WO2023174150A1 - 一种接入控制方法及装置 - Google Patents

一种接入控制方法及装置 Download PDF

Info

Publication number
WO2023174150A1
WO2023174150A1 PCT/CN2023/080458 CN2023080458W WO2023174150A1 WO 2023174150 A1 WO2023174150 A1 WO 2023174150A1 CN 2023080458 W CN2023080458 W CN 2023080458W WO 2023174150 A1 WO2023174150 A1 WO 2023174150A1
Authority
WO
WIPO (PCT)
Prior art keywords
campus
terminal
smf
policy
authentication
Prior art date
Application number
PCT/CN2023/080458
Other languages
English (en)
French (fr)
Inventor
马春燕
丁辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023174150A1 publication Critical patent/WO2023174150A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service

Definitions

  • the present application relates to the field of wireless communications, and in particular, to an access control method and device.
  • the registration of user equipment may include the following process: the UE sends a registration request to the access and mobility management function (AMF) through the radio access network (AN) , AMF determines the corresponding unified data management (UDM) based on the UE identity, and requests it to obtain the UE's contract data. After receiving the request, the UDM can obtain the actual UE from the unified data warehouse (unified data repository, UDR). Contract data.
  • the AMF can also initiate a user policy control establishment request (UEPolicyControl_Create) and an access management policy control establishment request (AMPolicyControl_Create) to the policy control function (PCF) to obtain the UE policy and access control policy respectively. In this process, the PCF returns the access control policy to the AMF and provides the UE policy to the UE via the AMF.
  • PDU session establishment may include the following process: UE sends a session establishment request to AMF through RAN; AMF selects SMF to provide services for the session, saves the correspondence between SMF and PDU session, and sends the session establishment request to the session management function (session management function).
  • Management function SMF
  • SMF selects the corresponding user plane function (UPF) for the UE and establishes a user plane transmission path, and allocates an IP address to the established transmission path.
  • UPF user plane function
  • SMF will also initiate a policy control session establishment request to PCF to establish a policy control session between SMF and PCF.
  • SMF will save the correspondence between the policy control session and the PDU session.
  • application function network element application function, AF
  • the PCF binds the AF session and the policy control session.
  • This application provides an access control method and device to solve the problem that if a terminal fails to access the campus DN, it cannot continue to access the public network DN.
  • this application provides an access control method, which includes: the session management function network element SMF receives a session establishment request sent by a terminal, and the SMF determines to send an authentication request to the campus server according to the request; the SMF Receive the authentication failure response message sent by the campus server; when the SMF determines to accept the session establishment request, the SMF sends a policy association establishment request to the policy control function network element PCF, and receives the policy sent by the PCF Association establishment response; the SMF executes policy execution rules for the session of the terminal according to the non-campus policy rules in the policy association establishment response; the SMF sends a session establishment response message to the terminal.
  • the method before the SMF receives the authentication failure response message sent by the authentication server, the method further includes: the SMF obtains the subscription information of the terminal device from the unified data management network element UDM, so The subscription information includes error processing indication information, which is used to indicate that the session establishment request of the terminal is still accepted when the terminal authentication fails; the SMF determines to accept the session establishment request, including: the SMF determines to accept the session establishment request according to the The error handling indication information determines acceptance of the session establishment request.
  • the SMF determining to accept the session establishment request includes: the SMF determining to accept the session establishment request according to local preconfiguration information.
  • the policy association establishment request includes indication information indicating that the terminal fails to access the campus data network DN, so that the policy association response sent by the PCF does not include Policy information rules of the campus DN.
  • the policy association establishment response includes the policy information rules of the campus DN; the method further includes: the SMF does not execute the policy rules of the campus DN; the SMF reports to the PCF Sends instructions indicating that the campus DN policy rules failed to be executed.
  • the SMF determines to send an authentication request to the campus server based on the request, including: the SMF determines to send an authentication request to the campus server based on the location information of the terminal, the subscription information of the terminal, or the local configuration of the SMF. information to confirm sending the authentication request to the campus server:
  • the PCF receives the indication information indicating that the terminal accesses the campus DN authentication failure, including: the PCF receives a policy association establishment request sent by the session management function network element SMF, and the policy association establishment request includes indication information indicating that the terminal accesses the campus DN authentication failure; the policy association message is a response message to the policy association establishment request.
  • the PCF receiving the indication information indicating that the terminal accesses the campus DN authentication fails includes: the PCF receives a policy authorization request message sent by the campus server, and the policy authorization request message includes the terminal access authorization request message.
  • the present application provides an access control method, including: the campus server receives an authentication request sent from the session management function network element SMF, and the authentication request includes a terminal requesting access to the campus data network DN. identification; the campus server determines to deny access to the campus DN by the terminal; the campus server sends an authentication response to the SMF, where the authentication response is used to indicate successful authentication but deny access to the terminal The park DN.
  • the authentication response includes authorization file index information, so that the SMF sends the authorization file index information to the policy control function network element PCF, and the authorization file index information is used to Indicates that the terminal is denied access to the campus DN.
  • embodiments of the present application provide a communication device, including: a processor, and a memory and a communication interface respectively coupled to the processor; the communication interface is used to communicate with other devices; the processor , used to run instructions or programs in the memory, and execute the access control method as described in the first to third aspects and any possible implementation manner through the communication interface.
  • embodiments of the present application provide a computer-readable storage medium.
  • Computer-readable instructions are stored in the computer-readable storage medium.
  • the computer-readable instructions When the computer-readable instructions are run on a computer, the first The methods described in aspects to the third aspect and any possible implementation manner are executed.
  • embodiments of the present application provide a computer program product containing instructions that, when run on a computer, cause the methods described in the first to third aspects and any possible implementation manner to be executed. .
  • Figure 1 is a schematic diagram of the network architecture applicable to the embodiment of the present application.
  • FIG. 2 is a schematic diagram of the secondary authentication process provided by the embodiment of this application.
  • Figure 3 is a schematic diagram of the offload architecture of UPF UL CL provided by the embodiment of this application;
  • Figure 4 is a schematic flow chart of an access control method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of an access control method provided by an embodiment of the present application.
  • Figure 6 is a schematic flow chart of an access control method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of an access control method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of an access control method provided by an embodiment of the present application.
  • Figure 10 is a schematic structural diagram of another communication device according to an embodiment of the present application.
  • FIG. 1 exemplarily provides a schematic diagram of a wireless communication system architecture applicable to embodiments of the present application.
  • the system architecture may include the following units or devices:
  • Terminal equipment can also be called terminal, user equipment (UE), mobile station, mobile terminal, etc.
  • Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), and the Internet of Things (internet of things, IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • Terminal devices can be mobile phones, tablets, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc. The embodiments of this application do not limit the specific technology and specific equipment form used by the terminal equipment.
  • Wireless access network can also be called access network equipment or base station, which is used to connect terminal equipment to the wireless network.
  • the wireless access network may be a base station, an LTE system or an evolved LTE
  • the evolved base station evolved NodeB, eNodeB
  • LTE-A LTE-Advanced
  • gNB next generation base station
  • TRP transmission reception point
  • BBU base band unit
  • WiFi access point access point, AP
  • base station in future mobile communication system or access node in WiFi system, etc.
  • the wireless access network can also be a module or unit that completes some functions of the base station, for example, it can be a centralized unit (central unit, CU) or a distributed unit (distributed unit, DU).
  • CU central unit
  • DU distributed unit
  • the embodiments of this application do not limit the specific technologies and specific equipment forms used in the wireless access network.
  • the radio access network may be a CU node, a DU node, or a radio access network including a CU node and a DU node.
  • the CU node is used to support protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc.; the DU node Used to support wireless link control (radio link control, RLC) layer protocols, media access control (medium access control, MAC) layer protocols and physical layer protocols.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • SDAP service data adaptation protocol
  • RLC wireless link control
  • MAC media access control
  • physical layer protocols physical layer protocols.
  • the core network may include one or more of the following network elements: access and mobility management function (AMF) network element, session management function (SMF) network element, user plane Function (user plane function, UPF) network element, application function (application function, AF) network element, policy control function (PCF) network element, unified data management (unified data management, UDM) network element.
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane Function
  • AF application function
  • PCF policy control function
  • UDM unified data management
  • AMF Mainly used for attachment and mobility management of terminals in mobile networks. In addition, it is also responsible for transmitting user policies between UE and PCF.
  • SMF Mainly used for session management in mobile networks, such as session establishment, modification, and release; execution of control policies issued by PCF; selection of UPF that provides message forwarding function; allocation of Internet Protocol (IP) addresses to terminals, etc. .
  • IP Internet Protocol
  • UPF Mainly responsible for processing user messages, such as forwarding, accounting, legal interception, etc.
  • User plane network elements can also be called PDU session anchors (PDU session anchor, PSA).
  • AF Mainly used to convey the requirements of the application side to the network side, such as QoS requirements, charging policy requirements, routing policy requirements, user status event subscription, etc.
  • AF can be a third-party functional entity or an application service deployed by an operator, such as an IMS voice call service.
  • NEF can also be used for authorization processing when interacting with the core network. For example, AF directly sends a request message to NEF, and NEF determines whether the AF is allowed to send the request message. If the verification passes, then The request message will be forwarded to the corresponding PCF or UDM.
  • PCF Mainly responsible for policy control functions such as session and service flow level billing, QoS bandwidth guarantee and mobility management, and UE policy decision-making.
  • the PCFs connected to AMF and SMF correspond to AM PCF (PCF for Access and Mobility Control) and SM PCF (PCF for Session Management) respectively.
  • AM PCF and SM PCF can be the same PCF entity, or they can be different PCF entity.
  • UDM Mainly responsible for managing contract data, user access authorization and other functions.
  • UDR Unified Data Warehouse. Mainly responsible for the access functions of contract data, policy data, application data and other types of data.
  • DN Provides data transmission services for terminals. It can be a public data network (PDN) network, such as the Internet, or a local access data network (LADN), such as a campus DN. wait.
  • PDN public data network
  • LADN local access data network
  • Network element can also be called “entity” or “device”, which is not limited by this application.
  • Network elements can be co-located. When two network elements are co-located, the interaction between the two network elements provided by the embodiment of the present application becomes an internal operation of the co-located network element or can be omitted.
  • Figure 1 takes the 5G communication system as an example to provide an exemplary network architecture to which embodiments of the present application can be applied.
  • the actual applied network architecture may include more or fewer network elements than shown in Figure 1 .
  • the embodiments of this application can also be applied to future communication systems.
  • PDU session is a session service that implements PDU connectivity between UE and DN, and is identified by PDU session ID.
  • the operator can configure a secondary authentication indication at the DNN/S-NSSAI granularity to trigger SMF to send the data network authentication, authorization, and accounting server (DN- authentication, authorization, accounting, DN-AAA) initiates the authentication process to verify whether the UE is allowed to access the DNN/S-NSSAI.
  • the secondary authentication process can be shown in Figure 2, including the following processes:
  • the session establishment process is executed between SMF and UPF.
  • SMF determines to trigger secondary authentication based on the local configuration information or the subscription instruction information sent by UDM, and sends an authentication/authorization request to DN-AAA through UPF.
  • the DN needs to interact with the extensible authentication protocol (EAP) messages between UPF, SMF and UE to obtain the information required for secondary authentication.
  • EAP extensible authentication protocol
  • DN-AAA sends an authentication/authorization response (authentication/authorization response) to SMF through UPF.
  • the SMF and AMF transmit messages to instruct the AMF to instruct the UE to upload the information required for secondary authentication.
  • AMF sends an authentication message to the UE through the RAN.
  • the UE replies to the AMF with an authentication message through the RAN.
  • the authentication message contains the information required for secondary authentication.
  • AMF sends a PDU session context update (PDUsession_updateSMcontext) message to SMF.
  • PDUsession_updateSMcontext PDU session context update
  • SMF sends an authentication authorization request to DN-AAA through UPF.
  • DN-AAA returns an authentication authorization response to SMF through UPF, including indication information of authentication passing or authentication failing.
  • SMF continues to execute the PDU session establishment process.
  • SMF sends an IP address notification to DN-AAA through UPF.
  • SMF will send a PDU session establishment failure message to the UE.
