CN109151950B

CN109151950B - Access control method, network equipment and terminal equipment

Info

Publication number: CN109151950B
Application number: CN201710459461.9A
Authority: CN
Inventors: 娄崇; 毕皓; 韩锋; 晋英豪
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2017-06-16
Filing date: 2017-06-16
Publication date: 2021-09-07
Anticipated expiration: 2037-06-16
Also published as: CN109151950A; WO2018228517A1

Abstract

The embodiment of the application discloses an access control method, which is used for reducing the complexity of network slice access control. The method of the embodiment comprises the following steps: a first network device sends a first message to a terminal device, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one radio access network slice; and the first network equipment sends access control information to the terminal equipment. The embodiment of the application also provides the network equipment and the terminal equipment.

Description

Access control method, network equipment and terminal equipment

Technical Field

The present application relates to the field of communications, and in particular, to an access control method, a network device, and a terminal device.

Background

In order to cope with various user use cases which are in existence or are about to appear, and different user use cases have obvious difference on the requirements of network performance, a network architecture of a Network Slice (NS) is provided as a remarkable characteristic of the fifth generation mobile communication system (5G), such as a New Radio (NR). Software Defined Network (SDN) and Network Function Virtualization (NFV) technologies are core technologies of a network slice architecture, and the NFV technology can implement virtualization of underlying physical resources, load virtual Network Functions (NFs) to a general platform, such as virtual machines, and the SDN technology implements logical connection between virtual machines, and construct a path for carrying signaling and data streams. An end-to-end service chain is configured through dynamic connection between NF of an access network (RAN) and a Core Network (CN), so that a network slice is constructed. Operators can form a specific network function set and contain network resources required by the operation of the network functions according to the requirements of each specific business case on Key Performance Indicators (KPIs) such as capacity, coverage, speed, time delay and reliability, so that required telecommunication service services and network capacity services can be provided, and specific market scenes and requirements can be met.

As shown in fig. 1, a schematic diagram of supporting multiple network slices for 3 GPP. The third generation partnership project (3 GPP) has classified the main types of 5G network slices into the following three major categories: enhanced mobile broadband service (eMBB), massive machine type connectivity (mtc), and ultra-reliable and low latency communications (URLLC). The eMBB is mainly oriented to terminals with high requirements on speed and mobility, such as mobile phones and multimedia devices, and the mMTC is mainly used for Internet of things devices and has large-scale, low-mobility and low-speed requirements. URLLC mainly refers to services and equipment types that have strict requirements on time delay and reliability, such as car networking, security information, and the like. For example, a mobile phone user may access an eMBB-type network slice to download or watch a 4K high-definition video at a high speed, and a sensor device may access an mtc network slice to transmit a small data packet and update system configuration. The user equipment can be accessed to one or more or all network slices simultaneously, thereby meeting the service requirements and achieving better user experience.

If the current network has congestion, the Access connection or service request of User Equipment (UE) can be limited through Access control, so as to manage the network load and achieve the purpose of relieving the network congestion. The current access control scheme has the problems of complex access control, poor compatibility, high system overhead and the like.

Disclosure of Invention

The embodiment of the application provides an access control method, network equipment and terminal equipment, which are used for reducing the complexity of network slice access control.

The wireless communication system applied in the embodiment of the present application may include a first network device, a terminal device, and a second network device, where the terminal device takes UE, the first network device takes RAN, and the second network device takes CN as an example for description. That is, the wireless communication system may include an Access Network (RAN) device, a Core Network (CN) device, and a User Equipment (UE). The communication system of the embodiment of the application supports a network slice architecture, and the core network slices in the communication system can share the core network devices and/or the core network resources and can monopolize the core network devices and/or the core network resources. In the wireless communication system, a UE accesses one or more RAN network slices or CN network slices through a RAN device. Specifically, the RAN device selects an AMF for the UE according to information provided by the UE and configured or acquired Access and Mobility Management Function (AMF) information.

A first aspect of an embodiment of the present application provides an access control method, which may include: a first network device sends a first message to a terminal device, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one Radio Access Network (RAN) network slice; and the first network equipment sends access control information to the terminal equipment. In the embodiment of the present application, since the RAN network slice and the core network CN network slice are generally in a one-to-many mapping relationship, information of at least one RAN network slice is included in the first mapping rule sent by the RAN to the UE, and compared with the prior art, configuration content of the first mapping rule in the embodiment of the present application is smaller, and complexity is lower.

With reference to the first aspect of the embodiment of the present application, in a first implementation manner of the first aspect of the embodiment of the present application, the first mapping rule and the access control information are used to perform access control on the terminal device. In this embodiment of the present application, the first mapping rule and the access control information sent by the RAN to the UE may be used for the UE to perform access control and initiate access of a network slice. And the information of at least one RAN network slice is included in the first mapping rule, and because the information of the RAN network slice is generally in one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower.

With reference to the first aspect of the embodiment of the present application, the first implementation manner of the first aspect, and in a second implementation manner of the first aspect of the embodiment of the present application, the method may further include: the first network device receives a second message from a second network device, the second message including a second mapping rule, the second mapping rule including at least one CN access category, and the first mapping rule further including a mapping relationship between information of the at least one RAN network slice and the at least one CN access category. In the embodiment of the present application, the at least one CN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., an access class of the UE, information of at least one CN network slice, an application, a traffic category, etc.) included in the mapping rule. The information of the at least one RAN network slice is determined according to the at least one access category because the RAN maintains a preset mapping relationship of the information of the RAN network slice and the information of the CN network slice. The RAN may determine information of at least one CN network slice from information of currently available CN network slices, the information of at least one CN network slice corresponding to at least one CN class, and therefore, the second mapping rule may include a mapping relationship between the information of at least one RAN network slice and the at least one CN access class. An optional implementation manner of the second mapping rule is provided, and the first mapping rule may further include a mapping relationship between information of the at least one RAN network slice and the at least one CN access category, which increases flexibility of the scheme of the present application.

With reference to the first aspect of the embodiment of the present application, the first implementation manner of the first aspect, and in a third implementation manner of the first aspect of the embodiment of the present application, the method may further include: the first network device receives a third message from a second network device, where the third message includes a CN network Allowed network slice selection assistance information Allowed by the CN network, and the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and the CN Allowed nsai list. In the embodiment of the present application, the information of the at least one CN network slice is determined according to a CN Allowed NSSAI list, and the RAN stores a mapping relationship between preset information of the RAN network slice and information of the CN network slice, so that the information of the at least one CN network slice may be determined according to the information of the at least one CN network slice. An implementation manner that the second mapping rule is optional is provided, and the first mapping rule may further include a mapping relationship between the information of the at least one RAN network slice and the CN Allowed NSSAI list, so that flexibility of the scheme of the present application is increased.

With reference to the first aspect of the embodiment of the present application, the first implementation manner of the first aspect, and in a fourth implementation manner of the first aspect of the embodiment of the present application, the method may further include: the first network device receives a fourth message from a second network device, where the fourth message includes a second mapping rule and a CN network Allowed network slice selection assistance information Allowed nsai list, the second mapping rule includes at least one CN access category, and the first mapping rule further includes information of the at least one RAN network slice, and a mapping relationship between the at least one CN access category and the CN Allowed nsai list. In the embodiment of the present application, the information of the at least one CN network slice is determined according to a CN Allowed NSSAI list, and the RAN stores a mapping relationship between preset information of the RAN network slice and information of the CN network slice, so that the information of the at least one RAN network slice can be determined according to the information of the at least one CN network slice, and the at least one CN access category corresponds to the CN Allowed NSSAI list. An implementation manner that the second mapping rule is optional is provided, and the first mapping rule may further include information of the at least one RAN network slice, and a mapping relationship between the CN Allowed NSSAI list and at least one CN access category, which increases flexibility of the scheme of the present application.

The CN may select, according to factors such as CN Allowed network slice selection assistance information (CN NSSAI) reported by the UE, subscription information of the UE, a local policy, and availability of a network slice, information of at least one CN network slice that the UE is Allowed to access in the current registration area, where the information of the at least one CN network slice may be presented in a form of a list, which may be referred to as a CN Allowed NSSAI (CN Allowed NSSAI) list, or may be presented in other forms, which is not limited specifically.

With reference to the first aspect of the embodiment of the present application, the first implementation manner to the second implementation manner of the first aspect, in a fifth implementation manner of the first aspect of the embodiment of the present application, the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and information of a currently available CN network slice. In the embodiment of the present application, the information of at least one CN network slice is determined by the RAN according to the information of currently available CN network slices, and another implementation manner that the second mapping rule is optional is provided, so that the flexibility of the scheme of the present application is increased.

With reference to the fourth implementation manner of the first aspect of the embodiment of the present application, in a fifth implementation manner of the first aspect of the embodiment of the present application, the first mapping rule further includes mapping relationships between the information of the at least one RAN network slice, the information of a currently available CN network slice, and at least one CN access category. In the embodiment of the present application, the information of at least one CN network slice is determined by the RAN according to the information of currently available CN network slices, and another implementation manner that the second mapping rule is optional is provided, so that the flexibility of the scheme of the present application is increased.

With reference to the first aspect of the embodiment of the present application, the first implementation manner to the fifth implementation manner of the first aspect, and in a sixth implementation manner of the first aspect of the embodiment of the present application, the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and at least one RAN access category. In this embodiment, the at least one RAN access category is an access category of RAN reconfiguration, and may be understood as an index for looking up access control information corresponding to at least one factor (e.g., information of at least one RAN network slice, etc.) included in the second mapping rule. Another optional implementation manner of the second mapping rule is provided, and the flexibility of the scheme of the application is increased.

