WO2022001324A1 - 通信方法、装置及*** - Google Patents

通信方法、装置及*** Download PDF

Info

Publication number
WO2022001324A1
WO2022001324A1 PCT/CN2021/089411 CN2021089411W WO2022001324A1 WO 2022001324 A1 WO2022001324 A1 WO 2022001324A1 CN 2021089411 W CN2021089411 W CN 2021089411W WO 2022001324 A1 WO2022001324 A1 WO 2022001324A1
Authority
WO
WIPO (PCT)
Prior art keywords
data flow
service data
service
identification information
information
Prior art date
Application number
PCT/CN2021/089411
Other languages
English (en)
French (fr)
Inventor
孙海洋
李岩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022001324A1 publication Critical patent/WO2022001324A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/0268—Traffic management, e.g. flow control or congestion control using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR]

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a communication method, device, and system.
  • IP Internet protocol
  • E2E End to end
  • IPsec Internet Protocol Security
  • the terminal device or the security gateway will use the Authentication Header (AH) protocol or the Encapsulating Security Payload (ESP) protocol to perform encryption on the user plane data stream. Encryption, the core network cannot identify the port number and other information, so it cannot identify the user plane data flow, and thus cannot perform Quality of Service (QoS) control.
  • AH Authentication Header
  • ESP Encapsulating Security Payload
  • the present application provides a communication method, device and system for implementing QoS control on encrypted user plane data flow.
  • an embodiment of the present application provides a communication method, including: a security gateway receiving a request message from a policy control network element, where the request message includes service data flow description information, and the service data flow description information includes service data flow filtering server or application identifier, the request message is used to request to obtain the service data stream identification information corresponding to the service data stream description information, and the service data stream identification information is a security parameter index SPI or a service data stream index; the security gateway Sending the service data flow identification information corresponding to the service data flow description information to the policy control network element, where the service data flow identification information is used to generate a policy control charging PCC rule, and is used to identify and carry the service Packet of data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that core network elements such as user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the security gateway sends the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the terminal device can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the security gateway identifies the received service data stream according to the service data stream description information; the security gateway adds the service data stream identification information to the data packet of the service data stream; The security gateway sends the data packets of the service data flow.
  • the security gateway can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the security gateway sending the service data flow identification information corresponding to the service data flow description information to the policy control network element includes: the security gateway sending the policy control network element the the upstream SPI and/or the downlink SPI corresponding to the service data flow description information; or, the security gateway sends the upstream service data flow index and/or downlink service data corresponding to the service data flow description information to the policy control network element Stream index.
  • an embodiment of the present application provides a communication method, including: a policy control network element sends a request message to a security gateway, where the request message includes service data flow description information, and the service data flow description information includes service data flow filtering device or application identifier, the request message is used to request to obtain the service data stream identification information corresponding to the service data stream description information, and the service data stream identification information is a security parameter index SPI or a service data stream index; the policy control The network element receives the service data flow identification information corresponding to the service data flow description information from the security gateway; the policy control network element generates a policy control charging PCC rule according to the service data flow identification information, the The service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that core network elements such as user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the policy control network element receives an authorization request from an application function network element, the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; The policy control network element generates the service data flow description information according to the service description information.
  • the policy control network element receiving the service data flow identification information corresponding to the service data flow description information from the security gateway includes: the policy control network element receiving the service data flow identification information from the security gateway. the upstream SPI and/or the downlink SPI corresponding to the service data flow description information; or, the policy control network element receives from the security gateway the upstream service data flow index and/or downlink service data corresponding to the service data flow description information Stream index.
  • the policy control network element determines that the service data flow description information cannot be combined with other service data flow description information into the same PCC rule, and sends the request message to the security gateway; or, the The policy control network element determines that the binding parameters of the PCC rules corresponding to the service data flow description information are different from the binding parameters of the PCC rules corresponding to other service data flow description information, and then sends the request message to the security gateway.
  • an embodiment of the present application provides a communication method, including: a security gateway receiving a request message from a policy control network element, where the request message includes service data flow description information and service data flow identification information, the service data flow identification information
  • the information is a security parameter index SPI or a business data flow index
  • the business data flow description information includes a business data flow filter or an application identifier
  • the request message is used to request the establishment of the business data flow description information and the business data flow.
  • the corresponding relationship between the identification information the security gateway sends a response message to the policy control network element, and the response message is used to indicate that the corresponding relationship between the service data flow description information and the service data flow identification information has been established.
  • the service data flow identification information is used to generate a policy control and charging PCC rule, and is used to identify a data packet carrying the service data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that the core network elements such as the user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the security gateway sends the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the terminal device can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the security gateway identifies the received service data flow according to the service data flow template; the security gateway adds the service data flow identification information to the data packet of the service data flow; the The security gateway sends the data packets of the service data flow.
  • the security gateway can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the SPI includes an upstream SPI and/or a downstream SPI.
  • the service data flow index includes an uplink service data flow index and/or a downlink service data flow index.
  • an embodiment of the present application provides a communication method, including: a policy control network element sending a request message to a security gateway, where the request message includes service data flow description information and service data flow identification information, the service data flow identification information
  • the information is a security parameter index SPI or a business data flow index
  • the business data flow description information includes a business data flow filter or an application identifier
  • the request message is used to request the establishment of the business data flow description information and the business data flow.
  • the policy control network element receives a response message from the security gateway, and the response message is used to indicate that the corresponding relationship between the service data flow description information and the service data flow identification information has been established;
  • the policy control network element generates a policy control charging PCC rule according to the service data flow identification information, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that core network elements such as user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the policy control network element receives an authorization request from an application function network element, the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; The policy control network element generates the service data flow description information according to the service description information.
  • the SPI includes an upstream SPI and/or a downstream SPI.
  • the service data flow index includes an uplink service data flow index and/or a downlink service data flow index.
  • the policy control network element determines that the service data flow description information can be combined with other service data flow description information into the same PCC rule, and then determines to establish the service data flow identification information and the service data The corresponding relationship of the flow description information; or, the policy control network element determines that the binding parameters of the PCC rule corresponding to the service data flow description information are the same as the binding parameters of the PCC rules corresponding to other service data flow description information, then determine A corresponding relationship between the service data flow identification information and the service data flow description information is established.
  • an embodiment of the present application provides a communication method, comprising: a security gateway receiving service information from an application function network element, where the service information includes service description information and/or service requirement information, and the service description information includes service data flow filter or application identifier; the security gateway determines service data flow identification information according to the service information, and the service data flow identification information is a security parameter index SPI or a service data flow index; the security gateway reports to the policy control network
  • the element sends the service data flow identification information, where the service data flow identification information is used to generate a policy control and charging PCC rule, and is used to identify a data packet carrying the service data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that core network elements such as user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the security gateway sends the corresponding relationship between the service data flow identification information and the service description information to the terminal device.
  • the terminal device can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the security gateway identifies the received service data flow according to the service description information; the security gateway adds the service data flow identification information to the data packet of the service data flow; the security The gateway sends the data packets of the service data flow.
  • the security gateway can add the service data flow identification information to the data packet corresponding to the service data flow description information, so that the user plane network element can identify the data packet based on the service data flow identification information.
  • the security gateway sending the service data flow identification information to the policy control network element includes: the security gateway sending the uplink SPI and/or the downlink SPI to the policy control network element; or, the The security gateway sends the upstream service data flow index and/or the downstream service data flow index to the policy control network element.
  • the service information includes at least the service requirement information; the security gateway determines the service data flow identification information according to the service information, including: the security gateway determines the service requirement information and other services If the demand information is the same, and the other business demand information corresponds to the business data flow identification information, it is determined that the business information corresponds to the business data flow identification information.
  • the service information includes at least the service requirement information; the security gateway determines the service data flow identification information according to the service information, including: the security gateway determines the service requirement information and other services If the demand information is different, or the other business demand information has no corresponding business data flow identification information, the business data flow identification information is generated for the business information.
  • the security gateway sends the corresponding relationship between the service data flow identification information and the service requirement information to the policy control network element.
  • an embodiment of the present application provides a communication method, including: a policy control network element receives service information from a security gateway and service data flow identification information corresponding to the service information, where the service information includes service description information and/or Service requirement information, the service description information includes service data flow filters or application identifiers, and the service data flow identification information is a security parameter index SPI or a service data flow index; the policy control network element identifies according to the service data flow
  • the information generation policy controls the charging PCC rule, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the policy control network element can generate PCC rules according to the service data flow identification information, so that core network elements such as user plane network elements can A data packet corresponding to the service data flow description information is identified according to the service data flow identification information, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the policy control network element receiving service information and service data flow identification information corresponding to the service information from the security gateway includes: the policy control network element receiving the service information and the service information from the security gateway. Uplink SPI and/or downlink SPI corresponding to the service information; or, the policy control network element receives the service information and the uplink service data flow index and/or downlink service data corresponding to the service information from the security gateway Stream index.
  • an embodiment of the present application provides a communication method, comprising: a user plane network element receiving a packet detection rule PDR from a session management network element, where the PDR includes service data flow identification information and a quality of service flow identification QFI, and the service
  • the data flow identification information is a security parameter index SPI or a service data flow index;
  • the user plane network element identifies the data packet carrying the service data flow identification information;
  • the user plane network element corresponds to the service data flow identification information according to the The QFI performs quality of service QoS control.
  • the user plane network element can identify the data packet corresponding to the service data flow description information according to the service data flow identification information, and then execute QoS flow control according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • an embodiment of the present application provides a communication device, and the device may be a security gateway or a chip for a security gateway.
  • the device has the function of implementing the implementation methods of the first aspect, the third aspect, and the fifth aspect. This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an embodiment of the present application provides a communication device, where the device may be a policy control network element, and may also be a chip used for the policy control network element.
  • the device has the function of implementing the implementation methods of the second aspect, the fourth aspect, and the sixth aspect. This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an embodiment of the present application provides a communication device, where the device may be a user plane network element or a chip used for the user plane network element.
  • the device has the function of realizing the above seventh aspect. This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an embodiment of the present application provides a communication device, including a processor and a memory; the memory is used to store computer-executed instructions, and when the device is running, the processor executes the computer-executed instructions stored in the memory to The apparatus is caused to perform the respective implementation methods of the above-mentioned first to seventh aspects.
  • an embodiment of the present application provides a communication apparatus, including units or means for executing each step of each implementation method of the above-mentioned first to seventh aspects.
  • an embodiment of the present application provides a communication device, including a processor and an interface circuit, where the processor is configured to communicate with other devices through the interface circuit, and execute the implementation methods of the first to seventh aspects above.
  • the processor includes one or more.
  • an embodiment of the present application provides a communication device, including a processor, which is connected to a memory and used to call a program stored in the memory to execute the implementation methods of the first to seventh aspects above.
  • the memory may be located within the device or external to the device.
  • the processor includes one or more.
  • the embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium runs on a computer, the processor executes the first to seventh aspects above. various implementation methods.
  • an embodiment of the present application further provides a computer program product, the computer product includes a computer program, and when the computer program runs, the implementation methods of the above-mentioned first to seventh aspects are executed.
  • an embodiment of the present application further provides a chip system, including: a processor configured to execute each implementation method of the first aspect to the seventh aspect.
  • an embodiment of the present application further provides a communication system, including a security gateway and a policy control network element; the policy control network element is configured to send a request message to the security gateway, where the request message includes service data Flow description information, the service data flow description information includes a service data flow filter or application identifier, the request message is used to request to obtain the service data flow identification information corresponding to the service data flow description information, and the service data flow identification information
  • the information is a security parameter index SPI or a service data flow index; the service data flow identification information corresponding to the service data flow description information is received from the security gateway; and a policy control and charging PCC is generated according to the service data flow identification information
  • the service data flow identification information is used to identify the data packet carrying the service data flow identification information; the security gateway is used to receive the request message from the policy control network element; to the policy control network element The element sends the service data flow identification information corresponding to the service data flow description information.
  • an embodiment of the present application further provides a communication method, including: a policy control network element sending a request message to a security gateway, where the request message includes service data flow description information, and the service data flow description information includes service data Flow filter or application identifier, the request message is used to request to obtain the business data flow identification information corresponding to the business data flow description information, and the business data flow identification information is a security parameter index SPI or a business data flow index; a security gateway Receive the request message from the policy control network element; the security gateway sends the service data flow identification information corresponding to the service data flow description information to the policy control network element; the policy control network element receives the service data flow description from the security gateway The service data flow identification information corresponding to the information; the policy control network element generates a policy control charging PCC rule according to the service data flow identification information, and the service data flow identification information is used to identify and carry the service data flow identification information the data package.
  • an embodiment of the present application further provides a communication system, including a security gateway and a policy control network element; the policy control network element is configured to send a request message to the security gateway, where the request message includes service data Flow description information and business data flow identification information, the business data flow identification information is a security parameter index SPI or a business data flow index, the business data flow description information includes a business data flow filter or an application identifier, and the request message uses upon requesting to establish a correspondence between the service data flow description information and the service data flow identification information; and receiving a response message from the security gateway, where the response message is used to indicate that the service data flow description information and the service data flow description information have been established
  • the corresponding relationship of service data flow identification information according to the service data flow identification information, a policy control charging PCC rule is generated, and the service data flow identification information is used to identify the data packet carrying the service data flow identification information; the A security gateway, configured to receive the request message from the policy control network element; and send the response message to the policy control network
  • an embodiment of the present application further provides a communication method, including: a policy control network element sending a request message to a security gateway, where the request message includes service data flow description information and service data flow identification information, the service The data flow identification information is a security parameter index SPI or a service data flow index, the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request the establishment of the service data flow description information and the described service data flow.
  • the correspondence between the service data flow identification information; the security gateway receives the request message from the policy control network element; the security gateway sends a response message to the policy control network element, and the response message is used to indicate that the service data flow description information and the service data flow description information have been established.
  • the identification information is used to identify the data packet carrying the identification information of the service data flow.
  • an embodiment of the present application further provides a communication system, including a security gateway and a policy control network element;
  • the security gateway is configured to receive service information from an application function network element, where the service information includes service description information and/or business requirement information, the business description information includes a business data flow filter or an application identifier; according to the business information, determine the business data flow identification information, and the business data flow identification information is the security parameter index SPI or business data flow index; send the service data flow identification information and the service information to the policy control network element;
  • the policy control network element is configured to receive the service data flow identification information corresponding to the service information and the service information from the security gateway The service information is generated; the policy control charging PCC rule is generated according to the service data flow identification information, and the service data flow identification information is used to identify the data packet carrying the service data flow identification information.
  • an embodiment of the present application further provides a communication method, including: a security gateway receiving service information from an application function network element, where the service information includes service description information and/or service requirement information, and the service description information It includes a service data flow filter or an application identifier; the security gateway determines the service data flow identification information according to the service information, and the service data flow identification information is a security parameter index SPI or a service data flow index; the security gateway sends the policy control network element to the Send the service data flow identification information and the service information; the policy control network element receives the service data flow identification information and the service information corresponding to the service information from the security gateway; generate a policy control according to the service data flow identification information The charging PCC rule, the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • FIG. 1 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • Figure 2(a) is a schematic diagram of a 5G network architecture based on a service-oriented architecture
  • Figure 2(b) is a schematic diagram of a 5G network architecture based on a point-to-point interface
  • Fig. 3 is the schematic diagram of the data packet format in the transmission mode
  • FIG. 4 is a schematic diagram of a packet format in a tunnel mode
  • FIG. 5(a) is a schematic diagram of a communication method provided by an embodiment of the present application.
  • FIG. 5(b) is a schematic diagram of another communication method provided by an embodiment of the present application.
  • FIG. 5(c) is a schematic diagram of another communication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another communication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another communication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a communication device according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of still another communication apparatus provided by an embodiment of the present application.
  • the present application provides a communication system, which includes a security gateway and a policy control network element.
  • the system further includes a session management network element and/or a user plane network element.
