[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2023273790A1 - 一种认证方法及通信装置 - Google Patents

一种认证方法及通信装置 Download PDF

Info

Publication number
WO2023273790A1
WO2023273790A1 PCT/CN2022/096843 CN2022096843W WO2023273790A1 WO 2023273790 A1 WO2023273790 A1 WO 2023273790A1 CN 2022096843 W CN2022096843 W CN 2022096843W WO 2023273790 A1 WO2023273790 A1 WO 2023273790A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication device
authentication
identification information
vlan
information
Prior art date
Application number
PCT/CN2022/096843
Other languages
English (en)
French (fr)
Inventor
谢春生
韩文勇
张博
朱强华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023273790A1 publication Critical patent/WO2023273790A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent

Definitions

  • the present application relates to the technical field of wireless communication, and in particular to an authentication method and a communication device.
  • the session management network element decides whether to initiate a secondary authentication process for the session created by the terminal.
  • the session management network element interacts with the data network authentication, authorization and accounting (DN-AAA) server to authenticate the terminal session, and the DN-AAA server passes the session management network
  • the element implements the authorization of the terminal session, wherein the authorized content includes: for an Ethernet type session, the DN-AAA server can authorize the session to allow the media access control (medium access control, MAC) address list and the virtual local area network ( virtual local area network, VLAN) list.
  • media access control medium access control, MAC
  • VLAN virtual local area network
  • the session management network element can accept the session establishment request of the terminal, so that the terminal can complete the session creation.
  • the present application provides an authentication method and a communication device, which are used to implement authentication on a communication device connected to a terminal, so as to improve communication security of the communication device.
  • the embodiment of the present application provides an authentication method, which can be executed by a terminal or a module (such as a chip) applied in the terminal.
  • the method includes: determining an authentication indication, where the authentication indication is used to instruct the communication device to be authenticated; receiving a first message from the first communication device, where the first message includes identification information of the first communication device; when the first communication device A communication device is an unsuccessfully authenticated communication device, or when the first communication device is an unsuccessfully authenticated communication device and the first set does not contain the identification information of the first communication device, sending a first request to the session management network element , the first request includes indication information and identification information of the first communication device, and the indication information indicates that the first communication device should be authenticated; the first set includes identification information of authentication-free communication devices.
  • the terminal may establish a data channel, and the data channel may be used by a communication device connected to the terminal, such as the first communication device.
  • a communication device such as the first communication device.
  • the UE first establishes a PDU session, and after the session is established, the corresponding data channel is established.
  • the terminal when the terminal determines that the first communication device is an unsuccessfully authenticated communication device, it initiates a first request to the network side to request the network side to authenticate the first communication device, so that the communication of the first communication device can be ensured. security at the time.
  • the first response from the session management network element is received, the first response includes the identification information of the first communication device, authentication success information and a second set, the second set includes Identification information of the authorized VLAN corresponding to the first communication device.
  • the first packet includes the identification information of the first VLAN; when the second set includes the identification information of the first VLAN, the first communication device is authorized to communicate in the first VLAN ; or, when the second set does not contain the identification information of the first VLAN, rejecting the communication of the first communication device.
  • the terminal can authorize the communication of the first communication device or reject the communication of the first communication device, so as to realize the authentication of the communication device and help to improve communication security.
  • the identification information of the second VLAN is selected from the second set; and the first communication device is authorized to communicate in the second VLAN.
  • the session management network element before sending the first request to the session management network element, send a second request to the first communication device, where the second request is used to request to obtain the authentication information of the first communication device ; Receive the authentication information from the first communication device; wherein, the first request also includes the authentication information.
  • the authentication information includes a user name and/or a password.
  • the first message includes the identification information of the first VLAN; a third set is determined, and the third set includes the identification information of the authorized VLAN corresponding to the first communication device; when the The first communication device is a successfully authenticated communication device and the third set contains the identification information of the first VLAN, or when the first set does not contain the identification information of the first communication device, the first communication device is successfully authenticated communication device and the third set contains the identification information of the first VLAN, authorize the first communication device to communicate in the first VLAN; or, when the first communication device is a successfully authenticated communication device and the third set does not Contains the identification information of the first VLAN, or when the first set does not contain the identification information of the first communication device, the first communication device is a successfully authenticated communication device and the third set does not include the first VLAN Identification information, rejecting the communication of the first communication device.
  • the terminal can authorize the communication of the first communication device or reject the communication of the first communication device, so as to realize the authentication of the communication device and help to improve communication security.
  • a third set is determined, and the third set includes the identification information of the authorized VLAN corresponding to the first communication device; when the first communication device is a successfully authenticated communication device, or when the The first set does not contain the identification information of the first communication device and the first communication device is a successfully authenticated communication device, select the identification information of the third VLAN from the third set; authorize the first communication device to be in the first set Three VLAN communication.
  • the terminal can authorize the communication of the first communication device or reject the communication of the first communication device, so as to realize the authentication of the communication device and help to improve communication security.
  • the first message includes the identification information of the first VLAN; a fourth set is determined, and the fourth set includes the authorization-free communication devices corresponding to the authentication-free communication devices in the first set.
  • VLAN when the fourth set contains the identification information of the first VLAN, or when the first set contains the identification information of the first communication device and the fourth set contains the identification information of the first VLAN, authorize the The first communication device communicates in the first VLAN; or, when the fourth set does not contain the identification information of the first VLAN, or when the first set contains the identification information of the first communication device and the fourth set does not contain the identification information of the first VLAN, and reject the communication of the first communication device.
  • the terminal can authorize the communication of the first communication device or reject the communication of the first communication device, so as to realize the authentication of the communication device and help to improve communication security.
  • the fourth set is determined, and the fourth set includes the authorization-free VLAN corresponding to the authentication-free communication device in the first set; the identification of the fourth VLAN is selected from the fourth set information; or, when the first set contains the identification information of the first communication device, select the identification information of the fourth VLAN from the fourth set; authorize the first communication device to communicate in the fourth VLAN.
  • the terminal can authorize the communication of the first communication device or reject the communication of the first communication device, so as to realize the authentication of the communication device and help to improve communication security.
  • session configuration information from the session management network element is received, and the session configuration information includes the authentication indication.
  • the identification information of the first communication device includes a MAC address, or includes a MAC address and an IP address.
  • the embodiment of the present application provides an authentication method, which can be executed by a session management network element or a module (such as a chip) applied to the session management network element.
  • the method includes: determining an authentication indication, where the authentication indication is used to indicate that the communication device is authenticated; sending the authentication indication to the first terminal; receiving a first request from the first terminal, the first request including indication information and the first request Identification information of a communication device, the indication information indicating that the first communication device is to be authenticated; a first response is sent to the first terminal, and the first response includes authentication result information of the first communication device.
  • the authentication of the first communication device is initiated, so that the security of the communication of the first communication device can be guaranteed.
  • an authentication request is sent to the authentication server, and the authentication request includes the identification information and authentication information of the first communication device; An authentication response, which includes the authentication result information.
  • the authentication response when the authentication result information is authentication success information, the authentication response further includes a second set, and the second set includes the identifier of the authorized VLAN corresponding to the first communication device information; then the first response also includes the second set.
  • the first request further includes authentication information of the first communication device.
  • a third request before sending the first response to the first terminal, send a third request to the first communication device, where the third request is used to request to acquire the authentication information of the first communication device; The authentication information of the first communication device.
  • the first set before sending the authentication request to the authentication server, determine the first set, the first set includes the identification information of the authentication-free communication device; determine that the first set does not include the first communication device identification information.
  • the authentication information includes a user name and/or a password.
  • a first set and a fourth set are determined, the first set includes identification information of authentication-free communication devices, and the fourth set includes The authorization-free VLAN corresponding to the authentication-free communication device in the first set; determine that the first set contains the identification information of the first communication device; then the first response also includes the fourth set, and the authentication The result message is authentication success message.
  • a first set and a fourth set are determined, the first set includes identification information of authentication-free communication devices, and the fourth set includes including the authorization-free VLANs corresponding to the authentication-free communication devices in the first set; and sending the first set and the fourth set to the first terminal.
  • a deletion instruction is sent to the second terminal, where the deletion instruction is used to instruct to delete the authorization configuration information corresponding to the first communication device.
  • the authorized configuration information includes the authorized VLAN.
  • the subscription information of the first terminal is acquired, and the subscription information includes the authentication indication.
  • session configuration information is sent to the first terminal, where the session configuration information includes the authentication indication.
  • the identification information of the first communication device includes a MAC address, or includes a MAC address and an IP address.
  • the embodiment of the present application provides a communication device, and the device may be a terminal, and may also be a chip for the terminal.
  • the device has the function of realizing any realization method of the first aspect above. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides a communication device, and the device may be a session management network element, or may be a chip or a module for the session management network element.
  • the device has the function of implementing any implementation method of the second aspect above. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the embodiment of the present application provides a communication device, including a processor and a memory; the memory is used to store computer instructions, and when the device is running, the processor executes the computer instructions stored in the memory so that the device executes Any implementation method in the first aspect to the second aspect above.
  • the embodiment of the present application provides a communication device, including a unit or means (means) for performing each step of any implementation method in the first aspect to the second aspect.
  • the embodiment of the present application provides a communication device, including a processor and an interface circuit, the processor is configured to communicate with other devices through the interface circuit, and execute any implementation method in the first aspect to the second aspect above.
  • the processor includes one or more.
  • an embodiment of the present application provides a communication device, including a processor coupled to a memory, and the processor is used to call a program stored in the memory to execute any implementation method in the first aspect to the second aspect above .
  • the memory may be located within the device or external to the device. And there may be one or more processors.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when it is run on a communication device, the above-mentioned first to second aspects Any implementation method is executed.
  • the embodiment of the present application also provides a computer program product, the computer program product includes a computer program or instruction, when the computer program or instruction is run by the communication device, any of the above first to second aspects can be realized method is executed.
  • the embodiment of the present application further provides a chip system, including: a processor, configured to execute any implementation method in the first aspect to the second aspect above.
  • Figure 1 is a schematic diagram of the 5G network architecture
  • Figure 2 shows the user plane architecture where multiple terminals under the same 5G LAN group are registered in the same PSA UPF;
  • Figure 3 shows the user plane architecture in which multiple terminals under the same 5G LAN group are registered in multiple PSA UPFs;
  • Figure 4 is a schematic diagram of the 5G LAN architecture
  • Figure 5(a) is a schematic diagram of an authentication method provided in the embodiment of the present application.
  • Figure 5(b) is a schematic diagram of an authentication method provided in the embodiment of the present application.
  • FIG. 6 is a schematic diagram of an authentication method provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of an authentication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an authentication method provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an authentication method provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of a communication device provided in an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a communication device provided by an embodiment of the present application.
  • FIG 1 is a schematic diagram of a fifth generation (5th generation, 5G) network architecture.
  • the 5G network architecture shown in Figure 1 may include three parts, namely a terminal, a data network (data network, DN) and an operator network.
  • the functions of some of the network elements are briefly introduced and described below.
  • the operator network may include but not limited to one or more of the following network elements: authentication server function (authentication server function, AUSF) network element, network exposure function (network exposure function, NEF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, unified database (unified data repository, UDR), network storage function (network repository function, NRF) network element, application function (application function, AF) network element, access and mobility management function (access and mobility management function, AMF) network element, session management function (session management function, SMF) network element, radio access network (radio access network, RAN) Devices and user plane function (user plane function, UPF) network elements, network slice selection function (network slice selection function, NSSF) network elements (not shown in the figure), etc.
  • network elements or devices other than radio access network devices may be referred to as core network elements or core network devices.
  • the wireless access network equipment can be a base station (base station), an evolved base station (evolved NodeB, eNodeB), a transmission reception point (transmission reception point, TRP), and a next generation base station (next generation NodeB, gNB) in a 5G mobile communication system , the next generation base station in the sixth generation (6th generation, 6G) mobile communication system, the base station in the future mobile communication system or the access node in the wireless fidelity (wireless fidelity, WiFi) system, etc.; it can also complete the base station part
  • a functional module or unit for example, can be a centralized unit (central unit, CU) or a distributed unit (distributed unit, DU).
  • the radio access network equipment may be a macro base station, a micro base station or an indoor station, or a relay node or a donor node.
  • the embodiment of the present application does not limit the specific technology and specific equipment form adopted by the radio access network equipment.
  • a base station is used as an example of a radio access network device for description.
  • a terminal may also be called terminal equipment, user equipment (user equipment, UE), mobile station, mobile terminal, and so on.
  • Terminals can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things ( internet of things, IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearables, smart transportation, smart city, etc.
  • Terminals can be mobile phones, tablet computers, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc.
  • the embodiment of the present application does not limit the specific technology and device form adopted by the terminal, and any of the above implementation manners may be adopted.
  • Base stations and terminals can be fixed or mobile. Base stations and terminals can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and artificial satellites in the air. The embodiments of the present application do not limit the application scenarios of the base station and the terminal.
  • the AMF network element performs functions such as mobility management and access authentication/authorization. In addition, it is also responsible for transferring user policies between the terminal and the PCF.
  • the SMF network element performs functions such as session management, execution of control policies issued by the PCF, selection of UPF, and allocation of Internet Protocol (IP) addresses for terminals.
  • functions such as session management, execution of control policies issued by the PCF, selection of UPF, and allocation of Internet Protocol (IP) addresses for terminals.
  • IP Internet Protocol
  • the UPF network element as the interface UPF with the data network, completes functions such as user plane data forwarding, session/flow-based charging statistics, and bandwidth limitation.
  • DN is a network outside the operator's network.
  • the operator's network can access multiple DNs, and various services can be deployed on the DN, which can provide data and/or voice services for terminals.
  • DN is a private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminals, and the control server of the sensors is deployed in the DN, and the control server can provide services for the sensors.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • DN is a company's internal office network.
  • the mobile phone or computer of the company's employees can be a terminal, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.
  • the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • a platform for example, a cloud platform.
  • the foregoing network element or function may be implemented by one device, or jointly implemented by multiple devices, or may be a functional module in one device, which is not specifically limited in this embodiment of the present application.
  • the session management network element, user plane network element, and mobility management network element in this application can be the SMF, UPF, and AMF in Figure 1(a) or Figure 1(b), respectively, or they can be future communications such as the sixth generation (6th generation, 6G) network elements that have the functions of the SMF, UPF, and AMF described above, this application does not limit this.
  • 6G sixth generation
  • SMF, UPF, and AMF are respectively used as an example of a session management network element, a user plane network element, and a mobility management network element for description.
  • Authentication refers to confirming the identity of a claimant based on identifying information unique to the claimant.
  • the most common way to implement authentication is through username and password, but the authentication method is not limited to this.
  • combined authentication or multi-factor authentication
  • authentication is often used in occasions with high security requirements, that is, multiple authentication methods are used to verify the user's identity at the same time.
  • authentication is mainly to confirm the identity of the user accessing the network, and to judge whether the visitor is a legitimate network user.
  • authentication is used to confirm whether the identity of the user trying to access the network is legal
  • authorization is used to specify the network access rights that the legal user can have, that is, which resources the user can access.
  • a local area network is a computer communication network that connects various computers, external devices, and databases within a local geographical area (such as a school, factory, and institution).
  • a local geographical area such as a school, factory, and institution.
  • wired LANs and wireless LANs have shown their deficiencies in deployment complexity, flexibility, mobility, and coverage, which prompts the development of LAN technology to adapt to future applications. demand.
  • 5G local area network 5G local area network
  • the terminal solves the problem of data exchange between the terminal and the data network by establishing a traditional PDU connection.
  • 5G LAN adds the concept of group (group), that is, terminals belonging to the same 5G LAN group can not only complete data exchange with the data network corresponding to the group, but also directly communicate with the terminals in the group through UPF. Other terminals complete data exchange, and terminals belonging to different groups are isolated from each other. Virtual private network communication can be realized through 5G LAN.
  • Figure 2 shows the user plane architecture of multiple terminals under the same 5G LAN group registered in the same protocol data unit anchor (PDU session anchor, PSA) UPF.
  • PSA protocol data unit anchor
  • the PSA UPF since Terminal 1 and Terminal 2 belong to the same 5G LAN group, the PSA UPF not only completes the data exchange with the data network for Terminal 1 and Terminal 2, but also serves as the local switch node of the 5G LAN group Complete the data exchange between terminal 1 and terminal 2.
  • the I-UPF in FIG. 2 refers to an intermediate UPF (Intermediate UPF).
  • Figure 3 shows the user plane architecture in which multiple terminals under the same 5G LAN group are registered in multiple PSA UPFs.
  • the N19 interface is added between the PSA UPFs.
  • Terminal 1 and Terminal 2 belonging to the same 5G LAN group perform data exchange, the PSA UPFs corresponding to Terminal 1 and Terminal 2 will complete the transmission of terminal data through the N19 channel. .
  • the mobile network can support multiple 5G LAN groups at the same time, and terminals under the same group can communicate with each other. Terminals in different groups are isolated from each other.
  • the secondary authentication is an optional process for the terminal when establishing a PDU session. Its function is to authenticate and authorize the user's identity through interaction between the 3GPP network and the DN-AAA server when establishing the PDU session.
  • the DN-AAA server is referred to as DN-AAA for short.
  • the DN-AAA can be inside the data network (DN), or outside the data network.
  • SMF decides whether to initiate a secondary authentication process for the session created by the terminal.
  • SMF interacts with DN-AAA to authenticate the terminal session, and DN-AAA implements Authorization of terminal sessions, where the authorized content includes:
