WO2020034971A1 - 分配ebi的方法和装置 - Google Patents

分配ebi的方法和装置 Download PDF

Info

Publication number
WO2020034971A1
WO2020034971A1 PCT/CN2019/100460 CN2019100460W WO2020034971A1 WO 2020034971 A1 WO2020034971 A1 WO 2020034971A1 CN 2019100460 W CN2019100460 W CN 2019100460W WO 2020034971 A1 WO2020034971 A1 WO 2020034971A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
information
pdu session
eps
encryption
Prior art date
Application number
PCT/CN2019/100460
Other languages
English (en)
French (fr)
Inventor
孙海洋
韦安妮
熊春山
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to BR112021002388-7A priority Critical patent/BR112021002388A2/pt
Priority to CA3109203A priority patent/CA3109203A1/en
Priority to EP22207406.4A priority patent/EP4216652A1/en
Priority to EP19849468.4A priority patent/EP3836727B1/en
Publication of WO2020034971A1 publication Critical patent/WO2020034971A1/zh
Priority to US17/174,581 priority patent/US11849313B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/24—Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H04W76/32—Release of transport tunnels

Definitions

  • the present invention relates to the field of communications, and in particular, to a method and device for allocating EBI.
  • a fifth-generation mobile based on quality of service flow (QoS Flow) as shown in FIG. 1A is proposed Communication technology service quality (5th generation, quality of service, 5G QoS) model.
  • the 5G QoS model supports guaranteed bitrate (GBR) QoS Flow and non-guaranteed bitrate (non-GBR).
  • GRR guaranteed bitrate
  • non-GBR non-guaranteed bitrate
  • QoS Flow the data flow controlled by the same QoS Flow has the same QoS guarantee.
  • the UE can establish one or more PDU sessions with the 5GS.
  • Each packet data unit (PDU) session can establish one or more QoS flows.
  • Each QoS flow consists of A QoS Data Flow Identifier (QFI) is used for identification.
  • QFI uniquely represents the QoS Flow ID in a PDU session.
  • PDU sessions in 5GS can be migrated to EPS, and a packet data network (packet data network) corresponding to the PDU session is established in EPS. , PDN) connection.
  • the QoS Flow in the PDU session will map an EPS bearer (EPS bearer) in the PDN connection.
  • EPS bearer EPS bearer
  • the technical problem to be solved by the embodiments of the present invention is to provide a method and device for allocating EBI, which realizes the allocation of EBI that meets requirements for EPS, avoids allocating EBI that does not meet user plane security requirements to EPS bearers, and realizes signaling savings. Overhead and waste of EBI resources.
  • the present application provides a method for allocating EBI, which includes: when the user plane security execution information of a PDU session matches the user plane encryption protection information of an EPS, the transmission management device sends an EBI allocation to the access management device Request information, where the EBI allocation request information is used to request allocation of EBI allocation request information for an EPS bearer whose QoS is mapped in the EPS, and the PDU session includes at least one QoS Flow.
  • the transmission management device sends the EBI allocation request message information to the access management device only when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match. Only when the user plane of the EPS satisfies the security requirements of the PDU session, the EBI is requested to be allocated to avoid the assignment of EBI that does not meet the user plane security requirements to the EPS bearer.
  • SMF + PGW-C obtains user plane security execution information and EPS user plane encryption protection information associated with the PDU session, and QoS Flow is located in the PDU session;
  • the transmission management device sends an EBI allocation request to the access management device.
  • the EBI allocation request carries a PDU session identifier, and the PDU session identifier is the PDU session. Identity.
  • the EPS bearer that needs to be mapped in the EPS for QoS flows When the UE initiates a PDU session establishment request in a non-roaming or local grooming scenario, the PDU session supports between 5GS and EPS. For interworking; indicate that EBI needs to be allocated for ESP bearers whose QoS is mapped in EPS; or
  • the UE initiates a PDU session modification in a non-roaming scenario or a roaming scenario based on local grooming.
  • the PDU session supports interworking between 5GS and EPS; or
  • the UE or network device initiates a PDU session modification based on the routing home roaming scenario, and the PDU session supports interworking between 5GS and EPS; or
  • the UE or the network requested a PDU session modification procedure.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;
  • the integrity protection information indicates that the PDU session is not integrity protected, and the encryption requirement information indicates that the PDU session is not encrypted, the user plane security execution information of the PDU session and the user plane of the EPS The encryption protection information is matched; or
  • the integrity protection information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is encrypted, and the user plane encryption activation information indicates that the EPS has activated user plane encryption.
  • the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information, and the user plane encryption protection information of the EPS includes user plane encryption activation information;
  • the integrity protection requirement information indicates that the PDU session is integrity protected, the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • the transmission management device when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send an EBI allocation request to the access management device.
  • the transmission management device obtains user plane security execution information or receives user plane security execution information from a PCF PDU session according to the subscription information.
  • the present application provides a method for allocating EBI, including: an access management device receives EBI allocation request information from a transmission management device, and the EBI allocation request information is used to request EPS bearer allocation mapped in EPS for QoS Flow EBI; when the user plane security execution information of the PDU session where the QoS Flow is located matches the user plane encryption protection information of the EPS, the access management device sends an EBI allocation response to the transmission management device, and the EBI allocation response carries an access request.
  • the access management device when the access management device receives the EBI allocation request information, the access management device will only perform QoS for the QoS flow in EPS when the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the EPS bearers mapped in the EBI are allocated to avoid the allocation of EBIs that do not meet user plane security requirements to the EPS bearers.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption activation information
  • Integrity protection requirement information indicates that the PDU session is not integrity protected. Encryption requirement information indicates that the PDU session is not encrypted.
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match; or
  • Integrity protection requirement information indicates that the PDU session is not integrity protected.
  • Encryption requirement information indicates that the PDU session is encrypted.
  • User plane encryption activation information indicates that the user plane encryption of the EPS is activated. The user plane security execution information of the PDU session and the user of the EPS The encryption protection information is matched.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information.
  • the EPS user plane encryption protection information includes: user plane encryption activation information; the integrity protection requirement information indicates the PDU.
  • the user plane security execution information of the PDU session does not match the user plane encryption protection information of the EPS.
  • the access management device when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the access management device sends EBI allocation response information to the transmission management device, and the EBI allocation response information carries EBI allocation failure reason information.
  • this application provides an EBI release method, including:
  • the access management device obtains user plane security execution information of a PDU session, wherein the PDU session includes at least one QoS Flow, and the QOS Flow is associated with an EPS bearer, and the EPS bearer has been assigned an EBI;
  • the access management device sends an EBI to a transmission management device serving the EPS bearer Release request information, where the EBI release request information is used to indicate that the EPS bearer needs to be released.
  • the access management device judges whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match if the EBI is allocated to the EPS mapped by the QoS in the EPS. , Release the EBI previously allocated for EPS, to avoid the use of EBI that does not meet user plane security requirements when the UE moves from 5GS to EPS.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption activation information
  • the integrity protection requirement information indicates that the PDU session is integrity protected, and then the user plane security execution information of the PDU session does not match the user plane encryption protection information of the EPS.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes user plane encryption activation information
  • Integrity protection requirement information indicates that the PDU session is not integrity protected.
  • Encryption requirement information indicates that the PDU session is encrypted.
  • the user plane encryption activation information indicates that the user plane encryption of the EPS is activated. Then, the user plane security execution information of the PDU session and the EPS Of user plane encryption protection information is matched; or
  • Integrity protection requirement information indicates that the PDU session is not integrity protected. Encryption requirement information indicates that the PDU session is not encrypted. The user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.
  • the access management device when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match, the access management device does not release the EBI carried by the EPS.
  • the method before the access management device obtains the user plane security execution information of the PDU session, the method further includes:
  • the access management device receives a PDU session identifier from the transmission management device and user plane security execution information corresponding to the PDU session identifier.
  • the user plane encryption protection information of the EPS is from the mobile management device in the EPS.
  • Another aspect of the present application provides a device for distributing EBI, which is used to implement a function of a transmission management device behavior in each possible design in the first aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the structure of the transmission management device includes a processor and a transceiver, and the processor is configured to determine whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.
  • the transceiver is configured to send EBI allocation request information to the access management device when the judgment result of the processor is yes, the EBI allocation request information is used to request that EBI be allocated to an EPS bearer whose QoS Flow is mapped in the EPS,
  • the PDU session includes at least one QoS Flow.
  • the transmission management apparatus may further include a memory, which is used for coupling with the processor, and stores program instructions and data necessary for the network device.
  • Another aspect of the present application provides an apparatus for distributing EBI, and the apparatus has a function of realizing the behavior of the access management apparatus in each possible design of the second aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the modules may be software and / or hardware.
  • the structure of the access management device includes a transceiver and a processor, and the transceiver is configured to receive EBI allocation request information from the transmission management device; wherein the EBI allocation request is used to request QoS Flow.
  • the EPS bearer mapped in the EPS is assigned an EBI.
  • a processor configured to determine whether the user plane security execution information of the PDU session in which the QoS flow is located matches the user plane encryption protection information of the EPS.
  • the transceiver is further configured to: when the determination result of the processing unit is yes, send EBI allocation response information to the transmission management device; wherein the EBI allocation response information carries the access management device as the EPS bearer Assigned EBI.
  • the access management apparatus may further include a memory, which is configured to be coupled to the processor and stores program instructions and data necessary for the network device.
  • a further aspect of the present application provides a device for allocating an EBI.
  • the device has a function of implementing the behavior of an access management device in each possible design of the third aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the modules may be software and / or hardware.
  • the structure of the access management device includes a transceiver and a processor, and the processor is configured to obtain user plane security execution information of the PDU session, where the PDU session includes at least one QoS Flow, and the QoS Flow Associated with an EPS bearer, which has been assigned an EBI.
  • the processor is further configured to determine whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS that is pre-stored or pre-configured; the transceiver is configured to determine the result of the processing unit as If not, an EBI release request is sent to a transmission management device serving the EPS bearer, and the EBI release request is used to indicate that the EBI of the EPS bearer needs to be released.
  • the access management apparatus may further include a memory, which is configured to be coupled to the processor and stores program instructions and data necessary for the network device.
  • a further aspect of the present application provides a computer storage medium including instructions that, when run on a computer, cause the computer to perform the method according to any one of the first aspect to each possible implementation manner of the first aspect.
  • a further aspect of the present application provides a computer program product containing instructions, which when executed on a computer, causes the computer to perform the method according to any one of the first aspect to each possible implementation manner of the first aspect.
  • a further aspect of the present application provides a computer storage medium, including instructions, which, when run on a computer, cause the computer to perform the method according to any one of the second aspect to each possible implementation manner of the second aspect.
  • Another aspect of the present application is a computer program product containing instructions, which when executed on a computer, causes the computer to perform the method according to any one of the second aspect to the second possible implementation manner of each of the possible aspects.
  • a further aspect of the present application provides a computer storage medium including instructions that, when run on a computer, cause the computer to execute the method according to any one of the third to third possible implementation manners.
  • Another aspect of the present application provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the method according to any one of the third to third possible implementation manners.
  • FIG. 1A is a schematic diagram of mapping of QoS and Flow in 5GS according to an embodiment of the present invention
  • FIG. 1B is another schematic structural diagram of a communication system according to an embodiment of the present invention.
  • FIG. 1C is another schematic structural diagram of a communication system according to an embodiment of the present invention.
  • FIG. 1D is another schematic structural diagram of a communication system according to an embodiment of the present invention.
  • FIG. 1E is a schematic flowchart of establishing a PDU session according to an embodiment of the present invention.
  • FIG. 1F is a schematic flowchart of a method for allocating an EBI according to an embodiment of the present invention
  • FIG. 2 is another schematic flowchart of a method for allocating an EBI according to an embodiment of the present invention
  • FIG. 3 is another schematic flowchart of a method for allocating an EBI according to an embodiment of the present invention.
  • FIG. 4 is another schematic flowchart of a method for allocating EBI according to an example of the present invention.
  • FIG. 5 is a schematic structural diagram of a device according to an embodiment of the present invention.
  • FIG. 6 is another schematic structural diagram of a device according to an embodiment of the present invention.
  • FIG. 1B is an architecture diagram of a communication system based on a non-roaming scenario for interworking between 5GS and EPC / E-UTRAN based on 5GS and EPS interworking according to an embodiment of the present invention.
  • the communication system of FIG. 1B is an architecture diagram of a communication system based on a non-roaming scenario for interworking between 5GS and EPC / E-UTRAN based on 5GS and EPS interworking according to an embodiment of the present invention.
  • unified data management + home user server unified data management + home subscriber server (UDM + HSS)
  • policy and charging functions + policy and charging rules function (policy and charging function) function PCF + PCRF
  • session management function + control plane PDN gateway session management function + PDN gateway control plane (SMF + PGW-C)
  • user plane function + user plane PDN network element user plane plane function + PDN gateway user plane
  • UPF + PGW-U serving gateway
  • SGW mobility management entity
  • MME evolved universal terrestrial radio access network
  • e-UTRAN user equipment
  • UE access and mobility management function
  • NG-RAN next generation radio access network
  • UE2 next generation radio access network