  • the policy control network element is configured to send a request message to the security gateway, where the request message includes service data flow description information, and the service data flow description information includes a service data flow filter or an application identifier, and the request message for requesting to obtain service data flow identification information corresponding to the service data flow description information, where the service data flow identification information is a security parameter index SPI or a service data flow index; receiving the service data flow description information from the security gateway The corresponding service data flow identification information; according to the service data flow identification information, a policy control charging PCC rule is generated, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the security gateway is configured to receive the request message from the policy control network element; and send the service data flow identification information corresponding to the service data flow description information to the policy control network element.
  • the security gateway is further configured to send the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the security gateway is further configured to identify the received business data flow according to the business data flow description information; and add the business data flow identification information to the data of the business data flow packet; sending the data packet of the service data flow.
  • the security gateway configured to send the service data flow identification information corresponding to the service data flow description information to the policy control network element, specifically includes: sending the service data flow identification information corresponding to the service data flow description information to the policy control network element. Controlling the network element to send the upstream SPI and/or the downlink SPI corresponding to the service data flow description information; or, for sending the upstream service data flow index and/or the corresponding service data flow description information to the policy control network element Downlink service data flow index.
  • the policy control network element is further configured to receive an authorization request from an application function network element, where the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; generate the service data flow description information according to the service description information.
  • the policy control network element is further configured to determine that the service data flow description information cannot be combined with other service data flow description information into the same PCC rule, and then send the service data flow description information to the security gateway. or, if it is determined that the binding parameters of the PCC rule corresponding to the service data flow description information are different from the binding parameters of the PCC rules corresponding to other service data flow description information, the request message is sent to the security gateway.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet inspection rule according to the PCC rule PDR, where the PDR includes the service data flow identification information and the quality of service flow identification QFI; the PDR is sent to the user plane network element.
  • the user plane network element is configured to receive the PDR from the session management network element; identify the data packet carrying the identification information of the service data flow; identify according to the service data flow
  • the QFI corresponding to the information performs quality of service QoS control.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet quality of service according to the PCC rule QoS rules, the QoS rules include the service data flow identification information and QFI; send the QoS rules to the terminal device.
  • the policy control network element is configured to send a request message to the security gateway, where the request message includes service data flow description information and service data flow identification information, where the service data flow identification information is a security parameter index SPI or service data Flow index, the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request to establish a corresponding relationship between the service data flow description information and the service data flow identification information;
  • the security gateway receives a response message, where the response message is used to indicate that the corresponding relationship between the service data flow description information and the service data flow identification information has been established; according to the service data flow identification information, a policy control and charging PCC rule is generated , the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the security gateway is configured to receive the request message from the policy control network element; and send the response message to the policy control network element.
  • the security gateway is further configured to send the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the security gateway is further configured to identify the received service data flow according to the service data flow template; and add the service data flow identification information to the data packets of the service data flow ; Send the data packets of the service data flow.
  • the SPI includes an upstream SPI and/or a downstream SPI.
  • the service data flow index includes an uplink service data flow index and/or a downlink service data flow index.
  • the policy control network element is further configured to receive an authorization request from an application function network element, where the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; generate the service data flow description information according to the service description information.
  • the policy control network element is further configured to determine that the service data flow description information can be combined with other service data flow description information into the same PCC rule, and then determine to establish the service data flow The corresponding relationship between the identification information and the description information of the service data flow; or, it is determined that the binding parameters of the PCC rule corresponding to the description information of the service data flow are the same as the binding parameters of the PCC rules corresponding to the description information of other service data flow, then It is determined to establish a corresponding relationship between the service data flow identification information and the service data flow description information.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet inspection rule according to the PCC rule PDR, where the PDR includes the service data flow identification information and the quality of service flow identification QFI; the PDR is sent to the user plane network element.
  • the user plane network element is configured to receive the PDR from the session management network element; identify the data packet carrying the identification information of the service data flow; identify according to the service data flow
  • the QFI corresponding to the information performs quality of service QoS control.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet quality of service according to the PCC rule QoS rules, the QoS rules include the service data flow identification information and QFI; send the QoS rules to the terminal device.
  • the security gateway is configured to receive service information from an application function network element, the service information includes service description information and/or service requirement information, and the service description information includes a service data flow filter or an application identifier; according to the service information, determine the service data flow identification information, the service data flow identification information is the security parameter index SPI or the service data flow index; send the service data flow identification information and the service information to the policy control network element.
  • the policy control network element is configured to receive the service information and the service data flow identification information from the security gateway; generate a policy control and charging PCC rule according to the service data flow identification information, and the service data flow identification information The information is used to identify the data packet carrying the identification information of the service data flow.
  • the security gateway is further configured to send the corresponding relationship between the service data flow identification information and the service description information to the terminal device.
  • the security gateway is further configured to identify the received service data flow according to the service description information; and add the service data flow identification information to the data packets of the service data flow; Send the data packets of the service data flow.
  • the security gateway configured to send the service data flow identification information to the policy control network element, specifically includes: sending the uplink SPI and/or the downlink SPI to the policy control network element ; or, for sending the upstream service data flow index and/or the downlink service data flow index to the policy control network element.
  • the service information includes at least the service requirement information; the security gateway is configured to determine service data flow identification information according to the service information, specifically including: determining the service If the demand information is the same as other business demand information, and the other business demand information corresponds to the business data flow identification information, it is determined that the business information corresponds to the business data flow identification information.
  • the service information includes at least the service requirement information; the security gateway is configured to determine service data flow identification information according to the service information, specifically including: determining the service If the demand information is different from other business demand information, or the other business demand information has no corresponding business data flow identification information, the business data flow identification information is generated for the business information.
  • the security gateway is further configured to send the corresponding relationship between the service data flow identification information and the service requirement information to the policy control network element.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet inspection rule according to the PCC rule PDR, where the PDR includes the service data flow identification information and the quality of service flow identification QFI; the PDR is sent to the user plane network element.
  • the user plane network element is configured to receive the PDR from the session management network element; identify the data packet carrying the identification information of the service data flow; identify according to the service data flow
  • the QFI corresponding to the information performs quality of service QoS control.
  • the policy control network element is further configured to send the PCC rule to the session management network element; the session management network element is configured to generate a packet quality of service according to the PCC rule QoS rules, the QoS rules include the service data flow identification information and QFI; send the QoS rules to the terminal device.
  • the system shown in Figure 1 can be used in the fifth generation (5G) network architecture shown in Figure 2(a) or Figure 2(b), of course, it can also be used in future network architectures, such as the sixth generation (6th generation, 6G) network architecture, etc., which are not limited in this application.
  • 5G fifth generation
  • 6G sixth generation
  • FIG. 2( a ) is a schematic diagram of a 5G network architecture based on a service-oriented architecture.
  • the network element or entity corresponding to the policy control network element in Figure 1 may be the Policy Control Function (PCF) network element in the 5G network architecture shown in Figure 2(a), and the user plane network in Figure 1
  • the network element or entity corresponding to the element may be a user plane function (UPF) network element in the 5G network architecture shown in Figure 2(a).
  • the network element or entity corresponding to the session management network element in FIG. 1 may be a session management function (session management function, SMF) network element in the 5G network architecture shown in FIG. 2(a).
  • SMF session management function
  • the 5G network architecture shown in Figure 2(a) can include three parts, namely the terminal equipment part, the data network (DN) and the operator network part. The following briefly describes the functions of some of the network elements.
  • the operator network may include one or more of the following network elements: Authentication Server Function (AUSF) network element, Network Exposure Function (NEF) network element, PCF network element, unified data Management (unified data management, UDM) network element, unified database (Unified Data Repository, UDR), network storage function (Network Repository Function, NRF) network element, application function (Application Function, AF) network element, access and mobility Management function (Access and Mobility Management Function, AMF) network elements, SMF network elements, RAN and UPF network elements, etc.
  • AUSF Authentication Server Function
  • NEF Network Exposure Function
  • PCF Policy and Charging Function
  • unified data Management unified data management
  • UDR Unified Data Repository
  • NRF Network Repository Function
  • AMF Access and Mobility Management Function
  • the part other than the radio access network part may be referred to as the core network part.
  • the terminal device in this embodiment of the present application may be a device for implementing a wireless communication function.
  • the terminal equipment may be a user equipment (UE), an access terminal, a terminal unit, a terminal station, a mobile station, a mobile station in a 5G network or a public land mobile network (PLMN) evolved in the future.
  • PLMN public land mobile network
  • remote station remote terminal, mobile equipment, wireless communication equipment, terminal agent or terminal device, etc.
  • the access terminal may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices or wearable devices, virtual reality (VR) end devices, augmented reality (AR) end devices, industrial control (industrial) Wireless terminals in control), wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc. Terminals can be mobile or stationary.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • a wireless communication Functional handheld devices computing devices or other processing devices connected to wireless modems, in-vehicle devices or wearable devices, virtual reality (VR) end devices, augmented reality (AR) end devices, industrial control (industrial) Wireless terminals in control), wireless terminals
  • the above-mentioned terminal device can establish a connection with the operator network through an interface (eg, N1, etc.) provided by the operator network, and use the data and/or voice services provided by the operator network.
  • the terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN and/or the service provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and the terminal device, and may provide other data and/or voice services for the terminal device.
  • the specific expression form of the above third party can be specifically determined according to the actual application scenario, and is not limited here.
  • RAN is a sub-network of an operator's network, and is an implementation system between service nodes and terminal equipment in the operator's network.
  • the terminal device To access the operator's network, the terminal device first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN.
  • the RAN device in this application is a device that provides a wireless communication function for a terminal device, and the RAN device is also called an access network device.
  • the RAN equipment in this application includes but is not limited to: next-generation base station (g nodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B in 5G (node B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center, etc.
  • next-generation base station g nodeB, gNB
  • evolved node B evolved node B
  • eNB evolved node B
  • RNC radio network controller
  • node B in 5G node B, NB
  • base station controller BSC
  • base transceiver station base transceiver station
  • BTS home base station
  • base station for example, home
  • the AMF network element mainly performs functions such as mobility management and access authentication/authorization. In addition, it is also responsible for transferring user policies between UE and PCF.
  • the SMF network element mainly performs functions such as session management, execution of control policies issued by PCF, UPF selection, and UE IP address allocation.
  • the UPF network element as the interface UPF with the data network, implements functions such as user plane data forwarding, session/flow-level accounting statistics, and bandwidth limitation.
  • the UDM network element is mainly responsible for the management of contract data, user access authorization and other functions.
  • UDR is mainly responsible for the access function of contract data, policy data, application data and other types of data.
  • the NEF network element is mainly used to support the opening of capabilities and events.
  • the AF network element mainly conveys the requirements of the application side to the network side, such as QoS requirements or subscription of user status events.
  • the AF may be a third-party functional entity or an application service deployed by an operator, such as an IP Multimedia Subsystem (IP Multimedia Subsystem, IMS) voice call service.
  • IP Multimedia Subsystem IP Multimedia Subsystem, IMS
  • the PCF network element is mainly responsible for policy control functions such as charging for sessions and service flow levels, QoS bandwidth guarantee and mobility management, and UE policy decision-making.
  • the NRF network element can be used to provide the network element discovery function, and provide network element information corresponding to the network element type based on the request of other network elements.
  • NRF also provides network element management services, such as network element registration, update, de-registration, and network element status subscription and push.
  • AUSF network element It is mainly responsible for authenticating users to determine whether to allow users or devices to access the network.
  • a DN is a network outside the operator's network.
  • the operator's network can access multiple DNs, and multiple services can be deployed on the DNs, which can provide data and/or voice services for terminal devices.
  • DN is the private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminal devices, and the control server of the sensor is deployed in the DN, and the control server can provide services for the sensor.
  • the sensor can communicate with the control server, obtain the instruction of the control server, and transmit the collected sensor data to the control server according to the instruction.
  • the DN is an internal office network of a company.
  • the mobile phones or computers of employees of the company can be terminal devices, and the mobile phones or computers of employees can access information and data resources on the internal office network of the company.
  • Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • interface serial numbers refer to the meanings defined in the 3GPP standard protocol, which is not limited here.
  • FIG. 2(b) is a schematic diagram of a 5G network architecture based on a point-to-point interface.
  • the network element or entity corresponding to the policy control network element in FIG. 1 may be the PCF network element in the 5G network architecture shown in FIG. 2(b), and the network element or entity corresponding to the user plane network element in FIG. 1 may be is the UPF network element in the 5G network architecture shown in Figure 2(b).
  • the network element or entity corresponding to the session management network element in FIG. 1 may be the SMF network element in the 5G network architecture shown in FIG. 2(b).
  • FIG. 2( b ) For the introduction of the functions of the network elements in FIG. 2( b ), reference may be made to the introduction of the functions of the corresponding network elements in FIG. 2( a ), and details are not repeated here.
  • the main difference between Fig. 2(b) and Fig. 2(a) is that the interface between each network element in Fig. 2(b) is a point-to-point interface, not a service-oriented interface.
  • N7 the interface between the PCF and the SMF, used to issue a protocol data unit (protocol data unit, PDU) session granularity and a business data flow granularity control policy.
  • protocol data unit protocol data unit
  • N15 the interface between the PCF and the AMF, used for delivering UE policies and access control related policies.
  • N5 the interface between the AF and the PCF, used for application service request delivery and network event reporting.
  • N4 The interface between the SMF and the UPF, used to transmit information between the control plane and the user plane, including controlling the distribution of forwarding rules for the user plane, QoS control rules, traffic statistics rules, etc., and information on the user plane report.
  • N11 the interface between the SMF and the AMF, used to transfer the PDU session tunnel information between the RAN and the UPF, the control message sent to the UE, the radio resource control information sent to the RAN, and the like.
  • N2 the interface between the AMF and the RAN, used to transmit radio bearer control information from the core network side to the RAN, etc.
  • N1 the interface between the AMF and the UE, irrespective of access, used to deliver QoS control rules and the like to the UE.
  • N8 the interface between the AMF and the UDM, used for the AMF to obtain the access and mobility management related contract data and authentication data from the UDM, and the AMF to register the UE current mobility management related information to the UDM, etc.
  • N10 the interface between the SMF and the UDM, for the SMF to obtain the session management related subscription data from the UDM, and the SMF to register the UE's current session related information to the UDM.
  • N35 an interface between the UDM and the UDR, used for the UDM to obtain user subscription data information from the UDR.
  • N36 an interface between the PCF and the UDR, for the PCF to obtain the policy-related subscription data and application data-related information from the UDR.
  • N12 the interface between AMF and AUSF, used for AMF to initiate an authentication process to AUSF, which can carry SUCI as a contract identifier;
  • N13 the interface between the UDM and the AUSF, for the AUSF to obtain the user authentication vector from the UDM to execute the authentication process.
  • network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • a platform eg, a cloud platform
  • the foregoing network element or function may be implemented by one device, or may be implemented jointly by multiple devices, or may be a functional module in one device, which is not specifically limited in this embodiment of the present application.
  • Session management network elements, policy control network elements, user plane network elements, access network equipment, and application function network elements in this application may be SMF, PCF, UPF, RAN and AF may also be network elements having the functions of the above-mentioned SMF, PCF, UPF, RAN, and AF in future communication such as a 6th generation (6th generation, 6G) network, which is not limited in this application.
  • 6G 6th generation
  • the present application uses the SMF, PCF, UPF, RAN, and AF as examples for the above-mentioned SMF, PCF, UPF, RAN, and AF, respectively.
  • the SMF determines to establish a QoS flow according to the local policy or the Policy and Charging Control (PCC) rule sent by the PCF, and the PCC rule contains the service data flow template ( Service data flow template, SDF template).
  • PCC rules and SDF templates are in a one-to-one correspondence.
  • a set of information enabling the detection of a service data flow and providing parameters for policy control and/or charging control and/or other control or support information).