  • DN-AAA can authorize the list of MAC addresses and VLAN lists that are allowed to communicate in the PDU session.
  • the failure of DN-AAA to re-authenticate the terminal session will cause the SMF to reject the terminal's session establishment request, which may eventually lead to the failure of the terminal session creation.
  • FIG. 4 is a schematic diagram of the 5G LAN architecture.
  • the terminal creates an Ethernet-type PDU session. At this time, only an Ethernet-type PDU data channel is established.
  • the device that actually uses this channel to send messages is the communication device connected to the terminal (such as communication device 1, communication device 2, etc.). Specifically which communication device will be connected to the terminal cannot be determined during the session creation phase of the terminal, and the same communication device may switch the terminal it accesses.
  • these communication devices need to be authenticated and authorized by DN-AAA before sending service data packets through the terminal to determine the legitimacy of their access to network resources.
  • the existing 3GPP secondary authentication cannot realize the authentication and authorization of the communication device under the terminal after the terminal completes session creation.
  • the embodiment of the present application provides a corresponding authentication method, which can realize the authentication of the communication device connected to the terminal, so as to ensure that only the authenticated communication device can communicate through the terminal and use the 3GPP network.
  • a data channel is established.
  • the data channel can be the aforementioned PDU data channel, and then the communication device connected to the terminal is authenticated. Only the communication device that is authenticated successfully can This data channel can be used for data sending and receiving.
  • the communication device in this embodiment of the present application may be a device in an industrial field network, such as a robot arm, an industrial controller, and the like.
  • the first set includes identification information of authentication-free communication devices
  • the second set includes identification information of authorized VLANs corresponding to communication devices
  • the third set includes identification information of authorized VLANs corresponding to communication devices.
  • the four sets include the authorization-free VLANs corresponding to the authentication-free communication devices in the first set.
  • the difference between the second set and the third set is: the second set is used to represent the identification information of the authorized VLAN after the current authentication request, and the third set is used to represent the identification information of the authorized VLAN after the historical authentication request , so the third set can be stored locally.
  • Fig. 5(a) is a schematic diagram of an authentication method provided by the embodiment of the present application. The method includes the following steps:
  • Step 501a the terminal determines an authentication indication, where the authentication indication is used to instruct the communication device to be authenticated.
  • the terminal may receive session configuration information from the SMF during the session establishment process of the terminal, and the session configuration information includes the authentication indication.
  • the method for the SMF to obtain the authentication indication may be, for example, to obtain the subscription information of the terminal during the session establishment process of the terminal, and the subscription information includes the authentication indication.
  • the terminal may also determine the authentication indication according to the local configuration of the terminal.
  • Step 502a the first communication device sends the first packet to the terminal, and the terminal receives the first packet accordingly.
  • the first packet includes identification information of the first communication device, and the identification information may include a MAC address, or include a MAC address and an IP address.
  • the first packet may be an authentication request or a data packet.
  • the first packet includes the first VLAN.
  • Step 503a the terminal judges whether the first communication device is a successfully authenticated communication device.
  • the terminal locally records relevant information of communication devices that have successfully authenticated and/or failed to authenticate, for example, in a table format, so as to determine whether the first communication device is a successfully authenticated communication device.
  • the successful authentication refers to that the previous authentication is successful and the authentication result is still valid.
  • Unsuccessful authentication refers to no previous authentication, or previous authentication but the authentication result is authentication failure, or previous authentication is successful but the authentication result has expired.
  • step 504a is performed after step 503a.
  • Step 504a the terminal sends the first request to the SMF, and the SMF receives the first request accordingly.
  • the first request includes indication information and identification information of the first communication device, and the indication information indicates that the first communication device should be authenticated.
  • the terminal when the terminal determines that the first communication device is an unsuccessfully authenticated communication device, it initiates a first request to the network side to request the network side to authenticate the first communication device, thereby ensuring the communication security of the communication device .
  • step 505a is also executed.
  • step 505a the SMF judges whether the first communication device is an authentication-free communication device.
  • the identification information of the first communication device belongs to the first set, it is determined that the first communication device is an authentication-free communication device, and if the identification information of the first communication device does not belong to the first set, it is determined that the first communication device is not an authentication-free communication device. certified communications equipment.
  • the method for the SMF to acquire the first set may be, for example: the SMF acquires the first set from the subscription information of the terminal, or the SMF acquires the first set from local configuration.
  • step 506a to step 509a are performed after step 505a.
  • step 510a to step 511a are performed after step 505a.
  • step 506a the SMF sends an authentication request to the authentication server (take the authentication server as DN-AAA as an example), and the authentication server receives the authentication request accordingly.
  • the authentication request includes identification information and authentication information of the first communication device.
  • the authentication information may include username and/or password.
  • the user name is also referred to as the user account.
  • the methods for SMF to obtain authentication information include but are not limited to the following method 1 or method 2:
  • Method 1 the terminal sends a second request to the first communication device, the second request is used to request to obtain the authentication information of the first communication device, the terminal receives the authentication information from the first communication device, and then the terminal carries in the above-mentioned first request The authentication information.
  • Method 2 The SMF sends a third request to the first communication device, where the third request is used to request to obtain the authentication information of the first communication device, and the SMF receives the authentication information from the first communication device.
  • the terminal actively obtains the authentication information from the first communication device and sends it to the SMF.
  • the SMF actively obtains the authentication information from the first communication device.
  • the DN-AAA After the DN-AAA receives the authentication request, it authenticates the first communication device. For example, the DN-AAA can exchange EAP messages with the first communication device according to an extended authentication protocol (extensible authentication protocol, EAP) to complete authentication of the first communication device. Certification process for communication devices.
  • EAP extended authentication protocol
  • the DN-AAA After the DN-AAA completes the authentication of the first communication device, it can obtain authentication result information, where the authentication result information is authentication success information or authentication failure information.
  • step 507a the DN-AAA sends an authentication response to the SMF, and the SMF receives the authentication response accordingly.
  • the authentication response includes authentication result information.
  • the authentication response also includes a second set, and the second set is the identification information of the authorized VLAN corresponding to the first communication device generated after the authentication is successful.
  • step 508a the SMF sends the first response to the terminal, and the terminal receives the first response accordingly.
  • the first response includes authentication result information for the first communication device.
  • the first response further includes the above-mentioned second set.
  • Step 509a the terminal judges whether to authorize the communication of the first communication device.
  • the terminal rejects the communication of the first communication device.
  • the terminal In the case where the authentication result information in the first response is authentication success information and the first packet contains the identification information of the first VLAN, if the second set contains the identification information of the first VLAN, the terminal authorizes the first communication The device communicates in the first VLAN, and if the second set does not contain the identification information of the first VLAN, the terminal rejects the communication of the first communication device.
  • the terminal selects the identification information of the second VLAN from the second set, and authorizes the identification information of the second VLAN.
  • a communication device communicates in the second VLAN.
  • step 510a the SMF sends a first response to the terminal, where the first response includes authentication result information and a fourth set.
  • the terminal receives the first response.
  • the authentication result information is authentication success information.
  • the method for the SMF to acquire the fourth set may be, for example: the SMF acquires the fourth set from the subscription information of the terminal, or the SMF acquires the fourth set from local configuration.
  • Step 511a the terminal judges whether to authorize the communication of the first communication device according to the fourth set.
  • the terminal In the case that the first packet contains the identification information of the first VLAN, if the fourth set contains the identification information of the first VLAN, the terminal authorizes the first communication device to communicate in the first VLAN, if the fourth set does not If the identification information of the first VLAN is included, the terminal rejects the communication of the first communication device.
  • the terminal selects the identification information of the fourth VLAN from the fourth set, and authorizes the first communication device to communicate in the fourth VLAN.
  • step 503a the terminal determines that the first communication device is a successfully authenticated communication device, the following steps 512a to 513a are performed after step 503a.
  • Step 512a the terminal determines the third set.
  • the third set here is the identification information of the authorized VLAN corresponding to the first communication device received from the network side after the first communication device is authenticated successfully.
  • the third set can be stored in the terminal or in the SMF.
  • the terminal determines the third set, and may acquire the third set locally, or acquire the third set from the SMF.
  • Step 513a the terminal judges whether to authorize the communication of the first communication device according to the third set.
  • the terminal In the case that the first packet contains the identification information of the first VLAN, if the third set contains the identification information of the first VLAN, the terminal authorizes the first communication device to communicate in the first VLAN, if the third set does not If the identification information of the first VLAN is included, the terminal rejects the communication of the first communication device.
  • the terminal selects the identification information of the third VLAN from the third set, and authorizes the first communication device to communicate in the third VLAN.
  • step 514a is also included.
  • Step 514a the terminal sends notification information to the first communication device.
  • the first communication device receives the notification information.
  • the notification information is used to indicate that the first communication device has successfully authenticated or failed to authenticate.
  • the communication device may be authorized or refused to communicate, thereby helping to improve communication security.
  • Fig. 5(b) is a schematic diagram of an authentication method provided by the embodiment of the present application. The method includes the following steps:
  • Step 501b to step 502b are the same as the above step 501a to step 502a, and reference may be made to the foregoing description.
  • step 503b the terminal judges whether the first communication device is an authentication-free communication device according to the first set.
  • the method for the terminal to acquire the first set may be, for example, receiving session configuration information from the SMF in the session establishment process of the terminal, the session configuration information including the first set.
  • the method for the SMF to obtain the first set may be, for example, to obtain the subscription information of the terminal during the session establishment process of the terminal, and the subscription information includes the first set, or the SMF obtains the first set from the local configuration. gather.
  • the identification information of the first communication device belongs to the first set, it is determined that the first communication device is an authentication-free communication device, and if the identification information of the first communication device does not belong to the first set, it is determined that the first communication device is not an authentication-free communication device. certified communications equipment.
  • step 504b is performed after step 503b.
  • Step 504b the terminal judges whether the first communication device is a successfully authenticated communication device.
  • the terminal locally records relevant information of communication devices that have successfully authenticated and/or failed to authenticate, for example, in a table format, so as to determine whether the first communication device is a successfully authenticated communication device.
  • step 505b is performed after step 504b.
  • Step 505b is the same as the above step 504a.
  • the terminal determines that the first communication device is not an authentication-free communication device and is an unsuccessfully authenticated communication device, it initiates a first request to the network side to request the network side to authenticate the first communication device, Thus, communication security can be guaranteed.
  • Step 506b to step 509b are the same as above step 506a to step 509a.
  • step 504b determines that the first communication device is a successfully authenticated communication device, the following step 510b is performed after step 504b.
  • Step 510b is the same as step 513a.
  • step 511b to step 512b are performed after step 503b.
  • Step 511b the terminal determines the fourth set.
  • the method for the terminal to acquire the fourth set is similar to the method for the terminal to acquire the first set described in step 503b, and reference may be made to the foregoing description.
  • Step 512b is the same as step 511a.
  • step 513b is also included.
  • Step 513b is the same as step 514a.
  • step 503b if it is determined in step 503b that the first communication device is not an authentication-free communication device, then step 505b to step 509b are performed, and step 513b is performed after step 509b. If it is determined in step 503b that the first communication device is an authentication-free communication device, then step 511b to step 512b are executed, and step 513b is executed after step 512b. That is to say, this solution does not need to execute the above step 504b, that is, it does not need to judge whether the first communication device is a successfully authenticated communication device.
  • the communication device may be authorized or refused to communicate, thereby helping to improve communication security.
  • the embodiment of the present application is also applicable to a scenario where a communication device switches an access terminal.
  • the first communication device switches from accessing the second terminal to accessing the first terminal.
  • the second terminal is the terminal before the first communication device accesses the first terminal.
  • the SMF may also send a deletion indication to the second terminal, where the deletion indication is used to instruct the second terminal to delete the Authorized configuration information, which includes authorized VLANs.
  • FIG. 6 and FIG. 7 are specific examples of the above-mentioned embodiment in FIG. 5( a ).
  • the following embodiments in FIG. 8 and FIG. 9 are specific examples of the above-mentioned embodiment in FIG. 5( b ).
  • FIG. 6 is a schematic diagram of an authentication method provided by an embodiment of the present application.
  • the method realizes that the authentication of the communication device is triggered by the terminal, and in the method, the SMF can perceive the authentication-free information of the communication device, and the authentication-free information includes a first set, which includes identification information of the authentication-free communication device.
  • the method includes the following steps:
  • Step 601 sign a 5G LAN, and the terminal joins the 5G LAN.
  • Add authentication and authorization parameters related to the communication device to the terminal's subscription information such as an authentication indication, which is used to indicate that the communication device connected to the terminal is authenticated, or the authentication indication information is used to indicate that the terminal is creating a session Afterwards, the communication device connected to the terminal is authenticated.
  • the following information is added to the subscription information of the terminal or the subscription information of the 5G LAN: the identification information of the authentication-free communication device (ie, the first set), the authorization-free VLAN corresponding to the authentication-free communication device (ie, the first set) four sets).
  • the subscription information of the 5G LAN is applicable to all terminals joining the 5G LAN, that is, the subscription information of the 5G LAN can be As part of the subscription information of all terminals under the 5G LAN. If the subscription information of the terminal includes the first set and the fourth set, the first set and the fourth set are only applicable to the terminal and not applicable to other terminals.
  • Step 602 the terminal registers with the network.
  • This process will trigger authentication between the network and the terminal, and the AMF on the network side will establish a mobility management context for the terminal.
  • Step 603 the communication device sends a first packet to the terminal, where the first packet is a data packet or an authentication request.
  • the first packet includes identification information of the communication device, and optionally, the first packet also includes identification information of the VLAN.
  • the first packet includes single network slice selection assistance information (single network slice selection assistance information, S-NSSAI) and DNN, where the S-NSSAI and DNN are used to indicate the session that bears the first packet. That is, the terminal can determine a session corresponding to the S-NSSAI and DNN according to the S-NSSAI and DNN, and the session bears the first message sent by the communication device.
  • the session may be a PDU session.
  • the terminal may determine the session that bears the first message sent by the communication device according to the physical port through which the communication device accesses the terminal. That is, there is a corresponding relationship between the physical port on the terminal and the session of the terminal.
  • the terminal determines the session corresponding to the physical port as the first message sent by the communication device. session.
  • the session is the session carrying the first message sent by the communication device.
  • steps 604 to 610 are performed after step 603 .
  • step 604 the terminal sends a session establishment request for requesting establishment of a PDU session.
  • Step 605 the SMF obtains the subscription information of the terminal from the UDM.
  • the subscription information of the terminal includes the authentication indication, the first set and the fourth set.
  • the SMF perceives that the terminal belongs to the 5G LAN. If the session of the 5G LAN group to which the terminal belongs is not created when the terminal creates a session, trigger the SMF to create a session of the 5G LAN group, that is, perform the following steps 606 to 607.
  • Step 606 the SMF obtains the subscription information of the 5G LAN from the UDM.
  • the 5G LAN subscription information includes the first set and the fourth set.
  • Step 607 the SMF interacts with the UPF to create a session of the 5G LAN group.
  • step 608 the SMF judges whether to initiate a second authentication for the terminal according to the terminal's subscription information, local configuration, and the session creation request sent by the terminal.
  • the second authentication may be initiated on the terminal.
  • step 609 the SMF interacts with the UPF to create a terminal session.
  • step 610 the SMF sends session configuration information to the terminal, which includes an authentication indication.
  • the SMF After the SMF completes the session creation of the terminal, it sends the session configuration information to the terminal, which includes an authentication instruction.
  • the terminal which includes an authentication instruction.
  • the terminal can obtain the authentication indication, and the SMF can obtain the first set and the fourth set from the subscription information of the terminal in the above step 605, or obtain the first set and the fourth set from the 5G LAN in the above step 606. Obtain the first set and the fourth set from the subscription information of .
  • the terminal determines that the communication device does not need to be authenticated again. And the terminal stores the third set issued by the network side when the communication device is successfully authenticated before, and the third set includes the identification information of the authorized VLAN.
  • the terminal judges whether the VLAN in the first message is included in the third set, and if it is included, the communication device is authorized to communicate in the VLAN; if not included, then Deny communication with the communication device. If the above-mentioned first message does not contain VLAN identification information, the terminal selects a VLAN from the third set, and then authorizes the communication device to communicate in the selected VLAN.
  • the communication device sending the first message is a communication device that has not been successfully authenticated, trigger the terminal to authenticate the communication device.
  • the terminal authenticating the communication device refer to the following steps 611 to 623.
  • the unsuccessful authentication may be unauthenticated or failed authentication.
  • Step 611 the terminal sends a session modification request (session modification request) to the SMF, which includes the session identifier, indication information and identification information of the communication device.
  • a session modification request session modification request
  • the session modification request may be a PDU session modification request.
  • the indication information is used to indicate to authenticate the communication device.
  • Step 612 the SMF judges whether the communication device is exempt from authentication.
  • the communication device is an authentication-free communication device, and thus the following steps 613a, 613b to 614 are performed.
  • Step 613a the SMF sends an N4 session modification request to the UPF for modifying the N4 session of the terminal or 5G LAN, and adding a forwarding rule for the communication device in the N4 session of the terminal or 5G LAN, which allows the communication device to correspond to the fourth set Communications within the authorized scope.
  • step 613b the SMF sends a session modification response to the terminal, which includes the authentication result information and the fourth set.
  • the authentication result information refers to authentication result information for authenticating the communication device. Since the communication device is exempt from authentication, the authentication result information is authentication success information.
  • Step 614 the terminal judges whether to authorize the communication of the communication device.
  • the terminal After receiving the authentication success information and the fourth set, the terminal judges whether to authorize the communication of the communication device.
  • the terminal judges whether the fourth set contains the VLAN in the first message, and if it is included, the communication device is authorized to communicate in the VLAN; if it is not included, then Deny communication with the communication device.
  • the terminal selects a VLAN from the fourth set, and then authorizes the communication device to communicate in the selected VLAN.
  • Step 615 the SMF sends an EAP request (request) message to the communication device, for requesting to acquire the authentication information of the communication device.
  • EAP request request
  • the authentication information may include username and/or password.
  • Step 616 the communication device sends an EAP response (response) message to the SMF, which includes the authentication information of the communication device.
  • the above-mentioned EAP request message may be replaced by an EAP confirm (identify) message
  • the above-mentioned EAP response message may also be replaced by an EAP confirm message.
  • step 617 the SMF sends an N4 session establishment request to the UPF.
  • the SMF can open the channel between the SMF and the DN-AAA after establishing the N4 session with the UPF.
  • the SMF can open the channel between the SMF and the DN-AAA after establishing the N4 session with the UPF.
