Nothing Special   »   [go: up one dir, main page]

WO2024065843A1 - 私有物联网单元pine的接入认证方法和装置 - Google Patents

私有物联网单元pine的接入认证方法和装置 Download PDF

Info

Publication number
WO2024065843A1
WO2024065843A1 PCT/CN2022/123645 CN2022123645W WO2024065843A1 WO 2024065843 A1 WO2024065843 A1 WO 2024065843A1 CN 2022123645 W CN2022123645 W CN 2022123645W WO 2024065843 A1 WO2024065843 A1 WO 2024065843A1
Authority
WO
WIPO (PCT)
Prior art keywords
pine
identity information
pin
information
pegc
Prior art date
Application number
PCT/CN2022/123645
Other languages
English (en)
French (fr)
Inventor
梁浩然
陆伟
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202280003986.0A priority Critical patent/CN118120201A/zh
Priority to PCT/CN2022/123645 priority patent/WO2024065843A1/zh
Publication of WO2024065843A1 publication Critical patent/WO2024065843A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00—Modulated-carrier systems

Definitions

  • the present disclosure relates to the field of communication technology, and in particular to a PINE access authentication method and device.
  • the 5G (5th generation mobile networks) system proposes to support the connection of PINE (Personal IoT Networks Element) without gateway capability to the gateway of 5GC (5G core).
  • PINE Personal IoT Networks Element
  • PINE is connected to 5GC through PEGC (Personal IoT Networks Elements with Gateway Capability, private IoT unit with gateway capability).
  • the related technology does not support identity authentication and authorization of PINE, and there is a risk of abuse of network resources, which is an urgent problem to be solved.
  • the embodiments of the present disclosure provide a PINE access authentication method and device, which can authenticate and authorize the PINE and avoid abuse of network resources.
  • an embodiment of the present disclosure provides an access authentication method for a PINE, which is executed by a PEGC and includes: receiving an access request sent by a PINE, wherein the access request includes identity information of the PINE; and sending a protocol data unit PDU session modification request to a session management function SMF.
  • PEGC receives an access request sent by PINE, wherein the access request includes the identity information of the PINE, and sends a protocol data unit PDU session modification request to the session management function SMF.
  • the PINE can be authenticated and authorized to avoid abuse of network resources.
  • an embodiment of the present disclosure provides another access authentication method for PINE, which is executed by SMF, including: receiving a PDU session modification request sent by PEGC, wherein the PDU session modification request is sent by the PEGC when it receives an access request sent by PINE, and the access request includes the identity information of the PINE; triggering the identity authentication of the PINE according to the PDU session modification request.
  • an embodiment of the present disclosure provides another access authentication method of a PINE, which is executed by the PINE and includes: sending an access request to a PEGC associated with/to which the PINE belongs, wherein the access request includes identity information of the PINE.
  • an embodiment of the present disclosure provides another access authentication method of PINE, which is executed by PCF, including: receiving a query request sent by SMF; determining a configuration policy based on the query request; and sending the configuration policy to the SMF.
  • an embodiment of the present disclosure provides a communication device, which has some or all of the functions of the PEGC in the method described in the first aspect above.
  • the functions of the communication device may have some or all of the functions in the embodiments of the present disclosure, or may have the functions of implementing any one of the embodiments of the present disclosure alone.
  • the functions may be implemented by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the communication device includes: a transceiver module configured to receive an access request sent by a PINE, wherein the access request includes identity information of the PINE; the transceiver module is also configured to send a protocol data unit PDU session modification request to a session management function SMF.
  • an embodiment of the present disclosure provides another communication device, which has some or all of the functions of the SMF in the method example described in the second aspect above.
  • the functions of the communication device may have some or all of the functions in the embodiments of the present disclosure, or may have the functions of implementing any one of the embodiments of the present disclosure alone.
  • the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the communication device includes: a transceiver module, configured to receive a PDU session modification request sent by a PEGC, wherein the PDU session modification request is sent by the PEGC when receiving an access request sent by a PINE, and the access request includes the identity information of the PINE; and a processing module, configured to perform identity authentication on the PINE according to the PDU session modification request.
  • a transceiver module configured to receive a PDU session modification request sent by a PEGC, wherein the PDU session modification request is sent by the PEGC when receiving an access request sent by a PINE, and the access request includes the identity information of the PINE
  • a processing module configured to perform identity authentication on the PINE according to the PDU session modification request.
  • an embodiment of the present disclosure provides another communication device, which has the function of implementing some or all of the functions of PINE in the method example described in the third aspect above.
  • the function of the communication device may have the functions of some or all of the embodiments in the present disclosure, or may have the function of implementing any one of the embodiments in the present disclosure alone.
  • the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the communication device includes: a transceiver module configured to send an access request to a PEGC associated with/to which a PINE belongs, wherein the access request includes identity information of the PINE.
  • an embodiment of the present disclosure provides another communication device, which has some or all of the functions of the PCF in the method example described in the third aspect above.
  • the functions of the communication device may have some or all of the functions in the embodiments of the present disclosure, or may have the functions of implementing any one of the embodiments of the present disclosure alone.
  • the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the communication device includes: a transceiver module configured to receive a query request sent by the SMF; a processing module configured to determine a configuration strategy according to the query request; and the transceiver module is further configured to send the configuration strategy to the SMF.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the first aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the second aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the third aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor.
  • the processor calls a computer program in a memory, the method described in the fourth aspect is executed.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the first aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the second aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the third aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the method described in the fourth aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the first aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the second aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the third aspect above.
  • an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the method described in the fourth aspect above.
  • an embodiment of the present disclosure provides a communication system, the system comprising the communication device described in aspect 5, the communication device described in aspect 6, and the communication device described in aspect 7; or, the system comprising the communication device described in aspect 8, the communication device described in aspect 9, the communication device described in aspect 10, and the communication device described in aspect 11; or, the system comprising the communication device described in aspect 12, the communication device described in aspect 13, the communication device described in aspect 14, and the communication device described in aspect 15; or, the system comprising the communication device described in aspect 16, the communication device described in aspect 17, the communication device described in aspect 18, and the communication device described in aspect 19.
  • an embodiment of the present invention provides a computer-readable storage medium for storing instructions for the above-mentioned terminal device, and when the instructions are executed, the terminal device executes the method described in the first aspect.
  • an embodiment of the present invention provides a readable storage medium for storing instructions used for the above-mentioned SMF.
  • the SMF executes the method described in the second aspect.
  • an embodiment of the present invention provides a readable storage medium for storing instructions used by the above-mentioned PCF.
  • the PCF executes the method described in the third aspect.
  • an embodiment of the present invention provides a readable storage medium for storing instructions used by the above-mentioned core network.
  • the core network executes the method described in the fourth aspect.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the first aspect above.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the second aspect above.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the third aspect above.
  • the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the method described in the fourth aspect above.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, for supporting PEGC to implement the functions involved in the first aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for PEGC.
  • the chip system can be composed of a chip, or it can include a chip and other discrete devices.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, for supporting the SMF to implement the functions involved in the second aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for the SMF.
  • the chip system can be composed of a chip, or it can include a chip and other discrete devices.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, for supporting PINE to implement the functions involved in the third aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for PINE.
  • the chip system can be composed of a chip, or it can include a chip and other discrete devices.
  • the present disclosure provides a chip system, which includes at least one processor and an interface, for supporting the PCF to implement the functions involved in the fourth aspect, for example, determining or processing at least one of the data and information involved in the above method.
  • the chip system also includes a memory, which is used to store computer programs and data necessary for the PCF.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in the first aspect above.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in aspect two above.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in aspect 3 above.
  • the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the method described in aspect four above.
  • FIG1 is an architecture diagram of a communication system provided by an embodiment of the present disclosure.
  • FIG2 is a flow chart of a PINE access authentication method provided by an embodiment of the present disclosure
  • FIG3 is a flow chart of another PINE access authentication method provided by an embodiment of the present disclosure.
  • FIG5 is a flowchart of another PINE access authentication method provided by an embodiment of the present disclosure.
  • FIG6 is a flowchart of another PINE access authentication method provided by an embodiment of the present disclosure.
  • FIG7 is a structural diagram of a communication device provided in an embodiment of the present disclosure.
  • FIG8 is an architecture diagram of another communication system provided by an embodiment of the present disclosure.
  • FIG9 is a structural diagram of another communication device provided in an embodiment of the present disclosure.
  • FIG. 10 is a structural diagram of a chip provided in an embodiment of the present disclosure.
  • first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • word “if” used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • the information including but not limited to user device information, user personal information, etc.
  • data including but not limited to data used for analysis, stored data, displayed data, etc.
  • signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • Fig. 1 shows a schematic diagram of a communication system 10 using a PINE access authentication method disclosed in the present invention.
  • the communication system 10 mainly includes AMF 101, Session Management Function (SMF) 102, Radio Access Network (RAN) 103, Authentication Server Function (AUSF) 104, Unified Data Management (UDM) 105, Policy Control Function (PCF) 106, Data Network (DN) 107, User Plane Function (UPF) 108, and User Equipment (UE) 109.
  • AMF Session Management Function
  • RAN Radio Access Network
  • AUSF Authentication Server Function
  • UDM Unified Data Management
  • PCF Policy Control Function
  • DN Data Network
  • UPF User Plane Function
  • UE User Equipment
  • UE 109 is connected to AMF 101 through N1 interface, and UE 109 is connected to RAN 103 through Radio Resource Control (RRC) protocol; RAN 103 is connected to AMF 101 through N2 interface, and RAN 103 is connected to UPF 108 through N3 interface; multiple UPFs 108 are connected through N9 interface, UPF 108 is connected to DN 107 through N6 interface, and UPF 108 is connected to SMF 102 through N4 interface; S MF 102 is connected to PCF 106 via N7 interface, SMF 102 is connected to UDM 105 via N10 interface, and SMF 102 is connected to AMF 101 via N11 interface; multiple AMF 101 are connected via N14 interface, AMF 101 is connected to UDM 105 via N8 interface, AMF 101 is connected to AUSF 104 via N12 interface, and AMF 101 is connected to PCF 106 via N15 interface; AUSF 104 is connected to UDM 105 via N13 interface.
  • AMF 101 and SMF 102 obtain user subscription data
  • the access and mobility management function (AMF) 101 is mainly used for mobility management and access management, etc., and can be used to implement other functions in the mobility management entity (MME) function except session management, such as legal monitoring and access authorization/authentication.
  • the AMF network function is referred to as AMF below.
  • the AMF may include an initial AMF (initialAMF), an old AMF (oldAMF) and a target AMF (targetAMF).
  • the initial AMF can be understood as the first AMF that processes the UE registration request in this registration.
  • the initial AMF is selected by the (R)AN, but the initial AMF may not be able to serve the UE.
  • the old AMF can be understood as the AMF that served the UE when the UE last registered with the network.
  • the target AMF can be understood as the AMF that serves the UE after the UE re-registers.
  • SMF 102 used for session management (such as session establishment, modification and release), selection and control of UPF 12, selection of service and session continuity mode, and roaming services.
  • (Radio) access network ((radio) access network, (R) AN) 103 is used to provide network access functions for authorized terminal devices in a specific area, and can use transmission tunnels of different qualities according to the level of the terminal device, business requirements, etc.
  • (R) AN can manage wireless resources, provide access services for terminal devices, and then complete the forwarding of control information and/or data information between terminal devices and the core network (core network, CN).
  • the access network device in the embodiment of the present disclosure is a device that provides wireless communication functions for terminal devices, and can also be called a network device.
  • the access network equipment may include: the next generation node basestation (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (e.g., home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station equipment (pico), the mobile switching center, or the network equipment in the future network.
  • the embodiments of the present disclosure do not limit the specific types of access network equipment. In systems with different wireless access technologies, the names of devices with access network equipment functions may be different.
  • AUSF 104 Used to interact with UDM 20 to obtain user information and perform authentication-related functions, such as generating intermediate keys.
  • UDM 105 Mainly used to manage the contract information of terminal devices.
  • the unified data management network element can be unified data management (UDM).
  • the unified data management network element can still be the UDM network element, or it can also have other names.
  • UDM 105 processes the authentication information in the 3GPP authentication and key negotiation mechanism, processes user identity information, access authorization, registration and mobility management, contract management, short message management, etc.
  • PCF 106 includes user contract data management function, policy control function, charging policy control function, quality of service (QoS) control, etc.
  • the policy control network element may be a policy control function (PCF).
  • PCF policy control function
  • future communication systems such as 6G communication systems
  • the policy control network element may still be a PCF network element, or may have other names, which is not limited in the present disclosure.
  • DN 107 is a network that provides business services to users.
  • the client is located in UE and the server is located in the data network.
  • the data network can be a private network, such as a local area network, or an external network that is not controlled by the operator, such as the Internet, or a proprietary network jointly deployed by operators, such as a network that provides Internet protocol (IP) multimedia core network subsystem (IMS) services.
  • IP Internet protocol
  • IMS Internet multimedia core network subsystem
  • UPF 108 Used to handle events related to the user plane, such as transmitting or routing data packets, detecting data packets, reporting traffic, processing quality of service (QoS), legal monitoring, storing downlink data packets, etc.
  • QoS quality of service
  • the terminal device is an entity on the user side for receiving or transmitting signals, such as a mobile phone.
  • the terminal device may also be referred to as a terminal device (terminal), user equipment, mobile station (MS), mobile terminal (MT), etc.
  • the terminal device may be a car with communication function, a smart car, a mobile phone, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in a smart city (smart city), a wireless terminal device in a smart home (smart home), etc.
  • the embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the terminal device.
  • the N1 interface is the interface between the terminal device and the AMF.
  • the N2 interface is the interface between the RAN and the AMF, which is used to send non-access stratum (NAS) messages, etc.
  • the N3 interface is the interface between the (R)AN and the UPF, which is used to transmit user plane data, etc.
  • the N4 interface is the interface between the SMF and the UPF, which is used to transmit information such as the tunnel identification information of the N3 connection, data cache indication information, downlink data notification messages, etc.
  • the N6 interface is the interface between the UPF and the DN, which is used to transmit user plane data, etc.
  • the above network functions or functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).
  • the network elements involved in the embodiments of the present disclosure may also be referred to as functional devices or functions or entities or functional entities.
  • the access and mobility management network element may also be referred to as access and mobility management functional devices or access and mobility management functional entities or access and mobility management functional entities.
  • the names of the various functional devices are not limited in the present disclosure. Those skilled in the art may replace the names of the above functional devices with other names and perform the same functions, which all fall within the scope of protection of the present disclosure.
  • the above functional devices may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).
  • a key aspect of the planned support of the 5G system for PIN (Personal IoT Networks) to connect to 5GC is to act as a gateway for PIN to connect to 5GC through PINE.
  • a key aspect of the planned support of the 5G system for PIN is the ability of a UE (referred to as PEGC) to act as a gateway for PIN elements (PINEs), which are not acting as 5G UEs, to connect to 5GC.)
