S-NSSAI-1
  • the rejection reason value is that S-NSSAI-1 is pending, then you need to update the S-NSSAI -1
  • Execute secondary authentication that is, execute the following S205.
  • the AMF performs a second authentication process on the S-NSSAI in the suspended state.
  • the AMF can initiate the secondary authentication process for S-NSSAI-1, refer to the process shown in Figure 3 for details, and will not repeat it here.
  • the AMF may execute the following S206 based on the authentication result.
  • the AMF updates the authorized NSSAI according to the secondary authentication result.
  • the AMF will add the S-NSSAI to the authorized NSSAI, and if the authentication fails, the AMF does not need to update the authorized NSSAI.
  • the AMF sends an indication message to the UE to update the authorized NSSAI to S-NSSAI-1 and S-NSSAI-2. If the authentication fails , the AMF will not send indication information to update the authorized NSSAI to the UE.
  • FIG. 3 is a second schematic flow diagram of the existing secondary authentication based on the network slice authentication flow.
  • the authentication process may include the following steps:
  • the AMF triggers the execution of the second authentication of the network slice.
  • the AMF sends a first NAS MM transmission request to the UE.
  • the first non-access stratum (non-access stratum, NAS) mobility management (mobility management, MM) transport (NAS MM Transport) request carries: an extensible authentication protocol (extensible authentication protocol, EAP) identifier ( identifier, ID) request (EAP ID R-equest), and single network slice selection assistance information (single network slice selection assistance information, S-NSSAI).
  • EAP extensible authentication protocol
  • ID identifier
  • S-NSSAI single network slice selection assistance information
  • the UE sends the first NAS MM transmission response to the AMF.
  • the first NAS MM transmission response carries an EAP ID response (EAP ID response), an S-NSSAI and a UE identifier (UE Identifier, UE ID).
  • EAP ID response EAP ID response
  • S-NSSAI UE Identifier
  • UE ID UE Identifier
  • the UE ID is used to identify the UE, for example, it may be a generic public subscription identifier (GPSI) of the UE
  • GPSI generic public subscription identifier
  • S-NSSAI refers to the identifier of a network slice that provides network services for the UE.
  • the content of the EAP ID response and the EAP ID request in S302 may also be carried in other NAS messages, which is not limited here.
  • the AMF sends the first NSSAA authentication request to the NSSAAF.
  • the first NSSAAF is a network slice and SNPN authentication and authorization function (network slice&SNPN function), and the Nnssaaf authentication request (Nnssaaf_NSSAA_Authenticate Req) carries information such as the EAP ID response, the UE's GPSI, and S-NSSAI.
  • the NSSAAF sends a first AAA protocol request to the AAA-P.
  • the AAA-P sends the first AAA protocol request to the AAA-S.
  • AAA-P is an authentication, authorization, and accounting proxy server (authentication, authorization, and accounting proxy server), and the first AAA protocol request (AAA protocol request message) carries the above-mentioned EAP ID response, UE's GPSI, S-NSSAI and other information.
  • the NSSAAF may send the first AAA protocol request to the AAA-P (S305), and then the AAA-P forwards the first AAA protocol request to the AAA-S (S306).
  • the NSSAAF can send the AAA protocol message to the AAA-S through the AAA-P.
  • S305 and S306 may also be replaced by the following steps: the NSSAAF sends the first AAA protocol request to the AAA-S.
  • the AAA-S sends the first AAA protocol request to the AAA-P.
  • the AAA-P sends the first AAA protocol response to the NSSAAF.
  • the first AAA protocol response carries information such as the EAP message, the GPSI of the UE, and the S-NSSAI.
  • the function and content of the EAP message are similar to the above-mentioned EAP ID request and EAP ID response, and will not be repeated here.
  • S307-S308 may also be replaced by the following steps: AAA-S sends an AAA protocol message to NSSAAF.
  • the NSSAAF sends the first NSSAA authentication response to the AMF.
  • the first NNSSAA authentication response (Nnssaaf_NSSAA_Authenticate Resp) carries the EAP message, the UE's GPSI, S-NSSAI and other information.
  • the AMF sends a second NAS MM transmission request to the UE.
  • the second NAS MM transmission request carries information such as EAP message and S-NSSAI.
  • the UE sends a second NAS MM transmission response to the AMF.
  • the second NAS MM transmission response carries information such as EAP message and S-NSSAI.
  • the AMF sends a second NSSAA authentication request to the NSSAAF.
  • the second NNSSAA authentication request (Nnssaaf_NSSAA_Authenticate Request) carries information such as the EAP message, the GPSI of the UE, and the S-NSSAI.
  • the NSSAAF sends a second AAA protocol request to the AAA-P.
  • the AAA-P sends a second AAA protocol request to the AAA-S.
  • the second AAA protocol second carries information such as the EAP message, the address of the AAA-S, the GPSI of the UE, and the S-NSSAI.
  • NSSAAF and AAA-S can communicate directly, similar to S305-S306, S313-S314 may also be replaced by the following steps: NSSAAF sends a second AAA protocol request to AAA-S.
  • steps S307-S314 are used to perform the exchange of EAP messages, and this process may be performed once or multiple times, which is not limited here.
  • the AAA-S can perform the second authentication, and return the authentication result to the UE, that is, execute the following S315-S318.
  • the AAA-S sends a second AAA protocol response to the AAA-P.
  • the AAA-P sends a second AAA protocol response to the NSSAAF.
  • the second AAA protocol response carries EAP authentication success/failure (EAP success/failure) indication, GPSI of the UE, authorized S-NSSAI and other information.
  • EAP authentication success/failure EAP success/failure
  • S315-S316 may also be replaced by the following steps: AAA-S sends a second AAA protocol response to NSSAAF.
  • the NSSAAF sends a second NSSAA authentication response to the AMF.
  • the second NSSAA authentication response carries EAP authentication success/failure indication, GPSI of the UE, authorized S-NSSAI and other information.
  • the AMF sends a second NAS MM transmission response to the UE.
  • the second NAS MM transmission response carries an EAP authentication success/failure (success/failure) indication.
  • AMF shall store the EAP authentication result of each S-NSSAI executing the NSSAA procedure in S301-S317. Afterwards, the UE and the network can perform a configuration update process according to the result of the secondary authentication, that is, perform the following S319-S320.
  • the AMF triggers a UE configuration update process.
  • the AMF can initiate a UE configuration update (UE Configuration update, UCU) process.
  • UE Configuration update UCU
  • the AMF shall trigger the release of the PDU session.
  • the AMF initiates a UE de-registration procedure.
  • the AMF initiates a de-registration process (network-initiated deregistration).
  • a second authentication is required between the UE and the authentication server deployed in the DN .
  • the establishment of the PDU session can be triggered by the core network (core network, CN) of the UE or the operator's network.
  • the operator's network initiates a second authentication process. Specifically, the UE sends an authentication request to the operator network, and the operator network forwards the authentication request to the authentication server in the DN, so as to complete the authentication of the UE by the DN.
  • the UE server corresponding to the above-mentioned DN may be an authentication, authorization, and accounting server (authentication, authorization, and accounting, AAA) Server, AAA-S), and the result of the authentication and/or authorization of the UE by the authentication server will be Send it to the operator's network, and the operator's network will confirm whether to establish a corresponding PDU session for the UE based on the result of the second authentication.
  • AAA authentication, authorization, and accounting Server
  • FIG. 4 is a schematic flow diagram of an existing secondary authentication based on a PDU session flow. As shown in Figure 4, the process may include the following steps:
  • the UE sends a registration request to the AMF.
  • the UE performs an authentication with the operator network.
  • the AMF may trigger the AUSF to perform an authentication between the UE and the operator network.
  • the AUSF can obtain the authentication information required for the authentication from the UDM, such as the subscription data of the UE, and then can generate or store the authentication information based on the UDM.
  • Authorization information to realize one-time authentication between the UE and the operator's network.
  • the AMF can establish NAS (non-access stratum, NAS) security with the UE.
  • NAS exists in the wireless communication protocol stack of the universal mobile telecommunications system (UMTS), and serves as a functional layer between the CN and the UE.
  • UMTS universal mobile telecommunications system
  • NAS supports signaling and/or data transmission between both CN and UE.
  • the UE sends a session establishment request to the AMF.
  • the UE may initiate a session establishment request to the AMF, and the session establishment request carries a NAS message.
  • the above session establishment request may be specifically used to request establishment of a PDU session.
  • the AMF sends a session establishment request to the SMF.
  • the AMF may decode the session establishment request in the NAS message, and send the session establishment request to the SMF.
  • the above-mentioned SMF is an SMF that manages the PDU session requested by the session establishment request.
  • the SMF verifies the signing data.
  • the SMF acquires subscription data from the UDM, and if the subscription data indicates that secondary authentication needs to be performed, the following S407 is executed.
  • the SMF starts an EAP authentication process.
  • the session establishment request carries information required for the second authentication, the following S408 and S409 may be skipped.
  • the SMF sends an EAP ID request to the UE.
  • the EAP ID request is used to request the identity information of the UE, such as the GPSI of the UE.
  • the UE sends an EAP ID response to the SMF.
  • the EAP ID response carries the identity information of the UE, such as the GPSI of the UE.
  • the SMF initiates an N4 session establishment process to the UPF.
  • the SMF initiates a UPF selection process, and establishes an N4 session between the SMF and the selected UPF.
  • the SMF sends the EAP ID response and the identity information of the UE to the AAA-S.
  • the SMF can send the EAP ID response and the identity information of the UE to the AAA-S through the UPF.
  • the SMF can send the EAP ID response and the identity information of the UE to the UPF through the N4 session established in the above S410, and then the UPF sends the received EAP ID response and the identity information of the UE to the AAA-S.
  • the UE and the AAA-S may perform multiple EAP message exchanges to complete the second authentication of the UE by the AAA-S.
  • the AAA-S sends the second authentication result to the SMF.
  • the AAA-S successfully authenticates the UE, the AAA-S sends an authentication success message to the UPF, and then the UPF sends an authentication success message to the SMF through the N4 session.
  • AAA-S can also provide authorization information, such as the index of DN authorization text, allowed media access control (media control access, MAC) address or virtual local area network identifier (virtual local area network identifier, VID), DN authorization
  • authorization information such as the index of DN authorization text, allowed media access control (media control access, MAC) address or virtual local area network identifier (virtual local area network identifier, VID), DN authorization
  • the aggregate maximum bit rate (aggregate maximum bit rate, AMBR) of the session etc.
  • the SMF triggers and executes the remaining steps of the PDU session establishment process.
  • the SMF can continue to initiate the remaining steps in the PDU session establishment process, such as the following S415:
  • the SMF initiates an N4 session establishment/modification process to the UPF.
  • the SMF sends a PDU session establishment success message to the UE.
  • the SMF sends a PDU session establishment success message to the AMF, and the AMF receives the PDU session establishment success message and sends it to the UE.
  • both the above-mentioned secondary authentication based on the network slice authentication process and the secondary authentication based on the PDU session have the problem of low security.
  • the UE will establish a new PDU session according to URSP rules, or select an existing PDU session to be associated with the network slice.
  • URSP rules are as follows:
  • both APP1 and APP2 can use the network slice S-NSSAI-a.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless fidelity (WiFi) systems, vehicle-to-everything (V2X) communication systems, device-to-devie (D2D) Communication systems, IoV communication systems, 4th generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems,
  • 4G 4th generation mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems
  • the fifth generation (5th generation, 5G) mobile communication system such as the new air interface (new radio, NR) system
  • future communication systems such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. In addition, combinations of these schemes can also be used.
  • a subscript such as W 1 may be a clerical error into a non-subscript form such as W1.
  • the network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.
  • FIG. 5 is a first structural diagram of a communication system to which the authentication method provided in the embodiment of the present application is applicable.
  • the communication system includes a terminal device, a first network element and an authentication device.
  • the above-mentioned terminal device is a terminal that can access the above-mentioned communication system and has a wireless or wired transceiver function, or a chip or a chip system that can be provided in the terminal.
  • the terminal equipment may also be called user equipment, user equipment (user equipment, UE), handheld terminal, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, Terminal, wireless communication device, user agent or user device.
  • the terminal device in the embodiment of the present application may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal device, an augmented reality (augmented reality, AR) terminal Equipment, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, transportation safety ( Wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, vehicle-mounted terminals, RSUs with terminal functions, notebook computers, subscriber units, cellular Cellular phone, smart phone, wireless data card, personal digital assistant (PDA), computer, tablet, wireless modem, handheld, laptop (laptop computer), cordless phone (cordless phone) or wireless local loop (wireless local loop, WLL) station, machine type communication (machine type communication, MTC) terminal, etc.
  • a virtual reality (virtual reality, VR) terminal device an augmented reality (augmented reality, AR) terminal Equipment
  • wireless terminals in industrial control wireless terminals
  • the terminal device of the present application can also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip, or a vehicle-mounted unit built into the vehicle as one or more components or units.
  • the on-board component, on-board chip or on-board unit can implement the authentication method provided by this application.
  • the above-mentioned first network element is the requester of the secondary authentication, and may be a core network element in the operator network, such as AMF and SMF shown in FIGS. 6-11 below.
  • the above-mentioned authentication device is the responder of the secondary authentication, which can be an authentication server deployed by an operator or a third-party content provider, such as the AAA-S deployed in NSSAAF and DN shown in Figure 6- Figure 11 below , AAA-P, etc.
  • the communication system shown in FIG. 5 may also include an access network device, which is a device located on the network side of the above-mentioned communication system and has a wireless transceiver function or a chip that can be set on the device or system-on-a-chip.
  • an access network device which is a device located on the network side of the above-mentioned communication system and has a wireless transceiver function or a chip that can be set on the device or system-on-a-chip.
  • the access network equipment includes but is not limited to: an access point (access point, AP) in a wireless fidelity (WiFi) system, such as a home gateway, a router, a server, a switch, a bridge, etc., and an evolved node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), node B (Node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS) , home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), wireless relay node, wireless backhaul node, transmission point (transmission and reception point, TRP or transmission point, TP), etc., can also be 5G, such as gNB in the new air interface (new radio, NR) system, or, transmission point (TRP or TP), one or a group of base stations in the 5G system (including multiple antenna panels )
  • FIG. 6-11 are examples 1 to 6 of the 5G system.
  • Figure 6 shows the non-roaming architecture based on the service interface
  • Figure 7 shows the non-roaming architecture based on the reference point.
  • the UE is located in the home public land mobile network (home public land mobile network, HPLMN), and the offloading of services is completed by the HPLMN. , that is, both the UE and the DN are located in the HPLMN.
  • HPLMN home public land mobile network
  • Figure 8 is a local breakout (LBO) roaming architecture based on a service interface
  • Figure 9 is a reference point-based local breakout roaming architecture
  • the UE is located in the visited public land mobile network (visited public land mobile network, VPLMN)
  • the service also needs to be offloaded in the VPLMN, that is, both the UE and the DN are located in the VPLMN
  • Figure 10 is a home routed (HR) roaming architecture based on a service interface
  • Figure 11 is a home routed roaming architecture based on a reference point.
  • the UE is located in the VPLMN, but the service needs to be offloaded in the HPLMN, that is, the DN is located in the HPLMN.
  • the 5G system architecture is divided into two parts: the access network and the core network.
  • the access network is used to implement functions related to wireless access.
  • the core network mainly includes the following key network elements: access and mobility management function (AMF), session management function (SMF), user plane function (UPF) ), policy control network element (policy control function, PCF), unified data management network element (unified data management, UDM).
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • policy control network element policy control function
  • PCF policy control function
  • UDM unified data management network element
  • RAN equipment equipment that provides access for terminal equipment, including radio access network (radio access network, RAN) equipment and access network (access network, AN) equipment.
  • the RAN device is mainly a wireless network device defined by 3GPP, and the AN may be an access network device defined by non-3GPP.
  • RAN equipment mainly responsible for radio resource management, quality of service (QoS) management, data compression and encryption on the air interface side.
  • the RAN equipment may include base stations in various forms, for example: macro base stations, micro base stations (also called small stations), relay stations, access points, and so on. In systems using different radio access technologies, the names of devices with base station functions may be different.
  • 5G NodeB 5G NodeB
  • gNB 5G NodeB
  • eNB evolved Node B
  • Node B Node B
  • AN equipment Allow non-3GPP technology interconnection and intercommunication between terminal equipment and 3GPP core network, among which, non-3GPP technology such as: wireless fidelity (wireless fidelity, Wi-Fi), global microwave interoperability for microwave access (worldwide interoperability for microwave access) , WiMAX), code division multiple access (code division multiple access, CDMA) network, etc.
  • non-3GPP technology such as: wireless fidelity (wireless fidelity, Wi-Fi), global microwave interoperability for microwave access (worldwide interoperability for microwave access) , WiMAX), code division multiple access (code division multiple access, CDMA) network, etc.
  • AMF Mainly responsible for mobility management in the mobile network, such as user location update, user registration network, user switching, etc.
  • SMF It is mainly responsible for session management in mobile networks, such as session establishment, modification, and release. Specific functions include assigning IP addresses to users, selecting UPF that provides message forwarding functions, and so on.
  • UPF responsible for forwarding and receiving user data in terminal equipment. It can receive user data from the data network and transmit it to the terminal device through the access network device; UPF can also receive user data from the terminal device through the access network device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services for terminal equipment in UPF are managed and controlled by SMF network elements.
  • PCF It mainly supports the provision of a unified policy framework to control network behavior, provides policy rules to the network functions of the control layer, and is responsible for obtaining user subscription information related to policy decisions.
  • Network exposure function (NEF): mainly used to support the exposure of capabilities and events.
  • Network slice admission control function (network slice admission control function, NSACF): mainly used to support the following functions:
  • Application function (application function, AF): It mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • Unified data management used to generate authentication credentials, user identification processing (such as storing and managing user permanent identities, etc.), access authorization control and contract data management, etc.
  • the authentication and authorization function (network slice-specific authentication and authorization function, NSSAAF) of network slice selection is mainly used to perform network slice and independent non-public network (stand-alone non-public networks, SNPN) authentication and authorization functions, specifically include:
  • AAA-S Support specific authentication and authorization for specified network slices using authentication, authorization, and accounting (authentication, authorization, and accounting, AAA) server AAA-server, AAA-S). If the AAA-S belongs to a third party, the NSSAAF can contact the AAA-S through an AAA proxy (AAA-proxy, AAA-P).
  • AAA-proxy AAA-P
  • AAA-S Support using AAA-S credentials to access SNPN. If the credential holder belongs to a third party, NSSAAF can contact AAA-S through AAA-P.
  • Data network refers to the service network that provides data transmission services for users, such as multimedia services (IP multi-media service, IMS), Internet (internet), etc.
  • the UE accesses the data network through a packet data unit (packet data unit, PDU) session established between the UE and the DN.
  • PDU packet data unit
  • AAA-P AAA-P
  • DN-AAA DN-AAA
  • AAA-S AAA-S
  • AAA server The AAA server and NSSAAF can be collectively referred to as an authentication device/function.
  • xx network element in Figure 6- Figure 11 can also be called xx function or xx.
  • an AMF network element may also be called an AMF or an AMF function
  • an SMF network element may also be called an SMF or an SMF function, which is not limited in this embodiment of the present application.
  • the authentication method provided by the embodiment of the present application can be applied to the communication system shown in any one of Fig. 5-Fig. I won't repeat them here.
  • FIG. 5-FIG. 11 are only simplified schematic diagrams for easy understanding, and the communication system may also include other network devices and/or other terminal devices, which are not shown in FIG. 5-FIG. 11 .
  • FIG. 12 is a first schematic flowchart of the authentication method provided by the embodiment of the present application. This authentication method can be applied to the communication system shown in FIG. 1, and performs a second authentication operation on the terminal device.
  • the authentication method includes the following steps:
  • the terminal device sends application information to the first network element.
  • the application information includes application identification information.
  • the application identification information may include one or more of the following: application identification, Internet protocol (internet protocol, IP) quintuple, application name, etc., which can be used to perform a secondary authentication operation on the application.
  • IP Internet protocol
  • S1203 is described above, and will not be repeated here.
  • the application information also includes application authentication information.
  • the application authentication information may include one or more of the following: user name, password, certificate information, etc., which may be used together with the application identification information for the authentication device to perform an authentication operation on the application.
  • user name e.g., a registered trademark of Cisco Systems, etc.
  • certificate information e.g., a registered trademark of Cisco Systems, etc.
  • the first network element may be an AMF.
  • S1201 may be specifically implemented as: the terminal device sends the application information to the AMF network element through the access network device.
  • the first network element may be an SMF.
  • S1201 may be specifically implemented as: the terminal device sends the application information to the SMF network element through the access network device and the AMF.
  • the first network element sends application information to the authentication device.
  • the first network element may be an AMF
  • the authentication device may be an NSSAAF deployed by an operator.
  • AMF can send application information to NSSAAF through service interface or N58 interface.
  • the first network element may be an AMF
  • the authentication device may be an NSSAAF deployed by an operator.
  • AMF can send application information to NSSAAF through service interface or N58 interface.
  • the first network element may be an SMF
  • the authentication device may be an NSSAAF deployed by an operator.
  • SMF can send application information to NSSAAF through the service interface.
  • the first network element may be an SMF
  • the authentication device may be an AAA-S deployed by a third-party application provider.
  • the AMF can send the application information to the NSSAAF through the service interface, and then the NSSAAF forwards it to the AAA-S.
  • NSSAAF may not forward the application information to AAA-S, but complete the second authentication operation by itself according to the authorization.
  • the authentication device determines an authentication result according to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the authentication device can compare the application information provided by the terminal device with the application information stored locally by the authentication device to determine whether the second authentication is successful.
  • the application information stored locally by the authentication device may include: application information of authorized applications, such as a whitelist, and/or application information of prohibited applications, such as a blacklist. For example, if the application information provided by the terminal device exists in the white list, it is deemed that the second authentication has passed (authentication is successful), otherwise it is deemed that the second authentication has not passed (authentication failed). For another example, if the application information provided by the terminal device exists in the blacklist, it is deemed that the second authentication has not passed (authentication failed), otherwise it is deemed that the second authentication has passed (authentication succeeded).
  • the authentication device can also determine the authentication result in combination with application authentication information, such as user name, password, and certificate information. In this way, dual authentication of application information and user information can be implemented to improve the reliability of the authentication result, thereby further improving network security and operating efficiency.
  • application authentication information such as user name, password, and certificate information.
  • the authentication result may be indicated implicitly or explicitly.
  • the following example illustrates.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the authentication result may not include authentication indication information, but include application identification information.
  • the application identification information in the authentication result can be understood as one of the following: all applications corresponding to the application identification information default to pass the authentication, all applications corresponding to the application identification information default to fail the authentication, or some applications The applications corresponding to the identification information pass the authentication by default, and the applications corresponding to the other application identification information fail the authentication by default.
  • the two parts of application identification information can be carried in different positions in the authentication result, such as different fields (fields) or information elements (information element, IE) to distinguish them.
  • the authentication device sends an authentication result to the first network element.
  • the authentication result is determined according to the application information, and the authentication result is used to generate a detection rule, and the detection rule is used to perform forwarding or discarding operations on the data of the application corresponding to the application information, such as forwarding the data of the application with successful secondary authentication, discarding The data of the application that failed the second authentication.
  • the first network element may be an access and mobility management network element, such as an AMF.
  • the method shown in FIG. 12 may further include the following step: the access and mobility management network element sends the authentication result to the session management network element.
  • the authentication device can send the authentication result to the AMF through the service interface or the N58 interface.
  • the AMF can send the authentication result to the session management network element, so that the session management network element can determine the detection rule.
  • the first network element may be a session management network element, such as an SMF.
  • the method shown in FIG. 12 may further include the following step: the authentication device sends the authentication result to the session management network element. Specifically, referring to FIG. 6 , FIG. 8 and FIG. 10 , the authentication device may send the authentication result to the SMF through the service interface.
