WO2023274132A1 - 切片准入控制的方法和通信装置 - Google Patents

切片准入控制的方法和通信装置 Download PDF

Info

Publication number
WO2023274132A1
WO2023274132A1 PCT/CN2022/101465 CN2022101465W WO2023274132A1 WO 2023274132 A1 WO2023274132 A1 WO 2023274132A1 CN 2022101465 W CN2022101465 W CN 2022101465W WO 2023274132 A1 WO2023274132 A1 WO 2023274132A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice
terminal device
amf
nssai
nsacf
Prior art date
Application number
PCT/CN2022/101465
Other languages
English (en)
French (fr)
Inventor
雷中定
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22831946.3A priority Critical patent/EP4344341A1/en
Publication of WO2023274132A1 publication Critical patent/WO2023274132A1/zh
Priority to US18/397,099 priority patent/US20240129843A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/302—Route determination based on requested QoS
    • H04L45/306—Route determination based on the nature of the carried application
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H04W76/34—Selective release of ongoing connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H04W76/32—Release of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/14—Backbone network devices

Definitions

  • the present application relates to the communication field, and more specifically, relates to a slice admission control method and a communication device.
  • a terminal device can register multiple slices.
  • the network considers each slice requested by the terminal device separately, that is, each slice is used as a granularity to allocate slice access quotas. There is no correlation with admission between slices.
  • the network does not deactivate each slice accessed by the terminal device (granularity), but must deactivate all the slices accessed by the terminal device at one time.
  • the main reason is that the slice access control of the terminal device is currently bound (associated) with the registration and de-registration process of the terminal device.
  • the registration process is based on slices as the granularity, and slices are accessed one slice at a time (simultaneously or not at the same time).
  • the de-registration process does not take slices as the granularity, but when the terminal device exits all slices, the PLMN will trigger the de-registration process, or when the PLMN triggers the de-registration process, the terminal device needs to exit all slices.
  • a network usually has hundreds or thousands of terminal devices. If each terminal device has this problem, it will seriously occupy network resources and cause other terminal devices to be denied slicing services (denial of services, DoS).
  • the present application provides a slice admission control method and a communication device, which can reduce resource waste and reduce the probability of other terminal devices being denied slice service (DoS).
  • DoS slice service
  • a slice admission control method including: when there is no protocol data unit PDU session of the terminal device in the first slice or the duration of the terminal device being admitted to the first slice exceeds the first duration , the access and mobility management function network element AMF sends a first request message to the network slice admission control function network element NSACF, and the first request message is used to request the NSACF to release the admission quota of the first slice occupied by the terminal device; The AMF receives the first response message from the NSACF, where the first response message is used to indicate that the admission quota of the first slice occupied by the terminal device has been released.
  • a single slice is used as the granularity, and for each slice of each UE, the PDU session of the UE is released according to whether the UE does not have a PDU session in the first slice (that is, whether it is idle or not).
  • the access quota of the first slice is occupied, so as to avoid the situation that the UE occupies the slice quota for a long time even if the slice is not used, and reduces the probability of other UEs being denied the slice service.
  • the AMF when there is no protocol data unit PDU session of the terminal device in the first slice, the AMF sends the first request message to the NSACF, including: when the terminal device is in When the last PDU session in the first slice has been released, the AMF sends the first request message to the NSACF; or, when the PDU session of the terminal device is not successfully established in the first slice within the second duration, the AMF sends the message to the NSACF The first request message, wherein the second time duration starts from the time when the AMF authorizes the terminal device to access the first slice.
  • the method further includes: the AMF modifies the authorization state of the terminal device in the first slice to pre-authorization, Pre-authorization means that the terminal device is allowed to directly access the first slice when the first slice has an admission quota.
  • the UE In the existing process, if the UE has no quota in the first slice and the authorization status of the UE is "denied authorization", then when the UE wants to establish a PDU session in the first slice or access the first slice again, the UE needs to first Initiate a slice registration request (Registration Request) or service request (Service Request) process to the AMF. After the AMF completes the slice registration and authorizes the UE to access the first slice, the UE can initiate a PDU session establishment request to the AMF. However, in this embodiment, in the state of pre-authorization without a quota, the UE may directly apply for establishing a PDU session in the first slice without going through the registration process, thereby saving resources of the UE and the network.
  • Registration Request slice registration request
  • Service Request Service Request
  • the UE may directly apply for establishing a PDU session in the first slice without going through the registration process, thereby saving resources of the UE and the network.
  • the method further includes: the AMF receives a second request message from the terminal device, and the second request message is used to request the terminal device to establish the first PDU in the first slice Conversation; AMF sends a first message to NSACF, and the first message is used to confirm whether the first slice has an admission quota for terminal equipment; AMF receives a second response message from NSACF, and the second response message is used to indicate that the terminal equipment is admitted Enter the first slice (that is, occupy the admission quota of the first slice) or the first slice has no admission quota.
  • the method further includes: the second response message is used to indicate that the terminal device is admitted to the first slice, and the AMF authorizes the terminal device to access the first slice; the AMF Continue the process of establishing the first PDU session (that is, the AMF sends a message to the SMF to request the establishment of the first PDU session of the terminal device); or, the second response message is used to indicate that the first slice has no admission quota, and the AMF refuses to establish First PDU session.
  • the method further includes: the AMF modifies the authorization state of the terminal device in the first slice to deny authorization, where the denial of authorization means that the terminal device is not allowed to access the first slice. slice.
  • the method further includes: the AMF sends a second message to the terminal device, and the second message is used to notify the terminal device of an authorization status in the first slice.
  • a slice admission control method including: the terminal device determines that the authorization state of the terminal device in the first slice is the pre-authorization state, and the pre-authorization state indicates that the terminal device has an admission quota in the first slice is allowed to directly access the first slice; the terminal device sends a second request message to the access and mobility management function network element AMF, and the second request message is used to request the terminal device to establish the first protocol data in the first slice Unit PDU session.
  • the UE in the pre-authorized state without a quota, can directly apply for establishing a PDU session in the first slice without going through the registration process, thereby saving resources of the UE and the network.
  • a method for slice admission control including: after the first duration expires, the access and mobility management functional network element AMF sends a third request message to the network slice admission control functional network element NSACF , the third request message is used to request the NSACF to release the admission quota of the first slice occupied by the terminal device, wherein the first duration is the valid duration for the terminal device to be admitted to the first slice; AMF receives the third response message from the NSACF , the third response message is used to indicate that the admission quota of the first slice occupied by the terminal device has been released.
  • a single slice is used as the granularity, and for each slice of each UE, the PDU session of the UE is released according to whether the UE does not have a PDU session in the first slice (that is, whether it is idle or not).
  • the access quota of the first slice is occupied, so as to avoid the situation that the UE occupies the slice quota for a long time even if the slice is not used, and reduces the probability of other UEs being denied the slice service.
  • the method before the AMF authorizes the terminal device to access the first slice, the method further includes: the AMF sends a fourth request message to the NSACF, and the fourth request message is used to request The terminal device accesses the first slice; the AMF receives a fourth response message from the NSACF, the fourth response message is used to instruct the terminal device to admit the first slice, and the fourth response message includes the first duration.
  • the first duration is stored in the AMF.
  • the method further includes: the AMF determines that the terminal device has one or more protocol data unit PDU sessions in the first slice ; AMF sends a third request message to NSACF after all one or more PDU sessions are released.
  • the method further includes: the AMF sends a fourth message to the terminal device, and the fourth message is used to notify the terminal device that the AMF will release The admission quota occupied by the terminal device in the first slice; the AMF receives a fifth message from the terminal device, and the fifth message is used to indicate that the terminal device does not need to continue using the first slice; the AMF sends a third request message to the NSACF.
  • the method further includes: when the terminal device is authorized to access the first slice, the AMF sends a sixth message to the terminal device, the sixth message includes the first duration ; The AMF receives a seventh message from the terminal device before the first duration expires, and the seventh message is used to request the AMF to update the valid duration for the terminal device to access the first slice to the third duration.
  • a method for slice admission control including: a network slice admission control function network element NSACF receives a fourth request message from an access and mobility management function network element AMF, and the fourth request message is used to request The terminal device accesses the first slice; the NSACF sends a fourth response message to the AMF, the fourth response message is used to indicate that the terminal device is admitted to the first slice, and the fourth response message includes a first duration, wherein the first duration The valid duration of the first slice granted to the terminal device.
  • a slice admission control method including: a terminal device receives a sixth message from an access and mobility management function network element AMF, and the sixth message includes a first duration, wherein the first duration is the terminal The valid duration for the device to be admitted to the first slice. Before the first duration expires, the terminal device sends a seventh message to the AMF, where the seventh message is used to request the AMF to update the valid duration for the terminal device to access the first slice to the third duration.
  • a method for slice admission control including: the access and mobility management function network element AMF determines that the network slice authentication authorization NSSAA of the first slice requested by the terminal device to access is successful; the AMF sends the network slice
  • the admission control function network element NSACF sends a fifth request message, and the fifth request message is used to request the terminal device to access the first slice;
  • AMF receives a fifth response message from the NSACF, and the fifth response message is used to indicate that the first slice does not have Access quota;
  • AMF changes the authorization status of the terminal device in the first slice to pre-authorization, which means that the terminal device is allowed to directly access the first slice when there is an admission quota in the first slice; or, AMF changes the terminal
  • the authorization state of the device in the first slice is changed to deny authorization, and record that the terminal device has successfully passed the NSSAA of the first slice, wherein the denial of authorization means that the terminal device is denied access to the first slice.
  • the UE when the UE requests to re-request access to the first slice in the pre-authorized state, it may not need to go through the registration process and/or the slice authentication process, and the UE is allowed to directly access the first slice when there is an admission quota. access to the first slice, thereby saving resources of the UE and the network; or, when the UE requests to re-request access to the first slice in the state of denying authorization, since the AMF stores the status of "slice authentication successful", there is no need to initiate slice authentication again process, thereby saving resources of the UE and the network.
  • the present application provides a communication device, the communication device has the function of implementing the method in the first aspect or any possible implementation thereof, or has the function of implementing the method in the third aspect or any possible implementation thereof , or have the function of implementing the method in the sixth aspect or any possible implementation thereof.
  • the functions may be implemented by hardware, or may be implemented by executing corresponding software through hardware.
  • Hardware or software includes one or more units corresponding to the functions described above.
  • the present application provides a communication device, the communication device has the function of implementing the method in the second aspect or any possible implementation thereof, or has the function of implementing the method in the fifth aspect or any possible implementation thereof .
  • the functions may be implemented by hardware, or may be implemented by executing corresponding software through hardware.
  • Hardware or software includes one or more units corresponding to the functions described above.
  • the present application provides a communication device, and the communication device has a function of implementing the method in the fourth aspect or any possible implementation thereof.
  • the functions may be implemented by hardware, or may be implemented by executing corresponding software through hardware.
  • Hardware or software includes one or more units corresponding to the functions described above.
  • the present application provides a communication device, including at least one processor, at least one processor is coupled with at least one memory, at least one memory is used to store computer programs or instructions, and at least one processor is used to call from at least one memory And execute the computer program or instruction, so that the communication device executes the method in the first aspect or any possible implementation thereof, or executes the method in the third aspect or any possible implementation thereof, or executes the sixth aspect or any possible implementation thereof method in a possible implementation.
  • the communication device may be an access and mobility management functional network element.
  • the communication device may be a component (such as a chip or an integrated circuit) installed in the access and mobility management functional network element.
  • the present application provides a communication device, including at least one processor, the at least one processor is coupled to at least one memory, the at least one memory is used to store computer programs or instructions, and the at least one processor is used to retrieve from the at least one memory
  • the computer program or instruction is invoked and executed, so that the communication device executes the method in the second aspect or any possible implementation thereof, or executes the method in the fifth aspect or any possible implementation thereof.
  • the communication device may be a terminal device.
  • the communication device may be a component (such as a chip or an integrated circuit) installed in the terminal device.
  • the present application provides a communication device, including at least one processor, the at least one processor is coupled with at least one memory, the at least one memory is used to store computer programs or instructions, and the at least one processor is used to read from at least one memory
  • the computer program or instruction is invoked and executed, so that the communication device executes the method in the fourth aspect or any possible implementation manner thereof.
  • the communication device may be a network element with a slice admission control function.
  • the communication device may be a component (such as a chip or an integrated circuit) installed in a slice admission control functional network element.
  • the present application provides a computer program product, the computer program product includes computer program code, and when the computer program code is run on a computer, the The method is executed, or causes the method in the third aspect or any possible implementation thereof to be executed, or causes the method in the sixth aspect or any possible implementation thereof to be executed.
  • the present application provides a computer program product, the computer program product includes computer program code, and when the computer program code is run on a computer, the A method is performed, or causes a method as in the fifth aspect or any possible implementation thereof to be performed.
  • the present application provides a computer program product, the computer program product includes computer program code, when the computer program code is run on a computer, as in the fourth aspect or any possible implementation thereof method is executed.
  • the present application provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are run on a computer, the The method in the third aspect is executed, or the method in the third aspect or any possible implementation thereof is executed, or the method in the sixth aspect or any possible implementation thereof is executed.
  • the present application provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are run on a computer, the The method in the fifth aspect is executed, or the method in the fifth aspect or any possible implementation thereof is executed.
  • the present application provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are run on a computer, the fourth aspect or any possible implementation thereof The method in is executed.
  • FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present application.
  • Fig. 2 is a schematic diagram of a process of querying the availability of network slices and updating the number of terminals.
  • Fig. 3 is a schematic flowchart of a slice admission control method proposed by the present application.
  • Fig. 4 is a schematic flow chart of a terminal device currently initiating a PDU session after a slice admission quota is cancelled.
  • Fig. 5 is a schematic flowchart of a terminal device initiating a PDU session in a pre-authorized state proposed in this application.
  • FIG. 6 is a schematic flowchart of another slice admission control method proposed by the present application.
  • Fig. 7 is a schematic flow chart of current UE slice registration including slice authentication.
  • Fig. 8 is a schematic flowchart of another slice admission control method proposed by the present application.
  • FIG. 9 is a schematic block diagram of a communication device 1000 provided by the present application.
  • FIG. 10 is a schematic block diagram of a communication device 2000 provided in the present application.
  • FIG. 11 is a schematic structural diagram of a communication device 10 provided by the present application.
  • FIG. 12 is a schematic structural diagram of a communication device 20 provided by the present application.
  • PLMN public land mobile network
  • operator network also may be referred to as an operator network, etc.
  • PLMN public land mobile network
  • MNO mobile network operators
  • 3GPP third generation partnership project
  • 3GPP networks generally include but are not limited to the fifth-generation mobile communication (5th-generation, 5G) network (referred to as 5G network), the fourth-generation mobile communication (4th-generation, 4G) network (referred to as 4G network) and other future communication systems Such as 6G network, etc.
  • 5G network fifth-generation mobile communication
  • 4G network fourth-generation mobile communication (4th-generation, 4G) network
  • 6G network 6th-generation network
  • PLMN or 5G network will be used as an example in the embodiment of this application for description.
  • FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present application. It takes the 5G network architecture based on the service-based architecture in the non-roaming scenario defined in the 3GPP standardization process as an example.
  • the network architecture may include three parts, namely a terminal equipment part, a PLMN, and a data network (data network, DN).
  • the terminal equipment part may include terminal equipment 110, and the terminal equipment 110 may also be called user equipment (user equipment, UE).
  • the terminal device 110 in this application is a device with a wireless transceiver function, which can communicate with one or Multiple core network (core network, CN) devices (or also called core devices) communicate.
  • Terminal equipment 110 may also be called an access terminal, terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, user device, or the like.
  • the terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as on aircraft, balloons, and satellites, etc.).
  • the terminal device 110 may be a cellular phone (cellular phone), a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a smart phone (smart phone), a mobile phone (mobile phone), a wireless local loop (wireless local loop, WLL ) station, personal digital assistant (PDA), etc.
  • the terminal device 110 may also be a handheld device with a wireless communication function, a computing device or other devices connected to a wireless modem, a vehicle device, a wearable device, a drone device or a terminal in the Internet of Things, the Internet of Vehicles, or a 5G network And terminals in any form in the future network, relay user equipment or terminals in the future evolved 6G network, etc.
  • the relay user equipment may be, for example, a 5G residential gateway (residential gateway, RG).
  • the terminal device 110 may be a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, a wireless terminal in industrial control (industrial control), a wireless terminal in self driving (self driving), a remote Wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, wireless terminals in smart city, smart home wireless terminals, etc.
  • the embodiment of the present application does not limit the type or category of the terminal device. It should be understood that in this application, the terminal device and UE can be replaced with each other.
  • PLMN may include but not limited to: network exposure function (network exposure function, NEF) 131, network storage function (network function repository function, NRF) 132, policy control function (policy control function, PCF) 133, unified data management function (unified data management (UDM) 134, network slice selection function (NSSF) 135, authentication server function (authentication server function, AUSF) 136, access and mobility management function (access and mobility management function, AMF) 137 , session management function (session management function, SMF) 138, user plane function (user plane function, UPF) 139, (wireless) access network ((radio) access network, (R) AN) 140, network slice access control Function (Network Slice Admission Control Function, NSACF) 141, Network Slice Specific Authentication and Authorization Function (Network Slice Specific Authentication and Authorization Function, NSSAAF) 142, etc.
  • the part other than the (wireless) access network 140 part may be called a core network (core network, CN) part.
  • the data network DN 120 can also be called a packet data network (packet data network, PDN), and can usually be deployed outside the PLMN, such as a third-party network (of course, the DN may also be deployed in the PLMN, which is not limited here).
  • PDN packet data network
  • the PLMN can access multiple data networks DN 120, and various services can be deployed on the data network DN 120, so as to provide services such as data and/or voice for the terminal device 110.
  • the data network DN120 can be a private network of a smart factory, the sensors installed in the workshop of the smart factory can be terminal devices 110, the control server of the sensors is deployed in the data network DN120, and the control server can provide services for the sensors.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • the data network DN 120 may be a company's internal office network, and the mobile phones or computers of employees of the company may be terminal devices 110, and the employees' mobile phones or computers may access information and data resources on the company's internal office network.
  • the terminal device 110 may establish a connection with the PLMN through an interface provided by the PLMN (such as the N1 interface in FIG. 1 ), and use services such as data and/or voice provided by the PLMN.
  • the terminal device 110 can also access the data network DN 120 through the PLMN, and use operator services deployed on the data network DN 120, and/or services provided by a third party.
  • the above-mentioned third party may be a service party other than the PLMN and the terminal device 110 , and may provide the terminal device 110 with other services such as data and/or voice.
  • the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.
  • (R)AN 140 is a sub-network of the PLMN, and is an implementation system between service nodes (or network functions) and terminal equipment 110 in the PLMN. To access the PLMN, the terminal device 110 first passes through the (R)AN 140, and then connects with the service node in the PLMN through the (R)AN 140.
  • the (R)AN 140 in the embodiment of the present application may refer to the access network itself, or may refer to the access network equipment, which is not distinguished here.
  • An access network device is a device that provides a wireless communication function for the terminal device 110, and may also be called an access device, (R)AN device, or network device.
  • the access network equipment includes but is not limited to: a next generation base station (next generation node basestation, gNB) in a 5G system, an evolved base station (evolved node B, eNB) in an LTE system, a radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (home evolved nodeB, or home node B, HNB), baseband Unit (base band unit, BBU), transmission and receiving point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), small base station equipment (pico), mobile switching center, or network equipment in the future network, etc.
  • RNC radio network controller
  • node B node B
  • BSC base station controller
  • base transceiver station base transceiver station
  • BTS home base station