  • a PINE without 3GPP capability cannot directly connect to the 5GC, but through the PEGC. Whether the PINE without 3GPP capability needs to be known by the 5GC and how to identify the PINE needs to be studied, e.g., for controlling access of the PINE to connecting 5G data networks, differentiating the PINE for policy provisioning, authorizing the PINE for traffic relay, etc.)
  • 5GS supports the policy and QoS differentiation for the traffic between a PINE and 5GS.
  • the network resource may be misused by the malicious, unauthenticated, and unauthorized PINE.
  • a PINE access authentication method and device are provided to support identity authentication and authorization of PINE to avoid abuse of network resources.
  • PINE is authenticated based on the default credentials via EAP methods, which is provisioned during production.
  • PIN AS does not provision credential to the PINE.
  • PIN AS creates the correlation among PINE related policy, the PIN ID, PEGC ID, PEMC ID, PINE ID, authenticated EAP identity of a specific PINE.
  • PIN AS has provisioned the PINE related policy, the PIN ID, PEGC ID, PEMC ID, PINE ID, authenticated EAP identity of a specific PINE to the UDR/PCF.
  • used to indicate may include being used to indicate directly or indirectly.
  • the information may include that the information directly indicates A or indirectly indicates A, but it does not mean that the information must carry A.
  • the information indicated by the information is called the information to be indicated.
  • the information to be indicated there are many ways to indicate the information to be indicated, such as but not limited to, directly indicating the information to be indicated, such as the information to be indicated itself or the index of the information to be indicated.
  • the information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance.
  • the indication of specific information can also be achieved by means of the arrangement order of each information agreed in advance (such as specified by the protocol), thereby reducing the indication overhead to a certain extent.
  • the information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and/or sending time of these sub-information can be the same or different.
  • the specific sending method is not limited in this disclosure. Among them, the sending period and/or sending time of these sub-information can be pre-defined, for example, pre-defined according to a protocol.
  • the “protocol” involved in the embodiments of the present disclosure may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, and the present disclosure does not limit this.
  • the "storage” and “saving” involved in the embodiments of the present disclosure may refer to saving in one or more memories.
  • the one or more memories may be set separately or integrated in an encoder or decoder, a processor, or a communication device.
  • the one or more memories may also be partially set separately and partially integrated in a decoder, a processor, or a communication device.
  • the type of memory may be any form of storage medium, which is not limited by the present disclosure.
  • the embodiments of the present disclosure list multiple implementation methods to clearly illustrate the technical solutions of the embodiments of the present disclosure.
  • the multiple embodiments provided by the embodiments of the present disclosure can be executed separately, or can be executed together with the methods of other embodiments of the embodiments of the present disclosure, or can be executed together with some methods in other related technologies separately or in combination; the embodiments of the present disclosure do not limit this.
  • Figure 2 is a flow chart of a PINE access authentication method provided by an embodiment of the present disclosure. As shown in Figure 2, the method may include but is not limited to the following steps:
  • PINE sends an access request to PEGC, where the access request includes identity information of PINE.
  • the PINE may send an access request to the PEGC to request access to the network through the PEGC, wherein the access request includes the identity information of the PINE.
  • the PINE may send the access request to the PEGC associated with the PINE or to which the PINE belongs.
  • PEGC can be a terminal device.
  • a terminal device can act as a PEGC for multiple PIN networks and can have multiple corresponding PIN IDs and PEGC IDs.
  • PINE sends an access request to PEGC, and the signaling used in the access request can be based on non-3GPP access (e.g. WIFI, Bluetooth) and application layer deployment.
  • non-3GPP access e.g. WIFI, Bluetooth
  • the signalling exchange between PINE and PEGC is based on non-3GPP access (e.g.WIFI, Bluetooth) and application layer deployment.
  • the identity information of the PINE includes at least one of the following:
  • the PINE ID of the PINE is The PINE ID of the PINE.
  • the identity information of PINE may include EAP (Extensible Authentication Protocol) identity information of PINE.
  • EAP Extensible Authentication Protocol
  • the identity information of the PINE may include the Mac address of the PINE.
  • the identity information of the PINE may include a permanent device identifier of the PINE.
  • the identity information of the PINE may include a device identification ID of the PINE.
  • the identity information of the PINE may include the PINE ID of the PINE.
  • the EAP identity information of PINE may include information about the MAC address, PEI, and device ID in the user name part.
  • the access request further includes at least one of the following:
  • the fully qualified domain name (FQDN) of the AAA server is the fully qualified domain name (FQDN) of the AAA server
  • the access request also includes the address of the AAA server.
  • the access request also includes the FQDN (Fully Qualified Domain Name) of the AAA server.
  • FQDN Full Qualified Domain Name
  • the access request also includes PIN information of the PIN to which the PINE belongs.
  • the EAP identity information of the PINE may include at least one of the following:
  • the PINE ID of the PINE is The PINE ID of the PINE.
  • the EAP identity information of the PINE may include the Mac address of the PINE.
  • the EAP identity information of the PINE may include a permanent device identifier of the PINE.
  • the EAP identity information of the PINE may include a device identification ID of the PINE.
  • the EAP identity information of the PINE may include the PINE ID of the PINE.
  • the PEGC may execute S22.
  • PEGC may send a PDU session modification request to SMF.
  • the PDU session modification request includes at least one of the following:
  • the fully qualified domain name (FQDN) of the AAA server is the fully qualified domain name (FQDN) of the AAA server.
  • the PDU session modification request includes the identity information of the PINE.
  • the PDU session modification request includes the address allocated by PEGC to PINE.
  • the PDU session modification request includes the port allocated by PEGC to PINE.
  • the PDU session modification request includes the PIN information of the PIN to which the PINE belongs.
  • the PDU session modification request includes the address of the AAA server.
  • the PDU session modification request includes the fully qualified domain name FQDN of the AAA server.
  • the PIN information of the PIN to which the PINE belongs includes at least one of the following:
  • the identity information of the PEGC associated with the PINE in the PIN is the identity information of the PEGC associated with the PINE in the PIN.
  • the PIN information of the PIN to which the PINE belongs includes identification information of the PIN.
  • the PIN information of the PIN to which the PINE belongs includes the identity information of the PEGC in the PIN.
  • the identity information of the PEGC includes, for example, PEGC ID and GPSI (Generic Public Subscription Identifier) of the PEGC.
  • the PIN information of the PIN to which the PINE belongs includes the identity information of the PIN unit PEMC with management capability in the PIN.
  • the identity information of the PEMC includes, for example, PEMC ID and GPSI of the PEMC.
  • the PIN information of the PIN to which the PINE belongs includes the identity information of the PEGC to which the PINE belongs in the PIN.
  • the PIN information of the PIN to which the PINE belongs includes the identity information of the PEGC associated with the PINE in the PIN.
  • S23 may be executed.
  • S23 SMF triggers PINE's identity authentication based on the PDU session modification request.
  • the SMF after the SMF receives the PDU session modification request sent by the PEGC, it can trigger the identity authentication of the PINE according to the PDU session modification request.
  • the SMF may determine the target AAA server, for example, according to a local policy of the SMF, or may also determine the target AAA server according to a PDU session modification request.
  • the SMF when it determines the target AAA server, it can send the EAP identity information of the PINE in the PDU session modification request to the target AAA server to trigger the identity authentication of the PINE.
  • PINE can also send the PIN information of the PIN belonging to PINE to the AAA server, so that the AAA server can authenticate PINE based on the EAP identity information of PINE sent by SMF and the PIN information of the PIN belonging to PINE sent by PINE.
  • the SMF determines the target AAA server based on at least one of the following:
  • the FQDN of the AAA server is The FQDN of the AAA server.
  • the SMF determines the target AAA server according to the address of the AAA server.
  • the SMF determines the target AAA server according to the FQDN of the AAA server.
  • the SMF determines the target AAA server according to the EAP identity information of the PINE.
  • the SMF determines the target AAA server according to the local configuration of the SMF.
  • the target AAA server when the target AAA server receives the EAP identity information of the PINE in the PDU session modification request sent by the SMF, the EAP identity information of the PINE can be authenticated. If the authentication is successful, EAP authentication success information can be sent to the SMF, and if the authentication fails, EAP authentication failure information can be sent to the SMF.
  • the SMF when the SMF receives EAP authentication failure information sent by the target AAA server, it can cancel the authentication process.
  • the SMF when the SMF receives the EAP authentication success information sent by the target AAA server, it can determine the authenticated EAP identity information of the PINE.
  • S24 SMF receives the authentication success message sent by the AAA server.
  • S25 SMF determines the authenticated EAP identity information of PINE.
  • the SMF upon receiving the EAP authentication success information sent by the target AAA server, determines the authenticated EAP identity information of the PINE, and can identify whether the EAP identity information of the PINE is anonymous EAP identity information, and then determines the authenticated EAP identity information of the PINE based on the identification result.
  • the EAP authentication success information includes the authenticated RAP identity information
  • the SMF can determine that the authenticated RAP identity information is the authenticated EAP identity information of PINE.
  • SMF can determine that the authenticated EAP identity information of PINE is the ordinary EAP identity information in the PDU session modification request.
  • SMF can use the address and/or port allocated to PINE by PEGC in the PDU session modification request to transmit EAP messages between PINE and the target AAA server to authenticate PINE.
  • the anonymous EAP identity information is obtained by PINE setting the user name part of the EAP identity information to anonymous, or by PINE ignoring the user name part of the EAP identity information.
  • PINE sends an access request to PEGC, wherein the access request includes the identity information of PINE
  • PINE sends a PDU session modification request to SMF
  • SMF triggers the identity authentication of PINE according to the PDU session modification request
  • SMF receives the authentication success message sent by the AAA server, and determines the authenticated EAP identity information of PINE.
  • PINE can be authenticated and authorized to avoid the abuse of network resources.
  • Figure 3 is a flow chart of another PINE access authentication method provided by an embodiment of the present disclosure. As shown in Figure 3, the method may include but is not limited to the following steps:
  • PINE sends an access request to PEGC, where the access request includes identity information of PINE.
  • S33 SMF triggers PINE's identity authentication based on the PDU session modification request.
  • S34 SMF receives the authentication success message sent by the AAA server.
  • S35 SMF determines the authenticated EAP identity information of PINE.
  • S36 SMF determines the configuration parameters corresponding to PINE.
  • the SMF triggers the identity authentication of the PINE according to the PDU session modification request, and upon receiving the authentication success message and determining the authenticated EAP identity information of the PINE, the configuration parameters corresponding to the PINE can be determined.
  • SMF determines the configuration parameters corresponding to PINE, which can be determined based on locally stored information, or obtains configuration parameters from other functional network elements, or obtains relevant information that can determine the configuration parameters from other network elements.
  • the embodiments of the present disclosure do not impose specific restrictions on this.
  • the SMF executes S38.
  • S37 SMF sends configuration parameters to PEGC.
  • the SMF may send the determined configuration parameters to the PEGC.
  • PEGC After PEGC receives the configuration parameters sent by SMF, it executes S39.
  • the PEGC may send an access response to the PINE, thereby enabling the PINE to access the network through the PEGC.
  • S31 to S36 can be implemented separately or in combination with any other steps in the embodiments of the present disclosure, for example, in combination with S21 to S23 in the embodiments of the present disclosure, and the embodiments of the present disclosure are not limited to this.
  • PINE sends an access request to PEGC, wherein the access request includes the identity information of PINE
  • PINE sends a PDU session modification request to SMF
  • SMF triggers the identity authentication of PINE according to the PDU session modification request
  • SMF determines the authenticated EAP identity information of PINE in response to receiving the authentication success message
  • SMF sends the configuration parameters to PEGC
  • PEGC sends an access response to PINE.
  • PINE can access the network through PEGC on the basis of identity authentication and authorization of PINE, thereby avoiding the abuse of network resources.
  • Figure 4 is a flow chart of a method for SMF to determine configuration parameters corresponding to PINE provided by an embodiment of the present disclosure. As shown in Figure 4, the method may include but is not limited to the following steps:
  • S41 SMF sends a query request to PCF.
  • S42 The PCF determines a configuration strategy according to the query request.
  • S44 SMF generates configuration parameters according to the configuration policy.
  • the SMF determines the configuration parameters corresponding to the PINE and may send a query request to the PCF.
  • the query request includes at least one of the following:
  • the query request includes the authenticated EAP identity information in the EAP authentication success information.
  • the query request includes PIN information of the PIN to which the PINE belongs.
  • the query request includes the identity information of the INE.
  • the PCF After receiving the query request sent by the SMF, the PCF can determine the configuration strategy according to the query request.
  • the PCF obtains the configuration policy from the PCF locally according to the query request.
  • the method in which the PCF obtains the configuration policy locally from the PCF according to the query request includes determining a mapping relationship between the configuration policy and at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE stored locally by the PCF; and determining the configuration policy according to the mapping relationship and at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE.
  • the PCF may determine a mapping relationship between the authenticated EAP identity information stored locally in the PCF and the configuration policy, and determine the configuration policy according to the mapping relationship and the authenticated EAP identity information in the query request.
  • the PCF may determine a mapping relationship between the PIN information of the PIN belonging to the PINE stored locally in the PCF and the configuration policy, and determine the configuration policy according to the mapping relationship and the PIN information of the PIN belonging to the PINE in the query request.
  • the PCF may determine a mapping relationship between the identity information of the PINE stored locally in the PCF and the configuration policy, and determine the configuration policy according to the mapping relationship and the identity information of the PINE in the query request.
  • the PCF obtains the configuration policy from the UDR according to the query request.
  • the method in which the PCF obtains the configuration policy from the UDR according to the query request includes sending at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE in the query request to the UDR, and obtaining the configuration policy from the UDR, wherein the UDR stores a mapping relationship between at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE and the configuration policy.
  • the PCF may send the authenticated EAP identity information in the query request to the UDR, and obtain the configuration policy from the UDR, wherein the UDR stores a mapping relationship between the authenticated EAP identity information and the configuration policy.
  • the PCF may send the PIN information of the PIN belonging to the PINE in the query request to the UDR, and obtain the configuration policy from the UDR, wherein the UDR stores a mapping relationship between the PIN information of the PIN belonging to the PINE and the configuration policy.
  • the PCF may send the identity information of the PINE in the query request to the UDR, and obtain the configuration policy from the UDR, wherein the UDR stores a mapping relationship between the identity information of the PINE and the configuration policy.
  • mapping relationship is provided by an application function and/or an application server related to the PIN.
  • a mapping relationship between at least one of the authenticated EAP identity information, the PIN information of the PIN to which the PINE belongs, and the identity information of the PINE and the configuration policy is provided by an application function and/or an application server related to the PIN.
  • mapping relationship can be provided by PIN AS or PIN AF.
  • the PCF sends a configuration policy to the SMF, and the configuration policy includes the QoS, URSP, connection information, etc. of the PINE.
  • S41 to S44 can be implemented separately or in combination with any other steps in the embodiments of the present disclosure, for example, in combination with S21 to S23 and/or S31 to S36 in the embodiments of the present disclosure, and the embodiments of the present disclosure are not limited to this.
  • SMF sends a query request to PCF
  • PCF determines a configuration policy according to the query request
  • PCF sends the configuration policy to SMF
  • SMF generates configuration parameters according to the configuration policy.
  • SMF can determine the configuration parameters corresponding to PINE.
  • Figure 5 is a flow chart of another PINE access authentication method provided by an embodiment of the present disclosure. As shown in Figure 5, the method may include but is not limited to the following steps:
  • S51 PINE establishes a PDU session with SMF.
  • the method for PINE to establish a PDU session with SMF can refer to the method in the related art and will not be repeated here.
  • PINE sends an access request to PEGC, where the access request includes identity information of PINE.
  • S53 PEGC sends a PDU session modification request to SMF.
  • S54 SMF triggers PINE's identity authentication based on the PDU session modification request.
  • S55 SMF receives the authentication success message sent by the AAA server.
  • S56 SMF determines the authenticated EAP identity information of PINE.
  • SMF determines the configuration parameters corresponding to PINE.
  • S58 SMF modifies the PDU session between PEGC and SMF suitable for PINE according to the configuration parameters.