  • the UPF uplink classifier distinguishes local services (such as services used within the campus, or downlink services deployed by service providers) from normal services, and passes them through the main anchor respectively.
  • Click UPF UPF PDU session anchors 1
  • auxiliary anchor point UPF UPF PDU session anchors 2
  • the offloading method based on UL CL greatly improves the convenience for users using the network.
  • the UE will not be aware of it, and the SMF will determine whether to access the campus DN based on the UE's location, currently initiated service type, campus service matching information, etc.
  • a terminal may need to perform a secondary authentication process to access the campus DN.
  • the current secondary authentication process for a terminal is only allowed to be executed once, which makes the terminal unable to continue to initiate public network services when it is denied access to the campus DN.
  • operators can use the above UL CL UPF architecture to allow terminals to access
  • the campus network is connected to the public network service at the same time; after receiving the session establishment request from terminal A, SMF can determine the authentication server to the campus network based on the location information of terminal A, the contract information of terminal A, or the local configuration information.
  • embodiments of this application provide an access control method, which is applied in the secondary authentication process to solve the problem that if a terminal fails to access the campus DN, it cannot continue to access the public network DN.
  • This method can be applied to the network architecture shown in Figure 1 and Figure 3, but the embodiments of this application are not limited to and only applicable to 5G communication systems.
  • the embodiments of this application can also be applied to 4G communication systems or future communication systems. .
  • the following takes the 5G communication system as an example.
  • FIG 4 is a schematic flow chart of an access control method provided by an embodiment of the present application. As shown in the figure, the method may include the following steps:
  • Step 401 The SMF receives the session establishment request sent from the terminal.
  • the terminal can send a session establishment request to the AMF, and the AMF selects the SMF, and then sends the terminal's session establishment request to the SMF.
  • the session establishment request sent by the terminal may be a PDU session establishment request, used to establish a PDU session.
  • the PDU session requested to be established may include an IP-based PDU session (such as IPv4, IPv6, etc.) or an Ethernet-type PDU session, that is, the user address corresponds to the MAC address, which is not limited by the present invention.
  • the session establishment request sent by the terminal may contain the DNN or S-NSSAI identifier of the access network it requests. Then SMF can determine the DN that the terminal requests access based on the DNN identifier contained in the session establishment request. Alternatively, the session establishment request sent by the terminal may not include the DNN, that is, the terminal does not need to determine the DN requested for access, which is determined by the SMF.
  • the SMF can also request the UDM to obtain the terminal's subscription data.
  • the subscription data may contain instruction information indicating that secondary authentication of the terminal is required, and then the SMF determines to initiate secondary authentication for the terminal.
  • SMF may also determine that secondary authentication needs to be initiated based on local configuration information.
  • Step 402 SMF determines to send an authentication request to the campus server according to the session establishment request.
  • the campus server is a server used to authenticate/authorize user access requests. It can decide to allow or deny access requests initiated by users based on user identity and/or authentication information, that is, return an authentication success/failure response. to SMF.
  • the campus server here can be campus DN-AAA.
  • the campus server may be deployed in the campus, or may be deployed centrally with the operator's network, which is not limited in the present invention.
  • SMF can send an authentication request to the campus server corresponding to the DNN identifier, that is, the DNN is the DNN corresponding to the campus service.
  • the SMF can determine the terminal's request to access the campus DN based on the terminal's location information, the terminal's subscription information, or the SMF local configuration information, and then send the request to the campus DN corresponding to the terminal.
  • the campus server sends an authentication request; or, the SMF can also determine that the terminal requests to establish a session for campus services based on the service information of the terminal's request to establish a session, and the SMF can also determine to send an authentication request to the campus server.
  • SMF can determine to send the authentication request to the campus server based on the terminal's location information, the terminal's subscription information, SMF local configuration information, or the service information of the session request. .
  • SMF when SMF sends an authentication request to the campus server, it can be forwarded through UPF, that is, SMF forwards the authentication request to the campus server.
  • UPF which forwards the authentication request to the corresponding campus server.
  • Step 403 The campus server determines whether the terminal is allowed to access the campus DN.
  • the campus server can obtain the authentication information of the terminal to authenticate the terminal and determine whether it is allowed to access the campus DN.
  • the campus server can interact with the terminal through EAP messages through UPF, SMF, and AMF, as shown in steps 3a to 3f in Figure 2, to obtain the information required to authenticate the terminal.
  • the campus server determines that the terminal is allowed to access the campus DN
  • the campus server sends an authentication success response message to the SMF.
  • the message can include the campus DN authorization profile index (DN authorization profile index), which is used to index to the policy rules configured on the SMF or PCF. It can also include the campus DN authorization session aggregate maximum bit rate (DN authorized session AMBR) parameters, etc., so that SMF can establish a session for the terminal according to the existing process, so that the terminal can obtain campus business services based on the established session.
  • DN authorization profile index campus DN authorization profile index
  • DN authorized session AMBR campus DN authorization session aggregate maximum bit rate
  • step 404 is executed.
  • Step 404 The campus server sends an authentication failure response message to the SMF.
  • the authentication failure response message may include information such as the reason for the authentication failure.
  • Step 405 When the SMF determines to accept the terminal's session establishment request, it sends a policy association establishment request to the PCF.
  • the SMF is locally configured with policy information of the terminal, indicating that a session is still allowed to be established for the terminal even if the secondary authentication fails.
  • the SMF can obtain the terminal's subscription data from the UDM after the above step 401, and the obtained subscription data contains error processing indication information, and the error processing indication information is used to indicate that even if the terminal 2 Sessions are allowed to be established despite multiple authentication failures.
  • the SMF determines to accept the terminal's session establishment request, continues the process of establishing a session for the terminal, and sends a policy association establishment request to the PCF.
  • the request may include the terminal session ID. Get the policy rules for a terminal session with a request.
  • the policy association establishment request sent by the SMF to the PCF may include instruction information indicating that the terminal is denied access to the campus DN, so that the PCF does not send policy rules about the campus.
  • Step 406 PCF sends a policy association establishment response to SMF.
  • the policy association establishment response sent by PCF to SMF contains session policy rules determined by PCF for the terminal, such as QoS control policy, gating policy, flow forwarding policy, accounting policy, etc.
  • the policy association establishment request sent by SMF can contain indication information indicating that the terminal is denied access to the campus DN. Then PCF will not send policy rules about the campus DN to SMF, but can send policy rules for the public network.
  • the PCF can send both the policy rules of the campus DN and the policy rules of the public network DN to the SMF.
  • the policy rules of the campus DN may include the data network access point identifier (DNAI) corresponding to the campus services, the routing information corresponding to the campus services, the policy charging rules corresponding to the campus services, etc.
  • DNAI data network access point identifier
  • Step 407 SMF executes the policy rules for the session of the terminal according to the policy rules in the policy association establishment response.
  • the SMF sends the indication information that the terminal is denied access to the campus DN in step 405 to the PCF, then the policy association establishment response received by the SMF does not contain the campus policy rules, then the SMF can directly base the policy association establishment response on the PCF. Policy rules enforce policy rules on sessions.
  • the policy association establishment response received by the PCF may contain the policy rules of the campus DN.
  • SMF needs to determine which of the received policy rules are campus DN policy rules and which are public network DN policy rules, execute the public network DN policy rules, and refuse to execute the campus DN policy rules.
  • SMF can determine whether the policy rule is a campus DN policy rule based on the flow description information in the policy rule. For example, the application identifier in the flow description information is a campus application, or the IP five-tuple information in the flow description information contains a campus address. segment and other information, you can determine that the policy rule is a campus DN policy rule.
  • SMF can also determine that the rule is a campus policy rule based on the DNAI access point information in the policy rule. For example, if the policy rule contains the DNAI access point corresponding to the campus service, or contains the DNAI access point corresponding to the campus service. If the offload destination address segment is used, it can be determined that the policy rule is a campus policy rule.
  • the SMF can also send an indication message indicating the campus DN policy execution failure to the PCF, or the SMF can also send a policy execution response message to the PCF, and carry the cause value of the execution failure in the message to indicate that the current terminal cannot Supports access to campus services.
  • Step 408 The SMF sends a session establishment response message to the terminal.
  • SMF After SMF executes the corresponding policy rules for the terminal's session, it can send a session establishment response to the terminal. Specifically, SMF can send the session establishment response message to the terminal through AMF.
  • the access control method in the above embodiment of the present application can also be applied in the process of modifying the terminal's secondary authentication result.
  • the campus server can SMF sends information that the authentication result is invalid.
  • the SMF can send a policy association update request to the PCF based on the information about the invalid authentication result.
  • the update request can include indication information that the terminal is denied access to the campus DN, and then obtains the updated policy rules from the PCF so that the terminal cannot continue.
  • Access campus services alternatively, SMF can also delete campus DN policy rules from executed policy rules to deny terminals continued access to campus services.
  • the campus server receives the legal identity authentication information for the terminal. Or the updated authentication information.
  • the campus server can also proactively send authentication success information to SMF.
  • SMF can send a policy association update request to PCF based on the authentication success information to obtain the policy rules of the campus DN. Then SMF can Enforce campus DN policy rules for terminal sessions.
  • the access control method may include the following steps:
  • Step 501 The terminal sends a session establishment request to the SMF.
  • the terminal may first send the session establishment request to the AMF, and then the AMF sends the session establishment request to the SMF.
  • Step 502 The SMF obtains the terminal's subscription data from the UDM.
  • the obtained contract data includes indication information (secondary authentication indication) used to indicate the need for secondary authentication, and error handling indication (error handling indication).
  • the error handling indication indicates that the terminal is allowed to establish a session even if the terminal fails secondary authentication.
  • the subscription data obtained by the SMF from the UDM may not include the error processing indication, and the SMF may also be locally configured with the terminal's error processing indication information.
  • Step 503 SMF sends an authentication/authorization request to the campus DN through UPF.
  • This authentication authorization request is the authentication request in the aforementioned embodiment.
  • the campus DN performs secondary authentication on the terminal through EAP message interaction between UPF, SMF and UE.
  • the secondary authentication process may be as shown in step 3a to step 3f in Figure 2.
  • Step 504 The campus server determines that the terminal fails secondary authentication and refuses the terminal to access the campus DN.
  • Step 505 The campus server sends an authentication/authorization response (authentication/authorization response) to SMF through UPF.
  • the authentication and authorization response indicates that authentication failed and the terminal is denied access to the campus DN.
  • the authentication authorization response is the authentication failure response message in the foregoing embodiment.
  • Step 506 The SMF sends a policy association establishment request to the PCF.
  • the request includes indication information that the terminal is denied access to the campus DN.
  • Step 507 The PCF determines the policy rules for the terminal to establish a session based on the indication information that the terminal is denied access to the campus DN.
  • Step 508 The PCF sends a policy association establishment response to the SMF.
  • the response includes the policy rules determined by the PCF in step 507.
  • Step 509 The SMF executes the policy rules sent by the PCF and sends a session establishment response to the terminal.
  • Figure 6 also provides an access control method as an example. As shown in Figure 6, the method may include the following steps:
  • Steps 601 to 605 are similar to steps 501 to 505 and will not be repeated here.
  • Step 606 The SMF sends a policy association establishment request to the PCF.
  • step 506 needs to carry indication information for indicating that the terminal is denied access to the campus DN, while step 606 does not need to carry indication information for indicating that the terminal is denied access to the campus DN. .
  • Step 607 PCF sends a policy association establishment response to SMF.
  • the policy association establishment response sent by PCF will contain the policy rules of the campus DN.
  • Step 608 SMF executes non-campus DN policy rules and does not execute campus DN policy rules.
  • Step 609 The SMF sends the campus DN policy execution failure indication information to the PCF.
  • Step 610 The SMF sends a session establishment response to the terminal.
  • the embodiment of the present application also provides an access control method, which can also solve the problem of the terminal being unable to access the public network DN if it fails to access the campus DN.
  • the difference between this method and the previous embodiment is that when the terminal is denied access to the campus DN, in the previous embodiment the SMF determines whether to continue to establish a session for the terminal based on the obtained subscription information or local configuration information, while this method embodiment can be performed by DN to confirm.
  • FIG 7 is a schematic flow chart of an access control method provided by an embodiment of the present application. As shown in the figure, the method may include the following processes:
  • Step 701 SMF sends an authentication request to the campus server.
  • the authentication request includes the identification of the terminal requesting access to the campus DN, so that the campus server authenticates the terminal.
  • Step 702 The campus server determines to deny the terminal access to the campus DN.