  • SDF is a set of packet flows carried through the UPF that matches a service data flow template (An aggregate set of packet flows carried through the UPF that matches a service data flow template).
  • the SDF template contains a set of SDF filters (Service data flow filter, SDF filter) or application ID (Application ID) in PCC rules, and the application ID can be indexed to an application detection filter in SMF or UPF.
  • SDF templates are used to define an SDF (The set of service data flow filters in a PCC Rule or an application identifier in a PCC rule referring to an application detection filter in the SMF or in the UPF, required for defining a service data flow ).
  • the SDF filter is a set of packet flow header parameter values/ranges used to identify one or more packet flows in the UPF (A set of packet flow header parameter values/ranges used to identify one or more of the packet flows in the UPF).
  • the SDF filter contains, but is not limited to, one or more of the following information:
  • Source IP address or source IP address prefix (source IP address or IPv6 prefix);
  • IP layer The upper layer protocol number of the IP layer (Protocol ID of the protocol above IP);
  • IPv6 Flow Label
  • An application ID is an ID that indexes into a specific application detection filter. If the SDF template contains an application identifier, one or more pieces of information contained in the above-mentioned SDF filter can be indexed according to the application identifier.
  • Packet Flow Description may also be referred to as PFD information.
  • PFD Packet Flow Description
  • PFD is able to detect a set of information about application traffic provided by third-party service providers.
  • PFD can be used to generate application detection filters.
  • the PFD contains the following information:
  • the triplet includes a protocol, a server-side Internet Protocol (Internet Protocol, IP) address and a port number, and a valid part of the URL to be matched can be, for example, a host name.
  • IP Internet Protocol
  • SMF sends SDF information to UPF
  • SDF information includes QoS control information
  • QoS configuration file of QoS flow is sent to RAN through AMF
  • QoS rules are sent to terminal equipment through AMF and RAN
  • QoS rules include QoS control information.
  • a QoS flow is established between the terminal device, the RAN, and the UPF, and the RAN establishes the data radio bearer (DRB) of the air interface according to the QoS configuration file, and stores the binding relationship between the QoS flow and the DRB.
  • DRB data radio bearer
  • the UPF In the downlink direction, when the UPF receives the downlink data packet, it performs QoS control according to the SDF information sent by the SMF. For example, the QoS flow identity (QFI) is carried in the header of the downlink data packet, and then the UPF sends the downlink data to the RAN. Bag. After receiving the downlink data packet, the RAN places the downlink data packet on the corresponding DRB and transmits it to the terminal device according to the QFI in the header of the downlink data packet and the binding relationship between the QoS flow and the DRB.
  • QFI QoS flow identity
  • the terminal equipment determines to send upstream data packets, determines the QoS flow according to the QoS rules, and carries the QFI of the QoS flow in the header of the upstream data packet, and then places the upstream data packets according to the binding relationship between the QoS flow and the DRB. It is transmitted to the RAN on the corresponding DRB.
  • the RAN receives the uplink data packet, obtains the QFI in the packet header of the uplink data packet, and then adds the QFI to the packet header of the data packet between the RAN and the UPF. After receiving the uplink data packet sent by the RAN, the UPF verifies whether the uplink data packet is transmitted using the correct QoS flow.
  • IPSec implements security protection at the IP layer, providing protection for the transmission of sensitive data in insecure network environments.
  • the two communicating parties perform encryption and data source authentication at the IP layer to ensure the confidentiality, data consistency, data source authentication and anti-replay of data packets during network transmission. That is, IPSec can provide the following security services:
  • Integrity protection to ensure that data is not tampered with during transmission
  • Replay protection refuse to receive old or duplicate messages.
  • the IPSec protocol system includes two security processing protocols and a key exchange (Internet Key Exchange, IKE) protocol.
  • the security processing protocol includes the AH protocol and the ESP protocol.
  • the AH protocol provides functions such as data source authentication, data integrity verification, and anti-replay attack, but does not support data encryption.
  • the ESP protocol provides functions such as data source authentication, data integrity verification, anti-replay attack, and data encryption.
  • AH and ESP can be used individually or nested. These combinations can be used between two hosts, two security gateways (such as firewalls and routers), or between a host and a security gateway.
  • the IKE protocol is responsible for key management, and defines the methods for performing identity authentication, negotiating encryption algorithms and generating shared session keys between communicating entities. The IKE protocol retains the result of the key negotiation for future use by the AH protocol and the ESP protocol.
  • IPsec SA is an agreement on parameters of the tunnel between the communicating parties to establish an IPSec tunnel, including the IP addresses at both ends of the tunnel, the authentication method used in the tunnel, the authentication algorithm, the authentication key, the encryption algorithm, the shared key, and a series of parameters such as the life cycle.
  • SA is an agreement established by two communication entities through negotiation. It creates a one-way logical connection for security purposes. All data flows passing through the same SA will receive the same security service, which determines the security of data packets.
  • SA is the foundation of IPSec. SAs are unidirectional (inbound and outbound) and "protocol-dependent", one SA corresponds to one AH, or one ESP.
  • SA is a one-way logical connection. Therefore, for two-way communication between two IPSec peer communication entities, at least two SAs need to be established to protect the data flow in two directions respectively.
  • An SA can be uniquely identified by a triple, which includes a security parameter index (Security Parameter Index, SPI), a destination IP address, and a security protocol number (AH protocol or ESP protocol).
  • SPI Security Parameter Index
  • AH protocol or ESP protocol security protocol number
  • SPI is a 32-bit value generated to uniquely identify SA, which is transmitted in the AH or ESP header.
  • Different SAs correspond to different SPIs.
  • the IPSec encapsulation modes for data packets mainly include:
  • Transmission mode no new IP header is generated, the AH or ESP header is inserted after the IP header of the original packet but before all transport layer protocols, usually used between host and host (data transfer point equals encryption point) IPSec scenarios.
  • FIG. 3 taking the upper layer protocol of IP as TCP as an example, it is a schematic diagram of the data packet format in the transmission mode.
  • the original IP data packet includes the original IP header (including the destination IP address, the source IP address), the Transmission Control Protocol (Transmission Control Protocol, TCP) (including the port number) and data.
  • the Transmission Control Protocol Transmission Control Protocol, TCP
  • the IP packet based on the AH protocol adds AH after the original IP header of the original IP packet and before TCP. And TCP and data are encrypted and invisible to the outside world.
  • the IP packet based on the ESP protocol is to add the ESP header before the original IP packet after the original IP header of the original IP packet, and add the ESP trailer and ESP verification after the data. And the TCP, data and ESP tails are encrypted and invisible to the outside world.
  • Tunnel mode The AH or ESP header is inserted before the original IP header, and a new IP header is generated and placed before the AH or ESP header, which is usually used in the scenario of communication between the private network and the private network through the public network.
  • FIG. 4 taking the upper layer protocol of IP as TCP as an example, it is a schematic diagram of the data packet format in the tunnel mode.
  • the original IP data packet includes the original IP header (including destination IP address, source IP address), TCP (including port number) and data.
  • the IP packet based on the AH protocol is to add AH and a new IP header before the original IP header of the original IP packet. And the original IP header, TCP and data are encrypted and invisible to the outside world.
  • the IP packet based on ESP protocol is to add ESP header and new IP header before the original IP header of the original IP packet, and add ESP tail and ESP verification after the data. And the original IP header, TCP, data and ESP trailer are encrypted and invisible to the outside world.
  • the terminal device or the security gateway will use the AH protocol or the ESP protocol to encrypt the data stream on the user plane, and the core network cannot identify it. port number and other information, so the data flow on the user plane cannot be identified, and QoS control cannot be performed.
  • the core network cannot obtain information such as the port number in the identification TCP, but can only obtain the source IP address and destination IP address in the original IP header. .
  • the core network cannot obtain the source IP address, destination IP address, port number in TCP and other information in the original IP header.
  • the service data flow identification information may be a security parameter index (SPI) or a service data flow index (SDF index).
  • SPI security parameter index
  • SDF index service data flow index
  • a service data flow index is used to identify an SDF template or to identify a service description information.
  • the service data flow identification information and the service data flow description information (such as an SDF template), that is, the corresponding service data flow description information (such as an SDF template) can be determined through the service data flow identification information.
  • both the terminal device and the security gateway can insert the SPI into the data packet. For example, add an IPsec protocol header (such as AH or ESP header) to the data packet, so that the core network element (such as UPF, etc.) can identify the SPI in the data packet, and determine the corresponding QoS flow (identified by QFI) according to the SPI, and then QoS control can be performed on the packet according to the QoS flow.
  • IPsec protocol header such as AH or ESP header
  • SPI and SA are in one-to-one correspondence, that is, an SA has only one SPI .
  • both the terminal device and the security gateway can insert the service data flow index into the data packet, for example, into the IPsec protocol.
  • the core network element such as UPF, etc.
  • the core network element can identify the service data flow index in the data packet, and the corresponding service data flow according to the service data flow index Descriptive information (or SDF template), determine the corresponding QoS flow, and then perform QoS control on the data packet according to the QoS flow.
  • Descriptive information or SDF template
  • the present application provides a communication method.
  • the method includes the following steps:
  • Step 501a the AF sends an authorization request to the PCF. Accordingly, the PCF can receive the authorization request.
  • the authorization request includes service description information, and the service description information includes service data flow filters or application identifiers.
  • Step 502a the PCF generates service data flow description information according to the service description information.
  • the business data flow description information includes the business data flow filter or application identifier.
  • the service data flow description information may be, for example, an SDF template, and the SDF template includes a service data flow filter or an application identifier.
  • steps 501a to 502a are optional steps.
  • Step 503a the PCF sends a request message to the security gateway.
  • the security gateway can receive the request message.
  • the request message includes service data flow description information, and the request message is used to request to obtain service data flow identification information corresponding to the service data flow description information, and the service data flow identification information is SPI or service data flow index.
  • the request message is used to request the security gateway to generate a service data flow identification information according to the service data flow description information, and the service data flow identification information may be an SPI or a service data flow index.
  • the PCF determines that the service data flow description information cannot be combined with other service data flow description information into the same PCC rule, or determines that the binding parameters of the PCC rule corresponding to the service data flow description information and other service data flow descriptions If the binding parameters of the PCC rules corresponding to the information (for example, the binding parameters defined in Section 6.1.3.2.4 of 3GPP Standard Protocol 23.503) are different, the above request message is sent to the security gateway. That is, when the PCF determines that the service data flow identification information corresponding to other service data flow description information cannot be used, the PCF sends the above request message to the security gateway to request a new service data flow identification information.
  • the binding parameters of the PCC rules corresponding to the information for example, the binding parameters defined in Section 6.1.3.2.4 of 3GPP Standard Protocol 23.503
  • Step 504a the security gateway generates service data flow identification information according to the service data flow description information.
  • Step 505a the security gateway sends service data flow identification information to the PCF.
  • the PCF can receive the identification information of the service data flow.
  • the service data flow identification information in the foregoing step 505a is the upstream SPI. If the request message in the above step 503a is used to request the downlink SPI corresponding to the service data stream description information, the service data stream identification information in the above step 505a is the downlink SPI. If the request message in the above step 503a is used to request the uplink SPI and the downlink SPI corresponding to the service data flow description information, the service data flow identification information in the above step 505a is the uplink SPI and the downlink SPI.
  • the service data flow identification information in the above step 505a is the upstream service data flow index. If the request message in the above step 503a is used to request the downlink service data flow index corresponding to the service data flow description information, the service data flow identification information in the above step 505a is the downlink service data flow index. If the request message in the above step 503a is used to request the upstream service data flow index and the downlink service data flow index corresponding to the service data flow description information, then the service data flow identification information in the above step 505a is the upstream service data flow index and the downlink service data flow index. index.
  • Step 506a the PCF generates a PCC rule according to the service data flow identification information.
  • the PCC rule generated by the PCF carries the service data flow identification information, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the PCF may send the above PCC rules to the SMF, and the SMF generates a PDR according to the PCC rules, where the PDR includes service data flow identification information and QFI, and then the SMF sends the PDR to the UPF.
  • UPF identifies data packets of service data flows according to triples (source IP address, destination IP address, and port number). Encryption is performed, so UPF cannot obtain some or all of the information in the triplet, so it cannot identify the service data flow based on the triplet, and thus cannot perform QoS control.
  • the UPF can identify the data packet of the service data flow through the service data flow identification information, that is, identify the data packet carrying the service data flow identification information, and then based on the correspondence between the service data flow identification information in the PDR and the QFI The QFI corresponding to the service data flow identification information in the data packet is determined, so that QoS control is performed on the data flow according to the QoS flow indicated by the QFI. That is, in the embodiment of the present application, the UPF no longer identifies the service data flow through triples, but identifies the service data flow through the service data flow identification information, and determines the corresponding relationship between the configured service data flow identification information and the QFI. The QFI that performs QoS control, in turn, performs QoS control.
  • step 507a may also be included.
  • Step 507a the security gateway sends the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the terminal device can add the service data flow identification information to the upstream data packet of the service data flow corresponding to the service data flow description information, and send the upstream data packet, so as to facilitate the core network elements (such as UPF, etc.)
  • the upstream data packet can be identified by the service data flow identification information in the upstream data packet.
  • the security gateway may identify the received service data flow according to the service data flow description information, and then add the service data flow identification information corresponding to the service data flow description information to the downlink data of the service data flow based on the above correspondence packet, and send the downlink data packet, so that the core network element (such as UPF, etc.) can identify the downlink data packet through the service data flow identification information in the downlink data packet.
  • the core network element such as UPF, etc.
  • the PCF can generate PCC rules according to the service data flow identification information, so that core network elements such as UPF can identify the service data flow according to the information.
  • core network elements such as UPF can identify the service data flow according to the information.
  • a data packet corresponding to the service data flow description information is identified, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the present application provides yet another communication method.
  • the method includes the following steps:
  • Step 501b the AF sends an authorization request to the PCF. Accordingly, the PCF can receive the authorization request.
  • the authorization request includes service description information, and the service description information includes service data flow filters or application identifiers.
  • Step 502b the PCF generates service data flow description information according to the service description information.
  • the business data flow description information includes the business data flow filter or application identifier.
  • the service data flow description information may be, for example, an SDF template, and the SDF template includes a service data flow filter or an application identifier.
  • steps 501b to 502b are optional steps.
  • Step 503b the PCF sends a request message to the security gateway.
  • the security gateway can receive the request message.
  • the request message contains business data flow description information and business data flow identification information.
  • the request message is used to request the establishment of a corresponding relationship between business data flow description information and business data flow identification information.
  • the business data flow identification information is SPI or business data flow index. .
  • the PCF determines that the service data flow description information can be combined with other service data flow description information into the same PCC rule, or determines the binding parameters of the PCC rule corresponding to the service data flow description information and other service data flow description information. If the binding parameters of the corresponding PCC rules (for example, the binding parameters defined in Section 6.1.3.2.4 of 3GPP Standard Protocol 23.503) are the same, the above request message is sent to the security gateway. That is, when the PCF determines that the service data flow identification information corresponding to other service data flow description information can be used, the PCF sends the above request message to the security gateway to request to use the existing service data flow identification information.
  • the binding parameters of the corresponding PCC rules for example, the binding parameters defined in Section 6.1.3.2.4 of 3GPP Standard Protocol 23.503
  • Step 504b the security gateway saves the correspondence between the service data flow description information and the service data flow identification information.
  • Step 505b the security gateway sends a response message to the PCF. Accordingly, the PCF can receive the response message.
  • the response message is used to indicate that the correspondence between the service data flow description information and the service data flow identification information has been established.
  • the request message in the above step 503b may include an upstream SPI, or a downstream SPI, or an upstream SPI and a downstream SPI.
  • the request message in the above step 503b may contain the upstream service data flow index I, or the downstream service data flow index, or the upstream service data flow index and the downstream service data flow index.
  • Step 506b the PCF generates a PCC rule according to the service data flow identification information.