With reference to the first aspect of the embodiment of the present application, the first implementation manner to the sixth implementation manner of the first aspect, in a seventh implementation manner of the first aspect of the embodiment of the present application, the first mapping rule further includes information of the at least one RAN network slice, and a mapping relationship between a CN Allowed NSSAI list and a RAN access category. In the embodiment of the present application, the information of the at least one CN network slice is determined by the RAN according to the CN Allowed NSSAI list, and another implementation manner that the second mapping rule is selectable is provided, so that the flexibility of the scheme of the present application is increased.

With reference to the first aspect of the embodiment of the present application, in an eighth implementation manner of the first aspect of the present application, the first mapping rule further includes mapping relationship between information of the at least one RAN network slice, information of currently available CN network slices, and RAN access categories. In the embodiment of the present application, the information of at least one CN network slice is determined by the RAN according to the information of currently available CN network slices, and another implementation manner that the second mapping rule is optional is provided, so that the flexibility of the scheme of the present application is increased.

It should be noted that, in any one of the first to eighth possible implementation manners, the information of the at least one RAN network slice included in the second mapping rule may have a mapping relationship with at least one RAN access category, or a CN Allowed nsai list and at least one RAN access category, or information of a currently available CN network slice, or at least one CN access category. However, the second mapping rule may not include at least one RAN access category, or a CN Allowed nsai list and at least one RAN access category, or information of currently available CN network slices, or at least one CN access category, and the RAN only needs to know that they have a mapping relationship, which is not limited in detail.

A second aspect of the present application provides an access control method, which may include: a terminal device receives a first message from a first network device, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one Radio Access Network (RAN) network slice; and the terminal equipment receives the access control information from the first network equipment. In the embodiment of the present application, because the information of the RAN network slice and the information of the CN network slice are generally in a one-to-many mapping relationship, the information of at least one RAN network slice is included in the first mapping rule sent by the RAN to the UE, and compared with the prior art, the configuration content of the first mapping rule in the embodiment of the present application is smaller and the complexity is lower.

With reference to the second aspect of the embodiment of the present application, in a first implementation manner of the second aspect of the embodiment of the present application, the method further includes: and the terminal equipment performs access control according to the first mapping rule and the access control information. In this embodiment of the present application, the UE may perform the access control check according to the information of the at least one RAN network slice, because the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is also achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

With reference to the second aspect of the embodiment of the present application, the first implementation manner of the second aspect, in the second implementation manner of the second aspect of the embodiment of the present application, the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and at least one RAN access category. In the embodiment of the present application, the UE may perform access control check according to the information of the at least one RAN network slice or the at least one RAN access category, so that the selectivity and flexibility of the technical solution of the present application are improved. Control of RAN network slice granularity is also achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

With reference to the second aspect of the embodiment of the present application, the first implementation manner of the second aspect, and in a third implementation manner of the second aspect of the embodiment of the present application, the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and at least one CN access category. In the embodiment of the present application, the UE may perform access control check according to the information of the at least one RAN network slice or the at least one CN access category, so that the selectivity and flexibility of the technical solution of the present application are improved. Control of RAN network slice granularity is also achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

With reference to the second aspect of the embodiment of the present application, the first implementation manner of the second aspect, and in a fourth implementation manner of the second aspect of the embodiment of the present application, the first mapping rule further includes a mapping relationship between information of the at least one RAN network slice and information of the at least one CN network slice. In the embodiment of the present application, the UE may perform access control check according to the information of the at least one RAN network slice or the information of the at least one CN network slice, so that the selectivity and flexibility of the technical solution of the present application are improved. Control of RAN network slice granularity is also achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

With reference to the second aspect of the embodiment of the present application, the first implementation manner of the second aspect, and in a fifth implementation manner of the second aspect of the embodiment of the present application, the first mapping rule further includes mapping relationship between information of the at least one RAN network slice, information of the at least one CN network slice, and at least one RAN access category. In the embodiment of the present application, the at least one CN network slice information may be determined by the RAN according to a CN Allowed NSSAI list or a currently available CN network slice. The UE may perform access control checking of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control checking of the RAN network slice according to the at least one RAN access category, or may perform access control checking of the RAN network slice according to the at least one CN access category. Because the information of the RAN network slice is generally in one-to-many relationship with the information of the CN network slice, the control of the granularity of the RAN network slice is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type is mapped on the information of the RAN network slice of the RAN in most cases to be the same.

With reference to the second aspect of the embodiment of the present application, the first implementation manner of the second aspect, and in a sixth implementation manner of the second aspect of the embodiment of the present application, the first mapping rule further includes mapping relationship between information of the at least one RAN network slice, information of the at least one CN network slice, and the at least one CN access category. In the embodiment of the present application, the UE may perform access control check of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control check of the CN network slice according to the information of the at least one CN network slice, thereby improving the selectivity and flexibility of the technical solution of the present application. The control of RAN network slice granularity is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type mapped on the RAN network slice of the RAN is mostly the same.

A third aspect of the present embodiment provides an access control method, which may include: the second network device sends a second message to the first network device, the second message including a second mapping rule, the second mapping rule including at least one CN access category. In this embodiment of the present application, the second mapping rule includes at least one CN access category, which can be used for being identified by the RAN, and determines the information of the at least one CN network slice according to a preset mapping relationship between the information of the RAN network slice and the information of the CN network slice, which provides an implementable manner.

With reference to the third aspect of the embodiment of the present application, in a first possible implementation manner of the third aspect of the embodiment of the present application, the second message includes a CN network slice selection assistance information Allowed NSSAI list. In this embodiment, if the second message includes the CN network slice selection assistance information Allowed NSSAI list, the RAN may determine the information of the at least one CN network slice directly according to the CN Allowed NSSAI list, so as to determine the information of the at least one RAN network slice in the second mapping rule, which provides an achievable way.

With reference to the first possible implementation manner of the third aspect of the embodiment of the present application, in a second possible implementation manner of the third aspect of the embodiment of the present application, the second mapping rule includes a mapping relationship between the at least one CN access category and the CN Allowed NSSAI list.

A fourth aspect of the embodiments of the present application provides a network device, which has a function of reducing complexity of network slice access control. The function can be realized by hardware, and can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

A fifth aspect of the embodiments of the present application provides a terminal device, which has a function of reducing complexity of network slice access control. The function can be realized by hardware, and can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

A sixth aspect of the present embodiment provides a network device, having a function of reducing complexity of network slice access control. The function can be realized by hardware, and can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

A seventh aspect of the embodiments of the present application provides a network device, which may include:

a memory, a transceiver, the memory and the transceiver connected by a bus;

the memory is used for storing operation instructions;

the transceiver is configured to send a first message to a terminal device by invoking the operation instruction, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one RAN network slice; and sending access control information to the terminal equipment.

An eighth aspect of embodiments of the present application provides a wireless communication apparatus, which may include:

at least one processor, a memory, transceiver circuitry, and a bus system, the processor, the memory, the transceiver circuitry coupled through the bus system, the wireless communication device communicating with a terminal device through the transceiver circuitry, the memory storing program instructions, the at least one processor executing the program instructions stored in the memory to cause the wireless communication device to perform portions of the operations of the first network device in the method according to any one of the embodiments of the present application. The wireless communication device may be a network device, or may be a system chip that is applied to a network-side device to perform a corresponding function.

A ninth aspect of an embodiment of the present application provides a wireless communication apparatus, which may include:

at least one processor, a memory, a transceiver circuit and a bus system, wherein the processor, the memory, the transceiver circuit are coupled through the bus system, the wireless communication apparatus communicates with a network side device through the transceiver circuit, the memory is used for storing program instructions, and the at least one processor is used for executing the program instructions stored in the memory, so that the wireless communication apparatus executes a part of the operation of the terminal device in the method according to any one of the second aspect of the embodiments of the present application. The wireless communication device can be a terminal device, and can also be a system chip which is applied to the terminal device and executes corresponding functions.

A tenth aspect of the embodiments of the present application provides a communication system, where the communication system includes a first network device, a terminal device, and a second network device, where the first network device is the first network device in any one of the optional implementations of the first aspect or the first aspect of the present application; the terminal device is the terminal device executing the second aspect of the present application or any optional implementation manner of the second aspect; the second network device is the second network device that performs the method of the third aspect or any optional implementation manner of the third aspect of the present application.

An eleventh aspect of the embodiments of the present application provides a storage medium, and it should be noted that, in essence, or a part of the technical solution that contributes to the prior art, or all or part of the technical solution may be embodied in the form of a software product, where the computer software product is stored in a storage medium, and is used for storing computer software instructions for the above-mentioned apparatuses, and includes a program designed for executing the first aspect, the second aspect, or the third aspect for a first network apparatus, a terminal apparatus, or a second network apparatus.

The storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

A twelfth aspect of embodiments of the present application provides a computer program product comprising instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect of the present application or any one of the alternative implementations of the first aspect.

A thirteenth aspect of embodiments of the present application provides a computer program product containing instructions which, when run on a computer, cause the computer to perform a method as described in the second aspect of the present application or any one of the alternative implementations of the second aspect.

A fourteenth aspect of embodiments of the present application provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the method as described in the third aspect or any one of the alternative implementations of the third aspect of the present application.

According to the technical scheme, the embodiment of the application has the following advantages:

in the embodiment of the application, a first message is sent to a terminal device through a first network device, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one RAN network slice; and the first network equipment sends access control information to the terminal equipment. Since the information of the RAN network slice and the information of the CN network slice are generally in a one-to-many mapping relationship, the RAN sends the first mapping rule to the UE, where the first mapping rule includes information of at least one RAN network slice, and compared with the prior art, the configuration content of the first mapping rule in the embodiment of the present application is smaller and the complexity is lower.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the embodiments and the drawings used in the description of the prior art, and obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained according to the drawings.