  • the campus server can obtain the authentication information of the terminal to authenticate the terminal and determine whether it is allowed to access the campus DN.
  • the campus server can interact with the terminal through EAP messages through UPF, SMF, and AMF, as shown in steps 3a to 3f in Figure 2, to obtain the information required to authenticate the terminal.
  • the campus server determines based on the obtained authentication information that the terminal is not a legally registered terminal for the campus DN, or the authentication fails due to other reasons, and therefore refuses the terminal to access the campus DN.
  • Step 703 The campus server sends an authentication response to the SMF.
  • the authentication response is used to indicate that the authentication is successful but refuses the terminal to access the campus DN.
  • the campus server can determine that the terminal is allowed to establish a session even if the terminal is denied access to the campus DN based on the obtained authentication information of the terminal; or the campus server can also determine that the terminal is allowed to establish a session even if the terminal is denied access to the campus DN based on the locally configured information. The terminal is still allowed to establish sessions.
  • the authentication success response sent by the campus server can carry the authorization file index (DN authorization profile index), which is used to index to the policy information configured on the SMF or PCF.
  • the authorization file index cannot index the policy rules of the campus DN, but should index the policy rules of the non-campus DN. Therefore, the authorization file index can be used as a kind of instruction information to indicate that the terminal is denied access to the campus DN.
  • the authorization file index can also be directly used to instruct the terminal to deny access to the campus DN.
  • the campus server can also set a new field in the authentication response to indicate that although the authentication is successful, the terminal is denied access to the campus DN.
  • Step 704 The SMF sends a policy association establishment request to the PCF according to the received authentication response.
  • SMF After SMF receives the authentication response, since the authentication response indicates that the authentication is successful, SMF sends a policy association establishment request to PCF to obtain the policy rules of the terminal session.
  • the SMF may carry the authorization file index in the received authentication response in the policy association establishment request sent to the PCF.
  • the PCF can determine the policy rules that need to be sent based on the authorization file index.
  • the PCF can indicate to the PCF that the terminal is denied access to the campus DN based on the authorization file index not indexing the campus DN policy rules; or, the authorization file index It can also be used to explicitly indicate that the terminal is not allowed to access the campus DN, then PCF selects non-campus DN policy rules based on the timing file index. During this process, SMF is not aware of the event that the terminal is denied access to the campus DN.
  • SMF Since the response message received by SMF is a successful authentication message, SMF is consistent with the process of establishing a session for the terminal under normal circumstances. According to the authorization The file index sends a policy association establishment request to PCF; however, the policy rules sent by PCF based on the authorized file index do not contain the policy rules of the campus DN. Therefore, even if SMF does not know that the terminal is denied access to the campus DN, it will not execute the session for the terminal. Campus DN policy rules.
  • the SMF can refer to the operation in the embodiment shown in Figure 4, and the SMF instructs the PCF terminal is denied access to the campus DN; alternatively, the SMF may not instruct the PCF terminal to be denied access to the campus DN.
  • the SMF executes the policy rules of the non-campus DN and does not execute the policy rules of the campus DN.
  • Step 705 SMF establishes a session for the terminal according to the policy rules obtained from PCF.
  • the campus server performs secondary authentication on the terminal, it can be determined based on the locally configured information or the obtained terminal authentication information. Even if the terminal is denied access to the campus DN, the terminal is still allowed to access the campus DN.
  • the authentication response sent by the campus server to the SMF can also only indicate that the authentication is successful and does not indicate that the terminal is denied access to the campus DN. Then the campus server can send indication information to the PCF to instruct the PCF Do not provide campus DN policy rules for this endpoint.
  • Figure 8 exemplarily provides a schematic flow chart of this implementation, as shown in the figure, including:
  • Steps 801 to 804 are similar to steps 501 to 504, and will not be described again here.
  • Step 805 The campus server sends an authentication authorization response to the SMF through UPF, and the response indicates that the authentication is successful.
  • Step 806 The SMF sends a policy association establishment request to the PCF.
  • Step 807 PCF sends a policy association establishment response to SMF.
  • Step 808 The SMF sends a session establishment response to the terminal.
  • Step 809 The campus server sends a policy authorization create request message (policy authorization create request) to PCF.
  • policy authorization request message is used to request PCF to stop providing campus DN policy rules for terminals.
  • Step 810 PCF sends a policy association update message to SMF.
  • the message does not carry the campus DN policy rules.
  • Step 811 SMF updates the associated policy rules for the terminal session according to the policy rules in the policy association update message.
  • FIG. 9 is a schematic diagram of a communication device provided according to an embodiment of the present application.
  • the communication device includes a processing module 901 and a transceiver module 902.
  • the processing module 901 is used to implement data processing by the communication device.
  • the transceiver module 902 is used to perform the information transceiver processing in the above method embodiment.
  • the processing module 901 in the embodiment of the present application can be implemented by a processor or processor-related circuit components (or, referred to as processing circuits), and the transceiver module 902 can be implemented by a receiver or receiver-related circuit components, a transmitter, or a transmitter. Implementation of device-related circuit components.
  • the communication device may be a communication device, or may be a chip used in the communication device or other combined devices, components, etc. having the functions of the above communication device.
  • the transceiver module 902 is used to receive a session establishment request sent by the terminal, and the processing module 901 is used to determine according to the request to send an authentication request to the campus server through the transceiver module 902; the transceiver module 902 is also configured to receive the authentication failure response message sent by the campus server; the processing module 901 is also configured to send a policy association establishment request to the policy control function network element PCF through the transceiver module 902 when determining to accept the session establishment request.
  • the processing module 901 is also used to execute policy rules for the session of the terminal according to the policy rules in the policy association establishment response;
  • the transceiver module 902 is also used to send to the terminal Session establishment response message.
  • each of the above modules can also be used to support other processes executed by SMF in the embodiments shown in Figures 4 to 8 and any implementation thereof.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • the transceiver module 902 is used to receive indication information indicating that the terminal accesses the campus data network DN authentication failure; the processing module 901 is used to send the information to the SMF through the transceiver module 902 according to the indication information.
  • Policy association message the policy association message includes non-described campus DN policy rules, excluding the above-mentioned Policy rules for campus DN.
  • the transceiver module 902 when receiving the indication information that the terminal accesses the campus DN authentication failure, is specifically configured to: receive a policy association establishment request sent by the session management function network element SMF, where the policy association establishment request includes the terminal access. Indication information indicating that DN authentication failed when entering the campus; the policy association message is a response message to the policy association establishment request.
  • the transceiver module 902 when receiving indication information indicating that terminal access campus DN authentication fails, is specifically configured to: receive a policy authorization request message sent by the campus server, where the policy authorization request message includes terminal access campus DN authentication.
  • the policy association message is a policy association update message sent to the SMF to indicate that the updated session policy rules of the terminal include the public network DN policy rules and do not include the campus DN policy rules.
  • each of the above modules can also be used to support other processes executed by the PCF in the embodiments shown in Figures 4 to 8 and any implementation thereof.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • the transceiver module 902 is used to receive an authentication request sent from the session management function network element SMF, where the authentication request includes the identification of the terminal requesting access to the campus data network DN; process Module 901 is used to determine that the terminal is denied access to the campus DN; the transceiver module 902 is also used to send an authentication response to the SMF, where the authentication response is used to indicate that the authentication is successful but refuses the terminal to access the campus DN. Describe the park DN.
  • each of the above modules can also be used to support other processes executed by the campus server in the embodiments shown in Figures 4 to 8 and any of their implementations.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • FIG 10 is a schematic diagram of another communication device provided according to an embodiment of the present application.
  • the communication device includes a processor 1001 as shown in Figure 10, and a communication interface 1002 connected to the processor 1001.
  • the processor 1001 may be a general processor, a microprocessor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, or one or more integrated circuits used to control the execution of the program of this application, etc.
  • a general-purpose processor may be a microprocessor or any conventional processor, etc.
  • the communication interface 1002 uses any device such as a transceiver to communicate with other devices or communication networks, such as RAN.
  • the processor 1001 is used to call the communication interface 1002 to perform receiving and/or sending functions, and to perform the user plane function disaster recovery method as described in the previous possible implementation manner.
  • the communication device may also include a memory 1003 and a communication bus 1004.
  • the memory 1003 is used to store program instructions and/or data, so that the processor 1001 calls the instructions and/or data stored in the memory 1003 to implement the above functions of the processor 1001.
  • the memory 1003 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory (RAM)) or other type that can store information and instructions.
  • the dynamic storage device can also be an electrically erasable programmable read-only memory (EEPROM) or can be used to carry or store the desired program code in the form of instructions or data structures and can be stored by the computer. any other medium, but not limited to this.
  • the memory 1003 may exist independently, such as an off-chip memory, and is connected to the processor 1001 through the communication bus 1004.
  • the memory 1003 may also be integrated with the processor 1001.
  • Communication bus 1004 may include a path that carries information between the above-mentioned components.
  • the processor 1001 executes through the communication interface 1002: receives the session establishment request sent by the terminal, determines to send the authentication request to the campus server according to the request; receives the session establishment request sent by the campus server. Authentication failure response message; when determining to accept the session establishment request, send a policy association establishment request to the policy control function network element PCF, and receive the policy association establishment response sent by the PCF; according to the policy association establishment response
  • the policy rule executes the policy rule for the session of the terminal; and sends a session establishment response message to the terminal.
  • each of the above modules can also be used to support other processes executed by SMF in the embodiments shown in Figures 4 to 8 and any implementation thereof.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • the processor 1001 executes through the communication interface 1002: receives the indication information that the terminal accesses the campus data network DN authentication failure; sends a policy association message to the SMF according to the indication information, so The policy association message includes policy rules other than the campus DN, and does not include policy rules for the campus DN.
  • the processor 1001 when the processor 1001 receives the indication information of the terminal accessing the campus DN authentication failure, it is specifically configured to: receive a policy association establishment request sent by the session management function network element SMF, and the policy association establishment The request includes indication information indicating that the terminal accesses the campus DN authentication failure; the policy association message is a response message to the policy association establishment request.
  • the processor 1001 when the processor 1001 receives the indication information that the terminal accesses the campus DN authentication failure, it is specifically configured to: receive a policy authorization request message sent by the campus server, where the policy authorization request message includes the terminal Access campus DN authentication failure indication information; the policy association message is a policy association update message sent by the PCF to the SMF to indicate that the updated session policy rules of the terminal include the public network DN policy rules and do not include The campus DN policy rules.
  • each of the above modules can also be used to support other processes executed by the PCF in the embodiments shown in Figures 4 to 8 and any implementation thereof.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • the processor 1001 executes through the communication interface 1002: receiving an authentication request sent from the session management function network element SMF, where the authentication request includes a terminal requesting access to the campus data network DN. identification; determine that the terminal is denied access to the campus DN; and send an authentication response to the SMF, where the authentication response is used to indicate successful authentication but deny the terminal access to the campus DN.
  • each of the above modules can also be used to support other processes executed by the campus server in the embodiments shown in Figures 4 to 8 and any of their implementations.
  • the beneficial effects can be referred to the previous description and will not be repeated here.
  • embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium stores computer-readable instructions.
  • When the computer-readable instructions are run on a computer such that: The access control method described in any of the possible implementation methods mentioned above is executed.
  • Embodiments of the present application provide a computer program product containing instructions, which when run on a computer causes the above method embodiments to be executed.
  • Embodiments of the present application provide a computer-readable storage medium storing a computer program.
  • the computer program includes instructions for executing the above method embodiments.
  • Embodiments of the present application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the above method embodiments.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种接入控制方法及装置，可应用于二次鉴权过程中。该方法包括：SMF接收终端发送的会话建立请求，SMF根据所述请求确定向园区服务器发送鉴权请求；SMF接收园区服务器发送的鉴权失败响应消息；在SMF确定接受所述会话建立请求时，SMF向PCF发送策略关联建立请求，并接收PCF发送的策略关联建立响应；SMF根据策略关联建立响应中的策略规则为终端的会话进行策略执行；SMF向所述终端发送会话建立响应消息。虽然在二次鉴权时终端被拒绝接入园区DN，但仍允许终端继续建立会话，仍可以为终端执行公网DN的相关策略，使得终端不能发起园区业务，但仍能够发起公网业务，解决了终端接入数据网络的合法需求。

