[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2021026927A1 - 通信方法和相关设备 - Google Patents

通信方法和相关设备 Download PDF

Info

Publication number
WO2021026927A1
WO2021026927A1 PCT/CN2019/100881 CN2019100881W WO2021026927A1 WO 2021026927 A1 WO2021026927 A1 WO 2021026927A1 CN 2019100881 W CN2019100881 W CN 2019100881W WO 2021026927 A1 WO2021026927 A1 WO 2021026927A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
network
user equipment
level
secondary authentication
Prior art date
Application number
PCT/CN2019/100881
Other languages
English (en)
French (fr)
Inventor
雷中定
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to MX2022001926A priority Critical patent/MX2022001926A/es
Priority to CN201980099050.0A priority patent/CN114223232A/zh
Priority to EP19941213.1A priority patent/EP4013093A4/en
Priority to PCT/CN2019/100881 priority patent/WO2021026927A1/zh
Priority to CA3148101A priority patent/CA3148101C/en
Publication of WO2021026927A1 publication Critical patent/WO2021026927A1/zh
Priority to US17/672,391 priority patent/US12114154B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/082—Access security using revocation of authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/08—Testing, supervising or monitoring using real traffic

Definitions

  • This application relates to the field of communications, and specifically relates to communication methods, user equipment, core network equipment, data network equipment, and computer-readable media.
  • the 3rd Generation Partnership Project puts forward the concept of network slicing in, for example, 5G (fifth generation) networks.
  • 5G fifth generation
  • a simple understanding of network slicing is to cut the operator’s physical network into multiple virtual end-to-end networks.
  • Each virtual network including the equipment, access, transmission and core network in the network, is logically independent, any one Any failure of a virtual network will not affect other virtual networks.
  • 3GPP emphasizes that network slices do not affect each other. For example, a large number of sudden meter reading services should not affect normal mobile broadband services.
  • the slice in the 5G network is a virtual private network, which is composed of a set of network functions and sub-networks. Many network slices can be deployed in the operator's network, and each slice can have different performance to meet the needs of different applications and different vertical industries. Operators can "tailor-make" a slice according to the needs of customers in different vertical industries. Operators can also allow some industry customers to enjoy greater autonomy, such as participating in part of the management and control functions of slices.
  • Slice-level authentication is a network control function that can be participated by industry customers, that is, to authenticate and authorize terminal users (User) to access slices.
  • the authentication for user terminals (or user equipment or terminals, etc.) to access the core network is called Primary Authentication; in addition, slice-level authentication (referred to as “slice authentication”) is also called “Primary Authentication”. Second-level authentication", the second-level authentication is the authentication between the data network and the end user.
  • the traditional technology temporarily lacks effective management of the certification results of the second-level certification, resulting in defects in the safety and effectiveness of the business operation based on the second-level certification.
  • the embodiment of the present application provides a communication method and related equipment.
  • the first aspect of the embodiments of the present application provides a communication method, which may include: after the first level authentication between the core network and the user equipment is successful, if the second level authentication is required between the data network and the user equipment, the The network function entity in the core network (for example, Access and Mobility Management Function (AMF, Access and Mobility Management Function), etc.) assists in the secondary authentication between the data network and the user equipment; the network function entity Obtain the authentication result of the secondary authentication and the restriction conditions of the secondary authentication from the data network; the network function entity will obtain the authentication result of the secondary authentication and the restriction conditions of the secondary authentication Stored in the core network (for example, AMF or UDM that can be stored in the core network).
  • AMF Access and Mobility Management Function
  • UDM User Data Management Function
  • the secondary authentication mentioned in the embodiments of this application is essentially the authentication between the data network and the user who uses the user equipment, and the user equipment can represent the user who uses the user equipment to a certain extent, so it can also be called “Secondary authentication between data network and user equipment", of course, can also be called “secondary authentication between data network and user who uses user equipment” or “secondary authentication between data network and user” in some cases ".
  • these several terms have the same meaning and can be used together, and similar "secondary authentication for user equipment” and “secondary authentication for user” can be used together, and so on.
  • the user terminal, user equipment, terminal, and terminal device mentioned in the embodiments of the present application have the same meaning and can be mixed.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the authentication result of the second-level authentication is stored in a binding manner with the authentication result of the first-level authentication (the authentication result of the second-level authentication is stored in a binding manner, It may indicate that the validity period of the authentication result of the secondary authentication is the same as or has a corresponding relationship with the authentication result of the primary authentication) or stored separately; or the authentication result of the secondary authentication is bound to the user equipment context and stored (The authentication result of the secondary authentication is stored in a binding manner with the user equipment context, which may indicate that the authentication result of the secondary authentication is the same or has a corresponding relationship with the validity period of the user equipment context) or stored independently, or The validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity period of the user equipment context, or the validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity of the primary authentication the term.
  • the network function entity in the core network assisting the secondary authentication between the data network and the user equipment includes: when it is determined that the initiation condition of the secondary authentication of the user equipment is satisfied, The network function entity in the core network assists the secondary authentication between the data network and the user equipment. In a case where it is determined that the initiation condition of the secondary authentication of the user equipment is not satisfied, the core network rejects the secondary authentication request of the user equipment or directly determines the secondary authentication between the data network and the user equipment unsuccessful.
  • the method may further include: the network function entity obtains the incidental information of the second-level authentication from the data network, and the network function entity obtains the incidental information of the second-level authentication.
  • the information is stored in the core network, and the additional information can be used to determine the initiation condition of the next secondary authentication of the user equipment or other user equipment.
  • the initiation condition of the secondary authentication may be determined by the previously stored incidental information of the secondary authentication for the current UE or other UEs. For example, when the operator’s network targets other UEs.
  • the initiation conditions of the second-level certification are used to assist the AMF in determining whether to continue the second-level certification process or directly determine that the second-level certification fails.
  • the reason for the authentication failure can be provided to the core network, and the reason for the authentication failure can be used as additional information for this secondary authentication for the next time the AMF meets the secondary authentication for this user or other users ( For S-NSSAI) conditions, auxiliary judgments are made.
  • AAA-S successfully completes the authentication and authorization of users, but the DN network capacity or the number of users that can be supported reaches the upper limit, AAA-S can notify the operator network that the DN is temporarily running in "full load mode", and no more will be accepted temporarily Level 2 certification.
  • AAA-S can also send a timer, which is used to limit the specific duration of "temporary”. After the AMF receives the timer, it is stored in the core network (such as AMF, UDM). The next time another UE applies for second-level authentication, it can directly reject the second-level authentication application to avoid unnecessary signaling interaction between the operator's core network and the DN .
  • the method further includes: the network function entity sending the acquired authentication result of the secondary authentication and the restriction condition of the secondary authentication to the user equipment.
  • the user equipment may receive and store the authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the method further includes: when the network function entity receives an update request from the data network for requesting to update the second-level authentication restriction condition, updating all the data according to the update request.
  • the restriction conditions of the secondary authentication stored in the core network.
  • the network function entity may also send the update request to the user equipment, and the After receiving the update request, the user equipment updates the restriction conditions of the secondary authentication stored in the user equipment according to the update request.
  • the second aspect of the embodiments of the present application provides a network functional entity in a core network, which may include: an assisting unit, configured to: after the first level authentication between the core network and the user equipment is successful, if the data network and the user equipment Secondary authentication is also required between the devices to assist the data network and the user equipment to perform secondary authentication.
  • an assisting unit configured to: after the first level authentication between the core network and the user equipment is successful, if the data network and the user equipment Secondary authentication is also required between the devices to assist the data network and the user equipment to perform secondary authentication.
  • the obtaining unit is used for the network function entity to obtain the authentication result of the secondary authentication and the restriction conditions of the secondary authentication from the data network.
  • the storage unit is configured to store the acquired authentication result of the secondary authentication and the restriction conditions of the secondary authentication in the core network (for example, AMF or UDM that can be stored in the core network).
  • the core network for example, AMF or UDM that can be stored in the core network.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the storage unit binds and stores the authentication result of the secondary authentication and the authentication result of the primary authentication (the authentication result of the secondary authentication is bound to the authentication result of the primary authentication).
  • Storage which may indicate that the validity period of the certification result of the second level certification is the same as or has a corresponding relationship with the certification result of the first level certification) or independently stored; or the storage unit stores the certification result of the second level certification with the User equipment context binding storage (the authentication result of the secondary authentication is bound to the user equipment context and stored, which may indicate that the authentication result of the secondary authentication is the same or has a corresponding relationship with the validity period of the user equipment context) Or independent storage.
  • the validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity period of the user equipment context.
  • the validity period of the secondary certification is equal to or not equal to (greater than or less than) the validity period of the primary certification.
  • the assisting unit assisting in the secondary authentication between the data network and the user equipment includes: assisting the data network when it is determined that the initiation condition of the secondary authentication of the user equipment is satisfied Perform secondary authentication with the user equipment.
  • the secondary authentication request of the user equipment may be rejected or it may be directly determined that the secondary authentication between the data network and the user equipment is not satisfied. success.
  • the obtaining unit is further configured to obtain the incidental information of the secondary authentication from the data network.
  • the storage unit is further configured to store the acquired incidental information of the secondary authentication in the core network, and the incidental information can be used to determine the initiation condition of the next secondary authentication of the user equipment or other user equipment.
  • the network function entity in the core network further includes a notification unit, configured to send the obtained authentication result of the secondary authentication and the restriction conditions of the secondary authentication to the user equipment .
  • the user equipment may receive and store the authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the network function entity in the core network further includes an update unit, configured to, when receiving an update request from the data network for requesting to update the secondary authentication restriction conditions, according to all The update request updates the restriction conditions of the secondary authentication stored in the core network.
  • the notification unit may be further configured to send the update request to the user equipment when the network function entity receives an update request from the data network for requesting to update the secondary authentication restriction condition.
  • the user equipment may update the restriction conditions of the secondary authentication stored in the user equipment according to the update request.
  • the third aspect of the embodiments of the present application provides another communication method, including: an authentication server in a data network performs second-level authentication with a user equipment with the assistance of a core network; and sends the second-level authentication to the core network
  • the authentication result and the restriction conditions of the secondary authentication, the authentication result of the secondary authentication and the restriction conditions of the secondary authentication can be stored by the core network.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the method may further include: the authentication server sending the secondary authentication incidental information to the core network, the incidental information can be stored by the core network, and the incidental information It can be used to determine the initiation condition of the next secondary authentication of the user equipment or other user equipment.
  • the method further includes: the authentication server sends to the core network an update request for requesting to update the second-level authentication restriction conditions, and the update request is used to trigger the core network The stored restriction conditions of the secondary certification are updated.
  • the fourth aspect of the embodiments of the present application provides another authentication server in a data network, including:
  • the secondary authentication unit is used to perform secondary authentication with the user equipment with the assistance of the core network (such as AMF);
  • the core network such as AMF
  • the interaction unit is configured to send the authentication result of the secondary authentication and the restriction conditions of the secondary authentication to the core network (such as AMF), wherein the authentication result of the secondary authentication and the authentication result of the secondary authentication
  • the restriction conditions can be stored by the core network.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the interaction unit is further configured to send incidental information of the secondary authentication to the core network.
  • the incidental information can be stored by the core network, and the incidental information can be used to determine the next second level authentication initiation condition of the user equipment or other user equipment.
  • the interaction unit is further configured to: send to the core network an update request for requesting to update the secondary authentication restriction conditions, and the update request is used to trigger the core network to store The restrictive conditions of the secondary certification are updated.
  • the fifth aspect of the embodiments of the present application provides a communication method, including: after the first level authentication between the core network and the user equipment is successful, if the second level authentication is required between the user equipment and the data network, the user The device performs secondary authentication with the data network with the assistance of the core network.
  • the user equipment receives the authentication result of the secondary authentication and the restriction condition of the secondary authentication sent by the core network.
  • the user equipment stores the received authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the method further includes: the user equipment is After determining that the validity period of the authentication result is over, initiate secondary authentication with the data network again; the user equipment suspends the initiation of communication with the data network before determining that the validity period of the authentication result is over Second level certification.
  • a sixth aspect of the embodiments of the present application provides a user equipment, including:
  • the authentication unit is configured to, after the first level authentication between the core network and the user equipment is successful, and if the second level authentication is required between the user equipment and the data network, with the assistance of the core network and the data Two-level authentication between networks.
  • the interaction unit is configured to receive the authentication result of the secondary authentication and the restriction conditions of the secondary authentication sent by the core network.
  • the storage unit is configured to store the received authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the authentication unit is further configured to: when the authentication result of the secondary authentication is authentication failure, and the restriction condition of the secondary authentication is the validity period of the authentication result, when determining After the validity period of the authentication result ends, the secondary authentication with the data network is initiated again; before it is determined that the validity period of the authentication result ends, the initiation of the secondary authentication with the data network is suspended.
  • the interaction unit is further configured to: receive the supplementary information of the secondary authentication sent by the core network; if it is determined that the initiation condition of the user equipment secondary authentication is satisfied, initiate again Secondary authentication with the data network; in the case where it is determined that the initiation condition of the secondary authentication of the user equipment is not satisfied, the initiation of the secondary authentication with the data network is suspended.
  • the additional information is used to determine the initiation condition of the next secondary authentication of the user equipment.
  • a seventh aspect of the embodiments of the present application provides a communication device, wherein the communication device includes a coupled processor and a memory; wherein the processor is used to call a computer program stored in the memory to complete the implementation of the application Some or all of the steps of any method provided in the example.
  • the communication device may be, for example, a user equipment, an authentication server in a data network, or a network functional entity (such as AMF, etc.) in a core network.
  • a network functional entity such as AMF, etc.
  • the eighth aspect of the embodiments of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it can complete any information provided in the embodiments of the present application. Part or all of the steps of a method.
  • the embodiments of the present application also provide a computer program product of instructions.
  • the computer program product runs on a computer device, the computer device executes any one of the devices provided in the embodiments of the present application. Part or all of the steps of this method.
  • Fig. 1 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • Figure 2-A is a schematic diagram of a secondary authentication provided by an embodiment of the present application.
  • Figure 2-B is a schematic diagram of an authentication process provided by an embodiment of the present application.
  • Fig. 3 is a schematic flow diagram of a secondary authentication provided by an embodiment of the present application.
  • Fig. 4 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • Fig. 6 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a user equipment provided by an embodiment of the present application.
  • Fig. 9 is a schematic structural diagram of an authentication server provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a network functional entity of a core network provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 1 is a schematic diagram of a 5G network architecture as an example of an embodiment of the present application.
  • the 5G network splits certain network functional entities (such as mobility management entities (MME, Mobility Management Entity), etc.) of the 4G network, and defines an architecture based on a service-oriented architecture.
  • MME mobility management entities
  • MMF Access and Mobility Management Function
  • SMF Session Management Function
  • the user terminal (or called the user equipment (UE, User Equipment) or terminal equipment or terminal, etc.) accesses the data network (DN, Data Network) and so on by accessing the operator network, and then uses the operator or the third Services provided by three parties.
  • UE User Equipment
  • DN Data Network
  • Access and Mobility Management Function is a control plane network function in the 3GPP network, which is mainly responsible for the access control and mobility management of the UE accessing the operator's network.
  • the security anchor function SEAF, Security Anchor Function
  • SEAF may be deployed in the AMF, or the SEAF may also be deployed in another device different from the AMF.
  • the SEAF is deployed in the AMF as an example.
  • the session management function is a control plane network function in the 3GPP network. Among them, the SMF is mainly responsible for managing the UE's data packet (PDU, Packet Data Unit) session.
  • PDU Packet Data Unit
  • the PDU session is a channel used to transmit PDUs, and the UE can send PDUs to each other through the PDU session and the DN.
  • SMF is responsible for management work such as establishment, maintenance and deletion of PDU sessions.
  • the data network (DN, Data Network) is also called the Packet Data Network (PDN, Packet Data Network), and is usually a network outside the 3GPP network.
  • the 3GPP network can access multiple DNs, and multiple services provided by operators or third parties can be deployed on the DN.
  • a certain DN is a private network of a smart factory, sensors installed on the smart factory workshop play the role of UE, and the sensor control server is deployed in the DN.
  • the UE communicates with the control server. After the UE obtains an instruction from the control server, it can transmit the collected data to the control server according to the instruction.
  • a DN is a company's internal office network, and the terminal used by the company's employees can play the role of a UE, and this UE can access the company's internal information and other resources.
  • the unified data management network function (UDM, Unified Data Management) is a control plane network function in the 3GPP network.
  • UDM is mainly responsible for storing the subscription data, credential and persistent identity (SUPI) of subscribers in the 3GPP network. , Subscriber Permanent Identifier) etc. These data can be used to authenticate and authorize the UE to access the operator's 3GPP network.
  • SUPI credential and persistent identity
  • SUPI subscriber Permanent Identifier
  • the authentication server function (AUSF, Authentication Server Function) is also a control plane network function in the 3GPP network.
  • AUSF is mainly used for first-level authentication (that is, authentication between the 3GPP network and the terminal of the subscriber).
  • the Network Exposure Function (NEF, Network Exposure Function) is also a control plane network function in the 3GPP network.
  • NEF is mainly responsible for opening the external interface of the 3GPP network to third parties in a safe manner.
  • network functions such as SMF need to communicate with third-party network functions, NEF can be used as a communication relay.
  • the network storage function (NRF, Network Repository Function) is also a control plane network function in the 3GPP network. It is mainly responsible for storing the configuration service profile of the accessible network function (NF) and providing the network for other network functions. Functional discovery service.
  • User Plane Function is the gateway for the communication between the 3GPP network and the DN.
  • the Policy Control Function (PCF, Policy Control Function) is a control plane function in the 3GPP network, which is used to provide the SMF with the policy of the PDU session.
  • Policies can include billing, quality of service (QoS, Quality of Service), authorization-related policies, etc.
  • the access network (AN, Access Network) is a sub-network of the 3GPP network. To access the 3GPP network, the UE first needs to go through the AN. In the radio access scenario, AN is also called Radio Access Network (RAN, Radio Access Network), so the two terms RAN and AN are often mixed without distinction.
  • RAN Radio Access Network
  • 3GPP network refers to a network that complies with 3GPP standards. Among them, the part other than UE and DN in Figure 1 can be regarded as a 3GPP network.
  • 3GPP networks are not limited to 5G networks defined by 3GPP, but can also include 2G, 3G, and 4G networks. Usually 3GPP networks are operated by operators.
  • N1, N2, N3, N4, N6, etc. in the architecture shown in FIG. 1 respectively represent reference points (Reference Points) between related network functions. Among them, Nausf, Namf... etc. respectively represent service-oriented interfaces of related network functions.
  • the mobility management network function in the embodiment of the present application may be the AMF shown in FIG. 1, or may be other network functions having the above-mentioned AMF function in the future communication system.
  • the mobility management network function in this application may also be an MME in long term evolution (LTE).
  • the embodiments of the present application mainly take the mobility management network function as AMF as an example for description.
  • the user terminal, user equipment, terminal equipment or terminal may be collectively referred to as UE. That is, unless otherwise specified, the AMF described later in the embodiments of the present application can be replaced with a mobility management network function, and the UE can be replaced with a user terminal, user equipment, terminal device, or terminal.
  • the network architecture shown in Figure 1 (such as the 5G network architecture) adopts a service-based architecture and common interfaces.
  • the traditional network element functions are based on network function virtualization (NFV, network function Virtualization) technology, which is split into several self-contained, Self-management and reusable network function service modules can realize customized network function reconstruction through flexible definition of service module collections, and form business processes through unified service call interfaces externally.
  • the schematic diagram of the network architecture shown in FIG. 1 can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario.
  • different network functions are combined in an orderly manner as needed to realize customization of network capabilities and services, so as to deploy dedicated networks for different services and realize 5G network slicing.