  • the PCC rule generated by the PCF carries the service data flow identification information, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the PCF may send the above PCC rules to the SMF, and the SMF generates a PDR according to the PCC rules, where the PDR includes service data flow identification information and QFI, and then the SMF sends the PDR to the UPF.
  • UPF identifies data packets of service data flows according to triples (source IP address, destination IP address, and port number). Encryption is performed, so UPF cannot obtain some or all of the information in the triplet, so it cannot identify the service data flow based on the triplet, and thus cannot perform QoS control.
  • the UPF can identify the data packet of the service data flow through the service data flow identification information, that is, identify the data packet carrying the service data flow identification information, and then based on the correspondence between the service data flow identification information in the PDR and the QFI The QFI corresponding to the service data flow identification information in the data packet is determined, so that QoS control is performed on the data flow according to the QoS flow indicated by the QFI. That is, in the embodiment of the present application, the UPF no longer identifies the service data flow through triples, but identifies the service data flow through the service data flow identification information, and determines the corresponding relationship between the configured service data flow identification information and the QFI. The QFI that performs QoS control, in turn, performs QoS control.
  • step 507b may also be included.
  • Step 507b the security gateway sends the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the terminal device can add the service data flow identification information to the upstream data packet of the service data flow corresponding to the service data flow description information, and send the upstream data packet, so as to facilitate the core network elements (such as UPF, etc.)
  • the upstream data packet can be identified by the service data flow identification information in the upstream data packet.
  • the security gateway may identify the received service data flow according to the service data flow description information, and then add the service data flow identification information corresponding to the service data flow description information to the downlink data of the service data flow based on the above correspondence packet, and send the downlink data packet, so that the core network element (such as UPF, etc.) can identify the downlink data packet through the service data flow identification information in the downlink data packet.
  • the core network element such as UPF, etc.
  • the PCF can generate the PCC rule according to the service data flow identification information, so that the core network element such as the UPF can identify the service data flow according to the information.
  • the core network element such as the UPF can identify the service data flow according to the information.
  • a data packet corresponding to the service data flow description information is identified, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • the present application provides yet another communication method.
  • the method includes the following steps:
  • Step 501c the AF sends service information to the security gateway.
  • the security gateway can receive the service information.
  • the service information includes service description information and/or service requirement information, the service description information includes service data flow filters or application identifiers, and the service requirement information includes bandwidth, delay, and the like.
  • Step 502c the security gateway determines service data flow identification information according to the service information, and the service data flow identification information may be SPI or service data flow index.
  • the security gateway will use the service requirement information corresponding to the other service requirement information.
  • the data flow identification information is determined as the service data flow identification information corresponding to the service information.
  • the service information in the above step 501c carries the service requirement information 1
  • the security gateway receives the service requirement information 2 from the AF before the above step 501c, and generates the service data flow identification information 1 for the service requirement information 2, then this step In 502c, the security gateway determines the service data flow identification information 1 as the service data flow identification information corresponding to the service information, that is, the service requirement information 1 and the service requirement information 2 correspond to the same service data flow identification information.
  • the PCF determines that the received service requirement information is different from other received service requirement information, or the received service requirement information is the same as other received service requirement information but the other service requirement information does not correspond to service data flow identification information, the security gateway regenerates a service data flow identification information for the service requirement information.
  • Step 503c the security gateway sends the service data flow identification information to the PCF.
  • the PCF can receive the identification information of the service data flow.
  • the identification information of the service data flow in this step 502c may be an upstream SPI, or may be a downstream SPI, or may also be an upstream SPI and a downstream SPI.
  • the service data flow identification information in step 502c may be an upstream service data flow index, or may be a downstream service data flow index, or may also be an upstream service data flow index and a downstream service data flow index.
  • the security gateway also sends the correspondence between the service data flow identification information and the service requirement information to the PCF.
  • Step 504c the PCF generates a PCC rule according to the service data flow identification information.
  • the PCC rule generated by the PCF carries the service data flow identification information, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the PCF may send the above PCC rules to the SMF, and the SMF generates a PDR according to the PCC rules, where the PDR includes service data flow identification information and QFI, and then the SMF sends the PDR to the UPF.
  • UPF identifies data packets of service data flows according to triples (source IP address, destination IP address, and port number). Encryption is performed, so UPF cannot obtain some or all of the information in the triplet, so it cannot identify the service data flow based on the triplet, and thus cannot perform QoS control.
  • the UPF can identify the data packet of the service data flow through the service data flow identification information, that is, identify the data packet carrying the service data flow identification information, and then based on the correspondence between the service data flow identification information in the PDR and the QFI The QFI corresponding to the service data flow identification information in the data packet is determined, so that QoS control is performed on the data flow according to the QoS flow indicated by the QFI. That is, in the embodiment of the present application, the UPF no longer identifies the service data flow through triples, but identifies the service data flow through the service data flow identification information, and determines the corresponding relationship between the configured service data flow identification information and the QFI. The QFI that performs QoS control, in turn, performs QoS control.
  • step 505c may also be included.
  • Step 505c the security gateway sends the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the terminal device can add the service data flow identification information to the upstream data packet of the service data flow corresponding to the service data flow description information, and send the upstream data packet, so as to facilitate the core network elements (such as UPF, etc.)
  • the upstream data packet can be identified by the service data flow identification information in the upstream data packet.
  • the security gateway may identify the received service data flow according to the service data flow description information, and then add the service data flow identification information corresponding to the service data flow description information to the downlink data of the service data flow based on the above correspondence packet, and send the downlink data packet, so that the core network element (such as UPF, etc.) can identify the downlink data packet through the service data flow identification information in the downlink data packet.
  • the core network element such as UPF, etc.
  • the PCF can generate PCC rules according to the service data flow identification information, so that core network elements such as UPF can identify the service data flow according to the information.
  • core network elements such as UPF can identify the service data flow according to the information.
  • a data packet corresponding to the service data flow description information is identified, and then QoS flow control is performed according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • FIG. 5( a ) to FIG. 5( c ) will be described below with reference to the specific embodiment shown in FIG. 6 or FIG. 7 . It should be noted that, in the following embodiments, description is made by taking the service data flow description information as an SDF template as an example.
  • FIG. 6 another communication method is provided in this embodiment of the present application.
  • the method includes the following steps:
  • step 601 the terminal device initiates a PDU session establishment process, and a policy association is established between the SMF and the PCF.
  • Step 602 the AF sends an authorization request to the PCF. Accordingly, the PCF can receive the authorization request.
  • the authorization request includes service information, and the service information includes service description information (eg, SDF filter or application identifier).
  • service information further includes service requirement information (such as bandwidth, delay, etc.).
  • the definitions of the SDF filter and the application identifier may refer to the foregoing description.
  • Step 603 the PCF sends a request message to the security gateway. Accordingly, the security gateway can receive the request message.
  • the request message contains the SDF template and the service data flow identification information, and the request message is used to request the establishment of the SDF template and the service data flow identification information.
  • the corresponding relationship of the data stream identification information For example, when multiple SDF templates (or services corresponding to SDF templates) can be merged into the same PCC rule, that is, when the PCC rules corresponding to these SDF templates are the same, or the PCF judges that only the PCC rules need to be updated without generating new ones.
  • the PCC rule when the PCC rule is specified, after the PCF requests the security gateway to allocate service data flow identification information for the first SDF template, other subsequent SDF templates can reuse the service data flow identification information, that is, these SDF templates are bound to the same A service data flow identification information.
  • the first parameter here can be the 5G QoS identifier (5G QoS Identifier, 5QI), one or more of Allocation and Retention Priority (ARP), and QoS Notification Control (QNC).
  • the first parameter may also be a parameter or parameter set for QoS Flow binding, such as a binding parameter defined in Section 6.1.3.2.4 of 3GPP Standard Protocol 23.503.
  • the request message includes an SDF template, and the request message is used to request to obtain service data flow identification information corresponding to the SDF template.
  • This SDF template contains the above SDF filter or application identifier. For example, if the PCF determines that the above SDF template cannot be merged with other SDF templates into the same PCC rule, or that the binding parameters of the PCC rules corresponding to the above SDF templates are different from those of the PCC rules corresponding to other SDF templates, the security The gateway requests the allocation of new traffic flow identification information.
  • Step 604 the security gateway sends a response message to the PCF. Accordingly, the PCF can receive the response message.
  • the security gateway allocates a service data flow identification information to the SDF template, and the response message includes the service data flow identification information.
  • the security gateway locally saves the corresponding relationship between the SDF template and the service data flow identification information, and the response message is used to indicate that the SDF template and the service data flow have been successfully established or saved. Correspondence of identification information.
  • the response message further includes the direction of the identification information of the service data flow, such as an uplink direction or a downlink direction.
  • Step 605 the security gateway uses the service data flow identification information to establish or modify a security association (SA) between the security gateway and the terminal device for the corresponding service flow.
  • SA security association
  • the security gateway sends the corresponding relationship between the service data flow identification information and the SDF template to the terminal device.
  • the SDF template sent by the security gateway to the terminal device may also have other names in the standard, for example, it may be called a Packet Filter Set or other names.
  • the security gateway needs to establish or modify the SA in the upstream direction; when the SDF profile has the downstream direction, the security gateway needs to establish or modify the SA in the downstream direction; when the SDF profile has both upstream and downstream directions. In the forward direction, the security gateway needs to establish or modify the SAs in the upstream and downstream directions.
  • the security gateway may add service data stream identification information to the downlink data packet.
  • the terminal device may add service data flow identification information to the upstream data packet.
  • the process of adding the service data flow identification information to the downlink data packet by the security gateway is as follows:
  • the security gateway can obtain the corresponding PFD through the NEF (or a packet flow description function (Packet Flow Description Function, PFDF) network element). For example, the security gateway sends the application identifier to the NEF (or the PFDF network element), and the NEF (or the PFDF network element) feeds back the PFD corresponding to the application identifier to the security gateway.
  • NEF Packet Flow Description Function
  • PFDF Packet Flow Description Function
  • the security gateway can identify the data packets of the service data flow according to the PFD. Certainly, the security gateway may also identify the service data flow corresponding to the application identifier based on the preconfigured information.
  • the security gateway may add the service data flow identification information corresponding to the SDF template into the data packet of the identified service data flow.
  • the security gateway may also send the above-mentioned PFD to the terminal device, which is used for identification of the data packet.
  • Step 606 the PCF sends the PCC rule to the SMF. Accordingly, the SMF can receive the PCC rules.
  • the PCC rule includes service data flow identification information, and the service data flow identification information is used for network elements such as UPF to identify data packets.
  • PCC rules may also contain SDF templates.
  • the SMF After receiving the PCC rules, the SMF generates PDR and QoS rules according to the PCC rules.
  • the PDR contains the service data flow identification information and the QFI, so the corresponding relationship between the service data flow identification information and the QFI is established through the PDR, and the QoS flow indicated by the QFI includes the SDF corresponding to the PCC rule, or is understood as the PCC
  • the SDF corresponding to the rule belongs to the QoS flow indicated by the QFI.
  • Step 607 the SMF sends the PDR to the UPF. Accordingly, the UPF can receive the PDR.
  • the UPF After the UPF receives the PDR, it can perform QoS control according to the PDR. For example, after the UPF receives the data packet, it obtains the service data flow identification information in the data packet, and then determines the QFI according to the corresponding relationship between the service data flow identification information and the QFI, and then the network can use the QoS indicated by the QFI. The flow performs QoS control on the packet.
  • Step 608 the SMF sends the QoS rule to the terminal device. Accordingly, the terminal device can receive the QoS rules.
  • the terminal device When the terminal device needs to send an uplink data packet, it can first determine the SDF template corresponding to the uplink data packet, and then add a service to the uplink data packet according to the corresponding relationship between the SDF template and the service data flow identification information obtained in the above step 605 Data stream identification information. And, the terminal device also carries the QFI in the uplink data packet according to the corresponding relationship between the service data flow identification information and the QFI in the QoS rule. Then, according to the binding relationship between QoS flow and DRB, the uplink data packet is placed on the corresponding DRB and transmitted to the RAN. That is, the terminal device can perform QoS control.
  • the PCF can generate PCC rules according to the service data flow identification information, so that core network elements such as UPF can identify the services in the data packets according to the first. data flow identification information, and then perform QoS flow control according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • FIG. 7 another communication method is provided in this embodiment of the present application.
  • the method includes the following steps:
  • Step 701 the terminal device initiates a PDU session establishment process, and a policy association is established between the SMF and the PCF.
  • step 702 the AF sends service information to the security gateway, and accordingly, the security gateway can receive the service information.
  • the service information includes service description information (such as SDF filter or application identifier) and/or service requirement information (such as bandwidth, delay, etc.).
  • service description information such as SDF filter or application identifier
  • service requirement information such as bandwidth, delay, etc.
  • the security gateway may determine whether to allocate new service data flow identification information or reuse existing service data flow identification information based on the received service description information. For example, if a service description information already has corresponding service data flow identification information, when the same service description information is received, the service data flow identification information can be reused. For another example, if a service description information does not have corresponding service data flow identification information, when the service description information is received, new service data flow identification information is allocated. For another example, the security gateway can also determine whether to allocate new service data flow identification information or reuse existing service data flow identification information according to the service requirement information. For example, the service requirement information of multiple services is the same, and the same service data flow identification information can be used even if the service description information is different. That is, when receiving a request with the same service requirement information as the service to which the service data flow identification information has been allocated, the security gateway can reuse the originally allocated service data flow identification information.
  • the security gateway may allocate two service data flow identification information for a service, which are the upstream service data flow identification information and the downlink service data flow identification information respectively.
  • Step 703 the security gateway uses the service data flow identification information to establish or modify a security association (SA) between the security gateway and the terminal device for the corresponding service flow.
  • SA security association
  • the security gateway sends the corresponding relationship between the service data flow identification information and the service description information to the terminal device.
  • the security gateway needs to establish or modify the SA in the upstream direction; when the service description information has the downstream direction, the security gateway needs to establish or modify the SA in the downstream direction; when the service description information has the upstream direction at the same time. In the direction of the upstream and downstream directions, the security gateway needs to establish or modify the SAs in the upstream and downstream directions.
  • the security gateway may add service data stream identification information to the downlink data packet.
  • the terminal device may add service data flow identification information to the upstream data packet.
  • the process of adding the service data flow identification information to the downlink data packet by the security gateway is as follows:
  • the security gateway can obtain the corresponding PFD through the NEF (or PFDF network element). For example, the security gateway sends the application identifier to the NEF (or the PFDF network element), and the NEF (or the PFDF network element) feeds back the PFD corresponding to the application identifier to the security gateway.
  • NEF or PFDF network element
  • NEF may obtain the PFD corresponding to the application ID locally, or obtain the PFD corresponding to the application ID from the UDR).
  • the security gateway can identify the data packets of the service data flow according to the PFD. Certainly, the security gateway may also identify the service data flow corresponding to the application identifier based on the preconfigured information.
  • the security gateway may add the service data flow identification information corresponding to the SDF template into the data packet of the identified service data flow.
  • Step 704 the security gateway sends an authorization request to the PCF. Accordingly, the PCF can receive the authorization request.
  • the authorization request includes service data flow identification information and service requirement information (such as bandwidth, delay, etc.).
  • the authorization request may further include service description information (such as SDF filter or application identifier).
  • service description information such as SDF filter or application identifier
  • the authorization request further includes the direction of the identification information of the service data flow, such as an uplink direction or a downlink direction.
  • Steps 705 to 707 are the same as steps 606 to 608 in the embodiment of FIG. 6 .
  • the PCF can generate PCC rules according to the service data flow identification information, so that core network elements such as UPF can identify the services in the data packets according to the first. data flow identification information, and then perform QoS flow control according to the QoS flow indicated by the QFI corresponding to the service data flow identification information.