Description

一种接入控制方法及装置
相关申请的交叉引用
本申请要求在2022年03月17日提交中国专利局、申请号为202210264265.7、申请名称为“一种接入控制方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信领域，尤其涉及一种接入控制方法及装置。
背景技术
用户设备(user equipment，UE)的注册可以包括以下流程：UE通过无线接入网络(radio access network，AN)发送注册请求至接入与移动性管理功能网元(access and mobility management function，AMF)，AMF根据UE标识确定相应的统一数据管理(unified data management，UDM)，并向其请求获取UE的签约数据，UDM收到该请求后可以向统一数据仓库(unified data repository，UDR)获取UE实际签约数据。此外，AMF还可以向策略控制功能(policy control function，PCF)发起用户策略控制建立请求(UEPolicyControl_Create)及接入管理策略控制建立请求(AMPolicyControl_Create)，分别用于获取UE策略及接入控制策略。PCF在该过程中返回接入控制策略至AMF，并经由AMF向UE提供UE策略。
UE在注册完成后，可以请求建立分组数据单元(packet data unit，PDU)会话。PDU会话建立可以包括以下流程：UE通过RAN向AMF发送会话建立请求；AMF为该会话选择SMF为其提供服务，保存SMF与PDU会话的对应关系，并将会话建立请求发送至会话管理功能(session management function，SMF)；SMF为UE选择相应的用户面功能(user plane function，UPF)并建立用户面传输路径，并为建立的传输路径分配IP地址。在此过程中，SMF还将向PCF发起策略控制会话建立请求，用于在SMF和PCF间建立策略控制会话，在策略控制会话建立过程中，SMF将保存策略控制会话与PDU会话间的对应关系。此外，应用功能网元(application function，AF)还可与PCF间建立AF会话，由PCF对AF会话与策略控制会话进行绑定。
在PDU会话建立流程中，运营商可以以数据网络名称(data network name，DNN)/单个切片选择辅助信息(single-network slice selection assistance information，S-NSSAI)为粒度配置二次鉴权指示。然而，目前针对二次鉴权的技术方案还有待完善。
发明内容
本申请提供一种接入控制方法及装置，用于解决终端接入园区DN失败则无法接续接入公网DN的问题。
第一方面，本申请提供一种接入控制方法，包括：会话管理功能网元SMF接收终端发送的会话建立请求，所述SMF根据所述请求确定向园区服务器发送鉴权请求；所述SMF 接收所述园区服务器发送的鉴权失败响应消息；在所述SMF确定接受所述会话建立请求时，所述SMF向策略控制功能网元PCF发送策略关联建立请求，并接收所述PCF发送的策略关联建立响应；所述SMF根据所述策略关联建立响应中的非所述园区策略规则为所述终端的会话进行执行策略执行规则；所述SMF向所述终端发送会话建立响应消息。
在一种可能的实现方式中，在SMF接收鉴权服务器发送的鉴权失败响应消息之前，所述方法还包括：所述SMF从统一数据管理网元UDM获取所述终端设备的签约信息，所述签约信息中包括错误处理指示信息，用于指示当所述终端鉴权失败时仍接受所述终端的会话建立请求；所述SMF确定接受所述会话建立请求，包括：所述SMF根据所述错误处理指示信息确定接受所述会话建立请求。
在一种可能的实现方式中，所述SMF确定接受所述会话建立请求，包括：所述SMF根据本地预配置信息确定接受所述会话建立请求。
在一种可能的实现方式中，所述策略关联建立请求中包括用于指示所述终端接入所述园区数据网络DN失败的指示信息，以使所述PCF发送的策略关联响应中不发送包括所述园区DN的策略信息规则。
在一种可能的实现方式中，所述策略关联建立响应中包括园区DN的策略信息规则；所述方法还包括：所述SMF不执行所述园区DN的策略规则；所述SMF向所述PCF发送园区DN策略规则执行失败的指示信息。
在一种可能的实现方式中，所述SMF根据所述请求确定向园区服务器发送鉴权请求，包括：所述SMF根据所述终端的位置信息、所述终端的签约信息或所述SMF本地配置信息，确定向园区服务器发送鉴权请求：
第二方面，本申请提供一种接入控制方法，包括：策略控制功能网元PCF接收终端接入园区数据网络DN鉴权失败的指示信息；所述PCF根据所述指示信息向SMF发送策略关联消息，所述策略关联消息中包括非所述园区DN策略规则，不包括所述园区DN的策略规则。
在一种可能的实现方式中，所述PCF接收终端接入园区DN鉴权失败的指示信息，包括：所述PCF接收会话管理功能网元SMF发送的策略关联建立请求，所述策略关联建立请求中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为所述策略关联建立请求的响应消息。
在一种可能的实现方式中，所述PCF接收终端接入园区DN鉴权失败的指示信息，包括：所述PCF接收园区服务器发送的策略授权请求消息，所述策略授权请求消息中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为所述PCF向SMF发送策略关联更新消息，以指示所述终端更新后的会话策略规则包括所述公网DN策略规则，不包括所述园区DN策略规则。
第三方面，本申请提供一种接入控制方法，包括：园区服务器接收来自会话管理功能网元SMF发送的鉴权请求，所述鉴权请求中包括请求接入所述园区数据网络DN的终端的标识；所述园区服务器确定拒绝所述终端接入所述园区DN；所述园区服务器向所述SMF发送鉴权响应，所述鉴权响应用于指示鉴权成功但拒绝所述终端接入所述园区DN。
在一种可能的实现方式中，所述鉴权响应中包括授权文件索引信息，以使所述SMF将所述授权文件索引信息发送给策略控制功能网元PCF，所述授权文件索引信息用于指示拒绝所述终端接入所述园区DN。
第四方面，本申请提供一种通信装置，所述装置包括执行上述第一方面至第三方面以及任意一种可能实现方式的方法的模块/单元；这些模块/单元可以通过硬件实现，也可以通过硬件执行相应的软件实现。
第五方面，本申请实施例提供一种通信装置，包括：处理器，以及分别与所述处理器耦合的存储器和通信接口；所述通信接口，用于与其他设备进行通信；所述处理器，用于运行所述存储器内的指令或程序，通过所述通信接口执行如第一方面至第三方面以及任意一种可能实现方式所述的接入控制方法。
第六方面，本申请实施例中提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可读指令，当所述计算机可读指令在计算机上运行时，使得如第一方面至第三方面以及任一种可能实现方式所述的方法被执行。
第七方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得如第一方面至第三方面及任一种可能的实现方式所述的方法被执行。
附图说明
图1为本申请实施例所能够适用的网络架构示意图；
图2为本申请实施例提供的二次鉴权流程示意图；
图3为本申请实施例提供的UPF UL CL的分流架构示意图；
图4为本申请实施例提供的一种接入控制方法的流程示意图；
图5为本申请实施例提供的一种接入控制方法的流程示意图；
图6为本申请实施例提供的一种接入控制方法的流程示意图；
图7为本申请实施例提供的一种接入控制方法的流程示意图；
图8为本申请实施例提供的一种接入控制方法的流程示意图；
图9为本申请实施例提供的一种通信装置结构示意图；
图10为本申请实施例提供另一种通信装置结构示意图。
具体实施方式
本申请实施例提供的接入控制方法可以应用于无线通信系统中，例如5G通信系统或未来的通信系统。图1示例性的提供了一种本申请实施例所适用的无线通信系统架构示意图，该系统架构可以包括以下单元或设备：
终端设备，也可以称为终端、用户设备(user equipment，UE)、移动台、移动终端等。终端设备可以广泛应用于各种场景，例如，设备到设备(device-to-device，D2D)、车物(vehicle to everything，V2X)通信、机器类通信(machine-type communication，MTC)、物联网(internet of things，IOT)、虚拟现实、增强现实、工业控制、自动驾驶、远程医疗、智能电网、智能家具、智能办公、智能穿戴、智能交通、智慧城市等。终端设备可以是手机、平板电脑、带无线收发功能的电脑、可穿戴设备、车辆、无人机、直升机、飞机、轮船、机器人、机械臂、智能家居设备等。本申请的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
RAN，用于实现无线有关的功能。无线接入网又可称为接入网设备或基站，用于将终端设备接入到无线网络。所述无线接入网可以是基站(base station)、LTE系统或演进的LTE 系统(LTE-Advanced，LTE-A)中的演进型基站(evolved NodeB，eNodeB)、5G通信系统中的下一代基站(next generation NodeB，gNB)、发送接收点(transmission reception point，TRP)、基带单元(base band unit，BBU)、WiFi接入点(access point，AP)、未来移动通信系统中的基站或WiFi系统中的接入节点等。无线接入网也可以是完成基站部分功能的模块或单元，例如，可以是集中式单元(central unit，CU)，或者分布式单元(distributed unit，DU)。本申请实施例对无线接入网所采用的具体技术和具体设备形态不作限定。例如，在一种网络结构中，无线接入网可以为CU节点、或DU节点、或为包括CU节点和DU节点的无线接入网。具体的，CU节点用于支持无线资源控制(radio resource control，RRC)、分组数据汇聚协议(packet data convergence protocol，PDCP)、业务数据适配协议(service data adaptation protocol，SDAP)等协议；DU节点用于支持无线链路控制(radio link control，RLC)层协议、媒体接入控制(medium access control，MAC)层协议和物理层协议。
核心网可包括以下网元中的一个或多个：接入与移动性管理功能(access and mobility management function，AMF)网元、会话管理功能网元(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、应用功能(application function，AF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元。需要说明的是，5G网络中包括并不限于以上提到的一个或多个网元。
AMF：主要用于移动网络中的终端的附着和移动性管理，此外，还负责在UE与PCF间传递用户策略。
SMF：主要用于移动网络中的会话管理，如会话建立、修改、释放；PCF下发控制策略的执行；选择提供报文转发功能的UPF；为终端分配互联网协议(internet protocol，IP)地址等。
UPF：主要负责对用户报文进行处理，如转发、计费、合法监听等。用户面网元也可以称为PDU会话锚点(PDU session anchor，PSA)。
AF：主要用于传递应用侧对网络侧的需求，例如，QoS需求、计费策略需求、路由策略需求、用户状态事件订阅等。AF可以是第三方功能实体，也可以是运营商部署的应用服务，如IMS语音呼叫业务。对于第三方应用的应用功能实体，其与核心网进行交互时还可经由NEF进行授权处理，例如AF直接向NEF发送请求消息，NEF判断该AF是否被允许发送该请求消息，若验证通过，则将转发该请求消息至对应PCF或UDM。
PCF：主要负责针对会话、业务流级别进行计费、QoS带宽保障及移动性管理、UE策略决策等策略控制功能。AMF、SMF所连接的PCF分别对应AM PCF(PCF for Access and Mobility Control)和SM PCF(PCF for Session Management)，在实际部署场景中，AM PCF与SM PCF可以相同的PCF实体，也可以是不同的PCF实体。
UDM：主要负责管理签约数据、用户接入授权等功能。
UDR：统一数据仓库。主要负责签约数据、策略数据、应用数据等类型数据的存取功能。
DN：为终端提供数据传输服务，可以是公用数据网(public data network，PDN)网络，如因特网(internet)等，也可以是本地接入数据网络(local access data network，LADN)，如园区DN等。
以上“网元”也可以称为“实体”或“装置”，本申请并不做限制。在实际部署中， 网元可以合设，当两个网元合设的时候，本申请实施例提供的这两个网元之间的交互就成为该合设网元的内部操作或者可以省略。
应当理解，图1以5G通信系统为例，示例性的提供了本申请实施例所能够适用的网络架构，实际应用的网络架构可以包括比图1所示更多或更少的网元。或者，本申请实施例也可以应用为未来的通信系统中。
PDU会话，是UE与DN之间实现PDU连通性的会话服务，由PDU会话ID标识。当终端设备请求建立PDU会话时，运营商可以以DNN/S-NSSAI为粒度配置二次鉴权指示，用于触发SMF在PDU会话建立过程中向数据网络认证、授权、计费服务器(DN-authentication、authorization、accounting，DN-AAA)发起鉴权流程，以验证是否允许UE接入该DNN/S-NSSAI。
具体的，二次鉴权的过程可以如图2所示，包括以下流程：
1、SMF在接收到UE发送的PDU会话建立请求后，SMF与UPF之间执行会话建立(session establishment)流程。
