WO2023143459A1 - 授权方法及装置 - Google Patents

授权方法及装置 Download PDF

Info

Publication number
WO2023143459A1
WO2023143459A1 PCT/CN2023/073403 CN2023073403W WO2023143459A1 WO 2023143459 A1 WO2023143459 A1 WO 2023143459A1 CN 2023073403 W CN2023073403 W CN 2023073403W WO 2023143459 A1 WO2023143459 A1 WO 2023143459A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
relay
network element
authorization
authorized
Prior art date
Application number
PCT/CN2023/073403
Other languages
English (en)
French (fr)
Inventor
吴义壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023143459A1 publication Critical patent/WO2023143459A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/04—Terminal devices adapted for relaying to or from another terminal or user

Definitions

  • the present application relates to the communication field, in particular to an authorization method and device.
  • D2D communication allows direct communication between terminal devices, which can effectively improve the utilization rate of spectrum resources.
  • a terminal device In D2D communication, a terminal device (referred to as a remote terminal device) can acquire services from a data network with the assistance of another terminal device (referred to as a relay terminal device). That is to say, the remote terminal device can be connected to the network through the relay terminal device.
  • the relay terminal device establishes a connection with the mobile network, a relay communication connection is established between the remote terminal device and the relay terminal device, and the relay terminal device can provide relay services for the remote terminal device through the relay communication connection.
  • Embodiments of the present application provide an authorization method and device, which can ensure the security of establishing a relay communication connection.
  • an authorization method includes: the policy control function network element receives the authorization request message from the access and mobility management function network element, and determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device.
  • the authorization request message includes the relay service code from the terminal device, the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code, and the relay service code is used to identify the connection provided by the relay device for the remote device Service, access and mobility management functions network elements serve terminal equipment.
  • the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the policy control function network element interacts with the access and mobility management function network element to obtain the relay service code from the terminal device, and determines whether the terminal device is authorized according to the adjacent service authorization information of the terminal device
  • the relay service code is used to identify the connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • the authorization request message also includes a public land mobile network identifier, and the authorization request message indicates that the terminal device is a relay terminal device.
  • the authorization request message indicates that the terminal device is a relay terminal device.
  • the adjacent service authorization information of the terminal device it is determined whether the terminal device is authorized to use Following the service code, it may include: according to the adjacent service authorization information, determine the Whether the device is authorized to use the relay service code and whether it is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the terminal device is a relay terminal device, verify whether the terminal device is authorized to provide the relay service identified by the relay service code for the remote terminal device, and whether it is authorized to serve as the remote terminal device in the public land mobile network Relay service, which can ensure that the relay terminal equipment uses the authorized relay service code and relays services for the remote terminal equipment in the public land mobile network network corresponding to the authorized public land mobile network identifier, which can also be understood as ensuring that the relay terminal
  • the device uses the authorized relay service code to relay services for the remote terminal device in the public land mobile network network corresponding to the authorized public land mobile network identifier, thereby improving security.
  • the determination of whether the terminal device is authorized to use the relay service code and whether it is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier according to the adjacent service authorization information includes: Determine whether the proximity service authorization information includes the relay service code and the public land mobile network identifier. If yes, the terminal device is authorized to use the relay service code and to relay services in the public land mobile network corresponding to the public land mobile network identifier. If the proximity service authorization information does not include the relay service code, the terminal device is not authorized to use the relay service code. If the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the proximity service authorization information includes the relay service code and the public land mobile network identifier, it is confirmed that the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier .
  • being authorized to use the relay service code may be understood as the terminal device being authorized to provide the relay service corresponding to the relay service code as the relay terminal device.
  • the authorization request message indicates that the terminal device is a remote terminal device
  • determining whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device may include: determining the proximity service authorization Whether the message includes a relay service code. If yes, the terminal device is authorized to use the relay service code as a remote terminal device. Otherwise, the terminal device is not authorized to use the relay service code as a remote terminal device.
  • verifying whether the adjacent service authorization information corresponding to the terminal device includes a relay service code can ensure that the relay terminal device uses the authorized remote service code, thereby improving security.
  • the terminal device is authorized to use the relay service code as the remote terminal device, which can be understood as the terminal device uses the relay service corresponding to the relay service code as the remote terminal device.
  • the authorization request message indicates that the terminal device is a remote terminal device
  • determining whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device may include: The proximity service authorization information to determine whether the terminal device is authorized to use the relay service code.
  • the proximity service authorization information may include proximity service authorization information corresponding to a terminal device as a remote terminal device, and may also include proximity service authorization information corresponding to a terminal device as a relay terminal device.
  • the authorization request message indicates that the terminal device is a relay terminal device
  • determining whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device may include: The proximity service authorization information to determine whether the terminal device is authorized to use the relay service code.
  • the proximity service authorization information may include proximity service authorization information corresponding to the terminal device as a relay terminal device, and may also include proximity service authorization information corresponding to the terminal device as a remote terminal device.
  • the authorization method provided in the first aspect may further include: sending an authorization response message to the access and mobility management functional network element.
  • the authorization response message may indicate whether the terminal device is authorized to use the relay service code.
  • the authorization response message may indicate authorization or unauthorized, or the authorization response message may indicate authorization success or authorization failure.
  • the authorization request message further includes one or more of the following: terminal indication information, an identifier of the terminal device, and a context identifier of the terminal device.
  • the terminal indication information may be used to indicate that the terminal device is a remote terminal device or a relay terminal device.
  • the terminal indication information can be used to instruct the terminal device to request authentication as a remote terminal device, or to request authentication as a relay terminal device
  • the nearby service authorization information is determined according to the identifier of the terminal device and/or the context identifier of the terminal device.
  • an authorization method may include: receiving a non-access stratum request message from a terminal device, sending an authorization request message to a policy control function network element in response to the non-access stratum request message, and receiving an authorization response message from the policy control function network element.
  • the non-access stratum request message includes a relay service code, and the relay service code is used to identify the connection service provided by the relay device for the remote device.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the authorization request message also includes a public land mobile network identifier.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code, specifically: indicates whether the terminal device is authorized to use the relay service code and whether it is authorized to use the relay service code corresponding to the public land mobile network identifier.
  • Relay service in public land mobile network It can also be understood as: indicating whether the relay terminal device is authorized to use the authorized relay service code to relay services for the remote device in the public land mobile network network corresponding to the public land mobile network identifier.
  • the non-access stratum request message also includes the proximity service key identifier
  • the authorization response message indicates that the terminal device is authorized to use the relay service code and the public land mobile network identifier corresponding to the public land mobile network.
  • the authorization method provided by the second aspect further includes: sending an authentication server function network element identification acquisition request message to the unified data management network element.
  • the authentication server function network element identifier acquisition request message may include the adjacent service key identifier.
  • the authorization method provided in the second aspect further includes: sending a proximity service request message to the authentication server functional network element.
  • the proximity service request message may include a relay service code.
  • the authorization method provided by the second aspect further includes: sending a non-access stratum response message to the terminal device.
  • the non-access stratum response message may indicate that the request fails.
  • the authorization method provided in the second aspect further includes: determining whether the terminal device is authorized as a remote terminal according to the nearby service subscription information of the terminal device equipment or relay terminal equipment.
  • the second aspect provides The authorization method further includes: determining whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information of the terminal device.
  • the authorization method provided in the second aspect may further include: determining whether the terminal device is a relay terminal device or a remote terminal device according to a non-access stratum request message.
  • the authorization request message further includes one or more of the following: terminal indication information, an identifier of the terminal device, and a context identifier of the terminal device.
  • the terminal indication information may be used to indicate that the terminal device is a remote terminal device or a relay terminal device.
  • an authorization method includes: obtaining the relay service code of the terminal device, and determining whether the terminal device is authorized to use the relay service code according to the authorization information of the adjacent service of the terminal device.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device, and the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the access and mobility management function network element obtains the relay service code of the terminal device, and determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device, and the relay The service code is used to identify the connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • the terminal device is a remote terminal device
  • determining whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device may include: determining whether the proximity service authorization information includes Follow the service code. If yes, the terminal device is authorized to use the relay service code as a remote terminal device. Otherwise, the terminal device is not authorized to use the relay service code as a remote terminal device. In this way, for the case where the terminal device is a remote terminal device, verifying whether the adjacent service authorization information corresponding to the terminal device includes a relay service code can ensure that the relay terminal device uses the authorized relay service code, thereby improving security.
  • the authorization method provided by the third aspect may include: when the terminal device is authorized to use the relay service code as a remote terminal device, sending a proximity service request to the functional network element of the authentication server information.
  • the proximity service request message may include a relay service code.
  • the access and mobility management functional network element triggers the derivation process of the adjacent service key identifier to the authentication server functional network element, which can ensure that the authentication
  • the authorization server function network element deduces the adjacent service key identification corresponding to the authorized terminal equipment, which can improve security.
  • the terminal device is a relay terminal device
  • determining whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device may include: determining whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information Whether the device is authorized to use the relay service code and whether it is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the public land mobile network identifier is the identifier of the network served by the access and mobility management functional network element.
  • the terminal device is a relay terminal device
  • verifying whether the terminal device is authorized to use the relay service identified by the relay service code and whether it is authorized to use the proximity service on the public land mobile network can ensure that the relay terminal device can use Authorized relay service codes and public land mobile network identities for increased security.
  • the determination of whether the terminal device is authorized to use the relay service code and whether it is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier according to the adjacent service authorization information may include : Determine whether the proximity service authorization information includes the relay service code and the public land mobile network identifier. If yes, the terminal device is authorized to use the relay service code and to relay services in the public land mobile network corresponding to the public land mobile network identifier. If the proximity service authorization information does not include the relay service code, the terminal device is not authorized to use the relay service code. If the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the proximity service authorization information includes the relay service code and the public land mobile network identifier, it is confirmed that the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier .
  • the authorization method provided by the third aspect may include: when the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier
  • an authentication server function network element identifier acquisition request message or a key acquisition request message is sent to the unified data management network element.
  • the authentication server function network element identifier acquisition request message may include a nearby service key identifier or a subscription concealment identifier
  • the key acquisition request message may include an adjacent service key identifier or a subscription concealment identifier.
  • the corresponding key is obtained only when the terminal device authorization check is passed (that is, the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier), Establish a relay communication connection, which can improve security.
  • the authorization method provided in the third aspect may include: when the terminal device is not authorized to use the relay service code and/or is not authorized to be in the public land mobile network corresponding to the public land mobile network identifier
  • a non-access stratum response message is sent to the terminal device.
  • the non-access stratum response message may indicate that the request fails.
  • the acquisition of the relay service code of the terminal device may include: receiving a non-access stratum request message from the terminal device.
  • the non-access stratum request message may include a relay service code.
  • the acquisition of the relay service code of the terminal device may include: receiving an authorization request message from a unified data management network element.
  • the authorization request message may include a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the unified data management network element can request an authorization check from the access and mobility management function network element, and trigger the access and mobility management function network element to check whether the terminal device is authorized to use the relay service code.
  • the authorization method provided by the third aspect may include: determining whether the terminal device is authorized to serve as the relay terminal device according to the nearby service subscription information of the terminal device. In this way, the access and mobility management function network element can determine whether the terminal device is authorized as a relay terminal device, which can improve security.
  • the above-mentioned determination of whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device may include: when the terminal device is authorized as a remote terminal device or In the case of a relay terminal device, it is determined whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device. In this way, it can avoid the access and mobility management functional network element determining whether the terminal device is authorized to use the relay service code when the terminal device is not authorized as a remote terminal device or a relay terminal device, thereby saving power consumption.
  • the authorization method provided by the third aspect may include: sending an authorization response message to a unified data management network element.
  • the authorization response message may indicate whether the terminal device is authorized to use the relay service code.
  • the authorization response message may indicate authorization or unauthorized, or the authorization response message may indicate authorization success or authorization failure.
  • the authorization method provided by the third aspect may include: receiving a communication message from a network element with a policy control function.
  • the communication message may include the proximity service authorization information. That is to say, the adjacent service authorization information may be obtained by the access and mobility management functional network element from the policy control functional network element.
  • the proximity service authorization information may be sent by the network element with the policy control function to the network element with the access and mobility management function during the registration process of the terminal device, or during the process of actively requesting a policy by the terminal device, or detected by the network element with the policy control function After the policy is updated, it is actively issued to the access and mobility management function network element, or is actively requested by the access and mobility management function network element.
  • the communication message may further include a policy container, and the policy container may include nearby service policy information, and the nearby service policy information is used for the terminal device to obtain the nearby service communication service.
  • the authorization method provided by the third aspect may include: sending an authorization information request message to a network element with a policy control function.
  • the authorization information request message may be used to request the proximity service authorization information of the terminal device.
  • the access and mobility management function network element can actively request the adjacent service authorization information from the policy control function network element
  • an authorization method includes: receiving an authentication server functional network element identifier acquisition request message from an access and mobility management functional network element, and sending an authorization to the access and mobility management functional network element determined according to the adjacent service key identifier or the subscription concealment identifier
  • the request message receives the authorization response message from the access and mobility management function network element determined according to the adjacent service key identifier or the subscription concealment identifier.
  • the authentication server function network element identifier acquisition request message includes the adjacent service key identifier and the relay service code
  • the authentication server function network element identifier acquisition request message includes the subscription concealment identifier and the relay service code
  • the relay service code uses It is used to identify the connection service provided by the relay device for the remote device.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the authorization method provided in the fourth aspect may include: determining whether the terminal device is authorized as the remote terminal device according to the nearby service subscription information of the terminal device.
  • the sending of the authorization request message to the access and mobility management function network element determined according to the adjacent service key identifier or the subscription concealment identifier includes: when the terminal equipment is authorized as a remote terminal equipment Next, send an authorization request message to the access and mobility management functional network element determined according to the adjacent service key identifier or the subscription concealment identifier.
  • the authorization method provided in the fourth aspect may include: sending an authentication The server function network element identifier obtains a response message.
  • the authentication server function network element identifier obtains the response message It may include the identity of the authentication server function network element instance.
  • the authorization method provided in the fourth aspect may include: sending a proximity service request message to the authentication server functional network element .
  • the proximity service request message may include a permanent subscription identifier, a relay service code and a random number.
  • the authorization method provided in the fourth aspect may include: receiving a proximity service response message from the authentication server functional network element, and sending a key acquisition response message to the access and mobility management functional network element.
  • the proximity service response message may include key and freshness parameters.
  • the Key Acquisition Response message includes key and freshness parameters.
  • an authorization method includes: receiving a policy control creation request message or a policy control update request message from an access and mobility management function network element, and sending a policy control creation response message or a policy control update response to the access and mobility management function network element Message, to send communication messages to network elements with access and mobility management functions.
  • the policy control creation request message includes the terminal device's subscription permanent identifier and the terminal device policy container
  • the policy control update request message includes the terminal device policy container
  • the terminal device policy container includes one or more of the following: policy segment identifier, operating system identifier , an indication that the terminal device supports an access network discovery and selection policy, and an indication of an adjacent service policy provision request.
  • the policy control create response message includes a policy control request trigger parameter.
  • the communication message includes the near service authorization information and the policy container of the terminal equipment.
  • the proximity service authorization information indicates the authorized relay service for the terminal device, and the policy container may include proximity service policy information, which is used for the terminal device to obtain the proximity service communication service.
  • an authorization method includes: determining that the adjacent service policy information of the terminal equipment is updated, and sending a communication message to a network element with access and mobility management functions.
  • the communication message includes the adjacent service authorization information of the terminal device and the policy container
  • the adjacent service authorization information indicates the relay service authorized by the terminal device
  • the policy container may include the adjacent service policy information
  • the adjacent service policy information is used for the terminal device to obtain the adjacent service Communication service.
  • an authorization method includes: receiving an authorization information request message from an access and mobility management function network element, and sending a communication message to the access and mobility management function network element.
  • the authorization information request message is used to request the proximity service authorization information of the terminal device.
  • the communication message includes the proximity service authorization information of the terminal device, the proximity service authorization information indicates the authorized relay service of the terminal device, and the proximity service policy information is used for the terminal device to obtain the proximity service communication service.
  • the communication message further includes authorization indication information, and the authorization indication information may indicate that the proximity service authorization information is the proximity service authorization information corresponding to the terminal device serving as the relay terminal device or the remote terminal device.
  • a communication device in an eighth aspect, includes: a transceiver module and a processing module.
  • the transceiver module is used to receive the authorization request message from the access and mobility management function network element.
  • the authorization request message includes the relay service code from the terminal device
  • the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code
  • the relay service code is used to identify the connection provided by the relay device for the remote device Serve.
  • a processing module configured to determine whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device. Wherein, the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the authorization request message also includes the public land mobile network identifier
  • the processing module is also used to determine whether the terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network according to the adjacent service authorization information.
  • the relay service in the public land mobile network corresponding to the mobile network identifier.
  • the processing module is further configured to determine whether the proximity service authorization information includes a relay service code and a public land mobile network identifier. If yes, the terminal device is authorized to use the relay service code and to relay services in the public land mobile network corresponding to the public land mobile network identifier. If the proximity service authorization information does not include the relay service code, the terminal device is not authorized to use the relay service code. If the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the authorization request message indicates that the terminal device is a remote terminal device
  • the processing module is further configured to determine whether the proximity service authorization information includes a relay service code. If yes, the terminal device is authorized to use the relay service code as a remote terminal device. Otherwise, the terminal device is not authorized to use the relay service code as a remote terminal device.
  • the transceiver module is further configured to send an authorization response message to the access and mobility management function network element.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the authorization request message further includes one or more of the following: terminal indication information, an identifier of the terminal device, and a context identifier of the terminal device.
  • the terminal indication information is used to indicate that the terminal device is a remote terminal device or a relay terminal device.
  • the nearby service authorization information is determined according to the identifier of the terminal device and/or the context identifier of the terminal device.
  • the transceiver module described in the eighth aspect may include a receiving module and a sending module.
  • the receiving module is used for receiving data and/or signaling from the access and mobility management functional network element;
  • the sending module is used for sending data and/or signaling to the access and mobility management functional network element. This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the eighth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the eighth aspect can execute the method described in the first aspect.
  • the communication device described in the eighth aspect may be a network element with a policy control function, or a chip (system) or other components or components that can be set on a network element with a policy control function, which is not limited in this application .
  • a communication device in a ninth aspect, includes: a sending module and a receiving module.
  • the receiving module is configured to receive a non-access stratum request message from a terminal device.
  • the non-access stratum request message The information includes a relay service code, which is used to identify the connection service provided by the relay device for the remote device.
  • a sending module configured to send an authorization request message to the policy control function network element in response to the non-access stratum request message.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the receiving module is also used for receiving the authorization response message from the policy control function network element.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the authorization request message may also include a public land mobile network identifier.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code, specifically: indicating whether the terminal device is authorized to use the relay service code and whether it is authorized to correspond to the public land mobile network identifier Relay service in the public land mobile network.
  • the non-access stratum request message may also include an adjacent service key identifier
  • the sending module is also configured to send an authentication server function network element identifier acquisition request message to the unified data management network element.
  • the authentication server function network element identifier acquisition request message may include the adjacent service key identifier.
  • the sending module is further configured to send a proximity service request message to the authentication server functional network element when the authorization response message indicates that the terminal device is authorized to use the relay service code.
  • the proximity service request message may include a relay service code.
  • the sending module is further configured to indicate in the authorization response message that the terminal device is not authorized to use the relay service code and/or not authorized to be in the public land mobile network corresponding to the public land mobile network identifier
  • a non-access stratum response message is sent to the terminal device.
  • the non-access stratum response message indicates that the request fails.
  • the communication device provided in the ninth aspect further includes: a processing module.
  • the processing module is configured to determine whether the terminal device is authorized as a relay terminal device according to the nearby service subscription information of the terminal device when the terminal device is a relay terminal device.
  • the communication device provided in the ninth aspect further includes: a processing module.
  • the processing module is further configured to determine whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information of the terminal device when the terminal device is a remote terminal device.
  • the processing module is further configured to determine whether the terminal device is a relay terminal device or a remote terminal device according to the non-access stratum request message.
  • the authorization request message may also include one or more of the following: terminal indication information, terminal device identifier, and terminal device context identifier.
  • the terminal indication information may be used to indicate that the terminal device is a remote terminal device or a relay terminal device.
  • the receiving module and the sending module can be set separately, or can be integrated into one module, that is, the transceiver module. This application does not specifically limit the specific implementation manners of the receiving module and the sending module.
  • the communication device described in the ninth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the ninth aspect can execute the method described in the second aspect.
  • the communication device described in the ninth aspect may be an access and mobility management function network element, or a chip (system) or other components or components that can be set on the access and mobility management function network element. Applications are not limited to this.
  • a communication device in a tenth aspect, includes: a transceiver module and a processing module.
  • the transceiver module is used to obtain the relay service code of the terminal device.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device.
  • a processing module configured to determine whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device. Wherein, the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the terminal device is a remote terminal device
  • the processing module is configured to determine whether the proximity service authorization information includes a relay service code. If yes, the terminal device is authorized to use the relay service code as a remote terminal device. Otherwise, the terminal device is not authorized to use the relay service code as a remote terminal device.
  • the transceiver module is further configured to send a proximity service request message to an authentication server functional network element when the terminal device is authorized to use the relay service code as a remote terminal device.
  • the proximity service request message may include a relay service code.
  • the terminal device is used as a relay terminal device, and the processing module is also used to determine whether the terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network identification according to the adjacent service authorization information.
  • the public land mobile network identifier is an identifier of the network served by the communication device.
  • the processing module is further configured to determine whether the proximity service authorization information includes a relay service code and a public land mobile network identifier. If yes, the terminal device is authorized to use the relay service code and to relay services in the public land mobile network corresponding to the public land mobile network identifier. If the proximity service authorization information does not include the relay service code, the terminal device is not authorized to use the relay service code. If the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the transceiver module is also used to report to the unified
  • the data management network element sends an authentication server function network element identifier acquisition request message or a key acquisition request message.
  • the authentication server function network element identifier acquisition request message may include a nearby service key identifier or a subscription concealment identifier
  • the key acquisition request message includes an adjacent service key identifier or a subscription concealment identifier.
  • the transceiver module is also used for the case where the terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier
  • send a non-access stratum response message to the terminal device wherein, the non-access stratum response message indicates that the request fails.
  • the transceiver module is further configured to receive a non-access stratum request message from a terminal device.
  • the non-access stratum request message may include a relay service code.
  • the transceiver module is further configured to receive an authorization request message from a unified data management network element.
  • the authorization request message may include a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the processing module is further configured to determine whether the terminal device is authorized to serve as the relay terminal device according to the subscription information of the terminal device's nearby service.
  • the processing module is also used to In the case of backup or relay terminal equipment, determine whether the terminal equipment is authorized to use the relay service code according to the adjacent service authorization information of the terminal equipment.
  • the transceiver module is further configured to send an authorization response message to the unified data management network element.
  • the authorization response message may indicate whether the terminal device is authorized to use the relay service code.
  • the transceiver module is further configured to receive a communication message from a network element with a policy control function.
  • the communication message includes the proximity service authorization information.
  • the transceiver module is further configured to send an authorization information request message to a network element with a policy control function.
  • the authorization information request message may be used to request the proximity service authorization information of the terminal device.
  • the transceiver module described in the tenth aspect may include a receiving module and a sending module.
  • the receiving module is used to receive data and/or signaling from terminal equipment, access network equipment, policy control function network element, unified data management network element, and authentication server function network element;
  • the sending module is used to send the terminal equipment , an access network device, a policy control function network element, a unified data management network element, and an authentication server function network element to send data and/or signaling.
  • This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the tenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the tenth aspect can execute the method described in the third aspect.
  • the communication device described in the tenth aspect may be an access and mobility management function network element, or a chip (system) or other components or components that can be set on the access and mobility management function network element. Applications are not limited to this.
  • a communication device In an eleventh aspect, a communication device is provided.
  • the authorization method includes: a sending module and a receiving module.
  • the receiving module is configured to receive an authentication server functional network element identification acquisition request message from the access and mobility management functional network element.
  • the authentication server function network element identifier acquisition request message includes the adjacent service key identifier and the relay service code, or the authentication server function network element identifier acquisition request message includes the subscription concealment identifier and the relay service code, and the relay service code uses It is used to identify the connection service provided by the relay device for the remote device.
  • a sending module configured to send an authorization request message to the access and mobility management function network element determined according to the adjacent service key identifier or the subscription concealment identifier.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the receiving module is further configured to receive an authorization response message from the access and mobility management function network element determined according to the adjacent service key identifier or the subscription concealment identifier.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the communication device provided in the eleventh aspect may further include: a processing module.
  • the processing module is configured to determine whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information of the terminal device.
  • the sending module is also configured to send the access and mobility management function network element determined according to the adjacent service key identifier or subscription concealment identifier when the terminal equipment is authorized as a remote terminal equipment Send an authorization request message.
  • the sending module is further configured to indicate in the authorization response message that the terminal device is authorized In the case of the right to use the relay service code, send the authentication server function network element identifier acquisition response message to the access and mobility management function network element.
  • the authentication server function network element identifier acquisition response message may include the authentication server function network element instance identifier.
  • the sending module is further configured to send a proximity service request message to the authentication server functional network element when the authorization response message indicates that the terminal device is authorized to use the relay service code.
  • the proximity service request message may include a permanent subscription identifier, a relay service code and a random number.
  • the receiving module is further configured to receive the proximity service response message from the functional network element of the authentication server.
  • the proximity service response message may include key and freshness parameters.
  • the sending module is further configured to send a key acquisition response message to the access and mobility management function network element.
  • the key acquisition response message may include key and freshness parameters.
  • the receiving module and the sending module can be set separately, or can be integrated into one module, that is, the transceiver module. This application does not specifically limit the specific implementation manners of the receiving module and the sending module.
  • the communication device described in the eleventh aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the eleventh aspect can execute the method described in the fourth aspect.
  • the communication device described in the eleventh aspect may be a unified data management network element, or a chip (system) or other components or components that can be set on a unified data management network element, and this application does not make any reference to this limited.
  • a communication device in a twelfth aspect, includes: a sending module and a receiving module.
  • the receiving module is configured to receive a policy control creation request message or a policy control update request message from an access and mobility management functional network element.
  • the policy control creation request message includes the terminal device's subscription permanent identifier and the terminal device policy container
  • the policy control update request message includes the terminal device policy container
  • the terminal device policy container includes one or more of the following: policy segment identifier, operating system identifier , an indication that the terminal device supports an access network discovery and selection policy, and an indication of an adjacent service policy provision request.
  • a sending module configured to send a policy control creation response message or a policy control update response message to an access and mobility management functional network element.
  • the policy control creation response message includes a policy control request trigger parameter.
  • the sending module is used to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the adjacent service authorization information of the terminal device and the policy container
  • the adjacent service authorization information indicates the relay service authorized by the terminal device
  • the policy container may include the adjacent service policy information
  • the adjacent service policy information is used for the terminal device to obtain the adjacent service Communication service.
  • the receiving module and the sending module can be set separately, or can be integrated into one module, that is, the transceiver module. This application does not specifically limit the specific implementation manners of the receiving module and the sending module.
  • the communication device described in the twelfth aspect may further include a storage module and a processing module, where the storage module stores programs or instructions.
  • the processing module executes the program or instruction
  • the communication device described in the twelfth aspect can execute the method described in the fifth aspect.
  • the communication device described in the twelfth aspect may be a network element with a policy control function, or a chip (system) or other components or components that can be installed on a network element with a policy control function, and this application does not make any limited.
  • the technical effect of the communication device described in the twelfth aspect can refer to any possible The technical effect of the authorization method described in the implementation manner will not be repeated here.
  • a communication device in a thirteenth aspect, includes: a transceiver module and a processing module.
  • the processing module is configured to determine that the adjacent service policy information of the terminal device is updated.
  • the transceiver module is used to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the adjacent service authorization information of the terminal device and the policy container
  • the adjacent service authorization information indicates the relay service authorized by the terminal device
  • the policy container may include the adjacent service policy information
  • the adjacent service policy information is used for the terminal device to obtain the adjacent service Communication service.
  • the transceiver module described in the thirteenth aspect may include a receiving module and a sending module.
  • the receiving module is used for receiving data and/or signaling from the access and mobility management functional network element;
  • the sending module is used for sending data and/or signaling to the access and mobility management functional network element. This application does not specifically limit the specific implementation manner of the transceiver module.
  • the communication device described in the thirteenth aspect may further include a storage module, where programs or instructions are stored in the storage module.
  • the processing module executes the program or instruction
  • the communication device described in the thirteenth aspect can execute the method described in the sixth aspect.
  • the communication device described in the thirteenth aspect may be a network element with a policy control function, or a chip (system) or other components or components that can be installed on a network element with a policy control function. limited.
  • a communication device in a fourteenth aspect, includes: a sending module and a receiving module.
  • the receiving module is used for receiving the authorization information request message from the access and mobility management function network element.
  • the authorization information request message is used to request the proximity service authorization information of the terminal device.
  • the sending module is used to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the proximity service authorization information of the terminal device, the proximity service authorization information indicates the authorized relay service of the terminal device, and the proximity service policy information is used for the terminal device to obtain the proximity service communication service.
  • the communication message may further include authorization indication information, and the authorization indication information may indicate that the proximity service authorization information is the proximity service authorization information corresponding to the terminal device serving as the relay terminal device or the remote terminal device.
  • the receiving module and the sending module can be set separately, or can be integrated into one module, that is, the transceiver module. This application does not specifically limit the specific implementation manners of the receiving module and the sending module.
  • the communication device described in the fourteenth aspect may further include a storage module and a processing module, where the storage module stores programs or instructions.
  • the processing module executes the program or instruction
  • the communication device described in the fourteenth aspect can execute the method described in the seventh aspect.
  • the communication device described in the fourteenth aspect may be a network element with a policy control function, or a chip (system) or other components or components that can be installed on a network element with a policy control function. limited.
  • a communication device in a fifteenth aspect, includes: a processor, the processor is coupled with a memory, and the memory is used for storing computer programs.
  • the processor is used to execute the computer program stored in the memory, so that any one of the first aspect to the seventh aspect
  • the authorization method described in a possible implementation manner is executed.
  • the communication device described in the fifteenth aspect may further include a transceiver.
  • the transceiver can be a transceiver circuit or an input/output port.
  • the transceiver may be used by the communication means to communicate with other devices.
  • the input port can be used to realize the receiving function involved in the first aspect to the seventh aspect
  • the output port can be used to realize the sending function involved in the first aspect to the seventh aspect.
  • the communication device described in the fifteenth aspect may be an access and mobility management function network element, a policy control function network element, a unified data management network element, or a network element with an access and mobility management function, a policy The chip or chip system inside the control function network element and unified data management network element.
  • a communication system in a sixteenth aspect, includes the communication device according to the eighth aspect and the communication device according to the ninth aspect.
  • the communication system includes the communication device described in the tenth aspect and the communication device described in the eleventh aspect, and may also include the communication device described in the twelfth aspect, or the communication device described in the thirteenth aspect.
  • the communication system includes the communication device according to the eighth aspect for realizing the method according to the first aspect, and the communication device according to the ninth aspect for realizing the method according to the second aspect.
  • the communication system includes the communication device according to the tenth aspect for realizing the method according to the third aspect, the communication device according to the eleventh aspect for realizing the method according to the fourth aspect, and It may include the communication device used to implement the method described in the fifth aspect as described in the twelfth aspect, or the communication device used to implement the method described in the sixth aspect as described in the thirteenth aspect, or the communication device used to implement the method described in the sixth aspect as described in the thirteenth aspect.
  • the communication device according to the fourteenth aspect for realizing the method according to the seventh aspect.
  • the communication system may include an access and mobility management functional network element and a policy control functional network element.
  • the communication system may include an access and mobility management function network element and a unified data management network element, and may also include a policy control function network element.
  • a chip system in a seventeenth aspect, includes a logic circuit and an input/output port.
  • the logic circuit is used to realize the processing function involved in the first aspect to the seventh aspect
  • the input/output port is used to realize the sending and receiving function involved in the first aspect to the seventh aspect.
  • the input port can be used to realize the receiving function involved in the first aspect to the seventh aspect
  • the output port can be used to realize the sending function involved in the first aspect to the seventh aspect.
  • system-on-a-chip further includes a memory, which is used to store program instructions and data for realizing the functions involved in the first aspect to the seventh aspect.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • a computer-readable storage medium stores computer programs or instructions; when the computer programs or instructions are run on a computer, any one of the first to seventh aspects
  • the authorization method described in one possible implementation manner is executed.
  • a computer program product including computer programs or instructions.
  • the authorized method is executed.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of the architecture of the communication system provided by the embodiment of the present application when it is applied to a 5G communication network;
  • FIG. 3 is a schematic diagram of a Layer 3 relay architecture provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a Layer 2 relay architecture provided by an embodiment of the present application.
  • FIG. 5 is a schematic flow diagram of an authorization method provided in an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 8a is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 8b is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 8c is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 9a is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 9b is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • FIG. 10 is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • FIG. 12 is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, such as universal mobile telecommunications system (universal mobile telecommunications system, UMTS), wireless local area network (wireless local area network, WLAN), wireless fidelity (wireless fidelity, Wi-Fi ) system, wired network, vehicle to everything (V2X) communication system, D2D communication system, vehicle networking communication system, 4th generation (4G) mobile communication system, such as long term evolution (long term evolution, LTE) system, worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) mobile communication system, such as new air interface (new radio, NR) system, and future communication systems , such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • 4G 4th generation
  • 5G fifth generation
  • 5G new air interface
  • NR new radio, NR
  • future communication systems such as the sixth generation (6th generation, 6G) mobile communication system, etc.
  • the present application presents various aspects, embodiments or features in terms of a system that can include a number of devices, components, modules and the like. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. Additionally, combinations of these schemes can also be used.
  • FIG. 1 is a schematic structural diagram of a communication system to which the authorization method provided in the embodiment of the present application is applicable.
  • the communication system includes core network elements, and may also include remote terminal equipment, relay terminal equipment, and access network equipment.
  • the above-mentioned core network element can be responsible for maintaining the subscription data of the mobile network, and providing functions such as session management, mobility management, policy management, and security authentication for terminal equipment.
  • the above relay terminal equipment is a terminal equipment that supports proximity services or proximity based services (proximity based services, proSe), and supports remote terminal equipment to connect to the network, and can provide intermediate Follow up service.
  • the relay terminal device may be a terminal device, or an integrated access and backhaul (IAB) node or the like.
  • the IAB node includes a mobile terminal (mobile terminal, MT) and a distributed unit (distributed unit, DU).
  • the relay terminal device may be called a proximity service terminal device to network relay (ProSe UE-to-network relay), terminal device to network relay (UE-to-network relay), or a relay, etc. This application does not limit the name of the relay terminal device.
  • the above-mentioned remote terminal equipment is a terminal equipment supporting proximity services or proximity based services (Proximity based services, ProSe), and supports communication with a data network through a relay terminal equipment.
  • ProSe proximity based services
  • the remote terminal equipment may be referred to as a proximity service remote equipment (ProSe remote UE), or remote, etc., and this application does not limit the name of the relay terminal equipment.
  • the above-mentioned access network device is a device located on the network side of the above-mentioned communication system and has a wireless transceiver function, or a chip or a chip system that can be provided in the device.
  • the access network equipment includes but is not limited to: an access point (access point, AP) in a wireless fidelity (wireless fidelity, Wi-Fi) system, such as a home gateway, a router, a server, a switch, a network bridge, etc., an evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), node B (Node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), wireless relay node, wireless backhaul node, transmission point (transmission and reception point, TRP or transmission point,
  • the communication system shown in FIG. 1 may be applicable to the communication network currently being discussed, or to other networks in the future, which is not specifically limited in this embodiment of the present application.
  • the communication network may include a terminal device, a core network element, a (wireless) access network ((radio) access network, (R)AN) device, and a data network (data network, DN).
  • a terminal device may include a terminal device, a core network element, a (wireless) access network ((radio) access network, (R)AN) device, and a data network (data network, DN).
  • R radio access network
  • DN data network
  • the core network element may include but not limited to one or more of the following: user plane function (user plane function, UPF) network element, access and mobility management function (core access and mobility management function, AMF) network element, session management function (session management function, SMF) network element, authentication server function (authentication server function, AUSF) network element, network slice selection function (network slice selection function, NSSF) network element, network opening function (network exposure function, NEF) network element, network function storage function (network exposure function repository function, NRF), policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, Application function (application function, AF) network element, network slice and independent non-public network specific authentication and authorization function (network slice-specific and stand-alone non-public network authentication and authorization function, NSSAAF) network element, service communication agent (service communication proxy, SCP) network element, and unified data storage (unified data repository, UDR) network element.
  • user plane function user plane function
  • AMF access and
  • the terminal device accesses the 5G network through the (R)AN device, and the terminal device communicates with the AMF through the N1 interface (N1 for short); the (R)AN device can communicate with the AMF through the N2 interface (N2 for short); the (R)AN device
  • the UPF can communicate with the UPF through the N3 interface (N3 for short); the SMF communicates with the UPF through the N4 interface (N4 for short), and the UPF accesses the data network through the N6 interface (N6 for short).
  • control plane functions such as AUSF, AMF, SMF, NSSF, NEF, NRF, PCF, UDM, NSSAAF, UDR and AF shown in Figure 2 can use the corresponding service interface Nausf, Namf, Nsmf, Nnssf, Nnef, Nnrf , Npcf, Nudm, Nnssaaf, Nudr and Naf to interact.
  • the AMF network element is mainly responsible for mobility management in the mobile network, such as user location update, user registration network, user handover, etc.
  • the AMF network element can obtain the 5G non-access stratum (Non-access stratum, NAS) security context, and the 5G NAS security context is used to protect NAS messages.
  • the AMF network element can be used to determine whether the terminal device is authorized as a remote terminal device or a relay terminal device, and the AMF network element can be used to determine whether the terminal device is authorized to use the relay service code.
  • the PCF network element mainly supports the provision of a unified policy framework to control network behavior, provides policy rules to the control layer network functions, and is responsible for obtaining user subscription information related to policy decisions.
  • the PCF network element can provide policies to the AMF network element and the SMF network element, such as quality of service (quality of service, QoS) policy, slice selection policy, adjacent service authorization information, and the like.
  • quality of service quality of service, QoS
  • the PCF network element can be used to determine whether the terminal device is authorized to use the relay service code.
  • AUSF network elements can be used to perform security authentication of terminal equipment.
  • the UDM network element can be used to store user data, such as subscription data (such as nearby service subscription information), authentication/authorization data, and the like.
  • the SMF network element is mainly responsible for session management in the mobile network, such as session establishment, modification, and release. For example, assign an Internet Protocol (internet protocol, IP) address to the user, select a UPF that provides a message forwarding function, and the like.
  • IP Internet protocol
  • the UPF network element is responsible for forwarding and receiving user data in terminal equipment.
  • the UPF network element can receive user data from the data network and transmit it to the terminal device through the RAN device; the UPF network element can also receive user data from the terminal device through the RAN device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services for terminal equipment in the UPF network element are managed and controlled by the SMF network element.
  • NSSF network elements are mainly responsible for the selection of network slices, and can determine the network slice instances that terminal devices are allowed to access according to the slice selection auxiliary information and subscription information of terminal devices.
  • NEF network elements can be used to support the opening of capabilities and events, and can support secure interactions between 3GPP networks and third-party applications.
  • NRF network elements can support registration and discovery of network functions.
  • the AF network element mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • the main function of the NSSAAF network element is an intermediate network element connecting the internal network elements of the 3GPP network and the external authentication server.
  • UDR network elements can be used to store adjacent service authorization information.
  • the SCP network element can be used to implement communication forwarding between network functions, and can also be used to implement load balancing and network function selection.
  • the data network can be an external network of the operator, or a network controlled by the operator, and is used to provide business services to terminal devices.
  • the above terminal equipment may also be called user equipment (user equipment, UE), user device, access terminal, subscriber unit, subscriber station, mobile station, mobile station (mobile station, MS), remote station, remote terminal, mobile equipment, A user terminal, terminal, terminal unit, end station, terminal device, wireless communication device, user agent or user device.
  • user equipment user equipment
  • UE user device
  • access terminal subscriber unit, subscriber station, mobile station, mobile station (mobile station, MS)
  • remote station remote terminal, mobile equipment
  • the terminal device in the embodiment of the present application may be a mobile phone (mobile phone), a wireless data card, or a personal digital assistant (personal digital assistant, PDA).
  • Computer laptop computer (laptop computer), tablet computer (Pad), drone, computer with wireless transceiver function, machine type communication (machine type communication, MTC) terminal, virtual reality (virtual reality, VR) terminal equipment , Augmented reality (augmented reality, AR) terminal equipment, Internet of things (Internet of things, IoT) terminal equipment, wireless terminals in industrial control (industrial control), wireless terminals in self driving (self driving), telemedicine ( Wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, wireless terminals in smart city, wireless terminals in smart home Terminals (such as game consoles, smart TVs, smart speakers, smart refrigerators and fitness equipment, etc.), vehicle-mounted terminals, and RSUs with terminal functions.
  • An access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA) , a handheld device (handset) with wireless communication function, a computing device or other processing device connected to a wireless modem, a wearable device, and the like.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • Handset handheld device with wireless communication function
  • computing device or other processing device connected to a wireless modem a wearable device, and the like.
  • the terminal device in the embodiment of the present application can be an express terminal in smart logistics (such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.), a wireless terminal in smart agriculture (such as a device that can collect poultry wearable devices related to livestock data, etc.), wireless terminals in smart buildings (such as smart elevators, fire monitoring equipment, and smart meters, etc.), wireless terminals in smart medical care (such as wireless terminals that can monitor the physiological status of people or animals) Wearable devices), wireless terminals in smart transportation (such as smart buses, smart vehicles, shared bicycles, charging pile monitoring equipment, smart traffic lights, and smart monitoring and smart parking equipment, etc.), wireless terminals in smart retail (such as automatic vending Cargo planes, self-checkout machines, and unmanned convenience stores, etc.).
  • smart logistics such as a device that can monitor the location of cargo vehicles, a device that can monitor the temperature and humidity of goods, etc.
  • a wireless terminal in smart agriculture such as a device that can collect poultry wearable devices
  • the terminal device of the present application may be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip, or a vehicle-mounted unit built into a vehicle as one or more components or units.
  • Components, on-board chips, or on-board units can implement the methods provided in this application.
  • FIG. 1 is only a simplified schematic diagram for easy understanding, and the communication system may also include other network devices and/or other terminal devices, which are not shown in FIG. 1 .
  • the first item, relay service and relay service code are The first item, relay service and relay service code:
  • the relay service is a connection service provided by the relay device for the remote device.
  • the relay service may include a layer 3 relay service and a layer 2 relay service.
  • the layer 3 relay service may be a layer 3 relay service provided by the relay device for the remote device
  • the layer 2 relay service may be a layer 2 relay service provided by the relay device for the remote device.
  • a relay service code may be used to identify the connection service provided by the relay device for the remote device.
  • a relay service code may identify a layer 3 relay service or a layer 2 relay service.
  • relay terminal device may be referred to as a relay terminal device
  • remote device may be referred to as a remote terminal device, which is not limited in this application.
  • a layer 3 relay device relays services for remote devices at the IP layer. After the layer 3 relay device registers to the network, it can actively establish a relay protocol data unit (protocol data unit, PDU) session.
  • the relay PDU session may also be established on demand after the remote device requests to initiate a layer 3 relay connection to the relay device.
  • the relay PDU session is used to relay the service of the remote device, can be used to relay the signaling between the terminal device and the network, and can also be used to relay the data exchanged between the terminal device and the data network.
  • Layer 2 relay devices relay services for remote devices at layer 2.
  • Layer 2 relay terminal devices can be used to forward RRC messages between remote terminal devices and access network devices, and RRC messages between remote terminal devices and the core network. NAS messages, etc., and the L2 relay terminal device does not have the ability to process the RRC messages of the remote device.
  • FIG. 3 is a schematic diagram of a Layer 3 relay architecture provided by an embodiment of the present application.
  • a PC5 connection is established between the remote terminal device and the layer 3 relay terminal device, and the layer 3 relay terminal device establishes a connection with the mobile network (for example, the layer 3 relay terminal device and the next generation wireless access network ( next generation RAN, NG-RAN) Uu connection between equipment), and then realize that the remote terminal equipment obtains services through the PC5 connection and the connection established between the layer 3 relay terminal equipment and the mobile network.
  • the layer 3 relay terminal device may be located in a home public land mobile network (public land mobile network, PLMN) or in a visited PLMN.
  • FIG. 4 is a schematic diagram of a Layer 2 relay architecture provided by an embodiment of the present application.
  • an air interface (such as Uu interface) connection is established between the remote terminal device and the access network, and the remote terminal device and the layer 2 relay terminal device can be served by different PLMNs , can also be served by the same PLMN.
  • FIG. 4 is only a simplified schematic diagram for easy understanding, and the architecture may also include other devices.
  • the remote terminal equipment and the layer 2 relay terminal equipment are served by different PLMNs, you can add remote before the name of the network element that will serve the remote terminal equipment, and you can serve the relay terminal equipment. Add a trunk before the name of the NE.
  • an AMF network element serving a remote terminal device may be called a remote AMF network element
  • an AMF network element serving a relay terminal device may be called a relay AMF network element.
  • the second item, AMF network element, remote AMF network element and relay AMF network element is the second item, AMF network element, remote AMF network element and relay AMF network element:
  • the network element serving the remote terminal device and the network element serving the relay terminal device may be the same or different, and whether they are the same depends on the selection of the remote terminal device and the access network device of the relay terminal device. Whether the NEs are the same.
  • the AMF network element serving the remote terminal device and the AMF network element serving the relay terminal device are the same depends on the AMF network element selected by the access network device of the remote terminal device and the relay terminal device Is it the same. For example, if the remote terminal device and the relay terminal device access the network in the same PLMN, and are located in the area served by the same AMF network element, the AMF network element serving the remote terminal device and the serving relay terminal The AMF network elements of the devices may be the same.
  • the authorization method provided by the embodiment of the present application (such as the method shown in FIG. 5-FIG. 12 below) is applicable to scenarios where the network element serving the remote terminal device is the same or different from the network element serving the relay terminal device. It should be noted that the name of the network element in the embodiment of the present application does not limit the application scenario of the network element.
  • the AMF network element in the embodiment of the present application may be an AMF network element serving remote terminal equipment and relay terminal equipment, or an AMF network element serving remote terminal equipment, or a service relay The AMF network element of the terminal equipment.
  • the remote AMF network element in this embodiment of the present application may be an AMF network element serving a remote terminal device.
  • the AMF network element serving the remote terminal device and the AMF network element serving the relay terminal device are not the same AMF network element
  • the AMF network element serving the remote terminal device may be called a remote AMF network element.
  • the AMF network element serving the remote terminal equipment and the AMF network element serving the relay terminal equipment are the same AMF network element
  • the AMF network element serving the remote terminal equipment can be called a remote AMF network element.
  • the relay AMF network element in this embodiment of the present application may be an AMF network element serving a relay terminal device.
  • the AMF network element serving the remote terminal device and the AMF network element serving the relay terminal device are not the same AMF network element, the AMF network element serving the relay terminal device may be called a remote AMF network element.
  • the AMF network element serving the relay terminal equipment can be called a relay AMF network element.
  • the AMF network element serving the remote terminal device may provide access and mobility management for the remote terminal device, and the AUSF network element serving the remote terminal device stores the key kausf of the remote terminal device.
  • the AMF network element serving the relay terminal device can provide access and mobility management for the relay terminal device, and the AUSF network element serving the relay terminal device stores the key kausf of the relay terminal device.
  • each network element (such as SMF network element, UPF network element, PCF network element and UDM network element, etc.) is not listed one by one. SMF network element, UPF network element, PCF network element and UDM network element, etc.) are also applicable.
  • the third item is the identification of the adjacent business key, the hidden identification of the contract, and the permanent identification of the contract:
  • the format of the ProSe key identifier may include the format of the network access identifier (NAI).
  • the P-KID may include username information and domain information.
  • P-KID can be username@realm.
  • the user name information of the P-KID may include a routing indicator (routing indicator, RID) and a proximate service temporary terminal equipment identifier (ProSe temporary UE identifier, P-TID).
  • the domain information of the P-KID may include the home network identifier.
  • the realm part includes the home network identification.
  • the P-KID may be username@example, and the example (example) part is not limited, for example, may include a home network identifier.
  • the AMF network element may determine the AUSF network element according to the RID information, and the AUSF network element may determine the UDM network element according to the RID information.
  • the RID information is the default value
  • AMF can select any AUSF instance in the home network; AUSF can also select any UDM instance in the home network.
  • the AMF network element can determine the AUSF network element according to the RID information, and the AUSF network element can determine the UDM network element according to the RID information.
  • the optional AUSF instance or UDM instance is stored locally or obtained from an NRF network element.
  • P-TID can be generated according to Kausf, FC, P0, L0, P1, and L1.
  • the intermediate key Kausf is used as the key K, and the parameters FC, P0, L0, P1, and L1 are used as the input S of the key derivation function.
  • FC is configured by 3GPP;
  • P0 subscription permanent identifier (SUPI);
  • L0 length of SUPI;
  • Kausf can also be replaced by other keys, such as a key further deduced by Kausf, or a new key generated by authentication, which is not limited here.
  • a subscription concealed identifier (subscription concealed identifier, SUCI) may be generated by the terminal device, and the subscription permanent identifier is obtained by decrypting the subscription concealed identifier.
  • the adjacent service key identifier may be the temporary identity of the terminal device
  • the permanent subscription identifier may be the permanent identity of the terminal device
  • the hidden subscription identifier is obtained by encrypting the permanent subscription identifier.
  • the fourth item, adjacent business authorization information and adjacent business policy information are identical to the fourth item, adjacent business authorization information and adjacent business policy information:
  • the adjacent service authorization information may be determined by the policy control function network element according to the identifier of the terminal device and/or the context identifier of the terminal device.
  • the proximity service authorization information may indicate the authorized relay service of the terminal device.
  • the adjacent service policy information is obtained by the terminal device from the network.
  • the adjacent service policy information may include: an authorization policy, and may also include a relay terminal device discovery policy/parameter.
  • the proximity service policy information may be used by the terminal device to obtain the proximity service communication service, and may indicate whether the terminal device is authorized to act as a relay terminal or a remote device.
  • the proximity service authorization information may include: a relay service code.
  • the proximity service authorization information may indicate that the terminal device is authorized to use the relay service code, or the proximity service authorization information may indicate that the terminal device is authorized to use or provide the relay service corresponding to the relay service code.
  • the proximity service authorization information of terminal device 1 includes remote terminal devices ⁇ RSC1, RSC2 ⁇ and relay terminal devices ⁇ RSC3, RSC4 ⁇
  • the proximity service authorization information indicates that terminal device 1 is authorized as a remote terminal device Authorized to use RSC1 and RSC2, terminal device 1 is authorized to use RSC3 and RSC4 as a relay terminal device, that is, terminal device 1 can provide the relay service corresponding to RSC3 and RSC4 for remote devices as a relay terminal device.
  • a terminal device may be authorized as one of a remote terminal device or a relay terminal device. If the terminal device is only authorized as a remote terminal device, the proximity service authorization information includes Information about whether to authorize the use of the relay service corresponding to the relay service code as a remote terminal device. For example, terminal device 1 is only authorized as a remote terminal device, and the proximity service authorization information of terminal device 1 may include remote terminal devices ⁇ RSC1, RSC2 ⁇ .
