WO2023202337A1 - 通信方法和装置 - Google Patents

通信方法和装置 Download PDF

Info

Publication number
WO2023202337A1
WO2023202337A1 PCT/CN2023/084809 CN2023084809W WO2023202337A1 WO 2023202337 A1 WO2023202337 A1 WO 2023202337A1 CN 2023084809 W CN2023084809 W CN 2023084809W WO 2023202337 A1 WO2023202337 A1 WO 2023202337A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
remote terminal
network element
management network
information
Prior art date
Application number
PCT/CN2023/084809
Other languages
English (en)
French (fr)
Inventor
李�赫
吴�荣
雷骜
吴义壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023202337A1 publication Critical patent/WO2023202337A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent

Definitions

  • the present application relates to the field of communication technology, and in particular, to a communication method and device.
  • the primary authentication process needs to be carried out on terminal devices that access the network, that is, identity authentication and authorization of terminal devices. Only after passing the authentication can a terminal device access the 3rd generation partnership project (3GPP) network and further request to establish a protocol data unit (PDU) session to access the data network ( data network (DN)).
  • 3GPP 3rd generation partnership project
  • PDU protocol data unit
  • DNs outside the operator's network also have authentication and authorization requirements for certain terminal devices connected to the DN, that is, the need for secondary authentication.
  • This kind of authentication The method can use a data network other than the operator's network to authenticate or authorize the terminal device through the operator's network.
  • not all terminal devices require secondary authentication. How to determine whether remote terminal devices in 5G proximity-based services (ProSe) require secondary authentication is a current issue that needs to be considered.
  • ProSe 5G proximity-based services
  • This application provides a communication method and device that can determine whether to perform secondary authentication on a remote terminal device in a nearby service.
  • the first aspect provides a communication method, which can be executed by a mobility management network element, or can also be executed by a component (such as a chip or circuit) of the mobility management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes the execution by the mobility management network element as an example.
  • the communication method includes: the mobility management network element receives the transmission identifier of the remote terminal device from the relay terminal device, and the report information of the remote terminal device, where the report information includes the name of the data network corresponding to the remote terminal device; the mobile The management network element determines the user permanent identification of the remote terminal device based on the transmission identification; the mobility management network element sends the user permanent identification and the report information to the session management network element.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • the mobility management network element can provide the user permanent identification of the remote terminal device and the name of the data network to the session management network element, so that the mobility management network element can use this information to determine whether to perform secondary authentication on the remote terminal device.
  • the method further includes: the mobility management network element receiving the user permanent identification of the remote terminal device from the authentication server function network element; the mobility management network element saving The corresponding relationship between the user permanent identification and the transmission identification; the mobility management network element determines the user permanent identification of the remote terminal device based on the transmission identification, including: the mobility management network element determines the user permanent identification based on the transmission identification and the corresponding relationship , determine the permanent identification of the user.
  • the mobility management network element can pre-store the correspondence between the user's permanent identity and the transmission identity.
  • the user permanent identification of the remote terminal device can be determined according to the transmission identification and the corresponding relationship.
  • the method further includes: the mobility management network element receives the message from the session management network element.
  • An authentication command message of the session management network element includes the identification information of the remote terminal device.
  • the authentication command message is used to request secondary authentication of the remote terminal device; the mobility management network element sends a message to the relay The terminal device sends the authentication command message.
  • the second aspect provides a communication method, which can be executed by a session management network element, or can also be executed by a component (such as a chip or circuit) of the session management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes the execution by the session management network element as an example.
  • the communication method includes: the session management network element receives the report information of the remote terminal device from the mobility management network element, and the user permanent identification of the remote terminal device, and the report information includes the name of the data network corresponding to the remote terminal device;
  • the session management network element sends a request message to the data management network element.
  • the request message includes the permanent identification of the user and the name of the data network;
  • the session management network element receives information from the data management network element, and the information is used to determine whether to The remote terminal device performs secondary authentication; the session management network element determines whether to perform secondary authentication on the remote terminal device based on this information.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • the session management network element can obtain the user permanent identification of the remote terminal device and the name of the data network from the mobile management network element. Therefore, the session management network element can use this information to obtain from the data management network element to determine whether to Information about secondary authentication of the remote terminal device, so that it can be determined whether secondary authentication of the remote terminal device is required.
  • the information includes at least one of the following information: subscription data of the remote terminal device related to session management corresponding to the data network, the first indication Information, second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the last secondary authentication of the remote terminal device is successful.
  • a communication method is provided, which method can be executed by a relay terminal device, or can also be executed by a component (such as a chip or circuit) of the relay terminal device, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by the relay terminal device as an example.
  • the communication method includes: the relay terminal device generates report information of the remote terminal device, and the report information includes the name of the data network corresponding to the remote terminal device; the relay terminal device sends the remote terminal device to the mobility management network element The corresponding transmission identifier, and the report information.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • the relay terminal device can provide the transmission identifier corresponding to the remote terminal device and the name of the data network to the mobility management network element, so that the mobility management network element can provide the session management network element with a method for obtaining secondary authentication information based on this information.
  • the secondary authentication information here is information used to determine whether to perform secondary authentication on the remote terminal device.
  • the method further includes: the relay terminal device determines the name of the data network based on the relay service code corresponding to the remote terminal device.
  • the method further includes: the relay terminal device transmits the transmission identifier from The mobility management network element receives an authentication command message.
  • the authentication command message includes the identification information of the remote terminal device.
  • the authentication command message is used to request secondary authentication of the remote terminal device; the relay terminal device performs the authentication according to the authentication Command message to obtain the identity information of the remote terminal device; the relay terminal device sends the identity information to the mobility management network element.
  • the fourth aspect provides a communication method, which can be executed by a session management network element, or can also be executed by a component (such as a chip or circuit) of the session management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes the execution by the session management network element as an example.
  • the communication method includes: the session management network element receives report information of the remote terminal device from the mobility management network element, the report information includes the user hidden identity of the remote terminal device and the name of the data network corresponding to the remote terminal device; The session management network element sends a request message to the data management network element.
  • the request message includes the hidden identity of the user and the name of the data network; the session management network element receives information from the data management network element, and the information is used to determine whether to The remote terminal device performs secondary authentication; the session management network element determines whether to perform secondary authentication on the remote terminal device based on this information.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • the session management network element can obtain the user hidden identity of the remote terminal device and the name of the data network corresponding to the remote terminal device from the mobility management network element, so that it can obtain the information from the data management network element for judgment based on this information.
  • Information about whether to perform secondary authentication on the remote terminal device so that it can be determined whether the remote terminal device needs to undergo secondary authentication.
  • the information includes at least one of the following information: subscription data of the remote terminal device related to session management corresponding to the data network, the first indication Information, second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the last secondary authentication of the remote terminal device is successful.
  • the fifth aspect provides a communication method, which can be executed by a relay terminal device, or can also be executed by a component (such as a chip or circuit) of the relay terminal device, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by the relay terminal device as an example.
  • the communication method includes: a relay terminal device receives a user hidden identification of the remote terminal device from a remote terminal device; the relay terminal device generates report information of the remote terminal device, the report information includes the user hidden identification and the Far The name of the data network corresponding to the terminal terminal device; the relay terminal device sends the report information of the remote terminal device to the mobility management network element.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • the relay terminal device after the relay terminal device obtains the user hidden identifier of the remote terminal device from the remote terminal device, it can use the report information to provide the user hidden identifier and the data network corresponding to the remote terminal device to the mobility management network element. Name, so that the mobility management network element can send this information to the session management network element, so that the session management network element can obtain the information used to determine whether to perform secondary authentication on the remote terminal device from the data management network element based on this information, so as to It can be determined whether secondary authentication is required for the remote terminal device.
  • the method further includes: the relay terminal device determines the name of the data network based on the transmission identifier of the remote terminal device.
  • the method further includes: the relay terminal device obtains the report information from the remote terminal device.
  • the mobility management network element receives an authentication command message.
  • the authentication command message includes the identification information of the remote terminal device.
  • the authentication command message is used to request secondary authentication of the remote terminal device; the relay terminal device performs a secondary authentication according to the authentication command. message to obtain the identity information of the remote terminal device; the relay terminal device sends the identity information to the mobility management network element.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the relay terminal device and the remote terminal device are relay devices and remote devices in a nearby service scenario.
  • a sixth aspect provides a communication method, which can be executed by a remote terminal device, or can also be executed by a component (such as a chip or circuit) of the remote terminal device, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by a remote terminal device as an example.
  • the communication method includes: a remote terminal device receives a direct connection security mode command message from a relay terminal device; the remote terminal device generates a user hidden identity of the remote terminal device; and the remote terminal device sends a direct connection message to the relay terminal device.
  • the direct connection security mode completion message includes the identification information of the remote terminal device.
  • a seventh aspect provides a communication method, which can be executed by a session management network element, or can also be executed by a component (such as a chip or circuit) of the session management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes the execution by the session management network element as an example.
  • the communication method includes: the session management network element receives the identification information of the remote terminal device and the first information from the mobility management network element, the first information is used to determine the data network corresponding to the remote terminal device; the session management network element sends the The data management network element sends a request message, the request message includes the identification information of the remote terminal device and the first information; the session management receives the second information from the data management network element, the second information is used to determine whether to The remote terminal device performs secondary authentication; the session management network element determines whether to perform secondary authentication on the remote terminal device based on the second information.
  • the first information includes at least one of a relay service code, a data network name, and a proximity service relay user key identification corresponding to the remote terminal device. .
  • the session management network element receives the identification information of the remote terminal device and the first information from the relay terminal device, including: the session management network element receives the identification information from the relay terminal device. Following the report information of the terminal device, the report information includes the identification information of the remote terminal device and the first information.
  • the second information includes at least one of the following information: session management subscription data of the remote terminal device corresponding to the data network, the first indication Information, second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the last secondary authentication of the remote terminal device is successful.
  • An eighth aspect provides a communication method, which can be executed by a data management network element, or can also be executed by a component (such as a chip or circuit) of the data management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by the data management network element as an example.
  • the communication method includes: the data management network element receives a request message and first information from the session management network element.
  • the request message includes identification information of the remote terminal device, and the first information is used to determine data corresponding to the remote terminal device.
  • Network the data management network element obtains the session management subscription data of the remote terminal device corresponding to the data network name based on the identification information of the remote terminal device and the data network name, and the data network name is determined based on the first information ;
  • the data management network element sends second information to the session management network element according to the contract data of the remote terminal device. The second information is used by the session management network element to determine whether to perform secondary authentication on the remote terminal device. .
  • the data management network element obtains the data network name corresponding to the remote terminal device, including: the data management network element obtains the relay service of the remote terminal device code; the data management network element determines the data network name corresponding to the remote terminal device according to the relay service code of the remote terminal device.
  • the data management network element obtains the relay service code of the remote terminal device, including: the data management network element obtains the relay service from the request message code.
  • the data management network element obtains the data network name corresponding to the remote terminal device, including: the data management network element obtains the data network name from the request message. .
  • the second information includes at least one of the following information: session management subscription data corresponding to the data network name of the remote terminal device, the first indication Information, second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the last secondary authentication of the remote terminal device is successful.
  • the identification information of the remote terminal device hides the identification of the user of the remote terminal device
  • the data management network element uses the identification information of the terminal device and the data
  • the network name obtains the contract data of the remote terminal device, including: the data management network element determines the user permanent identity of the remote terminal device based on the user hidden identity; the data management network element determines the user permanent identity of the remote terminal device based on the user permanent identity and the data network name , obtain the session management subscription data of the remote terminal device corresponding to the data network name.
  • a ninth aspect provides a communication method, which may be executed by a relay terminal device, or may be executed by a component (such as a chip or circuit) of the relay terminal device, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by the relay terminal device as an example.
  • the communication method includes: the relay terminal device receives the identification information of the remote terminal device from the remote terminal device; the relay terminal device sends the identification information of the remote terminal device and the remote terminal device to the session management network element Corresponding first information, the first information is used to determine the data network corresponding to the remote terminal device.
  • the first information includes at least one of a relay service code, a data network name, and a proximity service relay user key identification corresponding to the remote terminal device. .
  • the first information includes the data network name of the remote terminal device
  • the method further includes: the relay terminal device determines the remote terminal device corresponding to Relay service code; The relay terminal equipment determines the data network name according to the relay service code.
  • the relay terminal device sends the identification information of the remote terminal device and the first information corresponding to the remote terminal device to the session management network element, including: the The relay terminal device sends report information to the session management network element, where the report information includes the identification information of the remote terminal device and the first information.
  • the identification information of the remote terminal device is a user hidden identification of the remote terminal device.
  • the relay terminal device receives the identification information of the remote terminal device from the remote terminal device, including: the relay terminal device sends a message to the remote terminal device Send a direct connection security mode command message; the relay terminal device receives a direct connection security mode completion message from the remote terminal device, where the direct connection security mode completion message includes identification information of the remote terminal device.
  • a tenth aspect provides a communication method, which may be executed by a mobility management network element, or may be executed by a component (such as a chip or circuit) of the mobility management network element, which is not limited.
  • a component such as a chip or circuit
  • the following description takes the execution by the mobility management network element as an example.
  • the communication method includes: the mobility management network element receives a transmission identifier for the remote terminal device from the relay terminal device; the mobility management network element determines the identification information of the remote terminal device corresponding to the transmission identifier based on the transmission identifier; The mobility management network element sends the identification information of the remote terminal device to the session management network element.
  • the method before the mobility management network element receives the transmission identifier for the remote terminal device from the relay terminal device, the method further includes: the mobility management network element saves Correspondence between the transmission identifier and the identification information of the remote terminal device.
  • the mobility management network element determines the identification information of the remote terminal device corresponding to the transmission identifier based on the transmission identifier, including: the mobility management network element determines the identification information of the remote terminal device corresponding to the transmission identifier based on the transmission identifier. The identification and the corresponding relationship determine the identification information of the remote terminal device.
  • the method further includes: the mobility management network element determines the data network name corresponding to the remote terminal device according to the transmission identifier; the mobility management network element sends a request to the session The management network element sends the data network name.
  • the first information includes at least one of a relay service code, a data network name, and a proximity service relay user key identification corresponding to the remote terminal device. .
  • the method before the mobility management network element receives the transmission identifier for the remote terminal device from the relay terminal device, the method further includes: the mobility management network element saves Correspondence between the transmission identifier and the identification information of the remote terminal device.
  • An eleventh aspect provides a communication method, which can be executed by a remote terminal device, or can also be executed by a component (such as a chip or circuit) of the remote terminal device, which is not limited.
  • a component such as a chip or circuit
  • the following description takes execution by a remote terminal device as an example.
  • the communication method includes: a remote terminal device receives a direct connection security mode command message from a relay terminal device; the remote terminal device generates identification information of the remote terminal device; and the remote terminal device sends a direct connection message to the relay terminal device.
  • the direct connection security mode completion message includes the identification information of the remote terminal device.
  • the method further includes: the remote terminal device sending the data network name corresponding to the remote terminal device to the relay terminal device.
  • the identification information of the remote terminal device is a user hidden identification of the remote terminal device.
  • a communication device configured to receive a transmission identifier of a remote terminal device from a relay terminal device, and report information of the remote terminal device, where the report information includes the The name of the data network corresponding to the remote terminal device; the processing module is used to determine the user permanent identification of the remote terminal device based on the transmission identification; the transceiver module is also used to send the user permanent identification and the session management network element to the session management network element The report information.
  • the transceiver module is also used for the mobility management network element to receive the user permanent identification of the remote terminal device from the authentication server function network element; the processing The module is also used to save the corresponding relationship between the user's permanent identification and the transmission identification; the processing module is specifically used to determine the user's permanent identification based on the transmission identification and the corresponding relationship.
  • the transceiver module is also configured to receive an authentication command message from the session management network element, where the authentication command message includes identification information of the remote terminal device. , the authentication command message is used to request secondary authentication of the remote terminal device; and to send the authentication command message to the relay terminal device.
  • a communication device in a thirteenth aspect, includes: a transceiver module for receiving report information of a remote terminal device from a mobility management network element, and a user permanent identification of the remote terminal device.
  • the report information including the name of the data network corresponding to the remote terminal device; sending a request message to the data management network element, the request message including the user's permanent identification and the name of the data network; receiving information from the data management network element, the information is used Determine whether to perform secondary authentication on the remote terminal device; the processing module is used to determine whether to perform secondary authentication on the remote terminal device based on the information.
  • the information includes at least one of the following information: subscription data of the remote terminal device related to session management corresponding to the data network, One indication information, and a second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the remote terminal device needs to perform secondary authentication. success.
  • a communication device in a fourteenth aspect, includes: a processing module for generating report information of a remote terminal device, where the report information includes the name of a data network corresponding to the remote terminal device; and a transceiver module. , used to send the transmission identifier corresponding to the remote terminal device and the report information to the mobility management network element.
  • the processing module is further configured to determine the name of the data network based on the relay service code corresponding to the remote terminal device.
  • the transceiver module is also configured to receive an authentication command message from the mobility management network element, where the authentication command message includes the identification information of the remote terminal device, The authentication command message is used to request secondary authentication of the remote terminal device; the processing module is also used to obtain the identity information of the remote terminal device according to the authentication command message; the relay terminal device sends a request to the mobile management The network element sends the identity information.
  • a communication device includes: a transceiver module configured to receive report information of a remote terminal device from a mobility management network element, where the report information includes a user hidden identity of the remote terminal device and The name of the data network corresponding to the remote terminal device; sending a request message to the data management network element, the request message including the user hidden identity and the name of the data network; receiving information from the data management network element, the information is used to determine Whether to perform secondary authentication on the remote terminal device; the processing module is used to determine whether to perform secondary authentication on the remote terminal device based on the information. Perform secondary authentication.
  • the information includes at least one of the following information: subscription data of the remote terminal device related to session management corresponding to the data network, One indication information, and a second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the remote terminal device needs to perform secondary authentication. success.
  • a communication device in a sixteenth aspect, includes: a transceiver module for receiving the user hidden identity of the remote terminal device from the remote terminal device; and a processing module for generating the user hidden identity of the remote terminal device.
  • Report information includes the user hidden identity and the name of the data network corresponding to the remote terminal device; the transceiver module is also used to send the report information of the remote terminal device to the mobility management network element.
  • the processing module is further configured to determine the name of the data network based on the transmission identifier of the remote terminal device.
  • the transceiver module is also configured to receive an authentication command message from the mobility management network element, where the authentication command message includes the identification information of the remote terminal device, The authentication command message is used to request secondary authentication of the remote terminal device; the processing module is also used to obtain the identity information of the remote terminal device according to the authentication command message; the transceiver module is also used to send a message to the remote terminal device.
  • the mobility management network element sends the identity information.
  • a communication device in a seventeenth aspect, includes: a transceiver module for receiving a direct connection security mode command message from a relay terminal device; a processing module for generating a user hidden identity of the remote terminal device; The remote terminal device sends a direct connection security mode completion message to the relay terminal device, and the direct connection security mode completion message includes identification information of the remote terminal device.
  • a communication device in an eighteenth aspect, includes: a transceiver module configured to receive identification information of a remote terminal device and first information from a mobility management network element. The first information is used to determine the remote terminal device.
  • the data network corresponding to the terminal device sends a request message to the data management network element, the request message including the identification information of the remote terminal device and the first information; receives the second information from the data management network element, the second information It is used to determine whether to perform secondary authentication on the remote terminal device; and the processing module is used to determine whether to perform secondary authentication on the remote terminal device based on the second information.
  • the first information includes at least one of the relay service code, data network name, and proximity service relay user key identification corresponding to the remote terminal device. A sort of.
  • the transceiver module is specifically configured to receive report information from the relay terminal device, where the report information includes the identification information of the remote terminal device and the third a message.
  • the second information includes at least one of the following information: session management subscription data of the remote terminal device corresponding to the data network, One indication information, and a second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the remote terminal device needs to perform secondary authentication. success.
  • a communication device in a nineteenth aspect, includes: a transceiver module, configured to receive a request message and first information from a session management network element.
  • the request message includes identification information of a remote terminal device, and the third A piece of information is used to determine the data network corresponding to the remote terminal device;
  • a processing module is used to obtain the session management of the remote terminal device corresponding to the data network name based on the identification information of the remote terminal device and the data network name.
  • Subscription data the data network name is determined based on the first information; based on the subscription data of the remote terminal device, second information is sent to the session management network element, and the second information is used by the session management network element to determine whether to The remote terminal device performs secondary authentication certificate.
  • the processing module is specifically configured to obtain the relay service code of the remote terminal device; determine the relay service code according to the relay service code of the remote terminal device.
  • the processing module is specifically used for the data management network element to obtain the relay service code from the request message.
  • the processing module is specifically used for the data management network element to obtain the data network name from the request message.
  • the second information includes at least one of the following information: session management subscription data corresponding to the data network name of the remote terminal device, One indication information, and a second indication information, wherein the first indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the remote terminal device needs to perform secondary authentication. success.
  • the identification information of the remote terminal device is the user hidden identification of the remote terminal device
  • the processing module is specifically configured to determine based on the user hidden identification The user permanent identification of the remote terminal device; according to the user permanent identification and the data network name, obtain the session management subscription data of the remote terminal device corresponding to the data network name.
  • a communication device in a twentieth aspect, includes: a transceiver module for receiving the identification information of the remote terminal device from a remote terminal device; and sending the identification information of the remote terminal device to the session management network element. Identification information and first information corresponding to the remote terminal device, the first information is used to determine the data network corresponding to the remote terminal device.
  • the first information includes at least one of the relay service code, data network name, and proximity service relay user key identification corresponding to the remote terminal device. A sort of.
  • the first information includes the data network name of the remote terminal device, and the processing module is also used to determine the network address corresponding to the remote terminal device.
  • Relay service code determine the name of the data network based on the relay service code.
  • the transceiver module is specifically configured to send report information to the session management network element, where the report information includes the identification information of the remote terminal device and the third a message.
  • the identification information of the remote terminal device is a user hidden identification of the remote terminal device.
  • the transceiver module is configured to send a direct connection security mode command message to the remote terminal device; receive a direct connection security mode completion message from the remote terminal device message, the direct connection security mode completion message includes the identification information of the remote terminal device.
  • a communication device in a twenty-first aspect, includes: a transceiver module for receiving a transmission identifier for the remote terminal device from the relay terminal device; and a processing module for determining the transmission identifier based on the transmission identifier.
  • the transmission identifier corresponds to the identification information of the remote terminal device; the transceiver module is also used to send the identification information of the remote terminal device to the session management network element.
  • the processing module is also used to save the correspondence between the transmission identification and the identification information of the remote terminal device.
  • the processing module is specifically used according to The transmission identification and the corresponding relationship determine the identification information of the remote terminal device.
  • the processing module is also used to determine the data network name corresponding to the remote terminal device according to the transmission identifier; the transceiver module is also used to Send the data network name to the session management network element.
  • the first information includes the relay service code, data network name, and proximity service relay user key identification corresponding to the remote terminal device. of at least one.
  • the processing module is also used to save the correspondence between the transmission identification and the identification information of the remote terminal device.
  • a communication device in a twenty-second aspect, includes: a transceiver module for receiving a direct connection security mode command message from a relay terminal device; and a processing module for generating an identification of the remote terminal device. Information; the remote terminal device sends a direct connection security mode completion message to the relay terminal device, and the direct connection security mode completion message includes the identification information of the remote terminal device.
  • the transceiver module is also configured to send the data network name corresponding to the remote terminal device to the relay terminal device.
  • the identification information of the remote terminal device is a user hidden identification of the remote terminal device.
  • a twenty-third aspect provides a communication device, which is used to perform any of the methods provided in the first to eleventh aspects.
  • the device may include units and/or modules for executing the methods provided in the first to eleventh aspects, such as a processing module and/or a transceiver module (which may also become a communication module).
  • the device is a network device, for example, the device is a mobility management network element, a session management network element, or a data management network element.
  • the communication module may be a transceiver, or an input/output interface; the processing module may be a processor.
  • the device is a chip, chip system or circuit used in network equipment.
  • the communication module may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit etc.
  • the processing module may be a processor, a processing circuit or a logic circuit, etc.
  • the device is a chip, chip system or circuit in the mobile management network element.
  • the apparatus may comprise units and/or modules for performing the method provided in the first aspect, such as a processing unit and/or a communication unit.
  • the device is a session management network element, or a chip, chip system or circuit in the session management network element.
  • the device may include units and/or modules, such as a processing module and/or a transceiver module, for performing the method provided in any one of the second aspect, the fourth aspect, the seventh aspect, and the tenth aspect.
  • the device is a data management network element, or a chip, chip system or circuit in the data management network element.
  • the device may include units and/or modules for performing the method provided in the eighth aspect, such as a processing module and/or a transceiver module.
  • the device is a terminal device, for example, the device is a relay terminal device or a remote terminal device.
  • the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.
  • the device is a relay terminal equipment or a chip, chip system or circuit in the relay terminal equipment.
  • the device may include units and/or modules for performing the method provided in any one of the third aspect, the fifth aspect, and the ninth aspect, such as a processing module and/or a transceiver module.
  • the device is a remote terminal device or a chip, chip system or circuit in the remote terminal device.
  • the device may include units and/or modules for performing the method provided in any one of the second aspect, the sixth aspect, and the eleventh aspect, such as a processing module and/or a transceiver module.
  • the above-mentioned transceiver may be a transceiver circuit.
  • the above input/output interface may be an input/output circuit.
  • the above-mentioned transceiver may be a transceiver circuit.
  • the above input/output interface may be an input/output circuit.
  • a twenty-fourth aspect provides a communication device, which device includes: a memory for storing a program; a processor for executing the program stored in the memory; when the program stored in the memory is executed, the processor is configured to execute the above-mentioned first Any method provided by aspects through aspects five.
  • this application provides a processor for executing the methods provided in the above aspects.
  • the process of sending the above information and obtaining/receiving the above information in the above method can be understood as the process of the processor outputting the above information, and the process of the processor receiving the input above information.
  • the processor When outputting the above information, the processor outputs the above information to the transceiver for transmission by the transceiver. After the above information is output by the processor, it may also need to undergo other processing before reaching the transceiver.
  • the transceiver obtains/receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to undergo other processing before being input to the processor.
  • the receiving request message mentioned in the foregoing method can be understood as the processor receiving input information.
  • the above-mentioned processor may be a processor specifically designed to perform these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor.
  • the above-mentioned memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated on the same chip as the processor, or can be separately provided on different chips.
  • ROM read-only memory
  • a computer-readable storage medium stores program code for device execution.
  • the program code includes a method for executing any one of the methods provided in the above-mentioned first to fifth aspects.
  • a twenty-seventh aspect provides a computer program product containing instructions, which when the computer program product is run on a computer, causes the computer to execute any of the methods provided in the first to fifth aspects.
  • a chip in a twenty-eighth aspect, includes a processor and a communication interface.
  • the processor reads instructions stored in the memory through the communication interface and executes any of the methods provided in the first to fifth aspects.
  • the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory.
  • the processor is used to execute the above-mentioned first step. Any method provided by the first aspect to the fifth aspect.
  • a twenty-ninth aspect provides a communication system, including one or more of the aforementioned mobility management network elements, session management network elements, and data management network elements.
  • the communication system may also include the above-mentioned relay terminal equipment.
  • the communication system may also include the above-mentioned remote terminal device.
  • Figure 1 (a) and Figure 1 (b) show a schematic diagram of a network architecture applicable to the embodiment of the present application.
  • Figure 2 shows a schematic diagram of a control plane process 200.
  • Figure 3 is a schematic diagram of a secondary authentication process 300 provided by an embodiment of the present application.
  • Figure 4 is a schematic flow chart of a communication method 400 provided by an embodiment of the present application.
  • Figure 5 is a schematic flow chart of a communication method 500 provided by an embodiment of the present application.
  • Figure 6 is a schematic flow chart of a communication method 600 provided by an embodiment of the present application.
  • Figure 7 is a schematic flow chart of a communication method 700 provided by an embodiment of the present application.
  • Figure 8 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • Figure 9 is a schematic block diagram of a communication device provided by another embodiment of the present application.
  • Figure 10 is a schematic block diagram of a communication device provided by yet another embodiment of the present application.
  • the technical solutions provided by this application can be applied to various communication systems, such as: fifth generation (5th generation, 5G) or new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division Duplex (frequency division duplex, FDD) system, LTE time division duplex (TDD) system, etc.
  • the technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system.
  • the technical solution provided by this application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine type Communication (machine type communication, MTC), and Internet of things (IoT) communication system or other communication system.
  • D2D device-to-device