  • each network element in the above-mentioned implementation includes corresponding hardware structures and/or software modules for executing each function.
  • the present invention can be implemented in hardware or a combination of hardware and computer software in conjunction with the units and algorithm steps of each example described in the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.
  • the steps or operations corresponding to the policy control network elements can also be implemented by components (such as chips or circuits) configured in the policy control network elements, corresponding to the steps implemented by the security gateway.
  • the operation may also be implemented by a component (eg, a chip or a circuit) configured in the security gateway.
  • FIG. 8 it is a schematic diagram of a communication apparatus according to an embodiment of the present application.
  • the apparatus is used to implement the steps performed by the corresponding security gateways in the embodiments of FIG. 5(a) to FIG. 5(c) and FIG. 6 to FIG. 7.
  • the apparatus 800 includes a sending unit 810, A receiving unit 820 and a processing unit 830.
  • a receiving unit 820 configured to receive a request message from a policy control network element, where the request message includes service data flow description information, where the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request Acquire service data flow identification information corresponding to the service data flow description information, where the service data flow identification information is a security parameter index SPI or a service data flow index; a sending unit 810 is configured to send the policy control network element the The service data flow identification information corresponding to the service data flow description information, the service data flow identification information is used to generate a policy control charging PCC rule, and is used to identify a data packet carrying the service data flow identification information.
  • the sending unit 810 is further configured to send the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the processing unit 830 is configured to identify the received service data flow according to the service data flow description information; add the service data flow identification information to the data packet of the service data flow;
  • the sending unit 810 is further configured to send the data packets of the service data flow.
  • the sending unit 810 configured to send the service data flow identification information corresponding to the service data flow description information to the policy control network element, specifically includes: sending the service data flow identification information corresponding to the service data flow description information to the policy control network element.
  • the policy control network element sends the uplink SPI and/or the downlink SPI corresponding to the service data flow description information; or, for sending to the policy control network element the upstream service data flow index and/or the corresponding service data flow description information. Or downlink service data flow index.
  • the receiving unit 820 is configured to receive a request message from the policy control network element, where the request message includes service data flow description information and service data flow identification information, where the service data flow identification information is a security parameter index SPI or a service data flow index,
  • the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request to establish a corresponding relationship between the service data flow description information and the service data flow identification information;
  • the sending unit 810 is used for Sending a response message to the policy control network element, where the response message is used to indicate that a corresponding relationship between the service data flow description information and the service data flow identification information has been established, and the service data flow identification information is used to generate a policy Controlling the charging PCC rule, and identifying the data packet carrying the identification information of the service data flow.
  • the sending unit 810 is further configured to send the corresponding relationship between the service data flow identification information and the service data flow description information to the terminal device.
  • the processing unit 830 is configured to identify the received service data flow according to the service data flow template; add the service data flow identification information to the data packet of the service data flow;
  • the sending unit 810 is further configured to send the data packets of the service data flow.
  • the SPI includes an upstream SPI and/or a downstream SPI.
  • the service data flow index includes an uplink service data flow index and/or a downlink service data flow index.
  • the receiving unit 820 is configured to receive service information from the application function network element, where the service information includes service description information and/or service requirement information, and the service description information includes a service data stream filter or an application identifier; the processing unit 830 is configured to use determining the service data flow identification information according to the service information, where the service data flow identification information is a security parameter index SPI or a service data flow index; the sending unit 810 is configured to send the service data flow identification to the policy control network element information, the service data flow identification information is used to generate a policy control and charging PCC rule, and is used to identify a data packet carrying the service data flow identification information.
  • the service information includes service description information and/or service requirement information, and the service description information includes a service data stream filter or an application identifier
  • the processing unit 830 is configured to use determining the service data flow identification information according to the service information, where the service data flow identification information is a security parameter index SPI or a service data flow index
  • the sending unit 810 is configured to send the service data flow identification
  • the sending unit 810 is further configured to send the corresponding relationship between the service data flow identification information and the service description information to the terminal device.
  • the processing unit 830 is further configured to identify the received service data flow according to the service description information; and add the service data flow identification information to the data packets of the service data flow ;
  • the sending unit 810 is further configured to send the data packets of the service data flow.
  • the sending unit 810 configured to send the service data flow identification information to the policy control network element, specifically includes: sending the uplink SPI and/or downlink to the policy control network element SPI; or, used to send the upstream service data flow index and/or the downstream service data flow index to the policy control network element.
  • the service information includes at least the service requirement information; the processing unit 830 is configured to determine service data flow identification information according to the service information, and specifically includes: determining the service data flow identification information. If the service requirement information is the same as other service requirement information, and the other service requirement information corresponds to the service data flow identification information, it is determined that the service information corresponds to the service data flow identification information.
  • the service information includes at least the service requirement information; the processing unit 830 is configured to determine service data flow identification information according to the service information, and specifically includes: determining the service data flow identification information. If the service requirement information is different from other service requirement information, or the other service requirement information has no corresponding service data flow identification information, the service data flow identification information is generated for the service information.
  • the sending unit 810 is further configured to send the corresponding relationship between the service data flow identification information and the service requirement information to the policy control network element.
  • the above communication device 800 may further include a storage unit, which is used to store data or instructions (also referred to as codes or programs), and each of the above units may interact or be coupled with the storage unit to implement corresponding methods or Features.
  • the processing unit 830 may read data or instructions in the storage unit, so that the communication apparatus implements the methods in the above embodiments.
  • each unit in the above apparatus can be realized in the form of software calling through the processing element; also can all be realized in the form of hardware; some units can also be realized in the form of software calling through the processing element, and some units can be realized in the form of hardware.
  • each unit can be a separately established processing element, or can be integrated in a certain chip of the device to be implemented, and can also be stored in the memory in the form of a program, which can be called by a certain processing element of the device and execute the unit's processing.
  • each step of the above method or each of the above units may be implemented by an integrated logic circuit of hardware in the processor element or implemented in the form of software being invoked by the processing element.
  • a unit in any of the above apparatuses may be one or more integrated circuits configured to implement the above method, such as: one or more Application Specific Integrated Circuits (ASICs), or, one or more Multiple microprocessors (digital singnal processors, DSP), or, one or more field programmable gate arrays (Field Programmable Gate Array, FPGA), or a combination of at least two of these integrated circuit forms.
  • ASICs Application Specific Integrated Circuits
  • DSP digital singnal processors
  • FPGA Field Programmable Gate Array
  • FPGA Field Programmable Gate Array
  • a unit in the apparatus can be implemented in the form of a processing element scheduler
  • the processing element can be a general-purpose processor, such as a central processing unit (Central Processing Unit, CPU) or other processors that can invoke programs.
  • CPU central processing unit
  • these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • the above sending unit 810 is an interface circuit of the device, and is used to send signals to other devices.
  • the sending unit 810 is an interface circuit in the chip for sending signals to other chips.
  • the above receiving unit 820 is an interface circuit of the device for receiving signals from other devices.
  • the receiving unit 820 is an interface circuit in the chip for receiving signals from other chips.
  • FIG. 9 it is a schematic diagram of still another communication apparatus provided by an embodiment of the present application.
  • the apparatus is used to implement the steps performed by the corresponding policy control network element (or PCF) in the embodiments of FIGS. 5(a) to 5(c) and FIGS. 6 to 7.
  • the apparatus 900 includes a sending unit 910 , a receiving unit 920 and a processing unit 930 .
  • the sending unit 910 is configured to send a request message to the security gateway, where the request message includes service data flow description information, and the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request to obtain all the information.
  • the service data flow identification information corresponding to the service data flow description information, the service data flow identification information is a security parameter index SPI or a service data flow index;
  • the receiving unit 920 is configured to receive the service data flow description from the security gateway.
  • the processing unit 930 is configured to generate a policy control and charging PCC rule according to the service data flow identification information, and the service data flow identification information is used to identify the service data flow that carries the service data flow.
  • a packet of identification information is configured to send a request message to the security gateway, where the request message includes service data flow description information, and the service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request to obtain all the
  • the receiving unit 920 is further configured to receive an authorization request from an application function network element, where the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; the processing unit 930 is further configured to generate the service data flow description information according to the service description information.
  • the receiving unit 920 configured to receive the service data flow identification information corresponding to the service data flow description information from the security gateway, specifically includes: Receive the upstream SPI and/or the downstream SPI corresponding to the service data flow description information; or, for receiving the upstream service data flow index and/or the downstream service data flow index corresponding to the service data flow description information from the security gateway .
  • the processing unit 930 is further configured to determine that the service data flow description information cannot be combined with other service data flow description information into the same PCC rule, and then send the request to the security gateway or, if it is determined that the binding parameters of the PCC rule corresponding to the service data flow description information are different from the binding parameters of the PCC rules corresponding to other service data flow description information, the request message is sent to the security gateway.
  • the sending unit 910 is configured to send a request message to the security gateway, where the request message includes business data flow description information and business data flow identification information, the business data flow identification information is a security parameter index SPI or a business data flow index, the The service data flow description information includes a service data flow filter or an application identifier, and the request message is used to request to establish a corresponding relationship between the service data flow description information and the service data flow identification information; the receiving unit 920 is used to obtain the The security gateway receives a response message, the response message is used to indicate that the corresponding relationship between the service data flow description information and the service data flow identification information has been established; the processing unit 930 is configured to, according to the service data flow identification information, A policy control charging PCC rule is generated, and the service data flow identification information is used to identify a data packet carrying the service data flow identification information.
  • the receiving unit 920 is further configured to receive an authorization request from an application function network element, where the authorization request includes service description information, and the service description information includes the service data flow filter or the application identifier; the processing unit 930 is further configured to generate the service data flow description information according to the service description information.
  • the SPI includes an upstream SPI and/or a downstream SPI.
  • the service data flow index includes an uplink service data flow index and/or a downlink service data flow index.
  • the processing unit 930 is further configured to determine that the service data flow description information can be combined with other service data flow description information into the same PCC rule, and then determine to establish the service data flow identification The corresponding relationship between the information and the description information of the service data flow; or, if it is determined that the binding parameters of the PCC rules corresponding to the description information of the service data flow are the same as the binding parameters of the PCC rules corresponding to the description information of other service data flows, then it is determined that A corresponding relationship between the service data flow identification information and the service data flow description information is established.
  • a receiving unit 920 configured to receive service information and service data flow identification information corresponding to the service information from the security gateway, where the service information includes service description information and/or service requirement information, and the service description information includes service data flow filtering device or application identifier, the service data flow identification information is a security parameter index SPI or a service data flow index; the processing unit 930 is configured to generate a policy control charging PCC rule according to the service data flow identification information, the service data flow The identification information is used to identify the data packet carrying the identification information of the service data flow.
  • the receiving unit 920 configured to receive service information and service data flow identification information corresponding to the service information from a security gateway, specifically includes: being configured to receive the service from the security gateway The upstream SPI and/or the downstream SPI corresponding to the information and the service information; or, for receiving the service information and the upstream service data flow index and/or the downstream service data flow index corresponding to the service information from the security gateway .
  • the above-mentioned communication device 900 may further include a storage unit, which is used to store data or instructions (also referred to as codes or programs), and each of the above-mentioned units may interact or be coupled with the storage unit to implement corresponding methods or Features.
  • a storage unit which is used to store data or instructions (also referred to as codes or programs), and each of the above-mentioned units may interact or be coupled with the storage unit to implement corresponding methods or Features.
  • each unit in the above apparatus can be realized in the form of software calling through the processing element; also can all be realized in the form of hardware; some units can also be realized in the form of software calling through the processing element, and some units can be realized in the form of hardware.
  • each unit can be a separately established processing element, or can be integrated in a certain chip of the device to be implemented, and can also be stored in the memory in the form of a program, which can be called by a certain processing element of the device and execute the unit's processing.
  • each step of the above method or each of the above units may be implemented by an integrated logic circuit of hardware in the processor element or implemented in the form of software being invoked by the processing element.
  • a unit in any of the above apparatuses may be one or more integrated circuits configured to implement the above methods, eg, one or more specific integrated circuits (ASICs), or, one or more microprocessors (DSP), or, one or more Field Programmable Gate Arrays (FPGA), or a combination of at least two of these integrated circuit forms.
  • ASICs application-specific integrated circuits
  • DSP microprocessors
  • FPGA Field Programmable Gate Arrays
  • a unit in the apparatus can be implemented in the form of a processing element scheduler
  • the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processors that can invoke programs.
  • CPU central processing unit
  • these units can be integrated together and implemented in the form of a system-on-chip (SOC).
  • the above sending unit 910 is an interface circuit of the device, and is used to send signals to other devices.
  • the sending unit 910 is an interface circuit in the chip for sending signals to other chips.
  • the above receiving unit 920 is an interface circuit of the device for receiving signals from other devices.
  • the receiving unit 920 is an interface circuit in the chip for receiving signals from other chips.
  • FIG. 10 another schematic diagram of a communication apparatus provided in an embodiment of the present application is used to implement the operations of the security gateway or the policy control network element in the above embodiment.
  • the communication apparatus includes: a processor 1010 and an interface 1030 , and optionally, the communication apparatus further includes a memory 1020 .
  • the interface 1030 is used to implement communication with other devices.
  • the method performed by the first network element or the session management network element may be invoked by the processor 1010 to a program stored in a memory (which may be the security gateway, the memory 1020 in the policy control network element, or an external memory).
  • a memory which may be the security gateway, the memory 1020 in the policy control network element, or an external memory.
  • the apparatus for a security gateway or a policy control network element may include a processor 1010, and the processor 1010 executes the method for executing the security gateway or the policy control network element in the above method embodiments by invoking a program in the memory .
  • the processor here may be an integrated circuit with signal processing capability, such as a CPU.
  • the means for the first network element, or the session management network element may be implemented by one or more integrated circuits configured to implement the above method. For example: one or more ASICs, or, one or more microprocessor DSPs, or, one or more FPGAs, etc., or a combination of at least two of these integrated circuit forms. Alternatively, the above
  • the functions/implementation process of the sending unit 810, the receiving unit 820 and the processing unit 830 in FIG. 8 can be implemented by the processor 1010 in the communication apparatus 1000 shown in FIG. 10 calling the computer-executable instructions stored in the memory 1020 .
  • the function/implementation process of the processing unit 830 in FIG. 8 can be implemented by the processor 1010 in the communication apparatus 1000 shown in FIG. 10 calling the computer-executed instructions stored in the memory 1020, and the sending unit 810 and the receiving unit 810 in FIG.
  • the function/implementation process of the unit 820 may be implemented through the interface 1030 in the communication device 1000 shown in FIG. 10 .
  • the functions/implementation process of the sending unit 910 , the receiving unit 920 and the processing unit 930 in FIG. 9 can be implemented by the processor 1010 in the communication apparatus 1000 shown in FIG. 10 calling the computer-executable instructions stored in the memory 1020 .
  • the function/implementation process of the processing unit 930 in FIG. 9 may be implemented by the processor 1010 in the communication device 1000 shown in FIG. 10 calling the computer-executed instructions stored in the memory 1020, and the sending unit 910 and the receiving unit 910 in FIG.
  • the function/implementation process of the unit 920 may be implemented through the interface 1030 in the communication device 1000 shown in FIG. 10 .
  • At least one item (single, species) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.
  • “Plurality" means two or more, and other quantifiers are similar.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.
  • a general-purpose processor may be a microprocessor, or alternatively, the general-purpose processor may be any conventional processor, controller, microcontroller, or state machine.
  • a processor may also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors in combination with a digital signal processor core, or any other similar configuration. accomplish.
  • the steps of the method or algorithm described in the embodiments of this application may be directly embedded in hardware, a software unit executed by a processor, or a combination of the two.
  • Software units can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or this.
  • RAM Random Access Memory
  • ROM read-only memory
  • EPROM memory read-only memory
  • EEPROM memory electrically erasable programmable read-only memory
  • registers hard disk, removable disk, CD-ROM or this.
