WO2023143244A1 - 终端管理方法和核心网设备 - Google Patents

终端管理方法和核心网设备 Download PDF

Info

Publication number
WO2023143244A1
WO2023143244A1 PCT/CN2023/072596 CN2023072596W WO2023143244A1 WO 2023143244 A1 WO2023143244 A1 WO 2023143244A1 CN 2023072596 W CN2023072596 W CN 2023072596W WO 2023143244 A1 WO2023143244 A1 WO 2023143244A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
network
message
identification
authentication
Prior art date
Application number
PCT/CN2023/072596
Other languages
English (en)
French (fr)
Inventor
徐艺珊
诸华林
郭龙华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023143244A1 publication Critical patent/WO2023143244A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities

Definitions

  • the present application relates to the communication field, and in particular to a terminal management method and core network equipment.
  • a passive Internet of Things (passive IoT, P-IoT) architecture may include a passive terminal, a reader (reader), and an operation requester.
  • the passive terminal can be in the form of a tag or any other terminal form.
  • the passive terminal is described below by taking the terminal as an example.
  • the reader (reader) uses radio frequency to read and write terminals (such as electronic tags or radio frequency cards), so as to achieve the purpose of identifying targets and exchanging data.
  • the operation requester performs terminal operations on the terminal, it can send operation instructions to the reader through the core network equipment.
  • the operation instructions can include but are not limited to performing terminal information acquisition, inventory operations (or called inventory operations), read operations, and write operations. , failure operation, information exchange with the terminal and other operations.
  • the reader After the reader receives the operation instruction, it will send the operation instruction to the terminal; the terminal obtains or sends corresponding information according to the operation instruction. For example, when the operation instruction is an inventory instruction or an inventory operation is performed, the terminal will send identification information of the terminal. For another example, when the operation instruction is a read instruction or a read operation is performed, the terminal will send data information stored in the terminal storage area. For another example, when the operation instruction is a write instruction or a write operation is performed, the terminal will store the data information to be written into the terminal included in the instruction into a storage area of the terminal.
  • the reader receives the information sent by the terminal, and sends the information to the operation requester through the core network equipment.
  • the embodiment of the present application discloses a terminal management method and core network equipment, which can realize terminal management.
  • an embodiment of the present application provides a terminal management method, including: a first core network device receives a first message from a terminal, and the first message is used to request access to the network; When determining that the terminal is allowed to access the network according to the number information, send a second message to the operation requester to which the terminal belongs; the number information includes the number of terminals allowed to be used by the operation requester, and the second message Contains first identification information, where the first identification information includes one or more of the terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification of the terminal.
  • the first core network device when the first core network device determines that the terminal is allowed to access the network according to the quantity information, it sends the second message to the operation requester to which the terminal belongs. That is to say, before the first core network device sends the second message, it needs to determine that the terminal is allowed to access the network according to the quantity information, instead of directly allowing the terminal to access the network.
  • the first core network device determines that terminals are allowed to access the network according to the quantity information, which can prevent the number of terminals accessing the network among the terminals corresponding to the operation requesting party from being greater than or equal to the number of terminals allowed to be used by the operation requesting party.
  • the determining to allow the terminal to access the network according to the number information includes: when the number of terminals that access the network among the terminals corresponding to the operation requester is less than a number threshold, the Describe the first core network configuration The device determines that the terminal is allowed to access the network; the number threshold is the number of terminals allowed to be used by the operation requester.
  • the first core network device determines that the terminal is allowed to access the network, can quickly and accurately determine whether the terminal is allowed to access, and Avoid that the number of terminals accessing the network among the terminals corresponding to the operation requester is greater than or equal to the number threshold.
  • the method further includes: when the first core network device determines that the terminal is not allowed to access the network according to the quantity information, sending a third message; the third message indicates that the terminal is denied access to the network.
  • the first core network device sends a third message to the terminal when it is determined that the terminal is not allowed to access the network according to the number information; it can be avoided that the number of terminals accessing the network among the terminals corresponding to the operation requester is greater than or Equal to the number of terminals allowed by the operation requester.
  • the determining that the terminal is not allowed to access the network according to the number information includes: when the number of terminals that access the network among the terminals corresponding to the operation requester is greater than or equal to When the number threshold is set, the first core network device determines that the terminal is not allowed to access the network; the number threshold is the number of terminals allowed to be used by the operation requester.
  • the first core network device determines that the terminal is not allowed to access the network; it can quickly and accurately determine whether to allow Terminal access.
  • the method further includes: the first core network device sending a fourth message to the second core network device; the fourth message is used to request to perform an authentication process on the terminal;
  • the fourth message includes second identification information and authentication information, the second identification information and the authentication information are used to execute the authentication process;
  • the second identification information includes the terminal identification of the terminal, the encrypted terminal identification , one or more of terminal application identifiers, terminal network identifiers, and operation requester identifiers.
  • the first core network device sends a fourth message to the second core network device, so as to perform an authentication process on the terminal, thereby ensuring that the terminal is a trusted terminal.
  • the first core network device after the first core network device determines to allow the terminal to access the network according to the quantity information, the first core network device sends a fourth message to the second core network device;
  • the fourth message is used to request to perform an authentication process on the terminal;
  • the fourth message includes second identification information and authentication information, and the second identification information and the authentication information are used to perform the authentication process;
  • the second identification information includes one or more of the terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification of the terminal.
  • the first core network device sends a fourth message to the second core network device, so as to perform an authentication process on the terminal, thereby ensuring that the terminal is a trusted terminal.
  • the fourth message further includes indication information, where the indication information indicates that the authentication process is one-way authentication, two-way Any one of one-way authentication, one-way authentication of the terminal by the network or the operation requester.
  • the indication information indicates that the authentication process is a one-way authentication process or a two-way authentication process, so that the second core network device determines the authentication process to be executed according to the indication information.
  • the method further includes: the first core network device performs an authentication process on the terminal according to the first message; the first message includes third identification information and authentication information, The third identification information and the authentication information are used to execute the authentication process; the third identification information includes the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, the terminal network identification, and the operation requester identification one or more of the .
  • the first core network device performs the authentication process on the terminal according to the first message, and the first core network device itself can perform the authentication process on the terminal without interacting with other devices, which can reduce signaling overhead.
  • the first core network device determines that the terminal is allowed to access the network according to the quantity information, it performs an authentication process on the terminal according to the first message; the first The message includes third identification information and authentication information, the third identification information and the authentication information are used to execute the authentication process; the third identification information includes the terminal identification of the terminal, the encrypted terminal identification, the terminal application One or more of ID, terminal network ID, and operation requester ID.
  • the first core network device performs the authentication process on the terminal according to the first message, and the first core network device itself can perform the authentication process on the terminal without interacting with other devices, which can reduce signaling overhead.
  • the method further includes: the first core network device determining, according to the third identification information included in the first message, the operation requester to which the terminal belongs; the first The third identification information includes one or more of the terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification of the terminal.
  • the first core network device determines the operation requester to which the terminal belongs according to the third identification information included in the first message, so as to determine whether to allow the terminal to access the network according to the quantity information.
  • determining, by the first core network device, the operation requester to which the terminal belongs according to the third identification information included in the first message includes: the first core network device according to The third identification information and the first correspondence determine the operation requester to which the terminal belongs; the first correspondence indicates that the terminal belongs to the operation requester.
  • the first correspondence includes a correspondence between an application identifier (terminal identifier or network identifier) of the terminal and an operation requester identifier, where the operation requester identifier is the identifier of the operation requester.
  • the first core network device can quickly and accurately determine the operation requester to which the terminal belongs according to the third identification information and the first correspondence.
  • the method further includes: the The first core network device determines a second correspondence according to the operation instruction from the operation requester; the second correspondence indicates that the terminal belongs to the operation requester; the first core network device determines the second correspondence according to the operation requester.
  • the third identification information included in a message, determining the operation requester to which the terminal belongs includes: the first core network device determining the operation requester to which the terminal belongs according to the third identification information and the second correspondence relationship The operation requester.
  • the operation instruction may include a first identifier of the terminal, where the first identifier is any one of a terminal identifier, an encrypted terminal identifier, a terminal application identifier, and a terminal network identifier.
  • the first core network device determines the second corresponding relationship according to the operation instruction from the operation requester, and it is not necessary to pre-store the corresponding relationship between each terminal and the operation requester to which it belongs, which can reduce storage overhead and reduce the number of retrieval terminals.
  • the method further includes: the first core network device receiving a fifth message; the first core network device sending a sixth message to the terminal; the fifth message indicating The authentication process passes, and the sixth message indicates that the terminal is accepted to access the network; or, the fifth message indicates that the authentication process fails, and the sixth message indicates that the terminal is denied access to the network. described network.
  • the method further includes: acquiring, by the first core network device, the quantity information and/or the first identification information.
  • the first core network device acquires the quantity information and/or the first identification information, so as to determine whether to allow the terminal to access the network according to the quantity information, and implement an authentication procedure for the terminal.
  • the method further includes: the first core network device counts the number of terminals that access the network among the terminals corresponding to the operation requester.
  • the first core network device counts the number of terminals corresponding to the operation requester that access the network, so as to determine whether to allow the terminal to access the network according to the terminal device and the number threshold.
  • the first core network device counting the number of terminals that access the network among the terminals corresponding to the operation requester includes: after the terminal passes the authentication, the first core network The device updates the number of terminals that access the network among the terminals corresponding to the operation requester according to the first identification information and a third correspondence, where the third correspondence includes: the terminal identifier of the terminal, the encrypted The corresponding relationship of one or more of one or more of the terminal identifier, the terminal application identifier, the terminal network identifier, and the operation requester identifier.
  • the first core network device updates the number of terminals that access the network among the terminals corresponding to the operation requester according to the first identification information and the second correspondence; The number of terminals in the network, and prevent multiple terminals from accessing the network using the same identifier.
  • the present application provides another terminal management method, which is characterized by comprising: the operation requester obtains quantity information, the quantity information indicates the number of terminals that the operation requester is allowed to use; The above quantity information is used to obtain one or more terminal application identifiers.
  • the operation requester acquires one or more terminal application IDs according to the quantity information; it can be avoided that the number of terminal application IDs acquired by the operation requester exceeds the number of terminals allowed by the operation requester.
  • the method further includes: the operation requester sends an operation instruction, the operation instruction includes a first application identifier, and the first application identifier is included in the one or more terminal applications An identifier; the operation instruction is used to perform an operation on the terminal corresponding to the first application identifier.
  • the operation instruction includes the first application identifier; through the operation instruction including the first application identifier, operations can be conveniently performed on the terminal corresponding to the first application identifier.
  • the method further includes: the operation requester acquiring network identification information, where the network identification information includes one or more terminal network identifications.
  • the operation requester acquires network identification information, so that the operation requester can use the network identification information to manage the terminal.
  • the method further includes: sending, by the operation request, the one or more terminal application identifiers and/or the operation requester identifier to the first core network device.
  • the operation request sends one or more terminal application identifiers and/or operation requester identifiers to the first core network device; so that the first core network device can use the one or more terminal application identifiers and/or
  • the operation requester ID implements terminal management.
  • the present application provides another terminal management method, including: the operation requester acquires one or more terminal application identifiers; the operation requester sends an operation instruction, the operation instruction includes a first application identifier, and the second An application identifier is included in the one or more terminal application identifiers; the operation instruction is used to perform an operation on the terminal corresponding to the first application identifier.
  • the operation requester obtains one or more terminal application identifiers, and sends an operation instruction including the first application identifier, and can perform operations on the terminal corresponding to the first application identifier. That is to say, according to the acquired one or more terminal application identifiers, operations can be performed on corresponding terminals.
  • the obtaining, by the operation requester, one or more terminal application identifiers includes: the operation requester receiving the one or more terminal application identifiers from the first core network device.
  • the operation requester receives one or more terminal application identifiers from the first core network device; it does not need to allocate terminal application identifiers by itself.
  • the method further includes: the operation requester acquires quantity information, and the quantity The information indicates the number of terminals allowed to be used by the operation requester.
  • the operation requester obtains quantity information, and can know the quantity of terminals allowed to be used.
  • the present application provides another terminal management method, including: the second core network device obtains quantity information, the quantity information indicates the number of terminals allowed to be used by the operation requesting party; the second core network device sends the first core network The network device sends the quantity information and/or the first identification information; the first identification information includes one or more of the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, the terminal network identification, and the operation requester identification item; the operation requester ID is the ID of the operation requester, and the terminal belongs to the operation requester.
  • the second core network device sends quantity information and/or first identification information to the first core network device, so that the first core network device determines whether to allow the terminal to access the network according to the quantity information.
  • the method further includes: the second core network device configuring the number of terminals allowed to be used by the operation requester.
  • the second core network device configures the number of terminals allowed to be used by the operation requester, so as to use the number of terminals to perform terminal management.
  • the method further includes: the second core network device acquires (for example, allocates) the terminal network of the terminal according to the quantity information logo.
  • the second core network device acquires the terminal network identifier of the terminal according to the quantity information, so as to subsequently perform terminal management on the terminal according to the terminal network identifier.
  • the method further includes: the second core network device sends the The operation requester sends the terminal network identifier of the terminal.
  • the second core network device sends the terminal network identifier to the operation requester, so that the operation requester uses the terminal network identifier to perform terminal management on the corresponding terminal.
  • the method further includes: the second core network device receiving one or more terminal application identifiers from the operation requester; the one or more terminal application identifiers include the terminal's Terminal application ID.
  • the second core network device receives one or more terminal application identifiers from the operation requester, so as to use these terminal application identifiers to perform terminal management on corresponding terminals.
  • the method further includes: configuring the one or more terminal application identifiers by the second core network device A terminal application identifier.
  • the second core network device is configured with one or more terminal application identifiers, so that these terminal application identifiers are subsequently used to perform terminal management on corresponding terminals.
  • the method further includes: the second core network device acquires a seventh message; the seventh message includes the quantity information and fourth identification information; the fourth identification information includes One or more of the terminal ID, encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID of the terminal.
  • the acquisition of the seventh message by the second core network device may be receiving a seventh message sent from other devices (for example, devices belonging to operators).
  • the second core network device obtains the seventh message, so as to use the seventh message to obtain the first identification information.
  • the method further includes: the second core network device sending the application identifier of the terminal and/or the quantity information to the operation requester.
  • the operation requester can be made to obtain the application identification and/or quantity information of the terminal.
  • the method further includes: receiving, by the second core network device, A fourth message of the heart-network device, where the fourth message is used to request an authentication process for the terminal; the fourth message includes second identification information and authentication information, and the second identification information includes the terminal identification of the terminal, One or more of the encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID; the second core network device performs an authentication process on the terminal according to the fourth message.
  • the second core network device performs an authentication process on the terminal according to the fourth message, so that the terminal can be quickly authenticated.
  • the fourth message further includes indication information, where the indication information indicates that the authentication process is one-way authentication, two-way Any one of one-way authentication, one-way authentication of the terminal by the network or the operation requester; the method further includes: the second core network device determines the authentication process according to the indication information type.
  • the second core network device determines the type of the authentication process according to the indication information; so as to execute the corresponding authentication process on the terminal.
  • the second identification information includes an operation requester identification and does not include a terminal identification of the terminal, an encrypted terminal identification, a terminal application identification, and a terminal network identification; the second core network device After performing the authentication process on the terminal according to the fourth message, the method further includes: allocating a terminal network identifier to the terminal when the terminal passes the authentication.
  • a terminal network identifier is assigned to the terminal.
  • the network identifier of the terminal does not need to be configured in the operation requester in advance, which can prevent the operation requester from using the network identifier of one terminal for multiple terminals, that is, the process of obtaining the network identifier of the terminal by the terminal can be streamlined and more secure.
  • the method further includes: the second core network device counts the number of terminals that access the network among the terminals corresponding to the operation requester.
  • the second core network device counts the number of terminals corresponding to the operation requester that access the network, so as to determine whether to allow the terminal to access the network according to the terminal device and the number threshold.
  • the second core network device counting the number of terminals that access the network among the terminals corresponding to the operation requester includes: after the terminal passes the authentication, the second core network The device updates the number of terminals that access the network among the terminals corresponding to the operation requester according to the first identification information and a third correspondence, where the third correspondence includes: the terminal identifier of the terminal, the encrypted The corresponding relationship of one or more of one or more of the terminal identifier, the terminal application identifier, the terminal network identifier, and the operation requester identifier.
  • the second core network device updates the number of terminals that access the network among the terminals corresponding to the operation requester according to the first identification information and the third correspondence; The number of terminals in the network, and prevent multiple terminals from accessing the network using the same identifier.
  • the method further includes: the second core network device notifies The number of terminals that access the network among the terminals corresponding to the operation requester of the first core network device.
  • the first core network device may be made to know the number of terminals accessing the network among the terminals corresponding to the operation requester.
  • the terminal is a label; the method further includes: the second core network device updates or deletes the identification information of the invalid label, and the identification information of the invalid label includes one of the following information
  • the second core network device updates or deletes the identification information of the invalid label
  • the identification information of the invalid label includes one of the following information
  • One or more items terminal application identifier, terminal network identifier, terminal identifier, encrypted terminal identifier, and a third corresponding relationship of the invalid label, the third corresponding relationship includes the terminal application identifier and terminal network identifier of the invalid label The corresponding relationship between two or more of , terminal ID, and encrypted terminal ID.
  • the second core network device updates or deletes the identification information of the invalid label, so as to better manage the label.
  • the method further includes: receiving a label message from the operation requester; updating or deleting the identification information of the invalid label by the second core network device includes: the second core network device According to the tag information, the identification information of the invalid tag is updated or deleted.
  • the identification information of the invalid label can be updated or deleted according to the instruction of the operation requester.
  • the embodiments of the present application provide a communication device, which has a function of implementing the behaviors in the method embodiments of the first aspect above.
  • the functions described above may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the transceiver module includes a transceiver module and a processing module, wherein: the transceiver module is configured to receive a first message from a terminal, and the first message is used to request access to a network; the transceiver module, is further configured to send a second message to the operation requester to which the terminal belongs when the processing module determines that the terminal is allowed to access the network according to the quantity information; the quantity information includes the The number of terminals, the second message includes first identification information, and the first identification information includes one of the terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification of the terminal, or multiple.
  • the processing module is specifically configured to determine that the terminal is allowed to access the network when the number of terminals that access the network among the terminals corresponding to the operation requester is less than a number threshold ;
  • the number threshold is the number of terminals allowed to be used by the operation requester.
  • the transceiver module is further configured to send a third message to the terminal when the processing module determines that the terminal is not allowed to access the network according to the quantity information ;
  • the third message indicates that the terminal is denied access to the network.
  • the processing module is specifically configured to determine that the terminal is not allowed to access the network when the number of terminals that access the network among the terminals corresponding to the operation requester is greater than or equal to the number threshold.
  • the network; the number threshold is the number of terminals allowed to be used by the operation requester.
  • the transceiver module is further configured to send a fourth message to the second core network device; the fourth message is used to request an authentication process for the terminal; the fourth message includes Second identification information and authentication information, the second identification information and the authentication information are used to execute the authentication process; the second identification information includes the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, One or more of terminal network ID and operation requester ID.
  • the fourth message further includes indication information, where the indication information indicates that the authentication process is one-way authentication, two-way Any one of one-way authentication, one-way authentication of the terminal by the network or the operation requester.
  • the processing module is further configured to perform an authentication process on the terminal according to the first message;
  • the first message includes third identification information and authentication information, and the third identification
  • the information and the authentication information are used to execute the authentication process;
  • the third identification information includes one of the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, the terminal network identification, and the operation requester identification or multiple.
  • the processing module is further configured to determine the operation requester to which the terminal belongs according to third identification information included in the first message; the third identification information includes the One or more of the above terminal's terminal ID, encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID.
  • the processing module is specifically configured to determine the operation requester to which the terminal belongs according to the third identification information and a first correspondence; said terminal belongs to said operation requesting party.
  • the first correspondence includes a correspondence between an application identifier (terminal identifier or network identifier) of the terminal and an operation requester identifier, where the operation requester identifier is the identifier of the operation requester.
  • the processing module is specifically configured to determine a second correspondence according to an operation instruction from the operation requester; the second correspondence indicates that the terminal belongs to the operation requester ; Determine the operation requester to which the terminal belongs according to the third identification information and the second correspondence.
  • the operation instruction may include a first identifier of the terminal, where the first identifier is any one of a terminal identifier, an encrypted terminal identifier, a terminal application identifier, and a terminal network identifier.
  • the transceiver module is further configured to receive a fifth message; send a sixth message to the terminal; the fifth message indicates that the authentication process passes, and the sixth message indicates that Accepting the terminal to access the network; or, the fifth message indicating that the authentication process fails, and the sixth message indicating rejecting the terminal from accessing the network.
  • the processing module is further configured to acquire the quantity information and/or the first identification information.
  • the processing module is further configured to count the number of terminals that access the network among the terminals corresponding to the operation requester.
  • the processing module is specifically configured to, after the terminal passes the authentication, update the access information in the terminal corresponding to the operation requester according to the first identification information and the third corresponding relationship.
  • the number of terminals in the network, the third corresponding relationship includes: one or more of one or more of the terminal ID, encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID of the terminal. Multiple correspondences.
  • the embodiments of the present application provide a communication device, where the communication device has a function of implementing the behaviors in the method embodiments of the first aspect above.
  • the functions described above may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions. In a possible implementation manner, it includes a transceiver module and a processing module, wherein: the transceiver module is configured to obtain quantity information, and the quantity information indicates the number of terminals allowed to be used by the operation requester; the processing module, It is used to acquire one or more terminal application identifiers according to the quantity information.
  • the transceiver module is further configured to send an operation instruction, where the operation instruction includes a first application identifier, and the first application identifier is included in the one or more terminal application identifiers; The operation instruction is used to perform an operation on the terminal corresponding to the first application identifier.
  • the transceiving module is further configured to acquire network identification information, where the network identification information includes one or more terminal network identifications.
  • the transceiving module is further configured to send the one or more terminal application identifiers and/or the operation requester identifier to the first core network device.
  • the embodiments of the present application provide a communication device, where the communication device has a function of implementing the behaviors in the method embodiments of the third aspect above.
  • the functions described above may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • a transceiver module is included, wherein: the transceiver module is configured to obtain one or more terminal application identifiers; send an operation instruction, the operation instruction includes a first application identifier, and the first application The identification is included in the one or more terminal application identifications; The operation instruction is used to perform an operation on the terminal corresponding to the first application identifier.
  • the transceiving module is specifically configured to receive the one or more terminal application identifiers from the first core network device.
  • the transceiving module is further configured to acquire quantity information, where the quantity information indicates the quantity of terminals allowed to be used by the operation requester.
  • the embodiments of the present application provide a communication device, where the communication device has a function of implementing the behaviors in the method embodiments of the fourth aspect above.
  • the functions described above may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • a transceiver module is included, wherein: the transceiver module is configured to obtain quantity information, the quantity information indicating the number of terminals allowed to be used by the operation requester; sending the quantity to the first core network device information and/or first identification information; the first identification information includes one or more of terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification; the operation request The party identifier is the identifier of the operation requesting party, and the terminal belongs to the operation requesting party.
  • the communication device further includes: a processing module configured to configure the number of terminals allowed to be used by the operation requester.
  • the processing module is specifically configured to acquire (for example, assign) the terminal network identifier of the terminal according to the quantity information.
  • the transceiving module is further configured to send the terminal network identifier of the terminal to the operation requester.
  • the transceiving module is further configured to receive one or more terminal application identifiers from the operation requester; the one or more terminal application identifiers include the terminal application identifier of the terminal.
  • the processing module is further configured to configure the one or more terminal application identifiers.
  • the transceiver module is further configured to obtain a seventh message; the seventh message includes the quantity information and fourth identification information; the fourth identification information includes the terminal of the terminal One or more of ID, encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID.
  • the transceiving module is further configured to send the application identifier of the terminal and/or the quantity information to the operation requester.
  • the transceiver module is further configured to receive a fourth message from the first core network device, where the fourth message is used to request to perform an authentication process on the terminal; the first Fourth, the message includes second identification information and authentication information, and the second identification information includes one or more of terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification;
  • the processing module is further configured to perform an authentication process on the terminal according to the fourth message.
  • the fourth message further includes indication information, where the indication information indicates that the authentication process is one-way authentication, two-way Any one of one-way authentication, one-way authentication of the terminal by the network or the operation requester; the processing module is specifically configured to determine the type of the authentication process according to the indication information.
  • the second identification information includes the operation requester identification and does not include the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, and the terminal network identification; the processing module further uses If the terminal passes the authentication, assign the terminal network identifier to the terminal.
  • the processing module is further configured to count the number of terminals that access the network among the terminals corresponding to the operation requester.
  • the processing module is specifically configured to, after the terminal passes the authentication, the second core network device update the operation request according to the first identification information and the third corresponding relationship.
  • the number of terminals that access the network among the terminals corresponding to the party, the third correspondence includes: one of the terminal ID, encrypted terminal ID, terminal application ID, terminal network ID, and operation requester ID of the terminal One or more of the corresponding relationship.
  • the transceiving module is further configured to notify the first core network device of the number of terminals that access the network among the terminals corresponding to the operation requester. For example, the transceiver module sends a notification message to the first core network device, where the notification message includes the number of terminals that access the network among the terminals corresponding to the operation requester.
  • the terminal is a tag; the processing module is further configured to update or delete identification information of the invalid tag, where the identification information of the invalid tag includes one or more of the following information: The terminal application identifier, terminal network identifier, terminal identifier, encrypted terminal identifier, and a third corresponding relationship of the invalidation tag, the third correspondence includes the terminal application identifier, terminal network identifier, terminal identifier, encrypted The corresponding relationship between two or more of the terminal identifiers.
  • the transceiver module is further configured to receive a tag message from the operation requester; updating or deleting the identification information of the invalid tag by the second core network device includes: the second core The network device updates or deletes the identification information of the invalid label according to the label information.
  • the present application provides a communication device, the communication device includes a processor, and the processor can be used to execute computer-executed instructions stored in the memory, so that the above-mentioned first aspect or any possible implementation of the first aspect
  • the method shown is executed, or the method shown in the second aspect or any possible implementation of the second aspect is executed, or the third aspect or any possible implementation of the third aspect is shown
  • the method is executed, or the method shown in the fourth aspect or any possible implementation manner of the fourth aspect is executed.
  • the process of sending information in the above method may be understood as a process of outputting information based on instructions from a processor.
  • the processor In outputting information, the processor outputs the information to the transceiver for transmission by the transceiver. After the information is output by the processor, it may also need to undergo other processing before reaching the transceiver.
  • the processor receives incoming information
  • the transceiver receives that information and inputs it to the processor.
  • the information may require other processing before being input to the processor.
  • the above-mentioned processor may be a processor dedicated to performing these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor.
  • the processor may also be used to execute a program stored in the memory, and when the program is executed, the communication device executes the method as shown in the first aspect or any possible implementation manner of the first aspect.
  • the memory is located outside the communication device. In a possible implementation manner, the memory is located in the above communication device.
  • the processor and the memory may also be integrated into one device, that is, the processor and the memory may also be integrated together.
  • the communication device further includes a transceiver, where the transceiver is configured to receive a message or send a message, and the like.
  • the present application provides a data processing device, the data processing device includes a processing circuit and an interface circuit, The interface circuit is used to acquire data or output data; the processing circuit is used to execute the corresponding method as shown in the above first aspect or any possible implementation of the first aspect, or the processing circuit is used to execute the above second aspect or The corresponding method shown in any possible implementation of the second aspect, or the processing circuit is used to execute the corresponding method shown in the above third aspect or any possible implementation of the third aspect, or the processing circuit is used to execute A corresponding method as shown in the fourth aspect or any possible implementation manner of the fourth aspect.
  • the present application provides a computer-readable storage medium, which is used to store a computer program.
  • a computer program When it is run on a computer, the above-mentioned first aspect or any possible implementation of the first aspect
  • the method shown in the manner is executed, or the method shown in the second aspect or any possible implementation of the second aspect is executed, or the method shown in the third aspect or any possible implementation of the third aspect is executed.
  • the method is executed, or the method shown in the fourth aspect or any possible implementation manner of the fourth aspect is executed.
  • the present application provides a computer program product, the computer program product includes a computer program or computer code, and when it is run on a computer, the above-mentioned first aspect or any possible implementation of the first aspect shows The method is executed, or the method shown in the second aspect or any possible implementation of the second aspect is executed, or the method shown in the third aspect or any possible implementation of the third aspect is executed , or cause the method shown in the fourth aspect or any possible implementation manner of the fourth aspect to be executed.
  • the present application provides a communication system, including the first core network device in the fifth aspect or any possible implementation of the fifth aspect, and the operations described in the sixth aspect or the seventh aspect.
  • FIG. 1 is a schematic diagram of a passive Internet of Things service flow
  • FIG. 2A, FIG. 2B, and FIG. 2C show schematic diagrams of three architectures of a 3GPP network supporting P-IoT;
  • FIG. 3 is an example of a UE registration process provided by an embodiment of the present application.
  • Fig. 4 shows examples of several ways of allocating application identifiers of terminals provided by the embodiment of the present application
  • FIG. 5 is a flow chart of a terminal management method provided in an embodiment of the present application.
  • FIG. 6A is a flow chart of another terminal management method provided in the embodiment of the present application.
  • FIG. 6B is a flow chart of another terminal management method provided in the embodiment of the present application.
  • FIG. 7 is a flow chart of another terminal management method provided in the embodiment of the present application.
  • FIG. 8 is a flow chart of another terminal management method provided in the embodiment of the present application.
  • FIG. 9 is a flowchart of another terminal management method provided in the embodiment of the present application.
  • FIG. 10 is a flowchart of another terminal management method provided in the embodiment of the present application.
  • FIG. 11 is a flow chart of another terminal management method provided in the embodiment of the present application.
  • FIG. 12 shows a schematic structural diagram of a communication device 1200
  • FIG. 13 is a schematic structural diagram of another communication device 130 provided in an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of another communication device 140 provided by an embodiment of the present application.
  • an embodiment means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the present application.
  • the occurrences of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is understood explicitly and implicitly by those skilled in the art that the embodiments described herein can be combined with other embodiments.
  • At least one of the following or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one (one) of a, b and c may represent: a, or, b, or, c, or, a and b, or, a and c, or, b and c, or, a , b and c.
  • a, b and c can be single or multiple.
  • P-IoT Passive Internet of Things
  • Some network nodes in the passive Internet of Things can be passive, and they can obtain energy through solar energy, radio frequency, wind energy, water energy, or tidal energy, and there is no limit to the way of energy acquisition. These nodes are not equipped with or rely on power devices such as batteries, but obtain energy from the environment to support data perception, transmission and distributed computing. These nodes can also store the harvested energy.
  • the passive IoT architecture may include passive terminals, readers (readers), and operation requesters.
  • the passive terminal may be in the form of a tag (such as an electronic tag), or in any other terminal form, which is not limited in this application.
  • the reader (reader) can use radio frequency to read and write electronic tags or radio frequency cards (Tag), so as to achieve the purpose of identifying targets and data exchange.
  • the tag enters the effective identification range of the reader, it receives the radio frequency signal sent by the reader, and sends out the information stored in the chip by virtue of the energy obtained by the induced current (corresponding to passive tag); the other is that the tag (this can be called semi-passive or semi-active tag) can store part of the electric energy through solar energy, so that it can actively send a signal of a certain frequency or use the stored electric energy for communication and data
  • the reader receives and decodes the information, and sends it to the central information system for relevant data processing.
  • a tag may refer to an electronic tag, or a passive or semi-passive IoT tag (such as a non-electronic tag used to be embedded or attached to an item).
  • an example of a terminal is a tag.
  • the reader may be an access network device, and the access network device includes a base station, a pole station, a micro base station, a wireless access network device, a wireless access network node, and an integrated access and backhaul node.
  • the operation requester can be a server (server), passive IoT server (P-IoT server), application function (application function, AF), passive IoT application function (P-IoT AF) or other sending device for operating instructions.
  • the passive Internet of Things may also be called the ambient energy harvesting Internet of Things (ambient IoT or ambient power-enabled IoT, A-IoT).
  • the IoT terminals in the passive Internet of Things or the environmental energy harvesting Internet of Things may include passive terminals, semi-passive terminals, semi-active terminals or active terminals.
  • the passive terminal, the semi-passive terminal, or the semi-active terminal may communicate by means of reflecting a carrier wave. For example, receiving the radio frequency signal sent by the reader, relying on the sense The energy obtained in response to the electric current emits the information stored in the chip.
  • the semi-passive terminal or the semi-active terminal may have a capacitor to store energy obtained from the environment (such as solar energy, radio frequency energy, etc., and there is no limitation on the way of obtaining energy).
  • This energy can be used for computation, communication, data reading, data storage, etc.
  • a semi-active terminal or an active terminal may actively generate a carrier wave for communication.
  • part of the electric energy can be stored by means of solar energy, so that a signal of a certain frequency can be actively sent or the stored electric energy can be used to perform operations such as communication, data reading, or data writing.
  • Warehouse/Transportation/Materials Embedding or attaching passive or semi-passive tags to goods. During the logistics process of the goods stored in warehouses, shopping malls and other places, the relevant information of the goods is automatically collected by the reader through the Internet of Things tags. Managers can quickly query product information in the system, reduce the risk of goods being discarded or stolen, increase the speed of delivery of goods, improve accuracy, and prevent cross-selling and anti-counterfeiting.
  • FIG. 1 is a schematic diagram of a passive Internet of Things service flow.
  • FIG. 1 shows the following operations: 1.
  • the operation requester sends an operation instruction to the access network device through the AMF. 2.
  • the terminal executes the operation. After receiving the operation instruction from the mobility management device, the access network device sends the operation instruction to the terminal.
  • the terminal obtains or sends corresponding information according to the operation instruction, that is, performs a corresponding operation according to the operation instruction. 3.
