WO2023179397A1 - 一种授权方法及装置 - Google Patents

一种授权方法及装置 Download PDF

Info

Publication number
WO2023179397A1
WO2023179397A1 PCT/CN2023/081065 CN2023081065W WO2023179397A1 WO 2023179397 A1 WO2023179397 A1 WO 2023179397A1 CN 2023081065 W CN2023081065 W CN 2023081065W WO 2023179397 A1 WO2023179397 A1 WO 2023179397A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
network element
authorization
connection service
authorized
Prior art date
Application number
PCT/CN2023/081065
Other languages
English (en)
French (fr)
Inventor
许胜锋
朱方园
李濛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023179397A1 publication Critical patent/WO2023179397A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information

Definitions

  • the present application relates to the field of communication technology, and in particular, to an authorization method and device.
  • unified data management provides the UE's subscription data to the access and mobility management function (AMF).
  • the subscription data of the UE includes operation permission indication information, and the operation permission indication information is used to instruct the authorized UE to provide connection services or the unauthorized UE to provide connection services.
  • the AMF only sends a UE authorization indication or a UE non-authorization indication to the RAN based on the operation permission indication information, so that the RAN can control the UE's connection service.
  • the network only controls and manages the UE's connection services based on the operation permission indication information. For example, when the operation permission indication information is used to indicate that the UE is authorized to provide connection services, the UE can provide connection services at any location and at any time, causing the network to provide connection services to the UE. Less flexibility for control and management.
  • Embodiments of the present application provide an authorization method and device to flexibly and dynamically control and manage connection services provided by UE.
  • the first aspect provides an authorization method, including the following process: the access management network element obtains operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • the authorization conditions include the authorized location of the connection service. scope and/or authorization time range of connection services; the access management network element sends an authorization result to the access network element to which the terminal device is connected based on the authorization conditions.
  • the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal is allowed to The device provides connectivity services.
  • the access network element receives the authorization result, and then controls the connection service of the terminal device based on the authorization result.
  • the terminal device can perform corresponding operations according to the control of the access network element. For example, the terminal device can release resources used to provide connection services or provide connection services.
  • the access management network element only allows the terminal device to provide connection services at any location and at any time based on the operation permission indication information, which may result in poor flexibility in the network's control and management of connection services provided by the UE, and may also cause the terminal device to Cause interference to existing communications outside the authorized location range or authorized time range.
  • the access management network element in addition to the operation permission indication information, can also obtain authorization conditions. In this way, even if the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services, the access management network element can also obtain authorization conditions based on the authorization. Conditions, it is determined that the terminal device is not allowed to provide connection services, so that the connection services provided by the UE can be flexibly and dynamically controlled and managed to prevent the terminal device from providing services outside the authorized location range and/or authorized time range.
  • the access management network element may send the authorization result to the access network element based on the authorized location range and/or the authorized time range. More specifically, the access management network element may send the authorization result to the access network element based on the location of the terminal device and the authorized location range of the connection service, and/or the current time and the authorization time range of the connection service.
  • the access management network element can also send the authorization result to the terminal device.
  • the terminal device can receive the authorization result, and then perform corresponding operations based on the authorization result.
  • the authorization result is used to indicate that the terminal device is not allowed to provide connection services, and the terminal device can release resources used to provide connection services.
  • the authorization result is used to indicate that the terminal device is allowed to provide connection services, and the terminal device can provide connection services.
  • the terminal device can perform corresponding operations based on the control and/or authorization results of the access network element.
  • the access management network element when the access management network element sends the authorization result to the access network element to which the terminal device accesses according to the authorization conditions, the access management network element can use the authorization conditions (such as authorized location range and/or Authorization time range) determines the authorization result and sends the authorization result to the access network element.
  • the authorization conditions such as authorized location range and/or Authorization time range
  • the access management network element may determine the authorization result based on the location of the terminal device and the authorized location range of the connection service. As another example, the access management network element may determine the authorization result based on the current time and the authorized location range of the connection service.
  • the authorization condition includes an authorization time range for the connection service.
  • the access management network element determines the authorization result based on the authorization time range
  • the access management network element can determine that the authorization result is used to not allow the terminal device to provide connection services; when the current time is outside the authorization time range, Within the time range, the access management network element can determine the authorization result to allow the terminal device to provide connection services. In this implementation, interference to existing communications caused by the terminal device providing services outside the authorized time range can be avoided.
  • the authorization conditions include an authorized location range for the connection service.
  • the access management network element determines the authorization result based on the authorized location range
  • the access management network element can determine the authorization result to indicate that the terminal device is not allowed to provide connection services
  • the access management network element can determine the authorization result to indicate that the terminal device is allowed to provide connection services.
  • interference to existing communications caused by terminal equipment providing services outside the authorized location range can be avoided.
  • the terminal device can obtain the location of the terminal device from the positioning management network element, and determine whether the terminal device is outside the authorized location range or within the authorized location range based on the location of the terminal device and the authorized location range.
  • the authorization conditions include an authorized location range for the connection service.
  • the access management network element determines the authorization result based on the authorized location range, and when the terminal device is outside the authorized location range, the access management network element receives the notification information sent by the positioning management network element.
  • the notification information is used to notify the terminal device during authorization. Outside the location range, or within the authorized location range; when the notification information is used to notify the terminal device that it is outside the authorized location range, the access management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services; in the notification The information is used to notify the terminal device that when it is within the authorized location range, the access management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide connection services. In this implementation, interference to existing communications caused by terminal equipment providing services outside the authorized location range can be avoided.
  • the terminal device may send a request message to the location management network element to request whether the terminal device is outside the authorized location range or within the authorized location range.
  • the request message may include information about the authorized location range.
  • the authorization conditions include an authorized location range for the connection service.
  • the access management network element determines the authorization result based on the authorized location range, when the terminal device is outside the authorized location range, and when the tracking area where the terminal device is located is outside the tracking area corresponding to the authorized location range, the access management network
  • the meta-determination authorization result is used to indicate that the terminal device is not allowed to provide connection services; in the tracking area where the terminal device is located, it is in the authorized location.
  • the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services. In this implementation, interference to existing communications caused by terminal equipment providing services outside the authorized location range can be avoided.
  • the access management network element can obtain the tracking area range corresponding to the authorized location range from the network open network element.
  • connection service includes access backhaul integrated IAB service, and the terminal device is an IAB terminal device; or the connection service includes a vehicle relay VMR service, and the terminal device is a VMR device; or the connection service includes a relay service , the terminal device is a relay terminal device.
  • VMR can also be a mobile base station relay.
  • the authorized location range includes one or more of the following: authorized routes for connecting services, authorized areas for connecting services, areas that are allowed to provide connection services, or areas that are prohibited from providing connection services.
  • the authorized location range includes the authorized route of the connection service and the authorized area of the connection service.
  • the authorized location range includes areas that are allowed to provide connection services and areas that are prohibited from providing connection services.
  • an authorization method including the following process: the data management network element obtains operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • the authorization conditions include the authorized location range of the connection service. and/or the authorization time range of the connection service; the data management network element sends the authorization result to the access management network element according to the authorization conditions, and the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.
  • the data management network element when the data management network element sends the authorization result to the access management network element according to the authorization conditions, the data management network element can determine the authorization result (such as authorized location range and/or authorization time range) based on the authorization conditions. ), sending the authorization result to the access management network element.
  • the authorization result such as authorized location range and/or authorization time range
  • the data management network element can determine the authorization result based on the location of the terminal device and the authorized location range of the connection service. As another example, the data management network element can determine the authorization result based on the current time and the authorized location range of the connection service.
  • the authorization condition includes an authorization time range for the connection service.
  • the data management network element determines the authorization result based on the authorization time range
  • the data management network element can determine that the authorization result is used to not allow the terminal device to provide connection services; when the current time is within the authorization time range Within the time limit, the data management network element can determine the authorization result to allow the terminal device to provide connection services. In this implementation, interference to existing communications caused by the terminal device providing services outside the authorized time range can be avoided.
  • the authorization conditions include an authorized location range for the connection service.
  • the data management network element determines the authorization result based on the authorized location range
  • the data management network element can determine the authorization result to indicate that the terminal device is not allowed to provide connection services; when the terminal device is in the authorized location
  • the data management network element can determine the authorization result to indicate that the terminal device is allowed to provide connection services.
  • interference to existing communications caused by terminal equipment providing services outside the authorized location range can be avoided.
  • the terminal device can obtain the location of the terminal device from the gateway mobile location center, and determine whether the terminal device is outside the authorized location range or within the authorized location range based on the location of the terminal device and the authorized location range.
  • the authorization conditions include an authorized location range for the connection service.
  • the data management network element receives the notification information sent by the gateway mobile location center.
  • the notification information is used to notify the terminal device that it is outside the authorized location range, or is within the authorized location range. Within the range; when the notification information is used to notify the terminal device that it is outside the authorized location range, the data management network element determines the authorization result to indicate that the terminal device is not allowed to provide connection services; when the notification information is used to notify the terminal device that it is outside the authorized location range within the time limit, the data management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide connection services. In this implementation, interference to existing communications caused by terminal equipment providing services outside the authorized location range can be avoided.
  • the terminal device may send a request message to the gateway mobile location center to request whether the terminal device is outside the authorized location range or within the authorized location range.
  • the request message may include information about the authorized location range.
  • connection service includes an access backhaul integrated IAB service, and the terminal device is an IAB terminal device; or the connection service includes a vehicle relay VMR service, and the terminal device is a VMR device or a mobile base station relay (mobile base). station relay) equipment; or the connection service includes relay service, and the terminal equipment is a relay relay terminal equipment.
  • the authorized location range includes one or more of the following: authorized routes for connecting services, authorized areas for connecting services, areas that are allowed to provide connection services, or areas that are prohibited from providing connection services.
  • the authorized location range includes the authorized route of the connection service and the authorized area of the connection service.
  • the authorized location range includes areas that are allowed to provide connection services and areas that are prohibited from providing connection services.
  • an authorization method including the following process: the terminal device receives a first authorization result sent by the access management network element, and the first authorization result is used to indicate that the terminal device is not allowed to provide connection services; the terminal device performs the following steps according to the first authorization: As a result, resources used to provide connection services are released.
  • the access management network element can send an authorization result to the terminal device, indicating that the terminal device is not allowed to provide connection services, thereby preventing the terminal device from providing services outside the authorized location range and/or the authorized time range, causing damage to existing communications. interference.
  • the terminal device when releasing resources for providing connection services, releases the F1 interface, and the F1 interface is used for information transmission between the terminal device and the access network element.
  • the terminal device can also receive a second authorization result sent by the access management network element.
  • the second authorization result is used to indicate that the terminal device is allowed to provide connection services.
  • the terminal device can provide the connection service with the second authorization result.
  • the access management network element can instruct the terminal device to allow the terminal device to provide connection services, thereby ensuring business continuity and reliability.
  • an authorization method including the following process: a terminal device receives a connection control message sent by an access network element connected to the terminal device, and the connection control message is used to control the terminal device not to provide connection services; the terminal device performs the following steps according to the connection control message: Message to release resources used to provide connection services.
  • the terminal device can release resources used to provide connection services under the control of the access network element, thereby avoiding interference to existing communications caused by the terminal device providing services outside the authorized location range and/or authorized time range.
  • the terminal device when releasing resources for providing connection services, releases the F1 interface, and the F1 interface is used for information transmission between the terminal device and the access network element.
  • connection control message can also be used to control the terminal device to provide connection services, and the terminal device can also provide connection services according to the connection control message.
  • terminal equipment can provide connection services under the control of access network elements, thereby ensuring business continuity and reliability.
  • a fifth aspect provides a communication device, which may be an access management network element or a data management network element or a terminal device, or a chip provided in an access management network element or a data management network element or a terminal device.
  • the communication device can to implement any of the above methods.
  • the communication device includes corresponding modules, units, or means (means) for implementing the above method.
  • the modules, units, or means can be implemented by hardware, software, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • a communication device including a transceiver unit.
  • the communication device further includes a processing unit.
  • the communication device may implement any aspect or any one of the aspects implement the provided method.
  • a communication device including a processor.
  • the processor may be used to perform any of the above aspects or implement any of the methods provided in any of the aspects.
  • the device further includes a memory, the processor is coupled to the memory, and the memory is used to store computer programs or instructions.
  • the processor can execute the programs or instructions in the memory, so that the device can perform any of the above aspects or any of the above. Either of the aspects implements the provided method.
  • An eighth aspect provides a communication device, which includes an interface circuit and a logic circuit, and the logic circuit is coupled to the interface circuit.
  • the interface circuit may be a code/data read-write interface circuit, which is used to receive computer execution instructions (computer execution instructions are stored in the memory, may be read directly from the memory, or may pass through other devices) and transmitted to the logic circuit , so that the logic circuit runs the computer execution instructions to perform any of the above aspects or any of the aspects to implement the provided method.
  • the communication device may be a chip or a system on a chip.
  • a communication device including a processor, and the processor is coupled to a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter to execute any one of the above aspects or any one of the aspects to implement the provided method.
  • processors there can be one or more processors, and there can also be one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated on the same chip as the processor, or can be set in different On the chip, this application does not limit the type of memory and the arrangement of the memory and the processor.
  • ROM read-only memory
  • the communication device can be a chip, and the processor can be implemented by hardware or software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor
  • the processor can be a general-purpose processor that is implemented by reading software code stored in a memory.
  • the memory can be integrated into the processor, or it can be located outside the processor and exist independently.
  • a processor including: an input circuit, an output circuit and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes any of the above aspects or any one of the aspects to implement the provided method.
  • the above-mentioned processor can be a chip, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by, for example, but not limited to, the receiver, and the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by the transmitter, and the input circuit and the output A circuit may be the same circuit that functions as an input circuit and an output circuit at different times.
  • This application does not limit the specific implementation methods of the processor and various circuits.
  • a communication device including: a logic circuit and an input-output interface, the input-output interface being used to communicate with a module outside the communication device; the logic circuit being used to run a computer program or instructions to execute any of the above.
  • the communication device may be the first access network element in any of the above aspects or The second access network element or access management network element, or a device including the above-mentioned access management network element or data management network element or terminal equipment, or a device included in the above-mentioned access management network element or data management network element or terminal equipment Devices, such as chips.
  • the input/output interface may be a code/data read-write interface circuit, or a communication interface, which is used to receive computer programs or instructions (the computer programs or instructions are stored in the memory, may be read directly from the memory, or may be through other devices) and transmitted to the input and output interface, so that the input and output interface runs a computer program or instructions to perform any of the above methods.
  • the communication device may be a chip.
  • the computer program product includes: a computer program (which can also be called a code, or an instruction).
  • a computer program which can also be called a code, or an instruction.
  • the computer program When the computer program is run, it causes the computer to execute any of the above aspects or aspects. Any of the methods provided.
  • a computer-readable medium stores a computer program (which can also be called a code, or an instruction), and when it is run on a computer, it causes the computer to execute any one of the above aspects or any one of the above. Either aspect implements the provided method.
  • a fourteenth aspect provides a chip system.
  • the chip system includes a processor and an interface, and is used to support a communication device to implement any of the above aspects or any of the functions provided by any aspect.
  • the chip system further includes a memory for storing necessary information and data of the communication device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • a fifteenth aspect provides a chip device including an input interface and/or an output interface.
  • the input interface can implement the receiving function provided by any of the above aspects or any one of the aspects
  • the output interface can implement the sending function provided by any of the above aspects or any of the aspects.
  • a sixteenth aspect provides a functional entity that is used to implement any of the above aspects or any of the methods provided in any aspect.
  • a seventeenth aspect provides a communication system, including an access management network element and an access network element for performing the method in the first aspect.
  • the communication system may also include a terminal device for performing the method in the third aspect and/or the fourth aspect.
  • An eighteenth aspect provides a communication system, including a data management network element and an access management network element for performing the above-mentioned second aspect.
  • the communication system may also include a terminal device and an access network element for performing the method in the third aspect and/or the fourth aspect.
  • Figure 1A is a schematic diagram of the architecture of a 5G communication system
  • Figure 1B is a schematic diagram of an IAB architecture
  • Figure 2 is a schematic diagram of a mobile IAB architecture
  • Figure 3 is a schematic diagram of the network access process of an IAB-node
  • Figure 4 is a schematic diagram of an L2 Relay architecture
  • Figure 5 is a schematic diagram of a remote UE connection establishment process
  • Figure 6 is a schematic diagram of a UE positioning initiation process
  • Figure 7 is a schematic diagram of the termination process of UE positioning
  • Figure 8A is a schematic diagram of an authorization process provided by an embodiment of the present application.
  • Figure 8B is a schematic diagram of another authorization process provided by an embodiment of the present application.
  • Figure 9 is a schematic diagram of the authorization flow of an IAB scenario provided by the embodiment of this application.
  • Figure 10 is a schematic diagram of the authorization flow of an L2 Relay scenario provided by the embodiment of this application.
  • Figure 11 is a schematic diagram of an authorization process provided by an embodiment of the present application.
  • Figure 12 is a schematic diagram of the authorization flow of an IAB scenario provided by the embodiment of this application.
  • Figure 13 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 14 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Figure 15 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the mobile communication system may be a fourth generation (4th Generation, 4G) communication system (for example, a long term evolution (LTE) system), a fifth generation mobile communication (5th generation, 5G) communication system (for example, New radio (NR) system), and future mobile communication systems such as 6G.
  • 4G fourth generation
  • 5G fifth generation mobile communication system
  • 6G future mobile communication systems
  • FIG. 1A is a schematic diagram of the 5G network architecture, including: terminal equipment part, network equipment part and data network (DN) part.
  • DN data network
  • the terminal equipment part generally includes user equipment (UE), etc.
  • UE is a device with wireless transceiver functions that can communicate with one or more core network (CN) network elements through the access network element in the radio access network (RAN). communicate.
  • CN core network
  • RAN radio access network
  • the user equipment may also be called an access terminal, terminal, subscriber unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc.
  • User equipment can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as aircraft, balloons, satellites, etc.).
  • the user equipment may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) website, personal digital assistant (PDA), etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the user device may also be a handheld device with wireless communication capabilities, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or a terminal in the Internet of Things (also called an Internet of Things device) , terminals in the Internet of Vehicles, 5G networks and any form of terminals in future networks, relay user equipment, mobile terminals (mobile-termination, MT) or future evolved public land mobile network (PLMN) terminal etc.
  • the relay user equipment may be, for example, a 5G residential gateway (RG).
  • the user equipment may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, or telemedicine.
  • Wireless terminals in remote medical wireless terminals in smart grid, wireless terminals in transportation safety, wireless terminals in smart city, and smart homes. Wireless terminals, etc.
  • the embodiment of this application applies to terminal equipment The type or type is not limited.
  • the network equipment part includes network exposure function (NEF), network storage function (network repository function, NRF), policy control function (PCF), UDM, authentication server function (AUSF), AMF, session management function (SMF), user plane function (UPF), access network (AN), network slice selection function (NSSF), etc.
  • NEF network exposure function
  • NRF network storage function
  • PCF policy control function
  • UDM authentication server function
  • AUSF authentication server function
  • AMF session management function
  • SMF session management function
  • UPF user plane function
  • AN access network
  • NSSF network slice selection function
  • the core network part includes user plane functions and control plane functions.
  • the user plane function is mainly responsible for the forwarding of data packets, quality of service (QoS) control, billing information statistics, etc.
  • the control plane function is mainly responsible for business process interaction, delivering data packet forwarding strategies, QoS control strategies, etc. to the user plane functions.
  • Data network DN also known as packet data network (PDN)
  • PDN packet data network
  • the operator network can access multiple DNs, and multiple services can be deployed on the DNs to provide data and/or voice services to UEs.
  • the above-mentioned third party can be a service provider other than the operator's network and the UE, and can provide other data and/or voice services to the UE.
  • the specific manifestations of the above-mentioned third parties can be determined according to the actual application scenarios and are not limited here.
  • the application function may or may not be affiliated with the operator network. However, usually, AF belongs to a third party and does not belong to the operator's network, but has an agreement with the operator's network. AF is a functional network element used to provide various business services. It can support the function of affecting data routing through applications, access to network open functions NEF, and interaction with the policy framework for policy control.
  • the network functions in the operator network are briefly introduced below.
  • RAN is a subnetwork of the operator's network and an implementation system between the service nodes (or network functions) and UEs in the operator's network.
  • the UE To access the operator's network, the UE first passes through the RAN, and then connects to the service nodes in the operator's network through the RAN. That is, the RAN exists between the UE and the core network part, providing communication connections between the two.
  • the RAN in the embodiment of this application may refer to the access network itself or the access network element, and no distinction is made here.
  • the access network element is a device that provides wireless communication functions for UE, and may also be called access network equipment, AN equipment, etc.
  • the access network element includes but is not limited to: next-generation base station or next-generation node B (generation node B, gNB) in the 5G system, evolved node B (evolved node B, eNB) in the LTE system, and wireless network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (home node B, HNB), indoor Baseband processing unit (building base band unit, BBU), transceiver point (TRP), transmission point (TP), small base station equipment (pico), mobile switching center, or network equipment in future networks, etc. . It can be understood that this application does not limit the specific type of access network equipment. In systems using different wireless access technologies, the names of devices with access network device functions may be different.
  • the access equipment may include a centralized unit (centralized unit, CU), a distributed unit (distributed unit, DU), etc.
  • NEF is a control plane function provided by operators. It provides the framework, authentication and interfaces related to network capability opening, and transmits information between network functions and other network functions in the 5G system. NEF is an external bidirectional interface that opens the network's capabilities to third parties in a secure manner. When other network functions (such as AF, etc.) need to communicate with a third-party network, NEF can serve as a relay for communication with the third-party network entity. NEF can also serve as a translator for the identification information of contracted users and the identification information of third-party network functions.
  • NEF will subscribe the user’s permanent identifier (subscriber permanent identifier, SUPI) is sent from the PLMN to a third party, the SUPI can be translated into its corresponding externally publicly used subscription identifier (generic public subscription identifier, GPSI).
  • SUPI subscriber permanent identifier
  • GPSI Global System for Mobile communications
  • NRF is a control plane function provided by operators and can be used to maintain real-time information of all network function services in the network.
  • PCF is a control plane function provided by operators and is used to generate and manage users, sessions, and QoS flow processing policies. It supports a unified policy framework to govern network behavior, provides policy rules, contract information related to policy decisions, etc. to other control functions.
  • UDM is a control plane function provided by operators and is responsible for storing the security context, subscription data and other information of subscribed users in PLMN.