Fig. 1 is a schematic diagram illustrating that a 3GPP supports multiple network slices in an embodiment of the present application;

FIG. 2A is a schematic view of a scenario applied in the embodiment of the present application;

fig. 2B is a block diagram of a wireless communication system applied in the embodiment of the present application;

fig. 3 is a schematic diagram of an embodiment of a method for access control in an embodiment of the present application;

fig. 4 is a schematic diagram of another embodiment of an access control method in the embodiment of the present application;

FIG. 5A is a diagram of an embodiment of a network device in an embodiment of the present application;

fig. 5B is a schematic diagram of another embodiment of a network device in the embodiment of the present application;

fig. 6A is a schematic diagram of an embodiment of a terminal device in the embodiment of the present application;

fig. 6B is a schematic diagram of another embodiment of the terminal device in the embodiment of the present application;

FIG. 7 is a schematic diagram of another embodiment of a network device in the embodiment of the present application;

fig. 8 is a schematic diagram of another embodiment of the terminal device in the embodiment of the present application.

Detailed Description

For a person skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only some embodiments of the present application, and not all embodiments. The embodiments in the present application shall fall within the protection scope of the present application.

The embodiment of the application relates to wireless access network equipment, terminal equipment and core network equipment.

The access network device, which may also be referred to as a base station, is a device deployed in a radio access network to provide a wireless communication function for a terminal device, and includes but is not limited to: macro Base stations of various forms, micro Base stations (also referred to as small stations), relay stations, Transmission Reception Points (TRPs), evolved Node bs (enbs), Radio Network Controllers (RNCs), Node Bs (NBs), Base Station Controllers (BSCs), Base Transceiver Stations (BTSs), Home Base stations (e.g., Home evolved Node bs or Home Node bs, HNBs), and Base Band Units (BBUs) that process communication data, and the like. In systems employing different radio access technologies, the names of radio access network devices having similar wireless communication functions may differ. For convenience of description, in all embodiments of the present application, the above-mentioned apparatus for providing a wireless communication function for a terminal device is collectively referred to as a radio access network device.

The terminal device is also called User Equipment (UE) or a Mobile Station (MS) in a wireless communication standard, and the terminal device referred in this embodiment of the present application is a device having a wireless transceiving function, and may be deployed on a land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water surface (such as a ship and the like); and may also be deployed in the air (e.g., airplanes, balloons, satellites, etc.). The terminal devices may include various types of mobile phones (mobile phones), tablet computers (pads), computers with wireless transceiving functions, wireless data cards, Virtual Reality (VR) terminal devices, Augmented Reality (AR) terminal devices, Machine Type Communication (MTC) terminal devices, a terminal device in industrial control (industrial control), a terminal device in self driving (self driving), a terminal device in remote medical (remote medical), a terminal device in smart grid (smart grid), a terminal device in transportation safety (transportation safety), a terminal device in smart city (smart city), smart home (home devices with wireless communication function, such as refrigerator, television, washing machine or furniture), and a wearable device (such as smart watch, smart bracelet, pedometer, etc.), and the like. The terminal device referred to in this application may also be configured as a fixed location device having a similar wireless communication function as the terminal device described above. In a system using different radio access technologies, names of terminal devices having similar radio communication functions may be different, and for convenience of description, in the embodiments of the present application, the above-mentioned apparatuses having radio communication functions are collectively referred to as terminal devices.

The core network device may be a device having an access and mobility Management network function, a Session Management network function (SMF), a user plane network function, an authentication Management network function, and an AMF.

The term "and/or" appearing in this patent application is merely an associative relationship that describes the associated object, meaning that three relationships may exist, e.g., a and/or B, may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this application generally indicates that the former and latter related objects are in an "or" relationship.

Various objects such as various messages/information/devices/network elements/systems/devices/actions/operations/procedures/concepts may be named in the present patent application, but these specific names do not constitute limitations on related objects, and the named names may vary with factors such as scenes, contexts or usage habits, and understanding of technical meaning of related objects should be mainly determined by the functions and technical effects embodied/performed in the technical solutions.

With the continuous emergence of various communication system services, the requirements of different communication services on network performance are remarkably different, and 5G introduces a concept of network slicing to deal with the difference of the requirements of different communication services on network performance.

A complete network slice includes, but is not limited to, a RAN network slice and a CN network slice, which together construct an end-to-end network slice architecture, and the CN network slice includes, through a set of customized NFs, an Access and Mobility Management Function (AMF), a Session Management Function (SMF), a User Plane Function (UPF), and the like. RAN network slices implement different RAN network slices by scheduling and configuration of a set of different first protocol layers 1 (e.g., physical layer), second protocol layers 2 (e.g., medium access control layer, radio link control layer, data packet aggregation layer, etc.), and so on. The implementation form of the specific RAN network slice is not limited herein, and may be implemented by atomization, modularization, or by way of software, instantiation, etc.

Generally, the CN network slices are more according to different tenants, service types, and the like, while the RAN network slices are fewer due to factors such as limited air interface resources, and the CN network slices and the RAN network slices are in a many-to-one or many-to-many relationship, and in an extreme case, a one-to-one ratio can be achieved.

The current discussion of 3GPP on network architecture mainly focuses on network slice selection, which aims to select a suitable network slice for a UE and associate the UE with a specific network slice, so as to establish a connection of a corresponding control plane CP (CP) and/or user plane UP (UP) with the network slice.

A brief description of access control based on network slicing is provided below, as follows:

the network slices can be regarded as logically independent virtual networks, and different network slices need to meet the requirement of isolation, so that when the load of one network slice is too heavy, negative influence on other network slices needs to be avoided, and therefore, access control based on the network slices can effectively guarantee the isolation of the network slices, thereby meeting the Service requirement signed by an operator and a network slice client, or the requirement of a Service Level Agreement (SLA).

Specifically, the access control may be implemented by limiting the ratio of the UE accessing the network, for example, designing access limiting parameters including access factor and access back-off time (back-off), and limiting the network access of the UE in proportion, so as to achieve the purpose of access control.

At present, the LTE system supports multiple access control technologies, and several implementation manners are known as follows:

1) a common Access restriction Check (ABC) performs Access control according to types of signaling, emergency services, data, and the like, or performs Access control according to different Public Land Mobile Networks (PLMNs);

2) expanding Access Barring (EAB), expanding the common ABC, thereby restricting the Access of the UE with low Access priority;

3) service specific Congestion control for Data Communication (ACDC), which may classify applications and set different access control parameters according to different categories (categories);

4) service Specific Access Control (SSAC) can be applied to multimedia Telephony (Multi Media Telephony) services, including voice, video calls, messaging services, video image sharing, etc.

In one technology, the existing ABC scheme of LTE is applied to network slices, that is, RAN takes CN network slices supported by the network as separate ABC categories, and broadcasts access control information applicable to each CN network slice, thereby implementing access control based on CN network slices; the RAN broadcasts access control information suitable for the CN network slice, such as the access control information of the CN network slice 1 and the access control information of the CN network slice 2; the UE reads the access control information of each CN network slice in the system message, and stores the corresponding access control information in combination with the CN network slice to be connected; the UE performs an access Control check to determine whether a Radio Resource Control (RRC) connection request needs to be initiated.

However, the above technology only adds the category of CN network slices on the basis of the existing LTE, and the technology has high overhead and poor backward compatibility due to the excessive number of CN network slices.

In the 5G system standard making process, an attempt is made to provide a unified access control mechanism (unified access barring), which can design a common architecture, thereby simplifying the 5G access control mechanism.

In this scheme, the CN may configure an Access category to which the UE is applicable, where the configuration includes a mapping rule, for example, the mapping rule includes that aspects such as an Access class of the UE, information of CN network slices, applications, service categories, and the like are mapped to a specific Access category (Access category), which may be referred to as a CN Access category. The CN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., an access class of the UE, information of at least one CN network slice, an application, a traffic category, etc.) included in the mapping rule. Further, the mapping rule may be sent to the UE by the CN through a non-access stratum (NAS) message, and may be delivered during registration or registration area update. The mapping rules may be presented in tabular form, as shown in table 1 below.

TABLE 1

The UE may trigger network access, and then determine a CN access category corresponding to the access according to the obtained configuration information, where the configuration information may include a mapping rule. The RAN indicates CN access control information corresponding to the CN access category through a system message, for example, an access restriction ratio and a restriction time may be used, or a bitmap may be used to indicate whether UE access needs to be restricted. The UE carries out access restriction check, namely before initiating an access attempt, the UE firstly uses the determined CN access category to judge whether the access can be initiated; if the UE decides that the access is not restricted, an access attempt is initiated.

The scheme is uniformly controlled by CN, but the number of CN network slices is too large, and if different EAB/ACDC and different combinations of CN network slices can be mapped to proper access category, the NAS level configuration table is overlarge and has higher complexity; and the CN network slice requested by the UE may be different from the CN network slice allocated by the network. For example, a CN network slice of a tenant requested by the UE is not available in the current area, and the CN allocates a CN network slice which can be replaced by the same CN network slice of another tenant or a CN network slice with the same service type. The granularity of RAN access control is different from CN network slices, resulting in poor flexibility of RAN network slice-based access control.