  • the terminal accesses the core network. 4.
  • the terminal sends the operation result to the operation requester through the core network device (such as the AMF shown in FIG. 1 ).
  • the operation result is obtained by the terminal executing the corresponding operation according to the operation instruction.
  • the terminal may be sent to the terminal through a core network device (for example, an access and mobility management function (AMF) device) and an access network device.
  • AMF access and mobility management function
  • the operation instruction may include but is not limited to performing an acquisition of tag information, an inventory operation (or called an inventory operation), a read operation, a write operation, an invalidation operation, and an information exchange operation with the tag.
  • An AMF device is an example of a mobility management device.
  • the operation instruction may include area location information, identification information of the terminal, and the like.
  • the access network device After receiving the operation instruction, the access network device will send the operation instruction to the terminal.
  • the terminal acquires or sends corresponding information according to the operation instruction.
  • the terminal when the operation instruction is an inventory instruction or an instruction to perform an inventory operation, the terminal will send its identification information. For another example, when the operation instruction is a read instruction or an instruction to perform a read operation, the terminal will send the data information stored in its storage area. For another example, when the operation instruction is a write instruction or an instruction to perform a write operation, the terminal will store the data information to be written into the terminal included in the operation instruction into a storage area of the terminal.
  • the access network device receives the information sent by the terminal, and sends the information to the operation requester through the core network device.
  • the manner in which the operation requester sends instructions to the access network device may be sent through a control plane channel, for example, the operation requester sends instructions to the access network device through the control plane device.
  • the control plane device may include a mobile management device, a network opening function device, a session management device, a policy control device, a unified data management device, a unified data repository, and an IoT management device (such as a tag management function (TMF) network element, passive IoT management function (passiveIoT management function, PIMF) network element, ambient energy acquisition IoT management function (ambient IoT management function, AIMF) network element, equipment capable of IoT terminal management or capable of processing IoT services), etc.
  • TMF tag management function
  • PIMF passive IoT management function
  • AIMF ambient energy acquisition IoT management function
  • FIG. 1 takes the control plane device as an example of a mobility management device.
  • the operation request sends instructions to the AMF; at this time, the operation requester can be understood as the application function (application function, AF), server or passive IoT application function (P-IoT AF), passive IoT server.
  • the P-IoTAF sends instructions to the AMF.
  • the P-IoT AF sends instructions to the AMF through the control plane device.
  • the control plane device may be a network exposure function device (network exposure function, NEF), a session management device (session management function, SMF), a policy control device (policy control function, PCF), unified data management device (unified data management, UDM), unified data repository (unified data repository, UDR).
  • the operation requester can also send instructions to the access network device through the user plane channel.
  • the operation requester sends an instruction to the reader through a user plane function (UPF).
  • the operation requester sends instructions to the reader through user plane equipment and other access network equipment, such as radio access network equipment (radio access network, RAN); at this time, the reader may be a pole station , accessing integrated access and backhaul (IAB) nodes, terminal devices, etc.
  • IAB integrated access and backhaul
  • the operation requester can perform different terminal operations on the terminal. Several common terminal operations are listed below.
  • An inventory operation (also referred to as an inventory operation), that is, an inventory of currently existing terminal conditions, can also be understood as obtaining terminal identification information.
  • Each terminal will have its identification.
  • the identifier of the terminal may be assigned by an enterprise or a third-party entity (that is, written into the terminal when the enterprise produces or manufactures the terminal), or may be assigned by an operator.
  • the identifier of the terminal may be a globally unique code, such as an electronic product code (electronic product code, EPC), or may be a temporary identifier or an identifier that is not globally unique.
  • EPC electronic product code
  • the operation requester can issue an inventory instruction to the reader.
  • the inventory instruction will include information such as the identification range of the terminal, the identification of the reader, and location information.
  • the reader After receiving the inventory instruction, the reader will perform an inventory to the corresponding terminal according to the inventory instruction, and send the identification information of the terminal to the operation requester.
  • the operation request sends an instruction to the reader, and the reader sends the instruction to the corresponding terminal.
  • the terminal learns that it is an inventory operation according to the content of the instruction, and the terminal sends the identification information of the terminal to the reader.
  • the reader sends the identification information of the terminal to the operation requester.
  • Read operation that is, to read data from the terminal.
  • the terminal can have a storage function, and its storage area can store data. If the operation requester wants to perform a read operation on the terminal, it will send a read command to the reader, and the reader performs a read operation on the terminal according to the read command, reads data from the storage area of the terminal, and sends the data to the operation requester.
  • the operation requester can send a write command to the reader, and the reader performs a write operation on the terminal according to the command, and writes data into the storage area of the terminal.
  • the invalidation operation can invalidate the terminal.
  • the operation requester may send an invalidation instruction to the reader, and the invalidation instruction may include a terminal identifier (that is, an identifier of a terminal wishing to invalidate).
  • the reader performs an invalidation operation on the terminal according to the instruction. After the operation is completed, the terminal will be invalidated and cannot be inventoried or performed other operations.
  • an example of a terminal is a tag.
  • the invalidation operation can invalidate the label
  • the invalidation instruction may include the label identification (ie, the identification of the label to be invalidated).
  • Obtaining tag information can be understood as a high-level description of the above-mentioned various operations (for example, a high-level description of inventory operations and read operations). It does not distinguish whether the operation requester is an inventory terminal or read terminal data. This operation will obtain terminal information.
  • the terminal information may be identification information of the terminal or information stored in a storage area of the terminal.
  • the message interaction operation with the terminal can be understood as a high-level description of the above-mentioned various operations.
  • the reader After receiving the instruction sent by the operation requester, the reader performs information or message interaction with the terminal, and sends information from the terminal to the operation requester.
  • This operation is mainly for the reason that the above-mentioned reader does not view the content of the instruction, and is only responsible for forwarding the message sent by the operation requester to the terminal and the message sent by the terminal to the operation requester. Therefore, in this scenario, the operation performed by the reader on the terminal can be understood as a message interaction operation with the terminal.
  • FIG. 2A, FIG. 2B, and FIG. 2C show schematic diagrams of three architectures of a 3GPP network supporting P-IoT.
  • FIG. 2A shows a schematic diagram of a technical path 1 of a 3GPP network supporting P-IoT.
  • FIG. 2B shows a schematic diagram of the technical path 2 of the 3GPP network supporting P-IoT.
  • FIG. 2C shows a schematic diagram of a technical path 3 of a 3GPP network supporting P-IoT.
  • the transmission method of the instruction can be transmitted through the user plane connection.
  • the hatched areas in FIG. 2A indicate user plane connections or user plane channels, and N2, N3, N4, N6, and N11 all indicate interfaces.
  • the RAN and the UPF communicate through the N3 interface, or it can be understood that the RAN and the UPF establish an N3 tunnel.
  • the interface between the UPF and the data network is N6.
  • the reader establishes a user plane connection, and the operation requester (such as a server) sends an instruction to the reader through the user plane connection.
  • the reader can be a terminal device, or a wireless access network device, base station, micro station, integrated access and backhaul (IAB), pole station, etc.
  • FIG. 2A is illustrated by taking the reader as an access network device as an example.
  • the instruction transmission method can still be transmitted through the user plane connection.
  • the hatched area in FIG. 2B indicates a user plane connection or a user plane channel.
  • N2, N3, N4, N6, and N11 all represent interfaces.
  • the RAN and the UPF communicate through the N3 interface, or it can be understood that the RAN and the UPF establish an N3 tunnel.
  • the interface between the UPF and the data network is N6.
  • the difference from technical path 1 is that the reader establishes a user plane connection with the user plane device, and the user plane device establishes a connection with an operation requester (such as a server). That is, the reader does not establish a session at the granularity of the data network.
  • server 1 is located in data network (data network, DN) 1
  • server 2 is located in data network 2.
  • the reader needs to establish two sessions to connect to data network 1 and data network 2 respectively.
  • the reader only needs to establish one user plane connection with the same user plane device, and the user plane device establishes connections with server 1 and server 2 respectively.
  • the advantage of technical path 2 is that when the server needs to send instructions to multiple access network devices, and multiple readers are served by the same user plane device, in technical path 1, the server needs to send multiple commands to the user plane device.
  • the reader can be a terminal device, or a wireless access network device, base station, micro station, integrated access and backhaul (IAB), pole station, etc.
  • FIG. 2B is illustrated by taking the reader as an access network device as an example.
  • the command transmission mode can be transmitted through the control plane channel, that is, the server (or application function) sends commands to the AMF through the NEF.
  • N2, N3, N4 and N11 all represent interfaces.
  • the RAN and the UPF communicate through the N3 interface, or it can be understood that the RAN and the UPF establish an N3 tunnel.
  • the AMF sends the instruction to the access network device. After the access network device completes the information interaction with the terminal, it sends information (such as information from the terminal) to the AMF. AMF sends information to the server through NEF.
  • FIG. 2C is illustrated by taking the reader as an access network device as an example. When the reader is a terminal device, in technical path 3, the transmission mode of the instruction may be that the server (or application function) sends the instruction to the AMF through the NEF. The AMF sends the instruction to the reader through the access network device.
  • 3GPP network supports the operation mode of passive IoT
  • the business model of the passive Internet of Things supported by the 3GPP network established by the operator may have the following possibilities:
  • the operator establishes an independent network for the enterprise, which supports the passive Internet of Things. Operators make profits by charging enterprises for building websites.
  • the operator can establish an independent network or a non-independent network for the enterprise, which supports the passive Internet of Things.
  • Operators charge enterprises through contracts or packages. For example, an operator can sign a contract with an enterprise for 100 yuan per month, allowing the enterprise to use 10,000 terminals (such as tags).
  • the operator may have other business models, and this application does not limit the business model of the operator.
  • the operator does not need to obtain the terminal used by the enterprise, for other situations where the operator needs to obtain the terminal used by the enterprise or the operator needs to manage the terminal, access authentication, billing, etc., the operation The provider needs to obtain the identification information of the terminal to manage the terminal.
  • FIG. 3 is an example of a UE registration process provided by the embodiment of the present application. As shown in Figure 3, a possible UE registration process is as follows:
  • the UE sends a Registration Request message to the RAN.
  • the registration request message may include a registration type (registration type) and identification information of the UE.
  • the identification information of the UE may include a user hidden identifier (subscription concealed identifier, SUCI), a globally unique temporary UE identity (5G globally unique temporary UE identity, 5G-GUTI) or a permanent equipment identifier (permanent equipment identifier, PEI). one or more.
  • the registration types are as follows:
  • Initial registration the registration process initiated when the UE is in the de-registered state
  • Mobility registration update when the UE needs to initiate a registration process due to mobility;
  • Periodic registration update (periodic registration update): When the UE is in the registration state, the registration process initiated due to the expiration of the periodic registration update timer;
  • Emergency registration a registration process initiated when the UE is in a service-limited state.
  • the 5G-GUTI is carried in the registration request; if the UE does not have a valid 5G-GUTI, then Carry SUCI.
  • the UE has no valid 5G-GUTI and no SUPI (that is, no SUCI, SUCI is encrypted SUPI), it will carry PEI.
  • the RAN sends the registration request message sent by the UE to the AMF.
  • the AMF selects the appropriate AUSF to perform security procedures such as authentication; UE, AMF, AUSF, and UDM interact to complete security procedures such as authentication.
  • the AMF interacts with the UDM to obtain the subscription data of the UE.
  • AMF sends N2 message to RAN.
  • the N2 message may include the NAS message that needs to be forwarded by the RAN to the UE.
  • the NAS message may include a registration acceptance message (NAS message) sent by the AMF to the UE.
  • the RAN forwards the registration acceptance message sent by the AMF to the UE.
  • the operation requester When the operation requester performs a terminal operation, it needs to use the terminal's identifier to identify the terminal, so that the terminal on which the operation is performed knows whether the instruction corresponds to itself. Therefore, the operation requester needs to use a terminal identifier to identify the terminal.
  • the identifier used by the operation requester to identify the terminal is called a terminal application identifier (or called a terminal application identifier).
  • the 3GPP network supports the passive Internet of Things. If the 3GPP network wants to perform access authentication, management, or billing on the terminal, the 3GPP network also needs to obtain the identification information of the terminal.
  • the identification information for identifying a terminal by a network may be referred to as a terminal network identification (or as a terminal network identification).
  • the application identifier and the network identifier of the same terminal may be the same or different.
  • an enterprise or operator allocates an application identifier and/or a network identifier of a terminal. Since the enterprise may have demands for security and privacy and does not want the network to obtain the application ID of the terminal, a possible implementation method is that the application ID of the terminal is different from the network ID, and the application ID of the terminal is assigned by the enterprise, and the network ID of the terminal is assigned by the enterprise. Carrier assignment.
  • an entity corresponding to an enterprise is a device that provides services for the enterprise, such as a server or an application function;
  • an entity corresponding to an operator is a device that provides services for the operator, such as a business&operation support system (BOSS), a server Or core network equipment.
  • BOSS business&operation support system
  • the application identification and/or network identification of the enterprise distribution terminal refers to the operation requester (for example Such as server or application function) assigns the application ID and/or network ID of the terminal; the operator assigns the application ID and/or network ID of the terminal refers to the operator through its corresponding equipment (such as server, business operation support system or core network equipment) ) allocates the terminal's application ID and/or network ID.
  • the operation requester for example Such as server or application function
  • assigns the application ID and/or network ID of the terminal refers to the operator through its corresponding equipment (such as server, business operation support system or core network equipment) ) allocates the terminal's application ID and/or network ID.
  • an enterprise may be understood as a third party, an application party, a service provider, a core network or an entity outside the network or mobile network.
  • This application provides several possible solutions for how to allocate terminal identities.
  • Solution 1 The operator pre-configures the application identifier of the terminal.
  • the operator assigns the terminal's application identifier (similar to the operator assigning a mobile phone number).
  • the operator can be replaced by a network, an operating system, a server or a core network device.
  • the operation requester allocates the application identifier of the terminal and notifies the operator.
  • the operator writes the logo to the terminal (similar to the operator burning a card to issue a card), or the operator authorizes the enterprise to write the logo to the terminal.
  • a security parameter (or referred to as a security context) may be written when an identifier is written to the terminal.
  • Security parameters may include but are not limited to pre-configured keys (for example, for identification encryption and decryption or verification operations) or hash parameters (for example, for authentication or authentication); The verification value (AUTH value) after the number and hash.
  • a network may refer to a core network and/or an access network.
  • the authentication process is performed by writing security parameters to the terminal.
  • the terminal can send the terminal ID (or encrypted terminal ID), and the network records the corresponding relationship between the terminal application ID and the terminal ID.
  • the application ID of a terminal can only correspond to one terminal ID, so as to prevent multiple terminals from using the same ID, that is, To prevent the identity of the terminal from being stolen.
  • the terminal is a tag
  • the terminal identifier is a tag identifier (tag identifier, TID)
  • the encrypted terminal identifier is an encrypted tag identifier (concealed tag identifier, CTID).
  • TID is the unique identification of the tag. When the tag is produced, the TID and/or CTID will be written into the storage area of the tag, which can only be read but not written. The TID can be used to identify the tag itself, which can be different from the tag's application identification.
  • Solution 2 The enterprise or the operation requester allocates the terminal's application ID, and the operator does not pre-configure the terminal's application ID (that is, the operator does not pre-acquire the terminal's application ID).
  • the enterprise writes the logo to the terminal or the operator authorizes the enterprise to write the logo to the terminal.
  • the terminal is a tag, and writing the identifier to the terminal refers to writing the tag's identification information into the tag.
  • a security parameter (or called a security context) may be written when an identifier is written to a terminal.
  • the terminal is authenticated by writing security parameters when writing the identity to the terminal.
  • the terminal ID is sent, and the network records the terminal ID, and the number of terminals used by the enterprise can be monitored according to the terminal ID.
  • Option 3 The enterprise or the operation requester allocates the application ID of the terminal, and the operator allocates the network ID of the terminal
  • the distribution of the network identifier of the terminal by the operator may be to authorize the enterprise or the operation requester to write the network identifier of the terminal into the terminal.
  • a security parameter (or referred to as a security context) may be written when an identifier is written to the terminal.
  • Authorized terminals are authenticated by writing security parameters when writing an identity to the terminal.
  • the terminal ID can be sent, the network records the terminal ID, and the number of terminals used by the enterprise is monitored according to the terminal ID, so as to prevent the terminal ID from being stolen.
  • Solution 4 The enterprise or the operation requester allocates the application ID of the terminal, and the operator allocates the network ID of the terminal through online signing.
  • online signing may mean that the terminal uses a default credential to access the network, and after the network authentication, sends the signing data or credential for subsequent network access to the terminal (that is, it can be understood as obtaining the signing data online).
  • the terminal uses an enterprise or operation requester granularity identifier or credential or a default credential to access the network, and after the authentication is passed, the network sends the network identifier to the terminal. Subsequent terminals use the obtained network identifier to access the network.
  • the terminal When the terminal writes the identity, it can write security parameters (or called security context), and the network authenticates the enterprise-granularity identity (such as authenticating the AUTH value after the operation of the random number and the key), so that the network authentication terminal can be realized.
  • security parameters or called security context
  • the network authenticates the enterprise-granularity identity (such as authenticating the AUTH value after the operation of the random number and the key), so that the network authentication terminal can be realized.
  • the terminal When the terminal performs online signing, it needs to send the enterprise ID or the default ID, and the network assigns the network ID according to the enterprise ID or the default ID.
  • the default identifier may be any identifier negotiated or agreed between the terminal and the network.
  • the terminal When the terminal registers, it needs to send the network ID, and the network records the network ID.
  • the network records or monitors the number of terminals used by the enterprise (or the operation requester) according to the network identifier, so as to prevent the number of terminals used by the enterprise (or the operation requester) from exceeding the allowed number (that is, the number threshold).
  • An example of the network recording or monitoring the number of terminals used by the enterprise (or the operation requester) according to the network identifier is: UDM or AMF records or monitors the number of terminals used by the enterprise (or the operation requester) according to the network identifier.
  • the present application provides a terminal management method.
  • the terminal access management can be realized, and the identification of the terminal can be prevented from being stolen.
  • the terminal management method provided in this application is applicable to the passive Internet of Things architecture shown in FIG. 2A to FIG. 2C , and is also applicable to other architectures for terminal access management.
  • This application uses the 5G network as an example to illustrate this solution. It should be noted that the terminal management method provided in this application is also applicable to 4G, 6G networks, etc.
  • the devices involved include core network devices, such as AMF, AUSF, and UDM, and servers, such as the operation requester (that is, the server that issues instructions or the application function AF).
  • core network devices such as AMF, AUSF, and UDM
  • servers such as the operation requester (that is, the server that issues instructions or the application function AF).
  • the operation requester that is, the server that issues instructions or the application function AF.
  • the equipment involved in this application is introduced below.
  • Mobility management network element mainly used for mobility management and access management, etc., and can be used to implement functions other than session management in the mobility management network element (mobility management entity, MME) functions, such as lawful interception and Access authorization/authentication and other functions.
  • Mobility management network elements also referred to as access and mobility management equipment, access and mobility management functional entities, access and mobility management functional network elements, mobility management network elements, and mobility management entities
  • the mobility management device can be used to manage access control and mobility of user equipment.
  • An example of a mobility management device is an AMF network element in 5G.
  • the AMF network element includes the access and mobility management functions of the mobility management entity (MME) in the network framework of the long term evolution (LTE), and adds the access management function .
  • the AMF network element can be specifically responsible for user equipment registration, mobility management, tracking area update process, reachability detection, session management network element selection, mobility state transition management, etc.
  • the access and mobility management network element may be the access and AMF network element.
  • future communications such as 6G
  • the access and mobility management network element can still be an AMF network element, or have other names, which are not limited in this application.
  • the AMF network element can provide the Namf service.
  • AMF can provide N1N2 message transfer service (Namf_Communication_N1N2MessageTransfer service), and other core network elements can send N1 messages to terminal equipment or N2 messages to access network equipment through the AMF service.
  • IoT management device a device used to manage IoT terminals or process IoT services.
  • the functions of the IoT management device may include one or more of the following functions: identifying business instructions from the operation requester, instructing the reader to perform the access process of the IoT terminal (such as a random access process), collecting and /or process business data from IoT terminals, perform data routing on IoT services, etc.
  • the IoT management device may be a TMF network element, a PIMF network element, or an AIMF network element, etc. This application does not limit the name of the IoT management device.
  • User plane network element used for packet routing and forwarding and quality of service (quality of service, QoS) processing of user plane data, etc.
  • the user plane network element may be a user plane function (user plane function, UPF) network element, and may include an intermediate user plane function (intermediate user plane function, I-UPF) network element, an anchor user plane function (PDU Session anchor user plane function, PSA-UPF) network element.
  • the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.
  • a UPF network element (also called a user plane device) is a type of core network device. The UPF network element may be responsible for forwarding and receiving user data in the user equipment.
  • the element can receive user data from the data network and transmit it to the user equipment through the network element of the access network.
  • the user plane functional network element may also receive user data from the user equipment through the access network element, and forward the user data to the data network.
  • the transmission resources and scheduling functions of the user plane function network element providing services for the user equipment are managed and controlled by the session management function network element.
  • Session management network element mainly used for session management, network interconnection protocol (internet protocol, IP) address allocation and management of terminal equipment, selection of manageable terminal equipment plane functions, termination points of policy control and charging function interfaces, and downlink data notification wait.
  • the session management network element may be a session management function (session management function, SMF) network element, and may include an intermediate session management function (intermediate session management function, I-SMF) network element, an anchor session management function (anchor session management function, A-SMF) network element.
  • I-SMF intermediate session management function
  • A-SMF anchor session management function
  • the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.
  • An SMF network element (also called a session management device) is a type of core network device.
  • SMF network elements can be used to be responsible for session management of user equipment (including session establishment, modification and release), selection and reselection of user plane function network elements, Internet protocol (internet protocol, IP) address allocation of user equipment, quality of service ( quality of service, QoS) control, etc.
  • the session management network element may be a session management function (session management function, SMF) network element.
  • SMF session management function
  • the session management network element can still be an SMF network element, or have other names, which are not limited in this application.
  • the SMF network element can provide the Nsmf service.
  • Authentication service network element used for authentication services, generating keys to realize two-way authentication of terminal equipment, and supporting a unified authentication framework.
  • the authentication service network element may be an authentication server function (authentication server function, AUSF) network element.
  • the authentication service function network element may still be an AUSF network element, or may have other names, which are not limited in this application.
  • Application function network elements can interact with the 5G system through application function network elements, and are used to access network open function network elements or interact with policy frameworks for policy control, etc.
  • the application function network element may be an (application function, AF) network element.
  • the application function network element may still be an AF network element, or may have other names, which are not limited in this application.
  • Network opening function network element used to provide customized functions for network opening.
  • the network exposure function network element may be a network exposure function (network exposure function, NEF) network element.
  • NEF network exposure function
  • the 5G communication system can also open 5GC-supported capabilities to external application function network elements through NEF network elements, such as providing small data transmission capabilities.
  • An NEF network element (also called a network open device) is a type of core network device.
  • the network opening function network element can be used to enable 3GPP to securely provide network service capabilities to third-party AFs (for example, service capability server (service capability server, SCS), application server (application server, AS), etc.).
  • the network exposure network element may be a network exposure function (network exposure function, NEF) network element.
  • NEF network exposure function
  • the open network element may still be an NEF network element, or have other names, which are not limited in this application.
  • the NEF network element can provide Nnef services to other network function network elements.
  • Data management network element used to process terminal device identification, access authentication, registration, and mobility management.
  • the data management network element may be a unified data management (unified data management, UDM) network element or a unified data repository (unified data repository, UDR) network element.
  • the unified data management may still be UDM, UDR network element, or may have other names, which are not limited in this application.
  • the UDM or UDR network element in this embodiment of the present application may refer to a user database. Can exist as a single logical repository for storing user data.
  • a UDM network element also called a unified data management device, a data management device, or a unified data management entity).
  • the unified data management network element may be a UDM network element or a unified data management device.
  • the unified data management network element can also be a UDM network element, or it can also have other names, which are not covered in the embodiments of this application. limited.
  • the unified data management device may be a core network device.
  • the unified data management device may be a control plane device.
  • the UDR network element also called user database device, user database entity
  • the user database mainly includes the following functions: the access function of contract data, policy data, application data and other types of data.
  • UE User equipment
  • the UE can be called terminal equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent or user device.
  • the UE can also be a cellular phone, a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (wireless local loop, WLL) station, a personal digital assistant (personal digital assistant, PDA), having a wireless communication function Handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or future evolutions of public land mobile networks (public land mobile network, PLMN) or non-terrestrial Network (non-terrestrial networks, NTN) terminal equipment, etc., can also be terminal equipment, logical entities, intelligent equipment, such as mobile phones, intelligent terminals and other terminal equipment, and can also be communication equipment such as servers, gateways, base stations, controllers, etc.
  • SIP session
  • IoT devices such as tags, passive tags, active tags, semi-active tags, semi-passive tags, sensors, electricity meters, water meters and other Internet of things (IoT) devices.
  • the UE may also be an unmanned aerial vehicle (unmanned aerial vehicle or uncrewed aerial vehicle, UAV) with a communication function.
  • UAV unmanned aerial vehicle
  • the terminal When the terminal is a passive or semi-passive or semi-active terminal or tag, it can receive or send data by obtaining energy.
  • the way to obtain energy can be obtained by means of radio, solar energy, light energy, wind energy, water energy, heat energy, kinetic energy, etc.
  • the present application does not limit the manner in which a passive, semi-passive, or semi-active terminal acquires energy.
  • the embodiment of the present application does not limit this.
  • the operation requester can be understood as a device that sends operation instructions.
  • the operation requester can be a server (server) or a P-IoT server or an application function (AF) or other devices that send operation instructions.
  • the operation requester can correspond to a certain type of user, which can include enterprises, tenants, third parties or companies, without limitation. Wherein, the operation requester corresponds to a certain type of user may be understood as that the operation requester belongs to this type of user and is managed by this type of user.
  • Access network devices interact with terminals (such as tags) through radio frequency signals or wireless signals. It should be understood that this application does not limit the name of the access network device, and the access network device can also be named by other names.
  • the access network device here has some or all of the functions involved in the reader in this application, such as having the ability to Terminals (such as tags) perform the operations described in this application (such as obtaining tag information, inventory operations, read operations, write operations, or failure operations or message interaction operations with tags, etc.), and have the ability to obtain billing-related information and/or Or charging information, a function of sending charging information to a charging function (charging function, CHF), etc.
  • the access network device may send instructions from the server or application function or core network device to the terminal (such as a tag), or the access network device may send instructions from the terminal (such as a tag) to the server or application function. news.
  • the access network device may acquire information stored in a specified terminal (such as a tag) according to an instruction issued by the server. For example, if it is an inventory operation (or it may be called an inventory operation), the access network device obtains identification information of the terminal (such as a label); the identification information may be a unique identification of the terminal or a temporary identification of the terminal.
  • the access network device reads the data in the storage area of the terminal or sends the data from the storage area of the terminal to the core network device.
  • the access network device may have a write function. For example, if it is a write operation, the access network device writes data into the storage area of the terminal (such as a tag) or forwards instructions from the server or application function or core network equipment to the terminal (such as a tag), and writes data to the storage area of the tag. input data.
  • the access network device can also perform invalidation operations on terminals (such as tags).
  • a terminal such as a tag
  • the terminal becomes invalid, and the terminal (such as a tag) cannot be executed to obtain tag information, inventory operations, read operations, and message interaction operations with the terminal Or write operations and other operations.
  • the fact that the failure of the terminal cannot be executed to acquire label information may be understood as that after the terminal fails, the access network device cannot obtain the label information of the terminal that fails.
  • the fact that the message interaction operation with the terminal cannot be performed when the terminal fails can be understood as that after the terminal fails, the access network device cannot perform message interaction with the failed terminal.
  • the access network device may be a pole site, eNodeB, gNodeB, integrated access and backhaul (IAB) node, etc., and the form of the access network device is not limited in this application.
  • the reader may be an access network device or a terminal device. This application does not limit the form of the reader.
  • FIG. 4 shows examples of several ways of allocating application identifiers of terminals provided by the embodiments of the present application.
  • Method 1 The operation requester allocates the application identifier of the terminal, and the second core network device obtains the allocated number.
  • the number of allocated numbers can be understood as the number of terminals allowed to be used by the operation requester (such as an enterprise).
  • the terminals are tags, and the number of terminals is the number of tag identifiers or the number of entity tags. The difference between the two is that the former is the number of label identifications. If a label is damaged, it can be replaced with a new label, but the label identification of the new label can be the label identification of the original damaged label. The latter is to label the terminal itself.
  • the second core network device may be a UDM, UDR, or other core network elements.
  • the allocation of application identifiers of terminals in method 1 includes the following operations:
  • the second core network device acquires the first information.
  • the number of allocated numbers may be included in the first information.
  • the number of allocated numbers can be understood as the number of numbers, the number of terminals or the number of signs.
  • Number allocation quantity can be exchanged with identification quantity, terminal quantity, number quantity or quantity information, etc.
  • a possible implementation of step 401 is as follows: the second core network device receives the first information (may be referred to as a number allocation message) sent by the operator's business&operation support system (BOSS) system.
  • BOSS business&operation support system
  • BOSS business&operation support system
  • the embodiment of the present application does not limit the manner in which the operator sends the first information to the second core network device.
  • the first information may further include an enterprise identifier.
  • a corporate identity is used to identify a business. Since an enterprise can deploy an independent network, the second core network device (such as UDM or UDR) can only serve the enterprise, so the enterprise identifier is an optional parameter. For public network scenarios or core network devices serving multiple enterprises, the enterprise identifier can be used to identify different enterprises.
  • the enterprise ID can be understood or replaced with the operation requester ID or user ID.
  • the operation requester identifier may include one or more of address information, identifier information, port number, service identifier, and transaction number.
  • the second core network device configures the number of allocated numbers.
  • the second core network device configures the number of allocated numbers, so as to perform access management according to the number of allocated numbers.
  • Performing access management according to the number of numbers allocated may include one or more of the following: allocating network identifiers of terminals according to the number of numbers allocated, allocating application identifiers of terminals according to the number of numbers allocated, and determining the number of terminals allowed to be used by the operation requester according to the number of numbers allocated 1. Determine whether the number of terminals used by the operation requester exceeds the number of terminals allowed to be used by the operation requester according to the number of allocated numbers.
  • the operation requester obtains the second information.
  • the second information includes the number of allocated numbers.
  • a possible implementation of step 403 is as follows: the operation requester receives the second information (for example, a number allocation message) sent by the operator's BOSS system. BOSS can be replaced by other entities corresponding to operators. That is to say, the embodiment of the present application does not limit the method by which the operator sends the second information to the operation requester.
  • the first information and the second information may be the same or different.
  • both the first information and the second information are number allocation messages, and both include the number of number allocation.
  • the first information includes the number of numbers allocated and the company logo
  • the second information includes the number of numbers allocated and does not include the number of the company. industry logo.
  • the sequence of step 401 and step 403 is not limited. It can be understood that the operations performed by the second core network device (step 401 and step 402) and the operations performed by the operation requester (step 403 and step 404) are independent of each other.
  • the operation requester allocates the application identifier of the terminal.
  • the operation requester allocates the application identifier of the terminal according to the allocated number.
  • the number of allocated numbers is 10,000
  • the operation requester allocates application IDs of 10,000 terminals according to the number of allocated numbers, and each terminal corresponds to an application ID.
  • the first core network device receives quantity information and/or first identification information from the second core network device.
  • the first core network device may be an AMF, or an IoT management device, that is, a device capable of managing IoT terminals or processing IoT services.
  • the first identification information includes one or more of the terminal identification, the encrypted terminal identification, the terminal application identification, the terminal network identification, and the operation requester identification of the terminal.
  • the operation requester ID is used to identify the operation requester.
  • the quantity information may include the number of terminals allowed to be used by the operation requester (which may be understood as the number of allocated numbers).
  • Method 2 The operation requester allocates the terminal's application ID, and the operator allocates the terminal's network ID and sends the terminal's network ID to the operation requester or the operation requester allocates the terminal's network ID.
  • the second core network device acquires the first information.
  • Step 411 can refer to step 401 .
  • the first information may also include an enterprise identifier or a network identifier of the terminal.
  • the network identifier of the terminal is allocated by the BOSS system, and the first information may further include the network identifier of the terminal.
  • the network identifier of the terminal is assigned by the second core network device (such as UDM or UDR), and the first information does not need to include the network identifier of the terminal.
  • the second core network device configures the number of allocated numbers.
  • Step 412 can refer to step 402 .
  • the operation requester obtains the second information.
  • Step 413 may refer to step 403 .
  • the second information may also include the network identifier of the terminal. If the network identifier of the terminal is allocated by the BOSS system, the second information further includes the network identifier of the terminal. If the network identifier of the terminal is allocated by the second core network device (such as UDM or UDR), the second information does not need to include the network identifier of the terminal.
  • the second core network device such as UDM or UDR
  • the operation requester allocates the application identifier of the terminal.
  • Step 414 can refer to step 404 .
  • the second core network device allocates the network identifier of the terminal.
  • step 415 is as follows: the second core network device allocates the network identifier of the terminal according to the number of allocated numbers.
  • the terminal network identifier assigned by the second core network device may be the terminal network identifier assigned by the second core network device to the operation requester, that is, the network identifier assigned to the terminal of the operation requester.
  • Step 415 may be replaced by: the first information includes the network identifier of the terminal, and the second core network device acquires one or more network identifiers of the terminal according to the first information.
  • the second core network device sends the network identifier of the terminal to the operation requester.
  • Step 415 and step 416 are optional, but not necessary. It can be understood that if the network identifier of the terminal is assigned by the second core network device, the second core network device may assign the network identifier of the terminal according to the number of allocated numbers, so as to perform access management according to the network identifier of the terminal. If the network identifier of the terminal is assigned by the second core network device, after the second core network device executes step 415, it sends the assigned terminal network identifier to the operation requester, that is, executes step 416. In a possible implementation manner, the second core network device may send the assigned terminal network identifier to the operation requester through the NEF.
  • both the first information and the second information can contain the network identifier assigned by the operator to the terminal of the operation requester, and the second core network device can obtain the network identifier of the terminal according to the first information , the operation requester can obtain the terminal according to the second information end network ID. That is to say, if the network identifier of the terminal is assigned by the operator, the second core network device does not need to assign the network identifier of the terminal, nor does step 416 need to be performed.
  • the first core network device receives quantity information and/or first identification information from the second core network device.
  • Step 417 can refer to step 405 .
  • Mode 3 The operation requester assigns the application identifier of the terminal, and the second core network device acquires the number of allocated numbers and the application identifier of the terminal assigned by the operation requester.
  • the second core network device acquires the first information.
  • Step 421 can refer to step 401 .
  • the second core network device configures the number of allocated numbers.
  • Step 422 can refer to step 402 .
  • the operation requester obtains the second information.
  • Step 423 may refer to step 403 .
  • the operation requester allocates the application identifier of the terminal.
  • Step 424 can refer to step 404 .
  • the second core network device acquires the application identifier of the terminal.
  • step 425 is as follows: the second core network device receives the application identifier of the terminal allocated by the operation requester according to the number of allocated numbers.
  • the operation request sends the application identifier of the terminal allocated by it to the second core network device.
  • the operation request sends the terminal application identifier list to the second core network device, that is, a list including one or more terminal application identifiers.
  • the operation request sends a message to the second core network device, where the message includes one or more terminal application identifiers.
  • the message containing the terminal application identifier sent by the operation request to the second core network device may also include an enterprise identifier. A corporate identity is used to identify a business.
  • the second core network device can only serve the enterprise, so the enterprise identifier is an optional parameter.
  • the enterprise identifier may be used to identify different enterprises.
  • the operation requester sends a message including application identifiers of one or more terminals to the second core network device through the NEF.
  • the second core network device configures the application identifier of the terminal.
  • the second core network device configuring the terminal application identifier may be that the second core network device stores the corresponding relationship between the terminal terminal identifier and the terminal application identifier, or configure the one or more terminal application identifiers as a terminal available to the operation requester Application ID.
  • the first core network device receives quantity information and/or first identification information from the second core network device.
  • step 427 refer to step 405.
  • Method 4 The operator allocates the application identifier of the terminal, and the operator sends the application identifier of the terminal to the operation requester.
  • the BOSS system of the operator assigns the application identifier of the terminal.
  • step 431 is as follows: the BOSS system of the operator allocates the application identifier of the terminal according to the number of allocated numbers. That is to say, the operator's BOSS system allocates a corresponding number of terminal application identifiers to the operation requester according to the number of terminals allowed by the operation requester.
  • the second core network device acquires the first information.
  • the first information includes the number of allocated numbers and the terminal application identifier.
  • the terminal application identifier included in the first information may be the terminal application identifier assigned to the operation requester by the operator's BOSS system in step 431 .
  • the first information may also include an enterprise identification. Step 432 can refer to step 401 .
  • the second core network device configures the number of allocated numbers and the application identifier of the terminal.
  • the operation requester obtains the application identifier of the terminal.
  • the application identifier of the terminal obtained by the operation requester may be the terminal application identifier assigned to the operation requester.
  • step 434 the operation requester receives the terminal application identifier sent by the operator's BOSS system.
  • the operation requester may also obtain one or more terminal application identifiers from the device providing service for the operator in other ways.
