CN114173336B

CN114173336B - Authentication failure processing method and device, terminal and network equipment

Info

Publication number: CN114173336B
Application number: CN202010847188.9A
Authority: CN
Inventors: 张鹏飞; 柯小婉; 康艳超
Original assignee: Vivo Mobile Communication Co Ltd
Current assignee: Vivo Mobile Communication Co Ltd
Priority date: 2020-08-21
Filing date: 2020-08-21
Publication date: 2024-06-11
Anticipated expiration: 2040-08-21
Also published as: WO2022037619A1; CN114173336A

Abstract

The application discloses a method and a device for processing authentication failure, a terminal and network side equipment, and belongs to the technical field of wireless communication. The authentication failure processing method comprises the following steps: under the condition that authentication of the terminal fails, the access and mobile management functional entity determines an authentication failure cause value returned to the terminal according to a first message, wherein the first message indicates whether a current network is used for configuring network access of the terminal (onboarding); and sending a second message to the terminal, wherein the second message carries the authentication failure cause value.

Description

Authentication failure processing method and device, terminal and network equipment

Technical Field

The application belongs to the technical field of wireless communication, and particularly relates to a method and a device for processing authentication failure, a terminal and network side equipment.

Background

The configuration Network (onboarding) refers to that the terminal obtains information such as a certificate of a target independent Non-Public Network (SNPN) through accessing to the current Network.

Currently, when a terminal selects an independent non-public network (onboarding-SNPN, O-SNPN) configured to access the network, if a plurality of O-SNPN exist, one of the O-SNPN is selected for onboarding by a user manually or the terminal randomly, a registration request is initiated to the O-SNPN, the network side needs to authenticate the terminal in the process, and in the authentication process, the authentication may fail. In the related art, when authentication of a terminal fails in a network, a cause value (cause value) sent from a network side to the terminal includes: #3, #74, #75, etc. However, these cause values specified in the current protocol cannot cover authentication failure in onboarding procedures, for example, if the received cause value is #3, the terminal determines that an entry corresponding to SNPN of the current service in the subscription information list (list of subscriber data) of the terminal is invalid. However, SNPN of the current service fails to authenticate the UE only as onboarding network, and does not invalidate the subscription information of the terminal in SNPN, so it is inappropriate to invalidate the corresponding subscription information of SNPN of the current service.

Therefore, in the related art, after the authentication failure of the terminal by the network is performed by the terminal onboarding, the corresponding authentication failure cause value cannot be returned to the terminal according to whether the current network is used for onboarding, which may further cause an operation error performed by the terminal according to the authentication failure cause value returned by the network side.

Disclosure of Invention

The embodiment of the application provides a processing method, a device, a terminal and network side equipment for authentication failure, which can solve the problem that the network side equipment cannot return a corresponding authentication failure cause value to the terminal according to whether the current network is used for onboarding.

In a first aspect, a method for processing authentication failure is provided, where the method includes: under the condition that authentication of the terminal fails, the access and mobile management functional entity determines an authentication failure cause value returned to the terminal according to a first message, wherein the first message indicates whether a current network is used for configuring network access of the terminal (onboarding); and sending a second message to the terminal, wherein the second message carries the authentication failure cause value.

In a second aspect, there is provided an apparatus for processing authentication failure, the apparatus comprising: the determining module is configured to determine, according to a first message, an authentication failure cause value returned to the terminal in case of authentication failure of the terminal, where the first message indicates whether a current network is used for configuration access to the network onboarding of the terminal; the first transceiver module is configured to send a second message to the terminal, where the second message carries the authentication failure cause value.

In a third aspect, a method for processing authentication failure is provided, where the method includes: the terminal receives a second message, wherein the authentication failure cause value carried in the second message; if it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of onboarding procedures of the terminal, the independent non-public network SNPN currently accessed is marked as a network which is forbidden to be selected as onboarding.

In a fourth aspect, there is provided an apparatus for processing authentication failure, the apparatus comprising: the second transceiver module is used for receiving a second message, wherein the authentication failure cause value is carried in the second message; and the processing module is used for marking the independent non-public network SNPN which is accessed currently as a network which is forbidden to be selected as onboarding if the authentication failure indicated by the authentication failure cause value is determined to be the authentication failure of onboarding processes of the terminal.

In a fifth aspect, a network side device is provided, the network side device comprising a processor, a memory and a program or instructions stored on the memory and executable on the processor, the program or instructions implementing the steps of the method according to the first aspect when executed by the processor.

In a sixth aspect, there is provided a terminal comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, the program or instruction when executed by the processor implementing the steps of the method according to the first aspect.

In a seventh aspect, there is provided a readable storage medium having stored thereon a program or instructions which when executed by a processor, performs the steps of the method according to the first aspect, or performs the steps of the method according to the third aspect.

In an eighth aspect, a chip is provided, the chip comprising a processor and a communication interface, the communication interface being coupled to the processor, the processor being configured to run a network side device program or instruction to implement the method according to the first aspect, or the processor being configured to run a terminal program or instruction to implement the method according to the third aspect.