  • Network slicing technology can enable operators to respond to customer needs more flexibly and quickly, and support the flexible allocation of network resources.
  • Network slicing a simple understanding is to cut the operator’s physical network into multiple virtual end-to-end networks.
  • Each virtual network including the equipment, access, transmission and core network in the network, is logically independent. Failure of one virtual network will not affect other virtual networks.
  • 3GPP 3rd Generation Partnership Project
  • 3GPP 3rd Generation Partnership Project
  • network slices do not affect each other. For example, a large number of sudden meter reading services should not affect normal mobile broadband services.
  • 3GPP in order to meet diverse needs and isolation between slices, relatively independent management and operation and maintenance between businesses are required, and tailor-made business functions and analysis capabilities are provided. Instances of different types of services can be deployed on different network slices, and different instances of the same service type can also be deployed on different network slices.
  • the slice in the 5G network is a virtual private network, which is composed of a set of network functions and sub-networks.
  • the sub-network RAN 140, the AMF network function 137, the SMF network function 138, and the UPF network function 139 in FIG. 1 can form a slice.
  • Each network function in Figure 1 is schematically drawn only one, and in actual network deployment, each network function or sub-network can have multiple (such as several, tens or hundreds, or even more Multiple).
  • Many network slices can be deployed in the operator's network, and each slice can have different performance to meet the needs of different applications and different vertical industries. Operators can tailor a slice according to the needs of customers in different vertical industries.
  • slice-level authentication is a network control function participated by industry customers, that is, authentication and authorization of user equipment access to slices, which may be referred to as "slice authentication" in this embodiment of the application.
  • the UE 110 when the core network CN deploys network slices, if the UE 110 needs to access a certain network slice, the UE 110 can provide the core network with the requested network slice.
  • the network slice requested by the UE 110 for example, can be represented by a requested network slice set, or the requested network slice can also be represented by requested network slice selection assistance information (requested NSSAI, requested network slice selection assistance information) To represent.
  • the network slice set includes one or more network slices.
  • Requested NSSAI is composed of one or more single network slice selection assistance information (S-NSSAI, single network slice selection assistance information).
  • S-NSSAI single network slice selection assistance information
  • Each S-NSSAI is used to identify a network slice type, which can also be understood as S-NSSAI Used to identify network slices, or can be understood as S-NSSAI is identification information of network slices.
  • Network slicing in the embodiments of the present application may also be referred to as “slicing” or “network slicing instance”, and the three have the same meaning, and are explained here in a unified manner, and will not be repeated hereafter.
  • the core network function (such as AMF network function 137 or NSSF network function) comprehensively judges based on the subscription data of the UE 110, the requested NSSAI of the UE 110, the roaming agreement, and the local configuration, etc., and then The UE 110 selects a set of network slices allowed to be accessed.
  • the set of network slices allowed to be accessed may be represented by allowed NSSAI, and the S-NSSAI included in the allowed NSSAI is the S-NSSAI allowed to be accessed by the current operator network.
  • the UE 110 Before the UE 110 is allowed to access the network or the network slice, it will perform mutual authentication with the network and/or the network slice and be authorized by the network and/or the network slice.
  • the network's authentication and authorization of the UE 110 are directly performed by the operator's network. This type of authentication and authorization method is called primary authentication.
  • the data network DN 120 outside the operator network (such as the DN serving vertical industries) will also have authentication and authorization requirements for the UE 110 that accesses the DN 120 .
  • a commercial company provides a game platform to provide game players with game services through the operator's network.
  • the operator's network needs to authenticate and authorize the UE 110, that is, the first level authentication.
  • a game player is a customer of a commercial company, and the commercial company also needs to authenticate and authorize game players. If this authentication is based on network slicing, or authentication is based on slices, then this authentication can be called slicing Authentication (slice authentication) is also called slice-specific authentication or called secondary authentication.
  • secondary authentication may also be referred to as secondary authentication for slices, or slice authentication, or identity authentication for users (users using UE 110), which has the meaning, for example:
  • the secondary authentication performed between the UE 110 (or the user using the UE 110) and the third-party network, the authentication result will determine whether the operator network authorizes the UE to access the corresponding slice.
  • the method applied to secondary authentication in the embodiments of the present application is also applicable to scenarios such as session-based secondary authentication (secondary authentication) or slice-based secondary authentication, and will not be described in detail here.
  • the secondary authentication mentioned in the embodiments of this application is essentially the authentication between the data network and the user who uses the user equipment. Since the user equipment can represent the user to a certain extent, it can also be called “data network and user "Second-level authentication between devices", of course, can also be called “second-level authentication between data networks and users using user devices” in some cases. In the embodiment of the present application, these two terms have the same meaning and can be used together. Similar “secondary authentication for user equipment” and “secondary authentication for user” can be used together, and so on.
  • Figure 2-A illustrates the first-level authentication and slice authentication methods.
  • Figure 2-A shows the authentication process between the UE and the network.
  • the authentication process between the UE and the network includes the first-level authentication process and the second-level authentication process.
  • the first-level authentication process is the authentication process between the UE and the operator's network
  • the second-level authentication process is the UE or a user who uses the UE.
  • And the authentication process between the third-party network is the authentication process between the third-party network.
  • the description of the "second-level authentication process between the UE and the third-party network" can be understood as a second-level authentication process between a certain user using the UE and the third-party network.
  • the primary authentication process is the authentication process between the UE 210 and the core network CN 230
  • the secondary authentication process is the authentication process between the user using the UE 210 and the data network DN 220
  • Both the first-level authentication process and the second-level authentication process can be understood as part of the registration process of the UE 110.
  • the authentication device in DN 220 is an authentication, authorization, and accounting (AAA, authentication, authorization, accounting) server as an example for description.
  • AAA server can be expressed as AAA-S (AAA server), the AAA proxy function (AAA-F, AAA-proxy function) 238 may be located in the core network CN 230, and forward the message sent by the core network to AAA-S.
  • AAA-F is an optional implementation, which is not limited in the embodiment of the application. It should be further noted that AAA-S is usually deployed on the DN side outside the 3GPP network, but DN220 or AAA-S221 can also be deployed inside the 3GPP network, which is not limited in the embodiment of this application.
  • the main steps of the UE 210 registration process can be as follows:
  • the UE sends a registration request for requesting access to the network to the network, where the registration request carries identity information of the UE.
  • the UE 210 may send an access request carrying the identity information of the UE 210 to the AMF network function entity 237 in the core network CN 230.
  • the identity information may specifically be encrypted identity information SUCI or temporary identity information such as a globally unique temporary identity. (GUTI, globally unique temporary identifier).
  • the network determines whether to initiate the first-level authentication between the network and the UE according to the identity information of the UE carried in the registration request sent by the UE.
  • the AMF network function entity 237 may forward the encrypted identity information SUCI received from the UE 210 to the UDM network function entity 234, and the UDM network function entity 234 decrypts the SUCI, thereby restoring the real identity information SUPI of the UE 210 , And then return SUPI to the AMF network function entity 237.
  • the AMF network function entity 237 initiates the first level authentication process between the network and the UE 210 according to the real identity SUPI of the UE 210.
  • the network can authorize the UE to allow it to access the operator's network.
  • the AMF network function entity 237 authorizes the UE 210 to access the operator network.
  • step 201 the primary authentication process between the UE and the network can be considered as completed.
  • the AMF checks the validity of the GUTI on the network side. If it is valid, it indicates that the previous level 1 authentication is still valid, and no level 1 authentication is required.
  • the network determines whether the UE needs further secondary authentication.
  • the AMF network function entity 237 determines whether the slice to which the UE 210 applies for access needs further slice authentication (ie, secondary authentication) according to the local information of the AMF network function entity 237 or the UDM network function entity 234.
  • the network can trigger the secondary authentication process between the UE and the data network DN.
  • the AMF network function entity 237 triggers the secondary authentication process between the UE 210 and the DN 220.
  • This embodiment of the application takes the secondary authentication as slice authentication as an example.
  • This slice authentication process can be based on the extensible authentication protocol (EAP, extensible authentication) formulated by the standards organization-internet engineering task force (IETF). protocol) standard as the basic authentication mechanism.
  • EAP extensible authentication protocol
  • IETF standards organization-internet engineering task force
  • the UE mentioned in the embodiments of this application needs to perform secondary authentication. It can be understood that a user who uses the UE needs to perform secondary authentication. Taking the secondary authentication as slice authentication as an example, the UE 210 needs to perform secondary authentication. Authentication can be understood as a user who uses UE 210 needs to perform secondary authentication.
  • the UE 210 completes the secondary authentication through multiple rounds of signaling interaction with the data network, and the data network notifies the operator network of the secondary authentication result.
  • the carrier network will continue to perform other processes based on the results of the secondary certification, such as continuing to perform the remaining registration process, termination of the registration process, or other related processes, which are not listed here.
  • DN 220 can obtain UE 110
  • the user identity information contracted with the DN 220 that is, the identity information of a certain user who uses the UE 210 mentioned above.
  • the user identity information is referred to as the DN user identity (DUI, DN user identity) in this embodiment of the application.
  • the user identity information may also be referred to as a user ID.
  • the user ID used for secondary authentication is the contract information between the terminal device and an external network other than the operator's network, and the operator's network may not have this information.
  • the UE 210 sends the DUI to the AMF 237 in the core network CN 230, and the AMF 237 can forward the DUI to the authentication device in the DN 220 (such as the AAA-S 221 shown in the figure). ), after the secondary authentication is successful, the authentication device in DN 220 will notify AMF 237 of the secondary authentication result.
  • the DUI is placed in a message container (container) and sent to the AMF, and the AMF directly forwards the container to the DN, which is the so-called "transparent transmission". In this case, the AMF does not parse the DUI in the container, that is, the AMF does not know the user's DUI.
  • the DUI may be forwarded from the AMF network function entity 237 to the authentication device in the DN 220 through the AAA-F 238.
  • the first-level authentication process and the second-level authentication process between the UE 210 and the network are completed, and the operator network can also continue to perform other registration processes of the UE 210.
  • the secondary authentication process between UE data networks can be based on the EAP authentication mechanism, where the EAP authentication mechanism can support dozens of specific EAP authentication methods. Different UEs can support different or the same EAP authentication methods for the same data network; for different data networks, the same UE can support different or the same EAP authentication methods. The EAP authentication methods supported by different data networks can be different or the same.
  • a UE For a UE, it can support one or more EAP authentication methods; for a data network, it can support one or more EAP authentication methods.
  • the EAP authentication method supported by both the UE and the data network will be adopted.
  • the EAP authentication method supported by the data network can also be understood as the EAP authentication method supported by the authentication device in the data network. The two expressions have the same meaning, and the embodiment of this application does not make a strict distinction.
  • FIG. 3 schematically shows a part of the secondary authentication process between the UE and the AAA-S in the data network. It should be understood that the secondary authentication process between the UE and the data network (including AAA-S) also includes the network For other steps such as establishing a connection with AAA-S and the details of the EAP authentication process, detailed examples are not given here to simplify the description.
  • FIG. 3 shows an example of a partial process of secondary authentication.
  • the AMF determines that the UE needs to perform the second-level authentication and initiates the second-level authentication
  • the AMF sends the NAS message that can be used to initiate the second-level authentication to the UE.
  • the UE has completed the first-level authentication with the core network, so the AMF sent to the UE
  • This NAS message is encrypted and integrity protected.
  • This NAS message includes the EAP ID Request information, which requests the UE for the user ID (DUI mentioned in step 206) that needs to be used for secondary authentication.
  • the UE replies to the AMF with a NAS response message, and the NAS response message in the reply carries EAP ID Response information, which is used to send the user ID information (DUI) requested in step 301.
  • EAP ID Response information which is used to send the user ID information (DUI) requested in step 301.
  • step 301 and step 302 are optional steps, because not all EAP authentication processes need to use DUI or need to send DUI through EAP process. It should be further noted that in addition to EAP information, the NAS message may also include other related information, such as S-NSSAI, which is not limited here.
  • AMF sends an EAP authentication request to AAA-S, where the EAP authentication request carries DUI information (if step 301 and step 302 are performed).
  • the EAP authentication request is forwarded by network functions such as AUSF and/or AAA-P. It should be noted that it is not limited here whether the message is forwarded through these network functions or the message and message type carried by the information are forwarded.
  • the message sent by AMF to AAA-S may also include other related information, such as GPSI, etc., which is not limited here.
  • AAA-S sends an EAP authentication response to AMF. Similar to step 303, optionally, it is forwarded through network functions such as AUSF and/or AAA-P. Similarly, there are no restrictions on the message and message type carried by forwarding the information, as well as other related information sent, such as GPSI.
  • the UE continues to send the information required for EAP authentication to the AMF. Similar to step 303, this information is carried by the encrypted and integrity-protected NAS message. This NAS message can also carry other related information.
  • AMF sends the information required for EAP authentication to AAA-S. Similar to step 304, the forwarding network function, bearer message, and other related information are not limited.
  • steps 305-306 can be performed multiple times, and the number of interactions depends on the EAP method used and whether retransmission is required, and other factors, which are not limited here.
  • AAA-S can obtain/judge the result of EAP authentication, that is, authentication success or failure.
  • AAA-S sends the authentication result to AMF to complete the EAP authentication process in the secondary authentication.
  • the sending method is similar to step 304, and will not be repeated here.
  • the conditions for successful use of the second-level authentication are not clearly defined. For example, there is no limit to the validity period for the successful secondary certification. This will pose potential risks to network security or/and the efficiency of network operations. For example,
  • the results of the second-level certification are not limited to the validity period, and the network can determine that the results of the second-level certification are "permanently valid". For example, only after the user ID (DUI) or terminal ID (SUPI) is revoked by the DN (AAA-S) or the operator's network, the result of a successful secondary authentication will become invalid.
  • the result of the secondary authentication is stored in the network (such as AMF) as the security context of the terminal, it means that the result of the secondary authentication is bound with the result of the primary authentication.
  • the network such as AMF
  • the result of the slice authentication becomes invalid.
  • the result of the secondary authentication is stored in the network (such as AMF) as the context of the terminal, it means that the result of the secondary authentication is bound to the registration status of the terminal on the network.
  • the result of the slice authentication will be valid for a long time, and in this case, it is impossible to indicate that different S-NSSAIs may have different validity periods for the secondary authentication.
  • the user/terminal ID revocation event is an abnormal behavior processing event, under normal circumstances, after the secondary authentication is successful, it is equivalent to a "permanent" authorization.
  • This long-term effective authentication and authorization can greatly increase the security risks of unauthorized users accessing slices. For example, if the user and the terminal are not bound, after the attacker obtains the user name information, he can use a legitimate terminal to access the slice without authentication (assuming the user has passed the secondary authentication).
  • the attacker can embezzle the SIM card on other legitimate terminals (SIM card embezzlement, loss, stolen, clone, etc.), and first pass the first level authentication, then the second level authentication is not required , Direct access to the slice, this is because the terminal has passed the secondary certification and is valid for a long time. If the secondary certification is time-sensitive, this risk will be greatly reduced. On the other hand, the secondary authentication without time limit makes the network unable to effectively provide time-limited access services. If the process of first authentication and then revocation is used to complete time-limited access, it will cause abuse of the revocation process and increase network resource consumption. When the number of users increases, this waste of network resources will increase significantly.
  • the results of the second-level certification are bound to the results of the first-level certification by default, to implicitly limit the timeliness of the second-level certification, other problems may arise.
  • this may cause difficulties in setting the validity period of the first-level authentication security context: on the one hand, if the first-level authentication validity is set too long, it will bring greater security risks to the first-level authentication security context.
  • the longer the validity period of the security context the longer the time left for potential attackers to attack, that is, the lower the security.
  • the storage capacity requirement for the AMF is also higher.
  • the UE context and the UE's security context are that operators set a reasonable validity period according to their own network conditions and security considerations.
  • the validity period of the first level certification is set too short, it will cause frequent slice certification.
  • the time point for sending the slice authentication request is not fixed. For example, when the slice authentication request occurs near the first level authentication or the (security) context is about to expire, the result of the slice authentication will soon become invalid, causing repeated unnecessary slice authentication, especially based on the EAP mechanism.
  • Slicing authentication requires multiple rounds of network interaction with a long chain (from the terminal to the operator's network and then to the external DN), resulting in a significant waste of network resources.
  • the network needs to support: a) a single UE multi-user scenario; b) a single user uses a multi-UE scenario, the problem is more serious, and various application scenarios cannot be effectively supported in terms of resources.
  • the problem depends on the validity period of the UE context. If it is too long, there will also be similar security risks or/and higher storage resource requirements. If it is too short, there will be a problem of frequent secondary certification. Furthermore, since the UE supports multiple S-NSSAI secondary authentications, different S-NSSAIs may have different authentication and authorization validity periods. This method cannot achieve a differentiated validity period (UE context as a unified validity period).
  • the following discusses how to increase the mechanism of qualifications for secondary certification. For example, increase the validity period of the secondary certification, optimize the process and storage for the validity period, and add other restrictive conditions, such as level and mode. Specifically, for example, the storage method of the secondary authentication result, whether it is bound to the UE security context, and whether to establish an independent user-level (security) context.
  • the restriction conditions of the authentication result include, but are not limited to: validity period, authentication authorization level, authentication authorization operation mode, etc.
  • FIG. 4 is a schematic flowchart of a communication method according to an embodiment of the application.
  • the network function entity (such as AMF, etc.) in the core network will assist Perform secondary authentication between the data network and the user equipment.
  • the secondary authentication mentioned in the embodiments of this application is essentially the authentication between the data network and the user who uses the user equipment, and the user equipment can represent the user who uses the user equipment to a certain extent, so it can also be called “Secondary authentication between data network and user equipment", of course, can also be called “secondary authentication between data network and user who uses user equipment” or “secondary authentication between data network and user” in some cases ".
  • these several terms have the same meaning and can be used together, and similar "secondary authentication for user equipment” and “secondary authentication for user” can be used together, and so on.
  • the user terminal, user equipment, terminal, and terminal device mentioned in the embodiments of the present application have the same meaning and can be mixed.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the network function entity After the network function entity obtains the authentication result of the secondary authentication and the restriction conditions of the secondary authentication from the data network, the network function entity will obtain the authentication result of the secondary authentication and The restriction conditions of the secondary authentication are stored in the core network (for example, AMF or UDM that can be stored in the core network).
  • the core network for example, AMF or UDM that can be stored in the core network.
  • the network function entity sends the acquired authentication result of the secondary authentication and the restriction conditions of the secondary authentication to the user equipment.
  • the user equipment may receive and store the authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the authentication result of the second-level authentication is stored in a binding manner with the authentication result of the first-level authentication (the authentication result of the second-level authentication is stored in association with the authentication result of the first-level authentication, It may indicate that the validity period of the authentication result of the secondary authentication is the same as or has a corresponding relationship with the authentication result of the primary authentication) or stored separately; or the authentication result of the secondary authentication is bound to the user equipment context and stored (The authentication result of the secondary authentication is stored in a binding manner with the user equipment context, which may indicate that the authentication result of the secondary authentication is the same or has a corresponding relationship with the validity period of the user equipment context) or stored independently, or The validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity period of the user equipment context, or the validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity of the primary authentication the term.
  • the network function entity in the core network assisting the secondary authentication between the data network and the user equipment includes: when it is determined that the initiation condition of the secondary authentication of the user equipment is satisfied, The network function entity in the core network assists the secondary authentication between the data network and the user equipment. In a case where it is determined that the initiation condition of the secondary authentication of the user equipment is not satisfied, the core network rejects the secondary authentication request of the user equipment or directly determines the secondary authentication between the data network and the user equipment unsuccessful.
  • the method may further include: the network function entity obtains the incidental information of the second-level authentication from the data network, and the network function entity obtains the incidental information of the second-level authentication.
  • the information is stored in the core network, and the additional information can be used to determine the initiation condition of the next secondary authentication of the user equipment or other user equipment.
  • the initiation condition of the secondary authentication may be determined by the previously stored incidental information of the secondary authentication for the current UE or other UEs. For example, when the operator’s network targets other UEs.
  • the initiation conditions of the second-level certification are used to assist the AMF in determining whether to continue the second-level certification process or directly determine that the second-level certification fails.
  • the reason for the authentication failure can be provided to the core network, and the reason for the authentication failure can be used as additional information for this secondary authentication for the next time the AMF meets the secondary authentication for this user or other users ( For S-NSSAI) conditions, auxiliary judgments are made.