  • the contract users of the above-mentioned operator network can be users who use the services provided by the operator network, such as users who use China Telecom's terminal equipment chip cards, or users who use China Mobile's terminal equipment chip cards, etc.
  • the above security context may be data (cookie) or token stored on a local terminal device (such as a mobile phone).
  • the contract data of the above-mentioned contract users can be the supporting services of the terminal equipment chip card, such as the traffic package of the mobile phone chip card, etc.
  • AUSF is a control plane function provided by operators and is usually used for first-level authentication, that is, network authentication between UE (subscribed user) and the operator's network.
  • AMF is a control plane network function provided by the operator network. It is responsible for the access control and mobility management of UE access to the operator network, such as registration management, connection management, reachability management, mobility management, and allocation of user temporary identities. , functions such as authenticating and authorizing users.
  • SMF is a control plane network function provided by the operator network and is responsible for managing the UE's protocol data unit (PDU) session.
  • PDU session is a channel used to transmit PDUs.
  • the terminal device needs to transmit data to and from the DN through the PDU session.
  • PDU sessions can be established, maintained and deleted by SMF.
  • SMF includes session management (such as session establishment, modification and release, including tunnel maintenance between UPF and AN, etc.), UPF selection and control, service and session continuity (SSC) mode selection, roaming and other sessions related functions.
  • UPF is a gateway provided by the operator and is the gateway for communication between the operator's network and the DN.
  • UPF includes user plane related functions such as data packet routing and transmission, packet detection, business usage reporting, QoS processing, legal interception, uplink packet detection, downlink data packet storage, etc.
  • NSSF is a control plane network function provided by the operator network and is responsible for determining network slicing instances, selecting AMF, etc.
  • the core network part may also include a location management function (LMF), which is used to obtain the location information of the UE using specific positioning technology.
  • LMF location management function
  • Positioning technologies include but are not limited to: downlink time difference of arrival positioning (observed time difference of arrival, OTDOA), uplink time difference of arrival positioning (uplink time difference of arrival, UTDOA), timing advance (timing advance, TA), or arrival angle ( angle of arrival, AoA) and other technologies.
  • the core network part can also include a gateway mobile location center (GMLC), which is mainly responsible for opening positioning services to external location service (location service, LCS) clients or AF.
  • GMLC gateway mobile location center
  • Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, Nnssf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • the meaning of the above interface serial number may refer to the meaning defined in the 3GPP standard protocol. This application does not limit the meaning of the above interface serial number.
  • the name of each network function and the name of the interface between each network function are just examples. In specific implementation, the interface name of the system architecture may also be other names, which is not limited in this application.
  • the embodiments of this application can be applied to IAB scenarios and Layer-2 (L2) relay scenarios.
  • Scenario 1 IAB scenario.
  • IAB base station is proposed in 5G NR research.
  • IAB base station is also called IAB node (IAB-node).
  • IAB-node integrates wireless access link and wireless backhaul link.
  • the wireless access link is UE and IAB-node.
  • the communication link between nodes, the wireless backhaul link is the communication link between IAB-node, which mainly performs data return.
  • IAB-node does not require a wired transmission network for data backhaul, so IAB-node reduces the deployment requirements for wired transmission networks and can be deployed outdoors, indoors and other scenarios where it is difficult to deploy wired transmission networks.
  • IAB-node includes MT function and gNB-DU function.
  • FIG. 1B is a schematic diagram of an IAB architecture.
  • NG next generation
  • 5G core, 5GC 5G core
  • NR RAN includes gNB, IAB-node and IAB-donor gNB.
  • IAB-donor gNB (abbreviated as IAB-donor) includes gNB-CU function and gNB-DU function.
  • gNB-CU mainly handles non-real-time wireless high-level protocol stack functions, such as radio resource control (RRC) or packet data convergence protocol (PDCP) and other functions.
  • the gNB-DU function mainly handles physical layer functions and layer 2 functions with high real-time requirements, such as physical layer (PHY) function, media access control layer (MAC) function, wireless link control layer ( radio link control, RLC) function, etc.
  • PHY physical layer
  • MAC media access control layer
  • RLC radio link control
  • the gNB-DU in IAB-node can be used as the Uu port termination point of the backhaul link between IAB-node and IAB-donor, or IAB-node and other IAB-node.
  • FIG 2 is a schematic diagram of a mobile IAB architecture.
  • the relay installed on the vehicle serves as a vehicle mounted relay (VMR) or mobile base station relay (mobile base station relay).
  • VMR vehicle mounted relay
  • NR mobile base station relay
  • Support wireless relay related functions support access and backhaul through NR, that is, support wireless backhaul as service access and provide wireless access for UE.
  • VMR is mobile
  • the IAB-node in Figure 1B is a fixed relay on the ground
  • VMR can also be understood as a mobile IAB-node.
  • the ground donor RAN is responsible for providing core network interfaces for UEs and RAN nodes that provide wireless backhaul functions for VMRs. Under normal circumstances, donor RAN is generally installed on the ground and has no mobility.
  • IAB-node's MT (abbreviated as IAB-MT) accessing the network is shown in Figure 3, which includes the following steps:
  • IAB-MT sends an RRC connection establishment message to IAB-donor.
  • the RRC connection establishment message includes an IAB-indication.
  • the IAB-node initiates the RRC connection establishment process and accesses the 5G system.
  • the IAB-MT sends an RRC connection establishment message to the Donor-CU of the IAB-donor.
  • the N2 message includes IAB-indication.
  • UDM provides an IAB-operation allowed indication (IAB-operation allowed indication) to the AMF, and the IAB-operation allowed indication is included as part of access and mobility subscription data.
  • the AMF sends an IAB-node authorized indication to the RAN.
  • the IAB-node authorized indication can be used to indicate authorized or not authorized.
  • the RAN ensures that Save the IAB-node authorized indication. After the registration process is completed, the IAB-node remains connected.
  • IAB-MT establishes a protocol data unit (PDU) session, obtains an Internet protocol (IP) address, and interacts with operation administration and maintenance (OAM).
  • PDU protocol data unit
  • IP Internet protocol
  • OAM operation administration and maintenance
  • the PDU session of the IAB-MT provides an IP transmission connection between the IAB-node and the OAM through the 5G network.
  • IAB-MT obtains configuration information from OAM.
  • the configuration information includes global cell identifier (cell global identifier, CGI), physical cell identifier (physical cell identifier, PCI), tracking area code (tracking area code, TAC), etc.
  • the IAB-DU (that is, the DU of the IAB-node) sends an F1 Setup Request (F1Setup Request) message to the RAN.
  • F1Setup Request F1Setup Request
  • the F1 establishment request message is used to request the establishment of an F1 interface (F1interface), including CGI, PCI, TAC, etc.
  • F1 interface F1 interface
  • Donor-CU and AMF complete the tracking area (TA) list update.
  • TA tracking area
  • S308 The Donor-CU of the IAB-donor sends an F1 establishment response message to the IAB-DU to complete the establishment of the F1 interface.
  • Donor-CU determines whether to accept the F1 interface establishment based on the IAB-node authorized indication received from AMF. If the IAB-node authorized indication indicates authorization, Donor-CU accepts the F1 interface establishment. If the IAB-node authorized indication indicates non-authorization, Donor-CU -CU does not accept F1 interface establishment.
  • Scenario 2 L2 relay (Relay) scenario.
  • FIG. 4 is a schematic diagram of an L2Relay architecture.
  • indirect communication supports the L2 Relay communication method.
  • Indirect communication refers to the communication mode in which Remote UE accesses the network through Relay UE.
  • the Relay UE forwards the uplink and downlink data of the Remote UE according to the configuration of the access stratum layer (AS layer), so that the Remote UE can access the RAN and communicate with the 5GC.
  • AL2 Relay can also be called Layer 2 UE-to-Network Relay, L2 U2N Relay.
  • connection establishment process of Remote UE in the L2 Relay scenario is shown in Figure 5, including the following steps:
  • S501 Remote UE and Relay UE are initially registered to the network.
  • Remote UE may not be registered even if it is not directly connected to the network, and needs to be registered in subsequent S509.
  • AMF obtains 5G proxy services (ProSe) subscription data (5G ProSe subscription data) from UDM.
  • the 5G ProSe subscription data includes that the UE is authorized as an L2 Relay, and the AMF sends to the RAN that the UE is authorized as an L2 Relay. L2 Relay instructions.
  • Remote UE obtains authorization information from the PCF corresponding to Remote UE
  • Relay UE obtains authorization information from the PCF corresponding to Relay UE.
  • the PCF corresponding to the UE can be understood as the PCF responsible for providing the UE policy when the UE registers.
  • the authorization information obtained by the Remote UE includes that the UE is authorized to communicate indirectly, that is, as a Remote UE.
  • the authorization information obtained by the Relay UE includes that the UE is authorized to communicate indirectly, that is, as a Relay UE.
  • preconfigured authorization information can be used.
  • S503 Relay UE completes the discovery and selection process.
  • the Remote UE sends an indirect communication request message to the Relay UE to instruct the Relay UE to establish indirect communication.
  • S505 Relay UE initiates a service request (Service Request) message.
  • This S505 is an optional step. If the Relay UE is not in the connected state (RRC connected), the Relay UE initiates a Service Request message, which can cause the Relay UE to enter the connected state.
  • Relay UE returns an indirect communication response message to Remote UE.
  • the Remote UE After S504 to S506, the Remote UE establishes a PC5 connection with the Relay UE, and the Relay UE is in the connected state.
  • Remote UE sends an RRC setup request (Setup Request) message to RAN through Relay UE.
  • S508 RAN sends an RRC Setup message to Remote UE through Relay UE.
  • Relay UE can forward the uplink and downlink signaling of Remote UE according to the configuration of AS layer, so that Remote UE can access the RAN and complete the establishment of RRC connection between Remote UE and RAN. If the Relay UE is not authorized as an L2 Relay UE, the RAN may deny the Remote UE access through the Relay UE.
  • the Remote UE sends a non-access stratum (NAS) request message to the AMF through the RAN.
  • NAS non-access stratum
  • the NAS message is an initial registration message. If the Remote UE has been registered in S501, the NAS message is a service request message. In the service request message, the Remote UE can choose to activate the PDU session.
  • the AMF corresponding to the UE can be understood as the AMF responsible for UE mobility management when the UE registers. That is, the AMF corresponding to the Remote UE is the AMF responsible for the mobility management of the Remote UE when the UE registers.
  • the AMF corresponding to the Relay UE is Relay and is responsible for Relay when the UE registers. AMF for UE mobility management.
  • Remote UE transmits uplink and downlink data through Relay UE, RAN, and the corresponding UPF of Remote UE.
  • Relay UE forwards the uplink and downlink data of Remote UE according to the configuration of AS layer.
  • the protocol stack between Relay UE and RAN supports the adaptation layer, which is used to distinguish Remote UE data between Relay UE and RAN.
  • AMF obtains 5G ProSe subscription data from UDM.
  • 5G ProSe subscription data includes that the UE is authorized as an L2 Relay.
  • the AMF sends indication information to the RAN that the UE is authorized as an L2 Relay.
  • the AMF learns that the UE is authorized to serve as an L2 Relay, the AMF will not actively trigger the connection release process.
  • the connection release is controlled by the RAN. This is because only the RAN knows whether the UE is currently providing L2 Relay services. When providing L2 Relay services, Relay UE The connection should not be released.
  • the L2 Relay UE has two functional roles. One is to transmit the Relay UE's own business data, and the other is to provide relay services for the Remote UE to transmit the Remote UE's business data.
  • service area restrictions are defined, that is to say, the area in which the UE is allowed or not allowed to initiate communication with the network is defined.
  • the UE can communicate normally with the network.
  • the Non-Allowed Area the UE and the network cannot initiate the Service Request process or the interaction of general session management related signaling.
  • the UE needs to respond to paging initiated by the core network, NAS notification process, and paging initiated by the RAN node.
  • the service area restriction can include one or more complete TAs, or all TAs of the public land mobile network (PLMN).
  • Service area restrictions are included in the UE's subscription data stored in UDM, and can be represented by TA identification and/or other geographical information (such as latitude and longitude, postal code, etc.). If geographical location information is used, AMF will first map the geographical location information to TA before sending service area restriction information to PCF, RAN and UE. During the registration process, if there is no context for the UE's service area restrictions in the AMF, the AMF can obtain this information from the UDM and may further adjust it through the PCF. The network can update the service area restrictions through the common UE configuration update process.
  • the Allowed Area included in the service area limit provided by AMF to the UE can be pre-configured or dynamically allocated by AMF. (such as dynamic TA control as the UE position changes).
  • the AMF provides service area restrictions in the form of TA. This service area restriction can be part of the complete list stored in the UE subscription data, or it can be provided to the UE by the PCF during the registration process.
  • AMF does not allow the UE to interact with the network in the Service Request process or general session management-related signaling. That is, the UE cannot perform service-related processes but other mobility-related signaling processes are allowed.
  • the network When the network provides service area restrictions, it will not provide both Allowed Area and Non-Allowed Area to the UE. If the network provides a Non-Allowed Area to the UE, the TA in the PLMN that is not in the list will be regarded as belonging to the Allowed Area.
  • the position estimation result of the UE is determined, and then it can be determined whether the UE is within the Allowed Area or within the Non-Allowed Area.
  • the UE positioning initiation process is shown in Figure 6, which includes the following steps:
  • S601 The idle UE initiates a service request process and completes the signaling connection with the AMF.
  • S602 The UE sends a mobile originated location request (MO-LR) message.
  • MO-LR mobile originated location request
  • the MO-LR message can be carried in the uplink NAS TRANSPORT message.
  • a UE can request different location service types: A) location estimate for the UE, B) location estimate for the UE sent to the LCS client or AF, C) location assistance information.
  • the UL NAS TRANSPORT message can also include LCS quality of service (QoS) information, such as positioning accuracy (accuracy), response time (response time), LCS QoS class (class ), LCS QoS class can include Best Effort Class and Assured Class.
  • QoS quality of service
  • the UL NAS TRANSPORT message may also include the LCS client or AF identity, and the GMLC address assigned by the AMF.
  • S603 AMF selects a suitable LMF.
  • AMF sends a location determination request (Nlmf_Location_DetermineLocation Request) message to LMF.
  • the message includes the serving cell identity (serving cell identity) of the UE and the indication information or location assistance data requesting the UE's location information.
  • the LMF initiates the positioning process for the UE.
  • LMF obtains positioning data by interacting with the RAN and UE, and calculates the UE's position estimation result.
  • the positioning technologies used by LMF include but are not limited to: OTDOA, UTDOA, TA or AoA technologies.
  • AMF sends a location update request (Ngmlc_Location_LocationUpdate Request) message to GMLC.
  • This message includes the location estimation result, UE identification and LCS QoS information requested by the UE.
  • GMLC sends a location update request message to the LCS client or AF.
  • the location update request message includes the location estimation result of the UE.
  • S609 The LCS client or AF returns a location update response (Ngmlc_Location_LocationUpdate Response) message.
  • GMLC includes two entities: visited GMLC (visited GMLC, VGMLC) and home GMLC (home GMLC, HGMLC). If the UE is not roaming, VGMLC and HGMLC are the same entity.
  • S608 and S609 are optional steps. For example, when the UE does not request location service type B), S608 and S609 are skipped.
  • S610 GMLC sends a location update response message to the AMF.
  • the AMF sends an MO-LR response message to the UE.
  • the MO-LR response message can be carried in the downlink NAS TRANSPORT message.
  • the DL NAS TRANSPORT message can also include the position estimation result and whether the position estimation result meets the requested positioning accuracy.
  • the LCS client sends an LCS Service Request message to GMLC to request the location of the UE.
  • the LCS Service Request message includes the UE's identity and required QoS (required QoS).
  • the identity of the UE can be a general public user identity (generic public subscription identifier, GPSI) or a user permanent identity (subscription permanent identifier, SUPI).
  • GLMC obtains the AMF address of the current serving UE from UDM.
  • GLMC sends a Namf_Location_ProvidePositioningInfo Request message to the AMF to request to obtain the location of the UE.
  • GLMC obtains the LCS privacy profile (LCS privacy profile) from the UDM, determines the location of the LCS client authorized to obtain the UE based on the LCS privacy profile, and GLMC requests the AMF to obtain the location of the UE.
  • LCS privacy profile LCS privacy profile
  • S704 If the UE is in idle state, the AMF initiates a service request process to complete the signaling connection between the UE and the AMF.
  • This S704 is an optional step.
  • the AMF sends an Nlmf_Location_DetermineLocation Request message to the LMF to request the current location of the UE.
  • the Nlmf_Location_DetermineLocation Request message may also include the cell identity of the UE.
  • S707 The LMF initiates the positioning process of the UE.
  • the LMF interacts with the UE through the RAN to obtain positioning data and calculates the UE's position estimation result.
  • the positioning technologies used by LMF include but are not limited to: OTDOA, UTDOA, TA or AoA technologies.
  • the LMF sends the Nlmf_Location_DetermineLocation Response message to the AMF, including the current location of the UE and the achieved accuracy.
  • AMF sends a Namf_Location_ProvidePositioningInfo Response message to GMLC, including the UE's current location and the achieved accuracy.
  • GMLC sends an LCS Service Response message to the LCS client, including the UE's current location and the achieved accuracy.
  • the network only performs the connection service for the UE based on the operation permission indication information (such as the IAB-node authorized indication in the above scenario one, or the 5G ProSe subscription data in the scenario two).
  • the operation permission indication information such as the IAB-node authorized indication in the above scenario one, or the 5G ProSe subscription data in the scenario two.
  • the UE may provide connection services at any location and at any time, resulting in poor flexibility for the network to control and manage the connection services provided by the UE.
  • FIG. 8A is a schematic diagram of an authorization method provided by an embodiment of the present application. The method includes the following steps:
  • the access management network element obtains operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • Authorization conditions are used to determine whether the terminal device is allowed to provide connection services.
  • the authorization conditions include an authorized location range for the connection service and/or an authorized time range for the connection service.
  • S802 The access management network element sends the authorization result to the access network element connected to the terminal device according to the authorization conditions. Correspondingly, the access network element receives the authorization result.
  • the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.
  • the access management network element can determine whether the location and/or current time of the terminal device meet the authorization conditions based on the obtained authorization conditions, and send the corresponding authorization result to the access network element to which the terminal device is connected, even if the operation
  • the permission indication information allows the terminal device to provide connection services.
  • the access management network element does not allow the terminal device to provide connection services.
  • the connection services provided by the terminal device can be flexibly and dynamically controlled and managed.
  • the above solution can also avoid providing services outside the authorized location range and/or authorized time range, and can avoid causing interference to existing communications to a certain extent.
  • the access management network element can obtain the operation permission indication information and authorization conditions from the data management network element (such as UDM) or from the policy control network element (such as PCF).
  • the terminal device initiates the registration process and accesses the network through the access management network element.
  • the access management network element can obtain the contract data from the data management network element.
  • the contract data includes operation permission indication information and authorization conditions.
  • the registration process of the terminal device can be referred to S301 to S303 in Figure 3 above.
  • the subscription data can be Access and Mobility Subscription data (such as in the IAB scenario), or the subscription data can be 5G ProSe subscription data (such as in the L2 Relay scenario).
  • the access management policy includes operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is not allowed to provide connection services.
  • the contract data may not include authorization conditions.
  • the access management network element determines that the terminal device is not allowed to provide Serve.
  • the access management network element may not be able to obtain the operation permission indication information, and the terminal device is not allowed to provide services by default.
  • Connection services include but are not limited to IAB services, VMR or relay services, etc.
  • IAB terminal equipment can provide IAB services, that is, the terminal equipment can be IAB-UE/IAB-MT. Specifically, the IAB terminal equipment is IAB-MT.
  • VMR equipment or mobile base station relay equipment can provide VMR services, that is, the terminal equipment can be VMR equipment or mobile base station relay.
  • the VMR device acts as a relay between the terminal device and the network (such as the 5G network), for example, providing an access link to the UE and wirelessly connecting to the network through the IAB-donor.
  • the mobile base station relay can serve UEs located inside (or entering the vehicle) or outside (or leaving the vehicle).
  • the relay terminal device can provide relay services, that is, the terminal device can be a relay terminal device.
  • the access management network element can determine the authorization result according to the authorization conditions, and then send the authorization conditions to the access network element.
  • the authorization conditions include an authorization time range for the connection service.
  • the access management network element can determine whether the current time is outside the authorized time range or within the authorized time range, thereby determining the authorization result.
  • the access management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide services.
  • the access management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide services.
  • the authorization conditions include an authorized location range for the connection service.
  • the access management network element can determine whether the terminal device is outside the authorized location range or whether it is within the authorized location range, thereby determining the authorization result.
  • the access management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide connection services.
  • the access management network element determines the authorization result to indicate that the terminal device is allowed to provide connection services.
  • the terminal device is mobile, such as a VMR
  • moving the terminal device out of the authorized location range will cause the terminal device to be outside the authorized location range, and moving the terminal device into the authorized location range will cause the terminal device to be within the authorized location range.
  • Authorized location ranges include one or more of the following: authorized routes for connecting services, authorized areas for connecting services, areas where connecting services are allowed, or areas where connecting services are prohibited.
  • the authorization area of a connection service can contain one or more complete TAs. If the authorization area of the connection service is geographical location information, AMF maps the geographical location information to TA.
  • the authorized area for connection services may also include one or more cells. For example, the identity of each cell may be a global cell identifier (cell global identifier, CGI).
  • the authorization conditions include the authorized location range of the connection service and the authorized time range of the connection service, and the access management network element can determine whether the current time is outside the authorized time range ( or whether it is within the authorized time range), and whether the terminal device is outside the authorized location range (or whether it is within the authorized location range), thereby determining the authorization result.
  • the access management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide connection services.
  • the access management network element determines the authorization result to indicate that the terminal device is allowed to provide Provide connection services.
  • the access management network element can determine whether the terminal device is outside the authorized location range or whether it is within the authorized location range based on the location of the terminal device and the authorized location range.
  • the location of the terminal device can be the real-time location estimated by the positioning management network element (such as LMF).
  • the access management network element can obtain the position of the terminal device from the positioning management network element.
  • the location of the terminal device can be a location within the authorized time range.
  • the access management network element sends a location determination request message to the positioning management network element to request the location of the terminal device.
  • the location determination request message can carry Authorization time range
  • the positioning management network element can obtain the location of the terminal device within the authorization time range.
  • the authorized location range includes the authorized route (authorized path) and the authorized area (authorized area) of the connection service.
  • the authorized location range includes the area (Allowed) that is allowed to provide connection services. area) and areas where connection services are prohibited (Non-Allowed area).
  • the positioning management network element determines whether the terminal device is outside the authorized location range or within the authorized location range, and then notifies the access management network element of the determination result.
  • the access management network element may send a request message to the positioning management network element (for example, see S604 in the above-mentioned Figure 6 or see S706 in the above-mentioned Figure 7).
  • the request message includes information about the authorized location range.
  • the request message Used to request whether the terminal device is outside the authorized location range or whether it is within the authorized location range.
  • the positioning management network element sends notification information to the access management network element (for example, see S606 in Figure 6 above or S708 in Figure 7 above).
  • the notification information is used to notify the terminal device that it is outside the authorized location range, or that the terminal device is outside the authorized location range. Within the authorized location.
  • the request message may include an authorization time range.
  • the access management network element uses the tracking area where the terminal device is located to determine whether the terminal device is outside the authorized location range or whether it is within the authorized location range.
  • the access management network element can receive the tracking area range corresponding to the authorized location range (for example, the authorized location range is the tracking area range, or the network opening network element converts the authorized location range into the tracking area range), and the access management network element The tracking zone where the end device is known to be located. If the tracking area where the terminal device is located is outside the tracking area corresponding to the authorized location range (that is, the tracking area corresponding to the authorized location range does not include the tracking area where the terminal device is located), it means that the terminal device is outside the authorized location range.
  • the authorized location range is the tracking area range, or the network opening network element converts the authorized location range into the tracking area range
  • the tracking zone where the end device is known to be located. If the tracking area where the terminal device is located is outside the tracking area corresponding to the authorized location range (that is, the tracking area corresponding to the authorized location range does not include the tracking area where the terminal device is located), it means that the terminal device is outside the authorized location range.
  • the access management network element can request the network opening network element to map the authorized location range to the tracking area range.
  • the access management network element when the access management network element allocates a registration area (Registration Area) to a terminal device, it can consider the tracking area range corresponding to the authorized location range. If the terminal device is located within the authorized location range, the registration area shall consist of a group of TAs belonging to the tracking area corresponding to the authorized location range. Otherwise, the registration area should consist of a set of TAs that do not belong to the tracking area range corresponding to the authorized location range. Furthermore, the access management network element can know that the terminal device is within the authorized location range or outside the authorized location range through the Mobility Registration Update mechanism.
  • a registration area Registration Area
  • the access management network element determines whether the terminal device is in the cell where the terminal device is located. Outside the authorized location range, or whether it is within the authorized location range.
  • the access management network element can receive the cell list corresponding to the authorized location range (for example, the authorized location range is a cell list, or the network opening network element converts the authorized location range into a cell list), and the terminal is known to the access management network element The community where the device is located. If the cell where the terminal device is located is outside the cell list corresponding to the authorized location range (that is, the cell list corresponding to the authorized location range does not include the cell where the terminal device is located), it means that the terminal device is outside the authorized location range. If the cell where the terminal device is located is within the cell list corresponding to the authorized location range (that is, the cell list corresponding to the authorized location range includes the cell where the terminal device is located), it means that the terminal device is within the authorized location range.
  • the authorized location range is a cell list, or the network opening network element converts the authorized location range into a cell list
  • the community where the device is located If the cell where the terminal device is located is outside the cell list corresponding to the authorized location range (that is, the cell list corresponding
  • the access network element can control the connection service of the terminal device according to the received authorization result.
  • the access management network element can also send the authorization result to the terminal device.
  • the terminal device can only perform corresponding operations based on the authorization results sent by the access management network element. For example, the terminal device receives a first authorization result sent by the access management network element. The first authorization result is used to indicate that the terminal device is not allowed to provide connection services. The terminal device releases resources used to provide connection services according to the first authorization result. For another example, the terminal device receives the second authorization result sent by the access management network element. The second authorization result is used to indicate that the terminal device is allowed to provide the connection service. The terminal device provides the connection service according to the second authorization result.
  • the terminal device can only perform corresponding operations based on the control of the access network element. For example, the terminal device receives a connection control message sent by the access network element. The connection control message is used to control the terminal device not to provide connection services. The terminal device releases resources used to provide connection services according to the connection control message. For another example, the connection control message is also used to provide connection services, and the terminal device provides connection services according to the connection control message.