  • home evolved nodeB home evolved nodeB, or home node B
  • the access device may include a centralized unit (centralized unit, CU) and a distributed unit (distributed unit, DU).
  • the CU can also be divided into CU-control plane (control plane, CP) and CU-user plane (user plan, UP).
  • the access device may also be an open radio access network (ORAN) architecture, etc. This application does not limit the specific deployment method of the access device.
  • a network opening function NEF (also called a network opening function entity) 131 is a control plane function provided by an operator, and mainly enables third parties to use services provided by the network.
  • the network storage function NRF 132 is a control plane function provided by the operator, which can be used to maintain real-time information of all network function services in the network.
  • the policy control function PCF 133 is a control plane function provided by the operator. It supports a unified policy framework to govern network behavior, and provides policy rules and contract information related to policy decisions to other control functions.
  • the unified data management function UDM 134 is a control plane function provided by the operator, which is responsible for storing the subscriber permanent identifier (SUPI), security context (security context), subscription data and other information of the subscriber in the PLMN.
  • SUPI subscriber permanent identifier
  • security context security context
  • subscription data and other information of the subscriber in the PLMN.
  • a network slice selection function (network slice selection function, NSSF) 135 is a control plane network function provided by the PLMN, and is used to determine a network slice instance, select an AMF network function 137, and the like.
  • the authentication server function AUSF 136 is a control plane function provided by the operator, and is usually used for primary authentication, that is, the authentication between the terminal device 110 (subscriber) and the PLMN.
  • Access and mobility management function AMF 137 is a control plane network function provided by the PLMN, which is responsible for access control and mobility management of the terminal device 110 accessing the PLMN, including mobility status management, allocation of temporary user identities, and user Perform functions such as authentication and authorization.
  • the session management function SMF 138 is a control plane network function provided by the PLMN, and is responsible for managing the protocol data unit (protocol data unit, PDU) session of the terminal device 110.
  • the PDU session is a channel for transmitting PDUs, and the terminal equipment needs to transmit data with DN 120 through the PDU session.
  • the PDU session can be established, maintained and deleted by the SMF 138.
  • SMF 138 includes session management (such as session establishment, modification and release, including tunnel maintenance between UPF 139 and (R)AN 140, etc.), selection and control of UPF 139, service and session continuity (service and session continuity, SSC) Session-related functions such as mode selection and roaming.
  • the user plane function UPF 139 is a gateway provided by the operator, and is a gateway for communication between the PLMN and the DN 120.
  • UPF 139 includes user plane-related functions such as data packet routing and transmission, packet detection, service usage reporting, quality of service (QoS) processing, lawful interception, uplink packet detection, and downlink data packet storage.
  • QoS quality of service
  • the Network Slice Admission Control Function (Network Slice Admission Control Function, NSACF) 141 is a network function used by the PLMN to monitor and control the number of terminal devices registered on the network slice.
  • NSACF Network Slice Admission Control Function
  • NSACF is configured with the maximum number of terminal devices that can be served in each network slice monitored and controlled by it.
  • the network slice specific authentication and authorization function (network slice specific authentication and authorization function, NSSAAF) 142 is a control plane network function provided by the PLMN, and is used to support slice authentication between the terminal 110 and the DN.
  • the network functions in the PLMN shown in FIG. 1 may also include unified data storage (unified data repository, UDR), etc. (not shown in the figure), and the embodiments of the present application are not limited to other network functions included in the PLMN.
  • unified data storage unified data repository, UDR
  • UDR unified data repository
  • Nnef, Nnrf, Npcf, Nudm, Nnssf, Nausf, Namf, Nsmf, Nnssaaf, Nnsacf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • the meaning of the above interface serial number may refer to the meaning defined in the 3GPP standard protocol, and the present application does not limit the meaning of the above interface serial number.
  • the terminal device 110 is used as an example for UE, and the name of the interface between various network functions in FIG. 1 is only an example.
  • the interface name of the system architecture It may also be other names, which are not limited in this application.
  • the mobility management network function in this application can be the AMF 137 shown in Figure 1, and can also be other network functions with the above-mentioned access and mobility management function AMF 137 in the future communication system.
  • the mobility management network function in this application may also be a mobility management entity (mobility management entity, MME) in the LTE system.
  • the access and mobility management function AMF 137 is referred to as AMF
  • the terminal device 110 is referred to as UE
  • the network slice admission control function NSACF141 is referred to as NSACF, that is, the latter in the embodiment of this application
  • the AMF described in this article can be replaced by the mobility management network function
  • the UE can be replaced by the terminal equipment
  • the NSACF can be replaced by the network slice admission control function.
  • the network architecture diagram shown in FIG. 1 can be understood as a service-based architecture in a non-roaming scenario.
  • PLMN can combine some or all network functions in an orderly manner according to the needs of specific scenarios, realize the customization of network capabilities and services, and thus deploy dedicated networks for different services, that is, realize 5G network slicing (network slicing).
  • Network slicing technology can enable operators to respond to customer needs more flexibly and quickly, and support flexible allocation of network resources. In order to facilitate the understanding of the present application, the network slicing is further described below.
  • a simple understanding of network slicing is to divide an operator's physical network into multiple virtual end-to-end networks. ) are logically independent, preventing the failure of any one virtual network from affecting other virtual networks.
  • slicing In order to meet the diverse requirements and the isolation between slices, relatively independent management and operation and maintenance between businesses are required, and tailor-made business functions and analysis capabilities are provided.
  • Instances of different service types may be deployed on different network slices, and different instances (instances) of the same service type may also be deployed on different network slices.
  • a slice can consist of a set of network functions (network functions, NFs) and/or sub-networks.
  • the subnetwork (R)AN 140, AMF 137, SMF 138, and UPF 139 in Figure 1 can form a slice. It can be understood that only one of each network function is schematically shown in FIG. 1 , but in actual network deployment, there may be multiple or tens of each network function or sub-network. Many slices can be deployed in the PLMN, and each slice can have different performances to meet the requirements of different applications and vertical industries. Operators can "tailor-made" a slice according to the needs of customers in different vertical industries.
  • the UE can send uplink messages (that is, messages sent by the UE to the network, such as registration request, service request, periodic registration update, Periodic Registration Update, etc.
  • uplink messages that is, messages sent by the UE to the network, such as registration request, service request, periodic registration update, Periodic Registration Update, etc.
  • request message provides or indicates the slice that the core network UE wants to access.
  • the indication information of the desired slice is called a requested (network slice selection assistance information set) (NSSAI).
  • NSSAI network slice selection assistance information set
  • the NSSAI is actually a list or set, which includes one or more single network slice selection assistance information (single network slice selection assistance information, S-NSSAI), an S-NSSAI is used to identify a network slice (also can be A type of network slicing), it can also be understood that S-NSSAI is identification information of a slice.
  • S-NSSAI single network slice selection assistance information
  • NSI-ID Network Slice Instance Identifier/Identity
  • S-NSSAI Network Slice Instance Identifier/Identity
  • a slice identified by an S-NSSAI can also be instantiated into one or more slice instances (slice instance) , each NSI-ID corresponds to a slice instance.
  • an NSI-ID can also be called identification information of a slice, and one S-NSSAI can correspond to multiple NSI-IDs.
  • S-NSSAI uses S-NSSAI as an example for description, and does not strictly distinguish or limit S-NSSAI and NSI-ID. The description of S-NSSAI can also be applied to NSI-ID.
  • slice-level authentication is a network control function with limited participation by slice customers, that is, to authenticate and authorize terminal devices accessing slices. This application is referred to as “slice authentication" for short.
  • the terminal device Before the terminal device is allowed to access the network slice, it first needs to perform a "network-level authentication" with the PLMN network, that is, the PLMN needs to perform authentication based on the contract identification information used by the terminal device to sign with the PLMN. This authentication is usually called Primary authentication. Secondly, the PLMN needs to perform authentication based on the subscription identifier used by the terminal device and the DN, that is, "slice authentication".
  • NSACF is a newly defined network function in the 5G standard, and it is a network function used by PLMN to save, update and control the number of terminal devices registered on the network slice. Specifically, PLMN will first configure the maximum number of terminal devices that can be served in each network slice on NSACF, or called quota (quota), access limit, when the network authorizes a new terminal to access the slice or When the terminal goes to register, NSACF determines whether the network slice can still accept new terminal access requests according to the quota, and stores and updates the number of admitted terminals in the slice in real time.
  • quota quota
  • the network slicing here refers to the network slicing that requires admission control, and the network slicing is monitored and controlled by the current NSACF.
  • all network slices belong to such slices that require admission control. The following describes further in combination with the specific process defined in the 5G standard.
  • the basic process of querying the availability of network slices and updating the number of terminals is currently defined, as shown in Figure 2.
  • This process describes the process of updating the number of terminals registered on the slice (identified as S-NSSAI) on the NSACF (that is, the number of admitted terminal devices increases or decreases).
  • PLMN has pre-configured on AMF which slices S-NSSAI need to perform such a process (that is, slices that require admission control).
  • AMF triggers and sends "availability query and update" to NSACF "(availability check and update, ACU) request, hereinafter referred to as ACU request.
  • Step 1 AMF triggers the ACU process.
  • AMF is registering, de-registering, configuring update (UE configuration update, UCU), slice authentication server (that is, "authentication, authorization, accounting” server, or authentication, authorization, and accounting server,
  • UE configuration update UCU
  • slice authentication server that is, "authentication, authorization, accounting” server, or authentication, authorization, and accounting server
  • the AMF When the AMF decides to trigger the ACU process, it will first verify that the slice identified as S-NSSAI is a slice that the PLMN allows the terminal device to access, that is, the AMF verifies the "NSSAI list allowed for access" corresponding to the slice S-NSSAI in the terminal (ie Allowed NSSAI). If it is verified that the S-NSSAI is in the "NSSAI list allowed for access” corresponding to the terminal, the AMF will send an ACU request for the S-NSSAI to the NSACF, that is, step 2 will be performed.
  • Allowed NSSAI refers to the allowed or authorized NSSAI, indicating which S-NSSAIs are allowed or authorized to be accessed by the network among the NSSAIs requested by the UE.
  • NSSAI information element (information element, IE) sent to the UE.
  • Step 2 AMF sends ACU request to NSACF.
  • the request includes a terminal device identifier (S-NSSAI) and an update identifier (flag). This flag is used to indicate whether the request is for "increasing the number” (such as when registering) or “decreasing the number” (such as when going to register).
  • S-NSSAI terminal device identifier
  • Flag update identifier
  • Step 3 After receiving the request, the NSACF determines how to respond to the AMF's ACU request according to the stored admission status of the slice S-NSSAI, that is, the currently admitted terminal equipment and its quantity.
  • NSACF first checks whether the terminal device has been included in the terminal device admitted by the slice S-NSSAI, and if so, the number of admitted terminal devices The counter remains unchanged and is ready to reply to AMF. If the slice admission quota is not full, that is, the terminal device is admitted to the slice S-NSSAI; otherwise, continue to check whether the number of currently admitted terminal devices is less than the slice S-NSSAI Access quota.
  • NSACF will include the terminal device in the admitted terminal list, and increase the admitted counter by 1 (that is, update the stored admitted terminal The number of devices is +1), and it is ready to reply to AMF, and the slice admission quota is not full, that is, the terminal device is admitted. If the quota is full, the counter remains unchanged, and prepares to reply to the AMF, indicating that the quota is full, ie rejecting the terminal device.
  • NSACF deletes the identifier of the terminal device from the list of admitted terminal devices, and counts the counters of all slices S-NSSAI that the terminal device has admitted reduce by 1.
  • Step 4 After NSACF judges according to Step 3, it sends an ACU response to AMF, and AMF can handle accordingly.
  • the AMF authorizes the terminal device to access the slice S-NSSAI and notifies the terminal device
  • the authorization status of the slice S-NSSAI that the terminal device requests to access belongs to the Allowed NSSAI.
  • the AMF refuses to authorize the terminal device to access the slice S-NSSAI, and notifies the terminal device of the authorization status of the slice S-NSSAI that the terminal device requests to access, that is, the terminal device
  • the slice S-NSSAI requested to be accessed belongs to Rejected NSSAI, and the rejection reason is attached: the slice quota is full.
  • the AMF may notify the terminal device to wait for a period of time before accessing (that is, start a relevant timer, and re-initiate a registration request when the timer stops).
  • Rejected NSSAI refers to the rejection of NSSAI, indicating which S-NSSAIs among the NSSAI requested by the terminal device for access are rejected by the AMF, and the AMF will send the "Rejected NSSAI" IE in the registration acceptance message (Registration Accept) to the terminal device .
  • the PLMN (such as AMF and NSACF) does not match the control granularity (basic unit) of the terminal device's access, which is likely to cause the abuse of slice quotas and waste of resources.
  • the PLMN when a terminal device registers, the PLMN considers each slice (S-NSSAI) that the terminal device requests to access separately, that is, each slice is used as a granularity to allocate admission quotas, and the access quota between slices There is no correlation between the inputs.
  • S-NSSAI slice-NSSAI
  • the PLMN does not revoke each slice accessed by the terminal device as a unit (granularity), but must revoke all the slices accessed by the terminal device at the same time.
  • the main reason is that the access control of terminal devices is currently bound (associated) with the registration and de-registration process of terminal devices.
  • the registration process is based on slices as the granularity. The process does not take slices as the granularity, but when the terminal device exits all slices, the PLMN triggers the de-registration process, or when the PLMN triggers the de-registration process, the terminal device needs to exit all slices.
  • the above process will cause the terminal device to occupy the slice quota for a long time even if it does not use the slice.
  • a UE can access 8 slices at the same time. After the UE accesses 8 slices, the UE will occupy the quota of 8 slices. If the UE only uses one of the slices for a long time and does not use other slices, but because the UE has not exited the network, that is, it has not performed the de-registration process (that is, it still uses one of the slices), the quotas of all other slices are still used. The UE is occupied.
  • a network usually has hundreds or thousands of UEs. If each UE has this problem, it will seriously occupy network resources and cause other UEs to be denied slicing services (denial of services, DoS).
  • this application proposes an admission control method, which can reduce resource waste and reduce the probability of other UEs being denied slice service (DoS).
  • DoS slice service
  • FIG. 3 is a schematic flowchart of a slice admission control method proposed by the present application.
  • the AMF determines that there is no PDU session of the UE in the slice S-NSSAI#1.
  • This step can also be understood as the AMF determines that the use state of the UE in the slice S-NSSAI#1 is "idle state", and the idle state means that the UE does not currently use the slice S-NSSAI#1, and S302 is triggered. Therefore, the UE does not have a PDU session in the slice S-NSSAI#1, which can be regarded as a kind of idle state, that is, no PDU session is equivalent to the idle state, and having a PDU session is equivalent to the non-idle state.
  • the AMF when the AMF determines that the last PDU session of the UE in the slice S-NSSAI#1 has been released, the AMF considers that the current use state of the UE in the slice S-NSSAI#1 is an idle state, and triggers S302.
  • the SMF is responsible for managing the network function of the PDU session.
  • the SMF needs to have or add that the last PDU session has been released. notification service, and the AMF can be authorized to subscribe to the service to the SMF.
  • the AMF determines that the use state of the UE in slice S-NSSAI#1 is idle state, if a timer is set, before the timer expires, if the UE has not created a new PDU session in the slice S-NSSAI (According to the existing standard procedure, when the SMF creates a PDU session for the UE, it will notify the AMF), and the AMF triggers S302. If the SMF notifies the UE that a new PDU session in the slice S-NSSAI#1 is successfully created before the timer expires, the state of the UE in the slice S-NSSAI#1 changes from the idle state to the non-idle state, then AMF does not trigger S302.
  • this implementation may be applicable to a scenario where the UE has established a PDU session in the slice S-NSSAI#1 after being allowed to access the slice S-NSSAI#1. After all the PDU sessions established by the UE in the slice S-NSSAI#1 are released, the usage state of the UE in the slice S-NSSAI#1 changes from the non-idle state to the idle state.
  • the AMF starts counting the second duration when the UE is authorized to access the slice S-NSSAI#1. Before the second duration expires, the AMF has not received (for example, the AMF receives from the SMF) the SMF and The message that the UE has successfully established the PDU session of the UE in the slice S-NSSAI#1, then the AMF considers that the current use state of the UE in the slice S-NSSAI#1 is idle, and triggers S302, wherein the second duration can be preset duration.
  • this implementation manner may be applicable to a scenario where the UE initially allows access to the slice S-NSSAI#1 and has not yet established a PDU session in this slice.
  • the AMF does not detect within the second duration (or does not receive a notification message from the SMF to notify the AMF) to establish a PDU session of the UE in the slice S-NSSAI#1
  • the AMF does not execute S302.
  • the AMF sends a first request message to the NSACF, where the first request message is used to request the NSACF to release the admission quota of the slice S-NSSAI#1 occupied by the UE.
  • the first request message carries a "decrease in number" or "-" flag.
  • the absence of UE PDU session in slice S-NSSAI#1 may be a condition for triggering S302, and the condition may be determined by the AMF, or notified by other devices, that is to say, S301 is an optional step.
  • the AMF receives a first response message from the NSACF, where the first response message is used to indicate that the admission quota occupied by the UE in the slice S-NSSAI#1 has been released.
  • the above technical solution uses a single slice as the granularity, and for each slice of each UE, releases the slice quota occupied by the UE according to the usage status of the slice (that is, whether it is idle), thereby avoiding UE Even if slices are not used, slice quotas are occupied for a long time, reducing the probability of other UEs being denied slice services.
  • the AMF modifies the authorization state of the UE in the slice S-NSSAI#1 to pre-authorization.
  • the pre-authorization means that the UE is allowed to directly access the slice S-NSSAI#1 when it has an admission quota in the slice S-NSSAI#1.
  • the difference between the pre-authorization state and the authorization state in this embodiment is: in the pre-authorization state, the admission quota of the slice S-NSSAI#1 is full, and there is no UE admission quota. conditions for entering the quota), the pre-authorized status can be changed to authorized status.
  • the pre-authorization state is different from the existing authorization state that refuses to authorize the UE to access the slice S-NSSAI#1.
  • the UE can allow the UE to send a PDU session establishment request message, while in the existing denied authorization state, the UE must first send a registration request message or a service request message, and only after the request is accepted can it be allowed Send a PDU Session Establishment Request message (further described next in Figures 4 and 5).
  • the AMF may have different methods, storing the pre-authorization status of the UE in the slice S-NSSAI#1 or sending the pre-authorization status to the UE.
  • pre-authorization can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 that it requests to access is still S-NSSAI#1 belongs to the Allowed NSSAI, and the UE does not have access to the slice S-NSSAI#1. Admission quota.
  • pre-authorization can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 it requests to access is that S-NSSAI#1 belongs to Pending NSSAI (that is, "pending" NSSAI), and the UE is in the slice There is no admission quota for S-NSSAI#1.
  • pre-authorization can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 that it requests to access is that S-NSSAI#1 belongs to Rejected NSSAI (rejected NSSAI), and the reason for being rejected is UE has no admission quota in slice S-NSSAI#1.
  • AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 that it requests to access is that S-NSSAI#1 belongs to Rejected NSSAI (rejected NSSAI), and the reason for being rejected is UE has no admission quota in slice S-NSSAI#1.
  • this method is different from the existing procedure for the subsequent UE needing to re-access the slice or establish a PDU session in the slice.
  • the UE when the authorization state of the UE is "denied authorization", as shown in Figure 4, when the UE wants to establish a PDU session in the slice S-NSSAI#1, the UE needs to first initiate a slice registration request to the AMF (Registration Request) or service request (Service Request) process (S410 ⁇ S430, it should be noted that many message interactions between UE and PLMN are omitted between S410 and S430), and the registration process (or service request process) and after the UE is authorized to access the slice S-NSSAI#1 (S430), the UE can initiate a PDU session establishment request to the AMF (S440).
  • AMF Registration Request
  • Service Request Service Request
  • the UE in the state of pre-authorization without a quota, can directly apply for establishing a PDU session in the slice S-NSSAI#1 without going through the registration process or the service request process, thereby saving resources of the UE and the network.
  • the AMF notifies the UE of the UE's authorization status in S-NSSAI#1.
  • this step can also be a two-way communication between the AMF and the UE, such as notifying the authorization status of the UE in S-NSSAI#1 through the UE configuration update (UE configuration update, UCU) process.
  • UE configuration update UE configuration update, UCU
  • the UE sends a second request message to the AMF based on the current pre-authorization state in the slice S-NSSAI#1, where the second request message is used to request the UE to establish the first PDU session in the slice S-NSSAI#1.
  • the AMF receives the second request message.
  • the AMF sends a first message to the NSACF, where the first message is used to confirm whether the slice S-NSSAI#1 has a UE admission quota.
  • the fact that the UE has a quota in the slice S-NSSAI#1 is a necessary condition for the UE to be able to establish a PDU session in the slice S-NSSAI#1.
  • the AMF receives a second response message from the NSACF, and the second response message is used to indicate that S-NSSAI#1 has a UE admission quota (that is, it can be understood as UE admission slice S-NSSAI#1) or slice S-NSSAI# 1 No admission quota.
  • the AMF authorizes the UE to access the slice S-NSSAI#1, and S540 is performed.
  • the authorization status of the UE changes from "pre-authorization” to "authorization”, that is, at this time, the UE actually accesses the slice S-NSSAI#1 and the slice has a quota for the UE.
  • the AMF refuses to establish the first PDU session, and S540 is not executed.
  • the AMF continues to execute the process of establishing the first PDU session.
  • the AMF can continue to send the request message for establishing the first PDU session to the SMF.
  • the SMF can interact with the UE (and other NFs) to establish the first PDU session according to the existing standard procedures.
  • the SMF sends a message indicating that the first PDU session is successfully established to the AMF, and the AMF sends a message indicating that the first PDU session is successfully established to the UE.
  • the UE's current use state in the slice S-NSSAI#1 changes from the idle state to the non-idle state.
  • the SMF determines that the last PDU session of the UE in the slice S-NSSAI#1 has been released, the SMF directly initiates the release quota process (ie, the first request message) to the NSACF, and then , the SMF notifies the AMF that the S-NSSAI quota of the UE has been released (that is, the first response message), and the subsequent steps are the same as in FIG. 3 .
  • the AMF notifies the SMF to start the timer (the second duration) by the SMF.
  • the SMF Before the timer expires, if the SMF does not create a new PDU for the UE in S-NSSAI#1, the SMF initiates a release to the NSACF Quota process (i.e. the first request message), after that, the SMF notifies the AMF that the UE's S-NSSAI quota has been released (i.e. the first response message), and the subsequent steps are the same as in Figure 3, otherwise, the SMF does not initiate the release of the quota process.