  • SMF receives a PDU session modification request sent by PEGC, and in the process of executing the PDU session modification, it can trigger the identity authentication of PINE, and, when receiving the authentication success message, determine the configuration parameters corresponding to PINE, and modify the PDU session between PEGC and SMF to be suitable for PINE based on the configuration parameters, thereby completing the modification of the PDU session.
  • PINE establishes a PDU session with SMF
  • PINE sends an access request to PEGC, wherein the access request includes the identity information of PINE
  • PINE sends a PDU session modification request to SMF
  • SMF triggers the identity authentication of PINE according to the PDU session modification request
  • SMF determines the authenticated EAP identity information of PINE in response to receiving the authentication success message
  • determines the configuration parameters corresponding to PINE determines the configuration parameters corresponding to PINE
  • SMF modifies the PDU session between PEGC and SMF suitable for PINE according to the configuration parameters.
  • PINE can be authenticated and authorized to avoid the abuse of network resources.
  • Application layer signaling is exchanged between the PEGC and the PIN AS.
  • a list of PINEs authorized to access the PEGC are provisioned to the PEGC.
  • PINE requests via access request) access to the PEGC for traffic relay to 5GS.
  • the access request includes identities of PINE, external AAA server address (optional).
  • the identities of PINE include EAP identity of PINE, PINE ID of PINE.
  • EAP identity of PINE can contain information about MAC Address, PEI, device ID in the username part.
  • a PINE requests to access the PEGC for traffic relay to 5GS. The request includes identities of PINE,external AAA server address(optional).
  • the identities of PINE include EAP identity of PINE,PINE ID of PINE.EAP identity of PINE can contains information about MAC Address,PEI,device ID in the username part.
  • the signaling exchange between PINE and PEGC is based on non-3GPP access (e.g. WIFI, Bluetooth) and application layer deployment.
  • the PEGC authenticates and authorizes the access of the PINE, and allocates an IP address for the PINE. This procedure is realized based on non-3GPP access, which is out of scope of 3GPP.
  • the PEGC initiates PDU Session modification.
  • PEGC sends PINE information (PDU session modification request) to SMF through NAS signaling, including PINE's EAP identity information, the address of the external AAA server (optional), PINE ID, PINE's IP address, IP address and assigned port number (if NAT is applied). Since a PINE may be connected to multiple PEGCs, PEMCs and PINs, PEGC should send PINE-related PIN, PEGC and PEMC information to SMF. Specifically, PINE information also includes PIN identity information (such as PIN ID), PEMC identity information (such as PEMC ID, PEMC's GPSI), PEGC identity information (such as PEGC ID, PEGC's GPSI) to meet the unique identification of configuration policies.
  • PIN identity information such as PIN ID
  • PEMC identity information such as PEMC ID, PEMC's GPSI
  • PEGC identity information such as PEGC ID, PEGC's GPSI
  • the PEGC sends the PINE information to the SMF via NAS signalling, include the EAP identity of PINE, address of the external AAA server (optional), PINE ID, IP address of the PINE, IP address and allocated port number in case of NAT applied. Since a PINE may connect to multiple PEGCs, PEMCs, and PINs, the PEGC The two sides should send the PIN, PEGC, and PEMC information, which is related to the PINE, to the SMF.
  • the PINE information also include identities of PIN (e.g., PIN ID), identities of PEMC (e.g., PEMC ID, GPSI of PEMC), and identities of PEGC (e.g., PEGC ID, GPSI of PEGC) to the SMF to uniquely identify the policy.)
  • PIN ID e.g., PIN ID
  • PEMC e.g., PEMC ID, GPSI of PEMC
  • PEGC e.g., PEGC ID, GPSI of PEGC
  • SMSF triggers the EAP-based authentication mechanism with the external AAA server.
  • the external AAA server may send the successfully authenticated EAP identity of PINE.SMF terminates the procedure if the authentication is failed.
  • the SMF updates the PCF with the identities of PIN, identities of PEMC, identities of PEGC, PINE ID, and authenticated EAP identity of PINE in SM Policy Association Modification.
  • the PCF queries the UDR for PIN Specific Service Parameters with the identities of PIN, identities of PEMC, identities of PEGC, PINE ID, and authenticated EAP identity of PINE, and receives the QoS requirement of the PINE communication.
  • the PCF derives the PCC rules for the PINE according to the QoS requirement received from the UDR and IP address/port number of the PINE from the SMF.
  • the PEGC sends a response to the PINE.
  • the application traffic of the PINE is relayed to the 5GS via the PEGC.
  • each device includes a hardware structure and/or software module corresponding to each function.
  • the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present disclosure.
  • the communication device 1 shown in Figure 7 may include a transceiver module 11 and a processing module 12.
  • the transceiver module 11 may include a sending module and/or a receiving module, the sending module is used to implement a sending function, and the receiving module is used to implement a receiving function.
  • the transceiver module 11 can implement a sending function and/or a receiving function.
  • the communication device 1 is arranged at the PEGC side and comprises a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 is configured to receive an access request sent by a PINE, wherein the access request includes identity information of the PINE.
  • the transceiver module 11 is further configured to send a protocol data unit PDU session modification request to the session management function SMF.
  • the transceiver module 12 is further configured to receive configuration parameters sent by the SMF; and send an access response to the PINE.
  • the processing module 12 is configured to establish a PDU session with the SMF.
  • the PDU session modification request includes at least one of the following:
  • the fully qualified domain name (FQDN) of the AAA server is the fully qualified domain name (FQDN) of the AAA server.
  • the access request and the PDU session modification request further include at least one of the following:
  • the fully qualified domain name (FQDN) of the AAA server is the fully qualified domain name (FQDN) of the AAA server.
  • the PIN information of the PIN to which the PINE belongs includes at least one of the following:
  • the identity information of the PEGC associated with the PINE in the PIN is the identity information of the PEGC associated with the PINE in the PIN.
  • the identity information of the PINE includes at least one of the following:
  • EAP Extensible Authentication Protocol
  • the PINE ID of the PINE is The PINE ID of the PINE.
  • the communication device 1 is arranged at the SMF side and comprises a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 is configured to receive a PDU session modification request sent by a PEGC, wherein the PDU session modification request is sent by the PEGC after receiving an access request sent by a PINE, and the access request includes identity information of the PINE.
  • the processing module 12 is configured to trigger the identity authentication of the PINE according to the PDU session modification request.
  • the processing module 12 is further configured to determine a target AAA server.
  • the transceiver module 11 is further configured to send the EAP identity information of the PINE in the PDU session modification request to the target AAA server to trigger the identity authentication of the PINE.
  • the processing module 12 is further configured to determine the target AAA server according to at least one of the following:
  • the FQDN of the AAA server is The FQDN of the AAA server.
  • the processing module 12 is further configured to determine the authenticated EAP identity information of the PINE in response to receiving the EAP authentication success information.
  • the processing module 12 is further configured to, in response to the EAP identity information of the PINE being anonymous EAP identity information and the EAP authentication success information including the authenticated EAP identity information, determine that the authenticated EAP identity information is the authenticated EAP identity information of the PINE; or, in response to the EAP identity information of the PINE being ordinary EAP identity information, determine that the authenticated EAP identity information of the PINE is the ordinary EAP identity information in the PDU session modification request.
  • the processing module 12 is further configured to, in response to the EAP identity information of the PINE being anonymous EAP identity information, use the address and/or port of the PINE in the PDU session modification request to transmit the EAP message between the PINE and the target AAA server to perform identity authentication of the PINE.
  • the anonymous EAP identity information is obtained by PINE setting the user name part of the EAP identity information to be anonymous, or by PINE ignoring the user name part of the EAP identity information.
  • the processing module 12 is further configured to determine configuration parameters corresponding to the PINE.
  • the transceiver module 11 is further configured to send a query request to the PCF; and receive a configuration policy sent by the PCF.
  • the processing module 12 is further configured to determine configuration parameters corresponding to the PINE according to the configuration strategy.
  • the processing module 12 is further configured to modify the PDU session between the PEGC and the SMF suitable for PINE according to the configuration parameters.
  • the query request includes at least one of the following:
  • the PDU session modification request includes at least one of the following:
  • the FQDN of the AAA server is The FQDN of the AAA server.
  • the PIN information of the PIN to which the PINE belongs includes at least one of the following:
  • the identity information of the PEGC associated with the PINE in the PIN is the identity information of the PEGC associated with the PINE in the PIN.
  • the identity information of the PINE includes at least one of the following:
  • the PINE ID of the PINE is The PINE ID of the PINE.
  • the processing module 12 is further configured to establish a PDU session with the PEGC before receiving the PDU session modification request.
  • the communication device 1 is arranged at the PINE side and comprises a transceiver module 11 .
  • the transceiver module 11 is configured to send an access request to a PEGC associated with/to which the PINE belongs, wherein the access request includes identity information of the PINE.
  • the transceiver module 11 is further configured to receive an EAP authentication request message sent by the PEGC; and send an EAP authentication response to the PEGC.
  • the transceiver module 11 is further configured to receive an access response sent by the PEGC.
  • the identity information of the PINE includes at least one of the following:
  • the PINE ID of the PINE is The PINE ID of the PINE.
  • the access request further includes at least one of the following:
  • the FQDN of the AAA server is The FQDN of the AAA server.
  • the communication device 1 is arranged at the PCF side and comprises a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 is configured to receive a query request sent by the SMF.
  • the processing module 12 is configured to determine a configuration strategy according to the query request.
  • the transceiver module 11 is also configured to send the configuration policy to the SMF.
  • the processing module 12 is further configured to obtain the configuration policy from the PCF locally according to the query request; or to obtain the configuration policy from the UDR according to the query request.
  • the query request includes at least one of the following:
  • the processing module 12 is further configured to determine a mapping relationship between at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE stored locally by the PCF and the configuration policy; and determine the configuration policy based on the mapping relationship and at least one of the authenticated EAP identity information, the PIN information of the PIN belonging to the PINE, and the identity information of the PINE.
  • the processing module 12 is further configured to send at least one of the authenticated EAP identity information, the PIN information of the PIN to which the PINE belongs, and the identity information of the PINE in the query request to the UDR, and obtain the configuration policy from the UDR, wherein the UDR stores a mapping relationship between at least one of the authenticated EAP identity information, the PIN information of the PIN to which the PINE belongs, and the identity information of the PINE and the configuration policy.
  • mapping relationship is provided by an application function and/or an application server related to the PIN.
  • the communication device 1 provided in the above embodiments of the present disclosure achieves the same or similar beneficial effects as the PINE access authentication method provided in some of the above embodiments, which will not be described in detail here.
  • FIG8 is an architecture diagram of another communication system provided in an embodiment of the present disclosure.
  • the communication system 100 includes: PEGC, SMF, PINE and PCF.
  • PEGC is configured to execute the methods described in some of the above embodiments
  • the SMF is configured to execute the methods described in some of the above embodiments.
  • PINE is configured to perform the methods described in some of the above embodiments.
  • the PCF is configured to execute the methods described in some of the above embodiments.
  • the communication system 100 provided in the above embodiments of the present disclosure achieves the same or similar beneficial effects as the PINE access authentication method provided in some of the above embodiments, which will not be described in detail here.
  • FIG 9 is a structural diagram of another communication device 1000 provided in an embodiment of the present disclosure.
  • the communication device 1000 can be a terminal device, an SMF, or a PCF.
  • the device can be used to implement the method described in the above method embodiment, and the details can be referred to the description in the above method embodiment.
  • the communication device 1000 may include one or more processors 1001.
  • the processor 1001 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit.
  • the baseband processor may be used to process the communication protocol and communication data
  • the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.
  • the communication device 1000 may further include one or more memories 1002, on which a computer program 1004 may be stored, and the memory 1002 executes the computer program 1004 so that the communication device 1000 performs the method described in the above method embodiment.
  • data may also be stored in the memory 1002.
  • the communication device 1000 and the memory 1002 may be provided separately or integrated together.
  • the communication device 1000 may further include a transceiver 1005 and an antenna 1006.
  • the transceiver 1005 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., for implementing a transceiver function.
  • the transceiver 1005 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., for implementing a transmitting function.
  • the communication device 1000 may further include one or more interface circuits 1007.
  • the interface circuit 1007 is used to receive code instructions and transmit them to the processor 1001.
  • the processor 1001 executes the code instructions to enable the communication device 1000 to execute the method described in the above method embodiment.
  • the communication device 1000 is a PEGC, and the transceiver 1005 is used to execute S21 and S22 in FIG. 2 ; S31 , S32 , S37 and S38 in FIG. 3 ; and S52 and S53 in FIG. 5 .
  • the communication device 1000 is an SMF: the transceiver 1005 is used to execute S22 in Figure 2; S32, S34 and S37 in Figure 3; S41 and S43 in Figure 4; S53 and S55 in Figure 5; the processor 1001 is used to execute S23 and S25 in Figure 2; S33, S35 and S36 in Figure 3; S44 in Figure 4; S54, S56 and S57 in Figure 5.
  • the communication device 1000 is a PCF: the transceiver 1005 is used to execute S41 and S43 in FIG. 4 ; the processor 1001 is used to execute S42 in FIG. 4 .
  • the communication device 1000 is a PINE, and the transceiver 1005 is used to execute S21 in FIG. 2 ; S31 and S38 in FIG. 3 ; and S52 in FIG. 5 .
  • the processor 1001 may include a transceiver for implementing receiving and sending functions.
  • the transceiver may be a transceiver circuit, an interface, or an interface circuit.
  • the transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated.
  • the above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.
  • the processor 1001 may store a computer program 1003, which runs on the processor 1001 and enables the communication device 1000 to perform the method described in the above method embodiment.
  • the computer program 1003 may be fixed in the processor 1001, in which case the processor 1001 may be implemented by hardware.
  • the communication device 1000 may include a circuit that can implement the functions of sending or receiving or communicating in the aforementioned method embodiments.
  • the processor and transceiver described in the present disclosure may be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc.
  • the processor and transceiver may also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.
  • CMOS complementary metal oxide semiconductor
  • NMOS N-type metal oxide semiconductor
  • PMOS P-type metal oxide semiconductor
  • BJT bipolar junction transistor
  • BiCMOS bipolar CMOS
  • SiGe silicon germanium
  • GaAs gallium arsenide
  • the communication device described in the above embodiment may be a terminal device, an SMF, a PCF, or a core network, but the scope of the communication device described in the present disclosure is not limited thereto, and the structure of the communication device may not be limited by FIG. 9.
  • the communication device may be an independent device or may be part of a larger device.
  • the communication device may be:
  • the IC set may also include a storage component for storing data and computer programs;
  • ASIC such as modem
  • FIG. 10 is a structural diagram of a chip provided in an embodiment of the present disclosure.
  • the chip 1100 includes a processor 1101 and an interface 1103.
  • the number of the processor 1101 may be one or more, and the number of the interface 1103 may be multiple.
  • the interface 1103 is used to receive code instructions and transmit them to the processor.
  • the processor 1101 is configured to run code instructions to execute the PINE access authentication method as described in some of the above embodiments.
  • the interface 1103 is used to receive code instructions and transmit them to the processor.
  • the processor 1101 is configured to run code instructions to execute the PINE access authentication method as described in some of the above embodiments.
  • the interface 1103 is used to receive code instructions and transmit them to the processor.
  • the processor 1101 is configured to run code instructions to execute the PINE access authentication method as described in some of the above embodiments.
  • the interface 1103 is used to receive code instructions and transmit them to the processor.
  • the processor 1101 is configured to run code instructions to execute the PINE access authentication method as described in some of the above embodiments.
  • the chip 1100 further includes a memory 1102, and the memory 1102 is used to store necessary computer programs and data.
  • the disclosed embodiments also provide an access authentication system, which includes the communication device as PEGC, the communication device as PINE, the communication device as SMF and the communication device as PCF in the aforementioned embodiment of FIG. 7 , or the system includes the communication device as PEGC, the communication device as PINE, the communication device as SMF and the communication device as PCF in the aforementioned embodiment of FIG. 9 .
  • the present disclosure also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.
  • the present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.
  • the computer program product includes one or more computer programs.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a high-density digital video disc (DVD)
  • DVD high-density digital video disc
  • SSD solid state disk
  • At least one in the present disclosure can also be described as one or more, and a plurality can be two, three, four or more, which is not limited in the present disclosure.
  • the technical features in the technical feature are distinguished by “first”, “second”, “third”, “A”, “B”, “C” and “D”, etc., and there is no order of precedence or size between the technical features described by the “first”, “second”, “third”, “A”, “B”, “C” and “D”.
  • “A and/or B” includes the following three combinations: only A, only B, and a combination of A and B.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种PINE的接入认证方法和装置，该方法包括：PEGC接收PINE发送的接入请求，其中，接入请求包括PINE的身份信息；向会话管理功能SMF发送协议数据单元PDU会话修改请求。由此，能够对PINE进行身份验证和授权，避免网络资源滥用。