In a ninth aspect, there is provided a computer program product comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, the program or instruction when executed by the processor implementing the steps of the method according to the first aspect or implementing the steps of the method according to the third aspect.

In the embodiment of the application, under the condition that the authentication of the terminal fails, the access and mobile management functional entity determines the authentication failure reason value returned to the terminal according to the first message of onboarding indicating whether the current network is used for the terminal, and sends the authentication failure reason value to the terminal, so that the network serving as onboarding can select the corresponding reason value after the authentication of the terminal fails.

Drawings

Fig. 1 shows a block diagram of a wireless communication system to which embodiments of the present application are applicable;

fig. 2 is a schematic flow chart of a method for processing authentication failure according to an embodiment of the present application;

fig. 3 is a schematic flow chart of another method for processing authentication failure according to an embodiment of the present application;

fig. 4 is a schematic flow chart of a processing method for authentication failure according to an embodiment of the present application;

fig. 5 is a schematic flow chart of a processing method for authentication failure according to an embodiment of the present application;

Fig. 6 is a schematic flow chart of a processing method for authentication failure according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of an authentication failure processing apparatus according to an embodiment of the present application;

Fig. 8 is a schematic structural diagram of a processing device for authentication failure according to an embodiment of the present application;

fig. 9 is a schematic structural diagram of a communication device according to an embodiment of the present application;

Fig. 10 shows a schematic hardware structure of a terminal according to an embodiment of the present application;

Fig. 11 shows a schematic hardware structure of a network side device according to an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

The terms first, second and the like in the description and in the claims, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate, such that embodiments of the application may be practiced otherwise than as specifically illustrated and described herein, and that the "first" and "second" distinguishing between objects generally being of the same type, and not necessarily limited to the number of objects, such as the first object may be one or more. Furthermore, in the description and claims, "and/or" means at least one of the connected objects, and the character "/" generally means a relationship in which the associated object is an "or" before and after.

It should be noted that the techniques described in the embodiments of the present application are not limited to long term evolution (Long Term Evolution, LTE)/LTE evolution (LTE-Advanced, LTE-a) systems, but may also be used in other wireless communication systems, such as code division multiple access (Code Division Multiple Access, CDMA), time division multiple access (Time Division Multiple Access, TDMA), frequency division multiple access (Frequency Division Multiple Access, FDMA), orthogonal frequency division multiple access (Orthogonal Frequency Division Multiple Access, OFDMA), single-carrier frequency division multiple access (Single-carrier Frequency-Division Multiple Access, SC-FDMA), and other systems. The terms "system" and "network" in embodiments of the application are often used interchangeably, and the techniques described may be used for both the above-mentioned systems and radio technologies, as well as other systems and radio technologies. However, the following description describes a New Radio (NR) system for exemplary purposes, and NR terminology is used in much of the following description, but these techniques may also be applied to applications other than NR system applications, such as a 6 th Generation (6G) communication system.

Fig. 1 shows a block diagram of a wireless communication system to which an embodiment of the present application is applicable. The wireless communication system includes a terminal 11 and a network device 12. The terminal 11 may also be referred to as a terminal device or a User Equipment (UE), and the terminal 11 may be a terminal-side device such as a Mobile phone, a tablet Computer (Tablet Personal Computer), a Laptop (Laptop Computer) or a Personal digital assistant (Personal DIGITAL ASSISTANT, PDA), a palm Computer, a netbook, an ultra-Mobile Personal Computer (ultra-Mobile Personal Computer, UMPC), a Mobile internet device (Mobile INTERNET DEVICE, MID), a wearable device (Wearable Device) or a vehicle-mounted device (VUE), a pedestrian terminal (PUE), and the wearable device includes: a bracelet, earphone, glasses, etc. It should be noted that the specific type of the terminal 11 is not limited in the embodiment of the present application. The network side device 12 may be a base station or a core network, wherein the base station may be referred to as a node B, an evolved node B, an access Point, a base transceiver station (Base Transceiver Station, BTS), a radio base station, a radio transceiver, a Basic service set (Basic SERVICE SET, BSS), an Extended service set (Extended SERVICE SET, ESS), a node B, an evolved node B (eNB), a home node B, a home evolved node B, a WLAN access Point, a WiFi node, a transmission and reception Point (TRANSMITTING RECEIVING Point, TRP), or some other suitable terminology in the field, as long as the same technical effect is achieved, the base station is not limited to a specific technical vocabulary.

The core network may include functional entities such as access and mobility management function (ACCESS AND Mobility Management Function, AMF) entities, session management function (Session Management Function, SMF) entities, authentication service function (Authentication Server Function, AUSF) entities, digital certificate service (DIGITAL CERTIFICATE solutions, DCS) entities, and the like.

The method for processing authentication failure provided by the embodiment of the application is described in detail below through specific embodiments and application scenarios thereof with reference to the accompanying drawings.

Fig. 2 is a flow chart of a method for processing authentication failure in an embodiment of the present application, where the method 200 may be performed by a network side device (e.g., an AMF entity of a core network). In other words, the method may be performed by software or hardware installed on the network-side device. As shown in fig. 2, the method may include the following steps.