  • the session management network element determines the detection rule according to the authentication result, and sends it to the user plane network element, so that the user plane network element can check the secondary
  • the data of the application whose authentication succeeds is forwarded, and the data of the application whose secondary authentication fails is discarded, so as to provide differentiated data transmission services for applications corresponding to different application information.
  • the session management network element can determine the detection rule itself according to the authentication result, and can also send the authentication result to the policy control network element, such as PCF, and receive the PCC rule determined by the policy control network element according to the authentication result, and then The detection rule is generated according to the returned PCC rule, which is not limited in this embodiment of the present application.
  • the policy control network element such as PCF
  • the foregoing detection rules may include packet detection rules (packet detection rule, PDR) and forwarding action rules (forwarding action rules, FAR).
  • PDR packet detection rule
  • FAR forwarding action rules
  • the detection rule may be the N4 rule or a part of the N4 rule, which is not limited here.
  • FIG. 13 is a second schematic flow diagram of the authentication method provided by the embodiment of the present application.
  • the authentication method is implemented based on a network slice authentication process.
  • the terminal device in FIG. 12 may be the UE in FIG. 13
  • the first network element in FIG. 12 may be the AMF in FIG. 13
  • the authentication device in FIG. 12 may be the NSSAAF in FIG. 13 .
  • the AMF can determine whether the UE has the access right to use the network slice purchased by the third-party application provider based on the network slice authentication process, thereby completing the second authentication of the UE.
  • the authentication method may include the following steps:
  • the AMF triggers network slice authentication in a registration process initiated by the UE.
  • the UE sends a registration request to the AMF, and the AMF responds to the registration request initiated by the UE and performs an authentication process, that is, an operator network authentication process.
  • the registration request carries the NSSAI requested by the UE, and the requested NSSAI may include one or more S-NSSAIs.
  • the registration process you can refer to the above-mentioned Figure 2 and its related text descriptions, which will not be repeated here.
  • the following S1302 may be performed.
  • the UE sends application information to the AMF.
  • the AMF may send a NAS MM transmission request to the UE and receive a NAS MM transmission response from the UE.
  • the NAS MM transmission request is used to request the application information of the application corresponding to the network slice requiring secondary authentication
  • the NAS MM transmission response carries the application information of the application corresponding to the network slice requiring secondary authentication.
  • the NAS MM transmission request and the NAS MM transmission response refer to the first NAS MM transmission request in S302 and the first NAS MM transmission response in S303, which will not be repeated here.
  • the application information includes application identification information and application authentication information.
  • the application identification information may be an IP quintuple, an application identifier, etc.
  • the application authentication information may be a user name, password, certificate information, etc. of the application.
  • S1302 may not be performed, that is, S1302 may be regarded as an optional step at this time.
  • the AMF sends the application information to the NSSAAF.
  • the AMF may carry the application information in the NSSAA authentication request and send it to the AMF.
  • the AMF may carry the application information in the NSSAA authentication request and send it to the AMF.
  • the AMF may carry the application information in the NSSAA authentication request and send it to the AMF.
  • the NSSAAF sends an authentication result to the UE through the AMF.
  • the NSSAAF may request the AAA-S to complete the second authentication, or complete the second authentication by itself, depending on the situation.
  • the NSSAAF can complete the second authentication by itself.
  • the NSSAAF can send the application information to the AAA-S and receive the authentication result from the AAA-S.
  • the authentication result at least includes application identification information, such as S-NSSAI of successful secondary authentication, which can be transmitted in the form of a container.
  • the authentication result may also include authentication indication information, where the authentication indication information is used to indicate whether the secondary authentication for a certain S-NSSAI is successful.
  • AAA-S may locally pre-configure the application information available to the UE, and the UE may not need to report the application information in the above S1301-S1303.
  • the UE sends a PDU session establishment request to the SMF through the AMF.
  • the AMF receives the first PDU session establishment request from the UE, and sends the second PDU session establishment request to the SMF.
  • the first PDU session establishment request may include the allowed NSSAI
  • the second PDU session establishment request may include the S-NSSAI and the authentication result of the application information corresponding to the S-NSSAI.
  • the second PDU session establishment request may also include the ID of the NSSAAF, the ID of the UE, and the ID of the network slice.
  • the SMF can also directly obtain the authentication result from the NSSAAF, without the need for the AMF to forward the authentication result to the SMF after receiving the authentication result.
  • Another implementation manner may be: when the PDU session is established, the AMF sends the SMF identifier, the UE identifier and the network slice identifier to the NSSAAF, and the NSSAF sends the authentication result to the SMF.
  • the SMF sends the detection rule to the UPF.
  • the SMF can determine or request the PCF to determine the N4 rule according to the second authentication result of the S-NSSAI and the application information corresponding to the S-NSSAI, and send the N4 rule to the UPF through the N4 session.
  • the N4 rule includes a detection rule, and the detection rule is used to instruct the UPF to forward or discard the data of the application corresponding to the application information.
  • the detection rule for the specific implementation of the detection rule, reference may be made to the above S1204, which will not be repeated here.
  • FIG. 14 is a third schematic flowchart of the authentication method provided by the embodiment of the present application.
  • the authentication method is implemented based on a network slice authentication process.
  • the terminal device in FIG. 12 may be the UE in FIG. 14
  • the first network element in FIG. 12 may be the AMF in FIG. 14
  • the authentication device in FIG. 12 may be the NSSAAF in FIG. 14 .
  • the AMF can determine whether the UE has the access right to use the network slice purchased by the third-party application provider based on the network slice authentication process, thereby completing the second authentication of the UE.
  • the authentication method may include the following steps:
  • the AMF triggers network slice authentication in a registration process initiated by the UE.
  • the UE sends application information to the AMF.
  • the AMF sends the application information to the NSSAAF.
  • the NSSAAF sends an authentication result to the UE through the AMF.
  • the UE sends a PDU session establishment request to the SMF through the AMF.
  • the PDU session request may include the identifier of the network slice for which the UE requests to establish the PDU session, such as S-NSSAI.
  • the AMF may only perform the forwarding operation of the PDU session establishment request.
  • the difference between S1405 and S1305 is that: the second PDU session establishment request sent by the AMF to the SMF may not include the authentication result. At this time, the SMF may obtain the authentication result from the AMF after receiving the PDU session establishment request, that is, execute the following S1406-S1407.
  • the SMF acquires an authentication result from the AMF.
  • the SMF may send an authentication result acquisition request to the AMF, and receive the authentication result from the AMF.
  • the authentication result acquisition request may include the S-NSSAI of the network slice carried in the PDU session request.
  • the SMF can judge whether the S-NSSAI needs to perform secondary authentication for each application according to the subscription data in the UDM. If yes, obtain the authentication result from the AMF.
  • the SMF may also subscribe to the AMF for the application information passed the authentication. In this way, whenever the application authentication result is updated (or changed), the SMF can receive the authentication result update notification from the AMF.
  • the SMF sends the detection rule to the UPF.
  • FIG. 15 is a fourth schematic flowchart of the authentication method provided by the embodiment of the present application.
  • the authentication method is implemented based on the PDU session establishment process.
  • the terminal device in Figure 12 may be the UE in Figure 15
  • the first network element in Figure 12 may be the SMF in Figure 15
  • the authentication device in Figure 12 may be the DN-AAA in Figure 15, such as AAA-S deployed in the DN.
  • the SMF can determine whether the UE has the access right to use the network slice purchased by the third-party application provider based on the network slice authentication process, thereby completing the second authentication of the UE.
  • the authentication method may include the following steps:
  • the SMF sends a first authentication request to the DN-AAA.
  • the SMF may send the first authentication request to the DN-AAA through the UPF during the PDU session establishment process initiated by the UE, thereby triggering the second authentication.
  • the first authentication request is used to request the DN-AAA to start the second authentication.
  • the SMF receives the first authentication response from the DN-AAA.
  • the first authentication response is used to notify the SMF: whether the DN-AAA is allowed to start the second authentication of the UE. If yes, execute the following S1503.
  • the SMF can judge whether the DN-AAA needs to perform secondary authentication for the application according to the subscription data. If so, the SMF can send an application information acquisition request to the UE, and receive the application information from the UE, which can be specifically implemented as follows S1503-S1504:
  • the SMF sends an application information acquisition request to the UE.
  • the application information acquisition request carries the EAP ID request and the identity information of the UE, and is used to request application information requiring secondary authentication.
  • the SMF receives an application information acquisition response from the UE.
  • the application information obtaining response carries the application information, the EAP ID response and the identity information of the UE.
  • the application information obtaining response carries the application information, the EAP ID response and the identity information of the UE.
  • the content of the application information reference may be made to S1201, which will not be repeated here.
  • S1503-S1504 may not be executed, but the following S1505 is executed, that is, S1503-S1504 can be regarded as optional at this time step.
  • the SMF sends a second authentication request to the DN-AAA.
  • the second authentication request carries the application information obtained in S1504.
  • the DN-AAA sends a second authentication response to the SMF.
  • the second authentication response carries an authentication result.
  • the content of the authentication result please refer to S1203-S1204, which will not be repeated here.
  • the SMF determines the N4 rule according to the authentication result.
  • the SMF sends the N4 rule to the UPF.
  • the N4 rule includes the detection rule.
  • the detection rule reference may be made to S1306, which will not be repeated here.
  • the authentication method shown in FIG. 15 can be implemented alone, or can be implemented in combination with the authentication method shown in FIG. 13 or FIG. 14 .
  • the SMF can integrate the application information in the authentication result obtained from AMF and the authentication result obtained from AAA-S.
  • Application information such as the intersection of the above two types of application information, generates detection rules.
  • FIG. 16 is a fifth schematic flowchart of the authentication method provided by the embodiment of the present application.
  • This authentication method can be implemented in combination with the authentication method shown in any one of Figs. 13-15.
  • the terminal device in Figure 12 can be the UE in Figure 16
  • the first network element in Figure 12 can be the AMF or SMF in Figure 16
  • the authentication device in Figure 12 can be the NSSAAF or AAA in Figure 16 -S.
  • the PCF may generate a detection rule based on the authentication result obtained from the AMF and/or the NSSAAF/AAA-S.
  • the authentication method may include the following steps:
  • the SMF receives the authentication result from the AMF and/or NSSAAF.
  • the authentication result includes at least application identification information.
  • the SMF sends the authentication result to the PCF.
  • the PCF determines a PCC rule based on the authentication result.
  • the PCF sends the PCC rule to the SMF.
  • the SMF sends the detection rule to the UPF.
  • the SMF can generate a detection rule, such as the N4 rule, according to the PCC rule, and send it to the UPF.
  • UPF can implement a customized forwarding strategy for the application data corresponding to the application identification information according to the detection rules.
  • the gate control of the PCC rule corresponding to the application that passes the authentication is defined as open, otherwise it is defined as closed, so as to realize forwarding
  • the data of the application that succeeds in the second authentication, or the data of the application that fails the second authentication is discarded.
  • the difference between the authentication method shown in Figure 16 and the authentication method shown in any one of Figures 13-15 is that: in any one of Figures 13-15 In the authentication method shown in Figure 16, the PCC rule is determined by the SMF, while in the authentication method shown in Figure 16, the PCC rule is determined by the PCF.
  • FIGS. 13-15 are examples, and should not be considered as limiting the protection scope of the technical solution provided by the present application.
  • the authentication device is NSSAAF in FIG. 13 and FIG. 14 , DN-AAA in FIG. 15 , and NSSAAF and AAA-S in FIG. 16 .
  • the embodiment of the present application does not limit the type and quantity of authentication devices.
  • the PCF can generate URSP rules based on one or more of the following information: subscription information (such as whether the slice/DNN needs secondary authentication, whether an application Slice/DNN secondary authentication is required, etc.), authentication requirement information reported by AMF or SMF (such as whether slice/DNN requires secondary authentication, whether an application requires slice/DNN secondary authentication, etc.), two authentication result.
  • subscription information such as whether the slice/DNN needs secondary authentication, whether an application Slice/DNN secondary authentication is required, etc.
  • authentication requirement information reported by AMF or SMF such as whether slice/DNN requires secondary authentication, whether an application requires slice/DNN secondary authentication, etc.
  • the path selection descriptor of the URSP rule is shown in Table 6 below.
  • Table 6 has the following differences: Added the rules of passing the second authentication of the slice of the application and passing the second authentication of the DN of the application. It is worth noting that the names in Table 6 are examples only and do not limit the implementation to use other names.
  • the UE can judge whether to use a certain URSP (or routing descriptor, RSD) according to the returned authentication result. Specifically, only when the second authentication of the application passes, the UE considers that the URSP rule (or RSD) of the DNN/S-NSSAI corresponding to the application is valid. Only when the URSP rule or RSD is legal, the UE will use the corresponding URSP rule (RSD), such as initiating a PDU session establishment request based on the corresponding URSP rule.
  • URSP rule or RSD
  • RSD routing descriptor
  • the network side (such as AMF or SMF) can send the authentication result to the UE after (applying) the second authentication (as described in the above embodiments), and the UE can judge whether the above routing verification standard is met according to the authentication result.
  • the PCF uses the secondary authentication result as input, specifically, as shown in Table 6, it can also use the verification criteria (validation criteria) field, such as routing selection verification criteria, to directly transmit the authentication result, such as adding corresponding instructions.
  • the UE can directly make a judgment without the AMF or SMF sending an additional authentication result.
  • the authentication device can perform a secondary authentication operation on the applications corresponding to any application information one by one according to the application information.
  • the first network element can determine a detection rule for each application one by one based on the authentication result, and instruct each network node on the data transmission path to forward data of applications corresponding to different application information based on the detection rule.
  • discarding operations such as forwarding the data of applications that succeed in authentication and discarding data of applications that fail to authenticate, to ensure that even if application information is stolen or tampered with, network resources will not be abused, thereby improving network security and operating efficiency.
  • the authentication method provided by the embodiment of the present application has been described in detail above with reference to FIG. 12-FIG. 16 .
  • the authentication device for executing the authentication method provided by the embodiment of the present application will be described in detail below with reference to FIGS. 17-20 .
  • FIG. 17 is a first structural diagram of an authentication device provided by an embodiment of the present application.
  • an authentication device 1700 includes: a receiving module 1701 and a sending module 1702 .
  • FIG. 17 only shows the main components of the authentication device.
  • the authentication device 1700 can be applied in the communication system shown in FIG. 4, and perform the function of the first network element in the authentication method shown in FIG. 12, or be applicable to the communication system shown in FIG. In the communication system shown in any one of them, the function of AMF or SMF in the authentication method shown in Fig. 13-Fig. 16 is executed.
  • the receiving module 1701 is configured to receive application information from a terminal device.
  • a sending module 1702 configured to send application information to the authentication device.
  • the receiving module 1701 is also configured to receive the authentication result from the authentication device.
  • the authentication result is determined according to the application information, and the authentication result is used to generate a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the sending module 1702 is also configured to send the authentication result to the session management network element.
  • the authentication apparatus 1700 further includes: a processing module 1703 (shown by a dashed box in FIG. 17 ). Wherein, the processing module 1703 is configured to determine the detection rule according to the authentication result. The sending module 1702 is also configured to send the detection rule to the user plane network element.
  • the sending module 1702 is also configured to send the authentication result to the policy control network element.
  • the receiving module 1701 is also configured to receive detection rules from policy control network elements.
  • the receiving module 1701 and the sending module 1702 may also be integrated into one module, such as a transceiver module (not shown in FIG. 17 ).
  • the transceiving module is used to implement the transceiving function of the authentication device 1700 .
  • the authentication device 1700 may further include a storage module (not shown in FIG. 17 ), where computer programs or instructions are stored in the storage module.
  • the processing module 1703 executes the computer program or instruction
  • the authentication device 1700 can execute the authentication method shown in any one of Fig. 12-Fig. 16 .
  • the authentication device 1700 may be a first network element, such as an access and mobility management network element, or a session management network element, or a chip (system) or other components that can be set in the first network element or a component, and may also be a device or system including the first network element, which is not limited in this application.
  • a first network element such as an access and mobility management network element, or a session management network element, or a chip (system) or other components that can be set in the first network element or a component, and may also be a device or system including the first network element, which is not limited in this application.
  • the processing module involved in the authentication device 1700 may be implemented by a processor or a processor-related circuit component, and may be a processor or a processing unit;
  • the transceiver module may be implemented by a transceiver or a transceiver-related circuit component, and may be a transceiver or transceiver unit.
  • FIG. 18 is a second structural schematic diagram of an authentication device provided by an embodiment of the present application.
  • the authentication device 1800 includes: an acquiring module 1801 and a sending module 1802 .
  • FIG. 18 only shows the main components of the authentication device.
  • the authentication device 1800 can be applied to the communication system shown in FIG. 4, and perform the function of the authentication device in the authentication method shown in FIG. 12, or be applicable to the communication system shown in FIG. In the communication system shown in any one, the function of NSSAAF or DN-AAA in the authentication method shown in Fig. 13-Fig. 16 is executed.
  • the obtaining module 1801 is used to obtain application information.
  • the application information is used to determine the authentication result.
  • the sending module 1802 is configured to send the authentication result to the first network element.
  • the authentication result is used to determine a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the authentication apparatus 1800 further includes: a receiving module 1803 .
  • the receiving module 1803 is configured to receive application information from the first network element.
  • the receiving module 1803 and the sending module 1802 may also be integrated into one module, such as a transceiver module (not shown in FIG. 18 ).
  • the transceiving module is used to implement the transceiving function of the authentication device 1800 .
  • the obtaining module 1801 may be integrated with other processing functions of the authentication device 1800 into a processing module (not shown in FIG. 18 ), and the processing module is used to realize the processing functions of the authentication device 1800 .
  • the authentication device 1800 may further include a storage module (not shown in FIG. 18 ), where computer programs or instructions are stored in the storage module.
  • the processing module executes the computer program or instruction
  • the authentication device 1800 can execute the authentication method shown in any one of FIGS. 12-16 .
  • the authentication device 1800 can be an authentication device, such as NSSAAF, AAA-S, AAA-P, DN-AAA, etc., or a chip (system) or other components or components that can be set in the authentication device , may also be an apparatus or system including an authentication device, which is not limited in this embodiment of the present application.
  • an authentication device such as NSSAAF, AAA-S, AAA-P, DN-AAA, etc.
  • a chip (system) or other components or components that can be set in the authentication device may also be an apparatus or system including an authentication device, which is not limited in this embodiment of the present application.
  • FIG. 19 is a third schematic structural diagram of an authentication device provided by an embodiment of the present application.
  • the authentication device 1900 includes: a sending module 1901 .
  • FIG. 19 only shows the main components of the authentication device.
  • the authentication apparatus 1900 may be applicable to the communication system shown in FIG. 4, and perform the functions of the terminal equipment in the authentication method shown in FIG. 12, or be applicable to any of the In an illustrated communication system, the functions of the UE in the authentication methods shown in FIG. 13-FIG. 16 are performed.
  • the sending module 1901 is configured to send the application information to the first network element.
  • the application information is used to determine the authentication result, and the authentication result is used to generate a detection rule, and the detection rule is used to forward or discard the data of the application corresponding to the application information.
  • the application information includes application identification information
  • the authentication result includes application identification information
  • the application information also includes application authentication information.
  • the authentication result further includes authentication indication information, and the authentication indication information is used to indicate whether the authentication operation on the application corresponding to the application information is successful.
  • the authentication device 1900 further includes: a receiving module 1902 .
  • the receiving module 1902 is configured to receive the authentication result from the first network element.
  • the sending module 1901 and the receiving module 1902 may also be integrated into one module, such as a transceiver module (not shown in FIG. 19 ).
  • the transceiver module is used to implement the transceiver function of the authentication device 1900 .
  • the authentication apparatus 1900 may further include a processing module 1903 .
  • the processing module is used to realize the processing function of the device.
  • the authentication device 1900 may further include a storage module (not shown in FIG. 19 ), where computer programs or instructions are stored in the storage module.
  • the processing module 1903 executes the computer program or instruction
  • the authentication device 1900 can execute the authentication method shown in any one of FIG. 12-FIG. 16 .
  • the authentication device 1900 may be a terminal device, or a chip (system) or other components or components that may be installed in the terminal device, or a device or system including the terminal device, which is not covered by this application. limited.
  • FIG. 20 is a fourth structural schematic diagram of an authentication device provided by an embodiment of the present application.
  • the authentication device may be a terminal device or a network device, or may be a chip (system) or other components or components that may be provided in the terminal device or the network device.
  • the authentication device 2000 may include a processor 2001 .
  • the authentication device 2000 may further include a memory 2002 and/or a transceiver 2003 .
  • the processor 2001 is coupled with the memory 2002 and the transceiver 2003, such as may be connected through a communication bus.
  • the components of the authentication device 2000 will be specifically introduced below in conjunction with FIG. 20 :
  • the processor 2001 is the control center of the authentication device 2000, and may be one processor, or a general term for multiple processing elements.
  • the processor 2001 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 2001 can execute various functions of the authentication device 2000 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002 .
  • the processor 2001 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 20 .
  • the authentication apparatus 2000 may also include multiple processors, for example, the processor 2001 and the processor 2004 shown in FIG. 20 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 2002 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 2001.
  • the processor 2001 For the specific implementation, reference may be made to the above-mentioned method embodiments, which will not be repeated here.
  • the memory 2002 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices for instructions can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical discs storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and any other medium that can be accessed by a computer, but is not limited to.
  • the memory 2002 can be integrated with the processor 2001, or can exist independently, and is coupled with the processor 2001 through the interface circuit (not shown in FIG. 20 ) of the authentication device 2000, which is not specifically limited in this embodiment of the present application.
  • Transceiver 2003 used for communication with other authentication devices.
  • the authentication apparatus 2000 is a terminal device, and the transceiver 2003 can be used to communicate with a network device, or communicate with another terminal device.
  • the authentication apparatus 2000 is a network device, and the transceiver 2003 may be used to communicate with a terminal device or communicate with another network device.
  • the transceiver 2003 may include a receiver and a transmitter (not separately shown in FIG. 20 ). Wherein, the receiver is used to realize the receiving function, and the transmitter is used to realize the sending function.
  • the transceiver 2003 may be integrated with the processor 2001, or may exist independently, and be coupled to the processor 2001 through an interface circuit (not shown in FIG. 20 ) of the authentication device 2000. Not specifically limited.
  • the structure of the authentication device 2000 shown in FIG. 20 does not constitute a limitation to the authentication device.
  • the actual authentication device may include more or less components than shown in the figure, or combine some components, or different component arrangements.
  • An embodiment of the present application provides a communication system.
  • the communication system includes a terminal device, a first network element and an authentication device.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs. When the computer instruction or computer program is loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种鉴权方法及装置，能够解决APP信息容易被盗用或篡改的问题，从而提高网络安全性和运行效率，可应用于车联网、V2X、5G、6G等通信系统中。该方法包括：第一网元接收来自终端设备的应用信息，并向鉴权设备转发，然后接收来自鉴权设备的鉴权结果，从而完成基于应用信息的二次鉴权。其中，鉴权结果根据应用信息确定，用于生成检测规则，该检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。