  • the SMF sends the terminal's generic public subscription identity (GPSI), identification information of the communication device, and authentication information of the communication device to the DN-AAA.
  • GPSI generic public subscription identity
  • the SMF can send the GPSI of the terminal, the identification information of the communication device and the EAP response/confirmation message received from the communication device to the UPF through the N4 session, and then the UPF sends the GPSI of the terminal, the identification information of the communication device and The EAP response/confirmation message is sent to the DN-AAA, so that the DN-AAA can obtain the GPSI of the terminal, the identification information of the communication device, and obtain the authentication information of the communication device from the EAP response/confirmation message.
  • Step 619 complete the authentication process for the communication device according to the EAP authentication protocol.
  • the DN-AAA exchanges EAP messages with the communication device according to the EAP, and completes the authentication process for the communication device.
  • Step 620 the DN-AAA sends the authentication result information of the communication device to the SMF.
  • the authentication result information is authentication success information or authentication failure information.
  • the DN-AAA when the authentication result information is authentication success information, the DN-AAA also sends a second set to the SMF, and the second set includes the identification information of the authorized VLAN corresponding to the communication device.
  • Step 621a the SMF sends an N4 session modification request to the UPF, which is used to modify the N4 session of the terminal or 5G LAN, and add a forwarding rule in the N4 session of the terminal or 5G LAN, which allows the communication device to authorize the corresponding authorization in the second set communication within the range.
  • step 621b the SMF sends a session modification response to the terminal, which includes authentication result information.
  • the session modification response further includes the above-mentioned second set.
  • Step 622 the terminal judges whether to authorize the communication of the communication device.
  • the terminal judges whether to authorize the communication of the communication device.
  • the terminal judges whether the second set contains the identification information of the VLAN in the first message, and if so, authorizes the communication device to communicate in the VLAN, if If it is not included, the communication of the communication device is rejected.
  • the terminal selects the identification information of a VLAN from the second set, and then authorizes the communication device to communicate in the selected VLAN.
  • Step 623 the terminal sends notification information to the communication device.
  • This step is optional.
  • the notification information is used to indicate that the communication device is authenticated successfully or failed.
  • the terminal when the terminal receives the first message initiated by the communication device, it can initiate authentication of the communication device to the 3GPP network, and the 3GPP network interacts with the DN-AAA to authenticate the communication device under the terminal.
  • FIG. 7 is a schematic diagram of an authentication method provided by an embodiment of the present application. The method realizes the authentication of the communication device during the process of switching the communication device from the access terminal 1 to the access terminal 2 .
  • the process of the communication device accessing the terminal 1 reference may be made to the description of the embodiment in FIG. 6 .
  • the method includes the following steps:
  • step 701 the terminal 2 registers with the network.
  • the authentication between the network and the terminal 2 will be triggered, and the AMF on the network side will establish a mobility management context for the terminal 2.
  • Step 702 the communication device sends a first packet to the terminal 2, where the first packet is a data packet or an authentication request.
  • Step 703 when the session carrying the first message sent by the communication device does not exist, trigger the terminal 2 to create a session.
  • the SMF After the SMF completes the session creation of the terminal 2, it sends the session configuration information to the terminal 2, which includes an authentication instruction.
  • an authentication instruction For the meaning of the authentication indication, reference may be made to the foregoing description, and details are not repeated here.
  • Terminal 2 can obtain the authentication indication, and the SMF can obtain the first set and the fourth set from the subscription information of Terminal 2, or obtain the first set and the fourth set from the subscription information of 5G LAN. Fourth set.
  • the communication device sends a first message to the terminal 2, the first message includes the identification information of the communication device, and optionally, the first message also includes the identification information of the VLAN.
  • the terminal 2 determines that no further authentication is required for the communication device. Subsequent terminal 2 may determine whether to authorize the communication device according to the third set, for details, reference may be made to related descriptions in the embodiment of FIG. 6 .
  • the communication device sending the first message is a communication device that has not been successfully authenticated, trigger the terminal 2 to authenticate the communication device.
  • the process of terminal 2 authenticating the communication device refers to the following steps 704 to 713.
  • Step 704 terminal 2 sends a session modification request (session modification request) to the SMF, which includes the session identifier, indication information and identification information of the communication device.
  • the session modification request may be a PDU session modification request.
  • the indication information is used to indicate to authenticate the communication device.
  • Step 705 the SMF judges whether the communication device is exempt from authentication.
  • the identification information of the communication device is included in the first set stored on the SMF, it is determined that the communication device is an authentication-free communication device, and thus the following steps 706 to 709 are performed.
  • step 706 the SMF sends a deletion instruction to Terminal 1, which is used to instruct Terminal 1 to delete the authorization configuration information corresponding to the communication device, so as to delete the authorization of Terminal 1 to the communication device.
  • step 707a the SMF sends an N4 session modification request to the UPF, which is used to modify the N4 session of the terminal 1 or 5G LAN, and delete the forwarding rule of the communication device on the N4 session of the terminal 1 or 5G LAN.
  • step 707b the SMF sends an N4 session modification request to the UPF, which is used to modify the N4 session of the terminal 2 or 5G LAN, and adds a forwarding rule to the N4 session of the terminal 2 or 5G LAN, and the forwarding rule allows the communication device to correspond in the fourth set Communications within the authorized scope.
  • step 708 the SMF sends a session modification response to Terminal 2, which includes the authentication result information and the fourth set.
  • the authentication result information refers to authentication result information for authenticating the communication device. Since the communication device is exempt from authentication, the authentication result information is authentication success information.
  • step 709 the terminal 2 judges whether to authorize the communication of the communication device.
  • the terminal 2 judges whether to authorize the communication of the communication device.
  • the terminal 2 judges whether the fourth set contains the identification information of the VLAN in the first message, and if so, authorizes the communication device to communicate in the VLAN, If it is not included, the communication of the communication device is rejected.
  • the terminal 2 selects the identification information of a VLAN from the fourth set, and then authorizes the communication device to communicate in the selected VLAN.
  • step 710 the SMF sends a deletion instruction to Terminal 1, which is used to instruct Terminal 1 to delete the authorization configuration information corresponding to the communication device, so that Terminal 1 deletes the authorization of the communication device.
  • Step 711 the SMF sends an N4 session modification request to the UPF, which is used to modify the N4 session of the terminal 1 or 5G LAN, and delete the forwarding rule of the communication device on the N4 session of the terminal 1 or 5G LAN.
  • Step 712 the SMF interacts with the DN-AAA, and notifies the DN-AAA that the authentication of the communication device is offline.
  • step 713 the SMF initiates an authentication process for the communication device on the session of the terminal 2.
  • step 713 For the specific implementation process of step 713, reference may be made to the description of steps 615 to 623 above, and details are not repeated here.
  • the terminal 2 when the communication device that has been authenticated on the terminal 1 is switched from the terminal 1 to the terminal 2, the terminal 2 is triggered to re-authenticate the communication device. Specifically, when the SMF receives the authentication initiated by Terminal 2 and perceives that the communication device has valid authentication on Terminal 1, the SMF instructs to delete the authorization configuration information on the communication device on Terminal 1, and completes the authentication process of Terminal 2 on the communication device .
  • FIG. 8 is a schematic diagram of an authentication method provided by an embodiment of the present application.
  • the method realizes that the terminal triggers the authentication of the communication device, and in the method, the terminal can perceive the authentication-free information of the communication device, the authentication-free information includes a first set, and the first set includes identification information of the authentication-free communication device.
  • the method includes the following steps:
  • Step 801 to step 809 are the same as steps 601 to 609 described above.
  • Step 810 the SMF sends session configuration information to the terminal, which includes the authentication indication, the first set and the fourth set.
  • the SMF After the SMF completes the session creation of the terminal, it sends the session configuration information to the terminal, which includes the authentication indication, the first set and the fourth set.
  • the authentication indication, the first set, and the fourth set For the meanings of the authentication indication, the first set, and the fourth set, reference may be made to the foregoing description, and details are not repeated here.
  • the terminal judges whether the communication device sending the first packet belongs to the first set, and optionally, also judges whether the communication device is a successfully authenticated communication device.
  • the terminal judges whether the fourth set contains the identification information of the VLAN in the first message, and if so, authorizes the communication device to communicate in the VLAN, if If it is not included, the communication of the communication device is rejected. If the above-mentioned first message does not contain the identification information of the VLAN, the terminal selects the identification information of a VLAN from the fourth set, and then authorizes the communication device to communicate in the selected VLAN.
  • the terminal determines that the communication device does not need to be authenticated again. And the terminal stores the third set issued by the network side when the communication device is successfully authenticated before, and the third set includes the identification information of the authorized VLAN. In this case, if the above-mentioned first message contains the identification information of the VLAN, the terminal judges whether the third set contains the identification information of the VLAN in the first message, and if so, authorizes the communication device to communicate in the VLAN, if If it is not included, the communication of the communication device is rejected. If the above-mentioned first message does not contain the identification information of the VLAN, the terminal selects the identification information of a VLAN from the third set, and then authorizes the communication device to communicate in the selected VLAN.
  • the communication device that sends the first message does not belong to the first set and the communication device is not successfully authenticated, trigger the terminal to authenticate the communication device.
  • the terminal refer to the following steps 811 to 822 for the process of the terminal authenticating the communication device.
  • the unsuccessful authentication may be unauthenticated or failed authentication.
  • step 811 the terminal sends an EAP request message to the communication device, for requesting to acquire authentication information of the communication device.
  • Step 812 the communication device sends an EAP response message to the terminal, which includes authentication information of the communication device.
  • the authentication information may include username and/or password.
  • step 811 and step 812 are optional steps.
  • the above-mentioned EAP request message may be replaced by an EAP confirm (identify) message
  • the above-mentioned EAP response message may also be replaced by an EAP confirm message.
  • Step 813 the terminal sends a session modification request to the SMF, which includes the session identifier, indication information and identification information of the communication device.
  • the session modification request also includes authentication information.
  • the session modification request may be a PDU session modification request.
  • the indication information is used to indicate to authenticate the communication device.
  • step 814 the SMF sends an EAP request message to the communication device, for requesting to acquire the authentication information of the communication device.
  • Step 815 the communication device sends an EAP response message to the SMF, which includes authentication information of the communication device.
  • the authentication information may include username and/or password.
  • Step 814 and step 815 are optional steps. When the above step 811 and step 812 are executed, the step 814 and the step 815 do not need to be executed, and when the above step 811 and the step 812 are not executed, then the step 814 and the step 815 are executed.
  • the EAP request message in step 814 above may be replaced by an EAP identify (identify) message
  • the EAP response message in step 815 above may also be replaced by an EAP identify message.
  • Step 816 to step 822 are the same as the above step 617 to step 623, and reference may be made to the foregoing description.
  • authentication and authorization of communication devices under 5G LAN can be realized.
  • the terminal when the terminal receives the first message initiated by the communication device, the terminal first judges whether the communication device is exempt from authentication, and if not, initiates the authentication of the communication device to the 3GPP network, and the 3GPP network and DN-AAA Interaction realizes the authentication of the communication equipment under the terminal.
  • FIG. 9 is a schematic diagram of an authentication method provided by an embodiment of the present application. The method realizes the authentication of the communication device during the process of switching the communication device from the access terminal 1 to the access terminal 2 .
  • the process of the communication device accessing the terminal 1 reference may be made to the description of the embodiment in FIG. 8 .
  • the method includes the following steps:
  • Steps 901 to 903 are the same as steps 701 to 703 above.
  • the session configuration information sent by SMF to terminal 2 includes authentication indication, first set and fourth set.
  • authentication indication For the meanings of the authentication indication, the first set, and the fourth set, reference may be made to the foregoing description, and details are not repeated here.
  • the terminal 2 judges whether the communication device sending the first packet belongs to the first set, and optionally, also judges whether the communication device is a successfully authenticated communication device. Specifically, the terminal 2 executes after judging whether the communication device of the first message belongs to the first set, or after judging whether the communication device of the first message belongs to the first set and judging whether the communication device is a successfully authenticated communication device For operations, refer to the relevant description in the embodiment in FIG. 8 , and details are not repeated here.
  • the terminal 2 is triggered to authenticate the communication device. Refer to the following steps 904 to 913 for the process of terminal 2 authenticating the communication device.
  • Step 904 the terminal 2 sends an EAP request message to the communication device, for requesting to acquire the authentication information of the communication device.
  • Step 905 the communication device sends an EAP response message to the terminal 2, which includes authentication information of the communication device.
  • the authentication information may include username and/or password.
  • step 904 and step 905 are optional steps.
  • the above-mentioned EAP request message may be replaced by an EAP confirm (identify) message
  • the above-mentioned EAP response message may also be replaced by an EAP confirm message.
  • step 906 the terminal 2 sends a session modification request to the SMF, which includes the session identifier, indication information and identification information of the communication device.
  • the session modification request also includes authentication information.
  • the session modification request may be a PDU session modification request.
  • the indication information is used to indicate to authenticate the communication device.
  • step 907 the SMF sends an EAP request message to the communication device, for requesting to acquire the authentication information of the communication device.
  • Step 908 the communication device sends an EAP response message to the SMF, which includes the authentication information of the communication device.
  • the authentication information may include username and/or password.
  • Step 907 and step 908 are optional steps. When the above step 904 and step 905 are performed, the step 907 and the step 908 do not need to be performed, and when the above step 904 and the step 905 are not performed, then the step 907 and the step 908 are performed.
  • the EAP request message in the above step 907 can be replaced by an EAP confirm (identify) message
  • the EAP response message in the above step 908 can also be replaced by an EAP confirm message.
  • Step 909 to step 912 are the same as the above step 710 to step 713, and reference may be made to the foregoing description.
  • the terminal 2 when the communication device that has been authenticated on the terminal 1 is switched from the terminal 1 to the terminal 2, the terminal 2 is triggered to re-authenticate the communication device. Specifically, when terminal 2 judges that the communication device needs authentication, it initiates device authentication to SMF, and SMF receives the device authentication initiated by terminal 2, and perceives that the communication device has valid authentication on terminal 1, then SMF instructs terminal 1 to delete the authentication on terminal 1.
  • the authorization configuration information of the communication device, and the terminal 2 completes the authentication process of the communication device.
  • the session management network element and the terminal include corresponding hardware structures and/or software modules for performing various functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software with reference to the units and method steps of the examples described in the embodiments disclosed in the present application. Whether a certain function is executed by hardware or computer software drives the hardware depends on the specific application scenario and design constraints of the technical solution.
  • FIG. 10 and FIG. 11 are schematic structural diagrams of possible communication devices provided by the embodiments of the present application. These communication devices can be used to implement the functions of the session management network element (SMF) or the terminal in the above method embodiments, and thus can also realize the beneficial effects of the above method embodiments.
  • the communication device may be a session management network element and a terminal, or may be a module (such as a chip) applied to a terminal or a session management network element.
  • a communication device 1000 includes a processing unit 1010 and a transceiver unit 1020 .
  • the communication device 1000 is used to implement the functions of the session management network element or terminal in the method embodiments shown in FIG. 5( a ), FIG. 5( b ), and FIG. 6 to FIG. 9 .
  • the transceiving unit 1020 performs reception and/or transmission, and the processing unit 1010 performs processing operations other than transceiving.
  • the processing unit 1010 is used to determine the authentication indication
  • the authentication The indication is used to indicate that the communication device is authenticated
  • the transceiver unit 1020 is configured to receive a first message from the first communication device, and the first message includes the identification information of the first communication device; when the first communication device is An unsuccessfully authenticated communication device, or when the first communication device is an unsuccessfully authenticated communication device and the first set does not include the identification information of the first communication device, send a first request to the session management network element, and the first The request includes indication information and identification information of the first communication device, and the indication information indicates that the first communication device should be authenticated; the first set includes identification information of authentication-free communication devices.
  • the authentication indication is used to instruct the communication device to be authenticated; the authentication indication is sent to the first terminal; the transceiver unit 1020 is configured to receive a first request from the first terminal, the first request includes indication information and the first communication device identification information of the first communication device, where the indication information indicates that the first communication device is to be authenticated; and a first response is sent to the first terminal, and the first response includes authentication result information of the first communication device.
  • processing unit 1010 and the transceiver unit 1020 can be directly obtained by referring to the relevant descriptions in the method embodiments shown in FIG. 5(a), FIG. 5(b), and FIG. 6 to FIG.
  • a communication device 1100 includes a processor 1110 and an interface circuit 1120 .
  • the processor 1110 and the interface circuit 1120 are coupled to each other.
  • the interface circuit 1120 may be a transceiver or an input-output interface.
  • the communication device 1100 may further include a memory 1130 for storing instructions executed by the processor 1110 or storing input data required by the processor 1110 to execute the instructions or storing data generated by the processor 1110 after executing the instructions.
  • the terminal chip implements the functions of the terminal in the above method embodiment.
  • the terminal chip receives information from other modules in the terminal (such as radio frequency modules or antennas), and the information is sent to the terminal by the base station; or, the terminal chip sends information to other modules in the terminal (such as radio frequency modules or antennas), and the The information is sent by the terminal to the base station.
  • the processor in the embodiments of the present application can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • a general-purpose processor can be a microprocessor, or any conventional processor.
  • the method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by means of a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only Memory, registers, hard disk, removable hard disk, CD-ROM or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and storage medium can be located in the ASIC.
  • the ASIC can be located in the base station or the terminal.
  • the processor and the storage medium may also exist in the base station or the terminal as discrete components.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product comprises one or more computer programs or instructions. When the computer program or instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are executed in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, a base station, user equipment or other programmable devices.
  • the computer program or instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be downloaded from a website, computer, A server or data center transmits to another website site, computer, server or data center by wired or wireless means.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrating one or more available media.
  • the available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; and it may also be a semiconductor medium, such as a solid state disk.
  • the computer readable storage medium may be a volatile or a nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.
  • “at least one” means one or more, and “multiple” means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the contextual objects are an “or” relationship; in the formulas of this application, the character “/” indicates that the contextual objects are a "division” Relationship.
  • the steps of the method or algorithm described in the embodiments of the present application may be directly embedded in hardware, a software unit executed by a processor, or a combination of both.
  • the software unit can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or this In any other form of storage media in the field.
  • the storage medium can be connected to the processor, so that the processor can read information from the storage medium, and can write information to the storage medium.
  • the storage medium can also be integrated into the processor.
  • the processor and storage medium can be provided in an ASIC.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage media may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种认证方法及通信装置。该方法包括：确定认证指示，认证指示用于指示对通信设备进行认证；接收来自第一通信设备的第一报文，第一报文中包含第一通信设备的标识信息；当第一通信设备是未成功认证的通信设备，或者当第一通信设备是未成功认证的通信设备且第一集合中不包含第一通信设备的标识信息，向会话管理网元发送第一请求，第一请求中包含指示信息和第一通信设备的标识信息，该指示信息指示对第一通信设备进行认证；第一集合中包含免认证的通信设备的标识信息。该方案，当终端确定第一通信设备是未成功认证的通信设备，则向网络侧发起第一请求，用于请求网络侧对该第一通信设备进行认证，从而可以保证第一通信设备通信时的安全性。