  • AAA-S successfully completes the authentication and authorization of users, but the DN network capacity or the number of users that can be supported reaches the upper limit, AAA-S can notify the operator network that the DN is temporarily running in "full load mode", and no more will be accepted temporarily Level 2 certification.
  • AAA-S can also send a timer, which is used to limit the specific duration of "temporary”. After the AMF receives the timer, it is stored in the core network (such as AMF, UDM). The next time another UE applies for second-level authentication, it can directly reject the second-level authentication application to avoid unnecessary signaling interaction between the operator's core network and the DN .
  • the method further includes: the user equipment is After determining that the validity period of the authentication result is over, initiate secondary authentication with the data network again; the user equipment suspends the initiation of communication with the data network before determining that the validity period of the authentication result is over Second level certification.
  • the method further includes: when the network function entity receives an update request from the data network for requesting to update the second-level authentication restriction condition, updating all the data according to the update request.
  • the restriction conditions of the secondary authentication stored in the core network.
  • the network function entity may also send the update request to the user equipment, and the After receiving the update request, the user equipment updates the restriction conditions of the secondary authentication stored in the user equipment according to the update request.
  • FIG. 5 is a schematic flowchart of a communication method provided by an embodiment of the application.
  • the restriction condition of the validity period is added for the secondary authentication.
  • the storage location of the restriction conditions of the secondary authentication and the authentication result in the core network can be AMF or/and UDM (or can also be stored in other network functions).
  • a communication method may include:
  • the first level authentication establishes NAS security, and subsequent NAS signaling interaction between the UE and the network can be encrypted and integrity protected.
  • the AMF determines whether the UE (user using the UE) needs to perform secondary authentication.
  • the judgment method may include: querying the local AMF storage or querying the UDM storage.
  • the indication validity can be a period of time, during which it is valid.
  • the indication of validity can also be a timer. When the timer does not point to 0, the second level authentication is still valid. When the timer points to 0, the second level authentication is invalid.
  • the present invention does not limit the method of how to indicate the validity period.
  • the secondary authentication process is similar to the example schematic process of steps 302-307 in FIG. 3, which will not be repeated here, and reference may be made to the foregoing example description.
  • the AMF before the AMF initiates the secondary authentication between the UE and the AAA-S, it can further determine whether the initiation condition of the secondary authentication is satisfied.
  • the initiation condition can also be satisfied by default, which is equivalent to no initiation condition in this case. Only when the initiation conditions of the secondary authentication are met, the AMF initiates the secondary authentication between the UE and the AAA-S.
  • the initiation condition of the secondary authentication may be determined by the previously stored incidental information of the secondary authentication for the current UE or other UEs. For example, when the operator’s network targets other UEs.
  • the initiation conditions of the second-level certification are used to assist the AMF in determining whether to continue the second-level certification process or directly determine that the second-level certification fails.
  • the reason for the authentication failure can be provided to the core network, and the reason for the authentication failure can be used as additional information for this secondary authentication for the next time the AMF meets the secondary authentication for this user or other users ( For S-NSSAI) conditions, auxiliary judgments are made.
  • AAA-S successfully completes the authentication and authorization of users, but the DN network capacity or the number of users that can be supported reaches the upper limit, AAA-S can notify the operator network that the DN is temporarily running in "full load mode", and no more will be accepted temporarily Level 2 certification.
  • AAA-S can also send a timer, which is used to limit the specific duration of "temporary”. After the AMF receives the timer, it is stored in the core network (such as AMF, UDM). The next time another UE applies for second-level authentication, it can directly reject the second-level authentication application to avoid unnecessary signaling interaction between the operator's core network and the DN .
  • AAA-S can set the validity period of the secondary authentication (it can also set the incidental information of the secondary authentication), and send the authentication result with the same validity period as the successful authentication to the core network (such as AMF).
  • the validity period can be bound to the S-NSSAI, that is, for different S-NSSAIs, the validity period of the secondary certification can be different.
  • the validity period may also be bound to the UE or/and the user. For different UEs or/and users, for the same S-NSSAI secondary authentication, the validity period may be different.
  • the core network (such as AMF) receives the authentication result message sent by AAA-S, it stores the authentication result and the validity period (it can also store additional information).
  • the main possible storage methods are: 1) Bind the security context of the first level authentication; 2) Bind the UE context (independent of other contexts); 3) Define an independent "user" context (independent of the UE context).
  • the storage method and storage location have the following optional implementation methods:
  • the second-level certification result is bound to the first-level certification result (or the security context after the first-level certification), that is, when the first-level certification security context becomes invalid, the second-level certification result is automatically invalidated.
  • This storage method may cause potential repeated secondary certification problems. This is because a UE usually supports multiple S-NSSAI second-level authentication. When the UE applies for access to a certain S-NSSAI, if the previous first-level authentication is still valid (or has a security context), the first-level authentication is no longer performed Certification, only for the second level certification of the S-NSSAI.
  • the second level certification is usually controlled by the external network, while the first level certification is controlled by the operator. The way to increase the effectiveness of the first level certification through the second level certification may lead to the risk of the external network controlling the first level certification.
  • the secondary authentication result is bound to the UE context and stored, that is, when the UE context becomes invalid, the secondary authentication result is automatically invalidated.
  • this method it is necessary to ensure the independence of the validity period of the secondary certification result, that is, the result/validity of the secondary certification will not be invalidated due to the invalidation of other contexts. Since one UE will support multiple S-NSSAI secondary certifications, the validity period of the secondary certifications will be very different, which may cause the UE's context to be valid for a long time due to the existence of the secondary certification, occupying storage resources. Therefore, this storage method needs to reasonably set the validity period of its UE context according to the specific situation.
  • the result/validity period of the secondary authentication can be Central storage is more effective. For example, it is stored in UDM. AMF can access and query UDM to obtain information such as secondary authentication result/validity period.
  • the user context can be independent of the UE context.
  • This is a flexible storage method that decouples the user for slice authentication and the bearer terminal UE.
  • the "user" here refers to a user who performs secondary authentication, and the result/validity of slice authentication can be naturally decoupled from the context of the UE.
  • this method can more effectively support application scenarios where multiple users use the same UE and the same user uses multiple UEs.
  • the former means that multiple users use the same terminal to access the network at different times for secondary authentication.
  • each secondary authentication is independent of each other due to different users.
  • the latter means that a user can use different terminals to access the slice at different times (secondary authentication). As long as the slice authentication is valid, the user does not need to perform slice authentication.
  • the core network sends the secondary authentication result or/and the validity period to the UE.
  • the UE may store the received secondary authentication result or/and the validity period.
  • This embodiment introduces the limitation of the validity period for the second-level authentication, thereby helping to effectively limit the second-level authentication result, thereby helping to reduce the security risk of unauthorized access slices, and effectively supporting time-limited access and restricted conditions. Access to slice services. It is also beneficial to avoid unnecessary multiple slice authentication and improve network resource utilization. It is beneficial to effectively support single UE multi-user and single-user multi-UE application scenarios.
  • FIG. 6 is a schematic flowchart of another communication method provided by an embodiment of this application.
  • the restriction condition of the authorization level is added for the secondary authentication.
  • the storage location of the restriction conditions of the secondary authentication and the authentication result in the core network can be AMF or/and UDM (or can also be stored in other network functions).
  • another communication method may include:
  • the first level authentication establishes NAS security, and subsequent NAS signaling interaction between the UE and the network can be encrypted and integrity protected.
  • the AMF determines whether the UE (user using the UE) needs to perform secondary authentication.
  • the stored secondary authentication authorization status can be checked, such as whether secondary authentication is required, whether secondary authentication is within the validity period, etc.
  • the secondary authentication process is similar to the example schematic process of steps 302-307 in FIG. 3, which will not be repeated here, and reference may be made to the foregoing example description.
  • the AMF may send a secondary authentication request to AAA-S, and the secondary authentication request may carry a recommended secondary authentication authorization level, for example.
  • AAA-S sets the authorization level of this second-level authentication (you can also set the incidental information for the second-level authentication), and sends the authentication result with the same authorization level as the successful authentication to the core network (such as AMF).
  • the AAA-S can execute the authorization level setting action according to the DN strategy.
  • the core network (such as AMF) receives the authentication result message sent by AAA-S, it stores the authentication result and the validity period (it can also store additional information).
  • the storage mode and storage location can be considered with reference to the exemplary embodiment shown in FIG. 4.
  • the AMF can allocate "allowed S-NSSAI" according to the authorization level, and send the allowed S-NSSAI in step 606 without sending the authorization level.
  • the AMF sends both allowed S-NSSAI and authorization level in step 606.
  • the authorization level of the secondary certification is similar to the authorization levels of "Platinum”, “Gold”, “Silver” in commercial services or games. Different authorization levels can have different privileges, for example. The higher the authorization level, the higher the privileges it may enjoy.
  • the supplementary information in this embodiment includes some supplementary information.
  • the operator's network performs second-level authentication for other terminals (for the second-level authentication of the S-NSSAI)
  • the supplementary information can assist the network in determining whether to continue The secondary certification process may directly determine that the secondary certification has failed.
  • the reason for the authentication failure can be provided to the network, where the reason for the authentication failure can be used as auxiliary information for the network to perform secondary authentication on the user/terminal or other users/terminals (for This S-NSSAI) is used for auxiliary judgment.
  • the core network sends the secondary authentication result to the UE.
  • the UE may store the received secondary authentication result.
  • whether the core network sends the authorization level to the UE can be determined by following the example in step 605.
  • This embodiment introduces the restriction conditions of the authorization level for the second-level authentication, thereby helping to effectively restrict the second-level authentication, thereby helping to reduce the security risk of unauthorized access slices, and effectively supporting time-limited access and restricted access.
  • Into the slice business It is also beneficial to avoid unnecessary multiple slice authentication and improve network resource utilization. It is beneficial to effectively support single UE multi-user and single-user multi-UE application scenarios.
  • FIG. 7 is a schematic flowchart of another communication method provided by an embodiment of the application.
  • the embodiment shown in FIG. 7 is an update process for the restriction conditions of the secondary authentication.
  • AAA-S stores each user's secondary authentication results and restrictions (validity period or authorization level, etc.) based on previous authentication records, assuming that AAA-S is based on changes in contract data or based on DN/AAA-S policies , It is necessary to modify the restriction conditions of a user's previous secondary authentication (such as changing the validity period, authorization level, etc.).
  • the AAA-S sends an update request to the core network, where the update request includes the user ID, the terminal ID (such as GPSI) and the authority value that needs to be updated.
  • the updated authority value is, for example, a new validity period or an updated authorization level (Such as changing a silver user to a gold user).
  • the update request may also carry information such as the S-NSSAI of the user/terminal (if AAA-S can obtain it).
  • the core network (such as AMF) can update the locally stored second-level authentication restrictions.
  • AMF can also send update requests to UDM.
  • the AMF may also directly forward the update request to other related AMFs, thereby triggering the update of the restriction conditions of the second level authentication stored in other AMFs.
  • UDM also carries out the corresponding update of the second-level certification restrictions.
  • the UDM may also continue to forward the update request to other AMFs that store the restriction conditions of the second level authentication, thereby triggering other AMFs to also update the stored restriction conditions of the second level authentication.
  • the network (such as AMF) sends an update request to the UE, and the UE updates the locally stored secondary authentication restriction conditions based on the update request.
  • steps 702 and 703 can be performed in any order.
  • step 703 can also be performed first and then step 702 and so on.
  • the solutions in the embodiments of the present application are mainly for secondary authentication or slice authentication, and are also applicable to scenarios of session-based secondary authentication. I won't repeat it here.
  • the embodiment of the present application introduces restriction conditions for the secondary authentication, which is beneficial to effectively restrict the secondary authentication result, reduces the security risk of unauthorized access to slices, and effectively supports time-limited access and restricted access slice services. It helps to avoid unnecessary multiple slice authentication and improve network resource utilization. It is conducive to more effectively support single UE multi-user, single-user multi-UE application scenarios.
  • the solutions of the embodiments of the present application can be backward compatible, that is, if no restrictive conditions are sent, it is equal to unlimited access, or can be implicitly indicated according to the storage characteristics of the secondary authentication result.
  • an embodiment of the present application provides a user equipment 800, including:
  • the authentication unit 810 is configured to, after the first level authentication between the core network and the user equipment is successful, and if the second level authentication is required between the user equipment and the data network, with the assistance of the core network and the Two-level authentication between data networks.
  • the interaction unit 820 is configured to receive the authentication result of the secondary authentication and the restriction conditions of the secondary authentication sent by the core network.
  • the storage unit 830 is configured to store the received authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the authentication unit 810 is further configured to: when the authentication result of the secondary authentication is authentication failure, and the restriction condition of the secondary authentication is the validity period of the authentication result, After determining that the validity period of the authentication result is over, initiate secondary authentication with the data network again; before determining that the validity period of the authentication result is over, suspend initiating secondary authentication with the data network .
  • the interaction unit 820 is further configured to: receive the incidental information of the secondary authentication sent by the core network; in the case where it is determined that the initiation condition of the secondary authentication of the user equipment is satisfied, again Initiate the secondary authentication with the data network; in the case where it is determined that the initiation condition of the user equipment secondary authentication is not satisfied, suspend the initiation of the secondary authentication with the data network.
  • the additional information is used to determine the initiation condition of the next secondary authentication of the user equipment.
  • the user equipment 800 may cooperate with various modules to perform part or all of the steps of each method executed by the UE in the foregoing method embodiments.
  • an embodiment of the present application provides an authentication server 900 in a data network, including:
  • the secondary authentication unit 910 is used to perform secondary authentication with the user equipment with the assistance of the core network (such as AMF).
  • the core network such as AMF
  • the interaction unit 920 is configured to send the authentication result of the secondary authentication and the restriction conditions of the secondary authentication to the core network (such as AMF), wherein the authentication result of the secondary authentication and the secondary authentication
  • the restriction conditions can be stored by the core network.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the interaction unit 920 is further configured to send the incidental information of the secondary authentication to the core network.
  • the incidental information can be stored by the core network, and the incidental information can be used to determine the next secondary authentication initiation condition of the user equipment or other user equipment.
  • the interaction unit 920 is further configured to: send to the core network an update request for requesting to update the secondary authentication restriction conditions, and the update request is used to trigger the core network to The stored restriction conditions of the secondary certification are updated.
  • the authentication server 900 can cooperate with various modules to perform part or all of the steps of the methods executed by the authentication server in the foregoing method embodiments.
  • an embodiment of the present application provides a network function entity 1000 in a core network, which may include:
  • the assisting unit 1010 is configured to assist the communication between the data network and the user equipment if the second-level authentication is required between the data network and the user equipment after the first level authentication between the core network and the user equipment is successful Carry out secondary certification.
  • the obtaining unit 1020 is configured to obtain, from the data network, the authentication result of the secondary authentication and the restriction conditions of the secondary authentication by the network function entity.
  • the storage unit 1030 is configured to store the obtained authentication result of the secondary authentication and the restriction conditions of the secondary authentication in the core network (for example, AMF or UDM that can be stored in the core network).
  • the core network for example, AMF or UDM that can be stored in the core network.
  • the restriction conditions of the secondary certification may include, for example, the validity period of the certification result of the secondary certification and/or the authorization level of the secondary certification.
  • the storage unit 1030 binds and stores the authentication result of the secondary authentication and the authentication result of the primary authentication (the authentication result of the secondary authentication and the authentication result of the primary authentication are Bind storage, which may indicate that the validity period of the certification result of the second level certification is the same as or has a corresponding relationship with the certification result of the first level certification) or independently stored; or the storage unit combines the certification result of the second level certification with all
  • the user equipment context binding storage (the authentication result of the secondary authentication is stored in a binding storage of the user equipment context, which may indicate that the authentication result of the secondary authentication and the validity period of the user equipment context are the same or have a corresponding relationship ) Or independent storage.
  • the validity period of the secondary authentication is equal to or not equal to (greater than or less than) the validity period of the user equipment context.
  • the validity period of the secondary certification is equal to or not equal to (greater than or less than) the validity period of the primary certification.
  • the assisting unit 1010 assisting in the secondary authentication between the data network and the user equipment includes: assisting the data if it is determined that the initiation condition of the secondary authentication of the user equipment is satisfied Perform secondary authentication between the network and the user equipment.
  • the secondary authentication request of the user equipment may be rejected or it may be directly determined that the secondary authentication between the data network and the user equipment is not satisfied. success.
  • the obtaining unit 1020 is further configured to obtain the incidental information of the secondary authentication from the data network.
  • the storage unit is further configured to store the acquired incidental information of the secondary authentication in the core network, and the incidental information can be used to determine the initiation condition of the next secondary authentication of the user equipment or other user equipment.
  • the network function entity in the core network further includes a notification unit 1040, configured to send the obtained authentication result of the secondary authentication and the restriction of the secondary authentication to the user equipment condition.
  • the user equipment may receive and store the authentication result of the secondary authentication and the restriction conditions of the secondary authentication.
  • the network function entity in the core network further includes an update unit 1050, configured to, when receiving an update request from the data network for requesting to update the secondary authentication restriction conditions, according to The update request updates the restriction conditions of the secondary authentication stored in the core network.
  • the notification unit 1040 may be further configured to send the update request to the user equipment when the network function entity receives an update request from the data network for requesting to update the secondary authentication restriction condition. After receiving the update request, the user equipment may update the restriction conditions of the secondary authentication stored in the user equipment according to the update request.
  • the network function entity 1000 can cooperate with each module to perform part or all of the steps of each method executed by the AMF in the foregoing method embodiment.
  • an embodiment of the present application further provides a communication device 1100, which includes a coupled processor 1110 and a memory 1120; wherein the processor is used to call a program stored in the memory to complete the embodiment of the present application Part or all of the steps of any method executed by any device provided.
  • the communication device 1100 is the UE.
  • the communication device 1100 is the AMF.
  • the communication device 1100 is the authentication server in the data network. And so on.
  • the processor 1110 is used to call a computer program stored in the memory 1120 to complete part or all of the steps of any method executed by a UE, AMF, or AAA-S in the embodiment of the present application.
  • the processor 1110 is also called a central processing unit (CPU, Central Processing Unit).
  • the components of the communication device are coupled together, for example, through a bus system.
  • the bus system may include a power bus, a control bus, and a status signal bus in addition to a data bus.
  • various buses are marked as the bus system 1130 in the figure.
  • the method disclosed in the foregoing embodiment of the present application may be applied to the processor 1110 or implemented by the processor 1110.
  • the processor 1110 may be an integrated circuit chip with signal processing capabilities. In some implementation processes, part or all of the steps of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1110 or instructions in the form of software.
  • the processor 1110 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, an off-the-shelf programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component.
  • the processor 1110 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor 1110 may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed and completed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory or registers.
  • the storage medium is located in the memory 1120.
  • the processor 1110 can read information in the memory 1120 and complete some or all of the steps of the foregoing method in combination with its hardware.
  • an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and the computer program is executed by related hardware to perform any of the methods provided in the embodiments of the present invention .
  • embodiments of the present application also provide a computer program product, which when the computer program product runs on a computer, causes the computer to execute any method provided in the embodiments of the present invention.
  • the disclosed device may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the above-mentioned units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the aforementioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-accessible storage medium.
  • the technical solution of this application essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, where the computer software product is stored in a
  • the computer-readable storage medium includes a number of instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc., specifically a processor in a computer device) to execute all of the above methods of the various embodiments of the present application Or part of the steps.
  • the aforementioned storage media may include: U disk, mobile hard disk, magnetic disk, optical disk, read-only memory (ROM) or random access memory (random access memory, RAM) and other various programs that can store programs The medium of the code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例提供通信方法和相关产品。一种通信方法，可包括：在核心网与用户设备之间的一级认证成功之后，若数据网络与所述用户设备之间还需进行二级认证，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证；所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件；所述网络功能实体将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网。上述举例方案中，通过引入二级认证的限制条件，使得二级认证的认证结果被合理的限制性使用变得有可能，为二级认证的认证结果的有效管理奠定基础，进而有利于提高基于二级认证的业务运行的安全性和有效性。