  • the operation requester can also obtain the number of allocated numbers and/or the enterprise identification.
  • the operation requester receives second information from the BOSS system of the operator, where the second information includes one or more terminal application identifiers assigned by the operator to the operation requester.
  • the second information may also include number allocation and/or enterprise identification.
  • step 434 the operation requester receives the terminal application identifier sent by the second core network device.
  • the operation requester receives second information from the second core network device, where the second information includes one or more terminal application identifiers assigned by the operator to the operation requester.
  • the second information may also include number allocation and/or enterprise identification.
  • the first core network device receives quantity information and/or first identification information from the second core network device.
  • Step 435 can refer to step 405 .
  • manners 1 to 4 are only examples of several possible allocation terminal application identifiers and/or network identifiers provided by the embodiments of the present application, but not all of them.
  • Fig. 4 shows examples of several possible distribution terminal application identifiers and/or network identifiers implemented by the operation requester, the BOSS system, the second core network device and the first core network device.
  • the method flow performed by the operation requester in the process of allocating the application ID and/or network ID of the terminal will be separately described below with reference to the accompanying drawings.
  • the first core network device may be a mobility management device, a session management device, a policy control device, a unified data management device, a unified data storage library, a network open function device, a user plane device, or an IoT management device.
  • the second core network device may be a mobile management device, a session management device, a policy control device, a unified data management device, a unified data storage library, a network opening function device, and a user plane device. This application refers to the first core network device No restrictions.
  • the terminal accessing the network may be understood as the terminal registering with the network, the terminal successfully registering with the core network, or the terminal successfully executing a process.
  • Network acceptance of terminal access to the network can be understood as network acceptance of terminal registration, network acceptance of terminal registration request, network acceptance of terminal registration network, network acceptance of terminal registration process, core network acceptance of terminal registration network, core network acceptance of terminal registration core network.
  • Network denial of terminal access to the network can be understood as network denial of terminal registration, network denial of terminal registration request, network denial of terminal registration network, network denial of terminal registration process, core network denial of terminal registration network, core network denial of terminal registration core network.
  • FIG. 5 is a flow chart of a terminal management method provided by an embodiment of the present application. As shown in Figure 5, the method includes:
  • the operation requester acquires quantity information.
  • the number information indicates the number of terminals allowed to be used by the operation requester.
  • the quantity information obtained by the operation requester may be that the operation requester receives the quantity information sent by the BOSS system, see step 403 .
  • the operation requester acquires one or more terminal application identifiers according to the quantity information.
  • step 502 A possible implementation of step 502 is as follows: the operation requester allocates one or more terminal application IDs according to the quantity information; wherein, the number of terminal application IDs allocated by the operation requester is the number of terminals allowed to be used by the operation requester. For example, the number of terminals allowed to be used by the operation requester is 10,000, and the operation requester allocates 10,000 terminal application identifiers, and each terminal application identifier corresponds to one terminal.
  • the operation requester may also perform the following operations: send an operation instruction, the operation instruction includes a first terminal application identifier, and the first terminal application identifier is included in the one or more terminal application identifiers; the operation instruction is used to The terminal corresponding to the first terminal application identifier performs an operation.
  • the operations here may include inventory (or called inventory), request tag information, Read, write, invalidate, security authentication and other operations.
  • the operation requester can send operation instructions to the terminal through core network equipment and access network equipment.
  • the operation requester may also perform the following operation: acquire network identification information, where the network identification information includes one or more terminal network identifications.
  • acquire network identification information may be receiving one or more terminal network identifications sent by the second core network device, or receiving one or more terminal network identifications from the BOSS system.
  • the operation requester may also perform the following operation: sending the one or more terminal application identifiers and/or the operation requester identifier to the core network device.
  • the operation requesting to send the terminal application identifier and/or the operation requester identifier to the second core network device is an example of sending the one or more terminal application identifiers and/or the operation requester identifier to the core network device .
  • the method flow in FIG. 5 describes a possible example in which the operation requester acquires one or more terminal application identifiers.
  • the method flow in FIG. 5 describes the method flow performed by the operation requester in the first method, the second method and the third method.
  • Steps 501 and 502 may be replaced by: the operation requester obtains one or more terminal application identifiers (refer to step 434).
  • the acquisition of one or more terminal application identifiers by the operation requester may be receiving one or more terminal application identifiers from the BOSS system, or receiving the one or more terminal application identifiers from a core network device.
  • the second core network device sends one or more terminal application identifiers to the operation requester, where the first information includes the terminal application identifier assigned to the operation requester by the operator's BOSS system .
  • the operation requester acquires one or more terminal application IDs according to the quantity information; so that the number of terminal application IDs acquired is less than or equal to or not more than the number of terminals allowed to be used by the operation requester.
  • FIG. 6A is a flow chart of another terminal management method provided in the embodiment of the present application.
  • the first core network device may acquire quantity information and/or first identification information by performing the operations performed in Manner 1 to Manner 4. As shown in Figure 6A, the method includes:
  • the first core network device receives the first message from the terminal.
  • the first message is used to request access to a network
  • the network may include a core network, an access network, or other networks, and one or more core network devices and access network devices may be deployed in the network.
  • the network that the terminal requests to access is an independent network deployed by an enterprise, a public network, or a public network integrated with a non-public network.
  • the network that the terminal requests to access is a network shared by multiple enterprises.
  • the first core network device may be a mobility management device AMF, or other devices capable of implementing terminal management functions, or an IoT management device.
  • the first message may be a registration request message for requesting access to the network.
  • the first message may be a non-access stratum (non-access stratum, NAS) message or other protocol message, which is not limited in this application.
  • the receiving by the first core network device of the first message from the terminal may be that the first core network device receives the first message of the terminal forwarded by the access network device.
  • the terminal sends a registration request message (an example of the first message) to the access network device, and the first core network device receives the registration request message forwarded by the access network device.
  • the first message includes first identification information, where the first identification information identifies the terminal.
  • the first identification information includes one or more items of a terminal identification, an encrypted terminal identification, a terminal application identification, a terminal network identification, and an operation requester identification.
  • the first message includes identification information and authentication information, and the identification information and the authentication information are used to execute the authentication process;
  • the identification information includes the terminal identifier of the terminal, One or more of encrypted terminal identifiers, terminal application identifiers, terminal network identifiers, and the operation requester identifier.
  • the authentication information may include one or more items of random number, message authentication code (message authentication code, MAC), check value, token (token) and other information.
  • the first core network device When determining that the terminal is allowed to access the network according to the quantity information, the first core network device sends a second message to the operation requester to which the terminal belongs.
  • the number information includes the number of terminals allowed to be used by the operation requester to which the terminal belongs, that is, the number of allocated numbers.
  • the number of terminals allowed to be used by the operation requester may be understood as the number of terminals allowed to be used by the operation requester.
  • the second message may include first identification information, where the first identification information includes one or more of the terminal's terminal identification, encrypted terminal identification, terminal application identification, terminal network identification, and operation requester identification. Exemplarily, the second message is used to feed back the identification information of the terminal accessing the network to the operation requester; or the second message is used as a response message for the operation requester to request to acquire terminal information.
  • the first core network device is an AMF, and when the first core network device determines that the terminal is allowed to access the network according to the quantity information, it sends the second message to the operation requester to which the terminal belongs through the NEF.
  • the second message is an operation result obtained by the terminal executing the operation instruction from the operation requester.
  • step 602A is as follows: when the number of terminals that access the network among the terminals corresponding to the operation requester is less than or equal to the number threshold, the core network device determines to allow the terminal to access the network ;
  • the number threshold is the number of terminals allowed to be used by the operation requester.
  • the terminal corresponding to the operation requester refers to a terminal belonging to the operation requester or a terminal allowed to be used by the operation requester.
  • the number of terminals connected to the network among the terminals corresponding to the operation requester may be understood as the number of terminals belonging to the operation requester that have accessed the network.
  • the first core network device when the first core network device determines that the terminal is allowed to access the network according to the quantity information, it sends the second message to the operation requester to which the terminal belongs. That is to say, before the first core network device sends the second message, it needs to determine that the terminal is allowed to access the network according to the quantity information, instead of directly allowing the terminal to access the network.
  • the first core network device determines that terminals are allowed to access the network according to the quantity information, which can prevent the number of terminals accessing the network among the terminals corresponding to the operation requesting party from being greater than or equal to the number of terminals allowed to be used by the operation requesting party.
  • FIG. 6B is a flow chart of another terminal management method provided in the embodiment of the present application.
  • the first core network device may acquire quantity information and/or first identification information by performing the operations performed in Manner 1 to Manner 4.
  • the method flow in FIG. 6B is a possible implementation of the method described in FIG. 6A . As shown in Figure 6B, the method includes:
  • the first core network device receives the first message from the terminal.
  • step 601B refer to step 601A.
  • the first core network device sends a fourth message to the second core network device when determining that the terminal is allowed to access the network according to the quantity information.
  • the second core network device may be UDM, UDR or other core network devices.
  • the first core network device sends the fourth message to the second core network device through other core network devices (such as AUSF).
  • the fourth message is used to request to perform an authentication process or an authentication process on the terminal.
  • authentication and authentication may be the same concept, and authentication and authentication may be replaced with each other.
  • the authentication process can be a one-way authentication of whether the authentication terminal is a trusted terminal or an authorized terminal; or the authentication process can be a one-way authentication of whether the terminal authenticates the network or the operation requester is a trusted network or the operation requester; or the authentication
  • the process may be two-way authentication, that is, the authentication process includes the terminal authenticating the network or the operation requester, and also includes the network or the operation requesting party authenticating the terminal.
  • the fourth message includes second identification information and authentication information.
  • the second identification information and the authentication information are used to execute the authentication process.
  • the second identification information includes one or more of a terminal identification of the terminal, an encrypted terminal identification, a terminal application identification, a terminal network identification, and an operation requester identification. certification letter The information may include nonce, MAC, etc.
  • the fourth message further includes indication information; the indication information indicates that the authentication process is one-way authentication, two-way authentication, one-way authentication of the terminal to the network or operation requester, network or Either of the one-way authentication of the terminal by the operation requester.
  • the indication information indicates that the authentication process is an authentication process applied to the passive Internet of Things.
  • the fourth message is an authentication request message, and the indication information included in the fourth message indicates that the authentication is an authentication applied to the passive Internet of Things.
  • the first core network device determines the terminal to which the terminal belongs according to the third identification information included in the first message.
  • the operation requester includes one or more of the terminal identification of the terminal, the encrypted terminal identification, the terminal application identification, the terminal network identification, and the operation requester identification.
  • the first core network device determines the operation requester to which the terminal belongs, so as to determine whether to allow the terminal to access the network according to the quantity information. For example, the first core network device determines the operation requester to which the terminal belongs according to the third identification information and the first correspondence; the first correspondence indicates that the terminal belongs to the operation requester.
  • the first correspondence includes a correspondence between an application identifier (terminal identifier or network identifier) of the terminal and an operation requester identifier, where the operation requester identifier is the identifier of the operation requester.
  • the first core network device may be configured or stored with a correspondence between one or more terminals and the operation requester to which they belong, and the first core network device may determine the operation requester to which the terminal belongs according to the correspondence.
  • the first core network device determines the second correspondence according to the operation instruction from the operation requester, and the second correspondence indicates that the terminal belongs to the operation requestor; the first core network device determines the second correspondence according to the third The identification information and the second corresponding relationship determine the operation requester to which the terminal belongs.
  • the operation instruction may include a first identifier of the terminal, where the first identifier is any one of a terminal identifier, an encrypted terminal identifier, a terminal application identifier, and a terminal network identifier.
  • the first core network device receives the fifth message from the second core network device.
  • the fifth message indicates that the operation requester has successfully received or failed to receive the identification information of the terminal, or the fifth message indicates whether the authentication process of the terminal has passed or failed.
  • the fifth message may notify the terminal of the authentication result, so that the terminal performs corresponding subsequent operations according to the authentication result.
  • the receiving of the fifth message by the first core network device may be receiving a fifth message sent by other core network devices.
  • the second core network device may be UDM, UDR or other core network devices.
  • the first core network device is an AMF
  • the first core network device receives the fifth message sent by other core network devices (such as UDM or AUSF).
  • the first core network device is an AMF
  • the AMF receives the UDM (corresponding to the second core network device) through the AUSF or receives the fifth message sent to it by the AUSF (corresponding to the second core network device).
  • step 602B and step 603B may be replaced by: the first core network device performs an authentication process on the terminal according to the first message.
  • the first message includes third identification information and authentication information, where the third identification information and the authentication information are used to execute the authentication process.
  • the third identification information includes one or more of a terminal identification of the terminal, an encrypted terminal identification, a terminal application identification, a terminal network identification, and an operation requester identification.
  • the first message includes the terminal's application identifier, a random number, and a message authentication code; the first core network device retrieves security parameters according to the terminal's application identifier, and verifies the message authentication code according to the security parameters and the random number; if they are consistent, then It can be considered that the terminal has passed the authentication (or the terminal is considered as a trusted terminal); if they are inconsistent, it can be considered that the terminal has not passed the authentication (or the terminal is not considered as a trusted terminal).
  • the security parameter can be a key or a hash algorithm. If it is a key, the message authentication code may be a random number encrypted with the key. If it is a hash algorithm, the message authentication code may be a value obtained after the random number is operated by the hash algorithm.
  • the first core network device sends a sixth message to the terminal.
  • step A possible implementation manner of step 604B is as follows: the first core network device sends a sixth message to the terminal according to the fifth message. If the fifth message indicates that the operation requester has successfully received the identification information of the terminal or indicates that the authentication procedure of the terminal has passed, the first core network device sends to the terminal a sixth message indicating that the terminal is accepted to access the network.
  • the first core network device sends to the terminal a sixth message indicating that the terminal is denied access to the network. That is to say, the first core network device may send a corresponding sixth message to the terminal according to the fifth message.
  • the first core network device may further perform the following operations: acquire the quantity information and/or first identification information; the first identification information includes the terminal identification of the terminal, the encrypted terminal One or more of an identifier, a terminal application identifier, a terminal network identifier, and an identifier of the operation requester.
  • the first core network device may also be configured with the number of allocated numbers (or quantity information) and the first identification information.
  • the first core network device configures one or more of the terminal ID, the encrypted terminal ID, the terminal application ID, the terminal network ID, the operation requester ID, and the allocated number (or quantity information) of the terminal.
  • the first core network device may be the first core network device in FIG.
  • the quantity information and/or the first identification information are acquired by performing any one of the method procedures in Way 1 to Way 4. It should be understood that the method flow in FIG. 6A and FIG. 6B may not be executed until the first core network device acquires the quantity information and/or the first identification information.
  • the first core network device sends the second message to the operation requester to which the terminal belongs.
  • the first core network device sends the fourth message to the second core network device, so as to perform an authentication process on the terminal, thereby ensuring that the terminal is a trusted terminal.
  • the first core network device before the first core network device sends the second message, it needs to determine that the terminal is allowed to access the network according to the quantity information. If the first core network device determines that the terminal is not allowed to access the network according to the quantity information, it is not necessary to send the fourth message for requesting an authentication process for the terminal, which can reduce signaling overhead.
  • the first core network device determines that the terminal is allowed to access the network according to the quantity information, and can quickly and accurately determine whether to perform an authentication process on the terminal. It should be understood that when the first core network device determines that the terminal is allowed to access the network according to the quantity information, it may not mean that the terminal can pass the authentication process.
  • FIG. 7 is a flowchart of another terminal management method provided by the embodiment of the present application.
  • the first core network device may acquire quantity information and/or first identification information by performing the operations performed in Manner 1 to Manner 4.
  • FIG. 7 and FIG. 6A are two different method flows that may be executed by the first core network device after receiving the first message from the terminal. As shown in Figure 7, the method includes:
  • the first core network device receives a first message from a terminal.
  • the first core network device may be an AMF, or other devices capable of realizing the functions of the AMF, or an IoT management device.
  • the first core network device sends a third message to the terminal when it is determined according to the quantity information that the terminal is not allowed to access the network.
  • the third message indicates that the terminal is denied access to the network.
  • the third message may be a registration rejection message.
  • the number information includes the number of terminals allowed to be used by the operation requester to which the terminal belongs, which can be understood as the number of allocated numbers.
  • step 702 is as follows: when the number of terminals that access the network among the terminals corresponding to the operation requester is greater than or equal to the number threshold, the first core network device determines that the terminal is not allowed to access the network.
  • Network the number threshold is the number of terminals allowed to be used by the operation requester.
  • the first core network device may further perform the following operations: acquire the quantity information and/or first identification information; the first identification information includes the terminal identification of the terminal, the encrypted terminal One or more of an identifier, a terminal application identifier, a terminal network identifier, and an identifier of the operation requester.
  • the core network device can also configure the number of allocated numbers and identification information.
  • the first core network device configures the terminal ID of the terminal, the encrypted terminal ID, the terminal application ID, One or more of the terminal network identifier, the operation requester identifier, and the number of allocated numbers.
  • the first core network device may be the first core network device in FIG.
  • the quantity information and/or the first identification information are acquired by performing any one of the method procedures in Way 1 to Way 4. It should be understood that the method flow in FIG. 7 may not be executed until the first core network device acquires the quantity information and/or the first identification information.
  • the first core network device when the first core network device determines that the terminal is not allowed to access the network according to the quantity information, it sends the third message to the terminal, and there is no need to perform an authentication process for the terminal, which can reduce unnecessary operations, and Deny the access of the terminal in time.
  • FIG. 8 is an interaction flowchart of a terminal management method provided in an embodiment of the present application.
  • FIG. 8 is illustrated by taking the reader as an access network device as an example, and this method is also applicable to a scenario where the reader is a terminal device (such as a UE). As shown in Figure 8, the method includes:
  • the UDM and the operation requester obtain the application identifier of the terminal.
  • step 801 is as follows: the UDM (or UDR), the operation requester, and the operator's BOSS system assign the application identifier of the terminal according to the third or fourth method above.
  • the UDM in FIG. 8 is an example of the second core network device in FIG. 4 , and the UDM in FIG. 8 may be replaced by a UDR or other core network elements. Referring to methods 3 and 4 in FIG. 4, it can be seen that the application identifier of the terminal is allocated according to method 3 or 4, and both the second core network device (such as UDM or UDR) and the operation requester can obtain the application identifier of the terminal.
  • the network device (AMF in FIG. 8 ) may obtain quantity information and/or identification information.
  • the AMF in FIG. 8 is an example of the first core network device in FIG. 4 .
  • the terminal is initialized.
  • terminal initialization can be understood as label printing by the label side.
  • the label printer can be an operator or an operation requester.
  • the label of the terminal can be printed by the operator or be printed by the operator authorizing the operation requester (such as an enterprise).
  • the terminal initialization content may include the application identifier of the terminal.
  • the content of the label of the terminal may also include a security parameter (or called a security context).
  • Security parameters may include preconfigured keys, hash parameters, and the like.
  • the pre-configured key may be used to encrypt and decrypt data, or to generate or derive a key, or to execute a hash algorithm or other algorithms for authentication.
  • the hash parameter is used for hash operation.
  • the hash operation can be understood as a hash algorithm (hash), also known as a digest algorithm (digest), and its function is to calculate an arbitrary set of input data to obtain a fixed-length output digest.
  • hash algorithm also known as a digest algorithm (digest)
  • digest digest algorithm
  • the most important feature of the hash algorithm is: the same input must get the same output; different inputs have a high probability of getting different outputs.
  • Step 801 and step 802 are optional. Step 801 and step 802 may be operations completed before performing other steps in FIG. 8 . In the method flow in FIG. 8 , step 801 and step 802 can be regarded as operations performed in the preparation phase, and other steps are operations performed in the application phase. It should be understood that if the label of the terminal has been printed, and the UDM and the operation requester have obtained the application identification of the terminal, the steps after step 803 in the method flow of FIG. into management.
  • the operation request sends an operation instruction to the access network device.
  • the operation instruction may include application identifiers of one or more terminals.
  • the operation requester may send an operation instruction to the access network device through a control plane channel or a user plane channel.
  • Figure 8 shows an example where the operation requester (such as P-IoT AF) sends an operation command to the access network device through the control plane channel.
  • the operation requester may send an operation instruction to the access network device through the NEF network element or the AMF network element.
  • the operation requester may send an operation instruction to the access network device through the AMF. If it is sent through the user plane channel, the operation requester (such as the P-IoT server) can send the operation instruction to the access network device through the UPF.
  • step 803 may send an operation instruction to the core network device for the operation request, and the core network device sends the operation instruction to the terminal through the access network device.
  • the operation instruction (or message) sent by the operation request to the core network device may be different from the operation instruction (or message) sent by the core network device to the terminal; that is, the core network device may generate an Operation instructions (or messages) sent to the terminal.
  • the operation requester communicates with the core network device using the first protocol, and the core network device communicates with the terminal using the second protocol.
  • the first protocol can be the same as the second protocol, or it can be different.
  • the first protocol may be a service interface protocol or an application programming interface (application programming interface);
  • the second protocol may be a NAS protocol or other non-access layer protocols.
  • the access network device exchanges messages with the terminal.
  • the access network device may learn the content of the operation instruction, and perform a corresponding operation according to the learned content of the operation instruction. For example, the access network device exchanges messages with the terminal to perform an inventory operation, a read operation, or a write operation.
  • the access network device forwards the operation instruction to the terminal, and exchanges messages with the terminal.
  • the terminal judges its own registration state.
  • Step 805 is optional, but not necessary.
  • the terminal can determine its own registration status. If the terminal is not registered, step 805 to step 816 may be performed; if the terminal is registered, step 817 may be performed. If the terminal does not have the ability to judge its own registration status, or does not have the ability to record the registration status, the terminal needs to perform step 806 .
  • the terminal sends a registration request message to the access network device.
  • the application identifier of the terminal may be included in the registration request message (for example, registration request).
  • the registration request message may further include one or more of a terminal identifier, an encrypted terminal identifier, a random number, a message authentication code (message authentication code, MAC), a verification value, and a token.
  • the registration request message may include multiple random numbers and message authentication codes.
  • the terminal identifier can be understood as an identifier for uniquely identifying a terminal (or uniquely identifying an object or device as a terminal).
  • the encrypted terminal ID can be understood as an encrypted terminal ID.
  • one possible form of the terminal is a tag
  • a tag identifier TID
  • an encrypted tag identifier CEID
  • CTID closed tag identifier
  • the terminal uses a pre-configured key (or called a pre-configured key) to encrypt the terminal identifier to obtain the encrypted terminal identifier.
  • an encrypted terminal identifier may be written into the terminal.
  • the operation requester can pre-generate an encrypted terminal identifier, and write it into the terminal (such as a label) when printing the label or after printing the label.
  • the random number and the message authentication code can be used to identify or authenticate whether the message has been tampered with during transmission, or can be used for the network to authenticate whether the terminal is a credible terminal.
  • the terminal can generate a random number, and use the security parameter to perform operations on the random number to obtain a message authentication code (also called a verification value or token).
  • a message authentication code also called a verification value or token
  • the security parameter may be a key or a hash algorithm. If it is a key, the message authentication code may be a random number encrypted with the key. If it is a hash algorithm, the message authentication code may be a value obtained after the random number is operated by the hash algorithm.
  • the random number and message authentication code can be included in the registration request message.
  • the registration request message is a NAS message (for example, NAS registration request).
  • the access network device selects an AMF supporting the P-IoT.
  • Step 807 is optional.
  • the access network device may directly send the registration request message from the terminal to any AMF without selecting an AMF supporting P-IoT.
  • the access network device sends a registration request message from the terminal to the AMF.
  • the AMF in FIG. 8 is an example of the first core network device in FIG. 6A , FIG. 6B and FIG. 7 , and receiving the registration request message by the AMF is an example of the first core network device receiving the first message from the terminal.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information.
  • step 809 is as follows: when the number of terminals accessing the network among the terminals corresponding to the operation requester is less than or equal to the number threshold, the AMF determines to allow the terminal to access the network; otherwise, the AMF determines not to allow all The terminal accesses the network. If the AMF determines that the terminal is allowed to access the network, execute step 810; if the AMF determines that the terminal is not allowed to access the network, execute step 816, that is, send a registration rejection message to the terminal. AMF can count and record the number of terminals connected to the network belonging to the same operation requester.
  • the AMF updates the number of terminals used by the operation requester to which the one or more terminals belong.
  • the AMF may determine whether the number of terminals that the operation requests to access the network exceeds the number threshold according to the statistics of the number of terminals that the operation requester accesses the network.
  • the AMF after the AMF determines that the terminal is allowed to access the network according to the quantity information, it can learn that it is necessary to select an AUSF that supports P-IoT according to the application identifier of the terminal in the registration request message; then, send an authentication message to the AUSF request message.
  • the application identifier of the terminal is different from the identifier of a third-generation partnership (3rd Generation Partnership Project, 3GPP) terminal, such as a subscription concealed identifier (SUCI), a permanent subscriber identifier (subscription permanent identifier, SUPI), 5G globally unique temporary identity (5G-GUTI), temporary mobile subscriber identity (TMSI), etc.
  • 3GPP third-generation partnership
  • AMF learns that the terminal is a passive IoT terminal or To be a P-IoT terminal, you need to select an AUSF that supports P-IoT. In a possible implementation manner, the AMF may not select an AUSF supporting P-IoT, but sends the first authentication request message to any AUSF.
  • the AMF sends a first authentication request message to the AUSF.
  • the first authentication request message (for example, Nausf_UEAuthentication_Authenticate Request) may include the application identifier of the terminal.
  • a possible implementation of step 810 is as follows: AMF selects an AUSF supporting P-IoT, and sends a first authentication request message to the selected AUSF.
  • Another possible implementation of step 810 is as follows: AMF sends a first authentication request message to any AUSF. If the registration request message sent by the terminal contains one or more of the terminal identifier, encrypted terminal identifier, random number, and message authentication code, the first authentication request message sent by the AMF to the AUSF may include the terminal identifier, encrypted One or more of terminal ID, random number, and message authentication code.
  • the AMF sends indication information 1 (such as P-IoT indication information) to the AUSF, which is used to indicate that the authentication corresponding to the first authentication request message is the authentication applied to the passive Internet of Things, or For authentication of passive IoT terminals.
  • the first authentication request message may include indication information 1, and the indication information 1 indicates that the first authentication request message is used to perform authentication applied to the passive Internet of Things or to authenticate the passive Internet of Things terminal authentication.
  • the AMF sends indication information 1 to the AUSF through a message other than the first authentication request message, and the indication information 1 indicates that the authentication corresponding to the first authentication request message is the authentication applied to the passive Internet of Things, Or it is used for authentication of passive IoT terminals.
  • the indication information 1 is used to indicate that the authentication process is one of one-way authentication, two-way authentication, authentication of the terminal to the network or operation requester, or authentication of the network or operation requester to the terminal or more.
  • the AUSF selects the UDM that supports P-IoT.
  • the AUSF learns that it needs to select the UDM supporting P-IoT according to the indication information 1 sent by the AMF or according to the application identifier of the terminal.
  • the application identifier of the terminal is different from the identifier of the 3GPP terminal, such as SUCI, SUPI, 5G-GUTI, TMSI, etc., and the AUSF learns that the terminal is a passive IoT terminal or a P-IoT terminal according to the application identifier of the terminal.
  • the terminal you need to select a UDM that supports P-IOT.
  • the first authentication request message includes indication information 1 indicating that the AUSF selects the UDM supporting the P-IoT, and the AUSF selects the UDM supporting the P-IoT according to the indication information 1 .
  • Step 811 is optional.
  • the AUSF may not select a UDM, but directly send the second authentication request message to any UDM.
  • the AUSF sends a second authentication request message to the UDM.
  • the second authentication request message may include the application identifier of the terminal. If the first authentication request message sent by AMF to AUSF includes one or more of terminal identification, encrypted terminal identification, random number, and message authentication code, the second authentication request message sent by AUSF to UDM may include One or more of terminal ID, encrypted terminal ID, random number, and message authentication code.
  • the second authentication request message sent by the AUSF to the UDM includes indication information 2 (such as P-IoT indication information), and the indication information 2 is used to indicate that the authentication corresponding to the second authentication request message is Applied to the authentication of the passive Internet of Things, or for the authentication of the terminals of the passive Internet of Things.
  • the indication information 2 is used to indicate that the authentication process is one of one-way authentication, two-way authentication, authentication of the terminal to the network or operation requester, or authentication of the network or operation requester to the terminal or more.
  • the UDM authenticates the terminal according to the second authentication request message.
  • the second authentication request message includes the terminal's application identifier, a random number, and a message authentication code; the UDM can retrieve the security parameters according to the terminal's application identifier, and verify the message authentication code according to the security parameters and the random number. code; if they match, it can be considered that the terminal has passed the authentication (or the terminal can be considered as a trusted terminal); if not, it can be considered that the terminal has not passed the authentication (or it can be considered that the terminal is not a trusted terminal).
  • the security parameter can be a key or a hash algorithm. If it is a key, the message authentication code may be a random number encrypted with the key.
  • the message authentication code may be a value obtained after the random number is operated by the hash algorithm.
  • the UDM marks the application ID as used; if the message authentication code in the second authentication request message passes the verification and the terminal's application ID is not marked as used, then It is considered that the application identification of the terminal is authenticated.
  • the UDM may select a terminal authentication method according to the instruction information 2 sent by the AUSF to the UDM (that is, select an authentication method suitable for the passive Internet of Things or the terminal of the passive Internet of Things).
  • the UDM may record the correspondence between the terminal's application identifier and the terminal identifier. If the second authentication request message sent by the AUSF to the UDM includes the encrypted terminal identifier, the UDM may decrypt the encrypted terminal identifier to obtain the terminal identifier. The UDM may record the correspondence between the terminal application identifier and the terminal identifier, or record the correspondence between the terminal application identifier and the encrypted terminal identifier, or record the correspondence between the terminal application identifier, the encrypted terminal identifier, and the terminal identifier. The UDM can count the number of used terminals according to the recorded terminal application identifiers or corresponding relationships.
  • the second authentication request message includes the terminal application ID 1 and the terminal ID 1; if the UDM has recorded the corresponding relationship between the terminal application ID 1 and the terminal ID 2, it is determined that the terminal does not pass the authentication, and the statistical operation requester The number of terminals used remains the same.
  • the UDM has recorded the corresponding relationship between the terminal application ID 1 and the terminal ID 2, indicating that the terminal application ID 1 has been used by other terminals, that is, the terminal application ID 1 has been stolen. It can be seen that the UDM can determine whether the terminal application identifier is used by multiple terminals according to the recorded correspondence between the terminal application identifier and the terminal identifier (or encrypted terminal identifier).
  • the UDM determines that the terminal does not pass the authentication when the terminal application identifier has been used by other terminals. That is to say, if the application identifier of the terminal is stolen, it is determined that the terminal does not pass the authentication.
  • the second authentication request message includes the terminal application ID 1 and the terminal ID 1; if the UDM has recorded the terminal application ID 1, it is determined that the terminal does not pass the authentication, and the counted number of terminals used by the operation requester remains constant. In this example, the UDM has recorded the terminal application identifier 1, indicating that the terminal application identifier 1 has been used by other terminals, that is, the terminal application identifier 1 has been stolen.
  • the second authentication request message includes the terminal application ID 1 and the terminal ID 1; if the UDM does not record the corresponding relationship between the terminal application ID 1 and other terminal IDs and does not record the terminal application ID 1, then the UDM records the terminal Apply the corresponding relationship between ID 1 and terminal ID 1, and add one to the number of terminals used by the operation requester. In this example, UDM does not record the corresponding relationship between terminal application ID 1 and other terminal IDs and does not record terminal application ID 1, indicating that Terminal Application ID 1 is not used. The UDM can count the number of used terminals according to the recorded terminal application identifiers or corresponding relationships.
  • the UDM sends a first authentication response message to the AUSF.
  • the first authentication response message (for example, Nudm_UEAuthentication_Get Response) may include an authentication result, for example, the authentication result may include authentication passing or authentication failing. Passing the authentication means that the terminal passes the authentication. Failure to pass the authentication means that the terminal fails to pass the authentication.
  • the first authentication response message sent by the UDM to the AUSF may include The generated random number and MAC value (or check value or token).
  • the MAC value may be the MAC value (or check value or token) generated by the UDM according to the security parameters corresponding to the terminal and the random number; or, the MAC value may be the random number sent by the UDM according to the terminal and the random number generated by the UDM
  • the security parameter corresponding to the terminal generates a MAC value (or check value or token).
  • the MAC value (or check value or token) is sent to the terminal through the core network.
  • the terminal analyzes the random number according to the pre-configured security parameters and MAC value (or check value or token), and verifies whether the network is a trusted network according to the analyzed random number. For example, when the analyzed random number includes the random number generated by the terminal, the network is a trusted network.
  • the AUSF sends a second authentication response message to the AMF.
  • the second authentication response message (for example, Nausf_UEAuthentication_Authenticate Response may include the authentication result, for example, the authentication result may include whether the authentication is passed or the authentication is not passed.
  • the authentication result included in the second authentication response message is the same as that included in the first authentication response message. The authentication results are the same.
  • the AMF sends a registration acceptance message or a registration rejection message to the terminal.
  • the AMF sends a registration acceptance message (for example, registration accept) to the terminal; if the terminal fails the authentication, the AMF sends a registration rejection message (for example, registration reject) to the terminal.
  • the registration acceptance message or the registration rejection message may be a NAS message (such as NAS Registration Accept or NAS Registration Reject). If the terminal has the ability to record the registration state, after receiving the registration acceptance message, the terminal can record that it has been registered, so that the terminal can judge its own registration state. That is to say, the terminal is in the unregistered state before receiving the registration acceptance message, indicating that it is not registered; after receiving the registration acceptance message, the terminal is adjusted from the unregistered state to the registered state, indicating that it is registered.
  • the terminal sends a NAS message to the AMF.
  • the terminal After the terminal is successfully registered, if the terminal needs to send information (such as the terminal's application ID) to the operation requester (P-IoT AF or P-IoT server), and the information sent by the terminal is sent to the P-IoT AF through the control plane channel , it can be sent to the AMF through the NAS message, and the AMF sends it to the P-IoT AF (or the AMF sends it to the P-IoT AF through the NEF), as shown in Figure 8.
  • information such as the terminal's application ID
  • the AMF needs to exchange security parameters with the terminal to execute the NAS security mechanism.
  • the information sent by the terminal is sent to the P-IoT server through the user plane channel, it can be sent to the access network device through the RRC message, and the access network device sends the information to the P-IoT server through the user plane channel.
  • Send by the P-IoT server for example, the access network device sends to the P-IoT server through the UPF network element.
  • the AMF sends the data from the terminal to the operation requester through the NEF.
  • the AMF can send the data from the terminal to the P-IoT AF through the NEF.
  • the data of the terminal may include the application identifier of the terminal and information stored in the storage area of the terminal.
  • Step 818 may be replaced by: the AMF sends the data from the terminal to the operation requester through the NEF. If the terminal sends information to the P-IoT server through the user plane channel, the terminal can send the information to the access network device through the RRC message, and the access network device will The user channel is sent to the P-IoT server.
  • the operation request sends invalidation information to the UDM.
  • the failure information indicates one or more failed terminals. If one or more terminals (such as tags) of the operation requester are invalid and need to be replaced, the operation requester can send the terminal identification (or encrypted terminal identification) of the invalid terminal to UDM (via NEF).
  • the invalidation information may contain terminal identifications (or encrypted terminal identifications) of one or more invalidated terminals.
  • the UDM updates or deletes the identification information of the invalid terminal.
  • the identification information of the invalid terminal may include one or more of the following information: the application identification of the invalid terminal, the network identification, the terminal identification, the encrypted terminal identification, and the second corresponding relationship, the second corresponding relationship includes the application of the invalid terminal.
  • the corresponding relationship between two or more of the identifiers, network identifiers, terminal identifiers, and encrypted terminal identifiers may include one or more of the following information: the application identification of the invalid terminal, the network identification, the terminal identification, the encrypted terminal identification, and the second corresponding relationship, the second corresponding relationship includes the application of the invalid terminal.
  • step 820 A possible implementation manner of step 820 is as follows: the UDM updates or deletes the identification information of the invalid terminal according to the invalidation information. For example, if the invalidation information indicates that Terminal 1 and Terminal 5 are invalid, the UDM deletes the application ID, network ID, terminal ID, and encrypted terminal ID of Terminal 1, or deletes or updates the application ID, network ID, terminal ID, Correspondence between two or more encrypted terminal identities and deletion of terminal 5's application identities, network identities, terminal identities, and encrypted terminal identities, or deleting or updating terminal 5's application identities, network identities, and terminal identities , the correspondence between two or more encrypted terminal identifiers.