Fig. 2A is a schematic view of a scenario applied in the embodiment of the present application. In the embodiment of the present application, taking an LTE system as an example, a UE is located in a coverage area of one or more cells (carriers) provided by a macro base station or a small base station, and the number of the cells serving the UE may be one or more. When there are multiple serving cells for the UE, the UE may operate according to Carrier Aggregation (CA) or Dual Connectivity (DC) or coordinated multiple point transmission (CoMP), where at least one cell provides more than one air interface technology format, such as more than one Transmission Time Interval (TTI), more than one subcarrier interval width, more than one cyclic prefix length, and other air interface formats or transmission characteristics, and simultaneously provides radio resources for the UE. The present application is also applicable to a Universal Mobile Telecommunications System (UMTS) System, a Code Division Multiple Access (CDMA) System, a Wireless Local Area Network (WLAN) or a future 5g (radio generation) wireless communication System, and the like.

Fig. 2B is a block diagram of a wireless communication system according to an embodiment of the present application. The network device may include a first network device, a terminal device, and a second network device, where the terminal device is illustrated by using a UE, the first network device is illustrated by using a RAN, and the second network device is illustrated by using a CN as an example. That is, the wireless communication system may include an Access Network (RAN) device 110, a Core Network (CN) device 120, and a User Equipment (UE) 130. The communication system of the embodiment of the application supports a network slice architecture, and the core network slices in the communication system can share the core network devices and/or the core network resources and can monopolize the core network devices and/or the core network resources. As shown in fig. 2B, in the wireless communication system, UE 130 accesses one or more RAN network slices or CN network slices through RAN device 110. Specifically, RAN device 110 selects an AMF for UE 130 based on information provided by UE 130 and configured or obtained Access and Mobility Management Function (AMF) information.

In the embodiment of the application, a first network device sends a first message to a terminal device, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one RAN network slice; and the first network equipment sends access control information to the terminal equipment. The terminal device may perform an access control check according to the received first mapping rule and the access control information. Since the information of the RAN network slice and the information of the CN network slice are generally in a one-to-many mapping relationship, the RAN sends the first mapping rule to the UE, where the first mapping rule includes information of at least one RAN network slice, and compared with the prior art, the configuration content of the first mapping rule in the embodiment of the present application is smaller and the complexity is lower. The problem of CN network slice more, cause NAS level table configuration too big, the complexity is too high is solved. Further, the first mapping rule may further include a mapping relationship between information of the at least one RAN network slice and at least one RAN access category, or the first mapping rule may further include a mapping relationship between information of the at least one RAN network slice and the at least one CN access category, or the first mapping rule may further include a mapping relationship between information of the at least one RAN network slice and at least one RAN access category and at least one CN access category. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved because the information of the same CN network slice or the information of the RAN network slice mapped to the RAN by the service type is mostly the same. RAN-based network slice granularity access control is also achieved.

In the following embodiments, a terminal device, a first network device, and a second network device are described as examples of a RAN and a CN.

The technical solution of the present application is further described below by way of an embodiment, and as shown in fig. 3, an embodiment of a method for access control in the embodiment of the present application is schematically illustrated, which includes:

301. the UE sends the uplink message to the CN.

In the embodiment of the present application, the UE sends an uplink message to the CN through the RAN. The uplink message may be a Non-access stratum (NAS) message such as a registration request or a registration area update request. That is, the UE initiates a registration management request to the CN (for example, the CN may be an access management function, an access and mobility management function, etc.) through the RAN, requests the UE to register with the CN, and completes functions such as identification, authentication, or registration area update.

It should be understood that the NAS message may be any upstream message related to registration management, and is not limited to the NAS message such as the registration request or the registration area update request described above. In a possible implementation manner, the uplink message may carry at least one piece of slice selection assistance information (NSSAI) allowed by the CN network, and is used to assist the CN to select a CN network slice suitable for access for the UE.

302. The CN obtains a first mapping rule, wherein the first mapping rule comprises at least one CN access category.

In this embodiment of the present application, after receiving the uplink message, the CN configures a CN access category applicable to the UE, so as to obtain a first mapping rule, where the first mapping rule includes at least one CN access category. For example, the first mapping rule may include an index for mapping factors such as an Access class of the UE, information of at least one CN network slice, an application, and a service class to a specific Access category (referred to herein as CN Access category), where the CN Access category may be understood as an index for searching Access control information corresponding to at least one factor (e.g., an Access class of the UE, information of at least one CN network slice, an application, and a service class) included in the first mapping rule. Further, the CN access category may be indicated by numbers, letters, bytes, etc., and is not specifically limited in the embodiments of the present application.

Alternatively, the first mapping rule may be presented in a table form, and the first mapping rule does not include information of at least one CN network slice, as shown in table 2 below:

TABLE 2

Optionally, in the first mapping rule, information of at least one CN network slice may be included, as shown in table 3 below:

TABLE 3

It should be noted that table 2 and table 3 are only an example of the first mapping rule, the first mapping rule includes at least one CN access category, and other included factors may be greater than or less than those shown in table 2 and table 3.

Optionally, if the first mapping rule includes information of at least one CN network slice, the information of the at least one CN network slice may be represented by Network Slice Selection Assistance Information (NSSAI) allowed by at least one CN network, specifically, the network slice selection assistance information allowed by the CN network includes but is not limited to the following related information:

network slice type: information indicating a network slice Type, such as enhanced Mobile Broadband service (eMBB), Ultra-Reliable Low latency Communications (URLLC), Massive Machine Type Communications (mtc), and the like. Further, the network slice type may refer to an end-to-end network slice type, which includes a RAN network slice type and a CN network slice type, and may also refer to a RAN network slice type or a CN network slice type.

And (4) service type: information related to a specific service, such as a video service, a car networking service, a voice service, etc., indicating a feature of the service or the specific service.

Network slice differentiation (diffentiator): the auxiliary network slice type and the service type are used for further distinguishing the information of the network slices, and can be used for distinguishing the network slices in the same network slice type or service type.

Tenant (Tenant) information: customer information indicating the creation or lease of the network slice, such as Tencent, national grid, etc.

User group information: grouping information for indicating that users are grouped according to a certain characteristic, such as the level of the users.

Network slice instance information: indicating the instance identification and feature information created for the network slice. For example, an identifier is allocated to the network slice instance to indicate the network slice instance, or a new identifier may be mapped on the basis of the identifier of the network slice instance, and the network slice instance is associated, so that the recipient may identify the represented specific network slice instance according to the identifier.

Proprietary Core Network (DCN) identification: the identifier is used for uniquely indicating a proprietary core network, such as a core network proprietary to the internet of things. Optionally, the DCN identifier may be mapped with a network slice identifier, the network slice identifier may be mapped by the DCN identifier, and the DCN identifier may also be mapped by the network slice identifier.

It should be noted that the CN Allowed NSSAI list is determined in the following manner: the CN may select, according to factors such as CN Allowed network slice selection auxiliary information (CN NSSAI) reported by the UE, subscription information of the UE, local policy, availability of a network slice, and the like, information of at least one CN network slice that the UE is Allowed to access in the current registration area, where the information of the at least one CN network slice may be presented in a form of a list, which may be referred to as a CN Allowed NSSAI (CN Allowed NSSAI) list, or may be presented in another form, which is not limited specifically.

303. The CN sends the first downlink message to the RAN.

In the embodiment of the present application, the CN sends the first downlink message to the RAN, and the RAN receives the first downlink message from the CN. The first downlink message may include a first mapping rule and a list of CN Allowed NSSAIs, the first mapping rule including at least one CN access category; alternatively, the first downlink message may comprise a first mapping rule comprising at least one CN access category; alternatively, the first downlink message may include a list of CN Allowed NSSAIs.

Optionally, when both the first mapping rule and the CN Allowed NSSAI list need to be sent to the RAN, the first downlink message may include the first mapping rule, and the CN Allowed NSSAI list may also be sent to the RAN through another downlink message. The first mapping rule can refer to the above table 2 and table 3, and is not described herein again. The first downlink message may be an NAS message, and is sent to the RAN through the CN and RAN interface, for example: the CN sends a first downlink message to the RAN over the N2 interface.

304. The RAN obtains a second mapping rule comprising information of at least one RAN network slice.

In the embodiment of the present application, the RAN receives a first downlink message sent by the CN. The first downlink message may include a first mapping rule and a list of CN Allowed NSSAIs, the first mapping rule including at least one CN access category; alternatively, the first downlink message may comprise a first mapping rule comprising at least one CN access category; alternatively, the first downlink message may include a list of CN Allowed NSSAIs. Further, the RAN obtains a second mapping rule, which includes information of at least one RAN network slice. Optionally, the first downlink message received by the RAN may include the first mapping rule, and the other downlink message received may include the CN Allowed NSSAI list.

It should be understood that, if the RAN receives a downlink message including a CN Allowed nsai list, the information of the at least one RAN network slice may have a mapping relationship with the CN Allowed nsai list, and the second mapping rule may include the information of the at least one RAN network slice and the CN Allowed nsai list; if the downlink message received by the RAN does not include the CN Allowed NSSAI list, the information of the at least one RAN network slice has a mapping relationship with the information of the currently available CN network slice, and the second mapping rule may include the information of the at least one RAN network slice and the information of the currently available CN network slice.

Illustratively, the RAN maintains a mapping relationship between preset RAN network slice information and CN network slice information, for example, the mapping relationship may be preconfigured by a network manager, or may be preconfigured by the CN device through interface information between the CN and the RAN. The information of one or more CN network slices may correspond to information of one RAN network slice, as shown in table 4 below:

RAN Network slice, information of access Network slice	CN Network slice, information of core Network slice
		1	1，2
2	3，4
		3	5，6，7，8
4	9，10，11，12
		5	13，14
6	15，16
		7	17，18，19
8	20，21，22
		9	23，24
10	25，26

TABLE 4

(1) If the downlink message received by the RAN includes the CN Allowed nsai list, the second mapping rule may find, according to the mapping relationship between the preset RAN network slice information and the CN network slice information, as shown in table 4, information of at least one RAN network slice corresponding to the CN Allowed nsai list as the second mapping rule. Further, information of at least one RAN network slice is mapped to a specific Access category (Access category), which may be referred to as RAN Access category. For example, the access category may be identified by a RAN network slice ID (RAN network slice ID), or a new access category may be used to determine the second mapping rule. The RAN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., information of at least one RAN network slice, etc.) included in the second mapping rule.