Description

鉴权方法及装置
本申请要求于2021年10月20日提交国家知识产权局、申请号为202111223393.9、申请名称为“鉴权方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种鉴权方法及装置。
背景技术
当与一个网络切片(network slice)关联的多个应用程序(application，APP)运行时，可以基于用户设备路由选择策略(user equipment route selection policy，URSP)规则，建立新的分组数据单元(packet data unit，PDU)会话(session)，或者选择现有的PDU会话与网络切片关联。例如，假定APP1和APP2均被允许(allowed)使用网络切片1，APP1已经通过网络切片鉴权(network slice-specific authentication and authorization，NSSAA)，且APP1可以通过新创建的PDU会话1与网络切片1相关联，则无需再对APP2进行任何鉴权操作，即可通过PDU会话1与网络切片1相关联。
在此情况下，APP的各种信息很容易被盗用或篡改，导致滥用网络切片资源/数据网络资源的问题，网络安全性差，且运行效率低下。
发明内容
本申请实施例提供一种鉴权方法及装置，能够解决APP信息容易被盗用或篡改的问题，从而提高网络安全性和运行效率。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种鉴权方法，应用于第一网元。该方法包括：接收来自终端设备的应用信息，并向鉴权设备发送应用信息，然后接收来自鉴权设备的鉴权结果。其中，鉴权结果根据应用信息确定，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
基于第一方面至下述第三方面所述的鉴权方法，鉴权设备可以根据应用信息，对任一应用信息对应的应用逐一进行鉴权操作。如此，第一网元可以基于该鉴权结果，为每个应用逐一定制检测规则，并指示数据传输路径上的各网络节点，基于定制的检测规则，对不同应用信息对应的各个应用的数据分别执行转发或丢弃操作，如转发鉴权成功的应用的数据、丢弃鉴权失败的应用的数据，以确保即使应用信息被盗用或篡改，也不会滥用网络资源，从而提高网络安全性和运行效率。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。其中，应用识别信息可以包括如下一项或多项：应用标识、互联网协议(internet protocol，IP)五元组、应用名称等，可以用于对应用执行鉴权操作，并基于鉴权结果为应用逐一定制检测规则，以便对不同应用的数据执行差异化的数据传输服务，如转发通过认证的应用的数据、或丢弃未通过鉴权的应用的数据，从而提高网络安全性和运行效率。
可选地，应用信息还包括应用鉴权信息。其中，应用鉴权信息可以包括如下一项或多项：用户名、密码、证书信息等，可以与应用识别信息一起，用于鉴权设备对应用执行鉴权操作，以提高鉴权结果的可靠性，从而进一步提高网络安全性和运行效率。
本申请中，可以隐式或显式地指示鉴权结果。下面举例说明。
示例性地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应 的应用的鉴权操作是否成功。
或者，鉴权结果不包括鉴权指示信息，而是包括应用识别信息。此时，鉴权结果中的应用识别信息可以理解为如下之一：所有应用识别信息各自对应的应用均默认为鉴权通过、所有应用识别信息各自对应的应用均默认为鉴权未通过、或一部分应用识别信息对应的应用默认为鉴权通过，且另一部分应用识别信息对应的应用默认为鉴权未通过。其中，该两部分应用识别信息可以承载于鉴权结果中的不同位置，如不同字段(field)或信元(information element，IE)，予以区分。
一种可能的设计方案中，第一网元可以为接入与移动性管理网元。相应地，第一方面所述的方法还可以包括：接入与移动性管理网元向会话管理网元发送鉴权结果，以便会话管理网元自行确定检测规则，也可以请求策略控制网元确定检测规则，从而实现对不同应用信息对应的应用提供差异化的数据传输服务。
另一种可能的设计方案中，第一网元可以为会话管理网元。相应地，第一方面所述的方法还可以包括：会话管理网元根据鉴权结果确定检测规则，并向用户面网元发送检测规则。
类似地，会话管理网元可以自行确定检测规则，也可以请求策略控制网元确定检测规则，从而实现对不同应用信息对应的应用提供差异化的数据传输服务。
可选地，会话管理网元根据鉴权结果确定检测规则，具体包括：会话管理网元向策略控制网元发送鉴权结果，并接收来自策略控制网元的检测规则，从而实现对不同应用信息对应的应用提供差异化的数据传输服务。
第二方面，提供一种鉴权方法，应用于鉴权设备。该方法包括：获取应用信息。其中，应用信息用于确定鉴权结果。向第一网元发送鉴权结果。其中，鉴权结果用于确定检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，获取应用信息，具体包括：接收来自第一网元的应用信息。
第三方面，提供一种鉴权方法，应用于终端设备。该方法包括：向第一网元发送应用信息。其中，应用信息用于确定鉴权结果，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，第三方面所述的方法还包括：接收来自第一网元的鉴权结果。
此外，第二方面至第三方面所述的鉴权方法的技术效果可以参考第一方面所述的鉴权方法的技术效果，此处不再赘述。
第四方面，提供一种鉴权装置，该装置可应用于第一网元。该装置包括：接收模块和发送模块。其中，接收模块，用于接收来自终端设备的应用信息。发送模块，用于向鉴权设备发送应用信息。接收模块，还用于接收来自鉴权设备的鉴权结果。其中，鉴权结果根据应用信息确定，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，第一网元可以为接入与移动性管理网元。相应地，发送模块，还用于向会话管理网元发送鉴权结果。
另一种可能的设计方案中，第一网元可以为会话管理网元。相应地，第四方面所述的装置还包括：处理模块。其中，处理模块，用于根据鉴权结果确定检测规则。发送模块，还用于向用户面网元发送检测规则。
可选地，发送模块，还用于向策略控制网元发送鉴权结果。接收模块，还用于接收来自策略控制网元的检测规则。
可选地，接收模块和发送模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第四方面所述的装置的收发功能。
可选地，第四方面所述的鉴权装置还可以包括存储模块，该存储模块存储有计算机程序或指令。当处理模块执行该计算机程序或指令时，使得该鉴权装置可以执行第一方面所述的鉴权方法。
可选地，第四方面所述的鉴权装置可以是第一网元，如接入与移动性管理网元、或会话管理网元，也可以是可设置于第一网元中的芯片(系统)或其他部件或组件，还可以是包含第一网元的装置或系统，本申请对此不做限定。
第五方面，提供一种鉴权装置，应用于鉴权设备。该装置包括：获取模块和发送模块。其中，获取模块，用于获取应用信息。其中，应用信息用于确定鉴权结果。发送模块，用于向第一网元发送鉴权结果。其中，鉴权结果用于确定检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，第五方面所述的装置还包括：接收模块。其中，接收模块，用于接收来自第一网元的应用信息。
可选地，获取模块可以具有接收功能，该接收功能和发送模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第五方面所述的装置的收发功能。
可选地，获取模块也可以具有处理功能，如访问本地存储空间，该处理功能也可以与第五方面所述的装置的其他处理功能集成为一个模块，如处理模块。其中，处理模块用于实现该装置的处理功能。
可选地，第五方面所述的鉴权装置还可以包括存储模块，该存储模块存储有计算机程序或指令。当处理模块执行该计算机程序或指令时，使得该鉴权装置可以执行第二方面所述的鉴权方法。
可选地，第五方面所述的鉴权装置可以是鉴权设备，也可以是可设置于鉴权设备中的芯片(系统)或其他部件或组件，还可以是包含鉴权设备的装置或系统，本申请对此不做限定。
第六方面，提供一种鉴权装置，可应用于终端设备。该装置包括：发送模块。其中，发送模块，用于向第一网元发送应用信息。其中，应用信息用于确定鉴权结果，鉴权结果用于 生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，第六方面所述的装置还包括：接收模块。其中，接收模块，用于接收来自第一网元的鉴权结果。
可选地，接收模块和发送模块也可以集成为一个模块，如收发模块。其中，收发模块用于实现第六方面所述的装置的收发功能。
可选地，第六方面所述的装置还可以包括处理模块。其中，处理模块用于实现该装置的处理功能。
可选地，第六方面所述的鉴权装置还可以包括存储模块，该存储模块存储有计算机程序或指令。当处理模块执行该计算机程序或指令时，使得该鉴权装置可以执行第三方面所述的鉴权方法。
可选地，第六方面所述的鉴权装置可以是终端设备，也可以是可设置于终端设备中的芯片(系统)或其他部件或组件，还可以是包含终端设备的装置或系统，本申请对此不做限定。
第七方面，提供一种鉴权装置。该鉴权装置用于执行第一方面至第三方面中任一方面所述的鉴权方法。
其中，第七方面所述的鉴权装置包括实现上述第一方面至第三方面中任一方面所述的鉴权方法相应的模块、单元、或手段(means)，该模块、单元、或手段可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个用于执行上述鉴权方法所涉及的功能的模块或单元。
第八方面，提供一种鉴权装置。该鉴权装置包括：处理器，该处理器用于执行第一方面至第三方面中任一方面所述的鉴权方法。
在一种可能的设计方案中，第八方面所述的鉴权装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第八方面所述的鉴权装置与其他装置通信。
在一种可能的设计方案中，第八方面所述的鉴权装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面至第三方面中任一方面所述的鉴权方法所涉及的计算机程序和/或数据。
第九方面，提供一种鉴权装置。该鉴权装置包括：处理器，该处理器与存储器耦合，该处理器用于执行存储器中存储的计算机程序，以使得该鉴权装置执行第一方面至第三方面中任一方面所述的鉴权方法。
在一种可能的设计方案中，第九方面所述的鉴权装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第九方面所述的鉴权装置与其他装置通信。
在一种可能的设计方案中，第九方面所述的鉴权装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面至第三方面中任一方面所述的鉴权方法所涉及的计算机程序和/或数据。
第十方面，提供了一种鉴权装置，包括：处理器和存储器；该存储器用于存储计算机程序，当该处理器执行该计算机程序时，以使该鉴权装置执行第一方面至第三方面中的任一方面所述的鉴权方法。
可选地，该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储 第一方面至第三方面中任一方面所述的鉴权方法所涉及的计算机程序和/或数据。
在一种可能的设计方案中，第十方面所述的鉴权装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第十方面所述的鉴权装置与其他鉴权装置通信。
第十一方面，提供了一种鉴权装置，包括：处理器；所述处理器用于与存储器耦合，并在读取存储器中的计算机程序之后，根据该计算机程序执行如第一方面至第三方面中任一方面所述的鉴权方法。
可选地，该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面至第三方面中任一方面所述的鉴权方法所涉及的计算机程序和/或数据。
在一种可能的设计方案中，第十一方面所述的鉴权装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第十一方面所述的鉴权装置与其他装置通信。
可选地，上述第七方面至第十一方面所述的鉴权装置可以是上述第一网元或鉴权设备或终端设备，也可以是可设置于该第一网元或鉴权设备或终端设备中的芯片(系统)或其他部件或组件，还可以是包含该第一网元或鉴权设备或终端设备的装置或系统，本申请对此不做限定。
此外，上述第四方面至第十一方面所述的鉴权装置的技术效果，可以参考上述第一方面所述的鉴权方法的技术效果，此处不再赘述。
第十二方面，提供一种通信系统。该通信系统包括第一网元、鉴权设备和终端设备。
第十三方面，提供一种计算机可读存储介质，存储有计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第三方面中任一方面所述的鉴权方法。
第十四方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第三方面中任一方面所述的鉴权方法。
附图说明
图1为现有的PDU会话选择示例图；
图2为现有的基于网络切片鉴权流程的二次鉴权的流程示意图一；
图3为现有的基于网络切片鉴权流程的二次鉴权的流程示意图二；
图4为现有的基于PDU会话流程的二次鉴权的流程示意图；
图5为本申请实施例提供的通信系统的架构示意图一；
图6为5G系统的架构示意图一；
图7为5G系统的架构示意图二；
图8为5G系统的架构示意图三；
图9为5G系统的架构示意图四；
图10为5G系统的架构示意图五；
图11为5G系统的架构示意图六；
图12为本申请实施例提供的鉴权方法的流程示意图一；
图13为本申请实施例提供的鉴权方法的流程示意图二；
图14为本申请实施例提供的鉴权方法的流程示意图三；
图15为本申请实施例提供的鉴权方法的流程示意图四；
图16为本申请实施例提供的鉴权方法的流程示意图五；
图17为本申请实施例提供的鉴权装置的结构示意图一；
图18为本申请实施例提供的鉴权装置的结构示意图二；
图19为本申请实施例提供的鉴权装置的结构示意图三；
图20为本申请实施例提供的鉴权装置的结构示意图四。
具体实施方式
首先介绍本申请实施例所涉及的技术术语。
1、URSP
在第五代(5th generation，5G)移动通信中，引入了用户设备(user equipment，UE)相关的策略信息，如用户路由选择策略(user equipment route selection policy，URSP)，由UE作为该策略的执行者，为业务流选择一个合适的PDU会话。换言之，某些业务对使用PDU会话的数据网络(data network，DN)，网络切片(network slice)，会话和服务连续模式(session and service continuity mode，SSC)等具有一定的要求，UE可使用此策略确定检测到的应用(application，APP)是否可以关联到已建立的PDU会话，是否可以卸载到PDU会话之外的非3GPP接入，或者是否可以触发新的PDU会话的建立等操作。
URSP通常基于如下路径下发给UE：PCF->AMF->UE。其中，PCF为策略控制功能(policy control function)网元，AMF为接入和移动性管理功能(access and mobility management function)网元。
具体地，PCF可以根据签约信息(切片/DNN是否需要二次鉴权，某个应用是否需要切片/DNN二次鉴权等等)，或者AMF、SMF上报的信息(切片/DNN是否需要二次鉴权，某个应用是否需要切片/DNN二次鉴权等等)，生成以上URSP规则，并下发给AMF。
URSP的执行：由UE来执行，可能会触发PDU会话的建立或修改。比如，没有符合要求的PDU会话时，UE会发起PDU会话建立过程；有符合要求的会话时，可能直接使用已经存在的PDU会话。
URSP包括一条或多条URSP规则。一条URSP规则主要包括流量描述符(traffic descriptor)和路由选择描述符(route selection descriptor)两部分。其中，流量描述符包括多个APP的名称或标识等，路由选择描述符包括每个APP对应的网络切片选择信息，以及通配的网络切片选择信息，如未包括在流量描述符的APP可以使用的网络切片选择信息等等。其中，URSP可以参阅表1所示，URSP规则可以参阅表2所示，路由选择描述符可以参阅表3所示。
表1
Figure PCTCN2022125734-appb-000001
表2
Figure PCTCN2022125734-appb-000002
Figure PCTCN2022125734-appb-000003
表3
Figure PCTCN2022125734-appb-000004
当检测到新的APP时，UE根据URSP确定该APP对应的路由选择描述信息(route selection descriptor，RSD)，并确定已建立的PDU会话中是否存在满足该路由选择描述信息的PDU会话。若是，则UE将检测到的新的APP关联到满足该路由选择描述信息的PDU会话上，通过该PDU会话传输所述新的APP的数据。若否，则UE建立一个满足该路由选择描述信息的PDU会话。
例如，图1为现有的PDU会话选择示例。如图1所示，UE为应用B建立PDU会话1，而为应用A、C、D、E、F选择现有的PDU会话，如为应用A选择PDU会话2。
2、二次鉴权
5G通信系统包括运营商网络。当UE访问运营商网络时，需要对该UE进行鉴权(运营商网络鉴权、第一级鉴权、一级鉴权、第一次鉴权、一次鉴权、主鉴权)，以确定该UE是否具备该运营商网络的访问权限，如该UE为该运营商网络的签约用户，或该UE签约的运营商与该UE想要访问的运营商网络的所有方(另一运营商)之间签署有漫游服务协议。
可选地，5G通信系统还可以包括提供商网络，即应用内容可以是由第三方应用提供商提供的。类似地，当UE通过运营商网络访问提供商网络时，除上述一次鉴权外，提供商网络也需要对该UE进行鉴权(提供商网络鉴权、第二级鉴权、二级鉴权、第二次鉴权、二次鉴权、辅鉴权)，以确定该UE是否具备该提供商网络的访问权限，如该UE为该提供商网络的签约用户。
需要说明的是，二次鉴权可以委托运营商网络进行，如下述由运营商网络执行的网络切片鉴权，也可以由提供商网络进行，如下述由提供商部署的数据网络(data network，DN)，如DN中的AAA-S，执行的PDU会话鉴权。
3、网络切片鉴权
网络切片是通过切片技术在一个通用硬件基础上虚拟出多个端到端网络，每个网络具有不同网络功能，以适配不同类型的服务需求。换言之，网络切片可以理解为基于物理网络的部分资源，以实现一种或多种特定功能的逻辑网络。例如，运营商部署物理资源后，可以针对大众上网业务，使用物理资源虚拟出一个增强型移动宽带业务(enhanced mobile broadband，eMBB)切片，也可以针对垂直行业中某些厂商的智能抄表需求，使用物理资源再虚拟出一个海量机器类通信(massive machine type of communication，mMTC)切片，还可以针对智能驾驶、无人驾驶等需求，使用物理资源再虚拟出一个超高可靠与低时延通信(ultra reliable low latency communication，uRLLC)切片。上述三个网络切片分别为不同业务场景提供不同类型的服务。