  • steps 806 to 816 are steps for the terminal to register or access a network (such as a core network).
  • steps 813 and 814 performed by UDM can be implemented by AMF, and steps 810 to 815 can be replaced by: AMF retrieves the security parameters according to the application identification of the terminal, and verifies the message authentication according to the security parameters and random numbers code; if they match, it can be considered that the terminal has passed the authentication (or the terminal can be considered as a trusted terminal); if not, it can be considered that the terminal has not passed the authentication (or it can be considered that the terminal is not a trusted terminal). If the AMF believes that the terminal has passed the authentication, it sends a registration acceptance message to the terminal; if the AMF believes that the terminal has not passed the authentication, it sends a registration rejection message to the terminal.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information. If the AMF determines that the terminal is not allowed to access the network according to the quantity information, it does not need to send a message for requesting the terminal to perform an authentication process, which can reduce signaling overhead.
  • the UDM before the terminal registers to the network through the operator, the UDM obtains the application identification of the terminal, and uses the application identification of the terminal to authenticate the terminal. By counting the number of terminals, it is possible to prevent the application identifier of one terminal from being used by multiple terminals, which is beneficial to label management and billing of the network.
  • the terminal application identifier is used for access management. If the terminal needs to be authenticated, it is also possible to write or configure security parameters for the terminal when printing the label or after printing the label or when initializing the label, so that when the terminal registers with the network, it sends information for authentication to the network (such as a random number and message authentication code). At the same time, it can also prevent the application identifier of one terminal from being used by multiple terminals according to the terminal identifier, which is beneficial for the operator to manage and charge the terminal.
  • FIG. 9 is an interactive flowchart of another terminal management method provided by the embodiment of the present application.
  • FIG. 9 is illustrated by taking the reader as an access network device as an example, and this method is also applicable to a scenario where the reader is a terminal device (such as a UE). As shown in Figure 9, the method includes:
  • the operation requester obtains the application identifier of the terminal, and the AMF obtains quantity information and/or identification information.
  • a possible implementation manner of step 901 is as follows: the BOSS system of the operation requester and the operator assigns the application identifier of the terminal according to the first manner.
  • the UDM in FIG. 9 is an example of the second core network device in FIG. 4 , and the UDM in FIG. 9 may be replaced by a UDR or other core network elements. Referring to the first method in FIG. 4, it can be seen that the application identifier of the terminal is allocated according to the first method. identification, the operation requester can obtain the application identification of the terminal, but the second core network device (corresponding to UDM in FIG. 9 ) does not obtain the application identification of the terminal. In the method embodiment in FIG.
  • the operator does not pre-configure the application identifier of the terminal, and the operation requester allocates the application identifier of the terminal.
  • the UDM, the operation requester, and the operator's BOSS system execute the method flow in mode 1, so that the UDM can configure the number of allocated numbers, and the operation requester can obtain the application identifier of the terminal, and the first core network
  • the device (AMF in FIG. 9) may obtain quantity information and/or identification information.
  • the terminal is initialized.
  • Step 901 and step 902 are optional. Step 901 and step 902 may be operations completed before performing subsequent steps.
  • the operation request sends an operation instruction to the access network device.
  • step 903 refer to step 803.
  • the access network device exchanges messages with the terminal.
  • step 904 refer to step 804.
  • the terminal judges its own registration state.
  • step 905 refer to step 805.
  • the terminal sends a registration request message to the access network device.
  • step 906 refer to step 806.
  • the access network device may select an AMF supporting P-IoT.
  • step 907 refer to step 807.
  • the access network device sends a registration request message from the terminal to the AMF.
  • step 908 refer to step 808.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information.
  • step 909 refer to step 809. If the AMF determines that the terminal is allowed to access the network, perform step 910; if the AMF determines that the terminal is not allowed to access the network, then perform step 916, that is, send a registration rejection message to the terminal.
  • the AMF sends a first authentication request message to the AUSF.
  • Step 910 can refer to step 810 .
  • the difference between step 910 and step 810 is that the application identifier of the terminal is not included in the first authentication request message.
  • the first authentication request message may include a terminal identifier (or an encrypted terminal identifier).
  • the first authentication request message includes one or more of a terminal identifier, an encrypted terminal identifier, a random number, and a message authentication code.
  • AUSF selects UDM that supports P-IoT.
  • step 911 refer to step 811.
  • the AUSF sends a second authentication request message to the UDM.
  • Step 912 can refer to step 812 .
  • the second authentication request message (for example, Nudm_UEAuthentication GetRequest) may include a terminal identifier (TID) or an encrypted terminal identifier (CTID).
  • TID terminal identifier
  • CID encrypted terminal identifier
  • the difference between step 912 and step 812 is that the application identifier of the terminal is not included in the second authentication request message.
  • the second authentication request message sent by AUSF to UDM may include One or more of terminal ID, encrypted terminal ID, random number, and message authentication code.
  • the UDM authenticates the terminal according to the second authentication request message.
  • Step 913 can refer to step 813 .
  • the second authentication request message includes the terminal identifier (or encrypted terminal identifier) of the terminal ID), random number and message authentication code;
  • UDM can retrieve the security parameters according to the terminal ID of the terminal or the plaintext part of the encrypted terminal ID, and verify the message authentication code according to the security parameters and random numbers; if they are consistent, the terminal can be considered as passed authentication (or consider the terminal to be a credible terminal); if inconsistent, it may be considered that the terminal has not passed the authentication (or the terminal is not considered to be a credible terminal).
  • the UDM sends a first authentication response message to the AUSF.
  • Step 914 can refer to step 814 .
  • the AUSF sends a second authentication response message to the AMF.
  • Step 915 may refer to step 815 .
  • the AMF sends a registration acceptance message or a registration rejection message to the terminal.
  • Step 916 can refer to step 816 .
  • the terminal sends a NAS message to the AMF.
  • step 917 refer to step 817.
  • the AMF sends the data from the terminal to the operation requester through the NEF.
  • step 918 refer to step 818.
  • the operation request sends invalidation information to the UDM.
  • step 919 refer to step 819.
  • the UDM updates or deletes the identification information of the invalid terminal.
  • Step 920 can refer to step 820 .
  • steps 913 and 914 performed by UDM can be implemented by AMF, and steps 910 to 915 can be replaced by: AMF retrieves security parameters according to the terminal ID of the terminal or the plaintext part of the encrypted terminal ID, and Verify the message authentication code according to the security parameter and the random number; if they are consistent, it can be considered that the terminal has passed the authentication (or the terminal is considered to be a trusted terminal); terminal). If the AMF considers that the terminal has passed the authentication, it sends a registration acceptance message to the terminal; if the AMF believes that the terminal does not pass the authentication, it sends a registration rejection message to the terminal.
  • the UDM performs access management and authentication on the terminal without obtaining the application identifier of the terminal. Compared with the method flow in FIG. 8 , it can meet the privacy and security requirements of enterprises, users, or operation requesters, that is, the network does not obtain the application identification of the terminal. Similarly, according to the terminal ID, the network (that is, the UDM) can count the number of used terminals and prevent the theft of terminal IDs.
  • the UDM uses the terminal identifier to perform access management. If the terminal needs to be authenticated, it is also possible to write security parameters into the terminal when printing the label or after printing the label, so that when the terminal registers with the network, it sends authentication information (such as random numbers and message authentication codes) to the network. At the same time, it can also prevent one terminal identifier from being used by multiple terminals according to the terminal identifier, which is beneficial for the operator to manage and charge the terminal.
  • FIG. 10 is an interactive flowchart of another terminal management method provided in the embodiment of the present application.
  • FIG. 10 is illustrated by taking the reader as an access network device as an example, and this method is also applicable to a scenario where the reader is a terminal device (such as a UE). As shown in Figure 10, the method includes:
  • the operation requester acquires the application identifier of the terminal, and the UDM acquires the network identifier of the terminal.
  • step 1001 is as follows: the BOSS system of the operation requester, UDM (or UDR), and operator assigns the terminal's application identifier and network identifier according to the second manner.
  • the terminal's application ID and network ID are allocated, the operation requester can obtain the terminal's application ID, and the second core network device can obtain the terminal's network ID.
  • the UDM in Figure 10 is an example of the second core network device in Figure 4, and the UDM in Figure 10 It can be replaced by a UDR or other core network elements.
  • the AMF in FIG. 10 is an example of the first core network device in FIG. 4 . In the method embodiment in FIG.
  • the operator does not pre-configure the application identifier of the terminal, and the operation requester allocates the application identifier of the terminal.
  • the second core network device such as UDM or UDR
  • the first core network device such as AMF
  • the operator's BOSS system executes the method flow in the second mode, so that the second The core network device can obtain the network identifier of the terminal, the operation requester can obtain the application identifier of the terminal, and the first core network device (AMF in FIG. 10 ) can obtain quantity information and/or identification information.
  • the terminal is initialized.
  • Step 1001 and step 1002 are optional. Step 1001 and step 1002 may be operations completed before subsequent steps are performed.
  • the operation request sends an operation instruction to the access network device.
  • step 1003 refer to step 803.
  • the access network device exchanges messages with the terminal.
  • step 100 refer to step 804.
  • the terminal judges its own registration state.
  • step 1005 refer to step 805.
  • the terminal sends a registration request message to the access network device.
  • the registration request message may include the network identification of the terminal.
  • the registration request message may further include one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code.
  • the network identifier of the terminal is an identifier assigned to the terminal by the operator for implementing access management or authentication.
  • the access network device selects an AMF supporting P-IoT.
  • step 1007 refer to step 807.
  • the access network device sends a registration request message from the terminal to the AMF.
  • step 1008 refer to step 808.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information.
  • step 1009 refer to step 809. If the AMF determines that the terminal is allowed to access the network, execute step 1010; if the AMF determines that the terminal is not allowed to access the network, execute step 1016, that is, send a registration rejection message to the terminal.
  • the AMF sends a first authentication request message to the AUSF.
  • step 1010 refer to step 810.
  • the first authentication request message (for example, Nausf_UEAuthentication_Authenticate Request) may include the network identifier of the terminal.
  • a difference between step 1010 and step 810 is that the first authentication request message includes the network identifier of the terminal.
  • the AUSF selects the UDM supporting the P-IoT.
  • step 1011 refer to step 811.
  • the AUSF sends a second authentication request message to the UDM.
  • the second authentication request message (for example, Nudm_UEAuthentication GetRequest) may include the network identifier of the terminal.
  • the difference between step 1012 and step 812 is that the second authentication request message includes the network identifier of the terminal. If the first authentication request message sent by AMF to AUSF includes one or more of the terminal's network ID, terminal ID, encrypted terminal ID, random number, and message authentication code, the second authentication message sent by AUSF to UDM
  • the request message may include one or more of the terminal's network identifier, terminal identifier, encrypted terminal identifier, random number, and message authentication code.
  • the UDM authenticates the terminal according to the second authentication request message.
  • step 1013 refer to step 813.
  • the UDM authenticates or authorizes the terminal in different ways.
  • the second authentication request message includes the terminal's network identifier, a random number, and a message authentication code; the UDM can retrieve security parameters according to the terminal's network identifier, and verify the message authentication code based on the security parameters and the random number. code; if they match, it can be considered that the terminal has passed the authentication (or the terminal can be considered as a trusted terminal); if not, it can be considered that the terminal has not passed the authentication (or it can be considered that the terminal is not a trusted terminal).
  • the UDM may record the corresponding relationship.
  • the corresponding relationship includes the corresponding relationship between two or more of the terminal network identifier, the terminal application identifier, the terminal identifier and the encrypted terminal identifier.
  • the UDM may decrypt the encrypted terminal identifier to obtain the terminal identifier. The UDM can count the number of terminals used by the operation requester according to the corresponding relationship.
  • step 1013 UDM retrieves the security parameters according to the terminal network identifier in the second authentication request message, and verifies the message authentication code according to the security parameters and the random number; if the verification is passed, record the terminal network identifier, and Count the number of terminals used by the operation requester.
  • the second authentication request message includes the terminal network identifier 1 of terminal 1, and UDM checks whether the terminal network identifier 1 is recorded after terminal 1 passes the verification; if the terminal network identifier 1 is not recorded, the operation Add one to the number of terminals used by the requester; if the terminal application ID 1 is recorded, keep the number of terminals used by the requester unchanged.
  • step 1013 Another possible implementation of step 1013 is as follows: UDM retrieves security parameters according to the terminal network identifier in the second authentication request message, and verifies the message authentication code according to the security parameters and random numbers; if the verification is passed, UDM can record the terminal The corresponding relationship between the network identifier and the terminal network identifier, the corresponding relationship includes the corresponding relationship between the terminal network identifier and one or more of encrypted terminal identifiers, terminal identifiers, and terminal application identifiers. The UDM can count the number of terminals used by the operation requester according to the corresponding relationship.
  • the second authentication request message includes the terminal network identifier 1 of the terminal 1, and the UDM checks whether the corresponding relationship between the terminal network identifier 1 and the terminal network identifier 1 is recorded after the terminal 1 passes the verification; If the terminal network ID is 1 and the corresponding relationship of the terminal network ID 1 is not recorded, the number of terminals used by the operation requester will be increased by one; if the terminal application ID 1 or the corresponding relationship of the terminal application ID 1 is recorded, the operation requester will be kept The number of terminals used is unchanged.
  • the UDM sends a first authentication response message to the AUSF.
  • step 1014 refer to step 814.
  • the AUSF sends a second authentication response message to the AMF.
  • Step 1015 may refer to step 815 .
  • the AMF sends a registration acceptance message or a registration rejection message to the terminal.
  • step 1016 refer to step 816.
  • the terminal sends a NAS message to the AMF.
  • step 1017 refer to step 817.
  • the AMF sends the data from the terminal to the operation requester through the NEF.
  • step 1018 refer to step 818.
  • the operation request sends invalidation information to the UDM.
  • step 1019 refer to step 819.
  • the UDM updates or deletes the identification information of the invalid terminal.
  • Step 1020 can refer to step 820 .
  • steps 1013 and 1014 performed by UDM can be implemented by AMF, and step 1010 Up to step 1015 can be replaced by: AMF retrieves security parameters according to the network identification of the terminal, and verifies the message authentication code according to the security parameters and the random number; if they are consistent, the terminal can be considered as passed the authentication (or the terminal is considered as a credible terminal); if If they are inconsistent, it can be considered that the terminal does not pass the authentication (or the terminal is considered not to be a trusted terminal). If the AMF considers that the terminal has passed the authentication, it sends a registration acceptance message to the terminal; if the AMF believes that the terminal does not pass the authentication, it sends a registration rejection message to the terminal.
  • the core network can perform access management and authentication on the terminal without obtaining the application identifier of the terminal.
  • it can meet the privacy and security requirements of the enterprise, that is, the network does not obtain the application identifier of the terminal.
  • the network uses the terminal's network identifier to perform access management and authentication on the terminal. This mechanism can meet the requirements of the enterprise not to report data to the network (for example, the enterprise does not report the application identification and terminal identification of the terminal).
  • the network can count the number of used terminals and prevent terminal ID theft.
  • FIG. 11 is an interactive flowchart of another terminal management method provided in the embodiment of the present application.
  • FIG. 11 is illustrated by taking the reader as an access network device as an example, and this method is also applicable to a scenario where the reader is a terminal device (such as a UE). As shown in Figure 11, the method includes:
  • the operation requester obtains the application identifier of the terminal, and the UDM configures the number of allocated numbers.
  • step 1001 is as follows: the operation requester, the second core network device (such as UDM or UDR), the first core network device (AMF in FIG. 11 ), and the operator's BOSS system execute the method flow of the first mode .
  • the operation requester can obtain the application identifier of the terminal, the second core network device can configure the number of allocated numbers, and the first core network device (AMF in Figure 8) can Get quantity information and/or identification information.
  • the UDM in Figure 11 is an example of the second core network equipment in Figure 4, the UDM in Figure 11 can be replaced by UDR or other core network elements, and the AMF in Figure 11 is the first core network in Figure 4 An example of a device.
  • the operator does not pre-configure the application identifier of the terminal, and the operation requester allocates the application identifier of the terminal.
  • the terminal is initialized.
  • Step 1101 and step 1102 are optional. Step 1101 and step 1102 may be operations completed before performing subsequent steps.
  • the AMF sends a first instruction to the access network device.
  • the first instruction (may be referred to as an online subscription instruction) is used to execute online subscription or is used to trigger the terminal to execute online subscription. Alternatively, the first instruction instructs the terminal to execute online subscription.
  • the access network device receives and exchanges messages with the terminal.
  • the access network device learns that the first instruction is an online subscription instruction, and the access network device exchanges messages with the terminal according to the first instruction, for example, notifies or triggers the terminal to perform online subscription.
  • the access network device forwards the first instruction to the terminal, and the access network device exchanges messages with the terminal to notify or trigger the terminal to perform online subscription.
  • the terminal judges the subscription status.
  • the terminal after the terminal receives the first instruction forwarded by the access network device, it can judge its own subscription status; if the terminal is in an unsubscribed state or has not obtained subscription data, the terminal performs step 1106; if the terminal If the subscription data has been obtained or the terminal is in a subscribed state, step 1106 to step 1116 may be skipped.
  • the subscription data may include identification information and/or authentication information of the terminal.
  • the identification information may include a terminal network identification. After the terminal acquires the identification information and/or authentication information allocated by the core network device (eg, UDM), the terminal adjusts from the unsubscribed state to the subscribed state.
  • the terminal before the terminal obtains the identification information and/or authentication information assigned by the core network device (such as UDM), the terminal does not obtain the subscription data; the terminal obtains the identification information and/or authentication information assigned by the core network device (such as UDM) After the information, the terminal obtains the subscription data.
  • the core network device such as UDM
  • the terminal can determine its own subscription status after learning that online subscription needs to be performed through the exchange of messages with the access network device; ; If the terminal has obtained the subscription data or the terminal is in the state of signing, step 1106 to step 1116 can be skipped.
  • Step 1105 is optional.
  • the terminal may not perform step 1105, but directly perform step 1106 after performing step 1104.
  • the terminal sends a first request message to the access network device.
  • the first request message (for example, it may be an online subscription request message or a registration request message, but the registration request message is used to instruct the registration network to perform online subscription), and the first request message is used to request to perform online subscription.
  • the first request message may include an enterprise identifier (or an operation requester identifier or a user identifier), a network identifier of a terminal that is an empty set (that is, an empty terminal network identifier), a random number, a message One or more of the authentication codes.
  • the message authentication code may be a value obtained by encrypting a random number or performing a hash algorithm.
  • the network may allocate network identifiers according to the enterprise identifiers (or user identifiers or operation requestor identifiers) sent by the terminal.
  • the terminal may not send the enterprise ID (or user ID or operation requester ID).
  • the first request message sent by the terminal includes a random number and a message authentication code; the network may assign a network identifier of the terminal to the terminal after the terminal passes the authentication.
  • the access network device selects the AMF that supports P-IoT.
  • the access network device can choose an AMF that supports P-IoT online subscription.
  • the AMF that supports P-IoT online subscription has the function of performing the operations performed by the AMF in Figure 11.
  • the access network device selects an AMF supporting P-IoT.
  • the access network device can choose an AMF that supports P-IoT online subscription.
  • the AMF that supports P-IoT online subscription has the function of performing the operations performed by the AMF in Figure 11.
  • the access network device sends the first request message from the terminal to the AMF.
  • the first request message may include one or more of an enterprise identifier (or a user identifier or an operation requester identifier), an empty terminal network identifier, a random number, and a message authentication code.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information.
  • step 1110 If the AMF determines that the terminal is allowed to access the network, perform step 1110; if the AMF determines that the terminal is not allowed to access the network, then perform step 1116, that is, send a registration rejection message to the terminal.
  • the AMF sends a second request message to the AUSF.
  • the second request message (for example, an authentication message, Nausf_UEAuthentication_Authenticate Request) is used to request the core network device (for example, UDM) to perform online subscription.
  • the first request message sent by the terminal includes one or more of the enterprise identifier (or user identifier or operation requester identifier), empty terminal network identifier, random number, and message authentication code
  • the second request sent by the AMF to the AUSF may include one or more of an enterprise identifier (or a user identifier or an operation requester identifier), an empty terminal network identifier, a random number, and a message authentication code.
  • the AMF sends indication information 3 (such as P-IoT indication information) to the AUSF to indicate that it is an online subscription, or an online subscription for the passive Internet of Things, or an online subscription for the passive Internet of Things. Terminal online signing.
  • indication information 3 sent by the AMF to the AUSF may be included in the second request message or in other messages.
  • the AMF Before the AMF sends the second request message to the AUSF, it may select an AUSF that supports P-IoT (or supports P-IoT online subscription).
  • the AUSF that supports P-IoT (or supports P-IoT online subscription) has the function of performing the operations performed by the AUSF in FIG. 11 .
  • the AMF may, according to the first request message or according to the Know that you need to choose an AUSF that supports P-IoT (or supports P-IoT online signing).
  • the type of the first request message is a specific type, and the AMF can determine the need to select an AUSF that supports P-IoT (or supports P-IoT online subscription) according to the message type of the first request message; another Possible implementation, the access network device has the access network device that supports P-IoT capability, and AMF chooses to support P-IoT (or supports P-IoT online signing ) of AUSF.
  • AUSF selects UDM.
  • the AUSF selects UDM that supports P-IoT (or supports P-IoT online subscription).
  • the UDM that supports P-IoT (or supports P-IoT online subscription) has the function of performing the operations performed by the UDM in Figure 11.
  • the AUSF learns that it needs to select a UDM that supports P-IoT (or supports P-IoT online subscription) according to the indication information 3 sent by the AMF or according to the second request message.
  • the AUSF sends a third request message to the UDM.
  • the third request message (for example, an authentication request message, Nudm_UEAuthentication GetRequest) is used to request authentication or authorization of the terminal.
  • the third request message may include one or more of an enterprise identifier (or a user identifier or an operation requester identifier), an empty terminal network identifier, a random number, and a message authentication code.
  • the second request message sent by AMF to AUSF includes one or more of enterprise ID (or user ID or operation requester ID), empty terminal network ID, random number, message authentication code, AUSF sends UDM
  • the third request message sent may include one or more of an enterprise identifier (or a user identifier or an operation requester identifier), an empty terminal network identifier, a random number, and a message authentication code.
  • the AUSF sends indication information 4 (such as P-IoT indication information) to the UDM to indicate that it is an online subscription, or an online subscription for the passive Internet of Things, or an online subscription for the passive Internet of Things. Terminal online signing.
  • indication information 4 sent by the AUSF to the UDM may be included in the third request message, or may be included in other messages.
  • the UDM performs authentication according to the enterprise ID (or user ID or operation requester ID), and assigns the network ID of the terminal after the authentication is passed.
  • the UDM can also assign security parameters to the terminal, and the security parameters are used to authenticate the terminal.
  • the UDM can also record the corresponding relationship between the network identifier assigned to the terminal and the security parameter, so as to retrieve the security parameter according to the network identifier of the terminal.
  • the terminal can use the security parameters assigned by UDM to process the random number to obtain the message authentication code; the registration request message sent by the terminal can include the random number and the message authentication code; A security parameter is retrieved, and the message authentication code is verified using the security parameter.
  • the third request message includes one or more of the enterprise ID (or user ID or operation requester ID), empty terminal network ID, random number, and message authentication code, and the UDM
  • the enterprise ID retrieves the security parameters.
  • UDM verifies the message authentication code according to the retrieved security parameters and random numbers; if they are consistent, the terminal can be considered to be authenticated (or the terminal is considered to be a trusted terminal, or the terminal is considered to be from a trusted operation requester).
  • the UDM verifies the message authentication code according to the security parameter and the random number; if they are inconsistent, it can be considered that the terminal does not pass the authentication (or the terminal is considered not to be a trusted terminal).
  • the UDM can select an authentication method according to the indication information 4 sent by the AUSF to the UDM (that is, to select an authentication method suitable for online subscription, or for passive Internet of Things online subscription, or for passive IoT Online signing method for networked terminals).
  • the UDM may record the correspondence between the terminal's network identifier and the enterprise identifier (or user identifier or operation requester identifier).
  • the UDM may count the number of terminals used by the operation requester according to the network identifier of the terminal or the corresponding relationship, and the UDM may also count the number of terminals used by the operation requester during subsequent terminal registration.
  • the UDM may count the number of terminals used according to the network identifier of the terminal or the corresponding relationship, refer to step 1013 in FIG. 10 .
  • the UDM sends a first response message to the AUSF.
  • the first response message (for example, an authentication response message, Nudm_UEAuthentication_Get Response) may include an authentication result.
  • the authentication result may include, for example, passing the authentication or failing the authentication. If the authentication result included in the first response message is that the authentication is passed, the first response message may also include the network identifier and security parameters assigned by the UDM to the terminal. If the authentication result included in the first response message is authentication passed, the first response message may only include the authentication result.
  • the AUSF sends a second response message to the AMF.
  • the second response message (for example, may be an authentication response message, Nausf_UEAuthentication_Authenticate Response may include an authentication result, for example, may include authentication passing or authentication failing. If the authentication result included in the second response message is authentication passing, then the second response message It may also include the network identifier and security parameters assigned by the UDM to the terminal.
  • the AMF sends a registration acceptance message or a registration rejection message to the terminal.
  • the registration acceptance message (or called online subscription reception message, online subscription completion message) may include the network identifier assigned to the terminal.
  • the registration to receive message may also include security parameters.
  • the registration acceptance message indicates that the online subscription of the terminal is passed. In other words, the registration acceptance message instructs the terminal to complete the online subscription.
  • the registration rejection message (or called an online subscription failure message, an online subscription failure message, etc.) indicates that the online subscription of the terminal fails. In other words, the registration rejection message indicates that the online subscription of the terminal fails or is not completed.
  • the AMF sends an online subscription acceptance message, or an online subscription completion message, or a registration acceptance message (for example, registrationaccept) to the terminal.
  • the online subscription acceptance message, the online subscription completion message, and the registration acceptance message all include the network identifier assigned to the terminal.
  • the AMF sends an online subscription failure message to the terminal, or a message that the online subscription fails, or a registration rejection message (such as Registration Reject).
  • the online subscription failure message, the online subscription failure message, and the registration rejection message all indicate that the online subscription fails or the terminal fails to pass the authentication.
  • the registration acceptance message or the registration rejection message may be sent as a NAS message or included in a NAS message (such as NAS Registration Accept, NAS Onboarding Accept, NAS Onboarding complete, NAS Registration Reject, NAS Onboarding Reject, NAS Onboarding failed).
  • the operation request sends an operation instruction to the access network device.
  • step 1003 refer to step 803.
  • the operation instruction may include application identifiers of one or more terminals.
  • the operation requester may send an operation instruction to the access network device through a control plane channel or a user plane channel. In the figure, the operation requester sends an operation instruction to the access network device through the control plane channel as an example.
  • the operation requester (such as P-IoT AF) can send operation instructions to the access network device through NEF and AMF, or the operation requester can send operation instructions to the access network device through AMF. If it is sent through the user plane channel, the operation requester (P-IoT server) can send the operation instruction to the access network device through UPF.
  • the access network device exchanges messages with the terminal.
  • step 1118 refer to step 804.
  • the terminal judges its own registration status.
  • step 1119 refer to step 805 .
  • the terminal sends a registration request message to the AMF.
  • the registration request message may include the network identification of the terminal.
  • the registration request message may further include one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code.
  • the network identifier of the terminal is an identifier assigned by the operator to the terminal for access management or authentication.
  • Step 1120 may be replaced by: the terminal sends a registration request message to the AMF through the access network device.
  • the registration request message is a NAS message (such as NAS Registration Request); the terminal sends the registration request message to the access network device, and the access network device may select an AMF supporting P-IoT, and send the selected The AMF sent from The terminal's registration request message.
  • the AMF sends a first authentication request message to the AUSF.
  • Step 1121 can refer to step 810 .
  • the first authentication request message (for example, Nausf_UEAuthentication_Authenticate Request) may include the network identifier of the terminal.
  • the first authentication request message is used to request authentication or authorization of the terminal. If the registration request message sent by the terminal includes one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code, the first authentication request message sent by the AMF to the AUSF It may include one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code.
  • the AMF sends indication information 1 (for example, P-IoT indication information) to the AUSF, which is used to indicate that the authentication is the authentication of the passive Internet of Things, or the authentication of the terminal of the passive Internet of Things.
  • indication information 1 for example, P-IoT indication information
  • the AMF selects the AUSF that supports P-IoT.
  • the AMF may know the need to select an AUSF supporting P-IoT according to the network identifier of the terminal in the registration request message or according to the indication information 1 .
  • the terminal's network identifier is different from the 3GPP terminal's identifier such as SUCI, SUPI, 5G-GUTI, TMSI, etc., and the AMF learns that the terminal is a passive IoT terminal or a P-IoT terminal based on the terminal's application identifier. For terminals, you need to select AUSF that supports P-IOT.
  • the AUSF sends a second authentication request message to the UDM.
  • Step 1122 can refer to step 812 .
  • the second authentication request message (for example, Nausf_UEAuthentication_Authenticate Request) may include the network identifier of the terminal.
  • the second authentication request message is used to request authentication or authorization of the terminal. If the first authentication request message sent by the AMF to the AUSF includes one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code, the second authentication request message sent by the AUSF to the UDM
  • the authentication request message may include one or more of the terminal's application identifier, terminal identifier (or encrypted terminal identifier), random number, and message authentication code.
  • the AMF sends indication information 2 (such as P-IoT indication information) to the AUSF to indicate that the authentication is the authentication applied to the passive Internet of Things, or the authentication of the passive Internet of Things terminal .
  • indication information 2 is used to indicate that the authentication process is one of one-way authentication, two-way authentication, authentication of the terminal to the network or operation requester, or authentication of the network or operation requester to the terminal or more.
  • AUSF selects UDM that supports P-IoT.
  • the AUSF learns that it needs to select the UDM supporting the P-IoT according to the indication information sent by the AMF or according to the network identifier of the terminal.
  • the UDM authenticates the terminal according to the second authentication request message.
  • step 1123 refer to step 1013.
  • the UDM sends a first authentication response message to the AUSF.
  • step 1124 refer to step 814.
  • the AUSF sends a second authentication response message to the AMF.
  • Step 1125 may refer to step 815 .
  • the AMF sends a registration acceptance message or a registration rejection message to the terminal.
  • Step 1126 can refer to step 816 .
  • the terminal sends a NAS message to the AMF.
  • step 1127 refer to step 817.
  • the AMF sends the data from the terminal to the operation requester through the NEF.
  • Step 1128 can refer to step 818 .
  • the operation request sends failure information to the UDM.
  • Step 1129 may refer to step 819 .
  • the UDM updates or deletes the identification information of the invalid terminal.
  • Step 1130 can refer to step 820 .
  • steps 1113 and 1114 performed by UDM can be implemented by AMF, and steps 1110 to 1115 can be replaced by: AMF performs authentication according to the enterprise identifier, and assigns the network identifier of the terminal after the authentication is passed. It should be understood that if the terminal passes the authentication, a registration acceptance message is sent to the terminal; otherwise, a registration rejection message is sent to the terminal.
  • steps 1101 to 1116 are the steps of executing online subscription to obtain the network identifier of the terminal
  • steps 1107 to 1130 are the steps of executing the registration flow.
  • the method flow in FIG. 11 is that the network identifier of the terminal is sent to the terminal through an online subscription process.
  • the beneficial effect is that the network identifier of the terminal does not need to be configured in the enterprise in advance, which can prevent the enterprise from using the network identifier of one terminal for multiple terminals, that is, the terminal can obtain the network identifier of the terminal in a streamlined manner, which is more secure.
  • the AMF determines whether to allow the terminal to access the network according to the quantity information.
  • the threshold If the number of terminal devices connected to the network by the terminal corresponding to the operation requester is less than or equal to the threshold, it is not necessary to assign a network identifier to the terminal (belonging to the operation requester) requesting online subscription, which can reduce unnecessary operations.
  • FIG. 12 shows a schematic structural diagram of a communication device 1200 .
  • the communication device 1200 can correspondingly implement the functions or steps implemented by the core network equipment (such as the first core network equipment and the second core network equipment in FIG. 4 and FIG. 6B ) in the above-mentioned various method embodiments, and can also implement the above-mentioned various methods. Functions or steps implemented by the operation requester in the embodiment.
  • the communication device may include a processing module 1210 and a transceiver module 1220 .
  • a storage unit may also be included, and the storage unit may be used to store instructions (code or program) and/or data.
  • the processing module 1210 and the transceiver module 1220 may be coupled to the storage unit, for example, the processing module 1210 may read instructions (code or program) and/or data in the storage unit to implement a corresponding method.
  • the processing module 1210 may read instructions (code or program) and/or data in the storage unit to implement a corresponding method.
  • Each of the above units can be set independently, or can be partially or fully integrated.
  • the transceiving module 1220 may include a sending module and a receiving module.
  • the communications apparatus 1200 can correspondingly implement the operations and functions of the first core network device in the foregoing method embodiments.
  • the communication apparatus 1200 may be a first core network device, or may be a component (such as a chip or a circuit) applied in the first core network device.
  • the transceiver module 1220 can be used to perform all the receiving or sending performed by the first core network device or the AMF in the embodiments shown in FIG. 4, FIG. 6A, FIG. 6B, FIG. 7, FIG. 8, FIG. 9, FIG. Operation, such as step 405, step 417, step 427, step 435 in the embodiment shown in FIG. 4 and step 601A, step 602A in the embodiment shown in FIG. other processes.
  • the processing module 1210 is configured to execute all operations performed by the first core network device or the AMF in the embodiments of FIG. 6A, FIG. 6B, FIG. 7, FIG. 8, FIG. 9, FIG. 10, and FIG. 11 except the transceiving operation. , for example, step 602A in the embodiment shown in FIG. 6A , step 702 in the embodiment shown in FIG. 7 , and step 809 in the embodiment shown in FIG. 8 .
  • the communications apparatus 1200 can correspondingly implement the operations and functions of the second core network device in the foregoing method embodiments.
  • the communication apparatus 1200 may be a second core network device, or may be a component (such as a chip or a circuit) applied in the second core network device.
  • the transceiver module 1220 may be used to perform all receiving or sending operations performed by the second core network device in the embodiments shown in FIG. 4, FIG. 6B, FIG. 8, FIG. 9, FIG. 10, and FIG.
  • the processing module 1210 is configured to execute all operations performed by the second core network device in the embodiments of FIG. 4 , FIG. 8 , FIG. 9 , FIG. 10 , and FIG. Step 402 , step 412 , step 415 , step 422 , step 426 , and step 433 in the example, and step 813 and step 820 in the embodiment shown in FIG. 8 .
  • the communication device 1200 can correspondingly implement the operations and functions of the operation requester in the foregoing method embodiments.
  • the communication device 1200 may be an operation requester, or a component (such as a chip or a circuit) applied to the operation requester.
  • the transceiver module 1220 may be used to perform all receiving or sending operations performed by the operation requesting party in the embodiments shown in FIG. 4, FIG. 5, FIG. 6A, FIG. 6B, FIG. 8, FIG. 9, FIG. 10, and FIG. Step 403, step 413, step 416, step 423, step 425, step 434 in the embodiment shown in 4, and step 501 in the embodiment shown in FIG. 5, step 602A in the embodiment shown in FIG. 6A, FIG.
  • the processing module 1210 is used to execute all the operations performed by the operation requester in the embodiments of FIG. 4 , FIG. 5 , FIG. 8 , FIG. 9 , FIG. 10 , and FIG. Step 401 , step 414 , and step 424 in the embodiment, step 502 in the embodiment shown in FIG. 5 , and step 801 in the embodiment shown in FIG. 8 .
  • FIG. 13 is a schematic structural diagram of another communication device 130 provided by an embodiment of the present application.
  • the communication device in FIG. 13 may be the above-mentioned first core network device.
  • the communication device in FIG. 13 may be the aforementioned second core network device.
  • the communication device in FIG. 13 may be the operation requester described above.
  • the communication device 130 includes at least one processor 1320 and a transceiver 1310 .
  • the processor 1320 and the transceiver 1310 may be configured to perform the functions or operations performed by the foregoing first core network device.
  • the processor 1320 may perform one of the following multiple operations: step 602A in the embodiment shown in FIG. 6A , step 702 in the embodiment shown in FIG. 7 , and step 809 in the embodiment shown in FIG. 8 .
  • the transceiver 1310 may perform one or more of the following operations: step 405, step 417, step 427, and step 435 in the embodiment shown in FIG. 4, and step 601A and step 602A in the embodiment shown in FIG. 6A.
  • the processor 1320 and the transceiver 1310 may be configured to perform the functions or operations performed by the foregoing second core network device.
  • the processor 1320 may perform one of the following multiple operations: step 402, step 412, step 415, step 422, step 426, and step 433 in the embodiment shown in FIG. Step 813 and Step 820.
  • the transceiver 1310 may perform one or more of the following operations: step 401, step 405, step 411, step 417, step 421, step 425, step 427, step 432, step 435 in the embodiment shown in FIG. Step 602B and step 603B in the embodiment shown in FIG. 6B , and step 812 , step 814 , and step 819 in the embodiment shown in FIG. 8 .
  • the processor 1320 and the transceiver 1310 may be configured to perform the functions or operations performed by the above operation requesting party.
  • the processor 1320 may perform one or more of the following operations: step 401, step 414, and step 424 in the embodiment shown in FIG. 4, step 502 in the embodiment shown in FIG. Step 801 in the embodiment.
  • the transceiver 1310 may perform one or more of the following operations: step 403, step 413, step 416, step 423, step 425, and step 434 in the embodiment shown in FIG. 4, and the steps in the embodiment shown in FIG. 501, step 602A in the embodiment shown in FIG. 6A , and step 803, step 818, and step 819 in the embodiment shown in FIG. 8 .
  • the transceiver 1310 is used to communicate with other devices/apparatus through the transmission medium.
  • the processor 1320 uses the transceiver 1310 to send and receive data and/or signaling, and is used to implement the methods in the foregoing method embodiments.
  • the processor 1320 can realize the function of the processing module 1210 , and the transceiver 1310 can realize the function of the transceiver module 1220 .
  • the communication device 130 may further include at least one memory 1330 for storing program instructions and/or data.
  • the memory 1330 is coupled to the processor 1320 .
  • the coupling in the embodiments of the present application is an indirect coupling or a communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • Processor 1320 may cooperate with memory 1330 .
  • Processor 1320 may execute program instructions stored in memory 1330 . At least one of the at least one memory may be included in the processor.
  • the specific connection between the transceiver 1310, the processor 1320 and the memory 1330 is not limited in the embodiment of the present application. medium.
  • the memory 1330, the processor 1320, and the transceiver 1310 are connected through the bus 1340.
  • the bus is represented by a thick line in FIG. 13, and the connection between other components is only for schematic illustration. , is not limited.
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 13 , but it does not mean that there is only one bus or one type of bus.
  • the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or Execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.
  • a general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • FIG. 14 is a schematic structural diagram of another communication device 140 provided by an embodiment of the present application.
  • the communication device shown in FIG. 14 includes a logic circuit 1401 and an interface 1402 .
  • the processing module 1210 in FIG. 12 can be realized by a logic circuit 1401
  • the transceiver module 1220 in FIG. 12 can be realized by an interface 1402 .
  • the logic circuit 1401 may be a chip, a processing circuit, an integrated circuit or a system on chip (SoC) chip, etc.
  • the interface 1402 may be a communication interface, an input-output interface, or the like.
  • the logic circuit and the interface may also be coupled to each other. The embodiment of the present application does not limit the specific connection manner of the logic circuit and the interface.
  • the logic circuit and the interface may be used to perform the functions or operations performed by the above-mentioned first core network device.
  • the logic circuit and the interface may be used to perform the functions or operations performed by the aforementioned second core network device.
  • the logic circuit and the interface may be used to perform the functions or operations performed by the above-mentioned operation requesting party.
  • the logic circuit and interface may be used to perform the functions or operations performed by the access network device 2 described above.
  • the present application also provides a computer-readable storage medium, where computer codes are stored in the computer-readable storage medium, and when the computer codes are run on the computer, the computer is made to execute the methods of the above-mentioned embodiments.
  • the present application also provides a computer program product.
  • the computer program product includes computer code or computer program.
  • the authentication method in the above-mentioned embodiments is executed.
  • the present application also provides a communication system, including a terminal device, an access network device 1, a second access network device, and a third access network device.
  • the present application also provides a communication system, including a terminal device and an access network device 2 .