Description

通信方法和相关设备 技术领域
本申请涉及通信领域，具体涉及了通信方法、用户设备、核心网设备、数据网设备和计算机可读介质等。
背景技术
第三代合作伙伴项目(3GPP,3rd Generation Partnership Project)在例如5G(第五代)网络中提出了网络切片的概念。网络切片简单理解就是将运营商的物理网络切割成多个虚拟的端到端的网络，每个虚拟网络之间，包括网络内的设备、接入、传输和核心网，是逻辑独立的，任何一个虚拟网络发生故障都不会影响到其它虚拟网络。目前，多种多样的场景对3GPP生态系统提出了不同的需求，如计费、策略、安全、移动性等需求。3GPP强调网络切片之间不相互影响，例如突发的大量抄表业务不应该影响正常的移动宽带业务。为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同类型业务的实例可以部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。
5G网络中的切片是一个虚拟的专用网络，它是由一组网络功能、子网络所构成。运营商网络中可以部署很多网络切片，每个切片可以有不同的性能来满足不同应用、不同垂直行业的需求。运营商可以根据不同垂直行业客户的需求“量身定做”一个切片。运营商也可允许一些行业客户享有较大自主权，例如可以参与切片的部分管理、控制功能。切片级认证就是可以由行业客户参与的一种网络控制功能，即对终端用户(User)接入切片进行认证和授权。通常来说，用户终端(或称为用户设备或终端等等)接入核心网的认证称为一级认证(Primary Authentication)；此外，切片级认证(简称“切片认证”)也被称为“二级认证”，二级认证是数据网络和终端用户之间的认证。
传统技术暂时缺乏二级认证的认证结果的有效管理，导致基于二级认证的业务运行的安全性和有效性存在缺陷。
发明内容
本申请实施例提供通信方法和相关设备。
本申请实施例第一方面提供一种通信方法，可包括：在核心网与用户设备之间的一级认证成功之后，若数据网络与所述用户设备之间还需进行二级认证，所述核心网中的网络功能实体(例如接入与移动性管理功能(AMF,Access and Mobility Management Function)等等)协助所述数据网络与所述用户设备之间进行二级认证；所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件；所述网络功能实体将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网(例如可存储到所述核心网中的AMF或UDM等)。
其中，本申请实施例中提到的二级认证，本质上是数据网络与使用用户设备的用户之间的认证，而用户设备在一定程度上可代表使用这个用户设备的用户，因此也可称“数据 网络与用户设备之间的二级认证”，当然在有些情况下也可称“数据网络与使用用户设备的用户之间的二级认证”或“数据网络与用户之间的二级认证”。其中，在本申请实施例描述中，这几种说法含义相同，可以混用，类似的“对用户设备的二级认证”和“对用户的二级认证”可以混用，依此类推。
此外，本申请实施例中提到的用户终端、用户设备、终端和终端设备含义相同，可以混用。
可以看出，上述举例方案中，通过引入二级认证的限制条件，使得二级认证的认证结果被合理的限制性使用变得有可能，为二级认证的认证结果的有效管理奠定基础，进而有利于提高基于二级认证的业务运行的安全性和有效性。
在一些可能实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，所述二级认证的认证结果与所述一级认证的认证结果绑定存储(所述二级认证的认证结果与所述一级认证的认证结果绑定存储，可表示所述二级认证的认证结果与所述一级认证的认证结果的有效期限相同或具有对应关系)或独立存储；或所述二级认证的认证结果与所述用户设备上下文绑定存储(所述二级认证的认证结果与所述用户设备上下文绑定存储，可表示所述二级认证的认证结果与所述用户设备上下文的有效期限相同或具有对应关系)或独立存储，或所述二级认证的有效期限等于或不等于(大于或小于)所述用户设备上下文的有效期限，或所述二级认证的有效期限等于或不等于(大于或小于)所述一级认证的有效期限。
在一些可能的实施方式中，核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证包括：在确定所述用户设备二级认证的发起条件满足的情况下，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证。在确定所述用户设备二级认证的发起条件不满足的情况下，所述核心网拒绝所述用户设备的二级认证请求或直接判定所述数据网络与所述用户设备之间的二级认证不成功。
在一些可能的实施方式中，所述方法还可包括：所述网络功能实体从所述数据网络获取所述二级认证的附带信息,所述网络功能实体将获取的所述二级认证的附带信息存储到所述核心网，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
举例来说，二级认证的发起条件可能通过之前已存储的已经进行的某次或某几次针对当前UE或其他UE的二级认证的附带信息来确定，例如，当运营商网络针对其他UE进行二级认证时(针对S-NSSAI的二级认证)，二级认证的发起条件用于辅助AMF判断是否继续二级认证流程或直接判定二级认证失败。类似地，如果二级认证失败，则认证失败原因可提供给核心网，认证失败原因可以作为这次二级认证的附带信息，用于AMF下一次对这个用户或其他用户是否满足二级认证(针对S-NSSAI)条件进行辅助判断。例如AAA-S成功完成对用户的认证授权，但DN网络容量或所能支持的用户数达到上限，AAA-S可通知运营商网络，DN暂时已运行在“满载模式”，暂时不接受更多二级认证。此时AAA-S也可发送一个计时器，这个计时器用于限定“暂时”的具体时长。AMF收到计时器后存储于核心网(如AMF、UDM)，在下 一次其他UE申请二级认证时，可以直接拒绝二级认证申请，避免运营商核心网与DN之间不必要的信令交互。
在一些可能的实施方式中，所述方法还包括：所述网络功能实体向所述用户设备发送获取到的所述二级认证的认证结果和所述二级认证的限制条件。所述用户设备可接收和存储存储所述二级认证的认证结果和所述二级认证的限制条件。
在一些可能的实施方式中，所述方法还包括：当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，根据所述更新请求更新所述核心网存储的所述二级认证的限制条件。进一步的，当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，所述网络功能实体还可以向用户设备发送所述更新请求，所述用户设备在接收到所述更新请求之后，根据所述更新请求更新所述用户设备存储的所述二级认证的限制条件。
本申请实施例第二方面提供一种核心网中的网络功能实体，可包括：协助单元，用于在核心网与用户设备之间的一级认证成功之后，若所述数据网络与所述用户设备之间还需进行二级认证，协助数据网络与所述用户设备之间进行二级认证。
获取单元，用于所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件。
存储单元，用于将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网(例如可存储到所述核心网中的AMF或UDM等)。
可以看出，上述举例方案中，通过引入二级认证的限制条件，使得二级认证的认证结果被合理的限制性使用变得有可能，为二级认证的认证结果的有效管理奠定基础，进而有利于提高基于二级认证的业务运行的安全性和有效性。
在一些可能的实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，存储单元将所述二级认证的认证结果与所述一级认证的认证结果绑定存储(所述二级认证的认证结果与所述一级认证的认证结果绑定存储，可表示所述二级认证的认证结果与所述一级认证的认证结果的有效期限相同或具有对应关系)或独立存储；或存储单元将所述二级认证的认证结果与所述用户设备上下文绑定存储(所述二级认证的认证结果与所述用户设备上下文绑定存储，可表示所述二级认证的认证结果与所述用户设备上下文的有效期限相同或具有对应关系)或独立存储。或所述二级认证的有效期限等于或不等于(大于或小于)所述用户设备上下文的有效期限。或所述二级认证的有效期限等于或不等于(大于或小于)所述一级认证的有效期限。
在一些可能的实施方式中，协助单元协助所述数据网络与所述用户设备之间进行二级认证包括：在确定所述用户设备二级认证的发起条件满足的情况下，协助所述数据网络与所述用户设备之间进行二级认证。此外，在确定所述用户设备二级认证的发起条件不满足的情况下，可拒绝所述用户设备的二级认证请求或直接判定所述数据网络与所述用户设备之间的二级认证不成功。
在一些可能的实施方式中，所述获取单元还用于：从所述数据网络获取所述二级认证的附带信息。
所述存储单元还用于将获取的所述二级认证的附带信息存储到所述核心网，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
在一些可能的实施方式中，所述核心网中的网络功能实体还包括通知单元，用于向所述用户设备发送获取到的所述二级认证的认证结果和所述二级认证的限制条件。所述用户设备可接收和存储存储所述二级认证的认证结果和所述二级认证的限制条件。
在一些可能的实施方式中，所述核心网中的网络功能实体还包括更新单元，用于当接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，根据所述更新请求更新所述核心网存储的所述二级认证的限制条件。
进一步的，所述通知单元还可用于，当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，向用户设备发送所述更新请求。所述用户设备在接收到所述更新请求之后，可根据所述更新请求更新所述用户设备存储的所述二级认证的限制条件。
本申请实施例第三方面提供另一种通信方法，包括：数据网络中的认证服务器在核心网的协助下与用户设备之间进行二级认证；向所述核心网发送所述二级认证的认证结果和所述二级认证的限制条件，所述二级认证的认证结果和所述二级认证的限制条件能够被所述核心网存储。
在一些可能的实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，所述方法还可包括：所述认证服务器向所述核心网发送所述二级认证的附带信息,所述附带信息能够被所述核心网存储，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
在一些可能的实施方式中，所述方法还包括：所述认证服务器向所述核心网发送用于请求更新所述二级认证限制条件的更新请求，所述更新请求用于触发所述核心网将存储的所述二级认证的限制条件进行更新。
本申请实施例第四方面提供另一种数据网络中的认证服务器，包括：
二级认证单元，用于在核心网(如AMF)的协助下与用户设备之间进行二级认证；
交互单元，用于向所述核心网(如AMF)发送所述二级认证的认证结果和所述二级认证的限制条件，其中，所述二级认证的认证结果和所述二级认证的限制条件能够被所述核心网存储。
在一些可能的实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，所述交互单元还用于：向所述核心网发送所述二级认证的附带信息。所述附带信息能够被所述核心网存储，所述附带信息能够用于确定所述用户设 备或其他用户设备下一次二级认证的发起条件。
在一些可能的实施方式中，所述交互单元还用于：向所述核心网发送用于请求更新所述二级认证限制条件的更新请求，所述更新请求用于触发所述核心网将存储的所述二级认证的限制条件进行更新。
本申请实施例第五方面提供一种通信方法，包括：在核心网与用户设备之间的一级认证成功之后，如果所述用户设备与数据网络之间还需要进行二级认证，所述用户设备在所述核心网的协助之下与所述数据网络之间进行二级认证。所述用户设备接收所述核心网发送的所述二级认证的认证结果和所述二级认证的限制条件。所述用户设备将接收到的所述二级认证的认证结果和所述二级认证的限制条件进行存储。
在一些可能实施方式中，在所述二级认证的认证结果为认证失败，且所述二级认证的限制条件为认证结果的有效期限的情况下，所述方法还包括：所述用户设备在确定所述认证结果的有效期限结束之后，再次发起与所述数据网络之间的二级认证；所述用户设备在确定所述认证结果的有效期限结束之前，暂停发起与所述数据网络之间的二级认证。
本申请实施例第六方面提供一种用户设备，包括：
认证单元，用于在核心网与用户设备之间的一级认证成功之后，如果所述用户设备与数据网络之间还需要进行二级认证，在所述核心网的协助之下与所述数据网络之间进行二级认证。
交互单元，用于接收所述核心网发送的所述二级认证的认证结果和所述二级认证的限制条件。
存储单元，用于将接收到的所述二级认证的认证结果和所述二级认证的限制条件进行存储。
在一些可能实施方式之中，所述认证单元还用于，在所述二级认证的认证结果为认证失败，且所述二级认证的限制条件为认证结果的有效期限的情况下，在确定所述认证结果的有效期限结束之后，再次发起与所述数据网络之间的二级认证；在确定所述认证结果的有效期限结束之前，暂停发起与所述数据网络之间的二级认证。
在一些可能实施方式中，所述交互单元还用于：接收所述核心网发送的所述二级认证的附带信息；在确定所述用户设备二级认证的发起条件满足的情况下，再次发起与所述数据网络之间的二级认证；在确定所述用户设备二级认证的发起条件不满足的情况下，暂停发起与所述数据网络之间的二级认证。所述附带信息用于确定所述用户设备下一次二级认证的发起条件。
本申请实施例第七方面提供一种通信装置，其特征在于，所述通信装置包括耦合的处理器和存储器；其中，所处理器用于调用所述存储器中存储的计算机程序，以完成本申请实施例提供的任意一种方法的部分或全部步骤。
其中，通信装置例如可以是用户设备、数据网络中的认证服务器或核心网中的网络功 能实体(如AMF等)。
本申请实施例第八方面提供一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时能够完成本申请实施例提供的任意一种方法的部分或全部步骤。
第九方面，本申请实施例还提供一种指令的计算机程序产品，当所述计算机程序产品在计算机设备上运行时，使得所述计算机设备执行本申请实施例提供的任意一个设备执行的任意一种方法的部分或全部步骤。
附图说明
图1是本申请实施例提供的一种网络架构的示意图。
图2-A是本申请实施例提供的一种二级认证的示意图。
图2-B是本申请实施例提供的一种认证流程的示意图。
图3是本申请实施例提供的一种二级认证的流程示意图。
图4是本申请实施例提供的一种通信方法的流程示意图。
图5是本申请实施例提供的一种通信方法的流程示意图。
图6是本申请实施例提供的另一种通信方法的流程示意图。
图7是本申请实施例提供的另一种通信方法的流程示意图。
图8是本申请实施例提供的一种用户设备的结构示意图。
图9是本申请实施例提供的一种认证服务器的结构示意图。
图10是本申请实施例提供的一种核心网的网络功能实体的结构示意图。
图11是本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
本申请的说明书和权利要求书及上述附图中的术语“包括”和“具有”以及它们任何变形，意图在覆盖不排他的包括。例如包括一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或者可选地还包括对于这些过程、方法、产品或设备固有的其他步骤或单元。此外，本申请的说明书和权利要求书及上述附图中术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。
下面先介绍一下相关网络架构。
参见图1，图1是本申请实施例举例的一种5G网络架构示意图。5G网络对4G网络的某些网络功能实体(例如移动性管理实体(MME，Mobility Management Entity)等等)进行了一定拆分，并定义了基于服务化架构的架构。在图1所示网络架构中，类似于4G网络中的MME的功能被拆成接入与移动性管理功能(AMF,Access and Mobility Management Function)和会话管理功能(SMF,Session Management Function)等等。
下面对其他一些相关网络功能/实体进行介绍。
用户终端(或称为用户设备(UE,User Equipment)或终端设备或终端等)通过接入运营商网络来访问数据网络(DN,Data Network)等等，进而使用DN上的由运营商或第三方提供的业务。
接入与移动性管理功能(AMF)是3GPP网络中的一种控制面网络功能，主要负责UE接入运营商网络的接入控制和移动性管理。其中，安全锚点功能(SEAF,Security Anchor Function)可以部署于AMF之中，或SEAF也可能部署于不同于AMF的另一设备中，图1中以SEAF被部署于AMF为例。
会话管理功能(SMF)是3GPP网络中的一种控制面网络功能，其中，SMF主要负责管理UE的数据包(PDU,Packet Data Unit)会话。PDU会话是一个用于传输PDU的通道，UE可以通过PDU会话与DN互相发送PDU。SMF负责PDU会话的建立、维护和删除等管理工作。
数据网络(DN,Data Network)也称为分组数据网络(PDN,Packet Data Network)，通常是位于3GPP网络之外的网络。3GPP网络可接入多个DN，DN上可部署运营商或第三方提供的多种业务。例如，某个DN是一个智能工厂的私有网络，安装在智能工厂车间的传感器扮演UE的角色，DN中部署了传感器的控制服务器。UE与控制服务器通信，UE在获取控制服务器的指令之后，可根据这个指令将采集的数据传递给控制服务器。又例如，DN是一个公司的内部办公网络，该公司员工所使用的终端则可扮演UE的角色，这个UE可访问公司内部的信息和其他资源。
其中，统一数据管理网络功能(UDM,Unified Data Management)是3GPP网络中的一种控制面网络功能，UDM主要负责存储3GPP网络中签约用户的签约数据、信任状(credential)和持久身份标识(SUPI,Subscriber Permanent Identifier)等。这些数据可以被用于UE接入运营商3GPP网络的认证和授权。
认证服务器功能(AUSF,Authentication Server Function)也是3GPP网络中的一种控制面网络功能，AUSF主要用于一级认证(即3GPP网络与签约用户的终端之间的认证)。
其中，网络开放功能(NEF,Network Exposure Function)也是3GPP网络中的一种控制面网络功能。NEF主要负责以安全的方式对第三方开放3GPP网络的对外接口。在SMF等网络功能需要与第三方网络功能通信时，可以以NEF为通信的中继。
其中，网络存储功能(NRF,Network Repository Function)也是3GPP网络中的一种控制面网络功能，主要负责存储可被访问的网络功能(NF)的配置服务资料(profile)，为其他网络功能提供网络功能的发现服务。
用户面功能(UPF,User Plane Function)是3GPP网络与DN通信的网关。
策略控制功能(PCF,Policy Control Function)是3GPP网络中的一种控制面功能，用于向SMF提供PDU会话的策略。策略可包括计费、服务质量(QoS,Quality of Service)、授权相关策略等。
接入网(AN,Access Network)是3GPP网络的一个子网络，UE要接入3GPP网络，首先需要经过AN。在无线接入场景下AN也称无线接入网(RAN,Radio Access Network),因此RAN和AN这两个术语经常不做区分的混用。
3GPP网络是指符合3GPP标准的网络。其中，图1中除了UE和DN以外的部分可看作是3GPP网络。3GPP网络不只局限于3GPP定义的5G网络，还可包括2G、3G、4G网络。通常3GPP网络由运营商来运营。此外，在图1所示架构中的N1、N2、N3、N4、N6等分别代表相关网络功能之间的参照点(Reference Point)。其中，Nausf、Namf...等分别代表相关网络功能的服务化接口。
本申请实施例中的移动性管理网络功能可以是图1所示的AMF，也可以是未来通信系统中的具有上述AMF功能的其他网络功能。或者，本申请中的移动性管理网络功能还可以是长期演进(LTE,long term evolution)中的MME。
为方便说明，本申请实施例主要以移动性管理网络功能为AMF为例进行说明。并且用户终端、用户设备、终端设备或终端可统称为UE。即若无特别说明，本申请实施例后文所描述的AMF均可替换为移动性管理网络功能，UE均可替换为用户终端、用户设备、终端设备或终端。
图1中示出的网络架构(例如5G网络架构)采用基于服务的架构和通用接口，传统网元功能基于网络功能虚拟化(NFV,network function Virtualization)技术,拆分成了若干个自包含、自管理、可重用的网络功能服务模块，通过灵活定义服务模块集合，可以实现定制化的网络功能重构，对外通过统一的服务调用接口组成业务流程。图1中示出的网络架构示意图可以理解为一种非漫游场景下基于服务的5G网络架构示意图。在该架构中，根据特定场景需求，将不同网络功能按需有序组合，可实现网络的能力与服务的定制化，从而为不同业务部署专用网络，实现5G网络切片(network slicing)。网络切片技术可以使运营商能够更加灵活、快速地响应客户需求，支持网络资源的灵活分配。
网络切片,简单理解就是将运营商的物理网络切割成多个虚拟的端到端的网络，每个虚拟网络之间，包括网络内的设备、接入、传输和核心网，是逻辑独立的，任何一个虚拟网络发生故障都不会影响到其它虚拟网络。
目前，多种多样的场景对第三代合作伙伴计划(3GPP)生态系统提出了不同需求，例如如计费、策略、安全、移动性等需求。3GPP强调了网络切片之间不相互影响，例如突发的大量的抄表业务不应该影响正常的移动宽带业务。其中，为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同类型业务的实例可以部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。