  • the terminal device can perform corresponding operations based on the authorization results sent by the control and access management network elements of the access network element.
  • the control of the access network element and the authorization result of the access management network element are consistent, that is, the terminal equipment will be caused to perform the same operation.
  • the terminal device may release the F1 interface, and the F1 interface is used for information transmission between the terminal device and the access network element.
  • Information here includes data and/or signaling.
  • the access management network element sends a deregistration request message (Deregistration Request message) to the terminal device.
  • the deregistration request message may include indication information that the terminal device is not allowed to provide connection services.
  • the terminal device releases resources used to provide connection services.
  • the access management network element can obtain the unauthorized location range (or prohibited area) of the connection service, and when the terminal is within the unauthorized location range (or prohibited area), the terminal device is not allowed to provide connections. services to flexibly and dynamically control and manage terminal devices providing connection services.
  • Figure 8B another schematic diagram of an authorization method provided by an embodiment of the present application includes the following steps:
  • the access management network element obtains the operation permission indication information and the unauthorized location range of the connection service.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • the unauthorized location range for connecting services is the Forbidden Area.
  • prohibited areas are included in Access and Mobility Subscription data.
  • the access management network element can obtain the operation permission indication information and the unauthorized location range of the connection service from the data management network element or from the policy control network element.
  • the access management network element determines that the terminal device is in an unauthorized location range (or prohibited area), and sends an authorization result to the access network element to which the terminal device is connected.
  • the authorization result indicates that the terminal device is not allowed to provide connection services; or the terminal device is not allowed to provide connection services.
  • the accessed access network element sends an N2 terminal device context release request message (N2 UE Context Release Request message).
  • N2 terminal context release request message may include indication information that the terminal device is not allowed to provide connection services.
  • the access network element receives the authorization result or the N2 terminal device context release request message.
  • the access management network element can also send the authorization result to the terminal device.
  • the access management network element sends a deregistration request message (Deregistration Request message) to the terminal device.
  • the deregistration request message may include indication information that the terminal device is not allowed to provide connection services. After the terminal device receives the deregistration request message, the terminal device releases resources used to provide connection services.
  • the access management network element determines that the terminal device is in a prohibited area, which is similar to the above-mentioned process of S802 in which the access management network element determines that the terminal device is outside or within the authorized location range, and repeated details will not be repeated. The difference is that when the terminal device is within the prohibited area, the access management network element determines that the terminal device is not allowed to provide connection services; when the terminal device is outside the prohibited area, the access management network element determines that the terminal device is allowed to provide connection services.
  • FIG. 9 is a schematic diagram of the authorization process in the IAB scenario, including the following steps:
  • UDM sends Access and Mobility Subscription data to AMF.
  • the Access and Mobility Subscription data includes IAB-operation allowed indication and authorized path/area.
  • IAB-operation allowed indication is an example of the above operation allowed indication information
  • authorized path/area is an example of the above authorized location range.
  • the Access and Mobility Subscription data also includes a validity period.
  • the validity period is an example of the above authorization time range.
  • AMF obtains the location of IAB-UE from LMF.
  • S904 AMF determines whether the IAB-UE is within the authorized path/area and determines the authorization result.
  • the non-authorized indication information is used to indicate that the IAB-UE is not authorized, that is, the IAB-UE is not allowed to provide connection services. This example mainly explains the situation when IAB-UE is outside the authorized path/area.
  • the authorization result is determined to be authorization indication information.
  • the authorization indication information is used to instruct the IAB-UE to authorize it, that is to say, the IAB-UE is allowed to provide connection services.
  • the S903 and S904 are possible implementation methods 1.
  • S905 AMF subscribes to LMF whether IAB-UE is within authorized path/area.
  • LMF determines that IAB-UE is outside the authorized path/area. Alternatively, LMF determines that IAB-UE is within the authorized path/area.
  • the LMF sends an event notification (event notify) message to the AMF.
  • the event notify message includes indication information used to notify the IAB-UE that it is outside the authorized path/area.
  • the event notify message includes indication information used to notify the IAB-UE that it is within the authorized path/area.
  • the S905 and S906 are possible implementation methods 2.
  • S907 AMF determines whether the TA/cell where the IAB-UE is located is in the TA/cell set corresponding to the authorized area.
  • AMF determines that the IAB-UE is outside the authorized area.
  • AMF determines that the IAB-UE is outside the authorized area.
  • AMF determines that the IAB-UE is within the authorized area.
  • AMF determines that the IAB-UE is within the authorized area.
  • the S907 and S908 are possible implementation methods 3.
  • the authorization granularity of S907 and S908 is authorized area.
  • AMF sends an N2 message to the RAN.
  • the N2 message includes unauthorized indication information.
  • the N2 message includes authorization indication information.
  • the AMF can initiate the registration process of the IAB-UE or release the NAS connection.
  • AMF determines that the IAB-UE is outside the authorized path/area and will send non-authorization indication information to the RAN. If the RAN does not obtain authorization or authorization from the IAB-UE, it defaults to the fact that the IAB-UE is not authorized.
  • S910 RAN controls the service of IAB-UE according to the N2 message.
  • the RAN may not allow the IAB-UE to provide IAB services as an IAB-node, or release the resources used by the IAB-UE to provide IAB services, or release the IAB-UE as the F1 interface of the DU, or IAB-UE is not allowed to request the establishment of F1 interface as a DU.
  • the AMF can dynamically update the IAB-UE's authorization indication when the IAB-UE is not authorized to provide IAB services outside a specific route/area.
  • the RAN can control the IAB-UE's IAB service based on the updated unauthorized indication. Prevent IAB-UE from providing IAB services in unlicensed areas (or unlicensed hours) and causing interference to existing communications.
  • FIG 10 is a schematic diagram of the authorization process in the L2 Relay scenario, including the following steps:
  • S1001 The UE initiates the registration process.
  • UDM sends 5G ProSe subscription data to AMF.
  • 5G ProSe subscription data includes L2 UE to network (UE to network, U2N) Relay authorized and Allowed area (or Non-Allowed area).
  • L2 U2N Relay authorized is used to indicate that the UE is allowed to provide L2 U2N Relay services.
  • the AMF determines to authorize the UE to serve as the L2 U2N Relay.
  • AMF determines that the UE is not authorized to serve as L2 U2N Relay based on the fact that the UE is in the Non-Allowed area.
  • the AMF sends an N2 message to the RAN.
  • the N2 message includes non-authorization indication information.
  • the N2 message When determining to authorize the UE to serve as L2 U2N Relay, the N2 message includes authorization indication information.
  • the AMF can also initiate the NAS connection release process, or actively initiate the N2 connection release process to trigger the UE to enter the idle state.
  • S1005 RAN controls the UE's L2 U2N Relay service based on the N2 message.
  • the RAN may prohibit the UE's L2 U2N Relay service.
  • the RAN can also release the RRC connection between the RAN and the UE.
  • the RAN may allow the UE's L2 U2N Relay service.
  • the AMF determines whether the UE is allowed to serve as an L2 U2N Relay based on whether the UE is in the Allowed area or Non-Allowed area, and can update the UE's authorization indication.
  • the RAN controls the UE's L2 U2N Relay service based on the updated non-authorization indication. It can prevent the UE from providing L2 U2N Relay services in the Non-Allowed area and causing interference to existing communications.
  • FIG. 11 is a schematic diagram of an authorization method provided by an embodiment of the present application. The method includes the following steps:
  • S1101 The data management network element obtains operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • Authorization conditions are used to determine whether the terminal device is allowed to provide connection services.
  • the authorization conditions include an authorized location range for the connection service and/or an authorized time range for the connection service.
  • S1102 The data management network element sends the authorization result to the access management network element according to the authorization conditions. Correspondingly, the access management network element receives the authorization result.
  • the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.
  • the data management network element can determine whether the location and/or current time of the terminal device meet the authorization conditions based on the obtained authorization conditions, and send the corresponding authorization result to the access management network element, even if the operation permission indication information allows the terminal
  • the device provides connection services.
  • the authorization conditions are not met, the data management network element does not allow the terminal device to provide connection services. It can flexibly and dynamically control and manage the connection services provided by the terminal device.
  • the above solution can also avoid providing services outside the authorized location range and/or authorized time range, and can avoid causing interference to existing communications to a certain extent.
  • the data management network element stores contract data, and the contract data includes operation permission indication information and authorization conditions.
  • the authorization process of the data management network element and the authorization process of the access management network element will not be described in detail here.
  • the data management network element obtains contract data from the universal data repository (UDR).
  • the contract data includes operation permission indication information and authorization conditions.
  • UDR provides unified data repository services.
  • the data management network element may determine the authorization result according to the authorization conditions, and then send the authorization result to the access management network element.
  • the data management network element may not send the authorization result to the access management network element. Without obtaining the authorization result, the access management network element learns that the terminal device is not allowed to provide connection services.
  • the access management network element when it determines that the terminal device is not allowed to provide connection services, it sends a deregistration request message (Deregistration Request message) to the terminal device.
  • the deregistration request message may include indication information that the terminal device is not allowed to provide connection services.
  • the terminal device After the terminal device receives the deregistration request message, the terminal device releases resources used to provide connection services.
  • the authorization conditions include an authorization time range for the connection service.
  • the data management network element can determine whether the current time is outside the authorized time range or within the authorized time range, thereby determining the authorization result.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide services.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide services.
  • the authorization conditions include an authorized location range for the connection service.
  • the data management network element can determine whether the terminal device is outside the authorized location range or whether it is within the authorized location range, thereby determining the authorization result.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide connection services.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide connection services.
  • the terminal device is mobile, such as a VMR
  • moving the terminal device out of the authorized location range will cause the terminal device to be outside the authorized location range, and moving the terminal device into the authorized location range will cause the terminal device to be within the authorized location range.
  • the authorization conditions include the authorized location range of the connection service and the authorized time range of the connection service.
  • the data management network element can determine whether the current time is outside the authorized time range (or Whether it is within the authorized time range), and whether the terminal device is outside the authorized location range (or whether it is within the authorized location range), thereby determining the authorization result.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is not allowed to provide connection services.
  • the data management network element determines that the authorization result is used to indicate that the terminal device is allowed to provide connection services.
  • the data management network element can determine whether the terminal device is outside the authorized location range or whether it is within the authorized location range based on the location of the terminal device and the authorized location range.
  • the location of the terminal device can be the real-time location estimated by the network mobile location center (such as GMLC), and the data management network element can obtain the location of the terminal device from the network mobile location center.
  • the location of the terminal device can be a location within the authorized time range.
  • the data management network element sends a location determination request message to the network mobile location center to request the location of the terminal device.
  • the location determination request message can carry authorization. time range, the network mobile location center can obtain the location of the terminal device within the authorized time range.
  • the authorized location range includes the authorized route (authorized path) and the authorized area (authorized area) of the connection service.
  • the authorized location range includes the area (Allowed) that is allowed to provide connection services. area) and areas where connection services are prohibited (Non-Allowed area).
  • the data management network element determines whether the terminal device is outside the authorized location range, or whether Within the authorized location range, the judgment result is then notified to the access management network element.
  • the data management network element can send a request message to the network mobile location center.
  • the request message includes information about the authorized location range.
  • the request message is used to request whether the terminal device is outside the authorized location range, or whether it is within the authorized location range. within.
  • the network mobile location center sends notification information to the data management network element.
  • the notification information is used to notify the terminal device that it is outside the authorized location range, or that the terminal device is within the authorized location range.
  • the request message may include an authorization time range.
  • the data management network element may obtain the unauthorized location range (or forbidden area) of the connection service.
  • the data management network element does not allow the terminal device to provide connection services, thereby flexibly and dynamically controlling and managing the connection services provided by the terminal device.
  • the data management network element determines that the terminal device is in a prohibited area, which is similar to the process in which the data management network element determines that the terminal device is outside or within the authorized location range in S1102 above, and repeated details will not be repeated. The difference is that when the terminal device is within the prohibited area, the data management network element determines that the terminal device is not allowed to provide connection services; when the terminal device is outside the prohibited area, the data management network element determines that the terminal device is allowed to provide connection services.
  • FIG. 12 is a schematic diagram of the authorization process in the IAB scenario, including the following steps:
  • S1202 UDM saves Access and Mobility Subscription data, which includes IAB-operation allowed indication and authorized path/area.
  • IAB-operation allowed indication is an example of the above operation allowed indication information
  • authorized path/area is an example of the above authorized location range.
  • the Access and Mobility Subscription data also includes a validity period.
  • the validity period is an example of the above authorization time range.
  • UDM obtains the location of the IAB-UE from GMLC.
  • S1204 DUM determines whether the IAB-UE is within the authorized path/area and determines the authorization result.
  • the non-authorized indication information is used to indicate that the IAB-UE is not authorized, that is, the IAB-UE is not allowed to provide connection services. This example mainly explains the situation when IAB-UE is outside the authorized path/area.
  • the authorization result is determined to be authorization indication information.
  • the authorization indication information is used to instruct the IAB-UE to authorize it, that is to say, the IAB-UE is allowed to provide connection services.
  • the S1203 and S1204 are possible implementation methods 1.
  • S1205 UDM subscribes to GMLC whether the IAB-UE is within the authorized path/area.
  • GMLC determines that IAB-UE is outside the authorized path/area. Alternatively, GMLC determines that the IAB-UE is within the authorized path/area.
  • GMLC sends an event notification (event notify) message to UDM.
  • the event notify message includes indication information used to notify the IAB-UE that it is outside the authorized path/area.
  • the event notify message includes indication information used to notify the IAB-UE that it is within the authorized path/area.
  • the S1205 and S1206 are possible implementation methods 2.
  • the Access and Mobility Subscription data includes IAB-operation allowed indication and unauthorized indication information.
  • S1208 AMF sends an N2 message to the RAN.
  • the N2 message includes unauthorized indication information.
  • the N2 message includes authorization indication information.
  • S1209 RAN controls the service of IAB-UE according to the N2 message.
  • UDM can dynamically update the IAB-UE's authorization indication when the IAB-UE is not authorized to provide IAB services outside a specific route/area.
  • the RAN can control the IAB-UE's IAB service based on the updated unauthorized indication. Prevent IAB-UE from providing IAB services in unlicensed areas (or unlicensed hours) and causing interference to existing communications.
  • the communication device 1300 includes a receiving unit 1301 and a sending unit 1302.
  • the functions implemented by the optional receiving unit 1301 and the sending unit 1302 can be completed by the communication interface, and the receiving unit and the sending unit can be integrated into a sending and receiving unit.
  • the communication device 1300 may be an access management network element or a data management network element or a terminal device, or may be located in an access management network element or a data management network element or a terminal device.
  • the communication device 1300 can be used to implement the method described in the above method embodiment. For example, the communication device 1300 can perform various steps performed by the access management network element or the data management network element or the terminal device in the above-mentioned methods of FIGS. 8A to 12 .
  • the communication device 1300 is applied to access management network elements.
  • the receiving unit 1301 is used to obtain operation permission indication information and authorization conditions.
  • the operation permission indication information is used to indicate that the terminal device is allowed to provide connection services.
  • the authorization conditions include an authorized location range of the connection service and/or an authorized time range of the connection service;
  • the sending unit 1302 is configured to send an authorization result to the access network element to which the terminal device accesses according to the authorization condition.
  • the authorization result is used to indicate that the terminal device is not allowed to provide connection services, or that the terminal device is allowed to provide connection services.
  • the sending unit 1302 is specifically configured to send the authorization result to the access network element according to the authorized location range and/or the authorized time range.
  • the sending unit 1302 is also used to send the authorization result to the terminal device.
  • a processing unit 1303 is also included, configured to determine the authorization result according to the authorization conditions.
  • the processing unit is specifically configured to determine the authorization result based on the authorization location range and/or the authorization time range.
  • the processing unit 1303 is specifically configured to determine the authorization result to indicate that the terminal device is not allowed to provide connection services when the current time is outside the authorization time range; when the current time is within the authorization time range, determine the authorization result. The result is used to indicate that the terminal device is allowed to provide connection services.
  • the processing unit 1303 is specifically configured to determine that the authorization result is used to indicate that the terminal device is not allowed to provide connection services when the terminal device is outside the authorized location range; when the terminal device is within the authorized location range, determine The authorization result is used to indicate that the terminal device is allowed to provide connection services.
  • the receiving unit 1301 is also used to receive notification information sent by the positioning management network element.
  • the notification information is used to notify the terminal device that it is outside the authorized location range or within the authorized location range;
  • the processing unit 1303 is specifically configured to determine that the authorization result is used to indicate that the terminal device is not allowed to provide connection services when the notification information is used to notify the terminal device that it is outside the authorized location range; when the notification information is used to notify the terminal device that it is outside the authorized location range.
  • the authorization result is used to indicate that the terminal device is allowed to provide connection services.
  • the processing unit 1303 is specifically configured to determine that the authorization result is used to indicate that the terminal device is not allowed to provide connection services when the tracking area where the terminal device is located is outside the tracking area corresponding to the authorized location range; when the terminal device When the tracking area is within the tracking area corresponding to the authorized location range, the authorization result is determined to indicate that the terminal device is allowed to provide connection services.
  • connection service includes access backhaul integrated IAB service, and the terminal device is an IAB terminal device; or
  • connection service includes vehicle relay VMR service, and the terminal device is a VMR device; or
  • connection service includes relay service
  • terminal device is a relay terminal device.
  • the authorized location range includes one or more of the following: authorized routes for connecting services, authorized areas for connecting services, areas that are allowed to provide connection services, or areas that are prohibited from providing connection services.
  • the communication device 1300 is applied to a terminal device.
  • the receiving unit 1301 is configured to receive a first authorization result sent by the access management network element, where the first authorization result is used to indicate that the terminal device is not allowed to provide connection services;
  • the processing unit 1303 is configured to release resources used to provide connection services according to the first authorization result.
  • the processing unit 1303 is specifically configured to release the F1 interface, which is used for information transmission between the terminal device and the access network element accessed by the terminal device.
  • the receiving unit 1301 is also configured to receive a second authorization result sent by the access management network element, where the second authorization result is used to indicate that the terminal device is allowed to provide connection services;
  • the processing unit 1303 is also configured to provide connection services according to the second authorization result.
  • each functional unit in each embodiment of the present application It can be integrated in a processing unit, or it can exist physically alone, or two or more units can be integrated in one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • the transceiver unit may include a receiving unit and/or a transmitting unit.
  • Integrated units may be stored in a computer-readable storage medium if they are implemented in the form of software functional units and sold or used as independent products. Based on this understanding, the integrated unit can be stored in a storage medium as a computer software product, including a number of instructions to cause a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) Execute all or part of the steps of the methods of each embodiment of the application.
  • a computer device which can be a personal computer, a server, or a network device, etc.
  • processor processor
  • this embodiment of the present application also provides a schematic structural diagram of a communication device 1400.
  • the communication device 1400 may be used to implement the method described in the above method embodiment. Please refer to the description in the above method embodiment.
  • the communication device 1400 can perform each step performed by the access management network element or the data management network element or the terminal device in the methods of FIGS. 8A to 12 .
  • Apparatus 1400 includes one or more processors 1401.
  • the processor 1401 may be a general-purpose processor or a special-purpose processor, or the like.
  • it can be a baseband processor or a central processing unit.
  • the baseband processor can be used to process communication protocols and communication data
  • the central processor can be used to control communication devices (such as base stations, terminals, or chips, etc.), execute software programs, and process data of software programs.
  • the communication device may include a transceiver unit to implement input (reception) and output (transmission) of signals.
  • the transceiver unit can be a transceiver, a radio frequency chip, etc.
  • the device 1400 includes one or more processors 1401, and the one or more processors 1401 can implement the methods in the embodiments shown above.
  • the processor 1401 can also implement other other functions.
  • the processor 1401 can execute instructions to cause the device 1400 to perform the method described in the above method embodiment.
  • the instructions may be stored in whole or in part within processor 1401, such as instructions 1403 may be stored in whole or in part in processor 1401, or instructions 1403 may be stored in processor 1401, and instructions 1404 may be stored in memory 1402 coupled to the processor,
  • the processor 1401 can synchronously execute instructions 1403 and 1404 to cause the device 1400 to perform the method described in the above method embodiment.
  • Instructions 1403 and 1404 are also referred to as computer programs.
  • the communication device 1400 may also include a circuit, and the circuit may implement the functions in the foregoing method embodiments.
  • the device 1400 may include one or more memories 1402, on which instructions 1404 are stored, and the instructions may be executed on the processor 1401, so that the device 1400 executes the method described in the above method embodiment.
  • the memory 1402 may also store data.
  • Optional processor 1401 may also store instructions and/or data.
  • one or more memories 1402 may store the corresponding relationships described in the above embodiments, or related parameters or tables involved in the above embodiments.
  • the processor and memory can be set up separately or integrated together.
  • the device 1400 may also include a transceiver 1405 and an antenna 1406.
  • the processor 1401 may be called a processing unit and controls a device (terminal or base station).
  • the transceiver 1405 may be called a transceiver, a transceiver circuit, a transceiver unit, etc., and is used to implement the transceiver function of the device through the antenna 1406.
  • the processor can be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of this application. , general processor, digital signal processor (DSP), off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • FPGA off-the-shelf programmable gate array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module may be stored in a storage medium located in a memory.
  • the memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory.
  • Erase programmable read-only memory Electrically EPROM, EEPROM
  • Volatile memory may be Random Access Memory (RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • synchronous link dynamic random access memory synchronous link DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • Embodiments of the present application also provide a computer-readable medium on which a computer program is stored.
  • the computer program When executed by a computer, the communication method of any of the above method embodiments is implemented.
  • An embodiment of the present application also provides a computer program product, including a computer program, which implements the communication method of any of the above method embodiments when executed by a computer.
  • An embodiment of the present application also provides a communication system, including an access management network element and an access network element.
  • the access management network element and the access network element can implement the communication method of any of the above method embodiments.
  • the communication system also includes one or more of a terminal device and a data management network element.
  • the terminal device and data management network element can implement the communication method of any of the above method embodiments.
  • a computer program product includes one or more computer instructions.
  • Computer instructions When computer instructions are loaded and executed on a computer, processes or functions according to embodiments of the present application are generated in whole or in part.
  • the computer may be the communication device described above.
  • Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer-readable storage medium may be the above-mentioned storage medium or the above-mentioned memory.
  • the processing unit or processor 1401 may be one or more logic circuits, a sending unit Or the receiving unit or transceiver 1405 may be an input-output interface, also known as a communication interface, or an interface circuit, or an interface, etc. Or the transceiver 1405 can also be a sending unit and a receiving unit.
  • the sending unit can be an output interface, and the receiving unit can be an input interface.
  • the sending unit and the receiving unit are integrated into one unit, such as an input-output interface.
  • the logic circuit 1501 can be a chip, a processing circuit, an integrated circuit or a system on chip (SoC) chip, etc.
  • the interface circuit 1502 can be a communication interface, an input-output interface, etc.
  • the logic circuit and the interface circuit may also be coupled to each other. The embodiments of this application do not limit the specific connection methods of the logic circuit and the interface circuit.
  • the logic circuit 1501 and the interface circuit 1502 may be used to perform functions or operations performed by the above-mentioned network functions or control plane functions, etc.
  • the interface circuit 1502 may be used to receive signals from other communication devices other than the communication device 1500 and transmit them to the logic circuit 1501 or to send signals from the logic circuit 1501 to other communication devices other than the communication device 1500 .
  • the logic circuit 1501 may be used to implement any of the above method embodiments by executing code instructions.
  • the interface circuit 1502 is configured to receive operation permission indication information and authorization conditions.
  • the functions or operations performed by the communication device reference may be made to the foregoing method embodiments, which will not be described again here.
  • the disclosed systems, devices and methods can be achieved through other means.
  • the device embodiments described above are only illustrative.
  • the division of units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.
  • a unit described as a separate component may or may not be physically separate.
  • a component shown as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.
  • each functional unit in various embodiments of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • Computer-readable media includes computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • Storage media can be any available media that can be accessed by the computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种授权方法及装置。该方法包括：接入管理网元获取操作允许指示信息和授权条件，操作允许指示信息用于指示允许终端设备提供连接服务，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围；接入管理网元根据授权位置范围和/或授权时间范围，向终端设备接入的接入网元发送授权结果，授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务，即使操作允许指示信息用于指示允许终端设备提供连接服务，接入管理网元也可以基于授权条件，确定不允许终端设备提供连接服务，从而避免终端设备在授权位置范围和/或授权时间范围之外提供连接服务。