Abstract

本申请实施例公开了一种终端管理方法和核心网设备，该方法包括：第一核心网设备接收来自终端的第一消息，所述第一消息用于请求接入网络；所述第一核心网设备在根据数量信息确定允许所述终端接入所述网络时，向所述终端所属的操作请求方发送第二消息；所述数量信息包括所述操作请求方允许使用的终端数量，所述第二消息包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。本申请实施例中，第一核心网设备根据数量信息确定允许终端接入网络，可避免操作请求方对应的终端中接入网络的终端数量大于或等于操作请求方允许使用的终端数量。

Description

终端管理方法和核心网设备
本申请要求于2022年01月30日提交中国专利局、申请号为202210114767.1、申请名称为“终端管理方法和核心网设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种终端管理方法和核心网设备。
背景技术
无源物联网(passive IoT，P-IoT)架构中可以包括无源终端、阅读器(reader)以及操作请求方。无源终端可以是标签形态，也可以是其他任意终端形态。下面无源终端以终端为例进行阐述。阅读器(reader)利用无线射频方式对终端(例如电子标签或射频卡)进行读写，从而达到识别目标和数据交换的目的。当操作请求方对终端进行终端操作时，可以通过核心网设备向阅读器发送操作指令，操作指令可以包括但不限于执行获取终端信息、盘点操作(或者称为盘存操作)、读操作、写操作、失效操作、与终端交互信息等操作。当阅读器接收到该操作指令后，会向终端发送该操作指令；终端根据该操作指令获取或者发送相应的信息。例如，当操作指令为盘点指令或者为执行盘点操作时，终端会发送终端的标识信息。又例如，当操作指令为读指令或者为执行读操作时，终端会发送存储在终端存储区中的数据信息。又例如，当操作指令为写指令或者执行写操作时，终端会将指令中包括的待写入终端的数据信息存储至终端的存储区中。阅读器接收终端发送的信息，并通过核心网设备向操作请求方发送该信息。
发明内容
本申请实施例公开了一种终端管理方法和核心网设备，可实现对终端的管理。
第一方面，本申请实施例提供一种终端管理方法，包括：第一核心网设备接收来自终端的第一消息，所述第一消息用于请求接入网络；所述第一核心网设备在根据数量信息确定允许所述终端接入所述网络时，向所述终端所属的操作请求方发送第二消息；所述数量信息包括所述操作请求方允许使用的终端数量，所述第二消息包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
本申请实施例中，第一核心网设备在根据数量信息确定允许终端接入所述网络时，向该终端所属的操作请求方发送第二消息。也就是说，第一核心网设备发送第二消息之前，需要根据数量信息确定允许终端接入网络，而不是直接允许该终端接入网络。第一核心网设备根据数量信息确定允许终端接入网络，可避免操作请求方对应的终端中接入网络的终端数量大于或等于操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述根据数量信息确定允许所述终端接入所述网络包括：当所述操作请求方对应的终端中接入所述网络的终端数量小于数量阈值时，所述第一核心网设 备确定允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
在该实现方式中，当操作请求方对应的终端中接入网络的终端数量小于数量阈值时，第一核心网设备确定允许终端接入网络，可快速、准确地确定是否允许终端接入，并避免操作请求方对应的终端中接入网络的终端数量大于或等于数量阈值。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备在根据所述数量信息确定不允许所述终端接入所述网络的情况下，向所述终端发送第三消息；所述第三消息指示拒绝所述终端接入所述网络。
在该实现方式中，第一核心网设备在根据数量信息确定不允许终端接入网络的情况下，向终端发送第三消息；可避免操作请求方对应的终端中接入网络的终端数量大于或等于操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述根据所述数量信息确定不允许所述终端接入所述网络包括：当所述操作请求方对应的终端中接入所述网络的终端数量大于或等于数量阈值时，所述第一核心网设备确定不允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
在该实现方式中，当操作请求方对应的终端中接入网络的终端数量大于或等于数量阈值时，第一核心网设备确定不允许终端接入所述网络；可快速、准确地确定是否允许终端接入。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备向第二核心网设备发送第四消息；所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息和所述认证信息用于执行所述认证流程；所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在该实现方式中，第一核心网设备向第二核心网设备发送第四消息，以便于对终端执行认证流程，从而保证该终端为可信的终端。
在一种可能的实现方式中，所述第一核心网设备在根据数量信息确定允许所述终端接入所述网络之后，所述第一核心网设备向第二核心网设备发送第四消息；所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息和所述认证信息用于执行所述认证流程；所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在该实现方式中，第一核心网设备向第二核心网设备发送第四消息，以便于对终端执行认证流程，从而保证该终端为可信的终端。
在一种可能的实现方式中，所述第四消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种。
在该实现方式中，指示信息指示认证流程为单向认证流程或双向认证流程，以便第二核心网设备根据该指示信息确定待执行的认证流程。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备根据所述第一消息对所述终端执行认证流程；所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在该实现方式中，第一核心网设备根据第一消息对终端执行认证流程，该第一核心网设备自身就可对该终端执行认证流程，不必与其他设备交互，可减少信令开销。
在一种可能的实现方式中，所述第一核心网设备在根据数量信息确定允许所述终端接入所述网络之后，根据所述第一消息对所述终端执行认证流程；所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在该实现方式中，第一核心网设备根据第一消息对终端执行认证流程，该第一核心网设备自身就可对该终端执行认证流程，不必与其他设备交互，可减少信令开销。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在该实现方式中，第一核心网设备根据第一消息包括的第三标识信息，确定终端所属的操作请求方，以便根据数量信息确定是否允许终端接入网络。
在一种可能的实现方式中，所述第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方包括：所述第一核心网设备根据所述第三标识信息和第一对应关系，确定所述终端所属的所述操作请求方；所述第一对应关系表示所述终端属于所述操作请求方。可选的，第一对应关系包括所述终端的应用标识(终端标识或网络标识)与操作请求方标识的对应关系，所述操作请求方标识为所述操作请求方的标识。
在该实现方式中，第一核心网设备根据第三标识信息和第一对应关系，可快速、准确地确定终端所属的操作请求方。
在一种可能的实现方式中，所述第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方之前，所述方法还包括：所述第一核心网设备根据来自所述操作请求方的操作指令，确定第二对应关系；所述第二对应关系表示所述终端属于所述操作请求方；所述第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方包括：所述第一核心网设备根据所述第三标识信息和所述第二对应关系，确定所述终端所属的所述操作请求方。所述操作指令可包含所述终端的第一标识，该第一标识为终端的终端标识、加密的终端标识、终端应用标识、终端网络标识中的任一项。
在该实现方式中，第一核心网设备根据来自操作请求方的操作指令，确定第二对应关系，不必预先存储各终端与其所属的操作请求方的对应关系，可以减少存储开销，并减少检索终端所属的操作请求方的工作量。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备接收第五消息；所述第一核心网设备向所述终端，发送第六消息；所述第五消息指示所述认证流程通过，所述第六消息指示接受所述终端接入所述网络；或者，所述第五消息指示所述认证流程不通过，所述第六消息指示拒绝所述终端接入所述网络。
在该实现方式中，可及时指示接受或拒绝终端接入网络。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备获取所述数量信息和/或所述第一标识信息。
在该实现方式中，第一核心网设备获取数量信息和/或第一标识信息，以便根据该数量信息确定是否允许终端接入网络，以及实现对终端的认证流程。
在一种可能的实现方式中，所述方法还包括：所述第一核心网设备统计所述操作请求方对应的终端中接入所述网络的终端数量。
在该实现方式中，第一核心网设备统计操作请求方对应的终端中接入网络的终端数量，以便根据该终端设备和数量阈值确定是否允许终端接入网络。
在一种可能的实现方式中，所述第一核心网设备统计所述操作请求方对应的终端中接入所述网络的终端数量包括：在所述终端通过认证之后，所述第一核心网设备根据所述第一标识信息和第三对应关系，更新所述操作请求方对应的终端中接入所述网络的终端数量，所述第三对应关系包括：所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项中的一个或多个的对应关系。
在该实现方式中，第一核心网设备根据第一标识信息和第二对应关系，更新操作请求方对应的终端中接入网络的终端数量；可以准确地统计操作请求方对应的终端中接入网络的终端数量，并防止多个终端使用相同的标识接入网络。
第二方面，本申请提供另一种终端管理方法，其特征在于，包括：操作请求方获取数量信息，所述数量信息指示所述操作请求方允许使用的终端数量；所述操作请求方根据所述数量信息，获取一个或多个终端应用标识。
本申请实施例中，操作请求方根据数量信息，获取一个或多个终端应用标识；可以避免该操作请求方获取的终端应用标识的数量超过该操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述方法还包括：所述操作请求方发送操作指令，所述操作指令包括第一应用标识，所述第一应用标识包含于所述一个或多个终端应用标识；所述操作指令用于对所述第一应用标识对应的终端执行操作。
在该实现方式中，操作指令包括第一应用标识；通过包含第一应用标识的操作指令，可方便地对第一应用标识对应的终端执行操作。
在一种可能的实现方式中，所述方法还包括：所述操作请求方获取网络标识信息，所述网络标识信息包括一个或多个终端网络标识。
在该实现方式中，操作请求方获取网络标识信息，以便于该操作请求方利用该网络标识信息实现对终端的管理。
在一种可能的实现方式中，所述方法还包括：所述操作请求方向第一核心网设备发送所述一个或多个终端应用标识和/或所述操作请求方标识。
在该实现方式中，操作请求方向第一核心网设备发送一个或多个终端应用标识和/或操作请求方标识；以便于该第一核心网设备利用该一个或多个终端应用标识和/或操作请求方标识实现终端管理。
第三方面，本申请提供另一种终端管理方法，包括：操作请求方获取一个或多个终端应用标识；所述操作请求方发送操作指令，所述操作指令包括第一应用标识，所述第一应用标识包含于所述一个或多个终端应用标识；所述操作指令用于对所述第一应用标识对应的终端执行操作。
本申请实施例中，操作请求方获取一个或多个终端应用标识，并发送包括第一应用标识的操作指令，可以对第一应用标识对应的终端执行操作。也就是说，根据获取的一个或多个终端应用标识，可对相应的终端执行操作。
在一种可能的实现方式中，所述操作请求方获取一个或多个终端应用标识包括：所述操作请求方接收来自第一核心网设备的所述一个或多个终端应用标识。
在该实现方式中，操作请求方接收来自第一核心网设备的一个或多个终端应用标识；不需要自己分配终端应用标识。
在一种可能的实现方式中，所述方法还包括：所述操作请求方获取数量信息，所述数量 信息指示所述操作请求方允许使用的终端数量。
在该实现方式中，操作请求方获取数量信息，可以获知其允许使用的终端数量。
第四方面，本申请提供另一种终端管理方法，包括：第二核心网设备获取数量信息，所述数量信息指示操作请求方允许使用的终端数量；所述第二核心网设备向第一核心网设备发送所述数量信息和/或第一标识信息；所述第一标识信息包括终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项；所述操作请求方标识为所述操作请求方的标识，所述终端属于所述操作请求方。
本申请实施例中，第二核心网设备向第一核心网设备发送数量信息和/或第一标识信息，以便该第一核心网设备根据该数量信息确定是否允许终端接入网络。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备配置所述操作请求方允许使用的终端数量。
在该实现方式中，第二核心网设备配置操作请求方允许使用的终端数量，以便利用该终端数量执行终端管理。
在一种可能的实现方式中，在第二核心网设备获取数量信息之后，所述方法还包括：所述第二核心网设备根据所述数量信息，获取(例如分配)所述终端的终端网络标识。
在该实现方式中，第二核心网设备根据所述数量信息，获取终端的终端网络标识，以便后续根据该终端网络标识对该终端执行终端管理。
在一种可能的实现方式中，第二核心网设备根据所述数量信息，获取(例如分配)所述终端的终端网络标识之后，所述方法还包括：所述第二核心网设备向所述操作请求方发送所述终端的终端网络标识。
在该实现方式中，第二核心网设备向操作请求方发送终端网络标识，以便该操作请求方利用该终端网络标识对相应的终端执行终端管理。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备接收来自操作请求方的一个或多个终端应用标识；所述一个或多个终端应用标识包括所述终端的终端应用标识。
在该实现方式中，第二核心网设备接收来自操作请求方的一个或多个终端应用标识，以便后续利用这些终端应用标识对相应的终端进行终端管理。
在一种可能的实现方式中，所述第二核心网设备接收来自操作请求方的一个或多个终端应用标识之后，所述方法还包括：所述第二核心网设备配置所述一个或多个终端应用标识。
在该实现方式中，第二核心网设备配置一个或多个终端应用标识，以便后续利用这些终端应用标识对相应的终端进行终端管理。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备获取第七消息；所述第七消息包括所述数量信息和第四标识信息；所述第四标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。所述第二核心网设备获取第七消息可以是接收来自其他设备(例如属于运营商的设备)发送的第七消息。
在该实现方式中，第二核心网设备获取第七消息，以便利用该第七消息得到第一标识信息。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备向所述操作请求方发送所述终端的应用标识和/或所述数量信息。
在该实现方式中，可以使得操作请求方获得终端的应用标识和/或数量信息。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备接收来自所述第一核 心网设备的第四消息，所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息包括终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项；所述第二核心网设备根据所述第四消息对所述终端执行认证流程。
本申请实施例中，第二核心网设备根据第四消息对终端执行认证流程，可以快速认证终端。
在一种可能的实现方式中，所述第四消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种；所述方法还包括：所述第二核心网设备根据所述指示信息确定所述认证流程的类型。
在该实现方式中，第二核心网设备根据指示信息确定认证流程的类型；以便对终端执行相应的认证流程。
在一种可能的实现方式中，所述第二标识信息包括操作请求方标识且未包括所述终端的终端标识、加密的终端标识、终端应用标识以及终端网络标识；所述第二核心网设备根据所述第四消息对所述终端执行认证流程之后，所述方法还包括：在所述终端通过认证的情况下，为所述终端分配终端网络标识。
在该实现方式中，在终端通过认证的情况下，为终端分配终端网络标识。这样终端的网络标识可以无需提前配置于操作请求方中，可以防止操作请求方将一个终端的网络标识用于多个终端中，即终端获取终端网络标识可以流程化，更安全。
在一种可能的实现方式中，所述方法还包括：所述第二核心网设备统计所述操作请求方对应的终端中接入所述网络的终端数量。
在该实现方式中，第二核心网设备统计操作请求方对应的终端中接入网络的终端数量，以便根据该终端设备和数量阈值确定是否允许终端接入网络。
在一种可能的实现方式中，所述第二核心网设备统计所述操作请求方对应的终端中接入所述网络的终端数量包括：在所述终端通过认证之后，所述第二核心网设备根据所述第一标识信息和第三对应关系，更新所述操作请求方对应的终端中接入所述网络的终端数量，所述第三对应关系包括：所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项中的一个或多个的对应关系。
在该实现方式中，第二核心网设备根据第一标识信息和第三对应关系，更新操作请求方对应的终端中接入网络的终端数量；可以准确地统计操作请求方对应的终端中接入网络的终端数量，并防止多个终端使用相同的标识接入网络。
在一种可能的实现方式中，所述第二核心网设备统计所述操作请求方对应的终端中接入所述网络的终端数量之后，所述方法还包括：所述第二核心网设备通知所述第一核心网设备所述操作请求方对应的终端中接入所述网络的终端数量。
在该实现方式中，可使得第一核心网设备获知操作请求方对应的终端中接入网络的终端数量。
在一种可能的实现方式中，所述终端为标签；所述方法还包括：所述第二核心网设备更新或者删除失效标签的标识信息，所述失效标签的标识信息包括以下信息中的一项或多项：所述失效标签的终端应用标识、终端网络标识、终端标识、加密的终端标识、第三对应关系，所述第三对应关系包含所述失效标签的终端应用标识、终端网络标识、终端标识、加密的终端标识中的两个或两个以上的对应关系。
在该实现方式中，第二核心网设备更新或者删除失效标签的标识信息，以便更好地管理标签。
在一种可能的实现方式中，所述方法还包括：接收来自所述操作请求方的标签消息；所述第二核心网设备更新或者删除失效标签的标识信息包括：所述第二核心网设备根据所述标签信息，更新或者删除失效标签的标识信息。
在该实现方式中，可按照操作请求方的指示更新或者删除失效标签的标识信息。
第五方面，本申请实施例提供一种通信装置，该通信装置具有实现上述第一方面方法实施例中的行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块或单元。在一种可能的实现方式中，包括收发模块和处理模块，其中：所述收发模块，用于接收来自终端的第一消息，所述第一消息用于请求接入网络；所述收发模块，还用于在所述处理模块根据数量信息确定允许所述终端接入所述网络时，向所述终端所属的操作请求方发送第二消息；所述数量信息包括所述操作请求方允许使用的终端数量，所述第二消息包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述处理模块，具体用于当所述操作请求方对应的终端中接入所述网络的终端数量小于数量阈值时，确定允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述收发模块，还用于在所述处理模块根据所述数量信息确定不允许所述终端接入所述网络的情况下，向所述终端发送第三消息；所述第三消息指示拒绝所述终端接入所述网络。
在一种可能的实现方式中，所述处理模块，具体用于当所述操作请求方对应的终端中接入所述网络的终端数量大于或等于数量阈值时，确定不允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述收发模块，还用于向第二核心网设备发送第四消息；所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息和所述认证信息用于执行所述认证流程；所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述第四消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种。
在一种可能的实现方式中，所述处理模块，还用于根据所述第一消息对所述终端执行认证流程；所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述处理模块，还用于根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述处理模块，具体用于根据所述第三标识信息和第一对应关系，确定所述终端所属的所述操作请求方；所述第一对应关系表示所述终端属于所述操作 请求方。可选的，第一对应关系包括所述终端的应用标识(终端标识或网络标识)与操作请求方标识的对应关系，所述操作请求方标识为所述操作请求方的标识。
在一种可能的实现方式中，所述处理模块，具体用于根据来自所述操作请求方的操作指令，确定第二对应关系；所述第二对应关系表示所述终端属于所述操作请求方；根据所述第三标识信息和所述第二对应关系，确定所述终端所属的所述操作请求方。所述操作指令可包含所述终端的第一标识，该第一标识为终端的终端标识、加密的终端标识、终端应用标识、终端网络标识中的任一项。
在一种可能的实现方式中，所述收发模块，还用于接收第五消息；向所述终端，发送第六消息；所述第五消息指示所述认证流程通过，所述第六消息指示接受所述终端接入所述网络；或者，所述第五消息指示所述认证流程不通过，所述第六消息指示拒绝所述终端接入所述网络。
在一种可能的实现方式中，所述处理模块，还用于获取所述数量信息和/或所述第一标识信息。
在一种可能的实现方式中，所述处理模块，还用于统计所述操作请求方对应的终端中接入所述网络的终端数量。
在一种可能的实现方式中，所述处理模块，具体用于在所述终端通过认证之后，根据所述第一标识信息和第三对应关系，更新所述操作请求方对应的终端中接入所述网络的终端数量，所述第三对应关系包括：所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项中的一个或多个的对应关系。
关于第五方面的各种可能的实施方式所带来的技术效果，可参考对于第一方面或第一方面的各种可能的实施方式的技术效果的介绍。
第六方面，本申请实施例提供一种通信装置，该通信装置具有实现上述第一方面方法实施例中的行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块或单元。在一种可能的实现方式中，包括收发模块和处理模块，其中：所述收发模块，用于获取数量信息，所述数量信息指示所述操作请求方允许使用的终端数量；所述处理模块，用于根据所述数量信息，获取一个或多个终端应用标识。
在一种可能的实现方式中，所述收发模块，还用于发送操作指令，所述操作指令包括第一应用标识，所述第一应用标识包含于所述一个或多个终端应用标识；所述操作指令用于对所述第一应用标识对应的终端执行操作。
在一种可能的实现方式中，所述收发模块，还用于获取网络标识信息，所述网络标识信息包括一个或多个终端网络标识。
在一种可能的实现方式中，所述收发模块，还用于向第一核心网设备发送所述一个或多个终端应用标识和/或所述操作请求方标识。
关于第六方面的各种可能的实施方式所带来的技术效果，可参考对于第二方面或第二方面的各种可能的实施方式的技术效果的介绍。
第七方面，本申请实施例提供一种通信装置，该通信装置具有实现上述第三方面方法实施例中的行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块或单元。在一种可能的实现方式中，包括收发模块，其中：所述收发模块，用于获取一个或多个终端应用标识；发送操作指令，所述操作指令包括第一应用标识，所述第一应用标识包含于所述一个或多个终端应用标识； 所述操作指令用于对所述第一应用标识对应的终端执行操作。
在一种可能的实现方式中，所述收发模块，具体用于接收来自第一核心网设备的所述一个或多个终端应用标识。
在一种可能的实现方式中，所述收发模块，还用于获取数量信息，所述数量信息指示所述操作请求方允许使用的终端数量。
关于第七方面的各种可能的实施方式所带来的技术效果，可参考对于第三方面或第三方面的各种可能的实施方式的技术效果的介绍。
第八方面，本申请实施例提供一种通信装置，该通信装置具有实现上述第四方面方法实施例中的行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块或单元。在一种可能的实现方式中，包括收发模块，其中：所述收发模块，用于获取数量信息，所述数量信息指示操作请求方允许使用的终端数量；向第一核心网设备发送所述数量信息和/或第一标识信息；所述第一标识信息包括终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项；所述操作请求方标识为所述操作请求方的标识，所述终端属于所述操作请求方。
在一种可能的实现方式中，所述通信装置还包括：处理模块，用于配置所述操作请求方允许使用的终端数量。
在一种可能的实现方式中，所述处理模块，具体用于根据所述数量信息，获取(例如分配)所述终端的终端网络标识。
在一种可能的实现方式中，所述收发模块，还用于向所述操作请求方发送所述终端的终端网络标识。
在一种可能的实现方式中，所述收发模块，还用于接收来自操作请求方的一个或多个终端应用标识；所述一个或多个终端应用标识包括所述终端的终端应用标识。
在一种可能的实现方式中，所述处理模块，还用于配置所述一个或多个终端应用标识。
在一种可能的实现方式中，所述收发模块，还用于获取第七消息；所述第七消息包括所述数量信息和第四标识信息；所述第四标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述收发模块，还用于向所述操作请求方发送所述终端的应用标识和/或所述数量信息。
在一种可能的实现方式中，所述收发模块，还用于接收来自所述第一核心网设备的第四消息，所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息包括终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项；所述处理模块，还用于根据所述第四消息对所述终端执行认证流程。
在一种可能的实现方式中，所述第四消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种；所述处理模块，具体用于根据所述指示信息确定所述认证流程的类型。
在一种可能的实现方式中，所述第二标识信息包括操作请求方标识且未包括所述终端的终端标识、加密的终端标识、终端应用标识以及终端网络标识；所述处理模块，还用于在所述终端通过认证的情况下，为所述终端分配终端网络标识。
在一种可能的实现方式中，所述处理模块，还用于统计所述操作请求方对应的终端中接入所述网络的终端数量。
在一种可能的实现方式中，所述处理模块，具体用于在所述终端通过认证之后，所述第二核心网设备根据所述第一标识信息和第三对应关系，更新所述操作请求方对应的终端中接入所述网络的终端数量，所述第三对应关系包括：所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项中的一个或多个的对应关系。
在一种可能的实现方式中，所述收发模块，还用于通知所述第一核心网设备所述操作请求方对应的终端中接入所述网络的终端数量。例如，收发模块向第一核心网设备发送一个通知消息，该通知消息包括操作请求方对应的终端中接入网络的终端数量。
在一种可能的实现方式中，所述终端为标签；所述处理模块，还用于更新或者删除失效标签的标识信息，所述失效标签的标识信息包括以下信息中的一项或多项：所述失效标签的终端应用标识、终端网络标识、终端标识、加密的终端标识、第三对应关系，所述第三对应关系包含所述失效标签的终端应用标识、终端网络标识、终端标识、加密的终端标识中的两个或两个以上的对应关系。
在一种可能的实现方式中，所述收发模块，还用于接收来自所述操作请求方的标签消息；所述第二核心网设备更新或者删除失效标签的标识信息包括：所述第二核心网设备根据所述标签信息，更新或者删除失效标签的标识信息。
关于第八方面的各种可能的实施方式所带来的技术效果，可参考对于第四方面或第四方面的各种可能的实施方式的技术效果的介绍。
第九方面，本申请提供一种通信装置，该通信装置包括处理器，该处理器可以用于执行存储器所存储的计算机执行指令，以使上述第一方面或第一方面的任意可能的实现方式所示的方法被执行，或者以使上述第二方面或第二方面的任意可能的实现方式所示的方法被执行，或者以使上述第三方面或第三方面的任意可能的实现方式所示的方法被执行，或者以使上述第四方面或第四方面的任意可能的实现方式所示的方法被执行。
本申请实施例中，在执行上述方法的过程中，上述方法中有关发送信息的过程，可以理解为基于处理器的指令进行输出信息的过程。在输出信息时，处理器将信息输出给收发器，以便由收发器进行发射。该信息在由处理器输出之后，还可能需要进行其他的处理，然后到达收发器。类似的，处理器接收输入的信息时，收发器接收该信息，并将其输入处理器。更进一步的，在收发器收到该信息之后，该信息可能需要进行其他的处理，然后才输入处理器。
对于处理器所涉及的发送和/或接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则可以一般性的理解为基于处理器的指令输出。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器等。例如，处理器还可以用于执行存储器中存储的程序，当该程序被执行时，使得该通信装置执行如上述第一方面或第一方面的任意可能的实现方式所示的方法。在一种可能的实现方式中，存储器位于上述通信装置之外。在一种可能的实现方式中，存储器位于上述通信装置之内。
本申请实施例中，处理器和存储器还可能集成于一个器件中，即处理器和存储器还可能被集成于一起。
在一种可能的实现方式中，通信装置还包括收发器，该收发器，用于接收报文或发送报文等。
第十方面，本申请提供一种数据处理装置，该数据处理装置包括处理电路和接口电路， 该接口电路用于获取数据或输出数据；处理电路用于执行如上述第一方面或第一方面的任意可能的实现方式所示的相应的方法，或者处理电路用于执行如上述第二方面或第二方面的任意可能的实现方式所示的相应的方法，或者处理电路用于执行如上述第三方面或第三方面的任意可能的实现方式所示的相应的方法，或者处理电路用于执行如上述第四方面或第四方面的任意可能的实现方式所示的相应的方法。
第十一方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质用于存储计算机程序，当其在计算机上运行时，使得上述第一方面或第一方面的任意可能的实现方式所示的方法被执行，或者使得上述第二方面或第二方面的任意可能的实现方式所示的方法被执行，或者使得上述第三方面或第三方面的任意可能的实现方式所示的方法被执行，或者使得上述第四方面或第四方面的任意可能的实现方式所示的方法被执行。
第十二方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或计算机代码，当其在计算机上运行时，使得上述第一方面或第一方面的任意可能的实现方式所示的方法被执行，或者使得上述第二方面或第二方面的任意可能的实现方式所示的方法被执行，或者使得上述第三方面或第三方面的任意可能的实现方式所示的方法被执行，或者使得上述第四方面或第四方面的任意可能的实现方式所示的方法被执行。
第十三方面，本申请提供一种通信系统，包括上述第五方面或第五方面的任意可能的实现方式的所述第一核心网网设备、上述第六方面或第七方面所述的操作请求方以及上述第八方面或第八方面的任意可能的实现方式所述第二核心网设备中的一个或多个。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为一种无源物联网业务流的示意图；
图2A、图2B、图2C示出了3GPP网络支持P-IoT的三种架构示意图；
图3为本申请实施例提供的一种UE的注册流程的示例；
图4示出了本申请实施例提供的几种分配终端的应用标识的方式的示例；
图5为本申请实施例提供的一种终端管理方法流程图；
图6A为本申请实施例提供的另一种终端管理方法流程图；
图6B为本申请实施例提供的另一种终端管理方法流程图；
图7为本申请实施例提供的另一种终端管理方法流程图；
图8为本申请实施例提供的另一种终端管理方法流程图；
图9为本申请实施例提供的另一种终端管理方法流程图；
图10为本申请实施例提供的另一种终端管理方法流程图；
图11为本申请实施例提供的另一种终端管理方法流程图；
图12示出了一种通信装置1200的结构示意图；
图13为本申请实施例提供的另一种通信装置130的结构示意图；
图14为本申请实施例提供的另一种通信装置140的结构示意图。
具体实施方式
本申请的说明书、权利要求书及附图中的术语“第一”和“第二”等仅用于区别不同对象， 而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们的任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备等，没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元等，或可选地还包括对于这些过程、方法、产品或设备等固有的其它步骤或单元。
在本文中提及的“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员可以显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
本申请以下实施例中所使用的术语只是为了描述特定实施例的目的，而并非旨在作为对本申请的限制。如在本申请的说明书和所附权利要求书中所使用的那样，单数表达形式“一个”、“一种”、“所述”、“上述”、“该”和“这一”旨在也包括复数表达形式，除非其上下文中明确地有相反指示。还应当理解，本申请中使用的术语“和/或”是指并包含一个或多个所列出项目的任何或所有可能组合。例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。本申请中使用的术语“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b和c中的至少一项(个)，可以表示：a，或，b，或，c，或，a和b，或，a和c，或，b和c，或，a、b和c。其中a、b和c分别可以是单个，也可以是多个。
下面首先介绍本申请实施例中所涉及的术语和技术特征。
无源物联网(P-IoT)
无源物联网中的部分网络节点可以是无源的，它们可以通过太阳能、射频、风能、水能或者潮汐能等方式获取能量，获取能量的方式不做限制。这些节点自身不配备或者不依赖电池等电源设备，而是从环境中获取能量，支撑数据的感知、传输和分布式计算。这些节点还可以将获取的能量进行存储。无源物联网架构中可以包括无源终端、阅读器(reader)以及操作请求方。无源终端可以是标签形态(例如电子标签)，也可以是其他任意终端形态，本申请不做限制。阅读器(reader)可利用无线射频方式对电子标签或射频卡(Tag)进行读写，从而达到识别目标和数据交换的目的。它的工作方式有两种情况：一种就是当标签进入阅读器有效识别范围内时，接收阅读器发出的射频信号，凭借感应电流所获得的能量发出存储在芯片中的信息(对应于无源标签)；另一种就是标签(这种可以称为半无源或者半有源标签)可以通过太阳能等方式存储部分电能，使得可以主动发送某一频率的信号或者利用存储的电能进行通信、数据读取或者数据写入等操作，阅读器接收信息并解码后，送至中央信息系统进行有关数据处理。本申请中，标签可以是指电子标签，也可以是指无源或半无源物联网标签(例如用于嵌入或贴在物品上的非电子标签)。本申请中，终端的一种示例为标签。本申请中，阅读器可以是接入网设备，接入网设备包括基站、杆站、微型基站、无线接入网设备、无线接入网节点、接入回传一体化节点等，本申请不做限制。本申请中，操作请求方可以是服务器(server)、无源物联网服务器(P-IoT server)、应用功能(application function，AF)、无源物联网应用功能(P-IoT AF)或者其他发送操作指令的设备。
无源物联网也可以称为环境能量获取物联网(ambient IoT或者ambientpower-enabled IoT，A-IoT)。其中，无源物联网或者环境能量获取物联网中的物联终端可以包括无源终端、半无源终端、半有源终端或者有源终端。一种可能的实现方式中，无源终端、半无源终端或者半有源终端可以通过反射载波的通信方式进行通信。例如接收阅读器发出的射频信号，凭借感 应电流所获得的能量发出存储在芯片中的信息。可选的，半无源终端或半有源终端可以具备电容，存储从环境中获取的能量(例如太阳能、无线射频能量等，对获取能量的方式不做限定)。该能量可以用于计算、通信、数据读取、数据存储等。另一种可能的实现方式中，半有源终端或者有源终端可以主动生成载波进行通信。例如可以通过太阳能等方式存储部分电能，使得可以主动发送某一频率的信号或者利用存储的电能进行通信、数据读取或者数据写入等操作。
该技术广泛应用于各行业领域，下面简单列举了两个应用场景。
仓库/运输/物资：给货品嵌入或贴上无源或半无源标签。存放在仓库、商场等地方的货品在物流过程中，货品相关信息通过物联网标签被阅读器自动采集。管理人员就可以在系统迅速查询货品信息，降低货品被丢弃或者被盗的风险，可以提高货品交接速度，提高准确率，并且防止窜货和防伪。
固定资产管理：像图书馆、艺术馆及博物馆等资产庞大或者物品贵重的一些场所，就需要有完整的管理程序或者严谨的保护措施。当书籍或者贵重物品的存放信息有异常变动，就会及时提醒管理员，从而处理相关情况。
图1为一种无源物联网业务流的示意图。图1示出了如下操作：1、操作请求方通过AMF向接入网设备发送操作指令。2、终端执行操作。接入网设备接收到来自移动管理设备的操作指令后，向终端发送该操作指令。终端根据操作指令获取或者发送相应的信息，即根据该操作指令执行相应的操作。3、终端接入核心网。4、终端通过核心网设备(例如图1所示的AMF)向操作请求方发送操作结果。操作结果为终端根据操作指令执行相应的操作得到。
如图1所示，当操作请求方请求对终端进行操作时，可以通过核心网设备(例如可以是接入与移动管理功能(access and mobility management function，AMF)设备)、接入网设备向终端发送操作指令，操作指令可以包括但不限于执行获取标签信息、盘点操作(或者称为盘存操作)、读操作、写操作、失效操作、与标签交互信息操作。AMF设备为移动管理设备的一个示例。操作指令可以包括区域位置信息、终端的标识信息等。当接入网设备接收到该操作指令后，会向终端发送该操作指令。终端根据该操作指令获取或者发送相应的信息。例如，当操作指令为盘点指令或者为执行盘点操作的指令时，终端会发送其标识信息。又例如，当操作指令为读指令或者为执行读操作的指令时，终端会发送存储在其存储区中的数据信息。又例如，当操作指令为写指令或者执行写操作的指令时，终端会将该操作指令中包括的待写入终端的数据信息存储至终端的存储区中。接入网设备接收终端发送的信息，并通过核心网设备向操作请求方发送该信息。操作请求方向接入网设备发送指令的方式可以通过控制面通道发送，例如操作请求方通过控制面设备向接入网设备发送指令。控制面设备可以包括移动管理设备、网络开放功能设备、会话管理设备、策略控制设备、统一数据管理设备、统一数据存储库、物联管理设备(例如可称为标签管理功能(tagmanagementfunction，TMF)网元、无源物联管理功能(passiveIoTmanagementfunction，PIMF)网元、环境能量获取物联管理功能(ambient IoT managementfunction，AIMF)网元、具备物联终端管理或者具备处理物联业务功能的设备)等，本申请对控制面设备的名称不做限定。图1以控制面设备为移动管理设备为例。如图1所示：操作请求方向AMF发送指令；此时，操作请求方可以理解为应用功能(application function，AF)、服务器或者无源物联网应用功能(P-IoT AF)、无源物联服务器。一种可能的实现方式中，P-IoTAF向AMF发送指令。另一种可能的实现方式中，P-IoT AF通过控制面设备向AMF发送指令。该控制面设备可以是网络开放功能设备(network exposure function，NEF)、会话管理设备(session management function，SMF)、策略控制设备(policy  control function，PCF)、统一数据管理设备(unified data management，UDM)、统一数据存储库(unified data repository，UDR)。此外，操作请求方还可以通过用户面通道向接入网设备发送指令。一种可能的实现方式中，操作请求方通过用户面设备(user plane function，UPF)向阅读器发送指令。另一种可能的实现方式，操作请求方通过用户面设备和其他接入网设备，例如无线接入网设备(radio access network，RAN)向阅读器发送指令；此时，阅读器可以是杆站、接入回传一体化(integrated access and backhaul，IAB)节点、终端设备等。
终端操作
操作请求方可以对终端执行不同的终端操作。以下列举了几种常见的终端操作。
盘点操作(也可以称为盘存操作)，即盘点当前存在的终端情况，也可以理解为获取终端的标识信息。每个终端会有其标识。终端的标识可以由企业或者第三方实体分配(即在企业生产或制造终端时写入终端中)，也可以由运营商分配。在一种可能的实现方式中，终端的标识可以是一个全球唯一的码，例如电子产品代码(electronicproduct code，EPC)，也可以是临时的标识或者不为全球唯一的标识。在盘点流程中，操作请求方可以向阅读器下发盘点指令。通常，盘点指令会包括终端的标识范围、阅读器的标识、位置信息等信息。阅读器接收到盘点指令后，会根据盘点指令向相应终端进行盘点，并向操作请求方发送终端的标识信息。或者，操作请求方向阅读器发送指令，阅读器向相应终端发送该指令。终端根据指令的内容获知为盘点操作，终端向阅读器发送终端的标识信息。阅读器向操作请求方发送终端的标识信息。
读操作，即对终端进行数据读取。终端可以有存储功能，其存储区可以存储数据。若操作请求方欲对终端进行读操作，则会向阅读器发送读指令，阅读器根据读指令对终端进行读操作，从终端的存储区中读取数据，并向操作请求方发送该数据。
写操作，即对终端进行数据写入。操作请求方可以向阅读器发送写指令，阅读器根据指令对终端进行写操作，向终端的存储区写入数据。
失效操作，即能使终端失效。操作请求方可以向阅读器发送失效指令，失效指令中可以包括终端标识(即希望失效的终端的标识)。阅读器根据指令对终端进行失效操作，操作完成后，该终端会失效，而不得再被盘点或被执行其他操作。本申请中，终端的示例为标签。例如，失效操作能使标签失效，失效指令中可以包含标签标识(即希望失效的标签的标识)。
获取标签信息，可以理解为是上述各种操作的一个上位描述(例如是盘点操作和读操作的上位描述)，它不区分操作请求方是盘点终端还是读终端数据，该操作会获取终端信息，该终端信息可以是终端的标识信息或者是终端的存储区中存储的信息。
与终端的消息交互操作，可以理解为是上述各种操作的一个上位描述。阅读器接收操作请求方发送的指令后，与终端进行信息或者消息交互，并向操作请求方发送来自终端的信息。该操作主要是针对上述阅读器不查看指令内容，只负责转发操作请求方发送给终端的消息和终端发送给操作请求方的消息。因此在该场景下，阅读器对终端执行的操作可以理解为是与终端的消息交互操作。
无源物联网的几种可能架构
当第三代合作伙伴项目(the3rd generation partnership project，3GPP)网络支持无源物联网时，需要支持无源物联网指令的传输。图2A、图2B、图2C示出了3GPP网络支持P-IoT的三种架构示意图。图2A示出了3GPP网络支持P-IoT的技术路径1的架构示意图。图2B示出了3GPP网络支持P-IoT的技术路径2的架构示意图。图2C示出了3GPP网络支持P-IoT的技术路径3的架构示意图。
对于技术路径1，指令的传输方式可以通过用户面连接传输。图2A中的斜线区域表示用户面连接或者用户面通道，N2、N3、N4、N6以及N11均表示接口。例如RAN与UPF通过N3接口通信，或者可以理解为RAN与UPF建立了N3隧道。又例如，UPF与数据网络的接口是N6。在一种可能的实现方式中，阅读器建立用户面连接，操作请求方(例如服务器)通过用户面连接向阅读器发送指令。阅读器可以是终端设备，也可以是无线接入网设备、基站、微站、接入回传一体化(integrated access and backhaul，IAB)、杆站等。图2A以阅读器为接入网设备为例进行示意。
对于技术路径2，指令的传输方式仍可以通过用户面连接传输。图2B中的斜线区域表示用户面连接或者用户面通道。图2B中，N2、N3、N4、N6以及N11均表示接口。例如RAN与UPF通过N3接口通信，或者可以理解为RAN与UPF建立了N3隧道。又例如，UPF与数据网络的接口是N6。与技术路径1不同的是，阅读器与用户面设备建立用户面连接，用户面设备与操作请求方(例如服务器)建立连接。也就是说，阅读器并非建立数据网络粒度的会话。例如，若服务器1位于数据网络(data network，DN)1中，而服务器2位于数据网络2中。若在技术路径1中，阅读器需要建立两个会话分别连接数据网络1和数据网络2。若在技术路径2中，阅读器只需与同1个用户面设备建立一个用户面连接，由用户面设备分别与服务器1与服务器2建立连接。技术路径2的好处在于，当服务器需要向多个接入网设备发送指令，且多个阅读器均由同一用户面设备服务时，在技术路径1中，服务器需要向该用户面设备发送多个指令；而在技术路径2中服务器只需向该用户面设备发送一个指令，由用户面设备分别向多个阅读器发送指令。技术路径2中，阅读器可以是终端设备，也可以是无线接入网设备、基站、微站、接入回传一体化(integrated access and backhaul，IAB)、杆站等。图2B以阅读器为接入网设备为例进行示意。
对于技术路径3，指令的传输方式可以通过控制面通道传输，即服务器(或者应用功能)通过NEF向AMF发送指令。图2C中，N2、N3、N4以及N11均表示接口。例如RAN与UPF通过N3接口通信，或者可以理解为RAN与UPF建立了N3隧道。AMF向接入网设备发送该指令。当接入网设备与终端完成信息交互后，向AMF发送信息(如来自终端的信息)。AMF通过NEF向服务器发送信息。图2C以阅读器为接入网设备为例进行示意。当阅读器是终端设备时，在技术路径3中，指令的传输方式可以是服务器(或者应用功能)通过NEF向AMF发送指令。AMF通过接入网设备向阅读器发送该指令。
3GPP网络支持无源物联网的运营模式
运营商建立的3GPP网络支持的无源物联网，其商业模式可能有以下几种可能：
(1)、运营商为企业建立独立的网络，该网络支持无源物联网。运营商通过向企业收取建站的费用来盈利。
(2)、运营商可以为企业建立独立的网络或者非独立的网络，该网络支持无源物联网。运营商通过合约或者套餐的方式向企业收取费用。例如，运营商可以与企业签订合约，每月100元，允许企业使用1万个终端(例如标签)。
(3)、运营商可能还会有其他的商业模式，本申请不限制运营商的商业模式。除了第一种商业模式中，运营商无需获取企业使用终端的情况之外，对于其他运营商需要获取企业使用的终端情况或者运营商需要对终端进行管理、接入认证、计费等情况，运营商需要获取终端的标识信息从而对终端进行管理。
终端的注册流程
本申请中，终端可称为终端设备或者用户设备(user equipment，UE)，后续以UE代指 终端。图3为本申请实施例提供的一种UE的注册流程的示例。如图3所示，一种可能的UE的注册流程如下：
1.UE向RAN发送注册请求消息。
注册请求消息可包含注册类型(registration type)以及UE的标识信息。UE的标识信息可以包括用户隐藏标识符(subscription concealed identifier，SUCI)、全局唯一的临时UE标识(5G globally unique temporary UE identity，5G-GUTI)或者永久设备标识符(permanent equipment identifier，PEI)中的一个或多个。
注册类型有如下几种：
初始注册(initialregistration)：当UE处于去注册状态时发起的注册流程；
移动性注册更新(mobilityregistration update)：当UE因移动而需要发起的注册流程；
周期性注册更新(periodic registrationupdate)：当UE处于注册状态，因周期性注册更新计时器超时而发起的注册流程；
紧急注册(emergency registration)：当UE处于业务受限状态时发起的注册流程。
对于UE的标识信息，当UE有有效的5G-GUTI(一个临时身份标识，由服务于它的AMF分配)时，在注册请求中携带该5G-GUTI；若UE无有效的5G-GUTI，则携带SUCI。在紧急注册中，若UE无有效的5G-GUTI以及无SUPI(即无SUCI，SUCI是加密的SUPI)，则携带PEI。
2.RAN选择AMF。
3.RAN将UE发送的注册请求消息发给AMF。
4.AMF选择合适的AUSF以进行鉴权等安全流程；UE、AMF、AUSF、UDM交互，以完成鉴权等安全流程。