S210, in the case of authentication failure of the terminal, the AMF entity determines an authentication failure reason value returned to the terminal according to a first message, wherein the first message indicates whether the current network is used for onboarding of the terminal.

The current network refers to a network to which the terminal is currently connected.

In the embodiment of the present application, the configuration of the Network (onboarding) refers to that the terminal obtains information such as a certificate of a target independent Non-Public Network (SNPN) through accessing the current Network.

In one possible implementation, the information carried in the first message includes, but is not limited to: the registration type of the terminal and/or the authentication parameter of the terminal are not limited to this, and in practical application, the first message may also carry other information, as long as the network side can determine whether the current network is used for onboarding of the terminal according to the information, which is not limited in the embodiment of the present application.

In one possible implementation, the first message may be sent by the terminal, and thus, in this possible implementation, before S210, the method may further include: and receiving the first message sent by the terminal.

In the foregoing possible implementation manner, the first message may include: a registration request message, e.g., a terminal initiated registration request message for onboarding. From the registration request message, the AMF may determine onboarding whether the current network is used for the terminal.

In one possible implementation manner, if the first message indicates that the current network is used for onboarding of the terminal, the cause value of authentication failure determined by AMF may be a new added cause value, that is, a first target cause value, where the first target cause value is used in the system to indicate authentication failure in onboarding process of the terminal, where the first target cause value may be used to indicate authentication failure in onboarding process of the terminal, through which authentication failure in onboarding process of the terminal may be directly indicated, and according to which the terminal may determine that authentication fails when the current network is used as onboarding network, and may identify the current network as a network unsuitable for onboarding.

Or in another possible implementation manner, if the first message indicates that the current network is used for onboarding of the terminal, the authentication failure cause value determined by the AMF may also be a second target cause value, where the second target cause value is used to indicate that the authentication of the terminal fails, that is, the second target cause value is not dedicated to indicate that the authentication in onboarding of the terminal fails. For example, the second target cause values may be #3, #74 and #75 existing in the system, which is of course not limited thereto, and in practical application, the second target cause value may also be other specific values, which may be cause values in the system indicating authentication failure of the terminal in other cases. With the possible implementation manner, the terminal side can combine the registration type to determine the reason of authentication failure.

S220, sending a second message to the terminal, wherein the second message carries the authentication failure reason value.

For example, the AMF may send a registration reject message to the terminal, where the registration reject message carries the authentication failure cause value. Of course, the AMF may also send the authentication failure cause value to the terminal through other messages, which is not limited in the embodiment of the present application.

By the method for processing authentication failure provided by the embodiment of the application, under the condition that the authentication of the terminal fails, the access and mobile management functional entity determines the authentication failure reason value returned to the terminal according to the first message of onboarding indicating whether the current network is used for the terminal, and sends the authentication failure reason value to the terminal, so that the network serving as onboarding can select the corresponding reason value after the authentication of the terminal fails.

Fig. 3 shows another flow chart of a method for processing authentication failure in an embodiment of the present application, and the method 300 may be performed by a terminal. In other words, the method may be performed by software or hardware installed on the terminal. As shown in fig. 3, the method may include the following steps.

And S310, the terminal receives a second message, wherein the authentication failure cause value carried in the second message.

The second message is the same as the second message in the method 200, and the authentication failure cause value carried in the second message is the same as that in the method 200, which can be specifically referred to the description in the method 200.

And S320, if the authentication failure indicated by the authentication failure cause value is determined to be the authentication failure of onboarding processes of the terminal, marking the independent non-public network SNPN which is accessed currently as a network which is forbidden to be selected as onboarding.

In one possible implementation manner, if the authentication failure cause value is the first target cause value described in the method 200, the terminal may determine that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding procedure of the terminal according to the first target cause value. Thus, in this possible implementation manner, determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal includes: and if the authentication failure cause value is a first target cause value, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the first target cause value is used for indicating the cause value of the authentication failure in the onboarding process of the terminal.

Or in another possible implementation, if the authentication failure cause value is the second target cause value described in the method 200, the terminal may determine whether the purpose of the current registration is to be onboarding that the authentication failure indicated by the authentication failure cause value is an authentication failure of the onboarding procedure of the terminal. Thus, in this possible implementation manner, determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal includes: if the authentication failure cause value is a second target cause value and the purpose of the current registration is onboarding, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the second target cause value is used for indicating the authentication failure of the terminal.

Optionally, the second target cause value may include any one of the following: 3. 74, 75. That is, the second target cause value may be one of #3, #74 or #75 in the existing system, but of course, not limited thereto, and the second target cause value may be other cause values in the existing system.

In one possible implementation, if the second target cause value is #3, an entry corresponding to SNPN of the current service in the subscription information list (list of subscriber data) of the terminal may be set to unavailable if the purpose of the current registration type is not onboarding. If the second target cause value is #74 or #75, if the purpose of the current registration type is not onboarding, SNPN ID of the current access network may be stored in a temporary forbidden SNPN (temporarily forbidden SNPNs) list, where #75 differs from #74 in that if the second target cause value is #74, SNPN ID is stored as a globally unique identity of the SNPN network.