Description

一种授权方法及装置
相关申请的交叉引用
本申请要求在2022年03月21日提交中国国家知识产权局、申请号为202210276517.8、申请名称为“一种授权方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种授权方法及装置。
背景技术
用户设备(user equipment，UE)在注册过程中，统一数据管理(unified data management，UDM)向接入及移动性管理功能(access and mobility management function，AMF)提供UE的签约数据。UE的签约数据中包括操作允许指示信息，操作允许指示信息用于指示授权UE提供连接服务或非授权UE提供连接服务。AMF仅根据操作允许指示信息，向RAN发送UE授权指示或UE非授权指示，用于RAN对UE的连接服务进行控制。
网络仅根据操作允许指示信息，控制和管理UE的连接服务，例如操作允许指示信息用于指示授权UE提供连接服务时，UE可以在任何位置、任何时间提供连接服务，导致网络对UE提供连接服务进行控制和管理的灵活性较差。
发明内容
本申请实施例提供一种授权方法及装置，用以灵活动态地对UE提供连接服务进行控制和管理。
第一方面，提供一种授权方法，包括如下过程：接入管理网元获取操作允许指示信息和授权条件，操作允许指示信息用于指示允许终端设备提供连接服务，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围；接入管理网元根据授权条件，向终端设备接入的接入网元发送授权结果，授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务。
相应的，接入网元接收授权结果，然后根据该授权结果，控制终端设备的连接服务。终端设备可以根据接入网元的控制，执行相应的操作，例如终端设备可以释放用于提供连接服务的资源或提供连接服务。
相关技术中接入管理网元仅根据操作允许指示信息允许终端设备在任何位置、任何时间提供连接服务，可能导致网络对UE提供连接服务进行控制和管理的灵活性较差，还可能导致终端设备在授权位置范围或授权时间范围之外对已有通信造成干扰。而在上述方案中，除操作允许指示信息外，接入管理网元还可以获取到授权条件，这样即使操作允许指示信息用于指示允许终端设备提供连接服务，接入管理网元也可以基于授权条件，确定不允许终端设备提供连接服务，从而可以灵活动态地对UE提供连接服务进行控制和管理，避免终端设备在授权位置范围和/或授权时间范围之外提供服务。
示例的，接入管理网元可以根据授权位置范围和/或授权时间范围，向接入网元发送授权结果。更具体的，接入管理网元可以根据终端设备的位置和连接服务的授权位置范围，和/或当前时间和连接服务的授权时间范围，向接入网元发送授权结果。
在一种可能的实现中，接入管理网元还可以向终端设备发送授权结果。
相应的，终端设备可以接收到授权结果，然后根据授权结果，执行相应的操作。例如授权结果用于指示不允许终端设备提供连接服务，终端设备可以释放用于提供连接服务的资源，授权结果用于指示允许终端设备提供连接服务，终端设备可以提供连接服务。
可选的，终端设备可以根据接入网元的控制和/或授权结果，执行相应的操作。
在一种可能的实现中，在接入管理网元根据授权条件，向终端设备接入的接入网元发送授权结果时，接入管理网元可以根据授权条件(如授权位置范围和/或授权时间范围)确定授权结果，向接入网元发送授权结果。
示例的，接入管理网元可以根据终端设备的位置和连接服务的授权位置范围，确定授权结果。又一示例的，接入管理网元可以根据当前时间和连接服务的授权位置范围，确定授权结果。
在一种可能的实现中，授权条件包括连接服务的授权时间范围。
在接入管理网元根据授权时间范围确定授权结果时，在当前时间在授权时间范围之外时，接入管理网元可以确定授权结果用于不允许终端设备提供连接服务；在当前时间在授权时间范围之内时，接入管理网元可以确定授权结果用于允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权时间范围之外提供服务对已有通信造成干扰。
在一种可能的实现中，授权条件包括连接服务的授权位置范围。
在接入管理网元根据授权位置范围确定授权结果时，在终端设备在授权位置范围之外时，接入管理网元可以确定授权结果用于指示不允许终端设备提供连接服务；在终端设备在授权位置范围之内时，接入管理网元可以确定授权结果用于指示允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权位置范围之外提供服务对已有通信造成干扰。
示例的，终端设备可以从定位管理网元中获取终端设备的位置，根据终端设备的位置和授权位置范围，判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内。
在一种可能的实现中，授权条件包括连接服务的授权位置范围。
在接入管理网元根据授权位置范围确定授权结果时，在终端设备在授权位置范围之外时，接入管理网元接收定位管理网元发送的通知信息，通知信息用于通知终端设备在授权位置范围之外，或在授权位置范围之内；在通知信息用于通知终端设备在授权位置范围之外时，接入管理网元确定授权结果用于指示不允许终端设备提供连接服务；在通知信息用于通知终端设备在授权位置范围之内时，接入管理网元确定授权结果用于指示允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权位置范围之外提供服务对已有通信造成干扰。
示例的，终端设备可以向定位管理网元发送请求消息，用于请求终端设备是否在授权位置范围之外，或在授权位置范围之内。该请求消息可以包括授权位置范围的信息。
在一种可能的实现中，授权条件包括连接服务的授权位置范围。
在接入管理网元根据授权位置范围确定授权结果时，在终端设备在授权位置范围之外时，在终端设备所在的跟踪区在授权位置范围对应的跟踪区范围之外时，接入管理网元确定授权结果用于指示不允许终端设备提供连接服务；在终端设备所在的跟踪区在授权位置 范围对应的跟踪区范围之内时，接入管理网元确定授权结果用于指示允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权位置范围之外提供服务对已有通信造成干扰。
示例的，接入管理网元可以从网络开放网元获取授权位置范围对应的跟踪区范围。
在一种可能的实现中，连接服务包括接入回传一体化IAB服务，终端设备为IAB终端设备；或者连接服务包括车载中继VMR服务，终端设备为VMR设备；或者连接服务包括中继服务，终端设备为中继relay终端设备。VMR还可以是移动基站中继(mobile base station relay)。
在一种可能的实现中，授权位置范围包括以下一个或多个：连接服务的授权路线、连接服务的授权区域、允许提供连接服务的区域或禁止提供连接服务的区域。
示例的，在IAB场景下，授权位置范围包括连接服务的授权路线和连接服务的授权区域。又一示例的，在L2 Relay场景下，授权位置范围包括允许提供连接服务的区域和禁止提供连接服务的区域。
第二方面，提供一种授权方法，包括如下过程：数据管理网元获取操作允许指示信息和授权条件，操作允许指示信息用于指示允许终端设备提供连接服务，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围；数据管理网元根据授权条件，向接入管理网元发送授权结果，授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务。
在一种可能的实现中，在数据管理网元根据授权条件，向接入管理网元发送授权结果时，数据管理网元可以根据授权条件确定授权结果(如授权位置范围和/或授权时间范围)，向接入管理网元发送授权结果。
示例的，数据管理网元可以根据终端设备的位置和连接服务的授权位置范围，确定授权结果。又一示例的，数据管理网元可以根据当前时间和连接服务的授权位置范围，确定授权结果。
在一种可能的实现中，授权条件包括连接服务的授权时间范围。
在数据管理网元根据授权时间范围确定授权结果时，在当前时间在授权时间范围之外时，数据管理网元可以确定授权结果用于不允许终端设备提供连接服务；在当前时间在授权时间范围之内时，数据管理网元可以确定授权结果用于允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权时间范围之外提供服务对已有通信造成干扰。
在一种可能的实现中，授权条件包括连接服务的授权位置范围。
在数据管理网元根据授权位置范围确定授权结果时，在终端设备在授权位置范围之外时，数据管理网元可以确定授权结果用于指示不允许终端设备提供连接服务；在终端设备在授权位置范围之内时，数据管理网元可以确定授权结果用于指示允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权位置范围之外提供服务对已有通信造成干扰。
示例的，终端设备可以从网关移动位置中心中获取终端设备的位置，根据终端设备的位置和授权位置范围，判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内。
在一种可能的实现中，授权条件包括连接服务的授权位置范围。
在数据管理网元根据授权位置范围确定授权结果时，数据管理网元接收网关移动位置中心发送的通知信息，通知信息用于通知终端设备在授权位置范围之外，或在授权位置范 围之内；在通知信息用于通知终端设备在授权位置范围之外时，数据管理网元确定授权结果用于指示不允许终端设备提供连接服务；在通知信息用于通知终端设备在授权位置范围之内时，数据管理网元确定授权结果用于指示允许终端设备提供连接服务。在该实现中，可以避免终端设备在授权位置范围之外提供服务对已有通信造成干扰。
示例的，终端设备可以向网关移动位置中心发送请求消息，用于请求终端设备是否在授权位置范围之外，或在授权位置范围之内。该请求消息可以包括授权位置范围的信息。
在一种可能的实现中，连接服务包括接入回传一体化IAB服务，终端设备为IAB终端设备；或者连接服务包括车载中继VMR服务，终端设备为VMR设备或移动基站中继(mobile base station relay)设备；或者连接服务包括中继服务，终端设备为中继relay终端设备。
在一种可能的实现中，授权位置范围包括以下一个或多个：连接服务的授权路线、连接服务的授权区域、允许提供连接服务的区域或禁止提供连接服务的区域。
示例的，在IAB场景下，授权位置范围包括连接服务的授权路线和连接服务的授权区域。又一示例的，在L2 Relay场景下，授权位置范围包括允许提供连接服务的区域和禁止提供连接服务的区域。
第三方面，提供一种授权方法，包括如下过程：终端设备接收接入管理网元发送的第一授权结果，第一授权结果用于指示不允许终端设备提供连接服务；终端设备根据第一授权结果，释放用于提供连接服务的资源。
在上述方案中，接入管理网元可以向终端设备发送授权结果，指示不允许终端设备提供连接服务，从而避免终端设备在授权位置范围和/或授权时间范围之外提供服务对已有通信造成干扰。
在一种可能的实现中，在释放用于提供连接服务的资源时，终端设备释放F1接口，F1接口用于终端设备和接入网元之间的信息传输。
在一种可能的实现中，终端设备还可以接收接入管理网元发送的第二授权结果，第二授权结果用于指示允许终端设备提供连接服务，终端设备可以第二授权结果，提供连接服务。在该实现中，接入管理网元可以向终端设备指示允许终端设备提供连接服务，从而保证业务连续性和可靠性。
第四方面，提供一种授权方法，包括如下过程：终端设备接收终端设备接入的接入网元发送的连接控制消息，连接控制消息用于控制终端设备不提供连接服务；终端设备根据连接控制消息，释放用于提供连接服务的资源。
在上述方案中，终端设备可以在接入网元的控制下，释放用于提供连接服务的资源，从而避免终端设备在授权位置范围和/或授权时间范围之外提供服务对已有通信造成干扰。
在一种可能的实现中，在释放用于提供连接服务的资源时，终端设备释放F1接口，F1接口用于终端设备和接入网元之间的信息传输。
在一种可能的实现中，连接控制消息还可以用于控制终端设备提供连接服务，终端设备还可以根据连接控制消息，提供连接服务。在该实现中，终端设备可以在接入网元的控制下提供连接服务，从而保证业务连续性和可靠性。
第五方面，提供一种通信装置，该通信装置可以为接入管理网元或数据管理网元或终端设备，或者为设置在接入管理网元或数据管理网元或终端设备中的芯片。该通信装置可 以实现上述任一方面所提供的方法。
通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
第六方面，提供一种通信装置，包括收发单元。可选地，该通信装置还包括处理单元。该通信装置可以实现任一方面或任一方面中的任一项实现所提供的方法。
第七方面，提供一种通信装置，包括处理器。该处理器可用于执行上述任一方面或任一方面中的任一项实现所提供的方法。可选地，该装置还包括存储器，该处理器与存储器耦合，存储器中用于存储计算机程序或指令，处理器可以执行存储器中的程序或指令，以使得该装置可以执行上述任一方面或任一方面中的任一项实现所提供的方法。
第八方面，提供一种通信装置，该装置包括接口电路和逻辑电路，逻辑电路与接口电路耦合。该接口电路可以为代码/数据读写接口电路，该接口电路用于接收计算机执行指令(计算机执行指令存储在存储器中，可能直接从存储器读取，或可能经过其他器件)并传输至该逻辑电路，以使该逻辑电路运行计算机执行指令以执行上述任一方面或任一方面中的任一项实现所提供的方法。
在一些可能的设计中，该通信装置可以为芯片或芯片系统。
第九方面，提供一种通信装置，包括处理器，处理器和存储器耦合。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以执行上述任一方面或任一方面中的任一项实现所提供的方法。
可选地，该处理器可以为一个或多个，该存储器也可以为一个或多个。可选地，该存储器可以与该处理器集成在一起，或者该存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型以及存储器与处理器的设置方式不做限定。
该通信装置可以是一个芯片，该处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第十方面，提供一种处理器，包括：输入电路、输出电路和处理电路。该处理电路用于通过该输入电路接收信号，并通过该输出电路发射信号，使得该处理器执行上述任一方面或任一方面中的任一项实现所提供的方法。
在具体实现过程中，上述处理器可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请对处理器及各种电路的具体实现方式不做限定。
第十一方面，提供一种通信装置，包括：逻辑电路和输入输出接口，该输入输出接口用于与该通信装置之外的模块通信；该逻辑电路用于运行计算机程序或指令以执行上述任一方面的任一项设计所提供的方法。该通信装置可以为上述任一方面中的第一接入网元或 第二接入网元或接入管理网元，或者包含上述接入管理网元或数据管理网元或终端设备的装置，或者上述接入管理网元或数据管理网元或终端设备中包含的装置，比如芯片。
或者，该输入输出接口可以为代码/数据读写接口电路，或通信接口，该输入输出接口用于接收计算机程序或指令(计算机程序或指令存储在存储器中，可能直接从存储器读取，或可能经过其他器件)并传输至该输入输出接口，以使该输入输出接口运行计算机程序或指令以执行上述任一方面的方法。
可选的，该通信装置可以为芯片。
第十二方面，提供一种计算机程序产品，该计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当该计算机程序被运行时，使得计算机执行上述任一方面或任一方面中的任一项实现所提供的方法。
第十三方面，提供一种计算机可读介质，该计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述任一方面或任一方面中的任一项实现所提供的方法。
第十四方面，提供一种芯片系统，该芯片系统包括处理器和接口，用于支持通信装置实现上述任一方面或任一方面中的任一项实现所提供的功能。在一种可能的设计中，芯片系统还包括存储器，用于保存前述通信装置的必要的信息和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十五方面，提供芯片装置，该芯片装置包括输入接口和/或输出接口。该输入接口可以实现上述任一方面或任一方面中的任一项实现所提供的接收功能，该输出接口可以实现上述任一方面或任一方面中的任一项实现所提供的发送功能。
第十六方面，提供一种功能实体，该功能实体用于实现上述任一方面或任一方面中的任一项实现所提供的方法。
第十七方面，提供一种通信系统，包括用于执行上述第一方面中的方法的接入管理网元和接入网元。
可选的，该通信系统还可以包括用于执行上述第三方面和/或第四方面中的方法的终端设备。
第十八方面，提供一种通信系统，包括用于执行上述第二方面中的数据管理网元和接入管理网元。
可选的，该通信系统还可以包括用于执行上述第三方面和/或第四方面中的方法的终端设备和接入网元。
其中，上述第五方面至第十八方面中任一实现所带来的技术效果可参见上述第一方面至第四方面所带来的技术效果，此处不再赘述。
附图说明
图1A为一种5G通信系统的架构示意图；
图1B为一种IAB架构的示意图；
图2为一种移动IAB架构的示意图；
图3为一种IAB-node的入网流程示意图；
图4为一种L2 Relay架构的示意图；
图5为一种远端UE的连接建立流程示意图；
图6为一种UE定位的发起流程示意图；
图7为一种UE定位的终结流程示意图；
图8A为本申请实施例提供的一种授权过程示意图；
图8B为本申请实施例提供的又一种授权过程示意图；
图9为本申请实施例提供的一种IAB场景的授权流程示意图；
图10为本申请实施例提供的一种L2 Relay场景的授权流程示意图；
图11为本申请实施例提供的一种授权过程示意图；
图12为本申请实施例提供的一种IAB场景的授权流程示意图；
图13为本申请实施例提供的一种通信装置的结构示意图；
图14为本申请实施例提供的一种通信装置的结构示意图；
图15为本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
下面将结合说明书附图对本申请实施例做详细描述。
本申请实施例的技术方案可以应用于移动通信系统。例如，移动通信系统可以为第四代(4th Generation，4G)通信系统(例如，长期演进(long term evolution，LTE)系统)，第五代移动通信(5th-generation，5G)通信系统(例如，新无线(new radio，NR)系统)，及未来的移动通信系统如6G等。
3GPP标准组制定了下一代移动通信网络架构(next generation system)，称为5G网络架构。图1A为5G网络架构的一个示意图，包括：终端设备部分、网络设备部分和数据网络(data network，DN)部分。
终端设备部分，一般包括用户设备(user equipment，UE)等。在无线网络中，UE是一种具有无线收发功能的设备，可以经无线接入网(radio access network，RAN)中的接入网元与一个或多个核心网(core network，CN)网元进行通信。
例如用户设备也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、用户代理或用户装置等。用户设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。用户设备可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、智能电话(smart phone)、手机(mobile phone)、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)等。或者，用户设备还可以是具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它设备、车载设备、可穿戴设备、无人机设备或物联网中的终端(也称物联网设备)、车联网中的终端、5G网络以及未来网络中的任意形态的终端、中继用户设备、移动终端(mobile-termination，MT)或者未来演进的公共移动陆地网络(public land mobile network，PLMN)中的终端等。其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。例如用户设备可以是虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。本申请实施例对终端设备 的类型或种类等并不限定。
网络设备部分包括网络开放功能(network exposure function，NEF)、网络存储功能(network repository function，NRF)、策略控制功能(policy control function，PCF)、UDM、认证服务器功能(authentication server function，AUSF)、AMF、会话管理功能(session management function，SMF)、用户面功能(user plane function，UPF)、接入网(access network，AN)、网络切片选择功能(network slice selection function，NSSF)等。上述网络设备中，除接入网部分之外的部分可以称为核心网部分。
核心网部分包括用户面功能和控制面功能。用户面功能主要负责数据包的转发、服务质量(quality of service，QoS)控制、计费信息统计等。控制面功能主要负责业务流程交互、向用户面功能下发数据包转发策略、QoS控制策略等。
数据网络DN，也可以称为分组数据网络(packet data network，PDN)，通常可以部署在运营商网络之外，例如第三方网络。示例性的，运营商网络可以接入多个DN，DN上可部署多种业务，从而为UE提供数据和/或语音等服务。上述第三方可为运营商网络和UE之外的服务方，可为UE提供其他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
应用功能(application function，AF)可以隶属于运营商网络，也可以不隶属于运营商网络。不过通常情况下，AF隶属于第三方而不属于运营商网络，但同运营商网络有协议关系。AF用于提供各种业务服务的功能网元，可以支持通过应用来影响数据路由的功能以及接入网络开放功能NEF、与策略框架交互进行策略控制等。
示例性的，下面对运营商网络中的网络功能进行简要介绍。
RAN，是运营商网络的子网络，是运营商网络中业务节点(或网络功能)与UE之间的实施系统。UE要接入运营商网络，首先是经过RAN，进而通过RAN与运营商网络中的业务节点连接，即RAN存在于UE和核心网部分之间，提供两者间的通信连接。本申请实施例中的RAN，可以指代接入网本身，也可以指接入网元，此处不作区分。接入网元是一种为UE提供无线通信功能的设备，也可以称为接入网设备、或AN设备等。该接入网元包括但不限于：5G系统中的下一代基站或下一代节点B(generation node B，gNB)、LTE系统中的演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(home node B，HNB)、室内基带处理单元(building base band unit，BBU)、收发点(transmit receive point，TRP)、传输点(transmission point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本申请对接入网设备的具体类型不作限定。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。
可选的，在接入设备的一些部署中，接入设备可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)等。
NEF是由运营商提供的控制面功能，提供网络能力开放相关的框架、鉴权和接口，在5G系统中网络功能和其他网络功能之间传递信息。NEF以安全的方式对第三方开放网络的能力的对外双向接口。在其他网络功能(如AF等)需要与第三方的网络通信时，NEF可作为与第三方的网络实体进行通信的中继。NEF还可作为签约用户的标识信息的翻译，以及第三方的网络功能的标识信息的翻译。比如，NEF将签约用户的用户永久标识符 (subscriber permanent identifier，SUPI)从PLMN发送到第三方时，可以将SUPI翻译成其对应的外部公开使用的签约标识(generic public subscription identifier，GPSI)。反之，NEF将外部信息转发送到PLMN网络，防止PLMN内部的其他网络功能与外部直接接触。
NRF是由运营商提供的控制面功能，可用于维护网络中所有网络功能服务的实时信息。
PCF是由运营商提供的控制面功能，用于生成、管理用户、会话、QoS流处理策略。它支持统一的策略框架来治理网络行为、向其他控制功能提供策略规则、策略决策相关的签约信息等。
UDM是由运营商提供的控制面功能，负责存储PLMN中签约用户的安全上下文(security context)、签约数据等信息。上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的终端设备芯卡的用户，或者使用中国移动的终端设备芯卡的用户等。示例性的，上述安全上下文可以为存储在本地终端设备(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可以为该终端设备芯卡的配套业务，例如该手机芯卡的流量套餐等。
AUSF是由运营商提供的控制面功能，通常用于一级认证，即UE(签约用户)与运营商网络之间的网络认证。
AMF是由运营商网络提供的控制面网络功能，负责UE接入运营商网络的接入控制和移动性管理，例如包括注册管理、连接管理、可达性管理、移动管理，分配用户临时身份标识，认证和授权用户等功能。
SMF是由运营商网络提供的控制面网络功能，负责管理UE的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与DN互相传输数据。PDU会话可以由SMF负责建立、维护和删除等。SMF包括会话管理(如会话建立、修改和释放，包含UPF和AN之间的隧道维护等)、UPF的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
UPF是由运营商提供的网关，是运营商网络与DN通信的网关。UPF包括数据包路由和传输、包检测、业务用量上报、QoS处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
NSSF，是由运营商网络提供的控制面网络功能，用于负责确定网络切片实例，选择AMF等。
在一些场景中，核心网部分还可以包括定位管理功能(location management function，LMF)，用于采用特定的定位技术获取UE的位置信息。定位技术包括但不限于：下行到达时间差定位(observed time difference of arrival，OTDOA)、上行到达时间差定位(uplink time difference of arrival，UTDOA)、定时提前量(timing advance，TA)、或到达角向(angle of arrival，AoA)等技术。
在一些场景中，核心网部分还可以包括网关移动位置中心(gateway mobile location center，GMLC)，主要负责向外部位置服务(location service，LCS)客户端或AF开放定位服务。
图1A中Nnef、Nausf、Nnrf、Npcf、Nudm、Naf、Namf、Nsmf、Nnssf、N1、N2、N3、N4，以及N6为接口序列号。示例性的，上述接口序列号的含义可参见3GPP标准协议中定义的含义，本申请对于上述接口序列号的含义不做限制。需要说明的是，图1A中 各个网络功能的名称、各个网络功能之间的接口名称也仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请对此不作限定。
本申请实施例可以应用于IAB场景和层2(Layer-2，L2)中继(relay)场景。
场景一：IAB场景。