  • UDM + HSS is a network element composed of HSS in EPS and UDM in 5GS
  • PCF + PCRF is a network element composed of PCRF in EPS and PCF in 5GS
  • SMF + PGW-C is A network element in which PGW-C in EPS and SMF in 5GS are combined
  • UPF + PGW-U is a network element in which PGW-U in EPS and UPF in 5GS are combined.
  • MME and E-UTRAN are network elements in EPS
  • AMF and NG-RAN are network elements in 5GS
  • UE1 accesses through E-UTRAN (core network)
  • UE2 accesses through NG-RAN (core network)
  • UE1 And UE2 can refer to the same UE.
  • the S6a interface represents the communication interface between the MME and HSS + UDM.
  • the S11 interface represents a communication interface between the MME and the SGW.
  • the S1-MME interface represents a communication interface between the MME and the E-UTRAN.
  • the S1-U interface represents a communication interface between E-UTRAN and SGW.
  • the N10 interface represents the communication interface between HSS + UDM and SMF + PGW-C.
  • the S5-C interface represents the communication interface of the control plane between the SGW and SMF + PGW-C.
  • the S5-U interface represents a user plane communication interface between the SGW and the UPF + PGW-U.
  • the N7 interface represents the communication interface between PCF + PCRF and SMF + PGW-C.
  • N4 represents the communication interface between SMF + PGW-C and UPF + PGW-U.
  • the N8 interface represents the communication interface between HSS + UDM and AMF.
  • the N15 interface represents the communication interface between PCF + PCRF and AMF.
  • the N11 interface represents the communication interface between SMF + PGW-C and AMF.
  • the N3 interface represents the communication interface between UPF + PGW-U and NG-RAN.
  • the N2 interface represents a communication interface between NG-RAN and AMF.
  • the N1 interface represents a communication interface between the AMF and the UE.
  • FIG. 1C is an architecture diagram of a communication system based on a 5GS and EPS interworking local roaming scenario (Local breakout architecture for 5G and EPC / E-UTRAN) according to an embodiment of the present invention.
  • the communication system of Figure 1C includes UDM + HSS, home policy and charging function + home policy and charging function + home policy and charging function (h-PCF + h-PCRF), roaming Local policy and charging function + roaming policy and charging rule function (visited policy and charging function + visited policy and charging function, v-PCF + v-PCRF), SMF + PGW-C, UPF + PGW-U, SGW, MME, E-UTRAN, UE1, AMF, NG-RAN, and UE2.
  • UDM + HSS is a network element composed of HSS in EPS and UDM in 5GS
  • h-PCF + h-PCRF and v-PCF + v-PCRF are a combination of PCRF in EPS and PCF in 5GS
  • SMF + PGW-C is a combination of PGW-C in EPS and SMF in 5GS
  • UPF + PGW-U is a combination of PGW-U in EPS and UPF in 5GS Network element.
  • MME and E-UTRAN are network elements in EPS
  • AMF and NG-RAN are network elements in 5GS
  • UE1 resides in E-UTRAN
  • UE2 resides in NG-RAN.
  • HSS + UDM is located in the home public land mobile network (HPLMN), and other network elements in the communication system are located in the roamed public land mobile network VPLMN.
  • HPLMN home public land mobile network
  • the S6a interface represents the communication interface between the MME and HSS + UDM.
  • the S11 interface represents a communication interface between the MME and the SGW.
  • the S1-MME interface represents a communication interface between the MME and the E-UTRAN.
  • the S1-U interface represents a communication interface between E-UTRAN and SGW.
  • the N10 interface represents the communication interface between HSS + UDM and SMF + PGW-C.
  • the S5-C interface represents the communication interface of the control plane between the SGW and SMF + PGW-C.
  • the S5-U interface represents a user plane communication interface between the SGW and the UPF + PGW-U.
  • the N24 interface represents the communication interface between h-PCF + h-PCRF and v-PCF + v-PCRF
  • the N7 interface represents the communication interface between v-PCF + v-PCRF and SMF + PGW-C
  • N4 represents the communication interface between SMF + PGW-C and UPF + PGW-U.
  • the N8 interface represents the communication interface between HSS + UDM and AMF.
  • the N15 interface represents the communication interface between v-PCF + v-PCRF and AMF.
  • the N11 interface represents the communication interface between SMF + PGW-C and AMF.
  • the N3 interface represents the communication interface between UPF + PGW-U and NG-RAN.
  • the N2 interface represents a communication interface between NG-RAN and AMF.
  • the N1 interface represents the communication interface between the AMF and the UE.
  • FIG. 1D is an architecture diagram of a communication system based on home-routed roaming architecture (interworking between 5GS and EPC / E-UTRAN) based on 5GS and EPS interworking according to an embodiment of the present invention.
  • the communication system in Figure 1D includes: HSS + UDM, h-PCF + h-PCRF, SMF + PGW-C, UPF + PGW-U, SGW, MME, E-UTRAN, UE1, v-PCF, v-SMF, UPF , AMF, NG-RAN, and UE2.
  • HSS + UDM is a network element composed of HSS in EPS and UDM in 5GS.
  • h-PCF + h-PCRF is a network element composed of PCF in 5GS and PCRF in EPS.
  • SMF + PGW-C is a network element composed of SMG in 5GS and PGW-C in EPS.
  • UPF + PGW-U is a network element composed of UPF in 5GS and PGW-U in EPS.
  • HSS + UDM, h-PCF + h-PCRF, SMF + PGW-C, UPF + PGW-U are located in HPLMN, and other network elements in the communication system are located in VPLMN.
  • the S6a interface represents the communication interface between the MME and HSS + UDM.
  • the S11 interface represents a communication interface between the MME and the SGW.
  • the S1-MME interface represents a communication interface between the MME and the E-UTRAN.
  • the S1-U interface represents a communication interface between E-UTRAN and SGW.
  • the N10 interface represents the communication interface between HSS + UDM and SMF + PGW-C.
  • the N7 interface represents the communication interface between h-PCF + h-PCRF and SMF + PGW-C.
  • the N4 interface represents the communication interface between SMF + PGW-C and UPF + PGW-U.
  • the S8-C interface represents the communication interface of the control plane between the SMF + PGW-C and the SGW.
  • the S8-U interface represents the user plane communication interface between the SGW and UPF + PGW-U.
  • N26 represents the communication interface between the MME and the AMF.
  • N10 represents the communication interface between HSS + UDM and v-SMF.
  • the N24 interface represents the communication interface between h-PCF + h-PCRF and v-PCF.
  • the N16 interface represents the communication interface between SMF + PGW-C and v-SMF.
  • the N9 interface represents the communication interface between UPF + PGW-U and UPF.
  • the N15 interface represents the communication interface between v-PCF and AMF.
  • the N11 interface represents the communication interface between v-SMF and AMF.
  • the N4 interface represents the communication interface between UPF and v-SMF.
  • the N3 interface represents the communication interface between UPF and NG-RAN.
  • the N2 interface represents the communication interface between AMF and NG-RAN.
  • the N1 interface represents a communication interface between the UE and the
  • FIG. 1B The functions of each network element in FIG. 1B, FIG. 1C, and FIG. 1D are described below:
  • UPF + PGW-U Used for user data transmission management.
  • this network element can be used for both EPS data transmission and 5G data transmission functions.
  • SMF + PGW-C used for session establishment, deletion, and modification management.
  • this network element can not only provide EPS session management functions, but also provide 5G session management functions.
  • PCF + PCRF It is used for policy and charging control entities.
  • this network element can provide terminal devices with both EPS policy and charging control, and 5G policy and charging control.
  • HSS + UDM It is used to store the user's subscription data.
  • this network element stores both the contract information of the EPS of the terminal device and the 5G contract information of the terminal device.
  • 5G wireless access network (radio access network, RAN): Provides a wireless air interface for terminal devices to access the core network, thereby obtaining corresponding services.
  • RAN radio access network
  • Evolved universal terrestrial radio access network used for radio resource management, to establish, modify, or delete air interface resources for terminal devices. Provides terminal devices with the transmission of data and signaling.
  • AMF used for user access and mobility management, mainly including user registration management, reachability management mobility management, paging management, access authentication and authorization of non-access layer signaling encryption and integrity protection, etc. .
  • MME used for user mobility management. For example, it mainly includes user's attachment management, reachability management, mobility management, paging management, access authentication, and encryption and integrity protection of authorized non-access layer signaling.
  • SGW User plane gateway
  • E-UTRAN user plane termination point As a local mobile anchor point for handover between base stations. Manage the routing and transmission of data packets, add packet labels at the transport layer, etc.
  • the UE in this application is a device with wireless communication capabilities and can be deployed on land, including indoor or outdoor, handheld, wearable, or vehicle-mounted; it can also be deployed on the water (such as a ship); it can also be deployed in the air (Such as on airplanes, balloons, and satellites).
  • the terminal device may be a mobile phone, a tablet computer, a computer with a wireless transmitting and receiving function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, or an industrial control device.
  • wireless terminal in industrial control wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, transportation safety Wireless terminals, wireless terminals in smart cities, wireless terminals in smart homes, and the like.
  • the terminal device may also be a handheld device with wireless communication function, a vehicle-mounted device, a wearable device, a computing device, or other processing device connected to a wireless modem, and the like.
  • Terminal equipment can be called different names in different networks, for example: terminal equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication Equipment, user agents or user devices, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital processing (PDA), Terminal equipment in 5G networks or future evolution networks.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital processing
  • FIG. 1E is a schematic flowchart of establishing a PDU session in 5GS according to an embodiment of the present invention. The process includes:
  • the UE sends a PDU session establishment request (PDU session establishment request) to the AMF, and the AMF receives a PDU session establishment request from the UE.
  • the PDU session establishment request is used to establish a PDU session in the EGS.
  • AMF selects SMF.
  • the AMF sends a PDU session establishment request to the SMF, and the SMF receives a PDU session establishment request from the AMF.
  • the SMF can send a PDU session establishment request to the AMF through the Nsmf interface.
  • the SMF registers in the UDM and obtains the contract information from the UDM.
  • the contract information includes user plane security policies.
  • the SMF sends a PDU session establishment response (PDU session establishment response) to the AMF, and the AMF receives the PDU session establishment response from the SMF.
  • the SMF may reject the establishment of the PDU session in this step, and the reason value of the rejection is carried in the PDU session establishment response.
  • SMF performs PCF selection.
  • the SMF requests policy rules from the PCF.
  • the SMF may obtain the dynamic user plane security policy of the PDU session from the PCF to update the user plane security policy in the contract information.
  • the SMF sends information related to the PDU session to the PCF (for example, the UE's IP address / prefix, trigger status, etc.), and the PCF receives the information related to the PDU session reported from the SMF.
  • the PCF for example, the UE's IP address / prefix, trigger status, etc.
  • the SMF sends tunnel information and rule information to the UPF, and the UPF receives tunnel information and rule information from the SMF.
  • the SMF sends a PDU session identifier, and session management information (session management information, SM information) and session management container (session management container, SM container) associated with the PDU session identifier to the AMF.
  • session management information session management information, SM information
  • session management container session management container, SM container
  • the AMF sends a PDU session request to the NG-RAN, and the RAN receives the PDU session request from the AMF.
  • the PDU session request includes SM information and NAS messages.
  • the AMF sends the SM Information to the RAN through the N2 interface.
  • the NAS message includes the SM container to the RAN. That is, the AMF sends the SM container to the RAN through the transparent transmission method.
  • SM Information protects user plane policy enforcement of PDU sessions.
  • the NG-RAN and the UE perform access network specific resource setup (AN specific resource setup).
  • the NR-RAN sends a PDU session establishment acceptance to the UE.
  • the NG-RAN sends a PDU session request acknowledgement (PDU session request ACK) to the AMF, and the AMF accepts the PDU session request acknowledgement from the NG-RAN.
  • PDU session request ACK PDU session request acknowledgement
  • the AMF sends an update session management context request (PDU session update SM context request) to the SMF, and the SMF accepts an update session management context request from the AMF.
  • the request can be sent through the Nsmf interface.
  • the SMF sends a session modification request to the UPF, and the UPF receives the session modification request from the SMF.
  • the request can be sent through the N4 interface.
  • the UPF sends a session modification response (session modification response) to the SMF, and the SMF receives a session modification response from the SMF. This response can be sent over the N4 interface.
  • session modification response session modification response
  • the SMF sends an update session management context response (PDU session update SM context response) to the AMF, and the AMF receives an update session management context response from the SMF.
  • PDU session update SM context response PDU session update SM context response
  • the session management context status notification sent by the SMF to the AMF (PDU, session, SM, context, status).
  • the AMF receives the session management context status notification from the SMF.
  • the SMF configures an IPv6 address for the UPF and the UE.
  • FIG. 1F is an EBI allocation process according to an embodiment of the present invention.
  • the process includes:
  • the PGW-C + SMF will request the EBI for the corresponding default EPS bearer / dedicated GBR EPS bearer from the AMF.
  • the creation process of the default QoS Flow is during the PDU Session establishment process initiated by the UE, and the creation process of the GBR QoS Flow is during the PDU Session modification process initiated by the UE or the network.
  • the SMF sends an EBI allocation request to the AMF.
  • the EBI allocation request carries the PDU session identifier and the allocation and preemption priority (ARP list) Namf_Communication_EBIAssignment service request, requesting to obtain the EBI allocated by the AMF. PDU Session ID and ARP list.
  • Steps 3-6 are only used by the AMF to release the previously allocated EBI (Note: The number of EBIs in the EPS is limited).
  • the AMF may cancel the previously allocated EBI based on ARP and S-NSSAI and send a request to update the session management context to the SMF + PGW-C serving the EPS bearer. (Note: AMF can assign EBI to multiple SMFs, so the SMF in this step may not be the same as the SMF that sent the request to AMF in step 2.)
  • the SMF sends a session management container (N1, SM container) and session management information (N2, SM information) to the AMF, which are respectively used to notify the UE and the RAN of the released EBI.
  • N1, SM container session management container
  • N2, SM information session management information
  • the AMF first pages the UE, and then the UE initiates the Service Request process.
  • the N2 SM information element and the N1 SM container element in the N2 Session message in the Service Request process are brought to the RAN and UE.
  • the AMF is brought to the RAN and the UE through the N2 SM information element and the N1 SM container information element in the N2 Session Request message.
  • the UE triggers a PDU session modification process.
  • the AMF sends an EBI allocation response to the SMF + PGW-C. If the AMF successfully allocates the EBI, the EBI allocation response carries the allocated EBI. If the AMF fails to allocate the EBI, the EBI allocation response finds that carry failure. Cause value, for example: the failure cause value is insufficient EBI number, the AMF will respond to the assigned EBI to the SMF. If the allocation is not successful, the AMF responds with a cause value indicating that the EBI allocation failed.
  • SMF + PGW-C modifies the user plane tunnel information.
  • the SMF sends N1 SM container and N2 SM information to the AMF, which are used to notify the UE and the RAN of the EBI released, respectively.
  • the AMF sends the allocated EBI to the UE and the RAN.
  • the UE, the RAN, and the network side modify the tunnel information.
  • the AMF allocates EBI to the EPS bearer. Because the user plane security requirements of 5GS are higher than the user plane security capabilities of EPS, after a PDU session that supports EPS migration is migrated to EPS, the user plane security capabilities of EPS may not meet the user plane security requirements of PDU sessions.
  • the EBI allocated by the EPS bearer in which the QoS Flow is mapped in the EPS is unavailable, which results in a waste of limited EBI resources in the EPS, and also increases unnecessary signaling overhead.
  • the present application proposes the solutions of FIGS. 2 to 4.
  • FIG. 2 is a schematic flowchart of a method for allocating EBI according to an embodiment of the present invention.
  • the method includes:
  • the transmission management device determines that the user plane security execution information of the PDU session matches the user plane security protection information of the EPS.
  • one or more QoS flows can be established in a PDU session.
  • the PDU session supports migration to EPS, that is, the PDU session supports establishment of a corresponding PDN connection in the EPS.
  • the QoS Flow maps one in the EPS.
  • EPS bearer Among them, the EPS bearer mapped by QoS and Flow represents the EPS bearer corresponding to QoS in 5GS and EPS.
  • the UE After the UE moves from 5GS to EPS, the UE establishes a PDN connection corresponding to the PDU session in the EPS. Accordingly, the PDU The QoS Flow in the session maps the EPS bearer in the PDN connection.
  • the UE After the PDN connection is successfully established, the UE initiates a process of releasing the PDU session, and one or more QoS Flows in the corresponding PDU session are also released.
  • the EBI needs to be allocated for the EPS bearer whose QoS is mapped in the EPS: 1.
  • the UE In the roaming scenario of non-roaming in FIG. 1B and local grooming in FIG. 1C, The UE initiated the establishment of a PDU session; 2.
  • the UE In the roaming scenario of the home route of FIG. 1D, the UE initiated the establishment of a PDU session; 3.
  • the roaming scenario of FIG. 1B non-roaming and FIG.
  • the transmission management device in this embodiment is used to manage PDU sessions in 5GS and manage PDN connections in EPS, including responsible for establishment, modification, and deletion of PDU sessions, and establishment, modification, and deletion of PDN connections.
  • the transmission management device may be composed of SMF and PGW-C are two types of devices, and it can also be a device with the functions of SMF and PGW-C.
  • the non-roaming scenario indicates that the home network provides services to the UE.
  • the roaming scenario of the home route indicates the home network gateways (h-SMF + PGW-C and h-UPF + PGW-U) roaming access, which means that roaming users obtain services provided by the home network through the home network gateway H-PGW access.
  • Locally groomed roaming scenarios indicate that roaming users access the corresponding services through gateways (v-SMF + PGW-C and v-UPF + PGW-U) of the visited network, and the service provider can be the home network or the visit The internet.
  • the transmission management device obtains a session management policy of the PDU session from the PCF.
  • the PDU session management policy includes a field indicating whether migration to EPS is supported.
  • the session management policy includes EPS support indication. Field, the value of the EPS support indication is "1" to indicate that the PDU session supports migration to EPS; the value of the EPS support indication is "0" indicates that the PDU session does not support migration to EPS.
  • the acquiring, by the transmission management device, the user plane security execution information of the PDU session includes: SMF + PGW-C is pre-stored or pre-configured with a mapping relationship between the PDU session identifier and the user plane security execution information.
  • SMF + PGW-C determines the user plane security execution information corresponding to the PDU session ID according to the mapping relationship; or SMF + PGW-C obtains the user plane security policy contracted in UDM, and the user plane security policy includes the user plane security execution information; or SMF + PGW-C obtains the corresponding user plane security execution information from the PCF.
  • the acquiring, by the transmission management device, the user plane encryption protection information of the EPS includes: the transmission management device pre-stores or preconfigures the user plane encryption protection information of the EPS, and the SMF obtains the user plane encryption protection information of the EPS locally; Or the transmission management device receives the user plane encryption protection information of the EPS sent by the MME in the EPS; or the transmission management device receives the user plane encryption protection information of the EPS from the PCRF.
  • the transmission management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it indicates that the user plane security capabilities of the EPS meet the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session and the EPS user The plane encryption protection information does not match, indicating that the user plane security capabilities of the EPS do not meet the user plane security requirements of the PDU session.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes: user plane encryption activation information
  • the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected
  • the user plane encryption protection information of the EPS indicates that the user plane encryption is activated by the EPS
  • the user plane security execution information of the PDU session and the user plane encryption protection of the EPS The information is matched.
  • the integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted indicates that the PDU session does not require integrity protection.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to analyze the user plane encryption protection information, that is, whether the user plane encryption activation information is activated or unactivated, the transmission management device It can be directly determined that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the integrity protection requirement information indicates that the PDU session is not integrity protected
  • the encryption requirement information indicates that the PDU session is encrypted
  • the user encryption activation information indicates that EPS has activated user plane encryption
  • the PDU session The user plane security execution information matches the user plane encryption protection information of the EPS.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and the encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not required, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS are matched.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information;
  • the integrity requirement information indicates that the PDU session is integrity protected
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and the encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device can directly determine the user plane security execution information of the PDU session without analyzing the encryption protection requirement information and the user plane encryption activation information.
  • the user plane encryption protection information does not match the EPS.
  • the transmission management device sends EBI allocation request information to the access management device, and the access management device receives the EBI allocation request information from the transmission management device.
  • the transmission management device determines that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS
  • the transmission management device sends EBI allocation request information to the access management device
  • the EBI allocation request information carries the PDU session identifier.
  • the PDU session identifier indicates the identity of the PDU session.
  • the access management device receives the EBI allocation request information sent from the transmission management device.
  • the access management device determines that there is an available EBI in the EPS, it allocates the available EBI to the EPS bearer.
  • the access management device initiates an EBI release process, releases the previously allocated EBI, and then allocates the EBI to the EPS bearer.
  • the access management device sends an EBI allocation response to the SMF + PGW-C. If the EBI is successfully allocated for the EPS bearer, the EBI allocation response carries the allocated EBI; if the EBI is not successfully allocated for the EPS, the EBI allocation response carries the reason for the allocation failure. .
  • the access management device may be AMF in 5GS.
  • the judgment condition for the transmission management device to send the EBI allocation request information to the access management device is not limited to only the judgment condition described in S201, and may also include one or more other judgment conditions, such as other judgment conditions.
  • the data network name (DNN) of the PDU session is the local data network (LADN), that is, the user plane security execution information of the PDU session and the user plane security protection information of the EPS are matched. And when the DNN of the PDU session is LADN, the transmission management device sends the EBI allocation request information to the access management device.
  • LADN local data network
  • the transmission management device when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send an EBI allocation request to the access management device, that is, only when the PDU is When the user plane security execution information of the session matches the user plane encryption protection information of the EPS, the transmission management device sends an EBI allocation request to the access management device to avoid that the user plane security capabilities of the EPS do not meet the requirements of the PDU session and cause the EBI resource Waste and overhead of the signaling process.
  • FIG. 3 is another schematic flowchart of an EBI allocation method according to an embodiment of the present invention.
  • the method includes:
  • the access management device receives EBI allocation request information sent from the transmission management device, and the access management device receives EBI allocation request information sent from the transmission management device.
  • the access management device is configured to manage access and mobility of the UE in the 5GS, and the access management device may be an AMF.
  • the transmission management device is used to manage PDU sessions in 5GS and manage PDN connections in EPS, including the establishment, modification, and deletion of PDU sessions, and the establishment, modification, and deletion of PDN connections.
  • the transmission management device can be composed of SMF and PGW-C. Two types of devices can be constructed, and it can also be a type of device with the functions of SMF and PGW-C.
  • the access management device may be AMF in 5GS. In the case that EBI needs to be allocated for the EPS bearer whose QoS is mapped in the EPS, the transmission management device sends EBI allocation request information to the access management device.
  • the EBI allocation request information carries the PDU session identifier, and the PUD session identifier is the identity identifier of the PDU session.
  • the PDU session includes the QoS Flow, and the PDU session supports migration to EPS.
  • the access management device After receiving the EBI allocation request information from the transmission management device, the access management device determines that EBI needs to be allocated for the EPS bearer. The access management device determines whether there is an available EBI in the EPS, and if so, executes S302. If there is no available EBI in the EPS, the access management device initiates an EBI release process to release the previously allocated EBI, and there are available EBIs in the EPS. When EBI is executed, S302 is executed.
  • the access management device determines that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the access management device obtains the user plane security execution information of the PDU session, and obtains the user plane encryption protection information of the EPS.
  • the user plane security execution information of the PDU session and the EPS user plane encryption protection information match to indicate the user plane security of the EPS. Capabilities meet the security needs of PDU sessions.
  • the access management device acquiring the user plane security execution information of the PDU session includes: the access management device pre-stores or preconfigures a mapping relationship between the PDU session identifier and the user plane security execution information, The AMF determines the corresponding user plane security execution information according to the PDU session identifier in the EBI allocation request; or the AMF obtains the user plane security execution information corresponding to the PDU session identifier from the PCF; or the AMF obtains the user plane security corresponding to the PDU session identifier from the SMF Implementation information.
  • the access management device obtaining the user plane encryption protection information of the EPS includes: the access management device prestores or preconfigures the user plane encryption protection information of the EPS; or the access management device receives the information sent from the MME.
  • the user plane of the EPS protects the information.
  • the access management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it indicates that the user plane security capabilities of the EPS meet the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session and the EPS user The plane encryption protection information does not match, indicating that the user plane security capabilities of the EPS do not meet the user plane security requirements of the PDU session.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes: user plane encryption activation information
  • the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected
  • the user plane encryption protection information of the EPS indicates that user plane encryption is activated by the EPS
  • the user plane security execution information of the PDU session and the user plane encryption protection of the EPS The information is matched.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and the encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to analyze the user plane encryption protection information, that is, whether the user plane encryption activation information is activated or unactivated, the transmission management device It can be directly determined that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the integrity protection requirement information indicates that the PDU session is not integrity protected
  • the encryption requirement information indicates that the PDU session is encrypted
  • the user encryption activation information indicates that EPS has activated user plane encryption
  • the PDU session The user plane security execution information matches the user plane encryption protection information of the EPS.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and encryption requirement information can be expressed in bits It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not required, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS are matched.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information;
  • the integrity requirement information indicates that the PDU session is integrity protected
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and encryption requirement information can be expressed in bits It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device can directly determine the user plane security execution information of the PDU session without analyzing the encryption protection requirement information and the user plane encryption activation information.
  • the user plane encryption protection information does not match the EPS.
  • the access management device sends EBI allocation response information to the transmission management device, and the access management device receives the EBI allocation response information from the transmission management device.
  • the access management device allocates EBI for the EPS bearer, and the access management device sends an EBI allocation response to SMF + PGW-C.
  • the EBI allocation response carries the EBI allocated for the EPS bearer
  • the access management device when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the access management device does not allocate an EBI for the EPS bearer, and the access management device manages the transmission to the transmission.
  • the device sends an EBI allocation response, and the EBI allocation response information carries a cause value of the allocation failure, which indicates that the user plane security requirements of the PDU session are not met.
  • the determination condition that the access management device sends the EBI allocation response information carrying the allocated EBI to the transmission management device is not limited to only the determination condition described in S302, and may also include one or more other determination conditions.
  • the other judgment condition is that the data network name (DNN) of the PDU session is the local data network (LADN), that is, the user plane security execution information of the PDU session and the user plane security protection of the EPS are simultaneously met.
  • the access management device will send the EBI allocation response information carrying the allocated EBI to the transmission management device.
  • the access management device when the embodiment of the present invention is implemented, when the access management device receives the EBI allocation request information, the access management device will perform QoS flow only when the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the EPS bearers mapped in the EPS are assigned EBIs to avoid assigning EBIs that do not meet user plane security requirements to the EPS bearers.
  • FIG. 4 is a schematic flowchart of an EBI release method according to an embodiment of the present invention.
  • the method includes:
  • the access management device acquires user plane security execution information of a PDU session and user plane encryption protection information of an EPS.
  • the access management device is configured to manage access and mobility of the UE in the 5GS, and the access management device may be an AMF.
  • the access management device has allocated the EBI for the EPS bearer mapped by Qos Flow in the EPS based on the method of allocating EBI in FIG. 1E, and then the access management device obtains the user plane security execution information of the PDU session and the EPS. User plane encryption to protect information.
  • the access management device may be AMF in 5GS.
  • the access management device acquiring the user plane security execution information of the PDU session includes: the access management device pre-stores or preconfigures a mapping relationship between the PDU session identifier and the user plane security execution information, The access management device determines the corresponding user plane security execution information according to the PDU session identifier in the EBI allocation request; or the access management device obtains the user plane security execution information corresponding to the PDU session identifier from the PCF.