5G网络中的切片是一个虚拟的专用网络，它由一组网络功能、子网络所构成。比如图1中的子网络RAN 140、AMF网络功能137、SMF网络功能138、UPF网络功能139等可以组成一个切片。图1中的每种网络功能只示意性地画出了一个，而在实际网络部署中，每种网络功能或子网络可以有多个(例如数个、数十个或数百个，甚至更多个)。运营商网络中可以部署很多网络切片，每个切片可以有不同的性能来满足不同应用、不同垂直行业的需求。运营商可以根据不同垂直行业客户的需求来“量身定做”一个切片。此外，运营商也可以允许一些行业客户享有较大的自主权，参与切片的部分管理、控制功能。其中，切片级的认证就是由行业客户参与的一种网络控制功能，即对用户设备接入切片进行认证和授权，本申请实施例可简称为“切片认证”。
以图1为例，当核心网CN部署了网络切片，如果UE 110需接入到某个网络切片时，那么UE 110可以向核心网提供请求的网络切片。举例来说，UE 110所请求的网络切片，例如可以用请求的网络切片集合来表示，或者，请求的网络切片也可以用请求的网络切片选择辅助信息(requested NSSAI,requested network slice selection assistance information)来表示。网络切片集合包括一个或多个网络切片。Requested NSSAI是由一个或多个单网络切片选择辅助信息(S-NSSAI,single network slice selection assistance information)来表示构成，每个S-NSSAI用于标识一个网络切片类型，也可以理解为S-NSSAI用于标识网络切片，或者可以理解为S-NSSAI是网络切片的标识信息。
为方便理解，在后文的描述中，本申请实施例对“网络切片”或“S-NSSAI”不做严格区分，二者可以互换使用。本申请实施例中的“网络切片”也可称为“切片”或“网络切片实例”，三者具有相同的含义，在此统一说明，后文不再赘述。
UE 110向网络发送注册请求后，核心网网络功能(如AMF网络功能137或NSSF网络功能)根据UE 110的签约数据、UE 110的requested NSSAI、漫游协议以及本地配置等等信息综合判断，进而为UE 110选择允许接入的网络切片集合。其中，允许接入的网络切片集合可以用允许的(allowed)NSSAI来表示，allowed NSSAI包含的S-NSSAI为当前运营商网络允许接入的S-NSSAI。
UE 110在被允许接入网络或网络切片之前，将与网络和/或网络切片进行双向认证并得到网络和/或网络切片的授权。目前，在5G标准中，网络对UE 110的认证与授权都是由运营商网络直接进行，这类认证授权方法被称为一级认证(primary authentication)。
随着垂直行业和物联网的发展，可以预见，运营商网络之外的数据网络DN 120(如服务于垂直行业的DN)，对于接入到该DN 120的UE 110同样有认证与授权的需求。比如某商业公司提供了游戏平台，通过运营商网络，为游戏玩家提供游戏服务。一方面，由于玩家使用的UE 110是通过运营商网络接入游戏平台，运营商网络需对UE 110进行认证和授权，即一级认证。游戏玩家是商业公司的客户，该商业公司也需对游戏玩家进行认证和授权，这种认证如果是基于网络切片的，或者说认证是以切片为单位的，那么，这个认证可被称为切片认证(slice authentication)或称为基于切片的认证(slice-specific authentication)或称为二级认证。
需要说明的是，本申请实施例中也可以将二级认证称为针对切片的二级认证，或切片认证，或针对用户(使用UE 110的用户)的身份认证，其具有的含义例如是：UE 110(或使用该UE 110的用户)与第三方网络之间执行的二级认证，其认证结果，将会决定运营商网络是否授权UE接入相应切片。还应理解，本申请实施例中应用于二级认证的方法也同样适用于基于会话的二次认证(secondary authentication)或基于切片的二次认证等场景，在此不再详述。
其中，本申请实施例中提到的二级认证，本质上是数据网络与使用用户设备的用户之间的认证，由于用户设备在一定程度上可代表用户，因此也可称“数据网络与用户设备之间的二级认证”，当然，在有些情况下也可称“数据网络与使用用户设备的用户之间的二级认证”。在本申请实施例中，这两种说法含义相同，可以混用，类似的“对用户设备的二级认证”和“对用户的二级认证”可以混用，依此类推。
图2-A举例示出的一级认证和切片认证的方式。
具体的，图2-A示出了UE与网络的认证流程。UE与网络的认证流程包括一级认证流程和二级认证流程，其中一级认证流程为UE与运营商网络之间的认证过程，二级认证流程为UE或使用这个UE的某个用户(user)与第三方网络之间的认证过程。
在本申请实施例中，描述“UE与第三方网络之间的二级认证过程”可以理解为是使用该UE的某个用户与第三方网络之间的二级认证过程。如图2-A所示，示例性的，一级认证流程为UE 210与核心网CN 230之间的认证过程，二级认证流程为使用UE 210的用户与数据网络DN 220之间的认证过程，该一级认证流程和二级认证流程均可以理解为是UE 110的注册流程的一部分。为方便理解和描述，本申请实施例中以DN 220中的认证设备为认证、授权和计费(AAA,authentication、authorization、accounting)服务器为例进行说明，AAA服务器可表示为AAA-S(AAA server)，AAA代理功能(AAA-F,AAA-proxy function)238可以位于核心网CN 230中，转发核心网发送给AAA-S的消息。AAA-F为可选实现，本申请实施例不做限制。进一步需要说明的是，AAA-S通常部署在3GPP网络之外的DN侧，但DN220或AAA-S221也可以部署在3GPP网络内部，本申请实施例不做限制。
参考图2-B，UE 210注册流程的主要步骤可以如下：
201.UE向网络发送用于请求接入网络的注册请求，其中，所述注册请求携带有UE的身份信息。示例性的，UE 210可向核心网CN 230中的AMF网络功能实体237发送携带UE 210的身份信息的接入请求，身份信息具体例如加密的身份信息SUCI或者临时身份信息例如全球唯一临时身份标识(GUTI,globally unique temporary identifier)。
网络根据UE发送的注册请求中携带的UE的身份信息，判断是否发起网络与UE之间进行一级认证。示例性的，AMF网络功能实体237可将从UE 210接收的加密的身份信息SUCI转发给UDM网络功能实体234，由UDM网络功能实体234对SUCI进行解密，从而还原出UE 210的真实身份信息SUPI，然后，再将SUPI返回给AMF网络功能实体237。AMF网络功能实体237根据UE 210的真实身份SUPI发起网络与UE 210之间的一级认证流程。
在UE与网络之间的一级认证成功后，网络可授权UE允许其接入运营商网络。具体示例性的，一级认证成功后，AMF网络功能实体237授权UE 210可接入运营商网络。
经步骤201后，UE与网络之间的一级认证过程可认为已完成。另一方面，如果步骤201中UE发送的是临时身份信息GUTI，那么在步骤201中，AMF检查网络侧的GUTI有效性，如果有效则表明以前的一级认证仍然有效，不必进行一级认证。
202.网络判断UE是否还需要进行进一步的二级认证。示例性的，AMF网络功能实体237根据AMF网络功能实体237本地或UDM网络功能实体234的信息，判断UE 210申请接入的切片是否还需要进行进一步地切片认证(即二级认证)。
203.如果UE需要进行二级认证，那么例如网络可以触发UE与数据网络DN之间的二级认证流程。示例性的，在UE 210需要进行二级认证时，AMF网络功能实体237触发UE 210与DN 220之间的二级认证流程。
本申请实施例以二级认证为切片认证为例，这个切片认证流程可以是基于标准组织-国际互联网工程任务组(IETF,internet engineering task force)制定的可扩展的身份验 证协议(EAP,extensible authentication protocol)标准作为基本认证机制。所述EAP机制具有很大的灵活性，可支持数十种具体的EAP认证方法。
应理解，本申请实施例中提到的UE需要进行二级认证，可以理解为使用该UE的某个用户需要进行二级认证，以二级认证为切片认证为例，UE 210需进行二级认证可理解为使用UE 210的某个用户需要进行二级认证。
203.UE 210与数据网络之间通过多轮信令交互而完成二级认证，并由数据网络将二级认证结果通知运营商网络。运营商网络根据二级认证结果继续执行其他流程，如继续执行剩余的注册流程、终止注册流程或其他相关流程，这里不一一列出。
示例性的，以二级认证为切片认证为例，使用UE 210的某个用户与DN 220之间进行二级认证时需经过多轮信令交互完成切片认证，其中，DN 220可获取UE 110与DN 220之间签约的用户身份信息，即上述使用UE 210的某个用户的身份信息，为方便描述，本申请实施例中将该用户身份信息称为DN用户身份标识(DUI,DN user identity)，在一些实施例中也可以将该用户身份信息称为用户ID。用于二级认证的用户ID是终端设备与除运营商网络之外的外部网络的签约信息，运营商网络不一定会有该信息。
以图2-A中所示为例，UE 210将DUI发送给核心网CN 230中的AMF 237，AMF 237可以将DUI转发给DN 220中的认证设备(例如图中示出的AAA-S 221)，二级认证成功后,DN 220中的认证设备将二级认证结果通知AMF 237。需要说明的是，在一些实施例之中，DUI是放入消息容器(container)中发送给AMF，并由AMF直接把该容器转发给DN，即所谓“透传”。在这种情况，AMF不解析容器中的DUI，即AMF不知道用户的DUI。另外，在一些实施例中，可以通过AAA-F 238将DUI从AMF网络功能实体237转发至DN 220中的认证设备。至此，UE 210与网络之间的一级认证流程和二级认证流程完成，运营商网络还可以继续进行UE 210的其他注册流程。
上文提到UE数据网络之间的二级认证过程可以基于EAP认证机制，其中EAP认证机制可以支持数十种具体的EAP认证方法。不同的UE针对同一数据网络，可支持的EAP认证方法可以不同，也可以相同；同一UE针对不同的数据网络来说，其可支持的EAP认证方法可以不同或者相同。不同的数据网络可支持的EAP认证方法可以不同，也可以相同。
针对一个UE，其可支持的EAP认证方法可为一个或多个；对于一种数据网络来说，其可支持的EAP认证方法可以为一个或多个。UE与数据网络之间进行二级认证时，将采用UE和数据网络均支持的EAP认证方法。应理解，本申请实施例中，数据网络支持的EAP认证方法也可以理解为是数据网络中的认证设备所支持的EAP认证方法，两种表述含义相同，本申请实施例不做严格区分。
为了更详细地了解二级认证(如切片认证)的过程，下面通过二级认证前后的信令交互流程的示意图，对上述203作进一步阐述。图3示意性地示出了UE与数据网络中AAA-S之间的二级认证流程的部分过程，应理解，UE与数据网络(包括AAA-S)之间的二级认证流程还包括网络与AAA-S之间建立连接以及EAP认证流程细节等其他步骤，这里为了简化描述，不作详细举例。
参见图3，图3举例示出了一种二级认证的部分流程。
301.当AMF判断出UE需要进行二级认证并发起二级认证，AMF向UE发送可用于发起二级认证的NAS消息，此时UE已经同核心网完成一级认证，因此AMF向UE发送的这个NAS消息是经过加密和完整性保护的。这个NAS消息包括了EAP ID Request的信息，向UE请求二级认证需使用的用户ID(步骤206中提到的DUI)。
302.UE向AMF回复NAS响应消息，回复的NAS响应消息携带EAP ID Response信息，用来发送步骤301请求的用户ID信息(DUI)。
需要说明的是步骤301和步骤302是可选步骤，因为不是所有EAP认证流程都需要通过使用DUI或者是需要通过EAP流程来发送DUI。进一步需要说明的是，除了EAP信息，NAS消息还可以包括其他相关信息，如S-NSSAI等，这里不作限定。
303.AMF向AAA-S发送EAP认证请求，其中，EAP认证请求携带DUI信息(如果执行了步骤301和步骤302)。可选的，EAP认证请求经过AUSF和/或AAA-P等网络功能的转发。需要说明的是，这里不限定消息是否经过这些网络功能转发或者转发该信息所承载的消息以及消息类型等。可选的，AMF发送给AAA-S的消息还可以包括其他相关信息，如GPSI等，这里不作限定。
304.AAA-S向AMF发送EAP认证响应。类似步骤303，可选的，经过AUSF和/或AAA-P等网络功能的转发。类似地，这里不限定转发该信息所承载的消息以及消息类型，以及发送的其他相关信息，如GPSI等。
305.UE继续向AMF发送EAP认证所需信息。类似步骤303，这些信息由加密和完整性保护后的NAS消息所承载。这个NAS消息还可以携带其他相关信息。
306.AMF向AAA-S发送EAP认证所需信息。类似步骤304，不限定转发网络功能、承载消息以及其他相关信息等。
需要说明的是，类似步骤305-306的信息交互可进行多次，交互次数取决于所使用的EAP方法以及是否需要重发等因素，这里不作限定。
307.根据前述信息交互，AAA-S可获得/判断EAP认证的结果，即认证成功或失败。AAA-S将认证结果发送给AMF，完成二级认证中的EAP认证流程。发送方式类似于步骤304，这里不再赘述。
在上述举例的二级认证方式中，当二级认证成功以后，对二级认证成功的使用条件没有作明确限定。比如，没有限定二级认证成功的有效期限。这会为网络安全或/和网络运行的效率构成潜在隐患。具体例如，
一方面，二级认证的结果不做有效期限限定，网络可以认定二级认证的结果为“永久有效”的。例如，只有在用户ID(DUI)或终端ID(SUPI)分别被DN(AAA-S)或运营商网络吊销之后，二级认证成功的结果才会变为无效。
另一方面，若将二级认证的结果作为终端的安全上下文存储于网络(如AMF)，意味着二级认证的结果与一级认证的结果进行了绑定。当一级认证失效或UE上下文失效时，切片认证的结果随即失效。
再一方面，如果将二级认证的结果作为终端的上下文存储于网络(如AMF)，意味着二级认证的结果与终端在网络的注册状态绑定。只要终端的上下文存在，切片认证的结果就会 长时间有效，而且，这种情况下，也无法表明不同S-NSSAI有可能具有不同二级认证有效期的情况。
另外，二级认证结果没有其他限制条件。例如如：没有限制“允许接入”的等级(类似商业服务或游戏中的“白金”、“金”、“银”等授权等级)。又例如没有具体限制“允许接入”是否在不同模式下均有效，具体例如，当网络需要过载保护之时，是否会被限制接入等。
对于上述技术问题，可能分别会对网络造成不同的负面影响。具体例如：
因为用户/终端ID的吊销事件属于异常行为的处理事件，在正常情况下，二级认证成功之后，相当于是“永久”授权。这种长期有效的认证授权，可大大增加非授权用户接入切片的安全隐患。比如，如果用户和终端没有绑定关系，攻击者获取用户名信息后，可以使用合法终端不经认证即可接入切片(假设该用户曾经通过了二级认证)。另一方面，如果用户和终端具有绑定关系，攻击者可盗用其他合法终端上的SIM卡(SIM卡挪用、丢失、被盗和克隆等)，先通过一级认证，就可以无需二级认证，直接接入切片，这是由于该终端曾经通过了二级认证且长期有效。如果二级认证是有时效性的，这种风险就会大大降低。而另一方面，没有时间限制的二级认证，使得网络无法有效地提供限时接入的业务。如果采用先认证再吊销的流程来完成限时接入，就会造成吊销流程的滥用，增加网络资源消耗。当用户量增加时，这种网络资源浪费会显著增加。
如果是采用二级认证的结果与一级认证的结果默认绑定的方式，来隐式限制二级认证的时效性，可能带来其他的问题。首先，这可能会造成一级认证安全上下文有效期在设定上的困难：一方面，如果一级认证有效性设定太长，会对一级认证的安全上下文带来较大安全风险。一般的，安全上下文有效期越长，留给潜在攻击者攻击的时间就越长，也即安全性越低。进一步的，如果UE的上下文在AMF保留的时间越长，那么对AMF的存储容量要求也越高。因此，通常UE上下文、UE的安全上下文是运营商根据自身的网络条件、安全综合考虑，而设定合理的有效期。另一方面，如果一级认证有效期设定太短，会造成频繁的切片认证。因为UE会支持多种切片认证，切片认证请求的发送时间点不固定。比如，当切片认证请求发生在临近一级认证或(安全)上下文快失效之时，切片认证的结果就会随之很快的失效，造成重复的不必要的切片认证，尤其是基于EAP机制的切片认证需经过多轮次和长链条(从终端到运营商网络再中转到外部DN)的网络交互，造成网络资源的显著浪费。当网络需要支持：a)单UE多用户场景；b)单用户使用多UE场景时，问题更为严重，无法从资源上有效支持各种应用场景。
若是采用二级认证的结果与UE上下文的有效性隐式地限制二级认证的时效性，其问题取决于该UE上下文的有效时间长短。如果太长，同样会有类似的安全风险或/和对存储资源要求较高。如果太短，又会存在需要频繁进行二级认证的问题。进一步，由于UE支持多种S-NSSAI的二级认证，不同S-NSSAI可以有不同的认证授权有效期，这种方法无法实现差异化的有效期限(UE上下文作为统一的有效期)。
二级认证的结果没有其他限制条件，难以有效提供各种应用服务以及难以有效支持网络的运行、资源分配的优化。
下面探讨如何增加二级认证的限定条件的机制。例如增加二级认证的有效期限、优化针对有效期的流程与存储、增加其他限定条件，如等级、模式等。具体例如，二级认证结果的存储方式，是否与UE安全上下文绑定，是否建立独立的用户级(安全)上下文。认证结果的限制条件例如包括但不限于：有效期限、认证授权等级、认证授权运行模式等。
下面通过一些具体实施例进行进一步举例说明。
参见图4，图4为本申请实施例提供的一种通信方法的流程示意图。
401.核心网与用户设备之间进行一级认证。
402.在核心网与用户设备之间的一级认证成功之后，若数据网络与所述用户设备之间还需进行二级认证，所述核心网中的网络功能实体(例如AMF等等)协助所述数据网络与所述用户设备之间进行二级认证。
其中，本申请实施例中提到的二级认证，本质上是数据网络与使用用户设备的用户之间的认证，而用户设备在一定程度上可代表使用这个用户设备的用户，因此也可称“数据网络与用户设备之间的二级认证”，当然在有些情况下也可称“数据网络与使用用户设备的用户之间的二级认证”或“数据网络与用户之间的二级认证”。其中，在本申请实施例描述中，这几种说法含义相同，可以混用，类似的“对用户设备的二级认证”和“对用户的二级认证”可以混用，依此类推。
此外，本申请实施例中提到的用户终端、用户设备、终端和终端设备含义相同，可以混用。
403.所述数据网络与所述用户设备之间进行二级认证，所述数据网络中的认证服务器向核心网发送所述二级认证的认证结果和所述二级认证的限制条件。
在一些可能实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
404.所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件之后，所述网络功能实体将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网(例如可存储到所述核心网中的AMF或UDM等)。
405.所述网络功能实体向所述用户设备发送获取到的所述二级认证的认证结果和所述二级认证的限制条件。所述用户设备可接收和存储存储所述二级认证的认证结果和所述二级认证的限制条件。
可以看出，上述举例方案中，通过引入二级认证的限制条件，使得二级认证的认证结果被合理的限制性使用变得有可能，为二级认证的认证结果的有效管理奠定基础，进而有利于提高基于二级认证的业务运行的安全性和有效性。
在一些可能的实施方式中，所述二级认证的认证结果与所述一级认证的认证结果绑定存储(所述二级认证的认证结果与所述一级认证的认证结果绑定存储，可表示所述二级认证的认证结果与所述一级认证的认证结果的有效期限相同或具有对应关系)或独立存储；或所述二级认证的认证结果与所述用户设备上下文绑定存储(所述二级认证的认证结果与所述用户设备上下文绑定存储，可表示所述二级认证的认证结果与所述用户设备上下文的有效 期限相同或具有对应关系)或独立存储，或所述二级认证的有效期限等于或不等于(大于或小于)所述用户设备上下文的有效期限，或所述二级认证的有效期限等于或不等于(大于或小于)所述一级认证的有效期限。
在一些可能的实施方式中，核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证包括：在确定所述用户设备二级认证的发起条件满足的情况下，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证。在确定所述用户设备二级认证的发起条件不满足的情况下，所述核心网拒绝所述用户设备的二级认证请求或直接判定所述数据网络与所述用户设备之间的二级认证不成功。
在一些可能的实施方式中，所述方法还可包括：所述网络功能实体从所述数据网络获取所述二级认证的附带信息,所述网络功能实体将获取的所述二级认证的附带信息存储到所述核心网，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
举例来说，二级认证的发起条件可能通过之前已存储的已经进行的某次或某几次针对当前UE或其他UE的二级认证的附带信息来确定，例如，当运营商网络针对其他UE进行二级认证时(针对S-NSSAI的二级认证)，二级认证的发起条件用于辅助AMF判断是否继续二级认证流程或直接判定二级认证失败。类似地，如果二级认证失败，则认证失败原因可提供给核心网，认证失败原因可以作为这次二级认证的附带信息，用于AMF下一次对这个用户或其他用户是否满足二级认证(针对S-NSSAI)条件进行辅助判断。例如AAA-S成功完成对用户的认证授权，但DN网络容量或所能支持的用户数达到上限，AAA-S可通知运营商网络，DN暂时已运行在“满载模式”，暂时不接受更多二级认证。此时AAA-S也可发送一个计时器，这个计时器用于限定“暂时”的具体时长。AMF收到计时器后存储于核心网(如AMF、UDM)，在下一次其他UE申请二级认证时，可以直接拒绝二级认证申请，避免运营商核心网与DN之间不必要的信令交互。
在一些可能实施方式中，在所述二级认证的认证结果为认证失败，且所述二级认证的限制条件为认证结果的有效期限的情况下，所述方法还包括：所述用户设备在确定所述认证结果的有效期限结束之后，再次发起与所述数据网络之间的二级认证；所述用户设备在确定所述认证结果的有效期限结束之前，暂停发起与所述数据网络之间的二级认证。