  • the SMF does not initiate the release of the quota process.
  • the AMF may send the received second request message to the SMF, perform S520 and S530 between the SMF and the NSACF, and then the SMF continues to execute the process of establishing the first PDU session.
  • this application proposes another admission control method, which can also reduce resource waste and reduce the probability of other UEs being denied slice service (DoS).
  • DoS slice service
  • FIG. 6 is a schematic flowchart of another slice admission control method proposed by the present application.
  • the AMF authorizes the UE to access the slice S-NSSAI#1.
  • the authorization means that the UE is allowed to access the slice S-NSSAI#1 and there is an admission quota for the UE in the slice S-NSSAI#1.
  • the authorization state of the slice S-NSSAI#1 that the UE is currently requesting to access is that S-NSSAI#1 belongs to the Allowed NSSAI.
  • the AMF sends a third request message to the NSACF.
  • the third request message is used to request the NSACF to release the admission quota occupied by the UE in the slice S-NSSAI#1, wherein the first duration is the valid duration for the UE to be admitted to the slice S-NSSAI#1.
  • the third request message carries a "decrease in number" or "-" flag.
  • the NSACF saves the admission valid duration of each UE in the admitted UE list, so that the AMF can obtain the first duration from the NSACF when interacting with the NSACF.
  • the AMF sends a fourth request message to the NSACF, and the fourth request message is used to request or query the admission quota required for the UE to access slice S-NSSAI#1; the NSACF sends a fourth response message to the AMF
  • the fourth response message is used to indicate that the UE is admitted to the slice S-NSSAI#1 (that is, the admission quota of S-NSSAI#1 is not full), and the fourth response message includes the first duration.
  • the AMF stores the valid duration (that is, includes the first duration) of the admission quota of each UE.
  • the method further includes: when the first duration expires, the AMF determines that the UE has one or more PDU sessions in the slice S-NSSAI#1, that is, determines the use state of the UE in the slice S-NSSAI#1 is "not idle", the AMF automatically postpones the release of the UE's admission quota. For example, the AMF sends the third request message to the NSACF after all the one or more PDU sessions are released, that is, when the usage state of the UE slice S-NSSAI#1 is "idle".
  • the method further includes: when the first duration expires, the AMF notifies the UE that the admission quota occupied by the UE in the slice S-NSSAI#1 is about to be released, and if the UE does not initiate a request to continue using the slice, the AMF sends a request to the NSACF Send the third request message.
  • the method further includes: when the AMF notifies the UE that it is authorized to access the slice S-NSSAI#1, at the same time, it sends the first duration to the UE, and the UE can apply for updating the UE access to the slice S before the first duration expires.
  • the effective duration of NSSAI#1 is the third duration. If the UE no longer initiates a request to continue using the slice after the third duration expires, the AMF sends a third request message to the NSACF.
  • the AMF receives a third response message from the NSACF, where the third response message is used to indicate that the admission quota occupied by the UE in the slice S-NSSAI#1 has been released.
  • the previously approved admission quota is released periodically.
  • the effective period of admission that is, renewal
  • the admission quota is automatically expired and released, thereby reducing the probability of other UEs being denied slice service (DoS) .
  • Step 1 The UE initiates a slice registration request to the network (AMF), which includes the S-NSSAI of the slice to be accessed.
  • AMF the network
  • Step 2 The AMF determines whether the slice S-NSSAI that requests access needs to perform a slice authentication (ie NSSAA) process.
  • a slice authentication ie NSSAA
  • the AMF determines whether slice authentication needs to be performed for the slice S-NSSAI through the subscription information of the UE and the configuration of the slice. If slice authentication is not required, go to step 3. If slice authentication is required, skip step 3 and go to step 4.
  • the slice S-NSSAI does not need to perform slice authentication with the UE, it means that the UE can be authorized to access the slice S-NSSAI on the precondition that the UE has an admission quota in the slice S-NSSAI. Therefore, it is necessary to perform step 3 to confirm the admission quota.
  • Step 3 The AMF initiates the ACU process to the NSACF to query and update the admission quota of the slice S-NSSAI.
  • Step 4 The AMF sends a "registration result" message to the UE according to the execution of steps 2 and 3. There are three main outcomes at this point:
  • step 3 If slice S-NSSAI does not require slice authentication, step 3 is performed:
  • step 3 The result of step 3 is that there is an admission quota, and the AMF "authorizes" the UE to access the slice S-NSSAI.
  • step 3 The result of step 3 is that there is no admission quota, and the AMF "refuses to authorize" the UE to access the slice S-NSSAI.
  • step 3 If slice S-NSSAI needs slice authentication, step 3 is not performed:
  • AMF puts the slice S-NSSAI into the Pending NSSAI ("pending" NSSAI) list.
  • Step 5 Optionally, the UE responds to the AMF "registration complete" message.
  • Step 6 If it is determined in step 2 that the slice S-NSSAI needs slice authentication (that is, the S-NSSAI in the Pending NSSAI list in step 4), perform slice authentication for the slice S-NSSAI. If the slice authentication succeeds, go to step 7. Otherwise, skip step 7 and go to step 8.
  • Step 7 See Step 3.
  • Step 8 The AMF performs a UE configuration update (UE configuration update, UCU) process with the UE according to the execution results of steps 6 and 7, and updates the result of UE authorization to access the slice.
  • UE configuration update UE configuration update, UCU
  • step 7 is executed:
  • step 7 there is an admission quota: the AMF "authorizes" the UE to access the slice S-NSSAI.
  • step 7 is that there is no admission quota: the AMF "refuses to authorize" the UE to access the slice S-NSSAI.
  • step 6 slice authentication fails: AMF "denies authorization" for UE to access S-NSSAI.
  • the PLMN first executes the network slice specific authentication and authorization (NSSAA) process with the UE, and only performs admission control after the authentication is successful.
  • NSSAA network slice specific authentication and authorization
  • Process ie ACU process.
  • the AMF will reject the UE's access application, thus causing a waste of executing the NSSAA process.
  • the NSSAA process is performed between the terminal device and the AAA server of the DN, and needs to go through multiple rounds of information interaction.
  • this application proposes a slice admission control method, which improves the efficiency of the NSSAA process and saves resources by decoupling the impact of slice authentication and access quota on slice authorization.
  • FIG. 8 is a schematic flowchart of another slice admission control method proposed by the present application.
  • the AMF determines that the slice authentication of the slice S-NSSAI#1 that the UE requests to access succeeds.
  • the AMF sends a fifth request message to the NSACF, where the fifth request message is used to query and update the admission quota of the slice S-NSSAI#1 that the UE requests to access.
  • the NSACF receives the fifth request message from the AMF.
  • this step is performed when the AMF determines that the slice S-NSSAI#1 needs slice authentication.
  • the AMF receives a fifth response message from the NSACF.
  • the fifth response message is used to indicate that the slice S-NSSAI#1 has no UE quota or the slice S-NSSAI#1 is full (that is, the NSACF cannot provide the UE with The slice allocates admission slots).
  • the AMF modifies the authorization state of the UE in the slice S-NSSAI#1 to pre-authorization, where the pre-authorization means that the UE is allowed to directly access the slice S-NSSAI#1 when the slice S-NSSAI#1 has an admission quota.
  • the pre-authorization in this implementation can be understood in many ways, and the following will introduce several possible pre-authorization ways one by one.
  • Pre-authorization can be understood as: AMF replaces the authorization state of UE's slice S-NSSAI#1 from Pending NSSAI to Allowed NSSAI, that is, AMF saves and informs UE that the authorization state of slice S-NSSAI#1 is S-NSSAI #1 belongs to the Allowed NSSAI, and the UE has no admission quota in slice S-NSSAI#1.
  • the AMF saves or notifies the UE that the UE has successfully passed the slice authentication on the slice S-NSSAI#1. Since S-NSSAI#1 in method (1) belongs to Allowed NSSAI already implies that slice authentication is successful, so this step is optional.
  • the AMF may inform the UE of the fourth duration of re-access to S-NSSAI#1.
  • AMF allows the UE to directly initiate the PDU session establishment process in the pre-authorized state of mode (1). After receiving the PDU session request, AMF will still first confirm whether the slice S-NSSAI#1 has a quota. If there is no quota, the PDU session establishment process initiated by the UE will continue to be executed, and the related description is as shown in Figure 5. If there is no admission quota, the PDU session request will be rejected.
  • the AMF can keep the UE's authorization state still in the pre-authorization state, and optionally send the fifth duration (that is, it is necessary to re-initiate the PDU session establishment after the fifth duration expires) process).
  • the AMF may also update the authorization state of the UE, for example, update it to a rejected state.
  • the method for the AMF to confirm whether the slice S-NSSAI#1 has an admission quota can be described in S520 and S530, or execute the existing ACU process (described in FIG. 2 ). It can also be based on the admission control mode of AMF. For example, when the Early Admission Control mode (Early Admission Control mode) is not activated, AMF has admission quotas by default, and there is no need to execute S520 and S530 (or ACU process).
  • Early Admission Control mode Early Admission Control mode
  • the UE may wait for a period of time (if the fourth time length or the fifth time length is received, it needs to wait at least until After the fourth time period or the fifth time period), the process of establishing the PDU session is directly initiated without first initiating the registration process and the slice authentication process.
  • the UE can also re-initiate the registration process voluntarily.
  • Pre-authorization can be understood as: AMF saves and informs UE that the authorization status of slice S-NSSAI#1 is still Pending NSSAI (that is, S-NSSAI#1 belongs to Pengding NSSAI), and UE has successfully passed the slice S-NSSAI Slice #1 is authenticated, and the UE has no quota for slice S-NSSAI#1.
  • the AMF may inform the UE of the fourth duration for re-accessing the S-NSSAI#1.
  • the AMF allows the UE to directly initiate the process of establishing a PDU session in the pre-authorized state of mode (2).
  • the description of establishing the PDU session between the AMF and the UE refer to the above method (1), and will not be repeated here.
  • the AMF does not allow the UE to directly initiate the process of establishing a PDU session in the pre-authorized state of mode (2), but requires the UE to re-initiate the registration process (or service request process/UCU process). If the UE has received the fourth duration or the fifth duration, it needs to initiate after the fourth duration or the fifth duration expires.
  • the AMF receives the registration request re-initiated by the UE, unlike the existing process, since the AMF has already saved the information that "the UE has successfully passed the slice authentication of the slice S-NSSAI#1", the AMF does not need to initiate the execution of the slice authentication process. That is, in step 2 of FIG. 7 , the AMF determines that the UE does not need to (re) perform slice authentication on the slice S-NSSAI#1.
  • Pre-authorization can be understood as: AMF replaces the authorization state of UE's slice S-NSSAI#1 from Pending NSSAI to Rejected NSSAI (that is, S-NSSAI#1 belongs to Rejected NSSAI), and AMF saves and informs UE of the slice S-NSSAI
  • the authorization status of NSSAI#1 is Rejected NSSAI (that is, S-NSSAI#1 belongs to Rejected NSSAI), and the reason for the rejection is that the UE does not have an admission quota in slice S-NSSAI#1.
  • the AMF saves (and optionally notifies the UE) that the UE has successfully passed slice authentication on slice S-NSSAI#1.
  • the AMF may inform the UE of the fourth duration for re-accessing the S-NSSAI#1.
  • the AMF allows the UE to directly initiate (if the fourth duration is sent, it needs to be initiated after the expiration of the fourth duration) the process of establishing the PDU session in the pre-authorization state of mode (2).
  • the above-mentioned method 1 can be used, and details are not repeated here.
  • the AMF does not allow the UE to directly initiate the process of establishing a PDU session in the pre-authorized state of mode (2), but requires the UE to re-initiate the registration process (or service request process/UCU process). If the UE has received the fourth duration or the fifth duration, it needs to initiate after the fourth duration or the fifth duration expires.
  • the AMF receives the registration request re-initiated by the UE, unlike the existing process, since the AMF has already saved the information that "the UE has successfully passed the slice authentication of the slice S-NSSAI#1", the AMF does not need to initiate the execution of the slice authentication process. That is, in step 2 of FIG. 7 , the AMF determines that the UE does not need to (re) perform slice authentication on the slice S-NSSAI#1.
  • the UE when the UE requests to re-request access to the slice S-NSSAI#1 in the pre-authorization state, it may not need to go through the slice authentication process (in some cases, it does not need to perform the registration process), and the slice S-NSSAI# 1 When there is an admission quota, the UE is allowed to directly access the slice S-NSSAI#1, thereby saving resources of the UE and the network.
  • step 2 of Figure 7 slice S-NSSAI#1 does not require slice authentication, the AMF can also pre-authorize the UE to access the S-NSSAI#1 Import slice S-NSSAI#1.
  • the pre-authorization here can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 is Allowed NSSAI, and the UE has no admission quota in the slice S-NSSAI#1.
  • the pre-authorization here can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 is Pending NSSAI, and the UE has no admission quota in the slice S-NSSAI#1.
  • the pre-authorization here can be understood as: AMF saves and informs the UE that the authorization status of the slice S-NSSAI#1 is Rejected NSSAI, and the reason for the rejection is that the UE has no admission quota in the slice S-NSSAI#1.
  • slice S-NSSAI#1 does not require slice authentication
  • the UE when the UE requests to re-request access to slice S-NSSAI#1 in the pre-authorized state, it can directly access slice S-NSSAI# without going through the registration process 1, thereby saving resources of the UE and the network.
  • step 3 is performed regardless of whether slice authentication needs to be performed for the S-NSSAI. That is to say, even if the S-NSSAI needs slice authentication, step 3 is performed.
  • step 2 decouple step 2 from step 3, that is, whether to perform "query update quota ACU” and whether to perform "slice authentication NSSAA” to disassociate.
  • step 3 the UE requests access to multiple slices, and some of the slices require slice authentication and some do not need slice authentication, it can be executed in step 3 at one time, without the need to execute the ACU process twice ( Step 3 and Step 7). For example, UE requests to access slices S-NSSAI#1 and S-NSSAI#2, S-NSSAI#1 requires slice authentication, and S-NSSAI#2 does not need slice authentication.
  • step 3 needs to be performed for S-NSSAI#2, but step 3 does not need to be performed for S-NSSAI#1, and step 7 needs to be executed after the slice authentication is successful, and the ACU process is performed twice in total.
  • step 3 the ACU process for the two slices S-NSSAI#1 and S-NSSAI#2 can be executed at one time, thereby saving one ACU process.
  • FIG. 9 is a schematic block diagram of a communication device 1000 provided in this application. As shown in FIG. 9 , the communication device 1000 includes a sending unit 1100 and a receiving unit 1200 .
  • the sending unit 1100 is configured to, when there is no protocol data unit PDU session of the terminal device in the first slice or when the duration of the terminal device's access to the first slice exceeds the first duration, to the network slice admission control function network element
  • the NSACF sends a first request message, where the first request message is used to request the NSACF to release the admission quota of the first slice occupied by the terminal device, and the first duration is the admission quota of the terminal device
  • the receiving unit 1200 is configured to receive a first response message from the NSACF, where the first response message is used to indicate that the admission quota of the first slice occupied by the terminal device has been released.
  • the sending unit sending the first request message includes: when the terminal device is in the When the last PDU session in the first slice has been released, the sending unit 1100 is configured to send the first request message to the NSACF; or, the terminal device is in the first request message within the second duration When the PDU session of the terminal device is not successfully established in any slice, the sending unit 1100 is configured to send a first request message to the NSACF, wherein the second duration is from the AMF to authorize the terminal device to access The first slice starts timing.
  • the communication device 1000 further includes: a processing unit 1300, configured to perform processing or operations performed internally by the access and mobility management functional network element in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • a processing unit 1300 configured to perform processing or operations performed internally by the access and mobility management functional network element in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • the processing unit 1300 is configured to send the terminal device in the first slice
  • the authorization state is changed to a pre-authorization state, and the pre-authorization state indicates that the terminal device is allowed to directly access the first slice when the first slice has an admission quota.
  • the receiving unit 1200 is further configured to receive a second request message from the terminal device, where the second request message is used to request the terminal device to A first PDU session is established in the slice; the sending unit 1100 is further configured to send a first message to the NSACF, and the first message is used to confirm whether the first slice has an admission quota for the terminal device The receiving unit 1200 is further configured to receive a second response message from the NSACF, where the second response message is used to indicate whether the first slice has an admission quota for the terminal device.
  • the sending unit 1100 and the receiving unit 1200 may also be integrated into a transceiver unit, which has both receiving and sending functions, which is not limited here.
  • the communication device 1000 may be the access and mobility management functional network element in the method embodiment.
  • the sending unit 1100 may be a transmitter
  • the receiving unit 1200 may be a receiver. Receiver and transmitter can also be integrated into a transceiver.
  • the processing unit 1300 may be a processing device.
  • the communication device 1000 may be a chip or an integrated circuit installed in a network element with an access and mobility management function.
  • the sending unit 1100 and the receiving unit 1200 may be communication interfaces or interface circuits.
  • the sending unit 1100 is an output interface or an output circuit
  • the receiving unit 1200 is an input interface or an input circuit
  • the processing unit 1300 may be a processing device.
  • the functions of the processing device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the processing device may include a memory and a processor, wherein the memory is used to store computer programs, and the processor reads and executes the computer programs stored in the memory, so that the communication device 1000 executes the access and mobility management method in each method embodiment. Operations and/or processing performed by a functional network element.
  • the processing means may comprise only a processor, and the memory for storing the computer program is located outside the processing means.
  • the processor is connected to the memory through circuits/wires to read and execute the computer programs stored in the memory.
  • the processing device may be a chip or an integrated circuit.
  • FIG. 10 is a schematic block diagram of a communication device 2000 provided in this application. As shown in FIG. 10 , the communication device 2000 includes a processing unit 2100 and a sending unit 2200 .
  • the processing unit 2100 determines that the authorization state of the terminal device in the first slice is a pre-authorization state, and the pre-authorization state indicates that the terminal device is allowed to directly access the second slice when the first slice has an admission quota. a slice;
  • a sending unit 2200 configured to send a second request message to an access and mobility management functional network element AMF, where the second request message is used to request the terminal device to establish a second request message in the first slice.
  • a protocol data unit PDU session configured to send a second request message to an access and mobility management functional network element AMF, where the second request message is used to request the terminal device to establish a second request message in the first slice.
  • the communication apparatus 2000 further includes a receiving unit 2300, configured to perform the receiving action performed by the terminal device in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • a receiving unit 2300 configured to perform the receiving action performed by the terminal device in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • the sending unit 2200 and the receiving unit 2300 may also be integrated into a transceiver unit, which has both receiving and sending functions, which is not limited here.
  • the communications apparatus 2000 may be the terminal device in the method embodiment.
  • the sending unit 2200 may be a transmitter
  • the receiving unit 2300 may be a receiver. Receiver and transmitter can also be integrated into a transceiver.
  • the processing unit 2100 may be a processing device.
  • the communication apparatus 2000 may be a chip or an integrated circuit installed in a terminal device.
  • the sending unit 2200 and the receiving unit 2300 may be communication interfaces or interface circuits.
  • the sending unit 2200 is an output interface or an output circuit
  • the receiving unit 2300 is an input interface or an input circuit
  • the processing unit 2100 may be a processing device.
  • the functions of the processing device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the processing device may include a memory and a processor, where the memory is used to store computer programs, and the processor reads and executes the computer programs stored in the memory, so that the communication device 2000 executes the operations and operations performed by the terminal device in each method embodiment. /or processing.
  • the processing means may comprise only a processor, and the memory for storing the computer program is located outside the processing means.
  • the processor is connected to the memory through circuits/wires to read and execute the computer programs stored in the memory.
  • the processing device may be a chip or an integrated circuit.
  • FIG. 11 is a schematic structural diagram of a communication device 10 provided in the present application.
  • the communication device 10 includes: one or more processors 11 , one or more memories 12 and one or more communication interfaces 13 .
  • the processor 11 is used to control the communication interface 13 to send and receive signals
  • the memory 12 is used to store a computer program
  • the processor 11 is used to call and run the computer program from the memory 12, so that the access and mobile
  • the processes and/or operations performed by the network element with the performance management function are executed.
  • the processor 11 may have the functions of the processing unit 1100 shown in FIG. 9
  • the communication interface 13 may have the functions of the sending unit 1100 and/or the receiving unit 1200 shown in FIG. 9 .
  • the processor 11 can be used to execute the processing or operation performed by the access and mobility management functional network element in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application, and the communication interface 13 is used to execute the corresponding The sending and/or receiving actions performed by the access and mobility management functional network element in each method embodiment.
  • the communication device 10 may be a network element with an access and mobility management function in the method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • the communication interface 13 may be a transceiver.
  • a transceiver may include a receiver and a transmitter.
  • the processor 11 may be a baseband device, and the communication interface 13 may be a radio frequency device.
  • the communication device 10 may be a chip installed in an access and mobility management functional network element.
  • the communication interface 13 may be an interface circuit or an input/output interface.
  • FIG. 12 is a schematic structural diagram of a communication device 20 provided in the present application.
  • the communication device 20 includes: one or more processors 21 , one or more memories 22 and one or more communication interfaces 23 .
  • the processor 21 is used to control the communication interface 23 to send and receive signals
  • the memory 22 is used to store a computer program
  • the processor 21 is used to call and run the computer program from the memory 22, so that the method embodiment corresponding to FIG. 3 or FIG. 6 of this application
  • the processes and/or operations performed by the terminal device are performed.
  • the processor 21 may have the functions of the processing unit 2100 shown in FIG. 10
  • the communication interface 23 may have the functions of the sending unit 2200 and/or the receiving unit 2300 shown in FIG. 10 .
  • the processor 21 may be used to execute the processing or operations performed internally by the terminal device in each method embodiment corresponding to FIG. 3 or FIG. 6 of this application, and the communication interface 23 is used to execute the method corresponding to FIG. 3 or FIG. 6 of this application.
  • the sending and/or receiving actions performed by the terminal device in the embodiment will not be described again.
  • the communication device 20 may be a terminal device in each method embodiment corresponding to FIG. 3 or FIG. 6 of this application.
  • the communication interface 13 may be a transceiver.
  • a transceiver may include a receiver and a transmitter.
  • the processor 21 may be a baseband device, and the communication interface 23 may be a radio frequency device.
  • the communication device 20 may be a chip installed in a terminal device.
  • the communication interface 23 may be an interface circuit or an input/output interface.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种切片准入控制的方法和通信装置，该方法包括：以单个切片为颗粒度，对每个UE的每个切片，根据UE的切片使用状态是否为空闲态，或者，通过设置UE准入切片的有效时长来确定释放UE在切片所占用的名额，从而避免UE即使不使用切片，也长时间霸占切片配额的情况，进而降低其他UE被拒绝切片服务的概率。