In one possible implementation, marking SNPN the current access as prohibiting the network selected as onboarding may include: the SNPN identity of SNPN currently accessed is recorded in a target list, wherein the target list is used for recording SNPN identities of networks which are forbidden to be selected as onboarding by the terminal. Through the target list, the networks prohibited from being selected by the terminal as onboarding can be uniformly managed.

In a specific application, after determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of onboarding procedures of the terminal, if the target list currently exists, adding the SNPN identifier of SNPN which is currently accessed to the target list, if the target list does not currently exist, creating the target list, and recording the SNPN identifier of SNPN which is currently accessed to the target list.

In one possible implementation, after marking SNPN currently accessed as a network prohibited from being selected as onboarding, the terminal prohibits selecting SNPN networks recorded in the target list as the network of onboarding if set to the automatic network selection mode. With this possible implementation, in the case where the terminal is set to the automatic network selection mode, the network corresponding to the SNPN identification recorded in the target list is prohibited as a network of onboarding.

In another possible implementation, if the terminal is set in the manual network selection mode, after marking SNPN currently accessed as prohibiting the network to be selected as onboarding, the method may further include: in the case of being set to the manual network selection mode, in response to an input network selection command, one of the following processes is performed:

(1) The SNPN identifiers recorded in the target list are not displayed; for example, if the network selection command entered selects a network that is onboarding, the SNPN identification recorded in the target list is not displayed so that the user does not select the SNPN network recorded in the target list as the network of onboarding.

(2) Displaying SNPN identifiers recorded in the target list; for example, if the entered network selection command selects a network other than onboarding, the SNPN identification recorded in the target list may be displayed so that the user may select the SNPN network recorded in the target list as a network for other purposes than onboarding.

(3) The SNPN identities recorded in the target list are displayed and the SNPN identity recorded in the target list is identified as an identity that prohibits SNPN networks selected as onboarding. With this possible implementation, the user may be prompted when SNPN identifiers recorded in the target list are displayed, that the SNPN networks corresponding to these SNPN identifiers are prohibited from being selected as onboarding, so that the user may not select SNPN recorded in the target list when selecting onboarding networks.

By the method for processing authentication failure provided by the embodiment of the application, when the terminal receives the second message carrying the authentication failure cause value, if the authentication failure indicated by the authentication failure cause value is determined to be the authentication failure of the onboarding process of the terminal, the current accessed SNPN is marked as the network which is forbidden to be selected as onboarding, so that the terminal can not select the current accessed SNPN as the onboarding network in the subsequent process when onboarding is carried out, and the success rate of onboarding is improved.

Fig. 4 is a flowchart of a method for processing authentication failure according to an embodiment of the present application, where the method 400 may be performed by a terminal and a network side device. In other words, the method may be performed by software or hardware installed on the terminal and the network-side device. Wherein, the network side equipment can include: AMF entity, AUSF entity and DCS entity. As shown in fig. 4, the method may include the following steps.

S410, the UE initiates a registration request for onboarding.

S420, the AMF initiates an authentication request to AUSF (Nausf _ UEAuthentication _ Aunthenticate Request).

S430, AUSF authenticate the UE by DCS, e.g., using default credentials.

S440, the authentication result is failure, for example, the DCS does not have authentication information of the UE, etc.;

S450, the AMF sends a registration rejection message to the UE, wherein the registration rejection message comprises a cause: #X. Wherein X is a cause value dedicated to indicating authentication failure in onboarding procedures of the terminal, for example, a newly defined authentication failure cause value.

S460, the UE receives the signal containing the cause: following the registration reject message for #x, the SNPN ID is stored, which may be implemented by creating or updating SNPN IDs a list for storing SNPN identities (forbidden onboarding SNPN IDs) that are prohibited from being selected as onboarding.

S470, the UE selects other O-SNPN for registration.

Wherein, in the automatic network selection mode, the UE selects other available onboarding networks for registration according to the stored forbidden onboarding SNPN IDs information and the SNPN IDs information supporting onboarding.

In manual network selection mode: for forbidden onboarding SNPN IDs, there are several treatments:

Not presented to the user, or

Is presented to the user, or

When presented to the user, the SNPN IDs may be indicated as SNPN IDs of forbidden onboarding.

Fig. 5 is a flowchart of a method for processing authentication failure according to an embodiment of the present application, where the method 500 may be performed by a terminal and a network side device. In other words, the method may be performed by software or hardware installed on the terminal and the network-side device. Wherein, the network side equipment can include: AMF entity, AUSF entity and DCS entity. As shown in fig. 5, the method may include the following steps.

S510-S540 are the same as S S-S410-S440 in method 400, and are not described in detail herein.

S550, sending a cause value #3 in the registration rejection to indicate authentication failure.

S560, when the UE receives the cause value #3, it is judged that the current registration type is onboarding.

S570, storing the SNPN ID, which may be accomplished by creating or updating SNPN IDs a list for storing forbidden onboarding SNPN IDs instead of setting the SNPN ID as unavailable.