网络切片可以用单网络切片选择辅助信息(single network slice selection Assistance information，S-NSSAI)来标识。根据运营商的运营或部署需要，一个S-NSSAI可以关联一个或多个网络切片实例，一个网络切片实例可以关联一个或多个S-NSSAI。
S-NSSAI包括SST和SD两部分：切片/服务类型(slice/servicetype，SST)和切片差异(slice differentiator，SD)。其中，SST是指在特性和服务方面预期的网络切片行为。SST的标准取值范围为1、2、3，取值1表示eMBB、2表示URLLC、3表示大规模物联网(massive internet of things，MIoT)。SD是一个可选信息，用来补充SST以区分同一个切片/业务类型的多个网络切片。
SST和SD两部分结合起来表示切片类型及同一切片类型的多个切片。例如S-NSSAI取值为0x01000000、0x02000000、0x03000000分别表示eMBB类型切片、uRLLC类型切片、MIoT类型切片。而S-NSSAI取值为0x01000001、0x01000002则表示eMBB类型切片，分别 服务于用户群1和用户群2。
网络切片选择辅助信息(network slice selection Assistance information，NSSAI)是S-NSSAI的集合。5G网络中使用到的NSSAI有请求的NSSAI(requested NSSAI)、已授权的NSSAI(allowed NSSAI)、配置的NSSAI(configured NSSAI)，它们的具体定义如表4所示。
表4
Figure PCTCN2022125734-appb-000005
网络切片选择策略(network slice selection policy，NSSP)，是由PCF将NSSP作为UE路由选择策略(UE route selection policy，URSP)规则的一部分，通过AMF发送给UE的，UE用来关联APP ID和S-NSSAI。关于网络切片选择的具体实现，可以参考现有方案，如在附着流程(attachment procedure)中实现网络切片选择。
虽然大众上网业务、垂直行业中各行各业对网络功能的需求多种多样，但是这些需求都可以解析成对网络带宽、连接数、时延、可靠性等网络功能的需求。5G标准也将不同业务对网络功能的需求特点归纳为三大典型场景，该三大典型场景对应的网络切片的类型分别是eMBB切片、mMTC切片、(ultra reliable low latency communication，uRLLC)切片。
eMBB场景：基于无线侧频谱利用率和频谱带宽技术的突破，5G可以提供比4G快10倍以上的传输速率。对于当下流行的AR/VR、高清视频直播，只有5G超高速率才能满足需求，而4G的传输速率是无法支持的。例如，使用VR看高清视频或者打大型交互游戏时，必须要拖着网线来获取数据，而在未来通过5G网络进行无线连接，VR/AR可以获得快捷的体验。
mMTC场景：通过多用户共享接入，超密集异构网络等技术，5G可以支持每平方公里接入100万个设备，是4G的10倍。近来智慧城市的快速发展，路灯，井盖，水表等公共设施都已经拥有了网络连接能力，可以进行远程管理，但是5G会有更大的革新。基于5G网络的强大连接能力，才可以把城市各个行业的公共设施都接入智能管理平台。这些公共设施通过5G网络协同工作，只需要少量的维护人员就可以统一管理，大大提升城市的运营效率。
uRRLC场景：在5G场景下最典型的应用就是自动驾驶，自动驾驶最常用的场景，如急刹车、车对车，车对人，车对基础设施等多路通信同时进行，需要瞬间进行大量的数据处理并决策。因此需要网络同时具有大带宽、低时延和高可靠性，5G网络具备应对这种场景的能力。
实际应用中，应用提供商，如各垂直行业可以通过购买运营商的网络切片服务，以实现通过运营商网络为用户提供网络服务。相应地，应用提供商可以委托运营商对用户进行网络切片鉴权。换言之，若用户通过网络切片鉴权，可以理解为用户有权限使用应用提供商提供的网络服务。
具体地，当UE注册到网络中时，除了执行UE永久标识的一次鉴权流程之外，可能还会根据UE请求的NSSAI以及UE的签约数据，判断是否需要执行网络切片粒度的鉴权和授权 流程(network slice specific authentication and authorization，NSSAA)，该流程也可以简单称为网络切片的二次鉴权流程，该流程的步骤如下述图2和图3所示。
示例性地，图2为现有的基于网络切片鉴权流程的二次鉴权的流程示意图一。如图2所示，该二次鉴权流程包括如下步骤：
S201，UE向AMF发送注册请求消息。
其中，注册请求(registration request)消息中携带有请求的NSSAI。换言之，UE可以在其发起的注册流程中，请求网络对特定NSSAI进行网络切片鉴权。
S202，AMF执行一次鉴权流程。
其中，鉴权服务功能(authentication server function，AUSF)用于对UE永久标识的一次鉴权。
在成功执行对UE永久标识的后，AMF从UDM获取UE的签约数据(subscription data)。其中，签约数据包含了该UE签约的每一个S-NSSAI是否需要执行二次鉴权的指示信息。
例如，UE签约的S-NSSAI如表5所示。
表5
Figure PCTCN2022125734-appb-000006
S203，AMF确定需要执行二次鉴权的S-NSSAI。
具体地，AMF根据UE的签约数据判断，需要执行二次鉴权的S-NSSAI是否包含在请求的NSSAI中。若是，则AMF判断出UE在本次注册流程之后还需要执行二次鉴权流程。
示例1，若UE携带的请求的NSSAI包括表5中所示出的S-NSSAI-1和S-NSSAI-2，则S-NSSAI-1需要执行二次鉴权流程，S-NSSAI-2不需要执行二次鉴权流程。
S204，AMF向UE发送注册接受消息。
其中，注册接受(registration accept)消息中携带有授权的NSSAI，和/或，被拒绝的NSSAI及其拒绝原因值。其中，授权的NSSAI只包含不需要进行二次鉴权的S-NSSAI，而被拒绝的NSSAI的拒绝原因值通常为挂起(pending)状态，需要执行二次鉴权。
请继续参考上述示例1，授权的NSSAI包括S-NSSAI-2，被拒绝的S-NSSAI包括S-NSSAI-1，拒绝原因值为S-NSSAI-1处于挂起状态，则需要对S-NSSAI-1执行二次鉴权，即执行下述S205。
S205，AMF对处于挂起状态的S-NSSAI执行二次鉴权流程。
请继续参考上述示例1，AMF可以发起对S-NSSAI-1的二次鉴权流程，具体参考图3所示流程，此处不再赘述。
待图3中所示的二次鉴权完成之后，AMF可以基于该鉴权结果，执行下述S206。
S206，AMF根据二次鉴权结果更新授权的NSSAI。
具体地，如果鉴权成功，AMF会将该S-NSSAI添加到授权的NSSAI中，如果鉴权失败，则AMF无需更新授权的NSSAI。
请继续参考上述示例1，若S-NSSAI-1的二次鉴权成功，则AMF向UE发送指示信息，将授权的NSSAI更新为S-NSSAI-1和S-NSSAI-2，如果鉴权失败，AMF不会向UE发送更新授权的NSSAI的指示信息。
示例性地，图3为现有的基于网络切片鉴权流程的二次鉴权的流程示意图二。如图3所 示，该鉴权流程可以包括如下步骤：
S301，AMF触发执行网络切片的二次鉴权。
S302，AMF向UE发送第一NAS MM传输请求。
其中，第一非接入层(non-access stratum，NAS)移动性管理(mobility management，MM)传输(NAS MM Transport)请求携带有：可扩展的身份验证协议(extensible authentication protocol，EAP)标识(identifier，ID)请求(EAP ID R-equest)，以及单网络切片选择辅助信息(single network slice selection assistanceinformation，S-NSSAI)。EAP ID请求用于请求对S-NSSAI对应的网络切片执行二次鉴权。
S303，UE向AMF发送第一NAS MM传输响应。
其中，第一NAS MM传输响应携带有EAP ID响应(EAP ID response)、S-NSSAI和UE标识(UE Identifier，UE ID)。其中，UE ID用于识别该UE，如可以为该UE的通用公共用户标识(generic public subscription identifier，GPSI)，S-NSSAI是指为UE提供网络服务的网络切片的标识。
可选地，EAP ID响应和S302中的EAP ID请求的内容也可以承载于其他NAS消息中，此处不予限制。
S304，AMF向NSSAAF发送第一NSSAA鉴权请求。
其中，第一NSSAAF为网络切片和SNPN身份验证和授权功能(network slice&SNPN function)，NSSAA鉴权请求(Nnssaaf_NSSAA_Authenticate Req)携带有EAP ID响应、该UE的GPSI、S-NSSAI等信息。
S305，NSSAAF向AAA-P发送第一AAA协议请求。
S306，AAA-P向AAA-S发送第一AAA协议请求。
其中，AAA-P为认证、授权和计费代理服务器(authentication,authorization,and accounting proxy server)，第一AAA协议请求(AAA protocol request message)携带有上述EAP ID响应、UE的GPSI、S-NSSAI等信息。
具体地，如果部署有AAA-P，则NSSAAF可以向AAA-P发送第一AAA协议请求(S305)，然后再由AAA-P向AAA-S转发该第一AAA协议请求(S306)。例如，当AAA-S由第三方部署时，NSSAAF与AAA-S之间没有直接的通信链路，则NSSAAF可以通过AAA-P向AAA-S发送该AAA协议消息。
可选地，若NSSAAF与AAA-S之间可直接通信，则S305和S306也可以替换为如下步骤：NSSAAF向AAA-S发送第一AAA协议请求。
S307，AAA-S向AAA-P发送第一AAA协议请求。
S308，AAA-P向NSSAAF发送第一AAA协议响应。
其中，第一AAA协议响应携带有EAP消息、UE的GPSI、S-NSSAI等信息。其中，EAP消息的作用和内容与上述EAP ID请求和EAP ID响应类似，此处不再赘述。
可选地，若NSSAAF与AAA-S之间可直接通信，与S305-S306类似，则S307-S308也可以替换为如下步骤：AAA-S向NSSAAF发送AAA协议消息。
S309，NSSAAF向AMF发送第一NSSAA鉴权响应。
其中，第一NSSAA鉴权响应(Nnssaaf_NSSAA_Authenticate Resp)携带有EAP消息、该UE的GPSI、S-NSSAI等信息。
S310，AMF向UE发送第二NAS MM传输请求。
其中，第二NAS MM传输请求携带有：EAP消息和S-NSSAI等信息。
S311，UE向AMF发送第二NAS MM传输响应。
其中，第二NAS MM传输响应携带有：EAP消息和S-NSSAI等信息。
S312，AMF向NSSAAF发送第二NSSAA鉴权请求。
其中，第二NSSAA鉴权请求(Nnssaaf_NSSAA_Authenticate Resquest)携带有EAP消息、该UE的GPSI、S-NSSAI等信息。
S313，NSSAAF向AAA-P发送第二AAA协议请求。
S314，AAA-P向AAA-S发送第二AAA协议请求。
其中，第二AAA协议第二携带有EAP消息、AAA-S的地址、该UE的GPSI、S-NSSAI等信息。
可选地，若NSSAAF与AAA-S之间可直接通信，与S305-S306类似，则S313-S314也可以替换为如下步骤：NSSAAF向AAA-S发送第二AAA协议请求。
上述S307-S314用于执行EAP消息的交换，该流程可能执行一次，也可能执行多次，此处不予限制。
之后，AAA-S即可执行二次鉴权，并将鉴权结果返回给UE，即执行下述S315-S318。
S315，AAA-S向AAA-P发送第二AAA协议响应。
S316，AAA-P向NSSAAF发送第二AAA协议响应。
其中，第二AAA协议响应携带有EAP鉴权成功/失败(EAP success/failure)指示、该UE的GPSI、已授权的S-NSSAI等信息。
可选地，若NSSAAF与AAA-S之间可直接通信，与S307-S308类似，则S315-S316也可以替换为如下步骤：AAA-S向NSSAAF发送第二AAA协议响应。
S317，NSSAAF向AMF发送第二NSSAA鉴权响应。
其中，第二NSSAA鉴权响应携带有EAP鉴权成功/失败(success/failure)指示、该UE的GPSI、已授权的S-NSSAI等信息。
S318，AMF向UE发送第二NAS MM传输响应。
其中，第二NAS MM传输响应携带有EAP鉴权成功/失败(success/failure)指示。
AMF应存储执行S301-S317中NSSAA程序的每个S-NSSAI的EAP鉴权结果。之后，UE和网络可以根据二次鉴权结果，执行配置更新流程，即执行下述S319-S320。
S319，可选地，AMF触发UE配置更新流程。
具体地，当有新的已授权的(allowed)NSSAI，或者已拒绝的(rejected)NSSAI时，或者AMF需要返回一个新的AMF时，AMF可以发起UE配置更新(UE Configuration update，UCU)流程。类似地，当有PDU会话相关的S-NSSAI鉴权失败时，AMF要触发PDU会话的释放。
S320，可选地，AMF发起UE去注册流程。
具体地，当没有S-NSSAI鉴权通过且没有可用的默认S-NSSAI时，AMF发起去注册流程(network-initiated deregistration)。
4、PDU会话鉴权
在UE接入到运营商网络中，UE与运营商网络进行一次鉴权成功之后，若UE需要接入某一DN，则UE与DN中部署的鉴权服务器之间还需要进行二次鉴权。PDU会话的建立可由UE或者运营商网络的核心网(core network，CN)触发，在PDU会话建立过程中或建立之后，由运营商网络发起二次鉴权流程。具体的，UE向运营商网络发送鉴权请求，运营商网络将鉴权请求转发给DN中的鉴权服务器，以完成DN对UE的鉴权。其中，上述DN所对应 的UE服务器可为认证、授权、计费服务器(authentication，authorization,and accounting，AAA)Server，AAA-S)，该鉴权服务器对UE的认证和/或者授权的结果会发送给运营商网络，运营商网络基于二次鉴权结果来确认是否为UE建立相应的PDU会话。
示例性地，图4为现有的基于PDU会话流程的二次鉴权的流程示意图。如图4所示，该流程可包括如下步骤：
S401，UE向AMF发送注册请求。
S402，UE与运营商网络进行一次鉴权。
具体地，AMF接收到UE发送的注册请求之后，可触发AUSF执行UE与运营商网络之间的一次鉴权。
可选的，AUSF执行UE与运营商网络的一次鉴权的过程中，可从UDM中获取一次鉴权所需的鉴权信息，如该UE的签约数据，进而可根据UDM生成或者存储的鉴权信息，实现UE与运营商网络之间的一次鉴权。
S403，建立UE和AMF之间的NAS安全。
具体地，UE与运营商网络之间的一次鉴权通过之后，AMF可与UE建立NAS(non-access stratum，NAS)安全。NAS存在于通用移动通信系统(universal mobile telecommunications system，UMTS)的无线通信协议栈中，作为CN与UE之间的功能层。NAS支持在CN与UE两者之间的信令和/或数据传输。
S404，UE向AMF发送会话建立请求。
具体地，UE与AMF建立NAS安全之后，UE可向AMF发起会话建立请求，该会话建立请求携带有NAS消息。其中，上述会话建立请求具体可用于请求建立PDU会话。
S405，AMF向SMF发送会话建立请求。
具体地，AMF接收到UE发送的NAS消息之后，可解码NAS消息中的会话建立请求，并向SMF发送会话建立请求。其中，上述SMF为管理该会话建立请求所请求建立的PDU会话的SMF。
S406，SMF校验签约数据。
具体地，SMF接收到会话建立请求之后，SMF从UDM处获取签约数据，若签约数据指示需要执行二次鉴权，则执行下述S407。
S407，SMF启动EAP鉴权流程。
可选的，若会话建立请求中携带有二次鉴权所需信息，则可跳过下述S408和S409。
S408，SMF向UE发送EAP ID请求。
其中，EAP ID请求用于请求UE的身份信息，如UE的GPSI。
S409，UE向SMF发送EAP ID响应。
其中，EAP ID响应携带有UE的身份信息，如UE的GPSI。
S410，SMF向UPF发起N4会话建立流程。
具体地，若SMF与AAA-S之间没有用于传输消息的UPF，则SMF发起UPF选择流程，并建立SMF与选择出来的UPF之间的N4会话。
S411，SMF向AAA-S发送EAP ID响应和UE的身份信息。
其中，SMF可以通过UPF，向AAA-S发送EAP ID响应和UE的身份信息。具体地，SMF可以通过上述S410中建立的N4会话，向UPF发送EAP ID响应和UE的身份信息，然后UPF向AAA-S发送接收到的EAP ID响应以及UE的身份信息。
S412，对UE进行二次鉴权。
具体地，UE和AAA-S可以进行多次EAP消息交互，以完成AAA-S对UE的二次鉴权。
其中，上述UE与AAA-S之间进行交互的EAP消息的消息类型、交互方式等细节取决于具体使用的EAP认证方法，在此不做限制。
S413，AAA-S向SMF发送二次鉴权结果。
具体地，如果AAA-S对UE认证成功，AAA-S向UPF发送鉴权成功消息，然后由UPF通过N4会话向SMF发送鉴权成功消息。
可选地，AAA-S还可以提供授权信息，如DN授权文本的索引、允许的媒体接入控制(media control access，MAC)地址或者虚拟局域网标识(virtual local area network identifier，VID)、DN授权的会话的聚合最大比特速率(aggregate maximum bit rate，AMBR)等。
S414，SMF触发执行PDU会话建立流程的剩余步骤。
AAA-S对UE的EAP认证结束之后，SMF可继续发起PDU会话建立流程中的剩余步骤，如下述S415：
S415，SMF向UPF发起N4会话建立/修改流程。
S416，SMF向UE发送PDU会话建立成功消息。
具体地，SMF向AMF发送PDU会话建立成功消息，AMF接收PDU会话建立成功消息，并向UE发送。
然而，上述基于网络切片鉴权流程的二次鉴权和基于PDU会话的二次鉴权均存在安全性低下的问题。具体地，当与一个网络切片关联的两个或多个应用程序运行时，UE将根据URSP规则建立新的PDU会话，或选择现有的PDU会话与该网络切片关联。其中，URSP规则示例如下：