Description

切片准入控制的方法和通信装置
本申请要求于2021年6月30日提交中国国家知识产权局、申请号为202110734233.4、申请名称为“切片准入控制的方法和通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种切片准入控制的方法和通信装置。
背景技术
目前，一个终端设备可以注册多个切片，当终端设备进行切片注册时，网络针对终端设备请求接入的每个切片单独考虑，即以每个切片为颗粒度，分配切片的准入名额，切片与切片之间的准入不存在互相关联。但是当终端设备去注册时，网络并不是以终端设备所接入的每个切片为单位(颗粒度)进行撤销，而是必须一次性地同时将终端设备所接入的所有切片进行撤销。主要原因是终端设备的切片准入控制目前是与终端设备的注册和去注册流程进行绑定(关联)，注册流程是以切片为颗粒度，一个切片一个切片(同时或不同时)地接入，而去注册流程并不以切片为颗粒度，而是当终端设备退出所有切片时，PLMN才会触发去注册流程，或者当PLMN触发去注册流程时，终端设备需要退出所有切片。
因此，上述流程会导致终端设备长时间的霸占不使用的切片配额。一个网络通常会有成百上千的终端设备，每个终端设备都存在这个问题的话，会严重占用网络资源，并造成其他终端设备被拒绝切片服务(denial of services，DoS)。
发明内容
本申请提供一种切片准入控制的方法和通信装置，能够减少资源浪费，降低其他终端设备被拒绝切片服务(DoS)的概率。
第一方面，提供了一种切片准入控制的方法，包括：当第一切片中不存在终端设备的协议数据单元PDU会话时或终端设备被准入第一切片的时长超过第一时长时，接入与移动性管理功能网元AMF向网络切片准入控制功能网元NSACF发送第一请求消息，第一请求消息用于请求NSACF释放终端设备占用的第一切片的准入名额；AMF接收来自NSACF的第一响应消息，第一响应消息用于指示终端设备占用的第一切片的准入名额已被释放。
上述技术方案中，相对于现有去注册流程而言，以单个切片为颗粒度，对每个UE的每个切片，根据UE在第一切片不存在PDU会话(即是否空闲)释放UE所占用的第一切片的准入名额，从而避免UE即使不使用切片，也长时间霸占切片配额的情况，降低其他UE被拒绝切片服务的概率。
结合第一方面，在第一方面的某些实现方式中，当在第一切片中不存在终端设备的协议数据单元PDU会话时，AMF向NSACF发送第一请求消息，包括：当终端设备在第一切片中的最后一个PDU会话已经被释放时，AMF向NSACF发送第一请求消息；或者，在第二时长内在第一切片中没有成功建立终端设备的PDU会话时，AMF向NSACF发送第一请求消息，其中，第二时长从AMF授权终端设备接入第一切片开始计时。
结合第一方面，在第一方面的某些实现方式中，AMF接收来自NSACF发送的第一响应消息之后，该方法还包括：AMF将终端设备在第一切片的授权状态修改为预授权，预授权表示终端设备在第一切片有准入名额时被允许直接接入第一切片。
现有流程中如果UE在第一切片中没有名额，UE的授权状态为“拒绝授权”，那么当UE希望在第一切片建立PDU会话或再次接入第一切片时，UE需要首先向AMF发起切片注册请求(Registration Request)或服务请求(Service Request)流程，在AMF完成切片注册且授权UE接入第一切片后，UE才能向AMF发起PDU会话建立请求。而本实施例中，UE在没有名额的预授权状态下，可以不需要再经过注册流程，直接申请在第一切片建立PDU会话，从而可以节省UE和网络的资源。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：AMF从终端设备接收第二请求消息，第二请求消息用于请求终端设备在第一切片中建立第一PDU会话；AMF向NSACF发送第一消息，第一消息用于确认第一切片是否有终端设备的准入名额；AMF接收来自NSACF的第二响应消息，第二响应消息用于指示终端设备被准入第一切片(即占用了第一切片的准入名额)或第一切片没有准入名额。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：第二响应消息用于指示终端设备被准入第一切片，AMF授权终端设备接入第一切片；AMF继续建立第一PDU会话的流程(即AMF向SMF发送消息，用于请求建立终端设备的第一PDU会话)；或者，第二响应消息用于指示第一切片没有准入名额，AMF拒绝建立第一PDU会话。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：AMF将终端设备在第一切片的授权状态修改为拒绝授权，拒绝授权表示终端设备不被允许接入第一切片。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：AMF向终端设备发送第二消息，第二消息用于通知终端设备在第一切片中的授权状态。
第二方面，提供了一种切片准入控制的方法，包括：终端设备确定终端设备在第一切片的授权状态为预授权状态，预授权状态表示终端设备在第一切片有准入名额时被允许直接接入第一切片；终端设备向接入与移动性管理功能网元AMF发送第二请求消息，第二请求消息用于请求终端设备在第一切片中建立第一协议数据单元PDU会话。
上述技术方案中，UE在没有名额的预授权状态下，可以不需要再经过注册流程，直接申请在第一切片建立PDU会话，从而可以节省UE和网络的资源。
第三方面，提供了一种切片准入控制的方法，包括：接入与移动性管理功能网元AMF在第一时长到期后，向网络切片准入控制功能网元NSACF发送第三请求消息，第三请求消息用于请求NSACF释放终端设备占用的第一切片的准入名额，其中，第一时长为终端设备被准入第一切片的有效时长；AMF从NSACF接收第三响应消息，第三响应消息用于指示终端设备占用的第一切片的准入名额已被释放。
上述技术方案中，相对于现有去注册流程而言，以单个切片为颗粒度，对每个UE的每个切片，根据UE在第一切片不存在PDU会话(即是否空闲)释放UE所占用的第一切片的准入名额，从而避免UE即使不使用切片，也长时间霸占切片配额的情况，降低其他UE被拒绝切片服务的概率。
结合第三方面，在第三方面的某些实现方式中，在AMF授权终端设备接入第一切片之前，该方法还包括：AMF向NSACF发送第四请求消息，第四请求消息用于请求终端设备接入第一切片；AMF从NSACF接收第四响应消息，第四响应消息用于指示终端设备准入第一切片，且第四响应消息包括第一时长。
结合第三方面，在第三方面的某些实现方式中，第一时长存储在AMF中。
结合第三方面，在第三方面的某些实现方式中，AMF在第一时长到期后，该方法还包括：AMF确定终端设备在第一切片中存在一个或多个协议数据单元PDU会话；AMF在一个或多个PDU会话全部释放后，向NSACF发送第三请求消息。
结合第三方面，在第三方面的某些实现方式中，AMF在第一时长到期后，该方法还包括：AMF向终端设备发送第四消息，第四消息用于通知终端设备AMF将释放终端设备在第一切片占用的准入名额；AMF从终端设备接收第五消息，第五消息用于指示终端设备不需要继续使用第一切片；AMF向NSACF发送第三请求消息。
结合第三方面，在第三方面的某些实现方式中，该方法还包括：AMF在终端设备被授权接入第一切片时，向终端设备发送第六消息，第六消息包括第一时长；AMF在第一时长到期之前从终端设备接收第七消息，第七消息用于请求AMF更新终端设备准入第一切片的有效时长为第三时长。
第四方面，提供了一种切片准入控制的方法，包括：网络切片准入控制功能网元NSACF从接入与移动性管理功能网元AMF接收第四请求消息，第四请求消息用于请求终端设备接入第一切片；NSACF向AMF发送第四响应消息，第四响应消息用于指示终端设备被准入第一切片，且第四响应消息包括第一时长，其中，第一时长为终端设备准入第一切片有效时长。
第五方面，提供了一种切片准入控制的方法，包括：终端设备从接入与移动性管理功能网元AMF接收第六消息，第六消息包括第一时长，其中，第一时长为终端设备准入第一切片的有效时长。终端设备在第一时长到期之前，向AMF发送第七消息，第七消息用于请求AMF更新终端设备准入第一切片的有效时长为第三时长。
第六方面，提供了一种切片准入控制的方法，包括：接入与移动性管理功能网元AMF确定终端设备请求接入的第一切片的网络切片认证授权NSSAA成功；AMF向网络切片准入控制功能网元NSACF发送第五请求消息，第五请求消息用于请求终端设备接入第一切片；AMF从NSACF接收第五响应消息，第五响应消息用于指示第一切片没有准入名额；AMF将终端设备在第一切片的授权状态修改为预授权，预授权表示终端设备在第一切片有准入名额时允许直接接入第一切片；或者，AMF将终端设备在第一切片的授权状态修改为拒绝授权，并记录终端设备已经成功通过第一切片的NSSAA，其中，拒绝授权表示终端设备被拒绝接入第一切片。
上述技术方案中，UE在预授权状态下请求重新请求接入第一切片时，可以不需要再经过注册流程和/或切片认证流程，在第一切片有准入名额时允许UE直接接入第一切片， 从而节省UE和网络的资源；或者，UE在拒绝授权状态下请求重新请求接入第一切片时，由于AMF存储了“切片认证成功”状态，不必再一次发起切片认证流程，从而也可以节省UE和网络的资源。第八方面，本申请提供一种通信装置，通信装置具有实现第一方面或其任意可能的实现方式中的方法的功能，或者具有实现第三方面或其任意可能的实现方式中的方法的功能，或者具有实现第六方面或其任意可能的实现方式中的方法的功能。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。
第八方面，本申请提供一种通信装置，通信装置具有实现第二方面或其任意可能的实现方式中的方法的功能，或者具有实现第五方面或其任意可能的实现方式中的方法的功能。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。
第九方面，本申请提供一种通信装置，通信装置具有实现第四方面或其任意可能的实现方式中的方法的功能。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。
第十方面，本申请提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得通信设备执行第一方面或其任意可能的实现方式中的方法，或者执行第三方面或其任意可能的实现方式中的方法，或者执行第六方面或其任意可能的实现方式中的方法。
在一个示例中，该通信装置可以为接入与移动性管理功能网元。
在另一个示例中，该通信装置可以为安装在接入与移动性管理功能网元内的部件(例如：芯片或集成电路)。
第十一方面，本申请提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得通信设备执行第二方面或其任意可能的实现方式中的方法，或者执行第五方面或其任意可能的实现方式中的方法。
在一个示例中，该通信装置可以为终端设备。
在另一个示例中，该通信装置可以为安装在终端设备内的部件(例如：芯片或集成电路)。
第十二方面，本申请提供一种通信设备，包括至少一个处理器，至少一个处理器与至少一个存储器耦合，至少一个存储器用于存储计算机程序或指令，至少一个处理器用于从至少一个存储器中调用并运行该计算机程序或指令，使得通信设备执行第四方面或其任意可能的实现方式中的方法。
在一个示例中，该通信装置可以为切片准入控制功能网元。
在另一个示例中，该通信装置可以为安装在切片准入控制功能网元内的部件(例如：芯片或集成电路)。
第十三方面，本申请提供一种计算机程序产品，所述计算机程序产品包括计算机程序代码，当所述计算机程序代码在计算机上运行时，使得如第一方面或其任意可能的实现方 式中的方法被执行，或者使得如第三方面或其任意可能的实现方式中的方法被执行，或者使得如第六方面或其任意可能的实现方式中的方法被执行。
第十四方面，本申请提供一种计算机程序产品，所述计算机程序产品包括计算机程序代码，当所述计算机程序代码在计算机上运行时，使得如第二方面或其任意可能的实现方式中的方法被执行，或者使得如第五方面或其任意可能的实现方式中的方法被执行。
第十五方面，本申请提供一种计算机程序产品，所述计算机程序产品包括计算机程序代码，当所述计算机程序代码在计算机上运行时，使得如第四方面或其任意可能的实现方式中的方法被执行。
第十六方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得如第一方面或其任意可能的实现方式中的方法被执行，或者使得如第三方面或其任意可能的实现方式中的方法被执行，或者使得如第六方面或其任意可能的实现方式中的方法被执行。
第十七方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得如第二方面或其任意可能的实现方式中的方法被执行，或者使得如第五方面或其任意可能的实现方式中的方法被执行。
第十八方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令，当计算机指令在计算机上运行时，使得如第四方面或其任意可能的实现方式中的方法被执行。
附图说明
图1是本申请实施例的一种网络架构示意图。
图2是查询网络切片可用性及终端数量更新的流程的示意图。
图3是本申请提出一种切片准入控制的方法的示意性流程图。
图4是目前终端设备在切片的准入名额被取消后UE发起PDU会话的示意性流程图。
图5是本申请提出的一种终端设备在预授权状态下发起PDU会话的示意性流程图。
图6是本申请提出另一种切片准入控制的方法的示意性流程图。
图7是目前包括切片认证的UE切片注册的示意性流程图。
图8是本申请提出又一种切片准入控制的方法的示意性流程图。
图9为本申请提供的通信装置1000的示意性框图。
图10为本申请提供的通信装置2000的示意性框图。
图11为本申请提供的通信装置10的示意性结构图。
图12为本申请提供的通信装置20的示意性结构图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请提供的技术方案可以应用于各种通信系统。一个通信系统中，由运营者运营的部分可称为公共陆地移动网络(public land mobile network，PLMN)(也可以称为运营商网络等)。PLMN是由政府或其所批准的经营者，为公众提供陆地移动通信业务目的而建立和经营的网络，主要是移动网络运营商(mobile network operator，MNO)为用户提供移 动宽带接入服务的公共网络。本申请中所描述的PLMN，具体可为符合第三代合作伙伴项目(3rd generation partnership project，3GPP)标准要求的网络，简称3GPP网络。3GPP网络通常包括但不限于第五代移动通信(5th-generation，5G)网络(简称5G网络)、第四代移动通信(4th-generation，4G)网络(简称4G网络)以及未来的其他通信系统如6G网络等。为了方便描述，本申请实施例中将以PLMN或5G网络为例进行说明。
参见图1，图1是本申请实施例的一种网络架构示意图，它以3GPP标准化过程中定义的非漫游场景下基于服务化架构的5G网络架构为例。该网络架构可以包括三部分，分别是终端设备部分、PLMN和数据网络(data network，DN)。
终端设备部分可以包括终端设备110，该终端设备110也可以称为用户设备(user equipment，UE)。本申请中的终端设备110是一种具有无线收发功能的设备，可以经无线接入网(radio access network，RAN)140中的接入网设备(或者也可以称为接入设备)与一个或多个核心网(core network，CN)设备(或者也可以称为核心设备)进行通信。终端设备110也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、用户代理或用户装置等。终端设备110可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端设备110可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、智能电话(smart phone)、手机(mobile phone)、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)等。或者，终端设备110还可以是具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它设备、车载设备、可穿戴设备、无人机设备或物联网、车联网中的终端、5G网络以及未来网络中的任意形态的终端、中继用户设备或者未来演进的6G网络中的终端等。其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。例如终端设备110可以是虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。本申请实施例对终端设备的类型或种类等并不限定。应理解，本申请中终端设备和UE可以互相替换。
PLMN可以包括但不限于：网络开放功能(network exposure function，NEF)131、网络存储功能(network function repository function，NRF)132、策略控制功能(policy control function，PCF)133、统一数据管理功能(unified data management，UDM)134、网络切片选择功能(network slice selection function,NSSF)135、认证服务器功能(authentication server function，AUSF)136、接入与移动性管理功能(access and mobility management function，AMF)137、会话管理功能(session management function，SMF)138、用户面功能(user plane function，UPF)139、(无线)接入网((radio)access network，(R)AN)140、网络切片准入控制功能(Network Slice Admission Control Function，NSACF)141、网络切片认证授权功能(Network Slice Specific Authentication and Authorization Function，NSSAAF)142等。上述PLMN中，除(无线)接入网140部分之外的部分可以称为核心网(core network，CN)部分。
数据网络DN 120，也可以称为分组数据网络(packet data network，PDN)，通常可以部署在PLMN之外，例如第三方网络(当然，DN也有可能部署在PLMN内，此处不做限制)。示例性的，PLMN可以接入多个数据网络DN 120，数据网络DN 120上可部署多种业务，从而为终端设备110提供数据和/或语音等服务。例如，数据网络DN 120可以是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备110，数据网络DN120中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，数据网络DN 120可以是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备110，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。终端设备110可通过PLMN提供的接口(例如图1中的N1接口等)与PLMN建立连接，使用PLMN提供的数据和/或语音等服务。终端设备110还可通过PLMN访问数据网络DN 120，使用数据网络DN 120上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为PLMN和终端设备110之外的服务方，可为终端设备110提供其他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
示例性地，下面对PLMN中的网络功能进行简要介绍。
1、(R)AN 140是PLMN的子网络，是PLMN中业务节点(或网络功能)与终端设备110之间的实施系统。终端设备110要接入PLMN，首先是经过(R)AN 140，进而通过(R)AN 140与PLMN中的业务节点连接。本申请实施例中的(R)AN 140，可以指代接入网本身，也可以指接入网设备，此处不作区分。接入网设备是一种为终端设备110提供无线通信功能的设备，也可以称为接入设备、(R)AN设备或网络设备等。该接入网设备包括但不限于：5G系统中的下一代基站(next generation node basestation，gNB)、LTE系统中的演进型基站(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输接收点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本申请对接入网设备的具体类型不作限定。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。
可选的，在接入设备的一些部署中，接入设备可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)等。在接入设备的另一些部署中，CU还可以划分为CU-控制面(control plane，CP)和CU-用户面(user plan，UP)等。在接入设备的又一些部署中，接入设备还可以是开放的无线接入网(open radio access network，ORAN)架构等，本申请对于接入设备的具体部署方式不作限定。
2、网络开放功能NEF(也可以称为网络开放功能实体)131是由运营商提供的控制面功能，主要使能第三方使用网络提供的服务。
3、网络存储功能NRF 132，是由运营商提供的控制面功能，可用于维护网络中所有网络功能服务的实时信息。
4、策略控制功能PCF 133是由运营商提供的控制面功能，它支持统一的策略框架来 治理网络行为、向其他控制功能提供策略规则、策略决策相关的签约信息等。
5、统一数据管理功能UDM 134是由运营商提供的控制面功能，负责存储PLMN中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、安全上下文(security context)、签约数据等信息。
6、网络切片选择功能(network slice selection function，NSSF)135，是由PLMN提供的控制面网络功能，用于负责确定网络切片实例，选择AMF网络功能137等。
7、认证服务器功能AUSF 136是由运营商提供的控制面功能，通常用于一级认证，即终端设备110(签约用户)与PLMN之间的认证。
8、接入与移动性管理功能AMF 137是由PLMN提供的控制面网络功能，负责终端设备110接入PLMN的接入控制和移动性管理，包括移动状态管理，分配用户临时身份标识，对用户进行认证和授权等功能。