  • V2X vehicle-to-everything
  • M2M machine-to-machine
  • MTC machine type Communication
  • IoT Internet of things
  • At least one of the following or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items).
  • at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • words such as “first” and “second” are used to distinguish identical or similar items with basically the same functions and effects.
  • words such as “first” and “second” do not limit the number and execution order, and words such as “first” and “second” do not limit the number and execution order.
  • words such as “exemplary” or “for example” are used to represent examples, illustrations or explanations. Any embodiment or design described as “exemplary” or “such as” in the embodiments of the present application is not to be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as “exemplary” or “such as” is intended to present related concepts in a concrete manner that is easier to understand.
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.
  • the network architecture can specifically include the following network elements:
  • User equipment can be called terminal equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication equipment , user agent or user device.
  • the terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a device with wireless communications Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, drones, wearable devices, end devices in 5G networks or evolved public land mobile networks (PLMN)
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • Functional handheld devices computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, drones, wearable devices, end devices in 5G networks or evolved public land mobile networks (PLMN)
  • PLMN evolved public land mobile networks
  • the UE can be connected to the next generation radio access network (NG-RAN) equipment through the Uu interface.
  • NG-RAN next generation radio access network
  • UE#A and UE#D shown in (a) of Figure 1 are connected to the NG-RAN through the Uu interface.
  • Two UEs with proximity-based services application (ProSe application) functions can also be connected through the PC5 interface.
  • UE#A and UE#B shown in (a) of Figure 1 are connected through the PC5 interface.
  • UE#B and UE#C are connected through the PC5 interface
  • UE#A and UE#D are connected through the PC5 interface.
  • Access network Provides network access functions for authorized users in a specific area, and can Different quality transmission tunnels are used according to the user's level and business needs.
  • the access network may be an access network using different access technologies.
  • Current access network technologies include: wireless access network technology used in the third generation (3G) system, wireless access network technology used in the 4G system, or NG- as shown in (a) of Figure 1 RAN technology (such as the wireless access technology used in 5G systems), etc.
  • An access network that implements access network functions based on wireless communication technology can be called a radio access network (RAN).
  • the wireless access network can manage wireless resources, provide access services to terminals, and complete the forwarding of control signals and user data between the terminals and the core network.
  • the wireless access network equipment can be, for example, a base station (NodeB), an evolved base station (evolved NodeB, eNB or eNodeB), a next generation base station node (next generation Node Base station, gNB) in a 5G mobile communication system, for example, a mobile communication system A base station in a wireless hotspot (WiFi) system, an access point (AP), etc., or a wireless controller in a cloud radio access network (CRAN) scenario, or the wireless Access network equipment can be relay stations, access points, vehicle-mounted equipment, drones, wearable devices, network equipment in 5G networks or network equipment in evolved PLMN, etc.
  • the embodiments of this application do not limit the specific technology and specific equipment form used by the wireless access network equipment.
  • Access management network element Mainly used for mobility management and access management, responsible for transmitting user policies between user equipment and policy control function (PCF) network elements, etc., and can be used to implement mobility management entities (mobility management entity, MME) functions other than session management. For example, lawful interception, or access authorization (or authentication) functions.
  • PCF policy control function
  • the access management network element can be an access and mobility management function (AMF) network element.
  • AMF access and mobility management function
  • the access management network element can still be an AMF network element, or it can have other names, which are not limited in this application.
  • Session management network element Mainly used for session management, Internet protocol (IP) address allocation and management of user equipment, selection of endpoints for manageable user plane functions, policy control and charging function interfaces, and downlink data Notifications etc.
  • IP Internet protocol
  • the session management network element can be a session management function (SMF) network element.
  • SMF session management function
  • the session management network element can still be an SMF network element, or it can also have other names, which is not limited in this application.
  • User plane network element used for packet routing and forwarding, quality of services (QoS) processing of user plane data, completing user plane data forwarding, session/flow level-based billing statistics, bandwidth limitation and other functions.
  • QoS quality of services
  • the user plane network element can be a user plane function (UPF) network element.
  • UPF user plane function
  • user plane network elements can still be UPF network elements, or they can have other names, which are not limited in this application.
  • Data network element used to provide a network for transmitting data.
  • the data network element may be a data network (DN) network element.
  • DN data network
  • data network elements can still be DN network elements, or they can have other names, which are not limited in this application.
  • Policy control network element A unified policy framework used to guide network behavior and provide policy rule information for control plane functional network elements (such as AMF, SMF network elements, etc.).
  • the policy control network element may be the policy and charging rule function (policy and charging rules function, PCRF) network element.
  • policy control network element may be a policy control function (PCF) network element.
  • PCF policy control function
  • future communication systems the policy control network element can still be a PCF network element, or it can also have other names, which are not limited in this application.
  • Data management network element used to process user equipment identification, access authentication, registration and mobility management, etc.
  • the data management network element can be a unified data management (UDM) network element; in the 4G communication system, the data management network element can be a home subscriber server (HSS) network element. Yuan. In future communication systems, the data management network element can still be a UDM network element, or it can also have other names, which is not limited in this application.
  • UDM unified data management
  • HSS home subscriber server
  • Data warehouse network element responsible for the access function of contract data, policy data, application data and other types of data.
  • the data warehouse network element may be a unified data warehouse (unified data repository, UDR) network element.
  • UDR unified data repository
  • the data warehouse network element can still be a UDR network element, or it can also have other names, which is not limited in this application.
  • Network exposure function (NEF) entity used to securely open to the outside the services and capabilities provided by 3GPP network functions.
  • ProSe application server It can be the application function (AF) of the DN, or it can be the AS itself that provides ProSe services.
  • AF with ProSe application server function has all the functions of AF defined in version 23.501R-15, as well as related functions for ProSe business. That is to say, in the user plane architecture, the ProSe application server and the UE communicate on the user plane through the UE-RAN-UPF-AF path.
  • the ProSe application server can also communicate with other network functions (NF) in the 5G core network (5GC) through NEF in the control plane architecture. For example, communicating with PCF through NEF.
  • NF network functions
  • the ProSe application server is the AF of the DN, and the AF is deployed by the operator of the 5GC, the ProSe application server can also directly communicate with other NFs in the 5GC in the control plane architecture, such as directly communicating with the PCF, without using NEF.
  • 5G direct discovery name management function It has the function of allocating and processing ProSe application identifiers and ProSe application codes for open ProSe discovery. The role of the mapping relationship between application code).
  • 5G DDNMF can communicate with the ProSe application server through the PC2 interface for authorization of processing discovery requests, and also has unallocated and processing application identifiers ) and the code used in the restricted proximity service, where the code used in the restricted proximity service includes the restricted proximity service code (ProSe restricted code), the proximity service request code (ProSe query code) and the proximity service Reply code (ProSe response code).
  • 5G DDNMF is PLMN granular, that is, a PLMN has only one 5G DDNMF.
  • a 5G DDNMF can be uniquely determined by the mobile country code (MCC) and mobile network code (MNC).
  • AUSF Authentication server function
  • ProSe key management function It can be responsible for generating and distributing keys for PC5 interface connection for UEs using proximity services. The UE needs to communicate with PKMF through the control plane. Interact to obtain the key used by the PC5 interface.
  • the above network elements or functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (for example, a cloud platform).
  • the above network element or function can be implemented by one device, or can be implemented by multiple devices together, or can be a functional module in one device, which is not specifically limited in the embodiments of this application.
  • network architecture applicable to the embodiment of the present application shown in (a) of Figure 1 is only an example, and the network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can implement the above various networks All functional network architectures are applicable to the embodiments of this application.
  • network function network element entities such as AMF, SMF network elements, PCF network elements, and UDM network elements are all called network function (NF) network elements; or, in other network architectures , AMF, SMF network elements, PCF network elements, UDM network elements and other network elements can be called control plane functional network elements.
  • AMF, SMF network elements, PCF network elements, UDM network elements and other network elements can be called control plane functional network elements.
  • network elements such as PKMF and DDNMF can be called user plane network elements.
  • FIG. 1 shows a schematic diagram of another communication system architecture according to an embodiment of the present application.
  • the remote terminal device can assist through the relay terminal device.
  • the communication between the terminal terminal equipment and the relay terminal equipment, and the communication between the relay terminal equipment and the access network equipment are implemented to realize the communication between the remote terminal equipment and the access network equipment.
  • the remote terminal device can communicate with the RAN through the relay terminal device.
  • D2D communication allows direct communication between UEs and can share spectrum resources with cell users under the control of the cell network, effectively improving the utilization of spectrum resources.
  • D2D communication has been used in 4G and 5G network systems, collectively called proximity based service communication (ProSe).
  • the remote UE can perform auxiliary communication through the relay UE (relay UE), that is, through communication between the remote UE and the relay UE, the relay UE After the UE communicates with the mobile network, the remote UE can obtain services.
  • the remote UE can obtain services.
  • the communication method from the remote UE to the relay UE to the network can be called UE-to-network relay communication.
  • the CP process refers to the process in which the remote UE obtains the key used to establish PC5 security with the relay UE through the NAS message of the relay UE.
  • AMF Remote
  • AMF Remote
  • AMF Relay
  • AMF Relay
  • This AMF can be recorded as Relay AMF, and other network elements can be explained in a similar way, so they will not be explained one by one here.
  • the following is an exemplary description of the CP process in conjunction with each step in the method 200. For parts that are not explained in detail, reference can be made to existing protocols.
  • Remote UE registers with the network and performs authentication and authorization through the network.
  • Relay UE registers with the network and performs authentication and authorization through the network.
  • the Remote UE sends a Direct Communication Request message to the Relay UE.
  • the message carries the Remote UE's subscriber concealed identifier (SUCI), relay service code (RSC), and Nounce_1.
  • SUCI is a temporary UE identity information used to provide privacy protection.
  • SUCI includes at least the encrypted result of the non-SUPI type portion of SUPI.
  • the SUCI of Remote UE is used by UDM to obtain the SUPI of Remote UE and authenticate remote UE; RSC is used for Remote UE and relay UE to discover each other, and it is used to indicate the service information that Relay can provide for Remote UE.
  • a RelayUE can support multiple different RSCs, but can only carry one RSC each time it is discovered.
  • RSC is issued by the network side to RelayUE and RemoteUE.
  • the network side will also issue PDU session related parameters, such as DNN or single network slice selection assistance information (single network slice selection assistance information, S-NSSAI); Nounce_1 is used for delivery Give the remote UE's home network as a key generation parameter.
  • PDU session related parameters such as DNN or single network slice selection assistance information (single network slice selection assistance information, S-NSSAI); Nounce_1 is used for delivery Give the remote UE's home network as a key generation parameter.
  • Relay UE sends a relay key request (Relay Key Request) message to the AMF (Relay).
  • the AMF is the AMF corresponding to the Relay UE, or in other words, the AMF is the AMF that provides access services for the Relay UE.
  • the message is NAS message, which includes the identity information of Relay UE, SUCI, RSC, Nounce_1, etc. of Remote UE.
  • AMF authenticates Relay UE. For example, the AMF checks whether the relay UE can provide relay services, or in other words, the AF checks whether the relay UE can serve as a relay device. If so, follow the process.
  • AMF sends a Prose authentication request (Nausf_UEAuthentication_ProseAuthenticate Request) message to AUSF (Remote).
  • the AUSF corresponds to the Remote UE
  • the Prose authentication request message carries the SUCI, RSC, Nounce_1, etc. of the Remote UE.
  • AUSF obtains the main authentication parameters through UDM. For example, AUSF sends a service request message to UDM to request to obtain the main authentication parameters, and UDM returns the main authentication parameters to AUSF according to the request of AUSF.
  • AUSF After AUSF obtains the main authentication parameters, it triggers the main authentication process of Remote UE.
  • Remote UE performs the main authentication process through the AUSF of relay UE and remote UE.
  • the specific process is shown in S209-S214. Please refer to the existing protocol for the detailed process and will not be repeated here.
  • Remote UE generates 5G PRUK and 5G PRUK ID.
  • the AUSF of the remote UE and the remote UE generate the key 5G PRUK and the key identifier 5G PRUK ID respectively.
  • the AUSF sends a Prose authorization response message to the AMF of the Relay UE.
  • the Prose authorization response message includes K NR_ProSe , Nounce_2, 5G PRUK ID, etc. Among them, when AUSF generates K NR_ProSe , it uses K NR_ProSe and Nounce_1 as input parameters to generate Nounce_2.
  • the AMF sends a relay key response (Relay Key Response) message to the Relay UE.
  • the relay key response message includes K NR_ProSe , Nounce_2, 5G PRUK ID, etc.
  • the Relay UE After receiving the relay key response message, the Relay UE saves K NR_ProSe and uses K NR_ProSe to generate K relay-sess . Then, the Relay UE sends a Direct Security mode command message to the Remote UE.
  • the direct connection security mode command message includes Nounce_2, 5G PRUK ID, etc.
  • the Remote UE After receiving the direct security mode command message from the Relay UE, the Remote UE uses K NR_ProSe to generate Krelay-sess.
  • Remote UE sends a direct security mode completion (Direct Security Complete) message to Relay UE.
  • Direct security Complete Direct Security Complete
  • Relay UE sends a Direct Communication Accept message to Remote UE.
  • Method 200 briefly describes the main authentication process.
  • DNs outside the operator's network also have authentication and authorization requirements for certain UEs connected to the DN, that is, the need for secondary authentication.
  • the authentication method can be used by a data network other than the operator network to authenticate or authorize the UE through the operator network.
  • Method 300 in Figure 3 shows a process for secondary authentication of Remote UE in a Prose scenario. The method 300 is illustrated below in conjunction with each step in Figure 3 .
  • Remote UE registers with the network and performs authentication and authorization through the network.
  • Relay UE registers with the network and performs authentication and authorization through the network.
  • S303 Relay UE performs the PDU session establishment process through the core network element.
  • S304-S308 are similar to S203-S222 in method 300 and will not be described again here. However, it should be noted that S306 in method 300 corresponds to S205-S220 in method 200. For simplicity, the detailed process is not shown in Figure 3 .
  • S309, Remote UE and Relay UE perform allocation of IP address (IP address)/prefix (prefix).
  • Relay UE sends a Remote UE report (Remote UE Report) to the SMF.
  • the Relay UE encapsulates the message carrying the Remote UE report in a NAS message and sends it to the AMF, and then the AMF sends it to the SMF.
  • the Remote UE report includes User info (or Remote User ID) and IP info.
  • the SMF After receiving the Remote UE report, the SMF determines whether secondary authentication is needed for the remote UE. If necessary, the SMF executes S311 to trigger the secondary authentication.
  • the specific process (S311-S320) can refer to the existing protocol and will not be explained in detail here. .
  • Method 300 describes the process of secondary authentication for Remote UE in the Prose scenario.
  • SMF determines whether the Remote UE needs secondary authentication.
  • Figure 4 shows an exemplary flow chart of the method 400 provided by the embodiment of the present application.
  • the method 400 can be applied to the network architecture given in (a) of Figure 1 or (b) of Figure 1 .
  • the method 400 is illustratively described below in conjunction with each step in FIG. 4 .
  • the mobility management network element sends the identification information and the first information of the remote terminal device to the session management network element.
  • the session management network element receives the identification information and the first information of the remote terminal device from the mobility management network element.
  • the mobility management network element obtains the identification information and the first information of the remote terminal device, and then sends the identification information and the first information of the remote terminal device to the session management network element.
  • the mobility management network element is a network element that provides services for relay terminal equipment, and the relay terminal equipment provides relay services for remote terminal equipment.
  • the identification information of the remote terminal device is information used to identify the identity of the remote terminal device. This information may be, for example, a user hidden identification of the remote terminal device, or may be used for permanent identification.
  • the first information is used to determine the data network corresponding to the remote terminal device.
  • the first information includes the relay service code of the remote terminal device, the name of the data network corresponding to the remote terminal device, and the proximity service relay user key identifier. at least one of them.
  • the name of the data network corresponding to the remote terminal device is recorded as the data network name. say.
  • the following is an exemplary description of a specific implementation manner in which the mobility management network element obtains and sends the identification information and the first information of the remote terminal device.
  • the identification information of the remote terminal device is the user hidden identification of the remote terminal device
  • the first information is the relay service code corresponding to the remote terminal device.
  • the remote terminal device generates a user hidden identity and then sends it to the relay terminal device.
  • the relay terminal device After receiving the user hidden identity, the relay terminal device sends the user hidden identity and the relay service code corresponding to the remote terminal device to the mobility management network element, where the relay service code corresponding to the remote terminal device The relay service code used when establishing a connection between the relay terminal device and the remote terminal device.
  • the mobility management network element sends the user hidden identity and the relay service code to the session management network element.
  • the user hidden identity and the relay service code can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the report information of the remote terminal device to the mobility management network element, and the report The information includes the user hidden identity and the relay service code.
  • the mobility management network element After receiving the report information, the mobility management network element sends the report information to the session management network element.
  • the user hidden identity can be carried in the report information of the remote terminal device, and the relay service code can be carried outside the report information of the remote terminal device, that is, the relay terminal device transmits the message to the mobility management
  • the non-access stratum (NAS) message sent by the network element includes the report information and relay service code of the remote terminal device.
  • the report information includes the hidden identity of the user.
  • the identification information of the remote terminal device is the user hidden identification of the remote terminal device
  • the first information is the data network name corresponding to the remote terminal device.
  • the remote terminal device generates a user hidden identity, and then sends it to the relay terminal device in a direct communication request (Direct Communication Request) message or a direct security mode complete (Direct Security Mode Complete) message.
  • the relay terminal device receives the user hidden identification, it determines the data network name corresponding to the remote terminal device according to the relay service code corresponding to the remote terminal device.
  • the data network name corresponding to the remote terminal device refers to the remote terminal device. The name of the data network to which the end terminal device is connected.
  • the relay terminal device obtains the data network name from the parameters. For another example, when the parameters of the session corresponding to the relay service code do not include the data network name but include single network slice selection support information, the relay terminal device determines the data network name based on the single network slice selection support information. After obtaining the data network name, the relay terminal device sends the user hidden identity and the data network name to the mobility management network element. In one implementation, the user hidden identity and the data network name can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the report information of the remote terminal device to the mobility management network element.
  • the report information Including the hidden identity of the user and the name of the data network, after receiving the report information, the mobility management network element sends the report information to the session management network element.
  • the user hidden identity can be carried in the reporting information of the remote terminal device
  • the data network name can be carried outside the reporting information of the remote terminal device, that is, the relay terminal device transmits data to the mobile management network
  • the NAS message sent by the network element includes the report information and data network name of the remote terminal device.
  • the report information includes the hidden identity of the user.
  • the mobility management network element sends the report information and data network name to the session management network element. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is the proximity service relay user key identification of the remote terminal device
  • the first information is the relay service code corresponding to the remote terminal device.
  • the relay terminal device obtains the proximity service relay user key identifier from the network side, it sends the proximity service relay user key identifier and the relay service code corresponding to the remote terminal device to the mobile management network Yuan.
  • the mobility management network element sends the proximity service relay user key identifier and the relay service code to the session management network element.
  • the proximity service relay user key identifier and the relay service code can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the remote terminal device's report information to the mobility management network element.
  • the report information includes the proximity service relay user key identification and the relay service code.
  • the mobility management network element After receiving the report information, the mobility management network element sends the report information to the session management network element.
  • the proximity service relay user key identification can be carried in the report information of the remote terminal device, and the relay service code can be carried outside the report information of the remote terminal device, that is, the relay
  • the NAS message sent by the terminal device to the mobility management network element includes the report information and the relay service code of the remote terminal device.
  • the report information includes the user key identification of the proximity service relay. After the mobility management network element receives the report information, Send the report information and relay service code to the session management network element.
  • the proximity service relay user key identifier and the relay service code are both carried outside the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element Including the remote relay service code, the proximity service relay user key identification and the report information of the remote terminal equipment.
  • the mobility management network element After receiving the information, the mobility management network element will convert the proximity service relay user key identification and the report information of the remote terminal equipment. All information is sent to the session management network element.
  • the UserInfo part in the report information of the remote terminal device can be set to any value. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is the proximity service relay user key identification of the remote terminal device
  • the first information is the data network name corresponding to the remote terminal device.
  • the relay terminal device obtains the proximity service relay user key identifier from the network side
  • the relay terminal device obtains the data network name, and then sends the proximity service relay user key identifier and the data network name to the mobility management network element.
  • the way for the relay terminal device to obtain the data network name can refer to the example in the second implementation method, which will not be described again here.
  • the mobility management network element sends the proximity service relay user key identifier and the data network name to the session management network element.
  • the proximity service relay user key identifier and the data network name can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the report of the remote terminal device to the mobility management network element.
  • Information the report information includes the user key identification of the proximity service relay and the name of the data network.
  • the mobility management network element After receiving the report information, the mobility management network element sends the report information to the session management network element.
  • the proximity service relay user key identification can be carried in the reporting information of the remote terminal equipment, and the data network name can be carried outside the reporting information of the remote terminal equipment, that is, the relay terminal
  • the NAS message sent by the device to the mobility management network element includes the report information and data network name of the remote terminal device.
  • the report information includes the proximity service relay user key identification.
  • the mobility management network element After the mobility management network element receives the report information, it The information and data network name are sent to the session management network element.
  • the proximity service relay user key identifier and the data network name are both carried outside the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element includes
  • the mobility management network element After receiving the report information of the remote terminal device, the proximity service relay user key identifier and the data network name, the mobility management network element combines the proximity service relay user key identifier, the data network name and the remote All report information of end terminal equipment is sent to the session management network element.
  • the UserInfo part in the report information of the remote terminal device can be set to any value. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is the permanent identification of the user of the remote terminal device
  • the first information is the data network name of the remote terminal device.
  • the relay terminal device obtains the data network name corresponding to the remote terminal device.
  • the transmission identifier is an identifier used to uniquely identify the connection corresponding to the remote terminal device between the relay terminal device and the mobility management network element.
  • the mobility management network element After receiving the transmission identification and the data network name, the mobility management network element determines the user permanent identification of the remote terminal device based on the transmission identification and the correspondence between the pre-saved transmission identification and the user permanent identification. Then the mobility management network element sends the user permanent identification and the data network name to the session management network element.
  • the data network name can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the transmission identifier and the report information of the remote terminal device to the mobility management network element, and the report information includes The name of the data network.
  • the mobility management network element determines the user's permanent identity based on the transmission identity, it sends the user's permanent identity and the report information to the session management network element.
  • the data network name can be carried in addition to the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element includes the report information of the remote terminal device and the data network name. .
  • the mobility management network element determines the user's permanent identity based on the transmission identity, it sends the report information, the user's permanent identity and the data network name to the session management network element. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is a permanent user identification of the remote terminal device
  • the first information is a relay service code corresponding to the remote terminal device.
  • the relay terminal device sends the transmission identification and relay service code to the mobility management network element.
  • the mobility management network element determines the user permanent identification of the remote terminal device based on the transmission identification and the correspondence between the pre-stored transmission identification and the user permanent identification. Then the mobility management network element sends the user permanent identification and the relay service code to the session management network element.
  • the relay service code can be carried in the report information of the remote terminal device, that is, the relay terminal device sends the transmission identifier and the report information of the remote terminal device to the mobility management network element.
  • the report information Includes the relay service code.
  • the relay service code can be carried in addition to the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element includes the report information of the remote terminal device and the relay Service code.
  • the mobility management network element determines the user's permanent identity based on the transmission identity, it sends the report information, the user's permanent identity and the relay service code to the session management network element. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is a permanent user identification of the remote terminal device
  • the first information is a data network name corresponding to the remote terminal device.
  • the relay terminal device sends the transmission identification to the mobility management network element.
  • the mobility management network element determines the user permanent identification and data network name of the remote terminal device based on the transmission identification and the pre-saved correspondence between the transmission identification, user permanent identification and data network name. . Then the mobility management network element sends the user permanent identification and the data network name to the session management network element.
  • the identification information of the remote terminal device is a permanent user identification of the remote terminal device
  • the first information is a relay service code corresponding to the remote terminal device.
  • the relay terminal device sends the transmission identification to the mobility management network element.
  • the mobility management network element determines the user permanent identification and relay service code of the remote terminal device based on the transmission identification and the pre-saved correspondence between the transmission identification, the user permanent identification and the relay service code. Service code. Then the mobility management network element sends the user permanent identification and the relay service code to the session management network element.
  • the identification information of the remote terminal device is a permanent user identification of the remote terminal device
  • the first information is a data network name corresponding to the remote terminal device.
  • the relay terminal device sends the transmission identification and the proximity service relay user key identification to the mobility management network element.
  • the mobility management network element determines the data network name of the remote terminal device based on the transmission identification and the pre-saved correspondence between the transmission identification and the data network name.
  • the mobility management network element also needs to use the adjacent service relay user key identity to obtain the user permanent identity of the remote terminal device from the adjacent anchor point network element. Then the mobility management network element sends the user permanent identification and the data network name to the session management network element.
  • the proximity service relay user key identification can be carried in the reporting information of the remote terminal equipment, that is, the relay terminal equipment sends the transmission identification and the reporting information of the remote terminal equipment to the mobility management network element , the report information includes the user key identification of the proximity service relay.
  • the mobility management network element obtains the user's permanent identity and data network name, it sends the user's permanent identity, data network name and report information to the session management network element.
  • the proximity service relay user key identification can be carried in addition to the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element includes the remote terminal device's Report information and proximity service trunk user key identification. After the mobility management network element determines the user's permanent identity and the data network name, it sends the report information, the user's permanent identity and the service network name to the session management network element. This embodiment does not limit the specific transmission method.
  • the identification information of the remote terminal device is a permanent user identification of the remote terminal device
  • the first information is a data network name corresponding to the remote terminal device.
  • the relay terminal obtains the proximity service relay user key identification from the network side.
  • the relay terminal equipment also needs to obtain the data network name.
  • the way for the relay terminal device to obtain the data network name can refer to the example in the second implementation method, which will not be described again here.
  • the relay terminal equipment sends the proximity service relay user key identification and the data network name to the mobility management network element.
  • the mobility management network element After the mobility management network element receives the proximity service relay user key identification, the mobility management network element also needs to use the proximity service relay user key identification to obtain the user's permanent identification from the proximity anchor point network element.
  • the mobility management network element sends the user permanent identification and the data network name to the session management network element.
  • the proximity service relay user key identifier and the data network name are both carried outside the report information of the remote terminal device, that is, the NAS message sent by the relay terminal device to the mobility management network element includes the remote terminal device's report information.
  • the proximity service relay user key identification, the data network name and the reporting information of the remote terminal device After the mobility management network element receives it, the mobility management network element also needs to use the adjacent service relay user key identification to obtain the user's permanent identity from the adjacent anchor point network element. Then, all the user permanent identification, data network name and report information of the remote terminal device are sent to the session management network element.
  • the UserInfo part in the report information of the remote terminal device can be set to any value. This embodiment does not limit the specific transmission method.
  • the session management network element sends a request message to the data management network element.
  • the request message includes the identification information of the remote terminal device and the first information.
  • the data management network element receives the request message from the session management network element.
  • the session management network element after receiving the identification information and the first information of the remote terminal device from the mobility management network element, the session management network element sends a request message to the data management network element, and carries the remote terminal device in the request message. identification information and the first information.
  • the request message is used to request to obtain second information, and the second information is used to determine whether to perform secondary authentication on the remote terminal device.
  • the method for the session management network element to obtain the identification information of the remote terminal device will be different depending on the position where the identification information of the terminal device appears in the message. For example, when the identification information of the terminal device is in the report information of the remote terminal device, the identification information of the terminal device can be obtained in the report information of the remote terminal device; if the identification information of the terminal device is in the report information of the remote terminal device, When reporting information, the session management network element can directly obtain the terminal device identification information. At this time, the session management network element does not need to check the UserInfo in the report information of the remote terminal device. Accordingly, the UserInfo part in the report information of the remote terminal device may be filled with arbitrary values by the relay terminal device. For example, it can be a random value with no practical meaning, or it can be filled with a user key identifier of a nearby service relay. This embodiment does not limit the filling content and filling method.
  • the data management network element obtains the remote terminal device and the session management subscription data corresponding to the data network name according to the identification information of the remote terminal device and the first information.
  • the data management network element determines the user permanent identity and data network name of the remote terminal device based on the identification information of the remote terminal device and the first information carried in the request message. . It should be noted that if the identification information of the remote terminal device in the request message is a hidden user identification, the data management network element obtains the permanent user identification by decrypting the user hidden identification; if the identification information of the remote terminal device in the request message is The identification information is the proximity service relay user key identification, then the data management network element determines the user permanent identification based on the proximity service relay user key identification.
  • the data management network element sends the proximity service relay user key identification to The proximity service application function network element requests the user permanent identification corresponding to the proximity service relay user key identification.
  • the proximity service application function network element sends the user permanent identification to the data management network element according to the request of the data management network element. ; If the first information in the request message is a relay service code, the data management network element determines the corresponding data network name based on the relay service code. For example, the data management network element determines the corresponding data network name based on the locally stored relay service code and the data network name.
  • the corresponding relationship between the names determines the data network name corresponding to the relay service code; for another example, the data management network element requests other network elements or functional entities (such as policy control network elements, or adjacent business application servers, etc.) to communicate with the relay.
  • the data network name corresponding to the service code is the data network name corresponding to the service code.
  • the data management network element determines the user permanent identity and data network name of the remote terminal device, if the data management network element finds that there is a secondary authentication result corresponding to the user permanent identity and data network name of the remote terminal device , then the data management network element does not need to execute S403.
  • the data management network element sends the second information to the session management network element.
  • the session management network element receives the second information from the data management network element.
  • the second information includes at least one of the following information: session management subscription data of the remote terminal device corresponding to the data network, first indication information, and second indication information, wherein the first The indication information is used to indicate whether the remote terminal device needs to perform secondary authentication, and the second indication information is used to indicate whether the last secondary authentication of the remote terminal device is successful.
  • manner a after the data management network element obtains the session management subscription data of the remote terminal device corresponding to the data network, it sends the session management subscription data to the session management network element.
  • mode b after the data management network element obtains the session management subscription data of the remote terminal device corresponding to the data network, it determines whether it is necessary to conduct remote processing according to the session management subscription data.
  • the terminal device performs secondary authentication.
  • the data management network element sends the first indication information to the session management network element to indicate whether the remote terminal device needs to be re-authenticated.
  • the data management network element may also send the session management subscription data to the session management network element.
  • mode c if the data management network element finds that there is a secondary authentication result corresponding to the user's permanent identification and data network name, the data management network element will As a result, second indication information is sent to the session management network element to indicate whether the last re-authentication of the remote terminal device was successful.
  • S403 may not be executed, or S403 may be executed. If S403 is executed, the data management network element is still OK. Send the session management subscription data and/or first indication information to the session management network element.