规则1：优先级＝1，APP ID＝APP1，网络切片选择＝S-NSSAI-a；
规则2：优先级＝2，APP ID＝APP2，网络切片选择＝S-NSSAI-a；
规则3：优先级＝3，APP ID＝APP3，网络切片选择＝S-NSSAI-b；
其中，APP1和APP2均可以使用网络切片S-NSSAI-a。
假设S-NSSAI-a包含在允许的NSSAI中，当APP1运行时，已成功为APP1执行二次鉴权，且为APP1建立了PDU会话1。然后，当APP2运行时，APP2将通过UE选择现有的PDU会话1的方式直接使用S-NSSAI-a，而无需再对APP2进行任何鉴权操作。在这种情况下，很容易在部署中篡改APP ID并滥用网络切片/数据网络资源，从而导致网络安全风险和运行效率低下。
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如无线保真(wireless fidelity，WiFi)系统，车到任意物体(vehicle to everything，V2X)通信系统、设备间(device-todevie，D2D)通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或 更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“信息(information)”，“信号(signal)”，“消息(message)”，“信道(channel)”、“信令(singaling)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例中，有时候下标如W 1可能会笔误为非下标的形式如W1，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图5中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图5为本申请实施例提供的鉴权方法所适用的通信系统的架构示意图一。
如图5所示，该通信系统包括终端设备、第一网元和鉴权设备。
其中，上述终端设备为可接入上述通信系统，且具有无线或有线收发功能的终端或可设置于该终端的芯片或芯片系统。该终端设备也可以称为用户设备、用户装置(user equipment，UE)、手持终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、车载终端、具有终端功能的RSU、笔记本电脑、用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)、电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端等。本申请的终端设备还可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元，车辆通过内置的所述车载模块、车载模组、车载部件、车载芯片或者车载单元可以实施本申请提供的鉴权方法。
上述第一网元为二次鉴权的请求方，可以为运营商网络中的核心网网元，如下述图6-图11中所示出的AMF、SMF等。
上述鉴权设备为二次鉴权的响应方，可以为运营商或第三方内容提供商部署的鉴权服务器，如下述图6-图11中所示出的NSSAAF、DN中部署的AAA-S、AAA-P等。
可选地，图5中所示出的通信系统还可以包括接入网设备，该接入网设备为位于上述通信系统的网络侧，且具有无线收发功能的设备或可设置于该设备的芯片或芯片系统。该接入网设备包括但不限于：无线保真(wireless fidelity，WiFi)系统中的接入点(access point，AP)，如家庭网关、路由器、服务器、交换机、网桥等，演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base  station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，无线中继节点、无线回传节点、传输点(transmission and reception point，TRP或者transmission point，TP)等，还可以为5G，如，新空口(new radio，NR)系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)、具有基站功能的路边单元(road side unit，RSU)等。
下面以5G系统为例，详细说明本申请实施例提供的通信系统。
图6-图11为5G系统的示例一至示例六。其中，图6为基于服务化接口的非漫游架构，图7为基于参考点的非漫游架构，UE位于归属地公共陆地移动网络(home public land mobile network，HPLMN)中，业务的卸载由HPLMN完成，即UE和DN均位于HPLMN中。图8为基于服务化接口的本地疏导(local breakout，LBO)漫游架构，图9为基于参考点的本地疏导漫游架构，UE位于访问地公共陆地移动网络(visited public land mobile network，VPLMN)中，且业务也需要在VPLMN中卸载，即UE和DN均位于VPLMN中。图10为基于服务化接口的归属路由(home routed，HR)漫游架构，图11为基于参考点的归属路由漫游架构，UE位于VPLMN中，但业务需要在HPLMN卸载，即DN位于HPLMN中。
参考图6-图11，5G系统架构分为接入网和核心网两部分。接入网用于实现无线接入有关的功能。核心网主要包括以下几个关键网元：接入和移动管理网元(access and mobility management function，AMF)、会话管理网元(session management function，SMF)、用户面网元(user plane function，UPF)、策略控制网元(policy control function，PCF)、统一数据管理网元(unified data management，UDM)。
(R)AN设备：为终端设备提供接入的设备，包含无线接入网(radio access network，RAN)设备和接入网(access network，AN)设备。RAN设备主要是3GPP定义的无线网络设备，AN可以是non-3GPP定义的接入网设备。RAN设备：主要负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。所述RAN设备可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如，在第五代(5th generation，5G)系统中，称为RAN或者g节点(5G NodeB，gNB)；在LTE系统中，称为演进的节点B(evolved NodeB，eNB或者eNodeB)；在第三代(3rd generation，3G)系统中，称为节点B(Node B)等。
AN设备：允许终端设备和3GPP核心网之间采用非3GPP技术互连互通，其中，非3GPP技术例如：无线保真(wireless fidelity，Wi-Fi)、全球微波互联接入(worldwide interoperability for microwave access，WiMAX)、码分多址(code division multiple access，CDMA)网络等。
AMF：主要负责移动网络中的移动性管理，如用户位置更新、用户注册网络、用户切换等。
SMF：主要负责移动网络中的会话管理，如会话建立、修改、释放。具体功能如为用户分配IP地址、选择提供报文转发功能的UPF等。
UPF：负责终端设备中用户数据的转发和接收。可以从数据网络接收用户数据，通过接入网设备传输给终端设备；UPF还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。UPF中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。
PCF：主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能， 同时负责获取与策略决策相关的用户签约信息。
网络开放功能(network exposure function，NEF)：主要用于支持能力和事件的开放。
网络切片准入控制功能(network slice admission control function，NSACF)：主要用于支持如下功能：
支持监控和控制每个网络切片的注册用户数；
支持监控和控制每个网络切片建立的PDU会话数；
支持基于事件的网络切片状态通知并向其他NF报告。
应用功能(application function，AF)：主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。
统一数据管理(unified data management，UDM)：用于生成认证信任状，用户标识处理(如存储和管理用户永久身份等)，接入授权控制和签约数据管理等。
网络切片选择的认证和授权功能(network slice-specific authentication and authorization function，NSSAAF)主要用于执行网络切片和独立的非公共网络(stand-alone non-public networks，SNPN)身份验证和授权功能，具体包括：
支持使用认证、授权和计费(authentication,authorization,and accounting，AAA)服务器AAA-server，AAA-S)对指定的网络切片特定身份验证和授权。如果AAA-S属于第三方，NSSAAF可以通过AAA代理(AAA-proxy，AAA-P)联系AAA-S。
支持使用AAA-S的凭据访问SNPN。如果凭据持有者属于第三方，NSSAAF可以通过AAA-P联系AAA-S。
数据网络(data network,DN):指的是为用户提供数据传输服务的服务网络，如多媒体业务(IP multi-media service，IMS)、因特网(internet)等。具体地，UE通过UE到DN之间建立的分组数据单元(packet data unit，PDU)会话，来访问数据网络。
此外，本申请实施例涉及到AAA-P、DN-AAA，AAA-S，可以统一称为AAA服务器。AAA服务器和NSSAAF可以统称为鉴权设备/功能。
需要说明的是，图6-图11中的xx网元也可以称为xx功能或xx。例如，AMF网元也可以称为AMF或AMF功能，SMF网元也可以称为SMF或SMF功能，本申请实施例对此不做限制。
本申请实施例提供的鉴权方法，可以适用于图5-图11中任一项所示的通信系统中，实现对终端设备的二次鉴权，具体实现可以参考下述方法实施例，此处不再赘述。
应当指出的是，本申请实施例中的方案还可以应用于其他通信系统中，相应的名称也可以用其他通信系统中的对应功能的名称进行替代。
应理解，图5-图11仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备，和/或，其他终端设备，图5-图11中未予以画出。
下面将结合图12-图16对本申请实施例提供的鉴权方法进行具体阐述。
示例性地，图12为本申请实施例提供的鉴权方法的流程示意图一。该鉴权方法可以适用于图1所示的通信系统中，对终端设备执行二次鉴权操作。
如图12所示，该鉴权方法包括如下步骤：
S1201，终端设备向第一网元发送应用信息。
一种可能的设计方案中，应用信息包括应用识别信息。其中，应用识别信息可以包括如下一项或多项：应用标识、互联网协议(internet protocol，IP)五元组、应用名称等，可以用于对应用执行二次鉴权操作，具体实现可以参考下述S1203，此处不再赘述。
可选地，应用信息还包括应用鉴权信息。其中，应用鉴权信息可以包括如下一项或多项：用户名、密码、证书信息等，可以与应用识别信息一起，用于鉴权设备对应用执行鉴权操作，具体实现可以参考下述S1203，此处不再赘述。
可选地，请参考图6-图11，第一网元可以为AMF。具体地，S1201可以具体实现为：终端设备通过接入网设备，向AMF网元发送应用信息。
或者，可选地，请参考图6-图11，第一网元可以为SMF。具体地，S1201可以具体实现为：终端设备通过接入网设备和AMF，向SMF网元发送应用信息。
S1202，第一网元向鉴权设备发送应用信息。
一种可能的设计方案中，请参考图6-图11，第一网元可以为AMF，鉴权设备可以为运营商部署的NSSAAF。相应地，AMF可以通过服务化接口或N58接口，向NSSAAF发送应用信息。
另一种可能的设计方案中，请参考图6-图11，第一网元可以为AMF，鉴权设备可以为运营商部署的NSSAAF。相应地，AMF可以通过服务化接口或N58接口，向NSSAAF发送应用信息。
又一种可能的设计方案中，请参考图6、图8、图10，第一网元可以为SMF，鉴权设备可以为运营商部署的NSSAAF。相应地，SMF可以通过服务化接口，向NSSAAF发送应用信息。
再一种可能的设计方案中，请参考图6、图8、图10，第一网元可以为SMF，鉴权设备可以为第三方应用提供商部署的AAA-S。相应地，AMF可以通过服务化接口，向NSSAAF发送应用信息，然后再由NSSAAF向AAA-S转发。
需要说明的是，倘若第三方应用提供商已授权运营商代为执行二次鉴权操作，则NSSAAF也可以不向AAA-S转发应用信息，而是根据授权自行完成二次鉴权操作。
S1203，鉴权设备根据应用信息确定鉴权结果。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
具体地，鉴权设备可以将终端设备提供的应用信息，与鉴权设备本地存储的应用信息做比较，以确定二次鉴权是否成功。其中，鉴权设备本地存储的应用信息可以包括：已授权应用的应用信息，如白名单，和/或，被禁应用的应用信息，如黑名单。例如，若终端设备提供的应用信息存在于白名单中，则视为二次鉴权通过(鉴权成功)，否则视为二次鉴权未通过(鉴权失败)。又例如，若终端设备提供的应用信息存在于黑名单中，则视为二次鉴权未通过(鉴权失败)，否则视为二次鉴权通过(鉴权成功)。
此外，鉴权设备还可以结合应用鉴权信息，如用户名、密码、证书信息等确定鉴权结果。如此，可以实现应用信息和用户信息进行双重认证，以提高鉴权结果的可靠性，从而进一步提高网络安全性和运行效率。
本申请实施例中，可以隐式或显式地指示鉴权结果。下面举例说明。
示例性地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
或者，鉴权结果可以不包括鉴权指示信息，而是包括应用识别信息。此时，鉴权结果中的应用识别信息可以理解为如下之一：所有应用识别信息对应的应用均默认为鉴权通过、所有应用识别信息对应的应用均默认为鉴权未通过、或一部分应用识别信息对应的应用默认为鉴权通过，另一部分应用识别信息对应的应用默认为鉴权未通过。其中，该两部分应用识别信息可以承载于鉴权结果中的不同位置，如不同字段(field)或信元 (information element，IE)中予以区分。
S1204，鉴权设备向第一网元发送鉴权结果。
其中，鉴权结果根据应用信息确定，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作，如转发二次鉴权成功的应用的数据、丢弃二次鉴权失败的应用的数据。
一种可能的设计方案中，第一网元可以为接入与移动性管理网元，如AMF。相应地，图12中所示出的方法还可以包括如下步骤：接入与移动性管理网元向会话管理网元发送鉴权结果。具体地，请参考图6-图11，鉴权设备可以通过服务化接口或N58接口，向AMF发送鉴权结果。
之后，AMF可以向会话管理网元发送鉴权结果，以便会话管理网元确定检测规则。
另一种可能的设计方案中，第一网元可以为会话管理网元，如SMF。相应地，图12中所示出的方法还可以包括如下步骤：鉴权设备向会话管理网元发送鉴权结果。具体地，请参考图6、图8和图10，鉴权设备可以通过服务化接口向SMF发送鉴权结果。
在会话管理网元接收到鉴权结果之后，还可以执行如下步骤：会话管理网元根据鉴权结果确定检测规则，并向用户面网元发送，以便用户面网元根据检测规则，对二次鉴权成功的应用的数据执行转发操作，而对二次鉴权失败的应用的数据执行丢弃操作，从而实现对不同应用信息对应的应用提供差异化的数据传输服务。
可选地，会话管理网元可以根据鉴权结果自行确定检测规则，也可以向策略控制网元，如PCF发送鉴权结果，并接收来自策略控制网元根据鉴权结果确定的PCC规则，然后根据返回的PCC规则生成检测规则，本申请实施例对此不予限制。
示例性地，上述检测规则可以包括分组数据检测规则(packet detection rule，PDR)和转发行为规则(forwarding action rules，FAR)。
其中，检测规则可以是N4规则或N4规则的一部分，此处不予限制。
下面结合图13-图16中的几个示例，详细说明本申请实施例提供的鉴权方法。
图13为本申请实施例提供的鉴权方法的流程示意图二。该鉴权方法是基于网络切片鉴权流程实现的。其中，图12中的终端设备可以为图13中的UE，图12中的第一网元可以为图13中的AMF，图12中的鉴权设备可以为图13中的NSSAAF。此时，AMF可以基于网络切片鉴权流程，确定UE是否具有使用第三方应用提供商购买的网络切片的访问权限，从而完成了对UE的二次鉴权。
如图13所示，该鉴权方法可以包括如下步骤：
S1301，AMF在UE发起的注册流程中触发网络切片鉴权。
具体地，UE向AMF发送注册请求，AMF响应UE发起的注册请求，执行一次鉴权流程，即运营商网络鉴权流程。该注册请求中携带有UE请求的NSSAI，该请求的NSSAI可以包括一个或多个S-NSSAI。关于注册流程的具体实现，可以参考上述图2及其相关的文字说明，此处不再赘述。
对于一次鉴权成功的S-NSSAI，若AMF根据从UDM获取的签约数据判断需要执行二次鉴权，则可以继续执行下述S1302。
S1302，UE向AMF发送应用信息。
具体地，AMF可以向UE发送NAS MM传输请求，并接收来自UE的NAS MM传输响应。其中，NAS MM传输请求用于请求需要二次鉴权的网络切片对应的应用的应用信息，NAS MM传输响应携带有需要二次鉴权的网络切片对应的应用的应用信息。关于NAS MM传输请求和 NAS MM传输响应的具体实现，可以参考S302中的第一NAS MM传输请求和S303中的第一NAS MM传输响应，此处不再赘述。
其中，应用信息包含应用识别信息和应用鉴权信息。应用识别信息可以是IP五元组，应用标识等，应用鉴权信息可以是该应用的用户名，密码，证书信息等。
需要说明的是，若是UE在发起的注册请求中携带有请求的NSSAI对应的应用信息，则S1302也可以不执行，即此时S1302可以视为可选步骤。
S1303，AMF向NSSAAF发送应用信息。
具体地，AMF可以将应用信息承载于NSSAA鉴权请求中，向AMF发送，具体实现可以参考上述S304中的第一NSSAA鉴权请求和第二NSSAA鉴权请求，此处不再赘述。
S1304，NSSAAF通过AMF向UE发送鉴权结果。
具体地，NSSAAF可以视情况，请求AAA-S完成二次鉴权，或者自行完成二次鉴权。可选地，若第三方应用提供商与网络运营商已达成二次鉴权的委托协议，则NSSAAF可以自行完成二次鉴权。