Description

一种认证方法及通信装置
相关申请的交叉引用
本申请要求在2021年06月30日提交中国专利局、申请号为202110736863.5、申请名称为“一种认证方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种认证方法及通信装置。
背景技术
目前，终端在创建会话阶段，由会话管理网元决定是否对终端创建的会话发起二次认证流程。在二次认证流程中，会话管理网元与数据网络认证、授权和计费(data network authentication,authorization and accounting，DN-AAA)服务器交互，对终端会话进行认证，DN-AAA服务器通过会话管理网元实现对终端会话的授权，其中授权的内容包括：对于以太类型的会话，DN-AAA服务器可授权会话允许通信的媒体接入控制(medium access control，MAC)地址列表以及允许通信的虚拟局域网(virtual local area network，VLAN)列表。DN-AAA服务器对终端会话的二次认证失败将导致会话管理网元拒绝终端的会话建立请求，最终导致终端会话创建失败。二次认证成功后，则会话管理网元可以接受终端的会话建立请求，从而终端可以完成创建会话。
在一些场景中，终端下还会接入其它的通信设备，终端创建会话之后，真正使用该会话发送数据报文的设备是接入到该终端的通信设备。然而这些通信设备是未经认证的，存在安全隐患。
发明内容
本申请提供一种认证方法及通信装置，用以实现对接入到终端的通信设备进行认证，以提升通信设备的通信安全。
第一方面，本申请实施例提供一种认证方法，该方法可以由终端或应用于终端中的模块(如芯片)来执行。该方法包括：确定认证指示，该认证指示用于指示对通信设备进行认证；接收来自第一通信设备的第一报文，该第一报文中包含第一通信设备的标识信息；当该第一通信设备是未成功认证的通信设备，或者当该第一通信设备是未成功认证的通信设备且第一集合中不包含该第一通信设备的标识信息，向会话管理网元发送第一请求，该第一请求中包含指示信息和该第一通信设备的标识信息，该指示信息指示对该第一通信设备进行认证；该第一集合中包含免认证的通信设备的标识信息。
其中，终端可以建立数据通道，该数据通道可以被接入到该终端的通信设备，如第一通信设备使用。比如，以PDU会话为例，在没有PDU会话之前，UE先建立PDU会话，在会话建立起来后，对应的数据通道就建立起来了。
根据上述方案，当终端确定第一通信设备是未成功认证的通信设备，则向网络侧发起第一请求，用于请求网络侧对该第一通信设备进行认证，从而可以保证第一通信设备通信时的安全性。
在一种可能的实现方法中，接收来自该会话管理网元的第一响应，该第一响应中包含该第一通信设备的标识信息、认证成功信息和第二集合，该第二集合中包含该第一通信设备对应的授权的VLAN的标识信息。
在一种可能的实现方法中，该第一报文中包含第一VLAN的标识信息；当该第二集合中包含该第一VLAN的标识信息，授权该第一通信设备在该第一VLAN通信；或者，当该第二集合中不包含该第一VLAN的标识信息，拒绝该第一通信设备的通信。
根据上述方案，终端可以授权第一通信设备的通信或拒绝第一通信设备的通信，实现对通信设备的认证，有助于提升通信安全。
在一种可能的实现方法中，从该第二集合中选择第二VLAN的标识信息；授权该第一通信设备在该第二VLAN通信。
在一种可能的实现方法中，在向该会话管理网元发送该第一请求之前，向该第一通信设备发送第二请求，该第二请求用于请求获取该第一通信设备的认证信息；接收来自该第一通信设备的该认证信息；其中，该第一请求中还包含该认证信息。
在一种可能的实现方法中，该认证信息包括用户名和/或密码。
在一种可能的实现方法中，该第一报文中包含第一VLAN的标识信息；确定第三集合，该第三集合中包含该第一通信设备对应的授权的VLAN的标识信息；当该第一通信设备是成功认证的通信设备且第三集合中包含该第一VLAN的标识信息，或者当该第一集合中不包含该第一通信设备的标识信息、该第一通信设备是成功认证的通信设备且第三集合中包含该第一VLAN的标识信息，授权该第一通信设备在该第一VLAN通信；或者，当该第一通信设备是成功认证的通信设备且第三集合中不包含该第一VLAN的标识信息，或者当该第一集合中不包含该第一通信设备的标识信息、该第一通信设备是成功认证的通信设备且第三集合中不包含该第一VLAN的标识信息，拒绝该第一通信设备的通信。
根据上述方案，终端可以授权第一通信设备的通信或拒绝第一通信设备的通信，实现对通信设备的认证，有助于提升通信安全。
在一种可能的实现方法中，确定第三集合，该第三集合中包含该第一通信设备对应的授权的VLAN的标识信息；当该第一通信设备是成功认证的通信设备，或者当该第一集合中不包含该第一通信设备的标识信息且该第一通信设备是成功认证的通信设备，从该第三集合中选择第三VLAN的标识信息；授权该第一通信设备在该第三VLAN通信。
根据上述方案，终端可以授权第一通信设备的通信或拒绝第一通信设备的通信，实现对通信设备的认证，有助于提升通信安全。
在一种可能的实现方法中，该第一报文中包含第一VLAN的标识信息；确定第四集合，该第四集合中包含该第一集合中的免认证的通信设备对应的免授权的VLAN；当该第四集合中包含该第一VLAN的标识信息，或者当该第一集合中包含该第一通信设备的标识信息且该第四集合中包含该第一VLAN的标识信息，授权该第一通信设备在该第一VLAN通信；或者，当该第四集合中不包含该第一VLAN的标识信息，或者当该第一集合中包含该第一通信设备的标识信息且该第四集合中不包含该第一VLAN的标识信息，拒绝该第一通信设备的通信。
根据上述方案，终端可以授权第一通信设备的通信或拒绝第一通信设备的通信，实现对通信设备的认证，有助于提升通信安全。
在一种可能的实现方法中，确定第四集合，该第四集合中包含该第一集合中的免认证的通信设备对应的免授权的VLAN；从该第四集合中选择第四VLAN的标识信息；或者，当该第一集合中包含该第一通信设备的标识信息，从该第四集合中选择第四VLAN的标识信息；授权该第一通信设备在该第四VLAN通信。
根据上述方案，终端可以授权第一通信设备的通信或拒绝第一通信设备的通信，实现对通信设备的认证，有助于提升通信安全。
在一种可能的实现方法中，接收来自该会话管理网元的会话配置信息，该会话配置信息中包含该认证指示。
在一种可能的实现方法中，该第一通信设备的标识信息包括MAC地址，或者包括MAC地址和IP地址。
第二方面，本申请实施例提供一种认证方法，该方法可以由会话管理网元或应用于会话管理网元中的模块(如芯片)来执行。该方法包括：确定认证指示，该认证指示用于指示对通信设备进行认证；向第一终端发送该认证指示；接收来自该第一终端的第一请求，该第一请求中包含指示信息和第一通信设备的标识信息，该指示信息指示对该第一通信设备进行认证；向该第一终端发送第一响应，该第一响应中包含对该第一通信设备的认证结果信息。
根据上述方案，当收到来自终端的第一请求，则发起对第一通信设备的认证，从而可以保证第一通信设备通信时的安全性。
在一种可能的实现方法中，向该第一终端发送第一响应之前，向认证服务器发送认证请求，该认证请求中包含该第一通信设备的标识信息和认证信息；接收来自该认证服务器的认证响应，该认证响应中包含该认证结果信息。
在一种可能的实现方法中，在该认证结果信息是认证成功信息的情况下，该认证响应中还包含第二集合，该第二集合中包含该第一通信设备对应的授权的VLAN的标识信息；则该第一响应中还包含该第二集合。
在一种可能的实现方法中，该第一请求中还包含该第一通信设备的认证信息。
在一种可能的实现方法中，向该第一终端发送第一响应之前，向该第一通信设备发送第三请求，该第三请求用于请求获取该第一通信设备的认证信息；接收来自该第一通信设备的该认证信息。
在一种可能的实现方法中，向认证服务器发送认证请求之前，确定第一集合，该第一集合中包含免认证的通信设备的标识信息；确定该第一集合中不包含该第一通信设备的标识信息。
在一种可能的实现方法中，该认证信息包括用户名和/或密码。
在一种可能的实现方法中，向该第一终端发送第一响应之前，确定第一集合和第四集合，该第一集合中包含免认证的通信设备的标识信息，该第四集合中包含该第一集合中的免认证的通信设备对应的免授权的VLAN；确定该第一集合中包含该第一通信设备的标识信息；则该第一响应中还包含该第四集合，且该认证结果信息是认证成功信息。
在一种可能的实现方法中，接收来自该第一终端的第一请求之前，确定第一集合和第四集合，该第一集合中包含免认证的通信设备的标识信息，该第四集合中包含该第一集合 中的免认证的通信设备对应的免授权的VLAN；向该第一终端发送该第一集合和该第四集合。
在一种可能的实现方法中，向第二终端发送删除指示，该删除指示用于指示删除该第一通信设备对应的授权配置信息，该第二终端是该第一通信设备在接入该第一终端之前所接入的终端，该授权配置信息中包含授权的VLAN。
在一种可能的实现方法中，在该第一终端的会话建立流程中，获取该第一终端的签约信息，该签约信息中包含该认证指示。
在一种可能的实现方法中，向该第一终端发送会话配置信息，该会话配置信息中包含该认证指示。
在一种可能的实现方法中，该第一通信设备的标识信息包括MAC地址，或者包括MAC地址和IP地址。
第三方面，本申请实施例提供一种通信装置，该装置可以是终端，还可以是用于终端的芯片。该装置具有实现上述第一方面的任意实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，本申请实施例提供一种通信装置，该装置可以是会话管理网元，还可以是用于会话管理网元的芯片或模块。该装置具有实现上述第二方面的任意实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第五方面，本申请实施例提供一种通信装置，包括处理器和存储器；该存储器用于存储计算机指令，当该装置运行时，该处理器执行该存储器存储的计算机指令，以使该装置执行上述第一方面至第二方面中的任意实现方法。
第六方面，本申请实施例提供一种通信装置，包括用于执行上述第一方面至第二方面中的任意实现方法的各个步骤的单元或手段(means)。
第七方面，本申请实施例提供一种通信装置，包括处理器和接口电路，所述处理器用于通过接口电路与其它装置通信，并执行上述第一方面至第二方面中的任意实现方法。该处理器包括一个或多个。
第八方面，本申请实施例提供一种通信装置，包括与存储器耦合的处理器，该处理器用于调用所述存储器中存储的程序，以执行上述第一方面至第二方面中的任意实现方法。该存储器可以位于该装置之内，也可以位于该装置之外。且该处理器可以是一个或多个。
第九方面，本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在通信装置上运行时，使得上述第一方面至第二方面中的任意实现方法被执行。
第十方面，本申请实施例还提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当计算机程序或指令被通信装置运行时，使得上述第一方面至第二方面中的任意实现方法被执行。
第十一方面，本申请实施例还提供一种芯片系统，包括：处理器，用于执行上述第一方面至第二方面中的任意实现方法。
附图说明
图1为5G网络架构示意图；
图2为同一个5G LAN组下的多个终端注册在同一个PSA UPF的用户面架构；
图3为同一个5G LAN组下的多个终端注册在多个PSA UPF的用户面架构；
图4为5G LAN架构示意图；
图5(a)为本申请实施例提供的一种认证方法示意图；
图5(b)为本申请实施例提供的一种认证方法示意图；
图6为本申请实施例提供的一种认证方法示意图；
图7为本申请实施例提供的一种认证方法示意图；
图8为本申请实施例提供的一种认证方法示意图；
图9为本申请实施例提供的一种认证方法示意图；
图10为本申请实施例提供的一种通信装置示意图；
图11为本申请实施例提供的一种通信装置示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。
图1为第五代(5th generation，5G)网络架构示意图。图1所示的5G网络架构中可包括三部分，分别是终端、数据网络(data network，DN)和运营商网络。下面对其中的部分网元的功能进行简单介绍说明。
其中，运营商网络可包括但不限于以下网元中的一个或多个：鉴权服务器功能(authentication server function，AUSF)网元、网络开放功能(network exposure function，NEF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、统一数据库(unified data repository，UDR)、网络存储功能(network repository function，NRF)网元、应用功能(application function，AF)网元、接入与移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、无线接入网(radio access network，RAN)设备以及用户面功能(user plane function，UPF)网元、网络切片选择功能(network slice selection function，NSSF)网元(图中未示出)等。上述运营商网络中，除无线接入网设备之外的网元或设备可以称为核心网网元或核心网设备。
无线接入网设备可以是基站(base station)、演进型基站(evolved NodeB，eNodeB)、发送接收点(transmission reception point，TRP)、5G移动通信系统中的下一代基站(next generation NodeB，gNB)、第六代(6th generation，6G)移动通信系统中的下一代基站、未来移动通信系统中的基站或无线保真(wireless fidelity，WiFi)系统中的接入节点等；也可以是完成基站部分功能的模块或单元，例如，可以是集中式单元(central unit，CU)，也可以是分布式单元(distributed unit，DU)。无线接入网设备可以是宏基站，也可以是微基站或室内站，还可以是中继节点或施主节点等。本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。在本申请的实施例中，以基站作为无线接入网设备的一个举例进行描述。