9、会话管理功能SMF 138是由PLMN提供的控制面网络功能，负责管理终端设备110的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与DN 120互相传输数据。PDU会话可以由SMF 138负责建立、维护和删除等。SMF 138包括会话管理(如会话建立、修改和释放，包含UPF139和(R)AN 140之间的隧道维护等)、UPF 139的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
10、用户面功能UPF 139是由运营商提供的网关，是PLMN与DN 120通信的网关。UPF 139包括数据包路由和传输、包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
11、网络切片准入控制功能(Network Slice Admission Control Function，NSACF)141是PLMN用来监测并控制注册在网络切片上的终端设备数量的网络功能。通常NSACF上配置了每个受其监测和控制的网络切片中，最多可以服务的终端设备的数量。
12、网络切片认证授权功能(network slice specific authentication and authorization function，NSSAAF)142，是由PLMN提供的控制面网络功能，用于支持终端110与DN进行的切片认证。
图1所示的PLMN中的网络功能还可以包括统一数据存储(unified data repository，UDR)等(图中未示出)，本申请实施例对于PLMN中包括的其他网络功能不作限定。
图1中Nnef、Nnrf、Npcf、Nudm、Nnssf、Nausf、Namf、Nsmf、Nnssaaf、Nnsacf、N1、N2、N3、N4，以及N6为接口序列号。示例性的，上述接口序列号的含义可参见3GPP标准协议中定义的含义，本申请对于上述接口序列号的含义不做限制。需要说明的是，图1中仅以终端设备110为UE作出了示例性说明，图1中的各个网络功能之间的接口名称也仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请对此不作限定。
应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。例如：本申请中的移动性管理网络功能可以是图1所示的AMF 137，也可以是未来通信系统中的 具有上述接入与移动性管理功能AMF 137的其他网络功能。或者，本申请中的移动性管理网络功能还可以是LTE系统中的移动管理实体(mobility management entity，MME)等。
为方便说明，本申请实施例中将接入与移动性管理功能AMF 137简称为AMF，将终端设备110称为UE，将网络切片准入控制功能NSACF141简称为NSACF，即本申请实施例中后文所描述的AMF均可替换为移动性管理网络功能，UE均可替换为终端设备，NSACF均可替换为网络切片准入控制功能。
图1中示出的网络架构示意图可以理解为一种非漫游场景下基于服务的架构。在该基于服务的架构中，PLMN可以根据特定场景需求，将部分或全部网络功能按需有序组合，实现网络的能力与服务的定制化，从而为不同业务部署专用网络，即实现5G网络切片(network slicing)。网络切片技术可以使运营商能够更加灵活、快速地响应客户需求，支持网络资源的灵活分配。为便于理解本申请，下面对网络切片进行进一步描述。
网络切片(也可简称切片)简单理解就是将运营商的物理网络分成多个虚拟的端到端的网络，每个虚拟的网络之间(包括网络内的设备、接入网、传输网和核心网)是逻辑独立的，避免任何一个虚拟网络发生故障影响到其它虚拟网络。为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同业务类型的实例可以部署在不同的网络切片上，相同业务类型的不同实例(instance)也可部署在不同的网络切片上。切片可以由一组网络功能(network function，NF)和/或子网络构成。比如，图1中的子网络(R)AN 140、AMF 137、SMF 138、UPF 139可以组成一个切片。可理解，图1中的每种网络功能只示意性地画出了一个，而在实际网络部署中，每种网络功能或子网络可以有多个、数十个。PLMN中可以部署很多切片，每个切片可以有不同的性能来满足不同应用、不同垂直行业的需求。运营商可以根据不同垂直行业客户的需求，“量身定做”一个切片。
当UE需要接入到网络中的某个切片时，UE可以在上行消息(即UE发给网络的消息，如注册请求registration request,服务请求service request，周期注册更新Periodic Registration Update等。为了描述方便，下面描述为“请求消息”)中提供或指示核心网UE想要接入的切片。通常，想要接入的切片的指示信息被称为请求的(requested)“网络切片选择辅助信息集合”(network slice selection assistance information，NSSAI)。该NSSAI实际上是一个列表或集合，其中包括了一个或多个单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)，一个S-NSSAI用于标识一个网络切片(也可以是一种网络切片类型)，也可以理解为，S-NSSAI是切片的标识信息。
另外，在标准中还定义了网络切片实例标识符(Network Slice Instance Identifier/Identity，NSI-ID)的概念，一个S-NSSAI所标识的切片还可以实例化成一个或多个切片实例(slice instance)，每个NSI-ID对应一个切片实例。也可以说，NSI-ID也可以称为切片的标识信息，一个S-NSSAI又可以对应于多个NSI-ID。本申请以S-NSSAI为例进行描述，对S-NSSAI和NSI-ID不作严格区分、限定，对S-NSSAI的描述，同样也可以适用于NSI-ID。
运营商(PLMN)在部署切片时，也可以允许一些切片客户享有较大的自主权，参与切片的部分管理、控制功能。其中，切片级的认证就是由切片客户有限参与的一种网络控制功能，即对终端设备接入切片进行认证和授权，即“切片级认证”，也可称为“二级认 证”、“二次认证”等，本申请简称为“切片认证”。
终端设备在被允许接入网络切片之前，首先需要与PLMN网络进行一次“网络级认证”，即PLMN要基于终端设备所使用的与PLMN签约的签约识别信息进行认证，这种认证通常被称为一级认证(primary authentication)。其次，PLMN要基于终端设备所使用的与DN的签约标识进行的认证，即“切片认证”。
由图1中的描述可知，NSACF是5G标准中新定义的网络功能，它是PLMN用来保存、更新并控制注册在网络切片上的终端设备数量的网络功能。具体地说，PLMN会在NSACF上先配置每个网络切片中最多可以服务的终端设备的数量，或称为配额(quota)、准入限额，当网络授权新的终端接入该切片时或是终端去注册时，NSACF根据该配额，确定网络切片是否还可以接纳新的终端接入请求，并实时存储、更新切片中已经准入的终端数量。需要说明的是，这里的网络切片是指需要进行准入控制(admission control)的网络切片，且该网络切片是由当前NSACF负责监视和控制。在以下描述中，如无特别说明，所有网络切片均属此类需要进行准入控制的切片。下面结合5G标准中定义的具体流程，进一步进行说明。
在5G标准中，目前定义了查询网络切片可用性及终端数量更新的基本流程，如图2所示。该流程描述了在NSACF上对注册在切片(标识为S-NSSAI)上的终端数量的更新(即准入的终端设备的数量增加或减少)的过程。PLMN在AMF上事先配置了哪些切片S-NSSAI需要进行这样的流程(即需要进行准入控制的切片)，对于这些需要进行准入控制的切片，由AMF触发并向NSACF发送“可用性查询和更新”(availability check and update，ACU)的请求，以下简称ACU请求。
步骤1：AMF触发ACU流程。
根据当前标准规定，AMF在为终端设备进行注册、去注册、配置更新(UE configuration update，UCU)、切片认证服务器(即“认证、授权、计费”服务器，或authentication,authorization,and accounting server，这里简称AAA服务器)发起的重认证和授权吊销等流程时(这里的“时”代表执行该流程之前、该流程过程中或该流程之后)，会触发ACU流程。
AMF决定触发ACU流程时，首先会验证标识为S-NSSAI的切片是PLMN允许该终端设备接入的切片，即AMF验证切片S-NSSAI在该终端对应的“允许接入的NSSAI列表”(即Allowed NSSAI)中。如果验证该S-NSSAI在该终端对应的“允许接入的NSSAI列表”中，则AMF会向NSACF发送针对该S-NSSAI的ACU请求，即执行步骤2。
应理解，Allowed NSSAI是指被允许或被授权的NSSAI，表示UE请求的NSSAI中，哪些S-NSSAI被网络允许接入或被授权接入，AMF会在注册接受消息(Registration Accept)的"Allowed NSSAI"信息元素(information element，IE)中发送给UE。
步骤2：AMF向NSACF发送ACU请求。
该请求中包括了终端设备标识(S-NSSAI)，以及更新标识(flag)。这个flag用于指示该请求是用于请求“数量增加”(如注册时)还是“数量减少”(如去注册时)。
步骤3：NSACF收到请求后，根据其所存储的该切片S-NSSAI的准入状态，即当前已经准入的终端设备及数量，确定如何响应AMF的ACU请求。
如果AMF请求携带“数量增加”或“+”的标识(flag)：NSACF先检查该终端设 备是否已经计入了该切片S-NSSAI准入的终端设备，如果是，则准入的终端设备数量计数器保持不变，并准备回复AMF，切片准入名额未满，即该终端设备准入该切片S-NSSAI；反之，则继续检查当前准入的终端设备数量是否少于该切片S-NSSAI的准入配额。如果配额足够(即准入的终端设备总数量不会超过配额)，NSACF将该终端设备计入准入的终端列表，并将已准入的计数器增加1(即更新存储的已经准入的终端设备的数量为+1)，并准备回复AMF，切片准入名额未满，即该终端设备准入。如果配额已满，则计数器不变，并准备回复AMF，指示配额已满，即拒绝该终端设备。
如果AMF请求携带“数量减少”或“-”的标识(flag)：NSACF将该终端设备的标识从准入终端设备列表中删除，并将该终端设备已准入的所有切片S-NSSAI的计数器减少1。
步骤4：NSACF根据步骤3判断后，给AMF发送ACU响应，AMF可以相应地做出处理。
例如，ACU响应指示该切片S-NSSAI的准入配额未满(即该终端准入并已经纳入了该切片的准入名额)，则AMF授权终端设备接入切片S-NSSAI，向终端设备通知终端设备请求接入的切片S-NSSAI的授权状态，即终端设备请求接入的切片S-NSSAI属于Allowed NSSAI。
如果ACU响应指示该切片S-NSSAI的准入配额已满，则AMF拒绝授权终端设备接入切片S-NSSAI，向终端设备通知终端设备请求接入的切片S-NSSAI的授权状态，即终端设备请求接入的切片S-NSSAI属于Rejected NSSAI，同时附上拒绝原因：切片配额已满。
可选地，AMF可以通知终端设备等待一段时间后再接入(即开启相关计时器，计时器停止时可重新发起注册请求)。
应理解，Rejected NSSAI是指拒绝NSSAI，表示终端设备请求接入的NSSAI中，哪些S-NSSAI被AMF拒绝了，AMF会在注册接收消息(Registration Accept)中的"Rejected NSSAI"IE发送给终端设备。
通过图2中的描述可以看出，终端设备在注册时与去注册时，PLMN(如AMF和NSACF)对该终端设备准入的控制颗粒度(基本单位)不匹配，容易造成切片配额的滥用和资源浪费。
具体来说，当终端设备注册时，PLMN针对终端设备请求接入的每个切片(S-NSSAI)单独考虑，即以每个切片为颗粒度，分配准入名额，切片与切片之间的准入不存在互相关联。但是当终端设备去注册时，PLMN并不是以终端设备所接入的每个切片为单位(颗粒度)进行撤销，而是必须一次性地同时将终端设备所接入的所有切片进行撤销。究其原因，主要是终端设备的准入控制目前是与终端设备的注册和去注册流程进行绑定(关联)，注册流程是以切片为颗粒度，一个切片一个切片地接入，而去注册流程并不以切片为颗粒度，而是在终端设备退出所有切片时，PLMN才会触发去注册流程，或者当PLMN触发去注册流程时，终端设备需要退出所有的切片。
因此，上述流程会导致终端设备即使不使用切片，也能长时间的霸占切片配额。例如，一个UE可以同时接入8个切片，当UE接入8个切片后，该UE就会占用8个切片的配额。如果该UE只是长期使用其中1个切片，而不使用其他切片，但因为该UE并没有退出网络，即没有进行去注册流程(即仍使用其中1个切片服务)，所有其他切片的配额仍 然被该UE占用。一个网络通常会有成百上千的UE，每个UE都存在这个问题的话，会严重占用网络资源，并造成其他UE被拒绝切片服务(denial of services，DoS)。
有鉴于此，本申请提出一种准入控制的方法，能够减少资源浪费，以及降低其他UE被拒绝切片服务(DoS)的概率。
参见图3，图3是本申请提出一种切片准入控制的方法的示意性流程图。
S301，AMF确定切片S-NSSAI#1中不存在UE的PDU会话。
该步骤也可以理解为AMF确定UE在切片S-NSSAI#1的使用状态为“空闲态”，空闲态表示UE当前没有使用切片S-NSSAI#1，则触发S302。因此，UE在切片S-NSSAI#1中不存在PDU会话可以认为是空闲态的一种，即没有PDU会话相当于空闲态，有PDU会话相当于非空闲态。
在一种实现方式中，AMF确定UE在切片S-NSSAI#1中的最后一个PDU会话已被释放，则AMF认为UE当前在切片S-NSSAI#1的使用状态为空闲态，触发S302。
需要说明的是，SMF负责是管理PDU会话的网络功能，为了获取UE在切片S-NSSAI#1中的最后一个PDU会话已被释放的信息，SMF需要有或者新增最后一个PDU会话已被释放的通知服务，并且AMF可以被授权向SMF订阅该服务。
可选地，AMF确定UE在切片S-NSSAI#1的使用状态为空闲态后，如设定一个计时器，在计时器到期前，如果该UE一直没有在该切片S-NSSAI新建PDU会话(根据现有标准流程，当SMF为UE新建PDU会话后，会通知AMF)，则AMF触发S302。如果计时器到期前收到SMF通知UE在该切片S-NSSAI#1中新的PDU会话创建成功，则UE在切片S-NSSAI#1的使用状态由空闲态又转为非空闲态，则AMF不触发S302。
应理解，该实现方式可以适用于UE被允许接入切片S-NSSAI#1之后已经在切片S-NSSAI#1中建立了PDU会话的场景。当UE在切片S-NSSAI#1中建立的所有PDU会话都被释放后，UE在切片S-NSSAI#1的使用状态由非空闲态转为空闲态。
在另一种实现方式中，AMF在授权UE接入切片S-NSSAI#1时开始计时第二时长，在第二时长到期之前，AMF还没有收到(如AMF从SMF收到)SMF和UE在切片S-NSSAI#1成功建立了UE的PDU会话的消息，则AMF认为UE当前在切片S-NSSAI#1的使用状态为空闲态，触发S302，其中，第二时长可以是预先设置的时长。
应理解，该实现方式可以适用于UE初始允许接入切片S-NSSAI#1，还未在该切片中建立过PDU会话的场景。当AMF在第二时长内没有检测到(或没有收到SMF的通知消息通知AMF)在切片S-NSSAI#1中建立UE的PDU会话，即认为该UE没有实际使用该切片，也就是AMF可以认为UE当前在切片S-NSSAI#1的使用状态为空闲态。
可以理解，如果在预置的第二时长范围内，AMF收到了在切片S-NSSAI#1中UE成功建立PDU会话的消息，则UE在切片S-NSSAI#1的使用状态由空闲态(暂时)转为非空闲态，则AMF不执行S302。
可以理解，在该步骤中UE在切片S-NSSAI#1的授权状态为Allowed NSSAI。
S302，AMF向NSACF发送第一请求消息，第一请求消息用于请求NSACF释放UE占用的切片S-NSSAI#1的准入名额。
可选地，所述请求NSACF释放UE的准入名额，即在第一请求消息中携带“数量减少”或“-”的标识(flag)。
应理解，切片S-NSSAI#1中不存在UE的PDU会话可以是触发S302的条件，该条件可以由AMF确定，也可以由其他设备通知AMF，也就是说，S301为可选步骤。
S303，AMF接收来自NSACF的第一响应消息，第一响应消息用于指示UE在切片S-NSSAI#1占用的准入名额已释放。
上述技术方案相对于现有去注册流程而言，以单个切片为颗粒度，对每个UE的每个切片，根据切片的使用状态(即是否空闲)释放UE所占用的切片名额，从而避免UE即使不使用切片，也长时间霸占切片配额的情况，降低其他UE被拒绝切片服务的概率。
需要说明的是，当UE在切片S-NSSAI#1的名额被释放后(即NSACF将该UE移除了切片S-NSSAI#1的准入列表后)，UE对应于切片S-NSSAI#1的授权状态也需要相应更新。具体流程可以参见S304中的描述。
可选地，S304，AMF将UE在切片S-NSSAI#1的授权状态修改为预授权。
其中，预授权表示当UE在切片S-NSSAI#1有准入名额时被允许直接接入切片S-NSSAI#1。本实施例中预授权状态与授权状态的区别为：预授权状态时切片S-NSSAI#1的准入名额已满，没有UE的准入名额，一旦有了准入名额(即满足了有准入名额的条件)，预授权状态就可以变成授权状态。预授权状态与现有的拒绝授权UE接入切片S-NSSAI#1的授权状态不同。例如，UE在预授权状态下，可以允许UE发送PDU会话建立请求消息，而现有的拒绝授权状态下，UE必须先发送注册请求消息或者服务请求消息，当该请求被接受以后，才被允许发送PDU会话建立请求消息(接下来在图4和图5中进一步描述)。
AMF可以有不同方式，存储UE在切片S-NSSAI#1的预授权状态或者发送预授权状态给UE。
可选地，预授权可以理解为：AMF保存并告知UE其请求接入的切片S-NSSAI#1的授权状态仍为S-NSSAI#1属于Allowed NSSAI，且UE在切片S-NSSAI#1没有准入名额。
可选地，预授权可以理解为：AMF保存并告知UE其请求接入的切片S-NSSAI#1的授权状态为S-NSSAI#1属于Pending NSSAI(即“待定”NSSAI)，且UE在切片S-NSSAI#1没有准入名额。
可选地，预授权可以理解为：AMF保存并告知UE其请求接入的切片S-NSSAI#1的授权状态为S-NSSAI#1属于Rejected NSSAI(拒绝的NSSAI)，其被拒绝的原因是UE在切片S-NSSAI#1没有准入名额。这种方式与现有通知UE的流程相同。不过在本实施例中，这种方式对接下来UE需要重新接入切片或在切片中建立PDU会话与现有流程不同。
应理解，在授权状态为“预授权”的情况下，由于切片S-NSSAI#1中没有UE的准入名额，UE当前还未真正接入切片S-NSSAI#1。
需要说明的是，现有流程中UE的授权状态为“拒绝授权”时，如图4所示，当UE希望在切片S-NSSAI#1建立PDU会话时，UE需要首先向AMF发起切片注册请求(Registration Request)或服务请求(Service Request)流程(S410～S430，需要说明的是，S410和S430之间省略了UE与PLMN之间的许多消息交互)，在AMF与UE完成注册流程(或服务请求流程)且授权UE接入切片S-NSSAI#1后(S430)，UE才能向AMF发起PDU会话建立请求(S440)。而本实施例中，UE在没有名额的预授权状态下，可以不需要再经过注册流程或服务请求流程，直接申请在切片S-NSSAI#1建立PDU会话，从而可以节省UE和网络的资源。
可选地，S305，AMF向UE通知UE在S-NSSAI#1中的授权状态。
例如：这个步骤也可以是AMF与UE间的双向通信，如通过UE配置更新(UE configuration update，UCU)流程通知UE在S-NSSAI#1中的授权状态。
下面结合图5对UE在预授权状态下发起PDU会话的流程进行具体说明。
S510，UE基于当前在切片S-NSSAI#1的预授权状态，向AMF发送第二请求消息，第二请求消息用于请求UE在切片S-NSSAI#1中建立第一PDU会话。
对应的，AMF接收第二请求消息。
S520，AMF向NSACF发送第一消息，第一消息用于确认切片S-NSSAI#1是否有UE的准入名额。
应理解，UE在切片S-NSSAI#1有名额是UE能够在切片S-NSSAI#1中建立PDU会话的必要条件。
S530，AMF从NSACF接收第二响应消息，第二响应消息用于指示S-NSSAI#1有UE的准入名额(即可理解为UE准入切片S-NSSAI#1)或切片S-NSSAI#1没有准入名额。
当第二响应消息用于指示UE准入切片S-NSSAI#1时，AMF授权UE接入切片S-NSSAI#1，执行S540。
应理解，此时，UE的授权状态从“预授权”变为“授权”，即此时UE真正接入了切片S-NSSAI#1且该切片有UE的准入名额。
还应理解，由于此时第一PDU会话还未建立成功，则UE当前在切片S-NSSAI#1的使用状态为空闲态。
当第二响应消息用于指示切片S-NSSAI#1没有准入名额，AMF拒绝建立第一PDU会话，不执行S540。
S540，AMF继续执行建立第一PDU会话流程。
PDU会话建立流程参见现有技术，这里仅简单描述。AMF可以继续向SMF发送建立第一PDU会话的请求消息，SMF收到建立第一PDU会话的请求消息后，可以按照现有标准流程，与UE(以及其他NF)交互建立第一PDU会话，第一PDU会话建立成功后，SMF发送第一PDU会话建立成功的消息给AMF，AMF发送第一PDU会话建立成功的消息给UE。
应理解，如果第一PDU会话建立成功，则UE当前在切片S-NSSAI#1的使用状态由空闲态转为非空闲态。
应理解，本申请中以“AMF与NSACF交互”为例进行描述的。需要说明的是，本实施例并不局限“AMF与NSACF交互”的情况，也可以采用其他现有的NF(例如SMF或专门定义新的NF)，来跟踪切片S-NSSAI中的PDU状态，并与NSACF进行交互。在这些场景下，图3和图5中的步骤需要做相应的调整。例如，如果以SMF与NSACF交互，并且SMF发起释放配额、更新NSACF为例，则相应的调整可以简要描述为：
以图3为例，图3的S301中如果SMF确定UE在切片S-NSSAI#1中的最后一个PDU会话已被释放，则SMF直接向NSACF发起释放配额流程(即第一请求消息)，之后，SMF通知AMF，该UE的S-NSSAI配额已经释放(即第一响应消息)，后续步骤与图3相同。或者，图3的S301中AMF通知SMF由SMF启动计时器(计时第二时长)，在计时器到期前，如果SMF没有为UE在S-NSSAI#1创建新的PDU，SMF向NSACF发起 释放配额流程(即第一请求消息)，之后，SMF通知AMF该UE的S-NSSAI配额已经释放(即第一响应消息)，后续步骤与图3相同，反之，SMF不发起释放配额流程。