  • the proximity service authorization information includes information for detecting whether the terminal device is authorized to provide the relay service corresponding to the relay service code as the relay terminal device.
  • terminal device 1 is only authorized as a relay terminal device, and the proximity service authorization information of terminal device 1 may include relay terminal devices ⁇ RSC3, RSC4 ⁇ .
  • the proximity service authorization information corresponding to terminal device 1 as a remote terminal device includes RSC1 and RSC2
  • the proximity service authorization information indicates that terminal device 1 is authorized to use RSC1 and RSC2 as a remote terminal device.
  • the proximity service authorization information corresponding to terminal device 1 as a relay terminal device includes RSC3 and RSC4, the proximity service authorization information indicates that terminal device 1 is authorized to use RSC3 and RSC4 as a relay terminal device.
  • the proximity service authorization information may also include: PLMN ID.
  • the adjacent service authorization information may indicate that the terminal device is authorized to relay traffic (relay traffic) in the PLMN corresponding to the PLMN ID.
  • the relay service means that the relay device relays services for the remote device.
  • the adjacent service authorization information may indicate that the terminal device is authorized to relay services for the remote device at the PLMN corresponding to the PLMN ID.
  • the proximity service authorization information of terminal device 1 includes PLMN ID1 and PLMN ID2
  • the proximity service authorization information may indicate that terminal device 1 is authorized for the PLMN relay service corresponding to PLMN ID1, and authorized for the PLMN relay service corresponding to PLMN ID2. PLMN relay service.
  • the proximity service authorization information of terminal device 1 includes remote terminal devices ⁇ RSC1, RSC2 ⁇ , relay terminal devices ⁇ RSC3, RSC4 ⁇ , PLMN ID1 and PLMN ID2. Then the proximity service authorization information can indicate that terminal device 1 is authorized to use RSC1 and RSC2 as a remote terminal device, terminal device 1 is authorized to use RSC3 and RSC4 as a relay terminal device, and terminal device 1 is authorized to be in the PLMN corresponding to PLMN ID1 Relay service, authorized PLMN relay service corresponding to PLMN ID2.
  • the proximity service authorization information may indicate that the terminal device is authorized to provide the relay service corresponding to the relay service code in the PLMN corresponding to the PLMN ID.
  • the adjacent service authorization information may also include: the RSC and the PLMN ID corresponding to the RSC. That is to say, there may be a corresponding relationship between RSC and PLMN ID.
  • the proximity service authorization information of terminal device 1 may include: PLMN ID1 (RSC3) and PLMN ID2 (RSC4), and the proximity service authorization information may indicate that terminal device 1 is authorized to provide the PLMN corresponding to RSC3 in the PLMN corresponding to PLMN ID1. It is authorized to provide the relay service corresponding to RSC4 in the PLMN corresponding to PLMN ID2.
  • the proximity service authorization information of terminal device 1 may include: remote terminal device ⁇ PLMN ID3 (RSC1), PLMN ID4 (RSC2) ⁇ , relay terminal device ⁇ PLMN ID1 (RSC3), PLMN ID2 (RSC4) ⁇ ,
  • the proximity service authorization information indicates that terminal device 1, as a remote terminal device, is authorized to provide the relay service corresponding to RSC1 in the PLMN corresponding to PLMN ID3, and terminal device 1, as a remote terminal device, is authorized to provide the relay service in the PLMN corresponding to PLMN ID4.
  • terminal device 1 is authorized to provide the relay service corresponding to RSC3 in the PLMN corresponding to PLMN ID1 as a relay terminal device, and terminal device 1 is authorized to provide in the PLMN corresponding to PLMN ID2 as a relay terminal device Relay service corresponding to RSC4.
  • one PLMN ID can correspond to multiple RSCs, and one RSC can correspond to multiple PLMNs ID, which is not limited in this application.
  • the authorization policy may include: PLMN ID.
  • the public land mobile network identifier may be used to indicate that the terminal device is authorized to relay services in the PLMN corresponding to the public land mobile network identifier.
  • the relay terminal device discovery strategy/parameters may include one or more of the following: user information identifier, relay service code and terminal device to network relay indication (UE-to-network relay layer indicator(s) ).
  • the user information identifier can be used for group member discovery or relay discovery.
  • the terminal device-to-network relay indication may indicate that a specific relay service code provides a layer 2 relay service or a layer 3 relay service.
  • the relay service code corresponds to the relay indication from the terminal device to the network.
  • the relay service code 1 corresponds to the terminal device-to-network relay indication 1
  • the terminal device-to-network relay indication 1 may indicate that the relay service code 1 provides a layer 2 relay service.
  • the relay service code 2 corresponds to the terminal device-to-network relay indication 2, and the terminal device-to-network relay indication 2 may indicate that the relay service code 2 provides a layer 3 relay service.
  • one terminal device-to-network relay indication may correspond to one or more relay service codes, which is not limited in this application.
  • the fifth item the information about the signing of the nearby business:
  • the ProSe subscription information may be used to indicate authorized ProSe services, such as ProSe direct discovery, ProSe direct communication, as a relay device, and the like.
  • the nearby service subscription information can be stored in the UDM network element.
  • the proximity service subscription information may be used to determine whether the terminal device supports the use of the proximity service service, whether the terminal device is authorized as a remote terminal device or a relay terminal device, or whether the terminal device is authorized to use (use) a relay terminal device (Equivalent as a remote terminal device) or as (serve as) a relay terminal device.
  • whether the terminal device is authorized as a remote terminal device may refer to whether the terminal device is authorized to use the service provided by the relay terminal device.
  • Whether the terminal device is authorized as a relay terminal device may refer to whether the terminal device is authorized to relay services for the remote terminal device.
  • FIG. 5 is a schematic flow chart of an authorization method provided in the embodiment of the present application.
  • Figure 5 illustrates the scheme of establishing a secure connection to PC5 through the signaling plane. This authorization method can be applied to the communication system shown in FIG. 1 .
  • the authorization method includes the following steps:
  • the remote terminal device registers with the network.
  • the remote terminal device may acquire service authorization and adjacent service policy information from the network.
  • the adjacent service policy information of the remote terminal device reference may be made to the above description, and details will not be repeated here.
  • the relay terminal device registers with the network.
  • the relay terminal device may obtain service authorization and adjacent service policy information from the network.
  • the adjacent service policy information of the relay terminal device reference may be made to the above description, and details will not be repeated here.
  • the remote terminal device sends a NAS relay key request message to the remote AMF network element.
  • the remote AMF network element receives the NAS relay key request message from the remote terminal device.
  • the NAS relay key request message may include a relay service code.
  • the remote terminal device acquires the relay service code authorized to be used by the remote device according to pre-configuration or adjacent service policy information from the network.
  • the remote AMF network element sends an adjacent service relay key request message to the remote AUSF network element.
  • the remote AUSF network element receives the proximity service relay key request message from the remote AMF network element.
  • the proximity service relay key request (Kasuf_ProSe_Relay Key request) message may include a relay service code.
  • the remote AUSF network element generates a P-KID.
  • the P-TID may be generated by the remote AUSF network element according to the intermediate keys Kausf, FC, P0, L0, P1, and L1.
  • Kausf the intermediate keys Kausf, FC, P0, L0, P1, and L1.
  • the remote AUSF network element sends an adjacent service relay key identification message to the remote UDM network element.
  • the remote UDM network element receives the adjacent service relay key identification message from the remote AUSF network element.
  • the Kudm_ProSe_RelayKeyID management (Kudm_ProSe_RelayKeyID management) message may include the P-KID.
  • the remote UDM network element sends a confirmation message to the remote AUSF network element.
  • the remote AUSF network element receives the confirmation message from the remote UDM network element.
  • the remote AUSF network element sends an adjacent service relay key response message to the remote AMF network element.
  • the remote AMF network element receives the adjacent service relay key response message from the remote AUSF network element.
  • the remote AMF network element sends a NAS relay key response message to the remote terminal device.
  • the remote terminal device receives the NAS relay key response message from the remote AMF network element.
  • S510 may be executed at any time after the above S509.
  • the remote terminal device generates a P-KID.
  • the P-TID may be generated according to Kausf, FC, P0, L0, P1, and L1.
  • Kausf Kausf
  • FC Temporal Component Interconnect
  • the remote terminal device sends a direct communication request message to the relay terminal device.
  • the relay terminal device receives the direct communication request message from the remote terminal device.
  • the direct communication request message may include a P-KID, a relay service code and a random number 1 (nonce 1).
  • the relay terminal device sends a NAS remote key request message to the relay AMF network element.
  • the relay AMF network element receives the NAS remote key request message from the relay terminal device.
  • the NAS remote key request message may include P-KID, relay service code and random number 1.
  • the relay AMF network element checks whether the relay terminal device is authorized as a relay, if yes, the relay AMF network element discovers the remote UDM network element, and sends the authentication server function network element identifier to the remote UDM network element Get request message. Correspondingly, the remote UDM network element receives the authentication server function network element identification acquisition request message from the relay AMF network element.
  • the authentication server function network element identifier acquisition request (Nudm_AUSFID_Get request) message includes the P-KID.
  • the remote UDM network element sends the authentication server function network element identifier acquisition response message to the relay AMF network element interest.
  • the relay AMF network element receives the authentication server function network element identification acquisition response message from the remote UDM network element.
  • the authentication server function network element identifier acquisition response (Nudm_AUSFID_Get response) message may include the AUSF instance ID of the AUSF serving the remote terminal device.
  • the relay AMF network element sends a remote service key request message to the remote AUSF network element.
  • the remote AUSF network element receives the proximity service remote key request message from the relay AMF network element.
  • the ProSe remote key request (Nausf_ProSe_Remote Key request) message may include P-KID, relay service code and random number 1.
  • the remote AUSF network element deduces the remote key K R .
  • the remote AUSF network element generates the freshness parameter, and deduces the remote key K R according to the intermediate key Kausf, the relay service code, the freshness parameter and the random number 1.
  • the remote AUSF network element sends the proximity service remote key response message to the relay AMF network element.
  • the relay AMF network element receives the proximity service remote key response message from the remote AUSF network element.
  • the proximity service remote key response (Nausf_ProSe_Remote Key response) message may include the remote key K R and freshness parameters.
  • the relay AMF network element sends a NAS remote key response message to the relay terminal device.
  • the relay terminal device receives the NAS remote key response message from the relay AMF network element.
  • the NAS Remote Key response (NAS Remote Key response) message may include the remote key K R and freshness parameters.
  • the relay terminal device sends a direct security mode command message to the remote terminal device.
  • the remote terminal device receives the direct security mode command message from the relay terminal device.
  • the direct security mode command message may include a freshness parameter and a random number 2 .
  • the remote terminal device sends a direct security mode command completion message to the relay terminal device.
  • the relay terminal device receives the direct security mode command completion message from the remote terminal device.
  • the remote terminal device deduces K R , generates the freshness parameter, and deduces the remote key K R according to the intermediate key Kausf, the relay service code, the freshness parameter and the random number 2.
  • the direct security mode command completion message is integrity protected, and the integrity protected key is generated according to KR .
  • the authorization method shown in Figure 5 can verify whether the relay terminal device is authorized as a relay terminal device, but for how to verify whether the terminal device is authorized as a remote terminal device and how to verify whether the terminal device is authorized to use the relay service code , does not give a solution, and cannot guarantee the security of the establishment of the relay communication connection.
  • whether the terminal device is authorized to use the relay service code may refer to whether the remote terminal device is authorized to use the connection service corresponding to the relay service code.
  • whether the terminal device is authorized to use the relay service code may refer to whether the relay terminal device is authorized to provide the connection service corresponding to the relay service code.
  • FIG. 6 is a schematic flowchart of another authorization method provided in the embodiment of the present application.
  • Figure 6 illustrates the scheme of establishing a PC5 security connection through the signaling plane.
  • the difference between the method shown in Figure 6 and the method shown in Figure 5 is that after the remote terminal device initiates a registration request, the remote AMF network element triggers the primary authentication After the main authentication process is successfully completed, the remote AUSF network element generates a P-KID, and the remote terminal device obtains service authorization and adjacent service policy brief information.
  • This authorization method can be applied to the communication system shown in FIG. 1 .
  • the authorization method includes the following steps:
  • the remote terminal device After the remote terminal device sends a registration request message to the remote AMF network element, the remote AMF network element triggers a main authentication process.
  • the remote AUSF network element sends a terminal device authentication acquisition request message to the remote UDM network element.
  • the remote UDM network element receives the terminal device authentication acquisition request message from the remote AUSF network element.
  • the terminal device authentication acquisition request message may request authentication data (such as an authentication vector) from the remote UDM network element.
  • authentication data such as an authentication vector
  • the authentication data can be used for primary authentication or primary authentication (Primary authentication) between the network element of the core network and the terminal device.
  • the terminal equipment authentication acquisition request (Nudm_UEAuthentication_Get Request) message may include SUPI or SUCI.
  • the terminal equipment authentication acquisition request message may include SUPI or SUCI.
  • the terminal device authentication acquisition request message carries the SUCI.
  • the remote AMF network element provides the SUPI to the remote AUSF network element, the SUPI is carried in the terminal device authentication acquisition request message.
  • the remote UDM network element sends a terminal device authentication acquisition response message to the remote AUSF network element.
  • the remote AUSF network element receives the terminal device authentication acquisition response message from the remote UDM network element.
  • the terminal equipment authentication get response (Num_UEAuthentication_Get Response) message may include an authentication vector.
  • the terminal device authentication acquisition response message may also include the proximity service indication information and the RID.
  • the ProSe indication information may be used to indicate that the terminal device supports the ProSe service.
  • the proximity service indication information may indicate whether the terminal device is authorized to use proximity service direct discovery and/or proximity service direct communication, and may also indicate whether the terminal device is authorized to act as a relay terminal device.
  • the UDM determines whether the terminal device is authorized to use the ProSe service according to the ProSe subscription information, and if authorized, transmits ProSe indication information to the AUSF.
  • the terminal device authentication acquisition request message when the terminal device authentication acquisition request message includes the proximity service indication information, it also includes the RID.
  • the remote AUSF network element generates a P-KID.
  • the above S604 may be performed after the main authentication process of the above S601 is successfully completed. That is, after the AUSF judges that the authentication is successful.
  • the P-TID may be generated by the remote AUSF network element according to the intermediate keys Kausf, FC, P0, L0, P1, and L1.
  • Kausf the intermediate keys Kausf, FC, P0, L0, P1, and L1.
  • the intermediate key Kausf may be stored after the remote AUSF network element receives the approaching service indication information.
  • the remote AUSF network element sends a terminal device authentication result confirmation request message to the remote UDM network element.
  • the remote UDM network element receives the terminal device authentication result confirmation request message from the remote AUSF network element.
  • the terminal device authentication result confirmation request (Nudm_UEAuthenticationResultConfimation Request) message may include the P-KID.
  • the remote UDM network element sends a terminal device authentication result confirmation response message to the remote AUSF network element.
  • the remote AUSF network element receives the terminal device authentication result confirmation response message from the remote UDM network element.
  • the remote terminal device acquires service authorization and nearby service policy information.
  • the relay terminal device registers with the network.
  • the relay terminal device may obtain service authorization and configuration information of the proximity service from the network.
  • the adjacent service policy information of the relay terminal device reference may be made to the above description, and details will not be repeated here.
  • S608 may be executed at any time before S609.
  • S609 may be executed at any time after the above S608.
  • the authorization method shown in FIG. 6 may further include: S610-S620. Wherein, for the specific implementation manners of S610-S620, reference may be made to the specific implementation manners of S511-S521 above, which will not be repeated here.
  • the authorization method shown in Figure 6 can verify whether the relay terminal device is authorized as a relay terminal device, but for how to verify whether the terminal device is authorized as a remote terminal device and how to verify the terminal Whether the device is authorized to use the relay service code does not give a solution, and cannot guarantee the security of the establishment of the relay communication connection.
  • the embodiment of the present application provides an authorization method, which can determine whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device.
  • the relay service code is used to identify the connection provided by the relay device for the remote device
  • a service such as Relay Service Code 1 may identify Layer 3 Relay Service 1. In this way, it can be verified whether the terminal device is authorized to use or provide the layer 3 relay service 1, thereby ensuring the security of establishing the relay communication connection.
  • the step of determining whether the terminal device is authorized to use the relay service code can be performed by a policy control function network element or an access and mobility management function network element.
  • the following figure 7 uses a policy control function network element to determine whether the terminal device is authorized to use
  • the relay service code is taken as an example for illustration, and the following FIG. 8a is described by taking the access and mobility management function network element to determine whether the terminal device is authorized to use the relay service code as an example.
  • FIG. 7 is a schematic flowchart of another authorization method provided in the embodiment of the present application.
  • Fig. 7 uses the policy control function network element to determine whether the terminal device is authorized to use the relay service code as an example.
  • the method shown in Fig. 7 is applicable to the architecture shown in Fig. 1-Fig. 4, and can also be applied to other, And in various forms of network architectures in the future, corresponding names may also be replaced with names of corresponding functions in other network architectures and various forms of network architectures in the future.
  • the terminal device can be a remote terminal device or a relay terminal device
  • an AMF network element can be called a remote AMF network element or a relay AMF network element
  • a PCF network element can be called a remote PCF network element or a relay PCF network element
  • the AUSF network element may be called a remote AUSF network element or a relay AUSF network element
  • the UDM network element may be called a remote UDM network element or a relay UDM network element.
  • the authorization method includes the following steps:
  • the access and mobility management function network element sends an authorization request message to the policy control function network element.
  • the policy control function network element receives the authorization request message from the access and mobility management function network element.
  • the authorization request message may be used to request to verify whether the terminal device is authorized to use the relay service code.
  • the authorization request message includes a relay service code from the terminal device.
  • Access and mobility management function network elements serve terminal equipment.
  • the relay service code may be used to identify the connection service provided by the relay device for the remote device.
  • the relay service code refer to the description in the first item above, and details will not be repeated here.
  • the authorization request message may further include one or more of the following: terminal indication information, terminal device identifier, terminal device context identifier, and public land mobile network identifier.
  • the terminal indication information may be used to indicate that the terminal device is a remote terminal device or a relay terminal device.
  • the terminal indication information may be used to instruct the terminal device to request authentication as a remote terminal device, or to request authentication as a relay terminal device.
  • the authorization request message may also include a PLMN ID.
  • the identifier of the terminal device or the context identifier of the terminal device may be used to acquire the proximity service authorization information of the terminal device.
  • the identifier of the terminal device may be the SUPI or SUCI of the terminal device.
  • the context identifier of the terminal device may be an identifier allocated by the PCF for identifying the context of the terminal device.
  • the context identifier of the terminal equipment is stored in the access and mobility management functional network element.
  • the public land mobile network identifier may be obtained by the network element with the access and mobility management function according to the network served by the network element with the access and mobility management function.
  • the authorization request message may indicate that the terminal device is a relay terminal device, or the authorization request message may indicate that the terminal device is a remote terminal device.
  • terminal indication information may be used to indicate that the terminal device is a relay terminal device or a remote terminal device. Alternatively, it may be indicated by the content included in the authorization request message. Alternatively, it can be indicated by a different service operation name.
  • the authorization request message may indicate whether the verification terminal device is authorized to use the relay service code as the remote terminal device.
  • the authorization request message may indicate whether the verification terminal device is a relay terminal device and is authorized to use the relay service code, and whether it is authorized to use the relay service code.
  • the PCF network element may determine whether the type of the terminal device is a relay terminal device or a remote terminal device according to the authorization request message.
  • the PCF network element may determine the type of the terminal device according to the terminal indication information or the content or service operation name included in the authorization request message.
  • the above S701 may include: when the terminal device is authorized as a remote terminal device or a relay terminal device, the access and mobility management function network element sends an authorization request to the policy control function network element information.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device. Only the relay terminal device or the remote terminal device can use the relay service code. In the case of a terminal device or a relay terminal device, the terminal device must not support the use of the relay service code. That is to say, if the terminal device is not authorized to be a remote terminal device or a relay terminal device, then the terminal device is not authorized to use the relay service code.
  • the AMF network element does not send an authorization request message to the PCF network element, which can prevent the PCF network element from determining whether the terminal device is authorized to use the relay service code (that is, avoid executing the following S702), thereby avoiding waste of resources.
  • the authorization method provided in the embodiment of this application may also include: S704, The access and mobility management function network element determines whether the terminal device is authorized as a remote terminal device or a relay terminal device according to the nearby service subscription information of the terminal device.
  • the ProSe subscription information may be used to indicate authorized ProSe services, such as ProSe direct discovery, ProSe direct communication, as a relay device, and the like.
  • the nearby service subscription information may be obtained by the AMF network element from the UDM network element.
  • the AMF network element obtains the adjacent service subscription information from the UDM network element according to the identifier of the terminal equipment or the context identifier of the terminal equipment.
  • the access and mobility management function network element determines whether the terminal device is authorized as a relay terminal device according to the subscription information of the terminal device's nearby service.
  • the AMF network element may determine whether the terminal device is authorized as a relay terminal device according to the nearby service subscription information. If the AMF network element determines that the terminal device is authorized as a relay terminal device, subsequent steps are performed, such as sending an authorization request message. Otherwise, the request failure may be fed back to the terminal device.
  • the access and mobility management function network element determines whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information of the terminal device.
  • the AMF network element may determine whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information. If the AMF network element determines that the terminal device is authorized as a remote terminal device, then perform subsequent steps, such as sending an authorization request message. Otherwise, the request failure may be fed back to the terminal device.
  • the access and mobility management functional network element may acquire the public land mobile network identifier of the network served by the access and mobility management functional network element. For example, if the terminal device is authorized as a relay terminal device, the AMF network element may acquire the public land mobile network identifier of the network served by the AMF network element.
  • the authorization method provided in the embodiment of the present application may further include: S705, the terminal device sends a non-access stratum request message to the access and mobility management functional network element.
  • the access and mobility management function network element receives the non-access stratum request message from the terminal device.
  • the non-access stratum request message may include a relay service code.
  • the non-access stratum request message may also include an adjacent service key identifier and a random number.
  • the proximity service key identifier may be generated by the remote terminal device and sent to the relay terminal device, and then sent by the relay terminal device to the access and mobility management function network element.
  • the non-access stratum request message may be called a non-access stratum relay key request message; if the terminal device is an ultimate terminal device, the non-access stratum request message may be It is called the non-access stratum remote key request message.
  • the AMF network element verifies whether the terminal device is authorized as a remote terminal device or a relay terminal device, and the PCF network element verifies whether the terminal device is authorized to use the relay service code.
  • the access and mobility management functional network element may determine whether the terminal device is a relay terminal device or a remote terminal device according to the non-access stratum request message.
  • the AMF network element may determine whether the terminal device is a relay terminal device or a remote terminal device according to the type of the non-access stratum request message or information elements included in the non-access stratum request message.
  • the AMF network element may not judge whether the terminal equipment is a relay terminal equipment or a remote terminal equipment, after receiving the non-access stratum request message, according to the type of the non-access stratum request message or the information element , verifying whether the terminal device is authorized as a remote terminal device or a relay terminal device (corresponding to S704), or directly sending an authorization request message (corresponding to S701).
  • non-access stratum request message may be called a non-access stratum key request message, and this application does not limit the name of the non-access stratum request message.
  • the policy control function network element determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device.
  • the adjacent service authorization information may be determined by the policy control function network element according to the identifier of the terminal device and/or the context identifier of the terminal device.
  • the proximity service authorization information may indicate the authorized relay service of the terminal device.
  • the adjacent service authorization information reference may be made to the description in the fourth item above, which will not be repeated here.
  • the terminal device is authorized to use the relay service Following service code 1.
  • the terminal device is not authorized to use the relay service Relay service code 2.
  • the PCF network element can directly verify whether the terminal device is authorized to use the relay service code, or can verify first Whether the terminal device is authorized as a remote terminal device, and if so, verify whether the terminal device is authorized to use the relay service code as a remote terminal device.
  • the PCF network element can directly verify whether the terminal device is authorized to use the relay service code, or can verify first Whether the terminal device is authorized as a relay terminal device, and if so, verify whether the terminal device is authorized to use the relay service code as a relay terminal device.
  • the terminal device is authorized as a relay terminal device can be verified by the AMF network element or the PCF network element, or after the AMF network element is verified, the PCF network element receives the authorization request message and then verifies. To limit.
  • the above S702 may include: in the case that the terminal device is authorized as a remote terminal device or a relay terminal device, the network element with the policy control function determines the Whether to be authorized to use the relay service code.
  • the PCF network element determines whether the terminal device can provide or use the connection service identified by the relay service code, which can prevent the PCF network element from performing unnecessary steps to avoid waste of resources.
  • the PCF network element determines whether the remote terminal device is authorized to use the connection corresponding to the relay service code according to the adjacent service authorization information of the terminal device Serve.
  • the PCF network element determines whether the relay terminal device is authorized to provide the connection service corresponding to the relay service code according to the adjacent service authorization information of the terminal device, It may also be determined whether the relay terminal device is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the policy control function network element can obtain the proximity service authorization information corresponding to the terminal device as a remote terminal device or relay terminal device according to the terminal indication information, for example, the proximity service authorization corresponding to the terminal device as a remote terminal device Information includes: RSC1 and RSC2.
  • the adjacent service authorization information corresponding to the terminal device as a relay terminal device includes: PLMN ID1, PLMN ID2; RSC3, RSC4.
  • the authorization request message indicates that the terminal device is a remote terminal device
  • the policy control function network element determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device, which may include :
  • the policy control function network element determines whether the adjacent service authorization information includes the relay service code. If yes, the terminal device is authorized to use the relay service code; otherwise, the terminal device is not authorized to use the relay service code.
  • the adjacent service authorization information includes RSC
  • the PCF network element can determine whether the RSC in the adjacent service authorization information is consistent with the RSC received from the AMF network element. If they are consistent, the terminal device is authorized to use the relay service code, otherwise, The terminal device is not authorized to use the relay service code.
  • the proximity service authorization information of terminal device 1 includes remote terminal devices ⁇ RSC1, RSC2 ⁇ and relay terminal devices ⁇ RSC3, RSC4 ⁇ , if the authorization request If the message includes RSC1, the PCF network element can determine that terminal device 1 is authorized to use RSC1 as a remote terminal device; if the authorization request message includes RSC5, then the PCF network element can determine that terminal device 1 is not authorized to use RSC5 as a remote terminal device.
  • terminal device 1 is used as a remote terminal device, and the authorization information for the proximity service of terminal device 1 may only include information related to terminal device 1 as a remote terminal (referring to remote terminal devices ⁇ RSC1, RSC2 ⁇ ), excluding terminal device 1 As the relevant information of the relay terminal device (referring to the relay terminal device ⁇ RSC3, RSC4 ⁇ ), this application does not limit it, and the above is only an example of this application.
  • the authorization request message also includes the public land mobile network identifier
  • the above S702 may include: the policy control function network element determines whether the terminal device is authorized to use the relay service code and whether the Authorize to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the authorization request message indicates that the terminal device is a relay terminal device
  • the PCF network element can determine whether the relay terminal device is authorized to use the relay service code and whether it is authorized to correspond to the public land mobile network identifier according to the adjacent service authorization information.
  • the authorization request message indicates that the terminal device is a relay terminal device
  • the PCF network element can determine whether the relay terminal device is authorized to provide the connection service corresponding to the relay service code in the PLMN corresponding to the PLMN ID according to the adjacent service authorization information .
  • the policy control function network element determines whether the terminal device is authorized to use the relay service code and whether it is authorized to be in the public land mobile network corresponding to the public land mobile network identifier according to the adjacent service authorization information.
  • the relay service may include: the policy control function network element determines whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information If the relay service code is not included, the terminal device is not authorized to use the relay service code; if the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to use the public land mobile network identifier corresponding to the public land mobile network identifier.
  • Relay business If so, the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information If the relay service code is not included, the terminal device is not authorized to use the relay service code; if the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to use the public land mobile network identifier corresponding to the public land mobile network identifier. Relay business.
  • the proximity service authorization information includes remote terminal devices ⁇ RSC3, RSC4 ⁇ , relay terminal devices ⁇ RSC1, RSC2 ⁇ , PLMN ID1 and PLMN ID2, if The authorization request message includes RSC1 and PLMN ID1, then the PCF network element can determine that terminal device 2 is authorized to use RSC1 as a relay terminal device and is authorized to relay services in the PLMN corresponding to PLMN ID1; if the authorization request message includes RSC4 and PLMN ID3, the PCF network element can determine that terminal device 2 is not authorized to use RSC4 as a relay terminal device, and is not authorized to relay services in the PLMN corresponding to PLMN ID3; if the authorization request message includes RSC1 and PLMN ID3, the PCF network element It can be determined that terminal device 2 is authorized to use RSC1 as a relay terminal device, but is not authorized to relay services in the PLMN corresponding to PLMN ID3.
  • the policy control function network element can determine whether the terminal device is authorized to provide the connection service corresponding to the RSC in the PLMN corresponding to the PLMN ID according to whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the adjacent service authorization information includes remote terminal devices ⁇ RSC3, RSC4 ⁇ , relay terminal devices ⁇ PLMN ID1 (RSC1, RSC5), PLMN ID2 (RSC2, RSC6) ⁇
  • the PCF network element can determine that terminal device 2 is authorized to provide the connection service corresponding to RSC1 in the PLMN corresponding to PLMN ID1; if the authorization request message includes RSC1 and PLMN ID2, the PCF network element It can be determined that the terminal device 2 is not authorized to provide the connection service corresponding to the RSC1 in the PLMN corresponding to the PLMN ID2.
  • the terminal device 2 is used as a relay terminal device, and the adjacent service authorization information of the terminal device 2 used by the network element with the policy control function may only include information related to the terminal device 2 as a relay (referring to the relay terminal device ⁇ PLMN ID1 (RSC1, RSC5), PLMN ID2 (RSC2, RSC6) ⁇ ), does not include the relevant information of the terminal device 2 as a remote terminal device (referring to the remote terminal device ⁇ RSC3, RSC4 ⁇ ), this application does not limit this, The above are only examples for this application.
  • the relay terminal device is authorized to serve the remote end in the PLMN corresponding to the PLMN ID, and whether it is authorized to provide the relay service corresponding to the RSC.
  • the authorization method provided in the embodiment of the present application may further include: S703, the network element with the policy control function sends an authorization response message to the network element with the access and mobility management function.
  • the access and mobility management functional network element receives the authorization response message from the policy control functional network element.
  • the authorization response message may indicate authorization or unauthorized, or the authorization response message may indicate authorization success or authorization failure.
  • the authorization response message may indicate whether the terminal device is authorized to use the relay service code.
  • the authorization response message indicates whether the terminal device is authorized to use the relay service code, specifically: indicating whether the terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network identifier corresponding to the public land mobile network Relay business.
  • the authorization response message may indicate that the terminal device is authorized to use the relay service corresponding to the relay service code, or the terminal device is not authorized to use the relay service corresponding to the relay service code.
  • the authorization response message may indicate that the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, or Indicates that the terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the authorization response message may indicate that the terminal device is authorized to provide the relay service corresponding to the relay service code in the PLMN corresponding to the PLMN ID, or the terminal device is not authorized to provide the relay service corresponding to the relay service code in the PLMN corresponding to the PLMN ID.
  • the authorization method provided in this embodiment of the application may further include: S706, the access and mobility management function network element Send the proximity service request message to the functional network element of the authentication server.
  • the authentication server functional network element receives the proximity service request message from the access and mobility management functional network element.
  • the proximity service request message may include a relay service code.
  • the relay service code is obtained by the AMF network element from the terminal device.
  • the AMF network element sends a Proximity Service Relay Request message (that is, a Proximity Service Relay Request message) to the AUSF network element, and the Proximity Service Relay Request message includes Relay service code.
  • the AUSF network element can use the relay service code to generate the P-KID, and can also generate the adjacent service root key.
  • the AMF network element triggers the P-KID derivation process to the AUSF network element, which can ensure that the P-KID corresponding to the authorized terminal device is deduced by the AUSF network element.
  • -KID does not deduce the P-KID corresponding to unauthorized terminal equipment, which can improve security.
  • Proximity Service Request message may be called a Proximity Service Key Request message, and this application does not limit the name of the Proximity Service Request message.
  • the non-access stratum request message includes the proximity service key identifier
  • the authorization response message indicates that the terminal device is authorized to use the relay service code and is authorized to be in the public land mobile network corresponding to the public land mobile network identifier
  • the authorization method provided in the embodiment of the present application may further include: S707, the access and mobility management function network element sends an authentication server function network element identification acquisition request message to the unified data management network element.
  • the unified data management network element receives the authentication server function network element identification acquisition request message from the access and mobility management function network element.
  • the authentication server function network element identifier acquisition request message may include an adjacent service key identifier.
  • the relay AMF network element may send an authentication server function network element identifier acquisition request message to the remote UDM network element.
  • the AMF network element can request a key from the AUSF network element, so that the authorized terminal device can obtain the corresponding key and establish a PC5 connection, and the unauthorized terminal device If the corresponding key cannot be obtained, security can be improved.
  • the authorization response message indicates that the terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier
  • the present application implements
  • the authorization method provided in the example may further include: S708, the access and mobility management functional network element sends a non-access stratum response message to the terminal device.
  • the terminal device receives the non-access stratum response message from the access and mobility management function network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the relay AMF network element sends a non-access stratum remote key response message (that is, a non-access stratum response message) to the terminal device. ), the non-access stratum remote key response message indicates that the key request failed.
  • the terminal device is a remote terminal device
  • the remote AMF network element sends a non-access stratum relay key response message (that is, a non-access stratum response key response message) to the terminal device.
  • the NAS Relay Key Response message indicates that the key request failed.
  • the terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the terminal device is notified that the request fails.
  • the PCF network element interacts with the AMF network element to obtain the relay service code from the terminal device, and determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device,
  • the relay service code is used to identify the connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • Fig. 8a is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Figure 8a uses the access and mobility management function network element to determine whether the terminal device is authorized to use the relay service code as an example.
  • the method shown in Figure 8a is applicable to the architecture shown in Figures 1-4, and can also be applied to In other and various future network architectures, corresponding names may also be replaced by other network architectures and names of corresponding functions in various future network architectures.
  • the terminal device can be a remote terminal device or a relay terminal device
  • an AMF network element can be called a remote AMF network element or a relay AMF network element
  • a PCF network element can be called a remote PCF network element or a relay PCF network element
  • the AUSF network element may be called a remote AUSF network element or a relay AUSF network element
  • the UDM network element may be called a remote UDM network element or a relay UDM network element.
  • the authorization method includes the following steps:
  • the access and mobility management function network element acquires the relay service code of the terminal device.
  • the relay service code may be used to identify the connection service provided by the relay device for the remote device.
  • the relay service code refer to the description in the first item above, and details will not be repeated here.
  • the above S801 may include: the terminal device sends a non-access stratum request message to a network element with an access and mobility management function.
  • the access and mobility management function network element receives the non-access stratum request message from the terminal device.
  • the non-access stratum request message may include a relay service code.
  • the non-access stratum request message may also include an adjacent service key identifier and a random number.
  • the non-access stratum request message may also include SUCI and a random number.
  • the access and mobility management function network element may perform the following S802 to determine whether the terminal device is authorized to use the relay service code.
  • the AMF network element verifies whether the terminal device is authorized to use the relay service code to provide or obtain the relay service during the process of triggering the key request by the terminal device.
  • non-access stratum request message can be called the non-access stratum key request message, which is not correct in this application
  • the name of the NAS request message is qualified.
  • the above S801 may include: the unified data management network element sends an authorization request message to the access and mobility management function network element.
  • the access and mobility management function network element receives the authorization request message from the unified data management network element.
  • the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the authorization request message may include the subscription permanent identifier and the relay service code of the terminal device.
  • the subscription permanent identifier can be used by network elements with access and mobility management functions to obtain the proximity service authorization information of terminal equipment.
  • the permanent subscription identifier may be determined by the unified data management network element according to the adjacent service key identifier or the hidden subscription identifier.
  • the unified data management network element can decrypt the hidden subscription identifier to obtain the permanent subscription identifier.
  • the unified data management network element can obtain the permanent subscription identifier from the corresponding relationship between the adjacent service key identifier and the subscription permanent identifier according to the adjacent service key identifier.
  • the identifier of the access and mobility management functional network element may be obtained by the UDM network element from the terminal device context stored in the UDM network element according to the adjacent service key identifier or the subscription concealment identifier.
  • the UDM network element can obtain the AMF network element serving the terminal device according to the adjacent service key identifier.
  • the UDM network element may obtain the permanent subscription identifier according to the hidden subscription identifier, obtain the security context of the terminal device according to the permanent subscription identifier, and obtain the AMF network element serving the terminal device from the security context.
  • the unified data management network element may send an authorization request message to the access and mobility management function network element determined according to the adjacent service key identifier or the subscription concealment identifier.
  • the network element with the access and mobility management function may execute the following S802 to determine whether the terminal device is authorized to use the relay service code.
  • the above-mentioned unified data management network element sending the authorization request message to the access and mobility management function network element may include: when the terminal device is authorized as a remote terminal device, the unified data management network element sends an authorization request message to the access and mobility management function network element.
  • the access and mobility management function network element sends an authorization request message.
  • the UDM network element determines that the terminal device is authorized as a remote terminal device, it can request an authorization check from the AMF network element, and trigger the AMF network element to check whether the terminal device is authorized to use the relay service code.
  • the AMF network element is not requested for an authorization check, and the AMF network element is not triggered to check whether the terminal device is authorized to use the relay service code, which can avoid waste of resources.
  • the UDM network element or the AMF network element may determine whether the terminal device is authorized as a remote terminal device or a relay terminal device.
  • the authorization method provided by the embodiment of the present application may also include: the unified data management network element determines whether the terminal device is authorized as a remote terminal device or a relay according to the nearby service subscription information of the terminal device Terminal Equipment.
  • the ProSe subscription information is used to indicate the authorized ProSe service, such as ProSe direct discovery, ProSe direct communication, as a relay device, and the like.
  • the UDM network element may determine whether the terminal device is authorized as a remote terminal device or a relay terminal device. For example, the remote UDM network element determines whether the terminal device is authorized as a remote terminal device.
  • the UDM network element may obtain the adjacent service subscription information according to the permanent subscription identifier.
  • the authorization method provided by the embodiment of the present application may further include: S803, the access and mobility management function network element determines whether the terminal device is authorized to act as a remote Terminal equipment or relay terminal equipment.
  • S803 the access and mobility management function network element determines whether the terminal device is authorized to act as a remote Terminal equipment or relay terminal equipment.
  • the AMF network element can determine whether the terminal device is authorized as a remote terminal device or a relay terminal device.
  • the access and mobility management function network element determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device.
  • the proximity service authorization information may be acquired by the access and mobility management functional network element from the policy control functional network element.
  • the terminal device is authorized to use the relay service Relay service code.
  • the adjacent service authorization information indicates that the terminal device is authorized to relay service 2
  • the relay service code received by the AMF network element from the terminal device or UDM network element identifies the relay service 1
  • the terminal device is not authorized to use The relay service code.
  • the authorization method provided in the embodiment of the present application may further include: S804, the network element with the policy control function sends a communication message to the network element with the access and mobility management function.
  • the access and mobility management function network element receives the communication message from the policy control function network element.
  • the communication message may include proximity service authorization information.
  • the access and mobility management functional network element may store the proximity service authorization information.
  • the communication message may further include authorization indication information, and the authorization indication information may indicate that the proximity service authorization information is the proximity service authorization information corresponding to the terminal device serving as the relay terminal device or the remote terminal device.
  • the adjacent service authorization information may be sent by the PCF network element to the AMF network element during the registration process of the terminal device, or during the policy process of the terminal device's active request, or sent to the AMF network element after the PCF network element detects that the policy is updated network element, or an active request of an AMF network element.
  • an AMF network element for example, a remote AMF network element or a relay AMF network element
  • FIG. 9a and FIG. 9b for example, a specific implementation process of an AMF network element (for example, a remote AMF network element or a relay AMF network element) obtaining authorization information for adjacent services.
  • the authorization method provided in the embodiment of the present application may further include: the network element with the access and mobility management function sending an authorization information request message to the network element with the policy control function.
  • the policy control function network element receives the authorization information request message from the access and mobility management function network element.
  • the authorization information request message may be used to request the proximity service authorization information of the terminal device.
  • the adjacent service authorization information may be actively requested by the AMF network element.
  • the above S802 may include: when the terminal device is authorized as a remote terminal device or a relay terminal device, the access and mobility management function network element according to the adjacent service authorization information of the terminal device , to determine whether the terminal device is authorized to use the relay service code.
  • the specific implementation may refer to the corresponding implementation performed by the policy control function network element in S702 above, and the policy control function network element may be replaced by the access and mobility management function network element, which will not be repeated here.
  • the terminal device is a remote terminal device
  • the access and mobility management function network element determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device, It may include: the access and mobility management function network element determines whether the proximity service authorization information includes the relay service code. If yes, the terminal device is authorized to use the relay service code; otherwise, the terminal device is not authorized to use the relay service code.
  • terminal device 1 is a remote terminal device, and the proximity service authorization information of terminal device 1 includes remote terminal devices ⁇ RSC1, RSC2 ⁇ and relay terminal devices ⁇ RSC3, RSC4 ⁇ . If the authorization request message includes RSC1, then The access and mobility management function network element may determine that terminal device 1 is authorized to use RSC1 as a remote terminal device; if the authorization request message includes RSC5, terminal device 1 may determine that terminal device 1 is not authorized to use RSC5 as a remote terminal device.
  • terminal device 1 when terminal device 1 is a remote terminal device, the proximity service authorization information of terminal device 1 used by network elements with access and mobility management functions may only include information related to terminal device 1 as a remote terminal (referring to remote terminal device ⁇ RSC1, RSC2 ⁇ ), does not include the relevant information of the terminal device 1 as a relay terminal device (referring to the relay terminal device ⁇ RSC3, RSC4 ⁇ ), which is not limited in this application, and the above is only an example of this application.
  • the terminal device is a relay terminal device.
  • the above S802 may include: the access and mobility management function network element determines whether the terminal device is authorized to use the relay service code and whether the Authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the terminal device is a relay terminal device
  • the AMF network element can determine whether the relay terminal device is authorized to provide the connection service corresponding to the relay service code in the PLMN corresponding to the PLMN ID according to the adjacent service authorization information.
  • the access and mobility management functional network element may acquire the public land mobile network identifier of the network served by the access and mobility management functional network element.
  • the AMF network element may acquire the public land mobile network identifier of the network served by the AMF network element.
  • the above access and mobility management function network element determines whether the terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network corresponding to the public land mobile network identifier according to the adjacent service authorization information.
  • the relay service in the network may include: the access and mobility management function network element determines whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information does not include the relay service code, the terminal device is not authorized Use the relay service code; if the proximity service authorization information does not include the public land mobile network identifier, the terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the proximity service authorization information of terminal device 2 includes remote terminal devices ⁇ RSC3, RSC4 ⁇ , relay terminal devices ⁇ RSC1, RSC2 ⁇ , PLMN ID1 and PLMN ID2, if The authorization request message includes RSC1 and PLMN ID1, then the access and mobility management function network element can determine that terminal device 2 is authorized to use RSC1 as a relay terminal device and is authorized to relay services in the PLMN corresponding to PLMN ID1; if the authorization request If the message includes RSC4 and PLMN ID3, the access and mobility management function network element can determine that terminal device 2 is not authorized to use RSC4 as a relay terminal device, and is not authorized to relay services in the PLMN corresponding to PLMN ID3; if the authorization request message Including RSC1 and PLMN ID3, the access and mobility management function network element can determine that terminal device 2 is authorized to use RSC1 as a relay terminal device, and is not authorized to relay services in the PLMN
  • the network element with the access and mobility management function may, according to whether the adjacent service authorization information includes Following the service code and public land mobile network identifier, it is determined whether the terminal device is authorized to provide the connection service corresponding to the RSC in the PLMN corresponding to the PLMN ID.
  • the adjacent service authorization information includes remote terminal equipment ⁇ RSC3, RSC4 ⁇ , relay terminal equipment ⁇ PLMN ID1 (RSC1, RSC5), PLMN ID2 (RSC2, RSC6) ⁇ , if the authorization request If the message includes RSC1 and PLMN ID1, the access and mobility management function network element can determine that terminal device 2 is authorized to provide the connection service corresponding to RSC1 in the PLMN corresponding to PLMN ID1; if the authorization request message includes RSC1 and PLMN ID2, the access The network element with the mobility management function may determine that the terminal device 2 is not authorized to provide the connection service corresponding to the RSC1 in the PLMN corresponding to the PLMN ID2.
  • the terminal device 2 acts as a relay terminal device, and the proximity service authorization information of the terminal device 2 used by network elements with access and mobility management functions may only include information related to the terminal device 2 as a relay (referred to as the relay terminal device ⁇ PLMN ID1(RSC1, RSC5), PLMN ID2(RSC2, RSC6)) ⁇ , does not include the relevant information of terminal device 2 as a remote terminal device (referring to remote terminal device ⁇ RSC3, RSC4 ⁇ ), this application does not For limitation, the above is only an example of the present application.
  • the AMF network element can verify whether the relay terminal device is authorized to serve the remote end in the PLMN corresponding to the PLMN ID, and whether it is authorized to provide the relay service corresponding to the RSC.
  • the authorization method provided by the embodiment of the present application may also include: S805, when the terminal device is authorized to use the relay service code as the remote terminal device, the access and mobility management function network
  • the element sends a proximity service request message to the authentication server functional network element.
  • the authentication server functional network element receives the proximity service request message from the access and mobility management functional network element.
  • the proximity service request message may include a relay service code.
  • the remote AMF network element sends a Proximity Service Relay Key Request message (that is, a Proximity Service Request message) to the remote AUSF network element.
  • a Proximity Service Relay Key Request message that is, a Proximity Service Request message
  • the AMF network element triggers the P-KID derivation process to the AUSF network element, which can ensure that the P-KID corresponding to the authorized terminal device is deduced by the AUSF network element. -KID, do not deduce the P-KID corresponding to the unauthorized terminal device.
  • the authorization method provided by the embodiment of the present application may further include: S806, after the terminal device is authorized to use the relay service code and is authorized to be in the public land mobile network corresponding to the public land mobile network identifier
  • the access and mobility management function network element sends an authentication server function network element identification acquisition request message or a key acquisition request message to the unified data management network element.
  • the unified data management network element receives the authentication server function network element identity acquisition request message or the key acquisition request message from the access and mobility management function network element.
  • the authentication server function network element identifier acquisition request message may include an adjacent service key identifier or a subscription concealment identifier.
  • the key acquisition request message may include an adjacent service key identifier or a subscription concealment identifier.
  • the authentication server function network element identifier obtaining request message may include the adjacent service key identifier and the relay service code.
  • the key acquisition request message may include an adjacent service key identifier and a relay service code.
  • the authentication server function network element identifier acquisition request message may include a subscription concealment identifier and a relay service code.
  • the key acquisition request message may include a subscription concealment identifier and a relay service code.
  • the relay AMF network element may send an authentication server function network element identifier acquisition request message or a key acquisition request message (also called a relay key acquisition request message) to the remote UDM network element.
  • an authentication server function network element identifier acquisition request message or a key acquisition request message also called a relay key acquisition request message
  • the corresponding key is obtained only when the terminal device authorization check is passed (that is, the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier), Establish a relay communication connection, which can improve security.
  • the UDM network element may request an authorization check from the AMF network element when the AMF network element requests the AUSF network element instance identifier or requests to obtain a key.
  • the above-mentioned unified data management network element sending the authorization request message to the access and mobility management function network element may include: the UDM network element receives the authentication server function network element identifier acquisition request message from the AMF network element, or the password In the case of a key acquisition request message, send an authorization request message to the AMF network element.
  • the relay AMF network element determines whether the relay terminal device is authorized to provide the relay service corresponding to the relay service code, and if the relay terminal device is authorized to provide the relay service corresponding to the relay service code, the relay After the AMF network element discovers the remote UDM network element, and sends an authentication server function network element identifier acquisition request message or a key acquisition request message to the remote UDM network element, triggering the remote UDM network element to send an authorization request to the AMF network element message, the relay AMF network element determines whether the remote terminal device is authorized to use the relay service corresponding to the relay service code in the authorization request message.
  • the authorization method provided by the embodiment of the present application may further include: S807, when the terminal device is not authorized to use the relay service code and/or is not authorized to identify the corresponding public land mobile network
  • the access and mobility management function network element sends a non-access stratum response message to the terminal equipment.
  • the terminal device receives the non-access stratum response message from the access and mobility management function network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the authorization method provided in the embodiment of the present application may further include: the access and mobility management function network element sends an authorization response message to the unified data management network element.
  • the unified data management network element receives the authorization response message from the access and mobility management functional network element.
  • the authorization response (Namf_UEAuthorization response) message may indicate whether the terminal device is authorized to use the relay service code.
  • the remote AMF network element sends an authorization response message to the remote UDM network element, and the authorization response message may indicate whether the terminal device is authorized to use the relay service corresponding to the relay service code.
  • the UDM network element sends an authorization request message to the AMF network element, and the AMF network element sends an authorization response message to the UDM network element after determining whether the terminal device is authorized to use the relay service code.
  • the AMF network element when the authorization response message indicates that the terminal device is authorized to use the relay service code, after the UDM network element receives the authorization response message, the AMF network element directly requests the key from the AUSF network element, specifically referring to FIG. 8b . Or, when the authorization response message indicates that the terminal device is authorized to use the relay service code, after the UDM network element receives the authorization response message, the UDM network element requests the key from the AUSF network element, and provides the key to the AMF network element , specifically refer to FIG. 8c.
  • FIG. 8b is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Figure 8b takes the AMF network element directly requesting a key from the AUSF network element as an example.
  • the method shown in Figure 8b is applicable to the architecture shown in Figure 1- Figure 4, and can also be applied to other and various future network architectures , the corresponding names can also be used in other network frames structure, and the names of corresponding functions in various forms of network architectures in the future. Similar to FIG. 8a, the method shown in FIG. 8b is applicable to a scenario where the network element serving the remote terminal device is the same as or different from the network element serving the relay terminal device.
  • the authorization method includes the following steps:
  • the unified data management network element sends an authentication server function network element identifier acquisition response message to the access and mobility management function network element.
  • the access and mobility management function network element receives the authentication server function network element identification acquisition response message from the unified data management network element.
  • the certificate service function network element identifier acquisition response message may include the authentication server function network element instance identifier, and may also include the subscription permanent identifier.
  • the authentication server function network element instance identifier may be used to identify the authentication server function network element.
  • the relay AMF network element can obtain the remote AUSF network element according to the authentication server function network element instance identifier.
  • the remote UDM network element when the remote terminal device is authorized to use the relay service corresponding to the relay service code, the remote UDM network element sends a certificate service function network element identifier acquisition response message to the relay AMF network element.
  • the above S809 may include: when the authorization response message indicates that the terminal device is authorized to use the relay service code, the unified data management network element sends the authentication server function network element identifier to the access and mobility management function network element Get the response message.
  • the access and mobility management functional network element sends a proximity service request message to the authentication server functional network element.
  • the authentication server functional network element receives the proximity service request message from the access and mobility management functional network element.
  • the proximity service request message may include a P-KID, a relay service code and a random number.
  • the proximity service request message may include a permanent subscription identifier, a relay service code and a random number.
  • the relay AMF network element sends a proximity service request message (also called a proximity service remote key request message) to a remote AUSF network element.
  • a proximity service request message also called a proximity service remote key request message
  • the AMF network element may forward it to the AUSF network element.
  • the signed permanent ID can be used by AUSF network elements to obtain the corresponding intermediate key Kausf or ProSe root key.
  • the AUSF network element can obtain the intermediate key Kausf or the ProSe root key according to the permanent contract identifier or the adjacent service key identifier.
  • the AMF network element can send the adjacent service key identifier received from the terminal device to the AUSF network element, so that the AUSF network element can obtain the intermediate key Kausf or the ProSe root key according to the adjacent service key identifier.
  • the functional network element of the authentication server deduces a key.
  • the AUSF network element generates the freshness parameter, and deduces the remote key K R according to at least two of the intermediate key Kausf, the relay service code, the freshness parameter and the random number, or according to the ProSe root key, At least two of the relay service code, the freshness parameter and the random number are used to derive the remote key K R .
  • the intermediate key Kausf may be obtained by the AUSF network element according to the permanent subscription identifier or the adjacent service key identifier.
  • the authentication server function network element sends the proximity service response message to the access and mobility management function network element.
  • the access and mobility management functional network element receives the proximity service response message from the authentication server functional network element.
  • the proximity service response message may include a key (such as a remote key K R ) and a freshness parameter.
  • the proximity service response message can be called the proximity service key response message, which is not correct in this application Qualify near the name of the business response message.
  • the AMF network element can directly request the key from the AUSF network element, and the AUSF network element obtains the key and sends it to the AMF network element.
  • Fig. 8c is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Figure 8c takes the UDM network element requesting a key from the AUSF network element and providing the key to the AMF network element as an example.
  • the method shown in Figure 8c is applicable to the architecture shown in Figures 1-4, and can also be applied to other, And in various forms of network architectures in the future, corresponding names may also be replaced with names of corresponding functions in other network architectures and various forms of network architectures in the future. Similar to FIG. 8a, the method shown in FIG. 8c is applicable to a scenario where the network element serving the remote terminal device is the same or different from the network element serving the relay terminal device.
  • the authorization method includes the following steps:
  • the unified data management network element sends the proximity service request message to the authentication server functional network element.
  • the authentication server functional network element receives the proximity service request message from the unified data management network element.
  • the proximity service request message may include a permanent subscription identifier, a relay service code and a random number.
  • the signed permanent identity is used by the AUSF network element to obtain the intermediate key Kausf or the ProSe root key to generate a key, such as the remote key K R .
  • the remote UDM network element sends the proximity service request message to the remote AUSF network element.
  • the above S813 may include: when the authorization response message indicates that the terminal device is authorized to use the relay service code, the unified data management network element sends the proximity service request message to the authentication server functional network element.
  • the authentication server function network element sends an approaching service response message to the unified data management network element.
  • the unified data management network element receives the proximity service response message from the authentication server functional network element.
  • the proximity service response message may include a key (such as a remote key K R ), and a freshness parameter.
  • the unified data management network element sends a key acquisition response message to the access and mobility management functional network element.
  • the access and mobility management function network element sends a key acquisition response message to the unified data management network element.
  • the key acquisition response message may include a key (such as a remote key K R ), and a freshness parameter.
  • the UDM network element can request a key from the AUSF network element, the AUSF network element obtains the key and sends it to the UDM network element, and the UDM network element provides the key to the AMF network element.
  • the AMF network element obtains the relay service code of the terminal device, and determines whether the terminal device is authorized to use the relay service code according to the adjacent service authorization information of the terminal device.
  • the relay service code is used to identify The connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • Fig. 9a is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Figure 9a uses the AMF network element to obtain the authorization information of adjacent services during the terminal device registration process and the terminal device's active request policy process as an example.
  • the method shown in Figure 9a can be combined with the methods shown in Figures 8a-8c use or alone.
  • a terminal device can be a remote terminal device or a relay terminal device
  • an AMF network element can be called a remote AMF network element or a relay AMF network element
  • a PCF network element can be called a remote PCF network element. element or relay PCF network element.
  • the authorization method includes the following steps:
  • the terminal device sends a registration request message or a policy provision request message to an access and mobility management functional network element.
  • the access and mobility management function network element receives the registration request message or the policy provision request message from the terminal device.
  • the registration request message may include adjacent service capability information.
  • the proximity service capability information may be used to indicate the proximity service capability supported by the terminal device.
  • the capability information of adjacent services may include one or more of the following: 5G adjacent service direct discovery capability (5G ProSe direct discovery), 5G adjacent service direct communication capability (5G ProSe direct communication), 5G adjacent service layer 2 terminal equipment To network relay (5G ProSe layer-2 UE-to-network relay), 5G near service layer 3 terminal equipment to network relay (5G ProSe layer-3 UE-to-network relay), 5G near service layer 2 remote Terminal equipment (5G ProSe layer-2 remote UE), 5G adjacent service layer 3 remote terminal equipment (5G ProSe layer-3 remote UE).
  • 5G adjacent service direct discovery capability 5G ProSe direct discovery
  • 5G adjacent service direct communication capability 5G adjacent service layer 2 terminal equipment To network relay
  • 5G ProSe layer-3 UE-to-network relay 5G near service layer 3 terminal equipment to network relay
  • 5G ProSe layer-2 remote UE 5G near service layer 2 remote Terminal equipment
  • 5G ProSe layer-3 remote terminal equipment 5G ProSe layer-3 remote UE
  • the policy provisioning request message may be used to request adjacent service authorization information.
  • the policy provision request message may include a terminal device policy container, and the terminal device policy container may include a 5G proximity service policy provision request.
  • the terminal device registration process corresponds to the registration request message, and the terminal device actively requests the policy process to correspond to the policy provision request message.
  • the terminal device actively requests the policy process to correspond to the policy provision request message.
  • the terminal device can actively initiate a policy provision request.
  • the access and mobility management function network element determines the PCF network element according to the adjacent service capability information.
  • the determined PCF network element supports providing adjacent service authorization information.
  • the AMF network element selects a PCF network element that supports distribution of the nearby service authorization information according to the nearby service capability information.
  • S902 may be executed in the terminal device registration process, and S902 may not be executed in the terminal device active request policy process.
  • the access and mobility management function network element sends a policy control creation request message or a policy control update request message to the policy control function network element.
  • the policy control function network element receives the policy control creation request message or the policy control update request message from the access and mobility management function network element.
  • the policy control creation (Npcf_UEpolicyControl_Create) request message may include the permanent subscription identifier of the terminal device.
  • the policy control creation request message may also include, but not limited to: service network name and/or terminal device policy container.
  • the policy control update (Npcf_UEPolicyControl_Update) request message may include a terminal device policy container.
  • the terminal device policy container is provided by the terminal device, and the terminal device policy container may include but not limited to one or more of the following: policy section identifier (policy section identifier, PSI), operating system identifier, terminal device support Access network discovery and selection policy (access network discovery&selection policy, ANDSP) indication, 5G ProSe policy provision request indication.
  • policy section identifier policy section identifier, PSI
  • operating system identifier operating system identifier
  • terminal device support Access network discovery and selection policy access network discovery&selection policy, ANDSP
  • 5G ProSe policy provision request indication 5G ProSe policy provision request indication.
  • the terminal device registration process corresponds to the policy control creation request message
  • the terminal device actively requests The policy seeking process corresponds to the policy control update request message.
  • the policy control function network element sends a policy control creation response message or a policy control update response message to the access and mobility management function network element.
  • the access and mobility management function network element receives the policy control creation response message or the policy control update response message from the policy control function network element.
  • the policy control create (Npcf_UEpolicyControl_Create) response message may include a policy control request trigger parameter.
  • the terminal device registration process corresponds to a policy control creation response message, and the terminal device actively requests a policy process corresponding to a policy control update response message (Npcf_UEPolicyControl_Update).
  • the network element with the policy control function sends a communication message to the network element with the access and mobility management function.
  • the access and mobility management function network element receives the communication message from the policy control function network element.
  • the communication message may include proximity service authorization information.
  • the communication message may also include a policy container, and the policy container may include adjacent service policy information.
  • the adjacent service policy information can be used to perform a discovery process, establish relay communication, direct communication, and the like.
  • the PCF network element acquires policy subscription-related information (such as nearby service authorization information) and the latest PSI list from the UDR network element.
  • policy subscription-related information such as nearby service authorization information
  • the communication message may be called a communication N1N2 message (Namf_Communication_N1N2Message).
  • the terminal device actively requests the policy process, and the communication message may be called a communication N1N2 message transfer (Namf_Communication_N1N2MessageTransfer) message.
  • the PCF network element may send corresponding proximity service authorization information according to whether the terminal device is authorized as a remote terminal device or a relay terminal device.
  • the proximity service authorization information may include: a relay service code. If the terminal device is authorized as a relay terminal device, the proximity service authorization information may include: a relay service code and a public land mobile network identifier. If the terminal device is authorized as both a remote terminal device and a relay terminal device, the proximity service authorization information may include: the corresponding relay service code when used as a remote terminal, and the corresponding relay service code when used as a relay , and public land mobile network identification.
  • the communication message may also include authorization indication information.
  • authorization indication information For a specific implementation manner of the authorization indication information, reference may be made to the above S804, which will not be repeated here.
  • the access and mobility management functional network element stores the adjacent service authorization information.
  • both the terminal device registration process and the terminal device active request policy process include S906 and the following S907-S909.
  • the access and mobility management functional network element sends the terminal device policy container to the terminal device.
  • the terminal device receives the terminal device policy container from the access and mobility management functional network element.
  • the terminal device sends the terminal device policy container transmission result to the access and mobility management functional network element.
  • the access and mobility management functional network element receives the terminal device policy container transmission result from the terminal device.
  • the access and mobility management functional network element sends a communication N1 message notification to the policy control functional network element.
  • the terminal device receives the communication N1 message notification from the access and mobility management functional network element.
  • the communication N1 message notification (Namf_Communication_N1messageNotify) may be used to notify the PCF network element whether the terminal device has received the adjacent service policy information.
  • the above S909 may be an optional step.
  • Fig. 9b is a schematic flowchart of another authorization method provided by the embodiment of the present application.
  • Fig. 9b uses the PCF network element to actively send the adjacent service authorization information to the AMF network element after detecting the policy update as an example.
  • the method shown in Fig. 9b can be used in combination with the methods shown in Figs. 8a-8c or used alone. Similar to FIG. 9a, the method shown in FIG. 9b is applicable to a scenario where the network element serving the remote terminal device is the same as or different from the network element serving the relay terminal device.
  • the authorization method includes the following steps:
  • the network element with the policy control function determines that the policy information of the adjacent service of the terminal device is updated.
  • the PCF network element receives new adjacent service policy information from the UDR network element.
  • the PCF network element detects that the adjacent service policy information of the terminal device is updated.
  • the network element with the policy control function sends a communication message to the network element with the access and mobility management function.
  • the access and mobility management function network element receives the communication message from the policy control function network element.
  • the communication message may include the proximity service authorization information of the terminal device.
  • the communication message may also include a policy container, and the policy container may include adjacent service policy information.
  • the specific implementation manner of the communication message reference may be made to the foregoing S905, which will not be repeated here.
  • the communication message may be called a communication N1N2 message transfer (Namf_Communication_N1N2MessageTransfer) message.
  • the method shown in Fig. 9b may further include: S912-S915.
  • S912-S915 For the implementation of S912-S915, reference may be made to the above-mentioned S906-S909, which will not be repeated here.
  • FIG. 10 is a schematic flowchart of another authorization method provided in the embodiment of the present application.
  • Figure 10 uses the remote PCF network element to verify whether the remote terminal device is authorized to use the relay service code during the process of the terminal device triggering the request key, and the relay PCF network element to verify the relay terminal device during the establishment of the relay communication connection Whether authorized to use the relay service code is taken as an example to describe the method shown in FIG. 7 in detail.
  • FIG. 10 illustrates that the method shown in FIG. 7 is applicable to the scenario shown in FIG. 5 , and the method shown in FIG. 7 is also applicable to the scenario shown in FIG. 6 , which will not be repeated in this application.
  • the method shown in FIG. 10 is applicable to a scenario where the network element serving the remote terminal device is the same or different from the network element serving the relay terminal device.
  • the remote PCF network element and the relay PCF network element may be the same PCF network element, and the remote AMF network element and the relay AMF network element may be the same AMF network element.
  • the authorization method includes the following steps:
  • the remote terminal device sends a non-access stratum request message to the remote AMF network element.
  • the remote AMF network element receives the non-access stratum request message from the remote terminal device.
  • the non-access stratum request message may include a relay service code.
  • the non-access stratum request message may be called a non-access stratum relay key request message.
  • the method provided in this embodiment of the present application may further include: the remote terminal device registers with the network.
  • the remote terminal device may acquire service authorization and adjacent service policy information from the network.
  • the relay service code may be obtained by the remote terminal device from adjacent service policy information.
  • the remote AMF network element determines whether the remote terminal device is authorized as the remote terminal device according to the nearby service subscription information of the remote terminal device.
  • S1002 may be an optional step.
  • the remote AMF network element sends an authorization request message to the remote PCF network element.
  • the remote PCF network element receives the authorization request message from the remote AMF network element.
  • the authorization request message may be used to request to verify whether the remote terminal device is authorized to use the relay service code.
  • the authorization request message includes a relay service code from the remote terminal device.
  • the remote AMF network element serves the remote terminal equipment.
  • the authorization request message may further include one or more of the following: terminal indication information, an identifier of the remote terminal device, and a context identifier of the remote terminal device.
  • the terminal indication information may be used to indicate that the terminal device is a remote terminal device.
  • the identifier of the remote terminal device or the context identifier of the remote terminal device may be used to acquire the proximity service authorization information of the remote terminal device.
  • the identifier of the remote terminal device may be the SUPI or SUCI of the remote terminal device.
  • the authorization request message may indicate that the terminal device requesting verification is a relay terminal device.
  • the remote PCF network element may determine, according to the authorization request message, whether the type of the terminal device requesting verification is a relay terminal device or a remote terminal device.
  • the above S701 may include: when the terminal device is authorized as a remote terminal device, the remote access and mobility management function network element sends an authorization request message to the remote policy control function network element .
  • the remote AMF network element does not send an authorization request message to the remote PCF network element, which can prevent the remote PCF network element from determining whether the terminal device is authorized to use the trunk Service code, so as to avoid waste of resources.
  • the remote PCF network element determines whether the remote terminal device is authorized to use the relay service code according to the nearby service authorization information of the remote terminal device.
  • the adjacent service authorization information may be determined by the remote policy control function network element according to the identifier of the remote terminal device and/or the context identifier of the remote terminal device.
  • the remote PCF network element sends an authorization response message to the remote AMF network element.
  • the remote AMF network element receives the authorization response message from the remote PCF network element.
  • the authorization response message may indicate authorization or unauthorized, or the authorization response message may indicate authorization success or authorization failure.
  • the authorization response message may indicate whether the remote terminal device is authorized to use the relay service code.
  • Authorization ring For the specific implementation manner of the response message, refer to the implementation manner of the authorization response message when the terminal device is a remote terminal device in S703 , which will not be repeated here.
  • the remote AMF network element sends a proximity service request message to the remote AUSF network element.
  • the remote AUSF network element receives the proximity service request message from the remote AMF network element.
  • the proximity service request message may include a relay service code.
  • the relay service code is obtained by the remote AMF network element from the remote terminal equipment.
  • the proximity service request message may be called a proximity service relay key request message.
  • the remote AMF network element triggers the P-KID deduction process to the remote AUSF network element, which can ensure that the remote AUSF The network element deduces the P-KID corresponding to the authorized remote terminal device, and does not deduce the P-KID corresponding to the unauthorized remote terminal device, which can improve security.
  • the remote AUSF network element sends an approaching service response message to the remote AMF network element.
  • the remote AMF network element receives the proximity service response message from the remote AUSF network element.
  • the proximity service response message may be called a proximity service relay key response message, which is not limited in this application.
  • the remote AMF network element sends a non-access stratum response message to the remote terminal device.
  • the remote terminal device receives the NAS response message from the remote AMF network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, indicates that the key request fails.
  • the authorization response message indicates that the remote terminal device is not authorized to use the relay service code
  • the above S1006-S1010 may not be performed, and S1011 may be directly performed.
  • the remote terminal device is not authorized to use the relay service code, the remote terminal device is notified that the key request fails, which can improve security.
  • the non-access stratum response message may be used to indicate that the request is successful, for example, to indicate that the key request is successful.
  • the authorization response message indicates that the remote terminal device is authorized to use the relay service code
  • the above S1006-S1011 may be executed.
  • S1012-S1014 may refer to the above-mentioned S510-S512, which will not be repeated here.
  • the remote terminal device in the relay terminal device discovery process, the remote terminal device generates a P-KID, and sends a direct communication request message to the relay terminal device.
  • the relay terminal device sends a non-access stratum request message to the relay AMF network element.
  • the relay AMF network element receives the non-access stratum request message from the relay terminal device.
  • the non-access stratum request message may be called a NAS remote key request message.
  • the non-access stratum request message may include a relay service code.
  • the non-access stratum request message may also include an adjacent service key identifier and a random number.
  • the relay AMF network element determines whether the relay terminal device is authorized as the relay terminal device according to the nearby service subscription information of the relay terminal device.
  • S1016 may be an optional step.
  • the relay AMF network element sends an authorization request message to the relay PCF network element.
  • the relay PCF network element receives the authorization request message from the relay AMF network element.
  • the authorization request message may be used to request to verify whether the relay terminal device is authorized to use the relay service code.
  • the authorization request message includes a relay service code from the relay terminal device.
  • the relay AMF network element serves the relay terminal equipment.
  • the authorization request message may further include one or more of the following: terminal indication information, an identifier of the relay terminal device, a context identifier of the relay terminal device, and a public land mobile network identifier.
  • the terminal indication information may be used to indicate that the terminal device is a relay terminal device.
  • the identifier of the relay terminal device or the context identifier of the relay terminal device may be used to acquire the proximity service authorization information of the relay terminal device.
  • the identifier of the relay terminal device may be the SUPI or SUCI of the relay terminal device.
  • the public land mobile network identifier may be obtained by the relay access and mobility management functional network element according to the network served by the relay access and mobility management functional network element.
  • the authorization request message may indicate that the terminal device requesting verification is a relay terminal device.
  • the relay PCF network element may determine, according to the authorization request message, whether the type of the terminal device requesting verification is a relay terminal device or a remote terminal device.
  • the above S701 may include: when the relay terminal device is authorized as a relay terminal device, the network element with the relay access and mobility management function sends the authorization to the network element with the relay policy control function request message.
  • the relay AMF network element does not send an authorization request message to the relay PCF network element, which can prevent the relay PCF network element from determining whether the relay terminal device is authorized. Authorize the use of relay service codes, thereby avoiding waste of resources.
  • the relay PCF network element determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device.
  • the adjacent service authorization information may be determined by the relay policy control function network element according to the identifier of the relay terminal device and/or the context identifier of the relay terminal device.
  • the authorization request message also includes the public land mobile network identifier
  • the above S1018 may include: the relay policy control function network element determines whether the relay terminal device is authorized to use the relay service according to the adjacent service authorization information code and whether it is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the specific implementation manner can be referred to correspondingly described in the above S702, and will not be repeated here.
  • the authorization request message indicates that the terminal device is a relay terminal device
  • the relay PCF network element can The near service authorization information determines whether the relay terminal device is authorized to provide the connection service corresponding to the relay service code in the PLMN corresponding to the PLMN ID.
  • the above-mentioned relay policy control function network element determines whether the relay terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network identifier corresponding to the public land mobile network according to the adjacent service authorization information.
  • the relay service in the mobile network may include: the relay policy control function network element determines whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information does not include the relay service code, the relay terminal The device is not authorized to use the relay service code; if the adjacent service authorization information does not include the public land mobile network identifier, the relay terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the specific implementation manner can be referred to correspondingly described in the above S702, and will not be repeated here.
  • the relay policy control function network element can determine whether the relay terminal device is authorized to provide the PLMN corresponding to the RSC according to whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier. Connection service.
  • the specific implementation manner can be referred to correspondingly described in the above S702, and will not be repeated here.
  • the relay terminal device is authorized to serve the remote end in the PLMN corresponding to the PLMN ID, and whether it is authorized to provide the relay service corresponding to the RSC.
  • the relay PCF network element sends an authorization response message to the relay AMF network element.
  • the relay AMF network element receives the authorization response message from the relay PCF network element.
  • the authorization response message may indicate authorization or unauthorized, or the authorization response message may indicate authorization success or authorization failure.
  • the authorization response message may indicate whether the relay terminal device is authorized to use the relay service code.
  • the authorization response message indicates whether the relay terminal device is authorized to use the relay service code. Specifically, it may be: indicating whether the relay terminal device is authorized to use the relay service code and whether it is authorized to use the relay service code corresponding to the public land mobile network identifier. Relay service in public land mobile network.
  • the relay access and mobility management function network element sends an authentication server function network element identifier acquisition request message to the remote unified data management network element.
  • the remote unified data management network element receives the authentication server function network element identification acquisition request message from the relay access and mobility management function network element.
  • the authentication server function network element identifier acquisition request message may include an adjacent service key identifier.
  • the successful authorization of the relay terminal device may refer to that the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay AMF network element can request a key from the remote AUSF network element, so as to ensure that the authorized relay terminal device obtains the corresponding key, and establishes the PC5 even Then, unauthorized relay terminal devices cannot obtain the corresponding key, which can improve security.
  • the remote UDM network element sends an authentication server function network element identifier acquisition response message to the relay AMF network element.
  • the relay AMF network element receives the authentication server function network element identification acquisition response message from the remote UDM network element.
  • the response message for acquiring the authentication server function network element identifier may include the AUSF instance ID of the AUSF serving the remote terminal device.
  • the relay AMF network element sends an adjacent service request message to the remote AUSF network element.
  • the remote AUSF network element receives the proximity service request message from the relay AMF network element.
  • the proximity service request message may include a relay service code.
  • the relay service code is obtained by the remote AMF network element from the remote terminal equipment.
  • the proximity service request message may be called a proximity service remote key request message.
  • the proximity service request message may also include a P-KID and/or a random number.
  • the relay AMF network element triggers the remote key derivation process to the remote AUSF network element, which can improve security.
  • the remote AUSF network element deduces the remote key.
  • the remote AUSF network element sends an adjacent service response message to the relay AMF network element.
  • the relay AMF network element receives the proximity service response message from the remote AUSF network element.
  • the proximity service response message may include a key (such as a remote key K R ) and a freshness parameter.
  • the proximity service response message may be called the proximity service remote key response message, and this application does not limit the name of the proximity service response message.
  • the relay AMF network element sends a non-access stratum response message to the relay terminal device.
  • the relay terminal device receives the NAS response message from the relay AMF network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the relay terminal device authorization failure may refer to that the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the authorization response message indicates that the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier
  • the For the above S1020-S1024 directly execute S1025.
  • the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the relay terminal device is notified that the key request fails, Can improve security.
  • the non-access stratum response message can be used to indicate that the request is successful , for example to indicate that the key request was successful.
  • the authorization response message indicates that the relay terminal device is authorized to use the relay service code
  • the above S1020-S1024 may be performed.
  • the NAS response message may include remote key and freshness parameters.
  • the remote PCF network element interacts with the remote AMF network element to obtain the trunk service code from the remote terminal device, and determines whether the remote terminal device is authorized to use the relay service code.
  • the relay PCF network element obtains the relay service code from the relay terminal device through interaction with the relay AMF network element, and determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device , the relay service code is used to identify the connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • FIG. 11 is a schematic flowchart of another authorization method provided in the embodiment of the present application.
  • Figure 11 uses the remote AMF network element to verify whether the remote terminal device is authorized to use the relay service code during the process of the terminal device triggering the request key, and the relay AMF network element to verify the relay terminal device during the establishment of the relay communication connection
  • the method shown in FIG. 8a will be described in detail by taking whether to be authorized to use the relay service code as an example.
  • FIG. 11 illustrates that the method shown in FIG. 8a is applicable to the scenario shown in FIG. 5 , and the method shown in FIG. 8a is also applicable to the scenario shown in FIG. 6 , which will not be repeated in this application.
  • the method shown in FIG. 11 is applicable to a scenario where the network element serving the remote terminal device is the same or different from the network element serving the relay terminal device.
  • the remote PCF network element and the relay PCF network element may be the same PCF network element, and the remote AMF network element and the relay AMF network element may be the same AMF network element.
  • the authorization method includes the following steps:
  • the remote policy control functional network element sends a communication message to the remote access and mobility management functional network element.
  • the remote access and mobility management function network element receives the communication message from the remote policy control function network element.
  • the communication message may include proximity service authorization information.
  • the remote access and mobility management functional network element may store the proximity service authorization information.
  • the communication message may further include authorization indication information, and the authorization indication information may indicate that the proximity service authorization information is the proximity service authorization information corresponding to the terminal device as the remote terminal device.
  • the proximity service authorization information may be sent by the remote PCF network element to the remote AMF network element during the registration process of the remote terminal device, or during the active request policy process of the remote terminal device, or the remote PCF network element After the policy update is detected, it is sent to the remote AMF network element actively, or the remote AMF network element actively requests it.
  • the remote PCF network element may be sent to the remote AMF network element actively, or the remote AMF network element actively requests it.
  • the remote AMF network element determines whether the remote terminal device is authorized to use the relay service code according to the nearby service authorization information of the remote terminal device.
  • the proximity service authorization information may be obtained by the remote access and mobility management functional network element from the remote policy control functional network element.
  • the remote AMF network element sends a proximity service request message to the remote AUSF network element.
  • the remote AUSF network element receives the proximity service request message from the remote AMF network element.
  • the proximity service request message may include a relay service code.
  • the relay service code is obtained by the remote AMF network element from the remote terminal equipment.
  • the proximity service request message may be called a proximity service relay key request message.
  • the remote AMF network element triggers the P-KID deduction process to the remote AUSF network element, which can ensure that the remote AUSF The network element deduces the P-KID corresponding to the authorized remote terminal device, and does not deduce the P-KID corresponding to the unauthorized remote terminal device, which can improve security.
  • the remote AUSF network element sends an approaching service response message to the remote AMF network element.
  • the remote AMF network element receives the proximity service response message from the remote AUSF network element.
  • the proximity service response message may be called a proximity service relay key response message, which is not limited in this application.
  • the remote AMF network element sends a non-access stratum response message to the remote terminal device.
  • the remote terminal device receives the NAS response message from the remote AMF network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the above S1105-S1109 may not be performed, and S1110 may be directly performed.
  • the remote terminal device is not authorized to use the relay service code, the remote terminal device is notified that the key request fails, which can improve security.
  • the non-access stratum response message may be used to indicate that the request is successful, for example, to indicate that the key request is successful.
  • the above S1105-S1109 may be performed.
  • S1111-S1113 may refer to the above-mentioned S510-S512, which will not be repeated here.
  • the remote terminal device in the relay terminal device discovery process, the remote terminal device generates a P-KID, and sends a direct communication request message to the relay terminal device.
  • the relay terminal device sends a non-access stratum request message to the relay AMF network element.
  • the relay AMF network element receives the non-access stratum request message from the relay terminal device.
  • the relay AMF network element determines whether the relay terminal device is authorized as the relay terminal device according to the nearby service subscription information of the relay terminal device.
  • the terminal equipment is a relay terminal equipment. , and will not be repeated here.
  • S1115 may be an optional step.
  • the relay policy control functional network element sends a communication message to the relay access and mobility management functional network element.
  • the relay access and mobility management function network element receives the communication message from the relay policy control function network element.
  • the communication message may include proximity service authorization information.
  • the relay access and mobility management functional network element may store the proximity service authorization information.
  • the communication message may further include authorization indication information, and the authorization indication information may indicate that the proximity service authorization information is the proximity service authorization information corresponding to the terminal device serving as the relay terminal device.
  • the proximity service authorization information may be sent by the relay PCF network element to the relay AMF network element during the registration process of the relay terminal device, or during the process of the relay terminal device actively requesting a policy, or the relay PCF network element After the policy update is detected, it is sent to the relay AMF network element actively, or the relay AMF network element actively requests it.
  • the relay PCF network element may be sent to the relay AMF network element actively, or the relay AMF network element actively requests it.
  • S1116 may be executed at any time before S1117.
  • the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device.
  • the adjacent service authorization information may be obtained by the relay access and mobility management functional network element from the relay policy control functional network element.
  • the terminal device is a relay terminal device.
  • the above S1117 may include: the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code and whether it is Authorize to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code and whether it is Authorize to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the above-mentioned relay AMF network element determines whether the relay terminal device is authorized to use the relay service code and whether it is authorized to use the public land mobile network corresponding to the public land mobile network identifier according to the adjacent service authorization information.
  • the intermediate relay service may include: the relay access and mobility management function network element determines whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information does not include the relay service code, the relay terminal The device is not authorized to use the relay service code; if the adjacent service authorization information does not include the public land mobile network identifier, the relay terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier; if the adjacent service authorization information does not include the relay service code, the relay terminal device is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay access and mobility management function network element can determine whether the relay terminal device is authorized to provide the relay terminal device in the PLMN corresponding to the PLMN ID according to whether the adjacent service authorization information includes the relay service code and the public land mobile network identifier.
  • the connection service corresponding to RSC For a specific implementation manner, reference may be made to corresponding descriptions in S802 above, and details are not repeated here.
  • the relay AMF network element can verify whether the relay terminal device is authorized to operate on the PLMN corresponding to the PLMN ID The remote service in the center, and whether it is authorized to provide the relay service corresponding to RSC.
  • the relay access and mobility management function network element sends an authentication server function network element identification acquisition request message to the remote unified data management network element.
  • the remote unified data management network element receives the authentication server function network element identification acquisition request message from the relay access and mobility management function network element.
  • the successful authorization of the relay terminal device may refer to that the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay AMF network element can request a key from the remote AUSF network element, so as to ensure that the authorized relay terminal device obtains the corresponding key, and establishes the PC5 connection, unauthorized relay terminal devices cannot obtain the corresponding key, which can improve security.
  • the relay AMF network element sends a non-access stratum response message to the relay terminal device.
  • the relay terminal device receives the NAS response message from the relay AMF network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the relay terminal device authorization failure may refer to that the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the above S1118-S1122 may not be performed , directly execute S1123.
  • the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the relay terminal device is notified that the key request fails, Can improve security.
  • the non-access stratum response message can be used to indicate that the request is successful, such as indicating the password The key request was successful.
  • the authorization response message indicates that the relay terminal device is authorized to use the relay service code
  • the above S1118-S1122 may be performed.
  • the NAS response message may include remote key and freshness parameters.
  • the remote AMF network element determines whether the remote terminal device is authorized to use the relay service code according to the proximity service authorization information of the remote terminal device.
  • the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device. In this way, it can be verified whether the terminal device is authorized to use the relay service identified by the relay service code, thereby ensuring the security of establishing the relay communication connection.
  • Fig. 12 is a schematic flow chart of another authorization method provided by the embodiment of the present application.
  • Figure 12 takes the remote AMF network element to verify whether the remote terminal device is authorized to use the relay service code during the establishment of the relay communication connection, and the relay AMF network element to verify whether the relay terminal device is authorized to use the relay service code as an example The method shown in Fig. 8a is described in detail.
  • the method shown in FIG. 12 is applicable to a scenario where the network element serving the remote terminal device is the same or different from the network element serving the relay terminal device.
  • the remote PCF network element and the relay PCF network element may be the same PCF network element, and the remote AMF network element and the relay AMF network element may be the same AMF network element.
  • the authorization method includes the following steps:
  • the remote terminal device in the relay terminal device discovery process, the remote terminal device generates a P-KID, and sends a direct communication request message to the relay terminal device.
  • S1205 may be an optional step.
  • the relay access and mobility management function network element acquires the proximity service authorization information of the relay terminal device.
  • the proximity service authorization information may be sent by the relay PCF network element to the relay AMF network element during the registration process of the relay terminal device, or during the process of the relay terminal device actively requesting a policy, or the relay PCF network element After the policy update is detected, it is sent to the relay AMF network element actively, or the relay AMF network element actively requests it.
  • the relay PCF network element may be sent to the relay AMF network element actively, or the relay AMF network element actively requests it.
  • S1206 may be executed at any time before S1207.
  • the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device.
  • the relay access and mobility management function network element sends an authentication server function network element identifier acquisition request message or a key acquisition request message to the remote unified data management network element.
  • the remote unified data management network element receives the authentication server function network element identity acquisition request message or the key acquisition request message from the relay access and mobility management function network element.
  • the successful authorization of the relay terminal device may refer to that the relay terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the authentication server function network element identifier acquisition request message may include an adjacent service key identifier or a subscription concealment identifier.
  • the authentication server function network element identifier acquisition request message may include a subscription concealment identifier and a relay service code.
  • the key acquisition request message may include an adjacent service key identifier and a relay service code.
  • the key acquisition request message may include a subscription concealment identifier and a relay service code.
  • the relay AMF network element may send an authentication server function network element identifier acquisition request message or a key acquisition request message (also called a relay key acquisition request message) to the remote UDM network element.
  • an authentication server function network element identifier acquisition request message or a key acquisition request message also called a relay key acquisition request message
  • the corresponding key is obtained only when the terminal device authorization check is passed (that is, the terminal device is authorized to use the relay service code and is authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier), Establish a relay communication connection, which can improve security.
  • the remote unified data management network element according to the remote The nearby service subscription information of the end terminal device determines whether the remote terminal device is authorized as a remote terminal device.
  • the UDM network element may obtain the adjacent service subscription information according to the adjacent service key identifier or the subscription permanent identifier.
  • S1209 may be an optional step.
  • the remote unified data management network element sends an authorization request message to the remote access and mobility management functional network element.
  • the remote access and mobility management function network element receives the authorization request message from the remote unified data management network element.
  • the authorization request message is used to request to verify whether the remote terminal device is authorized to use the relay service code.
  • the authorization request message may include the subscription permanent identifier and the relay service code of the remote terminal device.
  • the subscription permanent identifier can be used by network elements with remote access and mobility management functions to obtain the proximity service authorization information of remote terminal equipment.
  • the permanent subscription identifier may be determined by the remote unified data management network element according to the adjacent service key identifier or the hidden subscription identifier.
  • S1210 refers to the implementation of the unified data management network element sending an authorization request message to the access and mobility management function network element in S801 above, and the unified data management network element can be replaced by the remote unified
  • the access and mobility management function network element is replaced by the remote access and mobility management function network element, which will not be repeated here.
  • the remote access and mobility management function network element acquires the proximity service authorization information of the remote terminal device.
  • the proximity service authorization information may be sent by the remote PCF network element to the remote AMF network element during the registration process of the remote terminal device, or during the active request policy process of the remote terminal device, or the remote PCF network element After the policy update is detected, it is sent to the remote AMF network element actively, or the remote AMF network element actively requests it.
  • the remote PCF network element may be sent to the remote AMF network element actively, or the remote AMF network element actively requests it.
  • the remote AMF network element determines whether the remote terminal device is authorized to use the relay service code according to the nearby service authorization information of the remote terminal device.
  • the remote AMF network element sends an authorization response message to the remote UDM network element.
  • the remote UDM network element receives the authorization response message from the remote AMF network element.
  • the authorization response message may indicate whether the remote terminal device is authorized to use the relay service corresponding to the relay service code.
  • the authorization method may include: S1214-S1217, and the specific implementation may refer to the above-mentioned FIG. 8b, which will not be repeated here.
  • the authorization response message indicates that the remote terminal device is authorized to use the relay service code
  • the remote UDM network element requests the key from the remote AUSF network element, and
  • the authorization method provided in the embodiment of the present application may include: S1218-S1221, and the specific implementation may refer to the above-mentioned FIG. 8c, which will not be repeated here.
  • the relay access and mobility management function network element sends an authentication server function network element identifier acquisition request message to the remote unified data management network element
  • the remote AMF network element may directly send the remote AUSF
  • the network element requests a key, and the authorization method provided in this embodiment of the application may include: S1214-S1217.
  • the proximity service request message in S1215 includes the proximity service key identifier. If the authentication server function network element identifier acquisition request message in S1208 includes the subscription concealment identifier, correspondingly, the proximity service request message in S1215 includes the subscription permanent identifier.
  • the remote UDM network element may request the key from the remote AUSF network element, And provide the key to the remote AMF network element, the authorization method provided by the embodiment of the present application may include: S1218-S1221.
  • the proximity service request message in S1218 includes the proximity service key identifier. If the key acquisition request message in S1208 includes the subscription concealment identifier, correspondingly, the proximity service request message in S1218 includes the subscription permanent identifier.
  • the relay AMF network element sends a non-access stratum response message to the relay terminal device.
  • the relay terminal device receives the NAS response message from the relay AMF network element.
  • the non-access stratum response message may be used to indicate that the request fails, for example, to indicate that the key request fails.
  • the relay terminal device authorization failure may refer to that the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier.
  • the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the above S1208-S1221 may not be performed , directly execute S1222.
  • the relay terminal device is not authorized to use the relay service code and/or is not authorized to relay services in the public land mobile network corresponding to the public land mobile network identifier, the relay terminal device is notified that the key request fails, Can improve security.
  • the non-access stratum response message can be used to indicate that the request is successful, such as indicating the password The key request was successful.
  • the authorization response message indicates that the relay terminal device is authorized to use the relay service code
  • the above S1208-S1221 may be performed.
  • the NAS response message may include remote key and freshness parameters.
  • the remote AMF network element determines whether the remote terminal device is authorized to use the relay service code according to the proximity service authorization information of the remote terminal device.
  • the relay AMF network element determines whether the relay terminal device is authorized to use the relay service code according to the adjacent service authorization information of the relay terminal device.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device. In this way, it is possible to verify whether the end device is authorized.
  • the relay service identified by the relay service code is used to ensure the security of establishing the relay communication connection.
  • the authorization method provided by the embodiment of the present application has been described in detail above with reference to FIG. 1-FIG. 12 .
  • the communication device provided by the embodiment of the present application will be described in detail below with reference to FIG. 13-FIG. 15 .
  • Fig. 13 is a schematic structural diagram of a communication device that can be used to implement the authorization method provided by the embodiment of the present application.
  • the communication device 1300 may be an access and mobility management function network element, a policy control function network element, a unified data management network element, or an application access and mobility management function network element, a policy control function network element, and a unified data management network element Chips in or other components with corresponding functions.
  • a communication device 1300 may include a processor 1301 .
  • the communication device 1300 may further include one or more of a memory 1302 and a transceiver 1303 .
  • the processor 1301 may be coupled with one or more of the memory 1302 and the transceiver 1303, such as through a communication bus, or the processor 1301 may be used alone.
  • the components of the communication device 1300 are specifically introduced below in conjunction with FIG. 13 :
  • the processor 1301 is the control center of the communication device 1300, and may be one processor, or may be a general term for multiple processing elements.
  • the processor 1301 is one or more central processing units (central processing unit, CPU), may also be a specific integrated circuit (application specific integrated circuit, ASIC), or is configured to implement one or more An integrated circuit, for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • An integrated circuit for example: one or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA).
  • the processor 1301 can execute various functions of the communication device 1300 by running or executing software programs stored in the memory 1302 and calling data stored in the memory 1302 .
  • the processor 1301 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 13 .
  • the communication device 1300 may also include multiple processors, for example, the processor 1301 and the processor 1304 shown in FIG. 13 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more communication devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the memory 1302 may be a read-only memory (read-only memory, ROM) or other types of static storage communication devices that can store static information and instructions, or a random access memory (random access memory, RAM) that can store information and other types of dynamic storage and communication devices for instructions, it can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or Other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disc storage media or other magnetic storage communication devices, or capable of carrying or storing information in the form of instructions or data structures desired program code and any other medium that can be accessed by a computer, but not limited thereto.
  • the memory 1302 may be integrated with the processor 1301, or exist independently, and be coupled with the processor 1301 through an input/output port (not shown in FIG. 13 ) of the communication device 1300, which is not specifically limited in this embodiment of the present application.
  • the input port can be used to implement the receiving function performed by the access and mobility management function network element, the policy control function network element, and the unified data management network element in any of the above method embodiments
  • the output port can be used to implement any of the above-mentioned
  • the sending function is performed by the access and mobility management function network element, the policy control function network element, and the unified data management network element.
  • the memory 1302 may be used to store a software program for executing the solution of the present application, and the execution is controlled by the processor 1301 .
  • the processor 1301 may be used to store a software program for executing the solution of the present application, and the execution is controlled by the processor 1301 .
  • the transceiver 1303 is used for communication with other communication devices.
  • the transceiver 1303 may include a receiver and a transmitter (not separately shown in FIG. 13 ). Wherein, the receiver is used to realize the receiving function, and the transmitter is used to realize the sending function.
  • the transceiver 1303 may be integrated with the processor 1301, or may exist independently, and be coupled to the processor 1301 through an input/output port (not shown in FIG. 13 ) of the communication device 1300, which is not specifically limited in this embodiment of the present application. .
  • the structure of the communication device 1300 shown in FIG. 13 does not constitute a limitation to the communication device, and an actual communication device may include more or less components than shown in the figure, or combine certain components, or Different component arrangements.
  • the actions of the network element with policy control function in FIGS. 5-12 above can be executed by the processor 1301 in the communication device 1300 shown in FIG. 13 calling the application program code stored in the memory 1302 to instruct the network element with policy control function.
  • the above-mentioned actions of the unified data management network element in FIGS. 5-12 can be executed by the processor 1301 in the communication device 1300 shown in FIG. 13 calling the application program code stored in the memory 1302 to instruct the unified data management network element.
  • the communication device 1300 can implement any one or more possible design methods involved in the network element with a policy control function in the above method embodiments;
  • the communication device 1300 is a functional network element, the communication device 1300 can implement any one or more possible design methods involved in the access and mobility management function network element in the above method embodiments;
  • the communication device is a unified data management network element, the communication The device 1300 may implement any one or more possible design manners involved in the unified data management network element in the foregoing method embodiments.
  • FIG. 14 is a schematic structural diagram of another communication device provided by an embodiment of the present application. For ease of illustration, FIG. 14 only shows the main components of the communication device.
  • the communication device 1400 includes a transceiver module 1401 and a processing module 1402 .
  • the communication device 1400 may be the policy control functional network element or the access and mobility management functional network element in the foregoing method embodiments.
  • the transceiving module 1401 which may also be referred to as a transceiving unit, is configured to implement the transceiving function performed by the network element with the policy control function or the network element with the access and mobility management function in any of the above method embodiments.
  • the transceiver module 1401 may include a receiving module and a sending module (not shown in FIG. 14 ). Wherein, the receiving module is used for receiving data and/or signaling from other devices; the sending module is used for sending data and/or signaling to other devices. This application does not specifically limit the specific implementation manner of the transceiver module.
  • the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the processing module 1402 may be configured to implement the processing function performed by the policy control functional network element or the access and mobility management functional network element in any of the foregoing method embodiments.
  • the processing module 1402 may be a processor.
  • the communication device 1400 is presented in the form of dividing various functional modules in an integrated manner.
  • a “module” here may refer to a specific ASIC, a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that can provide the above-mentioned functions.
  • the communication device 1400 can take the form of the communication device 1300 shown in FIG. 13 .
  • the processor 1301 in the communication device 1300 shown in FIG. 13 may invoke the computer-executed instructions stored in the memory 1302, so that the authorization method in the above method embodiment is executed.
  • the function/implementation process of the transceiver module 1401 and the processing module 1402 in FIG. 14 can be implemented by the processor 1301 in the communication device 1300 shown in FIG. 13 invoking computer-executed instructions stored in the memory 1302.
  • the function/implementation process of the processing module 1402 in FIG. 14 can be realized by the processor 1301 in the communication device 1300 shown in FIG. /The implementation process may be implemented by the transceiver 1303 in the communication device 1300 shown in FIG. 13 .
  • the communication device 1400 provided in this embodiment can execute the above-mentioned authorization method, the technical effect it can obtain can refer to the above-mentioned method embodiment, and details are not repeated here.
  • FIG. 15 is a schematic structural diagram of another communication device provided by an embodiment of the present application. For ease of illustration, FIG. 15 shows only the main components of the communication device.
  • the communication device 1500 includes a sending module 1501 and a receiving module 1502 .
  • the communication device 1500 may be the access and mobility management function network element, the policy control function network element, or the unified data management network element in the foregoing method embodiments.
  • the sending module 1501 which may also be called a sending unit, is used to implement the sending function performed by the access and mobility management function network element, the policy control function network element, or the unified data management network element in any of the above method embodiments.
  • the receiving module 1502 and the sending module 1501 may be set separately, or may be integrated into one module, that is, a transceiver module. This application does not specifically limit the specific implementation manners of the receiving module 1502 and the sending module 1501 .
  • the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.
  • the communication device 1500 may further include a processing module 1503 .
  • the processing module 1503 may be configured to implement the processing function performed by the access and mobility management function network element, the policy control function network element, or the unified data management network element in any of the above method embodiments.
  • the processing module 1503 may be a processor.
  • the communication device 1500 is presented in a form of dividing various functional modules in an integrated manner.
  • a "module" here may refer to a specific ASIC, a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and/or other devices that can provide the above-mentioned functions.
  • the communication device 1500 can take the form of the communication device 1300 shown in FIG. 13 .
  • the processor 1301 in the communication device 1300 shown in FIG. 13 may invoke the computer-executed instructions stored in the memory 1302, so that the authorization method in the above method embodiment is executed.
  • the functions/implementation process of the receiving module 1502, the sending module 1501, and the processing module 1503 in FIG. 15 can be implemented by the processor 1301 in the communication device 1300 shown in FIG. 13 calling the computer-executed instructions stored in the memory 1302 .
  • the function/implementation process of the processing module 1503 in FIG. 15 can be realized by the processor 1301 in the communication device 1300 shown in FIG.
  • the function/implementation process of the module 1501 can be realized by the transceiver 1303 in the communication device 1300 shown in FIG. 13 . Since the communication device 1500 provided in this embodiment can execute the above-mentioned authorization method, the technical effect it can obtain can refer to the above-mentioned method embodiment, and details are not repeated here.
  • the communication device 1400 shown in FIG. 14 can be applied to the communication system shown in FIG. 1 , and implement the policy control function of the network element in the authorization method shown in FIGS. 7 and 10 . Function.
  • the transceiver module 1401 is configured to receive an authorization request message from an access and mobility management functional network element.
  • the authorization request message includes the relay service code from the terminal device, the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code, and the relay service code is used to identify the connection provided by the relay device for the remote device Serve.
  • the processing module 1402 is configured to determine whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device. Wherein, the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the communication device 1400 may further include a storage module (not shown in FIG. 14 ), where programs or instructions are stored in the storage module.
  • the processing module 1402 executes the program or instruction
  • the communication device 1400 can execute the function of the policy control function network element in the authorization method shown in FIG. 7 and FIG. 10 .
  • the communication device 1400 may be a network element with a policy control function, or may be a chip (system) or other components or components that may be disposed on the network element with a policy control function, which is not limited in this application.
  • the communication device 1500 shown in FIG. 15 can be applied to the communication system shown in FIG. 1 to perform access and mobility management functions in the authorization methods shown in FIG. 7 and FIG. 10 The function of the network element.
  • the receiving module 1502 is configured to receive a non-access stratum request message from a terminal device.
  • the non-access stratum request message includes a relay service code, and the relay service code is used to identify the connection service provided by the relay device for the remote device.
  • the sending module 1501 is configured to send an authorization request message to a policy control function network element in response to a non-access stratum request message.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the receiving module 1502 is also configured to receive an authorization response message from a policy control function network element. Wherein, the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the processing module 1503 is configured to determine whether the terminal device is authorized as a remote terminal device or a relay terminal device according to the nearby service subscription information of the terminal device.
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module 1503 executes the program or instruction, the communication device 1500 can execute the function of the access and mobility management functional network element in the authorization method shown in FIG. 7 and FIG. 10 .
  • the communication device 1500 may be an access and mobility management function network element, or a chip (system) or other components or components that may be configured on the access and mobility management function network element, which is not discussed in this application. limited.
  • the communication device 1400 shown in FIG. 14 can be applied to the communication system shown in FIG. 1 to execute the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the transceiver module 1401 is configured to acquire the relay service code of the terminal device.
  • the relay service code is used to identify the connection service provided by the relay device for the remote device.
  • the processing module 1402 is configured to determine whether the terminal device is authorized to use the relay service code according to the proximity service authorization information of the terminal device. Wherein, the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the communication device 1400 may further include a storage module (not shown in FIG. 14 ), where programs or instructions are stored in the storage module.
  • the processing module 1402 executes the program or instruction
  • the communication device 1400 can execute the function of the access and mobility management functional network element in the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the communication device 1400 may be an access and mobility management functional network element, or may be a chip (system) or other components or components that may be configured on the access and mobility management functional network element, which is not discussed in this application. limited.
  • the communication device 1500 shown in FIG. 15 can be applied to the communication system shown in FIG. 1 to execute the authorization methods shown in FIGS. 8a-9b and 11-12 The unified data management function of network elements.
  • the receiving module 1502 is configured to receive an authentication server function network element identification acquisition request message from the access and mobility management function network element.
  • the authentication server function network element identifier acquisition request message includes the adjacent service key identifier and the relay service code, or the authentication server function network element identifier acquisition request message includes the subscription concealment identifier and the relay service code, and the relay service code uses It is used to identify the connection service provided by the relay device for the remote device.
  • the sending module 1501 is configured to send an authorization request message to an access and mobility management functional network element determined according to an adjacent service key identifier or a subscription concealment identifier.
  • the authorization request message includes a relay service code, and the authorization request message is used to request to verify whether the terminal device is authorized to use the relay service code.
  • the receiving module 1502 is further configured to receive an authorization response message from the access and mobility management functional network element determined according to the adjacent service key identifier or the subscription concealment identifier. Wherein, the authorization response message indicates whether the terminal device is authorized to use the relay service code.
  • the processing module 1503 is configured to determine whether the terminal device is authorized as a remote terminal device according to the nearby service subscription information of the terminal device.
  • the communication device 1500 may further include a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module 1503 executes the program or instruction
  • the communication device 1500 can execute the function of the unified data management network element in the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the communication device 1500 may be a unified data management network element, or a chip (system) or other components or components that may be configured in the unified data management network element, which is not limited in this application.
  • the communication device 1500 shown in FIG. 15 can be applied to the communication system shown in FIG. 1, and execute the authorization methods shown in FIGS. 8a-9b and 11-12. Policies control the functions of functional network elements.
  • the receiving module 1502 is configured to receive a policy control creation request message or a policy control update request message from an access and mobility management functional network element.
  • the policy control creation request message includes the permanent subscription identifier of the terminal device and the policy container of the terminal device
  • the policy control update request message includes the policy container of the terminal device
  • the policy container of the terminal device includes one or more of the following: policy segment identifier, The operating system identifier, the indication that the terminal equipment supports the access network discovery and selection policy, and the indication of the provision request of the adjacent service policy.
  • the sending module 1501 is configured to send a policy control creation response message or a policy control update response message to an access and mobility management functional network element.
  • the policy control creation response message includes a policy control request trigger parameter.
  • the sending module 1501 is configured to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the proximity service authorization information of the terminal device and the policy container of the terminal device, and the proximity service authorization information indicates the authorized relay service of the terminal device.
  • the communication device 1500 may further include a processing module 1503 and a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module 1503 executes the program or instruction
  • the communication device 1500 can execute the function of the policy control function network element in the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the communication device 1500 may be a network element with a policy control function, or a chip (system) or other components or components that may be configured on the network element with a policy control function, which is not limited in this application.
  • the communication device 1400 shown in FIG. 14 can be applied to the communication system shown in FIG. 1 to execute the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the policy controls the function of the functional network element.
  • processing module 1402 is configured to determine that the adjacent service policy information of the terminal device is updated.
  • the transceiver module 1401 is configured to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the adjacent service authorization information of the terminal device and the policy container
  • the adjacent service authorization information indicates the relay service authorized by the terminal device
  • the policy container may include the adjacent service policy information
  • the adjacent service policy information is used for the terminal device to obtain the adjacent service Communication service.
  • the communication device 1400 may further include a storage module (not shown in FIG. 14 ), where programs or instructions are stored in the storage module.
  • the processing module 1402 executes the program or instruction
  • the communication device 1400 can execute the function of the policy control function network element in the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the communication device 1400 may be a network element with a policy control function, or may be a chip (system) or other components or components that may be disposed on the network element with a policy control function, which is not limited in this application.
  • the communication device 1500 shown in FIG. 15 can be applied to the communication system shown in FIG. 1, and execute the authorization methods shown in FIGS. 8a-9b and 11-12. Policies control the functions of functional network elements.
  • the receiving module 1502 is configured to receive an authorization information request message from an access and mobility management functional network element.
  • the authorization information request message is used to request the proximity service authorization information of the terminal device.
  • the sending module 1501 is configured to send communication messages to network elements with access and mobility management functions.
  • the communication message includes the proximity service authorization information of the terminal device, the proximity service authorization information indicates the authorized relay service of the terminal device, and the proximity service policy information is used for the terminal device to obtain the proximity service communication service.
  • the communication device 1500 may further include a processing module 1503 and a storage module (not shown in FIG. 15 ), where programs or instructions are stored in the storage module.
  • the processing module 1503 executes the program or instruction
  • the communication device 1500 can execute the function of the policy control function network element in the authorization methods shown in FIGS. 8a-9b and 11-12.
  • the communication device 1500 may be a network element with a policy control function, or a chip (system) or other components or components that may be configured on the network element with a policy control function, which is not limited in this application.
  • An embodiment of the present application provides a communication system.
  • the communication system includes: an access and mobility management functional network element and a policy control functional network element.
  • the communication system may include an access and mobility management function network element and a unified data management network element, and may also include a policy control function network element.
  • the network element with the access and mobility management function is used to execute the actions of the network element with the access and mobility management function in the above method embodiment.
  • the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • the network element with the policy control function is used to execute the actions of the network element with the policy control function in the above method embodiment.
  • the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • the unified data management network element is used to execute the actions of the unified data management network element in the above method embodiment.
  • the specific execution method and process can refer to the above method embodiment, and will not be repeated here.
  • An embodiment of the present application provides a chip system, and the chip system includes a logic circuit and an input/output port.
  • the logic circuit can be used to implement the processing function involved in the authorization method provided by the embodiment of the present application
  • the input/output port can be used for the sending and receiving function involved in the authorization method provided in the embodiment of the present application.
  • the input port can be used to realize the receiving function involved in the authorization method provided by the embodiment of the present application
  • the output port can be used to realize the sending function involved in the authorization method provided in the embodiment of the present application.
  • the processor in the communication device 1300 may be used to perform, for example but not limited to, baseband related processing, and the transceiver in the communication device 1300 may be used to perform, for example but not limited to, radio frequency transceiving.
  • the above-mentioned devices may be respectively arranged on independent chips, or at least partly or all of them may be arranged on the same chip.
  • processors can be further divided into analog baseband processors and digital baseband processors.
  • the analog baseband processor can be integrated with the transceiver on the same chip, and the digital baseband processor can be set on an independent chip.
  • a digital baseband processor can be combined with a variety of application processors (such as but not limited to graphics processors, multimedia processors, etc.) integrated on the same chip.
  • application processors such as but not limited to graphics processors, multimedia processors, etc.
  • Such a chip can be called a system chip (system on chip). Whether each device is independently arranged on different chips or integrated and arranged on one or more chips often depends on the specific needs of product design.
  • the embodiment of the present invention does not limit the specific implementation forms of the foregoing devices.
  • the chip system further includes a memory, where the memory is used to store program instructions and data for implementing functions involved in the authorization method provided by the embodiments of the present application.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • An embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium includes a computer program or an instruction, and when the computer program or instruction is run on a computer, the authorization method provided in the embodiment of the present application is executed.
  • An embodiment of the present application provides a computer program product, and the computer program product includes: a computer program or an instruction.
  • the authorization method provided in the embodiment of the present application is executed.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processor, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or other arbitrary combinations.
  • the above-described embodiments may be wholly or partly in the form of computer program products implementation.
  • the computer program product comprises one or more computer instructions or computer programs.
  • the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种授权方法及装置，能够验证终端设备是否被授权提供或使用特定的中继服务，可以应用于4G系统、5G系统、以及未来的通信系统，如6G系统等领域。该方法包括：策略控制功能网元接收来自接入和移动管理功能网元的授权请求消息，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，授权请求消息包括来自终端设备的中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务，临近业务授权信息指示终端设备被授权的中继服务。