终端也可以称为终端设备、用户设备(user equipment，UE)、移动台、移动终端等。终端可以广泛应用于各种场景，例如，设备到设备(device-to-device，D2D)、车物(vehicle to everything，V2X)通信、机器类通信(machine-type communication，MTC)、物联网(internet of things，IOT)、虚拟现实、增强现实、工业控制、自动驾驶、远程医疗、智能电网、智能家具、智能办公、智能穿戴、智能交通、智慧城市等。终端可以是手机、平板电脑、带无线收发功能的电脑、可穿戴设备、车辆、无人机、直升机、飞机、轮船、机器人、机械臂、智能家居设备等。本申请的实施例对终端所采用的具体技术和具体设备形态不做限定，可以采用上述任意实现方式。
基站和终端可以是固定位置的，也可以是可移动的。基站和终端可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上；还可以部署在空中的飞机、气球和人造卫星上。本申请的实施例对基站和终端的应用场景不做限定。
AMF网元，执行移动性管理、接入鉴权/授权等功能。此外，还负责在终端与PCF间传递用户策略。
SMF网元，执行会话管理、PCF下发控制策略的执行、UPF的选择、终端的互联网协议(internet protocol，IP)地址分配等功能。
UPF网元，作为和数据网络的接口UPF，完成用户面数据转发、基于会话/流级的计费统计，带宽限制等功能。
DN，是位于运营商网络之外的网络，运营商网络可以接入多个DN，DN上可部署多种业务，可为终端提供数据和/或语音等服务。例如，DN是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端，DN中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，DN是某公司的内部办公网络，该公司员工的手机或者电脑可为终端，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，上述网元或者功能可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的一个功能模块，本申请实施例对此不作具体限定。
本申请中的会话管理网元、用户面网元、移动性管理网元分别可以是图1(a)或图1(b)中的SMF、UPF、AMF，也可以是未来通信如第六代(6th generation，6G)网络中具有上述SMF、UPF、AMF的功能的网元，本申请对此不限定。在本申请的实施例中，以SMF、UPF、AMF分别作为会话管理网元、用户面网元、移动性管理网元的一个举例进行描述。
为便于理解本申请实施例方案，下面先对本申请实施例中涉及的名词或术语进行解释说明。
一、认证(authentication)
认证是指根据声明者所特有的识别信息，确认声明者的身份。最常见的认证实现方式是通过用户名和密码，但认证方式不限于此。为了确认用户的身份，防止伪造，在安全要求高的场合，经常会使用组合认证(或者叫多因素认证)，也就是同时使用多个认证方式对用户的身份进行校验。对于网络通信而言，认证主要是确认访问网络的用户的身份，判断访问者是否为合法的网络用户。
二、授权(authorization)
从网络通信的角度看，认证用于确认尝试接入网络的用户身份是否合法，而授权则用于指定身份合法的用户所能拥有的网络访问权限，即用户能够访问哪些资源。
三、局域网(local area network，LAN)与5GLAN
局域网是在一个局部的地理范围内(如一个学校、工厂和机关内)，将各种计算机，外部设备和数据库等互相联接起来组成的计算机通信网。随着新兴企业办公模式及智能居家模式的出现，有线局域网和无线局域网显现了其在部署复杂、灵活性、移动性、覆盖范围等方面的不足，这促使局域网技术再发展以适应未来应用对局域网的需求。利用5G移动网络其本身的广覆盖特点，直接提供局域网服务，称之为5G局域网(5G local area network，5GLAN)。
终端通过建立传统的PDU连接解决了终端与数据网络之间的数据交换问题。5G LAN在传统PDU连接的基础上，增加了组(group)的概念，即归属于同一个5G LAN组的终端既能与组对应的数据网络完成数据交换，又能通过UPF直接同组内的其它终端完成数据交换，属于不同group的终端之间相互隔离。通过5G LAN可实现虚拟专网通信。
图2为同一个5G LAN组下的多个终端注册在同一个协议数据单元锚点(PDU session anchor，PSA)UPF的用户面架构。此场景下，由于终端1和终端2归属于同一个5G LAN组，因此PSA UPF除了为终端1、终端2完成与数据网络的数据交换之外，还作为5G LAN组的本地交换(localswitch)节点完成终端1与终端2之间的数据交换。其中，图2中的I-UPF指的是中间UPF(Intermediate UPF)。
图3为同一个5G LAN组下的多个终端注册在多个PSA UPF的用户面架构。此场景下PSA UPF之间增加了N19接口，归属于同一个5G LAN组的终端1、终端2在进行数据交换时，将由终端1、终端2分别对应的PSA UPF通过N19通道完成终端数据的传输。
移动网络内可同时支持多个5G LAN组，同一个组下的终端可相互通信。不同组之间终端相互隔离。
四、二次鉴权
二次鉴权是终端在建立PDU会话时的一个可选的流程，它的作用是在建立PDU会话时，由3GPP网络与DN-AAA服务器交互，对用户的身份进行认证和授权。以下将DN-AAA服务器简称为DN-AAA。其中，DN-AAA可以为数据网络(DN)内，也可以位于数据网络外。
目前，终端在创建会话阶段，由SMF决定是否对终端创建的会话发起二次认证流程，在二次认证流程中，SMF与DN-AAA交互，对终端会话进行认证，DN-AAA通过SMF实现对终端会话的授权，其中授权的内容包括：对于Ethernet类型的PDU会话，DN-AAA可授权PDU会话允许通信的MAC地址列表以及允许通信的VLAN列表。DN-AAA对终端会话的二次认证失败将导致SMF拒绝终端的会话建立请求，最终将可能导致终端会话创建失败。
目前的3GPP二次认证，认证的时机在终端会话创建阶段，认证的对象是终端，认证失败将导致终端会话创建失败。二次认证成功后，则会话管理网元可以接受终端的会话建立请求，从而终端可以完成创建会话。图4为5G LAN架构示意图。终端创建Ethernet类型的PDU会话，此时仅仅是建立Ethernet类型的PDU数据通道，真正使用该通道发送报文的设备是接入到该终端的通信设备(如通信设备1、通信设备2等)。具体是哪个通信设 备会接入到终端下，不能在终端创建会话阶段确定，且同一个通信设备可能会切换其接入的终端。为保证网络安全，这些通信设备在通过终端发送业务数据报文之前，需要经过DN-AAA的认证授权，确定其访问网络资源的合法性。然而，现有的3GPP二次认证不能实现在终端完成会话创建后，对终端下的通信设备的认证授权。
为解决上述问题，本申请实施例提供相应的认证方法，可以实现对接入到终端的通信设备进行认证，从而保证只有经过认证的通信设备才可以通过终端，使用3GPP网络进行通信。具体的，在终端的会话建立完成之后，即建立了数据通道，比如该数据通道可以是前述的PDU数据通道，然后再对接入到该终端的通信设备进行认证，只有认证成功的通信设备才可以使用该数据通道进行数据收发。
本申请实施例中的通信设备可以是工业现场网中的设备，如机械臂、工业控制器等。
本申请实施例中的第一集合包含免认证的通信设备的标识信息，第二集合包含通信设备对应的授权的VLAN的标识信息，第三集合包含通信设备对应的授权的VLAN的标识信息，第四集合包含第一集合中的免认证的通信设备对应的免授权的VLAN。其中，第二集合与第三集合的区别是：第二集合用于表示本次认证请求之后的授权的VLAN的标识信息，第三集合用于表示历史的认证请求之后的授权的VLAN的标识信息，因此第三集合是可以存储在本地的。
下面结合图5(a)、图5(b)，介绍本申请实施例提供的认证方法。
图5(a)为本申请实施例提供的一种认证方法示意图。该方法包括以下步骤：
步骤501a，终端确定认证指示，该认证指示用于指示对通信设备进行认证。
作为一种实现方法，终端可以在终端建立会话过程中，接收来自SMF的会话配置信息，该会话配置信息中包含该认证指示。其中，SMF获取认证指示的方法，比如可以是：在该终端的会话建立流程中，获取该终端的签约信息，该签约信息中包含该认证指示。
作为另一种实现方法，终端还可以根据终端的本地配置，确定该认证指示。
步骤502a，第一通信设备向终端发送第一报文，相应地，终端接收第一报文。
该第一报文中包含第一通信设备的标识信息，该标识信息可以包括MAC地址，或者包括MAC地址和IP地址。
该第一报文可以是认证请求或数据报文。
可选的，该第一报文中包含第一VLAN。
步骤503a，终端判断该第一通信设备是否为成功认证的通信设备。
比如，终端本地记录有认证成功和/或认证失败的通信设备的相关信息，例如可以以表格的形式记录，从而可以判断第一通信设备是否为成功认证的通信设备。
其中，成功认证，指的是之前认证成功且认证结果仍然有效。
未成功认证，指的是之前没有认证过，或者之前认证过但认证结果为认证失败，或者之前认证成功但认证结果已经失效。
如果第一通信设备是未成功认证的通信设备，则在步骤503a之后执行以下步骤504a。
步骤504a，终端向SMF发送第一请求，相应地，SMF接收第一请求。
该第一请求中包含指示信息和第一通信设备的标识信息，该指示信息指示对第一通信设备进行认证。
根据上述方案，当终端确定第一通信设备是未成功认证的通信设备，则向网络侧发起第一请求，用于请求网络侧对该第一通信设备进行认证，从而可以保证通信设备的通信安 全。
可选的，该上述步骤504a之后，还执行以下步骤505a。
步骤505a，SMF判断第一通信设备是否为免认证的通信设备。
具体的，如果第一通信设备的标识信息属于第一集合，则确定第一通信设备是免认证的通信设备，第一通信设备的标识信息不属于第一集合，则确定第一通信设备不是免认证的通信设备。
其中，SMF获取第一集合的方法，比如可以是：SMF从终端的签约信息中获取第一集合，或者是SMF从本地配置中获取第一集合。
其中，如果第一通信设备不是免认证的通信设备，则在步骤505a之后执行步骤506a至步骤509a。
如果第一通信设备是免认证的通信设备，则在步骤505a之后执行步骤510a至步骤511a。
步骤506a，SMF向认证服务器(以认证服务器为DN-AAA为例)发送认证请求，相应地，认证服务器接收认证请求。
该认证请求中包含第一通信设备的标识信息和认证信息。该认证信息可以包括用户名和/或密码。其中，用户名也称为用户账户。
其中，SMF获取到认证信息的方法包括但不限于以下方法一或方法二：
方法一，终端向第一通信设备发送第二请求，该第二请求用于请求获取第一通信设备的认证信息，终端接收来自第一通信设备的认证信息，然后终端在上述第一请求中携带该认证信息。
方法二，SMF向第一通信设备发送第三请求，该第三请求用于请求获取第一通信设备的认证信息，SMF接收来自第一通信设备的认证信息。
上述方法一是由终端主动从第一通信设备获取认证信息后发送给SMF，上述方法二是由SMF主动从第一通信设备获取认证信息。
DN-AAA收到认证请求后，对该第一通信设备进行认证，例如，DN-AAA可以根据扩展身份验证协议(extensible authentication protocol，EAP)，与第一通信设备交互EAP消息，完成对第一通信设备的认证流程。
DN-AAA完成对第一通信设备的认证之后，可以得到认证结果信息，该认证结果信息是认证成功信息或认证失败信息。
步骤507a，DN-AAA向SMF发送认证响应，相应地，SMF接收认证响应。
该认证响应中包含认证结果信息。
其中，在认证结果信息是认证成功信息的情况下，该认证响应中还包含第二集合，该第二集合是本次认证成功之后生成的与该第一通信设备对应的授权的VLAN的标识信息。
步骤508a，SMF向终端发送第一响应，相应地，终端接收第一响应。
该第一响应中包含对第一通信设备的认证结果信息。
其中，在认证结果信息是认证成功信息的情况下，该第一响应中还包含上述第二集合。
步骤509a，终端判断是否授权该第一通信设备的通信。
在第一响应中的认证结果信息是认证失败信息的情况下，终端拒绝第一通信设备的通信。
在第一响应中的认证结果信息是认证成功信息、且第一报文中包含第一VLAN的标识信息的情况下，如果第二集合中包含第一VLAN的标识信息，则终端授权第一通信设备在 第一VLAN通信，如果第二集合中不包含第一VLAN的标识信息，则终端拒绝第一通信设备的通信。
在第一响应中的认证结果信息是认证成功信息、且第一报文中不包含第一VLAN的标识信息的情况下，则终端从第二集合中选择第二VLAN的标识信息，并授权第一通信设备在第二VLAN通信。
步骤510a，SMF向终端发送第一响应，该第一响应中包含认证结果信息和第四集合。相应的，终端接收第一响应。
该认证结果信息是认证成功信息。
其中，SMF获取第四集合的方法，比如可以是：SMF从终端的签约信息中获取第四集合，或者是SMF从本地配置中获取第四集合。
步骤511a，终端根据第四集合，判断是否授权第一通信设备的通信。
在第一报文中包含第一VLAN的标识信息的情况下，如果第四集合中包含该第一VLAN的标识信息，则终端授权第一通信设备在第一VLAN通信，如果第四集合中不包含该第一VLAN的标识信息，则终端拒绝第一通信设备的通信。
在第一报文中不包含第一VLAN的标识信息的情况下，则终端从第四集合中选择第四VLAN的标识信息，并授权第一通信设备在第四VLAN通信。
如果上述步骤503a中，终端确定第一通信设备是成功认证的通信设备，则在步骤503a之后执行以下步骤512a至步骤513a。
步骤512a，终端确定第三集合。
这里的第三集合是之前对该第一通信设备认证成功之后，从网络侧收到的与该第一通信设备对应的授权的VLAN的标识信息。该第三集合可以存储于终端中，或者存储于SMF中。
终端确定第三集合，可以是从本地获取第三集合，或者是从SMF获取第三集合。
步骤513a，终端根据第三集合，判断是否授权第一通信设备的通信。
在第一报文中包含第一VLAN的标识信息的情况下，如果第三集合中包含该第一VLAN的标识信息，则终端授权第一通信设备在第一VLAN通信，如果第三集合中不包含该第一VLAN的标识信息，则终端拒绝第一通信设备的通信。
在第一报文中不包含第一VLAN的标识信息的情况下，则终端从第三集合中选择第三VLAN的标识信息，并授权第一通信设备在第三VLAN通信。
可选的，在上述步骤509a之后，或者在步骤511a之后，或者在步骤513a之后，还包括以下步骤514a。
步骤514a，终端向第一通信设备发送通知信息。相应地，第一通信设备接收通知信息。
该通知信息用于指示该第一通信设备认证成功或认证失败。
根据上述方案，可以根据第一通信设备是否为成功认证的通信设备和/或是否为免认证的通信设备，对该通信设备授权通信或拒绝通信，从而有助于提升通信安全。
图5(b)为本申请实施例提供的一种认证方法示意图。该方法包括以下步骤：
步骤501b至步骤502b，同上述步骤501a至步骤502a，可参考前述描述。