2、SMF根据本地配置信息或者UDM发送的签约指示信息确定触发二次鉴权，通过UPF向DN-AAA发送认证授权请求(authentication/authorization request)。
在二次鉴权过程中，DN需要经由UPF、SMF与UE之间进行可扩展的身份验证协议(extensible authentication protocol，EAP)消息的交互，以获取二次鉴权所需信息。具体可以包括：
3a、DN-AAA通过UPF向SMF发送认证授权响应(authentication/authorization response)。
3b、SMF与AMF进行电文传输，以指示AMF向UE指示上传二次鉴权所需信息。
3c、AMF通过RAN向UE发送认证消息(authentication message)。
3d、UE通过RAN向AMF回复认证消息，该认证消息中包含有二次鉴权所需的信息。
3e、AMF向SMF发送PDU会话上下文更新(PDUsession_updateSMcontext)消息。
3f、SMF通过UPF向DN-AAA发送认证授权请求。
4、DN-AAA通过UPF向SMF返回认证授权响应，包含有认证通过或认证失败的指示信息。
5、若认证通过，则SMF继续执行PDU会话建立流程。
6、可选的，SMF通过UPF向DN-AAA发送IP地址通知。
若DN-AAA返回认证授权响应指示认证失败，则SMF将发送PDU会话建立失败消息至UE。
为了降低业务接入的时延，运营商可以在应用接入点附近部署UPF，以使得用户可以就近接入应用服务。如图3所示，UPF上行分类器(uplink classifier，UL CL)将本地业务(如园区内部使用的业务，或服务商部署的下沉业务)与正常的业务区分开来，并分别通过主锚点UPF(UPF PDU session anchors 1)、辅锚点UPF(UPF PDU session anchors 2)，送达给中心DN或园区DN。基于UL CL的分流方式，对于使用网络的用户而言，较大幅度提升了便捷性。在上述分流过程中，UE并不会有所感知，由SMF基于UE所在位置、当前所发起的业务类型、园区业务匹配信息等确定是否接入园区DN。
终端接入园区DN可能需要执行二次鉴权流程。然而，目前的针对一个终端的二次鉴权流程仅被允许执行一次，这就使得终端在被拒绝接入园区DN时，则无法继续发起公网业务。例如，运营商对于校园网注册终端，可以通过上述UL CL UPF架构允许终端在接入 校园网的同时接入公网业务；SMF在接收到终端A的会话建立请求后，可以基于终端A的位置信息、终端A的签约信息，或是本地配置信息等确定向校园网的鉴权服务器发起二次鉴权，若终端A并没有在校园网注册，或者由于其他原因导致终端A在校园网鉴权失败，将导致其被拒绝接入校园网。但由于针对一个终端的二次鉴权流程仅被允许执行一次，因此，终端A所发起的PDU会话建立请求被拒绝后，也无法继续发起公网业务。
有鉴于此，本申请实施例提供一种接入控制方法，应用于二次鉴权过程中，以解决终端接入园区DN失败则无法接续接入公网DN的问题。
该方法可以应用于图1、图3所示的网络架构中，但本申请实施例并不限定与仅适用于5G通信系统中，本申请实施例还可以应用于4G通信系统或未来的通信系统。下面以5G通信系统进行举例说明。
参见图4，为本申请实施例提供的接入控制方法的流程示意图，如图所示，该方法可以包括以下步骤：
步骤401、SMF接收来自终端发送的会话建立请求。
具体的，终端可以向AMF发送会话建立请求，由AMF选择SMF，然后将终端的会话建立请求发送给SMF。终端发送的会话建立请求可以为PDU会话建立请求，用于建立PDU会话。请求建立的PDU会话可以包括基于IP的PDU会话(例如IPv4、IPv6等)，也可以是以太类型的PDU会话，即用户地址对应的是MAC地址，本发明对此不作限定。
终端发送的会话建立请求中，可能包含有其请求接入网的DNN或S-NSSAI的标识，那么SMF可以根据会话建立请求中包含的DNN标识确定终端请求接入的DN。或者，终端发送的会话建立请求中，也可以不包含有DNN，即终端无需确定请求接入的DN，由SMF确定。
SMF在接收到会话建立请求之后，还可以向UDM请求获取终端的签约数据。可选的，该签约数据中可以包含有需要对终端进行二次鉴权的指示信息，那么SMF确定为终端发起二次鉴权。或者，SMF也可以根据本地配置信息确定需要发起二次鉴权。
步骤402、SMF根据会话建立请求确定向园区服务器发送鉴权请求。
所述园区服务器是用于对用户接入请求进行鉴权/授权的服务器，可以基于用户身份标识和/或认证信息决策允许或拒绝用户所发起的接入请求，即返回鉴权成功/失败响应至SMF。
这里的园区服务器可以是园区DN-AAA。园区服务器可能在园区内部署，也可与运营商网络集中部署，本发明对此不做限定。
可选的，当SMF接收到的会话建立请求中包含有DNN标识时，SMF可以向DNN标识对应的园区服务器发送鉴权请求，即该DNN为园区业务所对应的DNN。当SMF接收到的会话建立请求中不包含有DNN标识时，那么SMF可以根据终端的位置信息、终端的签约信息或者根据SMF本地配置信息确定终端请求接入园区DN，则向该园区DN对应的园区服务器发送鉴权请求；或者，SMF也可以根据终端请求建立会话的业务信息，确定终端请求为园区业务建立会话，则SMF也可以确定向园区服务器发送鉴权请求。
又或者，即使会话建立请求中包含的为公网DN的标识，SMF也可以根据终端的位置信息、终端的签约信息、SMF本地配置信息或会话请求的业务信息，确定向园区服务器发送鉴权请求。
具体的，SMF向园区服务器发送鉴权请求时，可以通过UPF转发，即SMF将鉴权请 求发送给UPF，由UPF将鉴权请求转发至相应的园区服务器。
步骤403、园区服务器确定终端是否被允许接入园区DN。
具体的，园区服务器可以获取终端的鉴权信息从而对终端进行鉴权，确定是否允许其接入园区DN。例如，园区服务器可以通过UPF、SMF、AMF与终端进行EAP消息交互，如图2中的步骤3a至步骤3f所示，从而获取对终端进行鉴权所需的信息。
若园区服务器确定允许终端接入园区DN，则园区服务器向SMF发送鉴权成功响应消息。可选的，该消息中可以包括园区DN授权文件索引(DN authorization profile index)，用于索引至SMF或PCF上所配置的策略规则，还可以包含有园区DN授权会话聚合最大比特速率(DN authorized session AMBR)参数等，以使SMF依照已有的流程为终端建立会话，使得终端能够基于建立的会话获取园区业务服务。
当园区服务器确定终端不被允许接入园区DN时，则执行步骤404。
步骤404、园区服务器向SMF发送鉴权失败响应消息。
园区服务器发送的鉴权失败响应消息，以指示拒绝该终端接入园区DN。可选的，鉴权失败响应消息中可以包含有鉴权失败的原因等信息。
步骤405、SMF在确定接受终端的会话建立请求时，向PCF发送策略关联建立请求。
在一种可能的设计中，SMF本地配置有终端的策略信息，指示即使二次鉴权失败仍允许为终端建立会话。
在另一种可能的设计，SMF可以在上述步骤401之后从UDM获取终端的签约数据，而获取到的签约数据中，包含有错误处理指示信息，该错误处理指示信息用于指示即使该终端二次鉴权失败也被允许建立会话。
SMF基于本地配置的策略信息或获取到的签约数据，确定接受终端的会话建立请求，继续执行为终端建立会话的流程，向PCF发送策略关联建立请求，该请求中可以包含有终端会话的ID，以请求获取终端会话的策略规则。
可选的，SMF向PCF发送的策略关联建立请求中，可以包含有用于指示终端被拒绝接入园区DN的指示信息，以使PCF不要发送关于园区的策略规则。
步骤406、PCF向SMF发送策略关联建立响应。
PCF向SMF发送的策略关联建立响应中，包含有PCF为终端确定的会话策略规则，例如QoS控制策略、门控策略、流转发策略、计费策略等。
如前所述，SMF发送的策略关联建立请求中可以包含有终端被拒绝接入园区DN的指示信息，那么PCF则不向SMF发送关于该园区DN的策略规则，可以发送公网的策略规则。
或者，若PCF接收到的策略关联建立请求中，未包含有终端被拒绝接入园区DN的指示信息，那么PCF可以将园区DN的策略规则以及公网DN的策略规则都发送给SMF。
示例性的，园区DN的策略规则可以包括园区业务对应的数据网络接入点标识(data network access identifier，DNAI)、园区业务对应的路由信息、园区业务对应的策略计费规则等。
步骤407、SMF根据策略关联建立响应中的策略规则为终端的会话执行策略规则。
若SMF在步骤405中将终端被拒绝接入园区DN的指示信息发送给PCF，那么SMF接收到的策略关联建立响应中不包含有园区策略规则，那么SMF可以直接基于策略关联建立响应中携带的策略规则对会话执行策略规则。
若SMF没有将终端被拒绝接入园区DN的指示信息发送给PCF，那么PCF接收到的策略关联建立响应中则可能包含有园区DN的策略规则。在这种情况下，SMF需要判断接收到的策略规则中，哪些是园区DN的策略规则，哪些是公网DN的策略规则，执行公网DN策略规则，拒绝执行园区DN策略规则。具体地，SMF可以基于策略规则中的流描述信息确定策略规则是否是园区DN策略规则，例如，流描述信息中的应用标识为园区应用，或者流描述信息中的IP五元组信息包含园区地址段等信息，则可以确定该策略规则为园区DN策略规则。可选地，SMF也可基于策略规则中的DNAI接入点信息确定该规则为园区策略规则，例如，若策略规则中包含园区业务所对应的DNAI接入点，或是包含园区业务所对应的分流目的地址段等，则可以判断该策略规则为园区策略规则。
可选的，SMF还可以向PCF发送园区DN策略执行失败的指示信息，或是，SMF也可以向PCF发送策略执行响应消息，并在该消息中携带执行失败的原因值，以指示当前终端不支持接入园区业务。
步骤408、SMF向终端发送会话建立响应消息。
SMF在为终端的会话执行相应策略规则之后，可以向终端发送会话建立响应。具体的，SMF可以通过AMF将会话建立响应消息发送给终端。
在一种可能的实现方式中，本申请上述实施例中的接入控制方法，也可以应用于终端二次鉴权结果修改的过程中。
例如，终端原本是被允许接入园区DN的，则终端在先执行的二次鉴权过程的结果为鉴权成功；但是，园区服务器接收到了针对该终端的信息删除指示，那么园区服务器可以向SMF发送鉴权结果失效的信息。SMF可以根据鉴权结果失效的信息，向PCF发送策略关联更新请求，该更新请求中可以包括终端被拒绝接入园区DN的指示信息，进而从PCF获取到更新后的策略规则以使得终端无法继续接入园区业务；或者，SMF也可以从已执行的策略规则中删除园区DN策略规则，以实现拒绝终端继续接入园区业务。
又例如，终端原本不被允许接入园区DN，则终端在先执行的二次鉴权过程的结果为鉴权失败；在上述步骤408之后，园区服务器接收到了针对该终端的合法身份认证信息，或是更新后的鉴权信息，园区服务器也可以主动向SMF发送鉴权成功的信息，SMF可以根据鉴权成功的信息向PCF发送策略关联更新请求，以获取园区DN的策略规则，然后SMF可以为终端的会话执行园区DN的策略规则。
在传统的二次鉴权过程中，由于针对一个终端二次鉴权仅被执行一次时，若终端在二次鉴权过程中被拒绝接入园区DN则无法继续接入公网DN，发起公网业务。而在本申请上述方法实施例中，SMF在为终端建立会话的过程中，虽然在二次鉴权时终端被园区DN拒绝接入，但SMF仍允许终端继续建立会话，只是拒绝为终端关联园区DN相关的策略规则，但仍可以为终端执行公网DN的相关策略规则，从而使得终端被拒绝接入园区DN，不能发起园区业务，但仍能够发起公网业务，解决了终端接入数据网络的合法需求。
为了更加清楚理解本申请上述实施例的操作流程，下面结合附图5、附图6进行举例说明。
参见图5所示的具体实施例，接入控制方法可以包括以下步骤：
步骤501、终端发送会话建立请求至SMF。
具体的，终端可以将会话建立请求先发送给AMF，然后由AMF将会话建立请求发送给SMF。
步骤502、SMF从UDM获取终端的签约数据。
其中，获取到的签约数据中包括用于指示需要进行二次鉴权的指示信息(secondary authentication indication)，以及错误处理指示(error handling indication)。错误处理指示表示即使终端二次鉴权失败也允许终端建立会话。
可选的，SMF从UDM中获取到的签约数据中也可以不包括错误处理指示，SMF也可以本地配置有终端的错误处理指示信息。
步骤503、SMF通过UPF向园区DN发送认证授权请求(authentication/authorization request)。该认证授权请求即为前述实施例中的鉴权请求。
可选的，园区DN通过UPF、SMF与UE之间的EAP消息交互，对终端进行二次鉴权。例如，二次鉴权的过程可以如图2中步骤3a至步骤3f所示。
步骤504、园区服务器确定终端二次鉴权失败，拒绝终端接入园区DN。
步骤505、园区服务器通过UPF向SMF发送认证授权响应(authentication/authorization response)。该认证授权响应指示鉴权失败，拒绝终端接入园区DN。该认证授权响应即为前述实施例中的鉴权失败响应消息。
步骤506、SMF向PCF发送策略关联建立请求，该请求中包括终端被拒绝接入园区DN的指示信息。
步骤507、PCF基于终端被拒绝接入园区DN的指示信息，确定终端建立会话的策略规则。
步骤508、PCF向SMF发送策略关联建立响应，该响应中包括步骤507中PCF确定出的策略规则。
步骤509、SMF执行PCF发送的策略规则，向终端发送会话建立响应。
图6也实例性的提供了一种接入控制方法，如图6所示，该方法可以包括以下步骤：
步骤601～步骤605，与步骤501～步骤505类似，此处不再重复。
步骤606、SMF向PCF发送策略关联建立请求。
与前述实施例中步骤506的区别在于，步骤506中需要携带用于指示终端被拒绝接入园区DN的指示信息，而步骤606中可以不携带用于指示终端被拒绝接入园区DN的指示信息。
步骤607、PCF向SMF发送策略关联建立响应。
由于PCF没有获取到终端被拒绝接入园区DN的指示信息，因此PCF发送的策略关联建立响应中，会包含有园区DN的策略规则。