或者，可选地，若第三方应用提供商没有委托网络运营商代为完成二次鉴权，则NSSAAF可以向AAA-S发送应用信息，并接收来自AAA-S的鉴权结果。其中，鉴权结果至少包括应用识别信息，如二次鉴权成功的S-NSSAI，可以采用容器(container)形式传输。可选地，鉴权结果还可以包括鉴权指示信息，该鉴权指示信息用于指示针对某个S-NSSAI的二次鉴权是否成功。
需要说明的是，AAA-S本地也可以预配置该UE可使用的应用信息，则上述S1301-S1303中也可以不需要UE上报应用信息。
S1305，UE通过AMF，向SMF发送PDU会话建立请求。
具体地，AMF接收来自UE的第一PDU会话建立请求，并向SMF发送第二PDU会话建立请求。其中，第一PDU会话建立请求可以包括被允许的NSSAI，第二PDU会话建立请求可以包括S-NSSAI和该S-NSSAI对应的应用信息的鉴权结果。
可选地，第二PDU会话建立请求还可以包括NSSAAF的标识、UE的标识和网络切片的标识。如此，SMF也可以直接从NSSAAF获取鉴权结果，而不需要AMF接收到鉴权结果之后，再向SMF转发。
另外一种实现方式可以是：PDU会话建立时，AMF将SMF的标识、UE的标识和网络切片的标识发送给NSSAAF，NSSAF将鉴权结果发送给SMF。
S1306，SMF向UPF发送检测规则。
具体地，SMF可以根据S-NSSAI和该S-NSSAI对应的应用信息的二次鉴权结果，自行确定或请求PCF确定N4规则，并通过N4会话向UPF发送N4规则。其中，N4规则包括检测规则，该检测规则用于指示UPF转发或丢弃该应用信息对应的应用的数据。关于检测规则的具体实现，可以参考上述S1204，此处不再赘述。
图14为本申请实施例提供的鉴权方法的流程示意图三。该鉴权方法是基于网络切片鉴权流程实现的。其中，图12中的终端设备可以为图14中的UE，图12中的第一网元可以为图14中的AMF，图12中的鉴权设备可以为图14中的NSSAAF。此时，AMF可以基于网络切片鉴权流程，确定UE是否具有使用第三方应用提供商购买的网络切片的访问权限，从而完成了对UE的二次鉴权。
如图14所示，该鉴权方法可以包括如下步骤：
S1401，AMF在UE发起的注册流程中触发网络切片鉴权。
S1402，UE向AMF发送应用信息。
S1403，AMF向NSSAAF发送应用信息。
S1404，NSSAAF通过AMF向UE发送鉴权结果。
上述S1401-S1404的具体实现，可以参考S1301-S1304，此处不再赘述。
S1405，UE通过AMF，向SMF发送PDU会话建立请求。
其中，PDU会话请求可以包括UE请求建立PDU会话的网络切片的标识，如S-NSSAI。此时，AMF可以仅执行PDU会话建立请求的转发操作。
S1405与S1305的不同之处在于：AMF向SMF发送第二PDU会话建立请求中可以不包括鉴权结果。此时，SMF可以在收到PDU会话建立请求后，再从AMF获取鉴权结果，即执行下述S1406-S1407。
S1406，SMF从AMF获取鉴权结果。
具体地，SMF可以向AMF发送鉴权结果获取请求，并接收来自AMF的鉴权结果。其中，鉴权结果获取请求可以包括PDU会话请求携带的网络切片的S-NSSAI。
可选地，SMF可以根据UDM中的签约数据，判断该S-NSSAI是否需要针对每个应用进行二次鉴权。若是，则从AMF获取鉴权结果。
或者，可选地，SMF也可以向AMF订阅鉴权通过的应用信息。这样一来，每当有应用鉴权结果更新(或称改变)时，SMF均可收到AMF的鉴权结果更新通知。
S1407，SMF向UPF发送检测规则。
关于S1407的具体实现，可以参考上述S1306，此处不再赘述。
图15为本申请实施例提供的鉴权方法的流程示意图四。该鉴权方法是基于PDU会话建立流程实现的。其中，图12中的终端设备可以为图15中的UE，图12中的第一网元可以为图15中的SMF，图12中的鉴权设备可以为图15中的DN-AAA，如DN中部署的AAA-S。此时，SMF可以基于网络切片鉴权流程，确定UE是否具有使用第三方应用提供商购买的网络切片的访问权限，从而完成了对UE的二次鉴权。
如图15所示，该鉴权方法可以包括如下步骤：
S1501，SMF向DN-AAA发送第一鉴权请求。
具体地，SMF可以在UE发起PDU会话建立流程中，通过UPF向DN-AAA发送第一鉴权请求，从而触发二次鉴权。
其中，第一鉴权请求用于请求DN-AAA启动二次鉴权。
S1502，SMF接收来自DN-AAA的第一鉴权响应。
其中，第一鉴权响应用于通知SMF：DN-AAA是否允许启动对UE的二次鉴权。若是，则执行下述S1503。
之后，SMF可以根据签约数据，判断该DN-AAA是否需要针对该应用进行二次鉴权。若是，则SMF可以向UE发送应用信息获取请求，并接收来自UE的应用信息，具体可以实现为如下S1503-S1504：
S1503，SMF向UE发送应用信息获取请求。
其中，应用信息获取请求携带有EAP ID请求和UE的身份信息，用于请求需要二次鉴权的应用信息。
S1504，SMF接收来自UE的应用信息获取响应。
其中，应用信息获取响应携带有应用信息、EAP ID响应和UE的身份信息。关于应用信息的内容可以参考S1201，此处不再赘述。
需要说明的是，若UE在S1501中发起的PDU会话建立请求中已携带有应用信息，则S1503-S1504也可以不执行，而是执行下述S1505，即此时S1503-S1504可以视为可选步骤。
S1505，SMF向DN-AAA发送第二鉴权请求。
其中，第二鉴权请求携带有S1504中获取的应用信息。
S1506，DN-AAA向SMF发送第二鉴权响应。
其中，第二鉴权响应携带有鉴权结果。关于鉴权结果的内容，请参考S1203-S1204，此处不再赘述。
S1507，执行PDU会话建立流程和二次鉴权流程中的剩余步骤。
S1508，SMF根据鉴权结果，确定N4规则。
S1509，SMF向UPF发送N4规则。
其中，N4规则包括检测规则，关于检测规则的具体实现，可以参考S1306，此处不再赘述。
需要说明的是，图15中所示出的鉴权方法可以单独实施，也可以与图13或图14中所示出的鉴权方法结合实施。例如，若UE发起建立的PDU会话的S-NSSAI和该PDU会话都需要鉴权，则SMF可以整合从AMF获取的鉴权结果中的应用信息，以及从AAA-S获取的鉴权结果中的应用信息，如上述两类应用信息的交集，生成检测规则。
图16为本申请实施例提供的鉴权方法的流程示意图五。该鉴权方法可以与图13-图15中任一项所示出的鉴权方法结合实施。其中，图12中的终端设备可以为图16中的UE，图12中的第一网元可以为图16中的AMF或SMF，图12中的鉴权设备可以为图16中的NSSAAF或AAA-S。此时，PCF可以基于从AMF，和/或，NSSAAF/AAA-S获取到的鉴权结果生成检测规则。
如图16所示，该鉴权方法可以包括如下步骤：
S1601，执行PDU会话建立流程和二次鉴权流程。
S1602，SMF接收来自AMF和/或NSSAAF的鉴权结果。
其中，鉴权结果中至少包括应用识别信息。
S1603，SMF向PCF发送鉴权结果。
S1604，PCF基于鉴权结果确定PCC规则。
S1605，PCF向SMF发送PCC规则。
S1606，SMF向UPF发送检测规则。
具体地，SMF可以根据PCC规则生成检测规则，如N4规则，并向UPF发送。之后，UPF即可根据检测规则，对应用标识信息对应的应用的数据实施定制的转发策略，如将鉴权通过的应用对应的PCC规则的门控定义为开，反之定义为关，从而实现转发二次鉴权成功的应用的数据，或丢弃二次鉴权失败的应用的数据。
需要说明的是，图16中所示出的鉴权方法与图13-图15中任一项所示出的鉴权方法之间的区别在于：在图13-图15中任一项所示出的鉴权方法中，PCC规则是由SMF确定的，而在图16中所示出的鉴权方法中，PCC规则是由PCF确定的。
本领域技术人员应当理解，上述图13-图15中所示出的各网元或设备均为示例，不得视为对本申请提供的技术方案的保护范围构成任何限制。以鉴权设备为例，在图13和图14中中为NSSAAF，在图15中为DN-AAA，在图16中为NSSAAF和AAA-S。实际应用中，用于执行二次鉴权功能的设备/网元可以不止一个，也可能不止一种，本申请实施例对于鉴权设备的种类和数量不做限制。
此外，在图13-图16中所示出的实施例中，PCF可以根据以下信息中的一个或多个生成URSP规则：签约信息(如切片/DNN是否需要二次鉴权，某个应用是否需要切片/DNN二次鉴权等等)、AMF或者SMF上报的鉴权需求信息(如切片/DNN是否需要二次鉴权，某个应用是否需要切片/DNN二次鉴权等等)、二次鉴权结果。
其中，URSP规则的路径选择描述符如下表6所示。
表6
Figure PCTCN2022125734-appb-000007
与表3相比，表6有如下不同：新增了应用的切片二次鉴权通过、应用的DN二次鉴权通过这几条规则。值得注意的是表6中的名称只是示例，并不限制在实现时使用其他名称。
换言之，UE可以根据返回的鉴权结果判断要不要使用某个URSP(或路径选择描述符，RSD)。具体的，只有当应用的二次鉴权通过时，UE才认为该应用对应的DNN/S-NSSAI的 URSP规则(或RSD)是合法的。只有URSP规则或RSD合法时，UE才会去使用对应的URSP规则(RSD)，如基于对应的URSP规则发起PDU会话建立请求。
网络侧(如AMF或SMF)可以在(应用)二次鉴权(如以上实施例所述)之后，将鉴权结果发送给UE，UE可以根据鉴权结果判断上述路由选择验证标准是否符合。
另外，当PCF使用二次鉴权结果作为输入时，具体地，如表6所示，也可以使用验证标准(validation criteria)字段，如路由选择验证标准，直接传输鉴权结果，如在其中增加相应的指示信息。如此，UE可以直接进行判断，不必由AMF或SMF另外发送鉴权结果。
基于图12-图16中任一项所示出的鉴权方法，鉴权设备可以根据应用信息，对任一应用信息对应的应用逐一进行二次鉴权操作。如此，第一网元可以基于该鉴权结果，为每个应用逐一确定检测规则，并指示数据传输路径上的各网络节点，基于该检测规则，对不同应用信息对应的应用的数据分别执行转发或丢弃操作，如转发鉴权成功的应用的数据、丢弃鉴权失败的应用的数据，以确保即使应用信息被盗用或篡改，也不会滥用网络资源，从而提高网络安全性和运行效率。
以上结合图12-图16详细说明了本申请实施例提供的鉴权方法。以下结合图17-图20详细说明用于执行本申请实施例提供的鉴权方法的鉴权装置。
示例性地，图17是本申请实施例提供的鉴权装置的结构示意图一。如图17所示，鉴权装置1700包括：接收模块1701和发送模块1702。为了便于说明，图17仅示出了该鉴权装置的主要部件。
一些实施例中，鉴权装置1700可适用于图4中所示出的通信系统中，执行图12中所示出的鉴权方法中第一网元的功能，或者适用于图6-图11中任一项所示出的通信系统中，执行图13-图16中所示出的鉴权方法中AMF或SMF的功能。
其中，接收模块1701，用于接收来自终端设备的应用信息。
发送模块1702，用于向鉴权设备发送应用信息。
接收模块1701，还用于接收来自鉴权设备的鉴权结果。其中，鉴权结果根据应用信息确定，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，发送模块1702，还用于向会话管理网元发送鉴权结果。
另一种可能的设计方案中，鉴权装置1700还包括：处理模块1703(图17中以虚线框示出)。其中，处理模块1703，用于根据鉴权结果确定检测规则。发送模块1702，还用于向用户面网元发送检测规则。
可选地，发送模块1702，还用于向策略控制网元发送鉴权结果。接收模块1701，还用于接收来自策略控制网元的检测规则。
可选地，接收模块1701和发送模块1702也可以集成为一个模块，如收发模块(图17中未示出)。其中，收发模块用于实现鉴权装置1700的收发功能。
可选地，鉴权装置1700还可以包括存储模块(图17中未示出)，该存储模块存储有计算机程序或指令。当处理模块1703执行该计算机程序或指令时，使得鉴权装置1700可以执行图12-图16中任一项所示出的鉴权方法。
可选地，鉴权装置1700可以是第一网元，如接入与移动性管理网元、或会话管理网元，也可以是可设置于第一网元中的芯片(系统)或其他部件或组件，还可以是包含第一网元的装置或系统，本申请对此不做限定。
应理解，鉴权装置1700中涉及的处理模块可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
示例性地，图18是本申请实施例提供的鉴权装置的结构示意图二。如图18所示，鉴权装置1800包括：获取模块1801和发送模块1802。为了便于说明，图18仅示出了该鉴权装置的主要部件。
一些实施例中，鉴权装置1800可适用于图4中所示出的通信系统中，执行图12中所示出的鉴权方法中鉴权设备的功能，或者适用于图6-图11中任一项所示出的通信系统中，执行图13-图16中所示出的鉴权方法中NSSAAF或DN-AAA的功能。
其中，获取模块1801，用于获取应用信息。其中，应用信息用于确定鉴权结果。
发送模块1802，用于向第一网元发送鉴权结果。其中，鉴权结果用于确定检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，鉴权装置1800还包括：接收模块1803。其中，接收模块1803，用于接收来自第一网元的应用信息。
可选地，接收模块1803和发送模块1802也可以集成为一个模块，如收发模块(图18中未示出)。其中，收发模块用于实现鉴权装置1800的收发功能。
可选地，获取模块1801可以与鉴权装置1800的其他处理功能集成为一个处理模块(图18中未示出)，该处理模块用于实现鉴权装置1800的处理功能。
可选地，鉴权装置1800还可以包括存储模块(图18中未示出)，该存储模块存储有计算机程序或指令。当处理模块执行该计算机程序或指令时，使得鉴权装置1800可以执行图12-图16中任一项所示出的鉴权方法。
可选地，鉴权装置1800可以是鉴权设备，如NSSAAF、AAA-S、AAA-P、DN-AAA等，也可以是可设置于鉴权设备中的芯片(系统)或其他部件或组件，还可以是包含鉴权设备的装置或系统，本申请实施例对此不做限定。
示例性地，图19是本申请实施例提供的鉴权装置的结构示意图三。如图19所示，鉴权装置1900包括：发送模块1901。为了便于说明，图19仅示出了该鉴权装置的主要部件。
一些实施例中，鉴权装置1900可适用于图4中所示出的通信系统中，执行图12中所示出的鉴权方法中终端设备的功能，或者适用于图6-图11中任一项所示出的通信系统中，执行图13-图16中所示出的鉴权方法中UE的功能。
其中，发送模块1901，用于向第一网元发送应用信息。其中，应用信息用于确定鉴权结果，鉴权结果用于生成检测规则，检测规则用于对应用信息对应的应用的数据执行转发或丢弃操作。
一种可能的设计方案中，应用信息包括应用识别信息，鉴权结果包括应用识别信息。
可选地，应用信息还包括应用鉴权信息。
可选地，鉴权结果还包括鉴权指示信息，鉴权指示信息用于指示对应用信息对应的应用的鉴权操作是否成功。
一种可能的设计方案中，鉴权装置1900还包括：接收模块1902。其中，接收模块1902，用于接收来自第一网元的鉴权结果。
可选地，发送模块1901接收模块1902和也可以集成为一个模块，如收发模块(图19中未示出)。其中，收发模块用于实现鉴权装置1900的收发功能。
可选地，鉴权装置1900还可以包括处理模块1903。其中，处理模块用于实现该装置的处理功能。
可选地，鉴权装置1900还可以包括存储模块(图19中未示出)，该存储模块存储有计算机程序或指令。当处理模块1903执行该计算机程序或指令时，使得鉴权装置1900可以执行图12-图16中任一项所示出的鉴权方法。
可选地，鉴权装置1900可以是终端设备，也可以是可设置于终端设备中的芯片(系统)或其他部件或组件，还可以是包含终端设备的装置或系统，本申请对此不做限定。
示例性地，图20为本申请实施例提供的鉴权装置的结构示意图四。该鉴权装置可以是终端设备或网络设备，也可以是可设置于终端设备或网络设备的芯片(系统)或其他部件或组件。如图20所示，鉴权装置2000可以包括处理器2001。可选地，鉴权装置2000还可以包括存储器2002和/或收发器2003。其中，处理器2001与存储器2002和收发器2003耦合，如可以通过通信总线连接。
下面结合图20对鉴权装置2000的各个构成部件进行具体的介绍：
其中，处理器2001是鉴权装置2000的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器2001是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
可选地，处理器2001可以通过运行或执行存储在存储器2002内的软件程序，以及调用存储在存储器2002内的数据，执行鉴权装置2000的各种功能。
在具体的实现中，作为一种实施例，处理器2001可以包括一个或多个CPU，例如图20中所示出的CPU0和CPU1。
在具体实现中，作为一种实施例，鉴权装置2000也可以包括多个处理器，例如图20中所示的处理器2001和处理器2004。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
其中，所述存储器2002用于存储执行本申请方案的软件程序，并由处理器2001来控制执行，具体实现方式可以参考上述方法实施例，此处不再赘述。
可选地，存储器2002可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器2002可以 和处理器2001集成在一起，也可以独立存在，并通过鉴权装置2000的接口电路(图20中未示出)与处理器2001耦合，本申请实施例对此不作具体限定。
收发器2003，用于与其他鉴权装置之间的通信。例如，鉴权装置2000为终端设备，收发器2003可以用于与网络设备通信，或者与另一个终端设备通信。又例如，鉴权装置2000为网络设备，收发器2003可以用于与终端设备通信，或者与另一个网络设备通信。
可选地，收发器2003可以包括接收器和发送器(图20中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。
可选地，收发器2003可以和处理器2001集成在一起，也可以独立存在，并通过鉴权装置2000的接口电路(图20中未示出)与处理器2001耦合，本申请实施例对此不作具体限定。
需要说明的是，图20中示出的鉴权装置2000的结构并不构成对该鉴权装置的限定，实际的鉴权装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
此外，图17-图20中任一项所示出的鉴权装置的技术效果可以参考上述方法实施例所述的鉴权方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该通信系统包括终端设备、第一网元和鉴权设备。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、 硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (29)