步骤503b，终端根据第一集合，判断第一通信设备是否为免认证的通信设备。
其中，终端获取第一集合的方法比如可以是：在终端的会话建立流程中，接收来自SMF的会话配置信息，该会话配置信息中包含该第一集合。其中，SMF获取第一集合的方法， 比如可以是：在该终端的会话建立流程中，获取该终端的签约信息，该签约信息中包含该第一集合，或者是SMF从本地配置中获取第一集合。
具体的，如果第一通信设备的标识信息属于第一集合，则确定第一通信设备是免认证的通信设备，第一通信设备的标识信息不属于第一集合，则确定第一通信设备不是免认证的通信设备。
其中，如果第一通信设备不是免认证的通信设备，则在步骤503b之后执行步骤504b。
步骤504b，终端判断该第一通信设备是否为成功认证的通信设备。
比如，终端本地记录有认证成功和/或认证失败的通信设备的相关信息，例如可以以表格的形式记录，从而可以判断第一通信设备是否为成功认证的通信设备。
其中，成功认证和未成功认证的含义，可以参考图5(a)的实施例中的描述。
如果第一通信设备是未成功认证的通信设备，则在步骤504b之后执行以下步骤505b。
步骤505b，同上述步骤504a。
根据上述方案，当终端确定第一通信设备不是免认证的通信设备、且是未成功认证的通信设备，则向网络侧发起第一请求，用于请求网络侧对该第一通信设备进行认证，从而可以保证通信安全。
可选的，该上述步骤505b之后，还执行以下步骤506b至步骤509b。
步骤506b至步骤509b，同上述步骤506a至步骤509a。
如果上述步骤504b中，终端确定第一通信设备是成功认证的通信设备，则在步骤504b之后执行以下步骤510b。
步骤510b，同步骤513a。
如果上述步骤503b中，确定第一通信设备是免认证的通信设备，则在步骤503b之后执行步骤511b至步骤512b。
步骤511b，终端确定第四集合。
其中，终端获取第四集合的方法与步骤503b中描述的终端获取第一集合的方法类似，可以参考前述描述。
步骤512b，同步骤511a。
可选的，在上述步骤509b之后，或者在步骤510b之后，或者在步骤512b之后，还包括以下步骤513b。
步骤513b，同步骤514a。
需要说明的是，作为另一种实现方法，如果在上述步骤503b中确定第一通信设备不是免认证的通信设备，则接着执行步骤505b至步骤509b，以及在步骤509b之后执行步骤513b。如果在上述步骤503b中确定第一通信设备是免认证的通信设备，则接着执行步骤511b至步骤512b，以及在步骤512b之后执行步骤513b。也即该方案是不需要执行上述步骤504b，即无需判断第一通信设备是否为成功认证的通信设备。
根据上述方案，可以根据第一通信设备是否为成功认证的通信设备和/或是否为免认证的通信设备，对该通信设备授权通信或拒绝通信，从而有助于提升通信安全。
该图5(b)的实施例与上述图5(a)的实施例的主要区别是：图5(a)的实施例中由SMF判断第一通信设备是否为免认证的通信设备，图5(b)的实施例中由终端判断第一通信设备是否为免认证的通信设备。
需要说明的是，本申请实施例还适用于通信设备切换接入的终端的场景。比如，第一 通信设备从接入第二终端切换为接入第一终端。比如，上述图5(a)或图5(b)的实施例中的终端是第一终端，则该第二终端是第一通信设备接入该第一终端之前的终端。可选的，第一通信设备在接入到第一终端之后，SMF还可以向第二终端发送删除指示，该删除指示用于指示第二终端删除第二终端上的与第一通信设备对应的授权配置信息，该授权配置信息中包含授权的VLAN。
下面结合具体示例，对上述图5(a)和图5(b)的实施例进行具体说明。其中，以下图6和图7的实施例是上述图5(a)的实施例的具体示例。以下图8和图9的实施例是上述图5(b)的实施例的具体示例。
图6为本申请实施例提供的一种认证方法示意图。该方法实现由终端触发对通信设备的认证，且该方法中SMF可以感知通信设备的免认证信息，该免认证信息包括第一集合，第一集合中包含免认证的通信设备的标识信息。
该方法包括以下步骤：
步骤601，签约5G LAN，且终端加入5G LAN。
需要说明的是，这里以及后续实施例中仅以5G LAN作为示例进行说明。随着通信技术演变，该实施例也可以适用于6G LAN或其它网络。
在终端的签约信息中增加与通信设备有关的认证授权参数，比如认证指示，该认证指示用于指示对接入到该终端的通信设备进行认证，或者该认证指示信息用于指示终端在创建会话后对接入到该终端的通信设备进行认证。
可选的，在终端的签约信息或5G LAN的签约信息中还增加以下信息：免认证的通信设备的标识信息(即第一集合)、免认证的通信设备对应的免授权的VLAN(即第四集合)。
需要说明的是，如果是在5G LAN的签约信息中包含上述第一集合和第四集合，则该5G LAN的签约信息对加入该5G LAN的所有终端都适用，也即5G LAN的签约信息可以作为该5G LAN下的所有终端的签约信息中的一部分。如果是在终端的签约信息中包含上述第一集合和第四集合，则该第一集合和第四集合只适用于该终端，不适用于其它终端。
步骤602，终端注册至网络。
该过程中会触发网络和终端之间鉴权，网络侧的AMF为终端建立移动管理上下文。
步骤603，通信设备向终端发送第一报文，该第一报文是数据报文或认证请求。
该第一报文中包含通信设备的标识信息，可选的，该第一报文中还包含VLAN的标识信息。
可选的，该第一报文中包含单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)和DNN，该S-NSSAI和DNN用于指示承载该第一报文的会话。也即终端可以根据该S-NSSAI和DNN，确定与该S-NSSAI和DNN对应的一个会话，该会话承载通信设备发送的第一报文。该会话可以是PDU会话。
如果该第一报文中没有包含S-NSSAI和DNN，则终端可以根据通信设备接入终端的物理端口，确定承载通信设备发送的第一报文的会话。也即终端上的物理端口与终端的会话之间存在对应关系，当通信设备从终端的某个物理端口接入，则终端确定该物理端口对应的会话，作为承载通信设备发送的第一报文的会话。
或者，当通信设备接入的终端上只有一个会话，则确定该会话为承载通信设备发送的第一报文的会话。
当承载第一报文的会话不存在，则在步骤603之后执行以下步骤604至步骤610。
步骤604，终端发送会话创建请求，用于请求建立PDU会话。
步骤605，SMF从UDM获取终端的签约信息。
其中，终端的签约信息中包含上述认证指示、第一集合和第四集合。
SMF根据终端的签约信息，感知终端归属于5G LAN。若终端创建会话时，该终端归属的5G LAN组的会话没有创建，则触发SMF创建5G LAN组的会话，也即执行以下步骤606至步骤607。
步骤606，SMF从UDM获取5G LAN的签约信息。
可选的，5G LAN的签约信息中包含第一集合和第四集合。
步骤607，SMF与UPF交互，创建5G LAN组的会话。
步骤608，SMF根据终端的签约信息、本地配置以及终端发送的会话创建请求，判断是否对该终端发起二次鉴权。
如果需要对该终端发起二次鉴权，则可以对该终端发起二次鉴权。
步骤609，SMF与UPF交互，创建终端的会话。
步骤610，SMF向终端发送会话配置信息，其中包含认证指示。
SMF完成终端的会话创建后，向终端发送该会话配置信息，其中包含认证指示。其中，认证指示的含义可参考前述描述，不再赘述。
在完成终端的会话创建之后，终端可以获取到认证指示，而SMF可以在上述步骤605中，从终端的签约信息中获取第一集合和第四集合，或者是在上述步骤606中，从5G LAN的签约信息中获取第一集合和第四集合。
如果发送上述第一报文的通信设备是成功认证的通信设备，则终端确定不需要再对该通信设备进行认证。并且终端中存储有之前对该通信设备进行成功认证时网络侧所下发的第三集合，该第三集合中包含授权的VLAN的标识信息。该情形下，如果上述第一报文中包含VLAN的标识信息，则终端判断第三集合中是否包含第一报文中的VLAN，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。如果上述第一报文中不包含VLAN的标识信息，则终端从该第三集合中选择一个VLAN，然后授权该通信设备在该选择的VLAN通信。
如果发送上述第一报文的通信设备是未成功认证的通信设备，则触发终端对该通信设备进行认证。其中，终端对该通信设备进行认证的过程参考以下步骤611至步骤623。其中，未成功认证可以是未认证或认证失败。
步骤611，终端向SMF发送会话修改请求(session modification request)，其中包含会话标识，指示信息和通信设备的标识信息。
可选的，该会话修改请求可以是PDU会话修改请求。
其中，该指示信息用于指示对该通信设备进行认证。
步骤612，SMF判断该通信设备是否免认证。
具体的，当SMF上存储的第一集合中包含该通信设备的标识信息，则确定该通信设备是免认证的通信设备，从而执行以下步骤613a、步骤613b至步骤614。
当SMF上存储的第一集合中不包含该通信设备的标识信息，则确定该通信设备不是免认证的通信设备，从而执行以下步骤615至步骤623。
步骤613a，SMF向UPF发送N4会话修改请求，用于修改终端或5G LAN的N4会话，在终端或5G LAN的N4会话中添加通信设备转发规则，该转发规则允许该通信设备在第 四集合对应的授权范围内通信。
步骤613b，SMF向终端发送会话修改响应，其中包含认证结果信息和第四集合。
该认证结果信息指的是对通信设备进行认证的认证结果信息。由于该通信设备是免认证的，因此该认证结果信息是认证成功信息。
该第四集合的定义参考前述描述。
步骤614，终端判断是否授权该通信设备的通信。
终端收到认证成功信息和第四集合后，判断是否授权该通信设备的通信。
具体的，如果上述第一报文中包含VLAN的标识信息，则终端判断该第四集合中是否包含第一报文中的VLAN，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。
如果上述第一报文中不包含VLAN的标识信息，则终端从该第四集合中选择一个VLAN，然后授权该通信设备在该选择的VLAN通信。
步骤615，SMF向通信设备发送EAP请求(request)消息，用于请求获取通信设备的认证信息。
该认证信息可以包括用户名和/或密码。
步骤616，通信设备向SMF发送EAP响应(response)消息，其中包含通信设备的认证信息。
可选的，上述EAP请求消息可以替换为EAP确认(identify)消息，以及上述EAP响应消息也替换为EAP确认消息。
步骤617，SMF向UPF发送N4会话建立请求。
由于在建立会话之后，已经打通了UPF与DN-AAA之间的通道，因此SMF在建立与UPF之间的N4会话之后，即可以打通SMF与DN-AAA之间的通道。具体实现细节可以参考3GPP 33.501 11.1.2的描述。
步骤618，SMF向DN-AAA发送终端的通用公开签约标识(generic public subscription identity，GPSI)、通信设备的标识信息和通信设备的认证信息。
作为一种实现方法，SMF可以将终端的GPSI、通信设备的标识信息和从通信设备收到的EAP响应/确认消息通过N4会话发送给UPF，然后UPF将终端的GPSI、通信设备的标识信息和EAP响应/确认消息发送给DN-AAA，从而DN-AAA可以获取到终端的GPSI、通信设备的标识信息，以及从EAP响应/确认消息中获取通信设备的认证信息。
步骤619，根据EAP认证协议，完成对通信设备的认证流程。
具体的，DN-AAA根据EAP，与通信设备交互EAP消息，完成对通信设备的认证流程。
步骤620，DN-AAA向SMF发送对通信设备的认证结果信息。
该认证结果信息是认证成功信息或认证失败信息。
可选的，当该认证结果信息是认证成功信息，则DN-AAA还向SMF发送第二集合，该第二集合中包含该通信设备对应的授权的VLAN的标识信息。
步骤621a，SMF向UPF发送N4会话修改请求，用于修改终端或5G LAN的N4会话，在终端或5G LAN的N4会话中添加转发规则，该转发规则允许该通信设备在第二集合对应的授权范围内通信。
步骤621b，SMF向终端发送会话修改响应，其中包含认证结果信息。
可选的，当认证结果信息是认证成功信息，则该会话修改响应还包含上述第二集合。
步骤622，终端判断是否授权该通信设备的通信。
如果认证结果信息是认证成功信息，则终端判断是否授权通信设备的通信。
具体的，如果上述第一报文中包含VLAN的标识信息，则终端判断该第二集合中是否包含第一报文中的VLAN的标识信息，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。
如果上述第一报文中不包含VLAN的标识信息，则终端从该第二集合中选择一个VLAN的标识信息，然后授权该通信设备在该选择的VLAN通信。
步骤623，终端向通信设备发送通知信息。
该步骤可选。
如果第一报文中包含VLAN的标识信息，则该通知信息用于指示该通信设备认证成功或认证失败。
根据上述方案，可以实现在5G LAN下对通信设备进行认证授权。其中，当终端在接收到通信设备发起的第一报文时，可以向3GPP网络发起对通信设备的认证，3GPP网络与DN-AAA交互实现对终端下的通信设备进行认证。
图7为本申请实施例提供的一种认证方法示意图。该方法是在通信设备从接入终端1，切换为接入终端2的过程中，实现对该通信设备的认证。其中，通信设备接入到终端1的过程可以参考图6的实施例的描述。
该方法包括以下步骤：
步骤701，终端2注册至网络。
该过程中会触发网络和终端2之间鉴权，网络侧的AMF为终端2建立移动管理上下文。
步骤702，通信设备向终端2发送第一报文，该第一报文是数据报文或认证请求。
该步骤的具体实现过程，可以参考前述步骤603的描述。
步骤703，当承载通信设备发送的第一报文的会话不存在，则触发终端2创建会话。
该步骤的具体实现过程可以参考前述步骤604至步骤610的描述，不再赘述。
SMF完成终端2的会话创建后，向终端2发送该会话配置信息，其中包含认证指示。其中，认证指示的含义可参考前述描述，不再赘述。
在完成终端2的会话创建之后，终端2可以获取到认证指示，而SMF可以从终端2的签约信息中获取第一集合和第四集合，或者是从5G LAN的签约信息中获取第一集合和第四集合。
在上述步骤702中，通信设备向终端2发送第一报文，该第一报文中包含通信设备的标识信息，可选的，该第一报文中还包含VLAN的标识信息。
如果发送上述第一报文的通信设备是成功认证的通信设备，则终端2确定不需要再对该通信设备进行认证。后续终端2可以根据第三集合判断是否对该通信设备进行授权，具体可以参考图6的实施例中的相关描述。
如果发送上述第一报文的通信设备是未成功认证的通信设备，则触发终端2对该通信设备进行认证。其中，终端2对该通信设备进行认证的过程参考以下步骤704至步骤713。