5.当UE与网络侧相互鉴权成功后，AMF与UDM交互以获取UE的签约数据。
6.AMF向RAN发送N2消息。
N2消息中可包括需要让RAN转发给UE的NAS消息。该NAS消息中可包括AMF向UE发送的注册接受消息(NAS消息)。
7.RAN向UE转发AMF发送的注册接受消息。
操作请求方进行终端操作时，需要采用终端的标识来识别终端，以便被执行操作的终端获知该指令是否对应自身。因此操作请求方需要使用一个终端标识来标识终端。本申请中，将操作请求方识别终端的标识称为终端应用标识(或者称为终端的应用标识)。3GPP网络支持无源物联网，若3GPP网络想要对终端进行接入认证、管理或者计费等，3GPP网络也需要获取终端的标识信息。本申请中，可以将网络识别终端的标识信息称为终端网络标识(或者称为终端的网络标识)。一种可能的实现方式中，同一个终端的应用标识和网络标识可以相同，也可以不同。在一种可能的实现方式中，由企业(或者运营商)分配终端的应用标识和/或网络标识。由于企业可能存在安全隐私的诉求，不希望网络获取终端的应用标识，那么一种可能的实现方式是，终端的应用标识与网络标识不同，且终端的应用标识由企业分配，终端的网络标识由运营商分配。若运营商需要获取终端的标识信息对终端进行管理，那么运营商如何防止企业盗用标签(例如不同的终端采用同样的网络标识接入网络，导致明明每月只能使用1万标签，企业却可以使用多于1万数量的标签)，这也是需要思考和解决的。本申请中，企业对应的实体是为企业提供服务的设备，例如服务器或者应用功能；运营商对应的实体是为运营商提供服务的设备，例如业务运营支撑系统(business&operation support system，BOSS)、服务器或者核心网设备。可理解，企业分配终端的应用标识和/或网络标识是指操作请求方(例 如服务器或者应用功能)分配终端的应用标识和/或网络标识；运营商分配终端的应用标识和/或网络标识是指运营商通过其对应的设备(例如服务器、业务运营支撑系统或者核心网设备)分配终端的应用标识和/或网络标识。
本申请中，企业可以理解为第三方、应用方、服务提供商、核心网或者网络或者移动网络之外的实体。
由于操作请求方和终端需要通过核心网设备进行通信，因此需要研究如何对终端进行接入管理的方案。对终端进行接入管理涉及的问题的举例如下：1、如何合理分配终端的标识，例如如何分配终端的网络标识和/或应用标识；2、终端的网络标识和/或应用标识由谁分配；3、如何防止终端的标识被盗用；4、如何认证授权终端；5、终端的标识由谁写入。
对于如何分配终端的标识，本申请提供了几种可能的方案。
方案一运营商预配置终端的应用标识。
运营商分配终端的应用标识(类似于运营商分配手机号)。本申请中，运营商可替换为网络、运营系统、服务器或核心网设备。或者，操作请求方分配终端的应用标识并通知运营商。运营商向终端写入标识(类似运营商烧卡发卡)或者运营商授权企业向终端写入标识。向终端写入标识时可以写入安全参数(或者称为安全上下文)。安全参数可以包括但不限于预配置密钥(例如用于标识加解密或者进行校验运算)或者哈希参数(例如用于认证或者鉴权)；网络对终端的应用标识进行认证(例如认证随机数与哈希后的校验值(AUTH值))。本申请中，网络可以是指核心网和/或接入网。通过向终端写入安全参数来执行认证流程。终端可以发送终端标识(或者加密的终端标识)，网络记录终端的应用标识与终端标识的对应关系，一个终端的应用标识只能与一个终端标识对应，从而防止多个终端采用同样的标识，即防止盗用终端的标识。在一种可能的实现方式中，终端为标签，终端标识为标签标识(tag identifier，TID)，加密的终端标识为加密的标签标识(concealed tag identifier，CTID)。TID是标签的唯一标识，在生产标签时，会将TID和/或CTID写入标签的存储区中，只可读不可写。TID可用于标识标签本身，可以不同于标签的应用标识。
方案二企业或者操作请求方分配终端的应用标识，运营商未预配置终端的应用标识(即运营商不预先获取终端的应用标识)。
企业向终端写入标识或者运营商授权企业向终端写入标识。在一种可能的实现方式中，终端为标签，向终端写入标识是指将标签的标识信息写入标签。向终端写入标识时可写入安全参数(或者称为安全上下文)。通过在向终端写入标识时写入安全参数来认证终端。终端注册时发送终端标识，网络记录终端标识，可根据终端标识监控企业使用终端的数量。
方案三企业或者操作请求方分配终端的应用标识，运营商分配终端的网络标识
运营商分配终端的网络标识可以是授权企业或操作请求方将终端的网络标识写入至终端中。向终端写入标识时可以写入安全参数(或者称为安全上下文)。通过在向终端写入标识时写入安全参数来认证授权终端。终端注册时可发送终端标识，网络记录终端标识，根据终端标识监控企业使用终端的数量，以便防止终端的标识被盗用。
方案四企业或者操作请求方分配终端的应用标识，运营商通过在线签约分配终端的网络标识。
本申请中，在线签约可以是指终端采用默认的凭证接入网络，网络认证后，向终端发送用于后续接入网络的签约数据或者凭证(即可以理解为在线获取签约数据)。一种可能的实现方式是，终端采用企业或者操作请求方粒度的标识或者凭证或者一个默认的凭证接入网络，认证通过后，网络向终端发送网络标识。后续终端再采用获得的网络标识接入网络中。向终 端写入标识时可写入安全参数(或者称为安全上下文)，网络对企业粒度的标识进行认证(如认证随机数与密钥进行运算后的AUTH值)，这样就可以实现网络认证终端。
终端执行在线签约时需要发送企业标识或者默认标识，网络根据企业标识或者默认标识分配网络标识。默认标识可以是终端与网络协商或约定的任意标识。终端注册时需要发送网路标识，网络记录网络标识。网络根据网络标识记录或者监控企业(或者操作请求方)使用的终端数量，从而防止企业(或者操作请求方)使用的终端数量超过允许使用的数量(即数量阈值)。网络根据网络标识记录或者监控企业(或者操作请求方)使用的终端数量的一种举例是：UDM或者AMF根据网络标识记录或者监控企业(或者操作请求方)使用的终端数量。
为解决如何对终端进行接入管理的问题，本申请提供了终端管理方法。采用本申请提供的终端管理方法，可实现对终端的接入管理，防止终端的标识被盗用。本申请提供的终端管理方法适用于图2A至图2C所示的无源物联网架构，还适用于其他对终端进行接入管理的架构。本申请以5G网络为例说明本方案。需注意的是，本申请提供的终端管理方法也适用于4G、6G网络等。
对于5G网络的系统架构，涉及的设备有核心网设备，例如AMF、AUSF、UDM，还有服务器，例如操作请求方(即下发指令的服务器或者应用功能AF)。下面介绍本申请涉及的设备。
移动性管理网元：主要用于移动性管理和接入管理等，可以用于实现移动性管理网元(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听以及接入授权/鉴权等功能。移动性管理网元(也可称为接入与移动性管理设备、接入与移动性管理功能实体、接入与移动性管理功能网元、移动管理网元、移动管理实体)，是核心网设备的一种。移动管理设备可用于对用户设备的接入控制和移动性进行管理。移动管理设备的一种举例为5G中的AMF网元。在实际应用中，AMF网元包括长期演进(long term evolution，LTE)的网络框架中的移动性管理实体(mobility management entity，MME)的接入与移动性管理功能，并加入了接入管理功能。AMF网元具体可以负责用户设备的注册、移动性管理、跟踪区更新流程、可达性检测、会话管理网元的选择、移动状态转换管理等。例如，在5G中，接入与移动性管理网元可以是接入与AMF网元。在未来通信，如6G中，接入与移动性管理网元仍可以是AMF网元，或有其它的名称，本申请不做限定。当接入与移动性管理网元是AMF网元时，AMF网元可以提供Namf服务。例如，AMF可以提供N1N2消息传输服务(Namf_Communication_N1N2MessageTransfer service)，其他核心网网元可以通过该AMF服务向终端设备发送N1消息或者向接入网设备发送N2消息。
物联管理设备：用于管理物联终端或者处理物联业务的设备。例如，物联管理设备的功能可以包括以下功能中的一项或多项：识别来自操作请求方的业务指令、指示阅读器执行物联终端的接入流程(例如随机接入流程)、收集和/或处理来自物联终端的业务数据、对物联业务进行数据路由等。物联管理设备可以是TMF网元、PIMF网元、或AIMF网元等，本申请对物联管理设备的名称不做限定。
用户面网元：用于分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元，可以包括中间用户面功能(intermediate user plane function，I-UPF)网元、锚点用户面功能(PDU Session anchor user plane function，PSA-UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。UPF网元(也可称为用户面设备)，是核心网设备的一种。UPF网元可以负责用户设备中用户数据的转发和接收。UPF网 元可以从数据网络接收用户数据，通过接入网网元传输给用户设备。用户面功能网元还可以通过接入网网元从用户设备接收用户数据，并将用户数据转发到数据网络。用户面功能网元中为用户设备提供服务的传输资源和调度功能由会话管理功能网元管理控制。
会话管理网元：主要用于会话管理、终端设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理终端设备平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。在5G通信系统中，该会话管理网元可以是会话管理功能(session management function，SMF)网元，可以包括中间会话管理功能(intermediate session management function，I-SMF)网元、锚点会话管理功能(anchor session management function，A-SMF)网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。SMF网元(也可称为会话管理设备)，是核心网设备的一种。SMF网元可用于负责用户设备的会话管理(包括会话的建立、修改和释放)，用户面功能网元的选择和重选、用户设备的互联网协议(internet protocol，IP)地址分配、服务质量(quality of service，QoS)控制等。例如，在5G中，会话管理网元可以是会话管理功能(session management function，SMF)网元。在未来通信系统中，如6G中，会话管理网元仍可以是SMF网元，或有其它的名称，本申请不做限定。当会话管理网元时SMF网元时，SMF网元可以提供Nsmf服务。
认证服务网元：用于鉴权服务、产生密钥实现对终端设备的双向鉴权，支持统一的鉴权框架。在5G通信系统中，该认证服务网元可以是认证服务功能(authentication server function，AUSF)网元。在未来通信系统中，认证服务功能网元仍可以是AUSF网元，或者，还可以有其它的名称，本申请不做限定。
应用功能网元：应用功能网元可以通过应用功能网元与5G系统交互，用于接入网络开放功能网元或与策略框架交互进行策略控制等。在5G通信系统中，该应用功能网元可以是(application function，AF)网元。在未来通信系统中，应用功能网元仍可以是AF网元，或者，还可以有其它的名称，本申请不做限定。
网络开放功能网元：用于提供网络开放的定制功能。在5G通信系统中，该网络开放功能网元可以是网络开放功能(network exposure function，NEF)网元在未来通信系统中，该网络开放功能网元仍可以是NEF网元，或者，还可以有其它的名称，本申请不做限定。5G通信系统还可以通过NEF网元，向外部的应用功能网元开放5GC支持的能力，譬如提供小数据传递能力等。NEF网元(也可以称为网络开放设备)，是核心网设备的一种。网络开放功能网元可用于使3GPP能够安全地向第三方的AF(例如，业务能力服务器(services capability server，SCS)、应用服务器(application server，AS)等)提供网络业务能力等。例如，在5G中，网络开放网元可以是网络开放功能(network exposure function，NEF)网元。在未来通信系统中，如6G中，网络开放网元仍可以是NEF网元，或有其它的名称，本申请不做限定。当网络开放网元是NEF网元时，NEF网元可以向其他网络功能网元提供Nnef服务。
数据管理网元：用于处理终端设备标识，接入鉴权，注册以及移动性管理等。在5G通信系统中，该数据管理网元可以是统一数据管理(unified data management，UDM)网元或统一数据存储库(unified data repository，UDR)网元。在未来通信系统中，统一数据管理仍可以是UDM、UDR网元，或者，还可以有其它的名称，本申请不做限定。本申请实施例中的UDM或UDR网元可以是指用户数据库。可以作为一个存储用户数据的单一逻辑存储库存在。UDM网元(也可以称为统一数据管理设备、数据管理设备、统一数据管理实体)。在5G通信系统中，统一数据管理网元可以是UDM网元或者统一数据管理设备。在未来的通信系统中，统一数据管理网元还可以是UDM网元，或者还可以有其它的名称，本申请实施例不做 限定。统一数据管理设备可以是核心网设备。统一数据管理设备可以是控制面设备。UDR网元(也可以称为用户数据库设备、用户数据库实体)可以理解为统一数据存储网元在5G架构中的命名。其中，用户数据库主要包括以下功能：签约数据、策略数据、应用数据等类型数据的存取功能。
用户设备(user equipment，UE)：可以称终端设备、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。UE还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中或者非陆地网络(non-terrestrial networks，NTN)的终端设备等，还可以是端设备，逻辑实体，智能设备，如手机，智能终端等终端设备，还可以是服务器，网关，基站，控制器等通信设备，或者物联网设备，如标签，无源标签，有源标签，半有源标签、半无源标签、传感器，电表，水表等物联网(internet of things，IoT)设备。UE还可以是具有通信功能的无人机(unmanned aerial vehicle或uncrewed aerial vehicle，UAV)。当终端为无源或者半无源或者半有源的终端或者标签时，可以通过获取能量以接收或者发送数据。获取能量的方式可以通过无线电、太阳能、光能、风能、水能、热能、动能等方式获取。本申请对于无源或者半无源或者半有源的终端获取能量的方式不做限定。本申请实施例对此并不限定。
操作请求方：操作请求方可以理解为发送操作指令的设备，比如操作请求方可以是服务器(server)或者P-IoT server或者应用功能(application function，AF)或者其他发送操作指令的设备。操作请求方可以对应某类用户，该类用户可以包括企业、租户、第三方或者公司，不予限制。其中，操作请求方对应某类用户可以理解为该操作请求方属于该类用户，由该类用户管理。
接入网设备通过射频信号或者无线信号与终端(例如标签)交互。应理解，本申请对接入网设备的名称不做限定，接入网设备还可以命名为其他名称，这里的接入网设备具备本申请中阅读器所涉及的部分或者全部功能，比如具备对终端(比如标签)执行本申请所述的操作(比如获取标签信息、盘点操作、读操作、写操作或者、失效操作或者与标签的消息交互操作等)的功能、具备获取计费相关信息和/或计费信息、向计费功能(charging function，CHF)发送计费信息的功能等。一种可能的实现方式中，接入网设备可以向终端(例如标签)发送来自服务器或者应用功能或者核心网设备的指令，或者接入网设备可以向服务器或者应用功能发送来自终端(例如标签)的消息。一种可能的实现方式中，接入网设备可以根据服务器下发的指令来获取指定的终端(例如标签)中存储的信息。例如若为盘点操作(或者可以称为盘存操作)，接入网设备获取终端(例如标签)的标识信息；该标识信息可以是终端的唯一标识，也可以是终端的临时标识。例如若为读操作，接入网设备则读取该终端的存储区中的数据或者向核心网设备发送来自终端的存储区中的数据。可选的，在一些需要改写终端内存储的信息的场合下，接入网设备可以具有写的功能。例如若为写操作，则接入网设备将数据写入终端(例如标签)的存储区中或者向终端(例如标签)转发来自服务器或者应用功能或者核心网设备的指令，向标签的存储区写入数据。除此之外，接入网设备还可以对终端(例如标签)执行失效操作。在终端(例如标签)被执行失效操作后，该终端(例如标签)失效，该终端(例如标签)不可被执行获取标签信息、盘点操作、读操作、与终端的消息交互操作 或者写操作等操作。一种可能的实现方式中，终端失效不可被执行获取标签信息可以理解为终端失效后，接入网设备无法获取该失效终端的标签信息。另一种可能的实现方式中，终端失效不可被执行与终端的消息交互操作可以理解为终端失效后，接入网设备无法与该失效终端进行消息交互。本申请中，接入网设备可以是杆站、eNodeB、gNodeB、接入回传一体化(integrated access and backhaul，IAB)节点等等，本申请对接入网设备的形态不做限定。本申请中，阅读器可以是接入网设备，也可以是终端设备。本申请对阅读器的形态不做限定。
在介绍本申请提供的一些可能的实施例之前，先整体介绍一下终端的应用标识和/或网络标识分配的几种可能的方式。这样后续在描述各个实施例时，可以直接引用几种可能方式中的一个或多个，从而可以不用重复赘述。图4示出了本申请实施例提供的几种分配终端的应用标识的方式的示例。
方式一：操作请求方分配终端的应用标识，第二核心网设备获取放号数量。
放号数量可以理解为操作请求方(例如企业)允许使用的终端数量。在一种可能的实现方式中，终端为标签，终端数量是标签标识的数量或者是实体标签的数量。两者差异在于，前者是标签标识的数量，若某个标签损坏了，那么可以替换为新标签，但新标签的标签标识可以为原先损坏的标签的标签标识。后者就是标签这个终端本身。本申请实施例中，第二核心网设备可以是UDM、UDR或者其他核心网网元。如图4所示，方式一中分配终端的应用标识包括以下操作：
401.第二核心网设备获取第一信息。
第一信息中可包括放号数量。本申请中，放号数量可以理解为号码的数量、终端的数量或者标识的数量。放号数量可与标识数量、终端数量、号码数量或者数量信息等互换。步骤401一种可能的实现方式如下：第二核心网设备接收运营商的运营业务支撑(business&operation support System，BOSS)系统发送的第一信息(可称为放号消息)。BOSS可替换为运营商对应的其他实体。也就是说，本申请实施例不限定运营商通过哪种方式向第二核心网设备发送第一信息。
在一种可能的实现方式中，第一信息中还可以包括企业标识。企业标识用于标识企业。由于企业可以部署独立的网络，因此第二核心网设备(例如UDM或UDR)可以只服务该企业，因此企业标识是作为可选的参数。对于公共网络场景或者核心网设备是服务多个企业时，企业标识可以用于标识不同的企业。本申请中，企业标识可以理解或者可以替换为操作请求方标识或者用户标识。操作请求方标识可以包括地址信息、标识信息、端口号、服务标识、事务号中的一项或多项。
402.第二核心网设备配置放号数量。
第二核心网设备配置放号数量，以便根据该放号数量执行接入管理。根据放号数量执行接入管理可以包括以下一项或多项：根据放号数量分配终端的网络标识、根据放号数量分配终端的应用标识、根据放号数量确定操作请求方允许使用的终端数量、根据放号数量确定操作请求方已使用的终端数量是否超过该操作请求方允许使用的终端数量。
403.操作请求方获取第二信息。
第二信息中包括放号数量。步骤403一种可能的实现方式如下：操作请求方接收运营商的BOSS系统发送的第二信息(例如可以是放号消息)。BOSS可替换为运营商对应的其他实体。也就是说，本申请实施例不限定运营商通过哪种方式向操作请求方发送第二信息。第一信息和第二信息可相同，也可以不同。例如，第一信息和第二信息均为放号消息，且均包含放号数量。又例如，第一信息包含放号数量和企业标识，第二信息包含放号数量且未包含企 业标识。在方式一中，步骤401和步骤403的先后顺序不作限定。可理解，第二核心网设备执行的操作(步骤401和步骤402)与操作请求方执行的操作(步骤403和步骤404)是相互独立的。
404.操作请求方分配终端的应用标识。
在一种可能的实现方式中，操作请求方根据放号数量分配终端的应用标识。举例来说，放号数量为1万，操作请求方根据放号数量分配1万个终端的应用标识，每个终端对应一个应用标识。
405.第一核心网设备接收来自第二核心网设备的数量信息和/或第一标识信息。
第一核心网设备可以是AMF，也可以是物联管理设备，即具备物联终端管理或者具备处理物联业务功能的设备。所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、所述操作请求方标识中的一项或多项。操作请求方标识用于标识操作请求方。数量信息可包括操作请求方允许使用的终端数量(可以理解为放号数量)。
方式二：操作请求方分配终端的应用标识，运营商分配终端的网络标识并向操作请求方发送终端的网络标识或者操作请求方分配终端的网络标识。
411.第二核心网设备获取第一信息。
步骤411可参阅步骤401。第一信息还可以包括企业标识或者终端的网络标识。在一种可能的实现方式中，终端的网络标识由BOSS系统分配，则在上述第一信息中还可包括终端的网络标识。另一种可能的实现方式中，终端的网络标识由第二核心网设备(例如UDM或UDR)分配，则第一信息中无需包括终端的网络标识。
412.第二核心网设备配置放号数量。
步骤412可参阅步骤402。
413.操作请求方获取第二信息。
步骤413可参阅步骤403。第二信息还可以包括终端的网络标识。若终端的网络标识由BOSS系统分配，则第二信息中还包括终端的网络标识。若终端的网络标识由第二核心网设备(例如UDM或UDR)分配，则第二信息中无需包括终端的网络标识。
414.操作请求方分配终端的应用标识。
步骤414可参阅步骤404。
415.第二核心网设备分配终端的网络标识。
步骤415一种可能的实现方式如下：第二核心网设备根据放号数量分配终端的网络标识。第二核心网设备分配的终端网络标识可以是第二核心网设备为操作请求方分配的终端网络标识，即为操作请求方的终端分配的网络标识。
步骤415可替换为：第一信息包括终端的网络标识，第二核心网设备根据该第一信息获取一个或多个终端的网络标识。
416.第二核心网设备向操作请求方发送终端的网络标识。
步骤415和步骤416是可选的，而非必要的。可理解，若终端的网络标识由第二核心网设备分配，则第二核心网设备可根据放号数量分配终端的网络标识，以便根据终端的网络标识执行接入管理。若终端的网络标识由第二核心网设备分配，则第二核心网设备执行步骤415之后，向操作请求方发送分配的终端网络标识，即执行步骤416。在一种可能的实现方式中，第二核心网设备可以通过NEF向操作请求方发送分配的终端网络标识。若终端的网络标识由运营商分配，第一信息和第二信息中均可包含运营商为操作请求方的终端分配的网络标识，则第二核心网设备可根据第一信息获取终端的网络标识，操作请求方可根据第二信息获取终 端的网络标识。也就是说，若终端的网络标识由运营商分配，则第二核心网设备不必分配终端的网络标识，也不需要执行步骤416。
417.第一核心网设备接收来自第二核心网设备的数量信息和/或第一标识信息。
步骤417可参阅步骤405。
方式三：操作请求方分配终端的应用标识，第二核心网设备获取放号数量和操作请求方分配的终端的应用标识。
421.第二核心网设备获取第一信息。
步骤421可参阅步骤401。
422.第二核心网设备配置放号数量。
步骤422可参阅步骤402。
423.操作请求方获取第二信息。
步骤423可参阅步骤403。
424.操作请求方分配终端的应用标识。
步骤424可参阅步骤404。
425.第二核心网设备获取终端的应用标识。
步骤425一种可能的实现方式如下：第二核心网设备接收操作请求方根据放号数量分配的终端的应用标识。相应地，操作请求方向第二核心网设备发送其分配的终端的应用标识。在一种可能的实现方式中，操作请求方向第二核心网设备发送终端的应用标识列表，即包括一个或多个终端的应用标识的列表。在一种可能的实现方式中，操作请求方向第二核心网设备发送一个消息，该消息包含一个或多个终端应用标识。可选的，操作请求方向第二核心网设备发送的包含终端应用标识的消息还可以包括企业标识。企业标识用于标识企业。由于企业可以部署独立的网络，第二核心网设备可以只服务该企业，因此企业标识是作为可选的参数。对于公共网络场景或者第二核心网设备是服务多个企业时，企业标识可以用于标识不同的企业。一种可能的实现方式中，操作请求方通过NEF向第二核心网设备发送包括一个或多个终端的应用标识的消息。
426.第二核心网设备配置终端的应用标识。
第二核心网设备配置终端的应用标识可以是第二核心网设备存储终端的终端标识与终端应用标识的对应关系，也可以是将该一个或多个终端应用标识配置为操作请求方可用的终端应用标识。
427.第一核心网设备接收来自第二核心网设备的数量信息和/或第一标识信息。
步骤427可参阅步骤405。
方式四：运营商分配终端的应用标识，运营商向操作请求方发送终端的应用标识。
431.运营商的BOSS系统分配终端的应用标识。
步骤431一种可能的实现方式如下：运营商的BOSS系统根据放号数量，分配终端的应用标识。也就是说，运营商的BOSS系统根据操作请求方允许使用的终端数量，为操作请求方分配相应数量的终端应用标识。
432.第二核心网设备获取第一信息。
第一信息包括放号数量和终端应用标识。第一信息包括的终端应用标识可以是步骤431中运营商的BOSS系统为操作请求方分配的终端的应用标识。第一信息还可以包括企业标识。步骤432可参阅步骤401。
433.第二核心网设备配置放号数量和终端的应用标识。
434.操作请求方获取终端的应用标识。
步骤434中，操作请求方获取的终端的应用标识可以是分配给该操作请求方的终端应用标识。
步骤434一种可能的实现方式是：操作请求方接收运营商的BOSS系统发送的终端应用标识。操作请求方还可以通过其他方式从为运营商提供服务的设备获取一个或多个终端应用标识。可选的，操作请求方还可以获取放号数量和/或企业标识。举例来说，操作请求方接收来自运营商的BOSS系统的第二信息，该第二信息包括运营商为操作请求方分配的一个或多个终端应用标识。该第二信息还可以包括放号数量和/或企业标识。
步骤434另一种可能的实现方式是：操作请求方接收第二核心网设备发送的终端应用标识。举例来说，操作请求方接收来自第二核心网设备的第二信息，该第二信息包括运营商为操作请求方分配的一个或多个终端应用标识。该第二信息还可以包括放号数量和/或企业标识。
435.第一核心网设备接收来自第二核心网设备的数量信息和/或第一标识信息。
步骤435可参阅步骤405。
需要说明，方式一至方式四仅为本申请实施例提供的几种可能的分配终端的应用标识和/或网络标识的举例，而不是全部举例。
图4示出了操作请求方、BOSS系统、第二核心网设备以及第一核心网设备实现的几种可能的分配终端的应用标识和/或网络标识的举例。下面结合附图单独描述操作请求方在分配终端的应用标识和/或网络标识的过程中执行的方法流程。
本申请中，第一核心网设备可以是移动管理设备、会话管理设备、策略控制设备、统一数据管理设备、统一数据存储库、网络开放功能设备、用户面设备、或物联管理设备，本申请对第一核心网设备不做限制。本申请中，第二核心网设备可以是移动管理设备、会话管理设备、策略控制设备、统一数据管理设备、统一数据存储库、网络开放功能设备、用户面设备，本申请对第一核心网设备不做限制。
本申请中，终端接入网络可以理解为终端注册网络、终端成功注册核心网或者终端成功执行流程。网络接受终端接入网络可以理解为网络接受终端的注册、网络接受终端的注册请求、网络接受终端注册网络、网络接受终端注册流程、核心网接受终端注册网络、核心网接受终端注册核心网。网络拒绝终端接入网络可以理解为网络拒绝终端的注册、网络拒绝终端的注册请求、网络拒绝终端注册网络、网络拒绝终端注册流程、核心网拒绝终端注册网络、核心网拒绝终端注册核心网。
图5为本申请实施例提供的一种终端管理方法流程图。如图5所示，该方法包括：
501、操作请求方获取数量信息。
所述数量信息指示所述操作请求方允许使用的终端数量。操作请求方获取数量信息可以是操作请求方接收BOSS系统发送的数量信息，可参阅步骤403。
502、操作请求方根据数量信息，获取一个或多个终端应用标识。
步骤502一种可能的实现方式如下：操作请求方根据数量信息，分配一个或多个终端应用标识；其中，操作请求方分配的终端应用标识的个数为操作请求方允许使用的终端数量。举例来说，操作请求方允许使用的终端数量为1万个，该操作请求方分配1万个终端应用标识，每个终端应用标识对应于一个终端。
操作请求方还可执行如下操作：发送操作指令，所述操作指令包括第一终端应用标识，所述第一终端应用标识包含于所述一个或多个终端应用标识；所述操作指令用于对所述第一终端应用标识对应的终端执行操作。这里的操作可包括盘存(或者称为盘点)、请求标签信息、 读、写、失效、安全认证等操作。操作请求方可通过核心网设备、接入网设备向终端发送操作指令。
操作请求方还可执行如下操作：获取网络标识信息，所述网络标识信息包括一个或多个终端网络标识。操作请求方获取网络标识信息可以是接收第二核心网设备发送的一个或多个终端网络标识，也可以是接收来自BOSS系统的一个或多个终端网络标识。
操作请求方还可执行如下操作：向核心网设备发送所述一个或多个终端应用标识和/或所述操作请求方标识。图4中操作请求方向第二核心网设备发送终端应用标识和/或操作请求方标识的操作为向核心网设备发送所述一个或多个终端应用标识和/或所述操作请求方标识的示例。
图5中的方法流程描述的是操作请求方获取一个或多个终端应用标识的一种可能的示例。图5中的方法流程描述了方式一、方式二以及方式三中操作请求方执行的方法流程。步骤501和步骤502可替换为：操作请求方获取一个或多个终端应用标识(参阅步骤434)。操作请求方获取一个或多个终端应用标识可以是接收来自BOSS系统的一个或多个终端应用标识，也可以是接收来自核心网设备的所述一个或多个终端应用标识。例如，第二核心网设备接收来自BOSS系统的第一信息之后，向操作请求方发送一个或多个终端应用标识，该第一信息包含运营商的BOSS系统为操作请求方分配的终端的应用标识。
本申请实施例中，操作请求方根据数量信息，获取一个或多个终端应用标识；以便获取的终端应用标识的个数小于或等于或者不多于操作请求方允许使用的终端数量。
下面结合附图介绍本申请提供的终端管理方法。
图6A为本申请实施例提供的另一种终端管理方法流程图。第一核心网设备在执行图6A中的方法流程之前，可通过执行其在方式一至方式四中执行的操作来获取数量信息和/或第一标识信息。如图6A所示，该方法包括：
601A、第一核心网设备接收来自终端的第一消息。
所述第一消息用于请求接入网络，该网络可以包括核心网、接入网或者其他网络，该网络中可部署有一个或多个核心网设备以及接入网设备。例如，终端请求接入的网络为企业部署的独立的网络或者公共网络或者公共网络集成非公共网络。又例如，终端请求接入的网络为多个企业公用的网络。第一核心网设备可以是移动管理设备AMF，也可以是其他可实现终端管理功能的设备，还可以是物联管理设备。第一消息可以是用于请求接入网络的注册请求消息。第一消息可以是非接入层(non-access stratum，NAS)消息或者其他协议消息，本申请不做限制。
第一核心网设备接收来自终端的第一消息可以是第一核心网设备接收接入网设备转发的终端的第一消息。举例来说，终端向接入网设备发送注册请求消息(第一消息的示例)，第一核心网设备接收该接入网设备向其转发的该注册请求消息。
在一种可能的实现方式中，第一消息包括第一标识信息，该第一标识信息标识该终端。该第一标识信息包括终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
在一种可能的实现方式中，所述第一消息包括标识信息和认证信息，所述标识信息和所述认证信息用于执行所述认证流程；所述标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、所述操作请求方标识中的一项或多项。认证信息可包括随机数、消息认证码(message authentication code，MAC)、校验值、令牌(token)等信息中的一项或多项。
602A、第一核心网设备在根据数量信息确定允许终端接入网络时，向终端所属的操作请求方发送第二消息。
所述数量信息包括所述终端所属的操作请求方允许使用的终端数量，即放号数量。操作请求方允许使用的终端数量可理解为操作请求方被允许使用的终端的数量。第二消息可包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。示例性的，第二消息用于向操作请求方反馈接入网络的终端的标识信息；或者第二消息作为操作请求方请求获取终端信息的响应消息。
在一种可能的实现方式中，第一核心网设备为AMF，第一核心网设备在根据数量信息确定允许终端接入网络时，通过NEF向终端所属的操作请求方发送第二消息。举例来说，第二消息为终端执行来自操作请求方的操作指令得到的操作结果。
步骤602A一种可能的实现方式如下：当所述操作请求方对应的终端中接入所述网络的终端数量小于或等于数量阈值时，所述核心网设备确定允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。操作请求方对应的终端是指属于该操作请求方的终端或者允许被该操作请求方使用的终端。操作请求方对应的终端中接入网络的终端数量可理解为属于该操作请求方的终端中已接入网络的数量。假定属于操作请求方的终端有F个，该F个终端中的H个已接入网络，该操作请求方对应的终端中接入网络的终端数量为H个，F和H均为大于或者等于0的整数。
本申请实施例中，第一核心网设备在根据数量信息确定允许终端接入所述网络时，向该终端所属的操作请求方发送第二消息。也就是说，第一核心网设备发送第二消息之前，需要根据数量信息确定允许终端接入网络，而不是直接允许该终端接入网络。第一核心网设备根据数量信息确定允许终端接入网络，可避免操作请求方对应的终端中接入网络的终端数量大于或等于操作请求方允许使用的终端数量。
图6B为本申请实施例提供的另一种终端管理方法流程图。第一核心网设备在执行图6A中的方法流程之前，可通过执行其在方式一至方式四中执行的操作来获取数量信息和/或第一标识信息。图6B中的方法流程为图6A中描述的方法的一种可能的实现方式。如图6B所示，该方法包括：
601B、第一核心网设备接收来自终端的第一消息。
步骤601B可参阅步骤601A。
602B、第一核心网设备在根据数量信息确定允许终端接入网络时，向第二核心网设备发送第四消息。
第二核心网设备可以是UDM、UDR或其他核心网设备。举例来说，第一核心网设备通过其他核心网设备(例如AUSF)向第二核心网设备发送第四消息。
在一种可能的实现方式中，所述第四消息用于请求对所述终端执行认证流程或鉴权流程。本申请中，认证和鉴权可以是相同的概念，认证和鉴权可以相互替换。认证流程可以是认证终端是否为可信的终端或授权的终端的单向认证；或者认证流程可以是终端认证网络或者操作请求方是否为可信的网络或者操作请求方的单向认证；或者认证流程可以是双向认证，即认证流程包括终端认证网络或者操作请求方，也包括网络或者操作请求方认证终端。
在一种可能的实现方式中，所述第四消息包括第二标识信息和认证信息。所述第二标识信息和所述认证信息用于执行所述认证流程。所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。认证信 息可包括随机数、MAC等。在一种可能的实现方式中，所述第四消息还包括指示信息；所述指示信息指示所述认证流程为单向认证、双向认证、终端对网络或者操作请求方的单向认证、网络或者操作请求方对终端的单向认证中的任一种。一种可能的实现方式中，所述指示信息指示所述认证流程为应用于无源物联网的认证流程。举例来说，第四消息为鉴权请求消息，该第四消息包含的指示信息指示该鉴权为应用于无源物联网的鉴权。
在一种可能的实现方式中，第一核心网设备在接收来自终端的第一消息之后，第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。第一核心网设备确定终端所属的操作请求方，以便根据数量信息确定是否允许终端接入网络。举例来说，第一核心网设备根据第三标识信息和第一对应关系，确定终端所属的操作请求方；所述第一对应关系表示终端属于操作请求方。可选的，第一对应关系包括所述终端的应用标识(终端标识或网络标识)与操作请求方标识的对应关系，所述操作请求方标识为所述操作请求方的标识。第一核心网设备可配置或存储有一个或多个终端与其所属的操作请求方的对应关系，该第一核心网设备可根据该对应关系确定终端所属的操作请求方。又举例来说，第一核心网设备根据来自操作请求方的操作指令，确定第二对应关系，该第二对应关系表示终端属于操作请求方；第一核心网设备根据第一消息包括的第三标识信息和该第二对应关系，确定该终端所属的操作请求方。所述操作指令可包含所述终端的第一标识，该第一标识为终端的终端标识、加密的终端标识、终端应用标识、终端网络标识中的任一项。
603B、第一核心网设备接收来自第二核心网设备的第五消息。
第五消息指示操作请求方成功接收或者未成功接收终端的标识信息，或者第五消息指示终端的认证流程通过或不通过。第五消息可以通知终端其认证结果，以便终端根据该认证结果执行相应的后续操作。第一核心网设备接收第五消息可以是接收其他核心网设备发送的第五消息。第二核心网设备可以是UDM、UDR或其他核心网设备。在一种可能的实现方式中，第一核心网设备为AMF，第一核心网设备接收其他核心网设备(例如UDM或者AUSF)发送的第五消息。举例来说，第一核心网设备为AMF，AMF接收UDM(对应于第二核心网设备)通过AUSF或者接收AUSF(对应于第二核心网设备)向其发送的第五消息。
在一种可能的实现方式中，步骤602B和步骤603B可替换为：第一核心网设备根据所述第一消息对所述终端执行认证流程。所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程。所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。举例来说，第一消息包括终端的应用标识、随机数和消息认证码；第一核心网设备根据终端的应用标识检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。安全参数可以是密钥或者是hash算法。如果是密钥，则消息认证码可以是随机数利用该密钥加密后的值。如果是hash算法，则消息认证码可以是随机数经过该hash算法运算后得到的值。
604B、第一核心网设备向终端，发送第六消息。
所述第五消息指示操作请求方成功接收终端的标识信息或者所述认证流程通过，所述第六消息指示接受所述终端接入所述网络。或者，所述第五消息指示操作请求方未成功接收终端的标识信息或者所述认证流程不通过，所述第六消息指示拒绝所述终端接入所述网络。步 骤604B一种可能的实现方式如下：第一核心网设备根据第五消息向终端，发送第六消息。若第五消息指示操作请求方成功接收终端的标识信息或者指示终端的认证流程通过，第一核心网设备向终端发送指示接受所述终端接入所述网络的第六消息。若第五消息指示操作请求方未成功接收终端的标识信息或者指示终端的认证流程不通过，第一核心网设备向终端发送指示拒绝所述终端接入所述网络的第六消息。也就是说，第一核心网设备可以根据第五消息，向终端发送相应的第六消息。
在一种可能的实现方式中，第一核心网设备还可执行如下操作：获取所述数量信息和/或第一标识信息；所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、所述操作请求方标识中的一项或多项。第一核心网设备还可配置放号数量(或者数量信息)以及第一标识信息。例如，第一核心网设备配置终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、所述操作请求方标识中的一项或多项以及放号数量(或者数量信息)。在一些实施例中，第一核心网设备可以是图4中的第一核心网设备，通过执行方式一至方式四中的任一种方法流程来获取数量信息和/或第一标识信息。应理解，第一核心网设备获取到数量信息和/或第一标识信息之后，才可执行图6A和图6B中的方法流程。
605B、第一核心网设备向终端所属的操作请求方发送第二消息。
本申请实施例中，第一核心网设备向第二核心网设备发送第四消息，以便于对终端执行认证流程，从而保证该终端为可信的终端。
本申请实施例中，第一核心网设备发送第二消息之前，需要根据数量信息确定允许终端接入网络。若第一核心网设备根据数量信息确定不允许终端接入网络，则不必发送用于请求对该终端执行认证流程的第四消息，这样可以减少信令开销。第一核心网设备根据数量信息确定允许终端接入网络，可快速、准确地确定是否对该终端执行认证流程。应理解，第一核心网设备在根据数量信息确定允许终端接入网络时，可以不代表该终端能通过所述认证流程。
图7为本申请实施例提供的另一种终端管理方法流程图。第一核心网设备在执行图6A中的方法流程之前，可通过执行其在方式一至方式四中执行的操作来获取数量信息和/或第一标识信息。图7与图6A是第一核心网设备接收来自终端的第一消息之后，可能执行的两种不同的方法流程。如图7所示，该方法包括：
701、第一核心网设备接收来自终端的第一消息。
步骤701可参阅步骤601B。第一核心网设备可以是AMF，也可以是其他可实现AMF具备的功能的设备，还可以是物联管理设备。
702、第一核心网设备在根据数量信息确定不允许终端接入网络的情况下，向终端发送第三消息。
所述第三消息指示拒绝所述终端接入所述网络。第三消息可以是注册拒绝消息。所述数量信息包括所述终端所属的操作请求方允许使用的终端数量，可以理解为放号数量。
步骤702一种可能的实现方式如下：当操作请求方对应的终端中接入所述网络的终端数量大于或等于数量阈值时，所述第一核心网设备确定不允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
在一种可能的实现方式中，第一核心网设备还可执行如下操作：获取所述数量信息和/或第一标识信息；所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、所述操作请求方标识中的一项或多项。核心网设备还可配置放号数量以及标识信息。例如，第一核心网设备配置终端的终端标识、加密的终端标识、终端应用标识、 终端网络标识、所述操作请求方标识中的一项或多项以及放号数量。在一些实施例中，第一核心网设备可以是图4中的第一核心网设备，通过执行方式一至方式四中的任一种方法流程来获取数量信息和/或第一标识信息。应理解，第一核心网设备获取到数量信息和/或第一标识信息之后，才可执行图7中的方法流程。
本申请实施例中，第一核心网设备在根据数量信息确定不允许终端接入网络的情况下，向终端发送第三消息，不需要对该终端执行认证流程，可以减少不必要的操作，并及时拒绝该终端的接入。
下面结合附图介绍本申请实施例提供的一些可能的终端管理方法流程。
下面结合具体实施例图8，对上述实施例图6A、图6B以及图7中的终端管理方法进行详细的说明。图8为本申请实施例提供的一种终端管理方法交互流程图。图8以阅读器为接入网设备为例进行阐述，该方法也适用于阅读器为终端设备(例如UE)的场景。如图8所示，该方法包括：
801、UDM和操作请求方获取终端的应用标识。
步骤801一种可能的实现方式如下：UDM(或UDR)、操作请求方、运营商的BOSS系统按照上述方式三或者方式四分配终端的应用标识。图8中的UDM为图4中的第二核心网设备的一种示例，图8中的UDM可替换为UDR或者其他核心网网元。参阅图4中的方式三和方式四可知，按照方式三或者方式四分配终端的应用标识，第二核心网设备(例如UDM或者UDR)和操作请求方均可获取终端的应用标识，第一核心网设备(图8中的AMF)可获取数量信息和/或标识信息。图8中的AMF为图4中的第一核心网设备的一种示例。
802、终端初始化。
当终端为标签时，终端初始化可以理解为标签方打印标签。标签打印方可以是运营商，也可以是操作请求方。终端的标签可以由运营商打印或者由运营商授权操作请求方(例如企业)打印。终端初始化内容可包括终端的应用标识。可选的，终端的标签的内容还可以包括安全参数(或者称为安全上下文)。安全参数可以包括预配置密钥、哈希(hash)参数等。预配置密钥可以用于对数据进行加解密或者用于生产或者推衍密钥或者用于执行哈希算法或其他用于执行认证的算法。hash参数用于进行hash运算。哈希运算可以理解为哈希算法(hash)，又称摘要算法(digest)，它的作用是：对任意一组输入数据进行计算，得到一个固定长度的输出摘要。哈希算法最重要的特点就是：相同的输入一定得到相同的输出；不同的输入大概率得到不同的输出。
步骤801和步骤802是可选的。步骤801和步骤802可以是在执行图8中的其他步骤之前预先完成的操作。图8的方法流程中，步骤801和步骤802可视为准备阶段执行的操作，其他步骤为应用阶段执行的操作。应理解，若终端的标签已被打印，且UDM和操作请求方已获取终端的应用标识，则可直接执行图8的方法流程中步骤803之后的步骤(包括步骤803)，以实现终端的接入管理。
803、操作请求方向接入网设备发送操作指令。
操作指令中可以包括一个或多个终端的应用标识。操作请求方可以通过控制面通道或者用户面通道向接入网设备发送操作指令。图8中以操作请求方(例如P-IoT AF)通过控制面通道向接入网设备发送操作指令为例展示。例如，操作请求方可以通过NEF网元、AMF网元向接入网设备发送操作指令。或者，操作请求方可以通过AMF向接入网设备发送操作指令。若通过用户面通道发送，则操作请求方(例如P-IoT服务器)可以通过UPF向接入网设备发送操作指令。
一种可能实现方式中，步骤803可以为操作请求方向核心网设备发送操作指令，由核心网设备通过接入网设备向终端发送操作指令。可以理解的，操作请求方向核心网设备发送的操作指令(或者消息)可以不同于核心网设备向终端发送的操作指令(或者消息)；即核心网设备可以根据来自操作请求方的操作指令，生成向终端发送的操作指令(或者消息)。一种可能的实现方式中，操作请求方与核心网设备采用第一协议通信，核心网设备与终端采用第二协议通信。第一协议可以与第二协议相同，也可以不同。示例性的，第一协议可以是服务化接口协议或者应用编程接口协议(application programming interface)；第二协议可以是NAS协议或者其他非接入层协议。
804、接入网设备与终端交互消息。
在一种可能的实现方式中，接入网设备可以获知操作指令的内容，根据获知的该操作指令的内容执行相应的操作。例如接入网设备与终端交互消息以执行盘点操作、读操作或者写操作。
在另一种可能的实现方式中，接入网设备向终端转发操作指令，并与终端交互消息。
805、终端判断自身的注册状态。
步骤805是可选的，而非必要的。终端可以判断自身的注册状态。若终端未注册，则可以执行步骤805至步骤816；若终端已注册，则可以执行步骤817。若终端无判断其自身的注册状态的能力，或者无记录注册状态的能力，则终端需执行步骤806。
806、终端向接入网设备发送注册请求消息。
注册请求消息(例如registration request)中可包括终端的应用标识。在一种可能的实现方式中，注册请求消息中还可以包括终端标识、加密的终端标识、随机数、消息认证码(message authentication code，MAC)、校验值、token中的一个或多个。注册请求消息可以包括多个随机数和消息认证码。终端标识可以理解为是用于唯一标识终端(或者是唯一标识终端这个物体或者设备)的标识。而加密的终端标识则可以理解为是将终端标识加密后的标识。本申请实施例中，终端一种可能的形态是标签，可将标签标识(tag identifier，TID)作为终端标识的示例，将加密的标签标识(concealed tag Identifier，CTID)作为加密的终端标识的示例。
在一种可能的实现方式中，终端采用预配置的密钥(或者称为预配置密钥)将终端标识加密后获取加密的终端标识。在另一种可能的实现方式中，可以向终端写入加密的终端标识。可能的方式有，操作请求方可以预先生成加密的终端标识，并在打印标签时或者在打印标签之后写入终端(例如标签)中。随机数和消息认证码可以用于鉴别或者认证消息在传输过程中是否有被篡改，或者可以用于网络认证终端是否为可信的终端。终端可生成随机数，并采用安全参数与随机数进行运算以获得消息认证码(也可以称为验证值或者token)。其中，安全参数可以是密钥或者是hash算法。如果是密钥，则消息认证码可以是随机数利用该密钥加密后的值。如果是hash算法，则消息认证码可以是随机数经过该hash算法运算后得到的值。随机数与消息认证码可以包含于注册请求消息中。一种可能的实现方式中，注册请求消息为NAS消息(例如NAS registration request)。
807、接入网设备选择支持P-IoT的AMF。
步骤807是可选的。在一种可能的实现方式中，接入网设备可直接向任意AMF发送来自终端的注册请求消息，不必选择支持P-IoT的AMF。
808、接入网设备向AMF发送来自终端的注册请求消息。
图8中的AMF为图6A、图6B和图7中的第一核心网设备的示例，AMF接收注册请求消息为第一核心网设备接收来自终端的第一消息的示例。
809、AMF根据数量信息确定是否允许终端接入网络。
步骤809一种可能的实现方式如下：当操作请求方对应的终端中接入网络的终端数量小于或者等于数量阈值时，AMF确定允许所述终端接入所述网络；否则，AMF确定不允许所述终端接入所述网络。若AMF确定允许终端接入网络，则执行步骤810；若AMF确定不允许终端接入网络，则执行步骤816，即向终端发送注册拒绝消息。AMF可统计并记录属于同一操作请求方的终端接入网络的数量。举例来说，AMF在一个或多个终端通过认证或鉴权之后，更新该一个或多个终端所属的操作请求方已使用的终端的数量。AMF可根据统计的操作请求方接入网络的终端的数量，确定该操作请求接入网络的终端的数量是否超过数量阈值。
在一种可能的实现方式中，AMF根据数量信息确定允许终端接入网络之后，可以根据注册请求消息中的终端的应用标识获知需要选择支持P-IoT的AUSF；然后，向该AUSF发送鉴权请求消息。一种可能的实现方式中，终端的应用标识不同于第三代合作伙伴(3rd Generation Partnership Project，3GPP)终端的标识如用户隐藏标识(subscription concealed identifier，SUCI)、用户永久标识(subscription permanent identifier，SUPI)、5G全球唯一临时标识(5G globally unique temporary identity，5G-GUTI)、临时移动台标识(temporary mobile subscriber identity，TMSI)等，AMF根据终端的应用标识获知该终端为无源物联终端或者为P-IoT终端，需要选择支持P-IOT的AUSF。在一种可能的实现方式中，AMF可以不选择支持P-IoT的AUSF，而是向任意AUSF发送第一鉴权请求消息。