以图5为例，图5中AMF可以将接收到的第二请求消息发送给SMF，在SMF和NSACF之间执行S520和S530，然后由SMF继续执行建立第一PDU会话流程。
以上实施例对切片粒度的配额控制进行了详细描述，下面，本申请提出另一种准入控制的方法，也能够减少资源浪费，降低其他UE被拒绝切片服务(DoS)的概率。
参见图6，图6是本申请提出另一种切片准入控制的方法的示意性流程图。
S610，AMF授权UE接入切片S-NSSAI#1。其中，授权表示UE被允许接入切片S-NSSAI#1且在切片S-NSSAI#1中有UE的准入名额。
也可以理解为，当前UE在请求接入的切片S-NSSAI#1的授权状态为S-NSSAI#1属于Allowed NSSAI。
S620，在第一时长到期时，AMF向NSACF发送第三请求消息。
第三请求消息用于请求NSACF释放UE在切片S-NSSAI#1占用的准入名额，其中，第一时长为UE准入切片S-NSSAI#1的有效时长。
可选地，所述请求NSACF释放UE的准入名额，即在第三请求消息中携带“数量减少”或“-”的标识(flag)。
可选地，NSACF保存准入UE列表中每个UE的准入有效时长，这样，AMF可以在与NSACF交互时，从NSACF获取第一时长。
在一种具体实现方式中，AMF向NSACF发送第四请求消息，第四请求消息用于请求或查询UE接入切片S-NSSAI#1所需的准入名额；NSACF向AMF发送第四响应消息，第四响应消息用于指示UE准入切片S-NSSAI#1(即S-NSSAI#1的准入名额未满)，且第四响应消息包括第一时长。
可选地，AMF中保存每个UE的准入名额的有效时长(即包括第一时长)。
可选地，该方法还包括：AMF在第一时长到期时，AMF确定UE在切片S-NSSAI#1中存在一个或多个PDU会话，即确定UE在切片S-NSSAI#1的使用状态为“非空闲”，则AMF自动延期释放UE的准入名额。比如，AMF在一个或多个PDU会话全部释放后，即UE在切片S-NSSAI#1的使用状态为“空闲”时，向NSACF发送第三请求消息。
可选地，该方法还包括：在第一时长到期时，AMF通知UE即将释放UE在切片S-NSSAI#1占用的准入名额，如果UE不发起请求继续使用该切片，则AMF向NSACF发送第三请求消息。
可选地，该方法还包括：AMF向UE通知被授权接入切片S-NSSAI#1时，同时向UE发送第一时长，UE在第一时长到期之前，可以申请更新UE准入切片S-NSSAI#1的有效时长为第三时长。如果在第三时长到期后，UE不再发起请求继续使用该切片，则AMF向NSACF发送第三请求消息。
S630，AMF从NSACF接收第三响应消息，第三响应消息用于指示UE在切片S-NSSAI#1占用的准入名额已释放。
应理解，本实施例中UE释放名额后的流程可以参见图3中S304和图5中的描述，这里不再赘述。
应理解，本申请中以“AMF与NSACF交互”为例进行描述的。需要说明的是，本实施例并不局限“AMF与NSACF交互”的情况，也可以采用其他现有的NF(例如SMF或专门定义新的NF)，来保存或确定第二时长、与NSACF进行交互。在这些场景下，图6中的步骤需要做相应的调整。调整方法类似图3、图5中的描述，这里不再赘述。
上述技术方案中，通过设定切片准入名额的有效期，定期释放之前批准的准入名额。对于需要继续使用切片的UE，可以重新申请准入有效时长(即续期)，而对于不需要继续使用的UE，准入名额自动过期释放，从而降低其他UE被拒绝切片服务(DoS)的概率。
以上对终端设备在注册时与去注册时，PLMN(AMF和NSACF)对该终端设备准入的控制颗粒度(基本单位)不匹配的问题以及本申请提出的准入控制方法进行了详细的描述。下面说明现有技术中存在的另一个问题：PLMN与UE进行的切片认证授权(network slice specific authentication and authorization，NSSAA)与准入控制不协调，造成NSSAA流程浪费。
为便于理解，这里结合图7对目前包括切片认证的UE注册流程进行简单介绍。
步骤1：UE向网络(AMF)发起切片注册请求，其中包括请求接入的切片的S-NSSAI。
步骤2：AMF确定请求接入的切片S-NSSAI是否需要进行切片认证(即NSSAA)流程。
例如，AMF通过UE的签约信息及该切片的配置来确定是否需要针对切片S-NSSAI进行切片认证。如果不需要切片认证，则执行步骤3。如果需要进行切片认证，则跳过步骤3，执行步骤4。
需要说明的是，如果切片S-NSSAI不需要与UE进行切片认证，代表UE在切片S-NSSAI有准入名额的前提条件可以被授权接入切片S-NSSAI。因此，需要执行步骤3确认准入名额。
步骤3：AMF向NSACF发起ACU流程，查询、更新切片S-NSSAI的准入名额。
步骤4：AMF根据步骤2以及步骤3的执行情况，向UE发送“注册结果”消息。此时主要有以下3种结果：
1)如果切片S-NSSAI不需进行切片认证，执行了步骤3：
步骤3结果为有准入名额，AMF“授权”UE接入切片S-NSSAI。
步骤3结果为无准入名额，AMF“拒绝授权”UE接入切片S-NSSAI。
2)如果切片S-NSSAI需进行切片认证，未执行步骤3：
AMF将切片S-NSSAI放入Pending NSSAI(“待定”NSSAI)列表中。
步骤5：可选地，UE响应AMF“注册完成”消息。
步骤6：如果步骤2确定切片S-NSSAI需要进行切片认证(即步骤4中Pending NSSAI列表中的S-NSSAI)，则针对该切片S-NSSAI执行切片认证。如果切片认证成功，则执行步骤7。否则跳过步骤7，执行步骤8。
步骤7：参见步骤3。
步骤8：AMF根据步骤6以及步骤7的执行结果，与UE进行UE配置更新(UE configuration update，UCU)流程，更新UE授权接入切片的结果。此时主要有以下2种结果：
1)如果步骤6切片认证成功，执行了步骤7：
步骤7结果为有准入名额：AMF“授权”UE接入切片S-NSSAI。
步骤7结果为无准入名额：AMF“拒绝授权”UE接入切片S-NSSAI。
2)如果步骤6切片认证失败：AMF“拒绝授权”UE接入S-NSSAI。
由上可以看出，在目前的流程中，如果需要进行切片认证，PLMN先执行与UE的切片认证授权(network slice specific authentication and authorization，NSSAA)流程，当认证成功后，才去执行准入控制流程(即ACU流程)。当针对S-NSSAI的切片认证成功了但该切片的配额已满时，根据前面描述，AMF会拒绝UE的接入申请，从而造成了执行NSSAA流程的浪费。需要说明的是，NSSAA的流程是终端设备与DN的AAA服务器之间进行的，需要经过多轮信息交互。尤其是在漫游场景，所有的信息交互需要从拜访PLMN(visiting PLMN)路由到归属PLMN(home PLMN)再返回拜访PLMN，占用资源多，交互流程长，造成网络资源的浪费。
有鉴于此，本申请提出一种切片准入控制的方法，通过解耦切片认证和准入名额对切片授权的影响，提升NSSAA流程效率，节省资源。
参见图8，图8是本申请提出又一种切片准入控制的方法的示意性流程图。
S810，AMF确定UE请求接入的切片S-NSSAI#1的切片认证成功。
S820，AMF向NSACF发送第五请求消息，第五请求消息用于查询、更新UE请求接入的切片S-NSSAI#1的准入名额。
对应的，NSACF从AMF接收第五请求消息。
应理解，该步骤是在AMF确定切片S-NSSAI#1需要进行切片认证的情况下执行的。
S830，AMF从NSACF接收第五响应消息，第五响应消息用于指示切片S-NSSAI#1没有UE的准入名额或切片S-NSSAI#1的准入名额已满(即NSACF无法给UE在该切片分配准入名额)。
S840，AMF将UE在切片S-NSSAI#1的授权状态修改为预授权，其中，预授权表示UE在切片S-NSSAI#1有准入名额时被允许直接接入切片S-NSSAI#1。
本实施中的预授权可以有多种理解方式，下面对可能的几种预授权方式一一进行介绍。
(1)预授权可以理解为：AMF将UE的切片S-NSSAI#1的授权状态从Pending NSSAI替换为Allowed NSSAI，即AMF保存并告知UE的切片S-NSSAI#1的授权状态为S-NSSAI#1属于Allowed NSSAI，且UE在切片S-NSSAI#1没有准入名额。
可选地，AMF保存或告知UE，该UE已经成功通过了关于切片S-NSSAI#1的切片认证。由于方式(1)中S-NSSAI#1属于Allowed NSSAI已经隐含了切片认证成功，因此该步骤是可选的。
可选地，在预授权状态下，AMF可以告知UE可以重新接入S-NSSAI#1的第四时长。
下面，对方式(1)的预授权状态下PLMN(如AMF)和UE的后续可能执行的步骤进行简单说明。
AMF允许UE在方式(1)的预授权状态下直接发起PDU会话建立的流程，AMF收到该PDU会话请求后，仍然会先确认切片S-NSSAI#1是否有准入名额，如果有准入名额，则会继续执行UE发起的PDU会话建立流程，相关描述如图5中所述。如果没有准入名额，则会拒绝该PDU会话请求。
可选地，如果AMF拒绝了UE的PDU会话请求，AMF可以保持UE的授权状态仍为预授权状态，并可选地发送第五时长(即需要在第五时长到期后重新发起PDU会话建立流程)。
可选地，如果AMF拒绝了UE的PDU会话请求，AMF也可以更新UE的授权状态，例如更新为拒绝状态。
AMF确认切片S-NSSAI#1是否有准入名额的方法可以是S520和S530的描述，或者执行现有ACU的流程(图2中的描述)。还可以根据AMF的准入控制模式，如在早期准入控制模式(Early Admission Control mode)没有激活时，AMF默认存在准入名额，不必执行S520和S530(或ACU流程)。
当UE收到了AMF发送的UE关于切片S-NSSAI#1的所述方式(1)的授权状态之后，UE可以在等待一段时间后(如果收到了第四时长或第五时长，则需要至少等到第四时长或第五时长之后)，直接发起PDU会话建立的流程，而不必先发起注册流程和切片认证流程。当然，UE也可以自愿重新发起注册流程。
(2)预授权可以理解为：AMF保存并告知UE的切片S-NSSAI#1的授权状态仍为Pending NSSAI(即S-NSSAI#1属于Pengding NSSAI)，并且UE已经成功通过关于切片S-NSSAI#1的切片认证，且UE在切片S-NSSAI#1没有准入名额。
可选地，AMF可以告知UE重新接入S-NSSAI#1的第四时长。
下面，对方式(2)的预授权状态下PLMN(如AMF)和UE的后续可能执行的步骤进行简单说明。
可选地，AMF允许UE在方式(2)的预授权状态下直接发起PDU会话建立的流程。关于AMF和UE的进行PDU会话建立的描述，可以参见上述方式(1)，不再赘述。
可选地，AMF不允许UE在方式(2)的预授权状态下直接发起PDU会话建立的流程，而是需要UE重新发起注册流程(或服务请求流程/UCU流程)。如果UE收到了第四时长或第五时长，则需要在第四时长或第五时长到期后发起。当AMF收到UE重新发起的注册请求后，与现有流程不同的是，由于AMF已经保存了“UE已经成功通过关于切片S-NSSAI#1的切片认证”的信息，AMF不必发起执行切片认证的流程。即在图7的步骤2中，AMF确定该UE不需要(重新)进行关于切片S-NSSAI#1的切片认证。
(3)预授权可以理解为：AMF将UE的切片S-NSSAI#1的授权状态从Pending NSSAI替换为Rejected NSSAI(即S-NSSAI#1属于Rejected NSSAI)，AMF保存并告知UE的切片S-NSSAI#1的授权状态为Rejected NSSAI(即S-NSSAI#1属于Rejected NSSAI)，拒绝的原因是UE在切片S-NSSAI#1没有准入名额。AMF保存(可选通知UE)UE已经成功通过关于切片S-NSSAI#1的切片认证。
可选地，AMF可以告知UE重新接入S-NSSAI#1的第四时长。
下面，对方式(3)的预授权状态下PLMN(如AMF)和UE的后续可能执行的步骤进行简单说明。
可选地，AMF允许UE在方式(2)的预授权状态下直接发起(如果发送了第四时长，则需要在第四时长到期后发起)PDU会话建立的流程。关于AMF和UE的进行PDU会话建立的描述，可以参加上述方式一，不再赘述。
可选地，AMF不允许UE在方式(2)的预授权状态下直接发起PDU会话建立的流 程，而是需要UE重新发起注册流程(或服务请求流程/UCU流程)。如果UE收到了第四时长或第五时长，则需要在第四时长或第五时长到期后发起。当AMF收到UE重新发起的注册请求后，与现有流程不同的是，由于AMF已经保存了“UE已经成功通过关于切片S-NSSAI#1的切片认证”的信息，AMF不必发起执行切片认证的流程。即在图7的步骤2中，AMF确定该UE不需要(重新)进行关于切片S-NSSAI#1的切片认证。
由上可知，UE在预授权状态下请求重新请求接入切片S-NSSAI#1时，可以不需要再经过切片认证流程(在一些情况下也不需要进行注册流程)，在切片S-NSSAI#1有准入名额时允许UE直接接入切片S-NSSAI#1，从而节省UE和网络的资源。
需要说明的是，如果在图7的步骤2中，切片S-NSSAI#1不需要切片认证，那么在UE在切片S-NSSAI#1没有准入名额的情况下，AMF也可以预授权UE接入切片S-NSSAI#1。
可选地，这里预授权可以理解为：AMF保存并告知UE的切片S-NSSAI#1的授权状态为Allowed NSSAI，且UE在切片S-NSSAI#1没有准入名额。
可选地，这里预授权可以理解为：AMF保存并告知UE的切片S-NSSAI#1的授权状态为Pending NSSAI，且UE在切片S-NSSAI#1没有准入名额。
可选地，这里预授权可以理解为：AMF保存并告知UE的切片S-NSSAI#1的授权状态为Rejected NSSAI，且拒绝的原因是UE在切片S-NSSAI#1没有准入名额。
同理，切片S-NSSAI#1如果不需要切片认证，UE在预授权状态下请求重新请求接入切片S-NSSAI#1时，可以不需要再经过注册流程，直接接入切片S-NSSAI#1，从而节省UE和网络的资源。
可选地，在图7所示的步骤2中，判断了是否需要执行切片认证之后，无论是否需要针对S-NSSAI执行切片认证，都执行步骤3。也就是说，即使S-NSSAI需要进行切片认证，也执行步骤3。
这样做的目的是将步骤2与步骤3解耦，即是否执行“查询更新配额ACU”与是否执行“切片认证NSSAA”去除关联。这样做的好处是，当UE请求接入多个切片，且其中的切片有的需要切片认证有的不需要切片认证时，可以一次性地在步骤3执行，而不需要执行两次ACU流程(步骤3和步骤7)。例如，UE请求接入切片S-NSSAI#1和S-NSSAI#2，S-NSSAI#1需要切片认证，S-NSSAI#2不需要切片认证。在现有流程中，针对S-NSSAI#2需要执行步骤3，而针对S-NSSAI#1不需要执行步骤3，需要等到步骤7切片认证成功后再执行，总共执行了两次ACU流程。而如果采用这样方式，可以在步骤3，一次性地执行对2个切片S-NSSAI#1和S-NSSAI#2的ACU流程，从而节省了一个ACU的流程。
以上对本申请提供的切片准入控制的方法进行了详细说明，下面介绍本申请提供的通信装置。
参见图9，图9为本申请提供的通信装置1000的示意性框图。如图9，通信装置1000包括发送单元1100和接收单元1200。
发送单元1100，用于当第一切片中不存在终端设备的协议数据单元PDU会话时或当终端设备准入第一切片的时长超过第一时长时，向网络切片准入控制功能网元NSACF发送第一请求消息，所述第一请求消息用于请求所述NSACF释放所述终端设备占用的所述第一切片的准入名额，所述第一时长为所述终端设备准入所述第一切片的有效时长；
接收单元1200，用于接收来自所述NSACF的第一响应消息，所述第一响应消息用于指示所述终端设备占用的所述第一切片的准入名额已被释放。
可选地，在一个实施例中，所述当第一切片中不存在终端设备的协议数据单元PDU会话时，所述发送单元发送第一请求消息，包括：当所述终端设备在所述第一切片中的最后一个PDU会话已经被释放时，所述发送单元1100，用于向所述NSACF发送所述第一请求消息；或者，在第二时长内所述终端设备在所述第一切片中没有成功建立所述终端设备的PDU会话时，所述发送单元1100，用于向所述NSACF发送第一请求消息，其中，所述第二时长从AMF授权所述终端设备接入所述第一切片开始计时。
可选地，该通信装置1000还包括：处理单元1300，用于执行本申请图3或图6对应的方法实施例中由接入与移动性管理功能网元内部执行的处理或操作。
可选地，在另一个实施例中，所述接收单元1200接收来自所述NSACF发送的第一响应消息之后，所述处理单元1300用于将所述终端设备在所述第一切片的的授权状态修改为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片。
可选地，在另一个实施例中，所述接收单元1200，还用于从所述终端设备接收第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一PDU会话；所述发送单元1100，还用于向所述NSACF发送第一消息，所述第一消息用于确认所述第一切片是否有所述终端设备的准入名额；所述接收单元1200，还用于接收来自所述NSACF的第二响应消息，所述第二响应消息用于指示所述第一切片是否有所述终端设备的准入名额。
可选地，发送单元1100和接收单元1200也可以集成为一个收发单元，同时具备接收和发送的功能，这里不作限定。
在一种实现方式中，通信装置1000可以为方法实施例中的接入与移动性管理功能网元。在这种实现方式中，发送单元1100可以为发射器，接收单元1200可以为接收器。接收器和发射器也可以集成为一个收发器。处理单元1300可以为处理装置。
在另一种实现方式中，通信装置1000可以为安装在接入与移动性管理功能网元中的芯片或集成电路。在这种实现方式中，发送单元1100和接收单元1200可以为通信接口或者接口电路。例如，发送单元1100为输出接口或输出电路，接收单元1200为输入接口或输入电路，处理单元1300可以为处理装置。
其中，处理装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。例如，处理装置可以包括存储器和处理器，其中，存储器用于存储计算机程序，处理器读取并执行存储器中存储的计算机程序，使得通信装置1000执行各方法实施例中由接入与移动性管理功能网元执行的操作和/或处理。可选地，处理装置可以仅包括处理器，用于存储计算机程序的存储器位于处理装置之外。处理器通过电路/电线与存储器连接，以读取并执行存储器中存储的计算机程序。又例如，处理装置可以芯片或集成电路。
参见图10，图10为本申请提供的通信装置2000的示意性框图。如图10，通信装置2000包括处理单元2100和发送单元2200。
处理单元2100，确定终端设备在第一切片的授权状态为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片；
发送单元2200，所述发送单元用于向接入与移动性管理功能网元AMF发送第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一协议数据单元PDU会话。
可选地，通信装置2000还包括接收单元2300，用于执行本申请图3或图6对应的方法实施例中由终端设备执行的接收动作。
可选地，发送单元2200和接收单元2300也可以集成为一个收发单元，同时具备接收和发送的功能，这里不作限定。
在一种实现方式中，通信装置2000可以为方法实施例中的终端设备。在这种实现方式中，发送单元2200可以为发射器，接收单元2300可以为接收器。接收器和发射器也可以集成为一个收发器。处理单元2100可以为处理装置。
在另一种实现方式中，通信装置2000可以为安装在终端设备中的芯片或集成电路。在这种实现方式中，发送单元2200和接收单元2300可以为通信接口或者接口电路。例如，发送单元2200为输出接口或输出电路，接收单元2300为输入接口或输入电路，处理单元2100可以为处理装置。
其中，处理装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。例如，处理装置可以包括存储器和处理器，其中，存储器用于存储计算机程序，处理器读取并执行存储器中存储的计算机程序，使得通信装置2000执行各方法实施例中由终端设备执行的操作和/或处理。可选地，处理装置可以仅包括处理器，用于存储计算机程序的存储器位于处理装置之外。处理器通过电路/电线与存储器连接，以读取并执行存储器中存储的计算机程序。又例如，处理装置可以芯片或集成电路。
参见图11，图11为本申请提供的通信装置10的示意性结构图。如图11，通信装置10包括：一个或多个处理器11，一个或多个存储器12以及一个或多个通信接口13。处理器11用于控制通信接口13收发信号，存储器12用于存储计算机程序，处理器11用于从存储器12中调用并运行该计算机程序，以使得本申请各方法实施例中由接入与移动性管理功能网元执行的流程和/或操作被执行。
例如，处理器11可以具有图9中所示的处理单元1100的功能，通信接口13可以具有图9中所示的发送单元1100和/或接收单元1200的功能。具体地，处理器11可以用于执行本申请图3或图6对应的方法实施例中由接入与移动性管理功能网元内部执行的处理或操作，通信接口13用于执行本申请对应的各方法实施例中由接入与移动性管理功能网元执行的发送和/或接收的动作。
在一种实现方式中，通信装置10可以为本申请图3或图6对应的方法实施例中的接入与移动性管理功能网元。在这种实现方式中，通信接口13可以为收发器。收发器可以包括接收器和发射器。
可选地，处理器11可以为基带装置，通信接口13可以为射频装置。
在另一种实现中，通信装置10可以为安装在接入与移动性管理功能网元中的芯片。在这种实现方式中，通信接口13可以为接口电路或者输入/输出接口。
参见图12，图12是本申请提供的通信装置20的示意性结构图。如图12，通信装置20包括：一个或多个处理器21，一个或多个存储器22以及一个或多个通信接口23。处理器21用于控制通信接口23收发信号，存储器22用于存储计算机程序，处理器21用于 从存储器22中调用并运行该计算机程序，以使得本申请图3或图6对应的方法实施例中由终端设备执行的流程和/或操作被执行。
例如，处理器21可以具有图10中所示的处理单元2100的功能，通信接口23可以具有图10中所示的发送单元2200和/或接收单元2300的功能。具体地，处理器21可以用于执行本申请图3或图6对应的各方法实施例中由终端设备内部执行的处理或操作，通信接口23用于执行本申请图3或图6对应的方法实施例中由终端设备执行的发送和/或接收的动作，不再赘述。
在一种实现方式中，通信装置20可以为本申请图3或图6对应的各方法实施例中的终端设备。在这种实现方式中，通信接口13可以为收发器。收发器可以包括接收器和发射器。
可选地，处理器21可以为基带装置，通信接口23可以为射频装置。
在另一种实现中，通信装置20可以为安装在终端设备中的芯片。在这种实现方式中，通信接口23可以为接口电路或者输入/输出接口。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (22)