Description

授权方法及装置
本申请要求于2022年01月29日提交国家知识产权局、申请号为202210112141.7、申请名称为“授权方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种授权方法及装置。
背景技术
随着移动通信的高速发展，用户对带宽的需求逐渐提高。设备到设备(device-to-device，D2D)通信允许终端设备之间直接进行通信，可以有效提高频谱资源的利用率。
在D2D通信中，一个终端设备(称为远端终端设备)可以通过另一个终端设备(称为中继终端设备)的辅助从数据网络获取业务。也就是说，远端终端设备可以通过中继终端设备连接至网络。中继终端设备与移动网络建立连接，远端终端设备与中继终端设备之间建立中继通信连接，中继终端设备可以通过中继通信连接为远端终端设备提供中继服务。
在远端终端设备通过中继终端设备进行通信连接时，对于如何保证该中继通信连接的建立的安全性，业界尚未给出相应的方案。
发明内容
本申请实施例提供一种授权方法及装置，能够保证中继通信连接的建立的安全性。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种授权方法。该授权方法包括：策略控制功能网元接收来自接入和移动管理功能网元的授权请求消息，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，授权请求消息包括来自终端设备的中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务，接入和移动管理功能网元服务终端设备。临近业务授权信息指示终端设备被授权的中继服务。
基于第一方面提供的授权方法，策略控制功能网元通过与接入和移动管理功能网元交互获得来自终端设备的中继服务码，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而可以保证中继通信连接的建立的安全性。
在一种可能的设计方式中，授权请求消息还包括公共陆地移动网标识，授权请求消息指示终端设备为中继终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：根据临近业务授权信息，确定终端设 备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
如此，对于终端设备为中继终端设备的情况，验证终端设备是否被授权为远端终端设备提供中继服务码标识的中继服务、以及是否被授权在公共陆地移动网为远端终端设备中继业务，可以保证中继终端设备使用授权的中继服务码和在授权的公共陆地移动网标识对应的公共陆地移动网网络中为远端终端设备中继业务，也可以理解为保证中继终端设备在授权的公共陆地移动网标识对应的公共陆地移动网网络中使用授权的中继服务码为远端终端设备中继业务，从而可以提高安全性。
在一种可能的设计方式中，上述根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，包括：确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。若临近业务授权信息不包括中继服务码，则终端设备未被授权使用中继服务码。若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
也就是说，临近业务授权信息包括中继服务码和公共陆地移动网标识，则确认终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。对于中继终端设备，被授权使用中继服务码可以理解为终端设备授权作为中继终端设备提供中继服务码对应的中继服务。
在一种可能的设计方式中，授权请求消息指示终端设备为远端终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：确定临近业务授权信息是否包括中继服务码。若是，则终端设备作为远端终端设备被授权使用中继服务码。否则，终端设备作为远端终端设备未被授权使用中继服务码。
如此，对于终端设备为远端终端设备的情况，验证该终端设备对应的临近业务授权信息是否包括中继服务码，可以保证中继终端设备使用授权的远端服务码，从而可以提高安全性。终端设备作为远端终端设备被授权使用中继服务码，可以理解为终端设备作为远端终端设备使用中继服务码对应的中继服务。
可选地，授权请求消息指示终端设备为远端终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：根据终端设备作为远端终端设备对应的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息可以包括终端设备作为远端终端设备对应的临近业务授权信息，还可以包括终端设备作为中继终端设备对应的临近业务授权信息。
可选地，授权请求消息指示终端设备为中继终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：根据终端设备作为中继终端设备对应的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息可以包括终端设备作为中继终端设备对应的临近业务授权信息，还可以包括终端设备作为远端终端设备对应的临近业务授权信息。
也就是说，可以根据终端设备的类型(中继终端设备或远端终端设备)，选择采 用临近业务授权信息中的部分信息，确定终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，第一方面提供的授权方法还可以包括：向接入和移动管理功能网元发送授权响应消息。其中，授权响应消息可指示终端设备是否被授权使用中继服务码。例如，授权响应消息可指示授权或未授权，或者，授权响应消息可指示授权成功或授权失败。
在一种可能的设计方式中，授权请求消息还包括如下一项或多项：终端指示信息、终端设备的标识和终端设备的上下文标识。终端指示信息可用于指示终端设备为远端终端设备或中继终端设备。例如，终端指示信息可用于指示终端设备作为远端终端设备请求验证、或作为中继终端设备请求验证
在一种可能的设计方式中，临近业务授权信息是根据终端设备的标识、和/或终端设备的上下文标识确定的。
第二方面，提供一种授权方法。该授权方法可以包括：接收来自终端设备的非接入层请求消息，响应于非接入层请求消息，向策略控制功能网元发送授权请求消息，接收来自策略控制功能网元的授权响应消息。其中，非接入层请求消息包括中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，授权请求消息还包括公共陆地移动网标识。
在一种可能的设计方式中，授权响应消息指示终端设备是否被授权使用中继服务码，具体为：指示终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。还可以理解为：指示中继终端设备是否授权在公共陆地移动网标识对应的公共陆地移动网网络中使用授权的中继服务码为远端设备中继业务。
在一种可能的设计方式中，非接入层请求消息还包括临近业务密钥标识，在授权响应消息指示终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，第二方面提供的授权方法还包括：向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息。其中，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识。
在一种可能的设计方式中，在授权响应消息指示终端设备被授权使用中继服务码的情况下，第二方面提供的授权方法还包括：向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括中继服务码。
在一种可能的设计方式中，在授权响应消息指示终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，第二方面提供的授权方法还包括：向终端设备发送非接入层响应消息。其中，非接入层响应消息可指示请求失败。
在一种可能的设计方式中，在终端设备为中继终端设备的情况下，第二方面提供的授权方法还包括：根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备或中继终端设备。
在一种可能的设计方式中，在终端设备为远端终端设备的情况下，第二方面提供 的授权方法还包括：根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
在一种可能的设计方式中，第二方面提供的授权方法还可以包括：根据非接入层请求消息，确定终端设备为中继终端设备还是远端终端设备。
在一种可能的设计方式中，授权请求消息还包括如下一项或多项：终端指示信息、终端设备的标识和终端设备的上下文标识。终端指示信息可用于指示终端设备为远端终端设备或中继终端设备。
此外，第二方面所述的授权方法的技术效果可以参考第一方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第三方面，提供一种授权方法。该授权方法包括：获取终端设备的中继服务码，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，中继服务码用于标识中继设备为远端设备提供的连接服务，临近业务授权信息指示终端设备被授权的中继服务。
基于第三方面提供的方法，接入和移动管理功能网元获取终端设备的中继服务码，并根据终端设备的临近业务授权信息，确定终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而可以保证中继通信连接的建立的安全性。
在一种可能的设计方式中，终端设备为远端终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：确定临近业务授权信息是否包括中继服务码。若是，则终端设备作为远端终端设备被授权使用中继服务码。否则，终端设备作为远端终端设备未被授权使用中继服务码。如此，对于终端设备为远端终端设备的情况，验证该终端设备对应的临近业务授权信息是否包括中继服务码，可以保证中继终端设备使用授权的中继服务码，从而可以提高安全性。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：在终端设备作为远端终端设备被授权使用中继服务码的情况下，向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括中继服务码。
如此，在对终端设备授权检查通过(即终端设备被授权使用中继服务码)后，接入和移动管理功能网元向鉴权服务器功能网元触发临近业务密钥标识推演过程，可以保证鉴权服务器功能网元推演授权的终端设备对应的临近业务密钥标识，可提高安全性。
在一种可能的设计方式中，终端设备为中继终端设备，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。其中，公共陆地移动网标识为接入和移动管理功能网元服务的网络的标识。如此，对于终端设备为中继终端设备的情况，验证终端设备是否被授权使用中继服务码标识的中继服务、以及是否被授权在公共陆地移动网使用临近业务，可以保证中继终端设备使用授权的中继服务码和公共陆地移动网标识，从而可以提高安全性。
在一种可能的设计方式中，上述根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，可以包括：确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。若临近业务授权信息不包括中继服务码，则终端设备未被授权使用中继服务码。若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
也就是说，临近业务授权信息包括中继服务码和公共陆地移动网标识，则确认终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：在终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。其中，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识、或签约隐藏标识，密钥获取请求消息可以包括临近业务密钥标识、或签约隐藏标识。
如此，在终端设备授权检查通过(即终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务)的情况下，才获取对应的密钥，建立中继通信连接，从而可以提高安全性。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：在终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向终端设备发送非接入层响应消息。其中，非接入层响应消息可指示请求失败。如此，若终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，则通知该终端设备请求失败，不进行密钥推演，可以提高中继通信连接的建立安全性。
在一种可能的设计方式中，上述获取终端设备的中继服务码，可以包括：接收来自终端设备的非接入层请求消息。其中，非接入层请求消息可以包括中继服务码。如此，可以实现在终端设备触发请求密钥的过程中，接入和移动管理功能网元验证终端设备是否被授权使用中继服务码提供或获取中继服务。
在一种可能的设计方式中，上述获取终端设备的中继服务码，可以包括：接收来自统一数据管理网元的授权请求消息。其中，授权请求消息可以包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。如此，可以由统一数据管理网元向接入和移动管理功能网元请求授权检查，触发接入和移动管理功能网元检查终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：根据终端设备的临近业务签约信息，确定终端设备是否被授权作为中继终端设备。如此，可以由接入和移动管理功能网元确定终端设备是否被授权作为中继终端设备，可以提高安全性。
在一种可能的设计方式中，上述根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：在终端设备被授权作为远端终端设备或中 继终端设备的情况下，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。如此，可以避免在终端设备未被授权作为远端终端设备或中继终端设备的情况下，接入和移动管理功能网元确定终端设备是否被授权使用中继服务码，从而可以节省功耗。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：向统一数据管理网元发送授权响应消息。其中，授权响应消息可指示终端设备是否被授权使用中继服务码。例如，授权响应消息可指示授权或未授权，或者，授权响应消息可指示授权成功或授权失败。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：接收来自策略控制功能网元的通信消息。其中，通信消息可以包括临近业务授权信息。也就是说，临近业务授权信息可以是接入和移动管理功能网元从策略控制功能网元获得的。
示例性地，临近业务授权信息可以是在终端设备注册过程中、或终端设备主动请求策略过程中策略控制功能网元发给接入和移动管理功能网元的，或者是策略控制功能网元检测到策略更新后主动下发给接入和移动管理功能网元的，或者是接入和移动管理功能网元主动请求的。
可选地，通信消息还可以包括策略容器，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
在一种可能的设计方式中，第三方面提供的授权方法，可以包括：向策略控制功能网元发送授权信息请求消息。其中，授权信息请求消息可用于请求终端设备的临近业务授权信息。如此，接入和移动管理功能网元可以主动向策略控制功能网元请求临近业务授权信息
第四方面，提供一种授权方法。该授权方法包括：接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息，向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息，接收来自根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元的授权响应消息。其中，鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识和中继服务码，或者鉴权服务器功能网元标识获取请求消息包括签约隐藏标识和中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，第四方面提供的授权方法，可以包括：根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
在一种可能的设计方式中，上述向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息，包括：在终端设备被授权作为远端终端设备的情况下，向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息。
在一种可能的设计方式中，在授权响应消息指示终端设备被授权使用中继服务码的情况下，第四方面提供的授权方法，可以包括：向接入和移动管理功能网元发送鉴权服务器功能网元标识获取响应消息。其中，鉴权服务器功能网元标识获取响应消息 可以包括鉴权服务器功能网元实例标识。
在一种可能的设计方式中，在授权响应消息指示终端设备被授权使用中继服务码的情况下，第四方面提供的授权方法，可以包括：向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括签约永久标识、中继服务码和随机数。
在一种可能的设计方式中，第四方面提供的授权方法，可以包括：接收来自鉴权服务器功能网元的临近业务响应消息，向接入和移动管理功能网元发送密钥获取响应消息。其中，临近业务响应消息可以包括密钥和新鲜性参数。密钥获取响应消息包括密钥和新鲜性参数。
此外，第四方面所述的授权方法的技术效果可以参考第二方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第五方面，提供一种授权方法。该授权方法包括：接收来自接入和移动管理功能网元的策略控制创建请求消息、或策略控制更新请求消息，向接入和移动管理功能网元发送策略控制创建响应消息、或策略控制更新响应消息，向接入和移动管理功能网元发送通信消息。其中，策略控制创建请求消息包括终端设备的签约永久标识和终端设备策略容器，策略控制更新请求消息包括终端设备策略容器，终端设备策略容器包括如下一项或多项：策略段标识、操作系统标识、终端设备支持接入网发现与选择策略的指示、和临近业务策略提供请求的指示。策略控制创建响应消息包括策略控制请求触发器参数。通信消息包括终端设备的临近业务授权信息和策略容器。临近业务授权信息指示终端设备被授权的中继服务，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
此外，第五方面所述的授权方法的技术效果可以参考第二方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第六方面，提供一种授权方法。该授权方法包括：确定终端设备的临近业务策略信息发生更新，向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息和策略容器，临近业务授权信息指示终端设备被授权的中继服务，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
此外，第六方面所述的授权方法的技术效果可以参考第二方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第七方面，提供一种授权方法。该授权方法包括：接收来自接入和移动管理功能网元的授权信息请求消息，向接入和移动管理功能网元发送通信消息。其中，授权信息请求消息用于请求终端设备的临近业务授权信息。通信消息包括终端设备的临近业务授权信息，临近业务授权信息指示终端设备被授权的中继服务，临近业务策略信息用于终端设备获取临近业务通信服务。
在一种可能的设计方案中，通信消息还包括授权指示信息，授权指示信息可指示临近业务授权信息为终端设备作为中继终端设备或远端终端设备对应的临近业务授权信息。
此外，第七方面所述的授权方法的技术效果可以参考第二方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第八方面，提供一种通信装置。该通信装置包括：收发模块和处理模块。
收发模块，用于接收来自接入和移动管理功能网元的授权请求消息。其中，授权请求消息包括来自终端设备的中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
处理模块，用于根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息指示终端设备被授权的中继服务。
在一种可能的设计方式中，授权请求消息还包括公共陆地移动网标识，处理模块，还用于根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
在一种可能的设计方式中，处理模块，还用于确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。若临近业务授权信息不包括中继服务码，则终端设备未被授权使用中继服务码。若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
在一种可能的设计方式中，授权请求消息指示终端设备为远端终端设备，处理模块，还用于确定临近业务授权信息是否包括中继服务码。若是，则终端设备作为远端终端设备被授权使用中继服务码。否则，终端设备作为远端终端设备未被授权使用中继服务码。
在一种可能的设计方式中，收发模块，还用于向接入和移动管理功能网元发送授权响应消息。其中，授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，授权请求消息还包括如下一项或多项：终端指示信息、终端设备的标识和终端设备的上下文标识。终端指示信息用于指示终端设备为远端终端设备或中继终端设备。
在一种可能的设计方式中，临近业务授权信息是根据终端设备的标识、和/或终端设备的上下文标识确定的。
需要说明的是，第八方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自接入和移动管理功能网元的数据和/或信令；发送模块用于向接入和移动管理功能网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第八方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第八方面所述的通信装置可以执行第一方面所述的方法。
需要说明的是，第八方面所述的通信装置可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第八方面所述的通信装置的技术效果可以参考第一方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第九方面，提供一种通信装置。该通信装置包括：发送模块和接收模块。
接收模块，用于接收来自终端设备的非接入层请求消息。其中，非接入层请求消 息包括中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
发送模块，用于响应于非接入层请求消息，向策略控制功能网元发送授权请求消息。其中，授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。
接收模块，还用于接收来自策略控制功能网元的授权响应消息。其中，授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，授权请求消息还可以包括公共陆地移动网标识。
在一种可能的设计方式中，授权响应消息指示终端设备是否被授权使用中继服务码，具体可以为：指示终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
在一种可能的设计方式中，非接入层请求消息还可以包括临近业务密钥标识，发送模块，还用于向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息。其中，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识。
在一种可能的设计方式中，发送模块，还用于在授权响应消息指示终端设备被授权使用中继服务码的情况下，向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括中继服务码。
在一种可能的设计方式中，发送模块，还用于在授权响应消息指示终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向终端设备发送非接入层响应消息。其中，非接入层响应消息指示请求失败。
在一种可能的设计方式中，第九方面提供的通信装置还包括：处理模块。其中，处理模块，用于在终端设备为中继终端设备的情况下，根据终端设备的临近业务签约信息，确定终端设备是否被授权作为中继终端设备。
在一种可能的设计方式中，第九方面提供的通信装置还包括：处理模块。其中，处理模块，还用于在终端设备为远端终端设备的情况下，根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
在一种可能的设计方式中，处理模块，还用于根据非接入层请求消息，确定终端设备为中继终端设备还是远端终端设备。
在一种可能的设计方式中授权请求消息还可以包括如下一项或多项：终端指示信息、终端设备的标识和终端设备的上下文标识。终端指示信息可用于指示终端设备为远端终端设备或中继终端设备。
需要说明的是，接收模块和发送模块可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。
可选地，第九方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第九方面所述的通信装置可以执行第二方面所述的方法。
需要说明的是，第九方面所述的通信装置可以是接入和移动管理功能网元，也可以是可设置于接入和移动管理功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第九方面所述的通信装置的技术效果可以参考第二方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第十方面，提供一种通信装置。该通信装置包括：收发模块和处理模块。
其中，收发模块，用于获取终端设备的中继服务码。其中，中继服务码用于标识中继设备为远端设备提供的连接服务。
处理模块，用于根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息指示终端设备被授权的中继服务。
在一种可能的设计方式中，终端设备为远端终端设备，处理模块，用于确定临近业务授权信息是否包括中继服务码。若是，则终端设备作为远端终端设备被授权使用中继服务码。否则，终端设备作为远端终端设备未被授权使用中继服务码。
在一种可能的设计方式中，收发模块，还用于在终端设备作为远端终端设备被授权使用中继服务码的情况下，向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括中继服务码。
在一种可能的设计方式中，终端设备作为中继终端设备，处理模块，还用于根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。其中，公共陆地移动网标识为通信装置服务的网络的标识。
在一种可能的设计方式中，处理模块，还用于确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。若临近业务授权信息不包括中继服务码，则终端设备未被授权使用中继服务码。若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
在一种可能的设计方式中，收发模块，还用于在终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。其中，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识、或签约隐藏标识，密钥获取请求消息包括临近业务密钥标识、或签约隐藏标识。
在一种可能的设计方式中，收发模块，还用于在终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向终端设备发送非接入层响应消息。其中，非接入层响应消息指示请求失败。
在一种可能的设计方式中，收发模块，还用于接收来自终端设备的非接入层请求消息。其中，非接入层请求消息可以包括中继服务码。
在一种可能的设计方式中，收发模块，还用于接收来自统一数据管理网元的授权请求消息。其中，授权请求消息可以包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，处理模块，还用于根据终端设备的临近业务签约信息，确定终端设备是否被授权作为中继终端设备。
在一种可能的设计方式中，处理模块，还用于在终端设备被授权作为远端终端设 备或中继终端设备的情况下，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，收发模块，还用于向统一数据管理网元发送授权响应消息。其中，授权响应消息可指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，收发模块，还用于接收来自策略控制功能网元的通信消息。其中，通信消息包括临近业务授权信息。
在一种可能的设计方式中，收发模块，还用于向策略控制功能网元发送授权信息请求消息。其中，授权信息请求消息可用于请求终端设备的临近业务授权信息。
需要说明的是，第十方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自终端设备、接入网设备、策略控制功能网元、统一数据管理网元、和鉴权服务器功能网元的数据和/或信令；发送模块用于向终端设备、接入网设备、策略控制功能网元、统一数据管理网元、和鉴权服务器功能网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十方面所述的通信装置可以执行第三方面所述的方法。
需要说明的是，第十方面所述的通信装置可以是接入和移动管理功能网元，也可以是可设置于接入和移动管理功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十方面所述的通信装置的技术效果可以参考第三方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第十一方面，提供一种通信装置。该授权方法包括：发送模块和接收模块。
接收模块，用于接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息。其中，鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识和中继服务码，或者鉴权服务器功能网元标识获取请求消息包括签约隐藏标识和中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
发送模块，用于向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息。其中，授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。
接收模块，还用于接收来自根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元的授权响应消息。其中，授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，第十一方面提供的通信装置还可以包括：处理模块。其中，处理模块，用于根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
在一种可能的设计方式中，发送模块，还用于在终端设备被授权作为远端终端设备的情况下，向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息。
在一种可能的设计方式中，发送模块，还用于在授权响应消息指示终端设备被授 权使用中继服务码的情况下，向接入和移动管理功能网元发送鉴权服务器功能网元标识获取响应消息。其中，鉴权服务器功能网元标识获取响应消息可以包括鉴权服务器功能网元实例标识。
在一种可能的设计方式中，发送模块，还用于在授权响应消息指示终端设备被授权使用中继服务码的情况下，向鉴权服务器功能网元发送临近业务请求消息。其中，临近业务请求消息可以包括签约永久标识、中继服务码和随机数。
在一种可能的设计方式中，接收模块，还用于接收来自鉴权服务器功能网元的临近业务响应消息。其中，临近业务响应消息可以包括密钥和新鲜性参数。
发送模块，还用于向接入和移动管理功能网元发送密钥获取响应消息。其中，密钥获取响应消息可以包括密钥和新鲜性参数。
需要说明的是，接收模块和发送模块可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。
可选地，第十一方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十一方面所述的通信装置可以执行第四方面所述的方法。
需要说明的是，第十一方面所述的通信装置可以是统一数据管理网元，也可以是可设置于统一数据管理网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十一方面所述的通信装置的技术效果可以参考第四方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第十二方面，提供一种通信装置。该通信装置包括：发送模块和接收模块。
其中，接收模块，用于接收来自接入和移动管理功能网元的策略控制创建请求消息、或策略控制更新请求消息。其中，策略控制创建请求消息包括终端设备的签约永久标识和终端设备策略容器，策略控制更新请求消息包括终端设备策略容器，终端设备策略容器包括如下一项或多项：策略段标识、操作系统标识、终端设备支持接入网发现与选择策略的指示、和临近业务策略提供请求的指示。
发送模块，用于向接入和移动管理功能网元发送策略控制创建响应消息、或策略控制更新响应消息。其中，策略控制创建响应消息包括策略控制请求触发器参数。
发送模块，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息和策略容器，临近业务授权信息指示终端设备被授权的中继服务，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
需要说明的是，接收模块和发送模块可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。
可选地，第十二方面所述的通信装置还可以包括存储模块和处理模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十二方面所述的通信装置可以执行第五方面所述的方法。
需要说明的是，第十二方面所述的通信装置可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十二方面所述的通信装置的技术效果可以参考第五方面中任一种可能的 实现方式所述的授权方法的技术效果，此处不再赘述。
第十三方面，提供一种通信装置。该通信装置包括：收发模块和处理模块。
其中，处理模块，用于确定终端设备的临近业务策略信息发生更新。
收发模块，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息和策略容器，临近业务授权信息指示终端设备被授权的中继服务，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
需要说明的是，第十三方面所述的收发模块可以包括接收模块和发送模块。其中，接收模块用于接收来自接入和移动管理功能网元的数据和/或信令；发送模块用于向接入和移动管理功能网元发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。
可选地，第十三方面所述的通信装置还可以包括存储模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十三方面所述的通信装置可以执行第六方面所述的方法。
需要说明的是，第十三方面所述的通信装置可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十三方面所述的通信装置的技术效果可以参考第六方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第十四方面，提供一种通信装置。该通信装置包括：发送模块和接收模块。
其中，接收模块，用于接收来自接入和移动管理功能网元的授权信息请求消息。其中，授权信息请求消息用于请求终端设备的临近业务授权信息。
发送模块，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息，临近业务授权信息指示终端设备被授权的中继服务，临近业务策略信息用于终端设备获取临近业务通信服务。
在一种可能的设计方式中，通信消息还可以包括授权指示信息，授权指示信息可指示临近业务授权信息为终端设备作为中继终端设备或远端终端设备对应的临近业务授权信息。
需要说明的是，接收模块和发送模块可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块和发送模块的具体实现方式，不做具体限定。
可选地，第十四方面所述的通信装置还可以包括存储模块和处理模块，该存储模块存储有程序或指令。当处理模块执行该程序或指令时，使得第十四方面所述的通信装置可以执行第七方面所述的方法。
需要说明的是，第十四方面所述的通信装置可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，第十四方面所述的通信装置的技术效果可以参考第七方面中任一种可能的实现方式所述的授权方法的技术效果，此处不再赘述。
第十五方面，提供一种通信装置。该通信装置包括：处理器，该处理器与存储器耦合，存储器用于存储计算机程序。
处理器用于执行存储器中存储的计算机程序，以使得如第一方面至第七方面中任 一种可能的实现方式所述的授权方法被执行。
在一种可能的设计中，第十五方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或输入/输出端口。所述收发器可以用于该通信装置与其他设备通信。
需要说明的是，输入端口可用于实现第一方面至第七方面所涉及的接收功能，输出端口可用于实现第一方面至第七方面所涉及的发送功能。
在本申请中，第十五方面所述的通信装置可以为接入和移动管理功能网元、策略控制功能网元、统一数据管理网元，或者设置于接入和移动管理功能网元、策略控制功能网元、统一数据管理网元内部的芯片或芯片系统。
此外，第十五方面所述的通信装置的技术效果可以参考第一方面至第七方面中任一种实现方式所述的授权方法的技术效果，此处不再赘述。
第十六方面，提供一种通信系统。该通信系统包括如第八方面所述的通信装置和如第九方面所述的通信装置。或者，该通信系统包括如第十方面所述的通信装置和如第十一方面所述的通信装置，还可以包括如第十二方面所述的通信装置、或如第十三方面所述的通信装置、或如第十四方面所述的通信装置。
或者，该通信系统包括如第八方面所述的用于实现如第一方面所述方法的通信装置、如第九方面所述的用于实现如第二方面所述方法的通信装置。或者，该通信系统包括如第十方面所述的用于实现如第三方面所述方法的通信装置、如第十一方面所述的用于实现如第四方面所述方法的通信装置，还可以包括如第十二方面所述的用于实现如第五方面所述方法的通信装置、或如第十三方面所述的用于实现如第六方面所述方法的通信装置、或如第十四方面所述的用于实现如第七方面所述方法的通信装置。
示例性的，该通信系统可以包括接入和移动管理功能网元和策略控制功能网元。或者，该通信系统可以包括接入和移动管理功能网元和统一数据管理网元，还可以包括策略控制功能网元。
第十七方面，提供了一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路用于实现第一方面至第七方面所涉及的处理功能，输入/输出端口用于实现第一方面至第七方面所涉及的收发功能。具体地，输入端口可用于实现第一方面至第七方面所涉及的接收功能，输出端口可用于实现第一方面至第七方面所涉及的发送功能。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现第一方面至第七方面所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
第十八方面，提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得第一方面至第七方面中任意一种可能的实现方式所述的授权方法被执行。
第十九方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得第一方面至第七方面中任意一种可能的实现方式所述的授权方法被执行。
附图说明
图1为本申请实施例提供的一种通信系统的架构示意图；
图2为本申请实施例提供的通信系统应用于5G通信网络时的架构示意图；
图3为本申请实施例提供的一种层3中继架构示意图；
图4为本申请实施例提供的一种层2中继架构示意图；
图5为本申请实施例提供的一种授权方法的流程示意图；
图6为本申请实施例提供的另一种授权方法的流程示意图；
图7为本申请实施例提供的又一种授权方法的流程示意图；
图8a为本申请实施例提供的又一种授权方法的流程示意图；
图8b为本申请实施例提供的又一种授权方法的流程示意图；
图8c为本申请实施例提供的又一种授权方法的流程示意图；
图9a为本申请实施例提供的又一种授权方法的流程示意图；
图9b为本申请实施例提供的又一种授权方法的流程示意图；
图10为本申请实施例提供的又一种授权方法的流程示意图；
图11为本申请实施例提供的又一种授权方法的流程示意图；
图12为本申请实施例提供的又一种授权方法的流程示意图；
图13为本申请实施例提供的一种通信装置的结构示意图；
图14为本申请实施例提供的另一种通信装置的结构示意图；
图15为本申请实施例提供的又一种通信装置的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如通用移动通信系统(universal mobile telecommunications system，UMTS)、无线局域网(wireless local area network，WLAN)、无线保真(wireless fidelity，Wi-Fi)系统、有线网络、车到任意物体(vehicle to everything，V2X)通信系统、D2D通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统，第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例 的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图1为本申请实施例提供的授权方法所适用的一种通信系统的架构示意图。
如图1所示，该通信系统包括核心网网元，还可以包括远端终端设备、中继终端设备和接入网设备。
上述核心网网元可负责维护移动网络的签约数据，为终端设备提供会话管理、移动性管理、策略管理以及安全认证等功能。
上述中继终端设备(relay user equipment，relay UE)为支持临近业务或近距离业务(proximity based services，proSe)的终端设备，并支持远端终端设备连接至网络，可以为远端终端设备提供中继服务。例如，中继终端设备可以是终端设备、或接入回传一体化(integrated access and backhaul，IAB)节点等。其中，IAB节点包括移动终端(mobile terminal，MT)和分布式单元(distributed unit，DU)。需要说明的是，中继终端设备可以称为临近业务终端设备到网络中继(ProSe UE-to-network relay)、终端设备到网络中继(UE-to-network relay)、或中继等，本申请不对中继终端设备的名称进行限定。
上述远端终端设备(remote UE)为支持临近业务或近距离业务(proximity based services，ProSe)的终端设备，并支持通过中继终端设备与数据网络通信。需要说明的是，远端终端设备可以称为临近业务远端设备(ProSe remote UE)、或远端等，本申请不对中继终端设备的名称进行限定。
上述接入网设备为位于上述通信系统的网络侧，且具有无线收发功能的设备或可设置于该设备的芯片或芯片系统。该接入网设备包括但不限于：无线保真(wireless fidelity，Wi-Fi)系统中的接入点(access point，AP)，如家庭网关、路由器、服务器、交换机、网桥等，演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，无线中继节点、无线回传节点、传输点(transmission and reception point，TRP或者transmission point，TP)等，还可以为5G，如，新空口(new radio，NR)系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)、具有基站功能的路边单元(road side unit，RSU)等，或者还可以为卫星、或未来各种形式的基站。可选地，接入网设备主要负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。
可选的，图1所示的通信系统可以适用于目前正在讨论的通信网络，也可以适用于未来的其他网络等，本申请实施例对此不做具体限定。
示例性的，以图1所示的通信系统应用于5G通信网络为例，如图2所示，5G通 信网络可以包括终端设备、核心网网元、(无线)接入网((radio)access network，(R)AN)设备、和数据网络(data network，DN)。
如图2所示，核心网网元可以包括但不限于如下一项或多项：用户面功能(user plane function，UPF)网元、接入和移动性管理功能(core access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、鉴权服务器功能(authentication server function，AUSF)网元、网络切片选择功能(network slice selection function，NSSF)网元、网络开放功能(network exposure function，NEF)网元、网络功能存储功能(network exposure function repository function，NRF)、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、应用功能(application function，AF)网元、网络切片和独立非公共网络特定的鉴权和授权功能(network slice-specific and stand-alone non-public network authentication and authorization function，NSSAAF)网元、服务通信代理(service communication proxy，SCP)网元、和统一数据存储(unified data repository，UDR)网元。
其中，终端设备通过(R)AN设备接入5G网络，终端设备通过N1接口(简称N1)与AMF通信；(R)AN设备可以通过N2接口(简称N2)与AMF通信；(R)AN设备可以通过N3接口(简称N3)与UPF通信；SMF通过N4接口(简称N4)与UPF通信，UPF通过N6接口(简称N6)接入数据网络。此外，图2所示的AUSF、AMF、SMF、NSSF、NEF、NRF、PCF、UDM、NSSAAF、UDR和AF等控制面功能可以采用对应的服务化接口Nausf、Namf、Nsmf、Nnssf、Nnef、Nnrf、Npcf、Nudm、Nnssaaf、Nudr和Naf进行交互。
AMF网元主要负责移动网络中的移动性管理，例如用户位置更新、用户注册网络、用户切换等。AMF网元可以获得5G非接入层(Non-access stratum，NAS)安全上下文，5G NAS安全上下文用于保护NAS消息。AMF网元可用于确定终端设备是否被授权作为远端终端设备或中继终端设备，AMF网元可用于确定终端设备是否被授权使用中继服务码。
PCF网元主要支持提供统一的策略框架来控制网络行为，提供策略规则给控制层网络功能，同时负责获取与策略决策相关的用户签约信息。PCF网元可以向AMF网元、SMF网元提供策略，例如服务质量(quality of service，QoS)策略、切片选择策略、临近业务授权信息等。PCF网元可用于确定终端设备是否被授权使用中继服务码。
AUSF网元可用于执行终端设备的安全认证。
UDM网元可用于存储用户数据，例如签约数据(如临近业务签约信息)、鉴权/授权数据等。
SMF网元主要负责移动网络中的会话管理，例如会话建立、修改、释放。例如为用户分配互联网协议(internet protocol，IP)地址，选择提供报文转发功能的UPF等。
UPF网元负责终端设备中用户数据的转发和接收。UPF网元可以从数据网络接收用户数据，通过RAN设备传输给终端设备；UPF网元还可以通过RAN设备从终端设备接收用户数据，转发到数据网络。UPF网元中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。
NSSF网元主要负责网络切片的选择，可以根据终端设备的切片选择辅助信息、签约信息等确定终端设备允许接入的网络切片实例。
NEF网元可用于支持能力和事件的开放，可以支持3GPP网络和第三方应用安全的交互。
NRF网元可以支持网络功能的注册和发现。
AF网元主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策、策略控制功能或者向网络侧提供第三方的一些服务。
NSSAAF网元主要作用是一个连接3GPP网络内部网元与外部鉴权服务器的中间网元。
UDR网元可以用于存储临近业务授权信息。
SCP网元可以用于实现网络功能之间的通信转发，还可以用于实现负载均衡和网络功能选择等。
数据网络可以为运营商外部网络，也可以为运营商控制的网络，用于向终端设备提供业务服务。
上述终端设备也可以称为用户设备(user equipment，UE)、用户装置、接入终端、用户单元、用户站、移动站、移动台(mobile station，MS)、远方站、远程终端、移动设备、用户终端、终端、终端单元、终端站、终端装置、无线通信设备、用户代理或用户装置。
例如，本申请的实施例中的终端设备(例如图1所示的中继终端设备和远端终端设备)可以是手机(mobile phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、膝上型电脑(laptop computer)、平板电脑(Pad)、无人机、带无线收发功能的电脑、机器类型通信(machine type communication，MTC)终端、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、物联网(internet of things，IoT)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端(例如游戏机、智能电视、智能音箱、智能冰箱和健身器材等)、车载终端、具有终端功能的RSU。接入终端可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备(handset)、计算设备或连接到无线调制解调器的其它处理设备、可穿戴设备等。
又例如，本申请实施例中的终端设备可以是智慧物流中的快递终端(例如可监控货物车辆位置的设备、可监控货物温湿度的设备等)、智慧农业中的无线终端(例如可收集禽畜的相关数据的可穿戴设备等)、智慧建筑中的无线终端(例如智慧电梯、消防监测设备、以及智能电表等)、智能医疗中的无线终端(例如可监测人或动物的生理状态的可穿戴设备)、智能交通中的无线终端(例如智能公交车、智能车辆、共享单车、充电桩监测设备、智能红绿灯、以及智能监控以及智能停车设备等)、智能零售中的无线终端(例如自动售货机、自助结账机、以及无人便利店等)。又例如， 本申请的终端设备可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元，车辆通过内置的所述车载模块、车载模组、车载部件、车载芯片或者车载单元可以实施本申请提供的方法。
需要说明的是，本申请实施例提供的授权方法，可以适用于图1所示的通信系统，具体实现可以参考下述方法实施例，此处不再赘述。
应当指出的是，本申请实施例中的方案还可以应用于其他通信系统中，相应的名称也可以用其他通信系统中的对应功能的名称进行替代。
应理解，图1仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备，和/或，其他终端设备，图1中未予以画出。
为了使得本申请实施例更加清楚，以下对与本申请实施例中相关的部分内容以及概念作统一介绍。
第一项，中继服务和中继服务码：
示例性地，中继服务为中继设备为远端设备提供的连接服务。
示例性地，中继服务可以包括层3中继服务和层2中继服务。其中，层3中继服务可以是中继设备为远端设备提供的层3中继服务，层2中继服务可以是中继设备为远端设备提供的层2中继服务。
示例性地，中继服务码(relay service code，RSC)可用于标识中继设备为远端设备提供的连接服务。例如，中继服务码可标识层3中继服务或层2中继服务。
需要说明的是，上述中继设备可以称为中继终端设备，远端设备可以称为远端终端设备，本申请对此不进行限定。
例如，层3中继设备在IP层为远端设备中继业务。层3中继设备注册到网络后可以主动建立中继协议数据单元(protocol data unit，PDU)会话。也可以在远端设备请求向中继设备发起层3中继连接的请求后，按需建立中继PDU会话。该中继PDU会话用于中继远端设备的业务，可以用于中继终端设备与网络之间的信令，也可以用于中继终端设备与数据网络之间交互的数据。
层2中继设备在层2为远端设备中继业务，层2中继终端设备可用于转发远端终端设备和接入网设备之间的RRC消息、远端终端设备和核心网之间的NAS消息等，且L2中继终端设备不处理远端设备的RRC消息的能力。
图3为本申请实施例提供的一种层3中继架构示意图。
如图3所示，远端终端设备与层3中继终端设备之间建立PC5连接，层3中继终端设备与移动网络建立连接(例如层3中继终端设备与下一代无线接入网络(next generation RAN，NG-RAN)设备之间的Uu连接)，进而实现远端终端设备通过PC5连接和层3中继终端设备与移动网络建立的连接获得业务。其中，层3中继终端设备可以位于家乡公共陆地移动网(public land mobile network，PLMN)中，也可以位于拜访PLMN中。
图4为本申请实施例提供的一种层2中继架构示意图。
如图4所示，在层2中继架构中，远端终端设备与接入网之间建立空口(如Uu口)连接，远端终端设备和层2中继终端设备可以由不同的PLMN服务，也可以由相同的PLMN服务。应理解，图4仅为便于理解而示例的简化示意图，该架构中还可以包括 其他设备。如图4所示，远端终端设备和层2中继终端设备由不同的PLMN服务时，可将为远端终端设备服务的网元名称前加上远端，可将为中继终端设备服务的网元名称前加上中继。例如服务远端终端设备的AMF网元可以称为远端AMF网元，服务中继终端设备的AMF网元可以称为中继AMF网元。
第二项，AMF网元、远端AMF网元和中继AMF网元：
本申请实施例中，服务远端终端设备的网元与服务中继终端设备的网元可以相同、或不相同，是否相同取决于远端终端设备与中继终端设备的接入网设备选择的网元是否相同。
以AMF网元为例，服务远端终端设备的AMF网元与服务中继终端设备的AMF网元是否相同，取决于远端终端设备与中继终端设备的接入网设备选择的AMF网元是否相同。例如，若远端终端设备与中继终端设备在同一个PLMN接入网络，且所处的位置位于相同的AMF网元服务的区域，则服务远端终端设备的AMF网元与服务中继终端设备的AMF网元可能相同。
本申请实施例提供的授权方法(例如下述图5-图12所示的方法)对于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景均适用。需要说明的是，本申请实施例中网元的名称并不对网元的应用场景进行限制。
以AMF网元为例，本申请实施例中的AMF网元可以是服务远端终端设备和中继终端设备的AMF网元、或是服务远端终端设备的AMF网元、或是服务中继终端设备的AMF网元。本申请实施例中的远端AMF网元可以是服务远端终端设备的AMF网元。例如服务远端终端设备的AMF网元与服务中继终端设备的AMF网元不是同一个AMF网元的情况下，服务远端终端设备的AMF网元可称为远端AMF网元。又例如，服务远端终端设备的AMF网元与服务中继终端设备的AMF网元是同一个AMF网元的情况下，AMF网元在服务远端终端设备的情况下可称为远端AMF网元。
本申请实施例中的中继AMF网元可以是服务中继终端设备的AMF网元。例如服务远端终端设备的AMF网元与服务中继终端设备的AMF网元不是同一个AMF网元的情况下，服务中继终端设备的AMF网元可称为远端AMF网元。又例如，服务远端终端设备的AMF网元与服务中继终端设备的AMF网元是同一个AMF网元的情况下，AMF网元在服务中继终端设备的情况下可称为中继AMF网元。
示例性地，服务远端终端设备的AMF网元可以为远端终端设备提供接入和移动性管理,服务远端终端设备的AUSF网元存储有远端终端设备的密钥kausf。服务中继终端设备的AMF网元可以为中继终端设备提供接入和移动性管理,服务中继终端设备的AUSF网元存储有中继终端设备的密钥kausf。此处不对各个网元(例如SMF网元、UPF网元、PCF网元和UDM网元等)一一列举，在第二项中以AMF网元为例进行的阐述，对其他网元(例如SMF网元、UPF网元、PCF网元和UDM网元等)同样适用。
第三项，临近业务密钥标识、签约隐藏标识、和签约永久标识：
示例性地，临近业务密钥标识(ProSe key identifier，P-KID)的格式可以包括网络访问标识符(network access identifier，NAI)格式。
当P-KID的格式为NAI格式时，P-KID可以包括用户名信息和域信息。例如，P-KID 可以为username@realm。
其中，P-KID的用户名信息可以包括路由指示符(routing indicator，RID)和临近业务临时终端设备标识(ProSe temporary UE identifier，P-TID)。P-KID的域信息可以包括家乡网络标识。例如，realm部分包括家乡网络标识。
示例性地，P-KID可以为username@example，举例(example)部分不进行限定，例如可以包括家乡网络标识。
可选地，AMF网元可以根据RID信息确定AUSF网元，AUSF网元可以根据RID信息确定UDM网元。在RID信息是缺省值的情况下，AMF可以选择家乡网络中的任意AUSF实例；AUSF也可以选择家乡网络中的任意UDM实例。在RID信息不是缺省值的情况下，AMF网元可以根据RID信息确定AUSF网元，AUSF网元可以根据RID信息确定UDM网元。其中，可供选择的AUSF实例或UDM实例为存储在本地或者从NRF网元获取的。
一些实施例中，P-TID可以是根据Kausf、FC、P0、L0、P1、和L1生成的。其中，中间密钥Kausf作为密钥K，参数FC、P0、L0、P1、和L1作为密钥推演函数的输入S。可选地，FC是由3GPP配置的；P0＝签约永久标识(subscription permanent identifier，SUPI)；L0＝SUPI的长度；P1＝RSC，L1＝RSC的长度。其中，Kausf也可以替换为其他的密钥，如由Kausf进一步推演的密钥，或者认证生成的新的密钥，此处不限制。
可选地，签约隐藏标识(subscription concealed identifier，SUCI)可以是终端设备生成的，签约永久标识是对签约隐藏标识进行解密获得的。临近业务密钥标识可以是终端设备的临时身份，签约永久标识可以是终端设备的永久身份，签约隐藏标识是对签约永久标识加密后的获得的。
第四项，临近业务授权信息和临近业务策略信息：
示例性地，临近业务授权信息可以是策略控制功能网元根据终端设备的标识、和/或终端设备的上下文标识确定的。临近业务授权信息可指示终端设备被授权的中继服务。
示例性地，临近业务策略信息为终端设备从网络获取的。临近业务策略信息可以包括：授权策略，还可以包括中继终端设备发现策略/参数。其中，临近业务策略信息可用于终端设备获取临近业务通信服务，可指示终端设备是否授权作为中继终端或远端设备等。
一些实施例中，临近业务授权信息可以包括：中继服务码。该临近业务授权信息可指示终端设备被授权使用中继服务码，或者，临近业务授权信息可指示终端设备被授权使用或提供中继服务码对应的中继服务。
示例性地，若终端设备1的临近业务授权信息包括远端终端设备{RSC1、RSC2}和中继终端设备{RSC3、RSC4}，则该临近业务授权信息指示终端设备1作为远端终端设备被授权使用RSC1和RSC2，终端设备1作为中继终端设备被授权使用RSC3和RSC4，即终端设备1可以作为中继终端设备为远端设备提供RSC3和RSC4对应的中继服务。