810、AMF向AUSF发送第一鉴权请求消息。
第一鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中可包括终端的应用标识。步骤810一种可能的实现方式如下：AMF选择支持P-IoT的AUSF，并向其选择的AUSF发送第一鉴权请求消息。步骤810另一种可能的实现方式如下：AMF向任意AUSF发送第一鉴权请求消息。若终端发送的注册请求消息中包含终端标识、加密的终端标识、随机数、消息认证码中的一个或多个，则AMF向AUSF发送的第一鉴权请求消息中可以包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个。在一种可能的实现方式中，AMF向AUSF发送指示信息1(例如P-IoT指示信息)，用于指示第一鉴权请求消息对应的鉴权为应用于无源物联网的鉴权，或者为对无源物联网终端的鉴权。举例来说，第一鉴权请求消息中可包含指示信息1，该指示信息1指示该第一鉴权请求消息用于执行应用于无源物联网的鉴权或者用于对无源物联网终端的鉴权。又举例来说，AMF通过第一鉴权请求消息之外的消息向AUSF发送指示信息1，该指示信息1指示第一鉴权请求消息对应的鉴权为应用于无源物联网的鉴权，或者为用于对无源物联网终端的鉴权。一种可能的实现方式中，指示信息1用于指示该认证流程为单向认证、双向认证、终端对网络或者操作请求方的认证，或者，网络或者操作请求方对终端的认证中的一项或多项。
811、AUSF选择支持P-IoT的UDM。
在一种可能的实现方式中，AUSF根据AMF发送的指示信息1或者根据终端的应用标识获知需要选择支持P-IoT的UDM。一种可能的实现方式中，终端的应用标识不同于3GPP终端的标识如SUCI、SUPI、5G-GUTI、TMSI等，AUSF根据终端的应用标识获知该终端为无源物联终端或者为P-IoT终端，需要选择支持P-IOT的UDM。举例来说，第一鉴权请求消息中包含指示AUSF选择支持P-IoT的UDM的指示信息1，AUSF根据该指示信息1选择支持P-IoT的UDM。
步骤811是可选的。在一种可能的实现方式中，AUSF可以不选择UDM，而是直接向任意UDM发送第二鉴权请求消息。
812、AUSF向UDM发送第二鉴权请求消息。
第二鉴权请求消息(例如Nudm_UEAuthentication GetRequest)中可包括终端的应用标识。如果AMF向AUSF发送的第一鉴权请求消息中包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个，则AUSF向UDM发送的第二鉴权请求消息中可以包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个。一种可能的实现方式，AUSF向UDM发送的第二鉴权请求消息中包含指示信息2(例如P-IoT指示信息)，该指示信息2用于指示第二鉴权请求消息对应的鉴权为应用于无源物联网的鉴权，或者为用于对无源物联网终端的鉴权。一种可能的实现方式中，指示信息2用于指示该认证流程为单向认证、双向认证、终端对网络或者操作请求方的认证，或者，网络或者操作请求方对终端的认证中的一项或多项。
813、UDM根据第二鉴权请求消息对终端进行认证。
在一种可能的实现方式中，第二鉴权请求消息中包括终端的应用标识、随机数和消息认证码；UDM可以根据终端的应用标识检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。安全参数可以是密钥或者是hash算法。如果是密钥，则消息认证码可以是随机数利用该密钥加密后的值。如果是hash算法，则消息认证码可以是随机数经过该hash算法运算后得到的值。在另一种可能的实现方式中，若任意终端通过认证，则UDM标记该应用标识已用；若第二鉴权请求消息中的消息认证码通过验证且终端的应用标识未标记已用，则认为终端的应用标识通过认证。
在一种可能的实现方式中，UDM可以根据AUSF向UDM发送的指示信息2选择对终端进行认证的方法(即选择适用于无源物联网或者无源物联网终端的鉴权方法)。
在一种可能的实现方式中，若AUSF向UDM发送的第二鉴权请求消息中包括终端标识，则UDM可以记录终端的应用标识与终端标识的对应关系。若AUSF向UDM发送的第二鉴权请求消息中包括加密的终端标识，则UDM可以将加密的终端标识进行解密，获取终端标识。UDM可以记录终端的应用标识与终端标识的对应关系，或者，记录终端的应用标识与加密的终端标识的对应关系，或者，记录终端的应用标识、加密的终端标识、终端标识的对应关系。UDM可以根据记录的终端应用标识或者对应关系统计已使用的终端数量。举例来说，第二鉴权请求消息包括终端应用标识1、终端标识1；若UDM已记录有终端应用标识1与终端标识2的对应关系，则判定终端不通过认证，并且统计的操作请求方已使用的终端数量保持不变。在该举例中，UDM已记录有终端应用标识1与终端标识2的对应关系，说明终端应用标识1已被其他终端使用，即终端应用标识1被盗用。可见，UDM可以根据记录的终端应用标识与终端标识(或加密的终端标识)的对应关系，可确定终端应用标识是否被多个终端使用。在一种可能的实现方式中，UDM在终端应用标识已被其他终端使用的情况下，确定终端不通过认证。也就是说，若终端的应用标识被盗用，则确定终端不通过认证。又举例来说，第二鉴权请求消息包括终端应用标识1、终端标识1；若UDM已记录有终端应用标识1，则确定终端不通过认证，并且统计的操作请求方已使用的终端数量保持不变。在该举例中，UDM已记录有终端应用标识1，说明终端应用标识1已被其他终端使用，即终端应用标识1被盗用。又举例来说，第二鉴权请求消息包括终端应用标识1、终端标识1；若UDM未记录有终端应用标识1与其他终端标识的对应关系且未记录有终端应用标识1，则UDM记录终端应用标识1和终端标识1的对应关系，并将操作请求方已使用的终端的数量加一。在该举例中，UDM未记录有终端应用标识1与其他终端标识的对应关系且未记录有终端应用标识1，说明 终端应用标识1未被使用。UDM可以根据记录的终端应用标识或者对应关系统计已使用的终端数量。
814、UDM向AUSF发送第一鉴权响应消息。
第一鉴权响应消息(例如Nudm_UEAuthentication_Get Response)中可以包括认证结果，例如该认证结果可以包括认证通过或者认证不通过。认证通过是指终端通过认证。认证不通过是指终端未通过认证。
一种可能的实现方式中，若认证流程对应于网络对终端的单向认证，或者终端与网络之间的双向认证，则在UDM向AUSF发送的第一鉴权响应消息中，可以包括由UDM生成的随机数与MAC值(或者校验值或token)。示例性的，MAC值可以是UDM根据终端对应的安全参数与该随机数生成MAC值(或者校验值或token)；或者，MAC值可以是UDM根据终端发送的随机数以及UDM生成的随机数与终端对应的安全参数生成MAC值(或者校验值或token)。该MAC值(或者校验值或token)通过核心网向终端发送。终端根据预配置的安全参数以及MAC值(或者校验值或token)解析随机数，并根据解析后的随机数认证网络是否为可信的网络。例如，当解析后的随机数包括终端生成的随机数时，网络为可信的网络。
815、AUSF向AMF发送第二鉴权响应消息。
第二鉴权响应消息(例如Nausf_UEAuthentication_Authenticate Response中可以包括认证结果，例如该认证结果可以包括认证通过或者认证不通过。第二鉴权响应消息中包括的认证结果与第一鉴权响应消息中包括的认证结果相同。
816、AMF向终端发送注册接受消息或者注册拒绝消息。
在一种可能的实现方式中，若终端通过认证，则AMF向终端发送注册接受消息(例如registrationaccept)；若终端没有通过认证，则AMF向终端发送注册拒绝消息(例如registrationreject)。在一种可能的实现方式中，注册接受消息或者注册拒绝消息可以是NAS消息(例如NAS Registration Accept或者NAS Registration Reject)。若终端具有记录注册状态的能力，终端在接收到注册接受消息之后，可以记录其已注册，这样该终端就可判断自身的注册状态。也就是说，终端在未接收到注册接受消息之前，处于未注册状态，表示其未注册；终端在接收到注册接受消息之后，从未注册状态调整为注册状态，表示其已注册。
817、终端向AMF发送NAS消息。
当终端注册成功后，若终端需要向操作请求方(P-IoT AF或者P-IoT服务器)发送信息(例如终端的应用标识)，且终端发送的信息是通过控制面通道向P-IoT AF发送的，则可以通过NAS消息发给AMF，由AMF向P-IoT AF发送(或者由AMF通过NEF向P-IoT AF发送)，如图8所示。
在一种可能的实现方式中，若终端与AMF之间要采用NAS加密机制，则在执行步骤817之前，AMF还需要与终端交互安全参数从而执行NAS安全机制。
在另一种可能的实现方式中，若终端发送的信息是通过用户面通道向P-IoT服务器发送的，则可以通过RRC消息发给接入网设备，由接入网设备通过用户面通道向P-IoT服务器发送(例如接入网设备通过UPF网元向P-IoT服务器发送)。
818、AMF通过NEF向操作请求方发送来自终端的数据。
若终端通过控制面通道向P-IoT AF发送信息，则AMF可以通过NEF向P-IoT AF发送来自终端的数据。例如终端的数据可以包含终端的应用标识、存储于终端的存储区的信息。步骤818可替换为：AMF通过NEF向操作请求方发送来自终端的数据。若终端通过用户面通道向P-IoT服务器发送信息，则终端可通过RRC消息发给接入网设备，由接入网设备通过用 户面通道向P-IoT服务器发送。
819、操作请求方向UDM发送失效信息。
失效信息指示一个或多个失效的终端。若操作请求方有一个或多个终端(例如标签)失效，需要替换失效的终端，则操作请求方可以(通过NEF)向UDM发送失效终端的终端标识(或者加密的终端标识)。失效信息可以包含一个或多个失效的终端的终端标识(或者加密的终端标识)。
820、UDM更新或者删除失效终端的标识信息。
失效终端的标识信息可以包括以下信息中的一项或多项：失效终端的应用标识、网络标识、终端标识、加密的终端标识、第二对应关系，所述第二对应关系包含失效终端的应用标识、网络标识、终端标识、加密的终端标识中的两个或两个以上的对应关系。
步骤820一种可能的实现方式如下：UDM根据失效信息，更新或者删除失效终端的标识信息。举例来说，失效信息指示终端1和终端5失效，UDM删除终端1的应用标识、网络标识、终端标识、加密的终端标识，或者，删除或更新终端1的应用标识、网络标识、终端标识、加密的终端标识中的两个或两个以上的对应关系以及删除终端5的应用标识、网络标识、终端标识、加密的终端标识，或者，删除或更新终端5的应用标识、网络标识、终端标识、加密的终端标识中的两个或两个以上的对应关系。
可理解，步骤806至步骤816为终端注册或接入至网络(例如核心网)的步骤。
在一种可能的实现方式中，UDM执行的步骤813和步骤814可由AMF实现，步骤810至步骤815可替换为：AMF根据终端的应用标识检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。若AMF认为终端通过认证，则向终端发送注册接收消息；若AMF认为终端未通过认证，则向终端发送注册拒绝消息。
本申请实施例中，AMF根据数量信息确定是否允许终端接入网络。若AMF根据数量信息确定不允许终端接入网络，则不必发送用于请求对该终端执行认证流程的消息，这样可以减少信令开销。
本申请实施例中，通过运营商在终端注册至网络之前，UDM获知终端的应用标识，采用终端的应用标识来对终端进行认证。通过统计终端数量，可以防止一个终端的应用标识被多个终端使用，有利于网络进行标签管理与计费。
本申请实施例中，采用终端的应用标识进行接入管理。若需要对终端进行认证，还可以在打印标签时或者打印标签之后或者对标签进行初始化时对终端写入或者配置安全参数，从而在终端注册网络时，向网络发送用于认证的信息(例如随机数和消息认证码)。同时，还可以根据终端标识防止一个终端的应用标识被多个终端使用，有利于运营商对终端进行管理与计费。
下面结合具体实施例图9，对上述实施例图6A、图6B以及图7中的终端管理方法进行详细的说明。图9为本申请实施例提供的另一种终端管理方法交互流程图。图9以阅读器为接入网设备为例进行阐述，该方法也适用于阅读器为终端设备(例如UE)的场景。如图9所示，该方法包括：
901、操作请求方获取终端的应用标识，AMF获取数量信息和/或标识信息。
步骤901一种可能的实现方式如下：操作请求方和运营商的BOSS系统按照方式一分配终端的应用标识。图9中的UDM为图4中的第二核心网设备的一种示例，图9中的UDM可替换为UDR或者其他核心网网元。参阅图4中的方式一可知，按照方式一分配终端的应用标 识，操作请求方可获取终端的应用标识，第二核心网设备(对应于图9中的UDM)没有获取终端的应用标识。图9的方法实施例中，运营商无预配置终端的应用标识，操作请求方分配终端的应用标识。在一种可能的实现方式中，UDM、操作请求方、运营商的BOSS系统执行方式一中的方法流程，这样UDM可配置放号数量，操作请求方可获取终端的应用标识，第一核心网设备(图9中的AMF)可获取数量信息和/或标识信息。
902、终端初始化。
步骤902可参阅步骤802。步骤901和步骤902是可选的。步骤901和步骤902可以是在执行后续步骤之前预先完成的操作。
903、操作请求方向接入网设备发送操作指令。
步骤903可参阅步骤803。
904、接入网设备与终端交互消息。
步骤904可参阅步骤804。
905、终端判断自身的注册状态。
步骤905可参阅步骤805。
906、终端向接入网设备发送注册请求消息。
步骤906可参阅步骤806。
907、接入网设备可以选择支持P-IoT的AMF。
步骤907可参阅步骤807。
908、接入网设备向AMF发送来自终端的注册请求消息。
步骤908可参阅步骤808。
909、AMF根据数量信息确定是否允许终端接入网络。
步骤909可参阅步骤809。若AMF确定允许终端接入网络，则执行步骤910；若AMF确定不允许终端接入网络，则执行步骤916，即向终端发送注册拒绝消息。
910、AMF向AUSF发送第一鉴权请求消息。
步骤910可参阅步骤810。步骤910和步骤810的区别在于，第一鉴权请求消息中未包括终端的应用标识。
第一鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中可包括终端标识(或者加密的终端标识)。在一种可能的实现方式中，第一鉴权请求消息中包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个。
911、AUSF选择支持P-IoT的UDM。
步骤911可参阅步骤811。
912、AUSF向UDM发送第二鉴权请求消息。
步骤912可参阅步骤812。第二鉴权请求消息(例如Nudm_UEAuthentication GetRequest)中可包括终端标识(TID)或者加密的终端标识(CTID)。步骤912和步骤812的区别在于，第二鉴权请求消息中未包括终端的应用标识。如果AMF向AUSF发送的第一鉴权请求消息中包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个，则AUSF向UDM发送的第二鉴权请求消息中可以包括终端标识、加密的终端标识、随机数、消息认证码中的一个或多个。
913、UDM根据第二鉴权请求消息对终端进行认证。
步骤913可参阅步骤813。
在一种可能的实现方式中，第二鉴权请求消息中包括终端的终端标识(或加密的终端标 识)、随机数和消息认证码；UDM可以根据终端的终端标识或者加密的终端标识中的明文部分检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。
914、UDM向AUSF发送第一鉴权响应消息。
步骤914可参阅步骤814。
915、AUSF向AMF发送第二鉴权响应消息。
步骤915可参阅步骤815。
916、AMF向终端发送注册接受消息或者注册拒绝消息。
步骤916可参阅步骤816。
917、终端向AMF发送NAS消息。
步骤917可参阅步骤817。
918、AMF通过NEF向操作请求方发送来自终端的数据。
步骤918可参阅步骤818。
919、操作请求方向UDM发送失效信息。
步骤919可参阅步骤819。
920、UDM更新或者删除失效终端的标识信息。
步骤920可参阅步骤820。
在一种可能的实现方式中，UDM执行的步骤913和步骤914可由AMF实现，步骤910至步骤915可替换为：AMF根据终端的终端标识或者加密的终端标识中的明文部分检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。若AMF认为终端通过认证，则向终端发送注册接收消息；若AMF认为终端不通过认证，则向终端发送注册拒绝消息。
本申请实施例中，UDM在不获取终端的应用标识的情况下，对终端进行接入管理和认证。相比图8中的方法流程，可以满足企业或者用户或者操作请求方的隐私安全需求，即网络不获取终端的应用标识。同理，根据终端标识，网络(即UDM)可以统计使用的终端数量以及防止终端标识盗用的情况。
本申请实施例中，UDM采用终端标识进行接入管理。若需要对终端进行认证，还可以在打印标签时或者打印标签之后对终端写入安全参数，从而在终端注册网络时，向网络发送用于认证的信息(例如随机数和消息认证码)。同时，还可以根据终端标识防止一个终端标识被多个终端使用，有利于运营商对终端进行管理与计费。
下面结合具体实施例图10，对上述实施例图6A、图6B以及图7中的终端管理方法进行详细的说明。图10为本申请实施例提供的另一种终端管理方法交互流程图。图10以阅读器为接入网设备为例进行阐述，该方法也适用于阅读器为终端设备(例如UE)的场景。如图10所示，该方法包括：
1001、操作请求方获取终端的应用标识，UDM获取终端的网络标识。
步骤1001一种可能的实现方式如下：操作请求方、UDM(或UDR)、运营商的BOSS系统按照方式二分配终端的应用标识以及网络标识。参阅图4中的方式二可知，按照方式二分配终端的应用标识和网络标识，操作请求方可获取终端的应用标识，第二核心网设备可获取终端的网络标识。图10中的UDM为图4中的第二核心网设备的一种示例，图10中的UDM 可替换为UDR或者其他核心网网元，图10中的AMF为图4中的第一核心网设备的一种示例。图10的方法实施例中，运营商无预配置终端的应用标识，操作请求方分配终端的应用标识。在一种可能的实现方式中，第二核心网设备(例如UDM或者UDR)、第一核心网设备(例如AMF)操作请求方、运营商的BOSS系统执行方式二中的方法流程，这样第二核心网设备可获取终端的网络标识，操作请求方可获取终端的应用标识，第一核心网设备(图10中的AMF)可获取数量信息和/或标识信息。
1002、终端初始化。
步骤1002可参阅步骤802。步骤1001和步骤1002是可选的。步骤1001和步骤1002可以是在执行后续步骤之前预先完成的操作。
1003、操作请求方向接入网设备发送操作指令。
步骤1003可参阅步骤803。
1004、接入网设备与终端交互消息。
步骤1004可参阅步骤804。
1005、终端判断自身的注册状态。
步骤1005可参阅步骤805。
1006、终端向接入网设备发送注册请求消息。
步骤1006可参阅步骤806。注册请求消息可包括终端的网络标识。在一种可能的实现方式中，注册请求消息中还可以包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个。其中，终端的网络标识为运营商为终端分配的用于实现接入管理或者认证的标识。
1007、接入网设备选择支持P-IoT的AMF。
步骤1007可参阅步骤807。
1008、接入网设备向AMF发送来自终端的注册请求消息。
步骤1008可参阅步骤808。
1009、AMF根据数量信息确定是否允许终端接入网络。
步骤1009可参阅步骤809。若AMF确定允许终端接入网络，则执行步骤1010；若AMF确定不允许终端接入网络，则执行步骤1016，即向终端发送注册拒绝消息。
1010、AMF向AUSF发送第一鉴权请求消息。
步骤1010可参阅步骤810。
第一鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中可包括终端的网络标识。步骤1010和步骤810的一个区别在于，第一鉴权请求消息中包括终端的网络标识。
1011、AUSF选择支持P-IoT的UDM。
步骤1011可参阅步骤811。
1012、AUSF向UDM发送第二鉴权请求消息。
步骤1012可参阅步骤812。第二鉴权请求消息(例如Nudm_UEAuthentication GetRequest)中可包括终端的网络标识。步骤1012和步骤812的区别在于，第二鉴权请求消息中包括终端的网络标识。如果AMF向AUSF发送的第一鉴权请求消息中包括终端的网络标识、终端标识、加密的终端标识、随机数、消息认证码中的一个或多个，则AUSF向UDM发送的第二鉴权请求消息中可以包括终端的网络标识、终端标识、加密的终端标识、随机数、消息认证码中的一个或多个。
1013、UDM根据第二鉴权请求消息对终端进行认证。
步骤1013可参阅步骤813。步骤1013和步骤813的一个区别在于，UDM对终端进行认证或鉴权的方式不同。在一种可能的实现方式中，第二鉴权请求消息中包括终端的网络标识、随机数和消息认证码；UDM可以根据终端的网络标识检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。
一种可能的实现方式中，若AUSF向UDM发送的第二鉴权请求消息中包括终端网络标识、终端应用标识、终端标识、加密的终端标识，则UDM可以记录对应关系。该对应关系包括终端网络标识、终端应用标识、终端标识和加密的终端标识中的两个或两个以上之间的对应关系。若AUSF向UDM发送的第二鉴权请求消息中包括加密的终端标识，则UDM可以将加密的终端标识进行解密，获取终端标识。UDM可以根据该对应关系统计操作请求方已使用的终端数量。
步骤1013一种可能的实现如下：UDM根据第二鉴权请求消息中的终端网络标识，检索安全参数，并根据安全参数和随机数验证消息认证码；若验证通过，则记录终端网络标识，并统计操作请求方已使用的终端数量。举例来说，第二鉴权请求消息中包括终端1的终端网络标识1，UDM在终端1通过验证之后，检查是否记录有该终端网络标识1；若未记录该终端网络标识1，则将操作请求方已使用的终端数量加一；若记录有该终端应用标识1，则保持操作请求方已使用的终端数量不变。
步骤1013另一种可能的实现如下：UDM根据第二鉴权请求消息中的终端网络标识，检索安全参数，并根据安全参数和随机数验证消息认证码；若验证通过，则UDM可以记录该终端网络标识和该终端网络标识的对应关系，该对应关系包括终端网络标识与加密的终端标识、终端标识、终端的应用标识中的一个或多个的对应关系。UDM可以根据该对应关系统计操作请求方使用的终端数量。举例来说，第二鉴权请求消息中包括终端1的终端网络标识1，UDM在终端1通过验证之后，检查是否记录有该终端网络标识1和终端网络标识1的对应关系；若未记录该终端网络标识1且未记录终端网络标识1的对应关系，则将操作请求方已使用的终端数量加一；若记录有该终端应用标识1或者终端应用标识1的对应关系，则保持操作请求方已使用的终端数量不变。
1014、UDM向AUSF发送第一鉴权响应消息。
步骤1014可参阅步骤814。
1015、AUSF向AMF发送第二鉴权响应消息。
步骤1015可参阅步骤815。
1016、AMF向终端发送注册接受消息或者注册拒绝消息。
步骤1016可参阅步骤816。
1017、终端向AMF发送NAS消息。
步骤1017可参阅步骤817。
1018、AMF通过NEF向操作请求方发送来自终端的数据。
步骤1018可参阅步骤818。
1019、操作请求方向UDM发送失效信息。
步骤1019可参阅步骤819。
1020、UDM更新或者删除失效终端的标识信息。
步骤1020可参阅步骤820。
在一种可能的实现方式中，UDM执行的步骤1013和步骤1014可由AMF实现，步骤1010 至步骤1015可替换为：AMF根据终端的网络标识检索安全参数，并根据安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端)；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。若AMF认为终端通过认证，则向终端发送注册接收消息；若AMF认为终端不通过认证，则向终端发送注册拒绝消息。
本申请实施例中，核心网能够在不获取终端的应用标识的情况下，对终端进行接入管理和认证。相比图8中的方法流程，可以满足企业的隐私安全需求，即网络不获取终端的应用标识。相比图9中的方法流程，网络采用终端的网络标识对终端进行接入管理和认证。该机制可以满足企业不将数据上报网络的需求(例如企业不上报终端的应用标识和终端标识的需求)。同理，根据终端标识，网络可以统计使用的终端数量以及防止终端标识盗用的情况。
下面结合具体实施例图11，对上述实施例图6A、图6B以及图7中的终端管理方法进行详细的说明。图11为本申请实施例提供的另一种终端管理方法交互流程图。图11以阅读器为接入网设备为例进行阐述，该方法也适用于阅读器为终端设备(例如UE)的场景。如图11所示，该方法包括：
1101、操作请求方获取终端的应用标识，UDM配置放号数量。
步骤1001一种可能的实现方式如下：操作请求方、第二核心网设备(例如UDM或者UDR)、第一核心网设备(图11中的AMF)、运营商的BOSS系统执行方式一的方法流程。参阅图4中的方式一可知，执行方式一的方法流程，操作请求方可获取终端的应用标识，第二核心网设备可配置放号数量，第一核心网设备(图8中的AMF)可获取数量信息和/或标识信息。图11中的UDM为图4中的第二核心网设备的一种示例，图11中的UDM可替换为UDR或者其他核心网网元，图11中的AMF为图4中的第一核心网设备的一种示例。图11的方法实施例中，运营商无预配置终端的应用标识，操作请求方分配终端的应用标识。
1102、终端初始化。
步骤1102可参阅步骤802。步骤1101和步骤1102是可选的。步骤1101和步骤1102可以是在执行后续步骤之前预先完成的操作。
1103、AMF向接入网设备发送第一指令。
第一指令(可称为在线签约指令)用于执行在线签约或者用于触发终端执行在线签约。或者，第一指令指示终端执行在线签约。
1104、接入网设备接与终端交互消息。
一种可能的实现方式，接入网设备获知第一指令为在线签约指令，接入网设备根据该第一指令与终端交互消息，例如通知或者触发终端执行在线签约。另一种可能的实现方式，接入网设备向终端转发第一指令，接入网设备与终端交互消息，通知或者触发终端执行在线签约。
1105、终端判断签约状态。
在一种可能的实现方式中，终端接收接入网设备转发的第一指令后，可以判断自己的签约状态；若终端为未签约的状态或者未获取签约数据，则终端执行步骤1106；若终端已获取签约数据或者终端为已签约的状态，则可以跳过步骤1106至步骤1116。签约数据可包括终端的标识信息和/或认证信息。标识信息可包括终端网络标识。当终端获取到核心网设备(例如UDM)分配的标识信息和/或认证信息之后，该终端从未签约的状态调整为已签约的状态。或者说，终端未获取到核心网设备(例如UDM)分配的标识信息和/或认证信息之前，该终端未获取签约数据；终端获取到核心网设备(例如UDM)分配的标识信息和/或认证信息之后， 该终端获取到签约数据。
在一种可能的实现方式中，终端通过与接入网设备交互消息获知需要执行在线签约之后，可以判断自己的签约状态；若终端为未签约的状态或者未获取签约数据，则终端执行步骤1106；若终端已获取签约数据或者终端为已签约的状态，则可以跳过步骤1106至步骤1116。
步骤1105是可选的。在一种可能的实现方式中，终端可不执行步骤1105，而是在执行步骤1104之后，直接执行步骤1106。
1106、终端向接入网设备发送第一请求消息。
第一请求消息(例如可以是在线签约请求消息或者注册请求消息，但该注册请求消息是用于指示注册网络执行在线签约)，该第一请求消息用于请求执行在线签约。
在一种可能的实现方式中，第一请求消息可以包括企业标识(或者操作请求方标识或者用户标识)、一个为空集的终端的网络标识(即空的终端网络标识)、随机数、消息认证码中的一个或多个。其中，消息认证码可以是将随机数加密或者经过哈希算法后获得的值。在一种可能的实现方式中，若网络服务多个企业或者用户或者操作请求方，则网络可以根据终端发送的企业标识(或者用户标识或者操作请求方标识)分配网络标识。若网络只服务一个企业(或者用户或者操作请求方)，则终端可以不发送企业标识(或者用户标识或者操作请求方标识)。另一种可能的实现方式中，终端发送的第一请求消息中包括随机数和消息认证码；网络可以在终端通过认证后，为终端分配终端的网络标识。
接入网设备选择支持P-IoT的AMF。
接入网设备可以选择一个支持P-IoT在线签约的AMF。支持P-IoT在线签约的AMF具备执行图11中的AMF执行的操作的功能。
1107、接入网设备选择支持P-IoT的AMF。
接入网设备可以选择一个支持P-IoT在线签约的AMF。支持P-IoT在线签约的AMF具备执行图11中的AMF执行的操作的功能。
1108、接入网设备向AMF发送来自终端的第一请求消息。
第一请求消息中可以包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个。
1109、AMF根据数量信息确定是否允许终端接入网络。
若AMF确定允许终端接入网络，则执行步骤1110；若AMF确定不允许终端接入网络，则执行步骤1116，即向终端发送注册拒绝消息。
1110、AMF向AUSF发送第二请求消息。
第二请求消息(例如可以是鉴权消息、Nausf_UEAuthentication_Authenticate Request)用于请求核心网设备(例如UDM)执行在线签约。若终端发送的第一请求消息包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个，则AMF向AUSF发送的第二请求消息中可以包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个。在一种可能的实现方式中，AMF向AUSF发送指示信息3(例如P-IoT指示信息)，用于指示为在线签约，或者，为无源物联网的在线签约，或者，为无源物联网终端的在线签约。AMF向AUSF发送的指示信息3可包含于第二请求消息，也可以包含于其他消息。
AMF向AUSF发送第二请求消息之前，可选择支持P-IoT(或者支持P-IoT在线签约)的AUSF。支持P-IoT(或者支持P-IoT在线签约)的AUSF具备执行图11中的AUSF执行的操作的功能。在一种可能的实现方式中，AMF可以根据第一请求消息或者根据接入网设备 获知需要选择支持P-IoT(或者支持P-IoT在线签约)的AUSF。一种可能的实现方式，第一请求消息的类型为特定的类型，AMF可以根据第一请求消息的消息类型确定需要选择支持P-IoT(或者支持P-IoT在线签约)的AUSF；另一种可能的实现方式，接入网设备具有支持P-IoT能力的接入网设备，AMF根据接入网设备或者根据接入网设备的能力获知需要选择支持P-IoT(或者支持P-IoT在线签约)的AUSF。
1111、AUSF选择UDM。
AUSF选择支持P-IoT(或者支持P-IoT在线签约)的UDM。支持P-IoT(或者支持P-IoT在线签约)的UDM具备执行图11中的UDM执行的操作的功能。一种可能的实现方式，AUSF根据AMF发送的指示信息3或者根据第二请求消息获知需要选择支持P-IoT(或者支持P-IoT在线签约)的UDM。
1112、AUSF向UDM发送第三请求消息。
第三请求消息(例如可以是鉴权请求消息、Nudm_UEAuthentication GetRequest)用于请求对终端做认证或鉴权。第三请求消息中可以包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个。举例来说，AMF向AUSF发送的第二请求消息中包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个，AUSF向UDM发送的第三请求消息中可以包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个。在一种可能的实现方式中，AUSF向UDM发送指示信息4(例如P-IoT指示信息)，用于指示为在线签约，或者，为无源物联网的在线签约，或者，为无源物联网终端的在线签约。AUSF向UDM发送的指示信息4可包含于第三请求消息，也可以包含于其他消息。
1113、UDM根据企业标识(或者用户标识或者操作请求方标识)执行认证，并在认证通过后分配终端的网络标识。
UDM在终端通过认证之后，还可为终端分配安全参数，该安全参数用于认证该终端。UDM还可记录为终端分配的网络标识和安全参数的对应关系，以便根据该终端的网络标识检索该安全参数。举例来说，终端可利用UDM为其分配的安全参数处理随机数以得到消息认证码；该终端发送的注册请求消息中可包含该随机数和该消息认证码；UDM可根据该终端的网络标识检索安全参数，并利用该安全参数验证该消息认证码。
在一种可能的实现方式中，第三请求消息中包括企业标识(或者用户标识或者操作请求方标识)、空的终端网络标识、随机数、消息认证码中的一个或多个，则UDM根据企业标识(或者用户标识或者操作请求方标识)检索安全参数。UDM根据检索的安全参数和随机数验证消息认证码；若一致，则可以认为终端通过认证(或者认为终端为可信的终端，或者认为终端来自可信的操作请求方)。UDM根据安全参数和随机数验证消息认证码；若不一致，则可以认为终端不通过认证(或者认为终端不为可信的终端)。在一种可能的实现方式中，UDM可以根据AUSF向UDM发送的指示信息4选择鉴权方法(即选择适用于在线签约，或者，适用于无源物联网在线签约，或者，适用于无源物联网终端的在线签约方法)。
在一种可能的实现方式中，UDM分配终端的网络标识之后，UDM可以记录该终端的网络标识与企业标识(或者用户标识或者操作请求方标识)的对应关系。可选的，UDM可以根据终端的网络标识或者该对应关系统计操作请求方使用的终端数量，UDM也可以在后续终端注册的时候统计操作请求方使用的终端数量。UDM可以根据终端的网络标识或者该对应关系统计使用的终端数量可参阅图10中的步骤1013。
1114、UDM向AUSF发送第一响应消息。
第一响应消息(例如可以是鉴权响应消息、Nudm_UEAuthentication_Get Response)中可以包括认证结果。该认证结果例如可以包括认证通过或者认证不通过。若第一响应消息包括的认证结果为认证通过，则该第一响应消息还可包括UDM为终端分配的网络标识和安全参数。若第一响应消息包括的认证结果为认证通过，则该第一响应消息可仅包括该认证结果。
1115、AUSF向AMF发送第二响应消息。
第二响应消息(例如可以是鉴权响应消息、Nausf_UEAuthentication_Authenticate Response中可以包括认证结果，例如可以包括认证通过或者认证不通过。若第二响应消息包括的认证结果为认证通过，则该第二响应消息还可包括UDM为终端分配的网络标识和安全参数。
1116、AMF向终端发送注册接受消息或者注册拒绝消息。
注册接受消息(或者称为在线签约接收消息、在线签约完成消息)可包括为终端分配的网络标识。注册接收消息还可包括安全参数。注册接受消息指示终端的在线签约通过。或者说，注册接受消息指示终端完成在线签约。注册拒绝消息(或者称为在线签约不通过消息、在线签约失败消息等)指示终端的在线签约不通过。或者说，注册拒绝消息指示终端的在线签约失败或未完成。
一种可能的实现方式中，若终端通过认证，则AMF向终端发送在线签约接受消息，或者，在线签约完成消息，或者，注册接受消息(例如registrationaccept)。在线签约接受消息、在线签约完成消息、注册接受消息均包含为终端分配的网络标识。若终端没有通过认证，则AMF向终端发送在线签约失败消息，或者，在线签约不通过消息，或者，注册拒绝消息(例如Registration Reject)。在线签约失败消息、在线签约不通过消息、注册拒绝消息均指示在线签约不通过或终端没有通过认证。
一种可能的实现方式中，注册接受消息或者注册拒绝消息可以是NAS消息或者包含于NAS消息中发送(例如NAS Registration Accept、NAS Onboarding Accept、NAS Onboarding complete、NAS Registration Reject、NAS Onboarding Reject、NAS Onboarding failed)。
1117、操作请求方向接入网设备发送操作指令。
步骤1003可参阅步骤803。
操作指令中可以包括一个或多个终端的应用标识。操作请求方可以通过控制面通道或者用户面通道向接入网设备发送操作指令。图中以操作请求方通过控制面通道向接入网设备发送操作指令为例展示。操作请求方(例如P-IoT AF)可以通过NEF、AMF向接入网设备发送操作指令，或者操作请求方可以通过AMF向接入网设备发送操作指令。若通过用户面通道发送，则操作请求方(P-IoT服务器)可以通过UPF向接入网设备发送操作指令。
1118、接入网设备与终端交互消息。
步骤1118可参阅步骤804。
1119、终端判断自身的注册状态。
步骤1119可参阅步骤805。
1120、终端向AMF发送注册请求消息。
注册请求消息可包括终端的网络标识。一种可能的实现方式中，注册请求消息中还可以包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个。其中，终端的网络标识为运营商为终端分配的用于接入管理或者认证的标识。
步骤1120可替换为：终端通过接入网设备向AMF发送注册请求消息。在一种可能的实现方式中，注册请求消息为NAS消息(例如NAS Registration Request)；终端向接入网设备发送注册请求消息，该接入网设备可以选择支持P-IoT的AMF，并向选择的AMF发送来自 终端的注册请求消息。
1121、AMF向AUSF发送第一鉴权请求消息。
步骤1121可参阅步骤810。
第一鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中可包括终端的网络标识。第一鉴权请求消息用于请求对终端进行认证或鉴权。若终端发送的注册请求消息中包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个，则AMF向AUSF发送的第一鉴权请求消息中可以包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个。在一种可能的实现方式，AMF向AUSF发送指示信息1(例如P-IoT指示信息)，用于指示该鉴权为无源物联网的鉴权，或者为无源物联网终端的鉴权。
可选的，AMF选择支持P-IoT的AUSF。在一种可能的实现方式中，AMF可以根据注册请求消息中的终端的网络标识或者根据指示信息1获知需要选择支持P-IoT的AUSF。一种可能的实现方式中，终端的网络标识不同于3GPP终端的标识如SUCI、SUPI、5G-GUTI、TMSI等，AMF根据终端的应用标识获知该终端为无源物联终端或者为P-IoT终端，需要选择支持P-IOT的AUSF。
1122、AUSF向UDM发送第二鉴权请求消息。
步骤1122可参阅步骤812。
第二鉴权请求消息(例如Nausf_UEAuthentication_Authenticate Request)中可包括终端的网络标识。第二鉴权请求消息用于请求对终端进行认证或鉴权。如果AMF向AUSF发送的第一鉴权请求消息中包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个，则AUSF向UDM发送的第二鉴权请求消息中可以包括终端的应用标识、终端标识(或者加密的终端标识)、随机数、消息认证码中的一个或多个。一种可能的实现方式，AMF向AUSF发送指示信息2(例如P-IoT指示信息)，用于指示该鉴权为应用于无源物联网的鉴权，或者为无源物联网终端的鉴权。一种可能的实现方式中，指示信息2用于指示该认证流程为单向认证、双向认证、终端对网络或者操作请求方的认证，或者，网络或者操作请求方对终端的认证中的一项或多项。
可选的，AUSF选择支持P-IoT的UDM。在一种可能的实现方式中，AUSF根据AMF发送的指示信息或者根据终端的网络标识获知需要选择支持P-IoT的UDM。
1123、UDM根据第二鉴权请求消息对终端进行认证。
步骤1123可参阅步骤1013。
1124、UDM向AUSF发送第一鉴权响应消息。
步骤1124可参阅步骤814。
1125、AUSF向AMF发送第二鉴权响应消息。
步骤1125可参阅步骤815。
1126、AMF向终端发送注册接受消息或者注册拒绝消息。
步骤1126可参阅步骤816。
1127、终端向AMF发送NAS消息。
步骤1127可参阅步骤817。
1128、AMF通过NEF向操作请求方发送来自终端的数据。
步骤1128可参阅步骤818。
1129、操作请求方向UDM发送失效信息。
步骤1129可参阅步骤819。
1130、UDM更新或者删除失效终端的标识信息。
步骤1130可参阅步骤820。
在一种可能的实现方式中，UDM执行的步骤1113和步骤1114可由AMF实现，步骤1110至步骤1115可替换为：AMF根据企业标识执行认证，并在认证通过后分配终端的网络标识。应理解，若终端通过认证，则向终端发送注册接受消息；否则，向终端发送注册拒绝消息。
图11的方法流程中，步骤1101至步骤1116为执行在线签约以获取终端的网络标识的流程，步骤1107至步骤1130为执行注册流程的步骤。
图11中的方法流程与图10中的方法流程相比，终端的网络标识是通过在线签约流程向终端发送的。其有益效果在于，终端的网络标识可以无需提前配置于企业中，可以防止企业将一个终端的网络标识用于多个终端中，即终端获取终端的网络标识可以流程化，更安全。另外，AMF根据数量信息确定是否允许终端接入网络。若操作请求方对应的终端接入网络的终端设备小于或等于数量阈值，则不必为请求执行在线签约的终端(属于该操作请求方)分配网络标识，这样可以减少不必要的操作。
图12示出了一种通信装置1200的结构示意图。该通信装置1200可以对应实现上述各个方法实施例中由核心网设备(例如图4和图6B中的第一核心网设备和第二核心网设备)实现的功能或者步骤，也可实现上述各个方法实施例中由操作请求方实现的功能或者步骤。该通信装置可以包括处理模块1210和收发模块1220。可选的，还可以包括存储单元，该存储单元可以用于存储指令(代码或者程序)和/或数据。处理模块1210和收发模块1220可以与该存储单元耦合，例如，处理模块1210可以读取存储单元中的指令(代码或者程序)和/或数据，以实现相应的方法。上述各个单元可以独立设置，也可以部分或者全部集成。例如收发模块1220可包括发送模块和接收模块。
在一些可能的实施方式中，通信装置1200能够对应实现上述方法实施例中第一核心网设备的操作和功能。例如通信装置1200可以为第一核心网设备，也可以为应用于第一核心网设备中的部件(例如芯片或者电路)。收发模块1220例如可以用于执行图4、图6A、图6B、图7、图8、图9、图10、图11的实施例中由第一核心网设备或AMF所执行的全部接收或发送操作，例如图4所示的实施例中的步骤405、步骤417、步骤427、步骤435以及图6A所示实施例中的步骤601A、步骤602A，和/或用于支持本文所描述的技术的其它过程。处理模块1210用于执行图6A、图6B、图7、图8、图9、图10、图11的实施例中中由第一核心网设备或AMF所执行的除了收发操作之外的全部操作，例如图6A所示的实施例中的步骤602A，图7所示的实施例中的步骤702，图8所示的实施例中的步骤809。
在一些可能的实施方式中，通信装置1200能够对应实现上述方法实施例中第二核心网设备的操作和功能。例如通信装置1200可以为第二核心网设备，也可以为应用于第二核心网设备中的部件(例如芯片或者电路)。收发模块1220例如可以用于执行图4、图6B、图8、图9、图10、图11的实施例中由第二核心网设备所执行的全部接收或发送操作，例如图4所示的实施例中的步骤401、步骤405、步骤411、步骤417、步骤421、步骤425、步骤427、步骤432、步骤435，图6B所示实施例中的步骤602B、步骤603B，图8所示实施例中的步骤812、步骤814、步骤819，和/或用于支持本文所描述的技术的其它过程。处理模块1210用于执行图4、图8、图9、图10、图11的实施例中中由第二核心网设备所执行的除了收发操作之外的全部操作，例如图4所示的实施例中的步骤402、步骤412、步骤415、步骤422、步骤426、步骤433，以及图8所示的实施例中的步骤813和步骤820。
在一些可能的实施方式中，通信装置1200能够对应实现上述方法实施例中操作请求方的操作和功能。例如通信装置1200可以为操作请求方，也可以为应用于操作请求方中的部件(例如芯片或者电路)。收发模块1220例如可以用于执行图4、图5、图6A、图6B、图8、图9、图10、图11的实施例中由操作请求方所执行的全部接收或发送操作，例如图4所示的实施例中的步骤403、步骤413、步骤416、步骤423、步骤425、步骤434，以及图5所示实施例中的步骤501，图6A所示实施例中的步骤602A，图8所示实施例中的步骤803、步骤818、步骤819，和/或用于支持本文所描述的技术的其它过程。处理模块1210用于执行图4、图5、图8、图9、图10、图11的实施例中中由操作请求方所执行的除了收发操作之外的全部操作，例如图4所示的实施例中的步骤401、步骤414、步骤424，图5所示的实施例中的步骤502，以及图8所示的实施例中的步骤801。
图13为本申请实施例提供的另一种通信装置130的结构示意图。图13中的通信装置可以是上述第一核心网设备。图13中的通信装置可以是上述第二核心网设备。图13中的通信装置可以是上述操作请求方。
如图13所示，该通信装置130包括至少一个处理器1320和收发器1310。
在本申请的另一些实施例中，处理器1320和收发器1310可以用于执行上述第一核心网设备执行的功能或操作等。处理器1320例如可执行如下一项多项操作：图6A所示的实施例中的步骤602A，图7所示的实施例中的步骤702，图8所示的实施例中的步骤809。收发器1310例如可执行如下一项或多项操作：图4所示的实施例中的步骤405、步骤417、步骤427、步骤435，图6A所示实施例中的步骤601A、步骤602A。
在本申请的一些实施例中，处理器1320和收发器1310可以用于执行上述第二核心网设备执行的功能或操作等。处理器1320例如可执行如下一项多项操作：图4所示的实施例中的步骤402、步骤412、步骤415、步骤422、步骤426、步骤433，以及图8所示的实施例中的步骤813和步骤820。收发器1310例如可执行如下一项或多项操作：图4所示的实施例中的步骤401、步骤405、步骤411、步骤417、步骤421、步骤425、步骤427、步骤432、步骤435，图6B所示实施例中的步骤602B、步骤603B，图8所示实施例中的步骤812、步骤814、步骤819。
在本申请的一些实施例中，处理器1320和收发器1310可以用于执行上述操作请求方执行的功能或操作等。处理器1320例如可执行如下一项或多项操作：图4所示的实施例中的步骤401、步骤414、步骤424，图5所示的实施例中的步骤502，以及图8所示的实施例中的步骤801。收发器1310可执行如下一项或多项操作：图4所示的实施例中的步骤403、步骤413、步骤416、步骤423、步骤425、步骤434，以及图5所示实施例中的步骤501，图6A所示实施例中的步骤602A，图8所示实施例中的步骤803、步骤818、步骤819。
收发器1310用于通过传输介质和其他设备/装置进行通信。处理器1320利用收发器1310收发数据和/或信令，并用于实现上述方法实施例中的方法。处理器1320可实现处理模块1210的功能，收发器1310可实现收发模块1220的功能。
可选的，通信装置130还可以包括至少一个存储器1330，用于存储程序指令和/或数据。存储器1330和处理器1320耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器1320可能和存储器1330协同操作。处理器1320可能执行存储器1330中存储的程序指令。该至少一个存储器中的至少一个可以包括于处理器中。
本申请实施例中不限定上述收发器1310、处理器1320以及存储器1330之间的具体连接 介质。本申请实施例在图13中以存储器1330、处理器1320以及收发器1310之间通过总线1340连接，总线在图13中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
图14为本申请实施例提供的另一种通信装置140的结构示意图。如图14所示，图14所示的通信装置包括逻辑电路1401和接口1402。图12中的处理模块1210可以用逻辑电路1401实现，图12中的收发模块1220可以用接口1402实现。其中，该逻辑电路1401可以为芯片、处理电路、集成电路或片上系统(system on chip，SoC)芯片等，接口1402可以为通信接口、输入输出接口等。本申请实施例中，逻辑电路和接口还可以相互耦合。对于逻辑电路和接口的具体连接方式，本申请实施例不作限定。
在本申请的一些实施例中，该逻辑电路和接口可用于执行上述第一核心网设备执行的功能或操作等。
在本申请的另一些实施例中，该逻辑电路和接口可用于执行上述第二核心网网设备执行的功能或操作等。
在本申请的另一些实施例中，该逻辑电路和接口可用于执行上述操作请求方执行的功能或操作等。
在本申请的一些实施例中，该逻辑电路和接口可用于执行上述接入网设备2执行的功能或操作等。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行上述实施例的方法。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得上述实施例中的认证鉴权方法被执行。
本申请还提供一种通信系统，包括终端设备、接入网设备1、第二接入网设备以及第三接入网设备。
本申请还提供一种通信系统，包括终端设备、接入网设备2。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以上述权利要求的保护范围为准。