步骤608、SMF执行非园区DN策略规则，不执行园区DN策略规则。
步骤609、SMF向PCF发送园区DN策略执行失败的指示信息。
步骤610、SMF向终端发送会话建立响应。
本申请实施例还提供了一种接入控制方法，该方法也能够解决终端接入园区DN失败则无法接续接入公网DN的问题。该方法与前述实施例的区别在于，当终端被拒绝接入园区DN时，前述实施例由SMF根据获取到的签约信息或本地配置信息确定是否继续为终端建立会话，而该方法实施例可以由DN来确定。
参见图7，为本申请实施例提供的接入控制方法的流程示意图，如图所示，该方法可以包括以下流程：
步骤701、SMF向园区服务器发送鉴权请求。
该鉴权请求中包括请求接入园区DN的终端的标识，以使园区服务器对该终端进行鉴权。
步骤702、园区服务器确定拒绝该终端接入园区DN。
具体的，园区服务器可以获取终端的鉴权信息对终端进行鉴权，确定是否允许其接入园区DN。例如，园区服务器可以通过UPF、SMF、AMF与终端进行EAP消息交互，如图2中的步骤3a至步骤3f所示，从而获取对终端进行鉴权所需的信息。
园区服务器根据获取到的鉴权信息确定终端并非该园区DN的合法注册终端，或者由于其他原因导致鉴权失败，故拒绝该终端接入园区DN。
步骤703、园区服务器向SMF发送鉴权响应，该鉴权响应用于指示鉴权成功但拒绝该终端接入园区DN。
园区服务器可以根据获取到的终端的鉴权信息，确定即使拒绝终端接入园区DN但仍允许该终端建立会话；或者，园区服务器也可以根据本地配置的信息，确定即使拒绝终端接入园区DN但仍允许该终端建立会话。
可选的，园区服务器发送的鉴权成功响应中，可以携带有授权文件索引(DN authorization profile index)，用于索引至SMF或PCF上所配置的策略信息。当园区服务器拒绝终端接入园区DN时，那么该授权文件索引则不能索引至园区DN的策略规则，而应当索引至非园区DN的策略规则。因此，该授权文件索引，可以作为用于指示拒绝该终端接入园区DN的一种指示信息。或者，该授权文件索引，也可以直接用于指示拒绝终端接入园区DN。
或者，园区服务器也可以通过在鉴权响应中设置新的字段，以指示虽然鉴权成功但拒绝终端接入园区DN。
步骤704、SMF根据接收到的鉴权响应，向PCF发送策略关联建立请求。
SMF在接收到鉴权响应后，由于鉴权响应指示鉴权成功，SMF则PCF发送策略关联建立请求，从而获取终端会话的策略规则。
可选的，SMF可以将接收到的鉴权响应中的授权文件索引携带在向PCF发送的策略关联建立请求中。PCF根据该授权文件索引可以确定需要发送的策略规则，进一步的，PCF能够根据该授权文件索引没有索引至园区DN策略规则，从而指示PCF该终端被拒绝接入园区DN；或者，该授权文件索引也可以用于明确指示不允许终端接入园区DN，那么PCF根据该授时文件索引选择非园区DN策略规则。在该过程中，SMF可以对终端被拒绝接入园区DN的事件不进行感知，由于SMF接收到的为鉴权成功的响应消息，故SMF与正常情况下为终端建立会话的流程一致，根据授权文件索引向PCF发送策略关联建立请求；而PCF根据授权文件索引发送的策略规则不包含园区DN的策略规则，故SMF即使不知道终端被拒绝接入园区DN，也不会为该终端的会话执行园区DN策略规则。
或者，若DN通过其他指示信息指示拒绝终端接入园区DN，SMF可以根据该指示信息确定终端被拒绝接入园区DN，那么SMF可以参照图4所示实施例中的操作，由SMF指示PCF终端被拒绝接入园区DN；或者，SMF也可以不指示PCF终端被拒绝接入园区DN，SMF在接收到策略规则后执行非园区DN的策略规则，不执行园区DN的策略规则。
步骤705、SMF根据从PCF获取到的策略规则为终端建立会话。
在传统的二次鉴权过程中，由于针对一个终端二次鉴权仅被执行一次时，若终端在二 次鉴权过程中被拒绝接入园区DN则无法继续接入公网DN，发起公网业务。而在本申请上述方法实施例中，园区服务器在对终端进行二次鉴权时，可以根据本地配置的信息或者根据获取到的终端鉴权信息确定，即使拒绝终端接入园区DN但仍允许该终端建立会话，则向SMF发送鉴权成功但拒绝终端接入园区DN的鉴权响应，从而使得SMF、PCF能够为终端配置非园区DN的策略规则，使得终端仍可以为接入公网DN，发起公网业务，解决了终端接入数据网络的合法需求。
在另一种可能的实现方式中，园区服务器向SMF发送的鉴权响应，也可以仅指示鉴权成功，不指示拒绝终端接入园区DN，然后园区服务器可以向PCF发送指示信息，以指示PCF不要为该终端提供园区DN策略规则。图8示例性的提供该实现方式下的流程示意图，如图所示，包括：
步骤801～步骤804，与步骤501～步骤504类似，此处不再赘述。
步骤805、园区服务器通过UPF向SMF发送认证授权响应，该响应指示鉴权成功。
步骤806、SMF向PCF发送策略关联建立请求。
步骤807、PCF向SMF发送策略关联建立响应。
步骤808、SMF向终端发送会话建立响应。
步骤809、园区服务器向PCF发送策略授权请求消息(policy authorization create request)，该策略授权请求消息用于请求PCF停止为终端提供园区DN策略规则。
步骤810、PCF向SMF发送策略关联更新消息，该消息中不携带园区DN策略规则。
步骤811、SMF根据策略关联更新消息中的策略规则，为终端会话更新关联的策略规则。
图9为根据本申请实施例提供的一种通信装置的示意图。通信装置包括处理模块901、收发模块902。处理模块901用于实现通信装置对数据的处理。收发模块902用于执行上述方法实施例中的信息收发处理。应理解，本申请实施例中的处理模块901可以由处理器或处理器相关电路组件(或者，称为处理电路)实现，收发模块902可以由接收器或接收器相关电路组件、发送器或发送器相关电路组件实现。
示例性地，通信装置可以是通信装置设备，也可以是应用于通信装置设备中的芯片或者其他具有上述通信装置设备功能的组合器件、部件等。
当该通信装置为会话管理功能网元SMF时，收发模块902用于接收终端发送的会话建立请求，处理模块901用于根据所述请求确定通过收发模块902向园区服务器发送鉴权请求；收发模块902还用于接收所述园区服务器发送的鉴权失败响应消息；处理模块901还用于在确定接受所述会话建立请求时，通过收发模块902向策略控制功能网元PCF发送策略关联建立请求，并接收所述PCF发送的策略关联建立响应；处理模块901还用于根据所述策略关联建立响应中的策略规则为所述终端的会话执行策略规则；收发模块902还用于向所述终端发送会话建立响应消息。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中SMF所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
当该通信装置为策略控制功能网元PCF时，收发模块902用于接收终端接入园区数据网络DN鉴权失败的指示信息；处理模块901用于根据所述指示信息通过收发模块902向SMF发送策略关联消息，所述策略关联消息中包括非所述园区DN策略规则，不包括所述 园区DN的策略规则。
可选的，收发模块902在接收终端接入园区DN鉴权失败的指示信息时，具体用于：接收会话管理功能网元SMF发送的策略关联建立请求，所述策略关联建立请求中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为所述策略关联建立请求的响应消息。
可选的，收发模块902在接收终端接入园区DN鉴权失败的指示信息时，具体用于：接收园区服务器发送的策略授权请求消息，所述策略授权请求消息中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为向SMF发送策略关联更新消息，以指示所述终端更新后的会话策略规则包括所述公网DN策略规则，不包括所述园区DN策略规则。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中PCF所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
当该通信装置为园区服务器时，收发模块902用于接收来自会话管理功能网元SMF发送的鉴权请求，所述鉴权请求中包括请求接入所述园区数据网络DN的终端的标识；处理模块901用于确定拒绝所述终端接入所述园区DN；收发模块902还用于向所述SMF发送鉴权响应，所述鉴权响应用于指示鉴权成功但拒绝所述终端接入所述园区DN。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中园区服务器所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
图10为根据本申请实施例提供的另一种通信装置的示意图。该通信装置包括如图10所示的处理器1001，以及与处理器1001连接的通信接口1002。
处理器1001可以是通用处理器，微处理器，特定集成电路(application specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件，分立门或者晶体管逻辑器件，或一个或多个用于控制本申请方案程序执行的集成电路等。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
通信接口1002，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如RAN等。
在本申请实施例中，处理器1001用于调用通信接口1002执行接收和/或发送的功能，并执行如前任一种可能实现方式所述的用户面功能容灾方法。
进一步的，该通信装置还可以包括存储器1003以及通信总线1004。
存储器1003，用于存储程序指令和/或数据，以使处理器1001调用存储器1003中存储的指令和/或数据，实现处理器1001的上述功能。存储器1003可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1003可以是独立存在，例如片外存储器，通过通信总线1004与处理器1001相连接。存储器1003也可以和处理器1001集成在一起。
通信总线1004可包括一通路，在上述组件之间传送信息。
当该通信装置为会话管理功能网元SMF时，处理器1001通过通信接口1002执行：接收终端发送的会话建立请求，根据所述请求确定向园区服务器发送鉴权请求；接收所述园区服务器发送的鉴权失败响应消息；在确定接受所述会话建立请求时，向策略控制功能网元PCF发送策略关联建立请求，并接收所述PCF发送的策略关联建立响应；根据所述策略关联建立响应中的策略规则为所述终端的会话执行策略规则；向所述终端发送会话建立响应消息。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中SMF所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
当该通信装置为策略控制功能网元PCF时，处理器1001通过通信接口1002执行：接收终端接入园区数据网络DN鉴权失败的指示信息；根据所述指示信息向SMF发送策略关联消息，所述策略关联消息中包括非所述园区DN策略规则，不包括所述园区DN的策略规则。
可选的，处理器1001通过通信接口1002，在接收终端接入园区DN鉴权失败的指示信息时，具体用于：接收会话管理功能网元SMF发送的策略关联建立请求，所述策略关联建立请求中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为所述策略关联建立请求的响应消息。
可选的，处理器1001通过通信接口1002，在接收终端接入园区DN鉴权失败的指示信息时，具体用于：接收园区服务器发送的策略授权请求消息，所述策略授权请求消息中包括终端接入园区DN鉴权失败的指示信息；所述策略关联消息为所述PCF向SMF发送策略关联更新消息，以指示所述终端更新后的会话策略规则包括所述公网DN策略规则，不包括所述园区DN策略规则。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中PCF所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
当该通信装置为园区服务器时，处理器1001通过通信接口1002执行：接收来自会话管理功能网元SMF发送的鉴权请求，所述鉴权请求中包括请求接入所述园区数据网络DN的终端的标识；确定拒绝所述终端接入所述园区DN；向所述SMF发送鉴权响应，所述鉴权响应用于指示鉴权成功但拒绝所述终端接入所述园区DN。
此外，上述各个模块还可以用于支持图4至图8所示实施例及其任一实现方式中园区服务器所执行的其它过程。有益效果可参考前面的描述，此处不再赘述。
基于相同的技术构思，本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机可读指令，当所述计算机可读指令在计算机上运行时，使得如前所述任一种可能的实现方式所述的接入控制方法被执行。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得上述方法实施例被执行。
本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。本申请中所涉及的多个，是指两个或两个以上。
另外，需要理解的是，在本申请的描述中，“第一”、“第二”、“第三”等词汇，仅用于 区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。在本说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
本申请实施例提供了一种计算机可读存储介质，存储有计算机程序，该计算机程序包括用于执行上述方法实施例的指令。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述方法实施例。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (16)