5G NR研究中提出了IAB基站，IAB基站也称IAB节点(IAB-node)，IAB-node是集成了无线接入链路和无线回传链路，其中无线接入链路为UE与IAB-node之间的通信链路，无线回传链路为IAB-node之间的通信链路，主要进行数据回传。IAB-node不需要有线传输网络进行数据回传，因此IAB-node降低了对有线传输网络的部署要求，可以部署在室外、室内等不易部署有线传输网络的场景下。IAB-node包括MT功能和gNB-DU功能，IAB-node启动后IAB-node的MT功能将通过小区选择接入网络，因此需要保证IAB-node能够接入IAB网络，从而实现IAB-node的功能。图1B为一种IAB架构的示意图，下一代(next generation，NG)RAN与5G核心网(5G core，5GC)通过NG接口进行通信。NR RAN包括gNB、IAB-node和IAB-宿主(donor)gNB。IAB-donor gNB(简称为IAB-donor)包括gNB-CU功能和gNB-DU功能。其中gNB-CU主要处理非实时的无线高层协议栈功能，如无线资源控制(radio resource control，RRC)或分组数据汇聚协议(packet data convergence protocol，PDCP)等功能。gNB-DU功能主要处理物理层功能和实时性需求较高的层2功能，如物理层(physical layer，PHY)功能、媒体访问控制层(media access control，MAC)功能、无线链路控制层(radio link control，RLC)功能等。IAB-node中的gNB-DU可以用于IAB-node与IAB-donor，或者IAB-node与其他IAB-node之间的回传链路的Uu口终结点。
图2为一种移动IAB架构的示意图，车载上安装的中继(relay)(该relay随车一起移动)作为车载中继(vehicle mounted relay，VMR)或移动基站中继(mobile base station relay)支持无线中继相关功能，支持通过NR进行接入和回传，也就是说，支持通过无线回传作为业务接入以及为UE提供无线接入。与上述图1B所示的IAB机制相比，VMR具有移动性，而图1B中的IAB-node为地面上固定不动的中继，因此VMR也可以理解为移动(mobile)IAB-node。地面的donor RAN负责为UE提供核心网接口以及为VMR提供无线回传功能的RAN节点。一般情况下，donor RAN一般安装在地面上，无移动性。
IAB-node的MT(简称为IAB-MT)入网的示意图参见图3所示，包括以下步骤：
S301：IAB-MT向IAB-donor发送RRC连接建立消息。
该RRC连接建立消息包括IAB-指示(indication)。
该S301中，IAB-node发起RRC连接建立流程，接入5G系统。
具体而言，IAB-MT向IAB-donor的Donor-CU发送RRC连接建立消息。
S302：IAB-donor向AMF发送N2消息。
该N2消息中包括IAB-indication。
S303：IAB-MT完成注册流程。
具体而言，UDM向AMF提供IAB操作允许指示(IAB-operation allowed indication)，IAB操作允许指示作为接入和移动签约数据(access and mobility subscription data)的一部分。AMF向RAN发送IAB节点授权指示(IAB-node authorized indication)，该IAB-node authorized indication可以用于指示授权(authorized)或非授权(not authorized)，RAN保 存该IAB-node authorized indication。注册流程完成后，IAB-node保持连接态。
S304：IAB-MT建立协议数据单元(protocol data unit，PDU)会话，获取网际互连协议(internet protocol，IP)地址，与操作管理和维护(operation administration and maintenance，OAM)进行交互。
该S304中，IAB-MT的PDU会话通过5G网络提供IAB-node与OAM之间使用IP的传输连接。
S305：IAB-MT从OAM获取配置信息。
该配置信息中包括全球小区标识码(cell global identifier，CGI)、物理小区标识(physical cell identifier，PCI)和跟踪区代码(tracking area code，TAC)等。
S306：IAB-DU(即IAB-node的DU)向RAN发送F1建立请求(F1Setup Request)消息。
该F1建立请求消息用于请求建立F1接口(F1interface)，包括CGI、PCI和TAC等。
S307：IAB-donor的Donor-CU与AMF完成参数配置更新流程。
例如，Donor-CU与AMF完成跟踪区(tracking area，TA)列表更新。
S308：IAB-donor的Donor-CU向IAB-DU发送F1建立响应消息，完成F1接口建立。
Donor-CU根据从AMF接收的IAB-node authorized indication确定是否接受F1接口建立，若IAB-node authorized indication指示授权，则Donor-CU接受F1接口建立，若IAB-node authorized indication指示非授权，则Donor-CU不接受F1接口建立。
场景二：L2中继(Relay)场景。
当UE处于网络覆盖之外或UE与RAN之间的通信信号差时，UE作为远端(Remote)UE可以通过Relay UE进行辅助，接入网络实现Remote UE与网络通信。图4为一种L2Relay架构的示意图。在5G系统中，非直接通信支持L2 Relay的通信方式，非直接通信指Remote UE通过Relay UE接入网络的通信模式。Relay UE根据接入层(access stratum layer，AS layer)的配置，转发Remote UE的上下行数据，使得Remote UE接入RAN，与5GC进行通信。L2 Relay还可称为层二终端到网络中继(L2 UE-to-Network Relay,L2 U2N Relay)。
L2 Relay场景下Remote UE的连接建立流程参见图5所示，包括以下步骤：
S501：Remote UE和Relay UE初始注册到网络。
Remote UE在没有直连到网络情况下也可能没有注册，需要在后续S509中进行注册。
在Relay UE初始注册过程中，AMF从UDM获取5G代理服务(proximity services，ProSe)签约数据(5G ProSe subscription data)，5G ProSe subscription data包括UE被授权作为L2 Relay，AMF向RAN发送UE被授权作为L2 Relay的指示信息。
S502：Remote UE从Remote UE对应的PCF获取授权信息，Relay UE从Relay UE对应的PCF获取授权信息。
UE对应的PCF可以理解为UE注册时负责提供UE策略的PCF。
Remote UE获取到的授权信息包括UE被授权非直接通信，即作为Remote UE。
Relay UE获取到的授权信息包括UE被授权非直接通信，即作为Relay UE。
若Remote UE未注册到网络，则可以使用预配置的授权信息。
S503：Relay UE完成发现和选择流程。
S504：Remote UE向Relay UE发送非直接通信请求(indirect communication request)消息，用于指示Relay UE建立非直接通信。
S505：Relay UE发起服务请求(Service Request)消息。
该S505为可选的步骤，若Relay UE未处于连接态(RRC connected)，Relay UE发起Service Request消息，可以使得Relay UE进入连接态。
S506：Relay UE向Remote UE返回非直接通信响应(indirect communication response)消息。
在S504至S506之后，Remote UE与Relay UE建立PC5连接，Relay UE处于连接态。
S507：Remote UE通过Relay UE向RAN发送RRC建立请求(Setup Request)消息。
S508：RAN通过Relay UE向Remote UE发送RRC Setup消息。
Relay UE可以根据AS layer的配置，转发Remote UE的上下行信令，使得Remote UE接入RAN，完成Remote UE建立到RAN的RRC连接。若该Relay UE未被授权作为L2 Relay UE，则RAN可以拒绝Remote UE通过Relay UE接入。
S509：Remote UE通过RAN向AMF发送非接入层(non-access stratum，NAS)请求消息。
如果Remote UE在S501中没有注册，则该NAS消息为初始注册消息。如果Remote UE在S501中已经注册，则该NAS消息为业务请求消息。在业务请求消息中，Remote UE可以选择激活PDU会话。
UE对应的AMF可以理解为UE注册时负责UE移动性管理的AMF，即Remote UE对应的AMF为Remote UE注册时负责Remote UE移动性管理的AMF，Relay UE对应的AMF为Relay UE注册时负责Relay UE移动性管理的AMF。
S510：Remote UE发起PDU会话建立流程。
S511：Remote UE经过Relay UE、RAN，与Remote UE对应UPF之间传输上下行数据。
Relay UE根据AS layer的配置，转发Remote UE的上下行数据。Relay UE和RAN之间的协议栈支持适配层(adaptation layer)，适配层用于Relay UE和RAN之间区分Remote UE的数据。
在Relay UE注册到网络的过程中，AMF从UDM获取5G ProSe subscription data，5G ProSe subscription data包括UE被授权作为L2 Relay。AMF向RAN发送UE被授权作为L2 Relay的指示信息。当AMF获知UE被授权作为L2 Relay后，AMF不会主动触发连接释放流程，连接释放由RAN控制，这是因为只有RAN知道UE当前是否在提供L2 Relay服务，在提供L2 Relay服务时，Relay UE的连接不应该被释放。
在该场景中，L2 Relay UE有两个功能角色，一是传输Relay UE自己的业务数据，二是为Remote UE提供中继服务传输Remote UE的业务数据。
基于签约数据，如access and mobility subscription data或5G ProSe subscription data，定义了服务区域限制，也就是说定义了UE允许或不允许发起与网络通信的区域。在允许区域(Allowed Area)中，UE可以与网络进行正常的通信。在不允许区域(Non-Allowed Area)中，UE与网络无法发起Service Request流程或一般的会话管理相关信令的交互。当UE处 于Non-Allowed Area时，UE需要响应核心网发起的寻呼、NAS通知流程以及RAN节点发起的寻呼等。
服务区域限制可以包含一个或多个完整的TA，也可以包含公共陆地移动网(public land mobile network，PLMN)的所有TA。服务区域限制包含在UDM存储的UE的签约数据中，可以由TA标识和/或其他地理信息(如经纬度、邮政编码等)来表示。如果使用了地理位置信息，在向PCF、RAN和UE发送服务区限制信息之前，AMF会首先将地理位置信息映射到TA。在注册过程中，如果AMF中没有UE的服务区域限制的上下文，则AMF可以从UDM中获取此信息，并可能会通过PCF对其进行进一步的调整。网络可以通过通用UE配置更新流程更新服务区域限制。
当AMF为UE分配的服务区域限制的大小有限(如仅包含一个或多个完整的TA)，AMF向UE提供的服务区域限制中包含的Allowed Area可以是预先配置的，也可以是AMF动态分配的(如随着UE位置的改变而进行动态TA的控制)。AMF以TA的形式提供服务区域限制，此服务区域限制可以是UE签约数据中存储的完整列表的一部分，也可以在注册流程中由PCF向UE提供。当UE处于Non-Allowed Area中，AMF不允许UE与网络进行Service Request流程或一般的会话管理相关信令的交互，即UE不能进行业务相关流程但其他移动性相关的信令流程是允许的。
网络在提供服务区域限制时，不会向UE同时提供Allowed Area与Non-Allowed Area。如果网络向UE提供了Non-Allowed Area，不在列表中的PLMN中的TA会被视为是属于Allowed Area。
通过发起定位和终结定位流程，确定UE的位置估计结果，进而可以判断UE在Allowed Area之内，或者在Non-Allowed Area之内。
UE定位的发起流程参见图6所示，包括以下步骤：
S601：空闲态的UE发起业务请求流程，完成与AMF之间的信令连接。
S602：UE发送移动发起的位置请求(mobile originated location request，MO-LR)消息。
该MO-LR消息可以携带在上行NAS传输(UL NAS TRANSPORT)消息中。
UE可以请求不同的位置服务类型：A)该UE的位置估计，B)该UE的位置估计发送到LCS客户端或AF，C)位置辅助信息。其中，对于A)和B)类型，UL NAS TRANSPORT消息中还可以包括LCS服务质量(quality of service，QoS)信息，如定位准确率(accuracy)、响应时间(response time)、LCS QoS类别(class)，LCS QoS class可以包括尽力而为(Best Effort Class)和可保证类别(Assured Class)。对于B)，UL NAS TRANSPORT消息中还可以包括LCS客户端或AF标识，以及AMF分配的GMLC地址。
S603：AMF选择一个合适的LMF。
S604：AMF向LMF发送确定位置请求(Nlmf_Location_DetermineLocation Request)消息。
该消息中包括服务UE的小区标识(serving cell identity)，请求UE位置信息的指示信息或位置辅助数据。
S605：LMF发起对UE的定位流程。
具体而言，LMF通过与RAN及UE交互获取定位数据，并计算UE的位置估计结果。
在该S605中，LMF采用的定位技术包括但不限于：OTDOA、UTDOA、TA或AoA等技术。
S606：在位置估计结果满足所请求的LCS QoS信息时，LMF向AMF返回UE的位置估计结果。
S607：AMF向GMLC发送位置更新请求(Ngmlc_Location_LocationUpdate Request)消息。
该消息包括位置估计结果、UE标识和UE所请求的LCS QoS信息。
S608：GMLC向LCS客户端或AF发送位置更新请求消息。
该位置更新请求消息包括UE的位置估计结果。
S609：LCS客户端或AF返回位置更新响应(Ngmlc_Location_LocationUpdate Response)消息。
如果UE漫游，GMLC分别包括拜访GMLC(visited GMLC，VGMLC)和归属GMLC(home GMLC，HGMLC)两个实体。如果UE没有漫游，VGMLC和HGMLC是同一个实体。
其中，S608和S609是可选的步骤。例如在UE没有请求位置服务类型B)时，跳过S608和S609。
S610：GMLC向AMF发送位置更新响应消息。
S611：AMF向UE发送MO-LR响应消息。
MO-LR响应消息可以携带在下行NAS传输(DL NAS TRANSPORT)消息中。DL NAS TRANSPORT消息中还可以包括位置估计结果，以及位置估计结果是否满足所请求的定位准确率。
UE定位的终结流程参见图7所示，包括如下步骤：
S701：LCS客户端向GMLC发送LCS Service Request消息，用于请求获取UE的位置。
LCS Service Request消息包括UE的标识、所需QoS(required QoS)。UE的标识可以为通用公共用户标识(generic public subscription identifier，GPSI)或用户永久标识(subscription permanent identifier，SUPI)。
S702：GLMC从UDM获取当前服务UE的AMF地址。
S703：GLMC向AMF发送提供位置信息请求(Namf_Location_ProvidePositioningInfo Request)消息，用于请求获取UE的位置。
GLMC从UDM中获取LCS隐私配置文件(LCS privacy profile)，根据LCS privacy profile确定LCS客户端授权获取UE的位置，GLMC向AMF请求获取UE的位置。
S704：如果UE是空闲态，AMF发起业务请求流程，完成UE与AMF之间的信令连接。
该S704为可选的步骤。
S705：AMF选择LMF。
S706：AMF向LMF发送Nlmf_Location_DetermineLocation Request消息，用于请求UE的当前位置。
Nlmf_Location_DetermineLocation Request消息中还可以包括UE的小区标识。
S707：LMF发起UE的定位流程。
LMF通过RAN与UE交互获取定位数据，并计算UE的位置估计结果。
在该S707中，LMF采用的定位技术包括但不限于：OTDOA、UTDOA、TA或AoA等技术。
S708：LMF向AMF发送Nlmf_Location_DetermineLocation Response消息，包括UE的当前位置和所实现的准确率。
S709：AMF向GMLC发送Namf_Location_ProvidePositioningInfo Response消息，包括UE的当前位置和所实现的准确率。
S710：GMLC向LCS客户端发送LCS Service Response消息，包括UE的当前位置和所实现的准确率。
综上所述，上述场景一和场景二中，网络仅根据操作允许指示信息(如上述场景一中的IAB-node authorized indication，或场景二中的5G ProSe subscription data)，对UE的连接服务进行控制和管理。例如在操作允许指示信息用于指示授权UE通过服务时，UE在任何位置、任何时间都可能提供连接服务，导致网络对UE提供连接服务进行控制和管理的灵活性较差。
基于此，本申请实施例提供了一种授权方法，该授权方法适用于上述场景一和场景二。图8A为本申请实施例提供的一种授权方法示意图，该方法包括以下步骤：
S801：接入管理网元获取操作允许指示信息和授权条件。
操作允许指示信息用于指示允许终端设备提供连接服务。
授权条件用于确定是否允许终端设备提供连接服务。例如，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围。
S802：接入管理网元根据授权条件，向终端设备接入的接入网元发送授权结果。相应的，接入网元接收该授权结果。
授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务。
基于上述方案，接入管理网元根据获取到的授权条件，可以确定终端设备的位置和/或当前时间是否满足授权条件，向终端设备接入的接入网元发送相应的授权结果，即使操作允许指示信息允许终端设备提供连接服务，在不满足授权条件时，接入管理网元也不允许终端设备提供连接服务，可以灵活动态地对终端设备提供连接服务进行控制和管理。上述方案还可以避免在授权位置范围和/或授权时间范围之外提供服务，在一定程度上可以避免对已有通信造成干扰。
作为一种实现方式，接入管理网元可以从数据管理网元(如UDM)或从策略控制网元(如PCF)中获取操作允许指示信息和授权条件。示例的，终端设备发起注册流程，通过接入管理网元接入网络，接入管理网元可以从数据管理网元中获取签约数据，签约数据包括操作允许指示信息和授权条件。终端设备的注册流程可以参见上述图3中的S301至S303。签约数据可以为Access and Mobility Subscription data(如在IAB场景下)，或者签约数据可以为5G ProSe subscription data(如在L2 Relay场景下)。示例的，PCF网元向接入管理网元发送接入管理策略时，接入管理策略包括操作允许指示信息和授权条件。
在一些情况下，操作允许指示信息用于指示不允许终端设备提供连接服务。签约数据可以不包括授权条件。接入管理网元根据该操作允许指示信息，确定不允许终端设备提供 服务。
或者在一些情况下，接入管理网元可能获取不到操作允许指示信息，默认不允许终端设备提供服务。
连接服务包括但不限于IAB服务、VMR或中继服务等。IAB终端设备可以提供IAB服务，即终端设备可以为IAB-UE/IAB-MT，具体而言，IAB终端设备为IAB-MT。VMR设备或mobile base station relay设备可以提供VMR服务，即终端设备可以为VMR设备或mobile base station relay。其中VMR设备作为终端设备和网络(如5G网络)之间的中继，例如向UE提供接入链路，以及通过IAB-donor无线连接到网络。mobile base station relay安装在移动车辆上时，可以服务位于车辆内部(或进入车辆)或外部(或离开车辆)的UE。relay终端设备可以提供中继服务，即终端设备可以为relay终端设备。
在S802中，接入管理网元可以根据授权条件确定授权结果，然后向接入网元发送授权条件。
在一种可能的情况(以下称为情况1)中，授权条件包括连接服务的授权时间范围。接入管理网元可以判断当前时间是否在授权时间范围之外，或是否在授权时间范围之内，从而确定授权结果。
在当前时间在授权时间范围之外时，接入管理网元确定授权结果用于指示不允许终端设备提供服务。在当前时间在授权时间范围之内时，接入管理网元确定授权结果用于指示允许终端设备提供服务。
在另一种可能的情况(以下称为情况2)中，授权条件包括连接服务的授权位置范围。接入管理网元可以判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内，从而确定授权结果。
在终端设备在授权位置范围之外时，接入管理网元确定授权结果用于指示不允许终端设备提供连接服务。在终端设备在授权位置范围之内时，接入管理网元确定授权结果用于指示允许终端设备提供连接服务。
如果终端设备具有移动性，如终端设备为VMR，终端设备移出授权位置范围会导致终端设备在授权位置范围之外，终端设备移入授权位置范围会导致终端设备在授权位置范围之内。
授权位置范围包括以下一个或多个：连接服务的授权路线、连接服务的授权区域、允许提供连接服务的区域或禁止提供连接服务的区域。连接服务的授权区域可以包含一个或多个完整的TA。如果连接服务的授权区域是地理位置信息，AMF将地理位置信息映射到TA。连接服务的授权区域还可以包括一个或多个小区，如每个小区的标识可以是全球小区标识(cell global identifier，CGI)。
在又一种可能的情况(以下称为情况3)中，授权条件包括连接服务的授权位置范围和连接服务的授权时间范围，接入管理网元可以判断当前时间是否在授权时间范围之外(或是否在授权时间范围之内)，以及终端设备是否在授权位置范围之外(或是否在授权位置范围之内)，从而确定授权结果。
在当前时间在授权时间范围之外，和/或终端设备在授权位置范围之外时，接入管理网元确定授权结果用于指示不允许终端设备提供连接服务。在当前时间在授权时间范围之内，和终端设备在授权位置范围之内时，接入管理网元确定授权结果用于指示允许终端设备提 供连接服务。
下面主要对情况2下的一些实现方式进行说明。
作为一种实现方式，接入管理网元可以根据终端设备的位置和授权位置范围，判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内。
在该实现方式中，终端设备的位置可以为定位管理网元(如LMF)估计得到的实时位置，接入管理网元可以从定位管理网元获取终端设备的位置，例如参见上述图6中的S604至S606，或参见上述图7中的S706至S708。可选的，终端设备的位置可以为授权时间范围内的位置，例如接入管理网元向定位管理网元发送位置确定请求消息，用于请求终端设备的位置，该位置确定请求消息中可以携带授权时间范围，定位管理网元可以获取该授权时间范围内的终端设备的位置。
示例的，在IAB场景下，授权位置范围包括连接服务的授权路线(authorized path)和连接服务的授权区域(authorized area)，在L2 Relay场景下，授权位置范围包括允许提供连接服务的区域(Allowed area)和禁止提供连接服务的区域(Non-Allowed area)。
作为另一种实现方式，定位管理网元判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内，然后将判断结果通知给接入管理网元。
具体而言，接入管理网元可以向定位管理网元发送请求消息(例如参见上述图6中的S604或参见上述图7中的S706)，该请求消息包括授权位置范围的信息，该请求消息用于请求终端设备是否在授权位置范围之外，或是否在授权位置范围之内。定位管理网元向接入管理网元发送通知信息(例如参见上述图6中的S606或参见上述图7中的S708)，该通知信息用于通知终端设备在授权位置范围之外，或终端设备在授权位置范围之内。
可选的，请求消息可以包括授权时间范围。
作为又一种实现方式中，接入管理网元以终端设备所在的跟踪区，判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内。
具体而言，接入管理网元可以接收授权位置范围对应的跟踪区范围(如授权位置范围为跟踪区范围，或网络开放网元将授权位置范围转换为跟踪区范围)，接入管理网元已知终端设备所在的跟踪区。终端设备所在的跟踪区在授权位置范围对应的跟踪区范围之外(即授权位置范围对应的跟踪区范围不包括终端设备所在的跟踪区)，表示终端设备在授权位置范围之外。终端设备所在的跟踪区在授权位置范围对应的跟踪区范围之内(即授权位置范围对应的跟踪区范围包括终端设备所在的跟踪区)，表示终端设备在授权位置范围之内。在该实现方式中，接入管理网元可以请求网络开放网元将授权位置范围映射为跟踪区范围。
再例如，接入管理网元在为终端设备分配注册区域(Registration Area)时，可以考虑授权位置范围对应的跟踪区范围。如果终端设备位于授权位置范围之内，则注册区域应由属于授权位置范围对应的跟踪区范围的一组TA组成。否则，注册区域应由不属于授权位置范围对应的跟踪区范围的一组TA组成。进而，接入管理网元可以通过移动注册更新机制(Mobility Registration Update mechanism)知道终端设备在授权位置范围之内或授权位置范围之外。
作为又一种实现方式中，接入管理网元以终端设备所在的小区，判断终端设备是否在 授权位置范围之外，或是否在授权位置范围之内。
具体而言，接入管理网元可以接收授权位置范围对应的小区列表(如授权位置范围为小区列表，或网络开放网元将授权位置范围转换为小区列表)，接入管理网元已知终端设备所在的小区。终端设备所在的小区在授权位置范围对应的小区列表之外(即授权位置范围对应的小区列表不包括终端设备所在的小区)，表示终端设备在授权位置范围之外。终端设备所在的小区在授权位置范围对应的小区列表之内(即授权位置范围对应的小区列表包括终端设备所在的小区)，表示终端设备在授权位置范围之内。
在上述S802中，接入网元可以根据接收到的授权结果，控制终端设备的连接服务。
可选的，接入管理网元还可以向终端设备发送授权结果。
对于终端设备而言：
终端设备可以仅根据接入管理网元发送的授权结果进行相应的操作。例如，终端设备接收接入管理网元发送的第一授权结果，第一授权结果用于指示不允许终端设备提供连接服务，终端设备根据第一授权结果，释放用于提供连接服务的资源。又如，终端设备接收接入管理网元发送的第二授权结果，第二授权结果用于指示允许终端设备提供连接服务，终端设备根据第二授权结果，提供连接服务。
或者，终端设备可以仅根据接入网元的控制进行相应的操作。例如，终端设备接收接入网元发送的连接控制消息，连接控制消息用于控制终端设备不提供连接服务，终端设备根据连接控制消息，释放用于提供连接服务的资源。又如，连接控制消息还用于提供连接服务，终端设备根据连接控制消息，提供连接服务。
或者，终端设备可以根据接入网元的控制和接入管理网元发送的授权结果进行相应的操作。一般的，接入网元的控制和接入管理网元的授权结果一致，也就是说，会使得终端设备执行相同的操作。当然为了避免接入网元的控制和接入管理网元的授权结果不一致，可以设置接入网元的控制和接入管理网元的授权结果的优先级，例如接入网元的控制的优先级高于接入管理网元发送的授权结果的优先级。