在一些可能的实施方式中，所述方法还包括：当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，根据所述更新请求更新所述核心网存储的所述二级认证的限制条件。进一步的，当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，所述网络功能实体还可以向用户设备发送所述更新请求，所述用户设备在接收到所述更新请求之后，根据所述更新请求更新所述用户设备存储的所述二级认证的限制条件。
参见图5，图5为本申请实施例提供的一种通信方法的流程示意图。图5举例所示的实施例中，针对二级认证增加了有效期的限制条件。其中，二级认证的限制条件和认证结果在核心网中的存储位置可以是AMF或/和UDM(或者也可以存储在其他网络功能)。
如图5举例所示，一种通信方法可包括：
501.UE和核心网之间进行一级认证，并建立一级认证的安全上下文。
例如一级认证建立了NAS安全，随后UE和网络的NAS信令交互都可以得到加密和完整性保护。
502.AMF判断所述UE(使用该UE的用户)是否需要进行二级认证。
其中，判断的方法可以包括：查询AMF本地存储或查询UDM存储。
查询后判断该UE或/和该用户是否已经进行过二级认证，而且其二级认证成功的结果仍然有效。指示有效性可以是一个期限，在此期限内均为有效。指示有效性也可以是一个计时器timer，当计时器没有指向0时，该二级认证仍然有效，当计时器指向0时，该二级认证则失效。本发明并不限定如何指示有效期限的方法。
503.若没有有效的二级认证，则确定UE与数据网络之间需要进行二级认证，AMF协助UE和AAA-S之间进行二级认证。
二级认证流程类似图3中步骤302-307的举例示意过程，这里不再赘述，可参考上述举例描述。
其中，AMF发起UE和AAA-S之间的二级认证之前，还可进一步判断二级认证的发起条件是否满足。当然，也可默认发起条件满足，这种情况下相当于没有发起条件。在二级认证的发起条件满足的情况下，AMF才发起UE和AAA-S之间的二级认证。
举例来说，二级认证的发起条件可能通过之前已存储的已经进行的某次或某几次针对当前UE或其他UE的二级认证的附带信息来确定，例如，当运营商网络针对其他UE进行二级认证时(针对S-NSSAI的二级认证)，二级认证的发起条件用于辅助AMF判断是否继续二级认证流程或直接判定二级认证失败。类似地，如果二级认证失败，则认证失败原因可提供给核心网，认证失败原因可以作为这次二级认证的附带信息，用于AMF下一次对这个用户或其他用户是否满足二级认证(针对S-NSSAI)条件进行辅助判断。例如AAA-S成功完成对用户的认证授权，但DN网络容量或所能支持的用户数达到上限，AAA-S可通知运营商网络，DN暂时已运行在“满载模式”，暂时不接受更多二级认证。此时AAA-S也可发送一个计时器，这个计时器用于限定“暂时”的具体时长。AMF收到计时器后存储于核心网(如AMF、UDM)，在下一次其他UE申请二级认证时，可以直接拒绝二级认证申请，避免运营商核心网与DN之间不必要的信令交互。
504.如果二级认证成功，AAA-S可设定该次二级认证的有效期限(还可设置二级认证的附带信息)，并将有效期限同认证成功的这个认证结果发送给核心网(如AMF)。
其中，有效期可以与S-NSSAI绑定，即针对不同的S-NSSAI，其二级认证的有效期可以不同。该有效期也可以是与UE或/和用户绑定，不同的UE或/和用户，针对同一个S-NSSAI的二级认证，其有效期限可以不同。
505.核心网(如AMF)收到AAA-S发来的认证结果消息后，存储认证结果和有效期限(还可存储附带信息)。
其中，需要注意的是，存储方式和存储位置不同，可能会对认证结果的有效期限造成影响。主要可能存储方式为：1)绑定一级认证的安全上下文；2)绑定UE上下文(独立于其他 上下文)；3)定义独立的“用户”上下文(独立于UE上下文)。
其中，存储方式和存储位置，有如下可选的实现方式：
1)二级认证结果与一级认证结果(或一级认证后的安全上下文)绑定存储，即当一级认证的安全上下文失效时，二级认证结果自动失效。这种存储方式，可能会造成潜在的反复进行二级认证的问题。这是因为一个UE通常支持多个S-NSSAI的二级认证，在UE申请接入某个S-NSSAI时，如果以前的一级认证还有效(或有安全上下文)，就不再执行一级认证，只进行针对该S-NSSAI的二级认证。而此时若一级认证虽然有效但有效期所剩时间不多时，二级认证成功的有效性会随着一级认证的失效而失效，浪费了该次二级认证。另一方面，若尝试根据二级认证结果/有效期来修改一级认证的有效期，又会造成其他问题。一来，一级认证有效期又可能根据二级认证结果而被显著变长，而设定过长的有效期对一级认证安全上下文的安全性带来风险。二来，通常二级认证是由外部网络控制，而一级认证是由运营商控制，通过二级认证来增加一级认证的有效性的方式，可能会导致外部网络控制一级认证的风险。
2)二级认证结果与UE上下文绑定存储，即当UE的上下文失效时，二级认证的结果也自动失效。采用这种方式时，需要保证二级认证结果有效期的独立性，即不会因为其他上下文的失效而导致二级认证的结果/有效期也随之失效。由于一个UE会支持多个S-NSSAI的二级认证，二级认证的有效期会大相径庭，这可能会导致UE的上下文由于二级认证的存在而长期有效，占用存储资源。因此，这种存储方式需要根据具体情况合理设置其UE上下文的有效期，如果太短，同样造成二级认证实际的有效期被缩短，而需要重新认证。如果设置太长，则又会占用过多存储资源。另一方面，由于不同的S-NSSAI有可能是由不同的AMF来处理。更进一步，同一个S-NSSAI也可能在不同时段使用不同AMF来处理的可能性(如AMF重定位(AMF relocation)、流量控制等原因)，这种情况，二级认证的结果/有效期限可以进行中央存储更有效，例如存储在UDM中，AMF可以访问查询UDM以获取二级认证结果/有效期限等信息。
3)定义新的独立的用户上下文，用户上下文可以独立于UE上下文。这是一种灵活的存储方式，解耦切片认证的用户和承载的终端UE。其中，此处的“用户”指的是进行二级认证的用户，切片认证的结果/有效期可以自然地同UE的上下文解耦。同时，这种方式可以更有效的支持多用户使用同一UE、同一用户使用多个UE的应用场景。其中，前者是指，多个用户在不同时间，共同使用同一个终端接入网络，进行二级认证。虽然使用的同一终端同样的一级认证，每个二级认证由于用户不同而相互独立。后者是指，一个用户，可以在不同时间，分别使用不同的终端来接入切片(二级认证)。只要切片认证有效，该用户就不必再进行切片认证。
506.核心网将二级认证结果或/和有效期限发送给UE。UE可以存储接收到的二级认证结果或/和有效期限。
本实施例针对二级认证引入了有效期限的限制条件，进而有利于使二级认证结果得以有效限制，进而有利于降低非授权接入切片的安全风险，有效支持限时接入、有限制条件的接入切片业务。也有利于避免不必要的多次切片认证，提高网络资源利用率。有利于有效地支持单UE多用户、单用户多UE的应用场景。
参见图6，图6为本申请实施例提供的另一种通信方法的流程示意图。图5举例所示的实施例中，针对二级认证增加了授权等级的限制条件。其中，二级认证的限制条件和认证结果在核心网中的存储位置可以是AMF或/和UDM(或者也可以存储在其他网络功能)。
如图6举例所示，另一种通信方法可包括：
601.UE和核心网之间进行一级认证，并建立一级认证的安全上下文。
例如一级认证建立了NAS安全，随后UE和网络的NAS信令交互都可以得到加密和完整性保护。
602.AMF判断所述UE(使用该UE的用户)是否需要进行二级认证。
其中，可检查存储的二级认证授权状态，如是否需要二级认证、是否二级认证在有效期之内等。
603.若没有有效的二级认证，则确定UE与数据网络之间需要进行二级认证，AMF协助UE和AAA-S之间进行二级认证。
二级认证流程类似图3中步骤302-307的举例示意过程，这里不再赘述，可参考上述举例描述。
其中，AMF可以向AAA-S发送二级认证请求，二级认证请求例如可携带建议的二级认证授权等级。
604.如果二级认证成功，AAA-S设定本次二级认证的授权等级(还可设置二级认证的附带信息)，并将授权等级同认证成功的这个认证结果发送给核心网(如AMF)。
需要说明的是，无论AMF向AAA-S发送二级认证请求中是否携带授权等级，AAA-S均可根据DN策略等来执行设定授权等级动作。
605.核心网(如AMF)收到AAA-S发来的认证结果消息后，存储认证结果和有效期限(还可存储附带信息)。
其中，存储方式和存储位置的考虑可参考图4所举例实施例。
需要说明的是，一方面，如果不同等级使用不同的S-NSSAI，AMF可以根据该授权等级分配“allowed S-NSSAI”，在步骤606中发送allowed S-NSSAI而不用发送授权等级。另一方面，如果不同等级使用的是相同的S-NSSAI，AMF在步骤606中既发送allowed S-NSSAI且还发送授权等级。
其中，二级认证的授权等级类似商业服务或游戏中的“白金”、“金”、“银”等授权等级。不同授权等级例如可具有不同的特权。授权等级越高，其所能享有的特权可能就越高。
进一步需要说明的是，本实施例中的附带信息包括一些辅助信息，当运营商网络针对其他终端进行二级认证时(针对该S-NSSAI的二级认证)，附带信息可辅助网络判断是否继续二级认证流程或直接判定二级认证失败。类似地，如果二级认证失败，则认证失败的原因可提供给网络，其中，认证失败原因可作为辅助信息，用于网络下一次对该用户/终端或其他用户/终端进行二级认证(针对该S-NSSAI)时进行辅助判断。
606.核心网将二级认证结果发送给UE。UE可以存储接收到的二级认证结果。本步骤中 核心网是否向UE发送授权等级，可遵循步骤605中举例的判断。
本实施例针对二级认证引入了授权等级的限制条件，进而有利于使二级认证得以有效限制，进而有利于降低非授权接入切片的安全风险，有效支持限时接入、有限制条件的接入切片业务。也有利于避免不必要的多次切片认证，提高网络资源利用率。有利于有效地支持单UE多用户、单用户多UE的应用场景。
参见图7，图7为本申请实施例提供的另一种通信方法的流程示意图。
图7举例所示实施例是针对二级认证的限制条件更新流程。其中，AAA-S根据以前的认证记录，存储每个用户的二次认证结果和限制条件(有效期限或授权等级等)，假设AAA-S根据签约数据的变化或根据DN/AAA-S的策略，需对某个用户之前的二级认证的限制条件进行修改(如更改有效期限、授权等级等等)。
701.AAA-S向核心网发送更新请求，其中，所述更新请求包括用户ID、终端ID(如GPSI)和需要更新的权限值，更新的权限值例如为新的有效期限或更新的授权等级(如将银牌用户更改为金牌用户)。
可选的，更新请求中还可以携带该用户/终端的S-NSSAI等等信息(如果AAA-S可以获取到的话)。
702.核心网(如AMF)收到更新请求后可更新本地存储的二级认证的限制条件。
此外，AMF还可发送更新请求给UDM。可选的，如果AMF知道其他AMF也存储有二级认证的限制条件，AMF也可以直接将更新请求转发给其他相关AMF，进而触发更新其他AMF中存储的二级认证的限制条件。
相应的，UDM也进行二级认证限制条件的相应更新。可选的，UDM也可以继续转发更新请求给存储有二级认证的限制条件的其他AMF，从而触发其他AMF也可以更新存储的二级认证的限制条件。
703.网络(如AMF)把更新请求发送给UE，UE基于更新请求来更新本地存储的二级认证的限制条件。
需要说明的是，步骤702和703的可按照任意顺序执行。如也可先执行步骤703而后再执行步骤702等。
本申请实施例方案主要针对二级认证或者是切片认证，同样也适用于基于会话的二次认证的场景等。这里不在赘述。本申请实施例针对二级认证引入限制条件，有利于使二级认证结果被有效限制，有利于降低非授权接入切片的安全风险，有效支持限时接入、有限制条件的接入切片业务。有利于避免不必要的多次切片认证，提高网络资源利用率。有利于更有效地支持单UE多用户、单用户多UE的应用场景。
本申请实施例方案可以进行后向兼容，即如果不发送任何的限制性条件，就等于无限制接入，或可根据二级认证结果的存储特征来隐含指示。
参见图8，本申请实施例提供一种用户设备800，包括：
认证单元810，用于在核心网与用户设备之间的一级认证成功之后，如果所述用户设备与数据网络之间还需要进行二级认证，在所述核心网的协助之下与所述数据网络之间进行二级认证。
交互单元820，用于接收所述核心网发送的所述二级认证的认证结果和所述二级认证的限制条件。
存储单元830，用于将接收到的所述二级认证的认证结果和所述二级认证的限制条件进行存储。
在一些可能实施方式之中，所述认证单元810还用于，在所述二级认证的认证结果为认证失败，且所述二级认证的限制条件为认证结果的有效期限的情况下，在确定所述认证结果的有效期限结束之后，再次发起与所述数据网络之间的二级认证；在确定所述认证结果的有效期限结束之前，暂停发起与所述数据网络之间的二级认证。
在一些可能实施方式中，所述交互单元820还用于：接收所述核心网发送的所述二级认证的附带信息；在确定所述用户设备二级认证的发起条件满足的情况下，再次发起与所述数据网络之间的二级认证；在确定所述用户设备二级认证的发起条件不满足的情况下，暂停发起与所述数据网络之间的二级认证。所述附带信息用于确定所述用户设备下一次二级认证的发起条件。
其中，用户设备800可各个模块可配合执行上述方法实施例中由UE执行的各个方法的部分或全部步骤。
参见图9，本申请实施例提供提供一种数据网络中的认证服务器900，包括：
二级认证单元910，用于在核心网(如AMF)的协助下与用户设备之间进行二级认证.
交互单元920，用于向所述核心网(如AMF)发送所述二级认证的认证结果和所述二级认证的限制条件，其中，所述二级认证的认证结果和所述二级认证的限制条件能够被所述核心网存储。
在一些可能的实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，所述交互单元920还用于：向所述核心网发送所述二级认证的附带信息。所述附带信息能够被所述核心网存储，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
在一些可能的实施方式中，所述交互单元920还用于：向所述核心网发送用于请求更新所述二级认证限制条件的更新请求，所述更新请求用于触发所述核心网将存储的所述二级认证的限制条件进行更新。
其中，认证服务器900可各个模块可配合执行上述方法实施例中由认证服务器执行的各个方法的部分或全部步骤。
参见图10，本申请实施例提供提供一种核心网中的网络功能实体1000，可包括：
协助单元1010，用于在核心网与用户设备之间的一级认证成功之后，若所述数据网络与所述用户设备之间还需进行二级认证，协助数据网络与所述用户设备之间进行二级认证。
获取单元1020，用于所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件。
存储单元1030，用于将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网(例如可存储到所述核心网中的AMF或UDM等)。
可以看出，上述举例方案中，通过引入二级认证的限制条件，使得二级认证的认证结果被合理的限制性使用变得有可能，为二级认证的认证结果的有效管理奠定基础，进而有利于提高基于二级认证的业务运行的安全性和有效性。
在一些可能的实施方式中，所述二级认证的限制条件例如可包括所述二级认证的认证结果的有效期限和/或所述二级认证的授权等级。
在一些可能的实施方式中，存储单元1030将所述二级认证的认证结果与所述一级认证的认证结果绑定存储(所述二级认证的认证结果与所述一级认证的认证结果绑定存储，可表示所述二级认证的认证结果与所述一级认证的认证结果的有效期限相同或具有对应关系)或独立存储；或存储单元将所述二级认证的认证结果与所述用户设备上下文绑定存储(所述二级认证的认证结果与所述用户设备上下文绑定存储，可表示所述二级认证的认证结果与所述用户设备上下文的有效期限相同或具有对应关系)或独立存储。或所述二级认证的有效期限等于或不等于(大于或小于)所述用户设备上下文的有效期限。或所述二级认证的有效期限等于或不等于(大于或小于)所述一级认证的有效期限。
在一些可能的实施方式中，协助单元1010协助所述数据网络与所述用户设备之间进行二级认证包括：在确定所述用户设备二级认证的发起条件满足的情况下，协助所述数据网络与所述用户设备之间进行二级认证。此外，在确定所述用户设备二级认证的发起条件不满足的情况下，可拒绝所述用户设备的二级认证请求或直接判定所述数据网络与所述用户设备之间的二级认证不成功。
在一些可能的实施方式中，所述获取单元1020还用于：从所述数据网络获取所述二级认证的附带信息。
所述存储单元还用于将获取的所述二级认证的附带信息存储到所述核心网，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
在一些可能的实施方式中，所述核心网中的网络功能实体还包括通知单元1040，用于向所述用户设备发送获取到的所述二级认证的认证结果和所述二级认证的限制条件。所述用户设备可接收和存储存储所述二级认证的认证结果和所述二级认证的限制条件。
在一些可能的实施方式中，所述核心网中的网络功能实体还包括更新单元1050，用于当接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，根据所述更新请求更新所述核心网存储的所述二级认证的限制条件。
进一步的，通知单元1040还可用于，当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，向用户设备发送所述更新请求。所述用 户设备在接收到所述更新请求之后，可根据所述更新请求更新所述用户设备存储的所述二级认证的限制条件。
其中，网络功能实体1000可各个模块可配合执行上述方法实施例中由AMF执行的各个方法的部分或全部步骤。
参见图11，本申请实施例还提供一种通信装置1100，所述通信装置包括耦合的处理器1110和存储器1120；其中，处理器用于调用所述存储器中存储的程序，以完成本申请实施例提供的任意一个设备执行的任意一种方法的部分或全部步骤。例如，当处理器执行上述方法实施例中由UE执行的部分或全部步骤时，通信装置1100即为UE。当处理器执行上述方法实施例中由AMF执行的部分或全部步骤时，通信装置1100即为AMF。当处理器执行上述方法实施例中由认证服务器AAA-S执行的部分或全部步骤时，通信装置1100即为数据网络中的认证服务器。以此类推。
其中，处理器1110用于调用存储器1120存储的计算机程序，进而完成本申请实施例中由UE、AMF或AAA-S等设备执行的任意一种方法的部分或全部步骤。
其中，处理器1110还称中央处理单元(CPU,Central Processing Unit)。具体的应用中通信装置的各组件例如通过总线系统耦合在一起。其中，总线系统除了可包括数据总线之外，还可包括电源总线、控制总线和状态信号总线等。但是为清楚说明起见，在图中将各种总线都标为总线系统1130。其中，上述本申请实施例揭示的方法可以应用于处理器1110中，或由处理器1110实现。处理器1110可能是一种集成电路芯片，具有信号的处理能力。在一些实现过程之中，上述方法的部分或全部步骤可通过处理器1110中的硬件的集成逻辑电路或软件形式的指令完成。处理器1110可为通用处理器、数字信号处理器、专用集成电路、现成可编程门阵列或其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。处理器1110可实现或执行本申请实施例公开的各方法、步骤及逻辑框图。通用处理器1110可为微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可直接体现为硬件译码处理器执行完成，或用译码处理器中的硬件及软件模块组合执行完成。软件模块可位于随机存储器，闪存、只读存储器，可编程只读存储器、电可擦写可编程存储器或寄存器等等本领域成熟的存储介质之中。该存储介质位于存储器1120，例如处理器1110可读取存储器1120中的信息，结合其硬件完成上述方法的部分或全部步骤。
此外，本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被相关硬件执行，以完成执行本发明实施例提供的任意一种方法。
此外，本申请实施例还提供一种计算机程序产品，当所述计算机程序产品在计算机上运行时，使得所述计算机执行本发明实施例提供的任意一种方法。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分可以参见其他实施例的相关描述。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的 动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可能可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于可选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可以通过其他的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些界面，装置或者单元的间接耦合或通信连接，可以是电性或其他的形式。
另外，在本申请各实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元若以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可获取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或者部分可以以软件产品的形式来体现出来，其中，该计算机软件产品存储在一个计算机可读存储介质中，包括若干指令用以使得一台计算机设备(可以为个人计算机、服务器或者网络设备等，具体可以是计算机设备中的处理器)执行本申请的各个实施例上述方法的全部或部分步骤。其中，而前述的存储介质可包括：U盘、移动硬盘、磁碟、光盘、只读存储器(read-only memory,ROM)或者随机存取存储器(random access memory,RAM)等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，然而本领域的普通技术人员应当理解：其依然可对前述各实施例所记载的技术方案进行修改，或对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (15)