In this embodiment, if the purpose of the current registration type is for initial registration or the like (i.e., the registration request is not for onboarding), then in one embodiment, the entry of "list of subscriber data" corresponding to the current SNPN is set to unavailable, i.e., the entry corresponding to SNPN of the current service in the subscription information list of the terminal is set to unavailable, i.e., SNPN ID is set to unavailable.

S580 is the same as S470 and will not be described here again.

Fig. 6 is a flowchart of a method for processing authentication failure according to an embodiment of the present application, where the method 600 may be performed by a terminal and a network side device. In other words, the method may be performed by software or hardware installed on the terminal and the network-side device. Wherein, the network side equipment can include: AMF entity, AUSF entity and DCS entity. As shown in fig. 6, the method may include the following steps.

S610-S640 are the same as S S-S410-S440 in method 400, and are not described in detail herein.

S650, sending a cause value #74 or #75 in the registration reject indicates authentication failure.

Wherein, if onboarding SNPN of the UE currently attempting to access has a globally unique SNPN identification, if authentication fails, AMF sends a cause value #75 to the UE, otherwise, AMF sends a cause value #74 to the UE.

S660, when the UE receives the cause value #74 or 75, the current registration type is judged to be onboarding.

S670, storing the SNPN ID, which may be accomplished by creating or updating SNPN IDs a list for storing forbidden onboarding SNPN IDs instead of setting the SNPN ID as unavailable.

In this embodiment, if the purpose of the current registration type is not onboarding or the like (i.e., the registration request is not onboarding), then in one implementation, this SNPN ID is stored in a temporary forbidden SNPN network (temporarily forbidden SNPNs) list.

S680, which is the same as S470, is not described here again.

It should be noted that, in the authentication failure processing method provided by the embodiment of the present application, the execution body may be an authentication failure processing device, or a control module for executing the authentication failure processing method in the authentication failure processing device. In the embodiment of the application, the processing method of authentication failure executed by the processing device of authentication failure is taken as an example, and the processing device of authentication failure provided by the embodiment of the application is described.

Fig. 7 is a schematic structural diagram of an authentication failure processing apparatus according to an embodiment of the present application, as shown in fig. 3, where the authentication failure processing apparatus mainly includes: a determination module 701 and a first transceiver module 702.

In the embodiment of the present application, a determining module 701 is configured to determine, in case of authentication failure of a terminal, an authentication failure cause value returned to the terminal according to a first message, where the first message indicates whether a current network is used for configuration access network onboarding of the terminal; and the first transceiver module 702 is configured to send a second message to the terminal, where the second message carries the authentication failure cause value.

In a possible implementation manner, the first message carries a registration type of the terminal and/or an authentication parameter of the terminal.

In one possible implementation manner, the determining module 701 determines, according to the first message, an authentication failure cause value returned to the terminal, including: if the first message indicates that the current network is used for onboarding of the terminal, determining the authentication failure cause value as a first target cause value, wherein the first target cause value is used for indicating authentication failure in a onboarding process of the terminal.

In one possible implementation manner, the determining module 701 determines, according to the first message, an authentication failure cause value returned to the terminal, including: if the first message indicates that the current network is used for onboarding of the terminal, determining the authentication failure cause value as a second target cause value, wherein the second target cause value is used for indicating authentication failure of the terminal.

In a possible implementation manner, the first transceiver module 702 is further configured to receive the first message sent by the terminal before determining, according to the first message, an authentication failure cause value returned to the terminal.

By means of the device for processing authentication failure provided by the embodiment of the present application, the determining module 701 determines, in the case of authentication failure of the terminal, the reason value of authentication failure returned to the terminal according to the first message indicating whether the current network is used for the terminal onboarding, and the first transceiver module 702 sends the reason value of authentication failure to the terminal, so that after authentication failure of the terminal, the corresponding reason value can be selected as the network onboarding.

The device for processing authentication failure in the embodiment of the application can be a device, and can also be a component, an integrated circuit or a chip in network side equipment. The apparatus may be a network side device. Exemplary network-side devices may include, but are not limited to, the AMF entity described above, and embodiments of the present application are not limited in detail.

The network side device in the embodiment of the application can be a device with an operating system. The operating system may be an Android operating system, an ios operating system, or other possible operating systems, and the embodiment of the present application is not limited specifically.

The network side device provided by the embodiment of the present application can implement each process implemented by the network side device in each method embodiment of fig. 2 to fig. 6, and achieve the same technical effects, and in order to avoid repetition, a detailed description is omitted here.

Fig. 8 is another schematic structural diagram of an authentication failure processing apparatus according to an embodiment of the present application, where, as shown in fig. 8, the authentication failure processing apparatus may include: a second transceiver module 801 and a processing module 802.

In the embodiment of the present application, the second transceiver module 801 is configured to receive a second message, where the second message carries an authentication failure cause value; a processing module 802, configured to mark SNPN currently accessed as a network that is forbidden to be selected as onboarding if it is determined that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal.