  1. 一种鉴权方法，其特征在于，应用于第一网元，所述方法包括：
    接收来自终端设备的应用信息；
    向鉴权设备发送所述应用信息；
    接收来自所述鉴权设备的鉴权结果；所述鉴权结果根据所述应用信息确定，所述鉴权结果用于生成检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  2. 根据权利要求1所述的鉴权方法，其特征在于，所述应用信息包括应用识别信息，所述鉴权结果包括所述应用识别信息。
  3. 根据权利要求2所述的鉴权方法，其特征在于，所述应用信息还包括应用鉴权信息。
  4. 根据权利要求2或3所述的鉴权方法，其特征在于，所述鉴权结果还包括鉴权指示信息，所述鉴权指示信息用于指示对所述应用信息对应的应用的鉴权操作是否成功。
  5. 根据权利要求1-4中任一项所述的鉴权方法，其特征在于，所述第一网元为接入与移动性管理网元；
    所述方法还包括：
    所述接入与移动性管理网元向会话管理网元发送所述鉴权结果。
  6. 根据权利要求1-4中任一项所述的鉴权方法，其特征在于，所述第一网元为会话管理网元；
    所述方法还包括：
    所述会话管理网元根据所述鉴权结果确定所述检测规则；
    所述会话管理网元向用户面网元发送所述检测规则。
  7. 根据权利要求6所述的鉴权方法，其特征在于，所述会话管理网元根据所述鉴权结果确定所述检测规则，具体包括：
    所述会话管理网元向策略控制网元发送所述鉴权结果；
    所述会话管理网元接收来自所述策略控制网元的检测规则。
  8. 一种鉴权方法，其特征在于，应用于鉴权设备，所述方法包括：
    获取应用信息；所述应用信息用于确定所述鉴权结果；
    向第一网元发送所述鉴权结果；所述鉴权结果用于确定检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  9. 根据权利要求8所述的鉴权方法，其特征在于，所述应用信息包括应用识别信息，所述鉴权结果包括所述应用识别信息。
  10. 根据权利要求9所述的鉴权方法，其特征在于，所述鉴权结果还包括鉴权指示信息，所述鉴权指示信息用于指示对所述应用信息对应的应用的鉴权操作是否成功。
  11. 根据权利要求8-10中任一项所述的鉴权方法，其特征在于，所述获取应用信息，具体包括：
    接收来自所述第一网元的所述应用信息。
  12. 一种鉴权方法，其特征在于，应用于终端设备，所述方法包括：
    向第一网元发送应用信息；所述应用信息用于确定鉴权结果，所述鉴权结果用于生成检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一网元的所述鉴权结果。
  14. 一种鉴权装置，其特征在于，所述装置包括：接收模块和发送模块；其中，
    所述接收模块，用于接收来自终端设备的应用信息；
    所述发送模块，用于向鉴权设备发送所述应用信息；
    所述接收模块，还用于接收来自所述鉴权设备的鉴权结果；所述鉴权结果根据所述应用信息确定，所述鉴权结果用于生成检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  15. 根据权利要求14所述的鉴权装置，其特征在于，所述应用信息包括应用识别信息，所述鉴权结果包括所述应用识别信息。
  16. 根据权利要求15所述的鉴权装置，其特征在于，所述应用信息还包括应用鉴权信息。
  17. 根据权利要求15或16所述的鉴权装置，其特征在于，所述鉴权结果还包括鉴权指示信息，所述鉴权指示信息用于指示对所述应用信息对应的应用的鉴权操作是否成功。
  18. 根据权利要求14-17中任一项所述的鉴权装置，其特征在于，
    所述发送模块，还用于向会话管理网元发送所述鉴权结果。
  19. 根据权利要求14-17中任一项所述的鉴权装置，其特征在于，所述装置还包括：处理模块；其中，
    所述处理模块，用于根据所述鉴权结果确定所述检测规则；
    所述发送模块，还用于向用户面网元发送所述检测规则。
  20. 根据权利要求19所述的鉴权装置，其特征在于，
    所述发送模块，还用于向策略控制网元发送所述鉴权结果；
    所述接收模块，还用于接收来自所述策略控制网元的检测规则。
  21. 一种鉴权装置，其特征在于，所述装置包括：获取模块和发送模块；其中，
    所述获取模块，用于获取应用信息；所述应用信息用于确定所述鉴权结果；
    所述发送模块，用于向第一网元发送所述鉴权结果；所述鉴权结果用于确定检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  22. 根据权利要求21所述的鉴权装置，其特征在于，所述应用信息包括应用识别信息，所述鉴权结果包括所述应用识别信息。
  23. 根据权利要求22所述的鉴权装置，其特征在于，所述鉴权结果还包括鉴权指示信息，所述鉴权指示信息用于指示对所述应用信息对应的应用的鉴权操作是否成功。
  24. 根据权利要求21-23中任一项所述的鉴权装置，其特征在于，所述装置还包括：接收模块；其中，
    所述接收模块，用于接收来自所述第一网元的所述应用信息。
  25. 一种鉴权装置，其特征在于，所述装置包括：发送模块；其中，
    所述发送模块，用于向第一网元发送应用信息；所述应用信息用于确定鉴权结果，所述鉴权结果用于生成检测规则，所述检测规则用于对所述应用信息对应的应用的数据执行转发或丢弃操作。
  26. 根据权利要求25所述的装置，其特征在于，所述装置还包括：接收模块；其中，
    所述接收模块，用于接收来自所述第一网元的所述鉴权结果。
  27. 一种鉴权装置，其特征在于，包括：处理器，所述处理器与存储器耦合；
    所述处理器，用于执行所述存储器中存储的计算机程序，以使得所述鉴权装置执行如权利要求1-13中任一项所述的鉴权方法。
  28. 一种计算机可读存储介质，其特征在于，存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-13中任一项所述的鉴权方法。
  29. 一种计算机程序产品，其特征在于，包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-13中任一项所述的鉴权方法。
PCT/CN2022/125734 2021-10-20 2022-10-17 鉴权方法及装置 WO2023066210A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111223393.9 2021-10-20
CN202111223393.9A CN115996378A (zh) 2021-10-20 2021-10-20 鉴权方法及装置