  • a storage medium may be coupled to the processor such that the processor may read information from, and store information in, the storage medium.
  • the storage medium can also be integrated into the processor.
  • the processor and storage medium may be provided in the ASIC.
  • the above-described functions described herein may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, the functions may be stored on, or transmitted over, a computer-readable medium in the form of one or more instructions or code.
  • Computer-readable media includes computer storage media and communication media that facilitate the transfer of a computer program from one place to another. Storage media can be any available media that a general-purpose or special-purpose computer can access.
  • Such computer-readable media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other device that can be used to carry or store instructions or data structures and Other media in the form of program code that can be read by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor.
  • any connection is properly defined as a computer-readable medium, for example, if software is transmitted from a website site, server or other remote source over a coaxial cable, fiber optic computer, twisted pair, digital subscriber line (DSL) Or transmitted by wireless means such as infrared, wireless, and microwave are also included in the definition of computer-readable media.
  • DSL digital subscriber line
  • the disks and magnetic disks include compressed disks, laser disks, optical disks, digital versatile disks (English: Digital Versatile Disc, DVD for short), floppy disks and Blu-ray disks. Discs usually use lasers to optically reproduce data. Combinations of the above can also be included in computer readable media.
  • the functions described in this application may be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供通信方法、装置及***。该方法包括：安全网关从策略控制网元接收请求消息，用于请求获取业务数据流描述信息对应的业务数据流识别信息；安全网关向策略控制网元发送业务数据流描述信息对应的业务数据流识别信息，业务数据流识别信息用于生成策略计费控制（PCC）规则，以及用于识别携带业务数据流识别信息的数据包。基于该方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的服务质量（QoS）流指标QFI所指示的QoS流，执行QoS流控制。

Description

通信方法、装置及***
相关申请的交叉引用
本申请要求在2020年06月29日提交中国专利局、申请号为202010607276.1、申请名称为“通信方法、装置及***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及通信方法、装置及***。
背景技术
为提升通信安全，目前提出终端设备到核心网的加密需求。其中，一种无需更改现有网络架构的方案是：在用户面网元和数据网络之间部署安全网关，终端设备与安全网关之间的通信实现因特网协议(internet protocol，IP)层的端到端(end to end，E2E)加密。其中，加密秘钥来源于终端设备与安全网关之间基于因特网协议安全(Internet Protocol Security，IPsec)协议的协商。
若终端设备与安全网关之间使用端到端的加密模式，则终端设备或安全网关会采用认证头(Authentication Header，AH)协议或封装安全载荷(Encapsulating Security Payload，ESP)协议对用户面数据流进行加密，核心网无法识别出端口号等信息，因而无法识别用户面数据流，进而无法执行服务质量(Quality of Service，QoS)控制。
发明内容
本申请提供通信方法、装置及***，用于实现对加密的用户面数据流执行QoS控制。
第一方面，本申请实施例提供一种通信方法，包括：安全网关从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
基于该方案，终端设备可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述安全网关根据所述业务数据流描述信息，识别接收的业务数据流；所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；所述安全网关发送所述业务数据流的数据包。
基于该方案，安全网关可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，包括：所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
第二方面，本申请实施例提供一种通信方法，包括：策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；所述策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述策略控制网元从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；所述策略控制网元根据所述业务描述信息，生成所述业务数据流描述信息。
作为一种实现方法，所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息，包括：所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
作为一种实现方法，所述策略控制网元确定所述业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，则向安全网关发送所述请求消息；或者，所述策略控制网元确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数不同，则向安全网关发送所述请求消息。
第三方面，本申请实施例提供一种通信方法，包括：安全网关从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；所述安全网关向所述策略控制网元发送响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系， 使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
基于该方案，终端设备可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述安全网关根据所述业务数据流模板，识别接收的业务数据流；所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；所述安全网关发送所述业务数据流的数据包。
基于该方案，安全网关可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述SPI包括上行SPI和/或下行SPI。
作为一种实现方法，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
第四方面，本申请实施例提供一种通信方法，包括：策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；所述策略控制网元从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；所述策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述策略控制网元从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；所述策略控制网元根据所述业务描述信息，生成所述业务数据流描述信息。
作为一种实现方法，所述SPI包括上行SPI和/或下行SPI。
作为一种实现方法，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
作为一种实现方法，所述策略控制网元确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，所述策略控制网元确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
第五方面，本申请实施例提供一种通信方法，包括：安全网关从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务 数据流过滤器或应用标识；所述安全网关根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；所述安全网关向策略控制网元发送所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务描述信息之间的对应关系。
基于该方案，终端设备可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述安全网关根据所述业务描述信息，识别接收的业务数据流；所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；所述安全网关发送所述业务数据流的数据包。
基于该方案，安全网关可以根据在与业务数据流描述信息对应的数据包中添加业务数据流识别信息，从而使得用户面网元可以基于业务数据流识别信息识别数据包。
作为一种实现方法，所述安全网关向策略控制网元发送所述业务数据流识别信息，包括：所述安全网关向所述策略控制网元发送上行SPI和/或下行SPI；或者，所述安全网关向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
作为一种实现方法，所述业务信息至少包含所述业务需求信息；所述安全网关根据所述业务信息，确定业务数据流识别信息，包括：所述安全网关确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
作为一种实现方法，所述业务信息至少包含所述业务需求信息；所述安全网关根据所述业务信息，确定业务数据流识别信息，包括：所述安全网关确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
作为一种实现方法，所述安全网关向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
第六方面，本申请实施例提供一种通信方法，包括：策略控制网元从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；所述策略控制网元根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得策略控制网元可以根据业务数据流识别信息生成PCC规则，从而核心网网元如用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
作为一种实现方法，所述策略控制网元从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，包括：所述策略控制网元从所述安全网关接收所述业务信息和所述业务信息对应的上行SPI和/或下行SPI；或者，所述策略控制网元从所述安全网关接收所述业务信息和所述业务信息对应的上行业务数据流索引和/或下行业务数据流索引。
第七方面，本申请实施例提供一种通信方法，包括：用户面网元从会话管理网元接收包检测规则PDR，所述PDR包含业务数据流识别信息和服务质量流标识QFI，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；所述用户面网元识别携带所述业务数据流识别信息的数据包；所述用户面网元根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
基于上述方案，用户面网元可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
第八方面，本申请实施例提供一种通信装置，该装置可以是安全网关，还可以是用于安全网关的芯片。该装置具有实现上述第一方面、第三方面、第五方面的各实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第九方面，本申请实施例提供一种通信装置，该装置可以是策略控制网元，还可以是用于策略控制网元的芯片。该装置具有实现上述第二方面、第四方面、第六方面的各实现方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第十方面，本申请实施例提供一种通信装置，该装置可以是用户面网元，还可以是用于用户面网元的芯片。该装置具有实现上述第七方面的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第十一方面，本申请实施例提供一种通信装置，包括处理器和存储器；该存储器用于存储计算机执行指令，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行如上述第一方面至第七方面的各实现方法。
第十二方面，本申请实施例提供一种通信装置，包括用于执行上述第一方面至第七方面的各实现方法的各个步骤的单元或手段(means)。
第十三方面，本申请实施例提供一种通信装置，包括处理器和接口电路，所述处理器用于通过接口电路与其它装置通信，并执行上述第一方面至第七方面的各实现方法。该处理器包括一个或多个。
第十四方面，本申请实施例提供一种通信装置，包括处理器，用于与存储器相连，用于调用所述存储器中存储的程序，以执行上述第一方面至第七方面的各实现方法。该存储器可以位于该装置之内，也可以位于该装置之外。且该处理器包括一个或多个。
第十五方面，本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得处理器执行上述第一方面至第七方面的各实现方法。
第十六方面，本申请实施例还提供一种计算机程序产品，该计算机产品包括计算机程序，当计算机程序运行时，使得上述第一方面至第七方面的各实现方法被执行。
第十七方面，本申请实施例还提供一种芯片***，包括：处理器，用于执行上述第一方面至第七方面的各实现方法。
第十八方面，本申请实施例还提供一种通信***，包括安全网关和策略控制网元；所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包；所述安全网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息。
第十九方面，本申请实施例还提供一种通信方法，包括：策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；安全网关从策略控制网元接收所述请求消息；安全网关向策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息；策略控制网元从安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
第二十方面，本申请实施例还提供一种通信***，包括安全网关和策略控制网元；所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包；所述安全网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述响应消息。
第二十一方面，本申请实施例还提供一种通信方法，包括：策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；安全网关从策略控制网元接收所述请求消息；安全网关向策略控制网元发送响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；策略控制网元从安全网关接收所述响应消息；策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
第二十二方面，本申请实施例还提供一种通信***，包括安全网关和策略控制网元；所述安全网关，用于从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/ 或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；向策略控制网元发送所述业务数据流识别信息和所述业务信息；所述策略控制网元，用于从所述安全网关接收所述业务信息对应的业务数据流识别信息和所述业务信息；根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
第二十三方面，本申请实施例还提供一种通信方法，包括：安全网关从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；安全网关根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；安全网关向策略控制网元发送所述业务数据流识别信息和所述业务信息；策略控制网元从安全网关接收所述业务信息对应的业务数据流识别信息和所述业务信息；根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
附图说明
图1为本申请实施例提供的一种通信***示意图；
图2(a)为基于服务化架构的5G网络架构示意图；
图2(b)为基于点对点接口的5G网络架构示意图；
图3为传输模式中的数据包格式示意图；
图4为隧道模式中的数据包格式示意图；
图5(a)为本申请实施例提供的一种通信方法示意图；
图5(b)为本申请实施例提供的又一种通信方法示意图；
图5(c)为本申请实施例提供的又一种通信方法示意图；
图6为本申请实施例提供的又一种通信方法示意图；
图7为本申请实施例提供的又一种通信方法示意图；
图8为本申请实施例提供的一种通信装置示意图；
图9为本申请实施例提供的又一种通信装置示意图；
图10为本申请实施例提供的又一种通信装置示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或***实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
为解决背景技术中提到的问题，如图1所示，本申请提供一种通信***，该***包括安全网关和策略控制网元。可选的，该***还包括会话管理网元和/或用户面网元。
在第一个实施例中：
所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息 用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。所述安全网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息。
在一种可能的实现方法中，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