Description

私有物联网单元PINE的接入认证方法和装置 技术领域
本公开涉及通信技术领域，尤其涉及一种PINE的接入认证方法和装置。
背景技术
相关技术中，5G(5th generation mobile networks，第五代移动网络)系统中提出支持不具有网关能力的PINE(Personal IoT Networks Element，私有物联网单元)连接至5GC(5G core，5G核心)的网关。
其中，PINE通过PEGC(Personal IoT Networks Elements with Gateway Capability，具有网关能力的私有物联网单元)连接到5GC。
但是，相关技术中不支持对PINE进行身份验证和授权，存在网络资源被滥用的风险，这是亟需解决的问题。
发明内容
本公开实施例提供一种PINE的接入认证方法和装置，能够对PINE进行身份验证和授权，避免网络资源滥用。
第一方面，本公开实施例提供一种PINE的接入认证方法，由PEGC执行，包括：接收PINE发送的接入请求，其中，所述接入请求包括所述PINE的身份信息；向会话管理功能SMF发送协议数据单元PDU会话修改请求。
在该技术方案中，PEGC接收PINE发送的接入请求，其中，所述接入请求包括所述PINE的身份信息；向会话管理功能SMF发送协议数据单元PDU会话修改请求。由此，能够对PINE进行身份验证和授权，避免网络资源滥用。
第二方面，本公开实施例提供另一种PINE的接入认证方法，由SMF执行，包括：接收PEGC发送的PDU会话修改请求，其中，所述PDU会话修改请求为所述PEGC在接收到PINE发送的接入请求的情况下发送的，所述接入请求包括所述PINE的身份信息；根据所述PDU会话修改请求，触发所述PINE的身份认证。
第三方面，本公开实施例提供又一种PINE的接入认证方法，由PINE执行，包括：向与PINE关联的/所归属的PEGC发送接入请求，其中，所述接入请求包括所述PINE的身份信息。
第四方面，本公开实施例提供又一种PINE的接入认证方法，由PCF执行，包括：接收SMF发送的查询请求；根据所述查询请求，确定配置策略；将所述配置策略发送至所述SMF。
第五方面，本公开实施例提供一种通信装置，该通信装置具有实现上述第一方面所述的方法中PEGC的部分或全部功能，比如通信装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
所述通信装置包括：收发模块，被配置为接收PINE发送的接入请求，其中，所述接入请求包括所述PINE的身份信息；所述收发模块，还被配置为向会话管理功能SMF发送协议数据单元PDU会话修改请求。
第六方面，本公开实施例提供另一种通信装置，该通信装置具有实现上述第二方面所述的方法示例中SMF的部分或全部功能，比如通信装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
所述通信装置包括：收发模块，被配置为接收PEGC发送的PDU会话修改请求，其中，所述PDU会话修改请求为所述PEGC在接收到PINE发送的接入请求的情况下发送的，所述接入请求包括所述PINE的身份信息；处理模块，被配置为根据所述PDU会话修改请求，对所述PINE进行身份认证。
第七方面，本公开实施例提供另一种通信装置，该通信装置具有实现上述第三方面所述的方法示例中PINE的部分或全部功能，比如通信装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
所述通信装置包括：收发模块，被配置为向与PINE关联的/所归属的PEGC发送接入请求，其中，所述接入请求包括所述PINE的身份信息。
第八方面，本公开实施例提供另一种通信装置，该通信装置具有实现上述第三方面所述的方法示例 中PCF的部分或全部功能，比如通信装置的功能可具备本公开中的部分或全部实施例中的功能，也可以具备单独实施本公开中的任一个实施例的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的单元或模块。
所述通信装置包括：收发模块，被配置为接收SMF发送的查询请求；处理模块，被配置为根据所述查询请求，确定配置策略；所述收发模块，还被配置为将所述配置策略发送至所述SMF。
第九方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第一方面所述的方法。
第十方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第二方面所述的方法。
第十一方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第三方面所述的方法。
第十二方面，本公开实施例提供一种通信装置，该通信装置包括处理器，当该处理器调用存储器中的计算机程序时，执行上述第四方面所述的方法。
第十三方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第一方面所述的方法。
第十四方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第二方面所述的方法。
第十五方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第三方面所述的方法。
第十六方面，本公开实施例提供一种通信装置，该通信装置包括处理器和存储器，该存储器中存储有计算机程序；所述处理器执行该存储器所存储的计算机程序，以使该通信装置执行上述第四方面所述的方法。
第十七方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第一方面所述的方法。
第十八方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第二方面所述的方法。
第十九方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第三方面所述的方法。
第二十方面，本公开实施例提供一种通信装置，该装置包括处理器和接口电路，该接口电路用于接收代码指令并传输至该处理器，该处理器用于运行所述代码指令以使该装置执行上述第四方面所述的方法。
第二十一方面，本公开实施例提供一种通信系统，该系统包括第五方面所述的通信装置、第六方面所述的通信装置以及第七方面所述的通信装置，或者，该系统包括第八方面所述的通信装置、第九方面所述的通信装置、第十方面所述的通信装置以及第十一方面所述的通信装置，或者，该系统包括第十二方面所述的通信装置、第十三方面所述的通信装置、第十四方面所述的通信装置以及第十五方面所述的通信装置，或者，该系统包括第十六方面所述的通信装置、第十七方面所述的通信装置、第十八方面所述的通信装置以及第十九方面所述的通信装置。
第二十二方面，本发明实施例提供一种计算机可读存储介质，用于储存为上述终端设备所用的指令，当所述指令被执行时，使所述终端设备执行上述第一方面所述的方法。
第二十三方面，本发明实施例提供一种可读存储介质，用于储存为上述SMF所用的指令，当所述指令被执行时，使所述SMF执行上述第二方面所述的方法。
第二十四方面，本发明实施例提供一种可读存储介质，用于储存为上述PCF所用的指令，当所述指令被执行时，使所述PCF执行上述第三方面所述的方法。
第二十五方面，本发明实施例提供一种可读存储介质，用于储存为上述核心网所用的指令，当所述 指令被执行时，使所述核心网执行上述第四方面所述的方法。
第二十六方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第二十七方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
第二十八方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第三方面所述的方法。
第二十九方面，本公开还提供一种包括计算机程序的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第四方面所述的方法。
第三十方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持PEGC实现第一方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存PEGC必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第三十一方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持SMF实现第二方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存SMF必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第三十二方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持PINE实现第三方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存PINE必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第三十三方面，本公开提供一种芯片系统，该芯片系统包括至少一个处理器和接口，用于支持PCF实现第四方面所涉及的功能，例如，确定或处理上述方法中所涉及的数据和信息中的至少一种。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存PCF必要的计算机程序和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第三十四方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第三十五方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第二方面所述的方法。
第三十六方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第三方面所述的方法。
第三十七方面，本公开提供一种计算机程序，当其在计算机上运行时，使得计算机执行上述第四方面所述的方法。
附图说明
为了更清楚地说明本公开实施例或背景技术中的技术方案，下面将对本公开实施例或背景技术中所需要使用的附图进行说明。
图1是本公开实施例提供的一种通信系统的架构图；
图2是本公开实施例提供的一种PINE的接入认证方法的流程图；
图3是本公开实施例提供的另一种PINE的接入认证方法的流程图；
图4是本公开实施例提供的一种SMF确定PINE对应的配置参数的方法的流程图；
图5是本公开实施例提供的又一种PINE的接入认证方法的流程图；
图6是本公开实施例提供的又一种PINE的接入认证方法的流程图；
图7是本公开实施例提供的一种通信装置的结构图；
图8是本公开实施例提供的另一种通信系统的架构图；
图9是本公开实施例提供的另一种通信装置的结构图；
图10是本公开实施例提供的一种芯片的结构图。
具体实施方式
为了更好的理解本公开实施例公开的一种PINE的接入认证方法和装置，下面首先对本公开实施例适用的通信系统进行描述。
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
在本公开使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开。在本公开和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也是旨在包括多数形式，除非上下文清楚地表示其它含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，例如，在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
需要说明的是，本公开所涉及的信息(包括但不限于用户设备信息、用户个人信息等)、数据(包括但不限于用于分析的数据、存储的数据、展示的数据等)以及信号，均为经用户授权或者经过各方充分授权的，且相关数据的收集、使用和处理需要遵守相关国家和地区的相关法律法规和标准。
应理解，本公开各个实施例的技术方案，按照接入制式来划分可以应用于各种通信系统，例如：全球移动通讯系统(Global System of Mobile communication，GSM)，码分多址(Code Division Multiple Access，CDMA)系统，宽带码分多址(Wideband CodeDivision Multiple Access Wireless，WCDMA)，通用分组无线业务(General PacketRadio Service，GPRS)，长期演进(Long Term Evolution，LTE)，LTE频分双工(FrequencyDivision Duplex，FDD)系统、LTE时分双工(Time Division Duplex，TDD)、通用移动通信系统(Universal Mobile Telecommunication System，UMTS)、无线蜂窝网络系统、5G系统以及未来的通信系统等。
图1示出了使用本公开的一种PINE的接入认证方法的通信系统10的示意图。如图1所示，该通信系统10主要包括AMF 101、会话管理功能设备(Session Management Function，SMF)102、无线接入网(Radio Access Network，RAN)103、鉴权服务器功能设备(Authentication Server Function，AUSF)104、统一数据管理设备(Unified DataManagement，UDM)105、策略控制功能设备(Policy Control function，PCF)106、数据网络(Data Network，DN)107、用户面功能设备(User Plane Function，UPF)108、用户设备(UserEquipment，UE)109。其中，UE 109通过N1接口与AMF 101连接，UE 109通过无线资源控制(Radio Resource Control，RRC)协议与RAN 103连接；RAN 103通过N2接口与AMF 101连接，RAN 103通过N3接口与UPF 108连接；多个UPF 108之间通过N9接口连接，UPF 108通过N6接口与DN 107连接，同时，UPF 108通过N4接口与SMF 102连接；SMF 102通过N7接口与PCF 106连接，SMF 102通过N10接口与UDM 105连接，同时，SMF 102通过N11接口与AMF 101连接；多个AMF 101之间通过N14接口连接，AMF 101通过N8接口与UDM 105连接，AMF 101通过N12接口与AUSF 104连接，同时，AMF 101通过N15接口与PCF 106连接；AUSF 104通过N13接口与UDM 105连接。AMF 101和SMF 102分别通过N8和N10接口从UDM 105获取用户签约数据，通过N15和N7接口从PCF 106获取策略数据。SMF 102通过N4接口控制UPF 108。
其中，接入和移动性管理(access and mobility management function，AMF)101，主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility managemententity，MME)功能中除会话管理之外的其它功能，例如，合法监听以及接入授权/鉴权等功能。可理解，以下简称AMF网络功能为AMF。本公开实施例中，AMF可包括初始AMF(initialAMF)，原AMF(oldAMF)和目标AMF(targetAMF)。例如，该初始AMF可理解为该次注册中第一个处理UE注册请求的AMF，该初始AMF由(R)AN选择，但是该初始AMF不一定能为该UE服务，原AMF可理解为UE上一次注册到网络时服务UE的AMF，目标AMF可理解为UE重新注册后，为该UE服务的AMF。
SMF 102：用于会话管理(例如会话的建立、修改和释放)、UPF 12的选择和控制、业务和会话连续性(service and session continuity)模式的选择以及漫游服务等。
(无线)接入网络((radio)access network，(R)AN)103，用于为特定区域的授权终端设备提供入网功能，并能够根据终端设备的级别，业务的需求等使用不同质量的传输隧道。如(R)AN可管理无线资源，为终端设备提供接入服务，进而完成控制信息和/或数据信息在终端设备和核心网(core network，CN)之间的转发。本公开实施例中的接入网设备是一种为终端设备提供无线通信功能的设备，也可称为网络设备。如该接入网设备可以包括：5G系统中的下一代基站节点(next generation node basestation，gNB)、长期演进(longterm evolution，LTE)中的演进型节点B(evolved node B，eNB)、无线网络控制器(radionetwork  controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolvednodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输点(transmitting andreceiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本公开实施例对接入网设备的具体类型不作限定。在不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。
AUSF 104：用于与UDM 20交互获取用户信息，并执行与认证相关的功能，例如生成中间密钥等。