  1. 一种通信方法，其特征在于，包括：
    在核心网与用户设备之间的一级认证成功之后，若数据网络与所述用户设备之间还需进行二级认证，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证；
    所述网络功能实体从所述数据网络获取所述二级认证的认证结果和所述二级认证的限制条件；
    所述网络功能实体将获取到的所述二级认证的认证结果和所述二级认证的限制条件存储到所述核心网。
  2. 根据权利要求1所述的方法，其特征在于，所述二级认证的限制条件包括所述二级认证的认证结果的有效期限。
  3. 根据权利要求2所述方法，其特征在于，所述二级认证的认证结果与所述一级认证的认证结果绑定存储或独立存储；或所述二级认证的认证结果与所述用户设备上下文绑定存储或独立存储，或所述二级认证的有效期限不等于所述用户设备上下文的有效期限，或所述二级认证的有效期限不等于所述一级认证的有效期限。
  4. 根据权利要求1至3任意一项所述的方法，其特征在于，所述二级认证的限制条件包括所述二级认证的授权等级。
  5. 根据权利要求1至4任意一项所述的方法，其特征在于，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证包括：在确定所述用户设备二级认证的发起条件满足的情况下，所述核心网中的网络功能实体协助所述数据网络与所述用户设备之间进行二级认证。
  6. 根据权利要求5所述方法，其特征在于，所述方法还包括：所述网络功能实体从所述数据网络获取所述二级认证的附带信息,所述网络功能实体将获取的所述二级认证的附带信息存储到所述核心网，所述附带信息能够用于确定所述用户设备或其他用户设备下一次二级认证的发起条件。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：所述网络功能实体向所述用户设备发送获取到的所述二级认证的认证结果和所述二级认证的限制条件。
  8. 根据权利要求1至7任意一项所述的方法，其特征在于，
    所述方法还包括：
    当所述网络功能实体接收到来自所述数据网络的用于请求更新所述二级认证限制条件的更新请求，根据所述更新请求更新所述核心网存储的所述二级认证的限制条件。
  9. 一种通信方法，其特征在于，包括：
    数据网络中的认证服务器在核心网的协助下与用户设备之间进行二级认证；
    向所述核心网发送所述二级认证的认证结果和所述二级认证的限制条件，所述二级认证的认证结果和所述二级认证的限制条件能够被所述核心网存储。
  10. 根据权利要求9所述的方法，其特征在于，
    所述方法还包括：所述认证服务器向所述核心网发送用于请求更新所述二级认证限制条件的更新请求，所述更新请求用于触发所述核心网将存储的所述二级认证的限制条件进行更新。
  11. 一种通信方法，其特征在于，包括：
    在核心网与用户设备之间的一级认证成功之后，如果所述用户设备与数据网络之间还需要进行二级认证，所述用户设备在所述核心网的协助之下与所述数据网络之间进行二级认证；
    所述用户设备接收所述核心网发送的所述二级认证的认证结果和所述二级认证的限制条件；所述用户设备将接收到的所述二级认证的认证结果和所述二级认证的限制条件进行存储。
  12. 根据权利要求11所述的方法，其特征在于，
    在所述二级认证的认证结果为认证失败，且所述二级认证的限制条件为认证结果的有效期限的情况之下，所述方法还包括：所述用户设备在确定所述认证结果的有效期限结束之后，再次发起与所述数据网络之间的二级认证；所述用户设备在确定所述认证结果的有效期限结束之前，暂停发起与所述数据网络之间的二级认证。
  13. 根据权利要求11所述的方法，其特征在于，所述方法还包括：所述用户设备接收所述核心网发送的所述二级认证的附带信息；所述用户设备在确定所述用户设备二级认证的发起条件满足的情况下，再次发起与所述数据网络之间的二级认证；所述用户设备在确定所述用户设备二级认证的发起条件不满足的情况下，暂停发起与所述数据网络之间的二级认证，其中，所述附带信息用于确定所述用户设备下一次二级认证的发起条件。
  14. 一种通信装置，其特征在于，所述通信装置包括耦合的处理器和存储器；
    其中，所处理器用于调用所述存储器中存储的计算机程序，以完成权利要求1至13任意一项所述的方法。
  15. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时能够完成权利要求1至13任意一项所述的方法。
PCT/CN2019/100881 2019-08-15 2019-08-15 通信方法和相关设备 WO2021026927A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
MX2022001926A MX2022001926A (es) 2019-08-15 2019-08-15 Metodo de comunicacion y dispositivo relacionado.
CN201980099050.0A CN114223232A (zh) 2019-08-15 2019-08-15 通信方法和相关设备
EP19941213.1A EP4013093A4 (en) 2019-08-15 2019-08-15 COMMUNICATION PROCESS AND ASSOCIATED DEVICES
PCT/CN2019/100881 WO2021026927A1 (zh) 2019-08-15 2019-08-15 通信方法和相关设备
CA3148101A CA3148101C (en) 2019-08-15 2019-08-15 Communication method and related device
US17/672,391 US12114154B2 (en) 2019-08-15 2022-02-15 Communication method and related device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/100881 WO2021026927A1 (zh) 2019-08-15 2019-08-15 通信方法和相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/672,391 Continuation US12114154B2 (en) 2019-08-15 2022-02-15 Communication method and related device