在一种可能的实现方法中，所述安全网关，还用于根据所述业务数据流描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业务数据流的数据包。
在一种可能的实现方法中，所述安全网关，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：用于向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，用于向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述策略控制网元，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；根据所述业务描述信息，生成所述业务数据流描述信息。
在一种可能的实现方法中，所述策略控制网元，还用于确定所述业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，则向安全网关发送所述请求消息；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数不同，则向安全网关发送所述请求消息。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
在一种可能的实现方法中，所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
在第二个实施例中：
所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。所述安全 网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述响应消息。
在一种可能的实现方法中，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
在一种可能的实现方法中，所述安全网关，还用于根据所述业务数据流模板，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业务数据流的数据包。
在一种可能的实现方法中，所述SPI包括上行SPI和/或下行SPI。
在一种可能的实现方法中，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述策略控制网元，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；根据所述业务描述信息，生成所述业务数据流描述信息。
在一种可能的实现方法中，所述策略控制网元，还用于确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
在一种可能的实现方法中，所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
在第三个实施例中：
所述安全网关，用于从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；向策略控制网元发送所述业务数据流识别信息和所述业务信息。所述策略控制网元，用于从所述安全网关接收所述业务信息和所述业务数据流识别信息；根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务描述信息之间的对应关系。
在一种可能的实现方法中，所述安全网关，还用于根据所述业务描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业 务数据流的数据包。
在一种可能的实现方法中，所述安全网关，用于向策略控制网元发送所述业务数据流识别信息，具体包括：用于向所述策略控制网元发送上行SPI和/或下行SPI；或者，用于向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述业务信息至少包含所述业务需求信息；所述安全网关，用于根据所述业务信息，确定业务数据流识别信息，具体包括：用于确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
在一种可能的实现方法中，所述业务信息至少包含所述业务需求信息；所述安全网关，用于根据所述业务信息，确定业务数据流识别信息，具体包括：用于确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
在一种可能的实现方法中，所述安全网关，还用于向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
在一种可能的实现方法中，所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
在一种可能的实现方法中，所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
其中，上述方案的具体实现将在后续方法实施例部分详细阐述，在此不再赘述。
图1所示的***可以用在图2(a)或图2(b)所示的第五代(5th generation，5G)网络架构中，当然，也可以用在未来网络架构，比如第六代(6th generation，6G)网络架构等，本申请不做限定。
示例性的，假设图1所示的通信***应用于5G网络架构，如图2(a)所示，为基于服务化架构的5G网络架构示意图。图1中的策略控制网元所对应的网元或者实体可以为图2(a)所示的5G网络架构中的策略控制功能(Policy Control Function，PCF)网元，图1中的用户面网元所对应的网元或者实体可以为图2(a)所示的5G网络架构中的用户面功能(user plane function，UPF)网元。图1中的会话管理网元所对应的网元或者实体可以为图2(a)所示的5G网络架构中的会话管理功能(session management function，SMF)网元。
图2(a)所示的5G网络架构中可包括三部分，分别是终端设备部分、数据网络(data network，DN)和运营商网络部分。下面对其中的部分网元的功能进行简单介绍说明。
其中，运营商网络可包括以下网元中的一个或多个：鉴权服务器功能(Authentication Server Function，AUSF)网元、网络开放功能(network exposure function，NEF)网元、PCF网元、统一数据管理(unified data management，UDM)网元、统一数据库(Unified Data  Repository，UDR)、网络存储功能(Network Repository Function，NRF)网元、应用功能(Application Function，AF)网元、接入与移动性管理功能(Access and Mobility Management Function，AMF)网元、SMF网元、RAN以及UPF网元等。上述运营商网络中，除无线接入网部分之外的部分可以称为核心网络部分。
在具体实现中，本申请实施例中的终端设备，可以是用于实现无线通信功能的设备。其中，终端设备可以是5G网络或者未来演进的公共陆地移动网络(public land mobile network，PLMN)中的用户设备(user equipment，UE)、接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。接入终端可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备或可穿戴设备，虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。终端可以是移动的，也可以是固定的。
上述终端设备可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备还可通过运营商网络访问DN，使用DN上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为运营商网络和终端设备之外的服务方，可为终端设备提供其他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
RAN是运营商网络的子网络，是运营商网络中业务节点与终端设备之间的实施***。终端设备要接入运营商网络，首先是经过RAN，进而可通过RAN与运营商网络的业务节点连接。本申请中的RAN设备，是一种为终端设备提供无线通信功能的设备，RAN设备也称为接入网设备。本申请中的RAN设备包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
AMF网元，主要进行移动性管理、接入鉴权/授权等功能。此外，还负责在UE与PCF间传递用户策略。
SMF网元，主要进行会话管理、PCF下发的控制策略的执行、UPF的选择、UE IP地址分配等功能。
UPF网元，作为和数据网络的接口UPF，完成用户面数据转发、基于会话/流级的计费统计，带宽限制等功能。
UDM网元，主要负责管理签约数据、用户接入授权等功能。
UDR，主要负责签约数据、策略数据、应用数据等类型数据的存取功能。
NEF网元，主要用于支持能力和事件的开放。
AF网元，主要传递应用侧对网络侧的需求，例如，QoS需求或用户状态事件订阅等。 AF可以是第三方功能实体，也可以是运营商部署的应用服务，如IP多媒体子***(IP Multimedia Subsystem，IMS)语音呼叫业务。
PCF网元，主要负责针对会话、业务流级别进行计费、QoS带宽保障及移动性管理、UE策略决策等策略控制功能。
NRF网元，可用于提供网元发现功能，基于其他网元的请求，提供网元类型对应的网元信息。NRF还提供网元管理服务，如网元注册、更新、去注册以及网元状态订阅和推送等。
AUSF网元：主要负责对用户进行鉴权，以确定是否允许用户或设备接入网络。
DN，是位于运营商网络之外的网络，运营商网络可以接入多个DN，DN上可部署多种业务，可为终端设备提供数据和/或语音等服务。例如，DN是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备，DN中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，DN是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
图2(a)中Nausf、Nnef、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号。这些接口序列号的含义可参见3GPP标准协议中定义的含义，在此不做限制。
示例性的，假设图1所示的通信***应用于5G网络架构，如图2(b)所示，为基于点对点接口的5G网络架构示意图。图1中的策略控制网元所对应的网元或者实体可以为图2(b)所示的5G网络架构中的PCF网元，图1中的用户面网元所对应的网元或者实体可以为图2(b)所示的5G网络架构中的UPF网元。图1中的会话管理网元所对应的网元或者实体可以为图2(b)所示的5G网络架构中的SMF网元。
图2(b)中的网元的功能的介绍可以参考图2(a)中对应的网元的功能的介绍，不再赘述。图2(b)与图2(a)的主要区别在于：图2(b)中的各个网元之间的接口是点对点的接口，而不是服务化的接口。
在图2(b)所示的架构中，各个网元之间的接口名称及功能如下：
1)、N7：PCF与SMF之间的接口，用于下发协议数据单元(protocol data unit，PDU)会话粒度以及业务数据流粒度控制策略。
2)、N15：PCF与AMF之间的接口，用于下发UE策略及接入控制相关策略。
3)、N5：AF与PCF之间的接口，用于应用业务请求下发以及网络事件上报。
4)、N4：SMF与UPF之间的接口，用于控制面与用户面之间传递信息，包括控制面向用户面的转发规则、QoS控制规则、流量统计规则等的下发以及用户面的信息上报。
5)、N11：SMF与AMF之间的接口，用于传递RAN和UPF之间的PDU会话隧道信息、传递发送给UE的控制消息、传递发送给RAN的无线资源控制信息等。
6)、N2：AMF与RAN之间的接口，用于传递核心网侧至RAN的无线承载控制信息等。
7)、N1：AMF与UE之间的接口，接入无关，用于向UE传递QoS控制规则等。
8)、N8：AMF与UDM间的接口，用于AMF向UDM获取接入与移动性管理相关签 约数据与鉴权数据，以及AMF向UDM注册UE当前移动性管理相关信息等。
9)、N10：SMF与UDM间的接口，用于SMF向UDM获取会话管理相关签约数据，以及SMF向UDM注册UE当前会话相关信息等。
10)、N35：UDM与UDR间的接口，用于UDM从UDR中获取用户签约数据信息。
11)、N36：PCF与UDR间的接口，用于PCF从UDR中获取策略相关签约数据以及应用数据相关信息。
12)、N12：AMF和AUSF间的接口，用于AMF向AUSF发起鉴权流程，其中可携带SUCI作为签约标识；
13)、N13：UDM与AUSF间的接口，用于AUSF向UDM获取用户鉴权向量，以执行鉴权流程。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，上述网元或者功能可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的一个功能模块，本申请实施例对此不作具体限定。
本申请中的会话管理网元、策略控制网元、用户面网元、接入网设备、应用功能网元分别可以是图2(a)或图2(b)中的SMF、PCF、UPF、RAN、AF，也可以是未来通信如第六代(6th generation，6G)网络中具有上述SMF、PCF、UPF、RAN、AF的功能的网元，本申请对此不限定。为方便说明，本申请以会话管理网元、策略控制网元、用户面网元、接入网设备、应用功能网元分别为上述SMF、PCF、UPF、RAN、AF为例进行说明。
在目前基于信令的QoS流(QoS flow)架构中，SMF根据本地策略或者PCF发送的策略计费控制(Policy and Charging Control，PCC)规则确定建立QoS flow，PCC规则中包含业务数据流模板(Service data flow template,SDF template)。其中，PCC规则与SDF模板是一一对应的关系。
其中，PCC规则是能够检测SDF并为策略控制和/或计费控制和/或其他控制或支持信息提供参数的一组信息(A set of information enabling the detection of a service data flow and providing parameters for policy control and/or charging control and/or other control or support information)。
SDF是UPF上承载的匹配到一个SDF模板报文流的集合(An aggregate set of packet flows carried through the UPF that matches a service data flow template)。
SDF模板包含PCC规则中的一组SDF过滤器(Service data flow filter，SDF filter)或者应用标识(Application ID)，应用标识可以索引到SMF或UPF中的一个应用检测过滤器。SDF模板是用来定义一个SDF的(The set of service data flow filters in a PCC Rule or an application identifier in a PCC rule referring to an application detection filter in the SMF or in the UPF,required for defining a service data flow)。
其中，SDF过滤器是数据包流头参数值/范围的集合，用于标识UPF中的一个或多个数据包流(A set of packet flow header parameter values/ranges used to identify one or more of the packet flows in the UPF)。SDF过滤器中包含但不限于以下信息中的一个或多个：
1)源IP地址或源IP地址前缀(source IP address or IPv6 prefix)；
2)目的IP地址或目的IP地址前缀(destination IP address or IPv6 prefix)；
3)源端口号(source port number)；
4)目的端口号(destination port number)；
5)IP层的上层协议号(Protocol ID of the protocol above IP)；
6)下一个头类型(Next header type)；
7)流标签(Flow Label)(IPv6)；
8)分组数据流方向(Packet Flow Direction)。
应用标识是一个索引到特定应用检测过滤器的标识。若SDF模板中包含应用标识，则可以根据该应用标识索引到上述SDF过滤器所包含的信息中的一个或多个信息。
数据包流描述(Packet Flow Description，PFD)也可以称为PFD信息。PFD能够检测第三方服务提供商提供的应用程序流量的一组信息。PFD可以用于生成应用检测过滤器。PFD包含以下信息：
1)PFD标识；
2)三元组、要匹配的统一资源定位符(Uniform Resource Locator，URL)的有效部分、域名匹配标准、有关应用协议的信息中的一项或多项。
其中，三元组包括协议、服务器端因特网协议(Internet Protocol，IP)地址和端口号，要匹配的URL的有效部分例如可以是主机名。
SMF向UPF发送SDF信息，SDF信息包含QoS控制信息，通过AMF向RAN发送QoS flow的QoS配置文件，以及通过AMF、RAN向终端设备发送QoS规则，QoS规则包含QoS控制信息。然后，终端设备、RAN和UPF之间建立QoS flow，RAN根据QoS配置文件建立空口的数据无线承载(Data Radio Bearer，DRB)，并存储QoS flow与DRB的绑定关系。
在下行方向，当UPF接收到下行数据包，则根据SMF发送的SDF信息执行QoS控制，比如在下行数据包的包头中携带QoS流标识(QoS flow identity，QFI)，然后UPF向RAN发送下行数据包。RAN接收到下行数据包后，根据下行数据包的包头中的QFI以及QoS flow与DRB的绑定关系，将下行数据包放在对应的DRB上传输至终端设备。
在上行方向，终端设备确定发送上行数据包，根据QoS规则确定QoS flow，并在上行数据包的包头中携带该QoS flow的QFI，然后根据QoS flow和DRB的绑定关系，将上行数据包放在对应的DRB上传输至RAN。RAN接收到上行数据包，获取到上行数据包的包头中的QFI，然后将该QFI添加到RAN与UPF之间的数据包的包头中。UPF接收到RAN发送的上行数据包后，验证该上行数据包是否使用正确的QoS flow传输。
为提升通信安全，目前提出终端设备到核心网的加密需求。其中，一种无需更改现有网络架构的方案是：在UPF和DN之间部署安全网关，终端设备与安全网关之间的通信实现IP层的端到端(E2E)加密。其中，加密秘钥来源于终端设备与安全网关之间基于IPsec协议的协商。
下面对IPsec协议进行介绍说明。
IPSec在IP层实现安全保护，提供在不安全的网络环境中传输敏感数据的保护。通信双方在IP层执行加密及数据源认证来确保网络传输时数据包的机密性、数据一致性、数据源认证及抗重放。也即，IPSec可以提供以下安全服务：
1)数据源认证：对端身份认证，不可抵赖；
2)完整性保护：保证数据在传输过程中不被篡改；
3)机密性：对传输的用户敏感数据进行加密保护；
4)重放保护：拒绝接收旧的或者重复的报文。
IPSec协议体系包括两个安全处理协议和一个密钥交换(Internet Key Exchange，IKE)协议。其中，安全处理协议包括AH协议和ESP协议。
AH协议提供数据源认证、数据完整性校验、防重放攻击等功能，但不支持数据加密。ESP协议提供数据源认证、数据完整性校验、防重放攻击、数据加密等功能。AH和ESP可以单独使用，也可以嵌套使用。通过这些组合方式，可以在两台主机、两台安全网关(如防火墙和路由器)，或者主机与安全网关之间使用。IKE协议负责密钥管理，定义了通信实体间进行身份认证、协商加密算法以及生成共享的会话密钥的方法。IKE协议将密钥协商的结果进行保留，供AH协议和ESP协议以后使用。
通信双方使用IKE协议协商建立安全关联(Security Association，SA)。IPsec SA是要建立IPSec隧道的通信双方对隧道参数的约定，包括隧道两端的IP地址、隧道采用的验证方式、验证算法、验证密钥、加密算法、共享密钥以及生命周期等一系列参数。
其中，SA是两个通信实体经协商建立起来的一种协定，为安全目的创建一个单向逻辑连接，所有经过同一SA的数据流会得到相同安全服务，其决定了用来保护数据包安全的IPSec协议、密钥以及密钥的有效存在时间等。SA是构成IPSec的基础。SA是单向的(inbound和outbound)，且“与协议相关”，一个SA对应一个AH，或对应一个ESP。
SA是单向的逻辑连接，因此两个IPSec对等通信实体之间的双向通信，最少需要建立两个SA来分别对两个方向的数据流进行安全保护。
一个SA可以由三元组来唯一标识，这个三元组包括安全参数索引(Security Parameter Index，SPI)、目的IP地址和安全协议号(AH协议或ESP协议)。其中，SPI是为唯一标识SA而生成的一个32位比特的数值，它在AH或ESP头中传输。不同的SA对应的SPI不同。