需要说明的是，终端设备可以被授权作为远端终端设备或中继终端设备中的一种。若终端设备只被授权作为远端终端设备，则临近业务授权信息包括用于检测终端设备 是否授权作为远端终端设备使用中继服务码对应的中继服务的信息。例如，终端设备1只被授权作为远端终端设备，终端设备1的临近业务授权信息可以包括远端终端设备{RSC1、RSC2}。
若终端设备只被授权作为中继终端设备，则临近业务授权信息包括用于检测终端设备是否授权作为中继终端设备提供中继服务码对应的中继服务的信息。例如，终端设备1只被授权作为中继终端设备，终端设备1的临近业务授权信息可以包括中继终端设备{RSC3、RSC4}。
示例性地，若终端设备1作为远端终端设备对应的临近业务授权信息包括RSC1和RSC2，则该临近业务授权信息指示终端设备1作为远端终端设备被授权使用RSC1和RSC2。若终端设备1作为中继终端设备对应的临近业务授权信息包括RSC3和RSC4，则该临近业务授权信息指示终端设备1作为中继终端设备被授权使用RSC3和RSC4。
可选地，临近业务授权信息还可以包括：公共陆地移动网标识PLMN ID。该临近业务授权信息可指示终端设备被授权在PLMN ID对应的PLMN中继业务(relay traffic)。
例如，中继业务指中继设备为远端设备中继业务。临近业务授权信息可指示终端设备被授权在PLMN ID对应的PLMN为远端设备中继业务。
示例性地，若终端设备1的临近业务授权信息包括PLMN ID1和PLMN ID2，则该临近业务授权信息可指示终端设备1被授权在PLMN ID1对应的PLMN中继业务、被授权在PLMN ID2对应的PLMN中继业务。
示例性地，若终端设备1的临近业务授权信息包括远端终端设备{RSC1、RSC2}、中继终端设备{RSC3、RSC4}、PLMN ID1和PLMN ID2。则该临近业务授权信息可指示终端设备1作为远端终端设备被授权使用RSC1和RSC2，终端设备1作为中继终端设备被授权使用RSC3和RSC4，终端设备1被授权在PLMN ID1对应的PLMN中继业务、被授权在PLMN ID2对应的PLMN中继业务。
一些实施例中，该临近业务授权信息可指示终端设备被授权在PLMN ID对应的PLMN中提供中继服务码对应的中继服务。
示例性地，临近业务授权信息还可以包括：RSC和RSC对应的PLMN ID。也就是说，RSC与PLMN ID可以存在对应关系。
例如，终端设备1的临近业务授权信息可以包括：PLMN ID1(RSC3)、和PLMN ID2(RSC4)，该临近业务授权信息可指示终端设备1被授权在PLMN ID1对应的PLMN中提供RSC3对应的中继服务、被授权在PLMN ID2对应的PLMN中提供RSC4对应的中继服务。
又例如，终端设备1的临近业务授权信息可以包括：远端终端设备{PLMN ID3(RSC1)、PLMN ID4(RSC2)}、中继终端设备{PLMN ID1(RSC3)、PLMN ID2(RSC4)}，则该临近业务授权信息指示终端设备1作为远端终端设备被授权在PLMN ID3对应的PLMN中提供RSC1对应的中继服务，终端设备1作为远端终端设备被授权在PLMN ID4对应的PLMN中提供RSC2对应的中继服务，终端设备1作为中继终端设备被授权在PLMN ID1对应的PLMN中提供RSC3对应的中继服务，终端设备1作为中继终端设备被授权在PLMN ID2对应的PLMN中提供RSC4对应的中继服务。
需要说明的是，一个PLMN ID可以对应多个RSC，一个RSC可以对应多个PLMN  ID，本申请对此不进行限定。
一些实施例中，授权策略可以包括：PLMN ID。
可选地，公共陆地移动网标识可用于指示终端设备被授权在公共陆地移动网标识对应的PLMN中中继业务。
一些实施例中，中继终端设备发现策略/参数可以包括如下一项或多项：用户信息标识、中继服务码和终端设备到网络中继指示(UE-to-network relay layer indicator(s))。
可选地，用户信息标识可用于组成员发现或中继发现。
可选地，终端设备到网络中继指示可以指示特定的中继服务码提供的是层2中继服务或层3中继服务。
示例性地，中继服务码与终端设备到网络中继指示对应。
例如，中继服务码1与终端设备到网络中继指示1对应，终端设备到网络中继指示1可以指示中继服务码1提供的是层2中继服务。中继服务码2与终端设备到网络中继指示2对应，终端设备到网络中继指示2可以指示中继服务码2提供的是层3中继服务。
需要说明的是，一个终端设备到网络中继指示可以对应一个或多个中继服务码，本申请对此不进行限定。
需要说明的是，本申请不对临近业务授权信息和临近业务策略信息的名称进行限定。
第五项，临近业务签约信息：
示例性地，临近业务签约信息可用于指示授权的临近业务服务，如临近业务直接发现、临近业务直接通信、作为中继设备等。临近业务签约信息可以存储在UDM网元中。
可选地，临近业务签约信息可用于确定终端设备是否支持使用临近业务服务、终端设备是否被授权作为远端终端设备或中继终端设备、或者终端设备是否被授权使用(use)中继终端设备(相当于作为远端终端设备)或作为(serve as)中继终端设备。其中，终端设备是否被授权作为远端终端设备可以指终端设备是否被授权使用中继终端设备提供的服务。终端设备是否被授权作为中继终端设备可以指终端设备是否被授权为远端终端设备中继业务。
示例性地，图5为本申请实施例提供的一种授权方法的流程示意图。图5阐述了通过信令面建立PC5安全连接的方案。该授权方法可以适用于图1所示的通信系统。
如图5所示，该授权方法包括如下步骤：
S501，远端终端设备注册到网络。
可选地，远端终端设备可以从网络获取服务授权和临近业务策略信息。关于远端终端设备的临近业务策略信息的具体实现方式可参照上述阐述，此处不再赘述。
S502，中继终端设备注册到网络。
可选地，中继终端设备可以从网络获取服务授权和临近业务策略信息。关于中继终端设备的临近业务策略信息的具体实现方式可参照上述阐述，此处不再赘述。
S503，远端终端设备向远端AMF网元发送NAS中继密钥请求消息。相应地，远端AMF网元接收来自远端终端设备的NAS中继密钥请求消息。
可选地，NAS中继密钥请求消息可以包括中继服务码。
可选地，远端终端设备根据预配置或来自网络的临近业务策略信息获取作为远端设备授权使用的中继服务码。
S504，远端AMF网元向远端AUSF网元发送临近业务中继密钥请求消息。相应地，远端AUSF网元接收来自远端AMF网元的临近业务中继密钥请求消息。
可选地，临近业务中继密钥请求(Kasuf_ProSe_Relay Key request)消息可以包括中继服务码。
S505，远端AUSF网元生成P-KID。
示例性地，P-TID可以是远端AUSF网元根据中间密钥Kausf、FC、P0、L0、P1、和L1生成的。具体实现方式可参照上述对应的实现方式，此处不再赘述。
S506，远端AUSF网元向远端UDM网元发送临近业务中继密钥标识消息。相应地，远端UDM网元接收来自远端AUSF网元的临近业务中继密钥标识消息。
示例性地，临近业务中继密钥标识管理(Kudm_ProSe_RelayKeyID management)消息可以包括P-KID。
S507，远端UDM网元向远端AUSF网元发送确认消息。相应地，远端AUSF网元接收来自远端UDM网元的确认消息。
S508，远端AUSF网元向远端AMF网元发送临近业务中继密钥响应消息。相应地，远端AMF网元接收来自远端AUSF网元的临近业务中继密钥响应消息。
S509，远端AMF网元向远端终端设备发送NAS中继密钥响应消息。相应地，远端终端设备接收来自远端AMF网元的NAS中继密钥响应消息。
S510，当远端终端设备确定使用中继终端设备进行通信时，则执行中继终端设备发现流程。
需要说明的是，S510可以在上述S509后的任意时刻执行。
S511，远端终端设备生成P-KID。
示例性地，P-TID可以是根据Kausf、FC、P0、L0、P1、和L1生成的。具体实现方式可参照上述对应的实现方式，此处不再赘述。
S512，远端终端设备向中继终端设备发送直接通信请求消息。相应地，中继终端设备接收来自远端终端设备的直接通信请求消息。
示例性地，直接通信请求消息可以包括P-KID、中继服务码和随机数1(nonce 1)。
S513，中继终端设备向中继AMF网元发送NAS远端密钥请求消息。相应地，中继AMF网元接收来自中继终端设备的NAS远端密钥请求消息。
示例性地，NAS远端密钥请求消息可以包括P-KID、中继服务码和随机数1。
S514，中继AMF网元检查中继终端设备是否被授权作为中继，如果是，则中继AMF网元发现远端UDM网元，并向远端UDM网元发送鉴权服务器功能网元标识获取请求消息。相应地，远端UDM网元接收来自中继AMF网元的鉴权服务器功能网元标识获取请求消息。
示例性地，鉴权服务器功能网元标识获取请求(Nudm_AUSFID_Get request)消息包括P-KID。
S515，远端UDM网元向中继AMF网元发送鉴权服务器功能网元标识获取响应消 息。相应地，中继AMF网元接收来自远端UDM网元的鉴权服务器功能网元标识获取响应消息。
示例性地，鉴权服务器功能网元标识获取响应(Nudm_AUSFID_Get response)消息可以包括服务远端终端设备的AUSF的AUSF实例ID。
S516，中继AMF网元向远端AUSF网元发送临近业务远端密钥请求消息。相应地，远端AUSF网元接收来自中继AMF网元的临近业务远端密钥请求消息。
示例性地，临近业务远端密钥请求(Nausf_ProSe_Remote Key request)消息可以包括P-KID、中继服务码和随机数1。
S517，远端AUSF网元推演远端密钥KR。
可选地，远端AUSF网元生成新鲜性参数，并根据中间密钥Kausf、中继服务码、新鲜性参数和随机数1推演远端密钥KR。
S518，远端AUSF网元向中继AMF网元发送临近业务远端密钥响应消息。相应地，中继AMF网元接收来自远端AUSF网元的临近业务远端密钥响应消息。
示例性地，临近业务远端密钥响应(Nausf_ProSe_Remote Key response)消息可以包括远端密钥KR和新鲜性参数。
S519，中继AMF网元向中继终端设备发送NAS远端密钥响应消息。相应地，中继终端设备接收来自中继AMF网元的NAS远端密钥响应消息。
示例性地，NAS远端密钥响应(NAS Remote Key response)消息可以包括远端密钥KR和新鲜性参数。
S520，中继终端设备向远端终端设备发送直接安全模式命令消息。相应地，远端终端设备接收来自中继终端设备的直接安全模式命令消息。
示例性地，直接安全模式命令消息可以包括新鲜性参数和随机数2。
S521，远端终端设备向中继终端设备发送直接安全模式命令完成消息。相应地，中继终端设备接收来自远端终端设备的直接安全模式命令完成消息。
可选地，远端终端设备推演KR，生成新鲜性参数，并根据中间密钥Kausf、中继服务码、新鲜性参数和随机数2推演远端密钥KR。
可选地，直接安全模式命令完成消息被完整性保护，完整性保护的密钥是根据KR生成的。
图5所示的授权方法可以验证中继终端设备是否被授权作为中继终端设备，但是对于如何验证终端设备是否被授权作为远端终端设备、以及如何验证终端设备是否被授权使用中继服务码，并未给出解决方案，不能保证中继通信连接的建立的安全性。
示例性地，对于远端终端设备来说，终端设备是否被授权使用中继服务码可以指远端终端设备是否被授权使用中继服务码对应的连接服务。对于中继终端设备来说，终端设备是否被授权使用中继服务码可以指中继终端设备是否被授权提供中继服务码对应的连接服务。
示例性地，图6为本申请实施例提供的另一种授权方法的流程示意图。图6阐述了通过信令面建立PC5安全连接的方案，图6所示的方法与图5所示的方法的区别在于：远端终端设备发起注册请求后，远端AMF网元触发主鉴权流程，在主鉴权流程成功完成后，远端AUSF网元生成P-KID，远端终端设备获取服务授权和临近业务策 略信息。该授权方法可以适用于图1所示的通信系统。
如图6所示，该授权方法包括如下步骤：
S601，远端终端设备向远端AMF网元发送注册请求消息后，远端AMF网元触发主鉴权流程。
S602，远端AUSF网元向远端UDM网元发送终端设备鉴权获取请求消息。相应地，远端UDM网元接收来自远端AUSF网元的终端设备鉴权获取请求消息。
可选地，终端设备鉴权获取请求消息可用向远端UDM网元请求认证数据(例如认证向量)。
例如，认证数据可用于核心网网元与终端设备之间进行主鉴权或主认证(Primary authentication)。
示例性地，终端设备鉴权获取请求(Nudm_UEAuthentication_Get Request)消息可以包括SUPI或者SUCI。例如，若远端AMF网元向远端AUSF网元提供的是SUCI，则终端设备鉴权获取请求消息中携带SUCI。若远端AMF网元向远端AUSF网元提供的是SUPI，则终端设备鉴权获取请求消息中携带SUPI。
S603，远端UDM网元向远端AUSF网元发送终端设备鉴权获取响应消息。相应地，远端AUSF网元接收来自远端UDM网元的终端设备鉴权获取响应消息。
示例性地，终端设备鉴权获取响应(Num_UEAuthentication_Get Response)消息可以包括认证向量。
可选地，终端设备鉴权获取响应消息还可以包括临近业务指示信息和RID。
示例性地，临近业务(ProSe)指示信息可用于指示终端设备支持使用临近业务服务。例如临近业务指示信息可指示终端设备是否被授权使用临近业务直接发现、和/或临近业务直接通信，还可以指示终端设备是否被授权作为中继终端设备。
例如，UDM根据临近业务签约信息确定终端设备是否授权使用临近业务服务，如果授权，则传递临近业务指示信息给AUSF。
可选地，当终端设备鉴权获取请求消息包括临近业务指示信息时，还包括RID。
S604，远端AUSF网元生成P-KID。
可选地，上述S604可以在上述S601的主鉴权流程成功完成后执行。即AUSF判断认证成功之后。
示例性地，P-TID可以是远端AUSF网元根据中间密钥Kausf、FC、P0、L0、P1、和L1生成的。具体实现方式可参照上述对应的实现方式，此处不再赘述。
可选地，中间密钥Kausf可以是远端AUSF网元接收到临近业务指示信息后存储的。
S605，远端AUSF网元向远端UDM网元发送终端设备鉴权结果确认请求消息。相应地，远端UDM网元接收来自远端AUSF网元的终端设备鉴权结果确认请求消息。
示例性地，终端设备鉴权结果确认请求(Nudm_UEAuthenticationResultConfimation Request)消息可以包括P-KID。
S606，远端UDM网元向远端AUSF网元发送终端设备鉴权结果确认响应消息。相应地，远端AUSF网元接收来自远端UDM网元的终端设备鉴权结果确认响应消息。
S607，远端终端设备获取服务授权和临近业务策略信息。
S608，中继终端设备注册到网络。
可选地，中继终端设备可以从网络获取服务授权和临近业务的配置信息。关于中继终端设备的临近业务策略信息的具体实现方式可参照上述阐述，此处不再赘述。
需要说明的是，S608可以在S609之前的任意时刻执行。
S609，当远端终端设备确定使用中继终端设备进行通信时，则执行中继终端设备发现流程。
需要说明的是，S609可以在上述S608后的任意时刻执行。
图6所示的授权方法还可以包括：S610-S620。其中，S610-S620的具体实现方式的实现方式可参照上述S511-S521的具体实现方式，此处不再赘述。
与图5所示的方法类似，图6所示的授权方法可以验证中继终端设备是否被授权作为中继终端设备，但是对于如何验证终端设备是否被授权作为远端终端设备、以及如何验证终端设备是否被授权使用中继服务码，并未给出解决方案，不能保证中继通信连接的建立的安全性。
本申请实施例提供一种授权方法，可以根据终端设备的临近业务授权信息，确定该终端设备是否被授权使用中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务，例如中继服务码1可标识层3中继服务1。如此，可以验证终端设备是否被授权使用或提供层3中继服务1，从而可以保证中继通信连接的建立的安全性。
确定该终端设备是否被授权使用中继服务码的步骤可以由策略控制功能网元或接入和移动管理功能网元执行，下述图7以策略控制功能网元确定终端设备是否被授权使用中继服务码为例进行阐述，下述图8a以接入和移动管理功能网元确定终端设备是否被授权使用中继服务码为例进行阐述。
示例性地，图7为本申请实施例提供的又一种授权方法的流程示意图。图7以由策略控制功能网元确定终端设备是否被授权使用中继服务码为例进行阐述，图7所示的方法适用于图1-图4所示的架构中，还可以应用于其他、以及未来各种形式的网络架构中，相应的名称也可以用其他网络架构、以及未来各种形式的网络架构中的对应功能的名称进行替代。
需要说明的是，图7所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。终端设备可以为远端终端设备或中继终端设备，AMF网元可以称为远端AMF网元或中继AMF网元，PCF网元可以称为远端PCF网元或中继PCF网元，AUSF网元可以称为远端AUSF网元或中继AUSF网元，UDM网元可以称为远端UDM网元或中继UDM网元。
如图7所示，该授权方法包括如下步骤：
S701，接入和移动管理功能网元向策略控制功能网元发送授权请求消息。相应地，策略控制功能网元接收来自接入和移动管理功能网元的授权请求消息。
示例性地，授权请求消息可用于请求验证终端设备是否被授权使用中继服务码。
示例性地，授权请求消息包括来自终端设备的中继服务码。接入和移动管理功能网元服务终端设备。
示例性地，中继服务码可用于标识中继设备为远端设备提供的连接服务。关于中继服务码的具体实现方式可参照上述第一项中的阐述，此处不再赘述。
在一些实施例中，授权请求消息还可以包括如下一项或多项：终端指示信息、终端设备的标识、终端设备的上下文标识、和公共陆地移动网标识。
可选地，终端指示信息可用于指示终端设备为远端终端设备或中继终端设备。
例如，终端指示信息可用于指示终端设备作为远端终端设备请求验证、或作为中继终端设备请求验证。
示例性地，当终端设备为中继终端设备时，授权请求消息还可以包括PLMN ID。
示例性地，终端设备的标识或终端设备的上下文标识可用于获取该终端设备的临近业务授权信息。
例如，终端设备的标识可以为终端设备的SUPI、或SUCI。终端设备的上下文标识可以为PCF分配的用于标识终端设备上下文的标识。该终端设备的上下文标识存储于接入和移动管理功能网元。
可选地，公共陆地移动网标识可以是接入和移动管理功能网元根据接入和移动管理功能网元服务的网络获得的。
在一些实施例中，授权请求消息可指示终端设备为中继终端设备，或者，授权请求消息可指示终端设备为远端终端设备。
可选地，可以通过终端指示信息来指示终端设备为中继终端设备或远端终端设备。或者，可以通过授权请求消息包括的内容来指示。或者，可以通过不同的服务操作名称来指示。
示例性地，若授权请求消息包括中继服务码，该授权请求消息可指示验证终端设备为远端终端设备是否被授权使用该中继服务码。
又示例性地，若授权请求消息包括中继服务码和公共陆地移动网标识，该授权请求消息可指示验证终端设备为中继终端设备是否被授权使用该中继服务码、以及是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
一些实施例中，PCF网元可以根据授权请求消息确定终端设备的类型是中继终端设备还是远端终端设备。
例如，PCF网元可以根据终端指示信息或者可以通过授权请求消息包括的内容或服务操作名称来确定终端设备的类型。
在一种可能的设计方法中，上述S701可以包括：在终端设备被授权作为远端终端设备或中继终端设备的情况下，接入和移动管理功能网元向策略控制功能网元发送授权请求消息。
需要说明的是，中继服务码用于标识中继设备为远端设备提供的连接服务，只有中继终端设备或远端终端设备才能使用中继服务码，在终端设备未被授权作为远端终端设备或中继终端设备的情况下，该终端设备肯定不支持使用中继服务码。也就是说，若终端设备未被授权作为远端终端设备或中继终端设备，则该终端设备未被授权使用中继服务码。
如此，在终端设备未被授权作为远端终端设备或中继终端设备的情况下，AMF网元不向PCF网元发送授权请求消息，可以避免PCF网元确定终端设备是否被授权使用中继服务码(即避免执行下述S702)，从而可以避免资源浪费。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S704， 接入和移动管理功能网元根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备或中继终端设备。
可选地，临近业务签约信息可用于指示授权的临近业务服务，如临近业务直接发现、临近业务直接通信、作为中继设备等。
示例性地，临近业务签约信息可以是AMF网元从UDM网元获得的。例如AMF网元根据终端设备的标识、或终端设备的上下文标识从UDM网元获取临近业务签约信息。
一些实施例中，在终端设备为中继终端设备的情况下，接入和移动管理功能网元根据终端设备的临近业务签约信息，确定终端设备是否被授权作为中继终端设备。
示例性地，终端设备作为中继终端设备请求验证其是否被授权使用中继服务码的情况下，AMF网元可以根据临近业务签约信息，确定终端设备是否被授权作为中继终端设备。若AMF网元确定终端设备被授权作为中继终端设备，则执行后续步骤，例如发送授权请求消息。否则，可以向终端设备反馈请求失败。
一些实施例中，在终端设备为远端终端设备的情况下，接入和移动管理功能网元根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
示例性地，终端设备作为远端终端设备请求验证其是否被授权使用中继服务码的情况下，AMF网元可以根据临近业务签约信息，确定终端设备是否被授权作为远端终端设备。若AMF网元确定终端设备被授权作为远端终端设备，则执行后续步骤，例如发送授权请求消息。否则，可以向终端设备反馈请求失败。
一些实施例中，接入和移动管理功能网元可以获取接入和移动管理功能网元服务的网络的公共陆地移动网标识。例如，若终端设备被授权作为中继终端设备，AMF网元可以获取AMF网元服务的网络的公共陆地移动网标识。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S705，终端设备向接入和移动管理功能网元发送非接入层请求消息。相应地，接入和移动管理功能网元接收来自终端设备的非接入层请求消息。
可选地，非接入层请求消息可以包括中继服务码。
可选地，非接入层请求消息还可以包括临近业务密钥标识和随机数。例如，临近业务密钥标识可以是远端终端设备生成并发送给中继终端设备，由中继终端设备发给接入和移动管理功能网元的。
示例性地，若终端设备为远端终端设备，则非接入层请求消息可以称为非接入层中继密钥请求消息；若终端设备为终极终端设备，则非接入层请求消息可以称为非接入层远端密钥请求消息。
需要说明的是，本申请不限定S705与上述S704执行的先后顺序，例如上述S705可以在上述S704之前执行。
如此，可以实现在终端设备触发请求密钥的过程中，AMF网元验证终端设备是否被授权作为远端终端设备或中继终端设备，PCF网元验证终端设备是否被授权使用中继服务码。
可选地，接入和移动管理功能网元可以根据非接入层请求消息，确定终端设备为中继终端设备还是远端终端设备。
示例性地，AMF网元可以根据非接入层请求消息的类型或非接入层请求消息包括的信元，确定终端设备为中继终端设备还是远端终端设备。
需要说明的是，AMF网元可以不对终端设备为中继终端设备还是远端终端设备进行判断，在收到非接入层请求消息后，根据非接入层请求消息的类型或包含的信元，验证终端设备是否被授权作为远端终端设备或中继终端设备(对应S704)，或者直接发送授权请求消息(对应S701)。
需要说明的是，非接入层请求消息可以称为非接入层密钥请求消息，本申请不对非接入层请求消息的名称进行限定。
S702，策略控制功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。
可选地，临近业务授权信息可以是策略控制功能网元根据终端设备的标识、和/或终端设备的上下文标识确定的。
示例性地，临近业务授权信息可指示终端设备被授权的中继服务。临近业务授权信息的具体实现方式可参照上述第四项中的阐述，此处不再赘述。
一些实施例中，假设临近业务授权信息指示终端设备被授权中继服务1，策略控制功能网元从AMF网元接收的中继服务码标识中继服务1，则该终端设备被授权使用该中继服务码1。
一些实施例中，假设临近业务授权信息指示终端设备被授权中继服务1，策略控制功能网元从AMF网元接收的中继服务码标识中继服务2，则该终端设备不被授权使用该中继服务码2。
在一些实施例中，PCF网元接收授权请求消息后，假设授权请求消息指示终端设备为远端终端设备，PCF网元可以直接验证终端设备是否被授权使用中继服务码，或者，可以先验证终端设备是否被授权作为远端终端设备，若是，再验证终端设备作为远端终端设备是否被授权使用中继服务码。
在一些实施例中，PCF网元接收授权请求消息后，假设授权请求消息指示终端设备为中继终端设备，PCF网元可以直接验证终端设备是否被授权使用中继服务码，或者，可以先验证终端设备是否被授权作为中继终端设备，若是，再验证终端设备作为中继终端设备是否被授权使用中继服务码。
需要说明的是，终端设备是否被授权作为中继终端设备可以由AMF网元或PCF网元来验证，或者AMF网元验证后，PCF网元接收授权请求消息后再验证，本申请对此不进行限定。
在一种可能的设计方法中，上述S702可以包括：在终端设备被授权作为远端终端设备或中继终端设备的情况下，策略控制功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。
如此，在确定终端设备能够作为远端终端设备或中继终端设备的情况下，PCF网元确定该终端设备是否能够提供或使用中继服务码标识的连接服务，可以避免PCF网元执行不必要的步骤，从而避免资源浪费。
示例性地，在终端设备被授权作为远端终端设备的情况下，PCF网元根据该终端设备的临近业务授权信息，确定远端终端设备是否被授权使用中继服务码对应的连接 服务。
又示例性地，在终端设备被授权作为中继终端设备的情况下，PCF网元根据该终端设备的临近业务授权信息，确定中继终端设备是否被授权提供中继服务码对应的连接服务，还可以确定中继终端设备是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
一些实施例中，策略控制功能网元可以根据终端指示信息，获得终端设备作为远端终端设备或中继终端设备对应的临近业务授权信息，例如，终端设备作为远端终端设备对应的临近业务授权信息包括：RSC1和RSC2。终端设备作为中继终端设备对应的临近业务授权信息包括：PLMN ID1，PLMN ID2；RSC3，RSC4。
在一种可能的设计方法中，授权请求消息指示终端设备为远端终端设备，上述策略控制功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码，可以包括：策略控制功能网元确定临近业务授权信息是否包括中继服务码。若是，则终端设备被授权使用中继服务码，否则，终端设备未被授权使用中继服务码。
示例性地，临近业务授权信息包括RSC，PCF网元可以确定临近业务授权信息中的RSC与从AMF网元接收的RSC是否一致，若一致，则终端设备被授权使用中继服务码，否则，终端设备未被授权使用中继服务码。
示例性地，假设授权请求消息指示终端设备1作为远端终端设备，终端设备1的临近业务授权信息包括远端终端设备{RSC1、RSC2}和中继终端设备{RSC3、RSC4}，若授权请求消息包括RSC1，则PCF网元可以确定终端设备1作为远端终端设备被授权使用RSC1；若授权请求消息包括RSC5，则PCF网元可以确定终端设备1作为远端终端设备未被授权使用RSC5。
需要说明的是，终端设备1作为远端终端设备，终端设备1临近业务授权信息可以只包括终端设备1作为远端的相关信息(指远端终端设备{RSC1、RSC2})，不包括终端设备1作为中继终端设备的相关信息(指中继终端设备{RSC3、RSC4})，本申请对此不进行限定，上述仅为本申请的示例。
在一种可能的设计方法中，授权请求消息还包括公共陆地移动网标识，上述S702可以包括：策略控制功能网元根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
示例性地，授权请求消息指示终端设备为中继终端设备，PCF网元可以根据临近业务授权信息，确定中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，授权请求消息指示终端设备为中继终端设备，PCF网元可以根据临近业务授权信息，确定中继终端设备是否被授权在PLMN ID对应的PLMN中提供中继服务码对应的连接服务。
在一种可能的设计方法中，上述策略控制功能网元根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，可以包括：策略控制功能网元确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务；若临近业务授权信息 不包括中继服务码，则终端设备未被授权使用中继服务码；若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，假设授权请求消息指示终端设备2作为中继终端设备，临近业务授权信息包括远端终端设备{RSC3、RSC4}、中继终端设备{RSC1、RSC2}、PLMN ID1和PLMN ID2，若授权请求消息包括RSC1和PLMN ID1，则PCF网元可以确定终端设备2作为中继终端设备被授权使用RSC1、且被授权在PLMN ID1对应的PLMN中中继业务；若授权请求消息包括RSC4和PLMN ID3，则PCF网元可以确定终端设备2作为中继终端设备未被授权使用RSC4、未被授权在PLMN ID3对应的PLMN中中继业务；若授权请求消息包括RSC1和PLMN ID3，则PCF网元可以确定终端设备2作为中继终端设备被授权使用RSC1、未被授权在PLMN ID3对应的PLMN中中继业务。
一些实施例中，策略控制功能网元可以根据临近业务授权信息是否包括中继服务码和公共陆地移动网标识，确定终端设备是否被授权在PLMN ID对应的PLMN中提供RSC对应的连接服务。
假设授权请求消息指示终端设备2作为中继终端设备，临近业务授权信息包括远端终端设备{RSC3、RSC4}、中继终端设备{PLMN ID1(RSC1，RSC5)、PLMN ID2(RSC2，RSC6)}，若授权请求消息包括RSC1和PLMN ID1，则PCF网元可以确定终端设备2被授权在PLMN ID1对应的PLMN中提供RSC1对应的连接服务；若授权请求消息包括RSC1和PLMN ID2，则PCF网元可以确定终端设备2未被授权在PLMN ID2对应的PLMN中提供RSC1对应的连接服务。
需要说明的是，终端设备2作为中继终端设备，策略控制功能网元使用的终端设备2的临近业务授权信息可以只包括终端设备2作为中继的相关信息(指中继终端设备{PLMN ID1(RSC1，RSC5)、PLMN ID2(RSC2，RSC6)})，不包括终端设备2作为远端终端设备的相关信息(指远端终端设备{RSC3、RSC4})，本申请对此不进行限定，上述仅为本申请的示例。
如此，可以验证中继终端设备是否被授权在PLMN ID对应的PLMN中服务远端，以及是否被授权提供RSC对应的中继服务。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S703，策略控制功能网元向接入和移动管理功能网元发送授权响应消息。相应地，接入和移动管理功能网元接收来自策略控制功能网元的授权响应消息。
可选地，授权响应消息可指示授权或未授权，或者，授权响应消息可指示授权成功或授权失败。
可选地，授权响应消息可指示终端设备是否被授权使用中继服务码。
可选地，授权响应消息指示终端设备是否被授权使用中继服务码，具体可以为：指示终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
例如，在终端设备为远端终端设备的情况下，授权响应消息可以指示终端设备被授权使用中继服务码对应的中继服务、或者终端设备未被授权使用中继服务码对应的中继服务。
又例如，在终端设备为中继终端设备的情况下，授权响应消息可以指示终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务、或者指示终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。或者，授权响应消息可以指示终端设备被授权在PLMN ID对应的PLMN中提供中继服务码对应的中继服务、或者终端设备未被授权在PLMN ID对应的PLMN中提供中继服务码对应的中继服务。
在一种可能的设计方法中，在授权响应消息指示终端设备被授权使用中继服务码的情况下，本申请实施例提供的授权方法，还可以包括：S706，接入和移动管理功能网元向鉴权服务器功能网元发送临近业务请求消息。相应地，鉴权服务器功能网元接收来自接入和移动管理功能网元的临近业务请求消息。
可选地，临近业务请求消息可以包括中继服务码。该中继服务码为AMF网元从终端设备获取的。
例如，假设终端设备为远端终端设备，在授权响应消息指示授权的情况下，AMF网元向AUSF网元发送临近业务中继请求消息(即临近业务请求消息)，临近业务中继请求消息包括中继服务码。可选地，AUSF网元可以采用中继服务码生成P-KID，还可以生成临近业务根密钥。
如此，在对终端设备授权检查通过(即终端设备被授权使用中继服务码)后，AMF网元向AUSF网元触发P-KID推演过程，可以保证AUSF网元推演授权的终端设备对应的P-KID，不推演未授权的终端设备对应的P-KID，可提高安全性。
需要说明的是，临近业务请求消息可以称为临近业务密钥请求消息，本申请不对临近业务请求消息的名称进行限定。
在一些实施例中，非接入层请求消息包括临近业务密钥标识，在授权响应消息指示终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，本申请实施例提供的授权方法，还可以包括：S707，接入和移动管理功能网元向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息。相应地，统一数据管理网元接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息。
可选地，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识。
例如，假设终端设备为中继终端设备，在授权响应消息指示授权的情况下，中继AMF网元可以向远端UDM网元发送鉴权服务器功能网元标识获取请求消息。
可选地，在对终端设备授权检查通过后，AMF网元可以向AUSF网元请求密钥，如此可以保证被授权的终端设备获取对应的密钥，并建立PC5连接，未被授权的终端设备不能获取对应的密钥，可以提高安全性。
在一些实施例中，在授权响应消息指示终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，本申请实施例提供的授权方法，还可以包括：S708，接入和移动管理功能网元向终端设备发送非接入层响应消息。相应地，终端设备接收来自接入和移动管理功能网元的非接入层响应消息。
可选地，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
例如，假设终端设备为中继终端设备，在授权响应消息指示未被授权的情况下，中继AMF网元向终端设备发送非接入层远端密钥响应消息(即非接入层响应消息)，非接入层远端密钥响应消息指示密钥请求失败。
又例如，假设终端设备为远端终端设备，在授权响应消息指示未被授权的情况下，远端AMF网元向终端设备发送非接入层中继密钥响应消息(即非接入层响应消息)，非接入层中继密钥响应消息指示密钥请求失败。
如此，若终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，则通知该终端设备请求失败。
需要说明的是，本申请不对非接入层响应消息的名称进行限定。
基于图7所示的授权方法，PCF网元通过与AMF网元交互获得来自终端设备的中继服务码，根据终端设备的临近业务授权信息，确定终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而保证中继通信连接的建立的安全性。
示例性地，图8a为本申请实施例提供的又一种授权方法的流程示意图。图8a以接入和移动管理功能网元确定终端设备是否被授权使用中继服务码为例进行阐述，图8a所示的方法适用于图1-图4所示的架构中，还可以应用于其他、以及未来各种形式的网络架构中，相应的名称也可以用其他网络架构、以及未来各种形式的网络架构中的对应功能的名称进行替代。
需要说明的是，图8a所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。终端设备可以为远端终端设备或中继终端设备，AMF网元可以称为远端AMF网元或中继AMF网元，PCF网元可以称为远端PCF网元或中继PCF网元，AUSF网元可以称为远端AUSF网元或中继AUSF网元，UDM网元可以称为远端UDM网元或中继UDM网元。
如图8a所示，该授权方法包括如下步骤：
S801，接入和移动管理功能网元获取终端设备的中继服务码。
示例性地，中继服务码可用于标识中继设备为远端设备提供的连接服务。关于中继服务码的具体实现方式可参照上述第一项中的阐述，此处不再赘述。
在一种可能的设计方法中，上述S801，可以包括：终端设备向接入和移动管理功能网元发送非接入层请求消息。相应地，接入和移动管理功能网元接收来自终端设备的非接入层请求消息。具体实现方式可参照上述S705，此处不再赘述。
可选地，非接入层请求消息可以包括中继服务码。
可选地，非接入层请求消息还可以包括临近业务密钥标识和随机数。或者，非接入层请求消息还可以包括SUCI和随机数。
如此，接入和移动管理功能网元可以在接收非接入层请求消息后，执行下述S802，确定终端设备是否被授权使用中继服务码。
如此，可以实现在终端设备触发请求密钥的过程中，AMF网元验证终端设备是否被授权使用中继服务码提供或获取中继服务。
需要说明的是，非接入层请求消息可以称为非接入层密钥请求消息，本申请不对 非接入层请求消息的名称进行限定。
在一种可能的设计方法中，上述S801，可以包括：统一数据管理网元向接入和移动管理功能网元发送授权请求消息。相应地，接入和移动管理功能网元接收来自统一数据管理网元的授权请求消息。
可选地，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。可选地，授权请求消息可以包括终端设备的签约永久标识和中继服务码。
例如，签约永久标识可用于接入和移动管理功能网元获取终端设备的临近业务授权信息。
可选地，签约永久标识可以是统一数据管理网元根据临近业务密钥标识、或签约隐藏标识确定的。
例如，统一数据管理网元可以对签约隐藏标识解密获得签约永久标识。
例如，统一数据管理网元可以根据临近业务密钥标识从临近业务密钥标识与签约永久标识的对应关系中，获得签约永久标识。
可选地，接入和移动管理功能网元的标识可以是UDM网元根据临近业务密钥标识、或签约隐藏标识从UDM网元中存储的终端设备上下文中获得的。
示例性地，UDM网元可以根据临近业务密钥标识获得服务终端设备的AMF网元。
示例性地，UDM网元可以根据签约隐藏标识获得签约永久标识，根据签约永久标识获取终端设备的安全上下文，从安全上下文中获取服务终端设备的AMF网元。
例如，统一数据管理网元可以向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息。
如此，接入和移动管理功能网元可以在接收授权请求消息后，执行下述S802，确定终端设备是否被授权使用中继服务码。
在一些实施例中，上述统一数据管理网元向接入和移动管理功能网元发送授权请求消息，可以包括：在终端设备被授权作为远端终端设备的情况下，统一数据管理网元向接入和移动管理功能网元发送授权请求消息。
如此，UDM网元可以在确定终端设备被授权作为远端终端设备的情况下，向AMF网元请求授权检查，触发AMF网元检查终端设备是否被授权使用中继服务码。在确定终端设备未被授权作为远端终端设备的情况下，不向AMF网元请求授权检查，不触发AMF网元检查终端设备是否被授权使用中继服务码，可以避免资源浪费。
可选地，可以由UDM网元或AMF网元确定终端设备是否被授权作为远端终端设备或中继终端设备。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：统一数据管理网元根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备或中继终端设备。
可选地，临近业务签约信息用于指示授权的临近业务服务，如临近业务直接发现、临近业务直接通信、作为中继设备等。
也就是说，可以由UDM网元确定终端设备是否被授权作为远端终端设备或中继终端设备。例如，远端UDM网元确定终端设备是否被授权作为远端终端设备。
可选地，UDM网元可以根据签约永久标识获取临近业务签约信息。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S803，接入和移动管理功能网元根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备或中继终端设备。具体实现方式可参照上述S704，此处不再赘述。
如此，可以由AMF网元确定终端设备是否被授权作为远端终端设备或中继终端设备。
S802，接入和移动管理功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。
示例性地，临近业务授权信息可以是接入和移动管理功能网元从策略控制功能网元获取的。
一些实施例中，假设临近业务授权信息指示终端设备被授权中继服务1，AMF网元从终端设备或UDM网元接收的中继服务码标识中继服务1，则该终端设备被授权使用该中继服务码。
一些实施例中，假设临近业务授权信息指示终端设备被授权中继服务2，AMF网元从终端设备或UDM网元接收的中继服务码标识中继服务1，则该终端设备不被授权使用该中继服务码。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S804，策略控制功能网元向接入和移动管理功能网元发送通信消息。相应地，接入和移动管理功能网元接收来自策略控制功能网元的通信消息。
可选地，通信消息可以包括临近业务授权信息。
可选地，接入和移动管理功能网元可以存储临近业务授权信息。
可选地，通信消息还可以包括授权指示信息，授权指示信息可指示临近业务授权信息为终端设备作为中继终端设备或远端终端设备对应的临近业务授权信息。
示例性地，临近业务授权信息可以是在终端设备注册过程中、或终端设备主动请求策略过程中PCF网元发给AMF网元的，或者是PCF网元检测到策略更新后主动下发给AMF网元的，或者是AMF网元主动请求的。AMF网元(例如远端AMF网元、或中继AMF网元)获取临近业务授权信息的具体实现过程可参照下述图9a、以及图9b所示的阐述。
在一些实施例中，本申请实施例提供的授权方法，还可以包括：接入和移动管理功能网元向策略控制功能网元发送授权信息请求消息。相应地，策略控制功能网元接收来自接入和移动管理功能网元的授权信息请求消息。
可选地，授权信息请求消息可用于请求终端设备的临近业务授权信息。如此，临近业务授权信息可以是AMF网元主动请求的。
在一种可能的设计方法中，上述S802，可以包括：在终端设备被授权作为远端终端设备或中继终端设备的情况下，接入和移动管理功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。具体实现方式可参照上述S702中由策略控制功能网元执行的对应的实现方式，将策略控制功能网元替换为接入和移动管理功能网元即可，此处不再赘述。
在一种可能的设计方法中，终端设备为远端终端设备，上述接入和移动管理功能网元根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码， 可以包括：接入和移动管理功能网元确定临近业务授权信息是否包括中继服务码。若是，则终端设备被授权使用中继服务码，否则，终端设备未被授权使用中继服务码。
示例性地，终端设备1作为远端终端设备，终端设备1的临近业务授权信息包括远端终端设备{RSC1、RSC2}和中继终端设备{RSC3、RSC4}，若授权请求消息包括RSC1，则接入和移动管理功能网元可以确定终端设备1作为远端终端设备被授权使用RSC1；若授权请求消息包括RSC5，则终端设备1可以确定终端设备1作为远端终端设备未被授权使用RSC5。
需要说明的是，终端设备1作为远端终端设备，接入和移动管理功能网元使用的终端设备1的临近业务授权信息可以只包括终端设备1作为远端的相关信息(指远端终端设备{RSC1、RSC2})，不包括终端设备1作为中继终端设备的相关信息(指中继终端设备{RSC3、RSC4})，本申请对此不进行限定，上述仅为本申请的示例。
在一种可能的设计方法中，终端设备为中继终端设备，上述S802，可以包括：接入和移动管理功能网元根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
一些实施例中，终端设备为中继终端设备，AMF网元可以根据临近业务授权信息，确定中继终端设备是否被授权在PLMN ID对应的PLMN中提供中继服务码对应的连接服务。
在一些实施例中，接入和移动管理功能网元可以获取接入和移动管理功能网元服务的网络的公共陆地移动网标识。
可选地，若终端设备被授权作为中继终端设备，则AMF网元可以获取AMF网元服务的网络的公共陆地移动网标识。
在一种可能的设计方法中，上述接入和移动管理功能网元根据临近业务授权信息，确定终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，可以包括：接入和移动管理功能网元确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务；若临近业务授权信息不包括中继服务码，则终端设备未被授权使用中继服务码；若临近业务授权信息不包括公共陆地移动网标识，则终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，假设终端设备2作为中继终端设备，终端设备2的临近业务授权信息包括远端终端设备{RSC3、RSC4}、中继终端设备{RSC1、RSC2}、PLMN ID1和PLMN ID2，若授权请求消息包括RSC1和PLMN ID1，则接入和移动管理功能网元可以确定终端设备2作为中继终端设备被授权使用RSC1、且被授权在PLMN ID1对应的PLMN中中继业务；若授权请求消息包括RSC4和PLMN ID3，则接入和移动管理功能网元可以确定终端设备2作为中继终端设备未被授权使用RSC4、未被授权在PLMN ID3对应的PLMN中中继业务；若授权请求消息包括RSC1和PLMN ID3，则接入和移动管理功能网元可以确定终端设备2作为中继终端设备被授权使用RSC1、未被授权在PLMN ID3对应的PLMN中中继业务。
一些实施例中，接入和移动管理功能网元可以根据临近业务授权信息是否包括中 继服务码和公共陆地移动网标识，确定终端设备是否被授权在PLMN ID对应的PLMN中提供RSC对应的连接服务。
假设终端设备2作为中继终端设备，临近业务授权信息包括远端终端设备{RSC3、RSC4}、中继终端设备{PLMN ID1(RSC1，RSC5)、PLMN ID2(RSC2，RSC6)}，若授权请求消息包括RSC1和PLMN ID1，则接入和移动管理功能网元可以确定终端设备2被授权在PLMN ID1对应的PLMN中提供RSC1对应的连接服务；若授权请求消息包括RSC1和PLMN ID2，则接入和移动管理功能网元可以确定终端设备2未被授权在PLMN ID2对应的PLMN中提供RSC1对应的连接服务。
需要说明的是，终端设备2作为中继终端设备，接入和移动管理功能网元使用的终端设备2的临近业务授权信息可以只包括终端设备2作为中继的相关信息(指中继终端设备{PLMN ID1(RSC1，RSC5)、PLMN ID2(RSC2，RSC6))}，不包括终端设备2作为远端终端设备的相关信息(指远端终端设备{RSC3、RSC4})，本申请对此不进行限定，上述仅为本申请的示例。
如此，AMF网元可以验证中继终端设备是否被授权在PLMN ID对应的PLMN中服务远端，以及是否被授权提供RSC对应的中继服务。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S805，在终端设备作为远端终端设备被授权使用中继服务码的情况下，接入和移动管理功能网元向鉴权服务器功能网元发送临近业务请求消息。相应地，鉴权服务器功能网元接收来自接入和移动管理功能网元的临近业务请求消息。具体实现方式可参照上述S706，此处不再赘述。
可选地，临近业务请求消息可以包括中继服务码。
示例性地，远端AMF网元向远端AUSF网元发送临近业务中继密钥请求消息(即临近业务请求消息)。
如此，在对终端设备授权检查通过(即终端设备被授权使用中继服务码)后，AMF网元向AUSF网元触发P-KID推演过程，可以保证AUSF网元推演授权的终端设备对应的P-KID，不推演未授权的终端设备对应的P-KID。
需要说明的是，本申请不对临近业务请求消息的名称进行限定。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S806，在终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，接入和移动管理功能网元向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。相应地，统一数据管理网元接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。
可选地，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识、或签约隐藏标识。密钥获取请求消息可以包括临近业务密钥标识、或签约隐藏标识。
或者，可选地，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识和中继服务码。密钥获取请求消息可以包括临近业务密钥标识和中继服务码。
或者，可选地，鉴权服务器功能网元标识获取请求消息可以包括签约隐藏标识和中继服务码。密钥获取请求消息可以包括签约隐藏标识和中继服务码。
示例性地，中继AMF网元可以向远端UDM网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息(也可称为中继密钥获取请求消息)。
如此，在终端设备授权检查通过(即终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务)的情况下，才获取对应的密钥，建立中继通信连接，从而可以提高安全性。
可选地，UDM网元可以在AMF网元请求AUSF网元实例标识、或请求获取密钥的情况下，向AMF网元请求授权检查。
一些实施例中，上述统一数据管理网元向接入和移动管理功能网元发送授权请求消息，可以包括：UDM网元接收来自AMF网元的鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息的情况下，向AMF网元发送授权请求消息。
示例性地，中继AMF网元确定中继终端设备是否被授权提供中继服务码对应的中继服务，在中继终端设备被授权提供中继服务码对应的中继服务的情况下，中继AMF网元发现远端UDM网元，并向远端UDM网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息，触发远端UDM网元向AMF网元发送授权请求消息，中继AMF网元确定远端终端设备是否被授权使用授权请求消息中的中继服务码对应的中继服务。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：S807，在终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，接入和移动管理功能网元向终端设备发送非接入层响应消息。相应地，终端设备接收来自接入和移动管理功能网元的非接入层响应消息。具体实现方式可参照上述S708，此处不再赘述。
可选地，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
在一种可能的设计方法中，本申请实施例提供的授权方法，还可以包括：接入和移动管理功能网元向统一数据管理网元发送授权响应消息。相应地，统一数据管理网元接收来自接入和移动管理功能网元的授权响应消息。
可选地，授权响应(Namf_UEAuthorization response)消息可以指示终端设备是否被授权使用中继服务码。
例如，远端AMF网元向远端UDM网元发送授权响应消息，授权响应消息可以指示终端设备是否被授权使用中继服务码对应的中继服务。
可选地，对应上述S801中，UDM网元向AMF网元发送授权请求消息，AMF网元确定终端设备是否被授权使用中继服务码后，向UDM网元发送授权响应消息。
在一些实施例中，授权响应消息指示终端设备被授权使用中继服务码的情况下，UDM网元接收该授权响应消息后，由AMF网元直接向AUSF网元请求密钥，具体参照图8b。或者，授权响应消息指示终端设备被授权使用中继服务码的情况下，UDM网元接收该授权响应消息后，由UDM网元向AUSF网元请求密钥，并将密钥提供给AMF网元，具体参照图8c。
图8b为本申请实施例提供的又一种授权方法的流程示意图。图8b以AMF网元直接向AUSF网元请求密钥为例，图8b所示的方法适用于图1-图4所示的架构中，还可以应用于其他、以及未来各种形式的网络架构中，相应的名称也可以用其他网络架 构、以及未来各种形式的网络架构中的对应功能的名称进行替代。与图8a类似，图8b所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。
如图8b所示，该授权方法包括如下步骤：
S809，统一数据管理网元向接入和移动管理功能网元发送鉴权服务器功能网元标识获取响应消息。相应地，接入和移动管理功能网元接收来自统一数据管理网元的鉴权服务器功能网元标识获取响应消息。
可选地，证服务功能网元标识获取响应消息可以包括鉴权服务器功能网元实例标识，还可以包括签约永久标识。
可选地，鉴权服务器功能网元实例标识可用于标识鉴权服务器功能网元。例如，中继AMF网元可根据鉴权服务器功能网元实例标识获取远端AUSF网元。
示例性地，远端终端设备被授权使用中继服务码对应的中继服务的情况下，远端UDM网元向中继AMF网元发送证服务功能网元标识获取响应消息。
可选地，上述S809，可以包括：在授权响应消息指示终端设备被授权使用中继服务码的情况下，统一数据管理网元向接入和移动管理功能网元发送鉴权服务器功能网元标识获取响应消息。
S810，接入和移动管理功能网元向鉴权服务器功能网元发送临近业务请求消息。相应地，鉴权服务器功能网元接收来自接入和移动管理功能网元的临近业务请求消息。
示例性地，临近业务请求消息可以包括P-KID、中继服务码和随机数。或者，临近业务请求消息可以包括签约永久标识、中继服务码和随机数。
例如，中继AMF网元向远端AUSF网元发送临近业务请求消息(也可称为临近业务远端密钥请求消息)。
需要说明的是，本申请不对临近业务请求消息的名称进行限定。
可选地，AMF网元接收签约永久标识后，可以转发给AUSF网元。签约永久标识可用于AUSF网元获取对应的中间密钥Kausf或ProSe根密钥。
需要说明的是，AUSF网元可以根据签约永久标识或临近业务密钥标识获取中间密钥Kausf或ProSe根密钥。
例如，AMF网元可以将从终端设备接收的临近业务密钥标识发给AUSF网元，以使AUSF网元根据临近业务密钥标识获取中间密钥Kausf或ProSe根密钥。
S811，鉴权服务器功能网元推演密钥。
可选地，AUSF网元生成新鲜性参数，并根据中间密钥Kausf、中继服务码、新鲜性参数和随机数中的至少两项推演远端密钥KR，或者根据ProSe根密钥、中继服务码、新鲜性参数和随机数中的至少两项推演远端密钥KR。
可选地，中间密钥Kausf可以是AUSF网元根据签约永久标识或临近业务密钥标识获取的。
S812，鉴权服务器功能网元向接入和移动管理功能网元发送临近业务响应消息。相应地，接入和移动管理功能网元接收来自鉴权服务器功能网元的临近业务响应消息。
示例性地，临近业务响应消息可以包括密钥(例如远端密钥KR)和新鲜性参数。
需要说明的是，临近业务响应消息可以称为临近业务密钥响应消息，本申请不对 临近业务响应消息的名称进行限定。
基于图8b所示的方法，可以实现AMF网元直接向AUSF网元请求密钥，AUSF网元获取密钥并发给AMF网元。
图8c为本申请实施例提供的又一种授权方法的流程示意图。图8c以UDM网元向AUSF网元请求密钥并将密钥提供给AMF网元为例，图8c所示的方法适用于图1-图4所示的架构中，还可以应用于其他、以及未来各种形式的网络架构中，相应的名称也可以用其他网络架构、以及未来各种形式的网络架构中的对应功能的名称进行替代。与图8a类似，图8c所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。
如图8c所示，该授权方法包括如下步骤：
S813，统一数据管理网元向鉴权服务器功能网元发送临近业务请求消息。相应地，鉴权服务器功能网元接收来自统一数据管理网元的临近业务请求消息。
可选地，临近业务请求消息可以包括签约永久标识、中继服务码和随机数。
可选地，签约永久标识用于AUSF网元获取中间密钥Kausf或ProSe根密钥，以生成密钥，例如远端密钥KR。
示例性地，远端UDM网元向远端AUSF网元发送临近业务请求消息。
可选地，上述S813，可以包括：在授权响应消息指示终端设备被授权使用中继服务码的情况下，统一数据管理网元向鉴权服务器功能网元发送临近业务请求消息。
S814，鉴权服务器功能网元推演密钥。
关于上述S814的具体实现方式可参照上述S811，此处不再赘述。
S815，鉴权服务器功能网元向统一数据管理网元发送临近业务响应消息。相应地，统一数据管理网元接收来自鉴权服务器功能网元的临近业务响应消息。
可选地，临近业务响应消息可以包括密钥(例如远端密钥KR)、和新鲜性参数。
S816，统一数据管理网元向接入和移动管理功能网元发送密钥获取响应消息。相应地，接入和移动管理功能网元向统一数据管理网元发送密钥获取响应消息。
可选地，密钥获取响应消息可以包括密钥(例如远端密钥KR)、和新鲜性参数。
基于图8c所示的方法，可以实现由UDM网元向AUSF网元请求密钥，AUSF网元获取密钥并发给UDM网元，UDM网元将密钥提供给AMF网元。
基于图8a所示的方法，AMF网元获取终端设备的中继服务码，并根据终端设备的临近业务授权信息，确定终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而可以保证中继通信连接的建立的安全性。
示例性地，图9a为本申请实施例提供的又一种授权方法的流程示意图。图9a以在终端设备注册过程中、以及终端设备主动请求策略过程中，AMF网元获取临近业务授权信息为例进行阐述，图9a所示的方法可以与图8a-图8c所示的方法结合使用或单独使用。
需要说明的是，图9a所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。终端设备可以为远端终端设备或中继终端设备，AMF网元可以称为远端AMF网元或中继AMF网元，PCF网元可以称为远端PCF网 元或中继PCF网元。
如图9a所示，该授权方法包括如下步骤：
S901，终端设备向接入和移动管理功能网元发送注册请求消息、或策略提供请求消息。相应地，接入和移动管理功能网元接收来自终端设备的注册请求消息、或策略提供请求消息。
可选地，注册请求消息可以包括临近业务能力信息。
可选地，临近业务能力信息可用于指示终端设备支持的临近业务能力。
示例性地，临近业务能力信息可以包括如下一项或多项：5G临近业务直接发现能力(5G ProSe direct discovery)、5G临近业务直接通信能力(5G ProSe direct communication)、5G临近业务层2终端设备到网络中继(5G ProSe layer-2 UE-to-network relay)、5G临近业务层3终端设备到网络中继(5G ProSe layer-3 UE-to-network relay)、5G临近业务层2远端终端设备(5G ProSe layer-2 remote UE)、5G临近业务层3远端终端设备(5G ProSe layer-3 remote UE)。
可选地，策略提供请求消息可用于请求临近业务授权信息。
示例性地，策略提供请求消息可以包括终端设备策略容器，终端设备策略容器可以包括5G临近业务策略提供请求。
需要说明的是，终端设备注册过程对应注册请求消息，终端设备主动请求策略过程对应策略提供请求消息，当终端设备中无可用的临近业务策略信息，或终端设备中的临近业务策略信息无效时，终端设备中可以主动发起策略提供请求。
S902，接入和移动管理功能网元根据临近业务能力信息确定PCF网元。
可选地，确定的PCF网元支持提供临近业务授权信息。
示例性地，AMF网元根据临近业务能力信息选择支持分发临近业务授权信息的PCF网元。
需要说明的是，终端设备注册过程可以执行S902，终端设备主动请求策略过程不执行S902。
S903，接入和移动管理功能网元向策略控制功能网元发送策略控制创建请求消息、或策略控制更新请求消息。相应地，策略控制功能网元接收来自接入和移动管理功能网元的策略控制创建请求消息、或策略控制更新请求消息。
可选地，策略控制创建(Npcf_UEpolicyControl_Create)请求消息可以包括终端设备的签约永久标识。
可选地，策略控制创建请求消息还可以包括但不限于：服务网络名称和/或终端设备策略容器。
可选地，策略控制更新(Npcf_UEPolicyControl_Update)请求消息可以包括终端设备策略容器。