UDM 105：主要用于管理终端设备的签约信息。在5G通信系统中，统一数据管理网元可以是统一数据管理(unified data management，UDM)，在未来的通信系统(如6G通信系统)中，统一数据管理网元可以仍是UDM网元，或者也可以具有其它名称。UDM 105处理3GPP认证和密钥协商机制中的认证信息、处理用户身份信息，接入授权、注册和移动性管理、签约管理、短消息管理等。
PCF 106：包含用户签约数据管理功能、策略控制功能、计费策略控制功能、服务质量(quality of service，QoS)控制等。在5G通信系统中，策略控制网元可以是策略控制功能(policy control function，PCF)，在未来的通信系统(如6G通信系统)中，策略控制网元可以仍是PCF网元，或者也可以具有其它名称，本公开并不限定。
DN 107是为用户提供业务服务的网络，一般客户端位于UE，服务端位于数据网络。数据网络可以是私有网络，如局域网，也可以是不受运营商管控的外部网络，如因特网，还可以是运营商共同部署的专有网络，如提供互联网协议(internet protocol，IP)多媒体网络子系统(IP multimedia core network subsystem，IMS)服务的网络。
UPF 108：用于处理与用户面相关的事件，例如传输或路由数据包、检测数据包、上报业务量、处理服务质量(quality of service，QoS)、合法监听、存储下行数据包等。
UE 109(user equipment，终端设备)是用户侧的一种用于接收或发射信号的实体，如手机。终端设备也可以称为终端设备(terminal)、用户设备、移动台(mobile station，MS)、移动终端设备(mobile terminal，MT)等。终端设备可以是具备通信功能的汽车、智能汽车、手机(mobile phone)、穿戴式设备、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self-driving)中的无线终端设备、远程手术(remote medical surgery)中的无线终端设备、智能电网(smart grid)中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备等等。本公开的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
在该网络架构中，N1接口为终端设备与AMF之间的接口。N2接口为RAN和AMF的接口，用于非接入层(non-access stratum，NAS)消息的发送等。N3接口为(R)AN和UPF之间的接口，用于传输用户面的数据等。N4接口为SMF和UPF之间的接口，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，下行数据通知消息等信息。N6接口为UPF和DN之间的接口，用于传输用户面的数据等。
可以理解的是，以上说介绍的术语在不同的领域或不同的标准中，可能有不同的名称，因此不应将以上所示的名称理解为对本公开实施例的限定。上述网络功能或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
需要说明的是，本公开实施例中所涉及的网元还可以称为功能设备或功能或实体或功能实体，例如，接入和移动性管理网元还可以称为接入和移动性管理功能设备或者接入和移动性管理功能实体或者接入和移动性管理功能实体。各个功能设备的名称在本公开中不做限定，本领域技术人员可以将上述功能设备的名称更换为其它名称而执行相同的功能，均属于本公开保护的范围。上述功能设备既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。
可以理解的是，本公开实施例描述的通信系统，以及网络架构是为了更加清楚的说明本公开实施例的技术方案，并不构成对于本公开实施例提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本公开实施例提供的技术方案对于类似的技术问题，同样适用。
下面结合附图对本公开所提供的PINE的接入认证方法和装置进行详细地介绍。
相关技术中，5G系统支持PIN(Personal IoT Networks，私有物联网)连接至5GC的一个关键方面为通过PINE充当PIN连接至5GC的网关。(A key aspect of the planned support of the 5G system for PIN is the ability of a UE(referred to as PEGC)to act as a gateway for PIN elements(PINEs),which are not acting as 5G UEs,to connect to 5GC.)
没有3GPP能力的PINE不能直接连接到5GC，而是通过PEGC。没有3GPP能力的PINE是否需 要5GC知道，以及如何识别PINE需要研究，例如，控制PINE对连接5G数据网络的访问，区分PINE进行策略配置，授权PINE进行流量延迟等。(A PINE without 3GPP capability cannot directly connect to the 5GC,but through the PEGC.Whether the PINE without 3GPP capability needs to be known by the 5GC and how to identify the PINE needs to be studied,e.g.,for controlling access of the PINE to connecting 5G data networks,differentiating the PINE for policy provisioning,authorizing the PINE for traffic relay,etc.)
5GS支持PINE和5GS之间流量的策略和QoS区分。网络资源可能被恶意、未经身份验证和未经授权的PINE滥用。(5GS supports the policy and QoS differentiation for the traffic between a PINE and 5GS.The network resource may be misused by the malicious,unauthenticated,and unauthorized PINE.)
但是，相关技术中不支持5GS对PINE(PIN单元)进行身份验证和授权。(However,there is no existing mechanism to enable 5GS to authenticate and authorize the PIN element.)
基于此，本公开实施例中，提供一种PINE的接入认证方法和装置，以支持对PINE进行身份验证和授权，避免网络资源滥用。
本公开实施例中，假设PINE基于出厂自带凭据通过EAP方法进行身份验证，该方法在生成期间提供。(It is assumed that PINE is authenticated based on the default credential via EAP methods,which is provisioned during production.)
PIN AS不为PINE提供凭证。(PIN AS does not provision credential to the PINE.)
PIN AS PIN相关策略、PIN ID、PEGC ID、PEMC ID、PINE ID、特定PINE的已验证EAP身份之间建立关联。(PIN AS creates the correlation among PINE related policy,the PIN ID,PEGC ID,PEMC ID,PINE ID,authenticated EAP identity of a specific PINE.)
PIN AS已将PINE相关策略、PIN ID、PEGC ID、PEMC ID、PINE ID、特定PINE的已验证EAP身份提供给UDR/PCF。(PIN AS has provisioned the PINE related policy,the PIN ID,PEGC ID,PEMC ID,PINE ID,authenticated EAP identity of a specific PINE to the UDR/PCF.)
此外，为了便于理解本公开实施例，做出以下几点说明。
第一，本公开实施例中，“用于指示”可以包括用于直接指示和用于间接指示。当描述某一信息用于指示A时，可以包括该信息直接指示A或间接指示A，而并不代表该信息中一定携带有A。
将信息所指示的信息称为待指示信息，则具体实现过程中，对待指示信息进行指示的方式有很多种，例如但不限于，可以直接指示待指示信息，如待指示信息本身或者该待指示信息的索引等。也可以通过指示其他信息来间接指示待指示信息，其中该其他信息与待指示信息之间存在关联关系。还可以仅仅指示待指示信息的一部分，而待指示信息的其他部分则是已知的或者提前约定的。例如，还可以借助预先约定(例如协议规定)的各个信息的排列顺序来实现对特定信息的指示，从而在一定程度上降低指示开销。
待指示信息可以作为一个整体一起发送，也可以分成多个子信息分开发送，而且这些子信息的发送周期和/或发送时机可以相同，也可以不同。具体发送方法本公开不进行限定。其中，这些子信息的发送周期和/或发送时机可以是预先定义的，例如根据协议预先定义的。
第二，本公开实施例中涉及的“协议”可以是指通信领域的标准协议，例如可以包括LTE协议、NR协议以及应用于未来的通信系统中的相关协议，本公开对此不做限定。
第三，本公开实施例中涉及的“存储”、“保存”，可以是指保存在一个或者多个存储器中。所述一个或者多个存储器，可以是单独的设置，也可以是集成在编码器或者译码器，处理器、或通信装置中。所述一个或者多个存储器，也可以是一部分单独设置，一部分集成在译码器、处理器、或通信装置中。存储器的类型可以是任意形式的存储介质，本公开并不对此限定。
第四，本公开实施例列举了多个实施方式以对本公开实施例的技术方案进行清晰地说明。当然，本领域内技术人员可以理解，本公开实施例提供的多个实施例，可以被单独执行，也可以与本公开实施例中其他实施例的方法结合后一起被执行，还可以单独或结合后与其他相关技术中的一些方法一起被执行；本公开实施例并不对此进行限定。
请参见图2，图2是本公开实施例提供的一种PINE的接入认证方法的流程图。如图2所示，该方法可以包括但不限于如下步骤：
S21：PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息。
本公开实施例中，PINE可以向PEGC发送接入请求，可以请求通过PEGC接入网络，其中，接入请求中包括PINE的身份信息。其中，PINE可以向与PINE关联的，或者PINE所归属的PEGC发送接入请求。
其中，PEGC可以为终端设备，一个终端设备可以给多个PIN网络充当PEGC，可以有多个对应的PIN ID和PEGC ID。一个PEGC下面有多个PINE，所以要配置某个PINE ID的QoS，就需要判断PINE  ID和哪个PEGC ID绑定，和哪个PIN ID绑定。
本公开实施例中，PINE向PEGC发送接入请求，接入请求所使用的信令可以基于非3GPP接入(如WIFI、蓝牙)和应用层部署。(The signalling exchange between PINE and PEGC is based on non-3GPP access(e.g.WIFI,Bluetooth)and application layer deployment.)
在一些实施例中，PINE的身份信息包括以下至少一项：
PINE的可扩展身份验证协议EAP身份信息；
PINE的媒体接入控制Mac地址；
PINE的永久设备标识符；
PINE的设备标识ID；
PINE的PINE ID。
本公开实施例中，PINE的身份信息可以包括PINE的EAP(Extensible Authen-tication Protocol，扩展认证协议)身份信息。
本公开实施例中，PINE的身份信息可以包括PINE的Mac地址。
本公开实施例中，PINE的身份信息可以包括PINE的永久设备标识符。
本公开实施例中，PINE的身份信息可以包括PINE的设备标识ID。
本公开实施例中，PINE的身份信息可以包括PINE的PINE ID。
其中，PINE的EAP身份信息可以在用户名部分包含有关MAC地址、PEI、设备ID的信息。
在一些实施例中，接入请求之中，还包括以下至少一个：
验证、授权和记账AAA服务器的地址；
AAA服务器的完全限定域名FQDN；
PINE所属PIN的PIN信息。
本公开实施例中，接入请求中还包括AAA服务器的地址。
本公开实施例中，接入请求中还包括AAA服务器的FQDN(Fully Qualified Domain Name，完全限定域名)。
本公开实施例中，接入请求中还包括PINE所属PIN的PIN信息。
其中，PINE的EAP身份信息可包括以下至少一个：
PINE的Mac(Media Access Control，媒体接入控制)地址；
PINE的永久设备标识符；
PINE的设备标识ID；
PINE的PINE ID。
本公开实施例中，PINE的EAP身份信息可包括PINE的Mac地址。
本公开实施例中，PINE的EAP身份信息可包括PINE的永久设备标识符。
本公开实施例中，PINE的EAP身份信息可包括PINE的设备标识ID。
本公开实施例中，PINE的EAP身份信息可包括PINE的PINE ID。
在一些可能的实现方式中，PEGC在接收到PINE发送的接入请求之后，可以执行S22。
S22：PEGC向SMF发送PDU会话修改请求。
本公开实施例中，PEGC在接收到PINE发送的接入请求之后，可以向SMF发送PDU会话修改请求。
在一些实施例中，PDU会话修改请求，包括以下至少一个：
PINE的身份信息；
PEGC为PINE分配的地址；
PEGC为PINE分配的端口；
PINE所属PIN的PIN信息；
验证、授权和记账AAA服务器的地址；
AAA服务器的完全限定域名FQDN。
本公开实施例中，PDU会话修改请求之中包括PINE的身份信息。
本公开实施例中，PDU会话修改请求之中包括PEGC为PINE分配的地址。
本公开实施例中，PDU会话修改请求之中包括PEGC为PINE分配的端口。
本公开实施例中，PDU会话修改请求之中包括PINE所属PIN的PIN信息。
本公开实施例中，PDU会话修改请求之中包括AAA服务器的地址。
本公开实施例中，PDU会话修改请求之中包括AAA服务器的完全限定域名FQDN。
在一些实施例中，PINE所属PIN的PIN信息包括以下至少一项：
PIN的标识信息；
PIN之中PEGC的身份信息；
PIN之中具有管理能力的PIN单元PEMC的身份信息；
PIN之中PINE所归属的PEGC的身份信息；
PIN之中PINE关联的PEGC的身份信息。
本公开实施例中，PINE所属PIN的PIN信息包括PIN的标识信息。
本公开实施例中，PINE所属PIN的PIN信息包括PIN之中PEGC的身份信息。其中，PEGC的身份信息，例如：PEGC ID、PEGC的GPSI(Generic Public Subscription Identifier，通用公共用户标识符)。
本公开实施例中，PINE所属PIN的PIN信息包括PIN之中具有管理能力的PIN单元PEMC的身份信息。其中，PEMC的身份信息，例如：PEMC ID、PEMC的GPSI。
本公开实施例中，PINE所属PIN的PIN信息包括PIN之中PINE所归属的PEGC的身份信息。
本公开实施例中，PINE所属PIN的PIN信息包括PIN之中PINE关联的PEGC的身份信息。
在一些可能的实现方式中，SMF接收到PEGC发送的PDU会话修改请求之后，可以执行S23。
S23：SMF根据PDU会话修改请求，触发PINE的身份认证。
本公开实施例中，SMF接收到PEGC发送的PDU会话修改请求之后，可以根据PDU会话修改请求，触发PINE的身份认证。
其中，SMF可以确定目标AAA服务器，例如根据SMF的本地策略确定目标AAA服务器，或者还可以根据PDU会话修改请求确定目标AAA服务器。
其中，SMF在确定目标AAA服务器的情况下，可以将PDU会话修改请求中的PINE的EAP身份信息发送至目标AAA服务器，以触发PINE的身份认证。
其中，在目标AAA服务器进行PINE的身份认证时，PINE还可以将PINE所属PIN的PIN信息发送至AAA服务器，从而AAA服务器可以根据SMF发送的PINE的EAP身份信息以及PINE发送PINE所属PIN的PIN信息，对PINE进行身份认证。
在一些实施例中，SMF根据以下至少一个，确定所述目标AAA服务器：
AAA服务器的地址；
AAA服务器的FQDN；
PINE的EAP身份信息；
SMF的本地配置。
本公开实施例中，SMF根据AAA服务器的地址，确定所述目标AAA服务器。
本公开实施例中，SMF根据AAA服务器的FQDN，确定所述目标AAA服务器。
本公开实施例中，SMF根据PINE的EAP身份信息，确定所述目标AAA服务器。
本公开实施例中，SMF根据SMF的本地配置，确定所述目标AAA服务器。
在一些实施例中，目标AAA服务器接收到SMF发送的PDU会话修改请求中的PINE的EAP身份信息的情况下，可以对PINE的EAP身份信息进行身份认证，其中，在认证成功的情况下，可以向SMF发送EAP认证成功信息，在认证失败的情况下，可以向SMF发送EAP认证失败信息。
本公开实施例中，SMF在接收到目标AAA服务器发送的EAP认证失败信息的情况下，可以取消认证过程。
本公开实施例中，SMF在接收到目标AAA服务器发送的EAP认证成功信息的情况下，可以确定PINE的已认证EAP身份信息。
S24：SMF接收AAA服务器发送的认证成功消息。
S25：SMF确定PINE的已认证EAP身份信息。