  • mode d if the data management network element finds that there is a secondary authentication result corresponding to the user's permanent identity and data network name, the data management network element can use the remote The last secondary authentication result corresponding to the terminal device determines whether secondary authentication is required for the remote terminal device. For example, when the remote terminal device succeeds in the last secondary authentication, the data management network element determines that there is no need to perform secondary authentication on the remote terminal device; if the remote terminal device fails in the last secondary authentication, the data management network element determines that the remote terminal device does not need to perform secondary authentication. Secondary authentication of the remote terminal device is required.
  • the data management network element sends first indication information to the session management network element to indicate whether the remote terminal device needs to be re-authenticated.
  • S403 may not be executed, or S403 may be executed. If S403 is executed, the data management network element may also send the session management subscription data and/or the second instruction information to the session management network element.
  • the session management network element determines whether to perform secondary authentication on the remote terminal device based on the second information.
  • the session management network element determines whether the remote terminal device needs to be re-authenticated based on the second information.
  • the session management network element receives the session management subscription data corresponding to the data network of the remote terminal device from the data management network element, and then, the session management network element determines whether the session management subscription data is needed based on the session management subscription data.
  • the remote terminal device performs secondary authentication.
  • the session management network element receives the first indication information from the data management network element.
  • the session management network element determines whether the remote terminal device needs to be re-authenticated based on the first indication information. For example, when the first indication information indicates that secondary authentication of the remote terminal device is required, the session management network element determines to perform secondary authentication of the remote terminal device (or determines to issue a secondary authentication process). When the first indication information indicates that secondary authentication of the remote terminal device is not required, the session management network element determines not to perform secondary authentication of the remote terminal device (or determines not to initiate a secondary authentication process).
  • the session management network element receives the second indication information from the data management network element, and the session management network element determines whether the remote terminal device needs to be re-authenticated based on the second indication information. For example, when the second indication information indicates that the last secondary authentication of the remote terminal device was successful, the session management network element determines that it is not necessary to perform secondary authentication on the remote terminal device; when the second indication information indicates that the remote terminal device If the last secondary authentication fails, the session management network element determines to perform secondary authentication on the remote terminal device.
  • the session management network element When the session management network element determines to perform secondary authentication on the remote terminal device, the session management network element triggers a secondary authentication process on the remote terminal device.
  • the session management network element can determine whether the remote terminal device in the adjacent business scenario requires secondary authentication.
  • Figure 5 shows an exemplary flowchart of the method 500 provided by the embodiment of the present application.
  • the Remote UE sends the newly generated SUCI (i.e. SUCI#2) to the Relay UE in the direct connection security mode completion message, and then the Relay UE obtains the DNN corresponding to the Relay UE, and then combines the DNN and the SUCI#2 Sent to SMF so that SMF can obtain parameter information from UDM for determining whether to perform secondary authentication.
  • the method 500 is illustratively described below with reference to each step in FIG. 5 .
  • S501-S511 is similar to S201-S219 in method 200, wherein S509 corresponds to S209-S214 in method 200, S510 corresponds to S215b in method 200, and steps corresponding to S215a and S216-S218 in method 200 It has been omitted in method 500.
  • S509 corresponds to S209-S214 in method 200
  • S510 corresponds to S215b in method 200
  • steps corresponding to S215a and S216-S218 in method 200 It has been omitted in method 500.
  • For the specific process please refer to the description of method 300, and the description will not be repeated here.
  • the SUCI carried in the direct communication request message of the Remote UE in S504 is recorded as SUCI#1.
  • Remote UE generates SUCI#2.
  • the Remote UE After receiving the Direct Security Mode Command message (ie S511) from the Relay UE, the Remote UE generates SUCI#2, or in other words, the Remote UE replies to the Direct Security Mode to the Relay UE. Before completing the (Direct Security Mode Complete) message, SUCI#2 is generated.
  • the SUCI#2 is generated by the Remote UE based on SUPI, and the specific method is not limited in this application.
  • Remote UE sends a direct connection security mode completion message to Relay UE.
  • Relay UE receives the direct connection security mode completion message from Remote UE,
  • the Remote UE After the Remote UE generates SUCI#2, it sends the direct connection security mode completion message to the Relay UE, and carries the SUCI#2 in the direct connection security mode completion message.
  • Relay UE sends a Direct communication Accept message to Remote UE.
  • the Remote UE receives the direct communication acceptance message from the Remote UE.
  • Relay UE sends a Remote UE report (Remote UE Report) to the SMF through the AMF.
  • the SMF receives the Remote UE report from the Relay UE through the AMF.
  • the Remote UE report includes SUCI#2, or in other words, the Remote User ID field in the Remote UE Report is filled with SUCI#2.
  • the Relay UE also sends the DNN corresponding to Remote UE to AMF.
  • the DNN can be obtained by the Relay UE from the Remote UE at any time before S515.
  • the Remote UE carries the DNN corresponding to the Remote UE in S504 or S513, and the Relay UE receives and saves the DNN; or, the DNN can also be
  • the Relay UE determines the DNN information based on the RSC.
  • the Relay UE determines the DNN information based on the PDU session parameters corresponding to the RSC used when establishing a connection with the Remote UE.
  • the Relay UE can directly obtain the DNN from the PDU session parameters. If the PDU session parameters do not include DNN, RelayUE can determine the DNN information based on the PDU session parameters. For example, when the PDU session parameters do not include DNN but include S-NSSAI information, RelayUE can obtain the DNN based on S-NSSAI. Optionally, S-NSSI may also be included. It should be understood that when S-NSSAI is a necessary parameter to determine whether secondary authentication is required, and there is no way to obtain it from other locations, then the PDU session parameters must include S-NSSAI.
  • the DNN may be carried in the Remote UE report (that is, as a part of the Remote UE), or it may not be carried in the Remote UE report (that is, as a separate information element), which is not limited in this application.
  • SMF sends a UE Secondary authentication request (UE Secondary authentication request) message to UDM.
  • UDM receives the UE secondary authentication request message from SMF.
  • the secondary authentication request message is used to request secondary authentication related parameters from the UDM.
  • the secondary authentication related parameters here can be understood as parameters used to determine whether to perform secondary authentication on the Remote UE.
  • the secondary authentication request message may also be called another name.
  • the secondary authentication request message may also be called a subscription information request message, which is not limited in this application.
  • the secondary authentication request message includes SUCI#2 and DNN.
  • UDM obtains the SM subscription data corresponding to the DN of the Remote UE.
  • the UDM after receiving the secondary authentication request message from the SMF, the UDM obtains the SM subscription data corresponding to the DN of the Remote UE based on the SUCI#2 and DNN carried in the secondary authentication request message.
  • UDM sends a UE Secondary authentication response (UE Secondary authentication response) message to SMF.
  • SMF receives the UE secondary authentication response message from UDM.
  • the secondary authentication response message is used to send the determined secondary authentication related parameters to the SMF. This embodiment does not limit message names.
  • the secondary authentication related parameters include one or more of the following: SM subscription data corresponding to the DN of the Remote UE, first indication information, and second indication information.
  • the first indication information is used to indicate whether the Remote UE needs to perform secondary authentication
  • the second indication information is used to indicate whether the last secondary authentication of the Remote UE was successful, or in other words, the second indication information is used to indicate
  • the result of the last secondary authentication of the Remote UE, the second indication information may also be called the secondary authentication result (secondary result).
  • UDM after UDM obtains the SM subscription data corresponding to the DN of the Remote UE, it sends a UE secondary authentication response message to the SMF, and carries the SM subscription in the UE secondary authentication response message. data.
  • the UDM after UDM obtains the SM subscription data of the Remote UE corresponding to the DN, it determines whether secondary authentication of the Remote UE is required based on the SM subscription data. Then the UDM sends a UE secondary authentication response message to the SMF, and carries the first indication information in the UE secondary authentication response message to indicate whether secondary authentication is required for the Remote UE.
  • the UE secondary authentication response message may also carry the SM subscription data.
  • the UDM finds that there is a secondary authentication result for the DNN of the Remote UE, the UDM sends a UE secondary authentication response message to the SMF based on the secondary authentication result, and sends a UE secondary authentication response message to the UE.
  • the secondary authentication response message carries second indication information to indicate whether the last secondary authentication of the Remote UE was successful.
  • the UE secondary authentication response message may also carry the SM subscription data and/or the first indication information.
  • the UDM can determine whether the Remote UE needs to be authenticated again based on the last secondary authentication result. . For example, when the Remote UE succeeds in the last secondary authentication, the UDM determines that the Remote UE does not need to be authenticated again; if the Remote UE fails in the last secondary authentication, the UDM determines that the Remote UE needs to be authenticated again. In this case, the UDM sends a UE secondary authentication response message to the SMF, and carries the first indication information in the UE secondary authentication response message to indicate whether the Remote UE needs to undergo secondary authentication.
  • the UE secondary authentication response message may also carry the SM subscription data and/or second indication information.
  • the SMF determines whether secondary authentication is required for the Remote UE.
  • the SMF determines whether secondary authentication of the Remote UE is required based on the information carried in the UE secondary authentication response message.
  • the SMF receives the secondary authentication response message from the UDM UE.
  • the secondary authentication response message includes the SM subscription data corresponding to the DN of the Remote UE. Then, the SMF performs the authentication according to the The SM contract data determines whether secondary authentication is required for the Remote UE.
  • the SMF receives the UE secondary authentication response message from UDM, and the secondary authentication response message includes the first indication information.
  • the SMF determines whether the Remote UE needs to be re-authenticated based on the first indication information. For example, if the first indication information indicates that secondary authentication is required for the Remote UE, the SMF determines to initiate the secondary authentication process. If the first indication information indicates that secondary authentication of the Remote UE is not required, the SMF determines not to initiate the secondary authentication process.
  • the SMF receives the UE secondary authentication request response from the UDM.
  • the secondary authentication response message includes the second indication information.
  • the SMF determines whether it needs to remote the UE based on the second indication information. Perform secondary authentication. For example, when the second indication information indicates that the last secondary authentication of the Remote UE was successful, the SMF determines that there is no need to perform secondary authentication on the Remote UE; when the second indication information indicates that the last secondary authentication of the Remote UE failed , then the SMF determines that it is necessary (or not necessary) to perform secondary authentication on the Remote UE.
  • the UE secondary authentication request message also carries the SM subscription data corresponding to the DN of the Remote UE, or the first indication information, the SMF can also combine this information to determine whether the Remote UE needs to be authenticated. Secondary certification.
  • S520 The SMF sends a PDU session authentication command message to the Relay UE. This PDU session authentication command message is used to start secondary authentication of RemoteUE.
  • the SMF determines that secondary authentication of the Remote UE is required, the SMF sends a PDU session authentication command message to the Relay UE to trigger the secondary authentication process of the Remote UE.
  • a PDU session authentication command message to the Relay UE to trigger the secondary authentication process of the Remote UE.
  • the specific process please refer to S311-S320 in method 400. , we won’t go into details here.
  • the DNN can also be replaced by RSC. That is to say, the Relay UE sends a Remote UE report to the SMF in S515, and the Remote UE report includes SUCI#2 and RSC.
  • the RSC can also be reported outside of RemoteUE.
  • the RSC can be obtained by the Relay UE in the discovery process of S503, or it can be obtained in S504, or it can be obtained in S513 (in this case, the Remote UE needs to carry the RSC in S513). This application does not limit it. .
  • SMF carries SUCI#2 and RSC in the secondary authentication request message of S516.
  • UDM receives the secondary authentication request message, it determines the DNN based on the RSC.
  • the UDM can determine the DNN based on the locally stored RSC and DNN. Determine the DNN corresponding to the corresponding relationship, or request the DNN corresponding to the RSC from other network elements or functional entities, such as requesting the PCF or ProseApplicationServer. Further, the UDM determines the SM subscription data of the Remote UE corresponding to the DN of the Remote UE based on SUPI and DNN.
  • the above solution uses SUCI#2 as the identifier of the Remote UE as an example, but in another implementation, the SUCI#2 can also be replaced with the 5G PRUK ID, that is to say, SUCI#2 in S513-S516 in the above solution can be replaced with the 5G PRUK ID.
  • the 5GPRUK ID can be carried outside the Remote UE report, that is, the content of the Remote UE report is not changed. In this implementation, the Remote UE may not perform S512.
  • the UDM determines the SUPI of the Remote UE based on the 5G PRUK ID. For example, the UDM sends a request message to the PrAF.
  • the request message includes the 5G PRUK ID.
  • the request message is used to request to obtain the SUPI corresponding to the 5G PRUK ID.
  • PrAF returns SUPI to UDM based on UDM's request.
  • the UDM determines the SM subscription data of the Remote UE corresponding to the DN of the Remote UE based on the SUPI and DNN.
  • the subsequent solution is similar to the above example and will not be described again. It should also be noted that the above solution takes the SMF receiving SUCI#2 and DNN from the Relay UE as an example, but in another implementation, the SMF may also receive the above information from other network elements or devices. For example, before S515, SMF receives the DNN corresponding to the Remote UE from AUSF or AMF.
  • SMF can save the DNN in advance. After receiving SUCI#2 in S515, SMF requests UDM to obtain the DNN through the DNN and SUCI#2. Secondary authentication parameters used to determine whether to perform secondary authentication. Or, the SMF has received the Remote UE from the AUSF or AMF before S515. The SUPI and DNN. After receiving the Remote UE report, the SMF requests the UDM through the DNN and the SUPI to obtain the secondary authentication parameters used to determine whether to perform secondary authentication.
  • FIG. 6 shows an exemplary flowchart of the method 600 provided by the embodiment of the present application.
  • AMF pre-saves the corresponding relationship between TID and SUPI.
  • Relay UE provides TID and DNN to AMF
  • AMF determines SUPI based on TID and the corresponding relationship, and then AMF sends the SUPI and DNN to SMF so that SMF obtains parameter information from UDM used to determine whether to perform secondary authentication.
  • the following is an exemplary description of the method 600 in conjunction with each step in FIG. 6 .
  • S601-S609, S611-S614 are similar to S201-S222 in method 200, wherein S609 corresponds to S209-S214 in method 200, and the steps corresponding to S215a, S216-S218, and S220 in method 200 are in method 600. has been omitted.
  • S609 corresponds to S209-S214 in method 200
  • steps corresponding to S215a, S216-S218, and S220 in method 200 are in method 600. has been omitted.
  • AMF saves the correspondence between TID and SUPI.
  • the AMF receives the SUPI of the Remote UE and saves the correspondence between the SUPI and the transmission identifier (TID).
  • the TID may be assigned by the Relay UE and sent to the AMF in S605.
  • the TID is used It is used to uniquely identify the connection corresponding to the Remote UE between the Relay UE and the AMF; the SUPI can be sent to the AMF by the AUSF.
  • the AUSF obtains the SUPI corresponding to the Remote UE from the UDM (for example, in S608 UDM sends the Remote UE's SUPI), and then the AUSF sends the SUPI of the Remote UE to the AMF (for example, in S609, the SUPI of the Remote UE is sent to the AMF).
  • the AMF saves the correspondence between the SUPI and the TID.
  • S611-S614 are similar to S315b, S319, and S321-S322 in method 300, and will not be described again here.
  • Relay UE sends TID, DNN and Remote UE report to AMF.
  • the AMF receives the TID, DNN and Remote UE report from the Relay UE.
  • the Relay UE sends the TID and the Remote UE Report (Remote UE Report) to the AMF.
  • the format of the message carrying the TID and the Remote UE Report can be a NAS message or other formats, for example, it can be: TID , NAS message(SM container(Remote UE report(remote user ID, IP info))), or NAS message(TID, SM container(Remote UE report(remote user ID, IP info))). That is, the TID may be within the NAS message or outside the NAS message, which is not limited in this application.
  • the RelayUE also sends the DNN corresponding to the Remote UE to the AMF.
  • the DNN can be carried inside the Remote UE Report.
  • the format of the message can be: NAS message(TID, SM container(Remote UE report(remote user ID, IP info, DNN) )).
  • the DNN can also be carried outside the Remote UE Report.
  • the format of the message can be: NAS message(TID, DNN, SM container(Remote UE report(remote user ID, IP info))), or NAS message(TID , SM container(DNN, Remote UE report(remote user ID, IP info))).
  • AMF determines SUPI based on TID.
  • the AMF determines the SUPI based on the TID and the pre-saved correspondence between the TID and the SUPI.
  • S617 AMF sends SUPI and Remote UE reports to SMF.
  • SMF receives the SUPI from AMF and the Remote UE report.
  • the AMF After determining the SUPI, the AMF sends a Remote UE report and the SUPI to the SMF. It should be understood that if the DNN is not carried inside the Remote UE Report, the AMF also sends the DNN to the SMF.
  • SMF sends a UE Secondary authentication request (UE Secondary authentication request) message to UDM.
  • UDM receives the UE secondary authentication request message from SMF.
  • the UE secondary authentication request message includes the SUPI of the Remote UE and the DNN.
  • UDM obtains the SM subscription data corresponding to the DN of the Remote UE.
  • the UDM After receiving the UE secondary authentication request message from the SMF, the UDM obtains the SM subscription data of the Remote UE corresponding to the DN of the Remote UE according to the SUPI and the DNN corresponding to the UE.
  • the specific implementation method is similar to S517 in method 500, and will not be described again here. However, it should be noted that in S517 of method 500, the UDM needs to determine the SUPI based on the SUCI#2 carried in the UE secondary authentication request message, and in S619, the UDM can directly obtain the SUPI from the UE secondary authentication request message.
  • S620-S623 are similar to S518-S521 in method 500 and will not be described again here.
  • Relay UE provides TID and DNN to AMF at S615 as an example.
  • the DNN can also be replaced by RSC.
  • Relay UE S615 provides TID and RSC to AMF.
  • Relay UE sends TID and Remote UE report to AMF at S615.
  • the Remote UE report may include RSC (it should be understood that RSC may also be carried outside the Remote UE report, which is not limited here).
  • the AMF determines the SUPI based on the TID in S616, it sends the SUPI and Remote UE report to the SMF in S617.
  • the Remote UE report includes the RSC.
  • the UDM can determine the DNN based on the corresponding relationship between the locally stored RSC and the DNN, or request the DNN corresponding to the RSC from other network elements or functional entities, and then obtain the SM subscription data corresponding to the DN of the Remote UE based on the DNN and the SUPI.
  • the subsequent solution is similar to the above example and will not be described again.
  • the SMF can also determine the DNN corresponding to the Remote UE based on the RSC, and then provide the DNN to the UDM at S618.
  • the SMF can also determine the DNN corresponding to the Remote UE based on the RSC, and then provide the DNN to the UDM at S618.
  • Relay UE provides at least 5GPRUKID and DNN to AMF at S615.
  • Step S610 may not be executed at this time.
  • Relay UE sends 5GPRUKID, DNN and Remote UE reports to AMF at S615.
  • the 5GPRUKID and DNN may be partially or completely included in the RemoteUE report, or may not be included in the RemoteUE report at all.
  • AMF also needs to use 5GPRUKID to request SUPI from PrAF to obtain the SUPI of RemoteUE.
  • the subsequent solution is similar to the above example and will not be described again.
  • FIG. 7 shows an exemplary flowchart of the method 700 provided by the embodiment of the present application.
  • AMF pre-saves the corresponding relationship between TID, SUPI and DNN.
  • AMF determines SUPI and DNN based on TID and the corresponding relationship, and then AMF sends the SUPI and DNN to SMF. , so that SMF can obtain parameter information from UDM for determining whether to perform secondary authentication.
  • the method 700 is illustratively described below with reference to each step in FIG. 7 .
  • S701-S709, S711-S714 are similar to S201-S222 in method 200, wherein S709 corresponds to S209-S214 in method 200, and the steps corresponding to S215a, S216-S218, and S220 in method 200 are in method 700. has been omitted.
  • S709 corresponds to S209-S214 in method 200
  • steps corresponding to S215a, S216-S218, and S220 in method 200 are in method 700. has been omitted.
  • AMF saves the correspondence between TID, SUPI, and DNN.
  • the AMF obtains the SUPI of the Remote UE and the DNN corresponding to the Remote UE, and then saves the correspondence between the SUPI, DNN, and TID.
  • the TID may be assigned by the Relay UE and sent to the AMF in S705; the SUPI It can be sent by the AUSF to the AMF.
  • the AUSF obtains the SUPI corresponding to the Remote UE from the UDM (for example, the UDM sends the SUPI of the Remote UE to the AUSF at S708), and then the AUSF sends the SUPI of the Remote UE to the AMF (for example, at S709 the SUPI The SUPI of the Remote UE is sent to the AMF);
  • the DNN can be sent by the Remote UE to the Relay UE (for example, the Remote UE sends the DNN to the Relay UE at S704), and then the Relay UE sends the DNN to the AMF (for example, the Relay UE sends the DNN at S705 to AMF) or obtained by AMF under RSC.
  • the AMF determines the DNN corresponding to the Remote UE based on the RSC corresponding to the Remote UE and the corresponding relationship between the locally configured RSC and DNN; for another example, the AMF requests the DNN corresponding to the RSC from other network elements or functional entities through the RSC corresponding to the Remote UE. After AMF obtains the DNN, SUPI and TID, it saves the correspondence between TID, SUPI and DNN.
  • S711-S714 are similar to S315b, S319, and S321-S322 in method 300, and will not be described again here.
  • Relay UE sends TID and Remote UE report to AMF.
  • the AMF receives the TID and the Remote UE report from the Relay UE.
  • Relay UE After Relay UE generates a Remote UE report, it sends the Remote UE report and the TID corresponding to the Remote UE to the AMF.
  • the format of the NAS message carrying the TID and the Remote UE report can be a NAS message or other formats, for example, it can be: TID, NAS message(SM container(Remote UE report(remote user ID, IP info))), Or NAS message(TID, SM container(Remote UE report(remote user ID, IP info))). That is, the TID may be within the NAS message or outside the NAS message, which is not limited in this application.
  • AMF determines SUPI and DNN based on TID.
  • the AMF determines the SUPI and DNN corresponding to the TID based on the TID and the correspondence relationship saved in S710.
  • AMF sends SUPI, DNN and Remote UE reports to SMF.
  • the SMF receives the SUPI, the DNN and the Remote UE report from the AMF.
  • the AMF sends the SUPI, the DNN and the Remote UE report to the SMF.
  • S718-S723 are similar to S618-S623 in method 600 and will not be described again here.
  • the above solution uses the AMF to save the correspondence between TID, SUPI and DNN in S710 as an example.
  • the DNN can also be replaced by RSC, that is to say , AMF saves the correspondence between TID, SUPI, and RSC in S710.
  • the AMF determines the SUPI and RSC based on the TID at S716, and then sends the SUPI, RSC and Remote UE report to the SMF at S717.
  • the SMF carries the SUPI and RSC in S718.
  • the UDM determines the DNN based on the RSC, and then obtains the SM subscription data corresponding to the DN of the Remote UE based on the DNN and the SUPI.
  • the subsequent solution is similar to the above example and will not be described again.
  • the embodiments of the present application also provide corresponding devices, which include: Includes corresponding modules for executing each of the above method embodiments.
  • the module can be software, hardware, or a combination of software and hardware. It can be understood that the technical features described in the above method embodiments are also applicable to the following device embodiments. Therefore, content that is not described in detail can be referred to the above method embodiments. For the sake of brevity, they will not be described again here.
  • FIG. 8 is a schematic block diagram of the communication device 10 provided by the embodiment of the present application.
  • the device 10 includes a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 can implement corresponding communication functions, and the processing module 12 is used to perform data processing, or in other words, the transceiver module 11 is used to perform operations related to receiving and sending, and the processing module 12 is used to perform other operations besides receiving and sending.
  • the transceiver module 11 may also be called a communication interface or communication unit.
  • the device 10 may also include a storage module 13, which may be used to store instructions and/or data, and the processing module 12 may read the instructions and/or data in the storage module, so that the device implements each of the foregoing. Actions of the device or network element in the method embodiment.
  • the device 10 may correspond to the mobility management network element in the above method embodiment (such as the mobility management network element in method 400, or the AMF in methods 500 to 700), or a mobile management network element.
  • Management network element components such as chips).
  • the device 10 can implement steps or processes corresponding to the execution of the mobility management network element in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to the transceiver of the mobility management network element in the above method embodiment, and the processing module 12 It can be used to perform operations related to processing of the mobile mobility management network element in the above method embodiment.
  • the transceiver module 11 is configured to receive the transmission identifier of the remote terminal device and the report information of the remote terminal device from the relay terminal device.
  • the report information includes the data network corresponding to the remote terminal device.
  • the device 10 may correspond to the session management network element in the above method embodiment (such as the session management network element in method 400, or the SMF in methods 500 to 700), or a session management network element.
  • Management network element components such as chips).
  • the device 10 can implement steps or processes corresponding to those performed by the session management network element in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to the transceiver of the terminal device in the above method embodiment, and the processing module 12 can be used To perform operations related to processing of the terminal device in the above method embodiment.
  • the transceiver module 11 is used to receive report information of the remote terminal device from the mobility management network element, and the user permanent identification of the remote terminal device.
  • the report information includes data corresponding to the remote terminal device. The name of the network; sending a request message to the data management network element, the request message including the permanent identification of the user and the name of the data network; receiving second information from the data management network element, the second information being used to determine whether the remote The remote terminal device performs secondary authentication; the processing module 12 is configured to determine whether to perform secondary authentication on the remote terminal device based on the second information.
  • the transceiver module 11 is used to receive report information of the remote terminal device from the mobility management network element.
  • the report information includes the user hidden identity of the remote terminal device and the remote terminal device. The name of the corresponding data network; sending a request message to the data management network element, the request message including the user hidden identity and the name of the data network; receiving second information from the data management network element, the second The information is used to determine whether to perform secondary authentication on the remote terminal device; the processing module 12 is used to determine whether to perform secondary authentication on the remote terminal device based on the second information.
  • the device 10 may correspond to the relay terminal equipment in the above method embodiment (such as method 400 The relay terminal equipment in the method, or the Relay UE in the methods 500 to 700), or a component of the relay terminal equipment (such as a chip).
  • the device 10 can implement steps or processes corresponding to those performed by the relay terminal equipment in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to the transmission and reception of the relay terminal equipment in the above method embodiment, and process Module 12 may be used to perform operations related to processing of the terminal device in the above method embodiment.
  • the processing module 12 is used to generate report information of the remote terminal device, where the report information includes the name of the data network corresponding to the remote terminal device; the transceiver module 11 is used to report the data to the mobile management network element. Send the transmission identifier corresponding to the remote terminal device and the report information.
  • the transceiver module 11 is used to receive the user hidden identity of the remote terminal device from the remote terminal device; the processing module 12 is used to generate report information of the remote terminal device, the The report information includes the user hidden identifier and the name of the data network corresponding to the remote terminal device; the transceiver module 11 is also configured to send the report information of the remote terminal device to the mobility management network element.
  • the device 10 may correspond to the remote terminal equipment in the above method embodiment (such as the remote terminal equipment in method 400, or the Remote UE in methods 500 to 700), or a remote terminal equipment.
  • Components of terminal equipment such as chips).
  • the device 10 can implement steps or processes corresponding to those performed by the remote terminal device in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to the transceiver of the remote terminal device in the above method embodiment, and process Module 12 may be used to perform operations related to processing of the remote terminal device in the above method embodiment.
  • the transceiver module 11 is used to receive the direct connection security mode command message from the relay terminal device; the processing module 12 is used to generate the user hidden identity of the remote terminal device; the transceiver module 11 is also used to send The relay terminal device sends a direct connection security mode completion message, and the direct connection security mode completion message includes identification information of the remote terminal device.
  • the device 10 here is embodied in the form of a functional module.
  • module may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor, or a group of processors) used to execute one or more software or firmware programs. processor, etc.) and memory, merged logic circuitry, and/or other suitable components to support the described functionality.
  • ASIC application specific integrated circuit
  • the device 10 can be specifically the mobility management network element in the above embodiments, and can be used to execute various processes and/or corresponding to the mobility management network element in the above method embodiments. or steps; alternatively, the apparatus 10 may be specifically a terminal device in the above embodiments, and may be used to execute various processes and/or steps corresponding to the terminal devices in the above method embodiments. To avoid duplication, they will not be described again here.
  • the apparatus 10 of each of the above solutions has the function of realizing the corresponding steps performed by the equipment in the above method (such as a mobility management network element, or a session management network element, or a relay terminal equipment, or a remote terminal equipment).
  • This function can be implemented by hardware, or it can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver module can be replaced by a transceiver (for example, the sending unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver. Instead), other units, such as processing modules, etc. can be replaced by processors to respectively perform the sending and receiving operations and related processing operations in each method embodiment.
  • transceiver module 11 may also be a transceiver circuit (for example, it may include a receiving circuit and a transmitting circuit),
  • the processing module may be a processing circuit.
  • FIG. 9 is a schematic diagram of another communication device 20 according to an embodiment of the present application.
  • the device 20 includes a processor 21, which is used to execute computer programs or instructions stored in the memory 22, or read data/signaling stored in the memory 22, to perform the methods in each of the above method embodiments.
  • processors 21 there are one or more processors 21 .
  • the device 20 further includes a memory 22, which is used to store computer programs or instructions and/or data.
  • the memory 22 may be integrated with the processor 21 or may be provided separately.
  • the device 20 also includes a transceiver 23, which is used for receiving and/or transmitting signals.
  • the processor 21 is used to control the transceiver 23 to receive and/or transmit signals.
  • the device 20 is used to implement the operations performed by the mobility management network element in each of the above method embodiments.
  • the processor 21 is used to execute the computer program or instructions stored in the memory 22 to implement the related operations of the mobility management network element in each of the above method embodiments.
  • the processor 21 executes the computer program or instructions stored in the memory 22 to implement The method performed by the mobility management network element in Figure 4, or the method used to instruct the AMF in Figures 5 to 7.
  • the device 20 is used to implement the operations performed by the session management network element in each of the above method embodiments.
  • the processor 21 is used to execute computer programs or instructions stored in the memory 22 to implement related operations of the session management network element in each of the above method embodiments.
  • the processor 21 executes the computer program or execution stored in the memory 22, which can implement the method executed by the session management network element in FIG. 4, or be used to instruct the method executed by the SMF in FIGS. 5 to 7.
  • the device 20 is used to implement the operations performed by the relay terminal equipment in each of the above method embodiments.
  • the processor 21 is used to execute computer programs or instructions stored in the memory 22 to implement related operations of the relay terminal equipment in each of the above method embodiments.
  • the processor 21 executes the computer program or execution stored in the memory 22, which can implement the method executed by the relay terminal device in FIG. 4, or be used to instruct the method executed by the Relay UE in FIGS. 5 to 7.
  • the device 20 is used to implement the operations performed by the remote terminal device in each of the above method embodiments.
  • the processor 21 is used to execute computer programs or instructions stored in the memory 22 to implement related operations of the remote terminal device in each of the above method embodiments.
  • the processor 21 executes the computer program or execution stored in the memory 22, which can implement the method executed by the remote terminal device in FIG. 4, or be used to instruct the method executed by the Remote UE in FIGS. 5 to 7.
  • processors mentioned in the embodiments of this application may be a central processing unit (CPU), or other general-purpose processor, digital signal processor (DSP), or application-specific integrated circuit (ASIC).
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the memory mentioned in the embodiments of the present application may be a volatile memory and/or a non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory.
  • ROM read-only memory
  • PROM programmable ROM
  • EPROM erasable programmable read-only memory
  • EPROM erasable PROM
  • EPROM erasable programmable read-only memory
  • Erase programmable read-only memory electrically EPROM, EEPROM
  • Volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM includes the following forms: static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), Double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and direct Memory bus random access memory (direct rambus RAM, DR RAM).
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component
  • the memory storage module
  • memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.
  • FIG. 10 is a schematic diagram of a chip system 30 provided by an embodiment of the present application.
  • the chip system 30 (or can also be called a processing system) includes a logic circuit 31 and an input/output interface 32.
  • the logic circuit 31 may be a processing circuit in the chip system 30 .
  • the logic circuit 31 can be coupled to the memory unit and call instructions in the memory unit, so that the chip system 30 can implement the methods and functions of various embodiments of the present application.
  • the input/output interface 32 can be an input/output circuit in the chip system 30, which outputs information processed by the chip system 30, or inputs data or signaling information to be processed into the chip system 30 for processing.
  • the chip system 30 is used to implement the operations performed by the mobility management network element (the mobility management network element in Figure 4, or the AMF in Figures 5-7) in each of the above method embodiments.
  • the mobility management network element the mobility management network element in Figure 4, or the AMF in Figures 5-7
  • the logic circuit 31 is used to implement processing-related operations performed by the mobility management network element in the above method embodiment, such as processing-related operations performed by the mobility management network element in the embodiment shown in Figure 4, or Figure 5 to the processing related operations performed by the AMF in any embodiment shown in Figure 7;
  • the input/output interface 32 is used to implement the sending and/or receiving related operations performed by the mobility management network element in the above method embodiment, For example, the sending and/or receiving related operations performed by the mobility management network element in the embodiment shown in Figure 4, or the sending and/or receiving related operations performed by the AMF in any one of the embodiments shown in Figures 5 to 7. operate.
  • the chip system 30 is used to implement the operations performed by the session management network element (the session management network element in Figure 4, or the SMF in Figures 5-7) in each of the above method embodiments.
  • the logic circuit 31 is used to implement processing-related operations performed by the mobility management network element in the above method embodiment, such as processing-related operations performed by the session management network element in the embodiment shown in Figure 4, or Figure 5 to the processing related operations performed by the SMF in any embodiment shown in Figure 7;
  • the input/output interface 32 is used to implement the sending and/or receiving related operations performed by the session management network element in the above method embodiment, For example, the sending and/or receiving related operations performed by the session management network element in the embodiment shown in Figure 4, or the sending and/or receiving related operations performed by the SMF in any one of the embodiments shown in Figures 5 to 7. operate.
  • the chip system 30 is used to implement the operations performed by the relay terminal equipment (the relay terminal equipment in Figure 4, or the Relay UE in Figures 5-7) in each of the above method embodiments. .
  • the logic circuit 31 is used to implement the processing-related operations performed by the relay terminal device in the above method embodiment, such as the processing-related operations performed by the relay terminal device in the embodiment shown in Figure 4, or Figure 5
  • the input/output interface 32 is used to implement the sending and/or reception-related operations performed by the relay terminal device in the above method embodiments. , such as the sending and/or receiving related operations performed by the relay terminal device in the embodiment shown in Figure 4, or the sending and/or reception performed by the Relay UE in any of the embodiments shown in Figures 5 to 7 related operations.
  • the chip system 30 is used to implement the operations performed by the mobile management network element (the remote terminal device in Figure 4, or the Remote UE in Figures 5-7) in each of the above method embodiments. .
  • the logic circuit 31 is used to implement the processing-related operations performed by the remote terminal device in the above method embodiment, such as the processing-related operations performed by the remote terminal device in the embodiment shown in Figure 4, or Figure 5 to the processing-related operations performed by the Remote UE in any of the embodiments shown in Figure 7;
  • the input/output interface 32 is used to implement the sending and/or reception-related operations performed by the remote terminal device in the above method embodiments. , such as the sending and/or receiving related operations performed by the remote terminal device in the embodiment shown in Figure 4, or the sending and/or reception performed by the Remote UE in any of the embodiments shown in Figures 5 to 7 related operations.
  • Embodiments of the present application also provide a computer-readable storage medium on which computer instructions for implementing the methods executed by the device in each of the above method embodiments are stored.
  • the computer when the computer program is executed by a computer, the computer can implement the method executed by the mobility management network element in each embodiment of the above method.
  • the computer when the computer program is executed by a computer, the computer can implement the method executed by the terminal device in each embodiment of the above method.
  • Embodiments of the present application also provide a computer program product that includes instructions that, when executed by a computer, implement the methods executed by devices (such as mobile management network elements and terminal equipment) in each of the above method embodiments.
  • devices such as mobile management network elements and terminal equipment
  • An embodiment of the present application also provides a communication system, including the aforementioned mobility management network element and session management network element.
  • the system also includes a device that communicates with the above-mentioned remote terminal device and/or relay terminal device.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer may be a personal computer, a server, or a network device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another, for example, the computer instructions may be transmitted from a website A site, computer, server or data center communicates to another website, computer, server or data center via wired (e.g. coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g. infrared, wireless, microwave, etc.) means transmission.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more available media integrated.
  • the available media may be magnetic media (such as floppy disks, hard disks, magnetic tapes), optical media (such as DVDs), or semiconductor media (such as solid state disks (SSD)).
  • the aforementioned available media include but Not limited to: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种通信方法和装置，该方法可以包括：移动管理网元从中继终端设备接收远端终端设备的传输标识，以及数据网络的名称；该移动管理网元根据该传输标识，确定该远端终端设备的用户永久标识，然后向会话管理网元发送该用户永久标识和数据网络的名称。会话管理网元接收该用户永久标识和该数据网络的名称之后，基于该用户永久标识和该数据网络的名称，通过数据管理网元确定是否对远端终端设备进行二次认证。通过提供的方案，可以确定是否对远端终端设备进行二次认证。