It should be understood that, according to the description in step 302, the CN Allowed NSSAI list is a representation of information of at least one CN network slice Allowed to be accessed in the current registration area of the UE, and therefore, the CN Allowed NSSAI list is information of at least one CN network slice, for example: the CN Allowed NSSAI list is shown in Table 5:

CN Allowed NSSAI List
	3
9
	17
20

TABLE 5

In table 5, 3, 9, 17, and 20 may be identifiers of CN network slices, or may be indications of network slice types, service types, network slice differentiation, tenant information, user group information, network slice instance information, and dedicated core network identifiers, which are used to differentiate different CN network slices, and are not limited specifically.

For example: as shown in table 6, the second mapping rule may include information of at least one RAN network slice, which is found from the list shown in table 5 in table 4, and since the CN Allowed nsai list is information of at least one CN network slice, it can be found through a preset mapping relationship between the information of the RAN network slice and the information of the CN network slice. Wherein, the RAN network slice information may be indicated by RAN network slice identifier, as follows:

information of at least one RAN network slice corresponding to CN Allowed NSSAI list
	2
4
	7
8

TABLE 6

In the scheme shown in table 6, the UE may perform the access control check according to the information of the at least one RAN network slice, because the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is also achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

For example: as shown in table 7, the second mapping rule may include a mapping relationship between information of at least one RAN network slice and at least one RAN access category, as follows:

TABLE 7

In the scheme shown in table 7, the UE may perform access control check according to information of at least one RAN network slice or at least one RAN access category, which improves the selectivity and flexibility of the technical scheme of the present application. Since the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

For example: as shown in table 8, the second mapping rule may include a mapping relationship between information of at least one RAN network slice and information of at least one CN network slice, as follows:

TABLE 8

In the scheme shown in table 8, the UE may perform access control check of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control check of the CN network slice according to the information of the at least one CN network slice, which improves the selectivity and flexibility of the technical solution of the present application. Since the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

For example: as shown in table 9, the second mapping rule may include a mapping relationship of information of at least one RAN network slice, information of at least one CN network slice, and at least one RAN access category, as follows:

TABLE 9

In the scheme shown in table 9, the UE may perform access control check of the RAN network slice according to information of at least one RAN network slice, or may perform access control check of the CN network slice according to information of at least one CN network slice, or may perform access control check of the RAN network slice according to at least one RAN access category, which improves the selectivity and flexibility of the technical solution of the present application. Since the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is achieved. The case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is also solved, because the information of the RAN network slice mapped on the RAN by the information of the different CN network slices of the same service type is mostly the same.

It should be noted that, in the second mapping rule described in tables 7-9 above, the information of at least one RAN network slice may have a mapping relationship with at least one RAN access category, or a CN Allowed nsai list and at least one RAN access category, but the second mapping rule may not include at least one RAN access category, or a CN Allowed nsai list and at least one RAN access category, and the RAN knows their mapping relationship, which is not limited specifically.

(2) If the downlink message received by the RAN does not include the CN Allowed NSSAI list, the second mapping rule may find, according to the mapping relationship between the preset RAN network slice information and the CN network slice information, the information of at least one CN network slice Allowed by the current RAN or the entire network, as shown in table 4, that is, the information of at least one RAN network slice corresponding to the currently available CN network slice information is used as the second mapping rule. Further, information of at least one RAN network slice is mapped to a specific Access category (Access category), which may be referred to as RAN Access category. For example, the access category may be identified by a RAN Network slice identifier (NSRPI), or a new access category may be used to determine the second mapping rule. The RAN access category may be understood as an index to look up access control information corresponding to at least one factor (e.g. information of at least one RAN network slice, etc.) contained in the second mapping rule.

For example: referring to any one of table 6, table 7, table 8 and table 9, the second mapping rule may include information of at least one RAN network slice, or may include a mapping relationship between the information of the at least one RAN network slice and at least one RAN access category, or may include a mapping relationship between the information of the at least one RAN network slice and the information of the at least one CN network slice, or may include a mapping relationship between the information of the at least one RAN network slice, the information of the at least one CN network slice and at least one RAN access category. It should be understood that, in the implementation manner of (2), the determined information of the at least one CN network slice is determined by the RAN according to the information of the currently available CN network slices, and the number of the determined information of the at least one CN network slice may be greater than or equal to the number of the determined information of the at least one CN network slice in the manner of (1).

It should be noted that, in the implementation of (2), there is no CN Allowed NSSAI list, and the RAN is information of at least one CN network slice determined according to information of currently available CN network slices. Then in the second mapping rule described with reference to tables 7-9 above, the information of at least one RAN network slice may have a mapping relationship with at least one RAN access category, or the information of currently available CN network slices and at least one RAN access category, but the second mapping rule may not include the information of at least one RAN access category, currently available CN network slices, or the information of currently available CN network slices and at least one RAN access category, which is not limited specifically.

Optionally, the second mapping rule may further include other factors besides the aforementioned information of the at least one RAN network slice, information of the at least one CN network slice, and the at least one CN access category, which is not limited specifically.

It should be noted that, in the embodiment of the present application, the information of the at least one RAN network slice may be represented by a self-defined identifier having a mapping relationship with the at least one CN network slice, or may be represented by a RAN network slice identifier, RAN network slice type information, RAN service type, RAN network slice differentiation, RAN tenant information, RAN network slice instance information, and the like, which are used to differentiate different RAN network slices, and is not limited specifically.

Further, in this embodiment of the present application, if the first downlink message includes the first mapping rule, the RAN only plays a role of forwarding, that is, forwards the first mapping rule to the UE. It should be understood that the RAN access category may be indicated by numbers, letters, bytes, etc., and is not specifically limited in the embodiments of the present application.

305. And the RAN sends a second downlink message to the UE, wherein the second downlink message comprises a second mapping rule.

In this embodiment of the present application, after acquiring a second mapping rule, the RAN may send second downlink information to the UE, where the second downlink information includes the second mapping rule, and the second mapping rule includes information of at least one RAN network slice; the UE receives a second downlink message from the RAN. The second downlink message may be an AS message such AS Radio Resource Control (RRC). The second mapping rule may refer to any one of table 6, table 7, table 8, and table 9, which is not described herein again.

Optionally, the second downlink message may further include a first mapping rule, where the first mapping rule includes at least one CN access category, or the RAN sends the first mapping rule to the UE through another downlink message, and the first mapping rule may refer to tables 2 and 3, which are shown above and are not described herein again.

306. The UE determines information of at least one RAN network slice according to a second mapping rule.

In this embodiment of the present application, a UE receives a second downlink message sent by a RAN, where the second downlink message includes a second mapping rule, and the second mapping rule includes information of at least one RAN network slice. The second mapping rule may refer to any one of table 6, table 7, table 8, and table 9, which is not described herein again.

Optionally, the second mapping rule includes a first mapping rule, or the UE receives another downlink message, where the another downlink message includes the first mapping rule, and the first mapping rule includes at least one CN access category.

307. The RAN sends the access control information to the UE.

In the embodiment of the present application, the RAN sends RAN access control information to the UE, and the UE receives the RAN access control information from the RAN. It should be understood that the RAN access control information may be access control information of all RAN network slices, or may be access control information of at least one RAN network slice.

Optionally, the RAN sends CN access control information to the UE, and the UE receives the CN access control information from the RAN. It should be understood that the CN access control information may be access control information of all CN network slices, or may be access control information of the above-mentioned at least one CN network slice.

308. And the UE performs access control according to the second mapping rule and the access control information.

In the embodiment of the present application, the UE may perform the access restriction check according to the second mapping rule and the RAN access control information. Before initiating an access attempt, the UE may perform ABC according to information of at least one RAN network slice or access control information corresponding to at least one RAN access category, so as to determine whether an access or service request can be initiated.

One possible way is: the corresponding access control information has an access restriction timer. If the access limit timer set by the RAN network slice is running, the terminal device determines that the secondary network access request or service request cannot be initiated. Otherwise, the terminal equipment selects a uniformly distributed random number between 0 and 1 by adopting a random number algorithm; if the random number is smaller than the corresponding access limiting factor in the access control information, the terminal equipment determines that the RAN network slice can be accessed; if the random number is greater than or equal to the corresponding access limiting factor, the terminal device determines that the RAN network slice is not accessible, and the terminal device starts an access limiting timer corresponding to the RAN network slice, for example, the timing length of the access limiting timer may be (0.7+0.6 random number) × access limiting time.

Another possible way is: the RAN access control information comprises a bitmap, different bits of which correspond to information of different RAN network slices or different RAN access categories. For example, the corresponding bit value is "0", which indicates that the network slice access request or service request can be initiated, otherwise, the network slice access request or service request cannot be initiated. The specific ABC mechanism may also refer to any ABC applicable to the LTE system or the 5G system, which is not limited herein. If not, the UE initiates an access attempt or a service request to the first RAN network slice.

Optionally, the UE may perform the access restriction check according to the first mapping rule and the CN access control information. Before initiating an access attempt, the UE may perform ABC according to information of at least one RAN network slice or access control information corresponding to at least one RAN access category, so as to determine whether an access or service request can be initiated. The specific ABC mechanism may refer to any ABC applicable to the LTE system or the 5G system, which is not limited herein. If not restricted, the UE may initiate an access attempt or a service request to the first CN network slice.