Publications (1)

Publication Number Publication Date
WO2021026927A1 true WO2021026927A1 (zh) 2021-02-18

Family

ID=74570857

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/100881 WO2021026927A1 (zh) 2019-08-15 2019-08-15 通信方法和相关设备

Country Status (6)

Country Link
US (1) US12114154B2 (zh)
EP (1) EP4013093A4 (zh)
CN (1) CN114223232A (zh)
CA (1) CA3148101C (zh)
MX (1) MX2022001926A (zh)
WO (1) WO2021026927A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210092103A1 (en) * 2018-10-02 2021-03-25 Arista Networks, Inc. In-line encryption of network data
CN114303404B (zh) * 2019-09-25 2023-05-16 日本电气株式会社 核心网络节点及通信方法
CN113498060B (zh) * 2020-04-07 2023-02-17 大唐移动通信设备有限公司 一种控制网络切片认证的方法、装置、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108012267A (zh) * 2016-10-31 2018-05-08 华为技术有限公司 一种网络认证方法、相关设备及系统
CN108141756A (zh) * 2015-09-29 2018-06-08 瑞典爱立信有限公司 促成网络切片管理
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
WO2018137873A1 (en) * 2017-01-27 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Secondary authentication of a user equipment
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8793490B1 (en) * 2006-07-14 2014-07-29 Jpmorgan Chase Bank, N.A. Systems and methods for multifactor authentication
US20160371475A1 (en) * 2015-06-19 2016-12-22 Microsoft Technology Licensing, Llc Enhanced alternative multifactor authentication
CA3057401A1 (en) * 2017-03-21 2018-09-27 Nokia Technologies Oy Enhanced registration procedure in a mobile system supporting network slicing
US11048785B2 (en) * 2018-02-14 2021-06-29 Samsung Electronics Co., Ltd Method and apparatus of performing authentication
US11032710B2 (en) * 2019-02-15 2021-06-08 Qualcomm Incorporated Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization
CN115835218A (zh) 2019-06-17 2023-03-21 华为技术有限公司 二级认证的方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108141756A (zh) * 2015-09-29 2018-06-08 瑞典爱立信有限公司 促成网络切片管理
CN108012267A (zh) * 2016-10-31 2018-05-08 华为技术有限公司 一种网络认证方法、相关设备及系统
CN108347729A (zh) * 2017-01-24 2018-07-31 电信科学技术研究院 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
WO2018137873A1 (en) * 2017-01-27 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Secondary authentication of a user equipment
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Update Slice-Specific Authentication and Authorisation", 3GPP DRAFT; S2-1905663_TS 23.501_UPDATE SLICE-SPECIFIC AUTHENTICATION AND AUTHORISATION R3, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Reno, US; 20190513 - 20190517, 7 May 2019 (2019-05-07), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051721128 *

Also Published As

Publication number Publication date
CN114223232A (zh) 2022-03-22
CA3148101A1 (en) 2021-02-18
EP4013093A4 (en) 2022-08-03
US20220174488A1 (en) 2022-06-02
MX2022001926A (es) 2022-03-11
CA3148101C (en) 2024-06-11
EP4013093A1 (en) 2022-06-15
US12114154B2 (en) 2024-10-08

Similar Documents

Publication Publication Date Title
US11895157B2 (en) Network security management method, and apparatus
US11737014B2 (en) Service processing method and device
US11115918B2 (en) Devices, systems and methods for accessing and providing network slices in a mobile communication network
CN111031571B (zh) 一种网络切片接入控制的方法及装置
US9113332B2 (en) Method and device for managing authentication of a user
CN107615732B (zh) 将会话接纳至虚拟网络中的方法和移动性管理功能实体
EP3804377A1 (en) Systems, devices, and techniques for registering user equipment (ue) in wireless networks using a native blockchain platform
WO2021037175A1 (zh) 一种网络切片的管理方法及相关装置
US12114154B2 (en) Communication method and related device
US8914867B2 (en) Method and apparatus for redirecting data traffic
WO2020177523A1 (zh) 终端设备的注册方法及装置
EP2317694B1 (en) Method and system and user equipment for protocol configuration option transmission
WO2018064987A9 (zh) 策略控制方法及装置
US11653395B2 (en) Method for establishing a connection of a mobile terminal to a mobile radio communication network and radio access network component
JP6732794B2 (ja) モバイル無線通信ネットワーク及び通信ネットワークデバイスへのモバイル端末の接続を確立するための方法
CN116889004A (zh) 用于边缘数据网络重定位的认证指示
CN101309504A (zh) 触发ip业务认证及获取用户信息的方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19941213

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3148101

Country of ref document: CA

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019941213

Country of ref document: EP

Effective date: 20220311