步骤704，终端2向SMF发送会话修改请求(session modification request)，其中包含会话标识，指示信息和通信设备的标识信息。
可选的，该会话修改请求可以是PDU会话修改请求。
其中，该指示信息用于指示对该通信设备进行认证。
步骤705，SMF判断该通信设备是否免认证。
具体的，当SMF上存储的第一集合中包含该通信设备的标识信息，则确定该通信设备是免认证的通信设备，从而执行以下步骤706至步骤709。
当SMF上存储的第一集合中不包含该通信设备的标识信息，则确定该通信设备不是免认证的通信设备，从而执行以下步骤710至步骤713。
步骤706，SMF向终端1发送删除指示，用于指示终端1删除该通信设备对应的授权配置信息，以实现删除终端1对该通信设备的授权。
步骤707a，SMF向UPF发送N4会话修改请求，用于修改终端1或5G LAN的N4会话，删除通信设备在终端1或5G LAN的N4会话上的转发规则。
步骤707b，SMF向UPF发送N4会话修改请求，用于修改终端2或5G LAN的N4会话，在终端2或5G LAN的N4会话中添加转发规则，该转发规则允许该通信设备在第四集合对应的授权范围内通信。
步骤708，SMF向终端2发送会话修改响应，其中包含认证结果信息和第四集合。
该认证结果信息指的是对通信设备进行认证的认证结果信息。由于该通信设备是免认证的，因此该认证结果信息是认证成功信息。
该第四集合的定义参考前述描述。
步骤709，终端2判断是否授权该通信设备的通信。
终端2收到认证成功信息和第四集合后，判断是否授权该通信设备的通信。
具体的，如果上述第一报文中包含VLAN的标识信息，则终端2判断该第四集合中是否包含第一报文中的VLAN的标识信息，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。
如果上述第一报文中不包含VLAN的标识信息，则终端2从该第四集合中选择一个VLAN的标识信息，然后授权该通信设备在该选择的VLAN通信。
步骤710，SMF向终端1发送删除指示，用于指示终端1删除该通信设备对应的授权配置信息，以实现终端1删除对该通信设备的授权。
步骤711，SMF向UPF发送N4会话修改请求，用于修改终端1或5G LAN的N4会话，删除通信设备在终端1或5G LAN的N4会话上的转发规则。
步骤712，SMF与DN-AAA交互，通知DN-AAA：该通信设备的认证下线。
步骤713，SMF在终端2的会话上发起对该通信设备的认证流程。
该步骤713的具体实现过程可以参考前述步骤615至步骤623的描述，不再赘述。
根据上述方案，已经在终端1上完成认证的通信设备从终端1切换到终端2时，触发终端2对该通信设备重新认证。具体的，SMF收到终端2发起的认证，感知通信设备在终端1存在有效认证，则SMF指示删除终端1上的对该通信设备的授权配置信息，并完成终端2对该通信设备的认证流程。
图8为本申请实施例提供的一种认证方法示意图。该方法实现由终端触发对通信设备的认证，且该方法中终端可以感知通信设备的免认证信息，该免认证信息包括第一集合，第一集合中包含免认证的通信设备的标识信息。
该方法包括以下步骤：
步骤801至步骤809，同前述步骤601至步骤609。
步骤810，SMF向终端发送会话配置信息，其中包含认证指示、第一集合和第四集合。
SMF完成终端的会话创建后，向终端发送该会话配置信息，其中包含认证指示、第一集合和第四集合。其中，认证指示、第一集合和第四集合的含义可参考前述描述，不再赘述。
终端判断发送上述第一报文的通信设备是否属于第一集合，可选的，还判断该通信设备是否为成功认证的通信设备。
如果发送上述第一报文的通信设备属于该第一集合，则确定该通信设备是免认证的通信设备。该情形下，如果上述第一报文中包含VLAN的标识信息，则终端判断第四集合中是否包含第一报文中的VLAN的标识信息，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。如果上述第一报文中不包含VLAN的标识信息，则终端从该第四集合中选择一个VLAN的标识信息，然后授权该通信设备在该选择的VLAN通信。
如果发送上述第一报文的通信设备不属于该第一集合、且该通信设备是成功认证的通信设备，则终端确定不需要再对该通信设备进行认证。并且终端中存储有之前对该通信设备进行成功认证时网络侧所下发的第三集合，该第三集合中包含授权的VLAN的标识信息。该情形下，如果上述第一报文中包含VLAN的标识信息，则终端判断第三集合中是否包含第一报文中的VLAN的标识信息，如果包含则授权该通信设备在该VLAN通信，如果不包含则拒绝该通信设备的通信。如果上述第一报文中不包含VLAN的标识信息，则终端从该第三集合中选择一个VLAN的标识信息，然后授权该通信设备在该选择的VLAN通信。
如果发送上述第一报文的通信设备不属于该第一集合、且该通信设备是未成功认证的通信设备，则触发终端对该通信设备进行认证。其中，终端对该通信设备进行认证的过程参考以下步骤811至步骤822。其中，未成功认证可以是未认证或认证失败。
步骤811，终端向通信设备发送EAP请求消息，用于请求获取通信设备的认证信息。
步骤812，通信设备向终端发送EAP响应消息，其中包含通信设备的认证信息。
该认证信息可以包括用户名和/或密码。
上述步骤811和步骤812为可选步骤。
可选的，上述EAP请求消息可以替换为EAP确认(identify)消息，以及上述EAP响应消息也替换为EAP确认消息。
步骤813，终端向SMF发送会话修改请求，其中包含会话标识，指示信息和通信设备的标识信息。
可选的，如果执行上述步骤811和步骤812，则会话修改请求中还包含认证信息。
可选的，该会话修改请求可以是PDU会话修改请求。
其中，该指示信息用于指示对该通信设备进行认证。
步骤814，SMF向通信设备发送EAP请求消息，用于请求获取通信设备的认证信息。
步骤815，通信设备向SMF发送EAP响应消息，其中包含通信设备的认证信息。
该认证信息可以包括用户名和/或密码。
该步骤814和步骤815为可选步骤。当执行上述步骤811和步骤812，则不需要执行该步骤814和步骤815，当没有执行上述步骤811和步骤812，则执行该步骤814和步骤815。
可选的，上述步骤814的EAP请求消息可以替换为EAP确认(identify)消息，以及上述步骤815的EAP响应消息也替换为EAP确认消息。
步骤816至步骤822，同上述步骤617至步骤623，可参考前述描述。
根据上述方案，可以实现在5G LAN下对通信设备进行认证授权。其中，当终端在接收到通信设备发起的第一报文时，先由终端判断该通信设备是否免认证，如果不是免认证，则向3GPP网络发起对通信设备的认证，3GPP网络与DN-AAA交互实现对终端下的通信设备进行认证。
图9为本申请实施例提供的一种认证方法示意图。该方法是在通信设备从接入终端1，切换为接入终端2的过程中，实现对该通信设备的认证。其中，通信设备接入到终端1的过程可以参考图8的实施例的描述。
该方法包括以下步骤：
步骤901至步骤903，同上述步骤701至703。
在终端2创建会话过程中，SMF向终端2发送的会话配置信息中包含认证指示、第一集合和第四集合。其中，认证指示、第一集合和第四集合的含义可参考前述描述，不再赘述。
终端2判断发送上述第一报文的通信设备是否属于第一集合，可选的，还判断该通信设备是否为成功认证的通信设备。具体的，终端2在判断第一报文的通信设备是否属于第一集合，或者在判断第一报文的通信设备是否属于第一集合以及判断该通信设备是否为成功认证的通信设备之后执行的操作，可以参考图8的实施例中相关描述，不再赘述。
其中，如果发送上述第一报文的通信设备不属于该第一集合、且该通信设备是未成功认证的通信设备，则触发终端2对该通信设备进行认证。终端2对该通信设备进行认证的过程参考以下步骤904至步骤913。
步骤904，终端2向通信设备发送EAP请求消息，用于请求获取通信设备的认证信息。
步骤905，通信设备向终端2发送EAP响应消息，其中包含通信设备的认证信息。
该认证信息可以包括用户名和/或密码。
上述步骤904和步骤905为可选步骤。
可选的，上述EAP请求消息可以替换为EAP确认(identify)消息，以及上述EAP响应消息也替换为EAP确认消息。
步骤906，终端2向SMF发送会话修改请求，其中包含会话标识，指示信息和通信设备的标识信息。
可选的，如果执行上述步骤904和步骤905，则会话修改请求中还包含认证信息。
可选的，该会话修改请求可以是PDU会话修改请求。
其中，该指示信息用于指示对该通信设备进行认证。
步骤907，SMF向通信设备发送EAP请求消息，用于请求获取通信设备的认证信息。
步骤908，通信设备向SMF发送EAP响应消息，其中包含通信设备的认证信息。
该认证信息可以包括用户名和/或密码。
该步骤907和步骤908为可选步骤。当执行上述步骤904和步骤905，则不需要执行该步骤907和步骤908，当没有执行上述步骤904和步骤905，则执行该步骤907和步骤908。
可选的，上述步骤907的EAP请求消息可以替换为EAP确认(identify)消息，以及 上述步骤908的EAP响应消息也替换为EAP确认消息。
步骤909至步骤912，同上述步骤710至步骤713，可参考前述描述。
根据上述方案，已经在终端1上完成认证的通信设备从终端1切换到终端2时，触发终端2对该通信设备重新认证。具体的，当终端2判断通信设备需要认证，则向SMF发起设备认证，SMF收到终端2发起的设备认证，感知通信设备在终端1存在有效认证，则SMF指示终端1删除终端1上的对该通信设备的授权配置信息，并由终端2完成对该通信设备的认证流程。
可以理解的是，为了实现上述实施例中功能，会话管理网元和终端包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本申请中所公开的实施例描述的各示例的单元及方法步骤，本申请能够以硬件或硬件和计算机软件相结合的形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用场景和设计约束条件。
图10和图11为本申请的实施例提供的可能的通信装置的结构示意图。这些通信装置可以用于实现上述方法实施例中会话管理网元(SMF)或终端的功能，因此也能实现上述方法实施例所具备的有益效果。在本申请的实施例中，该通信装置可以是会话管理网元和终端，也可以是应用于终端或会话管理网元的模块(如芯片)。
如图10所示，通信装置1000包括处理单元1010和收发单元1020。通信装置1000用于实现上述图5(a)、图5(b)、图6至图9中所示的方法实施例中会话管理网元或终端的功能。收发单元1020进行接收和/或发送，处理单元1010执行处理除了收发之外的操作。
比如，当通信装置1000用于实现图5(a)、图5(b)、图6至图9所示的方法实施例中终端的功能时：处理单元1010，用于确定认证指示，该认证指示用于指示对通信设备进行认证；收发单元1020，用于接收来自第一通信设备的第一报文，该第一报文中包含第一通信设备的标识信息；当该第一通信设备是未成功认证的通信设备，或者当该第一通信设备是未成功认证的通信设备且第一集合中不包含该第一通信设备的标识信息，向会话管理网元发送第一请求，该第一请求中包含指示信息和该第一通信设备的标识信息，该指示信息指示对该第一通信设备进行认证；该第一集合中包含免认证的通信设备的标识信息。
当通信装置1000用于实现图5(a)、图5(b)、图6至图9所示的方法实施例中会话管理网元的功能时：处理单元1010，用于确定认证指示，该认证指示用于指示对通信设备进行认证；向第一终端发送该认证指示；收发单元1020，用于接收来自该第一终端的第一请求，该第一请求中包含指示信息和第一通信设备的标识信息，该指示信息指示对该第一通信设备进行认证；向该第一终端发送第一响应，该第一响应中包含对该第一通信设备的认证结果信息。
有关上述处理单元1010和收发单元1020更详细的描述可以直接参考图5(a)、图5(b)、图6至图9所示的方法实施例中相关描述直接得到，这里不加赘述。
如图11所示，通信装置1100包括处理器1110和接口电路1120。处理器1110和接口电路1120之间相互耦合。可以理解的是，接口电路1120可以为收发器或输入输出接口。可选的，通信装置1100还可以包括存储器1130，用于存储处理器1110执行的指令或存储处理器1110运行指令所需要的输入数据或存储处理器1110运行指令后产生的数据。
当通信装置1100用于实现图5(a)、图5(b)、图6至图9所示的方法时，处理器1110用于实现上述处理单元1010的功能，接口电路1120用于实现上述收发单元1020的功能。
当上述通信装置为应用于终端的芯片时，该终端芯片实现上述方法实施例中终端的功能。该终端芯片从终端中的其它模块(如射频模块或天线)接收信息，该信息是基站发送给终端的；或者，该终端芯片向终端中的其它模块(如射频模块或天线)发送信息，该信息是终端发送给基站的。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器、闪存、只读存储器、可编程只读存储器、可擦除可编程只读存储器、电可擦除可编程只读存储器、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于基站或终端中。当然，处理器和存储介质也可以作为分立组件存在于基站或终端中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行所述计算机程序或指令时，全部或部分地执行本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、基站、用户设备或者其它可编程装置。所述计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘；还可以是半导体介质，例如，固态硬盘。该计算机可读存储介质可以是易失性或非易失性存储介质，或可包括易失性和非易失性两种类型的存储介质。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系；在本申请的公式中，字符“/”，表示前后关联对象是一种“相除”的关系。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先 后，各过程的执行顺序应以其功能和内在逻辑确定。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。本申请说明书的上述描述可以使得本领域技术任何可以利用或实现本申请的内容，任何基于所公开内容的修改都应该被认为是本领域显而易见的，本申请所描述的基本原则可以应用到其它变形中而不偏离本申请的发明本质和范围。因此，本申请所公开的内容不仅仅局限于所描述的实施例和设计，还可以扩展到与本申请原则和所公开的新特征一致的最大范围。