It should be noted that, the RAN performing the access control check according to the second mapping rule and the access control information includes, but is not limited to, the above-mentioned two possible implementation manners, and other manners of performing the access control check according to the second mapping rule and the access control information are also within the scope of the present application.

In this embodiment of the present application, a RAN sends a second downlink message to a UE, where the second downlink message includes a second mapping rule, and the second mapping rule includes information of at least one RAN network slice; the RAN sends RAN access control information to the UE. It should be noted that the second mapping rule determined by the RAN does not have to be related to the RAN receiving the first mapping rule sent by the CN. The UE may initiate an access request to information of a first RAN network slice of the information of the at least one RAN network slice according to RAN access control information. Since the information of the RAN network slice and the information of the CN network slice are generally in a one-to-many mapping relationship, the RAN sends the second mapping rule to the UE, where the second mapping rule includes information of at least one RAN network slice, and compared with the prior art, the configuration of the second mapping rule in the embodiment of the present application is smaller and has lower complexity. The problem of CN network slice information is more, cause NAS level table configuration too big, the complexity is too high is solved. Further, the case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of the RAN network slice mapped at the RAN by the information of the different CN network slices of the same service type is mostly the same. RAN-based network slice granularity access control is also achieved.

As shown in fig. 4, a schematic diagram of another embodiment of an access control method in the embodiment of the present application includes:

401. the UE sends the uplink message to the CN.

402. The CN acquires the first mapping rule.

In the embodiment of the present application, steps 401 and 402 are similar to steps 301 and 302 shown in fig. 3, and are not described herein again.

403. The CN sends a first downlink message to the RAN, wherein the first downlink message comprises a first mapping rule.

In the embodiment of the present application, the CN sends the first downlink message to the RAN, and the RAN receives the first downlink message from the CN. The first downlink message includes a first mapping rule, where the first mapping rule includes at least one CN access category, which may be referred to tables 2 and 3, and is not described herein again.

Optionally, the first downlink message may further include a CN Allowed NSSAI list, or the CN sends the CN Allowed NSSAI list to the RAN through another downlink message. It should be understood that the first downlink message may be a NAS message, sent to the RAN through the CN and RAN interface, for example: the CN sends a first downlink message to the RAN over the N2 interface.

404. The RAN obtains a second mapping rule comprising information of at least one RAN network slice.

In the embodiment of the present application, the RAN receives a first downlink message sent by the CN. The first downlink message comprises a first mapping rule comprising at least one CN access category. Optionally, the first downlink message may further include a CN Allowed nsai list, or the RAN receives another downlink message including a CN Allowed nsai list. Further, the RAN obtains a second mapping rule, which includes information of at least one RAN network slice.

It should be noted that the second mapping rule may be generated by adding information of at least one RAN network slice to the first mapping rule, or the second mapping rule is determined by the RAN according to the first mapping rule and the CN Allowed NSSAI list, or the second mapping rule is determined by the RAN according to the first mapping rule and information of currently available CN network slices.

Illustratively, the RAN maintains a mapping relationship between preset RAN network slice information and CN network slice information, for example, the mapping relationship may be preconfigured by a network manager, or may be preconfigured by the CN device through interface information between the CN and the RAN. The information for one or more CN network slices may correspond to information for one RAN network slice, as shown in table 10 below:

Watch 10

It should be understood that, as will be understood from the above description, the CN Allowed NSSAI list is a representation of information of at least one CN network slice Allowed to be accessed in the current registration area of the UE, and therefore, the CN Allowed NSSAI list is also information of at least one CN network slice, for example: the CN Allowed NSSAI list is shown in Table 11:

CN Allowed NSSAI List
	3
9
	17
20

TABLE 11

In table 11, 3, 9, 17, and 20 may be identifiers of CN network slices, or may be indications of network slice types, service types, network slice differentiation, tenant information, user group information, network slice instance information, and dedicated core network identifiers, which are used to differentiate different CN network slices, and are not limited specifically.

(1) If the downlink message received by the RAN includes the first mapping rule and the CN Allowed NSSAI list, the RAN may search, according to the CN Allowed NSSAI list, information of at least one corresponding RAN network slice in the table 10, and the second mapping rule adds information of at least one RAN network slice to the first mapping rule to generate the second mapping rule. Illustratively, the second mapping rule may include, but is not limited to, the following forms, as shown below:

1) if the first mapping rule is table 2 above and the second mapping rule is generated by adding information of at least one RAN network slice to the first mapping rule, the second mapping rule may be as shown in table 12 below:

TABLE 12

In the scheme shown in table 12, the UE may perform access control check according to the information of at least one RAN network slice, or at least one CN access category, because the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, and also implement control of RAN network slice granularity, which solves the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN, because the information of different CN network slices of the same service type is mapped to the information of the RAN network slice of the RAN in most cases to be the same.

2) If the first mapping rule is table 2 above, the second mapping rule is generated by adding information of at least one RAN network slice and at least one RAN access category to the first mapping rule. The RAN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., information of at least one RAN network slice, etc.) included in the second mapping rule. Information of at least one RAN network slice may be mapped to a particular access category, which may be referred to as a RAN access category. Then the second mapping rule may be as shown in table 13 below:

watch 13

In the scheme shown in table 13, the UE may perform access control checking of the RAN network slice according to information of the at least one RAN network slice, or may perform access control checking of the RAN network slice according to the at least one RAN access category, or may perform access control checking of the RAN network slice according to the at least one CN access category. Because the information of the RAN network slice is generally in one-to-many relationship with the information of the CN network slice, the control of the granularity of the RAN network slice is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type is mapped on the information of the RAN network slice of the RAN in most cases to be the same.

3) If the first mapping rule is table 2, the second mapping rule adds information of at least one RAN network slice and at least one CN network slice corresponding to the CN NSSAI list on the basis of the first mapping rule. Then the second mapping rule may be as shown in table 14 below:

TABLE 14

In the scheme shown in table 14, the UE may perform access control check of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control check of the CN network slice according to the information of the at least one CN network slice, which improves the selectivity and flexibility of the technical solution of the present application. The control of RAN network slice granularity is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type mapped on the RAN network slice of the RAN is mostly the same.

4) If the first mapping rule is table 2, the second mapping rule adds information of at least one RAN network slice, at least one RAN access category, and information of at least one CN network slice corresponding to the CN NSSAI list on the basis of the first mapping rule. The RAN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., information of at least one RAN network slice, etc.) included in the second mapping rule. Information of at least one RAN network slice may be mapped to a particular access category, which may be referred to as a RAN access category. Then the second mapping rule may be as shown in table 15 below:

watch 15

In the scheme shown in table 15, the UE may perform access control check of the RAN network slice according to information of at least one RAN network slice, or may perform access control check of the CN network slice according to information of at least one CN network slice, or may also perform access control check of the RAN network slice according to at least one RAN access category, or may perform access control check of the CN network slice according to at least one CN access category, which improves the selectivity and flexibility of the present technical solution. The control of RAN network slice granularity is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type mapped on the RAN network slice of the RAN is mostly the same.

5) If the first mapping rule is table 3 above and the second mapping rule is generated by adding information of at least one RAN network slice to the first mapping rule, the second mapping rule may be as shown in table 16 below:

TABLE 16

In the scheme shown in table 16, the UE may perform access control check of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control check of the CN network slice according to the information of the at least one CN network slice or the information of the at least one CN network slice, which improves the selectivity and flexibility of the technical solution of the present application. The control of RAN network slice granularity is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type mapped on the RAN network slice of the RAN is mostly the same.

6) If the first mapping rule is table 3 above, the second mapping rule is generated by adding information of at least one RAN network slice and at least one RAN access category to the first mapping rule. The RAN access category may be understood as an index for looking up access control information corresponding to at least one factor (e.g., information of at least one RAN network slice, etc.) included in the second mapping rule. Information of at least one RAN network slice may be mapped to a particular access category, which may be referred to as a RAN access category. Then the second mapping rule may be as shown in table 17 below:

TABLE 17

In the scheme shown in table 17, the UE may perform access control check of the RAN network slice according to information of at least one RAN network slice, or may perform access control check of the CN network slice according to information of at least one CN network slice, or may also perform access control check of the RAN network slice according to at least one RAN access category, or may also perform access control check of the CN network slice according to at least one CN access category, which improves the selectivity and flexibility of the present technical solution. The control of RAN network slice granularity is also realized, and the problem that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of different CN network slices of the same service type mapped on the RAN network slice of the RAN is mostly the same.

(2) If the downlink message received by the RNA includes the first mapping rule and does not include the CN NSSAI list, the RAN may search, according to the information of the currently available CN network slice, the information of the corresponding at least one RAN network slice in the table 10, and the second mapping rule adds the information of the at least one RAN network slice to the first mapping rule to generate the second mapping rule. Then, the obtained second mapping rule may be shown with reference to any one implementation manner of tables 12 to 17, which is not described herein again.

(3) And if the downlink message received by the RAN includes the first mapping rule and the CN Allowed NSSAI list, the second mapping rule is determined by the RAN according to the first mapping rule and the CN Allowed NSSAI list. For example, the second mapping rule may include any one of the implementations 12 to 17, but is not limited to the above implementations, and may also include other implementations, as shown below:

1) as shown in table 18 below, the second mapping rule may include information of at least one RAN network slice.

Watch 18

In the scheme shown in table 18, the UE may perform the access control check according to the information of the at least one RAN network slice, because the information of the RAN network slice is generally in a one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is also achieved.

2) As shown in table 19 below, the second mapping rule may include a mapping relationship of information of at least one RAN network slice and at least one RAN access category.