本公开实施例中，SMF在接收到目标AAA服务器发送的EAP认证成功信息的情况下，确定PINE的已认证EAP身份信息，可以对PINE的EAP身份信息是否为匿名EAP身份信息进行识别，进而根据识别结果确定PINE的已认证EAP身份信息。
其中，在PINE的EAP身份信息为匿名EAP身份信息的情况下，EAP认证成功信息中包括已认证的RAP身份信息，SMF可以确定已认证的RAP身份信息为PINE的已认证EAP身份信息。
其中，在PINE的EAP身份信息为普通EAP身份信息，不是匿名EAP身份信息的情况下，SMF可以确定PINE的已认证EAP身份信息为PDU会话修改请求中的普通EAP身份信息。
在一些可能的实现方式中，若PINE的EAP身份信息为匿名EAP身份信息，SMF可以利用PDU会话修改请求中PEGC为PINE分配的地址和/或端口，传递PINE与目标AAA服务器之间的EAP消息， 以进行PINE的身份认证。
其中，匿名EAP身份信息为PINE将EAP身份信息的用户名部分设置为匿名得到的，或者PINE忽略EAP身份信息的用户名部分得到的。
通过实施本公开实施例，PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息，PINE向SMF发送PDU会话修改请求，SMF根据PDU会话修改请求，触发PINE的身份认证，SMF接收AAA服务器发送的认证成功消息，确定PINE的已认证EAP身份信息。由此，能够对PINE进行身份验证和授权，避免网络资源滥用。
请参见图3，图3是本公开实施例提供的另一种PINE的接入认证方法的流程图。如图3所示，该方法可以包括但不限于如下步骤：
S31：PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息。
S32：PEGC向SMF发送PDU会话修改请求。
S33：SMF根据PDU会话修改请求，触发PINE的身份认证。
S34：SMF接收AAA服务器发送的认证成功消息。
S35：SMF确定PINE的已认证EAP身份信息。
其中，S31至S35的相关描述可以参见上述实施例中的相关描述，此处不再赘述。
S36：SMF确定PINE对应的配置参数。
本公开实施例中，SMF根据PDU会话修改请求，触发PINE的身份认证，在接收到认证成功消息，确定PINE的已认证EAP身份信息的情况下，可以确定PINE对应的配置参数。
其中，SMF确定PINE对应的配置参数，可以根据本地存储的信息进行确定，或者从其他功能网元处获取配置参数，或者从其他网元处获取能够确定配置参数的相关信息，本公开实施例对此不作具体限制。
在一些可能的实现方式中，SMF在确定配置参数之后，执行S38。
S37：SMF向PEGC发送配置参数。
本公开实施例中，SMF在确定配置参数之后，可以将确定的配置参数发送至PEGC。
其中，PEGC接收到SMF发送的配置参数之后，执行S39。
S38：PEGC向PINE发送接入响应。
本公开实施例中，PEGC接收到SMF发送的配置参数之后，可以向PINE发送接入响应。由此实现PINE通过PEGC接入网络。
需要说明的是，本公开实施例中，S31至S36可以单独被实施，也可以结合本公开实施例中的任何一个其他步骤一起被实施，例如结合本公开实施例中的S21至S23一起被实施，本公开实施例并不对此做出限定。
通过实施本公开实施例，PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息，PINE向SMF发送PDU会话修改请求，SMF根据PDU会话修改请求，触发PINE的身份认证，SMF响应于接收到认证成功消息，确定PINE的已认证EAP身份信息，确定PINE对应的配置参数，SMF向PEGC发送配置参数，PEGC向PINE发送接入响应。由此，能够在对PINE进行身份验证和授权的基础上，实现PINE通过PEGC接入网络，避免网络资源滥用。
请参见图4，图4是本公开实施例提供的一种SMF确定PINE对应的配置参数的方法的流程图。如图4所示，该方法可以包括但不限于如下步骤：
S41：SMF向PCF发送查询请求。
S42：PCF根据查询请求确定配置策略。
S43：PCF向SMF发送配置策略。
S44：SMF根据配置策略生成配置参数。
本公开实施例中，SMF确定PINE对应的配置参数，可以向PCF发送查询请求。
在一些实施例中，查询请求，包括以下至少一个：
PINE的已认证EAP身份信息；
PINE所属PIN的PIN信息；
PINE的身份信息。
本公开实施例中，查询请求中包括EAP认证成功信息中的已认证EAP身份信息。
本公开实施例中，查询请求中包括PINE所属PIN的PIN信息。
本公开实施例中，查询请求中包括INE的身份信息。
其中，PCF接收到SMF发送的查询请求之后，可以根据查询请求，确定配置策略。
在一种可能的实现方式中，PCF根据查询请求，从PCF本地获取配置策略。
其中，PCF根据查询请求，从PCF本地获取配置策略的方法，包括确定PCF本地存储的已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与配置策略之间的映射关系；根据映射关系，以及已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个，确定配置策略。
示例性地，PCF可以确定PCF本地存储的已认证EAP身份信息与配置策略之间的映射关系，根据映射关系以及查询请求中的已认证EAP身份信息，确定配置策略。
示例性地，PCF可以确定PCF本地存储的PINE所属PIN的PIN信息与配置策略之间的映射关系，根据映射关系以及查询请求中的PINE所属PIN的PIN信息，确定配置策略。
示例性地，PCF可以确定PCF本地存储的PINE的身份信息与配置策略之间的映射关系，根据映射关系以及查询请求中的PINE的身份信息，确定配置策略。
在另一种可能的实现方式中，PCF根据查询请求，从UDR处获取配置策略。
其中，PCF根据查询请求，从UDR处获取配置策略的方法，包括将查询请求中的已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个发送至UDR，从UDR处获取配置策略，其中，UDR处存储有已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与配置策略之间的映射关系。
示例性地，PCF可以将查询请求中的已认证EAP身份信息发送至UDR，从UDR处获取配置策略，其中，UDR处存储有已认证EAP身份信息与配置策略之间的映射关系。
示例性地，PCF可以将查询请求中的PINE所属PIN的PIN信息发送至UDR，从UDR处获取配置策略，其中，UDR处存储有PINE所属PIN的PIN信息与配置策略之间的映射关系。
示例性地，PCF可以将查询请求中的PINE的身份信息发送至UDR，从UDR处获取配置策略，其中，UDR处存储有PINE的身份信息与配置策略之间的映射关系。
在一些实施例中，映射关系由与PIN有关的应用功能和/或应用服务器提供。
本公开实施例中，已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与配置策略之间的映射关系由与PIN有关的应用功能和/或应用服务器提供。
示例性地，映射关系可以由PIN AS或PIN AF提供。
本公开实施例中，PCF向SMF发送配置策略，配置策略包括PINE的QoS,URSP,连接信息等。
需要说明的是，本公开实施例中，S41至S44可以单独被实施，也可以结合本公开实施例中的任何一个其他步骤一起被实施，例如结合本公开实施例中的S21至S23和/或S31至S36一起被实施，本公开实施例并不对此做出限定。
通过实施本公开实施例，SMF向PCF发送查询请求，PCF根据查询请求确定配置策略，PCF向SMF发送配置策略，SMF根据配置策略生成配置参数。由此，SMF能够确定PINE对应的配置参数。
请参见图5，图5是本公开实施例提供的又一种PINE的接入认证方法的流程图。如图5所示，该方法可以包括但不限于如下步骤：
S51：PINE建立与SMF之间的PDU会话。
本公开实施例中，PINE建立与SMF之间的PDU会话的方法可以参见相关技术中的方法，此处不再赘述。
S52：PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息。
S53：PEGC向SMF发送PDU会话修改请求。
S54：SMF根据PDU会话修改请求，触发PINE的身份认证。
S55：SMF接收AAA服务器发送的认证成功消息。
S56：SMF确定PINE的已认证EAP身份信息。
S57：SMF确定PINE对应的配置参数。
其中，S51至S57的相关描述可以参见上述实施例中的相关描述，此处不再赘述。
S58：SMF根据配置参数，修改PEGC和SMF之间适于PINE的PDU会话。
本公开实施例中，SMF接收PEGC发送的PDU会话修改请求，在执行PDU会话修改的过程中，能够触发PINE的身份认证，并且，在接收到认证成功消息的情况下，确定PINE对应的配置参数，并根据配置参数，修改PEGC和SMF之间适于PINE的PDU会话，实现完成PDU会话的修改。
通过实施本公开实施例，PINE建立与SMF之间的PDU会话，PINE向PEGC发送接入请求，其中，接入请求中包括PINE的身份信息，PINE向SMF发送PDU会话修改请求，SMF根据PDU会话修改请求，触发PINE的身份认证，SMF响应于接收到认证成功消息，确定PINE的已认证EAP身份信息， 确定PINE对应的配置参数，SMF根据配置参数，修改PEGC和SMF之间适于PINE的PDU会话。由此，能够对PINE进行身份验证和授权，避免网络资源滥用。
请参见图6，图6是本公开实施例提供的又一种PINE的接入认证方法的流程图。如图6所示，该方法可以包括但不限于如下步骤：
1.PEGC的PDU会话建立。(PDU Session of PEGC is established.)
2.应用层信令在PEGC和PIN AS之间交换。提供授权访问PEGC的PINE列表给PEGC。(Application layer signalling is exchanged between the PEGC and the PIN AS.A list of PINEs authorized to access the PEGC are provisioned to the PEGC.)
3.PINE请求(通过接入请求)访问PEGC以将流量中继到5GS。该接入请求包括PINE的身份信息、外部AAA服务器地址(可选)。PINE的身份信息包括PINE的EAP身份信息、PINE的PINE ID。PINE的EAP身份信息可以在用户名部分包含有关MAC地址、PEI、设备ID的信息。(A PINE requests to access the PEGC for traffic relay to 5GS.The request includes identities of PINE,external AAA server address(optional).The identities of PINE include EAP identity of PINE,PINE ID of PINE.EAP identity of PINE can contains information about MAC Address,PEI,device ID in the username part.)
其中，PINE和PEGC之间的信令交换基于非3GPP接入(如WIFI、蓝牙)和应用层部署。(The signalling exchange between PINE and PEGC is based on non-3GPP access(e.g.WIFI,Bluetooth)and application layer deployment.)
4.PEGC对PINE的访问进行认证和授权，并为PINE分配IP地址。该流程是基于非3GPP接入实现的，超出了3GPP的范围。(The PEGC authenticate and authorizes the access of the PINE,and allocates IP address for the PINE.This procedure is realized based on non-3GPP access,which is out of scope of 3GPP.)
5.PEGC启动PDU会话修改。(The PEGC initiates PDU Session modification.)
PEGC通过NAS信令向SMF发送PINE信息(PDU会话修改请求)，包括PINE的EAP身份信息、外部AAA服务器的地址(可选)、PINE ID、PINE的IP地址、IP地址和分配的端口号(如果应用NAT).由于一个PINE可能连接多个PEGC、PEMC和PIN，因此PEGC应该将与PINE相关的PIN、PEGC和PEMC信息发送给SMF。具体地，PINE信息还包括PIN的身份信息(如PIN ID)、PEMC的身份信息(如PEMC ID、PEMC的GPSI)、PEGC的身份信息(如PEGC ID、PEGC的GPSI)，以满足对配置策略的唯一识别。(The PEGC sends the PINE information to the SMF via NAS signalling,include the EAP identity of PINE,address of the external AAA server(optional),PINE ID,IP address of the PINE,IP address and allocated port number in case of NAT applied.Since a PINE may connect to multiple PEGCs,PEMCs,and PINs,the PEGC should send the PIN,PEGC,and PEMC information,which is related to the PINE,to the SMF.Specifically,the PINE information also include identities of PIN(e.g.,PIN ID),identities of PEMC(e.g.,PEMC ID,GPSI of PEMC),and identities of PEGC(e.g.,PEGC ID,GPSI of PEGC)to the SMF to uniquely identify the policy.)
6-8.SMF可以根据EAP身份信息的用户名部分或PINE提供的AAA服务器信息或本地配置来选择AAA服务器。SMF使用外部AAA服务器触发基于EAP的身份验证机制。外部AAA服务器可以发送EAP认证成功信息和/或PINE EAP身份信息。如果身份验证失败，SMF将终止该过程。(SMF can select the AAA server based on the realm part of the EAP identity or the AAA server address that is provided by the PINE.SMF triggers the EAP-based authentication mechanism with the external AAA server.The external AAA server may send the successfully authenticated EAP identity of PINE.SMF terminates the procedure if the authentication is failed.)
9.SMF使用PIN的身份信息、PEMC的身份信息、PEGC的身份信息、PINE ID和PINE的已认证EAP身份信息更新PCF。(The SMF updates the PCF with the identities of PIN,identities of PEMC,identities of PEGC,PINE ID,and authenticated EAP identity of PINE in SM Policy Association Modification.)
10.PCF用PIN的身份信息、PEMC的身份信息、PEGC的身份信息、PINE ID和PINE的已认证EAP身份向UDR查询PIN特定服务参数，并接收PINE通信的QoS要求。(The PCF queries the UDR for PIN Specific Service Parameters with the identities of PIN,identities of PEMC,identities of PEGC,PINE ID,and authenticated EAP identity of PINE,and receives the QoS requirement of the PINE communication.)
PCF根据从UDR收到的QoS要求和来自SMF的PINE的IP地址/端口号，为PINE导出PCC规则。(The PCF derives the PCC rules for the PINE according to the QoS requirement received from the UDR and IP address/port number of the PINE from the SMF.)
11.PDU会话修改程序从步骤2继续。建立与5GS的PINE通信的QoS流。(The PDU Session Modification procedures as specified in clause 4.3.3.2of TS 23.502[3]continues from step 2.The QoS flow  for the PINE communication with 5GS is established.)