Description

通信方法和装置
本申请要求于2022年4月21日提交中国专利局、申请号为202210426836.2、申请名称为“通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法和装置。
背景技术
在第五代(5th generation，5G)通信系统中，为了保障网络安全，需要对接入网络的终端设备进行主认证(primary authentication)流程，即对终端数设备进行身份认证和授权。一个终端设备只有在通过了认证后，才可以接入第三代合作伙伴计划(3rd generation partnership project，3GPP)网络，并进一步请求建立协议数据单元(protocol data unit，PDU)会话来访问数据网络(data network，DN)上的各种业务。
随着垂直行业和物联网的发展，运营商网络之外的DN对于接入到DN的某些终端设备同样有认证与授权的需求，即进行二次认证(secondary authentication)的需求，这种认证方式可以由运营商网络以外的数据网络通过运营商网络对终端设备进行认证或授权。但并非所有终端设备都需要进行二次认证，如何确定5G临近业务(proximity-based services，ProSe)中的远端终端设备是否需要进行二次认证，是当前需要考虑的问题。
发明内容
本申请提供了一种通信方法和装置，可以确定是否对临近业务中的远端终端设备进行二次认证。
第一方面，提供了一种通信方法，该方法可以由移动管理网元执行，或者，也可以由移动管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由移动管理网元执行为例进行说明。
该通信方法包括：移动管理网元从中继终端设备接收远端终端设备的传输标识，以及该远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网络的名称；该移动管理网元根据该传输标识，确定该远端终端设备的用户永久标识；该移动管理网元向会话管理网元发送该用户永久标识和该报告信息。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
基于上述方案，移动管理网元可以向会话管理网元提供远端终端设备的用户永久标识和数据网络的名称，以便移动管理网元可以借助这些信息判断是否对远端终端设备进行二次认证。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该移动管理网元从鉴权服务器功能网元接收该远端终端设备的用户永久标识；该移动管理网元保存该用户永久标识和该传输标识之间的对应关系；该移动管理网元根据该传输标识，确定该远端终端设备的用户永久标识，包括：该移动管理网元根据该传输标识和该对应关系，确定该用户永久标识。
基于上述方案，移动管理网元可以预先保存用户永久标识和该传输标识之间的对应关系，在这种情况下，当移动管理网元从中继终端设备接收到远端终端设备的传输标识之后，可以根据该传输标识和该对应关系确定远端终端设备的用户永久标识。
结合第一方面，在第一方面的某些实现方式中，该移动管理网元向会话管理网元发送该用户永久标识和该报告信息之后，该方法还包括：该移动管理网元接收来自该会话管理网元的认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；该移动管理网元向该中继终端设备发送该认证命令消息。
第二方面，提供了一种通信方法，该方法可以由会话管理网元执行，或者，也可以由会话管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由会话管理网元执行为例进行说明。
该通信方法包括：会话管理网元从移动管理网元接收远端终端设备的报告信息，以及该远端终端设备的用户永久标识，该报告信息包括该远端终端设备对应的数据网络的名称；该会话管理网元向数据管理网元发送请求消息，该请求消息包括该用户永久标识和该数据网络的名称；该会话管理网元从该数据管理网元接收信息，该信息用于确定是否对该远端终端设备进行二次认证；该会话管理网元根据该信息，确定是否对该远端终端设备进行二次认证。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
基于上述方案，会话管理网元可以从移动管理网元获取远端终端设备的用户永久标识和数据网络的名称，因此会话管理网元可以通过这些信息向数据管理网元获取用于判断是否对远端终端设备进行二次认证的信息，从而可以确定是否需要对远端终端设备进行二次认证。
结合第二方面，在第二方面的某些实现方式中，该信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第三方面，提供了一种通信方法，该方法可以由中继终端设备执行，或者，也可以由中继终端设备的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由中继终端设备执行为例进行说明。
该通信方法包括：中继终端设备生成远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网路的名称；中继终端设备向移动管理网元发送该远端终端设备对应的传输标识，以及该报告信息。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
基于上述方案，中继终端设备可以向移动管理网元提供远端终端设备对应的传输标识和数据网络的名称，以便移动管理网元可以根据这些信息向会话管理网元提供获取二次认证信息的相关信息，这里的二次认证信息是用于判断是否对远端终端设备进行二次认证的信息。
结合第三方面，在第三方面的某些实现方式中，该方法还包括：该中继终端设备根据该远端终端设备对应的中继服务码确定该数据网络的名称。
结合第三方面，在第三方面的某些实现方式中，在该中继终端设备向移动管理网元发送该远端终端设备对应的传输标识之后，该方法还包括：该中继终端设备从该移动管理网元接收认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；该中继终端设备根据该认证命令消息，获取该远端终端设备的身份信息；该中继终端设备向该移动管理网元发送该身份信息。
第四方面，提供了一种通信方法，该方法可以由会话管理网元执行，或者，也可以由会话管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由会话管理网元执行为例进行说明。
该通信方法包括：会话管理网元从移动管理网元接收远端终端设备的报告信息，该报告信息包括该远端终端设备的用户隐藏标识和该远端终端设备对应的数据网络的名称；该会话管理网元向数据管理网元发送请求消息，该请求消息包括该用户隐藏标识和该数据网络的名称；该会话管理网元从该数据管理网元接收信息，该信息用于确定是否对该远端终端设备进行二次认证；该会话管理网元根据该信息，确定是否对该远端终端设备进行二次认证。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
基于上述方案，会话管理网元可以从移动管理网元获取远端终端设备的用户隐藏标识和该远端终端设备对应的数据网络的名称，从而可以根据这些信息向数据管理网元获取用于判断是否对远端终端设备进行二次认证的信息，从而可以确定是否需要对远端终端设备进行二次认证。
结合第四方面，在第四方面的某些实现方式中，该信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第五方面，提供了一种通信方法，该方法可以由中继终端设备执行，或者，也可以由中继终端设备的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由中继终端设备执行为例进行说明。
该通信方法包括：中继终端设备从远端终端设备接收该远端终端设备的用户隐藏标识；该中继终端设备生成该远端终端设备的报告信息，该报告信息包括该用户隐藏标识和该远 端终端设备对应的数据网络的名称；该中继终端设备向移动管理网元发送该远端终端设备的报告信息。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
基于上述方案，中继终端设备从远端终端设备获取远端终端设备的用户隐藏标识之后，可以用过报告信息向移动管理网元提供该用户隐藏标识和该远端终端设备对应的数据网络的名称，以便移动管理网元可以将这些信息发送给会话管理网元，使得会话管理网元可以根据这些信息向数据管理网元获取用于判断是否对远端终端设备进行二次认证的信息，从而可以确定是否需要对远端终端设备进行二次认证。
结合第五方面，在第五方面的某些实现方式中，该方法还包括：该中继终端设备根据该远端终端设备的传输标识确定该数据网络的名称。
结合第五方面，在第五方面的某些实现方式中，在该中继终端设备向移动管理网元发送该远端终端设备的报告信息之后，该方法还包括：该中继终端设备从该移动管理网元接收认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；该中继终端设备根据该认证命令消息，获取该远端终端设备的身份信息；该中继终端设备向该移动管理网元发送该身份信息。
需要说明的是，该移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。或者说，该中继终端设备和该远端终端设备是临近业务场景中的中继设备和远端设备。
第六方面，提供了一种通信方法，该方法可以由远端终端设备执行，或者，也可以由远端终端设备的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由远端终端设备执行为例进行说明。
该通信方法包括：远端终端设备从中继终端设备接收直连安全模式命令消息；该远端终端设备生成该远端终端设备的用户隐藏标识；该远端终端设备向该中继终端设备发送直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
第七方面，提供了一种通信方法，该方法可以由会话管理网元执行，或者，也可以由会话管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由会话管理网元执行为例进行说明。
该通信方法包括：会话管理网元从移动管理网元接收远端终端设备的标识信息以及第一信息，该第一信息用于确定该远端终端设备对应的数据网络；该会话管理网元向数据管理网元发送请求消息，该请求消息包括该远端终端设备的标识信息和该第一信息；该会话管理接收来自该数据管理网元的第二信息，该第二信息用于确定是否对该远端终端设备进行二次认证；该会话管理网元根据该第二信息，确定是否对该远端终端设备进行二次认证。
结合第七方面，在第七方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、临近业务中继用户密钥标识中的至少一种。
结合第七方面，在第七方面的某些实现方式中，该会话管理网元接收来自中继终端设备的远端终端设备的标识信息以及第一信息，包括：该会话管理网元接收来自中继终端设备的报告信息，该报告信息包括该远端终端设备的标识信息和该第一信息。
结合第七方面，在第七方面的某些实现方式中，该第二信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第八方面，提供了一种通信方法，该方法可以由数据管理网元执行，或者，也可以由数据管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由数据管理网元执行为例进行说明。
该通信方法包括：数据管理网元接收来自会话管理网元的请求消息和第一信息，该请求消息包括远端终端设备的标识信息，该第一信息用于确定该远端终端设备对应的数据网络；该数据管理网元根据该远端终端设备的标识信息和数据网络名称获取该远端终端设备的、与该数据网络名称对应的会话管理签约数据，该数据网络名称根据该第一信息确定；该数据管理网元根据该远端终端设备的签约数据，向该会话管理网元发送第二信息，该第二信息用于该会话管理网元确定是否对该远端终端设备进行二次认证。
结合第八方面，在第八方面的某些实现方式中，该数据管理网元获取该远端终端设备对应的数据网络名称，包括：该数据管理网元获取该远端终端设备的中继服务码；该数据管理网元根据该远端终端设备的中继服务码确定该远端终端设备对应的数据网络名称。
结合第八方面，在第八方面的某些实现方式中，该数据管理网元获取该远端终端设备的中继服务码，包括：该数据管理网元从该请求消息中获取该中继服务码。
结合第八方面，在第八方面的某些实现方式中，该数据管理网元获取该远端终端设备对应的数据网络名称，包括：该数据管理网元从该请求消息中获取该数据网络名称。
结合第八方面，在第八方面的某些实现方式中，该第二信息包括以下信息中的至少一项：该远端终端设备的、与数据网络名称对应的会话管理签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
结合第八方面，在第八方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识，该数据管理网元根据该终端设备的标识信息和该数据网络名称获取该远端终端设备的签约数据，包括：该数据管理网元根据该用户隐藏标识确定该远端终端设备的用户永久标识；该数据管理网元根据该用户永久标识和该数据网络名称，获取该远端终端设备的、与该数据网络名称对应的会话管理签约数据。
第九方面，提供了一种通信方法，该方法可以由中继终端设备执行，或者，也可以由中继终端设备的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由中继终端设备执行为例进行说明。
该通信方法包括：中继终端设备接收来自远端终端设备的该远端终端设备的标识信息；该中继终端设备向会话管理网元发送该远端终端设备的标识信息以及该远端终端设备对应的第一信息，该第一信息用于确定该远端终端设备对应的数据网络。
结合第九方面，在第九方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、接近业务中继用户密钥标识中的至少一种。
结合第九方面，在第九方面的某些实现方式中，该第一信息包括该远端终端设备的数据网络名称，该方法还包括：该中继终端设备确定该远端终端设备对应的该中继服务码； 该中继终端设备根据该中继服务码确定该数据网络名称。
结合第九方面，在第九方面的某些实现方式中，该中继终端设备向会话管理网元发送该远端终端设备的标识信息以及该远端终端设备对应的第一信息，包括：该中继终端设备向该会话管理网元发送报告信息，该报告信息包括该远端终端设备的标识信息以及该第一信息。
结合第九方面，在第九方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识。
结合第九方面，在第九方面的某些实现方式中，该中继终端设备接收来自远端终端设备的该远端终端设备的标识信息，包括：该中继终端设备向该远端终端设备发送直连安全模式命令消息；该中继终端设备接收来自该远端终端设备的直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
第十方面，提供了一种通信方法，该方法可以由移动管理网元执行，或者，也可以由移动管理网元的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由移动管理网元执行为例进行说明。
该通信方法包括：移动管理网元接收来自中继终端设备的针对远端终端设备的传输标识；该移动管理网元根据该传输标识确定与该传输标识对应的该远端终端设备的标识信息；该移动管理网元向会话管理网元发送该远端终端设备的标识信息。
结合第十方面，在第十方面的某些实现方式中，在该移动管理网元接收来自中继终端设备的针对远端终端设备的传输标识之前，该方法还包括：该移动管理网元保存该传输标识和该远端终端设备的标识信息之间的对应关系。
结合第十方面，在第十方面的某些实现方式中，该移动管理网元根据该传输标识确定与该传输标识对应的远端终端设备的标识信息，包括：该移动管理网元根据该传输标识以及该对应关系，确定该远端终端设备的标识信息。
结合第十方面，在第十方面的某些实现方式中，该方法还包括：该移动管理网元根据该传输标识确定该远端终端设备对应的数据网络名称；该移动管理网元向该会话管理网元发送该数据网络名称。
结合第十方面，在第十方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、接近业务中继用户密钥标识中的至少一种。
结合第十方面，在第十方面的某些实现方式中，在该移动管理网元接收来自中继终端设备的针对远端终端设备的传输标识之前，该方法还包括：该移动管理网元保存该传输标识和该远端终端设备的标识信息之间的对应关系。
第十一方面，提供了一种通信方法，该方法可以由远端终端设备执行，或者，也可以由远端终端设备的组成部件(例如芯片或者电路)执行，对此不作限定。为了便于描述，下面以由远端终端设备执行为例进行说明。
该通信方法包括：远端终端设备接收来自中继终端设备的直连安全模式命令消息；远端终端设备生成该远端终端设备的标识信息；该远端终端设备向该中继终端设备发送直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
结合第十一方面，在第十一方面的某些实现方式中，该方法还包括：该远端终端设备向该中继终端设备发送该远端终端设备对应的数据网络名称。
结合第十一方面，在第十一方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识。
第十二方面，提供了一种通信装置，该通信装置包括：收发模块，用于从中继终端设备接收远端终端设备的传输标识，以及该远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网络的名称；处理模块，用于根据该传输标识，确定该远端终端设备的用户永久标识；该收发模块，还用于向会话管理网元发送该用户永久标识和该报告信息。
结合第十二方面，在第十二方面的某些实现方式中，该收发模块，还用于该移动管理网元从鉴权服务器功能网元接收该远端终端设备的用户永久标识；该处理模块，还用于保存该用户永久标识和该传输标识之间的对应关系；该处理模块，具体用于根据该传输标识和该对应关系，确定该用户永久标识。
结合第十二方面，在第十二方面的某些实现方式中，该收发模块，还用于接收来自该会话管理网元的认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；以及向该中继终端设备发送该认证命令消息。
第十三方面，提供了一种通信装置，该通信装置包括：收发模块，用于从移动管理网元接收远端终端设备的报告信息，以及该远端终端设备的用户永久标识，该报告信息包括该远端终端设备对应的数据网络的名称；向数据管理网元发送请求消息，该请求消息包括该用户永久标识和该数据网络的名称；从该数据管理网元接收信息，该信息用于确定是否对该远端终端设备进行二次认证；处理模块，用于根据该信息，确定是否对该远端终端设备进行二次认证。
结合第十三方面，在第十三方面的某些实现方式中，该信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第十四方面，提供了一种通信装置，该通信装置包括：处理模块，用于生成远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网路的名称；收发模块，用于向移动管理网元发送该远端终端设备对应的传输标识，以及该报告信息。
结合第十四方面，在第十四方面的某些实现方式中，该处理模块，还用于根据该远端终端设备对应的中继服务码确定该数据网络的名称。
结合第十三方面，在第十三方面的某些实现方式中，该收发模块，还用于从该移动管理网元接收认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；该处理模块，还用于根据该认证命令消息，获取该远端终端设备的身份信息；该中继终端设备向该移动管理网元发送该身份信息。
第十五方面，提供了一种通信装置，该通信装置包括：收发模块，用于从移动管理网元接收远端终端设备的报告信息，该报告信息包括该远端终端设备的用户隐藏标识和该远端终端设备对应的数据网络的名称；向数据管理网元发送请求消息，该请求消息包括该用户隐藏标识和该数据网络的名称；从该数据管理网元接收信息，该信息用于确定是否对该远端终端设备进行二次认证；处理模块，用于根据该信息，确定是否对该远端终端设备进 行二次认证。
结合第十五方面，在第十五方面的某些实现方式中，该信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第十六方面，提供了一种通信装置，该通信装置包括：收发模块，用于从远端终端设备接收该远端终端设备的用户隐藏标识；处理模块，用于生成该远端终端设备的报告信息，该报告信息包括该用户隐藏标识和该远端终端设备对应的数据网络的名称；该收发模块，还用于向移动管理网元发送该远端终端设备的报告信息。
结合第十六方面，在第十六方面的某些实现方式中，该处理模块，还用于根据该远端终端设备的传输标识确定该数据网络的名称。
结合第十六方面，在第十六方面的某些实现方式中，该收发模块，还用于从该移动管理网元接收认证命令消息，该认证命令消息包括该远端终端设备的标识信息，该认证命令消息用于请求对该远端终端设备进行二次认证；该处理模块，还用于根据该认证命令消息，获取该远端终端设备的身份信息；该收发模块，还用于向该移动管理网元发送该身份信息。
第十七方面，提供了一种通信装置，该通信装置包括：收发模块，用于从中继终端设备接收直连安全模式命令消息；处理模块，用于生成该远端终端设备的用户隐藏标识；该远端终端设备向该中继终端设备发送直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
第十八方面，提供了一种通信装置，该通信装置包括：收发模块，用于从移动管理网元接收远端终端设备的标识信息以及第一信息，该第一信息用于确定该远端终端设备对应的数据网络；向数据管理网元发送请求消息，该请求消息包括该远端终端设备的标识信息和该第一信息；接收来自该数据管理网元的第二信息，该第二信息用于确定是否对该远端终端设备进行二次认证；处理模块，用于根据该第二信息，确定是否对该远端终端设备进行二次认证。
结合第十七方面，在第十七方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、临近业务中继用户密钥标识中的至少一种。
结合第十七方面，在第十七方面的某些实现方式中，该收发模块，具体用于接收来自中继终端设备的报告信息，该报告信息包括该远端终端设备的标识信息和该第一信息。
结合第十七方面，在第十七方面的某些实现方式中，该第二信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
第十九方面，提供了一种通信装置，该通信装置包括：收发模块，用于接收来自会话管理网元的请求消息和第一信息，该请求消息包括远端终端设备的标识信息，该第一信息用于确定该远端终端设备对应的数据网络；处理模块，用于根据该远端终端设备的标识信息和数据网络名称获取该远端终端设备的、与该数据网络名称对应的会话管理签约数据，该数据网络名称根据该第一信息确定；根据该远端终端设备的签约数据，向该会话管理网元发送第二信息，该第二信息用于该会话管理网元确定是否对该远端终端设备进行二次认 证。
结合第十八方面，在第十八方面的某些实现方式中，该处理模块，具体用于获取该远端终端设备的中继服务码；根据该远端终端设备的中继服务码确定该远端终端设备对应的数据网络名称。
结合第十八方面，在第十八方面的某些实现方式中，该处理模块，具体用于该数据管理网元从该请求消息中获取该中继服务码。
结合第十八方面，在第十八方面的某些实现方式中，该处理模块，具体用于该数据管理网元从该请求消息中获取该数据网络名称。
结合第十八方面，在第十八方面的某些实现方式中，该第二信息包括以下信息中的至少一项：该远端终端设备的、与数据网络名称对应的会话管理签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
结合第十八方面，在第十八方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识，该处理模块，具体用于根据该用户隐藏标识确定该远端终端设备的用户永久标识；根据该用户永久标识和该数据网络名称，获取该远端终端设备的、与该数据网络名称对应的会话管理签约数据。
第二十方面，提供了一种通信装置，该通信装置包括：收发模块，用于接收来自远端终端设备的该远端终端设备的标识信息；向会话管理网元发送该远端终端设备的标识信息以及该远端终端设备对应的第一信息，该第一信息用于确定该远端终端设备对应的数据网络。
结合第二十方面，在第二十方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、接近业务中继用户密钥标识中的至少一种。
结合第二十方面，在第二十方面的某些实现方式中，该第一信息包括该远端终端设备的数据网络名称，该处理模块，还用于确定该远端终端设备对应的该中继服务码；根据该中继服务码确定该数据网络名称。
结合第二十方面，在第二十方面的某些实现方式中，该收发模块，具体用于向该会话管理网元发送报告信息，该报告信息包括该远端终端设备的标识信息以及该第一信息。
结合第二十方面，在第二十方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识。
结合第二十方面，在第二十方面的某些实现方式中，收发模块，用于向该远端终端设备发送直连安全模式命令消息；接收来自该远端终端设备的直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
第二十一方面，提供了一种通信装置，该通信装置包括：收发模块，用于接收来自中继终端设备的针对远端终端设备的传输标识；处理模块，用于根据该传输标识确定与该传输标识对应的该远端终端设备的标识信息；该收发模块，还用于向会话管理网元发送该远端终端设备的标识信息。
结合第二十一方面，在第二十一方面的某些实现方式中，该处理模块，还用于保存该传输标识和该远端终端设备的标识信息之间的对应关系。
结合第二十一方面，在第二十一方面的某些实现方式中，该处理模块，具体用于根据 该传输标识以及该对应关系，确定该远端终端设备的标识信息。
结合第二十一方面，在第二十一方面的某些实现方式中，该处理模块，还用于根据该传输标识确定该远端终端设备对应的数据网络名称；该收发模块，还用于向该会话管理网元发送该数据网络名称。
结合第二十一方面，在第二十一方面的某些实现方式中，该第一信息包括该远端终端设备对应的中继服务码、数据网络名称、接近业务中继用户密钥标识中的至少一种。
结合第二十一方面，在第二十一方面的某些实现方式中，该处理模块，还用于保存该传输标识和该远端终端设备的标识信息之间的对应关系。
第二十二方面，提供了一种通信装置，该通信装置包括：收发模块，用于接收来自中继终端设备的直连安全模式命令消息；处理模块，用于生成该远端终端设备的标识信息；该远端终端设备向该中继终端设备发送直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
结合第二十二方面，在第二十二方面的某些实现方式中，该收发模块，还用于向该中继终端设备发送该远端终端设备对应的数据网络名称。
结合第二十二方面，在第二十二方面的某些实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识。
第二十三方面，提供通信装置，该装置用于执行上述第一方面至第十一方面提供的任一方法。具体地，该装置可以包括用于执行第一方面至第十一方面提供的方法的单元和/或模块，如处理模块和/或收发模块(也可以成为通信模块)。在一种实现方式中，该装置为网络设备，例如该装置为移动管理网元，或会话管理网元，或数据管理网元。当该装置为网络设备时，通信模块可以是收发器，或，输入/输出接口；处理模块可以是处理器。
在一种实现方式中，该装置为用于网络设备中的芯片、芯片系统或电路。当该装置为用于通信设备中的芯片、芯片系统或电路时，通信模块可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等；处理模块可以是处理器、处理电路或逻辑电路等。
一种可能情况，该装置为移动管理网元中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第一方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
另一种可能情况，该装置为会话管理网元，或者会话管理网元中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第二方面、第四方面、第七方面、第十方面中任一方面提供的方法的单元和/或模块，如处理模块和/或收发模块。
另一种可能情况，该装置为数据管理网元，或者数据管理网元中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第八方面提供的方法的单元和/或模块，如处理模块和/或收发模块。
在另一种实现方式中，该装置为终端设备，例如该装置为中继终端设备，或远端终端设备。当该装置为终端设备时，通信单元可以是收发器，或，输入/输出接口；处理单元可以是处理器。
一种可能情况，该装置为中继终端设备或中继终端设备中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第三方面、第五方面、第九方面中任一方面提供的方法的单元和/或模块，如处理模块和/或收发模块。
另一种可能情况，该装置为远端终端设备或远端终端设备中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第二方面、第六方面、第十一方面中任一方面提供的方法的单元和/或模块，如处理模块和/或收发模块。
可选地，上述收发器可以为收发电路。可选地，上述输入/输出接口可以为输入/输出电路。
可选地，上述收发器可以为收发电路。可选地，上述输入/输出接口可以为输入/输出电路。
第二十四方面，提供一种通信装置，该装置包括：存储器，用于存储程序；处理器，用于执行存储器存储的程序，当存储器存储的程序被执行时，处理器用于执行上述第一方面至第五方面提供的任一方法。
第二十五方面，本申请提供一种处理器，用于执行上述各方面提供的方法。在执行这些方法的过程中，上述方法中有关发送上述信息和获取/接收上述信息的过程，可以理解为由处理器输出上述信息的过程，以及处理器接收输入的上述信息的过程。在输出上述信息时，处理器将该上述信息输出给收发器，以便由收发器进行发射。该上述信息在由处理器输出之后，还可能需要进行其他的处理，然后再到达收发器。类似的，处理器接收输入的上述信息时，收发器获取/接收该上述信息，并将其输入处理器。更进一步的，在收发器收到该上述信息之后，该上述信息可能需要进行其他的处理，然后再输入处理器。
基于上述原理，举例来说，前述方法中提及的接收请求消息可以理解为处理器接收输入的信息。
对于处理器所涉及的发射、发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则均可以更加一般性的理解为处理器输出和接收、输入等操作，而不是直接由射频电路和天线所进行的发射、发送和接收操作。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器。上述存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第二十六方面，提供一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述第一方面至第五方面提供的任一方法。
第二十七方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面至第五方面提供的任一方法。
第二十八方面，提供一种芯片，该芯片包括处理器与通信接口，该处理器通过该通信接口读取存储器上存储的指令，执行上述第一方面至第五方面提供的任一方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述第一方面至第五方面提供的任一方法。
第二十九方面，提供一种通信系统，包括前述的移动管理网元、会话管理网元、数据管理网元中的一个或多个。
可选地，该通信系统还可以包括上述中继终端设备。
可选地，该通信系统还可以包括上述远端终端设备。
附图说明
图1的(a)和图1的(b)示出了本申请实施例适用的网络架构的示意图。
图2示出了一种控制面流程200的示意图。
图3是本申请实施例提供的一种二次认证的流程300的示意图。
图4是本申请实施例提供的一种通信方法400的示意流程图。
图5是本申请实施例提供的一种通信方法500的示意性流程图。
图6是本申请实施例提供的一种通信方法600的示意性流程图。
图7是本申请实施例提供的一种通信方法700的示意性流程图。
图8是本申请一个实施例提供的通信装置的示意性框图。
图9是本申请另一个实施例提供的通信装置的示意性框图。
图10是本申请又一个实施例提供的通信装置的示意性框图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
可以理解的是，在本申请中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”以及其他各种术语标号等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请提供的技术方案可以应用于各种通信系统，例如：第五代(5th generation，5G)或新无线(new radio，NR)系统、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)系统等。本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统。本申请提供的技术方案还可以应用于设备到设备(device to device，D2D)通信，车到万物(vehicle-to-everything，V2X)通信，机器到机器(machine to machine，M2M)通信，机器类型通信(machine type communication，MTC)，以及物联网(internet of things，IoT) 通信系统或者其他通信系统。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。同时，在本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念，便于理解。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，下面结合图1的(a)详细说明本申请实施例的一个应用场景。
图1的(a)是适用于本申请实施例提供的方法的网络架构的示意图。如图所示，该网络架构具体可以包括下列网元：
1、用户设备(user equipment，UE)：可以称为终端设备、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、无人机、可穿戴设备，5G网络中的终端设备或演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，本申请实施例对此并不限定。UE可以通过Uu接口与下一代无线接入网(next generation radio access network，NG-RAN)设备相连，例如图1的(a)所示的UE#A和UE#D通过Uu接口与NG-RAN相连。两个具有临近业务应用(proximity-based services application，ProSe application)功能的UE之间也可以通过PC5接口相连，例如图1的(a)所示的UE#A与UE#B通过PC5接口相连，UE#B与UE#C通过PC5接口相连，UE#A与UE#D通过PC5接口相连。
2、接入网(access network，AN)：为特定区域的授权用户提供入网功能，并能够根 据用户的级别，业务的需求等使用不同质量的传输隧道。接入网络可以为采用不同接入技术的接入网络。目前的接入网络技术包括：第三代(3rd generation，3G)系统中采用的无线接入网技术、4G系统中采用的无线接入网技术、或图1的(a)所示的NG-RAN技术(如5G系统中采用的无线接入技术)等。