Watch 19

In the solution shown in table 19, the UE may perform access control check according to the information of the at least one RAN network slice or the at least one RAN access category, which improves the selectivity and flexibility of the technical solution of the present application, because the information of the RAN network slice is generally in one-to-many relationship with the information of the CN network slice, the configuration content of the second mapping rule is smaller than the existing configuration content, and the complexity is lower. Control of RAN network slice granularity is also achieved.

3) As shown in table 20 below, the second mapping rule may include a mapping relationship of information of at least one RAN network slice and information of at least one CN network slice.

Watch 20

In the scheme shown in table 19, the UE may perform access control check of the RAN network slice according to the information of the at least one RAN network slice, or may perform access control check of the CN network slice according to the information of the at least one CN network slice, so that the selectivity and flexibility of the technical solution of the present application are improved. Control of RAN network slice granularity is also achieved.

4) As shown in table 21 below, the second mapping rule may include mapping relationships of information of at least one RAN network slice, information of at least one CN network slice, and at least one RAN access category.

TABLE 21

In the scheme shown in table 21, the UE may perform access control check of the RAN network slice according to information of at least one RAN network slice, or may perform access control check of the CN network slice according to information of at least one CN network slice, or may perform access control check of the RAN network slice according to at least one RAN access category, which improves the selectivity and flexibility of the technical solution of the present application. Control of RAN network slice granularity is also achieved.

It should be noted that, in the second mapping rule described in the above tables 18-21, the information of at least one RAN network slice may have a mapping relationship with at least one RAN access category, or, CN Allowed nsai list and at least one RAN access category, or, at least one CN access category and at least one RAN access category, or, at least one CN access category and CN Allowed nsai list, but at least one RAN access category, or, CN Allowed nsai list and at least one RAN access category, or, at least one CN access category and at least one RAN access category, or, at least one CN access category and at least one CN Allowed nsai list may not be included in the second mapping rule, the RAN knows their mapping relationship, and is not limited in particular.

(4) And if the downlink message received by the RAN includes the first mapping rule and does not include the CN Allowed NSSAI list, the second mapping rule is determined by the RAN according to the first mapping rule and the information of the currently available CN network slice. For example, the second mapping rule may refer to an implementation including any one of the above-mentioned implementations 12-21, but is not limited to the above-mentioned implementations 12-21, except that in the implementation of the above-mentioned implementation 12-21, the information of at least one CN network slice is determined by the CN Allowed nsai list, and in a case where the RAN does not receive the CN Allowed nsai list, the information of the currently available CN network slice is determined.

Further, in this embodiment of the present application, the first downlink message includes a first mapping rule, and the RAN reads content of the first mapping rule, generates a second mapping rule, and then forwards the second mapping rule to the UE. It should be understood that the RAN access category may be indicated by numbers, letters, bytes, etc., and is not specifically limited in the embodiments of the present application.

405. And the RAN sends the second downlink message to the UE.

In this embodiment of the present application, after acquiring a second mapping rule, the RAN may send second downlink information to the UE, where the second downlink information includes the second mapping rule, and the second mapping rule includes information of at least one RAN network slice; the UE receives a second downlink message from the RAN. The second downlink message may be an AS message such AS Radio Resource Control (RRC). The second mapping rule may refer to any one of tables 12-20, which is not described herein.

406. The UE determines information of at least one RAN network slice according to a second mapping rule.

In this embodiment of the present application, a UE receives a second downlink message sent by a RAN, where the second downlink message includes a second mapping rule, and the second mapping rule includes information of at least one RAN network slice. The second mapping rule may refer to any one of tables 12-20, which is not described herein.

407. The RAN sends the access control information to the UE.

408. And the UE performs access control according to the second mapping rule and the access control information.

In this embodiment of the present application, a RAN sends a second downlink message to a UE, where the second downlink message includes a second mapping rule, and the second mapping rule includes information of at least one RAN network slice; the RAN sends RAN access control information to the UE. It should be noted that the second mapping rule determined by the RAN is related to the RAN receiving the first mapping rule sent by the CN. The UE may initiate an access request to information of a first RAN network slice of the information of the at least one RAN network slice according to RAN access control information. Since the information of the RAN network slice and the information of the CN network slice are generally in a one-to-many mapping relationship, the RAN sends the second mapping rule to the UE, where the second mapping rule includes information of at least one RAN network slice, and compared with the prior art, the configuration of the second mapping rule in the embodiment of the present application is smaller and has lower complexity. The problem of CN network slice information is more, cause NAS level table configuration too big, the complexity is too high is solved. Further, the case that the information of the CN network slice requested by the UE is inconsistent with the information of the CN network slice allocated by the CN is solved, because the information of the RAN network slice mapped at the RAN by the information of the different CN network slices of the same service type is mostly the same. RAN-based network slice granularity access control is also achieved.

The foregoing describes the method for access control in this embodiment, and the following describes a network device and a terminal device in this embodiment, as shown in fig. 5A, which is a schematic diagram of an embodiment of a network device in this embodiment, and may include:

a first sending module 501, configured to send a first message to a terminal device, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one radio access network slice;

a second sending module 502, configured to send access control information to the terminal device.

It should be understood that the first sending module and the second sending module may be logically separated, or may be implemented by the same module.

Optionally, in some embodiments of the present application, the first mapping rule and the access control information are used to perform access control on the terminal device.

Optionally, in some embodiments of the present application, as shown in fig. 5B, which is a schematic diagram of another embodiment of a network device in the embodiments of the present application, the network device may further include:

a receiving module 503, configured to receive a second message from a second network device, where the second message includes a second mapping rule, the second mapping rule includes at least one core network access category, and the first mapping rule further includes a mapping relationship between information of the at least one radio access network slice and the at least one core network access category;

alternatively, the first and second electrodes may be,

a receiving module 502, configured to receive a second message from a second network device, where the second message includes a list of Allowed network slice selection assistance information Allowed by a core network, and the first mapping rule further includes a mapping relationship between information of the at least one radio access network slice and the list of Allowed network slice selection assistance information of the core network;

alternatively, the first and second electrodes may be,

a receiving module 502, configured to receive a second message from a second network device, where the second message includes a second mapping rule and a list of Allowed network slice selection assistance information Allowed by a core network, the second mapping rule includes at least one core network access category, and the first mapping rule further includes information of the at least one radio access network slice and a mapping relationship between the at least one core network access category and the list of Allowed core network Allowed nsais.

Optionally, in some embodiments of the present application, the first mapping rule further includes a mapping relationship between information of the at least one radio access network slice and information of a currently available core network slice.

Optionally, in some embodiments of the present application, the first mapping rule further includes a mapping relationship between the information of the at least one radio access network slice and at least one radio access network access category.

As shown in fig. 6A, which is a schematic diagram of an embodiment of a terminal device in the embodiment of the present application, the method may include:

a receiving module 601, configured to receive a first message from a first network device, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one radio access network slice;

a second receiving module 602 receives the access control information from the first network device.

It should be understood that the first receiving module and the second receiving module may be logically separated, or may be implemented by the same module.

Optionally, in some embodiments of the present application, as shown in fig. 6B, which is a schematic view of another embodiment of a terminal device in the embodiments of the present application, the terminal device further includes:

a processing module 603, configured to perform access control according to the first mapping rule and the access control information.

Optionally, in some embodiments of the present application, the first mapping rule further includes a mapping relationship between information of the at least one radio access network slice and at least one core network access category.

As shown in fig. 7, a schematic diagram of another embodiment of a network device in the embodiment of the present application includes:

such network devices may vary widely in configuration or performance and may include one or more Central Processing Units (CPUs) 722 (e.g., one or more processors) and memory 732, one or more storage media 730 (e.g., one or more mass storage devices) storing applications 742 or data 744. Memory 732 and storage medium 730 may be, among other things, transient storage or persistent storage. The program stored on the storage medium 730 may include one or more modules (not shown), each of which may include a sequence of instructions operating on the network device. Still further, central processor 722 may be configured to communicate with storage medium 730 to perform a series of instruction operations on storage medium 730 on a network device.

The network device may also include one or more power supplies 726, one or more wired or wireless network interfaces 750, one or more input-output interfaces 758, and/or one or more operating systems 741, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and so forth.

The steps performed by the network device in the above embodiments may be based on the network device structure shown in fig. 7.

Fig. 8 is a schematic diagram of another embodiment of a network device in the embodiment of the present application.

For convenience of explanation, only the parts related to the embodiments of the present application are shown, and details of the specific technology are not disclosed. The terminal device may be any terminal device including a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), a vehicle-mounted computer, and the like, taking the terminal device as the mobile phone as an example:

fig. 8 is a block diagram illustrating a partial structure of a mobile phone related to a terminal device provided in an embodiment of the present application. Referring to fig. 8, the handset includes: radio Frequency (RF) circuitry 810, memory 820, input unit 830, display unit 840, sensor 850, audio circuitry 860, wireless fidelity (WiFi) module 870, processor 880, and power supply 890. Those skilled in the art will appreciate that the handset configuration shown in fig. 8 is not intended to be limiting and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.

The following describes each component of the mobile phone in detail with reference to fig. 8:

the RF circuit 810 may be used for receiving and transmitting signals during information transmission and reception or during a call, and in particular, for processing downlink information of a base station after receiving the downlink information to the processor 880; in addition, the data for designing uplink is transmitted to the base station. In general, RF circuit 810 includes, but is not limited to, an antenna, at least one Amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, the RF circuit 810 may also communicate with networks and other devices via wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), and the like.