12.PEGC向PINE发送接入响应。(The PEGC sends a response to the PINE.)
13.PINE的应用流量通过PEGC的中继到5GS。(The application traffic of the PINE is relayed to the 5GS via the PEGC.)
通过实施本公开实施例，支持启用5GS对PINE进行身份验证和授权，能够避免网络资源滥用。
上述本公开提供的实施例中，主要从设备之间交互的角度对本公开实施例提供的方案进行了介绍。可以理解的是，各个设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的算法步骤，本公开能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
请参见图7，为本公开实施例提供的一种通信装置1的结构示意图。图7所示的通信装置1可包括收发模块11和处理模块12。收发模块11可包括发送模块和/或接收模块，发送模块用于实现发送功能，接收模块用于实现接收功能，收发模块11可以实现发送功能和/或接收功能。
通信装置1，设置于PEGC侧：包括：收发模块11和处理模块12。
收发模块11，被配置为接收PINE发送的接入请求，其中，接入请求包括PINE的身份信息。
收发模块11，还被配置为向会话管理功能SMF发送协议数据单元PDU会话修改请求。
在一些实施例中，收发模块12，还被配置为接收SMF发送的配置参数；向PINE发送接入响应。
在一些实施例中，处理模块12，被配置为建立与SMF之间的PDU会话。
在一些实施例中，PDU会话修改请求，包括以下至少一个：
PINE的身份信息；
PINE的地址；
PINE的端口；
PINE所属PIN的PIN信息；
验证、授权和记账AAA服务器的地址；
AAA服务器的完全限定域名FQDN。
在一些实施例中，接入请求和PDU会话修改请求之中，还包括以下至少一个：
PINE所属PIN的PIN信息；
验证、授权和记账AAA服务器的地址；
AAA服务器的完全限定域名FQDN。
在一些实施例中，PINE所属PIN的PIN信息包括以下至少一项：
PIN的标识信息；
PIN之中PEGC的身份信息；
PIN之中具有管理能力的PIN单元PEMC的身份信息；
PIN之中PINE所归属的PEGC的身份信息；
PIN之中PINE关联的PEGC的身份信息。
在一些实施例中，PINE的身份信息包括以下至少一项：
PINE的扩展认证协议EAP身份信息；
PINE的媒体接入控制Mac地址；
PINE的永久设备标识符；
PINE的设备标识ID；
PINE的PINE ID。
通信装置1，设置于SMF侧：包括：收发模块11和处理模块12。
收发模块11，被配置为接收PEGC发送的PDU会话修改请求，其中，PDU会话修改请求为PEGC在接收到PINE发送的接入请求的情况下发送的，接入请求包括PINE的身份信息。
处理模块12，被配置为根据PDU会话修改请求，触发PINE的身份认证。
在一些实施例中，处理模块12，还被配置为确定目标AAA服务器。
收发模块11，还被配置为将PDU会话修改请求中的PINE的EAP身份信息发送至目标AAA服务器，以触发PINE的身份认证。
在一些实施例中，处理模块12，还被配置为根据以下至少一个，确定目标AAA服务器：
AAA服务器的地址；
AAA服务器的FQDN；
PINE的EAP身份信息；
SMF的本地配置。
在一些实施例中，处理模块12，还被配置为响应于接收到EAP认证成功信息，确定PINE的已认证EAP身份信息。
在一些实施例中，处理模块12，还被配置为响应于PINE的EAP身份信息为匿名EAP身份信息，且EAP认证成功信息中包括已认证的EAP身份信息，确定已认证的EAP身份信息为PINE的已认证EAP身份信息；或者响应于PINE的EAP身份信息为普通EAP身份信息，确定PINE的已认证EAP身份信息为PDU会话修改请求中的普通EAP身份信息。
在一些实施例中，处理模块12，还被配置为响应于PINE的EAP身份信息为匿名EAP身份信息，利用PDU会话修改请求中PINE的地址和/或端口，传递PINE与目标AAA服务器之间的EAP消息，以进行PINE的身份认证。
在一些实施例中，匿名EAP身份信息为PINE将EAP身份信息的用户名部分设置为匿名得到的，或者PINE忽略EAP身份信息的用户名部分得到的。
在一些实施例中，处理模块12，还被配置为确定PINE对应的配置参数。
在一些实施例中，收发模块11，还被配置为向PCF发送查询请求；接收PCF发送的配置策略。
处理模块12，还被配置为根据配置策略，确定PINE对应的配置参数。
在一些实施例中，处理模块12，还被配置为根据配置参数，修改PEGC和SMF之间适于PINE的PDU会话。
在一些实施例中，查询请求，包括以下至少一个：
PINE的已认证EAP身份信息；
PINE所属PIN的PIN信息；
PINE的身份信息。
在一些实施例中，PDU会话修改请求，包括以下至少一个：
PINE的身份信息；
PINE的地址；
PINE的端口；
PINE所属PIN的PIN信息；
AAA服务器的地址；
AAA服务器的FQDN。
在一些实施例中，PINE所属PIN的PIN信息包括以下至少一项：
PIN的标识信息；
PIN之中PEGC的身份信息；
PIN之中PEMC的身份信息；
PIN之中PINE所归属的PEGC的身份信息；
PIN之中PINE关联的PEGC的身份信息。
在一些实施例中，PINE的身份信息，包括以下至少一项：
PINE的EAP身份信息；
PINE的Mac地址；
PINE的永久设备标识符；
PINE的设备标识ID；
PINE的PINE ID。
在一些实施例中，处理模块12，还被配置为在接收PDU会话修改请求之前，建立与PEGC之间的PDU会话。
通信装置1，设置于PINE侧：包括：收发模块11。
收发模块11，被配置为向与PINE关联的/所归属的PEGC发送接入请求，其中，接入请求包括PINE的身份信息。
在一些实施例中，收发模块11，还被配置为接收PEGC发送的EAP认证请求消息；向PEGC发送的EAP认证响应。
在一些实施例中，收发模块11，还被配置为接收PEGC发送的接入响应。
在一些实施例中，PINE的身份信息包括以下至少一项：
PINE的EAP身份信息；
PINE的Mac地址；
PINE的永久设备标识符；
PINE的设备标识ID；
PINE的PINE ID。
在一些实施例中，接入请求之中，还包括以下至少一个：
PINE所属PIN的PIN信息；
AAA服务器的地址；
AAA服务器的FQDN。
通信装置1，设置于PCF侧：包括：收发模块11和处理模块12。
收发模块11，被配置为接收SMF发送的查询请求。
处理模块12，被配置为根据查询请求，确定配置策略。
收发模块11，还被配置为将配置策略发送至SMF。
在一些实施例中，处理模块12，还被配置为根据查询请求，从PCF本地获取配置策略；或者根据查询请求，从UDR处获取配置策略。
在一些实施例中，查询请求，包括以下至少一个：
PINE的已认证EAP身份信息；
PINE所属PIN的PIN信息；
PINE的身份信息。
在一些实施例中，处理模块12，还被配置为确定PCF本地存储的已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与所述配置策略之间的映射关系；根据所述映射关系，以及已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个，确定所述配置策略。
在一些实施例中，处理模块12，还被配置为将所述查询请求中的所述已认证EAP身份信息、所述PINE所属PIN的PIN信息和所述PINE的身份信息中的至少一个发送至UDR，从所述UDR处获取所述配置策略，其中，所述UDR处存储有已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与所述配置策略之间的映射关系。
在一些实施例中，映射关系由与PIN有关的应用功能和/或应用服务器提供。
关于上述实施例中的通信装置1，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本公开上述实施例中提供的通信装置1，与上面一些实施例中提供的PINE的接入认证方法取得相同或相似的有益效果，此处不再赘述。
请参见图8，图8是本公开实施例提供的另一种通信系统的架构图。
如图8所示，该通信系统100，包括：PEGC、SMF、PINE和PCF。
其中，PEGC，被配置为执行如上面一些实施例中所述的方法；
SMF，被配置为执行如上面一些实施例中所述的方法；
PINE被配置为执行如上面一些实施例中所述的方法；
PCF，被配置为执行如上面一些实施例中所述的方法。
关于上述实施例中的通信系统100，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本公开上述实施例中提供的通信系统100，与上面一些实施例中提供的PINE的接入认证方法取得相同或相似的有益效果，此处不再赘述。
请参见图9，图9是本公开实施例提供的另一种通信装置1000的结构图。通信装置1000可以是终端设备，也可以是SMF，也可以是PCF。该装置可用于实现上述方法实施例中描述的方法，具体可以参见上述方法实施例中的说明。
通信装置1000可以包括一个或多个处理器1001。处理器1001可以是通用处理器或者专用处理器等。例如可以是基带处理器或中央处理器。基带处理器可以用于对通信协议以及通信数据进行处理，中央处理器可以用于对通信装置(如，基站、基带芯片，终端设备、终端设备芯片，DU或CU等)进行控制，执行计算机程序，处理计算机程序的数据。
可选的，通信装置1000中还可以包括一个或多个存储器1002，其上可以存有计算机程序1004，存储器1002执行所述计算机程序1004，以使得通信装置1000执行上述方法实施例中描述的方法。可选 的，所述存储器1002中还可以存储有数据。通信装置1000和存储器1002可以单独设置，也可以集成在一起。
可选的，通信装置1000还可以包括收发器1005、天线1006。收发器1005可以称为收发单元、收发机、或收发电路等，用于实现收发功能。收发器1005可以包括接收器和发送器，接收器可以称为接收机或接收电路等，用于实现接收功能；发送器可以称为发送机或发送电路等，用于实现发送功能。
可选的，通信装置1000中还可以包括一个或多个接口电路1007。接口电路1007用于接收代码指令并传输至处理器1001。处理器1001运行所述代码指令以使通信装置1000执行上述方法实施例中描述的方法。
通信装置1000为PEGC，收发器1005用于执行图2中的S21和S22；图3中的S31、S32、S37和S38；图5中的S52和S53。
通信装置1000为SMF：收发器1005用于执行图2中的S22；图3中的S32、S34和S37；图4中的S41和S43；图5中的S53和S55；处理器1001用于执行图2中的S23和S25；图3中的S33、S35和S36；图4中的S44；图5中的S54、S56和S57。
通信装置1000为PCF：收发器1005用于执行执行图4中的S41和S43；处理器1001用于执行图4中的S42。
通信装置1000为PINE，收发器1005用于执行图2中的S21；图3中的S31和S38；图5中的S52。
在一种实现方式中，处理器1001中可以包括用于实现接收和发送功能的收发器。例如该收发器可以是收发电路，或者是接口，或者是接口电路。用于实现接收和发送功能的收发电路、接口或接口电路可以是分开的，也可以集成在一起。上述收发电路、接口或接口电路可以用于代码/数据的读写，或者，上述收发电路、接口或接口电路可以用于信号的传输或传递。
在一种实现方式中，处理器1001可以存有计算机程序1003，计算机程序1003在处理器1001上运行，可使得通信装置1000执行上述方法实施例中描述的方法。计算机程序1003可能固化在处理器1001中，该种情况下，处理器1001可能由硬件实现。
在一种实现方式中，通信装置1000可以包括电路，所述电路可以实现前述方法实施例中发送或接收或者通信的功能。本公开中描述的处理器和收发器可实现在集成电路(integrated circuit，IC)、模拟IC、射频集成电路RFIC、混合信号IC、专用集成电路(application specific integrated circuit，ASIC)、印刷电路板(printed circuit board，PCB)、电子设备等上。该处理器和收发器也可以用各种IC工艺技术来制造，例如互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)、N型金属氧化物半导体(nMetal-oxide-semiconductor，NMOS)、P型金属氧化物半导体(positive channel metal oxide semiconductor，PMOS)、双极结型晶体管(bipolar junction transistor，BJT)、双极CMOS(BiCMOS)、硅锗(SiGe)、砷化镓(GaAs)等。
以上实施例描述中的通信装置可以是终端设备，也可以是SMF，也可以是PCF，也可以是核心网，但本公开中描述的通信装置的范围并不限于此，而且通信装置的结构可以不受图9的限制。通信装置可以是独立的设备或者可以是较大设备的一部分。例如所述通信装置可以是：
(1)独立的集成电路IC，或芯片，或，芯片系统或子系统；
(2)具有一个或多个IC的集合，可选的，该IC集合也可以包括用于存储数据，计算机程序的存储部件；
(3)ASIC，例如调制解调器(Modem)；
(4)可嵌入在其他设备内的模块；
(5)接收机、终端设备、智能终端设备、蜂窝电话、无线设备、手持机、移动单元、车载设备、网络设备、云设备、人工智能设备等等；
(6)其他等等。
对于通信装置可以是芯片或芯片系统的情况，请参见图10，为本公开实施例中提供的一种芯片的结构图。
如图10所示，芯片1100包括处理器1101和接口1103。其中，处理器1101的数量可以是一个或多个，接口1103的数量可以是多个。
对于芯片用于实现本公开实施例中PEGC的功能的情况：
接口1103，用于接收代码指令并传输至所述处理器。
处理器1101，用于运行代码指令以执行如上面一些实施例所述的PINE的接入认证方法。
对于芯片用于实现本公开实施例中SMF的功能的情况：
接口1103，用于接收代码指令并传输至所述处理器。
处理器1101，用于运行代码指令以执行如上面一些实施例所述的PINE的接入认证方法。
对于芯片用于实现本公开实施例中PINE的功能的情况：
接口1103，用于接收代码指令并传输至所述处理器。
处理器1101，用于运行代码指令以执行如上面一些实施例所述的PINE的接入认证方法。
对于芯片用于实现本公开实施例中PCF的功能的情况：
接口1103，用于接收代码指令并传输至所述处理器。
处理器1101，用于运行代码指令以执行如上面一些实施例所述的PINE的接入认证方法。
可选的，芯片1100还包括存储器1102，存储器1102用于存储必要的计算机程序和数据。
本领域技术人员还可以了解到本公开实施例列出的各种说明性逻辑块(illustrative logical block)和步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个系统的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本公开实施例保护的范围。
本公开实施例还提供一种接入认证系统，该系统包括前述图7实施例中作为PEGC的通信装置、作为PINE的通信装置、作为SMF的通信装置和作为PCF的通信装置，或者，该系统包括前述图9实施例中作为PEGC的通信装置、作为PINE的通信装置、作为SMF的通信装置和作为PCF的通信装置。
本公开还提供一种可读存储介质，其上存储有指令，该指令被计算机执行时实现上述任一方法实施例的功能。
本公开还提供一种计算机程序产品，该计算机程序产品被计算机执行时实现上述任一方法实施例的功能。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序。在计算机上加载和执行所述计算机程序时，全部或部分地产生按照本公开实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机程序可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
除非上下文另有要求，否则，在整个说明书和权利要求书中，术语“包括(comprise)”及其其他形式例如第三人称单数形式“包括(comprises)”和现在分词形式“包括(comprising)”被解释为开放、包含的意思，即为“包含，但不限于”。在说明书的描述中，术语“一些实施例(some embodiments)”、“示例性实施例(exemplary embodiments)”等旨在表明与该实施例或示例相关的特定特征、结构、材料或特性包括在本公开的至少一个实施例或示例中。上述术语的示意性表示不一定是指同一实施例或示例。此外，所述的特定特征、结构、材料或特点可以以任何适当方式包括在任何一个或多个实施例或示例中。
本领域普通技术人员可以理解：本公开中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本公开实施例的范围，也表示先后顺序。
本公开中的至少一个还可以描述为一个或多个，多个可以是两个、三个、四个或者更多个，本公开不做限制。在本公开实施例中，对于一种技术特征，通过“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”等区分该种技术特征中的技术特征，该“第一”、“第二”、“第三”、“A”、“B”、“C”和“D”描述的技术特征间无先后顺序或者大小顺序。“A和/或B”，包括以下三种组合：仅A，仅B，及A和B的组合。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以所述权利要求的保护范围为准。