一些实施例中，终端设备策略容器是由终端设备提供的，终端设备策略容器可以包括但不限于如下一项或多项：策略段标识(policy section identifier，PSI)、操作系统标识、终端设备支持接入网发现与选择策略(access network discovery&selection policy，ANDSP)的指示、5G ProSe策略提供请求的指示。
需要说明的是，终端设备注册过程对应策略控制创建请求消息，终端设备主动请 求策略过程对应策略控制更新请求消息。
S904，策略控制功能网元向接入和移动管理功能网元发送策略控制创建响应消息、或策略控制更新响应消息。相应地，接入和移动管理功能网元接收来自策略控制功能网元的策略控制创建响应消息、或策略控制更新响应消息。
可选地，策略控制创建(Npcf_UEpolicyControl_Create)响应消息可以包括策略控制请求触发器参数。
需要说明的是，终端设备注册过程对应策略控制创建响应消息，终端设备主动请求策略过程对应策略控制更新响应消息(Npcf_UEPolicyControl_Update)。
S905，策略控制功能网元向接入和移动管理功能网元发送通信消息。相应地，接入和移动管理功能网元接收来自策略控制功能网元的通信消息。
可选地，通信消息可以包括临近业务授权信息。
可选地，通信消息还可以包括策略容器，策略容器可以包括临近业务策略信息。
示例性地，临近业务策略信息可用于执行发现流程、建立中继通信、直接通信等。
一些实施例中，PCF网元从UDR网元获取策略签约相关信息(例如临近业务授权信息)和最新的PSI列表。
可选地，终端设备注册过程中，通信消息可以称为通信N1N2消息(Namf_Communication_N1N2Message)。终端设备主动请求策略过程，通信消息可以称为通信N1N2消息转发(Namf_Communication_N1N2MessageTransfer)消息。
可选地，PCF网元可以根据终端设备被授权作为远端终端设备或中继终端设备，发送对应的临近业务授权信息。
例如，若终端设备被授权作为远端终端设备，则临近业务授权信息可以包括：中继服务码。若终端设备被授权作为中继终端设备，则临近业务授权信息可以包括：中继服务码和公共陆地移动网标识。若终端设备既被授权作为远端终端设备，又被授权作为中继终端设备，则临近业务授权信息可以包括：作为远端时对应的中继服务码、作为中继时对应的中继服务码、和公共陆地移动网标识。
可选地，通信消息还可以包括授权指示信息，关于授权指示信息的具体实现方式可参照上述S804，此处不再赘述。
S906，接入和移动管理功能网元存储临近业务授权信息。
需要说明的是，终端设备注册过程和终端设备主动请求策略过程均包括S906和下述S907-S909。
S907，接入和移动管理功能网元向终端设备发送终端设备策略容器。相应地，终端设备接收来自接入和移动管理功能网元的终端设备策略容器。
S908，终端设备向接入和移动管理功能网元发送终端设备策略容器传输结果。相应地，接入和移动管理功能网元接收来自终端设备的终端设备策略容器传输结果。
S909，接入和移动管理功能网元向策略控制功能网元发送通信N1消息通知。相应地，终端设备接收来自接入和移动管理功能网元的通信N1消息通知。
可选地，通信N1消息通知(Namf_Communication_N1messageNotify)可用于通知PCF网元，终端设备是否接收到临近业务策略信息。
上述S909可以为可选的步骤。
示例性地，图9b为本申请实施例提供的又一种授权方法的流程示意图。图9b以PCF网元检测到策略更新后主动向AMF网元发送临近业务授权信息为例进行阐述，图9b所示的方法可以与图8a-图8c所示的方法结合使用或单独使用。与图9a类似，图9b所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。
如图9b所示，该授权方法包括如下步骤：
S910，策略控制功能网元确定终端设备的临近业务策略信息发生更新。
可选地，PCF网元接收来自UDR网元的新的临近业务策略信息。
可选地，终端设备注册到网络后，PCF网元检测到该终端设备的临近业务策略信息发生更新。
S911，策略控制功能网元向接入和移动管理功能网元发送通信消息。相应地，接入和移动管理功能网元接收来自策略控制功能网元的通信消息。
可选地，通信消息可以包括终端设备的临近业务授权信息。可选地，通信消息还可以包括策略容器，策略容器可以包括临近业务策略信息。关于通信消息的具体实现方式可参照上述S905，此处不再赘述。
可选地，通信消息可以称为通信N1N2消息转发(Namf_Communication_N1N2MessageTransfer)消息。
图9b所示的方法还可以包括：S912-S915。S912-S915的实现方式可参照上述S906-S909，此处不再赘述。
示例性地，图10为本申请实施例提供的又一种授权方法的流程示意图。图10以在终端设备触发请求密钥的过程中远端PCF网元验证远端终端设备是否被授权使用中继服务码、以及在中继通信连接建立过程中继PCF网元验证中继终端设备是否被授权使用中继服务码为例对图7所示的方法进行具体阐述。图10以图7所示的方法适用于图5所示的场景进行阐述，图7所示的方法同样适用于图6所示的场景，本申请不再赘述。
需要说明的是，图10所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。远端PCF网元和中继PCF网元可以为同一个PCF网元，远端AMF网元和中继AMF网元可以为同一个AMF网元。
如图10所示，该授权方法包括如下步骤：
S1001，远端终端设备向远端AMF网元发送非接入层请求消息。相应地，远端AMF网元接收来自远端终端设备的非接入层请求消息。
可选地，非接入层请求消息可以包括中继服务码。
可选地，非接入层请求消息可以称为非接入层中继密钥请求消息。
一些实施例中，在S1001之前，本申请实施例提供的方法还可以包括：远端终端设备注册到网络。
可选地，远端终端设备可以从网络获取服务授权和临近业务策略信息。
示例性地，中继服务码可以是远端终端设备从临近业务策略信息中获得的。
S1002，远端AMF网元根据远端终端设备的临近业务签约信息，确定远端终端设备是否被授权作为远端终端设备。
关于S1002的具体实现方式可参照上述S704中终端设备为远端终端设备对应的阐述，此处不再赘述。
需要说明的是，S1002可以为可选的步骤。
S1003，远端AMF网元向远端PCF网元发送授权请求消息。相应地，远端PCF网元接收来自远端AMF网元的授权请求消息。
示例性地，授权请求消息可用于请求验证远端终端设备是否被授权使用中继服务码。
示例性地，授权请求消息包括来自远端终端设备的中继服务码。远端AMF网元服务远端终端设备。
在一些实施例中，授权请求消息还可以包括如下一项或多项：终端指示信息、远端终端设备的标识、和远端终端设备的上下文标识。
可选地，终端指示信息可用于指示终端设备为远端终端设备。
示例性地，远端终端设备的标识或远端终端设备的上下文标识可用于获取该远端终端设备的临近业务授权信息。
例如，远端终端设备的标识可以为远端终端设备的SUPI、或SUCI。
在一些实施例中，授权请求消息可指示请求验证的终端设备为中继终端设备。
一些实施例中，远端PCF网元可以根据授权请求消息确定请求验证的终端设备的类型是中继终端设备还是远端终端设备。
需要说明的是，授权请求消息的具体实现方式可参照上述S702中终端设备作为远端终端设备对应的阐述，此处不再赘述。
在一种可能的设计方法中，上述S701可以包括：在终端设备被授权作为远端终端设备的情况下，远端接入和移动管理功能网元向远端策略控制功能网元发送授权请求消息。
如此，在终端设备未被授权作为远端终端设备的情况下，远端AMF网元不向远端PCF网元发送授权请求消息，可以避免远端PCF网元确定终端设备是否被授权使用中继服务码，从而可以避免资源浪费。
S1004，远端PCF网元根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用中继服务码。
可选地，临近业务授权信息可以是远端策略控制功能网元根据远端终端设备的标识、和/或远端终端设备的上下文标识确定的。
需要说明的是，关于S1004的具体实现方式，可参照终端设备为远端终端设备、以及授权请求消息指示终端设备为远端终端设备的情况下上述S702对应的实现方式，此处不再赘述。
如此，可以验证远端终端设备是否被授权使用RSC对应的中继服务。
S1005，远端PCF网元向远端AMF网元发送授权响应消息。相应地，远端AMF网元接收来自远端PCF网元的授权响应消息。
可选地，授权响应消息可指示授权或未授权，或者，授权响应消息可指示授权成功或授权失败。
可选地，授权响应消息可指示远端终端设备是否被授权使用中继服务码。授权响 应消息的具体实现方式，可参照S703中终端设备为远端终端设备的情况下授权响应消息的实现方式，此处不再赘述。
S1006，在授权响应消息指示远端终端设备被授权使用中继服务码的情况下，远端AMF网元向远端AUSF网元发送临近业务请求消息。相应地，远端AUSF网元接收来自远端AMF网元的临近业务请求消息。
可选地，临近业务请求消息可以包括中继服务码。该中继服务码为远端AMF网元从远端终端设备获取的。
可选地，临近业务请求消息可以称为临近业务中继密钥请求消息。
如此，在对远端终端设备授权检查通过(即远端终端设备被授权使用中继服务码)后，远端AMF网元向远端AUSF网元触发P-KID推演过程，可以保证远端AUSF网元推演授权的远端终端设备对应的P-KID，不推演未授权的远端终端设备对应的P-KID，可提高安全性。
关于S1006的具体实现方式可参照上述S706，此处不再赘述。
需要说明的是，S1007-S1009的具体实现方式可参照上述S505-S507对应的实现方式，此处不再赘述。
S1010，远端AUSF网元向远端AMF网元发送临近业务响应消息。相应地，远端AMF网元接收来自远端AUSF网元的临近业务响应消息。
可选地，临近业务响应消息可以称为临近业务中继密钥响应消息，本申请对此不进行限定。
S1011，远端AMF网元向远端终端设备发送非接入层响应消息。相应地，远端终端设备接收来自远端AMF网元的非接入层响应消息。
在授权响应消息指示远端终端设备未被授权使用中继服务码的情况下，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
示例性地，在授权响应消息指示远端终端设备未被授权使用中继服务码的情况下，可以不执行上述S1006-S1010，直接执行S1011。
如此，若远端终端设备未被授权使用中继服务码，则通知该远端终端设备密钥请求失败，可以提高安全性。
在授权响应消息指示远端终端设备被授权使用中继服务码的情况下，非接入层响应消息可用于指示请求成功，例如指示密钥请求成功。
示例性地，在授权响应消息指示远端终端设备被授权使用中继服务码的情况下，可以执行上述S1006-S1011。
需要说明的是，S1012-S1014的实现方式可参照上述S510-S512，此处不再赘述。
示例性地，中继终端设备发现流程，远端终端设备生成P-KID，并向中继终端设备发送直接通信请求消息。
S1015，中继终端设备向中继AMF网元发送非接入层请求消息。相应地，中继AMF网元接收来自中继终端设备的非接入层请求消息。
可选地，非接入层请求消息可以称为NAS远端密钥请求消息。
可选地，非接入层请求消息可以包括中继服务码。
可选地，非接入层请求消息还可以包括临近业务密钥标识和随机数。
S1016，中继AMF网元根据中继终端设备的临近业务签约信息，确定中继终端设备是否被授权作为中继终端设备。
关于S1016的具体实现方式可参照上述S704中终端设备为中继终端设备对应的阐述，此处不再赘述。
需要说明的是，S1016可以为可选的步骤。
S1017，中继AMF网元向中继PCF网元发送授权请求消息。相应地，中继PCF网元接收来自中继AMF网元的授权请求消息。
示例性地，授权请求消息可用于请求验证中继终端设备是否被授权使用中继服务码。
示例性地，授权请求消息包括来自中继终端设备的中继服务码。中继AMF网元服务中继终端设备。
在一些实施例中，授权请求消息还可以包括如下一项或多项：终端指示信息、中继终端设备的标识、中继终端设备的上下文标识、和公共陆地移动网标识。
可选地，终端指示信息可用于指示终端设备为中继终端设备。
示例性地，中继终端设备的标识或中继终端设备的上下文标识可用于获取该中继终端设备的临近业务授权信息。
例如，中继终端设备的标识可以为中继终端设备的SUPI、或SUCI。
可选地，公共陆地移动网标识可以是中继接入和移动管理功能网元根据中继接入和移动管理功能网元服务的网络获得的。
在一些实施例中，授权请求消息可指示请求验证的终端设备为中继终端设备。
一些实施例中，中继PCF网元可以根据授权请求消息确定请求验证的终端设备的类型是中继终端设备还是远端终端设备。
需要说明的是，授权请求消息的具体实现方式可参照上述S702中终端设备作为中继终端设备对应的阐述，此处不再赘述。
在一种可能的设计方法中，上述S701可以包括：在中继终端设备被授权作为中继终端设备的情况下，中继接入和移动管理功能网元向中继策略控制功能网元发送授权请求消息。
如此，在中继终端设备未被授权作为中继终端设备的情况下，中继AMF网元不向中继PCF网元发送授权请求消息，可以避免中继PCF网元确定中继终端设备是否被授权使用中继服务码，从而可以避免资源浪费。
S1018，中继PCF网元根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用中继服务码。
可选地，临近业务授权信息可以是中继策略控制功能网元根据中继终端设备的标识、和/或中继终端设备的上下文标识确定的。
在一种可能的设计方法中，授权请求消息还包括公共陆地移动网标识，上述S1018可以包括：中继策略控制功能网元根据临近业务授权信息，确定中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。具体实现方式可参照上述S702中对应地阐述，此处不再赘述。
可选地，授权请求消息指示终端设备为中继终端设备，中继PCF网元可以根据临 近业务授权信息，确定中继终端设备是否被授权在PLMN ID对应的PLMN中提供中继服务码对应的连接服务。
在一种可能的设计方法中，上述中继策略控制功能网元根据临近业务授权信息，确定中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，可以包括：中继策略控制功能网元确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务；若临近业务授权信息不包括中继服务码，则中继终端设备未被授权使用中继服务码；若临近业务授权信息不包括公共陆地移动网标识，则中继终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。具体实现方式可参照上述S702中对应地阐述，此处不再赘述。
一些实施例中，中继策略控制功能网元可以根据临近业务授权信息是否包括中继服务码和公共陆地移动网标识，确定中继终端设备是否被授权在PLMN ID对应的PLMN中提供RSC对应的连接服务。具体实现方式可参照上述S702中对应地阐述，此处不再赘述。
如此，可以验证中继终端设备是否被授权在PLMN ID对应的PLMN中服务远端，以及是否被授权提供RSC对应的中继服务。
需要说明的是，关于S1018的具体实现方式，可参照终端设备为中继终端设备、以及授权请求消息指示终端设备为中继终端设备的情况下上述S702对应的实现方式，此处不再详细赘述。
S1019，中继PCF网元向中继AMF网元发送授权响应消息。相应地，中继AMF网元接收来自中继PCF网元的授权响应消息。
可选地，授权响应消息可指示授权或未授权，或者，授权响应消息可指示授权成功或授权失败。
可选地，授权响应消息可指示中继终端设备是否被授权使用中继服务码。
可选地，授权响应消息指示中继终端设备是否被授权使用中继服务码，具体可以为：指示中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
授权响应消息的具体实现方式，可参照S703中终端设备为中继终端设备的情况下授权响应消息的实现方式，此处不再赘述。
S1020，在授权响应消息指示中继终端设备授权成功的情况下，中继接入和移动管理功能网元向远端统一数据管理网元发送鉴权服务器功能网元标识获取请求消息。相应地，远端统一数据管理网元接收来自中继接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息。
可选地，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识。
示例性地，中继终端设备授权成功可以指中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，在对中继终端设备授权检查通过后，中继AMF网元可以向远端AUSF网元请求密钥，如此可以保证被授权的中继终端设备获取对应的密钥，并建立PC5连 接，未被授权的中继终端设备不能获取对应的密钥，可以提高安全性。
S1021，远端UDM网元向中继AMF网元发送鉴权服务器功能网元标识获取响应消息。相应地，中继AMF网元接收来自远端UDM网元的鉴权服务器功能网元标识获取响应消息。
示例性地，鉴权服务器功能网元标识获取响应消息可以包括服务远端终端设备的AUSF的AUSF实例ID。
S1022，中继AMF网元向远端AUSF网元发送临近业务请求消息。相应地，远端AUSF网元接收来自中继AMF网元的临近业务请求消息。
可选地，临近业务请求消息可以包括中继服务码。该中继服务码为远端AMF网元从远端终端设备获取的。
可选地，临近业务请求消息可以称为临近业务远端密钥请求消息。
可选地，临近业务请求消息还可以包括P-KID和/或随机数。
如此，在对中继终端设备授权检查通过后，中继AMF网元向远端AUSF网元触发远端密钥推演过程，可提高安全性。
S1023，远端AUSF网元推演远端密钥。
关于S1023的具体实现方式可参照上述S517，此处不再赘述。
S1024，远端AUSF网元向中继AMF网元发送临近业务响应消息。相应地，中继AMF网元接收来自远端AUSF网元的临近业务响应消息。
示例性地，临近业务响应消息可以包括密钥(例如远端密钥KR)和新鲜性参数。
需要说明的是，临近业务响应消息可以称为临近业务远端密钥响应消息，本申请不对临近业务响应消息的名称进行限定。
S1025，中继AMF网元向中继终端设备发送非接入层响应消息。相应地，中继终端设备接收来自中继AMF网元的非接入层响应消息。
在授权响应消息指示中继终端设备授权失败的情况下，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
示例性地，中继终端设备授权失败可以指中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
示例性地，在授权响应消息指示中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，可以不执行上述S1020-S1024，直接执行S1025。
如此，若中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，则通知该中继终端设备密钥请求失败，可以提高安全性。
在授权响应消息指示中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，非接入层响应消息可用于指示请求成功，例如指示密钥请求成功。
示例性地，在授权响应消息指示中继终端设备被授权使用中继服务码的情况下，可以执行上述S1020-S1024。
可选地，非接入层响应消息可以包括远端密钥和新鲜性参数。
需要说明的是，S1026-S1027的具体实现方式可参照上述S520-S521，此处不再赘述。
基于图10所示的方法，远端PCF网元通过与远端AMF网元交互获得来自远端终端设备的中继服务码，根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用该中继服务码。中继PCF网元通过与中继AMF网元交互获得来自中继终端设备的中继服务码，根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而保证中继通信连接的建立的安全性。
示例性地，图11为本申请实施例提供的又一种授权方法的流程示意图。图11以在终端设备触发请求密钥的过程中远端AMF网元验证远端终端设备是否被授权使用中继服务码、以及在中继通信连接建立过程中继AMF网元验证中继终端设备是否被授权使用中继服务码为例对图8a所示的方法进行具体阐述。图11以图8a所示的方法适用于图5所示的场景进行阐述，图8a所示的方法同样适用于图6所示的场景，本申请不再赘述。
需要说明的是，图11所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。远端PCF网元和中继PCF网元可以为同一个PCF网元，远端AMF网元和中继AMF网元可以为同一个AMF网元。
如图11所示，该授权方法包括如下步骤：
S1101-S1102的具体实现方式可参照上述S1001-S1002，此处不再赘述。
S1103，远端策略控制功能网元向远端接入和移动管理功能网元发送通信消息。相应地，远端接入和移动管理功能网元接收来自远端策略控制功能网元的通信消息。
可选地，通信消息可以包括临近业务授权信息。
可选地，远端接入和移动管理功能网元可以存储临近业务授权信息。
可选地，通信消息还可以包括授权指示信息，授权指示信息可指示临近业务授权信息为终端设备作为远端终端设备对应的临近业务授权信息。
示例性地，临近业务授权信息可以是在远端终端设备注册过程中、或远端终端设备主动请求策略过程中远端PCF网元发给远端AMF网元的，或者是远端PCF网元检测到策略更新后主动下发给远端AMF网元的，或者是远端AMF网元主动请求的。具体实现方式可参照上述S804、以及图9a、以及图9b所示的阐述，此处不再赘述。
需要说明的是，本申请不限定S1103的执行顺序，S1103可以在S1104之前的任意时刻执行。
S1104，远端AMF网元根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用中继服务码。
可选地，临近业务授权信息可以是远端接入和移动管理功能网元从远端策略控制功能网元获取的。
需要说明的是，关于S1104的具体实现方式，可参照终端设备为远端终端设备、以及授权请求消息指示终端设备为远端终端设备的情况下上述S802对应的实现方式，此处不再赘述。
如此，可以验证远端终端设备是否被授权使用RSC对应的中继服务。
S1105，在远端终端设备被授权使用中继服务码的情况下，远端AMF网元向远端AUSF网元发送临近业务请求消息。相应地，远端AUSF网元接收来自远端AMF网元的临近业务请求消息。
可选地，临近业务请求消息可以包括中继服务码。该中继服务码为远端AMF网元从远端终端设备获取的。
可选地，临近业务请求消息可以称为临近业务中继密钥请求消息。
如此，在对远端终端设备授权检查通过(即远端终端设备被授权使用中继服务码)后，远端AMF网元向远端AUSF网元触发P-KID推演过程，可以保证远端AUSF网元推演授权的远端终端设备对应的P-KID，不推演未授权的远端终端设备对应的P-KID，可提高安全性。
关于S1105的具体实现方式可参照上述S805，此处不再赘述。
需要说明的是，S1106-S1108的具体实现方式可参照上述S505-S507对应的实现方式，此处不再赘述。
S1109，远端AUSF网元向远端AMF网元发送临近业务响应消息。相应地，远端AMF网元接收来自远端AUSF网元的临近业务响应消息。
可选地，临近业务响应消息可以称为临近业务中继密钥响应消息，本申请对此不进行限定。
S1110，远端AMF网元向远端终端设备发送非接入层响应消息。相应地，远端终端设备接收来自远端AMF网元的非接入层响应消息。
在远端终端设备未被授权使用中继服务码的情况下，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
示例性地，在远端终端设备未被授权使用中继服务码的情况下，可以不执行上述S1105-S1109，直接执行S1110。
如此，若远端终端设备未被授权使用中继服务码，则通知该远端终端设备密钥请求失败，可以提高安全性。
在远端终端设备被授权使用中继服务码的情况下，非接入层响应消息可用于指示请求成功，例如指示密钥请求成功。
示例性地，在远端终端设备被授权使用中继服务码的情况下，可以执行上述S1105-S1109。
需要说明的是，S1111-S1113的实现方式可参照上述S510-S512，此处不再赘述。
示例性地，中继终端设备发现流程，远端终端设备生成P-KID，并向中继终端设备发送直接通信请求消息。
S1114，中继终端设备向中继AMF网元发送非接入层请求消息。相应地，中继AMF网元接收来自中继终端设备的非接入层请求消息。
关于S1114的具体实现方式可参照上述S1015，此处不再赘述。
S1115，中继AMF网元根据中继终端设备的临近业务签约信息，确定中继终端设备是否被授权作为中继终端设备。
关于S1115的具体实现方式可参照上述S704中终端设备为中继终端设备对应的阐 述，此处不再赘述。
需要说明的是，S1115可以为可选的步骤。
S1116，中继策略控制功能网元向中继接入和移动管理功能网元发送通信消息。相应地，中继接入和移动管理功能网元接收来自中继策略控制功能网元的通信消息。
可选地，通信消息可以包括临近业务授权信息。
可选地，中继接入和移动管理功能网元可以存储临近业务授权信息。
可选地，通信消息还可以包括授权指示信息，授权指示信息可指示临近业务授权信息为终端设备作为中继终端设备对应的临近业务授权信息。
示例性地，临近业务授权信息可以是在中继终端设备注册过程中、或中继终端设备主动请求策略过程中中继PCF网元发给中继AMF网元的，或者是中继PCF网元检测到策略更新后主动下发给中继AMF网元的，或者是中继AMF网元主动请求的。具体实现方式可参照上述S804、以及图9a、以及图9b所示的阐述，此处不再赘述。
需要说明的是，本申请不限定S1116的执行顺序，例如，S1116可以在S1117之前的任意时刻执行。
S1117，中继AMF网元根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用中继服务码。
可选地，临近业务授权信息可以是中继接入和移动管理功能网元从中继策略控制功能网元获取的。
在一种可能的设计方法中，终端设备为中继终端设备，上述S1117，可以包括：中继AMF网元根据临近业务授权信息，确定中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。具体实现方式可参照上述S802对应的实现方式，此处不再赘述。
在一种可能的设计方法中，上述中继AMF网元根据临近业务授权信息，确定中继终端设备是否被授权使用中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，可以包括：中继接入和移动管理功能网元确定临近业务授权信息是否包括中继服务码和公共陆地移动网标识。若是，则中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务；若临近业务授权信息不包括中继服务码，则中继终端设备未被授权使用中继服务码；若临近业务授权信息不包括公共陆地移动网标识，则中继终端设备未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。具体实现方式可参照上述S802对应的实现方式，此处不再赘述。
需要说明的是，关于S1117的具体实现方式，可参照终端设备为中继终端设备、以及授权请求消息指示终端设备为中继终端设备的情况下上述S802对应的实现方式，此处不再赘述。
一些实施例中，中继接入和移动管理功能网元可以根据临近业务授权信息是否包括中继服务码和公共陆地移动网标识，确定中继终端设备是否被授权在PLMN ID对应的PLMN中提供RSC对应的连接服务。具体实现方式可参照上述S802中对应地阐述，此处不再赘述。
如此，中继AMF网元可以验证中继终端设备是否被授权在PLMN ID对应的PLMN 中服务远端，以及是否被授权提供RSC对应的中继服务。
S1118，在中继终端设备授权成功的情况下，中继接入和移动管理功能网元向远端统一数据管理网元发送鉴权服务器功能网元标识获取请求消息。相应地，远端统一数据管理网元接收来自中继接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息。
可选地，关于鉴权服务器功能网元标识获取请求消息的具体实现方式可参照上述S806，此处不再赘述。
示例性地，中继终端设备授权成功可以指中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，在对中继终端设备授权检查通过后，中继AMF网元可以向远端AUSF网元请求密钥，如此可以保证被授权的中继终端设备获取对应的密钥，并建立PC5连接，未被授权的中继终端设备不能获取对应的密钥，可以提高安全性。
S1119-S1122的实现方式可分别参照上述S1021-S1024对应的阐述，此处不再赘述。
S1123，中继AMF网元向中继终端设备发送非接入层响应消息。相应地，中继终端设备接收来自中继AMF网元的非接入层响应消息。
在中继终端设备授权失败的情况下，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
示例性地，中继终端设备授权失败可以指中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
示例性地，在中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，可以不执行上述S1118-S1122，直接执行S1123。
如此，若中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，则通知该中继终端设备密钥请求失败，可以提高安全性。
在中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，非接入层响应消息可用于指示请求成功，例如指示密钥请求成功。
示例性地，在授权响应消息指示中继终端设备被授权使用中继服务码的情况下，可以执行上述S1118-S1122。
可选地，非接入层响应消息可以包括远端密钥和新鲜性参数。
需要说明的是，S1124-S1125的具体实现方式可参照上述S520-S521，此处不再赘述。
基于图11所示的方法，远端AMF网元根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用该中继服务码。中继AMF网元根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权使用中继服务码标识的中继服务，从而保证中继通信连接的建立的安全性。
示例性地，图12为本申请实施例提供的又一种授权方法的流程示意图。图12以在中继通信连接建立过程中远端AMF网元验证远端终端设备是否被授权使用中继服务码、中继AMF网元验证中继终端设备是否被授权使用中继服务码为例对图8a所示的方法进行具体阐述。
需要说明的是，图12所示的方法适用于服务远端终端设备的网元与服务中继终端设备的网元相同、或不相同的场景。远端PCF网元和中继PCF网元可以为同一个PCF网元，远端AMF网元和中继AMF网元可以为同一个AMF网元。
如图12所示，该授权方法包括如下步骤：
S1201-S1203的具体实现方式可分别参照上述S510-S512，此处不再赘述。
示例性地，中继终端设备发现流程，远端终端设备生成P-KID，并向中继终端设备发送直接通信请求消息。
S1204-S1205的具体实现方式可分别参照上述S1114-S1115，此处不再赘述。
需要说明的是，S1205可以为可选的步骤。
S1206，中继接入和移动管理功能网元获取中继终端设备的临近业务授权信息。
示例性地，临近业务授权信息可以是在中继终端设备注册过程中、或中继终端设备主动请求策略过程中中继PCF网元发给中继AMF网元的，或者是中继PCF网元检测到策略更新后主动下发给中继AMF网元的，或者是中继AMF网元主动请求的。具体实现方式可参照上述S804、以及图9a、以及图9b所示的阐述，此处不再赘述。
需要说明的是，本申请不限定S1206的执行顺序，例如，S1206可以在S1207之前的任意时刻执行。
S1207，中继AMF网元根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用中继服务码。
关于S1207的具体实现方式可参照上述S1117，此处不再赘述。
S1208，在中继终端设备授权成功的情况下，中继接入和移动管理功能网元向远端统一数据管理网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。相应地，远端统一数据管理网元接收来自中继接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息。
示例性地，中继终端设备授权成功可以指中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
可选地，鉴权服务器功能网元标识获取请求消息可以包括临近业务密钥标识、或签约隐藏标识。或者，鉴权服务器功能网元标识获取请求消息可以包括签约隐藏标识和中继服务码。
可选地，密钥获取请求消息可以包括临近业务密钥标识和中继服务码。或者，密钥获取请求消息可以包括签约隐藏标识和中继服务码。
示例性地，中继AMF网元可以向远端UDM网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息(也可称为中继密钥获取请求消息)。
如此，在终端设备授权检查通过(即终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务)的情况下，才获取对应的密钥，建立中继通信连接，从而可以提高安全性。S1209，远端统一数据管理网元根据远 端终端设备的临近业务签约信息，确定远端终端设备是否被授权作为远端终端设备。
可选地，UDM网元可以根据临近业务密钥标识或签约永久标识获取临近业务签约信息。
需要说明的是，S1209可以为可选的步骤。
S1210，远端统一数据管理网元向远端接入和移动管理功能网元发送授权请求消息。相应地，远端接入和移动管理功能网元接收来自远端统一数据管理网元的授权请求消息。
可选地，授权请求消息用于请求验证远端终端设备是否被授权使用中继服务码。可选地，授权请求消息可以包括远端终端设备的签约永久标识和中继服务码。
例如，签约永久标识可用于远端接入和移动管理功能网元获取远端终端设备的临近业务授权信息。
可选地，签约永久标识可以是远端统一数据管理网元根据临近业务密钥标识、或签约隐藏标识确定的。
需要说明的是，关于S1210的具体实现方式可参照上述S801中统一数据管理网元向接入和移动管理功能网元发送授权请求消息的实现方式，可将统一数据管理网元替换为远端统一数据管理网元，将接入和移动管理功能网元替换为远端接入和移动管理功能网元，此处不再赘述。
S1211，远端接入和移动管理功能网元获取远端终端设备的临近业务授权信息。
示例性地，临近业务授权信息可以是在远端终端设备注册过程中、或远端终端设备主动请求策略过程中远端PCF网元发给远端AMF网元的，或者是远端PCF网元检测到策略更新后主动下发给远端AMF网元的，或者是远端AMF网元主动请求的。具体实现方式可参照上述S804、以及图9a、以及图9b所示的阐述，此处不再赘述。
需要说明的是，本申请不限定S1211的执行顺序，例如，满足S1211在S1212之前执行即可。
S1212，远端AMF网元根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用中继服务码。
需要说明的是，关于S1212的具体实现方式可参照上述S1104对应的阐述，此处不再赘述。
如此，可以验证远端终端设备是否被授权使用RSC对应的中继服务。
S1213，远端AMF网元向远端UDM网元发送授权响应消息。相应地，远端UDM网元接收来自远端AMF网元的授权响应消息。
可选地，授权响应消息可以指示远端终端设备是否被授权使用中继服务码对应的中继服务。
在一些实施例中，授权响应消息指示远端终端设备被授权使用中继服务码的情况下，远端UDM网元接收该授权响应消息后，由远端AMF网元直接向远端AUSF网元请求密钥，本申请实施例提供的授权方法可以包括：S1214-S1217，具体实现方式可参照上述图8b，此处不再赘述。
或者，授权响应消息指示远端终端设备被授权使用中继服务码的情况下，远端UDM网元接收该授权响应消息后，由远端UDM网元向远端AUSF网元请求密钥，并 将密钥提供给远端AMF网元，本申请实施例提供的授权方法可以包括：S1218-S1221，具体实现方式可参照上述图8c，此处不再赘述。
可选地，若S1208中，中继接入和移动管理功能网元向远端统一数据管理网元发送鉴权服务器功能网元标识获取请求消息，则可由远端AMF网元直接向远端AUSF网元请求密钥，本申请实施例提供的授权方法可以包括：S1214-S1217。
若S1208中的鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识，对应的，S1215中的临近业务请求消息包括临近业务密钥标识。若S1208中的鉴权服务器功能网元标识获取请求消息包括签约隐藏标识，对应的，S1215中的临近业务请求消息包括签约永久标识。
可选地，若S1208中，中继接入和移动管理功能网元向远端统一数据管理网元发送密钥获取请求消息，则可由远端UDM网元向远端AUSF网元请求密钥，并将密钥提供给远端AMF网元，本申请实施例提供的授权方法可以包括：S1218-S1221。
若S1208中的密钥获取请求消息包括临近业务密钥标识，对应的，S1218中的临近业务请求消息包括临近业务密钥标识。若S1208中的密钥获取请求消息包括签约隐藏标识，对应的，S1218中的临近业务请求消息包括签约永久标识。
S1222，中继AMF网元向中继终端设备发送非接入层响应消息。相应地，中继终端设备接收来自中继AMF网元的非接入层响应消息。
在中继终端设备授权失败的情况下，非接入层响应消息可用于指示请求失败，例如指示密钥请求失败。
示例性地，中继终端设备授权失败可以指中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务。
示例性地，在中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，可以不执行上述S1208-S1221，直接执行S1222。
如此，若中继终端设备未被授权使用中继服务码和/或未被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，则通知该中继终端设备密钥请求失败，可以提高安全性。
在中继终端设备被授权使用中继服务码和被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，非接入层响应消息可用于指示请求成功，例如指示密钥请求成功。
示例性地，在授权响应消息指示中继终端设备被授权使用中继服务码的情况下，可以执行上述S1208-S1221。
可选地，非接入层响应消息可以包括远端密钥和新鲜性参数。
需要说明的是，S1223-S1224的具体实现方式可参照上述S520-S521，此处不再赘述。
基于图12所示的方法，远端AMF网元根据远端终端设备的临近业务授权信息，确定远端终端设备是否被授权使用该中继服务码。中继AMF网元根据中继终端设备的临近业务授权信息，确定中继终端设备是否被授权使用该中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。如此，可以验证终端设备是否被授权 使用中继服务码标识的中继服务，从而保证中继通信连接的建立的安全性。
本申请中，除特殊说明外，各个实施例之间相同或相似的部分可以互相参考。在本申请中各个实施例、以及各实施例中的各个实施方式/实施方法/实现方法中，如果没有特殊说明以及逻辑冲突，不同的实施例之间、以及各实施例中的各个实施方式/实施方法/实现方法之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例、以及各实施例中的各个实施方式/实施方法/实现方法中的技术特征根据其内在的逻辑关系可以组合形成新的实施例、实施方式、实施方法、或实现方法。以下所述的本申请实施方式并不构成对本申请保护范围的限定。
以上结合图1-图12详细说明了本申请实施例提供的授权方法。以下结合图13-图15详细说明本申请实施例提供的通信装置。
图13为可用于执行本申请实施例提供的授权方法的一种通信装置的结构示意图。通信装置1300可以是接入和移动管理功能网元、策略控制功能网元、统一数据管理网元，也可以是应用接入和移动管理功能网元、策略控制功能网元、统一数据管理网元中的芯片或者其他具有相应功能的部件。如图13所示，通信装置1300可以包括处理器1301。可选地，通信装置1300还可以包括存储器1302和收发器1303中的一个或多个。其中，处理器1301可以与存储器1302和收发器1303中的一个或多个耦合，如可以通过通信总线连接，处理器1301也可以单独使用。
下面结合图13对通信装置1300的各个构成部件进行具体的介绍：
处理器1301是通信装置1300的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器1301是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
其中，处理器1301可以通过运行或执行存储在存储器1302内的软件程序，以及调用存储在存储器1302内的数据，执行通信装置1300的各种功能。
在具体的实现中，作为一种实施例，处理器1301可以包括一个或多个CPU，例如图13中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置1300也可以包括多个处理器，例如图13中所示的处理器1301和处理器1304。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个通信设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
可选地，存储器1302可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储通信设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储通信设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储通信设备、或者能够用于携带或存储具有指令或数据结构形式的 期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1302可以和处理器1301集成在一起，也可以独立存在，并通过通信装置1300的输入/输出端口(图13中未示出)与处理器1301耦合，本申请实施例对此不作具体限定。
示例性地，输入端口可用于实现上述任一方法实施例中由接入和移动管理功能网元、策略控制功能网元、统一数据管理网元执行的接收功能，输出端口可用于实现上述任一方法实施例中由接入和移动管理功能网元、策略控制功能网元、统一数据管理网元执行的发送功能。
其中，所述存储器1302可用于存储执行本申请方案的软件程序，并由处理器1301来控制执行。上述具体实现方式可以参考下述方法实施例，此处不再赘述。
可选地，收发器1303，用于与其他通信装置之间的通信。此外，收发器1303可以包括接收器和发送器(图13中未单独示出)。其中，接收器用于实现接收功能，发送器用于实现发送功能。收发器1303可以和处理器1301集成在一起，也可以独立存在，并通过通信装置1300的输入/输出端口(图13中未示出)与处理器1301耦合，本申请实施例对此不作具体限定。
需要说明的是，图13中示出的通信装置1300的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
其中，上述图5-图12中策略控制功能网元的动作可以由图13所示的通信装置1300中的处理器1301调用存储器1302中存储的应用程序代码以指令策略控制功能网元执行。
上述图5-图12中接入和移动管理功能网元的动作可以由图13所示的通信装置1300中的处理器1301调用存储器1302中存储的应用程序代码以指令接入和移动管理功能网元执行。
上述图5-图12中统一数据管理网元的动作可以由图13所示的通信装置1300中的处理器1301调用存储器1302中存储的应用程序代码以指令统一数据管理网元执行。
当通信装置为策略控制功能网元时，通信装置1300可执行上述方法实施例中的策略控制功能网元所涉及的任一种或多种可能的设计方式；当通信装置为接入和移动管理功能网元时，通信装置1300可执行上述方法实施例中的接入和移动管理功能网元所涉及的任一种或多种可能的设计方式；当通信装置为统一数据管理网元时，通信装置1300可执行上述方法实施例中的统一数据管理网元所涉及的任一种或多种可能的设计方式。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图14为本申请实施例提供的另一种通信装置的结构示意图。为了便于说明，图14仅示出了该通信装置的主要部件。
该通信装置1400包括收发模块1401和处理模块1402。该通信装置1400可以是前述方法实施例中的策略控制功能网元、或接入和移动管理功能网元。收发模块1401，也可以称为收发单元，用以实现上述任一方法实施例中由策略控制功能网元、或接入和移动管理功能网元执行的收发功能。
需要说明的是，收发模块1401可以包括接收模块和发送模块(图14中未示出)。其中，接收模块用于接收来自其他设备的数据和/或信令；发送模块用于向其他设备发送数据和/或信令。本申请对于收发模块的具体实现方式，不做具体限定。该收发模块可以由收发电路、收发机、收发器或者通信接口构成。
处理模块1402，可以用于实现上述任一方法实施例中由策略控制功能网元、或接入和移动管理功能网元执行的处理功能。该处理模块1402可以为处理器。
在本实施例中，该通信装置1400以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置1400可以采用图13所示的通信装置1300的形式。
比如，图13所示的通信装置1300中的处理器1301可以通过调用存储器1302中存储的计算机执行指令，使得上述方法实施例中的授权方法被执行。
具体的，图14中的收发模块1401和处理模块1402的功能/实现过程可以通过图13所示的通信装置1300中的处理器1301调用存储器1302中存储的计算机执行指令来实现。或者，图14中的处理模块1402的功能/实现过程可以通过图13所示的通信装置1300中的处理器1301调用存储器1302中存储的计算机执行指令来实现，图14中的收发模块1401的功能/实现过程可以通过图13中所示的通信装置1300中的收发器1303来实现。
由于本实施例提供的通信装置1400可执行上述授权方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
图15为本申请实施例提供的又一种通信装置的结构示意图。为了便于说明，图15仅示出了该通信装置的主要部件。
该通信装置1500包括发送模块1501和接收模块1502。该通信装置1500可以是前述方法实施例中的接入和移动管理功能网元、策略控制功能网元、或统一数据管理网元。发送模块1501，也可以称为发送单元，用以实现上述任一方法实施例中由接入和移动管理功能网元、策略控制功能网元、或统一数据管理网元执行的发送功能。
需要说明的是，接收模块1502和发送模块1501可以分开设置，也可以集成在一个模块中，即收发模块。本申请对于接收模块1502和发送模块1501的具体实现方式，不做具体限定。该收发模块可以由收发电路，收发机，收发器或者通信接口构成。
可选地，该通信装置1500还可以包括处理模块1503。处理模块1503，可以用于实现上述任一方法实施例中由接入和移动管理功能网元、策略控制功能网元、或统一数据管理网元执行的处理功能。该处理模块1503可以为处理器。在本实施例中，该通信装置1500以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置1500可以采用图13所示的通信装置1300的形式。
比如，图13所示的通信装置1300中的处理器1301可以通过调用存储器1302中存储的计算机执行指令，使得上述方法实施例中的授权方法被执行。
具体的，图15中的接收模块1502、发送模块1501、和处理模块1503的功能/实现过程可以通过图13所示的通信装置1300中的处理器1301调用存储器1302中存储的计算机执行指令来实现。或者，图15中的处理模块1503的功能/实现过程可以通过图13所示的通信装置1300中的处理器1301调用存储器1302中存储的计算机执行指令来实现，图15中的接收模块1502、发送模块1501的功能/实现过程可以通过图13中所示的通信装置1300中的收发器1303来实现。由于本实施例提供的通信装置1500可执行上述授权方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
在一种可能的设计方案中，图14所示出的通信装置1400可适用于图1所示出的通信系统中，执行图7、图10所示的授权方法中的策略控制功能网元的功能。
其中，收发模块1401，用于接收来自接入和移动管理功能网元的授权请求消息。其中，授权请求消息包括来自终端设备的中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
处理模块1402，用于根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息指示终端设备被授权的中继服务。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1400还可以包括存储模块(图14中未示出)，该存储模块存储有程序或指令。当处理模块1402执行该程序或指令时，使得通信装置1400可以执行图7、图10所示的授权方法中的策略控制功能网元的功能。
需要说明的是，通信装置1400可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1400的技术效果可以参考图7、图10所示的授权方法的技术效果，此处不再赘述。
在一种可能的设计方案中，图15所示出的通信装置1500可适用于图1所示出的通信系统中，执行图7、图10所示的授权方法中的接入和移动管理功能网元的功能。
其中，接收模块1502，用于接收来自终端设备的非接入层请求消息。其中，非接入层请求消息包括中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
发送模块1501，用于响应于非接入层请求消息，向策略控制功能网元发送授权请求消息。其中，授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。
接收模块1502，还用于接收来自策略控制功能网元的授权响应消息。其中，授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，处理模块1503，用于根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备或中继终端设备。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块1503执行该程序或指令时，使得通信装置1500可以执行图7、图10所示的授权方法中接入和移动管理功能网元的功能。
需要说明的是，通信装置1500可以是接入和移动管理功能网元，也可以是可设置于接入和移动管理功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图7、图10所示的授权方法的技术效果，此处不再赘述。
在又一种可能的设计方案中，图14所示出的通信装置1400可适用于图1所示出的通信系统中，执行图8a-图9b、图11-图12所示的授权方法中的接入和移动管理功能网元的功能。
其中，收发模块1401，用于获取终端设备的中继服务码。其中，中继服务码用于标识中继设备为远端设备提供的连接服务。
处理模块1402，用于根据终端设备的临近业务授权信息，确定终端设备是否被授权使用中继服务码。其中，临近业务授权信息指示终端设备被授权的中继服务。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1400还可以包括存储模块(图14中未示出)，该存储模块存储有程序或指令。当处理模块1402执行该程序或指令时，使得通信装置1400可以执行图8a-图9b、图11-图12所示的授权方法中的接入和移动管理功能网元的功能。
需要说明的是，通信装置1400可以是接入和移动管理功能网元，也可以是可设置于接入和移动管理功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1400的技术效果可以参考图8a-图9b、图11-图12所示的授权方法的技术效果，此处不再赘述。
在又一种可能的设计方案中，图15所示出的通信装置1500可适用于图1所示出的通信系统中，执行图8a-图9b、图11-图12所示的授权方法中的统一数据管理网元的功能。
其中，接收模块1502，用于接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息。其中，鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识和中继服务码，或者鉴权服务器功能网元标识获取请求消息包括签约隐藏标识和中继服务码，中继服务码用于标识中继设备为远端设备提供的连接服务。
发送模块1501，用于向根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息。其中，授权请求消息包括中继服务码，授权请求消息用于请求验证终端设备是否被授权使用中继服务码。
接收模块1502，还用于接收来自根据临近业务密钥标识或签约隐藏标识确定的接入和移动管理功能网元的授权响应消息。其中，授权响应消息指示终端设备是否被授权使用中继服务码。
在一种可能的设计方式中，处理模块1503，用于根据终端设备的临近业务签约信息，确定终端设备是否被授权作为远端终端设备。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功 能模块的功能描述，在此不再赘述。
可选的，通信装置1500还可以包括存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块1503执行该程序或指令时，使得通信装置1500可以执行图8a-图9b、图11-图12所示的授权方法中统一数据管理网元的功能。
需要说明的是，通信装置1500可以是统一数据管理网元，也可以是可设置于统一数据管理网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8a-图9b、图11-图12所示的授权方法的技术效果，此处不再赘述。
在一种可能的设计方案中，图15所示出的通信装置1500可适用于图1所示出的通信系统中，执行图8a-图9b、图11-图12所示的授权方法中的策略控制功能网元的功能。
其中，接收模块1502，用于接收来自接入和移动管理功能网元的策略控制创建请求消息、或策略控制更新请求消息。其中，策略控制创建请求消息包括终端设备的签约永久标识和终端设备的策略容器，策略控制更新请求消息包括终端设备的策略容器，终端设备的策略容器包括如下一项或多项：策略段标识、操作系统标识、终端设备支持接入网发现与选择策略的指示、和临近业务策略提供请求的指示。
发送模块1501，用于向接入和移动管理功能网元发送策略控制创建响应消息、或策略控制更新响应消息。其中，策略控制创建响应消息包括策略控制请求触发器参数。
发送模块1501，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息和终端设备的策略容器，临近业务授权信息指示终端设备被授权的中继服务。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1500还可以包括处理模块1503和存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块1503执行该程序或指令时，使得通信装置1500可以执行图8a-图9b、图11-图12所示的授权方法中策略控制功能网元的功能。
需要说明的是，通信装置1500可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8a-图9b、图11-图12所示的授权方法的技术效果，此处不再赘述。
在又一种可能的设计方案中，图14所示出的通信装置1400可适用于图1所示出的通信系统中，执行图8a-图9b、图11-图12所示的授权方法中的策略控制功能网元的功能。
其中，处理模块1402，用于确定终端设备的临近业务策略信息发生更新。
收发模块1401，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息和策略容器，临近业务授权信息指示终端设备被授权的中继服务，策略容器可以包括临近业务策略信息，临近业务策略信息用于终端设备获取临近业务通信服务。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功 能模块的功能描述，在此不再赘述。
可选的，通信装置1400还可以包括存储模块(图14中未示出)，该存储模块存储有程序或指令。当处理模块1402执行该程序或指令时，使得通信装置1400可以执行图8a-图9b、图11-图12所示的授权方法中的策略控制功能网元的功能。
需要说明的是，通信装置1400可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1400的技术效果可以参考图8a-图9b、图11-图12所示的授权方法的技术效果，此处不再赘述。
在一种可能的设计方案中，图15所示出的通信装置1500可适用于图1所示出的通信系统中，执行图8a-图9b、图11-图12所示的授权方法中的策略控制功能网元的功能。
其中，接收模块1502，用于接收来自接入和移动管理功能网元的授权信息请求消息。其中，授权信息请求消息用于请求终端设备的临近业务授权信息。
发送模块1501，用于向接入和移动管理功能网元发送通信消息。其中，通信消息包括终端设备的临近业务授权信息，临近业务授权信息指示终端设备被授权的中继服务，临近业务策略信息用于终端设备获取临近业务通信服务。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，通信装置1500还可以包括处理模块1503和存储模块(图15中未示出)，该存储模块存储有程序或指令。当处理模块1503执行该程序或指令时，使得通信装置1500可以执行图8a-图9b、图11-图12所示的授权方法中策略控制功能网元的功能。
需要说明的是，通信装置1500可以是策略控制功能网元，也可以是可设置于策略控制功能网元的芯片(系统)或其他部件或组件，本申请对此不做限定。
此外，通信装置1500的技术效果可以参考图8a-图9b、图11-图12所示的授权方法的技术效果，此处不再赘述。
本申请实施例提供一种通信系统。该通信系统包括：接入和移动管理功能网元和策略控制功能网元。或者，该通信系统可以包括接入和移动管理功能网元和统一数据管理网元，还可以包括策略控制功能网元。
其中，接入和移动管理功能网元用于执行上述方法实施例中接入和移动管理功能网元的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
策略控制功能网元用于执行上述方法实施例中策略控制功能网元的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
统一数据管理网元用于执行上述方法实施例中统一数据管理网元的动作，具体执行方法和过程可参照上述方法实施例，此处不再赘述。
本申请实施例提供一种芯片系统，该芯片系统包括逻辑电路和输入/输出端口。其中，逻辑电路可用于实现本申请实施例提供的授权方法所涉及的处理功能，输入/输出端口可用于本申请实施例提供的授权方法所涉及的收发功能。
示例性地，输入端口可用于实现本申请实施例提供的授权方法所涉及的接收功能，输出端口可用于实现本申请实施例提供的授权方法所涉及的发送功能。
示例性的，通信装置1300中的处理器可用于进行，例如但不限于，基带相关处理，通信装置1300中的收发器可用于进行，例如但不限于，射频收发。上述器件可以分别设置在彼此独立的芯片上，也可以至少部分的或者全部的设置在同一块芯片上。例如，处理器可以进一步划分为模拟基带处理器和数字基带处理器。其中，模拟基带处理器可以与收发器集成在同一块芯片上，数字基带处理器可以设置在独立的芯片上。随着集成电路技术的不断发展，可以在同一块芯片上集成的器件越来越多，例如，数字基带处理器可以与多种应用处理器(例如但不限于图形处理器，多媒体处理器等)集成在同一块芯片之上。这样的芯片可以称为系统芯片(system on chip)。将各个器件独立设置在不同的芯片上，还是整合设置在一个或者多个芯片上，往往取决于产品设计的具体需要。本发明实施例对上述器件的具体实现形式不做限定。
在一种可能的设计中，该芯片系统还包括存储器，该存储器用于存储实现本申请实施例提供的授权方法所涉及功能的程序指令和数据。
该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质包括计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的授权方法被执行。
本申请实施例提供一种计算机程序产品，该计算机程序产品包括：计算机程序或指令，当计算机程序或指令在计算机上运行时，使得本申请实施例提供的授权方法被执行。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形 式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (41)