The memory 820 may be used to store software programs and modules, and the processor 880 executes various functional applications and data processing of the cellular phone by operating the software programs and modules stored in the memory 820. The memory 820 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. Further, the memory 820 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The input unit 830 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the cellular phone. Specifically, the input unit 830 may include a touch panel 831 and other input devices 832. The touch panel 831, also referred to as a touch screen, can collect touch operations performed by a user on or near the touch panel 831 (e.g., operations performed by the user on the touch panel 831 or near the touch panel 831 using any suitable object or accessory such as a finger, a stylus, etc.) and drive the corresponding connection device according to a preset program. Alternatively, the touch panel 831 may include two portions, i.e., a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts it to touch point coordinates, and sends the touch point coordinates to the processor 880, and can receive and execute commands from the processor 880. In addition, the touch panel 831 may be implemented by various types such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. The input unit 830 may include other input devices 832 in addition to the touch panel 831. In particular, other input devices 832 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

The display unit 840 may be used to display information input by the user or information provided to the user and various menus of the cellular phone. The Display unit 840 may include a Display panel 841, and the Display panel 841 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like, as an option. Further, touch panel 831 can overlay display panel 841, and when touch panel 831 detects a touch operation thereon or nearby, communicate to processor 880 to determine the type of touch event, and processor 880 can then provide a corresponding visual output on display panel 841 based on the type of touch event. Although in fig. 8, the touch panel 831 and the display panel 841 are two separate components to implement the input and output functions of the mobile phone, in some embodiments, the touch panel 831 and the display panel 841 may be integrated to implement the input and output functions of the mobile phone.

The handset may also include at least one sensor 850, such as light sensors, motion sensors, and other sensors. Specifically, the light sensor may include an ambient light sensor that adjusts the brightness of the display panel 841 according to the brightness of ambient light, and a proximity sensor that turns off the display panel 841 and/or the backlight when the mobile phone is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally, three axes), can detect the magnitude and direction of gravity when stationary, and can be used for applications of recognizing the posture of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer and tapping), and the like; as for other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured on the mobile phone, further description is omitted here.

Audio circuitry 860, speaker 861, microphone 862 may provide an audio interface between the user and the handset. The audio circuit 860 can transmit the electrical signal converted from the received audio data to the speaker 861, and the electrical signal is converted into a sound signal by the speaker 861 and output; on the other hand, the microphone 862 converts collected sound signals into electrical signals, which are received by the audio circuit 860 and converted into audio data, which are then processed by the audio data output processor 880 and transmitted to, for example, another cellular phone via the RF circuit 810, or output to the memory 820 for further processing.

WiFi belongs to short-distance wireless transmission technology, and the mobile phone can help a user to send and receive e-mails, browse webpages, access streaming media and the like through the WiFi module 870, and provides wireless broadband Internet access for the user. Although fig. 8 shows WiFi module 870, it is understood that it does not belong to the essential constitution of the handset, and may be omitted entirely as needed within the scope not changing the essence of the invention.

The processor 880 is a control center of the mobile phone, connects various parts of the entire mobile phone using various interfaces and lines, and performs various functions of the mobile phone and processes data by operating or executing software programs and/or modules stored in the memory 820 and calling data stored in the memory 820, thereby integrally monitoring the mobile phone. Optionally, processor 880 may include one or more processing units; preferably, the processor 880 may integrate an application processor, which mainly handles operating systems, user interfaces, applications, etc., and a modem processor, which mainly handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 880.

The handset also includes a power supply 890 (e.g., a battery) for powering the various components, which may preferably be logically coupled to the processor 880 via a power management system to manage charging, discharging, and power consumption.

Although not shown, the mobile phone may further include a camera, a bluetooth module, etc., which are not described herein.

The steps executed by the terminal device in the above method embodiment may be based on the terminal device structure shown in fig. 8, and are not described here again.

The embodiment of the present application provides a wireless communication device, and the constituent components of the wireless communication device may refer to the network device shown in the foregoing fig. 7. In a possible design, the hardware structure of the communication device may include, according to the requirements necessary for the embodiments of the present application:

at least one processor, a memory, a transceiver circuit and a bus system, wherein the processor, the memory, the transceiver circuit are coupled through the bus system, the wireless communication apparatus communicates with a terminal device through the transceiver circuit, the memory is used for storing program instructions, and the at least one processor is used for executing the program instructions stored in the memory, so that the wireless communication apparatus performs various possible operations (for example, operations performed by the radio access network device shown in fig. 3 or fig. 4) performed by the first network device (that is, the radio access network device) in the above embodiments. The wireless communication device may be the radio access network device, or may be a system chip that is applied to a radio access network-side device to perform a corresponding function.

An embodiment of the present application further provides a wireless communication apparatus, which may include:

at least one processor, a memory, a transceiver circuit and a bus system, wherein the processor, the memory and the transceiver circuit are coupled through the bus system, the wireless communication apparatus communicates with a network side device through the transceiver circuit, the memory is used for storing program instructions, and the at least one processor is used for executing the program instructions stored in the memory, so that the wireless communication apparatus performs various possible operations (for example, operations performed by the terminal device shown in fig. 3 or fig. 4) performed by the terminal device in the above embodiments. The wireless communication device can be a terminal device, and can also be a system chip which is applied to the terminal device and executes corresponding functions.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.

Claims

1. A method of access control, comprising:

the first network equipment receives a second message from a second network equipment, wherein the second message comprises a second mapping rule, and the second mapping rule comprises at least one core network access category; or, the first network device receives a fourth message from a second network device, where the fourth message includes the second mapping rule and a list of network slice selection assistance information allowed by a core network;

the first network equipment sends a first message to terminal equipment, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one radio access network slice;

the first mapping rule further comprises a mapping relation between information of the at least one radio access network slice and the at least one core network access category, wherein the information of the at least one radio access network slice is determined according to the at least one access category, the information of the at least one core network slice is determined according to the information of the currently available core network slice, and the information of the at least one core network slice corresponds to the at least one core network access category; or, the first mapping rule further includes mapping relationships between the at least one radio access network slice information and the at least one core network access category and a network slice selection auxiliary information list allowed by the core network, where the first network device stores a mapping relationship between preset radio access network slice information and core network slice information, the at least one radio access network slice information is determined according to the at least one core network slice information, and the at least one core network access category corresponds to the network slice selection auxiliary information list allowed by the core network;

and the first network equipment sends access control information to the terminal equipment so that the terminal equipment can carry out access control according to the first mapping rule and the access control information.

2. The method of claim 1, wherein the information of the at least one radio access network slice and the access control information are used for access control of the terminal device.

3. The method according to claim 1 or 2, wherein the first mapping rule further comprises a mapping relationship between information of the at least one radio access network slice and information of currently available core network slices.

4. The method according to claim 1 or 2, wherein the first mapping rule further comprises a mapping of information of the at least one radio access network slice to at least one radio access network access category.

5. A method of access control, comprising:

the terminal equipment receives a first message from first network equipment, wherein the first message comprises a first mapping rule, and the first mapping rule comprises information of at least one radio access network slice; the first mapping rule further comprises a mapping relation between the information of the at least one radio access network slice and at least one core network access category;

and the terminal equipment receives the access control information from the first network equipment.

6. The method of claim 5, further comprising:

and the terminal equipment performs access control according to the information of the at least one wireless access network slice and the access control information.

7. The method according to claim 5 or 6, wherein the first mapping rule further comprises a mapping relationship between information of the at least one radio access network slice and at least one radio access network access category.

8. A first network device, comprising:

a receiving module, configured to receive a second message from a second network device, where the second message includes a second mapping rule, and the second mapping rule includes at least one core network access category; or, receiving a second message from a second network device, where the second message includes the second mapping rule and a list of network slice selection assistance information allowed by a core network;

a first sending module, configured to send a first message to a terminal device, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one radio access network slice;

and the second sending module is used for sending access control information to the terminal equipment so that the terminal equipment can carry out access control according to the first mapping rule and the access control information.

9. The first network device of claim 8, wherein the information of the at least one radio access network slice and the access control information are used for access control of the terminal device.

10. The first network device of claim 8 or 9, wherein the first mapping rule further comprises a mapping relationship between information of the at least one radio access network slice and information of a currently available core network slice.

11. The first network device of claim 8 or 9, wherein the first mapping rule further comprises a mapping relationship between information of the at least one radio access network slice and at least one radio access network access category.

12. A terminal device, comprising:

a first receiving module, configured to receive a first message from a first network device, where the first message includes a first mapping rule, and the first mapping rule includes information of at least one radio access network slice; the first mapping rule further comprises a mapping relation between the information of the at least one radio access network slice and at least one core network access category; a second receiving module, configured to receive the access control information from the first network device.

13. The terminal device according to claim 12, wherein the terminal device further comprises:

and the processing module is used for carrying out access control check according to the information of the at least one wireless access network slice and the access control information.

14. A terminal device according to claim 12 or 13, wherein said first mapping rule further comprises a mapping of information of said at least one radio access network slice to at least one radio access network access category.

15. A computer-readable storage medium having stored therein instructions which, when run on a computer, cause the computer to perform the method of any one of claims 1 to 7.

16. A wireless communications apparatus, comprising:

at least one processor, a memory, transceiver circuitry, and a bus system, the processor, the memory, the transceiver circuitry coupled through the bus system, the wireless communication device in communication with a terminal device through the transceiver circuitry, the memory to store program instructions, the at least one processor to execute the program instructions stored in the memory to cause the wireless communication device to perform portions of the operations of the first network device in the method of any of claims 1-4.

17. A wireless communications apparatus, comprising:

at least one processor, a memory, transceiver circuitry, and a bus system, the processor, the memory, the transceiver circuitry coupled through the bus system, the wireless communication device communicating with a network-side device through the transceiver circuitry, the memory to store program instructions, the at least one processor to execute the program instructions stored in the memory to cause the wireless communication device to perform portions of the operations of the terminal device in the method of any of claims 5-7.