示例的，在终端设备释放用于提供连接服务的资源时，终端设备可以释放F1接口，F1接口用于终端设备和接入网元之间的信息传输。此处的“信息”包括数据和/或信令。
可选的，在授权结果指示不允许终端设备提供连接服务时，接入管理网元向终端设备发送去注册请求消息(Deregistration Request message)。例如，去注册请求消息可以包括不允许终端设备提供连接服务的指示信息。在终端设备接收去注册请求消息后，终端设备释放用于提供连接服务的资源。
作为另一种实现方式，接入管理网元可以获取到连接服务的非授权位置范围(或禁止区域)，在终端在非授权位置范围(或禁止区域)之内时，不允许终端设备提供连接服务，从而灵活动态地对终端设备提供连接服务进行控制和管理。参见图8B，为本申请实施例提供的又一种授权方法示意图，包括以下步骤：
S811：接入管理网元获取操作允许指示信息和连接服务的非授权位置范围。
操作允许指示信息用于指示允许终端设备提供连接服务。
连接服务的非授权位置范围为禁止区域(Forbidden Area)。示例的，禁止区域包括在Access and Mobility Subscription data中。
接入管理网元可以从数据管理网元或从策略控制网元中，获取操作允许指示信息和连接服务的非授权位置范围。
S812：接入管理网元确定终端设备处于非授权位置范围(或禁止区域)，向终端设备接入的接入网元发送授权结果，授权结果指示不允许终端设备提供连接服务；或者向终端设备接入的接入网元发送N2终端设备上下文释放请求消息(N2 UE Context Release Request message)，例如，N2终端上下文释放请求消息可以包括不允许终端设备提供连接服务的指示信息。相应的，接入网元接收该授权结果或N2终端设备上下文释放请求消息。
在该示例中，接入管理网元还可以向终端设备发送授权结果。或者，在授权结果指示不允许终端设备提供连接服务时，接入管理网元向终端设备发送去注册请求消息(Deregistration Request message)。例如，去注册请求消息可以包括不允许终端设备提供连接服务的指示信息。在终端设备接收去注册请求消息后，终端设备释放用于提供连接服务的资源。
其中S812中接入管理网元确定终端设备处于禁止区域，与上述S802中接入管理网元确定终端设备在授权位置范围之外或之内的过程相似，重复之处不做赘述。区别在于：当终端设备在禁止区域之内时，接入管理网元确定不允许终端设备提供连接服务，当终端设备在禁止区域之外时，接入管理网元确定允许终端设备提供连接服务。
下面结合示例对图8A所示的授权流程进行说明。
参考图9，为IAB场景的授权流程示意图，包括如下步骤：
S901：IAB-UE发起注册流程。
S902：UDM向AMF发送Access and Mobility Subscription data，该Access and Mobility Subscription data包括IAB-operation allowed indication和authorized path/area。
IAB-operation allowed indication为上述操作允许指示信息的一个示例，authorized path/area为上述授权位置范围的一个示例。
可选的，Access and Mobility Subscription data还包括有效期(validity period)，validity period为上述授权时间范围的一个示例。
S903：AMF从LMF获取IAB-UE的位置。
例如参见上述图6中的S604至S606，或参见上述图7中的S706至S708。
S904：AMF判断IAB-UE是否在authorized path/area内，确定授权结果。
在IAB-UE在authorized path/area之外时，确定授权结果为非授权指示信息，非授权指示信息用于指示不授权IAB-UE，也就是说不允许IAB-UE提供连接服务。该示例主要对IAB-UE在authorized path/area之外的情况进行说明。
在IAB-UE在authorized path/area之内时，确定授权结果为授权指示信息，该授权指示信息用于指示授权IAB-UE，也就是说允许IAB-UE提供连接服务。
该S903和S904为可能的实现方式1。
S905：AMF向LMF订阅IAB-UE是否处于authorized path/area之内。
LMF确定IAB-UE在authorized path/area之外。或者，LMF确定IAB-UE在authorized path/area之内。
S906：LMF向AMF发送事件通知(event notify)消息，该event notify消息包括用于通知IAB-UE在authorized path/area之外的指示信息。
如果LMF确定IAB-UE在authorized path/area之内，该event notify消息包括用于通知IAB-UE在authorized path/area之内的指示信息。
该S905和S906为可能的实现方式2。
S907：AMF判断IAB-UE所在的TA/cell是否在authorized area对应的TA/cell集合内。
在IAB-UE所在TA在authorized area对应的TA范围之外时，AMF确定IAB-UE在authorized area之外。
在IAB-UE所在cell在authorized area对应的cell列表之外时，AMF确定IAB-UE在authorized area之外。
在IAB-UE所在TA在authorized area对应的TA范围之内时，AMF确定IAB-UE在authorized area之内。
在IAB-UE所在cell在authorized area对应的cell列表之内时，AMF确定IAB-UE在authorized area之内。
S908：在IAB-UE在authorized area之外时，AMF确定授权结果为非授权指示信息。
该S907和S908为可能的实现方式3。S907和S908授权粒度为authorized area。
S909：AMF向RAN发送N2消息，在IAB-UE在authorized path/area之外时，N2消息包括非授权指示信息。
在IAB-UE在authorized path/area之内时，N2消息包括授权指示信息。
可选地，在IAB-UE在authorized path/area之外时，AMF可以发起IAB-UE的注册流程或释放NAS连接。
可以理解的是，在IAB-operation allowed indication指示授权IAB-UE时，AMF确定在IAB-UE在authorized path/area之外时，会向RAN发送非授权指示信息。RAN在没有获取到IAB-UE授权或非授权的情况下，默认该IAB-UE没有授权。
S910：RAN根据N2消息，控制IAB-UE的服务。
在N2消息包括非授权指示信息时，RAN可以不允许IAB-UE作为IAB-node提供IAB服务、或释放IAB-UE用于提供IAB服务的资源、或释放IAB-UE作为DU的F1接口、或不允许IAB-UE作为DU请求建立F1接口。
在该示例中，AMF在IAB-UE在特定路线/区域外不授权提供IAB服务，可以动态更新IAB-UE的授权指示，RAN根据更新后的非授权指示，控制IAB-UE的IAB服务，可以避免IAB-UE在非授权区域(或非授权时间内)提供IAB服务对已有通信造成干扰。
参考图10，为L2 Relay场景的授权流程示意图，包括如下步骤：
S1001：UE发起注册流程。
S1002：UDM向AMF发送5G ProSe签约数据，5G ProSe签约数据包括L2 UE到网络(UE to network，U2N)Relay authorized和Allowed area(或Non-Allowed area)。
L2 U2N Relay authorized用于指示允许UE提供L2 U2N Relay服务。
S1003：AMF根据UE处于Allowed area，确定授权UE作为L2 U2N Relay。AMF根据UE处于Non-Allowed area,确定不授权UE作为L2 U2N Relay。
该S1003的实现可以参见上述对情况2中的实现方式，重复之处不做赘述。
S1004：AMF向RAN发送N2消息，在确定不授权UE作为L2 U2N Relay时，N2消息包括非授权指示信息。
在确定授权UE作为L2 U2N Relay时，N2消息包括授权指示信息。
在确定不授权UE作为L2 U2N Relay时，AMF还可以发起NAS连接释放流程，或者主动发起N2连接释放流程，触发UE进入空闲态。
S1005：RAN根据N2消息，控制UE的L2 U2N Relay服务。
在N2消息包括非授权指示信息时，RAN可以禁止UE的L2 U2N Relay服务。RAN还可以释放RAN与UE之间的RRC连接。
在N2消息包括授权指示信息时，RAN可以允许UE的L2 U2N Relay服务。
在该示例中，AMF结合UE处于Allowed area或Non-Allowed area,确定是否允许UE作为L2 U2N Relay，可以更新UE的授权指示，RAN根据更新后的非授权指示，控制UE的L2 U2N Relay服务，可以避免UE在Non-Allowed area提供L2 U2N Relay服务对已有通信造成干扰。
本申请实施例还提供一种授权方法，该授权方法适用于上述场景一和场景二。图11为本申请实施例提供的一种授权方法示意图，该方法包括以下步骤：
S1101：数据管理网元获取操作允许指示信息和授权条件。
操作允许指示信息用于指示允许终端设备提供连接服务。
授权条件用于确定是否允许终端设备提供连接服务。例如，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围。
S1102：数据管理网元根据授权条件，向接入管理网元发送授权结果。相应的，接入管理网元接收该授权结果。
授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务。
基于上述方案，数据管理网元根据获取到的授权条件，可以确定终端设备的位置和/或当前时间是否满足授权条件，向接入管理网元发送相应的授权结果，即使操作允许指示信息允许终端设备提供连接服务，在不满足授权条件时，数据管理网元也不允许终端设备提供连接服务，可以灵活动态地对终端设备提供连接服务进行控制和管理。上述方案还可以避免在授权位置范围和/或授权时间范围之外提供服务，在一定程度上可以避免对已有通信造成干扰。
作为一种实现方式，数据管理网元中保存有签约数据，签约数据包括操作允许指示信息和授权条件。数据管理网元的授权过程与接入管理网元的授权过程的相似之处，在此不进行赘述。
另一种实现方式，数据管理网元从通用数据仓库(universal data repository，UDR)获取签约数据，签约数据包括操作允许指示信息和授权条件。其中，UDR提供统一数据存储库服务。
在S1102中，数据管理网元可以根据授权条件确定授权结果，然后向接入管理网元发送授权结果。
可选地，在授权结果指示不允许终端设备提供连接服务的情况下，数据管理网元可以不向接入管理网元发送授权结果。接入管理网元在没有获取到授权结果的情况下，获知不允许终端设备提供连接服务。
可选的，接入管理网元确定不允许终端设备提供连接服务时，向终端设备发送去注册请求消息(Deregistration Request message)。例如，去注册请求消息可以包括不允许终端设备提供连接服务的指示信息。在终端设备接收去注册请求消息后，终端设备释放用于提供连接服务的资源。
在一种可能的情况(以下称为情况1)中，授权条件包括连接服务的授权时间范围。数据管理网元可以判断当前时间是否在授权时间范围之外，或是否在授权时间范围之内，从而确定授权结果。
在当前时间在授权时间范围之外时，数据管理网元确定授权结果用于指示不允许终端设备提供服务。在当前时间在授权时间范围之内时，数据管理网元确定授权结果用于指示允许终端设备提供服务。
在另一种可能的情况(以下称为情况2)中，授权条件包括连接服务的授权位置范围。数据管理网元可以判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内，从而确定授权结果。
在终端设备在授权位置范围之外时，数据管理网元确定授权结果用于指示不允许终端设备提供连接服务。在终端设备在授权位置范围之内时，数据管理网元确定授权结果用于指示允许终端设备提供连接服务。
如果终端设备具有移动性，如终端设备为VMR，终端设备移出授权位置范围会导致终端设备在授权位置范围之外，终端设备移入授权位置范围会导致终端设备在授权位置范围之内。
在又一种可能的情况(以下称为情况3)中，授权条件包括连接服务的授权位置范围和连接服务的授权时间范围，数据管理网元可以判断当前时间是否在授权时间范围之外(或是否在授权时间范围之内)，以及终端设备是否在授权位置范围之外(或是否在授权位置范围之内)，从而确定授权结果。
在当前时间在授权时间范围之外，和/或终端设备在授权位置范围之外时，数据管理网元确定授权结果用于指示不允许终端设备提供连接服务。在当前时间在授权时间范围之内，和终端设备在授权位置范围之内时，数据管理网元确定授权结果用于指示允许终端设备提供连接服务。
下面主要对情况2下的一些实现方式进行说明。
作为一种实现方式，数据管理网元可以根据终端设备的位置和授权位置范围，判断终端设备是否在授权位置范围之外，或是否在授权位置范围之内。
在该实现方式中，终端设备的位置可以为网络移动位置中心(如GMLC)估计得到的实时位置，数据管理网元可以从网络移动位置中心获取终端设备的位置。可选的，终端设备的位置可以为授权时间范围内的位置，例如数据管理网元向网络移动位置中心发送位置确定请求消息，用于请求终端设备的位置，该位置确定请求消息中可以携带授权时间范围，网络移动位置中心可以获取该授权时间范围内的终端设备的位置。
示例的，在IAB场景下，授权位置范围包括连接服务的授权路线(authorized path)和连接服务的授权区域(authorized area)，在L2 Relay场景下，授权位置范围包括允许提供连接服务的区域(Allowed area)和禁止提供连接服务的区域(Non-Allowed area)。
作为另一种实现方式，数据管理网元判断终端设备是否在授权位置范围之外，或是否 在授权位置范围之内，然后将判断结果通知给接入管理网元。
具体而言，数据管理网元可以向网络移动位置中心发送请求消息，该请求消息包括授权位置范围的信息，该请求消息用于请求终端设备是否在授权位置范围之外，或是否在授权位置范围之内。网络移动位置中心向数据管理网元发送通知信息，该通知信息用于通知终端设备在授权位置范围之外，或终端设备在授权位置范围之内。
可选的，请求消息可以包括授权时间范围。
作为另一种实现方式，在上述S1101中，数据管理网元可以获取到连接服务的非授权位置范围(或禁止区域)。在终端在非授权位置范围(或禁止区域)之内时，数据管理网元不允许终端设备提供连接服务，从而灵活动态地对终端设备提供连接服务进行控制和管理。
其中数据管理网元确定终端设备处于禁止区域，与上述S1102中数据管理网元确定终端设备在授权位置范围之外或之内的过程相似，重复之处不做赘述。区别在于：当终端设备在禁止区域之内时，数据管理网元确定不允许终端设备提供连接服务，当终端设备在禁止区域之外时，数据管理网元确定允许终端设备提供连接服务。
下面结合示例对图11所示的授权流程进行说明。
参考图12，为IAB场景的授权流程示意图，包括如下步骤：
S1201：IAB-UE发起注册流程。
S1202：UDM保存有Access and Mobility Subscription data，该Access and Mobility Subscription data包括IAB-operation allowed indication和authorized path/area。
IAB-operation allowed indication为上述操作允许指示信息的一个示例，authorized path/area为上述授权位置范围的一个示例。
可选的，Access and Mobility Subscription data还包括有效期(validity period)，validity period为上述授权时间范围的一个示例。
S1203：UDM从GMLC获取IAB-UE的位置。
S1204：DUM判断IAB-UE是否在authorized path/area内，确定授权结果。
在IAB-UE在authorized path/area之外时，确定授权结果为非授权指示信息，非授权指示信息用于指示不授权IAB-UE，也就是说不允许IAB-UE提供连接服务。该示例主要对IAB-UE在authorized path/area之外的情况进行说明。
在IAB-UE在authorized path/area之内时，确定授权结果为授权指示信息，该授权指示信息用于指示授权IAB-UE，也就是说允许IAB-UE提供连接服务。
该S1203和S1204为可能的实现方式1。
S1205：UDM向GMLC订阅IAB-UE是否处于authorized path/area之内。
GMLC确定IAB-UE在authorized path/area之外。或者，GMLC确定IAB-UE在authorized path/area之内。
S1206：GMLC向UDM发送事件通知(event notify)消息，该event notify消息包括用于通知IAB-UE在authorized path/area之外的指示信息。
如果GMLC确定IAB-UE在authorized path/area之内，该event notify消息包括用于通知IAB-UE在authorized path/area之内的指示信息。
该S1205和S1206为可能的实现方式2。
S1207：UDM向AMF发送Access and Mobility Subscription data，该Access and Mobility Subscription data包括IAB-operation allowed indication和非授权指示信息。
S1208：AMF向RAN发送N2消息，在IAB-UE在authorized path/area之外时，N2消息包括非授权指示信息。
在IAB-UE在authorized path/area之内时，N2消息包括授权指示信息。
S1209：RAN根据N2消息，控制IAB-UE的服务。
在该示例中，UDM在IAB-UE在特定路线/区域外不授权提供IAB服务，可以动态更新IAB-UE的授权指示，RAN根据更新后的非授权指示，控制IAB-UE的IAB服务，可以避免IAB-UE在非授权区域(或非授权时间内)提供IAB服务对已有通信造成干扰。
基于与上述授权方法的同一技术构思，本申请实施例还提供一种通信装置，如图13所示，通信装置1300包括接收单元1301和发送单元1302。可选的接收单元1301和发送单元1302所实现的功能可以由通信接口完成，接收单元和发送单元可以集成为收发单元。通信装置1300可以为接入管理网元或数据管理网元或终端设备，或者位于接入管理网元或数据管理网元或终端设备中。通信装置1300可以用于实现上述方法实施例中描述的方法，例如通信装置1300能够执行上述图8A至图12的方法中由接入管理网元或数据管理网元或终端设备执行的各个步骤。
在一个可能的实施例中，通信装置1300应用于接入管理网元。
例如，接收单元1301，用于获取操作允许指示信息和授权条件，操作允许指示信息用于指示允许终端设备提供连接服务，授权条件包括连接服务的授权位置范围和/或连接服务的授权时间范围；发送单元1302，用于根据授权条件，向终端设备接入的接入网元发送授权结果，授权结果用于指示不允许终端设备提供连接服务，或允许终端设备提供连接服务。
在一个实现方式中，发送单元1302，具体用于根据授权位置范围和/或授权时间范围，向接入网元发送授权结果。
在一个实现方式中，发送单元1302，还用于向终端设备发送授权结果。
在一个实现方式中，还包括处理单元1303，用于根据授权条件确定授权结果。
在一个实现方式中，处理单元，具体用于根据授权位置范围和/或授权时间范围，确定授权结果。
在一个实现方式中，处理单元1303，具体用于在当前时间在授权时间范围之外时，确定授权结果用于指示不允许终端设备提供连接服务；当前时间在授权时间范围之内时，确定授权结果用于指示允许终端设备提供连接服务。
在一个实现方式中，处理单元1303，具体用于在终端设备在授权位置范围之外时，确定授权结果用于指示不允许终端设备提供连接服务；在终端设备在授权位置范围之内时，确定授权结果用于指示允许终端设备提供连接服务。
在一个实现方式中，接收单元1301，还用于接收定位管理网元发送的通知信息，通知信息用于通知终端设备在授权位置范围之外，或在授权位置范围之内；
处理单元1303，具体用于在通知信息用于通知终端设备在授权位置范围之外时，确定授权结果用于指示不允许终端设备提供连接服务；在通知信息用于通知终端设备在授权位置范围之内时，确定授权结果用于指示允许终端设备提供连接服务。
在一个实现方式中，处理单元1303，具体用于在终端设备所在的跟踪区在授权位置范围对应的跟踪区范围之外时，确定授权结果用于指示不允许终端设备提供连接服务；在终端设备所在的跟踪区在授权位置范围对应的跟踪区范围之内时，确定授权结果用于指示允许终端设备提供连接服务。
在一个实现方式中，连接服务包括接入回传一体化IAB服务，终端设备为IAB终端设备；或者
连接服务包括车载中继VMR服务，终端设备为VMR设备；或者
连接服务包括中继服务，终端设备为中继relay终端设备。
在一个实现方式中，授权位置范围包括以下一个或多个：连接服务的授权路线、连接服务的授权区域、允许提供连接服务的区域或禁止提供连接服务的区域。
在另一个可能的实施例中，通信装置1300应用于终端设备。
例如，接收单元1301，用于接收接入管理网元发送的第一授权结果，第一授权结果用于指示不允许终端设备提供连接服务；
处理单元1303，用于根据第一授权结果，释放用于提供连接服务的资源。
在一个实现方式中，处理单元1303，具体用于释放F1接口，F1接口用于终端设备和终端设备接入的接入网元之间的信息传输。
在一个实现方式中，接收单元1301，还用于接收接入管理网元发送的第二授权结果，第二授权结果用于指示允许终端设备提供连接服务；
处理单元1303，还用于根据第二授权结果，提供连接服务。
需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如收发单元可以包括接收单元和/或发送单元。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，该集成的单元可以作为计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。
如图14所示，本申请实施例还提供了一种通信装置1400的结构示意图。通信装置1400可用于实现上述方法实施例中描述的方法，可以参见上述方法实施例中的说明。例如通信装置1400能够执行上述图8A至图12的方法中由接入管理网元或数据管理网元或终端设备执行的各个步骤。
装置1400包括一个或多个处理器1401。处理器1401可以是通用处理器或者专用处理器等。例如可以是基带处理器、或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、终端、或芯片等)进行控制，执行软件程序，处理软件程序的数据。通信装置可以包括收发单元，用以实现信号的输入(接收)和输出(发送)。例如，收发单元可以为收发器，射频芯片等。
装置1400包括一个或多个处理器1401，一个或多个处理器1401可实现上述所示的实施例中的方法。可选的，处理器1401除了实现上述所示的实施例的方法，还可以实现其 他功能。
一种设计中，处理器1401可以执行指令，使得装置1400执行上述方法实施例中描述的方法。指令可以全部或部分存储在处理器1401内，如指令1403可以全部或部分存储在处理器1401中，或者指令1403存储在处理器1401中，以及指令1404存储在与处理器耦合的存储器1402中，处理器1401可以同步执行指令1403和指令1404使得装置1400执行上述方法实施例中描述的方法。指令1403和指令1404也称为计算机程序。
在又一种可能的设计中，通信装置1400还可以包括电路，电路可以实现前述方法实施例中的功能。
在又一种可能的设计中装置1400中可以包括一个或多个存储器1402，其上存有指令1404，指令可在处理器1401上被运行，使得装置1400执行上述方法实施例中描述的方法。可选的，存储器1402中还可以存储有数据。可选的处理器1401中也可以存储指令和/或数据。例如，一个或多个存储器1402可以存储上述实施例中所描述的对应关系，或者上述实施例中所涉及的相关的参数或表格等。处理器和存储器可以单独设置，也可以集成在一起。
在又一种可能的设计中，装置1400还可以包括收发器1405以及天线1406。处理器1401可以称为处理单元，对装置(终端或者基站)进行控制。收发器1405可以称为收发机、收发电路、或者收发单元等，用于通过天线1406实现装置的收发功能。
处理器可以是一个通用中央处理器(central processing unit，CPU)、微处理器、特定应用集成电路(application-specific integrated circuit，ASIC)、一个或多个用于控制本申请方案程序执行的集成电路、通用处理器、数字信号处理器(digital signal processor，DSP)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以存储介质中，该存储介质位于存储器。
存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchronous link DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。存储器可以是独立存在，通过通信线路与处理器相连接。存储器也可以和处理器集成在一起。
本申请实施例还提供了一种计算机可读介质，其上存储有计算机程序，该计算机程序 被计算机执行时实现上述任一方法实施例的通信方法。
本申请实施例还提供了一种计算机程序产品，包括计算机程序，该计算机程序被计算机执行时实现上述任一方法实施例的通信方法。
本申请实施例还提供了一种通信系统，包括接入管理网元和接入网元。其中接入管理网元和接入网元可以实现上述任一方法实施例的通信方法。
可选的，通信系统还包括终端设备、数据管理网元中的一个或多个，终端设备、数据管理网元可以实现上述任一方法实施例的通信方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是上述通信装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输。计算机可读存储介质可以是上述存储介质或上述存储器。
在一种可能的设计中，当上述通信装置是芯片，如网络设备中的芯片时，或者，如终端设备中的芯片时，处理单元或者处理器1401可以是一个或多个逻辑电路，发送单元或者接收单元或者收发器1405可以是输入输出接口，又或者称为通信接口，或者接口电路，或接口等等。或者收发器1405还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。如图15所示，图15所示的通信装置1500包括逻辑电路1501和接口电路1502。即上述确定单元或者处理器1401可以用逻辑电路1501实现，发送单元或者接收单元或者收发器1405可以用接口电路1502实现。其中，该逻辑电路1501可以为芯片、处理电路、集成电路或片上系统(system on chip，SoC)芯片等，接口电路1502可以为通信接口、输入输出接口等。本申请实施例中，逻辑电路和接口电路还可以相互耦合。对于逻辑电路和接口电路的具体连接方式，本申请实施例不作限定。
在本申请的一些实施例中，该逻辑电路1501和接口电路1502可用于执行上述网络功能或控制面功能执行的功能或操作等。接口电路1502可以用于接收来自通信装置1500之外的其它通信装置的信号并传输至逻辑电路1501或将来自逻辑电路1501的信号发送给通信装置1500之外的其它通信装置。逻辑电路1501可以通过执行代码指令用于实现上述任一方法实施例。
示例性地，接口电路1502用于接收操作允许指示信息和授权条件。通信装置执行的功能或操作可以参照前述方法实施例，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通 过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。
总之，以上仅为本申请技术方案的实施例而已，并非用于限定本申请的保护范围。凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (38)