In one possible implementation, the determining, by the processing module 802, that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal includes: and if the authentication failure cause value is a first target cause value, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the first target cause value is used for indicating the cause value of the authentication failure in the onboarding process of the terminal.

In one possible implementation, the determining, by the processing module 802, that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal includes:

If the authentication failure cause value is a second target cause value and the purpose of the current registration is onboarding, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding process of the terminal, wherein the second target cause value is used for indicating the authentication failure of the terminal.

In one possible implementation, the processing module 802 marks the independent non-public network SNPN currently accessed as a network to be forbidden to be selected as onboarding, including: recording SNPN identification of the currently accessed SNPN in a target list, wherein the target list is used for recording SNPN identifications of networks forbidden to be selected as onboarding by the terminal.

In one possible implementation, the processing module 802 is further configured to, after marking the currently accessed independent non-public network SNPN as a network prohibited from being selected as onboarding, prohibit selecting the corresponding SNPN network as onboarding network as the SNPN identifier recorded in the target list if set to the automatic network selection mode.

In one possible implementation, the processing module 802 is further configured to, after marking the currently accessed independent non-public network SNPN as a network to be prohibited from being selected as onboarding, perform, in response to the input network selection command, one of the following processes if set to the manual network selection mode:

the SNPN identifiers recorded in the target list are not displayed;

displaying SNPN identifiers recorded in the target list;

The SNPN identities recorded in the target list are displayed and the SNPN identity recorded in the target list is identified as an identity that prohibits SNPN networks selected as onboarding.

The device for processing authentication failure in the embodiment of the application can be a device, and can also be a component, an integrated circuit or a chip in a terminal. The device may be a mobile terminal or a non-mobile terminal. By way of example, mobile terminals may include, but are not limited to, the types of terminals 11 listed above, and non-mobile terminals may be servers, network attached storage (Network Attached Storage, NAS), personal computers (personal computer, PCs), televisions (TVs), teller machines, self-service machines, etc., and embodiments of the present application are not limited in particular.

The processing device for authentication failure in the embodiment of the present application may be a device with an operating system. The operating system may be an Android operating system, an ios operating system, or other possible operating systems, and the embodiment of the present application is not limited specifically.

The device for processing authentication failure provided by the embodiment of the application can realize each process realized by the terminal of the method embodiment of fig. 2 to 6 and achieve the same technical effect, and is not repeated here for avoiding repetition.

Optionally, as shown in fig. 9, the embodiment of the present application further provides a communication device 900, including a processor 901, a memory 902, and a program or an instruction stored in the memory 902 and capable of running on the processor 901, where, for example, the communication device 900 is a terminal, the program or the instruction implements each process of the foregoing embodiment of the authentication failure processing method when executed by the processor 901, and the same technical effects can be achieved. When the communication device 900 is a network side device, the program or the instruction implements each process implemented by the AMF or the network side device in the embodiment of the method for processing authentication failure when being executed by the processor 901, and the same technical effects can be achieved, so that repetition is avoided, and no description is repeated here. When the communication device 900 is a terminal, the program or the instruction is executed by the processor 901 to implement each process implemented by the terminal in the embodiment of the method for processing authentication failure, and the same technical effects can be achieved, so that repetition is avoided, and no further description is given here.

Fig. 10 is a schematic diagram of a hardware structure of a terminal for implementing an embodiment of the present application.

The terminal 1000 includes, but is not limited to: radio frequency unit 1001, network module 1002, audio output unit 1003, input unit 1004, sensor 1005, display unit 1006, user input unit 1007, interface unit 1008, memory 1009, and processor 1010.

Those skilled in the art will appreciate that terminal 1000 can also include a power source (e.g., a battery) for powering the various components, which can be logically connected to processor 1010 by a power management system so as to perform functions such as managing charge, discharge, and power consumption by the power management system. The terminal structure shown in fig. 10 does not constitute a limitation of the terminal, and the terminal may include more or less components than shown, or may combine some components, or may be arranged in different components, which will not be described in detail herein.

It should be appreciated that in embodiments of the present application, the input unit 1004 may include a graphics processor (Graphics Processing Unit, GPU) 10041 and a microphone 10042, where the graphics processor 10041 processes image data of still pictures or video obtained by an image capturing device (e.g., a camera) in a video capturing mode or an image capturing mode. The display unit 1006 may include a display panel 10061, and the display panel 10061 may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like. The user input unit 1007 includes a touch panel 10071 and other input devices 10072. The touch panel 10071 is also referred to as a touch screen. The touch panel 10071 can include two portions, a touch detection device and a touch controller. Other input devices 10072 may include, but are not limited to, a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and so forth, which are not described in detail herein.

In the embodiment of the present application, after receiving downlink data from a network side device, the radio frequency unit 1001 processes the downlink data with the processor 1010; in addition, the uplink data is sent to the network side equipment. In general, the radio frequency unit 1001 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.