  1. 一种接入控制方法，其特征在于，所述方法包括：
    会话管理功能网元SMF接收来自终端的会话建立请求；
    所述SMF根据所述会话建立请求向园区服务器发送鉴权请求；
    所述SMF接收来自所述园区服务器的鉴权失败响应消息；
    在所述SMF确定接受所述会话建立请求时，所述SMF向策略控制功能网元PCF发送策略关联建立请求，并接收来自所述PCF的策略规则，所述策略规则为非园区的策略规则，所述策略规则用于所述终端的会话的建立。
  2. 根据权利要求1所述的方法，其特征在于，在SMF接收来自鉴权服务器的鉴权失败响应消息之前，所述方法还包括：
    所述SMF从统一数据管理网元UDM获取所述终端的签约信息，所述签约信息中包括错误处理指示信息，用于指示当所述终端鉴权失败时仍接受所述终端的会话建立请求；
    所述SMF确定接受所述会话建立请求，包括：
    所述SMF根据所述错误处理指示信息确定接受所述会话建立请求。
  3. 根据权利要求1所述的方法，其特征在于，所述SMF确定接受所述会话建立请求，包括：
    所述SMF根据本地预配置信息确定接受所述会话建立请求。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述策略关联建立请求中包括用于指示所述终端接入所述园区数据网络DN失败的指示信息，以使所述PCF发送的策略关联响应中不包括所述园区DN的策略规则。
  5. 根据权利要求1-3任一项所述的方法，其特征在于，所述策略关联建立响应中包括园区DN的策略规则；
    所述方法还包括：
    所述SMF不执行所述园区DN的策略规则；
    所述SMF向所述PCF发送园区DN策略规则执行失败的指示信息。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述SMF根据所述请求确定向园区服务器发送鉴权请求，包括：
    所述SMF根据所述终端的位置信息、所述终端的签约信息或所述SMF本地配置信息，确定向园区服务器发送鉴权请求。
  7. 一种接入控制方法，其特征在于，所述方法包括：
    策略控制功能网元PCF接收终端接入园区数据网络DN鉴权失败的指示信息；
    所述PCF根据所述指示信息向SMF发送策略关联消息，所述策略关联消息中包括非所述园区DN策略规则，不包括所述园区DN的策略规则。
  8. 根据权利要求7所述的方法，其特征在于，所述PCF接收终端接入园区DN鉴权失败的指示信息，包括：
    所述PCF接收会话管理功能网元SMF发送的策略关联建立请求，所述策略关联建立请求中包括终端接入园区DN鉴权失败的指示信息；
    所述策略关联消息为所述策略关联建立请求的响应消息。
  9. 根据权利要求7所述的方法，其特征在于，所述PCF接收终端接入园区DN鉴权失 败的指示信息，包括：
    所述PCF接收园区服务器发送的策略授权请求消息，所述策略授权请求消息中包括终端接入园区DN鉴权失败的指示信息；
    所述策略关联消息为所述PCF向SMF发送策略关联更新消息，以指示所述终端更新后的会话策略规则包括所述公网DN策略规则，不包括所述园区DN策略规则。
  10. 一种接入控制方法，其特征在于，所述方法包括：
    园区服务器接收来自会话管理功能网元SMF鉴权请求，所述鉴权请求中包括请求接入所述园区数据网络DN的终端的标识；
    所述园区服务器确定拒绝所述终端接入所述园区DN；
    所述园区服务器向所述SMF发送鉴权响应，所述鉴权响应用于指示鉴权成功但拒绝所述终端接入所述园区DN。
  11. 根据权利要求10所述的方法，其特征在于，所述鉴权响应中包括授权文件索引信息，以使所述SMF将所述授权文件索引信息发送给策略控制功能网元PCF，所述授权文件索引信息用于指示拒绝所述终端接入所述园区DN。
  12. 一种通信装置，其特征在于，所述通信装置包括：处理器，以及分别与所述处理器耦合的存储器和通信接口；所述通信接口，用于与其他设备进行通信；所述处理器，用于运行所述存储器内的指令或程序，通过所述通信接口执行如权利要求1-11中任一项所述的方法。
  13. 一种通信装置，其特征在于，包括用于执行如权利要求1-6，或者权利要求7-9，或者权利要求10-11任一项所述方法的单元。
  14. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1-11任一项所述的方法。
  15. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1-6，或者权利要求7-9，或者权利要求10-11任一项所述的方法。
  16. 一种系统，其特征在于，包括会话管理功能网元，策略控制功能网元和园区服务器，所述园区服务器用于执行如权利要求10-11任一项所述的方法，所述策略控制功能网元用于执行如权利要求7-9任一项所述的方法，所述会话管理功能网元用于执行如权利要求1-6任一项所述的方法。
PCT/CN2023/080458 2022-03-17 2023-03-09 一种接入控制方法及装置 WO2023174150A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210264265.7A CN116801351A (zh) 2022-03-17 2022-03-17 一种接入控制方法及装置
CN202210264265.7 2022-03-17