  • the access management device obtaining the user plane encryption protection information of the EPS includes: the access management device prestores or preconfigures the user plane encryption protection information of the EPS; or the access management device receives the information sent from the MME.
  • the user plane of the EPS protects the information.
  • the access management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • the access management device determines whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS. The essence is whether the user plane security capability of the EPS can meet the user plane security requirements of the PDU session. If the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS, it indicates that the user plane security capabilities of the EPS meet the user plane security requirements of the PDU session; if the user plane security execution information of the PDU session and the EPS user The plane encryption protection information does not match, indicating that the user plane security capabilities of the EPS do not meet the user plane security requirements of the PDU session.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes: user plane encryption activation information
  • the user plane security requirement information of the PDU session indicates that the PDU session is not integrity protected
  • the user plane encryption protection information of the EPS indicates that the user plane encryption is activated by the EPS
  • the user plane security execution information of the PDU session and the user plane encryption protection of the EPS The information is matched.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and the encryption requirement information can be expressed in bits It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not needed and the encryption requirement information is not needed, the transmission management device does not need to analyze the user plane encryption protection information, that is, whether the user plane encryption activation information is activated or unactivated, the transmission management device It can be directly determined that the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS.
  • the integrity protection requirement information indicates that the PDU session is not integrity protected
  • the encryption requirement information indicates that the PDU session is encrypted
  • the user encryption activation information indicates that EPS has activated user plane encryption
  • the PDU session The user plane security execution information matches the user plane encryption protection information of the EPS.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and the encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device determines that the integrity protection requirement information is not required, the encryption requirement information is required, and the user plane encryption activation information is activated, the transmission management device determines that the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS are matched.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information;
  • the integrity requirement information indicates that the PDU session is integrity protected
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • integrity protection requirement information includes three forms: required, preferred, and not required.
  • Required indicates that the PDU session needs to be protected by integrity, preferred indicates that the PDU session is preferentially protected by integrity, and noted that the PDU session does not need to be integrity protected.
  • the integrity protection requirement information can be represented by bits, and different values of the bits correspond to different integrity protection requirement information.
  • Encryption protection requirement information includes three forms: required, preferred, and not required. Required indicates that the PDU session needs to be encrypted, preferred indicates that the PDU session is preferentially encrypted, not required indicates that the PDU session does not need to be encrypted, and encryption requirement information can be expressed in bits. It indicates that different values of bits are used to represent different encryption requirements information.
  • User plane encrypted activation information includes two forms: activated and unactivated.
  • the transmission management device can directly determine the user plane security execution information of the PDU session without analyzing the encryption protection requirement information and the user plane encryption activation information.
  • the user plane encryption protection information does not match the EPS.
  • the access management device sends the EBI release request information to the transmission management device, and the transmission management device receives the EBI release request information from the access management device.
  • the transmission management device is used to manage PDU sessions in 5GS and manage PDN connections in EPS, including responsible for the establishment, modification, and deletion of PDU sessions, and the establishment, modification, and deletion of PDN connections.
  • the transmission management device may be composed of SMF and PGW-C is composed of two devices, and it can also be a device with SMF and PGW-C functions.
  • the access management device determines that the EBI previously allocated for the EPS bearer needs to be released, and the access management device transmits management corresponding to the ESP bearer.
  • the device sends EBI release request information.
  • the EBI release request information carries the EBI that needs to be released and a release cause value.
  • the release cause value indicates that the user plane security requirements of the PDU session are not met.
  • the access management device judges whether the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match if the EBI has been assigned to the EPS mapped by the QoS in the EPS.
  • the EBI previously released for EPS is released to prevent the EPS bearer from using EBI that does not meet user plane security requirements when the UE moves from 5GS to EPS.
  • FIG. 5 is a schematic structural diagram of a device according to an embodiment of the present invention.
  • the device 5 may include a processing unit 501 and a transceiver unit 502.
  • Embodiment 1 A processing unit 501 is configured to determine whether user plane security execution information of a PDU session and user plane encryption protection information of an EPS match.
  • the processing unit 501 is configured to execute S201 in FIG. 2.
  • the sending and receiving unit 502 is configured to send an EBI allocation request message to the access management device when the judgment result of the processing unit is yes, and the EBI allocation request message is used to request that an EBI be allocated to an EPS bearer whose QoS is mapped in the EPS.
  • the PDU session includes at least one QoS Flow.
  • the transceiver unit 502 is configured to execute S202 in FIG. 2.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption activation information
  • the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is not encrypted, the user plane security execution information of the PDU session, and the user of the EPS The encryption protection information is matched; or
  • the integrity protection requirement information indicates that the PDU session is not integrity protected.
  • the encryption requirement information indicates that the PDU session is encrypted.
  • the user plane encryption activation information indicates that the user plane encryption of the EPS is activated.
  • the user plane security execution information matches the user plane encryption protection information of the EPS.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes user plane encryption activation information
  • the integrity protection requirement information indicates that integrity protection is performed.
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • the processing unit 501 is further configured to: when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match, the transmission management device does not send The access management device sends an EBI allocation request.
  • the device 5 may be a transmission management device, for example, the transmission management device is composed of two types of devices: SMF and PGW-C, or may be a device having functions of SMF and PGW-C.
  • the device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system chip (SoC), a central processing unit (CPU), and other related functions.
  • FPGA field-programmable gate array
  • SoC system chip
  • CPU central processing unit
  • NP Network processor
  • NP digital signal processing circuit
  • microcontroller microcontroller unit, MCU
  • PLD programmable controller
  • PLD programmable logic device
  • Embodiment 2 The transceiver unit 502 is configured to receive the EBI allocation request information from the transmission management device; wherein the EBI allocation request is used to request the EBI to be allocated for the EPS bearer whose QoS is mapped in the EPS; for example, the transceiver unit 502 is used for Step S301 in FIG. 3 is executed.
  • the processing unit 501 is configured to determine whether the user plane security execution information of the PDU session where the Qos Flow is located and the user plane encryption protection information of the EPS match; for example, the processing unit 501 is configured to execute S302 in FIG. 3.
  • the transceiver unit 502 is further configured to send an EBI allocation response message to the transmission management device when the judgment result of the processing unit is yes, wherein the EBI allocation response information carrying device 5 allocates an EBI allocated to the EPS bearer.
  • the transceiver unit 502 is configured to execute S303 in FIG. 3.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption activation information
  • the integrity protection requirement information indicates that integrity protection is not performed
  • the encryption requirement information indicates that encryption is not performed
  • the user plane security execution information of the PDU session and the EPS user plane encryption protection information are matched
  • the integrity protection requirement information indicates that integrity protection is not performed, the encryption requirement information indicates that encryption is performed, the user plane encryption capability information indicates that user plane encryption is supported, the user plane security execution information of the PDU session, and the EPS The user plane encryption protection information is matched.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption activation information
  • the The integrity protection requirement information indicates that the PDU session is integrity protected.
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • the transceiver unit 502 is further configured to send an EBI allocation response message to the transmission management device when the determination result of the processing unit 501 is no, and the EBI allocation response information carries the EBI allocation. Reason information for the failure.
  • the transceiver unit 502 is further configured to receive a user corresponding to the PDU session identifier and the PDU session identifier from the transmission management device during the establishment or modification of the PDU session. Face safety enforcement information.
  • the device 5 may be an access management device, for example, the access management device may be an AMF in 5GS.
  • the device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system chip (SoC), a central processing unit (CPU), and other related functions.
  • FPGA field-programmable gate array
  • SoC system chip
  • CPU central processing unit
  • NP Network processor
  • NP digital signal processing circuit
  • microcontroller microcontroller unit, MCU
  • PLD programmable controller
  • PLD programmable logic device
  • Embodiment 3 A processing unit 501 is configured to obtain user plane security execution information of a PDU session.
  • the PDU session includes at least one QoS Flow, which is associated with an EPS bearer, and the EPS bearer is assigned an EBI; for example:
  • the processing unit 501 is configured to execute S401 in FIG. 4.
  • the processing unit 501 is further configured to determine whether the user plane security execution information of the PDU session matches the user plane encryption protection information of the EPS that is stored or preconfigured; for example, the processing unit 501 is configured to execute S402 in FIG. 4. .
  • the transceiver unit 502 is configured to send an EBI release request to a transmission management device serving the EPS bearer when the judgment result of the processing unit is negative, and the EBI release request is used to indicate that the EBI of the EPS bearer needs to be freed.
  • the transceiver unit 502 is configured to execute S403 in FIG. 4.
  • the user plane security execution information of the PDU session includes: integrity protection requirement information and encryption requirement information
  • the EPS user plane encryption protection information includes: user plane encryption capability information
  • the integrity protection requirement information indicates that integrity protection is performed.
  • the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS do not match.
  • the user plane security execution information of the PDU session includes integrity protection requirement information and encryption requirement information
  • the user plane encryption protection information of the EPS includes: user plane encryption activation information
  • the integrity protection requirement information indicates that the PDU session is not integrity protected, the encryption requirement information indicates that the PDU session is not encrypted, the user plane security execution information of the PDU session, and the user of the EPS The encryption protection information is matched; or
  • the integrity protection requirement information indicates that integrity protection is not performed
  • the encryption requirement information indicates that the PDU session is encrypted
  • the user plane encryption capability information indicates that user plane encryption is supported
  • the user plane security execution information and address of the PDU session is matched.
  • the processing unit 501 is further configured not to release the EBI carried by the EPS when the user plane security execution information of the PDU session and the user plane encryption protection information of the EPS match.
  • the transceiver unit 502 is further configured to receive a user corresponding to the PDU session identifier and the PDU session identifier from the transmission management device during the establishment or modification of the PDU session. Face safety enforcement information.
  • the user plane encryption protection information of the EPS is from a mobile management entity MME, and the MME is an MME to which the PDU session is to be migrated.
  • the device 5 may be an access management device, for example, the access management device may be an AMF in 5GS.
  • the device 5 may also be a field-programmable gate array (FPGA), a dedicated integrated chip, a system chip (SoC), a central processing unit (CPU), and other related functions.
  • FPGA field-programmable gate array
  • SoC system chip
  • CPU central processing unit
  • NP Network processor
  • NP digital signal processing circuit
  • microcontroller microcontroller unit, MCU
  • PLD programmable controller
  • PLD programmable logic device
  • FIG. 6 is a schematic structural diagram of a device according to an embodiment of the present invention.
  • the device 6 is referred to as the device 6.
  • the device 6 may be integrated with the foregoing transmission management device or access management device.
  • the device includes a memory 602 and a processing unit. 601, a transceiver 603.
  • the memory 602 may be an independent physical unit, and may be connected to the processor 601 and the transceiver 603 through a bus.
  • the memory 602, the processor 601, and the transceiver 603 may also be integrated together and implemented by hardware.
  • the memory 602 is configured to store a program that implements the foregoing method embodiments or modules of the device embodiments, and the processor 601 calls the program to perform the operations of the foregoing method embodiments.
  • the device 6 may also include only a processor.
  • the memory for storing the program is located outside the device 6, and the processor 601 is connected to the memory through a circuit / wire for reading and executing the program stored in the memory.
  • the processor may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • CPU central processing unit
  • NP network processor
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory may include volatile memory (for example, random-access memory (RAM); the memory may also include non-volatile memory (for example, flash memory) , Hard disk (HDD) or solid-state drive (SSD); the storage may also include a combination of the above types of storage.
  • volatile memory for example, random-access memory (RAM)
  • non-volatile memory for example, flash memory
  • HDD Hard disk
  • SSD solid-state drive
  • the storage may also include a combination of the above types of storage.
  • the sending module or the transmitter performs the steps sent by the foregoing method embodiments
  • the receiving module or the receiver performs the steps received by the foregoing method embodiments
  • other steps are performed by other modules or processors.
  • the transmitting module and the receiving module may constitute a transceiver module
  • the receiver and the transmitter may constitute a transceiver.
  • An embodiment of the present application further provides a computer storage medium storing a computer program, where the computer program is used to execute the method for distributing EBI provided by the foregoing embodiment.
  • the embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the EBI allocation provided by the foregoing embodiment.
  • this application may be provided as a method, a system, or a computer program product. Therefore, this application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a particular manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Quality & Reliability (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种分配EBI的方法和装置，在需要为QoS F low在EPS中映射的EPS承载分配EBI时，判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，即EPS的用户面能力能否满足PDU会话的用户面安全需求，在满足的情况下才会为EPS承载分配EBI，否则不为EPS承载分配EBI或者在已分配EBI的情况下释放该EBI，这样避免UE从5GS移动到EPS时，EPS承载使用不满足用户面安全需求的EBI进行数据传输。