基于无线通信技术实现接入网络功能的接入网可以称为无线接入网络(radio access network，RAN)。无线接入网能够管理无线资源，为终端提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网设备例如可以是基站(NodeB)、演进型基站(evolved NodeB，eNB或eNodeB)、5G移动通信系统中的下一代基站节点(next generation Node Base station，gNB)、为例移动通信系统中的基站或wifi无线热点(WiFi)系统中的接入点(access point，AP)等，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该无线接入网设备可以为中继站、接入点、车载设备、无人机、可穿戴设备以及5G网络中的网络设备或者演进的PLMN中的网络设备等。本申请实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
3、接入管理网元：主要用于移动性管理和接入管理、负责在用户设备与策略控制功能(policy control function，PCF)网元间传递用户策略等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其他功能。例如，合法监听、或接入授权(或鉴权)的功能。
在5G通信系统中，接入管理网元可以是接入和移动管理功能(access and mobility management function，AMF)网元。在未来通信系统中，接入管理网元仍可以是AMF网元，或者，还可以有其他的名称，本申请不做限定。
4、会话管理网元：主要用于会话管理、用户设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
在5G通信系统中，会话管理网元可以会话管理功能(session management function，SMF)网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其他的名称，本申请不做限定。
5、用户面网元：用于分组路由和转发、用户面数据的服务质量(quality of services，QoS)处理、完成用户面数据转发、基于会话/流级的计费统计，带宽限制等功能等。
在5G通信系统中，用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其他名称，本申请不做限定。
6、数据网络网元：用于提供传输数据的网络。
在5G通信系统中，数据网络网元可以是数据网络(data network，DN)网元。在未来通信系统中，数据网络网元仍可以是DN网元，或者，还可以有其他名称，本申请不做限定。
7、策略控制网元：用于指导网络行为的统一策略框架，为控制面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
在4G通信系统中，该策略控制网元可以是策略和计费规则功能(policy and charging  rules function，PCRF)网元。在5G通信系统中，该策略控制网元可以是策略控制功能(policy control function，PCF)网元。在未来通信系统中，该策略控制网元仍可以是PCF网元，或者，还可以有其他名称，本申请不做限定。
8、数据管理网元：用于处理用户设备标识，接入鉴权，注册以及移动性管理等。
在5G通信系统中，该数据管理网元可以是统一数据管理(unified data management，UDM)网元；在4G通信系统中，该数据管理网元可以是归属用户服务器(home subscriber serve，HSS)网元。在未来通信系统中，数据管理网元仍可以是UDM网元，或者，还可以有其他的名称，本申请不做限定。
9、数据仓库网元：用于负责签约数据、策略数据、应用数据等类型数据的存取功能。
在5G通信系统中，该数据仓库网元可以是统一数据仓库(unified data repository，UDR)网元。在未来通信系统中，数据仓库网元仍可以是UDR网元，或者，还可以有其他的名称，本申请不做限定。
10、网络开放功能(network exposure function，NEF)实体：用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
11、ProSe应用服务器(application server，AS)：可以是DN的应用功能(application function，AF)，也可以是提供ProSe服务的AS本身。具有ProSe应用服务器功能的AF具有23.501R-15版本中定义的AF的所有功能，以及具有用于ProSe业务的相关功能。也就是说，在用户面架构中，ProSe应用服务器与UE是通过UE-RAN-UPF-AF的路径进行用户面通信。ProSe应用服务器还可以在控制面架构中，通过NEF与5G核心网(5G core network，5GC)中的其他网络功能(network function，NF)进行通信。比如通过NEF与PCF通信。如果ProSe应用服务器是DN的AF，且该AF为5GC的运营商布置，则ProSe应用服务器还可在控制面架构中，不通过NEF与5GC中的其他NF进行直接通信，比如直接与PCF通信。
12、5G直连通信发现名称管理功能(direct discovery name management function，DDNMF)：具有为开放临近业务发现(open ProSe discovery)分配和处理临近业务应用标识(ProSe application identifier)和临近业务应用代码(ProSe application code)之间映射关系的作用。在受限临近业务发现(restricted ProSe direct discovery)中，5G DDNMF可以通过PC2接口与临近业务应用服务器通信，用于处理发现请求(discovery request)的授权，也具有未分配和处理应用标识(application identifier)和受限临近业务中使用的代码之间映射关系的作用，其中受限临近业务中使用的代码包括受限临近业务代码(ProSe restricted code)、临近业务请求代码(ProSe query code)和临近业务回复代码(ProSe response code)。
目前标准定义中，5G DDNMF是PLMN粒度的，即一个PLMN只有一个5G DDNMF。通过移动国家码(mobile country code，MCC)和移动网络码(mobile network code，MNC)可以唯一确定一个5G DDNMF。
13、鉴权服务器功能(authentication server function，AUSF)：网元对用户进行鉴权和授权。
14、临近业务密钥管理功能(ProSe key management function，PKMF)：可以负责为使用临近业务的UE生成和分发PC5接口连接使用的密钥，UE需要通过控制面与PKMF 进行交互以获取PC5接口使用的密钥。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的一个功能模块，本申请实施例对此不作具体限定。
还应理解，上述图1的(a)所示的适用于本申请实施例的网络架构仅是一种举例说明，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
例如，在某些网络架构中，AMF、SMF网元、PCF网元以及UDM网元等网络功能网元实体都称为网络功能(network function，NF)网元；或者，在另一些网络架构中，AMF，SMF网元，PCF网元，UDM网元等网元的集合都可以称为控制面功能网元。因为UE需要通过用户面与PKMF和DDNMF交互，因此PKMF和DDNMF等网元可以称为用户面网元。
图1的(b)示出了本申请实施例的另一种通信系统架构示意图。当远端终端设备处于网络覆盖范围之外或者与接入网设备之间的信号质量不好(例如，低于预设门限)时，远端终端设备可以通过中继终端设备进行辅助，通过远端终端设备与中继终端设备之间的通信，以及中继终端设备与接入网设备之间的通信来实现远端终端设备和接入网设备之间的通信。例如，如图1的(b)所示，远端终端设备可以通过中继终端设备实现与RAN的通信。
随着移动通信的高速发展，新业务类型，如视频业务、虚拟现实(virtual reality，VR)/增强现实(augmented reality，AR)等数据业务的普遍使用提高了用户对带宽的需求。D2D通信允许UE之间直接进行通信，可以在小区网络的控制下与小区用户共享频谱资源，有效地提高频谱资源的利用率。目前，D2D通信已经应用于4G和5G网络系统中，统称为临近业务通信(proximity based service，ProSe)。
当UE处于网络覆盖之外或与RAN间通信信号不好时，远端UE(remote UE)可以通过中继UE(relay UE)进行辅助通信，即通过远端UE与中继UE间通信、中继UE与移动网络通信进而实现远端UE获得服务。通过建立远端UE到中继UE到网络的通信方式，可以扩展支持处在网络覆盖范围外UE到网络的通信。远端UE到中继UE到网络的通信方式可以称为UE至网络中继(UE-to-network relay)通信。
下面结合图2介绍一种Prose控制面(control plane，CP)流程，其中该CP流程指的是remote UE通过relay UE的NAS消息，获得用于与relay UE建立PC5安全的密钥的过程。需要说明的是，在方法300的流程图中，AMF(Remote)指的是Remote UE对应的AMF，该AMF也可以记作Remote AMF；类似地，AMF(Relay)指的是Relay UE的AMF，该AMF可以记作Relay AMF，其余网元可以用类似的方式解释，这里不再一一说明。下面结合方法200中的各个步骤对CP流程进行示例性说明，未详尽说明的部分可参考现有协议。
S201，Remote UE注册到网络，并通过网络进行认证和授权。
S202，Relay UE注册到网络，并通过网络进行认证和授权。
S203，Remote UE和Relay UE互相发现。
S204，Remote UE向Relay UE发送直连通信请求(Direct Communication Request)消息，该消息中携带Remote UE的用户隐藏标识(subscription concealed identifier，SUCI)，中继服务码(relay service code，RSC)，Nounce_1等。其中，SUCI是一种临时的UE身份信息，用于提供隐私保护。SUCI至少包括对SUPI的非SUPI类型部分的加密结果。Remote UE的SUCI用于UDM获得Remote UE的SUPI，并对remote UE进行鉴权；RSC用于Remote UE与relay UE互相发现，它用于指示Relay可以为RemoteUE提供的服务信息。一个RelayUE可以支持多个不同的RSC，但是在每一次发现的时候只能携带一个RSC。RSC是网络侧下发给RelayUE和RemoteUE的，同时网络侧还会下发PDU会话相关参数，比如DNN或者单网络切片选择支撑信息(single network slice selection assistance information，S-NSSAI)；Nounce_1用于传递给remote UE的家乡网络以作为密钥生成参数。
S205，Relay UE向AMF(Relay)发送中继密钥请求(Relay Key Request)消息，该AMF为Relay UE对应的AMF，或者说，该AMF是为Relay UE提供接入服务的AMF，该消息为NAS消息，该消息中包括Relay UE的身份信息，Remote UE的SUCI，RSC，Nounce_1等。
S206，AMF对Relay UE进行认证。示例性地，AMF检查relay UE是否可以提供中继服务，或者说，AF检查Relay UE是否可以作为中继设备。如果是的话，则执行后续流程。
S207，AMF向AUSF(Remote)发送Prose认证请求(Nausf_UEAuthentication_ProseAuthenticate Request)消息。其中，该AUSF与Remote UE对应，该Prose认证请求消息携带有Remote UE的SUCI，RSC，Nounce_1等。
S208，AUSF通过UDM获取主鉴权参数。示例性地，AUSF向UDM发送服务化请求消息，以请求获取主鉴权参数，UDM根据AUSF的请求向AUSF返回主鉴权参数。
AUSF获取主鉴权参数之后，触发Remote UE的主鉴权流程。Remote UE通过relay UE与remote UE的AUSF进行主鉴权流程。具体流程如S209-S214所示，详细过程可参考现有协议，这里不再赘述。
S215a，Remote UE生成5G PRUK和5G PRUK ID。
S215b，AUSF生成5G PRUK和5G PRUK ID。
示例性地，主鉴权流程成功后，remote UE的AUSF和Remote UE分别各自生成密钥5G PRUK和密钥标识符5G PRUK ID。
S216，Remote UE的AUSF进一步生成密钥KNR_ProSe。
S217，AUSF向Relay UE的AMF发送Prose授权响应消息。该Prose授权响应消息包括KNR_ProSe，Nounce_2，5G PRUK ID等。其中，AUSF在生成KNR_ProSe的时候，将该KNR_ProSe和Nounce_1作为输入参数生成Nounce_2。
S218，AMF向Relay UE发送中继密钥响应(Relay Key Response)消息。该中继密钥响应消息包括KNR_ProSe，Nounce_2，5G PRUK ID等。
S219，Relay UE接收到中继密钥响应消息之后，保存KNR_ProSe，并生使用KNR_ProSe生成Krelay-sess，然后，Relay UE向Remote UE发送直连安全模式命令(Direct Security mode command)消息，该直连安全模式命令消息中包括Nounce_2，5G PRUK ID等。
S220，Remote UE接收到来自Relay UE的直连安全模式命令消息之后，使用KNR_ProSe生成Krelay-sess。
S221，Remote UE向Relay UE发送直连安全模式完成(Direct Security Complete)消息。
S222，Relay UE向Remote UE发送直连通信接受(Direct Communication Accept)消息。
方法200简要描述了主鉴权流程。然而，随着垂直行业和物联网的发展，运营商网络之外的DN对于接入到DN的某些UE同样有认证与授权的需求，即进行二次认证(secondary authentication)的需求，这种认证方式可以由运营商网络以外的数据网络通过运营商网络对UE进行认证或授权。图3中的方法300示出了一种Prose场景中对Remote UE进行二次认证的流程。下面结合图3中的各个步骤对方法300作示例性说明。
S301，Remote UE注册到网络，并通过网络进行认证和授权。
S302，Relay UE注册到网络，并通过网络进行认证和授权。
可选地，S303，Relay UE通过核心网网元执行PDU会话建立流程。
S304-S308与方法300中的S203-S222类似，这里不再赘述。但需要说明的是，方法300中的S306对应于方法200中的S205-S220，为了简洁，图3未示出详细流程。
可选地，S309，Remote UE和Relay UE执行IP地址(IP address)/前缀(prefix)的分配。
S310，Relay UE向SMF发送Remote UE报告(Remote UE Report)。示例性地，Relay UE将承载Remote UE报告的消息封装在NAS消息中发送给AMF，然后由AMF再发送给SMF。该Remote UE报告包括User info(或是Remote User ID)和IP info。
SMF接收到Remote UE报告之后，判断是否需要对remote UE做二次认证，如果需要的话，则SMF执行S311触发二次认证，具体流程(S311-S320)可参考现有协议，这里不再详细说明。
方法300描述了Prose场景下，对Remote UE进行二次认证的流程，然而，SMF如何判断Remote UE是否需要进行二次认证，当前还没有解决方案。
图4示出了本申请实施例提供的方法400的示例性流程图。该方法400可应用于图1的(a)或图1的(b)给出的网络架构中。下面结合图4中的各个步骤对方法400作示例性说明。
S401，移动管理网元向会话管理网元发送远端终端设备的标识信息和第一信息。对应地，会话管理网元从移动管理网元接收该远端终端设备的标识信息和第一信息。
示例性地，移动管理网元获取远端终端设备的标识信息和第一信息，然后向会话管理网元发送该远端终端设备的标识信息和该第一信息。
应理解，在本实施例中，移动管理网元是为中继终端设备提供服务的网元，中继终端设备为远端终端设备提供中继服务。该远端终端设备的标识信息是用于标识远端终端设备身份的信息，该信息例如可以是远端终端设备的用户隐藏标识，或者是用于永久标识。该第一信息用于确定远端终端设备对应的数据网络，该第一信息包括远端终端设备的中继服务码、远端终端设备对应的数据网络的名称、临近业务中继用户密钥标识中的至少一种。另外，为了方便，后续实施例中，将远端终端设备对应的数据网络的名称记为数据网络名 称。
下面对移动管理网元获取并发送远端终端设备的标识信息和第一信息的具体实现方式作示例性说明。
在第一种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识，该第一信息为该远端终端设备对应的中继服务码。具体地，远端终端设备生成用户隐藏标识，然后发送给中继终端设备。例如，远端终端设备生成该标识信息之后，在直连通信请求(Direct Communication Request)消息或者直连安全模式完成(Direct Security Mode Complete)消息中将该用户隐藏标识发送给中继终端设备。中继终端设备接收到该用户隐藏标识之后，将该用户隐藏标识，以及与该远端终端设备对应的中继服务码发送给移动管理网元，其中该远端终端设备对应的中继服务码为该中继终端设备和该远端终端设备建立连接时使用的中继服务码。然后移动管理网元将该用户隐藏标识和该中继服务码发送给会话管理网元。在一种实现方式中，该用户隐藏标识和该中继服务码可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送远端终端设备的报告信息，该报告信息包括该用户隐藏标识和该中继服务码，移动管理网元接收到该报告信息之后，将该报告信息发送给会话管理网元。在另一种实现方式中，该用户隐藏标识可以承载于远端终端设备的报告信息中，该中继服务码可以承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的非接入层(non-access stratum，NAS)消息包括远端终端设备的报告信息和中继服务码，该报告信息包括该用户隐藏标识，移动管理网元接收到该报告信息之后，将该报告信息和中继服务码发送给会话管理网元。本实施例不对具体的传输方式做限定。
在第二种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户隐藏标识，该第一信息为该远端终端设备对应的数据网络名称。具体地，远端终端设备生成用户隐藏标识，然后，在直连通信请求(Direct Communication Request)消息或者直连安全模式完成(Direct Security Mode Complete)消息发送给中继终端设备。中继终端设备接收到该用户隐藏标识之后，根据该远端终端设备对应的中继服务码确定该远端终端设备对应的数据网络名称，该远端终端设备对应的数据网络名称指的是远端终端设备接入的数据网络的数据网络名称。例如，在中继服务码对应的会话的参数包括数据网络名称的情况下，中继终端设备从该参数中获取该数据网络名称。又例如，在中继服务码对应的会话的参数不包括数据网络名称，但包括单网络切片选择支撑信息的情况下，中继终端设备根据该单网络切片选择支撑信息确定该数据网络名称。中继终端设备获取到该数据网络名称之后，将该用户隐藏标识和该数据网络名称发送给移动管理网元。在一种实现方式中，该用户隐藏标识和该数据网络名称可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送远端终端设备的报告信息，该报告信息包括该用户隐藏标识和该数据网络名称，移动管理网元接收到该报告信息之后，将该报告信息发送给会话管理网元。在另一种实现方式中，该用户隐藏标识可以承载于远端终端设备的报告信息中，该数据网络名称可以承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和数据网络名称，该报告信息包括该用户隐藏标识，移动管理网元接收到该报告信息之后，将该报告信息和数据网络名称发送给会话管理网元。本实施例不对具体的传输方式做限定。
在第三种实现方式中，该远端终端设备的标识信息为该远端终端设备的临近业务中继用户密钥标识，该第一信息为该远端终端设备对应的中继服务码。具体地，中继终端设备从网络侧获取临近业务中继用户密钥标识之后，将该临近业务中继用户密钥标识，以及与该远端终端设备对应的中继服务码发送给移动管理网元。然后移动管理网元将该临近业务中继用户密钥标识和该中继服务码发送给会话管理网元。在一种实现方式中，该临近业务中继用户密钥标识和该中继服务码可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送远端终端设备的报告信息，该报告信息包括该临近业务中继用户密钥标识和该中继服务码。移动管理网元接收该报告信息之后，将该报告信息发送给会话管理网元。在另一种实现方式中，该临近业务中继用户密钥标识可以承载于远端终端设备的报告信息中，该中继服务码可以承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和中继服务码，该报告信息包括该临近业务中继用户密钥标识，移动管理网元接收到该报告信息之后，将该报告信息和中继服务码发送给会话管理网元。在又一种实现方式中，该临近业务中继用户密钥标识和该中继服务码均承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远该中继服务码，该临近业务中继用户密钥标识和远端终端设备的报告信息，移动管理网元接收到之后，将临近业务中继用户密钥标识和远端终端设备的报告信息全部发送给会话管理网元。此时，远端终端设备的报告信息中的UserInfo部分可以设置为任意值。本实施例不对具体的传输方式做限定。
在第四种实现方式中，该远端终端设备的标识信息为该远端终端设备的临近业务中继用户密钥标识，该第一信息为该远端终端设备对应的数据网络名称。具体地，中继终端设备从网络侧获取临近业务中继用户密钥标识之后，中继终端设备获取数据网络名称，然后将该临近业务中继用户密钥标识和该数据网络名称发送给移动管理网元。中继终端设备获取数据网络名称的方式可参考第二种实现方式中的示例，这里不再赘述。进一步地，移动管理网元将该临近业务中继用户密钥标识和该数据网络名称发送给会话管理网元。在一种实现方式中，该临近业务中继用户密钥标识和该数据网络名称可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送远端终端设备的报告信息，该报告信息包括该临近业务中继用户密钥标识和该数据网络名称。移动管理网元接收该报告信息之后，将该报告信息发送给会话管理网元。在另一种实现方式中，该临近业务中继用户密钥标识可以承载于远端终端设备的报告信息中，该数据网络名称可以承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和数据网络名称，该报告信息包括临近业务中继用户密钥标识，移动管理网元接收到该报告信息之后，将该报告信息和数据网络名称发送给会话管理网元。在又一种实现方式中，该临近业务中继用户密钥标识和该数据网络名称均承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息、该临近业务中继用户密钥标识和该数据网络名称，移动管理网元接收到这些信息之后，将该临近业务中继用户密钥标识、该数据网络名称和远端终端设备的报告信息全部发送给会话管理网元。此时，远端终端设备的报告信息中的UserInfo部分可以设置为任意值。本实施例不对具体的传输方式做限定。
在第五种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识， 该第一信息为该远端终端设备的数据网络名称。具体地，中继终端设备获取远端终端设备对应的数据网络名称，具体实现方式可参考第二种实现方式中的示例，这里不再赘述。然后中继终端设备可以向该移动管理网元发送传输标识和该数据网络名称。其中，该传输标识是用于在中继终端设备和移动管理网元之间唯一标识与该远端终端设备对应的连接的标识。移动管理网元接收到该传输标识和该数据网络名称之后，根据该传输标识，以及预先保存的传输标识和用户永久标识之间的对应关系，确定该远端终端设备的用户永久标识。然后移动管理网元向会话管理网元发送该用户永久标识和该数据网络名称。在一种实现方式中，该数据网络名称可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送传输标识和该远端终端设备的报告信息，该报告信息包括该数据网络名称。移动管理网元根据传输标识确定用户永久标识之后，向会话管理网元发送该用户永久标识和该报告信息。在另一种实现方式中，该数据网络名称可以承载于远端终端设备的报告信息外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和数据网络名称。移动管理网元根据传输标识确定用户永久标识之后，将该报告信息，用户永久标识和数据网络名称发送给会话管理网元。本实施例不对具体的传输方式做限定。
第六种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识，该第一信息为该远端终端设备对应的中继服务码。具体地，中继终端设备向移动管理网元发送传输标识和中继服务码。移动管理网元接收到该传输标识和该中继服务码之后，根据该传输标识，以及预先保存的传输标识和用户永久标识之间的对应关系，确定该远端终端设备的用户永久标识。然后移动管理网元向会话管理网元发送该用户永久标识和该中继服务码。在一种实现方式中，该中继服务码可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送传输标识和该远端终端设备的报告信息，该报告信息包括该中继服务码。移动管理网元根据传输标识确定用户永久标识之后，向会话管理网元发送该用户永久标识和该报告信息。在另一种实现方式中，该中继服务码可以承载于远端终端设备的报告信息外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和中继服务码。移动管理网元根据传输标识确定用户永久标识之后，将该报告信息、用户永久标识和中继服务码发送给会话管理网元。本实施例不对具体的传输方式做限定。
第七种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识，该第一信息为该远端终端设备对应的数据网络名称。具体地，中继终端设备向移动管理网元发送传输标识。移动管理网元接收到该传输标识之后，根据该传输标识，以及预先保存的传输标识、用户永久标识和数据网络名称之间的对应关系，确定该远端终端设备的用户永久标识和数据网络名称。然后移动管理网元向会话管理网元发送该用户永久标识和该数据网络名称。
第八种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识，该第一信息为该远端终端设备对应的中继服务码。具体地，中继终端设备向移动管理网元发送传输标识。移动管理网元接收到该传输标识之后，根据该传输标识，以及预先保存的传输标识、用户永久标识和中继服务码之间的对应关系，确定该远端终端设备的用户永久标识和中继服务码。然后移动管理网元向会话管理网元发送该用户永久标识和该中继服务码。
第九种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识，该第一信息为该远端终端设备对应的数据网络名称。具体地，中继终端设备向移动管理网元发送传输标识和临近业务中继用户密钥标识。移动管理网元接收到该传输标识之后，根据该传输标识，以及预先保存的传输标识和数据网络名称之间的对应关系，确定该远端终端设备的数据网络名称。移动管理网元还需要使用临近业务中继用户密钥标识从临近锚点网元获取远端终端设备的用户永久标识。然后移动管理网元向会话管理网元发送该用户永久标识和该数据网络名称。在一种实现方式中，该临近业务中继用户密钥标识可以承载于远端终端设备的报告信息中，即中继终端设备向移动管理网元发送传输标识和该远端终端设备的报告信息，该报告信息包括该临近业务中继用户密钥标识。移动管理网元获取用户永久标识和数据网络名称之后，向会话管理网元发送该用户永久标识、数据网络名称和该报告信息。在另一种实现方式中，该临近业务中继用户密钥标识可以承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远端终端设备的报告信息和临近业务中继用户密钥标识。移动管理网元确定用户永久标识之后和数据网络名称后，将该报告信息、用户永久标识和服务网络名称发送给会话管理网元。本实施例不对具体的传输方式做限定。
第十种实现方式中，该远端终端设备的标识信息为该远端终端设备的用户永久标识，该第一信息为该远端终端设备对应的数据网络名称。具体地，中继终端从网络侧获取临近业务中继用户密钥标识。中继终端设备还需获取数据网络名称。中继终端设备获取数据网络名称的方式可参考第二种实现方式中的示例，这里不再赘述。然后中继终端设备将该临近业务中继用户密钥标识和该数据网络名称发送给移动管理网元。移动管理网元接收到该临近业务中继用户密钥标识之后，移动管理网元还需要使用临近业务中继用户密钥标识从临近锚点网元获取用户的用户永久标识。然后，移动管理网元将该用户永久标识和该数据网络名称发送给会话管理网元。在一种实现方式中，该临近业务中继用户密钥标识和该数据网络名称均承载于远端终端设备的报告信息之外，即中继终端设备向移动管理网元发送的NAS消息包括远该临近业务中继用户密钥标识，该数据网络名称和远端终端设备的报告信息。移动管理网元接收到之后，移动管理网元还需用临近业务中继用户密钥标识从临近锚点网元获取用户的用户永久标识。然后，将用户永久标识，数据网络名称和远端终端设备的报告信息全部发送给会话管理网元。此时，远端终端设备的报告信息中的UserInfo部分可以设置为任意值。本实施例不对具体的传输方式做限定。
S402，会话管理网元向数据管理网元发送请求消息，该请求消息包括远端终端设备的标识信息和第一信息。对应地，数据管理网元从该会话管理网元接收该请求消息。
示例性地，会话管理网元接收来自移动管理网元的该远端终端设备的标识信息和第一信息之后，向数据管理网元发送请求消息，并在该请求消息中携带该远端终端设备的标识信息和该第一信息。该请求消息用于请求获取第二信息，该第二信息用于判断是否对该远端终端设备进行二次认证。
需要说明的是，会话管理网元获取远端终端设备的标识信息的方法会因为终端设备的标识信息在消息中出现的位置不同而不同。比如，当终端设备的标识信息在远端终端设备的报告信息内时，则可以在远端终端设备的报告信息中获取终端设备的标识信息；若当终端设备的标识信息在远端终端设备的报告信息外时，会话管理网元可以直接获得终端设备 的标识信息。此时，会话管理网元可以不查看远端终端设备的报告信息中的UserInfo。相应地，远端终端设备的报告信息中的UserInfo部分可能被中继终端设备填充任意值。比如，可以是没有实际意义的随机值，再比如填充临近业务中继用户密钥标识。本实施例不限制填充内容和填充方式。
可选地，S403，数据管理网元根据远端终端设备的标识信息和第一信息获取远端终端设备、与数据网络名称对应的会话管理签约数据。
示例性地，数据管理网元接收来自会话管理网元的请求消息之后，根据该请求消息携带的远端终端设备的标识信息和第一信息，确定远端终端设备的用户永久标识和数据网络名称。需要说明的是，如果请求消息中的远端终端设备的标识信息为用户隐藏标识，则数据管理网元通过对该用户隐藏标识进行解密获得用户永久标识；如果请求消息中的远端终端设备的标识信息为临近业务中继用户密钥标识，则数据管理网元根据该临近业务中继用户密钥标识确定用户永久标识，例如，数据管理网元将该临近业务中继用户密钥标识发送给临近业务应用功能网元，以请求与该临近业务中继用户密钥标识对应的用户永久标识，临近业务应用功能网元根据数据管理网元的请求，将该用户永久标识发送给数据管理网元；如果请求消息中的第一信息为中继服务码，则数据管理网元根据该中继服务码确定对应的数据网络名称，例如，数据管理网元根据本地存储的中继服务码与数据网络名称的对应关系确定与该中继服务码对应的数据网络名称；又例如，数据管理网元向其他网元或功能实体(如策略控制网元，或者临近业务应用服务器等)请求与该中继服务码对应的数据网络名称。
需要说明的是，数据管理网元确定远端终端设备的用户永久标识和数据网络名称之后，如果数据管理网元发现存在与该远端终端设备用户永久标识和数据网络名称对应的二次认证结果，则数据管理网元可以不执行S403。
S404，数据管理网元向会话管理网元发送第二信息。对应地，会话管理网元从数据管理网元接收该第二信息。
示例性地，该第二信息包括以下信息中的至少一项：该远端终端设备的、与该数据网络对应的会话管理签约数据，第一指示信息，第二指示信息，其中，该第一指示信息用于指示该远端终端设备是否需要进行二次认证，该第二指示信息用于指示该远端终端设备上一次二次认证是否成功。
在一种可能的实现方式中(记为方式a)，数据管理网元获取到远端终端设备的、与数据网络对应的会话管理签约数据之后，向会话管理网元发送该会话管理签约数据。
在另一种可能的实现方式中(记为方式b)，数据管理网元获取到远端终端设备的、与数据网络对应的会话管理签约数据之后，根据该会话管理签约数据判断是否需要对远端终端设备进行二次认证。然后数据管理网元向会话管理网元发送第一指示信息，以指示是否需要对该远端终端设备进行二次认证。可选地，数据管理网元还可以向会话管理网元发送该会话管理签约数据。
在又一种可能的实现方式中(记为方式c)，如果数据管理网元发现存在与该用户永久标识和数据网络名称对应的的二次认证结果，则数据管理网元根据该二次认证结果向会话管理网元发送第二指示信息，以指示该远端终端设备上一次二次认证是否成功。在这种实现方式中可以不执行S403，也可以执行S403。如果执行了S403，数据管理网元还可以 向会话管理网元发送上述会话管理签约数据和/或第一指示信息。
在又一种可能的实现方式中(记为方式d)，如果数据管理网元发现存在与该用户永久标识和数据网络名称对应的的二次认证结果，则数据管理网元可以根据该远端终端设备对应的上一次二次认证结果，确定是否需要对该远端终端设备进行二次认证。例如，当远端终端设备上一次二次认证成功，则数据管理网元确定不需要对远端终端设备进行二次认证；如果远端终端设备上一次二次认证失败，则数据管理网元确定需要对远端终端设备进行二次认证。在这种情况下，数据管理网元向会话管理网元发送第一指示信息，以指示是否需要对该远端终端设备进行二次认证。在这种实现方式中可以不执行S403，也可以执行S403。如果执行了S403，数据管理网元还可以向会话管理网元发送上述会话管理签约数据和/或第二指示信息。
S405，会话管理网元根据第二信息确定是否对远端终端设备进行二次认证。
示例性地，会话管理网元接收来自数据管理网元的第二信息之后，根据该第二信息，判断是否需要对远端终端设备进行二次认证。下面结合不同示例进行详细说明。
对应于上述方式a，会话管理网元从数据管理网元接收该远端终端设备的、与数据网络对应的会话管理签约数据，然后，会话管理网元根据该会话管理签约数据判断是否需要对该远端终端设备进行二次认证。
对应于上述方式b或d，会话管理网元接收来自数据管理网元的第一指示信息。会话管理网元根据该第一指示信息判断是否需要对该远端终端设备进行二次认证。例如，在第一指示信息指示需要对远端终端设备做二次认证的情况下，则会话管理网元确定对远端终端设备进行二次认证(或者说确定发二次认证流程)。在该第一指示信息指示不需要对远端终端设备进行二次认证的情况下，会话管理网元确定不对远端终端设备进行二次认证(或者说确定不发起二次认证流程)。
对应于上述方式c，会话管理网元接收来自数据管理网元的第二指示信息，会话管理网元根据该第二指示信息确定是否需要对该远端终端设备进行二次认证。例如，在第二指示信息指示远端终端设备上一次二次认证成功的情况下，则会话管理网元确定不需要对远端终端设备进行二次认证；在第二指示信息指示远端终端设备上一次二次认证失败的情况下，则会话管理网元确定对远端终端设备进行二次认证。
在会话管理网元确定对远端终端设备进行二次认证的情况下，该会话管理网元触发对该远端终端设备的二次认证流程。
通过上述方案，会话管理网元可以判断临近业务场景下的远端终端设备是否需要进行二次认证。