  1. 一种切片准入控制的方法，其特征在于，包括：
    当第一切片中不存在终端设备的协议数据单元PDU会话时或当终端设备被准入第一切片的时长超过第一时长时，接入与移动性管理功能网元AMF向网络切片准入控制功能网元NSACF发送第一请求消息，所述第一请求消息用于请求所述NSACF释放所述终端设备占用的所述第一切片的准入名额；
    所述AMF接收来自所述NSACF的第一响应消息，所述第一响应消息用于指示所述终端设备占用的所述第一切片的准入名额已被释放。
  2. 根据权利要求1所述的方法，其特征在于，所述当在第一切片中不存在终端设备的PDU会话时，AMF向NSACF发送第一请求消息，包括：
    当所述终端设备在所述第一切片中的最后一个PDU会话已经被释放时，所述AMF向所述NSACF发送所述第一请求消息；
    或者，
    在第二时长内所述第一切片中没有成功建立所述终端设备的PDU会话时，所述AMF向所述NSACF发送第一请求消息，其中，所述第二时长从所述AMF授权所述终端设备接入所述第一切片开始计时。
  3. 根据权利要求1或2所述的方法，其特征在于，所述AMF接收来自所述NSACF发送的第一响应消息之后，所述方法还包括：
    所述AMF将所述终端设备在所述第一切片的授权状态修改为预授权，所述预授权表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    所述AMF从所述终端设备接收第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一PDU会话；
    所述AMF向所述NSACF发送第一消息，所述第一消息用于确认所述第一切片是否有所述终端设备的准入名额；
    所述AMF接收来自所述NSACF的第二响应消息，所述第二响应消息用于指示所述第一切片是否有所述终端设备的准入名额。
  5. 一种切片准入控制的方法，其特征在于，包括：
    终端设备确定所述终端设备在第一切片的授权状态为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片；
    所述终端设备向接入与移动性管理功能网元AMF发送第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一协议数据单元PDU会话。
  6. 一种切片准入控制的方法，其特征在于，包括：
    AMF确定终端设备请求接入的第一切片的切片认证成功；
    所述AMF向NSACF发送第五请求消息，所述第五请求消息用于请求更新接入所述第一切片的终端设备的数量；
    所述AMF接收来自所述NSACF的第五响应消息，所述第五响应消息用于指示所述第一切片没有准入名额；
    所述AMF将所述终端设备在第一切片的授权状态修改为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片；
    或者，AMF将终端设备在第一切片的授权状态修改为拒绝授权，并记录终端设备已经成功通过第一切片的切片认证，其中，拒绝授权表示终端设备被拒绝接入第一切片。
  7. 一种通信装置，其特征在于，包括：
    发送单元，所述发送单元用于当第一切片中不存在终端设备的协议数据单元PDU会话时或当终端设备被准入第一切片的时长超过第一时长时，向网络切片准入控制功能网元NSACF发送第一请求消息，所述第一请求消息用于请求所述NSACF释放所述终端设备占用的所述第一切片的准入名额，所述第一时长为所述终端设备被准入所述第一切片的有效时长；
    接收单元，所述接收单元用于接收来自所述NSACF的第一响应消息，所述第一响应消息用于指示所述终端设备占用的所述第一切片的准入名额已被释放。
  8. 根据权利要求7所述的通信装置，其特征在于，所述当第一切片中不存在终端设备的PDU会话时，所述发送单元发送第一请求消息，包括：
    当所述终端设备在所述第一切片中的最后一个PDU会话已经被释放时，所述发送单元向所述NSACF发送所述第一请求消息；
    或者，
    在第二时长内所述第一切片中没有成功建立所述终端设备的PDU会话时，所述发送单元向所述NSACF发送第一请求消息，其中，所述第二时长从AMF授权所述终端设备接入所述第一切片开始计时。
  9. 根据权利要求7或8所述的通信装置，其特征在于，所述装置还包括：
    处理单元，在所述接收单元接收来自所述NSACF发送的第一响应消息之后，所述处理单元用于将所述终端设备在所述第一切片的授权状态修改为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片。
  10. 根据权利要求9所述的通信装置，其特征在于，
    所述接收单元，还用于从所述终端设备接收第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一PDU会话；
    所述发送单元，还用于向所述NSACF发送第一消息，所述第一消息用于确认所述第一切片是否有所述终端设备的准入名额；
    所述接收单元，还用于接收来自所述NSACF的第二响应消息，所述第二响应消息用于指示所述第一切片是否有所述终端设备的准入名额。
  11. 一种通信装置，其特征在于，包括：
    处理单元，所述处理单元用于确定终端设备在第一切片的授权状态为预授权状态，所述预授权状态表示所述终端设备在所述第一切片有准入名额时被允许直接接入所述第一切片；
    发送单元，所述发送单元用于向接入与移动性管理功能网元AMF发送第二请求消息，所述第二请求消息用于请求所述终端设备在所述第一切片中建立第一协议数据单元PDU会话。
  12. 一种通信装置，其特征在于，包括用于实现如权利要求1至4中任一项所述的方法的单元。
  13. 一种通信装置，其特征在于，包括用于实现如权利要求5所述的方法的单元。
  14. 一种通信装置，其特征在于，包括用于实现如权利要求6所述的方法的单元。
  15. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使得所述通信装置执行如权利要求1至4中任一项所述的方法。
  16. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使得所述通信装置执行如权利要求5所述的方法。
  17. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器与至少一个存储器耦合，所述至少一个处理器用于执行所述至少一个存储器中存储的计算机程序或指令，以使得所述通信装置执行如权利要求6所述的方法。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，如权利要求1至4中任一项所述的方法被执行。
  19. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，如权利要求5所述的方法被执行。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机指令，当所述计算机指令在计算机上运行时，如权利要求6所述的方法被执行。
  21. 一种计算机程序产品，其特征在于，所述计算机程序产品中包括计算机程序代码，当所述计算机程序代码在计算机上运行时，如权利要求1至4中任一项所述的方法被执行。
  22. 一种计算机程序产品，其特征在于，所述计算机程序产品中包括计算机程序代码，当所述计算机程序代码在计算机上运行时，如权利要求5所述的方法被执行。
PCT/CN2022/101465 2021-06-30 2022-06-27 切片准入控制的方法和通信装置 WO2023274132A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22831946.3A EP4344341A1 (en) 2021-06-30 2022-06-27 Method for slice admission control and communication apparatus
US18/397,099 US20240129843A1 (en) 2021-06-30 2023-12-27 Slice admission control method and communication apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110734233.4 2021-06-30
CN202110734233.4A CN115551122A (zh) 2021-06-30 2021-06-30 切片准入控制的方法和通信装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/397,099 Continuation US20240129843A1 (en) 2021-06-30 2023-12-27 Slice admission control method and communication apparatus