  1. 一种授权方法，其特征在于，所述方法包括：
    接入管理网元获取操作允许指示信息和授权条件，所述操作允许指示信息用于指示允许终端设备提供连接服务，所述授权条件包括所述连接服务的授权位置范围和/或所述连接服务的授权时间范围；
    所述接入管理网元根据所述授权位置范围和/或所述授权时间范围，向所述终端设备接入的接入网元发送授权结果，所述授权结果用于指示不允许所述终端设备提供所述连接服务，或允许所述终端设备提供所述连接服务。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入管理网元向所述终端设备发送所述授权结果。
  3. 如权利要求2所述的方法，其特征在于，所述接入管理网元向所述终端设备发送所述授权结果包括：
    在所述授权结果指示不允许所述终端设备提供所述连接服务时，所述接入管理网元向所述终端设备发送去注册请求消息，所述去注册请求消息包括不允许所述终端设备提供所述连接服务的指示信息。
  4. 如权利要求1-3任一项所述的方法，其特征在于，所述接入管理网元根据所述授权位置范围和/或所述授权时间范围，向所述终端设备接入的接入网元发送授权结果包括：
    所述接入管理网元根据所述授权位置范围和/或所述授权时间范围确定授权结果，向所述接入网元发送所述授权结果。
  5. 如权利要求4所述的方法，其特征在于，所述接入管理网元根据所述授权时间范围确定授权结果包括：
    在当前时间在所述授权时间范围之外时，所述接入管理网元确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；
    在所述当前时间在所述授权时间范围之内时，所述接入管理网元确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  6. 如权利要求4所述的方法，其特征在于，所述接入管理网元根据所述授权位置范围确定授权结果包括：
    在所述终端设备在所述授权位置范围之外时，所述接入管理网元确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；
    在所述终端设备在所述授权位置范围之内时，所述接入管理网元确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  7. 如权利要求4所述的方法，其特征在于，所述接入管理网元根据所述授权位置范围确定授权结果包括：
    所述接入管理网元接收所述定位管理网元发送的通知信息，所述通知信息用于通知所述终端设备在所述授权位置范围之外，或在所述授权位置范围之内；
    在所述通知信息用于通知所述终端设备在所述授权位置范围之外时，所述接入管理网元确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；
    在所述通知信息用于通知所述终端设备在所述授权位置范围之内时，所述接入管理网元确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  8. 如权利要求4所述的方法，其特征在于，所述接入管理网元根据所述授权位置范围确定授权结果包括：
    在所述终端设备所在的跟踪区在所述授权位置范围对应的跟踪区范围之外时，所述接入管理网元确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；
    在所述终端设备所在的跟踪区在所述授权位置范围对应的跟踪区范围之内时，所述接入管理网元确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  9. 如权利要求1-8任一项所述的方法，其特征在于，
    所述连接服务包括接入回传一体化IAB服务，所述终端设备为IAB终端设备；或者
    所述连接服务包括移动基站中继服务，所述终端设备为移动基站中继设备；或者
    所述连接服务包括中继服务，所述终端设备为中继relay终端设备。
  10. 如权利要求1-9任一项所述的方法，其特征在于，所述授权位置范围包括以下一个或多个：所述连接服务的授权路线、所述连接服务的授权区域、允许提供所述连接服务的区域或禁止提供所述连接服务的区域。
  11. 一种授权方法，其特征在于，所述方法包括：
    终端设备接收接入管理网元发送的第一授权结果，所述第一授权结果用于指示不允许所述终端设备提供连接服务；
    所述终端设备根据所述第一授权结果，释放用于提供所述连接服务的资源。
  12. 如权利要求11所述的方法，其特征在于，所述释放用于提供所述连接服务的资源包括：
    所述终端设备释放F1接口，所述F1接口用于所述终端设备和所述终端设备接入的接入网元之间的信息传输。
  13. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    终端设备接收所述接入管理网元发送的第二授权结果，所述第二授权结果用于指示允许所述终端设备提供所述连接服务；
    所述终端设备根据所述第二授权结果，提供所述连接服务。
  14. 一种授权方法，其特征在于，所述方法包括：
    终端设备接收所述终端设备接入的接入网元发送的连接控制消息，所述连接控制消息用于控制所述终端设备不提供连接服务；
    所述终端设备根据所述连接控制消息，释放用于提供所述连接服务的资源。
  15. 如权利要求14所述的方法，其特征在于，所述释放用于提供所述连接服务的资源包括：
    所述终端设备释放F1接口，所述F1接口用于所述终端设备和所述接入网元之间的信息传输。
  16. 如权利要求14或15所述的方法，其特征在于，所述连接控制消息还用于控制终端设备提供连接服务，所述方法还包括：
    终端设备根据所述连接控制消息，提供所述连接服务。
  17. 一种通信装置，其特征在于，所述装置包括：
    接收单元，用于获取操作允许指示信息和授权条件，所述操作允许指示信息用于指示允许终端设备提供连接服务，所述授权条件包括所述连接服务的授权位置范围和/或所述连接服务的授权时间范围；
    发送单元，用于根据所述授权位置范围和/或所述授权时间范围，向所述终端设备接入的接入网元发送授权结果，所述授权结果用于指示不允许所述终端设备提供所述连接服务，或允许所述终端设备提供所述连接服务。
  18. 如权利要求17所述的装置，其特征在于，所述发送单元，还用于向所述终端设备发送所述授权结果。
  19. 如权利要求18所述的装置，其特征在于，所述发送单元，具体用于在所述授权结果指示不允许所述终端设备提供所述连接服务时，向所述终端设备发送去注册请求消息，所述去注册请求消息包括不允许所述终端设备提供所述连接服务的指示信息。
  20. 如权利要求17-19任一项所述的装置，其特征在于，所述装置还包括：
    处理单元，用于根据所述授权条件确定授权结果。
  21. 如权利要求20所述的装置，其特征在于，所述处理单元，具体用于在当前时间在所述授权时间范围之外时，确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；所述当前时间在所述授权时间范围之内时，确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  22. 如权利要求20所述的装置，其特征在于，所述处理单元，具体用于在所述终端设备在所述授权位置范围之外时，确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；在所述终端设备在所述授权位置范围之内时，确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  23. 如权利要求20所述的装置，其特征在于，所述接收单元，还用于接收所述定位管理网元发送的通知信息，所述通知信息用于通知所述终端设备在所述授权位置范围之外，或在所述授权位置范围之内；
    所述处理单元，具体用于在所述通知信息用于通知所述终端设备在所述授权位置范围之外时，确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；在所述通知信息用于通知所述终端设备在所述授权位置范围之内时，确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  24. 如权利要求20所述的装置，其特征在于，所述处理单元，具体用于在所述终端设备所在的跟踪区在所述授权位置范围对应的跟踪区范围之外时，确定所述授权结果用于指示不允许所述终端设备提供所述连接服务；在所述终端设备所在的跟踪区在所述授权位置范围对应的跟踪区范围之内时，确定所述授权结果用于指示允许所述终端设备提供所述连接服务。
  25. 如权利要求17-24任一项所述的装置，其特征在于，
    所述连接服务包括接入回传一体化IAB服务，所述终端设备为IAB终端设备；或者
    所述连接服务包括车载中继VMR服务，所述终端设备为VMR设备；或者
    所述连接服务包括移动基站中继，所述终端设备为移动基站中继设备。
  26. 如权利要求17-25任一项所述的装置，其特征在于，所述授权位置范围包括以下一个或多个：所述连接服务的授权路线、所述连接服务的授权区域、允许提供所述连接服务的区域或禁止提供所述连接服务的区域。
  27. 一种通信装置，其特征在于，所述装置包括：
    接收单元，用于接收接入管理网元发送的第一授权结果，所述第一授权结果用于指示不允许终端设备提供所述连接服务；
    处理单元，用于根据所述第一授权结果，释放用于提供所述连接服务的资源。
  28. 如权利要求27所述的装置，其特征在于，所述处理单元，具体用于释放F1接口，所述F1接口用于所述终端设备和所述终端设备接入的接入网元之间的信息传输。
  29. 如权利要求27所述的装置，其特征在于，所述接收单元，还用于接收所述接入管理网元发送的第二授权结果，所述第二授权结果用于指示允许所述终端设备提供所述连接服务；
    所述处理单元，还用于根据所述第二授权结果，提供所述连接服务。
  30. 一种通信装置，其特征在于，所述装置包括：
    接收单元，用于接收终端设备接入的接入网元发送的连接控制消息，所述连接控制消息用于控制所述终端设备不提供连接服务
    处理单元，用于根据所述连接控制消息，释放用于提供所述连接服务的资源。
  31. 如权利要求30所述的装置，其特征在于，所述处理单元，具体用于释放F1接口，所述F1接口用于所述终端设备和所述接入网元之间的信息传输。
  32. 如权利要求30或31所述的装置，其特征在于，所述连接控制消息还用于控制终端设备提供连接服务；所述处理单元，还用于根据所述连接控制消息，提供所述连接服务。
  33. 一种通信装置，其特征在于，包括处理器，所述处理器与存储器耦合；
    所述处理器，用于执行所述存储器中存储的计算机程序或指令，以使得所述装置执行如权利要求1-16中任一项所述的方法。
  34. 一种通信装置，其特征在于，包括逻辑电路和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述逻辑电路或将来自所述逻辑电路的信号发送给所述通信装置之外的其它通信装置，所述逻辑电路通过执行代码指令用于实现如权利要求1-16中任一项所述的方法。
  35. 一种计算机可读存储介质，其特征在于，包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-16中任一项所述的方法被执行。
  36. 一种计算机程序产品，其特征在于，包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得如权利要求1-16中任一项所述的方法被执行。
  37. 一种通信系统，其特征在于，包括用于执行如权利要求1-10任一项所述方法的接入管理网元和接入网元。
  38. 一种芯片系统，其特征在于，所述芯片系统包括：
    处理器和存储器，所述处理器与所述存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，实现如权利要求1-16任一项所述的方法。
PCT/CN2023/081065 2022-03-21 2023-03-13 一种授权方法及装置 WO2023179397A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210276517.8 2022-03-21
CN202210276517.8A CN116828563A (zh) 2022-03-21 2022-03-21 一种授权方法及装置