Claims (41)

  1. 一种私有物联网单元PINE的接入认证方法，其特征在于，所述方法由具有网关能力的私有物联网单元PEGC执行，所述方法包括：
    接收PINE发送的接入请求，其中，所述接入请求包括所述PINE的身份信息；
    向会话管理功能SMF发送协议数据单元PDU会话修改请求。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    接收所述SMF发送的配置参数；
    向所述PINE发送接入响应。
  3. 如权利要求1或2所述的方法，其特征在于，在所述接收PINE发送的接入请求之前，还包括：
    建立与所述SMF之间的PDU会话。
  4. 如权利要求1至3中任一项所述的方法，其特征在于，所述PDU会话修改请求，包括以下至少一个：
    所述PINE的身份信息；
    所述PINE的地址；
    所述PINE的端口；
    所述PINE所属PIN的PIN信息；
    验证、授权和记账AAA服务器的地址；
    AAA服务器的完全限定域名FQDN。
  5. 如权利要求1至3中任一项所述的方法，其特征在于，所述接入请求之中，还包括以下至少一个：
    所述PINE所属PIN的PIN信息；
    账AAA服务器的地址；
    AAA服务器的FQDN。
  6. 如权利要求4或5所述的方法，其特征在于，所述PINE所属PIN的PIN信息包括以下至少一项：
    所述PIN的标识信息；
    所述PIN之中PEGC的身份信息；
    所述PIN之中具有管理能力的PIN单元PEMC的身份信息；
    所述PIN之中PINE所归属的PEGC的身份信息；
    所述PIN之中PINE关联的PEGC的身份信息。
  7. 如权利要求1至6中任一项所述的方法，其特征在于，所述PINE的身份信息包括以下至少一项：
    所述PINE的扩展认证协议EAP身份信息；
    所述PINE的媒体接入控制Mac地址；
    所述PINE的永久设备标识符；
    所述PINE的设备标识ID；
    所述PINE的PINE ID。
  8. 一种PINE的接入控制方法，其特征在于，所述方法由SMF执行，所述方法包括：
    接收PEGC发送的PDU会话修改请求，其中，所述PDU会话修改请求为所述PEGC在接收到PINE发送的接入请求的情况下发送的，所述接入请求包括所述PINE的身份信息；
    根据所述PDU会话修改请求，触发所述PINE的身份认证。
  9. 如权利要求8所述的方法，其特征在于，所述根据所述PDU会话修改请求，触发所述PINE的身份认证，包括：
    确定目标AAA服务器；
    将所述PDU会话修改请求中的PINE的EAP身份信息发送至所述目标AAA服务器，以触发所述PINE的身份认证。
  10. 如权利要求9所述的方法，其特征在于，所述确定目标AAA服务器，包括：
    根据以下至少一个，确定所述目标AAA服务器：
    AAA服务器的地址；
    AAA服务器的完全限定域名FQDN；
    PINE的EAP身份信息；
    SMF的本地配置。
  11. 如权利要求8至10中任一项所述的方法，其特征在于，所述方法还包括：
    响应于接收到EAP认证成功信息，确定所述PINE的已认证EAP身份信息。
  12. 如权利要求11所述的方法，其特征在于，所述确定所述PINE的已认证EAP身份信息，包括：
    响应于所述PINE的EAP身份信息为匿名EAP身份信息，且所述EAP认证成功信息中包括已认证的EAP身份信息，确定所述已认证的EAP身份信息为所述PINE的已认证EAP身份信息；或者
    响应于所述PINE的EAP身份信息为普通EAP身份信息，确定所述PINE的已认证EAP身份信息为所述PDU会话修改请求中的普通EAP身份信息。
  13. 如权利要求9至12中任一项所述的方法，其特征在于，所述将所述PDU会话修改请求中的PINE的EAP身份信息发送至所述目标AAA服务器以触发所述PINE的身份认证，包括：
    响应于所述PINE的EAP身份信息为匿名EAP身份信息，利用PDU会话修改请求中所述PINE的地址和/或端口，传递所述PINE与所述目标AAA服务器之间的EAP消息，以进行PINE的身份认证。
  14. 如权利要求13所述的方法，其特征在于，所述匿名EAP身份信息为所述PINE将EAP身份信息的用户名部分设置为匿名得到的，或者所述PINE忽略EAP身份信息的用户名部分得到的。
  15. 如权利要求11至14中任一项所述的方法，其特征在于，所述方法还包括：
    确定所述PINE对应的配置参数。
  16. 如权利要求15所述的方法，其特征在于，所述确定所述PINE对应的配置参数，包括：
    向PCF发送查询请求；
    接收所述PCF发送的配置策略；
    根据所述配置策略，确定所述PINE对应的配置参数。
  17. 如权利要求16所述的方法，其特征在于，所述方法还包括：
    根据所述配置参数，修改所述PEGC和所述SMF之间适于所述PINE的PDU会话。
  18. 如权利要求16所述的方法，其特征在于，所述查询请求，包括以下至少一个：
    所述PINE的已认证EAP身份信息；
    所述PINE所属PIN的PIN信息；
    所述PINE的身份信息。
  19. 如权利要求8至18中任一项所述的方法，其特征在于，所述PDU会话修改请求，包括以下至少一个：
    所述PINE的身份信息；
    所述PINE的地址；
    所述PINE的端口；
    所述PINE所属PIN的PIN信息；
    AAA服务器的地址；
    AAA服务器的FQDN。
  20. 如权利要求19所述的方法，其特征在于，所述PINE所属PIN的PIN信息包括以下至少一项：
    所述PIN的标识信息；
    所述PIN之中PEGC的身份信息；
    所述PIN之中PEMC的身份信息；
    所述PIN之中PINE所归属的PEGC的身份信息；
    所述PIN之中PINE关联的PEGC的身份信息。
  21. 如权利要求8至20中任一项所述的方法，其特征在于，所述PINE的身份信息，包括以下至少一项：
    所述PINE的EAP身份信息；
    所述PINE的Mac地址；
    所述PINE的永久设备标识符；
    所述PINE的设备标识ID；
    所述PINE的PINE ID。
  22. 如权利要求8至21中任一项所述的方法，其特征在于，在接收所述PDU会话修改请求之前，还包括：
    建立与所述PEGC之间的PDU会话。
  23. 一种PINE的接入控制方法，其特征在于，所述方法由PINE执行，所述方法包括：
    向与PINE关联的/所归属的PEGC发送接入请求，其中，所述接入请求包括所述PINE的身份信息。
  24. 如权利要求23所述的方法，其特征在于，所述方法还包括：
    接收所述PEGC发送的EAP认证请求消息；
    向所述PEGC发送的EAP认证响应。
  25. 如权利要求23或24所述的方法，其特征在于，所述方法还包括：
    接收所述PEGC发送的接入响应。
  26. 如权利要求23至25中任一项所述的方法，其特征在于，所述PINE的身份信息包括以下至少一项：
    所述PINE的EAP身份信息；
    所述PINE的Mac地址；
    所述PINE的永久设备标识符；
    所述PINE的设备标识ID；
    所述PINE的PINE ID。
  27. 如权利要求23所述的方法，其特征在于，所述接入请求之中，还包括以下至少一个：
    所述PINE所属PIN的PIN信息；
    AAA服务器的地址；
    AAA服务器的FQDN。
  28. 一种PINE的接入控制方法，其特征在于，所述方法由PCF执行，所述方法包括：
    接收SMF发送的查询请求；
    根据所述查询请求，确定配置策略；
    将所述配置策略发送至所述SMF。
  29. 如权利要求28所述的方法，其特征在于，所述根据所述查询请求，确定配置策略，包括：
    根据所述查询请求，从PCF本地获取所述配置策略；或者
    根据所述查询请求，从UDR处获取所述配置策略。
  30. 如权利要求28或29所述的方法，其特征在于，所述查询请求，包括以下至少一个：
    所述PINE的已认证EAP身份信息；
    所述PINE所属PIN的PIN信息；
    所述PINE的身份信息。
  31. 如权利要求30所述的方法，其特征在于，所述根据所述查询请求，从PCF本地获取所述配置策略，包括：
    确定PCF本地存储的已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与所述配置策略之间的映射关系；
    根据所述映射关系，以及已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个，确定所述配置策略。
  32. 如权利要求30所述的方法，其特征在于，所述根据所述查询请求，从UDR处获取所述配置策略，包括：
    将所述查询请求中的所述已认证EAP身份信息、所述PINE所属PIN的PIN信息和所述PINE的身份信息中的至少一个发送至UDR，从所述UDR处获取所述配置策略，其中，所述UDR处存储有已认证EAP身份信息、PINE所属PIN的PIN信息和PINE的身份信息中的至少一个与所述配置策略之间的映射关系。
  33. 如权利要求31或32所述的方法，其特征在于，所述映射关系由与PIN有关的应用功能和/或应用服务器提供。
  34. 一种通信装置，其特征在于，包括：
    收发模块，被配置为接收PINE发送的接入请求，其中，所述接入请求包括所述PINE的身份信息；
    所述收发模块，还被配置为向会话管理功能SMF发送协议数据单元PDU会话修改请求。
  35. 一种通信装置，其特征在于，包括：
    收发模块，被配置为接收PEGC发送的PDU会话修改请求，其中，所述PDU会话修改请求为所述PEGC在接收到PINE发送的接入请求的情况下发送的，所述接入请求包括所述PINE的身份信息；
    处理模块，被配置为根据所述PDU会话修改请求，对所述PINE进行身份认证。
  36. 一种通信装置，其特征在于，包括：
    收发模块，被配置为向与PINE关联的/所归属的PEGC发送接入请求，其中，所述接入请求包括所述PINE的身份信息。
  37. 一种通信装置，其特征在于，包括：
    收发模块，被配置为接收SMF发送的查询请求；
    处理模块，被配置为根据所述查询请求，确定配置策略；
    所述收发模块，还被配置为将所述配置策略发送至所述SMF。
  38. 一种通信系统，其特征在于，包括：
    PEGC，被配置为执行如权利要求1至7中任一项所述的方法；
    SMF，被配置为执行如权利要求8至22中任一项所述的方法；
    PINE，被配置为执行如权利要求23至27中任一项所述的方法；
    PCF，被配置为执行如权利要求28至33中任一项所述的方法。
  39. 一种通信装置，其特征在于，所述装置，包括：处理器和存储器，所述存储器中存储有计算机程序，所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求1至7中任一项所述的方法；或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求8至22中任一项所述的方法；或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求23至27中任一项所述的方法；或所述处理器执行所述存储器中存储的计算机程序，以使所述装置执行如权利要求28至33中任一项所述的方法。
  40. 一种通信装置，其特征在于，包括：处理器和接口电路；
    所述接口电路，用于接收代码指令并传输至所述处理器；
    所述处理器，用于运行所述代码指令以执行如权利要求1至7中任一项所述的方法；或运行所述代码指令以执行如权利要求8至22中任一项所述的方法；或运行所述代码指令以执行如权利要求23至27中任一项所述的方法；或运行所述代码指令以执行如权利要求28至33中任一项所述的方法。
  41. 一种计算机可读存储介质，用于存储有指令，当所述指令被执行时，使如权利要求1至7中任一项所述的方法被实现；或当所述指令被执行时，使如权利要求8至22中任一项所述的方法被实现；或当所述指令被执行时，使如权利要求23至27中任一项所述的方法被实现；或当所述指令被执行时，使如权利要求28至33中任一项所述的方法被实现。
PCT/CN2022/123645 2022-09-30 2022-09-30 私有物联网单元pine的接入认证方法和装置 WO2024065843A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280003986.0A CN118120201A (zh) 2022-09-30 2022-09-30 私有物联网单元pine的接入认证方法和装置
PCT/CN2022/123645 WO2024065843A1 (zh) 2022-09-30 2022-09-30 私有物联网单元pine的接入认证方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/123645 WO2024065843A1 (zh) 2022-09-30 2022-09-30 私有物联网单元pine的接入认证方法和装置

Publications (1)

Publication Number Publication Date
WO2024065843A1 true WO2024065843A1 (zh) 2024-04-04

Family

ID=90475627

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/123645 WO2024065843A1 (zh) 2022-09-30 2022-09-30 私有物联网单元pine的接入认证方法和装置

Country Status (2)

Country Link
CN (1) CN118120201A (zh)
WO (1) WO2024065843A1 (zh)

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on Application layer support for Personal IoT Network; (Release 18)", 3GPP TR 23.700-78, no. V0.5.0, 12 September 2022 (2022-09-12), pages 1 - 59, XP052210746 *
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on architecture enhancements for Personal IoT Network (PIN) (Release 18)", 3GPP TR 23.700-88, no. V0.2.0, 16 April 2022 (2022-04-16), pages 1 - 60, XP052145987 *
CATT: "KI #4 & #6, New Sol: QoS handling for PINE communication with 5GC via PEGC", 3GPP TSG-SA WG2#151E S2-2204056, 6 May 2022 (2022-05-06), XP052159561 *
QUALCOMM INCORPORATED: "Solution of authorization and management of PIN and PIN Elements", 3GPP TSG-SA WG2#150E E-MEETING S2-2202028, 29 March 2022 (2022-03-29), XP052132882 *
XIAOMI: "solution for KI#7: management for identification of PIN and PINE", SA WG2 MEETING #S2-151E S2-2204631, 6 May 2022 (2022-05-06), XP052160121 *

Also Published As

Publication number Publication date
CN118120201A (zh) 2024-05-31

Similar Documents

Publication Publication Date Title
US20220337995A1 (en) Apparatus and method for providing subscription data to non-subscriber registered terminal in wireless communication system
US20220052989A1 (en) Communication method and communications device
US8549293B2 (en) Method of establishing fast security association for handover between heterogeneous radio access networks
US20210329583A1 (en) Apparatus and method for registration on network in wireless communication system
US11849318B2 (en) Wireless communication network authentication
US20080026724A1 (en) Method for wireless local area network user set-up session connection and authentication, authorization and accounting server
WO2020248624A1 (zh) 一种通信方法、网络设备、用户设备和接入网设备
WO2018014539A1 (zh) 一种信息传输方法、融合网关及系统
US20200029217A1 (en) User Authentication Method and Apparatus
JP2001320372A (ja) 統合インターネットプロトコル網で統合加入者サーバの機能的モデリングを通した統合加入者管理装置及びその方法
JPWO2007097101A1 (ja) 無線アクセスシステムおよび無線アクセス方法
WO2020151677A1 (zh) 通信方法和相关产品
US20230048066A1 (en) Slice authentication method and apparatus
WO2021239098A1 (zh) 业务获取方法、装置、通信设备及可读存储介质
EP4135376A1 (en) Method and device for secure communication
US20240179525A1 (en) Secure communication method and apparatus
WO2018076553A1 (zh) 一种接入网络的方法及设备
WO2022062929A1 (zh) 一种会话建立方法及装置
US20230336992A1 (en) Method and apparatus for authenticating user equipment in wireless communication system
WO2024065843A1 (zh) 私有物联网单元pine的接入认证方法和装置
WO2022021139A1 (en) Method and apparatus for subscribing and provisioning
WO2014121613A1 (zh) 一种位置信息的获取方法及相应装置
KR101780401B1 (ko) 무선 통신 시스템에서의 인증 및 보안 설정을 위한 방법 및 이를 위한 장치
WO2023216274A1 (zh) 密钥管理方法、装置、设备和存储介质
WO2024212793A1 (zh) 通信方法和通信装置

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280003986.0

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22960447

Country of ref document: EP

Kind code of ref document: A1