Description

分配EBI的方法和装置 技术领域
本发明涉及通信领域，尤其涉及一种分配EBI的方法和装置。
背景技术
在第五代移动通信***(5th generation system，5GS)中，为了保证业务端到端的服务质量，提出了图1A所示的基于服务质量流(quality of service Flow，QoS Flow)的第五代移动通信技术服务质量(5th Generation generation quality of service，5G QoS)模型，该5G QoS模型支持保证比特率(guaranteed bit rate，GBR)的QoS Flow和不保证比特率(non-guaranteed bit rate，non GBR)的QoS Flow，使用同一个QoS Flow控制的数据流具有相同的QoS保障。对于一个用户设备(user equipment，UE)，UE可以与5GS建立一个或多个PDU会话，每个分组数据单元(packet data unit，PDU)会话可以建立一个或多个QoS Flow，每个QoS Flow由一个QoS数据流标识(QoS Flow identifier，QFI)来识别，QFI在PDU会话中唯一表示QoS Flow的身份标识。
在支持5GS和演进分组***(evolved packet system，EPS)之间进行互通的网络架构中，5GS中的PDU会话可以迁移到EPS中，以及在EPS建立该PDU会话对应的分组数据网络(packet data network，PDN)连接，相应的，PDU会话中的QoS Flow会在PDN连接中映射一个EPS承载(EPS bearer)。在5GS中支持互通的PDU会话建立流程中，5GS中的核心网网元需要为QoS Flow在EPS中映射的EPSbearer分配一个EBI，然而如何为EPS bearer分配EBI目前正在讨论中。
发明内容
本发明实施例所要解决的技术问题在于，提供一种分配EBI的方法和装置，实现了为EPS分配满足要求的EBI，避免将不符合用户面安全要求的EBI分配给EPS承载，实现节省信令开销和EBI资源的浪费。
第一方面，本申请提供了一种分配EBI的方法，包括：在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，传输管理装置向接入管理装置发送EBI分配请求信息，所述EBI分配请求信息用于请求为QoS Flow在所述EPS中映射的EPS承载分配EBI分配请求信息，所述PDU会话包括至少一个QoS Flow。
在本发明实施例中，传输管理装置在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，传输管理装置才会向接入管理装置发送EBI分配请求消息信息，这样只有在EPS的用户面安全满足PDU会话的安全需求时，才会请求分配EBI，避免将不符合用户面安全需求的EBI分配给EPS承载。
在需要为QoS Flow在EPS中映射的EPS承载分配EBI的情况下，SMF+PGW-C获取PDU会话关联的用户面安全执行信息和EPS的用户面加密保护信息，QoS Flow位于该PDU会话中；在用户面安全执行信息和用户面加密保护信息匹配的情况下，传输管理装置向接入管 理装置发送EBI分配请求，所述EBI分配请求携带PDU会话标识，所述PDU会话标识为所述PDU会话的身份标识。
其中，在以下情况中的任意一种时表明需要为QoS Flow在EPS中映射的EPS承载在UE在非漫游或本地疏导的场景下发起PDU会话建立请求时，该PDU会话支持5GS和EPS之间进行互通；标明需要为QoS Flow在EPS中映射的ESP承载分配EBI；或
UE在非漫游场景或基于本地疏导的漫游场景下发起PDU会话修改，该PDU会话支持5GS和EPS之间的互通；或
UE或网络设备发起基于路由归属漫游场景下发起PDU会话修改，该PDU会话支持5GS和EPS之间的互通；或
UE或网络请求了PDU会话修改流程。
在一种可能的设计中，PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括用户面加密激活信息；
在所述完整性保护信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，则所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配的；或
在所述完整性保护信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话被加密，所述用户面加密激活信息表示所述EPS已激活用户面加密，则所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配的。
在一种可能的设计中，PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括用户面加密激活信息；
在完整性保护需求信息表示所述PDU会话被完整性保护，则所述PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
在一种可能的设计中，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息不匹配的情况下，所述传输管理装置不向所述接入管理装置发送EBI分配请求。
在一种可能的设计中，传输管理装置根据签约信息获取用户面安全执行信息或接收来自PCF的PDU会话的用户面安全执行信息。
第二方面，本申请提供了一种分配EBI的方法，包括：接入管理装置接收来自传输管理装置的EBI分配请求信息，EBI分配请求信息用于请求为QoS Flow在EPS中映射的EPS承载分配EBI；当QoS Flow所在的PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，接入管理装置向所述传输管理装置发送EBI分配响应，所述EBI分配响应携带接入管理装置为EPS承载分配的EBI。
根据以上的描述，接入管理装置接收到EBI分配请求信息时，接入管理装置在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，才会为QoS Flow在EPS中映射的EPS承载分配EBI，避免将不符合用户面安全需求的EBI分配给EPS承载。
在一种可能的设计中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；
完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话未被加密，则PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的；或
完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话被加密，用户面加密激活信息表示EPS的用户面加密被激活，则PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在一种可能的设计中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；在完整性保护需求信息表示PDU会话被完整性保护时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
在一种可能的设计中，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息不匹配的情况下，接入管理装置向传输管理装置发送EBI分配响应信息，EBI分配响应信息携带EBI分配失败的原因信息。
第三方面，本申请提供了一种EBI的释放方法，包括：
接入管理装置获取PDU会话的用户面安全执行信息；其中，所述PDU会话包括至少一个QoS Flow，Qos Flow与EPS承载关联，所述EPS承载已分配有EBI；
在所述PDU会话的用户面安全执行信息和预存储或预配置的所述EPS的用户面加密保护信息不匹配的情况下，所述接入管理装置向服务于EPS承载的传输管理装置发送EBI释放请求信息，所述EBI释放请求信息用于指示所述EPS承载需要被释放。
根据以上的描述，接入管理装置在已经为QoS Flow在EPS中映射的EPS分配EBI的情况下，判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，在不匹配时，释放先前为EPS分配的EBI，避免UE从5GS移动到EPS时，EPS承载使用不符合用户面安全需求的EBI。
在一种可能的设计中，PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；
在完整性保护需求信息表示PDU会话被完整性保护，则PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
在一种可能的设计中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括用户面加密激活信息；
完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话被加密，所述用户面加密激活信息表示EPS的用户面加密被激活，则PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的；或
完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话未被加密，则PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在一种可能的设计中，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的情况下，接入管理装置不释放EPS承载的EBI。
在一种可能的设计中，接入管理装置获取PDU会话的用户面安全执行信息之前，还包括：
在所述PDU会话的建立或修改过程中，接入管理装置接收来自传输管理装置的PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
在一种可能的设计中，EPS的用户面加密保护信息是来自EPS中的移动管理设备的。
本申请又一方面提供了一种分配EBI的装置，该装置用于实现第一方面中各个可能的设计中传输管理装置行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，传输管理装置的结构中包括处理器和收发器，所述处理器被配置为判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配。所述收发器被配置为在处理器的判断结果为是时，向接入管理装置发送EBI分配请求信息，所述EBI分配请求信息用于请求为QoS Flow在EPS中映射的EPS承载分配EBI，所述PDU会话包括至少一个QoS Flow。所述传输管理装置还可以包括存储器，所述存储器用于与处理器耦合，其保存网络设备必要的程序指令和数据。
本申请又一方面提供了一种分配EBI的装置，该装置具有实现第二方面各个可能的设计中接入管理装置行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。所述模块可以是软件和/或硬件。
在一个可能的设计中，接入管理装置的结构中包括收发器和处理器，收发器，用于接收来自传输管理装置的EBI分配请求信息；其中，所述EBI分配请求用于请求为QoS Flow在EPS中映射的EPS承载分配EBI。处理器，用于判断所述Qos Flow所在的PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是否匹配。收发器还用于，在所述处理单元的判断结果为是时，向所述传输管理装置发送EBI分配响应信息；其中，所述EBI分配响应信息携带所述接入管理装置为所述EPS承载分配的EBI。所述接入管理装置还可以包括存储器，所述存储器用于与处理器耦合，其保存网络设备必要的程序指令和数据。
本申请又一方面提供了一种分配EBI的装置，该装置具有实现第三方面各个可能的设计中接入管理装置行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。所述模块可以是软件和/或硬件。
在一个可能的设计中，接入管理装置的结构中包括收发器和处理器，处理器，用于获取PDU会话的用户面安全执行信息；其中，PDU会话包括至少一个QoS Flow，所述QoS Flow与EPS bearer关联，所述EPS承载已分配有EBI。处理器，还用于判断所述PDU会话的用户面安全执行信息和预存储或预配置的所述EPS的用户面加密保护信息是否匹配；收发器，用于在所述处理单元的判断结果为否时，向服务于所述EPS承载的传输管理装置发送EBI释放请求，所述EBI释放请求用于指示所述EPS承载的EBI需要被释放。所述接入管理装置还可以包括存储器，所述存储器用于与处理器耦合，其保存网络设备必要的程序指令和数据。
本申请又一方面提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第一方面至第一方面的各个可能的实施方式中任意一项所述的方法。
本申请又一方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得 计算机执行如第一方面至第一方面的各个可能的实施方式中任意一项所述的方法。
本申请又一方面提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第二方面至第二方面各个可能的实施方式中任意一项所述的方法。
本申请又一方面一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如第二方面至第二方面各个可能的实施方式中任意一项所述的方法。
本申请又一方面提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第三方面至第三方面的各个可能的实施方式中任意一项所述的方法。
本申请又一方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如第三方面至第三方面的各个可能的实施方式中任意一项所述的方法。
附图说明
图1A是本发明实施例提供的5GS中QoS Flow的的映射示意图；
图1B是本发明实施例提供的通信***的另一结构示意图；
图1C是本发明实施例提供的通信***的另一结构示意图；
图1D是本发明实施例提供的通信***的另一结构示意图；
图1E是本发明实施例提供的PDU会话建立的流程示意图；
图1F是本发明实施例提供的分配EBI的方法的流程示意图；
图2是本发明实施例提供的分配EBI的方法的另一流程示意图；
图3是本发明实施例提供的分配EBI的方法的另一流程示意图；
图4是本发明实例提供的分配EBI的方法的另一流程示意图；
图5是本发明实施例提供的一种装置的结构示意图；
图6是本发明实施例提供的一种装置的另一结构示意图。
具体实施方式
图1B为本发明实施例涉及的一种基于5GS和EPS互通的非漫游场景(Non-roaming architecture for interworking between 5GS and EPC/E-UTRAN)的通信***的架构图。图1B的通信***包括：统一数据管理+归属用户服务器(unified data management+home subscriber server，UDM+HSS)、策略和计费功能+策略和计费规则功能(policy and charge function+policy and charging rules function，PCF+PCRF)、会话管理功能+控制面PDN网关(session management function+PDN gateway control plane，SMF+PGW-C)、用户面功能+用户面PDN网元(user plane function+PDN gateway user plane，UPF+PGW-U)、服务网关(serving gateway，SGW)、移动管理实体(mobility management entity，MME)、演进通用陆地无线接入网(evolved universal terrestrial radio access network，E-UTRAN)、用户设备(user equipment，UE)1、接入和移动性管理功能(access and mobility management function，AMF)、下一代无线接入网(next generation radio access network，NG-RAN)和UE2。其中，UDM+HSS为EPS中的HSS和5GS中的UDM合设而成的网元，PCF+PCRF为EPS中的PCRF和5GS中的PCF合设而成的网元，SMF+PGW-C为EPS中的PGW-C和5GS中 的SMF合设而成的网元，UPF+PGW-U为EPS中的PGW-U和5GS中的UPF合设而成的网元。MME和E-UTRAN为EPS中的网元，AMF和NG-RAN为5GS中的网元，UE1通过E-UTRAN接入(核心网)，UE2通过在NG-RAN接入(核心网)，UE1和UE2可以代指同一UE。
下面对图1B的通信***中的各个接口进行说明：
S6a接口表示MME和HSS+UDM之间的通信接口。S11接口表示MME和SGW之间的通信接口。S1-MME接口表示MME和E-UTRAN之间的通信接口。S1-U接口表示E-UTRAN和SGW之间的通信接口。N10接口表示HSS+UDM和SMF+PGW-C之间的通信接口。S5-C接口表示SGW和SMF+PGW-C之间的控制面的通信接口。S5-U接口表示SGW和UPF+PGW-U之间的用户面的通信接口。N7接口表示PCF+PCRF和SMF+PGW-C之间的通信接口。N4表示SMF+PGW-C和UPF+PGW-U之间的通信接口。N8接口表示HSS+UDM和AMF之间的通信接口。N15接口表示PCF+PCRF和AMF之间的通信接口。N11接口表示SMF+PGW-C和AMF之间的通信接口。N3接口表示UPF+PGW-U和NG-RAN之间的通信接口。N2接口表示NG-RAN和AMF之间的通信接口。N1接口表示AMF和UE之间的通信接口。
图1C是本发明实施例涉及的一种基于5GS和EPS互通的本地疏导漫游场景(Local breakout roaming architecture for interworking between 5GS and EPC/E-UTRAN)的通信***的架构图。图1C的通信***包括UDM+HSS、归属地策略和计费功能+归属地策略和计费规则功能(home policy and charge function+home policy and charging rules function，h-PCF+h-PCRF)、漫游地策略和计费功能+漫游地策略和计费规则功能(visited policy and charge function+visited policy and charging rules function，v-PCF+v-PCRF)、SMF+PGW-C、UPF+PGW-U、SGW、MME、E-UTRAN、UE1、AMF、NG-RAN和UE2。其中，UDM+HSS为EPS中的HSS和5GS中的UDM合设而成的网元，h-PCF+h-PCRF和v-PCF+v-PCRF为EPS中的PCRF和5GS中的PCF合设而成的网元，SMF+PGW-C为EPS中的PGW-C和5GS中的SMF合设而成的网元，UPF+PGW-U为EPS中的PGW-U和5GS中的UPF合设而成的网元。MME和E-UTRAN为EPS中的网元，AMF和NG-RAN为5GS中的网元，UE1为驻留在E-UTRAN中，UE2驻留在NG-RAN中。HSS+UDM位于归属地公共陆地移动网络(home public land mobile network，HPLMN)中，通信***中其他网元位于漫游地公共陆地移动网络VPLMN(visited public land mobile network，VPLMN)中。
下面对图1C的通信***中的各个接口进行说明：
S6a接口表示MME和HSS+UDM之间的通信接口。S11接口表示MME和SGW之间的通信接口。S1-MME接口表示MME和E-UTRAN之间的通信接口。S1-U接口表示E-UTRAN和SGW之间的通信接口。N10接口表示HSS+UDM和SMF+PGW-C之间的通信接口。S5-C接口表示SGW和SMF+PGW-C之间的控制面的通信接口。S5-U接口表示SGW和UPF+PGW-U之间的用户面的通信接口。N24接口表示h-PCF+h-PCRF和v-PCF+v-PCRF之间的通信接口，N7接口表示v-PCF+v-PCRF和SMF+PGW-C之间的通信接口。N4表示SMF+PGW-C和UPF+PGW-U之间的通信接口。N8接口表示HSS+UDM和AMF之间的通信接口。N15接口表示v-PCF+v-PCRF和AMF之间的通信接口。N11接口表示SMF+PGW-C和AMF之间的通信接口。N3接口表示UPF+PGW-U和NG-RAN之间的通信接口。N2接口表示NG-RAN和AMF之间的通信接口。N1接口表示AMF 和UE之间的通信接口。