Publications (1)

Publication Number Publication Date
WO2023179397A1 true WO2023179397A1 (zh) 2023-09-28

Family

ID=88099858

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/081065 WO2023179397A1 (zh) 2022-03-21 2023-03-13 一种授权方法及装置

Country Status (2)

Country Link
CN (1) CN116828563A (zh)
WO (1) WO2023179397A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056265A (zh) * 2009-11-10 2011-05-11 中兴通讯股份有限公司 限制mtc设备接入和通信的方法、移动管理单元及网关单元
WO2017166223A1 (zh) * 2016-03-31 2017-10-05 华为技术有限公司 无线承载管理方法、装置及系统
WO2020147044A1 (zh) * 2019-01-16 2020-07-23 Oppo广东移动通信有限公司 授权业务的方法、终端设备和网络设备
WO2021068162A1 (zh) * 2019-10-10 2021-04-15 华为技术有限公司 业务处理方法、设备及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056265A (zh) * 2009-11-10 2011-05-11 中兴通讯股份有限公司 限制mtc设备接入和通信的方法、移动管理单元及网关单元
WO2017166223A1 (zh) * 2016-03-31 2017-10-05 华为技术有限公司 无线承载管理方法、装置及系统
WO2020147044A1 (zh) * 2019-01-16 2020-07-23 Oppo广东移动通信有限公司 授权业务的方法、终端设备和网络设备
WO2021068162A1 (zh) * 2019-10-10 2021-04-15 华为技术有限公司 业务处理方法、设备及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
MEDIATEK INC.: "RRC and at NAS indication for onboarding", 3GPP DRAFT; S2-2100823, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. E-Meeting; 20210224 - 20210309, 18 February 2021 (2021-02-18), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052173323 *

Also Published As

Publication number Publication date
CN116828563A (zh) 2023-09-29

Similar Documents

Publication Publication Date Title
KR102242297B1 (ko) 무선 통신 시스템에서 네트워크 슬라이스 기반 nr을 위한 셀 특정 절차를 수행하는 방법 및 장치
US20210385625A1 (en) Wireless device location determination
US11653178B2 (en) Positioning service level
WO2023280121A1 (zh) 一种获取边缘服务的方法和装置
WO2021057794A1 (zh) 配置业务的方法、通信装置和通信系统
WO2023279776A1 (zh) 多模终端接入控制方法、装置、电子设备及存储介质
US20230379856A1 (en) Wireless device authorization by uncrewed aerial system service supplier
KR102536020B1 (ko) 다중 액세스에 걸쳐 트래픽을 분할하기 위한 방법 및 컴퓨팅 디바이스
US20230022005A1 (en) Location Management
EP4190034A1 (en) Access to second network
WO2023011049A1 (zh) 一种通信方法及装置
WO2023051287A1 (zh) 一种通信方法及装置
US20230254694A1 (en) Authentication and Authorization for Aerial System
US20230007556A1 (en) Handover
CN113811025A (zh) 一种释放中继连接的方法、设备及系统
US20240073848A1 (en) Network Slice in a Wireless Network
WO2023124875A1 (zh) 一种通信方法及装置
WO2022194262A1 (zh) 安全通信的方法和装置
US20230209431A1 (en) Method and apparatus for transmitting and receiving signals in wireless communication system
WO2023179397A1 (zh) 一种授权方法及装置
WO2015155132A1 (en) Downlink wifi channel aggregation through a tunneling
WO2023045741A1 (zh) 定位方法及装置、可读存储介质
WO2023160624A1 (zh) 一种通信方法及装置
WO2022217864A1 (zh) 无线通信方法、设备及存储介质
WO2023160657A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23773645

Country of ref document: EP

Kind code of ref document: A1