图5示出了本申请实施例提供的方法500的示例性流程图。在方法500中，Remote UE在直连安全模式完成消息中向Relay UE发送新生成的SUCI(即SUCI#2)，然后Relay UE获取该Relay UE对应的DNN，然后将该DNN和该SUCI#2发送给SMF，以便SMF向UDM获取用于判断是否进行二次认证的参数信息。下面结合图5中的各个步骤对方法500作示例性说明。
应理解，S501-S511与方法200中的S201-S219类似，其中，S509对应于方法200中的S209-S214，S510对应于方法200中的S215b，方法200中的S215a、S216-S218对应的步骤在方法500中已省略，具体过程可参考方法300部分的描述，这里不再重复说明。
还应理解，为了方便说明，将Remote UE在S504中的直连通信请求消息中携带的SUCI记为SUCI#1。
S512，Remote UE生成SUCI#2。
示例性地，Remote UE在接收到来自Relay UE的直连安全模式命令(Direct Security Mode Command)消息(即S511)之后，生成SUCI#2，或者说，Remote UE在向Relay UE回复直连安全模式完成(Direct Security Mode Complete)消息之前，生成SUCI#2。该SUCI#2是Remote UE根据SUPI生成的，具体方式本申请不作限定。
S513，Remote UE向Relay UE发送直连安全模式完成消息。对应地，Relay UE接收来自Remote UE的该直连安全模式完成消息、
示例性地，Remote UE生成SUCI#2之后，向Relay UE发送该直连安全模式完成消息，并在该直连安全模式完成消息中携带该SUCI#2。
S514，Relay UE向Remote UE发送直连通信接受(Direct communication Accept)消息。对应地，Remote UE接收来自Remote UE的该直连通信接受消息。
S515，Relay UE通过AMF向SMF发送Remote UE报告(Remote UE Report)。对应地，SMF通过AMF接收来自Relay UE的该Remote UE报告。
示例性地，该Remote UE报告中包括SUCI#2，或者说，该Remote UE Report中的Remote User ID字段填充了SUCI#2。
Relay UE还向AMF发送Remote UE对应的DNN。其中，该DNN可以是Relay UE在S515之前的任意时刻从Remote UE获得的，例如，Remote UE在S504或者S513中携带Remote UE对应的DNN，Relay UE接收并保存该DNN；或者，该DNN还可以是Relay UE根据RSC确定的，例如，在S515之前，Relay UE根据与RemoteUE建立连接时使用的RSC对应的PDU会话参数确定DNN信息。当RSC对应的PDU会话的参数包括DNN的时候，Relay UE可以直接从该PDU会话参数获取DNN。如果PDU会话参数不包括DNN，则RelayUE可以根据PDU会话参数确定出DNN信息。比如，当PDU会话参数不包括DNN，但是包括S-NSSAI的信息的时候，RelayUE可以根据S-NSSAI获得DNN。可选地，还可以包括S-NSSI。应理解，当S-NSSAI是一个确定二次认证是否需要的必要参数的时候，并且没有办法从其他位置获取的时候，那么该PDU会话参数必须包括S-NSSAI。
需要说明的是，DNN可以携带在Remote UE报告中(即作为Remote UE的一部分)，也可以不携带在Remote UE报告中(即作为单独的信元)，本申请不作限定。
S516，SMF向UDM发送UE二次认证请求(UE Secondary authentication request)消息。对应地，UDM接收来自SMF的该UE二次认证请求消息。
示例性地，该二次认证请求消息用于向UDM请求二次认证相关参数，这里的二次认证相关参数可以理解为用于判断是否对Remote UE进行二次认证的参数。该二次认证请求消息还可以叫做其他名称，例如该二次认证请求消息还可以称作签约信息请求消息，本申请对此不作限定。该二次认证请求消息中包括SUCI#2和DNN。
S517，UDM获取Remote UE的、与DN对应的SM签约数据。
示例性地，UDM接收到来自SMF的二次认证请求消息之后，根据该二次认证请求消息中携带的SUCI#2和DNN，获取Remote UE的、与DN对应的SM签约数据。
S518，UDM向SMF发送UE二次认证响应(UE Secondary authentication response)消息。对应地，SMF接收来自UDM的该UE二次认证响应消息。该二次认证响应消息用于将确定的二次认证相关参数发送给SMF。本实施例不限制消息名字。
示例性地，该二次认证相关参数包括以下一项或多项：Remote UE的、与DN对应的SM签约数据，第一指示信息，第二指示信息。其中，该第一指示信息用于指示该Remote UE是否需要进行二次认证；该第二指示信息用于指示该Remote UE上一次二次认证是否成功，或者说，该第二指示信息用于指示该Remote UE上一次二次认证的结果，该第二指示信息也可以称作二次认证结果(secondary result)。下面结合不同示例进行详细说明。
在第一种可能的实现方式中，UDM获取到Remote UE的、与DN对应的SM签约数据之后，向SMF发送UE二次认证响应消息，并在该UE二次认证响应消息中携带该SM签约数据。
在第二种可能的实现方式中，UDM获取到Remote UE的、与DN对应的SM签约数据之后，根据该SM签约数据判断是否需要对Remote UE进行二次认证。然后UDM向SMF发送UE二次认证响应消息，并在该UE二次认证响应消息中携带第一指示信息以指示是否需要对该Remote UE进行二次认证。可选地，该UE二次认证响应消息中还可以携带该SM签约数据。
在第三种可能的实现方式中，如果UDM发现存在与该Remote UE的该DNN的二次认证结果，则UDM根据该二次认证结果向SMF发送UE二次认证响应消息，并在该UE二次认证响应消息中携带第二指示信息以指示该Remote UE上一次二次认证是否成功。可选地，该UE二次认证响应消息中还可以携带该SM签约数据和/或第一指示信息。
在第四种可能的实现方式中，如果UDM发现存在与该Remote UE的该DNN对应的二次认证结果，则UDM可以根据上一次二次认证结果，确定是否需要对该Remote UE进行二次认证。例如，当Remote UE上一次二次认证成功，则UDM确定不需要对Remote UE进行二次认证；如果Remote UE上一次二次认证失败，则UDM确定需要对Remote UE进行二次认证。在这种情况下，UDM向SMF发送UE二次认证响应消息，并在该UE二次认证响应消息中携带第一指示信息以指示是否需要对该Remote UE进行二次认证。可选地，该UE二次认证响应消息中还可以携带该SM签约数据和/或第二指示信息。
S519，SMF确定是否需要对Remote UE进行二次认证。
示例性地，SMF接收来自UDM的UE二次认证响应消息之后，根据该UE二次认证响应消息中携带的信息，判断是否需要对Remote UE进行二次认证。下面结合不同示例进行详细说明。
对应于上述第一种可能的实现方式，SMF接收来自UDM的UE的二次认证响应消息，该二次认证响应消息中包括该Remote UE的、与DN对应的SM签约数据，然后，SMF根据该SM签约数据判断是否需要对该Remote UE进行二次认证。
对应于上述第二种或第四种可能的实现方式，SMF接收来自UDM的UE二次认证响应消息，该二次认证响应消息中包括第一指示信息。SMF根据该第一指示信息判断是否需要对该Remote UE进行二次认证。例如，在第一指示信息指示需要对Remote UE做二次认证的情况下，则SMF确定发起二次认证流程。在该第一指示信息指示不需要对RemoteUE进行二次认证的情况下，SMF确定不发起二次认证流程。
对应于上述第三种可能的实现方式，SMF接收来自UDM的UE二次认证请求响应，该二次认证响应消息中包括第二指示信息，SMF根据该第二指示信息确定是否需要对该Remote UE进行二次认证。例如，在第二指示信息指示Remote UE上一次二次认证成功的情况下，则SMF确定不需要对Remote UE进行二次认证；在第二指示信息指示Remote UE上一次二次认证失败的情况下，则SMF确定需要(或者是不需要)对Remote UE进行二次认证。可选地，如果该UE二次认证请求消息中还携带有该Remote UE的、与DN对应的SM签约数据，或者第一指示信息，则SMF也可以结合这些信息确定是否需要对该Remote UE进行二次认证。
S520，SMF向Relay UE发送PDU会话认证命令消息。该PDU会话认证命令消息用于开始对RemoteUE做二次认证。
S521，执行对Remote UE的二次认证流程。
示例性地，如果SMF确定需要对Remote UE进行二次认证，则SMF向Relay UE发送PDU会话认证命令消息，以触发对Remote UE的二次认证流程，具体过程可参考方法400中的S311-S320，这里不再赘述。
需要说明的是，上述方案是以Relay UE在S515向AMF提供SUCI#2和DNN为例进行说明的，但在另一种实现方式中，还可以将该DNN替换为RSC。也就是说，Relay UE在S515向SMF发送Remote UE报告，该Remote UE报告中包括SUCI#2和RSC。该RSC也可以在RemoteUE报告外。该RSC可以是Relay UE在S503的发现(Discovery)流程中获取的，也可以是在S504获取的，还可以是S513获取的(这种情况下Remote UE需要在S513携带RSC)，本申请不作限定。在这种实现方式中，SMF在S516的二次认证请求消息中携带SUCI#2和RSC，UDM接收到该二次认证请求消息之后，根据该RSC确定DNN，UDM可以根据本地存储的RSC与DNN的对应关系确定DNN，或者向其他网元或功能实体请求RSC对应的DNN，比如向PCF或ProseApplicationServer请求。进一步地，UDM根据SUPI和DNN确定Remote UE的、与Remote UE的DN对应的SM签约数据。后续方案与上述示例类似，不再赘述。
还需要说明的是，上述方案是以SUCI#2作为Remote UE的标识为例进行说明的，但在另一种实现方式中，还可以将该SUCI#2替换为5G PRUK ID，也就是说，可以将上述方案中的S513-S516中的SUCI#2替换为5G PRUK ID，但是，5GPRUKID可以携带在Remote UE报告外，即不改变RemoteUE报告的内容。在这种实现方式中，Remote UE可以不执行S512。另外，UDM从SMF接收到二次认证请求消息后，根据该5G PRUK ID确定Remote UE的SUPI。例如，UDM向PrAF发送请求消息，该请求消息包括该5G PRUK ID该请求消息用于请求获取该5G PRUK ID对应的SUPI。PrAF根据UDM的请求向UDM返回SUPI。进一步地，UDM根据SUPI和DNN确定Remote UE的、与Remote UE的DN对应的SM签约数据。后续方案与上述示例类似，不再赘述。还需要说明的是，上述方案是以SMF接收来自Relay UE的SUCI#2和DNN为例进行说明的，但在另一种实现方式中，SMF还可能从其他网元或设备接收到上述信息。例如，SMF在S515之前，SMF从AUSF或AMF接收到Remote UE对应的DNN，SMF可以预先保存该DNN，在S515接收到SUCI#2之后，通过该DNN和该SUCI#2向UDM请求获取用于判断是否进行二次认证的二次认证参数。或者，SMF在S515之前，预先从AUSF或AMF接收到了Remote UE 的SUPI和DNN，SMF接收到Remote UE报告之后，通过该DNN和该SUPI向UDM请求获取用于判断是否进行二次认证的二次认证参数。
还需要说明的是，上述方案是以SMF同时接收到SUCI#2和DNN(或者是SUCI#2和RSC)为例进行说明的，但在另一种实现方式中，SMF也可能在不同时机接收到SUCI#2和DNN(或者是SUCI#2和RSC)，本申请不作限定。
图6示出了本申请实施例提供的方法600的示例性流程图。在方法600中，AMF预先保存TID和SUPI之间的对应关系，Relay UE向AMF提供TID和DNN之后，AMF根据TID以及该对应关系确定SUPI，然后AMF将该SUPI和该DNN发送给SMF，以便SMF向UDM获取用于判断是否进行二次认证的参数信息。下面结合图6中的各个步骤对方法600作示例性说明。
应理解，S601-S609、S611-S614与方法200中的S201-S222类似，其中，S609对应于方法200中的S209-S214，方法200中的S215a、S216-S218、S220对应的步骤在方法600中已省略，具体过程可参考方法200部分的描述，这里不再重复说明。
S610，AMF保存TID和SUPI之间的对应关系。
示例性地，AMF接收Remote UE的SUPI，并保存该SUPI和传输标识(transaction identifier，TID)之间的对应关系，其中，该TID可以是Relay UE分配并在S605发送给AMF的，该TID用于在Relay UE和AMF之间唯一标识与该Remote UE对应的连接；该SUPI可以是AUSF通过发送给AMF的，例如，AUSF从UDM获取Remote UE对应的SUPI(例如在S608UDM向AUSF发送Remote UE的SUPI)，然后AUSF将该Remote UE的SUPI发送给AMF(例如在S609将该Remote UE的SUPI发送给AMF)，AMF接收到Remote UE的SUPI之后，保存该SUPI和TID之间的对应关系。
S611-S614与方法300中的S315b、S319、S321-S322类似，这里不再赘述。
S615，Relay UE向AMF发送TID、DNN和Remote UE报告。对应的，AMF接收来自Relay UE的该TID、DNN和该Remote UE报告。
示例性地，Relay UE向AMF发送该TID和该Remote UE报告(Remote UE Report)，承载该TID和该Remote UE报告的消息的格式可以是NAS消息，也可以是其他格式，例如可以是：TID，NAS message(SM container(Remote UE report(remote user ID，IP info)))，或者NAS message(TID，SM container(Remote UE report(remote user ID，IP info)))。即，该TID可以在NAS消息内，也可以在该NAS消息外，本申请不作限定。
RelayUE还向AMF发送Remote UE对应的DNN，该DNN可以携带在Remote UE Report内部，此时消息的格式可以为：NAS message(TID，SM container(Remote UE report(remote user ID，IP info，DNN)))。或者，该DNN也可以携带在Remote UE Report外部，此时消息的格式可以为：NAS message(TID，DNN，SM container(Remote UE report(remote user ID，IP info)))，或者NAS message(TID，SM container(DNN，Remote UE report(remote user ID，IP info)))。
S616，AMF根据TID确定SUPI。
示例性地，AMF接收到来自Relay UE的TID和Remote UE报告之后，根据该TID，以及预先保存的TID和SUPI之间的对应关系，确定该SUPI。
S617，AMF向SMF发送SUPI和Remote UE报告。对应地，SMF从AMF接收该SUPI 和该Remote UE报告。
示例性地，AMF确定SUPI之后，向SMF发送Remote UE报告以及该SUPI。应理解，如果DNN没有携带在Remote UE Report内部，则AMF还向SMF发送DNN。
S618，SMF向UDM发送UE二次认证请求(UE Secondary authentication request)消息。对应地，UDM接收来自SMF的该UE二次认证请求消息。
示例性地，该UE二次认证请求消息包括Remote UE的SUPI，以及DNN。
S619，UDM获取Remote UE的、与DN对应的SM签约数据。
示例性地，UDM接收来自SMF的UE二次认证请求消息之后，根据SUPI和UE对应的DNN，获取Remote UE的、与Remote UE的DN对应的SM签约数据。具体实现方式与方法500中的S517类似，这里不再赘述。不过需要说明的是，方法500中的S517中，UDM需要根据UE二次认证请求消息中携带的SUCI#2确定SUPI，而S619中，UDM可以直接从UE二次认证请求消息中获取SUPI。
S620-S623与方法500中的S518-S521类似，这里不再赘述。
需要说明的是，上述方案是以Relay UE在S615向AMF提供TID和DNN为例进行说明的，但是在另一种实现方式中，还可以将该DNN替换为RSC，也就是说，Relay UE在S615向AMF提供TID和RSC。例如，Relay UE在S615向AMF发送TID和Remote UE报告。该Remote UE报告中可以包括RSC(应理解，RSC也可以携带在Remote UE报告外面，这里不做限定)。然后AMF在S616根据TID确定SUPI后，在S617向SMF发送SUPI和Remote UE报告，该Remote UE报告中包括RSC。UDM可以根据本地存储的RSC与DNN的对应关系确定DNN，或者向其他网元或功能实体请求RSC对应的DNN，然后根据该DNN和该SUPI获取Remote UE的与DN对应的SM签约数据。后续方案与上述示例类似，不再赘述。
需要说明的是，上述方案是以SMF在S618向UDM提供SUPI和RSC为例进行说明的，但是在又一种实现方式中，SMF也可以根据RSC确定Remote UE对应的DNN，然后在S618向UDM提供SUPI和DNN，UDM可以直接根据SUPI和DNN获取Remote UE的与DN对应的SM签约数据。
需要说明的是，上述方案是以Relay UE在S615向AMF提供TID和DNN为例进行说明的，但是在另一种实现方式中，还可以将该TID替换为5GPRUKID，或者额外的再携带5GPRUKID。也就是说，Relay UE在S615向AMF至少提供5GPRUKID和DNN。此时步骤S610可以不执行。例如，Relay UE在S615向AMF发送5GPRUKID、DNN和Remote UE报告。该5GPRUKID、DNN可以部分或全部在RemoteUE报告中，也可以都不在RemoteUE报告中。然后AMF还需要使用5GPRUKID向PrAF请求SUPI，以获得RemoteUE的SUPI。在S617向SMF发送SUPI、DNN和Remote UE报告。后续方案与上述示例类似，不再赘述。
图7示出了本申请实施例提供的方法700的示例性流程图。在方法700中，AMF预先保存TID、SUPI和DNN之间的对应关系，Relay UE向AMF提供TID之后，AMF根据TID以及该对应关系确定SUPI和DNN，然后AMF将该SUPI和该DNN发送给SMF，以便SMF向UDM获取用于判断是否进行二次认证的参数信息。下面结合图7中的各个步骤对方法700作示例性说明。
应理解，S701-S709、S711-S714与方法200中的S201-S222类似，其中，S709对应于方法200中的S209-S214，方法200中的S215a、S216-S218、S220对应的步骤在方法700中已省略，具体过程可参考方法200部分的描述，这里不再重复说明。
S710，AMF保存TID、SUPI、DNN之间的对应关系。
示例性地，AMF获取Remote UE的SUPI和Remote UE对应的DNN，然后保存该SUPI、DNN、TID之间的对应关系，其中，该TID可以是Relay UE分配并在S705发送给AMF的；该SUPI可以是AUSF通过发送给AMF的，例如，AUSF从UDM获取Remote UE对应的SUPI(例如在S708UDM向AUSF发送Remote UE的SUPI)，然后AUSF将该Remote UE的SUPI发送给AMF(例如在S709将该Remote UE的SUPI发送给AMF)；该DNN可以是Remote UE发送给Relay UE(例如Remote UE在S704将DNN发送给Relay UE)，然后由Relay UE发送给AMF的(例如Relay UE在S705将DNN发送给AMF)，也可以是AMF根据RSC获得的。例如，AMF根据Remote UE对应的RSC以及本地配置的RSC与DNN的对应关系确定Remote UE对应的DNN；又例如，AMF通过Remote UE对应的RSC向其他网元或功能实体请求RSC对应的DNN。AMF获取到该DNN、SUPI和TID之后，保存TID、SUPI、DNN之间的对应关系。
S711-S714与方法300中的S315b、S319、S321-S322类似，这里不再赘述。
S715，Relay UE向AMF发送TID和Remote UE报告。对应的，AMF接收来自Relay UE的该TID和该Remote UE报告。
示例性地，Relay UE生成Remote UE报告之后，将该Remote UE报告以及Remote UE对应的TID发送给AMF。承载该TID和该Remote UE报告的NAS消息的格式可以是NAS消息，也可以是其他格式，例如可以是：TID，NAS message(SM container(Remote UE report(remote user ID，IP info)))，或者NAS message(TID，SM container(Remote UE report(remote user ID，IP info)))。即，该TID可以在NAS消息内，也可以在该NAS消息外，本申请不作限定。
S716，AMF根据TID确定SUPI和DNN。
示例性地，AMF从Relay UE接收Remote UE对应的TID之后，根据该TID以及S710保存的对应关系，确定与该TID对应的SUPI和DNN。
S717，AMF向SMF发送SUPI、DNN和Remote UE报告。对应地，SMF从AMF接收该SUPI、该DNN和该Remote UE报告。
示例性地，AMF确定SUPI和DNN之后，向SMF发送该SUPI、该DNN和Remote UE报告。
S718-S723与方法600中的S618-S623类似，这里不再赘述。
需要说明的是，上述方案是以AMF在S710保存TID、SUPI、DNN之间的对应关系为例进行说明的，但是在另一种实现方式中，还可以将该DNN替换为RSC，也就是说，AMF在S710保存TID、SUPI、RSC之间的对应关系。在这种实现方式中，AMF在S716根据TID确定SUPI和RSC，然后在S717向SMF发送SUPI、RSC和Remote UE报告。SMF在S718携带SUPI和RSC，UDM根据RSC确定DNN，然后根据该DNN和该SUPI获取Remote UE的与DN对应的SM签约数据。后续方案与上述示例类似，不再赘述。
相应于上述各方法实施例给出的方法，本申请实施例还提供了相应的装置，该装置包 括用于执行上述各个方法实施例相应的模块。该模块可以是软件，也可以是硬件，或者是软件和硬件结合。可以理解的是，上述各方法实施例所描述的技术特征同样适用于以下装置实施例，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
图8是本申请实施例提供的通信装置10的示意性框图。该装置10包括收发模块11和处理模块12。收发模块11可以实现相应的通信功能，处理模块12用于进行数据处理，或者说该收发模块11用于执行接收和发送相关的操作，该处理模块12用于执行除了接收和发送以外的其他操作。收发模块11还可以称为通信接口或通信单元。
可选地，该装置10还可以包括存储模块13，该存储模块13可以用于存储指令和/或数据，处理模块12可以读取存储模块中的指令和/或数据，以使得装置实现前述各个方法实施例中设备或网元的动作。
在第一种设计中，该装置10可对应于上文方法实施例中的移动管理网元(如方法400中的移动管理网元，或者是方法500至方法700中的AMF)，或者是移动管理网元的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的移动管理网元执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中移动管理网元的收发相关的操作，处理模块12可用于执行上文方法实施例中移动移动管理网元的处理相关的操作。
在一种可能的实现方式，收发模块11，用于从中继终端设备接收远端终端设备的传输标识，以及该远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网络的名称；处理模块12，用于根据该传输标识，确定该远端终端设备的用户永久标识；收发模块11，还用于向会话管理网元发送该用户永久标识和该报告信息。
在第二种设计中，该装置10可对应于上文方法实施例中的会话管理网元(如方法400中的会话管理网元，或者是方法500-方法700中的SMF)，或者是会话管理网元的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的会话管理网元执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中终端设备的收发相关的操作，处理模块12可用于执行上文方法实施例中终端设备的处理相关的操作。
一种可能的实现方式，收发模块11，用于从移动管理网元接收远端终端设备的报告信息，以及该远端终端设备的用户永久标识，该报告信息包括该远端终端设备对应的数据网络的名称；向数据管理网元发送请求消息，该请求消息包括该用户永久标识和该数据网络的名称；从该数据管理网元接收第二信息，该第二信息用于确定是否对该远端终端设备进行二次认证；处理模块12，用于根据该第二信息，确定是否对该远端终端设备进行二次认证。
另一种可能的实现方式，收发模块11，用于从移动管理网元接收远端终端设备的报告信息，所述报告信息包括所述远端终端设备的用户隐藏标识和所述远端终端设备对应的数据网络的名称；向数据管理网元发送请求消息，所述请求消息包括所述用户隐藏标识和所述数据网络的名称；从所述数据管理网元接收第二信息，所述第二信息用于确定是否对所述远端终端设备进行二次认证；处理模块12，用于根据所述第二信息，确定是否对所述远端终端设备进行二次认证。
第三种设计中，该装置10可对应于上文方法实施例中的中继终端设备(如方法400 中的中继终端设备，或者是方法500-方法700中的Relay UE)，或者是中继终端设备的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的中继终端设备执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中的中继终端设备的收发相关的操作，处理模块12可用于执行上文方法实施例中终端设备的处理相关的操作。
一种可能的实现方式，处理模块12，用于生成远端终端设备的报告信息，该报告信息包括该远端终端设备对应的数据网路的名称；收发模块11，用于向移动管理网元发送该远端终端设备对应的传输标识，以及该报告信息。
另一种可能的实现方式，收发模块11，用于从远端终端设备接收所述远端终端设备的用户隐藏标识；处理模块12，用于生成所述远端终端设备的报告信息，所述报告信息包括所述用户隐藏标识和所述远端终端设备对应的数据网络的名称；收发模块11，还用于向移动管理网元发送所述远端终端设备的报告信息。
第四种设计中，该装置10可对应于上文方法实施例中的远端终端设备(如方法400中的远端终端设备，或者是方法500-方法700中的Remote UE)，或者是远端终端设备的组成部件(如芯片)。
该装置10可实现对应于上文方法实施例中的远端终端设备执行的步骤或者流程，其中，收发模块11可用于执行上文方法实施例中的远端终端设备的收发相关的操作，处理模块12可用于执行上文方法实施例中远端终端设备的处理相关的操作。
一种可能的实现方式，收发模块11，用于从中继终端设备接收直连安全模式命令消息；处理模块12，用于生成该远端终端设备的用户隐藏标识；收发模块11，还用于向该中继终端设备发送直连安全模式完成消息，该直连安全模式完成消息包括该远端终端设备的标识信息。
应理解，各模块执行上述相应步骤的具体过程在上述各方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，这里的装置10以功能模块的形式体现。这里的术语“模块”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置10可以具体为上述实施例中的移动管理网元，可以用于执行上述各方法实施例中与移动管理网元对应的各个流程和/或步骤；或者，装置10可以具体为上述实施例中的终端设备，可以用于执行上述各方法实施例中与终端设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
上述各个方案的装置10具有实现上述方法中的设备(如移动管理网元，或会话管理网元，或中继终端设备，或远端终端设备)所执行的相应步骤的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块；例如收发模块可以由收发机替代(例如，收发模块中的发送单元可以由发送机替代，收发模块中的接收单元可以由接收机替代)，其它单元，如处理模块等可以由处理器替代，分别执行各个方法实施例中的收发操作以及相关的处理操作。
此外，上述收发模块11还可以是收发电路(例如可以包括接收电路和发送电路)， 处理模块可以是处理电路。
图9是本申请实施例提供另一种通信装置20的示意图。该装置20包括处理器21，处理器21用于执行存储器22存储的计算机程序或指令，或读取存储器22存储的数据/信令，以执行上文各方法实施例中的方法。可选地，处理器21为一个或多个。
可选地，如图9所示，该装置20还包括存储器22，存储器22用于存储计算机程序或指令和/或数据。该存储器22可以与处理器21集成在一起，或者也可以分离设置。可选地，存储器22为一个或多个。
可选地，如图9所示，该装置20还包括收发器23，收发器23用于信号的接收和/或发送。例如，处理器21用于控制收发器23进行信号的接收和/或发送。
作为一种方案，该装置20用于实现上文各个方法实施例中由移动管理网元执行的操作。
例如，处理器21用于执行存储器22存储的计算机程序或指令，以实现上文各个方法实施例中移动管理网元的相关操作，例如，处理器21执行存储器22存储的计算机程序或执行，可以实现图4中的移动管理网元执行的方法，或者用于指示图5至图7中AMF执行的方法。
作为另一种方案，该装置20用于实现上文各个方法实施例中由会话管理网元执行的操作。
例如，处理器21用于执行存储器22存储的计算机程序或指令，以实现上文各个方法实施例中会话管理网元的相关操作。例如，处理器21执行存储器22存储的计算机程序或执行，可以实现图4中的会话管理网元执行的方法，或者用于指示图5至图7中SMF执行的方法。
作为另一种方案，该装置20用于实现上文各个方法实施例中由中继终端设备执行的操作。
例如，处理器21用于执行存储器22存储的计算机程序或指令，以实现上文各个方法实施例中中继终端设备的相关操作。例如，处理器21执行存储器22存储的计算机程序或执行，可以实现图4中的中继终端设备执行的方法，或者用于指示图5至图7中Relay UE执行的方法。
作为另一种方案，该装置20用于实现上文各个方法实施例中由远端终端设备执行的操作。
例如，处理器21用于执行存储器22存储的计算机程序或指令，以实现上文各个方法实施例中远端终端设备的相关操作。例如，处理器21执行存储器22存储的计算机程序或执行，可以实现图4中的远端终端设备执行的方法，或者用于指示图5至图7中Remote UE执行的方法。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器和/或非易失性存储器。 其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
图10是本申请实施例提供一种芯片系统30的示意图。该芯片系统30(或者也可以称为处理系统)包括逻辑电路31以及输入/输出接口(input/output interface)32。
其中，逻辑电路31可以为芯片系统30中的处理电路。逻辑电路31可以耦合连接存储单元，调用存储单元中的指令，使得芯片系统30可以实现本申请各实施例的方法和功能。输入/输出接口32，可以为芯片系统30中的输入输出电路，将芯片系统30处理好的信息输出，或将待处理的数据或信令信息输入芯片系统30进行处理。
作为另一种方案，该芯片系统30用于实现上文各个方法实施例中由移动管理网元(如图4中的移动管理网元，或图5-图7中的AMF)执行的操作。
例如，逻辑电路31用于实现上文方法实施例中由移动管理网元执行的处理相关的操作，如，图4所示实施例中的移动管理网元执行的处理相关的操作，或图5至图7中任意一个所示实施例中的AMF执行的处理相关的操作；输入/输出接口32用于实现上文方法实施例中由移动管理网元执行的发送和/或接收相关的操作，如，图4所示实施例中的移动管理网元执行的发送和/或接收相关的操作，或图5至图7中任意一个所示实施例中的AMF执行的发送和/或接收相关的操作。
作为另一种方案，该芯片系统30用于实现上文各个方法实施例中由会话管理网元(如图4中的会话管理网元，或图5-图7中的SMF)执行的操作。
例如，逻辑电路31用于实现上文方法实施例中由移动管理网元执行的处理相关的操作，如，图4所示实施例中的会话管理网元执行的处理相关的操作，或图5至图7中任意一个所示实施例中的SMF执行的处理相关的操作；输入/输出接口32用于实现上文方法实施例中由会话管理网元执行的发送和/或接收相关的操作，如，图4所示实施例中的会话管理网元执行的发送和/或接收相关的操作，或图5至图7中任意一个所示实施例中的SMF执行的发送和/或接收相关的操作。
作为另一种方案，该芯片系统30用于实现上文各个方法实施例中由中继终端设备(如图4中的中继终端设备，或图5-图7中的Relay UE)执行的操作。
例如，逻辑电路31用于实现上文方法实施例中由中继终端设备执行的处理相关的操作，如，图4所示实施例中的中继终端设备执行的处理相关的操作，或图5至图7中任意一个所示实施例中的Relay UE执行的处理相关的操作；输入/输出接口32用于实现上文方法实施例中由中继终端设备执行的发送和/或接收相关的操作，如，图4所示实施例中的中继终端设备执行的发送和/或接收相关的操作，或图5至图7中任意一个所示实施例中的Relay UE执行的发送和/或接收相关的操作。
作为另一种方案，该芯片系统30用于实现上文各个方法实施例中由移动管理网元(如图4中的远端终端设备，或图5-图7中的Remote UE)执行的操作。
例如，逻辑电路31用于实现上文方法实施例中由远端终端设备执行的处理相关的操作，如，图4所示实施例中的远端终端设备执行的处理相关的操作，或图5至图7中任意一个所示实施例中的Remote UE执行的处理相关的操作；输入/输出接口32用于实现上文方法实施例中由远端终端设备执行的发送和/或接收相关的操作，如，图4所示实施例中的远端终端设备执行的发送和/或接收相关的操作，或图5至图7中任意一个所示实施例中的Remote UE执行的发送和/或接收相关的操作。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述各方法实施例中由设备执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法各实施例中由移动管理网元执行的方法。
又如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法各实施例中由终端设备执行的方法。
本申请实施例还提供一种计算机程序产品，包含指令，该指令被计算机执行时以实现上述各方法实施例中由设备(如移动管理网元，又如终端设备设备)执行的方法。
本申请实施例还提供一种通信的系统，包括前述的移动管理网元和会话管理网元。可选地，该系统中还包括与上述远端终端设备和/或中继终端设备通信的设备。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，所述计算机可以是个人计算机，服务器，或者网络设备等。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站 站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD)等。例如，前述的可用介质包括但不限于：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (42)