图1D是本发明实施例涉及的一种基于5GS和EPS互通的归属路由漫游场景(Home-routed roaming architecture for interworking between 5GS and EPC/E-UTRAN)的通信***的架构图。图1D的通信***包括：HSS+UDM、h-PCF+h-PCRF、SMF+PGW-C、UPF+PGW-U、SGW、MME、E-UTRAN、UE1、v-PCF、v-SMF、UPF、AMF、NG-RAN和UE2。其中，HSS+UDM为EPS中的HSS和5GS中的UDM合设而成的网元。h-PCF+h-PCRF为5GS中的PCF和EPS中的PCRF合设而成的网元。SMF+PGW-C为5GS中的SMG和EPS中的PGW-C合设而成的网元。UPF+PGW-U为5GS中的UPF和EPS中的PGW-U合设而成的网元。HSS+UDM、h-PCF+h-PCRF、SMF+PGW-C、UPF+PGW-U位于HPLMN中，通信***中其他网元位于VPLMN中。
下面对图1D的通信***中各个接口进行说明：
S6a接口表示MME和HSS+UDM之间的通信接口。S11接口表示MME和SGW之间的通信接口。S1-MME接口表示MME和E-UTRAN之间的通信接口。S1-U接口表示E-UTRAN和SGW之间的通信接口。N10接口表示HSS+UDM和SMF+PGW-C之间的通信接口。N7接口表示h-PCF+h-PCRF和SMF+PGW-C之间的通信接口。N4接口表示SMF+PGW-C和UPF+PGW-U之间的通信接口。S8-C接口表示SMF+PGW-C和SGW之间的控制面的通信接口。S8-U接口表示SGW和UPF+PGW-U之间的用户面的通信接口。N26表示MME和AMF之间的通信接口。N10表示HSS+UDM和v-SMF之间的通信接口。N24接口表示h-PCF+h-PCRF和v-PCF之间的通信接口。N16接口表示SMF+PGW-C和v-SMF之间的通信接口。N9接口表示UPF+PGW-U和UPF之间的通信接口。N15接口表示v-PCF和AMF之间的通信接口。N11接口表示v-SMF和AMF之间的通信接口。N4接口表示UPF和v-SMF之间的通信接口。N3接口表示UPF和NG-RAN之间的通信接口。N2接口表示AMF和NG-RAN之间的通信接口。N1接口表示UE和AMF之间的通信通信接口。
其中，下面对图1B、图1C和图1D中各个网元的功能进行介绍：
UPF+PGW-U：用于用户数据的传输管理，EPS和EGS互通架构中，该网元既能用于EPS的数据传输，又能提供5G的数据传输功能。
SMF+PGW-C：用于会话的建立、删除和修改管理，互通架构中，该网元既能提EPS的会话管理功能，又能提供5G的会话管理功能。
PCF+PCRF：用于策略和计费控制实体，互通架构中，该网元既能为终端装置提供EPS的策略和计费控制，又能提供5G的策略和计费控制。
HSS+UDM：用于存储用户的签约数据，互通架构中，该网元既存储有终端设备的EPS的签约信息，又存储有终端设备的5G的签约信息。
5G无线接入网(radio access network,RAN)：为终端装置提供无线空口接入核心网络，从而获取对应的业务。
演进的通用陆地无线接入网络(evolved universal terrestrial radio access network,E-UTRAN)：用于无线资源管理，为终端装置建立、修改或删除空口资源。为终端装置提供数据和信令的传输等。
AMF：用于用户的接入和移动性管理，主要包含用户的注册管理、可达性管理移动性管 理、寻呼管理、接入认证和授权非接入层信令的加密和完整性保护等。
MME：用于用户的移动性管理。例如，主要包含用户的附着管理、可达性管理、移动性管理、寻呼管理、接入认证和授权非接入层信令的加密和完整性保护等。
SGW:用户面的网关，与E-UTRAN的用户面终结点。作为基站之间切换的本地移动锚点。管理数据包的路由和传输，添加传输层的包标签等。
本申请中的UE是一种具有无线通信功能的设备，可以部署在陆地上，包括室内或室外、手持、可穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。终端设备也可以是具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备等。在不同的网络中终端设备可以叫做不同的名称，例如：终端设备、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、5G网络或未来演进网络中的终端设备等。
参见图1E，图1E是本发明实施例提供的在5GS中建立PDU会话的流程示意图，该流程包括：
1、UE向AMF发送PDU会话建立请求(PDU session establishment request)，AMF接收来自UE的PDU会话建立请求。PDU会话建立请求用于在EGS中建立PDU会话。
2、AMF进行SMF的选择。
3a、AMF向SMF发送PDU会话建立请求，SMF接收来自AMF的PDU会话建立请求。SMF可通过Nsmf接口向AMF发送PDU会话建立请求。
4a和4b、SMF在UDM中进行注册，并从UDM中获取签约信息。签约信息包括用户面安全策略(user plane security policy)。
5、SMF向AMF发送PDU会话建立响应(PDU session establishment response)，AMF接收SMF的PDU会话建立响应。其中，SMF可能会在本步骤拒绝PDU会话的建立，并在PDU会话建立响应中携带拒绝的原因值。
6、PDU会话的鉴权/授权。
7a和7b、SMF进行PCF的选择。SMF向PCF请求策略规则。SMF可能会从PCF得到PDU会话的动态的用户面安全策略，以更新签约信息中的用户面安全策略。
8、SMF进行UPF的选择。
9、SMF向PCF发送PDU会话相关的信息(例如：UE的IP地址/前缀、触发器状态等)，PCF接收来自SMF上报的的PDU会话相关的信息。
10a和10b、SMF向UPF发送隧道信息和规则信息，UPF接收来自SMF的隧道信息和规则信息。
11、SMF向AMF发送PDU会话标识、以及该PDU会话标识关联的会话管理信息(session management information，SM information)和会话管理容器(session management container，SM container)。
12、AMF向NG-RAN发送PDU会话请求，RAN接收来自AMF的PDU会话请求。PDU会话请求包括SM information和NAS消息，AMF是通过N2接口将SM Information是发送给RAN，NAS消息中包括SM container发送给RAN，即AMF是通过透传的方式将SM container发送给RAN的。SM information保护PDU会话的用户面策略执行(user plane policy rnforcement)。
13、NG-RAN和UE之间进行接入网特定资源建立(AN specific resource setup)，在此过程中NR-RAN向UE发送PDU会话建立接受(PDU session establishment accept)。
14、NG-RAN向AMF发送PDU会话请求确认(PDU session request ACK)，AMF接受来自NG-RAN的PDU会话请求确认。
15、AMF向SMF发送更新会话管理上下文请求(PDU session update SM context request)，SMF接受来自AMF的更新会话管理上下文请求。该请求可通过Nsmf接口发送。
16a、SMF向UPF发送会话修改请求(session modification request)，UPF接收来自SMF的会话修改请求。该请求可通过N4接口发送。
16b、UPF向SMF发送会话修改响应(session modification response)，SMF接收来自SMF的会话修改响应。该响应可通过N4接口发送。
17、SMF向AMF发送更新会话管理上下文响应(PDU session update SM context response)，AMF接收来自SMF的更新会话管理上下文响应。
18、SMF向AMF发送的会话管理上下文状态通知(PDU session SM context status notify)，AMF接收来自SMF的会话管理上下文状态通知。
19、SMF对UPF和UE进行IPv6地址的配置。
20、SMF和UDM之间进行撤销订阅/撤销注册流程(unsubscription/deregistration)。
参见图1F，图1F是本发明实施例提供的EBI分配流程，该流程包括：
1、在default QoS Flow或GBR QoS Flow创建过程中，PGW-C+SMF会为对应的default EPS bearer/dedicated GBR EPS bearer向AMF请求EBI。
在5GS中，default QoS Flow的创建过程在UE发起的PDU Session建立过程中，而GBR QoS Flow的创建过程则是在UE或者网络侧发起的PDU Session修改过程中。
2、SMF向AMF发送EBI分配请求，EBI分配请求中携带PDU会话标识和分配和抢占优先级(allocation and retention priority list，ARP list)Namf_Communication_EBIAssignment服务请求，请求得到AMF分配的EBI，该服务请求中携带PDU Session ID以及ARP list。
3-6步只用于AMF需要释放先前分配的EBI(注：EPS中EBI的数量是有限的)。
3、如果AMF没有可用的EBI，AMF可能会基于ARP和S-NSSAI取消先前分配的EBI，并向服务于该EPS承载的SMF+PGW-C发送更新会话管理上下文请求。(注：AMF可以为多个SMF分配EBI，所以本步骤中的SMF与第2步中向AMF发送请求的SMF可能不是同一个。)
4、SMF向AMF发送会话管理容器(N1 SM container)和会话管理信息(N2 SM information)，分别用来通知UE和RAN释放的EBI。
5、如果UE处于CM_IDLE态，则AMF首先寻呼UE，然后UE发起Service Request流程，在Service Request流程中的N2 Session消息中的N2 SM information信元以及N1 SM container信元带给RAN和UE。
如果UE处于CM_CONNECTED态，则AMF通过N2 Session Request消息中的N2 SM information信元以及N1 SM container信元带给RAN和UE。
6、UE触发PDU会话修改流程。
7、如果AMF成功分配了EBI，AMF向SMF+PGW-C发送EBI分配响应，若AMF成功分配EBI，EBI分配响应中携带分配的EBI，若AMF没有成功分配EBI，EBI分配响应找那个携带失败原因值，例如：失败原因值为EBI数量不足，则AMF将分配的EBI回应给SMF。若没有成功分配，AMF回应一个原因值指示EBI分配失败。
8、SMF+PGW-C修改用户面的隧道信息。
9、SMF向AMF发送N1 SM container和N2 SM information，分别用来通知UE和RAN释放的EBI。
10、AMF将分配的EBI发送给UE和RAN。UE、RAN和网络侧进行隧道信息的修改。
从图1F的EBI分配流程可以看出：AMF在接收到SMF+PGW-C的EBI分配请求之后，会为EPS承载分配EBI。由于5GS的用户面安全需求高于EPS的用户面安全能力，支持EPS迁移的PDU会话迁移到EPS后，EPS的用户面安全能力可能不满足PDU会话的用户面安全需求，这样预先为PDU会话中的QoS Flow在该EPS中映射的EPS承载分配的EBI是不可用的，从而导致EPS中有限的EBI资源的浪费，同时也会增加无必要的信令开销。为了解决上述问题，本申请提出了图2至图4的解决方案。
参见图2，图2是本发明实施例提供的一种分配EBI的方法的流程示意图，在本发明实施例中，所述方法包括：
S201、传输管理装置判断PDU会话的用户面安全执行信息和EPS的用户面安全保护信息是匹配的。
具体的，PDU会话中可建立一个或多个QoS Flow，PDU会话支持迁移到EPS，即PDU会话支持在EPS中建立对应的PDN连接，对于一个QoS Flow而言，该QoS Flow在EPS中映射一个EPS承载；其中，QoS Flow映射的EPS承载表示5GS中的QoS Flow在EPS中对应的EPS承载，在UE从5GS移动到EPS后，UE在EPS中建立PDU会话对应的PDN连接，相应的，PDU会话中的QoS Flow会在PDN连接中映射EPS承载，在成功建立PDN连接后，UE会发起释放PDU会话的流程，相应的PDU会话中的一个或多个QoS Flow也会被释放。在本发明实施例中，在出现如下的任意一种情况时，表明需要为QoS Flow在EPS中映射的EPS 承载分配EBI：1、在图1B非漫游和图1C的本地疏导的漫游场景下，UE发起了PDU会话的建立；2、在图1D的归属路由的漫游场景下，UE发起了PDU会话的建立；3、在图1B非漫游和图1C本地疏导的漫游场景下，UE或网络发起了PDU会话的修改；4、在图1D的归属漫游的场景下，UE或网络发起了PDU会话的修改。本实施例中的传输管理装置用于管理5GS中的PDU会话，以及管理EPS中的PDN连接，包括负责PDU会话的建立、修改和删除，PDN连接的建立、修改和删除，传输管理装置可以由SMF和PGW-C两种装置构成的，也可以是具有SMF和PGW-C的功能的一种装置。
其中，非漫游场景表示归属网络为UE提供服务。归属路由的漫游场景表示归属网络的网关(h-SMF+PGW-C和h-UPF+PGW-U)漫游接入，指漫游用户通过归属网络的网关H-PGW接入获取归属网络提供的业务。本地疏导的漫游场景表示漫游用户通过拜访网络的网关(v-SMF+PGW-C和v-UPF+PGW-U)接入获取相应的业务，业务的提供者可以是归属网络，也可以是拜访网络。
在一种可能的实施方式中，传输管理装置从PCF中获取该PDU会话的会话管理策略，该PDU会话管理策略中包括表示是否支持迁移到EPS的字段，例如：会话管理策略中包括EPS support indication的字段，在EPS support indication的值为“1”表示支持PDU会话支持迁移到EPS；EPS support indication的值为“0”表示PDU会话不支持迁移到EPS。
在一种可能的实施方式中，传输管理装置获取PDU会话的用户面安全执行信息包括：SMF+PGW-C预存储或预配置有PDU会话标识和用户面安全执行信息之间的映射关系，SMF+PGW-C根据该映射关系确定PDU会话标识对应的用户面安全执行信息；或SMF+PGW-C在UDM中获取签约的用户面安全策略，用户面安全策略包括用户面安全执行信息；或SMF+PGW-C从PCF中获取对应的用户面安全执行信息。
在一种可能的实施方式中，传输管理装置获取EPS的用户面加密保护信息包括：传输管理装置预存储或预配置EPS的用户面加密保护信息，SMF在本地获取EPS的用户面加密保护信息；或传输管理装置接收来自EPS中的MME发送的EPS的用户面加密保护信息；或传输管理装置接收来自PCRF的EPS的用户面加密保护信息。
其中，传输管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，其实质是，EPS的用户面安全能力能否满足PDU会话的用户面安全需求。如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的，表示EPS的用户面安全能力满足PDU会话的用户面安全需求；如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的，表示EPS的用户面安全能力不满足PDU会话的用户面安全需求。
在一种可能的实施方式中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息。
当PDU会话的用户面安全需求信息表示PDU会话未被完整性保护，以及EPS的用户面加密保护信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed， required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，以及加密需求信息为not needed，传输管理装置不需要再解析用户面加密保护信息，即无论用户面加密激活信息为activated还是unactivated，传输管理装置可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，当完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话被加密，以及用户加密激活信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，加密需求信息为required，以及用户面加密激活信息为activated，传输管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，PDU会话的用户面安全执行信息包括：完整性保护需求信息；
当完整性需求信息表示所述PDU会话被完整性保护时，PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。由于EPS的用户面不支持完整性保护，当完整性保护需求信息为required时，传输管理装置无需再解析加密保护需求信息和用户面加密激活信息，即可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
S203、传输管理装置向接入管理装置发送EBI分配请求信息，接入管理装置接收来自传输管理装置的EBI分配请求信息。
具体的，传输管理装置确定PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配时，传输管理装置向接入管理装置发送EBI分配请求信息，EBI分配请求信息携带PDU会话标识，该PDU会话标识表示PDU会话的身份标识，接入管理装置接收到来自传输管理装置发送的EBI分配请求信息，接入管理装置确定EPS中存在可用的EBI时，将可用的EBI分配给EPS承载；在EPS中不存在可用的EBI时，接入管理装置发起EBI释放流程，释放先前分配的EBI，然后再将EBI分配给EPS承载。接入管理装置向SMF+PGW-C发送EBI分配响应，如果成功为EPS承载分配EBI，EBI分配响应中携带分配的EBI；若没有成功为EPS分配EBI，EBI分配响应中携带分配失败的原因值。接入管理装置可以是5GS中的AMF。
其中，本实施例中，传输管理装置向接入管理装置发送EBI分配请求信息的判断条件不限于只包括S201所述的判断条件，还可以包括一个或多个其他判断条件，例如：其他判断条件为PDU会话的数据网络名(data network name，DNN)为本地数据网络(local area data network，LADN)，即同时满足PDU会话的用户面安全执行信息和EPS的用户面安全保护信息是匹配的，以及PDU会话的DNN为LADN时，传输管理装置才会向接入管理装置发送EBI分配请求信息。
在一种可能的实施方式中，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息不匹配的情况下，传输管理装置不向接入管理装置发送EBI分配请求，即只有在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下传输管理装置向接入管理装置发送EBI分配请求，避免EPS的用户面安全能力不满足PDU会话的需求，造成EBI资源的浪费和信令流程的开销。
参见图3，图3是本发明实施例提供的一种EBI分配方法的又一流程示意图，在本发明实施例中，所述方法包括：
S301、接入管理装置接收来自传输管理装置发送的EBI分配请求信息，接入管理装置接收来自传输管理装置发送的EBI分配请求信息。
具体的，接入管理装置用于对5GS中的UE的接入和移动性进行管理，接入管理装置可以为AMF。传输管理装置用于管理5GS中的PDU会话，以及管理EPS中的PDN连接，包括负责PDU会话的建立、修改和删除，PDN连接的建立、修改和删除，传输管理装置可以由SMF和PGW-C两种装置构成的，也可以是具有SMF和PGW-C的功能的一种装置。接入管理装置可以是5GS中的AMF。在需要为QoS Flow在EPS中映射的EPS承载分配EBI的情况下，传输管理装置向接入管理装置发送EBI分配请求信息，EBI分配请求信息携带PDU会话标识，PUD会话标识为PDU会话的身份标识，该PDU会话包括该QoS Flow，该PDU会话支持迁移到EPS。接入管理装置接收到来自传输管理装置的EBI分配请求信息后，确定需要为EPS承载分配EBI。接入管理装置判断EPS中是否存在可用的EBI，若为是，执行S302，若EPS中不存在可用的EBI，接入管理装置发起EBI释放流程，释放先前分配的EBI，在EPS中存在可用的EBI时，在执行S302。