Publications (1)

Publication Number Publication Date
WO2023174150A1 true WO2023174150A1 (zh) 2023-09-21

Family

ID=88022230

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/080458 WO2023174150A1 (zh) 2022-03-17 2023-03-09 一种接入控制方法及装置

Country Status (2)

Country Link
CN (1) CN116801351A (zh)
WO (1) WO2023174150A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117041969B (zh) * 2023-09-28 2024-01-02 新华三技术有限公司 5g双域专网的接入方法、系统及装置、电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019017836A1 (zh) * 2017-07-20 2019-01-24 华为国际有限公司 一种会话处理方法及设备
WO2020145305A1 (ja) * 2019-01-10 2020-07-16 シャープ株式会社 Ｕｅ、及びｓｍｆ
US20210136589A1 (en) * 2017-06-19 2021-05-06 Sharp Kabushiki Kaisha User equipment, communication control method of user equipment, core network device, communication control method of core network, smf, communication control method of smf, upf, and communication control method of upf
CN113766500A (zh) * 2020-05-22 2021-12-07 华为技术有限公司 一种网络的接入方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210136589A1 (en) * 2017-06-19 2021-05-06 Sharp Kabushiki Kaisha User equipment, communication control method of user equipment, core network device, communication control method of core network, smf, communication control method of smf, upf, and communication control method of upf
WO2019017836A1 (zh) * 2017-07-20 2019-01-24 华为国际有限公司 一种会话处理方法及设备
WO2020145305A1 (ja) * 2019-01-10 2020-07-16 シャープ株式会社 Ｕｅ、及びｓｍｆ
CN113766500A (zh) * 2020-05-22 2021-12-07 华为技术有限公司 一种网络的接入方法、装置及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SAMSUNG: "TS 23.501: Additional DN authorization data", 3GPP DRAFT; S2-179357 WAS S7-178294 23.501 ADDITIONAL AUTHORIZATION DATA, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Reno, NV, USA; 20171127 - 20171201, 30 November 2017 (2017-11-30), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051365882 *

Also Published As

Publication number Publication date
CN116801351A (zh) 2023-09-22

Similar Documents

Publication Publication Date Title
AU2021209155B2 (en) Registration method, session establishment method, terminal, and amf entity
JP7263234B2 (ja) 通信のための方法、装置、システム、端末、およびアクセス・ネットワーク・デバイス
US20240179774A1 (en) Wireless Communications For Asymmetric Services
EP3637846B1 (en) Method and device for use in configuring novel quality of service architecture in dual connectivity system
JP2023506462A (ja) ネットワークスライスの制御
EP3829203A1 (en) Information transmission method and device, and computer readable storage medium
JP2020504559A (ja) Ｐｄｕセッション管理
US20220360977A1 (en) Communication related to change of application server
US20210168151A1 (en) Method for implementing user plane security policy, apparatus, and system
US20210385283A1 (en) Multimedia Priority Service
WO2021136211A1 (zh) 授权结果的确定方法及装置
KR20210024160A (ko) 통신 방법 및 장치
KR20200117003A (ko) Ssc 모드를 결정하는 방법 및 기기
US20230422016A1 (en) Network access method and apparatus
US20230388863A1 (en) Communication method and apparatus
US20240022952A1 (en) Resource Allocation in Non-Public Network
WO2022199451A1 (zh) 会话切换的方法和装置
WO2023174150A1 (zh) 一种接入控制方法及装置
CN113242585B (zh) 网络切换方法、装置、设备及介质
CN115915196A (zh) 一种链路状态检测方法、通信装置及通信系统
WO2017008402A1 (zh) 一种认证接入的方法、基站及终端
US20230126490A1 (en) Optimized security mode command procedure to reduce communication setup failures
CN115066971A (zh) 在uu和pc5之间的路径选择
CN114982284A (zh) 通信方法及装置
WO2023015973A1 (zh) 一种网络切片准入控制方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23769656

Country of ref document: EP

Kind code of ref document: A1