  1. 一种通信方法，其特征在于，包括：
    移动管理网元从中继终端设备接收远端终端设备的传输标识，以及所述远端终端设备的报告信息，所述报告信息包括所述远端终端设备对应的数据网络的名称；
    所述移动管理网元根据所述传输标识，确定所述远端终端设备的用户永久标识；
    所述移动管理网元向会话管理网元发送所述用户永久标识和所述报告信息。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述移动管理网元从鉴权服务器功能网元接收所述远端终端设备的用户永久标识；
    所述移动管理网元保存所述用户永久标识和所述传输标识之间的对应关系；
    其中，所述移动管理网元根据所述传输标识，确定所述远端终端设备的用户永久标识，包括：
    所述移动管理网元根据所述传输标识和所述对应关系，确定所述用户永久标识。
  3. 根据权利要求1或2所述的方法，其特征在于，所述移动管理网元向会话管理网元发送所述用户永久标识和所述报告信息之后，所述方法还包括：
    所述移动管理网元接收来自所述会话管理网元的认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述移动管理网元向所述中继终端设备发送所述认证命令消息。
  4. 一种通信方法，其特征在于，包括：
    会话管理网元从移动管理网元接收远端终端设备的报告信息，以及所述远端终端设备的用户永久标识，所述报告信息包括所述远端终端设备对应的数据网络的名称；
    所述会话管理网元向数据管理网元发送请求消息，所述请求消息包括所述用户永久标识和所述数据网络的名称；
    所述会话管理网元从所述数据管理网元接收信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元根据所述信息，确定是否对所述远端终端设备进行二次认证。
  5. 根据权利要求4所述的方法，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  6. 一种通信方法，其特征在于，包括：
    中继终端设备生成远端终端设备的报告信息，所述报告信息包括所述远端终端设备对应的数据网路的名称；
    所述中继终端设备向移动管理网元发送所述远端终端设备对应的传输标识，以及所述报告信息。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述中继终端设备根据所述远端终端设备对应的中继服务码确定所述数据网络的名 称。
  8. 根据权利要求6或7所述的方法，其特征在于，在所述中继终端设备向移动管理网元发送所述远端终端设备对应的传输标识之后，所述方法还包括：
    所述中继终端设备从所述移动管理网元接收认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述中继终端设备根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述中继终端设备向所述移动管理网元发送所述身份信息。
  9. 一种通信方法，其特征在于，包括：
    会话管理网元从移动管理网元接收远端终端设备的报告信息，所述报告信息包括所述远端终端设备的用户隐藏标识和所述远端终端设备对应的数据网络的名称；
    所述会话管理网元向数据管理网元发送请求消息，所述请求消息包括所述用户隐藏标识和所述数据网络的名称；
    所述会话管理网元从所述数据管理网元接收信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元根据所述信息，确定是否对所述远端终端设备进行二次认证。
  10. 根据权利要求9所述的方法，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  11. 一种通信方法，其特征在于，包括：
    中继终端设备从远端终端设备接收所述远端终端设备的用户隐藏标识；
    所述中继终端设备生成所述远端终端设备的报告信息，所述报告信息包括所述用户隐藏标识和所述远端终端设备对应的数据网络的名称；
    所述中继终端设备向移动管理网元发送所述远端终端设备的报告信息。
  12. 根据权利要求11所述的方法，其特征在，所述方法还包括：
    所述中继终端设备根据所述远端终端设备的传输标识确定所述数据网络的名称。
  13. 根据权利要求11或12所述的方法，其特征在于，在所述中继终端设备向移动管理网元发送所述远端终端设备的报告信息之后，所述方法还包括：
    所述中继终端设备从所述移动管理网元接收认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述中继终端设备根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述中继终端设备向所述移动管理网元发送所述身份信息。
  14. 一种通信方法，其特征在于，包括：
    移动管理网元从中继终端设备接收远端终端设备的传输标识，以及所述远端终端设备的报告信息，所述报告信息包括所述远端终端设备对应的数据网路的名称；
    所述移动管理网元根据所述传输标识，确定所述远端终端设备的用户永久标识；
    所述移动管理网元向会话管理网元发送所述用户永久标识和所述报告信息；
    所述会话管理网元从所述移动管理网元接收远端终端设备的报告信息，以及所述远端终端设备的用户永久标识；
    所述会话管理网元向数据管理网元发送请求消息，所述请求消息包括所述用户永久标识和所述数据网络的名称；
    所述数据管理网元从所述会话管理网元接收所述请求消息；
    所述数据管理网元向所述会话管理网元发送信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元从所述数据管理网元接收所述信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元根据所述信息，确定是否对所述远端终端设备进行二次认证。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    鉴权服务器功能网元向所述移动管理网元发送所述远端终端设备的用户永久标识；
    所述移动管理网元从所述鉴权服务器功能网元接收所述远端终端设备的用户永久标识；
    所述移动管理网元保存所述用户永久标识和所述传输标识之间的对应关系；
    其中，所述移动管理网元根据所述传输标识，确定所述远端终端设备的用户永久标识，包括：
    所述移动管理网元根据所述传输标识和所述对应关系，确定所述用户永久标识。
  16. 根据权利要求14或15所述的方法，其特征在于，在所述移动管理网元向会话管理网元发送所述用户永久标识和所述报告信息之后，所述方法还包括：
    所述会话管理网元向所述移动管理网元发送认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述移动管理网元接收来自所述会话管理网元的所述认证命令消息；
    所述移动管理网元向所述中继终端设备发送所述认证命令消息；
    所述中继终端设备接收来自所述移动管理网元的所述认证命令消息；
    所述中继终端设备根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述中继终端设备向所述移动管理网元发送所述身份信息；
    所述移动管理网元接收来自所述中继终端设备的所述身份信息。
  17. 根据权利要求14至16中任一项所述的方法，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  18. 根据权利要求14至17中任一项所述的方法，其特征在于，所述方法还包括：
    所述中继终端设备生成所述远端终端设备的报告信息；
    所述中继终端设备向所述移动管理网元发送所述远端终端设备对应的传输标识，以及所述报告信息。
  19. 根据权利要求14至18中任一项所述的方法，其特征在于，所述方法还包括：
    所述中继终端设备根据所述远端终端设备对应的中继服务码确定所述数据网络的名称。
  20. 一种通信方法，其特征在于，包括：
    移动管理网元接收来自中继终端设备的远端终端设备的报告信息，所述报告信息包括所述远端终端设备的用户隐藏标识和所述远端终端设备对应的数据网络的名称；
    所述移动管理网元向会话管理网元发送所述远端终端设备的报告信息；
    所述会话管理网元从所述移动管理网元接收所述远端终端设备的报告信息；
    所述会话管理网元向数据管理网元发送请求消息，所述请求消息包括所述用户隐藏标识和所述数据网络的名称；
    所述数据管理网元接收来自所述会话管理网元的所述请求消息；
    所述数据管理网元向所述会话管理网元发送信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元从所述数据管理网元接收所述信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述会话管理网元根据所述信息，确定是否对所述远端终端设备进行二次认证。
  21. 根据权利要求20所述的方法，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  22. 根据权利要求20或21所述的方法，其特征在于，所述方法还包括：
    所述移动管理网元向所述中继终端设备发送认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述中继终端设备从所述移动管理网元接收所述认证命令消息；
    所述中继终端设备根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述中继终端设备向所述移动管理网元发送所述身份信息；
    所述移动管理网元接收来自所述中继终端设备的所述身份信息。
  23. 根据权利要求20至22中任一项所述的方法，其特征在，所述方法还包括：
    所述中继终端设备根据所述远端终端设备的传输标识确定所述数据网络的名称。
  24. 根据权利要求20至23中任一项所述的方法，其特征在于，所述方法还包括：
    所述中继终端设备从所述远端终端设备接收所述远端终端设备的用户隐藏标识；
    所述中继终端设备生成所述远端终端设备的报告信息；
    所述中继终端设备向所述移动管理网元发送所述远端终端设备的报告信息。
  25. 一种通信装置，其特征在于，包括：收发模块和处理模块，
    所述收发模块，用于从中继终端设备接收远端终端设备的传输标识，以及所述远端终端设备的报告信息，所述报告信息包括所述远端终端设备对应的数据网络的名称；
    所述处理模块，用于根据所述传输标识，确定所述远端终端设备的用户永久标识；
    所述收发模块，还用于向会话管理网元发送所述用户永久标识和所述报告信息。
  26. 根据权利要求25所述的装置，其特征在于，
    所述收发模块，还用于从鉴权服务器功能网元接收所述远端终端设备的用户永久标识；
    所述处理模块，还用于保存所述用户永久标识和所述传输标识之间的对应关系；
    所述处理模块，还用于根据所述传输标识和所述对应关系，确定所述用户永久标识。
  27. 根据权利要求25或26所述的装置，其特征在于，
    所述收发模块，还用于接收来自所述会话管理网元的认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述收发模块，还用于向所述中继终端设备发送所述认证命令消息。
  28. 一种通信装置，其特征在于，包括：收发模块和处理模块，
    所述收发模块，用于从移动管理网元接收远端终端设备的报告信息，以及所述远端终端设备的用户永久标识，所述报告信息包括所述远端终端设备对应的数据网络的名称；
    所述收发模块，还用于向数据管理网元发送请求消息，所述请求消息包括所述用户永久标识和所述数据网络的名称；
    所述收发模块，还用于从所述数据管理网元接收信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述处理模块，用于根据所述信息，确定是否对所述远端终端设备进行二次认证。
  29. 根据权利要求28所述的装置，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  30. 一种通信装置，其特征在于，包括：收发模块和处理模块，
    所述处理模块，用于生成远端终端设备的报告信息，所述报告信息包括所述远端终端设备对应的数据网路的名称；
    所述收发模块，用于向移动管理网元发送所述远端终端设备对应的传输标识，以及所述报告信息。
  31. 根据权利要求30所述的装置，其特征在于，
    所述处理模块，还用于根据所述远端终端设备对应的中继服务码确定所述数据网络的名称。
  32. 根据权利要求30或31所述的装置，其特征在于，
    所述收发模块，还用于从所述移动管理网元接收认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述处理模块，还用于根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述收发模块，还用于向所述移动管理网元发送所述身份信息。
  33. 一种通信装置，其特征在于，包括：收发模块和处理模块，
    所述收发模块，用于从移动管理网元接收远端终端设备的报告信息，所述报告信息包括所述远端终端设备的用户隐藏标识和所述远端终端设备对应的数据网络的名称；
    所述收发模块，还用于向数据管理网元发送请求消息，所述请求消息包括所述用户隐藏标识和所述数据网络的名称；
    所述收发模块，还用于从所述数据管理网元接收信息，所述信息用于确定是否对所述远端终端设备进行二次认证；
    所述处理模块，用于根据所述信息，确定是否对所述远端终端设备进行二次认证。
  34. 根据权利要求33所述的装置，其特征在于，所述信息包括以下信息中的至少一项：所述远端终端设备的、与所述数据网络对应的会话管理相关的签约数据，第一指示信息，第二指示信息，其中，所述第一指示信息用于指示所述远端终端设备是否需要进行二次认证，所述第二指示信息用于指示所述远端终端设备上一次二次认证是否成功。
  35. 一种通信装置，其特征在于，包括：收发模块和处理模块，
    所述收发模块，用于从远端终端设备接收所述远端终端设备的用户隐藏标识；
    所述处理模块，用于生成所述远端终端设备的报告信息，所述报告信息包括所述用户隐藏标识和所述远端终端设备对应的数据网络的名称；
    所述收发模块，还用于向移动管理网元发送所述远端终端设备的报告信息。
  36. 根据权利要求35所述的装置，其特征在，
    所述处理模块，还用于根据所述远端终端设备的传输标识确定所述数据网络的名称。
  37. 根据权利要求35或36所述的装置，其特征在于，
    所述收发模块，还用于从所述移动管理网元接收认证命令消息，所述认证命令消息包括所述远端终端设备的标识信息，所述认证命令消息用于请求对所述远端终端设备进行二次认证；
    所述处理模块，还用于根据所述认证命令消息，获取所述远端终端设备的身份信息；
    所述收发模块，还用于向所述移动管理网元发送所述身份信息。
  38. 一种通信装置，其特征在于，所述装置包括一个或多个功能模块，所述一个或多个功能模块：用于执行如权利要求1至3中任一项所述的方法，或者用于执行如权利要求4至5中任一项所述的方法，或者用于执行如权利要求6至8中任一项所述的方法，或者用于执行如权利要求9至10中任一项所述的方法，或者用于执行如权利要求11至13中任一项所述的方法。
  39. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机程序，以使得所述装置执行如权利要求1至3中任一项所述的方法，或者以使得所述装置执行如权利要求4至5中任一项所述的方法，或者以使得所述装置执行如权利要求6至8中任一项所述的方法，或者以使得所述装置执行如权利要求9至10中任一项所述的方法，或者以使得所述装置执行如权利要求11至13中任一项所述的方法。
  40. 一种通信系统，其特征在于，所述通信系统包括如权利要求25至27中任一项所述的通信装置，以及如权利要求28、29、33或34中任一项所述的通信装置。
  41. 一种计算机程序产品，其特征在于，所述计算机程序产品包括用于执行如权利要求1至3中任一项所述的方法的指令，或者，所述计算机程序产品包括用于执行如权利要求4至5中任一项所述的方法的指令，或者，所述计算机程序产品包括用于执行如权利要求6至8中任一项所述的方法的指令，或者，所述计算机程序产品包括用于执行如权利要求9至10中任一项所述的方法的指令，或者，所述计算机程序产品包括用于执行如权利要求11至13中任一项所述的方法的指令。
  42. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读存储介质存储有计算机程序；所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至3中任一项所述的方法，或者使得所述计算机执行如权利要求4至5中任一项所述的方法，或者使得所述计算机执行如权利要求6至8中任一项所述的方法，或者使得所述计算机执行如权利要求9至10中任一项所述的方法，或者使得所述计算机执行如权利要求11至13中任一项所述的方法。
PCT/CN2023/084809 2022-04-21 2023-03-29 通信方法和装置 WO2023202337A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210426836.2 2022-04-21
CN202210426836.2A CN116980893A (zh) 2022-04-21 2022-04-21 通信方法和装置