S302、接入管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
具体的，接入管理装置获取PDU会话的用户面安全执行信息，以及获取EPS的用户面加密保护信息，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配表示EPS的用户面安全能力满足PDU会话的安全需求。
在一种可能的实施方式中，接入管理装置获取该PDU会话的用户面安全执行信息包括：接入管理装置预存储或预配置有PDU会话标识和用户面安全执行信息之间的映射关系，AMF根据EBI分配请求中的PDU会话标识确定对应的用户面安全执行信息；或AMF从PCF中获取PDU会话标识对应的用户面安全执行信息；或AMF从SMF中获取PDU会话标识对应的用户面安全执行信息。
在一种可能的实施方式中，接入管理装置获取EPS的用户面加密保护信息包括：接入管理装置预存储或预配置有EPS的用户面加密保护信息；或接入管理装置接收来自MME发送的EPS的用户面加密保护信息。
其中，接入管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，其实质是，EPS的用户面安全能力能否满足PDU会话的用户面安全需求。如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的，表示EPS的用户面安全能力满足PDU会话的用户面安全需求；如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的，表示EPS的用户面安全能力不满足PDU会话的用户面安全需求。
在一种可能的实施方式中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息。
当PDU会话的用户面安全需求信息表示PDU会话未被完整性保护，以及EPS的用户面加密保护信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，以及加密需求信息为not needed，传输管理装置不需要再解析用户面加密保护信息，即无论用户面加密激活信息为activated还是unactivated，传输管理装置可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，当完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话被加密，以及用户加密激活信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，加密需求信息为required，以及用户面加密激活信息为activated，传输管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，PDU会话的用户面安全执行信息包括：完整性保护需求信息；
当完整性需求信息表示所述PDU会话被完整性保护时，PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。由于EPS的用户面不支持完整性保护，当完整性保护需求信息为required时，传输管理装置无需再解析加密保护需求信息和用户面加密激活信息，即可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
S303、接入管理装置向传输管理装置发送EBI分配响应信息，接入管理装置接收来自传输管理装置的EBI分配响应信息。
具体的，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，接入管理装置为EPS承载分配EBI，接入管理装置向SMF+PGW-C发送EBI分配响应，EBI分配响应中携带为EPS承载分配的EBI，
在一种可能的实施方式中，在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息不匹配的情况下，接入管理装置不为EPS承载分配EBI，接入管理装置向传输管理装置发送EBI分配响应，EBI分配响应信息中携带分配失败的原因值，该原因值表示不满足PDU会话的用户面安全需求。
其中，本实施例中，接入管理装置向传输管理装置发送携带分配的EBI的EBI分配响应信息的判断条件不限于只包括S302所述的判断条件，还可以包括一个或多个其他判断条件，例如：其他判断条件为PDU会话的数据网络名(data network name，DNN)为本地数据网络(local area data network，LADN)，即同时满足PDU会话的用户面安全执行信息 和EPS的用户面安全保护信息是匹配的，以及PDU会话的DNN为LADN时，接入管理装置才会向传输管理装置发送携带分配的EBI的EBI分配响应信息。
实施本发明的实施例，接入管理装置接收到EBI分配请求信息时，接入管理装置在PDU会话的用户面安全执行信息和EPS的用户面加密保护信息匹配的情况下，才会为QoS Flow在EPS中映射的EPS承载分配EBI，避免将不符合用户面安全需求的EBI分配给EPS承载。
参见图4，图4是本发明实施例提供的一种EBI释放方法的流程示意图，在本发明实施例中，所述方法包括：
S401、接入管理装置获取PDU会话的用户面安全执行信息和EPS的用户面加密保护信息。
具体的，接入管理装置用于对5GS中的UE的接入和移动性进行管理，接入管理装置可以为AMF。其中，在S401之前，接入管理装置已经基于图1E的分配EBI的方法为Qos Flow在EPS中映射的EPS承载分配EBI，然后接入管理装置获取PDU会话的用户面安全执行信息，以及获取EPS的用户面加密保护信息。接入管理装置可以是5GS中的AMF。
在一种可能的实施方式中，接入管理装置获取该PDU会话的用户面安全执行信息包括：接入管理装置预存储或预配置有PDU会话标识和用户面安全执行信息之间的映射关系，接入管理装置根据EBI分配请求中的PDU会话标识确定对应的用户面安全执行信息；或接入管理装置从PCF中获取PDU会话标识对应的用户面安全执行信息。
在一种可能的实施方式中，接入管理装置获取EPS的用户面加密保护信息包括：接入管理装置预存储或预配置有EPS的用户面加密保护信息；或接入管理装置接收来自MME发送的EPS的用户面加密保护信息。
S402、接入管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
具体的，接入管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，其实质是，EPS的用户面安全能力能否满足PDU会话的用户面安全需求。如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的，表示EPS的用户面安全能力满足PDU会话的用户面安全需求；如果PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的，表示EPS的用户面安全能力不满足PDU会话的用户面安全需求。
在一种可能的实施方式中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息。
当PDU会话的用户面安全需求信息表示PDU会话未被完整性保护，以及EPS的用户面加密保护信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式： required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，以及加密需求信息为not needed，传输管理装置不需要再解析用户面加密保护信息，即无论用户面加密激活信息为activated还是unactivated，传输管理装置可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，当完整性保护需求信息表示PDU会话未被完整性保护，加密需求信息表示PDU会话被加密，以及用户加密激活信息表示EPS已激活用户面加密时，PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。当传输管理装置确定完整性保护需求信息为not needed，加密需求信息为required，以及用户面加密激活信息为activated，传输管理装置判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是匹配的。
在又一种可能的实施方式中，PDU会话的用户面安全执行信息包括：完整性保护需求信息；
当完整性需求信息表示所述PDU会话被完整性保护时，PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
例如：完整性保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需要被完整性保护，preferred表示PDU会话优先被完整性保护，not needed表示PDU会话不需要进行完整性保护，完整性保护需求信息可以用比特位来表示，比特位不同的值对应不同的完整性保护需求信息。加密保护需求信息包括三种形式：required、preferred和not needed，required表示PDU会话需求被加密，preferred表示PDU会话优先被加密，not needed表示PDU会话不需要被加密，加密需求信息可以用比特位来表示，比特位不同的值用来表示不同的加密需求信息。用户面加密激活信息包括两种形式：activated和unactivated。由于EPS的用户面不支持完整性保护，当完整性保护需求信息为required时，传输管理装置无需再解析加密保护需求信息和用户面加密激活信息，即可直接判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是不匹配的。
S403、接入管理装置向传输管理装置发送EBI释放请求信息，传输管理装置接收来自接入管理装置的EBI释放请求信息。
具体的，传输管理装置用于管理5GS中的PDU会话，以及管理EPS中的PDN连接，包 括负责PDU会话的建立、修改和删除，PDN连接的建立、修改和删除，传输管理装置可以由SMF和PGW-C两种装置构成的，也可以是具有SMF和PGW-C的功能的一种装置。在PDU会话的用户面加密执行信息和EPS的用户面加密保护信息不匹配的情况下，接入管理装置确定需要释放先前为EPS承载分配的EBI，接入管理装置向该ESP承载对应的传输管理装置发送EBI释放请求信息，该EBI释放请求信息携带需要释放的EBI以及释放原因值，该释放原因值表示不满足PDU会话的用户面安全需求。
实施本发明的实施例，接入管理装置在已经为QoS Flow在EPS中映射的EPS分配EBI的情况下，判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配，在不匹配时，释放先前为EPS分配的EBI，避免UE从5GS移动到EPS时，EPS承载使用不符合用户面安全需求的EBI。
上述详细阐述了本发明实施例的方法，下面提供了本发明实施例的装置。
请参见图5，图5是本发明实施例提供的一种装置的结构示意图，该装置5可以包括处理单元501和收发单元502。
实施例一：处理单元501，用于判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配。例如：处理单元501用于执行图2中的S201。
收发单元502，用于在所述处理单元的判断结果为是时，向接入管理装置发送EBI分配请求信息，所述EBI分配请求信息用于请求为QoS Flow在EPS中映射的EPS承载分配EBI，所述PDU会话包括至少一个QoS Flow。例如：收发单元502用于执行图2中的S202。
在一种可能的实施方式中，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
所述完整性保护需求信息表示PDU会话未被完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密激活信息表示所述EPS的用户面加密被激活，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配的。
在一种可能的实施方式中，所述PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括用户面加密激活信息；
所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
在一种可能的实施方式中，处理单元501，还用于在所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息不匹配的情况下，所述传输管理装置不向所述接入管理装置发送EBI分配请求。
所述装置5可以为传输管理装置，例如：传输管理装置由SMF和PGW-C两种装置构成，也可以是具有SMF和PGW-C的功能的一种装置。所述装置5也可以为实现相关功能的现场可编程门阵列(field-programmable gate array，FPGA)，专用集成芯片，***芯片(system on chip，SoC)，中央处理器(central processor unit，CPU)，网络处理器(network  processor，NP)，数字信号处理电路，微控制器(micro controller unit，MCU)，还可以采用可编程控制器(programmable logic device，PLD)或其他集成芯片。
本发明实施例和图2的方法实施例基于同一构思，其带来的技术效果也相同，具体过程可参照图2的方法实施例的描述，此处不再赘述。
实施例二：收发单元502，用于接收来自传输管理装置的EBI分配请求信息；其中，所述EBI分配请求用于请求为QoS Flow在EPS中映射的EPS承载分配EBI；例如：收发单元502用于执行图3中的S301。
处理单元501，用于判断所述Qos Flow所在的PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是否匹配；例如：处理单元501用于执行图3中的S302。
收发单元502，还用于在所述处理单元的判断结果为是时，向所述传输管理装置发送EBI分配响应信息；其中，所述EBI分配响应信息携带装置5为所述EPS承载分配的EBI。例如：收发单元502用于执行图3中的S303。
在一种可能的实施方式中，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
其中，所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示不进行加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示进行加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
在一种可能的实施方式中，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；所述完整性保护需求信息表示PDU会话被完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
在一种可能的实施方式中，收发单元502，还用于在处理单元501的判断结果为否的情况下，向所述传输管理装置发送EBI分配响应信息，所述EBI分配响应信息携带EBI分配失败的原因信息。
在一种可能的实施方式中，收发单元502，还用于在所述PDU会话的建立或修改过程中，接收来自所述传输管理装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
所述装置5可以为接入管理装置，例如：接入管理装置可以是5GS中的AMF。所述装置5也可以为实现相关功能的现场可编程门阵列(field-programmable gate array，FPGA)，专用集成芯片，***芯片(system on chip，SoC)，中央处理器(central processor unit，CPU)，网络处理器(network processor，NP)，数字信号处理电路，微控制器(micro controller unit，MCU)，还可以采用可编程控制器(programmable logic device，PLD)或其他集成芯片。
本发明实施例和图3的方法实施例基于同一构思，其带来的技术效果也相同，具体过 程可参照图3的方法实施例的描述，此处不再赘述。
实施例三：处理单元501，用于获取PDU会话的用户面安全执行信息；其中，PDU会话包括至少一个QoS Flow，所述QoS Flow与EPS bearer关联，所述EPS承载已分配有EBI；例如：处理单元501用于执行图4中的S401。
处理单元501，还用于判断所述PDU会话的用户面安全执行信息和预存储或预配置的所述EPS的用户面加密保护信息是否匹配；例如：处理单元501用于执行图4中的S402。
收发单元502，用于在所述处理单元的判断结果为否时，向服务于所述EPS承载的传输管理装置发送EBI释放请求，所述EBI释放请求用于指示所述EPS承载的EBI需要被释放。例如：收发单元502用于执行图4中的S403。
在一种可能的实施方式中，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密能力信息；
所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
在一种可能的实施方式中，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；
其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
在一种可能的实施方式中，处理单元501，还用于当所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配时，不释放所述EPS承载的EBI。
在一种可能的实施方式中，收发单元502，还用于在所述PDU会话的建立或修改过程中，接收来自所述传输管理装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
在一种可能的实施方式中，所述EPS的用户面加密保护信息是来自移动管理实体MME的，所述MME是所述PDU会话待迁移到的MME。
所述装置5可以为接入管理装置，例如：接入管理装置可以是5GS中的AMF。所述装置5也可以为实现相关功能的现场可编程门阵列(field-programmable gate array，FPGA)，专用集成芯片，***芯片(system on chip，SoC)，中央处理器(central processor unit，CPU)，网络处理器(network processor，NP)，数字信号处理电路，微控制器(micro controller unit，MCU)，还可以采用可编程控制器(programmable logic device，PLD)或其他集成芯片。
本发明实施例和图4的方法实施例基于同一构思，其带来的技术效果也相同，具体过程可参照图4的方法实施例的描述，此处不再赘述。
图6为本发明实施例提供的一种装置结构示意图，以下简称装置6，装置6可以集成于前述的传输管理装置或接入管理装置，如图6所示，该装置包括：存储器602、处理器601、收发器603。
存储器602可以是独立的物理单元，与处理器601和收发器603可以通过总线连接。存储器602、处理器601、收发器603也可以集成在一起，通过硬件实现等。
存储器602用于存储实现以上方法实施例，或者装置实施例各个模块的程序，处理器601调用该程序，执行以上方法实施例的操作。
可选地，当上述实施例的分配EBI的方法中的部分或全部通过软件实现时，装置6也可以只包括处理器。用于存储程序的存储器位于装置6之外，处理器601通过电路/电线与存储器连接，用于读取并执行存储器中存储的程序。
处理器可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。
处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
存储器可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合。
上述实施例中，发送模块或发射器执行上述各个方法实施例发送的步骤，接收模块或接收器执行上述各个方法实施例接收的步骤，其它步骤由其他模块或处理器执行。发送模块和接收模块可以组成收发模块，接收器和发射器可以组成收发器。
本申请实施例还提供了一种计算机存储介质，存储有计算机程序，该计算机程序用于执行上述实施例提供的分配EBI的方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例提供的分配EBI的。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于 实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。