Claims (50)

  1. 一种认证方法，应用于终端，其特征在于，包括：
    确定认证指示，所述认证指示用于指示对通信设备进行认证；
    接收来自第一通信设备的第一报文，所述第一报文中包含第一通信设备的标识信息；
    当所述第一通信设备是未成功认证的通信设备，或者当所述第一通信设备是未成功认证的通信设备且第一集合中不包含所述第一通信设备的标识信息，向会话管理网元发送第一请求，所述第一请求中包含指示信息和所述第一通信设备的标识信息，所述指示信息指示对所述第一通信设备进行认证；所述第一集合中包含免认证的通信设备的标识信息。
  2. 如权利要求1所述的方法，其特征在于，还包括：
    接收来自所述会话管理网元的第一响应，所述第一响应中包含所述第一通信设备的标识信息、认证成功信息和第二集合，所述第二集合中包含所述第一通信设备对应的授权的虚拟局域网VLAN的标识信息。
  3. 如权利要求2所述的方法，其特征在于，所述第一报文中包含第一VLAN的标识信息；所述方法还包括：
    当所述第二集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，
    当所述第二集合中不包含所述第一VLAN的标识信息，拒绝所述第一通信设备的通信。
  4. 如权利要求2所述的方法，其特征在于，所述方法还包括：
    从所述第二集合中选择第二VLAN的标识信息；
    授权所述第一通信设备在所述第二VLAN通信。
  5. 如权利要求1至4中任一项所述的方法，其特征在于，在向所述会话管理网元发送所述第一请求之前，还包括：
    向所述第一通信设备发送第二请求，所述第二请求用于请求获取所述第一通信设备的认证信息；
    接收来自所述第一通信设备的所述认证信息；
    其中，所述第一请求中还包含所述认证信息。
  6. 如权利要求5所述的方法，其特征在于，
    所述认证信息包括用户名和/或密码。
  7. 如权利要求1所述的方法，其特征在于，所述第一报文中包含第一VLAN的标识信息；所述方法还包括：
    确定第三集合，所述第三集合中包含所述第一通信设备对应的授权的VLAN的标识信息；
    当所述第一通信设备是成功认证的通信设备且第三集合中包含所述第一VLAN的标识信息，或者当所述第一集合中不包含所述第一通信设备的标识信息、所述第一通信设备是成功认证的通信设备且第三集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，
    当所述第一通信设备是成功认证的通信设备且第三集合中不包含所述第一VLAN的标识信息，或者当所述第一集合中不包含所述第一通信设备的标识信息、所述第一通信设备是成功认证的通信设备且第三集合中不包含所述第一VLAN的标识信息，拒绝所述第一 通信设备的通信。
  8. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    确定第三集合，所述第三集合中包含所述第一通信设备对应的授权的VLAN的标识信息；
    当所述第一通信设备是成功认证的通信设备，或者当所述第一集合中不包含所述第一通信设备的标识信息且所述第一通信设备是成功认证的通信设备，从所述第三集合中选择第三VLAN的标识信息；
    授权所述第一通信设备在所述第三VLAN通信。
  9. 如权利要求1所述的方法，其特征在于，所述第一报文中包含第一VLAN的标识信息；
    所述方法还包括：
    确定第四集合，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；
    当所述第四集合中包含所述第一VLAN的标识信息，或者当所述第一集合中包含所述第一通信设备的标识信息且所述第四集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，
    当所述第四集合中不包含所述第一VLAN的标识信息，或者当所述第一集合中包含所述第一通信设备的标识信息且所述第四集合中不包含所述第一VLAN的标识信息，拒绝所述第一通信设备的通信。
  10. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    确定第四集合，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；
    从所述第四集合中选择第四VLAN的标识信息；或者，当所述第一集合中包含所述第一通信设备的标识信息，从所述第四集合中选择第四VLAN的标识信息；
    授权所述第一通信设备在所述第四VLAN通信。
  11. 如权利要求1至10中任一项所述的方法，其特征在于，所述确定认证指示，包括：
    接收来自所述会话管理网元的会话配置信息，所述会话配置信息中包含所述认证指示。
  12. 一种认证方法，应用于会话管理网元，其特征在于，包括：
    确定认证指示，所述认证指示用于指示对通信设备进行认证；
    向第一终端发送所述认证指示；
    接收来自所述第一终端的第一请求，所述第一请求中包含指示信息和第一通信设备的标识信息，所述指示信息指示对所述第一通信设备进行认证；
    向所述第一终端发送第一响应，所述第一响应中包含对所述第一通信设备的认证结果信息。
  13. 如权利要求12所述的方法，其特征在于，向所述第一终端发送第一响应之前，还包括：
    向认证服务器发送认证请求，所述认证请求中包含所述第一通信设备的标识信息和认证信息；
    接收来自所述认证服务器的认证响应，所述认证响应中包含所述认证结果信息。
  14. 如权利要求13所述的方法，其特征在于，
    在所述认证结果信息是认证成功信息的情况下，所述认证响应中还包含第二集合，所述第二集合中包含所述第一通信设备对应的授权的虚拟局域网VLAN的标识信息；
    则所述第一响应中还包含所述第二集合。
  15. 如权利要求13或14所述的方法，其特征在于，所述第一请求中还包含所述第一通信设备的认证信息。
  16. 如权利要求13或14所述的方法，其特征在于，向所述第一终端发送第一响应之前，还包括：
    向所述第一通信设备发送第三请求，所述第三请求用于请求获取所述第一通信设备的认证信息；
    接收来自所述第一通信设备的所述认证信息。
  17. 如权利要求13至16中任一项所述的方法，其特征在于，向认证服务器发送认证请求之前，还包括：
    确定第一集合，所述第一集合中包含免认证的通信设备的标识信息；
    确定所述第一集合中不包含所述第一通信设备的标识信息。
  18. 如权利要求13至17中任一项所述的方法，其特征在于，
    所述认证信息包括用户名和/或密码。
  19. 如权利要求12所述的方法，其特征在于，向所述第一终端发送第一响应之前，还包括：
    确定第一集合和第四集合，所述第一集合中包含免认证的通信设备的标识信息，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；
    确定所述第一集合中包含所述第一通信设备的标识信息；
    则所述第一响应中还包含所述第四集合，且所述认证结果信息是认证成功信息。
  20. 如权利要求12所述的方法，其特征在于，接收来自所述第一终端的第一请求之前，还包括：
    确定第一集合和第四集合，所述第一集合中包含免认证的通信设备的标识信息，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的虚拟局域网VLAN；
    向所述第一终端发送所述第一集合和所述第四集合。
  21. 如权利要求12至20中任一项所述的方法，其特征在于，所述方法还包括：
    向第二终端发送删除指示，所述删除指示用于指示删除所述第一通信设备对应的授权配置信息，所述第二终端是所述第一通信设备在接入所述第一终端之前所接入的终端，所述授权配置信息中包含授权的VLAN。
  22. 如权利要求12至21中任一项所述的方法，其特征在于，所述确定认证指示，包括：
    在所述第一终端的会话建立流程中，获取所述第一终端的签约信息，所述签约信息中包含所述认证指示。
  23. 如权利要求12至22中任一项所述的方法，其特征在于，所述向第一终端发送所述认证指示，包括：
    向所述第一终端发送会话配置信息，所述会话配置信息中包含所述认证指示。
  24. 一种通信装置，其特征在于，包括：
    处理单元，用于确定认证指示，所述认证指示用于指示对通信设备进行认证；
    收发单元，用于接收来自第一通信设备的第一报文，所述第一报文中包含第一通信设 备的标识信息；当所述第一通信设备是未成功认证的通信设备，或者当所述第一通信设备是未成功认证的通信设备且第一集合中不包含所述第一通信设备的标识信息，向会话管理网元发送第一请求，所述第一请求中包含指示信息和所述第一通信设备的标识信息，所述指示信息指示对所述第一通信设备进行认证；所述第一集合中包含免认证的通信设备的标识信息。
  25. 如权利要求24所述的装置，其特征在于，所述收发单元，还用于接收来自所述会话管理网元的第一响应，所述第一响应中包含所述第一通信设备的标识信息、认证成功信息和第二集合，所述第二集合中包含所述第一通信设备对应的授权的虚拟局域网VLAN的标识信息。
  26. 如权利要求25所述的装置，其特征在于，所述第一报文中包含第一VLAN的标识信息；所述处理单元，还用于当所述第二集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，当所述第二集合中不包含所述第一VLAN的标识信息，拒绝所述第一通信设备的通信。
  27. 如权利要求25所述的装置，其特征在于，所述处理单元，还用于从所述第二集合中选择第二VLAN的标识信息；授权所述第一通信设备在所述第二VLAN通信。
  28. 如权利要求24至27中任一项所述的装置，其特征在于，所述收发单元，还用于在向所述会话管理网元发送所述第一请求之前，向所述第一通信设备发送第二请求，所述第二请求用于请求获取所述第一通信设备的认证信息；接收来自所述第一通信设备的所述认证信息；其中，所述第一请求中还包含所述认证信息。
  29. 如权利要求28所述的装置，其特征在于，所述认证信息包括用户名和/或密码。
  30. 如权利要求24所述的装置，其特征在于，所述第一报文中包含第一VLAN的标识信息；所述处理单元，还用于确定第三集合，所述第三集合中包含所述第一通信设备对应的授权的VLAN的标识信息；当所述第一通信设备是成功认证的通信设备且第三集合中包含所述第一VLAN的标识信息，或者当所述第一集合中不包含所述第一通信设备的标识信息、所述第一通信设备是成功认证的通信设备且第三集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，当所述第一通信设备是成功认证的通信设备且第三集合中不包含所述第一VLAN的标识信息，或者当所述第一集合中不包含所述第一通信设备的标识信息、所述第一通信设备是成功认证的通信设备且第三集合中不包含所述第一VLAN的标识信息，拒绝所述第一通信设备的通信。
  31. 如权利要求24所述的装置，其特征在于，所述处理单元，还用于确定第三集合，所述第三集合中包含所述第一通信设备对应的授权的VLAN的标识信息；当所述第一通信设备是成功认证的通信设备，或者当所述第一集合中不包含所述第一通信设备的标识信息且所述第一通信设备是成功认证的通信设备，从所述第三集合中选择第三VLAN的标识信息；授权所述第一通信设备在所述第三VLAN通信。
  32. 如权利要求24所述的装置，其特征在于，所述第一报文中包含第一VLAN的标识信息；所述处理单元，还用于确定第四集合，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；当所述第四集合中包含所述第一VLAN的标识信息，或者当所述第一集合中包含所述第一通信设备的标识信息且所述第四集合中包含所述第一VLAN的标识信息，授权所述第一通信设备在所述第一VLAN通信；或者，当所述第四集合中不包含所述第一VLAN的标识信息，或者当所述第一集合中包含所述第一通信设 备的标识信息且所述第四集合中不包含所述第一VLAN的标识信息，拒绝所述第一通信设备的通信。
  33. 如权利要求24所述的装置，其特征在于，所述处理单元，还用于确定第四集合，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；从所述第四集合中选择第四VLAN的标识信息；或者，当所述第一集合中包含所述第一通信设备的标识信息，从所述第四集合中选择第四VLAN的标识信息；授权所述第一通信设备在所述第四VLAN通信。
  34. 如权利要求24至33中任一项所述的装置，其特征在于，所述处理单元，具体用于通过所述收发单元接收来自所述会话管理网元的会话配置信息，所述会话配置信息中包含所述认证指示。
  35. 一种认证装置，其特征在于，包括：
    处理单元，用于确定认证指示，所述认证指示用于指示对通信设备进行认证；
    收发单元，用于向第一终端发送所述认证指示；接收来自所述第一终端的第一请求，所述第一请求中包含指示信息和第一通信设备的标识信息，所述指示信息指示对所述第一通信设备进行认证；向所述第一终端发送第一响应，所述第一响应中包含对所述第一通信设备的认证结果信息。
  36. 如权利要求35所述的装置，其特征在于，所述收发单元，还用于向所述第一终端发送第一响应之前，向认证服务器发送认证请求，所述认证请求中包含所述第一通信设备的标识信息和认证信息；接收来自所述认证服务器的认证响应，所述认证响应中包含所述认证结果信息。
  37. 如权利要求36所述的装置，其特征在于，
    在所述认证结果信息是认证成功信息的情况下，所述认证响应中还包含第二集合，所述第二集合中包含所述第一通信设备对应的授权的虚拟局域网VLAN的标识信息；
    则所述第一响应中还包含所述第二集合。
  38. 如权利要求36或37所述的装置，其特征在于，所述第一请求中还包含所述第一通信设备的认证信息。
  39. 如权利要求36或37所述的装置，其特征在于，所述收发单元，还用于向所述第一终端发送第一响应之前，向所述第一通信设备发送第三请求，所述第三请求用于请求获取所述第一通信设备的认证信息；接收来自所述第一通信设备的所述认证信息。
  40. 如权利要求36至39中任一项所述的装置，其特征在于，所述处理单元，在所述收发单元向认证服务器发送认证请求之前，确定第一集合，所述第一集合中包含免认证的通信设备的标识信息；确定所述第一集合中不包含所述第一通信设备的标识信息。
  41. 如权利要求36至40中任一项所述的装置，其特征在于，所述认证信息包括用户名和/或密码。
  42. 如权利要求35所述的装置，其特征在于，所述处理单元，在所述收发单元向所述第一终端发送第一响应之前，确定第一集合和第四集合，所述第一集合中包含免认证的通信设备的标识信息，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的VLAN；确定所述第一集合中包含所述第一通信设备的标识信息；
    则所述第一响应中还包含所述第四集合，且所述认证结果信息是认证成功信息。
  43. 如权利要求35所述的装置，其特征在于，所述处理单元，在所述收发单元接收来 自所述第一终端的第一请求之前，确定第一集合和第四集合，所述第一集合中包含免认证的通信设备的标识信息，所述第四集合中包含所述第一集合中的免认证的通信设备对应的免授权的虚拟局域网VLAN；
    所述收发单元，还用于向所述第一终端发送所述第一集合和所述第四集合。
  44. 如权利要求35至43中任一项所述的装置，其特征在于，所述收发单元，还用于向第二终端发送删除指示，所述删除指示用于指示删除所述第一通信设备对应的授权配置信息，所述第二终端是所述第一通信设备在接入所述第一终端之前所接入的终端，所述授权配置信息中包含授权的VLAN。
  45. 如权利要求35至44中任一项所述的装置，其特征在于，所述处理单元，具体用于在所述第一终端的会话建立流程中，获取所述第一终端的签约信息，所述签约信息中包含所述认证指示。
  46. 如权利要求35至45中任一项所述的装置，其特征在于，所述收发单元，具体用于向所述第一终端发送会话配置信息，所述会话配置信息中包含所述认证指示。
  47. 一种通信装置，其特征在于，包括用于执行如权利要求1至11中任一项所述方法的模块，或用于执行如权利要求12至23中任一项所述方法的模块。
  48. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至11中任一项所述的方法，或用于实现如权利要求12至23中任一项所述的方法。
  49. 一种计算机程序产品，其特征在于，包括计算机程序，当所述计算机程序被通信装置执行时，实现如权利要求1至23中任一项所述的方法。
  50. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至23中任一项所述的方法。
PCT/CN2022/096843 2021-06-30 2022-06-02 一种认证方法及通信装置 WO2023273790A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110736863.5A CN115567934A (zh) 2021-06-30 2021-06-30 一种认证方法及通信装置
CN202110736863.5 2021-06-30

Publications (1)

Publication Number Publication Date
WO2023273790A1 true WO2023273790A1 (zh) 2023-01-05

Family

ID=84692531

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/096843 WO2023273790A1 (zh) 2021-06-30 2022-06-02 一种认证方法及通信装置

Country Status (2)

Country Link
CN (1) CN115567934A (zh)
WO (1) WO2023273790A1 (zh)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109391940A (zh) * 2017-08-02 2019-02-26 华为技术有限公司 一种接入网络的方法、设备及系统
CN109548008A (zh) * 2017-08-15 2019-03-29 华为技术有限公司 网络侧对远端用户设备的识别和控制方法以及设备
CN110086839A (zh) * 2018-01-26 2019-08-02 华为技术有限公司 一种远端设备的动态接入方法及装置
CN110892694A (zh) * 2017-07-26 2020-03-17 黑莓有限公司 用于在互联网协议多媒体子系统中使用中继用户设备的方法和系统
CN111183662A (zh) * 2017-10-05 2020-05-19 黑莓有限公司 通过中继用户设备认证用户设备
WO2020223629A1 (en) * 2019-05-01 2020-11-05 Convida Wireless, Llc Methods for a multi-hop relay in 5g network
CN111955021A (zh) * 2018-04-09 2020-11-17 瑞典爱立信有限公司 5g系统中用于用户平面保护的安全策略的amf控制处理
WO2020259856A1 (en) * 2019-06-28 2020-12-30 Nokia Technologies Oy Apparatus, method and computer program

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110892694A (zh) * 2017-07-26 2020-03-17 黑莓有限公司 用于在互联网协议多媒体子系统中使用中继用户设备的方法和系统
CN109391940A (zh) * 2017-08-02 2019-02-26 华为技术有限公司 一种接入网络的方法、设备及系统
CN109548008A (zh) * 2017-08-15 2019-03-29 华为技术有限公司 网络侧对远端用户设备的识别和控制方法以及设备
CN111183662A (zh) * 2017-10-05 2020-05-19 黑莓有限公司 通过中继用户设备认证用户设备
CN110086839A (zh) * 2018-01-26 2019-08-02 华为技术有限公司 一种远端设备的动态接入方法及装置
CN111955021A (zh) * 2018-04-09 2020-11-17 瑞典爱立信有限公司 5g系统中用于用户平面保护的安全策略的amf控制处理
WO2020223629A1 (en) * 2019-05-01 2020-11-05 Convida Wireless, Llc Methods for a multi-hop relay in 5g network
WO2020259856A1 (en) * 2019-06-28 2020-12-30 Nokia Technologies Oy Apparatus, method and computer program

Also Published As

Publication number Publication date
CN115567934A (zh) 2023-01-03

Similar Documents

Publication Publication Date Title
WO2020048469A1 (zh) 一种通信的方法及装置
WO2017092501A1 (zh) 网络认证方法及系统
WO2021197489A1 (zh) 通信系统、方法及装置
WO2022222745A1 (zh) 一种通信方法及装置
TWI799064B (zh) 一種金鑰標識的生成方法以及相關裝置
WO2021138822A1 (zh) 签约信息获取方法及装置
WO2021254172A1 (zh) 一种通信方法以及相关装置
WO2023185880A1 (zh) 一种接入网设备的确定方法
WO2021087696A1 (zh) 身份认证方法及通信装置
WO2022194262A1 (zh) 安全通信的方法和装置
WO2017129101A1 (zh) 路由控制方法、装置及系统
KR20220133042A (ko) 무선 통신 시스템에서 무인 항공기의 인증을 지원하는 통신 방법 및 장치
WO2023246942A1 (zh) 通信方法及装置
JP2023552486A (ja) 目標情報の取得方法、送信方法、装置、デバイス及び記憶媒体
WO2023124875A1 (zh) 一种通信方法及装置
WO2023273790A1 (zh) 一种认证方法及通信装置
WO2020208295A1 (en) Establishing secure communication paths to multipath connection server with initial connection over private network
WO2023016160A1 (zh) 一种会话建立方法和相关装置
CN103973570B (zh) 一种报文传输的方法、ap及系统
WO2022217571A1 (zh) 网络切片的鉴权方法及装置、设备和存储介质
WO2021169683A1 (zh) 一种通信的方法及装置
WO2021132087A1 (ja) Ａｍｆノード及びその方法
WO2021195816A1 (zh) 一种通信方法、装置及系统
WO2023065826A1 (zh) 一种通信方法及通信装置
WO2024032290A1 (zh) 会话建立方法、装置、网络设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22831611

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22831611

Country of ref document: EP

Kind code of ref document: A1