The memory 1009 may be used to store software programs or instructions and various data. The memory 1009 may mainly include a storage program or instruction area and a storage data area, wherein the storage program or instruction area may store an operating system, an application program or instruction (such as a sound playing function, an image playing function, etc.) required for at least one function, and the like. In addition, the Memory 1009 may include a high-speed random access Memory, and may also include a nonvolatile Memory, wherein the nonvolatile Memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable Programmable ROM (EPROM), an Electrically Erasable Programmable EPROM (EEPROM), or a flash Memory. Such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device.

The processor 1010 may include one or more processing units; alternatively, the processor 1010 may integrate an application processor that primarily processes operating systems, user interfaces, and applications or instructions, etc., with a modem processor that primarily processes wireless communications, such as a baseband processor. It will be appreciated that the modem processor described above may not be integrated into the processor 1010.

The radio frequency unit 1001 is configured to receive a second message, where the second message carries an authentication failure cause value.

And a processor 1010, configured to mark the independent non-public network SNPN currently accessed as a network that is forbidden to be selected as onboarding if it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of onboarding procedures of the terminal.

Specifically, the embodiment of the application also provides network side equipment. As shown in fig. 11, the network device 1100 includes: an antenna 1101, a radio frequency device 1102, and a baseband device 1103. The antenna 1101 is connected to a radio frequency device 1102. In the uplink direction, the radio frequency device 1102 receives information via the antenna 1101, and transmits the received information to the baseband device 1103 for processing. In the downlink direction, the baseband device 1103 processes information to be transmitted, and transmits the processed information to the radio frequency device 1102, and the radio frequency device 1102 processes the received information and transmits the processed information through the antenna 1101.

The above-described band processing apparatus may be located in the baseband apparatus 1103, and the method performed by the network-side device in the above embodiment may be implemented in the baseband apparatus 1103, where the baseband apparatus 1103 includes a processor 1104 and a memory 1105.

The baseband apparatus 1103 may, for example, include at least one baseband board, where a plurality of chips are disposed, as shown in fig. 11, where one chip, for example, a processor 1104, is connected to the memory 1105 to call a program in the memory 1105 to perform the network device operation shown in the above method embodiment.

The baseband device 1103 may further comprise a network interface 1106 for interacting with the radio frequency device 1102, such as a common public radio interface (common public radio interface, CPRI for short).

Specifically, the network side device of the embodiment of the present invention further includes: instructions or programs stored in the memory 1105 and executable on the processor 1104, the processor 1104 invokes the instructions or programs in the memory 1105 to perform the method performed by the modules shown in fig. 8 and achieve the same technical effects, so repetition is avoided and will not be described here.

The embodiment of the application also provides a readable storage medium, on which a program or an instruction is stored, which when executed by a processor, implements each process of the above-mentioned authentication failure processing method embodiment, and can achieve the same technical effect, so that repetition is avoided, and no further description is given here.

The processor may be a processor in the terminal described in the above embodiment, or a processor in the network side device described in the above embodiment. The readable storage medium includes a computer readable storage medium such as a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and the like.

The embodiment of the application further provides a chip, the chip comprises a processor and a communication interface, the communication interface is coupled with the processor, the processor is used for running a program or an instruction of a network side device or a terminal, each process of the authentication failure processing method embodiment is realized, the same technical effect can be achieved, and the repetition is avoided, and the description is omitted here.

The embodiment of the application also provides a computer program product, which comprises a processor, a memory and a program or an instruction stored in the memory and capable of running on the processor, wherein the program or the instruction realizes each process of the processing method embodiment of authentication failure when being executed by the processor, and can achieve the same technical effect, and in order to avoid repetition, the description is omitted here.

It should be understood that the chips referred to in the embodiments of the present application may also be referred to as system-on-chip chips, or the like.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element. Furthermore, it should be noted that the scope of the methods and apparatus in the embodiments of the present application is not limited to performing the functions in the order shown or discussed, but may also include performing the functions in a substantially simultaneous manner or in an opposite order depending on the functions involved, e.g., the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present application.

The embodiments of the present application have been described above with reference to the accompanying drawings, but the present application is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many forms may be made by those having ordinary skill in the art without departing from the spirit of the present application and the scope of the claims, which are to be protected by the present application.

Claims

1. A method for processing authentication failure, the method comprising:

Under the condition that authentication of a terminal fails, an access and mobile management functional entity determines an authentication failure cause value returned to the terminal according to a registration request message sent by the terminal, wherein the registration request message is used for indicating that a current network is used for configuring a network onboarding of the terminal;

Sending a registration rejection message to the terminal, wherein the registration rejection message carries the authentication failure reason value, and the authentication failure reason value comprises any one of the following: a first target cause value for indicating authentication failure in onboarding procedures of the terminal, and a second target cause value for determining authentication failure in onboarding procedures of the terminal together with registration purpose; the registration purpose is for onboarding.

2. Method according to claim 1, characterized in that the registration request message carries the registration type of the terminal and/or the authentication parameters of the terminal.

3. A method according to claim 1 or 2, characterized in that before the access and mobility management function determines the authentication failure cause value returned to the terminal from the registration request message, the method further comprises:

and receiving the registration request message sent by the terminal.