  1. 一种授权方法，其特征在于，包括：
    接收来自接入和移动管理功能网元的授权请求消息；其中，所述授权请求消息包括来自终端设备的中继服务码，所述授权请求消息用于请求验证所述终端设备是否被授权使用所述中继服务码，所述中继服务码用于标识中继设备为远端设备提供的连接服务；
    根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码；其中，所述临近业务授权信息指示所述终端设备被授权的中继服务。
  2. 根据权利要求1所述的授权方法，其特征在于，所述授权请求消息还包括公共陆地移动网标识，所述授权请求消息指示所述终端设备为中继终端设备，所述根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码，包括：
    根据所述临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码和是否被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务。
  3. 根据权利要求2所述的授权方法，其特征在于，所述根据所述临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码和是否被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务，包括：
    确定所述临近业务授权信息是否包括所述中继服务码和所述公共陆地移动网标识；若是，则所述终端设备被授权使用所述中继服务码和被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务；若所述临近业务授权信息不包括所述中继服务码，则所述终端设备未被授权使用所述中继服务码；若所述临近业务授权信息不包括所述公共陆地移动网标识，则所述终端设备未被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务。
  4. 根据权利要求1所述的授权方法，其特征在于，所述授权请求消息指示所述终端设备为远端终端设备，所述根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码，包括：
    确定所述临近业务授权信息是否包括所述中继服务码；若是，则所述终端设备作为所述远端终端设备被授权使用所述中继服务码；否则，所述终端设备作为所述远端终端设备未被授权使用所述中继服务码。
  5. 根据权利要求1-4中任一项所述的授权方法，其特征在于，所述方法还包括：
    向所述接入和移动管理功能网元发送授权响应消息；其中，所述授权响应消息指示所述终端设备是否被授权使用所述中继服务码。
  6. 根据权利要求1-5中任一项所述的授权方法，其特征在于，所述授权请求消息还包括如下一项或多项：终端指示信息、所述终端设备的标识和所述终端设备的上下文标识；所述终端指示信息用于指示所述终端设备为所述远端终端设备或所述中继终端设备。
  7. 根据权利要求1-6中任一项所述的授权方法，其特征在于，所述临近业务授权信息是根据所述终端设备的标识、和/或所述终端设备的上下文标识确定的。
  8. 一种授权方法，其特征在于，包括：
    接收来自终端设备的非接入层请求消息；其中，所述非接入层请求消息包括中继服务码，所述中继服务码用于标识中继设备为远端设备提供的连接服务；
    响应于所述非接入层请求消息，向策略控制功能网元发送授权请求消息；其中，所述授权请求消息包括所述中继服务码，所述授权请求消息用于请求验证所述终端设备是否被授权使用所述中继服务码；
    接收来自所述策略控制功能网元的授权响应消息；其中，所述授权响应消息指示所述终端设备是否被授权使用所述中继服务码。
  9. 根据权利要求8所述的授权方法，其特征在于，所述授权请求消息还包括公共陆地移动网标识。
  10. 根据权利要求9所述的授权方法，其特征在于，所述授权响应消息指示所述终端设备是否被授权使用所述中继服务码，具体为：指示所述终端设备是否被授权使用所述中继服务码和是否被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务。
  11. 根据权利要求10所述的授权方法，其特征在于，所述非接入层请求消息还包括临近业务密钥标识，在所述授权响应消息指示所述终端设备被授权使用所述中继服务码和被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，所述方法还包括：
    向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息；其中，所述鉴权服务器功能网元标识获取请求消息包括所述临近业务密钥标识。
  12. 根据权利要求8所述的授权方法，其特征在于，在所述授权响应消息指示所述终端设备被授权使用所述中继服务码的情况下，所述方法还包括：
    向鉴权服务器功能网元发送临近业务请求消息；其中，所述临近业务请求消息包括所述中继服务码。
  13. 根据权利要求9或10所述的授权方法，其特征在于，在所述授权响应消息指示所述终端设备未被授权使用所述中继服务码和/或未被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，所述方法还包括：
    向所述终端设备发送非接入层响应消息；其中，所述非接入层响应消息指示请求失败。
  14. 根据权利要求8-13中任一项所述的授权方法，其特征在于，在所述终端设备为中继终端设备的情况下，所述方法还包括：
    根据所述终端设备的临近业务签约信息，确定所述终端设备是否被授权作为所述中继终端设备。
  15. 根据权利要求8-13中任一项所述的授权方法，其特征在于，在所述终端设备为远端终端设备的情况下，所述方法还包括：
    根据所述终端设备的临近业务签约信息，确定所述终端设备是否被授权作为所述远端终端设备。
  16. 根据权利要求14或15所述的授权方法，其特征在于，所述方法还包括：
    根据所述非接入层请求消息，确定所述终端设备为所述中继终端设备还是所述远端终端设备。
  17. 根据权利要求8-16中任一项所述的授权方法，其特征在于，所述授权请求消息还包括如下一项或多项：终端指示信息、所述终端设备的标识和所述终端设备的上下文标识；所述终端指示信息用于指示所述终端设备为所述远端终端设备或所述中继终端设备。
  18. 一种授权方法，其特征在于，包括：
    获取终端设备的中继服务码；其中，所述中继服务码用于标识中继设备为远端设备提供的连接服务；
    根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码；其中，所述临近业务授权信息指示所述终端设备被授权的中继服务。
  19. 根据权利要求18所述的授权方法，其特征在于，所述终端设备为远端终端设备，所述根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码，包括：
    确定所述临近业务授权信息是否包括所述中继服务码；若是，则所述终端设备作为所述远端终端设备被授权使用所述中继服务码；否则，所述终端设备作为所述远端终端设备未被授权使用所述中继服务码。
  20. 根据权利要求19所述的授权方法，其特征在于，所述方法还包括：
    在所述终端设备作为所述远端终端设备被授权使用所述中继服务码的情况下，向鉴权服务器功能网元发送临近业务请求消息；其中，所述临近业务请求消息包括所述中继服务码。
  21. 根据权利要求18所述的授权方法，其特征在于，所述终端设备作为中继终端设备，所述根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码，包括：
    根据所述临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务；其中，所述公共陆地移动网标识为接入和移动管理功能网元服务的网络的标识。
  22. 根据权利要求21所述的授权方法，其特征在于，所述根据所述临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码和是否被授权在公共陆地移动网标识对应的公共陆地移动网中中继业务，包括：
    确定所述临近业务授权信息是否包括所述中继服务码和所述公共陆地移动网标识；若是，则所述终端设备被授权使用所述中继服务码和被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务；若所述临近业务授权信息不包括所述中继服务码，则所述终端设备未被授权使用所述中继服务码；若所述临近业务授权信息不包括所述公共陆地移动网标识，则所述终端设备未被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务。
  23. 根据权利要求21或22所述的授权方法，其特征在于，所述方法还包括：
    在所述终端设备被授权使用所述中继服务码和被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向统一数据管理网元发送鉴权服务器功能网元标识获取请求消息、或密钥获取请求消息；其中，所述鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识、或签约隐藏标识，所述密钥获取请求消息包 括临近业务密钥标识、或签约隐藏标识。
  24. 根据权利要求21或22所述的授权方法，其特征在于，所述方法还包括：
    在所述终端设备未被授权使用所述中继服务码和/或未被授权在所述公共陆地移动网标识对应的公共陆地移动网中中继业务的情况下，向所述终端设备发送非接入层响应消息；其中，所述非接入层响应消息指示请求失败。
  25. 根据权利要求18-24中任一项所述的授权方法，其特征在于，所述获取终端设备的中继服务码，包括：
    接收来自所述终端设备的非接入层请求消息；其中，所述非接入层请求消息包括所述中继服务码。
  26. 根据权利要求18-24中任一项所述的授权方法，其特征在于，所述获取终端设备的中继服务码，包括：
    接收来自所述统一数据管理网元的授权请求消息；其中，所述授权请求消息包括所述中继服务码，所述授权请求消息用于请求验证所述终端设备是否被授权使用所述中继服务码。
  27. 根据权利要求18-26中任一项所述的授权方法，其特征在于，所述方法还包括：
    根据所述终端设备的临近业务签约信息，确定所述终端设备是否被授权作为所述中继终端设备。
  28. 根据权利要求27所述的授权方法，其特征在于，所述根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码，包括：
    在所述终端设备被授权作为所述远端终端设备或所述中继终端设备的情况下，根据所述终端设备的临近业务授权信息，确定所述终端设备是否被授权使用所述中继服务码。
  29. 根据权利要求18-28中任一项所述的授权方法，其特征在于，所述方法还包括：
    向所述统一数据管理网元发送授权响应消息；其中，所述授权响应消息指示所述终端设备是否被授权使用所述中继服务码。
  30. 根据权利要求18-29中任一项所述的授权方法，其特征在于，所述方法还包括：
    接收来自策略控制功能网元的通信消息；其中，所述通信消息包括所述临近业务授权信息。
  31. 根据权利要求18-30中任一项所述的授权方法，其特征在于，所述方法还包括：
    向所述策略控制功能网元发送授权信息请求消息；其中，所述授权信息请求消息用于请求所述终端设备的所述临近业务授权信息。
  32. 一种授权方法，其特征在于，包括：
    接收来自接入和移动管理功能网元的鉴权服务器功能网元标识获取请求消息；其中，所述鉴权服务器功能网元标识获取请求消息包括临近业务密钥标识和中继服务码，或者所述鉴权服务器功能网元标识获取请求消息包括签约隐藏标识和所述中继服务码，所述中继服务码用于标识中继设备为远端设备提供的连接服务；
    向根据所述临近业务密钥标识或所述签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息；其中，所述授权请求消息包括所述中继服务码，所述授权请求消息用于请求验证终端设备是否被授权使用所述中继服务码；
    接收来自所述根据所述临近业务密钥标识或所述签约隐藏标识确定的接入和移动管理功能网元的授权响应消息；其中，所述授权响应消息指示所述终端设备是否被授权使用所述中继服务码。
  33. 根据权利要求32所述的授权方法，其特征在于，所述方法还包括：
    根据所述终端设备的临近业务签约信息，确定所述终端设备是否被授权作为远端终端设备。
  34. 根据权利要求33所述的授权方法，其特征在于，所述向根据所述临近业务密钥标识或所述签约隐藏标识确定的接入和移动管理功能网元发送授权请求消息，包括：
    在所述终端设备被授权作为所述远端终端设备的情况下，向所述根据所述临近业务密钥标识或所述签约隐藏标识确定的接入和移动管理功能网元发送所述授权请求消息。
  35. 根据权利要求32-34中任一项所述的授权方法，其特征在于，在所述授权响应消息指示所述终端设备被授权使用所述中继服务码的情况下，所述方法还包括：
    向所述接入和移动管理功能网元发送鉴权服务器功能网元标识获取响应消息；其中，所述鉴权服务器功能网元标识获取响应消息包括鉴权服务器功能网元实例标识。
  36. 根据权利要求32-34中任一项所述的授权方法，其特征在于，在所述授权响应消息指示所述终端设备被授权使用所述中继服务码的情况下，所述方法还包括：
    向鉴权服务器功能网元发送临近业务请求消息；其中，所述临近业务请求消息包括所述签约永久标识、所述中继服务码和随机数。
  37. 根据权利要求36所述的授权方法，其特征在于，所述方法还包括：
    接收来自所述鉴权服务器功能网元的临近业务响应消息；其中，所述临近业务响应消息包括密钥和新鲜性参数；
    向所述接入和移动管理功能网元发送密钥获取响应消息；其中，所述密钥获取响应消息包括所述密钥和所述新鲜性参数。
  38. 一种通信装置，其特征在于，所述通信装置包括用于执行如权利要求1-37中任一项所述方法的单元或模块。
  39. 一种通信装置，其特征在于，所述通信装置包括：处理器；所述处理器，用于执行如权利要求1-37中任一项所述的授权方法。
  40. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-37中任一项所述的授权方法被执行。
  41. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-37中任一项所述的授权方法被执行。
PCT/CN2023/073403 2022-01-29 2023-01-20 授权方法及装置 WO2023143459A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210112141.7 2022-01-29
CN202210112141.7A CN116567590A (zh) 2022-01-29 2022-01-29 授权方法及装置