Claims (30)

  1. 一种分配演进分组***承载标识EBI的方法，其特征在于，包括：
    当分组数据单元PDU会话的用户面安全执行信息和演进分组***EPS的用户面加密保护信息匹配时，传输管理装置向接入管理装置发送EBI分配请求信息，所述EBI分配请求信息用于请求为服务质量流QoS Flow在EPS中映射的EPS承载分配EBI，所述PDU会话包括至少一个QoS Flow。
  2. 根据权利要求1所述的方法，其特征在于，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示PDU会话未被完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密激活信息表示所述EPS的用户面加密被激活，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配的。
  3. 根据权利要求1所述的方法，其特征在于，所述PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括用户面加密激活信息；
    所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  4. 根据权利要求3所述的方法，其特征在于，还包括：
    在所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息不匹配的情况下，所述传输管理装置不向所述接入管理装置发送EBI分配请求。
  5. 一种分配EBI的方法，其特征在于，包括：
    接入管理装置接收来自传输管理装置的EBI分配请求信息；其中，所述EBI分配请求用于请求为QoS Flow在EPS中映射的EPS承载分配EBI，；
    当所述Qos Flow所在的PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息匹配时，所述接入管理装置向所述传输管理装置发送EBI分配响应信息；其中，所述EBI分配响应信息携带所述接入管理装置为所述EPS承载分配的EBI。
  6. 根据权利要求5所述的方法，其特征在于，
    所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示不进行加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示进行加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
  7. 根据权利要求5所述的方法，其特征在于，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；所述完整性保护需求信息表示PDU会话被完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  8. 根据权利要求5或7所述的方法，还包括：
    在所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息不匹配的情况下，所述接入管理装置向所述传输管理装置发送EBI分配响应信息，所述EBI分配响应信息携带EBI分配失败的原因信息。
  9. 根据权利要求5至8任意一项所述的方法，其特征在于，所述接入管理装置接收来自传输管理装置的EBI分配请求信息之前，还包括：
    在所述PDU会话的建立或修改过程中，所述接入管理装置接收来自所述传输管理装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
  10. 一种分配EBI的方法，其特征在于，包括：
    接入管理装置获取PDU会话的用户面安全执行信息；其中，PDU会话包括至少一个QoS Flow，所述QoS Flow与EPS bearer关联，所述EPS承载已分配有EBI；
    当所述PDU会话的用户面安全执行信息和预存储或预配置的所述EPS的用户面加密保护信息不匹配的情况下，所述接入管理装置向服务于所述EPS承载的传输管理装置发送EBI释放请求，所述EBI释放请求用于指示所述EPS承载的EBI需要被释放。
  11. 根据权利要求10所述的方法，其特征在于，
    所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密能力信息；
    所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  12. 根据权利要求10所述的方法，其特征在于，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
  13. 根据权利要求10或12所述的方法，还包括：
    当所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配时，所述接入管理装置不释放所述EPS承载的EBI。
  14. 根据权利要求10至13任意一项所述的方法，其特征在于，所述接入管理装置获取PDU会话的用户面安全执行信息之前，还包括：
    在所述PDU会话的建立或修改过程中，所述接入管理装置接收来自所述传输管理装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
  15. 根据权利要求10至14任意一项所述的方法，其特征在于，
    所述EPS的用户面加密保护信息是来自移动管理实体MME的，所述MME是所述PDU会话待迁移到的MME。
  16. 一种分配演进分组***承载标识EBI的装置，其特征在于，包括：
    处理单元，用于判断PDU会话的用户面安全执行信息和EPS的用户面加密保护信息是否匹配；
    收发单元，用于在所述处理单元的判断结果为是时，向接入管理装置发送EBI分配请求信息，所述EBI分配请求信息用于请求为QoS Flow在EPS中映射的EPS承载分配EBI，所述PDU会话包括至少一个QoS Flow。
  17. 根据权利要求1所述的装置，其特征在于，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示PDU会话未被完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密激活信息表示所述EPS的用户面加密被激活，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配的。
  18. 根据权利要求16所述的装置，其特征在于，所述PDU会话的用户面安全执行信息 包括完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括用户面加密激活信息；
    所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  19. 根据权利要求18所述的装置，其特征在于，
    所述处理单元，还用于在所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息不匹配的情况下，所述传输管理装置不向所述接入管理装置发送EBI分配请求。
  20. 一种分配EBI的装置，其特征在于，包括：
    收发单元，用于接收来自传输管理装置的EBI分配请求信息；其中，所述EBI分配请求用于请求为QoS Flow在EPS中映射的EPS承载分配EBI；
    处理单元，用于判断所述Qos Flow所在的PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是否匹配；
    所述收发单元，还用于在所述处理单元的判断结果为是时，向所述传输管理装置发送EBI分配响应信息；其中，所述EBI分配响应信息携带所述装置为所述EPS承载分配的EBI。
  21. 根据权利要求20所述的装置，其特征在于，
    所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示不进行加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示进行加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
  22. 根据权利要求20所述的装置，其特征在于，所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密激活信息；所述完整性保护需求信息表示PDU会话被完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  23. 根据权利要求20或22所述的装置，其特征在于，
    所述收发单元，还用于在所述处理单元的判断结果为否的情况下，向所述传输管理装置发送EBI分配响应信息，所述EBI分配响应信息携带EBI分配失败的原因信息。
  24. 根据权利要求20至23任意一项所述的装置，其特征在于，
    所述收发单元，还用于在所述PDU会话的建立或修改过程中，接收来自所述传输管理 装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
  25. 一种分配EBI的装置，其特征在于，包括：
    处理单元，用于获取PDU会话的用户面安全执行信息；其中，PDU会话包括至少一个QoS Flow，所述QoS Flow与EPS bearer关联，所述EPS承载已分配有EBI；
    所述处理单元，还用于判断所述PDU会话的用户面安全执行信息和预存储或预配置的所述EPS的用户面加密保护信息是否匹配；
    所述收发单元，用于在所述处理单元的判断结果为否时，向服务于所述EPS承载的传输管理装置发送EBI释放请求，所述EBI释放请求用于指示所述EPS承载的EBI需要被释放。
  26. 根据权利要求25所述的装置，其特征在于，
    所述PDU会话的用户面安全执行信息包括：完整性保护需求信息和加密需求信息，所述EPS的用户面加密保护信息包括：用户面加密能力信息；
    所述完整性保护需求信息表示进行完整性保护，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是不匹配的。
  27. 根据权利要求25所述的装置，其特征在于，PDU会话的用户面安全执行信息包括完整性保护需求信息和加密需求信息，EPS的用户面加密保护信息包括：用户面加密激活信息；
    其中，所述完整性保护需求信息表示所述PDU会话未被完整性保护，所述加密需求信息表示所述PDU会话未被加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的；或
    所述完整性保护需求信息表示不进行完整性保护，所述加密需求信息表示PDU会话被加密，所述用户面加密能力信息表示支持用户面加密，所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息为匹配的。
  28. 根据权利要求25或27所述的装置，其特征在于，
    所述处理单元，还用于当所述PDU会话的用户面安全执行信息和所述EPS的用户面加密保护信息是匹配时，不释放所述EPS承载的EBI。
  29. 根据权利要求25至28任意一项所述的装置，其特征在于，
    所述收发单元，还用于在所述PDU会话的建立或修改过程中，接收来自所述传输管理装置的所述PDU会话标识和所述PDU会话标识对应的用户面安全执行信息。
  30. 根据权利要求25至29任意一项所述的装置，其特征在于，
    所述EPS的用户面加密保护信息是来自移动管理实体MME的，所述MME是所述PDU会话待迁移到的MME。
PCT/CN2019/100460 2018-08-13 2019-08-13 分配ebi的方法和装置 WO2020034971A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
BR112021002388-7A BR112021002388A2 (pt) 2018-08-13 2019-08-13 método e aparelho para atribuir ebi
CA3109203A CA3109203A1 (en) 2018-08-13 2019-08-13 Method and apparatus for assigning ebi
EP22207406.4A EP4216652A1 (en) 2018-08-13 2019-08-13 Method and apparatus for assigning ebi
EP19849468.4A EP3836727B1 (en) 2018-08-13 2019-08-13 Method and apparatus for allocating ebi
US17/174,581 US11849313B2 (en) 2018-08-13 2021-02-12 Method and apparatus for assigning EBI

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810918782.5A CN110831244B (zh) 2018-08-13 2018-08-13 分配ebi的方法和装置
CN201810918782.5 2018-08-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/174,581 Continuation US11849313B2 (en) 2018-08-13 2021-02-12 Method and apparatus for assigning EBI

Publications (1)

Publication Number Publication Date
WO2020034971A1 true WO2020034971A1 (zh) 2020-02-20

Family

ID=69525110

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/100460 WO2020034971A1 (zh) 2018-08-13 2019-08-13 分配ebi的方法和装置

Country Status (6)

Country Link
US (1) US11849313B2 (zh)
EP (2) EP3836727B1 (zh)
CN (2) CN114286337A (zh)
BR (1) BR112021002388A2 (zh)
CA (1) CA3109203A1 (zh)
WO (1) WO2020034971A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11240699B2 (en) 2018-11-19 2022-02-01 Mediatek Inc. Insufficient resources in the UE during PDU session establishment procedure
US11284458B2 (en) * 2019-02-18 2022-03-22 Mediatek Inc. Handling of mapped EPS bearer context with duplicate EPS bearer ID
CN114980105A (zh) * 2021-02-21 2022-08-30 华为技术有限公司 通信方法及通信装置
GB2614409A (en) * 2021-11-02 2023-07-05 Samsung Electronics Co Ltd Improvements in and relating to QOS error handling during disaster roaming service
KR20230161813A (ko) * 2022-05-19 2023-11-28 삼성전자주식회사 네트워크 장비 내의 컴퓨팅과 결합된 차세대 이동통신 시스템을 위한 방법 및 장치

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012050841A1 (en) * 2010-09-28 2012-04-19 Research In Motion Corporation Method and apparatus for releasing connection with local gw when ue moves out of the residential/enterprise network coverage
CN108124238A (zh) * 2016-11-28 2018-06-05 大唐移动通信设备有限公司 一种集群组的信令处理方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101800958A (zh) * 2009-02-10 2010-08-11 中兴通讯股份有限公司 获取紧急会话信息的方法和***
WO2017020176A1 (zh) * 2015-07-31 2017-02-09 华为技术有限公司 一种数据传输方法及相关设备、***
WO2017111781A1 (en) 2015-12-23 2017-06-29 Intel Corporation Group-based eps bearer architecture
US10911977B2 (en) * 2016-08-01 2021-02-02 Samsung Electronics Co., Ltd. Method and apparatus for managing data communication in wireless communication network
US10275828B2 (en) 2016-11-02 2019-04-30 Experian Health, Inc Expanded data processing for improved entity matching
CN113630773B (zh) * 2017-01-24 2023-02-14 华为技术有限公司 安全实现方法、设备以及***

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012050841A1 (en) * 2010-09-28 2012-04-19 Research In Motion Corporation Method and apparatus for releasing connection with local gw when ue moves out of the residential/enterprise network coverage
CN108124238A (zh) * 2016-11-28 2018-06-05 大唐移动通信设备有限公司 一种集群组的信令处理方法和装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Allocation of EPS bearer ID in 5GS", SA WG2 MEETING #121 S 2-173322, 19 May 2017 (2017-05-19), XP051281818 *
See also references of EP3836727A4 *

Also Published As

Publication number Publication date
EP3836727A1 (en) 2021-06-16
CA3109203A1 (en) 2020-02-20
US11849313B2 (en) 2023-12-19
CN110831244B (zh) 2022-01-14
US20210168595A1 (en) 2021-06-03
CN110831244A (zh) 2020-02-21
CN114286337A (zh) 2022-04-05
EP3836727B1 (en) 2022-12-14
EP3836727A4 (en) 2021-09-15
EP4216652A1 (en) 2023-07-26
BR112021002388A2 (pt) 2021-05-04

Similar Documents

Publication Publication Date Title
US11463946B2 (en) System and method for UE context and PDU session context management
JP7130769B2 (ja) 通信方法および通信装置
WO2020034971A1 (zh) 分配ebi的方法和装置
CN110166580B (zh) 资源管理的方法、设备及***
US20200383035A1 (en) Communications method and apparatus
WO2020063317A1 (zh) 一种通信方法及装置
WO2017167203A1 (zh) 一种服务质量的控制方法和装置
WO2018006773A1 (zh) 信息、数据发送方法及装置、接入网和***
WO2009049529A1 (fr) Procédé d'établissement de support de charge et dispositif associé
WO2022001761A1 (zh) 通信方法及装置
CN102612096B (zh) 一种ip数据包的传输方法和设备
WO2019137194A1 (zh) 一种用户面数据安全保护方法及装置
WO2017113207A1 (zh) 一种业务消息传输方法、第一终端及网络侧设备
CN114830818A (zh) 管理QoS的方法、中继终端、PCF网元、SMF网元及远程终端
EP4319297A2 (en) Communication method and communications apparatus
US11991516B2 (en) Session migration method and apparatus
EP3823323A1 (en) Data transmission method and related apparatus
WO2021042381A1 (zh) 一种通信方法、装置及***
WO2022061916A1 (zh) 一种通信方法及装置
WO2023207637A1 (zh) 通信方法及装置
WO2023207838A1 (zh) 一种通信方法及设备
CN116848898A (zh) 信息传输方法及装置、通信设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19849468

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3109203

Country of ref document: CA

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112021002388

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2019849468

Country of ref document: EP

Effective date: 20210308

ENP Entry into the national phase

Ref document number: 112021002388

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20210208