4. A method for processing authentication failure, the method comprising:

The terminal receives a registration rejection message, wherein the registration rejection message carries an authentication failure reason value, and the authentication failure reason value comprises any one of the following: a first target cause value for indicating authentication failure in onboarding procedures of the terminal, and a second target cause value for determining authentication failure in onboarding procedures of the terminal together with registration purpose; the registration purpose is for onboarding;

if it is determined that the authentication failure indicated by the authentication failure cause value is the authentication failure of onboarding procedures of the terminal, the independent non-public network SNPN currently accessed is marked as a network which is forbidden to be selected as onboarding.

5. The method of claim 4, wherein determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal comprises:

And if the authentication failure cause value is the first target cause value, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of onboarding processes of the terminal.

6. The method of claim 4, wherein determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal comprises:

if the authentication failure cause value is the second target cause value and the purpose of the current registration is onboarding, determining that the authentication failure indicated by the authentication failure cause value is the authentication failure of the onboarding procedure of the terminal.

7. The method according to any of claims 4 to 6, wherein marking the currently accessed independent non-public network SNPN as a network forbidden to be selected as onboarding comprises:

Recording SNPN identification of the currently accessed SNPN in a target list, wherein the target list is used for recording SNPN identifications of networks forbidden to be selected as onboarding by the terminal.

8. The method of claim 7, wherein after marking the independent non-public network SNPN currently accessed as the network prohibited from being selected as onboarding, the method further comprises:

in the case of being set to the automatic network selection mode, the terminal prohibits selection of the network corresponding to SNPN identification recorded in the target list as the network of onboarding.

9. The method of claim 7, wherein after marking the independent non-public network SNPN currently accessed as the network prohibited from being selected as onboarding, the method further comprises:

in the case of being set to the manual network selection mode, in response to an input network selection command, one of the following processes is performed:

the SNPN identifiers recorded in the target list are not displayed;

displaying SNPN identifiers recorded in the target list;

10. An apparatus for processing authentication failure, the apparatus comprising:

The determining module is used for determining an authentication failure cause value returned to the terminal according to a registration request message sent by the terminal under the condition that authentication of the terminal fails, wherein the registration request message is used for indicating that the current network is used for onboarding of the terminal;

The first transceiver module is configured to send a registration rejection message to the terminal, where the registration rejection message carries the authentication failure cause value, and the authentication failure cause value includes any one of the following: a first target cause value for indicating authentication failure in onboarding procedures of the terminal, and a second target cause value for determining authentication failure in onboarding procedures of the terminal together with registration purpose; the registration purpose is for onboarding.

11. The apparatus according to claim 10, characterized in that the registration request message carries the registration type of the terminal and/or the authentication parameters of the terminal.

12. The apparatus according to claim 10 or 11, wherein the first transceiver module is further configured to receive the registration request message sent by the terminal before determining, according to the registration request message, an authentication failure cause value returned to the terminal.

13. An apparatus for processing authentication failure, the apparatus comprising:

The second transceiver module is configured to receive a registration rejection message, where the registration rejection message carries an authentication failure cause value, and the authentication failure cause value includes any one of the following: a first target cause value for indicating authentication failure in onboarding procedures of the terminal, and a second target cause value for determining authentication failure in onboarding procedures of the terminal together with registration purpose; the registration purpose is for onboarding;

And the processing module is used for marking the independent non-public network SNPN which is accessed currently as a network which is forbidden to be selected as onboarding if the authentication failure indicated by the authentication failure cause value is determined to be the authentication failure of the onboarding process of the terminal.

14. The apparatus of claim 13, wherein the processing module determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal comprises:

15. The apparatus of claim 13, wherein the processing module determining that the authentication failure indicated by the authentication failure cause value is an authentication failure of onboarding procedures of the terminal comprises:

16. The apparatus of any of claims 13 to 15, wherein the processing module marks the independent non-public network SNPN currently accessed as a network prohibited from being selected as onboarding, comprising:

17. The apparatus of claim 16, wherein the processing module is further configured to inhibit selection of a corresponding SNPN network as onboarding for SNPN identification recorded in the target list if set to an automatic network selection mode after marking a currently accessed independent non-public network SNPN as the network to be inhibited from being selected as onboarding.

18. The apparatus of claim 16, wherein the processing module is further configured to, after marking the currently accessed independent non-public network SNPN as the network to be prohibited from being selected as onboarding, in response to the entered network selection command if set to the manual network selection mode, perform one of:

the SNPN identifiers recorded in the target list are not displayed;

displaying SNPN identifiers recorded in the target list;

19. A network side device comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, which when executed by the processor, implements the steps of the method of handling authentication failure as claimed in any one of claims 1 to 3.

20. A terminal comprising a processor, a memory and a program or instruction stored on the memory and executable on the processor, which when executed by the processor, implements the steps of the method of handling authentication failure as claimed in any one of claims 4 to 9.

21. A readable storage medium, wherein a program or instructions is stored on the readable storage medium, which when executed by a processor, implements the method of handling authentication failures according to any one of claims 1 to 3, or the steps of the method of handling authentication failures according to any one of claims 4 to 9.