Publications (1)

Publication Number Publication Date
WO2023274132A1 true WO2023274132A1 (zh) 2023-01-05

Family

ID=84690070

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/101465 WO2023274132A1 (zh) 2021-06-30 2022-06-27 切片准入控制的方法和通信装置

Country Status (4)

Country Link
US (1) US20240129843A1 (zh)
EP (1) EP4344341A1 (zh)
CN (1) CN115551122A (zh)
WO (1) WO2023274132A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116095681B (zh) * 2023-04-11 2023-07-11 北京首信科技股份有限公司 一种网络融合认证的方法和设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111654862A (zh) * 2019-03-04 2020-09-11 华为技术有限公司 终端设备的注册方法及装置
US20210136715A1 (en) * 2019-11-06 2021-05-06 Samsung Electronics Co., Ltd. Method and apparatus for controlling network slice in wireless communication system
CN112788704A (zh) * 2019-11-06 2021-05-11 华为技术有限公司 网络切片的使用控制方法、装置及系统
WO2021125265A1 (en) * 2019-12-20 2021-06-24 Nec Corporation Network slice quota management during roaming
WO2021125165A1 (en) * 2019-12-20 2021-06-24 Nec Corporation Network slice quota management during network slice specific authentication and authorisation

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111654862A (zh) * 2019-03-04 2020-09-11 华为技术有限公司 终端设备的注册方法及装置
US20210136715A1 (en) * 2019-11-06 2021-05-06 Samsung Electronics Co., Ltd. Method and apparatus for controlling network slice in wireless communication system
CN112788704A (zh) * 2019-11-06 2021-05-11 华为技术有限公司 网络切片的使用控制方法、装置及系统
WO2021125265A1 (en) * 2019-12-20 2021-06-24 Nec Corporation Network slice quota management during roaming
WO2021125165A1 (en) * 2019-12-20 2021-06-24 Nec Corporation Network slice quota management during network slice specific authentication and authorisation

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON, SAMSUNG: "Default Subscribed S-NSSAIs for Network Slice Admission Control", 3GPP DRAFT; S2-2103468, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20210412 - 20210416, 16 April 2021 (2021-04-16), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051995809 *

Also Published As

Publication number Publication date
CN115551122A (zh) 2022-12-30
US20240129843A1 (en) 2024-04-18
EP4344341A1 (en) 2024-03-27

Similar Documents

Publication Publication Date Title
US11102828B2 (en) User plane function selection for isolated network slice
WO2020224622A1 (zh) 一种信息配置方法及装置
CN112584486B (zh) 一种通信方法及装置
WO2019033796A1 (zh) 会话处理方法及相关设备
WO2020177523A1 (zh) 终端设备的注册方法及装置
US20210385283A1 (en) Multimedia Priority Service
WO2021218878A1 (zh) 切片认证方法及装置
WO2019223490A1 (zh) 一种设备监控、去注册方法及装置
US20240129843A1 (en) Slice admission control method and communication apparatus
KR20220091555A (ko) 연결 처리 방법 및 통신 장비
WO2012109823A1 (zh) 一种机器类型通信设备的拥塞控制方法及系统
WO2020248709A1 (zh) 一种mdbv的确定方法、装置及系统
US20230388863A1 (en) Communication method and apparatus
KR102318746B1 (ko) 가상 id를 이용하여 복수의 pdu 세션들을 처리하는 방법 및 상기 방법을 수행하는 smf
WO2021253859A1 (zh) 切片认证方法及系统
US20240179614A1 (en) Communication method and apparatus
WO2023213181A1 (zh) 一种通信方法及装置
EP4376487A1 (en) Communication method and apparatus
JP7268203B2 (ja) 移動通信システムの利用を制御するためのアクセス管理コンポーネント及び方法
WO2024065843A1 (zh) 私有物联网单元pine的接入认证方法和装置
WO2024094047A1 (zh) 通信方法和通信装置
WO2024078313A1 (zh) 认证授权的方法与通信装置
US20230126490A1 (en) Optimized security mode command procedure to reduce communication setup failures
WO2022160183A1 (zh) 接入网络的方法和装置
WO2021088060A1 (zh) 通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22831946

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022831946

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022831946

Country of ref document: EP

Effective date: 20231222