Publications (1)

Publication Number Publication Date
WO2023143459A1 true WO2023143459A1 (zh) 2023-08-03

Family

ID=87470576

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/073403 WO2023143459A1 (zh) 2022-01-29 2023-01-20 授权方法及装置

Country Status (2)

Country Link
CN (1) CN116567590A (zh)
WO (1) WO2023143459A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109716810A (zh) * 2017-01-06 2019-05-03 华为技术有限公司 授权验证方法和装置
WO2021135295A1 (zh) * 2019-12-30 2021-07-08 华为技术有限公司 建立连接和获取中继服务代码的方法和通信装置
WO2021232897A1 (zh) * 2020-05-21 2021-11-25 华为技术有限公司 中继链接建立、配置信息发送方法、装置和可读存储介质

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109716810A (zh) * 2017-01-06 2019-05-03 华为技术有限公司 授权验证方法和装置
WO2021135295A1 (zh) * 2019-12-30 2021-07-08 华为技术有限公司 建立连接和获取中继服务代码的方法和通信装置
WO2021232897A1 (zh) * 2020-05-21 2021-11-25 华为技术有限公司 中继链接建立、配置信息发送方法、装置和可读存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI: "Summary of [AT116bis-e][608][Relay] RAN sharing (Huawei)", 3GPP TSG_RAN\WG2_RL2, R2-220XXXX, vol. RAN WG2, no. Electronic; 20220117 - 20220125, 25 January 2022 (2022-01-25), XP052103251 *
PHILIPS INTERNATIONAL B.V: "Resolving editor’s note in solution #32", 3GPP SA WG3 MEETING #102BIS-E, S3-211258, 5 March 2021 (2021-03-05), XP052174150 *

Also Published As

Publication number Publication date
CN116567590A (zh) 2023-08-08

Similar Documents

Publication Publication Date Title
CN111107047B (zh) 服务授权方法及通信装置
AU2019383599B2 (en) Method, apparatus, and system for obtaining capability information of terminal
CN113841366B (zh) 通信方法及装置
US20230087407A1 (en) Authentication and authorization method and apparatus
WO2021204065A1 (zh) 一种通信方法及装置
US20240163666A1 (en) Method and device for authenticating network access request through terminal-to-terminal connection in mobile communication system
US20240244681A1 (en) Communication method, apparatus, and system
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
US20220225463A1 (en) Communications method, apparatus, and system
JP2023080266A (ja) モビリティ管理ノード、ユーザ機器、及びこれらの方法
WO2024067619A1 (zh) 通信方法和通信装置
WO2023246942A1 (zh) 通信方法及装置
WO2023066210A1 (zh) 鉴权方法及装置
WO2023143459A1 (zh) 授权方法及装置
AU2023211342A1 (en) Communication method and apparatus
JP7131721B2 (ja) Ａｍｆノード及びその方法
WO2021073382A1 (zh) 注册方法及装置
WO2023072275A1 (zh) 通信方法、装置及系统
WO2024160127A1 (zh) 通信方法、装置及系统
WO2022252658A1 (zh) 一种漫游接入方法及装置
CN114640988B (zh) 基于隐式指示加密的信息处理方法及装置
WO2024149053A1 (zh) 鉴权方法及通信装置
CN113412679B (zh) 通信方法及装置
WO2023051614A1 (zh) 通信方法及装置
EP4274310A1 (en) Network intercommunication method and apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23746337

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023746337

Country of ref document: EP

Effective date: 20240730

NENP Non-entry into the national phase

Ref country code: DE