Publications (1)

Publication Number Publication Date
WO2023066210A1 true WO2023066210A1 (zh) 2023-04-27

Family

ID=85990833

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125734 WO2023066210A1 (zh) 2021-10-20 2022-10-17 鉴权方法及装置

Country Status (2)

Country Link
CN (1) CN115996378A (zh)
WO (1) WO2023066210A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117041969B (zh) * 2023-09-28 2024-01-02 新华三技术有限公司 5g双域专网的接入方法、系统及装置、电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
CN111165025A (zh) * 2017-10-16 2020-05-15 华为技术有限公司 协同终端切片功能和网络切片功能
WO2021047964A1 (en) * 2019-09-10 2021-03-18 Orange Network slicing application access control
CN112804679A (zh) * 2020-12-29 2021-05-14 中兴通讯股份有限公司 一种网络切片连接方法、装置、存储介质及电子装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111165025A (zh) * 2017-10-16 2020-05-15 华为技术有限公司 协同终端切片功能和网络切片功能
US20200053083A1 (en) * 2018-08-13 2020-02-13 Lenovo (Singapore) Pte. Ltd. Network slice authentication
WO2021047964A1 (en) * 2019-09-10 2021-03-18 Orange Network slicing application access control
CN112804679A (zh) * 2020-12-29 2021-05-14 中兴通讯股份有限公司 一种网络切片连接方法、装置、存储介质及电子装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CHINA TELECOM: "Discussion on supporting authentication and authorization for each application in the same network slice", 3GPP DRAFT; S2-2104619, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20210517 - 20210528, 10 May 2021 (2021-05-10), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP052004916 *
CHINA TELECOM: "New WID on Supporting Authentication and Authorization of Network Slice per Application", 3GPP DRAFT; S2-2104621, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20210517 - 20210528, 10 May 2021 (2021-05-10), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP052004918 *

Also Published As

Publication number Publication date
CN115996378A (zh) 2023-04-21

Similar Documents

Publication Publication Date Title
US11903048B2 (en) Connecting to virtualized mobile core networks
US11102828B2 (en) User plane function selection for isolated network slice
CN114080843A (zh) 用于增强5g网络的网络切片和策略框架的装置、系统和方法
TWI631866B (zh) 使用多個證書進行存取和訊務區分
WO2020224622A1 (zh) 一种信息配置方法及装置
WO2021223507A1 (zh) 一种通信方法、装置及芯片
US20240015630A1 (en) Routing Between Networks Based on Identifiers
US20240022952A1 (en) Resource Allocation in Non-Public Network
WO2023066210A1 (zh) 鉴权方法及装置
WO2021233362A1 (zh) 认证授权的方法和装置
US20240073848A1 (en) Network Slice in a Wireless Network
WO2023216934A1 (zh) 通信方法及装置
US20240129793A1 (en) Network Overload Control
WO2024037215A1 (zh) 通信方法及装置
WO2023143459A1 (zh) 授权方法及装置
US20230422293A1 (en) Network Slice Based Priority Access
US20240031929A1 (en) Connection Establishment
US20230319685A1 (en) Access Restriction of Wireless Device
CN116980218A (zh) 一种楼宇设备的生命周期管控SaaS系统及方法
WO2023081276A1 (en) Network slice for access of wireless device to a network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22882816

Country of ref document: EP

Kind code of ref document: A1