Publications (1)

Publication Number Publication Date
WO2023202337A1 true WO2023202337A1 (zh) 2023-10-26

Family

ID=88419171

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/084809 WO2023202337A1 (zh) 2022-04-21 2023-03-29 通信方法和装置

Country Status (2)

Country Link
CN (1) CN116980893A (zh)
WO (1) WO2023202337A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021034093A1 (ko) * 2019-08-19 2021-02-25 엘지전자 주식회사 릴레이를 위한 인증
CN113507705A (zh) * 2021-07-13 2021-10-15 中国人民解放军战略支援部队信息工程大学 一种基于eap-tls协议的5g二次认证方法及系统
CN114024693A (zh) * 2020-07-16 2022-02-08 中国移动通信有限公司研究院 一种认证方法、装置、会话管理功能实体、服务器及终端

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021034093A1 (ko) * 2019-08-19 2021-02-25 엘지전자 주식회사 릴레이를 위한 인증
CN114024693A (zh) * 2020-07-16 2022-02-08 中国移动通信有限公司研究院 一种认证方法、装置、会话管理功能实体、服务器及终端
CN113507705A (zh) * 2021-07-13 2021-10-15 中国人民解放军战略支援部队信息工程大学 一种基于eap-tls协议的5g二次认证方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LG ELECTRONICS, INTERDIGITAL: "Procedure for secondary authentication without N3IWF", 3GPP DRAFT; S3-213971, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20211108 - 20211119, 1 November 2021 (2021-11-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052073384 *

Also Published As

Publication number Publication date
CN116980893A (zh) 2023-10-31

Similar Documents

Publication Publication Date Title
US20230016378A1 (en) Pdu session management
US11844142B2 (en) Communications method and apparatus
EP4072234A1 (en) Method for establishing connection and obtaining relay service code, and communication apparatus
WO2020164763A1 (en) Methods and apparatuses for alternative data over non-access stratum, donas, data delivery in a roaming scenario
US20230319556A1 (en) Key obtaining method and communication apparatus
WO2020141356A1 (en) Flexible authorization in 5g service based core network
US20230029714A1 (en) Authorization method, policy control function device, and access and mobility management function device
WO2021136211A1 (zh) 授权结果的确定方法及装置
US11399307B2 (en) Service authorization method, terminal device and network device
WO2020217224A1 (en) Amf and scp behavior in delegated discovery of pcf
CN113676904B (zh) 切片认证方法及装置
US20240107417A1 (en) Communication method and apparatus
EP4262260A1 (en) Key identifier generation method, and related apparatus
CN115134875A (zh) 会话切换的方法和装置
US20220264435A1 (en) Access control method and communications apparatus
KR20240060670A (ko) 통신 방법 및 장치
US10057871B2 (en) Data transmission method and base station
WO2023202337A1 (zh) 通信方法和装置
CN115942305A (zh) 一种会话建立方法和相关装置
WO2023216932A1 (zh) 通信方法和装置
WO2023160390A1 (zh) 通信方法与装置
US11881961B2 (en) Communication method and related apparatus
EP4376461A1 (en) Method and device for operating terminal in wireless communication system
EP4262149A1 (en) Method and apparatus for authenticating user equipment in wireless communication system
WO2023040732A1 (zh) 确定密钥获取方式的方法、通信方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23790997

Country of ref document: EP

Kind code of ref document: A1