Claims (23)

  1. 一种终端管理方法，其特征在于，包括：
    第一核心网设备接收来自终端的第一消息，所述第一消息用于请求接入网络；
    所述第一核心网设备在根据数量信息确定允许所述终端接入所述网络时，向所述终端所属的操作请求方发送第二消息；所述数量信息包括所述操作请求方允许使用的终端数量，所述第二消息包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  2. 根据权利要求1所述的方法，其特征在于，所述根据数量信息确定允许所述终端接入所述网络包括：
    当所述操作请求方对应的终端中接入所述网络的终端数量小于数量阈值时，所述第一核心网设备确定允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备在根据所述数量信息确定不允许所述终端接入所述网络的情况下，向所述终端发送第三消息；所述第三消息指示拒绝所述终端接入所述网络。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述数量信息确定不允许所述终端接入所述网络包括：
    当所述操作请求方对应的终端中接入所述网络的终端数量大于或等于数量阈值时，所述第一核心网设备确定不允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备向第二核心网设备发送第四消息；所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息和所述认证信息用于执行所述认证流程；所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  6. 根据权利要求5所述的方法，其特征在于，所述第二消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种。
  7. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备根据所述第一消息对所述终端执行认证流程；所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  9. 根据权利要求5或6或7所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备接收第五消息；
    所述第一核心网设备向所述终端，发送第六消息；所述第五消息指示所述认证流程通过， 所述第六消息指示接受所述终端接入所述网络；或者，所述第五消息指示所述认证流程不通过，所述第六消息指示拒绝所述终端接入所述网络。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，所述方法还包括：
    所述核心网设备获取所述数量信息和/或所述第一标识信息。
  11. 一种通信装置，其特征在于，包括：
    收发模块，用于接收来自终端的第一消息，所述第一消息用于请求接入网络；
    所述收发模块，还用于在处理模块根据数量信息确定允许所述终端接入所述网络时，向所述终端所属的操作请求方发送第二消息；所述数量信息包括所述操作请求方允许使用的终端数量，所述第二消息包含第一标识信息，所述第一标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  12. 根据权利要求11所述的装置，其特征在于，
    所述处理模块，具体用于当所述操作请求方对应的终端中接入所述网络的终端数量小于数量阈值时，确定允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
  13. 根据权利要求11或12所述的装置，其特征在于，
    所述收发模块，还用于在所述处理模块根据所述数量信息确定不允许所述终端接入所述网络的情况下，向所述终端发送第三消息；所述第三消息指示拒绝所述终端接入所述网络。
  14. 根据权利要求13所述的装置，其特征在于，
    所述处理模块，具体用于当所述操作请求方对应的终端中接入所述网络的终端数量大于或等于数量阈值时，确定不允许所述终端接入所述网络；所述数量阈值为所述操作请求方允许使用的终端数量。
  15. 根据权利要求11至14任一项所述的装置，其特征在于，
    所述收发模块，还用于向第二核心网设备发送第四消息；所述第四消息用于请求对所述终端执行认证流程；所述第四消息包括第二标识信息和认证信息，所述第二标识信息和所述认证信息用于执行所述认证流程；所述第二标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  16. 根据权利要求15所述的装置，其特征在于，所述第四消息还包括指示信息，所述指示信息指示所述认证流程为单向认证、双向认证、所述终端对所述网络或者所述操作请求方的单向认证、所述网络或者所述操作请求方对所述终端的单向认证中的任一种。
  17. 根据权利要求11至14任一项所述的装置，其特征在于，
    所述处理模块，还用于根据所述第一消息对所述终端执行认证流程；所述第一消息包括第三标识信息和认证信息，所述第三标识信息和所述认证信息用于执行所述认证流程；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  18. 根据权利要求11至17任一项所述的装置，其特征在于，
    所述处理模块，还用于根据所述第一消息包括的第三标识信息，确定所述终端所属的所述操作请求方；所述第三标识信息包括所述终端的终端标识、加密的终端标识、终端应用标识、终端网络标识、操作请求方标识中的一项或多项。
  19. 根据权利要求15或16或17所述的装置，其特征在于，
    所述收发模块，还用于接收第五消息；向所述终端，发送第六消息；所述第五消息指示所述认证流程通过，所述第六消息指示接受所述终端接入所述网络；或者，所述第五消息指 示所述认证流程不通过，所述第六消息指示拒绝所述终端接入所述网络。
  20. 根据权利要求11至19任一项所述的装置，其特征在于，
    所述处理模块，还用于获取所述数量信息和/或所述第一标识信息。
  21. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时，使所述处理器执行权利要求1至10任意一项所述的方法。
  22. 一种通信装置，其特征在于，包括处理器和存储器，
    所述存储器，用于存储计算机程序或指令；
    所述处理器，用于执行存储器中的计算机程序或指令，使得权利要求1-10任一项所述的方法被执行。
  23. 一种通信系统，其特征在于，包括用于执行如权利要求1-10中任一项所述的方法的设备。
PCT/CN2023/072596 2022-01-30 2023-01-17 终端管理方法和核心网设备 WO2023143244A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210114767.1 2022-01-30
CN202210114767.1A CN116567780A (zh) 2022-01-30 2022-01-30 终端管理方法和核心网设备

Publications (1)

Publication Number Publication Date
WO2023143244A1 true WO2023143244A1 (zh) 2023-08-03

Family

ID=87470668

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/072596 WO2023143244A1 (zh) 2022-01-30 2023-01-17 终端管理方法和核心网设备

Country Status (2)

Country Link
CN (1) CN116567780A (zh)
WO (1) WO2023143244A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117793733A (zh) * 2022-09-27 2024-03-29 华为技术有限公司 一种通信方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140204736A1 (en) * 2013-01-18 2014-07-24 Research In Motion Limited System and method for reporting that a maximum number of data contexts is reached
CN105723797A (zh) * 2014-10-17 2016-06-29 联发科技股份有限公司 达到最大承载数目时维护最大承载数目的方法
CN108073955A (zh) * 2016-11-18 2018-05-25 中兴通讯股份有限公司 一种基于rfid实现资产管理的方法及装置
CN110583036A (zh) * 2017-05-29 2019-12-17 华为国际有限公司 网络认证方法、网络设备及核心网设备
WO2020155021A1 (zh) * 2019-01-31 2020-08-06 华为技术有限公司 用于会话建立的方法及终端设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140204736A1 (en) * 2013-01-18 2014-07-24 Research In Motion Limited System and method for reporting that a maximum number of data contexts is reached
CN105723797A (zh) * 2014-10-17 2016-06-29 联发科技股份有限公司 达到最大承载数目时维护最大承载数目的方法
CN108073955A (zh) * 2016-11-18 2018-05-25 中兴通讯股份有限公司 一种基于rfid实现资产管理的方法及装置
CN110583036A (zh) * 2017-05-29 2019-12-17 华为国际有限公司 网络认证方法、网络设备及核心网设备
WO2020155021A1 (zh) * 2019-01-31 2020-08-06 华为技术有限公司 用于会话建立的方法及终端设备

Also Published As

Publication number Publication date
CN116567780A (zh) 2023-08-08

Similar Documents

Publication Publication Date Title
US11451950B2 (en) Indirect registration method and apparatus
EP3657894B1 (en) Network security management method and apparatus
US7370350B1 (en) Method and apparatus for re-authenticating computing devices
WO2020029729A1 (zh) 一种通信方法和装置
WO2004034645A1 (ja) Ｗｌａｎ相互接続における識別情報の保護方法
US20220368684A1 (en) Method, Device, and System for Anchor Key Generation and Management in a Communication Network for Encrypted Communication with Service Applications
WO2021197347A1 (zh) 通信系统、方法及装置
WO2023143244A1 (zh) 终端管理方法和核心网设备
US20220337408A1 (en) Method, Device, and System for Application Key Generation and Management in a Communication Network for Encrypted Communication with Service Applications
KR20230125301A (ko) 인증 방법 및 통신 장치
CN115004635A (zh) 签约信息获取方法及装置
WO2021129803A1 (zh) 一种信息处理方法及通信装置
EP4228303A1 (en) Communication system, communication method and communication apparatus
WO2022252076A1 (zh) 一种报文传输方法以及相关装置
WO2024067046A1 (zh) 一种通信方法及装置
WO2024067047A1 (zh) 一种通信方法及装置
WO2023142569A1 (zh) 一种通信方法、装置、可读存储介质和芯片系统
WO2023116735A1 (zh) 一种终端管理方法及装置
CN101483634B (zh) 一种触发重认证的方法及装置
WO2023169122A1 (zh) 通信方法和装置
US11968530B2 (en) Network authentication for user equipment access to an edge data network
WO2024001241A1 (zh) 一种信息写入方法及装置
WO2023082161A1 (en) Secure information pushing by service applications in communication networks
WO2024065483A1 (en) Authentication procedures for edge computing in roaming deployment scenarios
WO2023168620A1 (zh) 获取用户同意的方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23746126

Country of ref document: EP

Kind code of ref document: A1