目前，基于IPSec协议通信时，对数据包的IPSec封装模式主要包括：
1)传输模式：不产生新的IP包头，AH或ESP头被***到原始数据包的IP头之后但在所有传输层协议之前，通常用于主机与主机之间(数据传输点等于加密点)的IPSec场景。
如图3所示，以IP上层协议为TCP为例，为传输模式中的数据包格式示意图。
可以看出，原始的IP数据包包括原始IP头(包含目的IP地址、源IP地址)、传输控制协议(Transmission Control Protocol，TCP)(包含端口号)和数据。
基于AH协议的IP数据包是在原始IP数据包的原始IP头之后，TCP之前增加AH。并且TCP和数据是加密的，对外不可见。
基于ESP协议的IP数据包是在原始IP数据包的原始IP头之后，TCP之前增加ESP头,以及在数据之后增加ESP尾和ESP验证。并且TCP、数据和ESP尾是加密的，对外不可见。
2)隧道模式：AH或ESP头插在原始IP头之前，另外生成一个新的IP头放到AH或ESP头之前，通常用于私网与私网之间通过公网进行通信的场景。
如图4所示，以IP上层协议为TCP为例，为隧道模式中的数据包格式示意图。
可以看出，原始的IP数据包包括原始IP头(包含目的IP地址、源IP地址)、TCP(包含端口号)和数据。
基于AH协议的IP数据包是在原始IP数据包的原始IP头之前增加AH和新的IP头。并且原始IP头、TCP和数据是加密的，对外不可见。
基于ESP协议的IP数据包是在原始IP数据包的原始IP头之前增加ESP头和新的IP头,以及在数据之后增加ESP尾和ESP验证。并且原始IP头、TCP、数据和ESP尾是加密的，对外不可见。
基于上述描述，可以看出，若终端设备与安全网关之间使用端到端的加密模式，则终端设备或安全网关会采用AH协议或ESP协议对用户面的数据流进行加密，核心网无法识别出端口号等信息，因而无法识别用户面的数据流，进而无法执行QoS控制。
比如，当采用图3所示的传输模式，由于TCP和数据被加密，则核心网无法获取识别TCP中的端口号等信息，而只能获取到原始IP头中的源IP地址和目的IP地址。
再比如，当采用图4所示的隧道模式，由于原始IP头、TCP和数据被加密，则核心网无法获取原始IP头中的源IP地址、目的IP地址、TCP中的端口号等信息。
因此，当终端设备与安全网关之间使用端到端的加密模式，如何使得核心网能够识别用户面的数据流，进而执行QoS控制，是目前需要解决的。
为解决上述问题，本申请实施例提供多种不同的方法。需要说明的是，以下任意实施例中，业务数据流识别信息可以是安全参数索引(SPI)或业务数据流索引(SDF index)。其中，SPI的定义参考前述描述。一个业务数据流索引用于标识一个SDF模板、或用于标识一个业务描述信息。
业务数据流识别信息与业务数据流描述信息(比如可以是SDF模板)存在对应关系，也即通过业务数据流识别信息可以确定相应的业务数据流描述信息(比如可以是SDF模板)。
当业务数据流识别信息是SPI，则终端设备与安全网关之间建立基于IPsec的安全关联之后，终端设备和安全网关均可以在数据包中***SPI。例如为数据包加上IPsec协议头(如AH或ESP头)，从而核心网网元(如UPF等)可以识别数据包中的SPI，根据该SPI确定相应的QoS流(以QFI标识)，进而可以根据该QoS流对该数据包执行QoS控制。(注：同一PDU会话中的具有相同QFI的数据包会得到同样的数据流转发处理，比如调度，准入门限)需要说明的是，SPI与SA是一一对应的，即一个SA只有一个SPI。
当业务数据流识别信息是业务数据流索引，则终端设备与安全网关之间建立基于IPsec的安全关联之后，终端设备和安全网关均可以在数据包中***业务数据流索引，例如***到IPsec协议头中(如AH中的保留位或ESP头中的填充位)，从而核心网网元(如UPF等)可以识别数据包中的业务数据流索引，根据该业务数据流索引对应的业务数据流描述信息(或SDF模板)，确定相应的QoS流，进而根据该QoS流对该数据包执行QoS控制。需要说明的是，业务数据流索引与SA不一定是一一对应的，比如一个SA可以有多个业 务数据流索引,不同的SA也可以共用一个业务数据流索引。业务流索引不具有方向性。
下面对本申请实施例的方案进行具体说明。
基于图2(a)或图2(b)所示的网络架构，如图5(a)所示，本申请提供一种通信方法。该方法包括以下步骤：
步骤501a，AF向PCF发送授权请求。相应的，PCF可以接收到该授权请求。
该授权请求包含业务描述信息，业务描述信息包含业务数据流过滤器或应用标识。
步骤502a，PCF根据业务描述信息，生成业务数据流描述信息。
业务数据流描述信息包含业务数据流过滤器或应用标识。
该业务数据流描述信息比如可以是SDF模板，SDF模板包含业务数据流过滤器或应用标识。
上述步骤501a至步骤502a为可选步骤。
步骤503a，PCF向安全网关发送请求消息。相应的，安全网关可以接收到该请求消息。
该请求消息包含业务数据流描述信息，该请求消息用于请求获取业务数据流描述信息对应的业务数据流识别信息，业务数据流识别信息为SPI或业务数据流索引。
也即，该请求消息用于请求安全网关根据业务数据流描述信息，生成一个业务数据流识别信息，该业务数据流识别信息可以是SPI或业务数据流索引。
作为一种实现方法，PCF确定业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，或者确定业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数(比如可以是3GPP标准协议23.503第6.1.3.2.4章节定义的绑定参数)不同，则向安全网关发送上述请求消息。也即当PCF确定不能使用其他业务数据流描述信息对应的业务数据流识别信息时，则向安全网关发送上述请求消息，以请求一个新的业务数据流识别信息。
步骤504a，安全网关根据业务数据流描述信息，生成业务数据流识别信息。
步骤505a，安全网关向PCF发送业务数据流识别信息。相应的，PCF可以接收到该业务数据流识别信息。
需要说明的是，若上述步骤503a的请求消息用于请求业务数据流描述信息对应的上行SPI，则上述步骤505a的业务数据流识别信息为上行SPI。若上述步骤503a的请求消息用于请求业务数据流描述信息对应的下行SPI，则上述步骤505a的业务数据流识别信息为下行SPI。若上述步骤503a的请求消息用于请求业务数据流描述信息对应的上行SPI和下行SPI，则上述步骤505a的业务数据流识别信息为上行SPI和下行SPI。
若上述步骤503a的请求消息用于请求业务数据流描述信息对应的上行业务数据流索引，则上述步骤505a的业务数据流识别信息为上行业务数据流索引。若上述步骤503a的请求消息用于请求业务数据流描述信息对应的下行业务数据流索引，则上述步骤505a的业务数据流识别信息为下行业务数据流索引。若上述步骤503a的请求消息用于请求业务数据流描述信息对应的上行业务数据流索引和下行业务数据流索引，则上述步骤505a的业务数据流识别信息为上行业务数据流索引和下行业务数据流索引。
步骤506a，PCF根据业务数据流识别信息，生成PCC规则。
也即，PCF生成的PCC规则携带该业务数据流识别信息，该业务数据流识别信息用于识别携带业务数据流识别信息的数据包。
比如，PCF可以向SMF发送上述PCC规则，SMF根据该PCC规则生成PDR，该PDR包含业务数据流识别信息和QFI,然后SMF将PDR发送给UPF。
在现有技术中，UPF是根据三元组(源IP地址、目的IP地址、端口号)识别业务数据流的数据包，但根据上述分析可知，在增加了安全网关之后，由于对业务数据流进行了加密，因此UPF无法根据获取到三元组中的部分或全部信息，因而无法基于三元组识别业务数据流，进而无法执行QoS控制。而本申请实施例中，UPF可以通过业务数据流识别信息识别业务数据流的数据包，也即识别携带业务数据流识别信息的数据包，然后基于PDR中的业务数据流识别信息与QFI的对应关系，确定数据包中的业务数据流识别信息对应的QFI，从而根据该QFI所指示的QoS流，对该数据流执行QoS控制。也即，本申请实施例是，UPF不再通过三元组识别业务数据流，而是通过业务数据流识别信息识别业务数据流，并根据配置的业务数据流识别信息与QFI的对应关系，确定执行QoS控制的QFI，进而可执行QoS控制。
作为一种实现方法，在上述步骤504a之后，还可以包括以下步骤507a。
步骤507a，安全网关向终端设备发送业务数据流识别信息与业务数据流描述信息之间的对应关系。
基于该对应关系，终端设备可以将业务数据流识别信息添加至与业务数据流描述信息对应的业务数据流的上行数据包，并发送该上行数据包，以便于核心网网元(如UPF等)可以通过上行数据包中的业务数据流识别信息来识别上行数据包。
作为一种实现方法，安全网关可以根据业务数据流描述信息识别接收的业务数据流，然后基于上述对应关系，将与业务数据流描述信息对应的业务数据流识别信息添加至业务数据流的下行数据包，并发送该下行数据包，以便于核心网网元(如UPF等)可以通过下行数据包中的业务数据流识别信息来识别下行数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得PCF可以根据业务数据流识别信息生成PCC规则，从而核心网网元如UPF可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
基于图2(a)或图2(b)所示的网络架构，如图5(b)所示，本申请提供又一种通信方法。该方法包括以下步骤：
步骤501b，AF向PCF发送授权请求。相应的，PCF可以接收到该授权请求。
该授权请求包含业务描述信息，业务描述信息包含业务数据流过滤器或应用标识。
步骤502b，PCF根据业务描述信息，生成业务数据流描述信息。
业务数据流描述信息包含业务数据流过滤器或应用标识。
该业务数据流描述信息比如可以是SDF模板，SDF模板包含业务数据流过滤器或应用标识。
上述步骤501b至步骤502b为可选步骤。
步骤503b，PCF向安全网关发送请求消息。相应的，安全网关可以接收到该请求消息。
该请求消息包含业务数据流描述信息和业务数据流识别信息，该请求消息用于请求建立业务数据流描述信息与业务数据流识别信息的对应关系，业务数据流识别信息为SPI或业务数据流索引。
作为一种实现方法，PCF确定业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，或者确定业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数(比如可以是3GPP标准协议23.503第6.1.3.2.4章节定义的绑定参数)相同，则向安全网关发送上述请求消息。也即当PCF确定能够使用其他业务数据流描述信息对应的业务数据流识别信息时，则向安全网关发送上述请求消息，以请求使用已有的业务数据流识别信息。
步骤504b，安全网关保存业务数据流描述信息与业务数据流识别信息的对应关系。
步骤505b，安全网关向PCF发送响应消息。相应的，PCF可以接收到该响应消息。
该响应消息用于指示已经建立业务数据流描述信息与业务数据流识别信息的对应关系。
需要说明的是，上述步骤503b的请求消息可以包含上行SPI，或者包含下行SPI，或者包含上行SPI和下行SPI。或者，上述步骤503b的请求消息可以包含上行业务数据流索引I，或者包含下行业务数据流索引，或者包含上行业务数据流索引和下行业务数据流索引。
步骤506b，PCF根据业务数据流识别信息，生成PCC规则。
也即，PCF生成的PCC规则携带该业务数据流识别信息，该业务数据流识别信息用于识别携带业务数据流识别信息的数据包。
比如，PCF可以向SMF发送上述PCC规则，SMF根据该PCC规则生成PDR，该PDR包含业务数据流识别信息和QFI,然后SMF将PDR发送给UPF。
在现有技术中，UPF是根据三元组(源IP地址、目的IP地址、端口号)识别业务数据流的数据包，但根据上述分析可知，在增加了安全网关之后，由于对业务数据流进行了加密，因此UPF无法根据获取到三元组中的部分或全部信息，因而无法基于三元组识别业务数据流，进而无法执行QoS控制。而本申请实施例中，UPF可以通过业务数据流识别信息识别业务数据流的数据包，也即识别携带业务数据流识别信息的数据包，然后基于PDR中的业务数据流识别信息与QFI的对应关系，确定数据包中的业务数据流识别信息对应的QFI，从而根据该QFI所指示的QoS流，对该数据流执行QoS控制。也即，本申请实施例是，UPF不再通过三元组识别业务数据流，而是通过业务数据流识别信息识别业务数据流，并根据配置的业务数据流识别信息与QFI的对应关系，确定执行QoS控制的QFI，进而可执行QoS控制。
作为一种实现方法，在上述步骤504b之后，还可以包括以下步骤507b。
步骤507b，安全网关向终端设备发送业务数据流识别信息与业务数据流描述信息之间的对应关系。
基于该对应关系，终端设备可以将业务数据流识别信息添加至与业务数据流描述信息对应的业务数据流的上行数据包，并发送该上行数据包，以便于核心网网元(如UPF等)可以通过上行数据包中的业务数据流识别信息来识别上行数据包。
作为一种实现方法，安全网关可以根据业务数据流描述信息识别接收的业务数据流，然后基于上述对应关系，将与业务数据流描述信息对应的业务数据流识别信息添加至业务数据流的下行数据包，并发送该下行数据包，以便于核心网网元(如UPF等)可以通过下行数据包中的业务数据流识别信息来识别下行数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系， 使得PCF可以根据业务数据流识别信息生成PCC规则，从而核心网网元如UPF可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
基于图2(a)或图2(b)所示的网络架构，如图5(c)所示，本申请提供又一种通信方法。该方法包括以下步骤：
步骤501c，AF向安全网关发送业务信息。相应的，安全网关可以接收到该业务信息。
该业务信息包含业务描述信息和/或业务需求信息，业务描述信息包含业务数据流过滤器或应用标识，业务需求信息包含带宽、时延等。
步骤502c，安全网关根据业务信息，确定业务数据流识别信息，该业务数据流识别信息可以是SPI或业务数据流索引。
作为一种实现方法，PCF确定接收到的业务需求信息与接收到的其他业务需求信息相同、且其他业务需求信息已经对应有业务数据流识别信息，则安全网关将该其他业务需求信息对应的业务数据流识别信息确定为该业务信息对应的业务数据流识别信息。例如，上述步骤501c的业务信息携带业务需求信息1，而安全网关在上述步骤501c之前，从AF接收到业务需求信息2，且为业务需求信息2生成了业务数据流识别信息1，则该步骤502c中，安全网关确定业务数据流识别信息1作为该业务信息对应的业务数据流识别信息，也即业务需求信息1和业务需求信息2对应相同的业务数据流识别信息。
作为另一种实现方法，PCF确定接收到的业务需求信息与接收到的其他业务需求信息不相同，或者接收到的业务需求信息与接收到的其他业务需求信息相同但该其他业务需求信息没有对应的业务数据流识别信息，则安全网关为该业务需求信息重新生成一个业务数据流识别信息。
步骤503c，安全网关向PCF发送业务数据流识别信息。相应的，PCF可以接收到该业务数据流识别信息。
需要说明的是，该步骤502c的业务数据流识别信息可以是上行SPI，或者可以是下行SPI，或者还可以是上行SPI和下行SPI。或者，该步骤502c的业务数据流识别信息可以是上行业务数据流索引，或者可以是下行业务数据流索引，或者还可以是上行业务数据流索引和下行业务数据流索引。
可选的，安全网关还向PCF发送业务数据流识别信息与业务需求信息的对应关系。
步骤504c，PCF根据业务数据流识别信息，生成PCC规则。
也即，PCF生成的PCC规则携带该业务数据流识别信息，该业务数据流识别信息用于识别携带业务数据流识别信息的数据包。
比如，PCF可以向SMF发送上述PCC规则，SMF根据该PCC规则生成PDR，该PDR包含业务数据流识别信息和QFI,然后SMF将PDR发送给UPF。
在现有技术中，UPF是根据三元组(源IP地址、目的IP地址、端口号)识别业务数据流的数据包，但根据上述分析可知，在增加了安全网关之后，由于对业务数据流进行了加密，因此UPF无法根据获取到三元组中的部分或全部信息，因而无法基于三元组识别业务数据流，进而无法执行QoS控制。而本申请实施例中，UPF可以通过业务数据流识别信息识别业务数据流的数据包，也即识别携带业务数据流识别信息的数据包，然后基于PDR中的业务数据流识别信息与QFI的对应关系，确定数据包中的业务数据流识别信息对应的 QFI，从而根据该QFI所指示的QoS流，对该数据流执行QoS控制。也即，本申请实施例是，UPF不再通过三元组识别业务数据流，而是通过业务数据流识别信息识别业务数据流，并根据配置的业务数据流识别信息与QFI的对应关系，确定执行QoS控制的QFI，进而可执行QoS控制。
作为一种实现方法，在上述步骤502c之后，还可以包括以下步骤505c。
步骤505c，安全网关向终端设备发送业务数据流识别信息与业务数据流描述信息之间的对应关系。
基于该对应关系，终端设备可以将业务数据流识别信息添加至与业务数据流描述信息对应的业务数据流的上行数据包，并发送该上行数据包，以便于核心网网元(如UPF等)可以通过上行数据包中的业务数据流识别信息来识别上行数据包。
作为一种实现方法，安全网关可以根据业务数据流描述信息识别接收的业务数据流，然后基于上述对应关系，将与业务数据流描述信息对应的业务数据流识别信息添加至业务数据流的下行数据包，并发送该下行数据包，以便于核心网网元(如UPF等)可以通过下行数据包中的业务数据流识别信息来识别下行数据包。
基于上述方案，通过建立业务数据流识别信息与业务数据流描述信息之间的对应关系，使得PCF可以根据业务数据流识别信息生成PCC规则，从而核心网网元如UPF可以根据业务数据流识别信息识别出与业务数据流描述信息对应的数据包，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
下面结合图6或图7所示的具体实施例，对上述图5(a)至图5(c)所示的实施例进行介绍说明。需要说明的是，以下实施例中，均以业务数据流描述信息为SDF模板为例进行说明。
如图6所示，为本申请实施例提供的另一种通信方法。该方法包括以下步骤：
步骤601，终端设备发起PDU会话建立流程，SMF和PCF之间建立策略关联。
步骤602，AF向PCF发送授权请求。相应地，PCF可以接收到该授权请求。
该授权请求包含业务信息，该业务信息包含业务描述信息(如SDF过滤器或应用标识)。可选的，该业务信息还包含业务需求信息(如带宽、时延等)。
其中，SDF过滤器和应用标识的定义可以参考前述描述。
步骤603，PCF向安全网关发送请求消息。相应地，安全网关可以接收到该请求消息。
作为一种实现方法，若PCF决定将SDF模板与已经分配的业务数据流识别信息绑定，则请求消息包含SDF模板和业务数据流识别信息，该请求消息用于请求建立该SDF模板与该业务数据流识别信息的对应关系。比如，当多个SDF模板(或者称SDF模板对应的业务)可以合并到同一个PCC规则，即这些SDF模板对应的PCC规则相同时，或者PCF判断只需做PCC规则的更新，而不用产生新的PCC规则时，则PCF在为第一个SDF模板向安全网关请求分配业务数据流识别信息之后，则后续其他SDF模板可以重用该业务数据流识别信息，也即这些SDF模板都绑定到同一个业务数据流识别信息。再比如，当多个SDF模板将要生成的PCC规则中的第一参数相同，则这些SDF模板也可以重用相同的业务数据流识别信息，这里的第一参数可以是5G QoS标识(5G QoS Identifier，5QI)、分配与抢占优先级(Allocation and Retention Priority，ARP)、服务质量通知控制(QoS Notification Control，QNC)中的一个或多个。第一参数还可以是用于QoS Flow绑定的参数或参数集 合，比如可以是3GPP标准协议23.503第6.1.3.2.4章节定义的绑定参数。
作为另一种实现方法，该请求消息包含SDF模板，该请求消息用于请求获取该SDF模板对应的业务数据流识别信息。该SDF模板包含上述SDF过滤器或应用标识。比如，PCF确定上述SDF模板不能够与其他SDF模板合并至同一个PCC规则，或者上述SDF模板对应的PCC规则的绑定参数与其他SDF模板对应的PCC规则的绑定参数不同，则需要向安全网关请求分配新的业务流识别信息。
步骤604，安全网关向PCF发送响应消息。相应地，PCF可以接收到该响应消息。
若上述请求包含SDF模板，则安全网关为该SDF模板分配一个业务数据流识别信息，响应消息包含该业务数据流识别信息。
若上述请求消息包含SDF模板和业务数据流识别信息，则安全网关在本地保存该SDF模板与业务数据流识别信息的对应关系，且响应消息用于指示已经成功建立或保存SDF模板与业务数据流识别信息的对应关系。
可选的，该响应消息还包含该业务数据流识别信息的方向，如上行方向或下行方向。
步骤605，安全网关使用业务数据流识别信息为对应的业务流建立或修改安全网关与终端设备之间的安全关联(SA)。
该过程中，安全网关将业务数据流识别信息与SDF模板的对应关系发送至终端设备。
SDF模板的内容请见前文。需要说明的是，安全网关发送给终端设备的SDF模板在标准上也可以有其他名称，比如可以称为包过滤集合(Packet Filter Set)或其他名称。
具体的，当SDF模板具有上行方向时，安全网关要建立或修改上行方向的SA；当SDF模板具有下行方向时，安全网关要建立或修改下行方向的SA；当SDF模板同时具有上行方向和下行方向时，安全网关要建立或修改上行方向和下行方向的SA。
在安全网关与终端设备之间建立了安全关联之后，安全网关在检测到对应业务数据流的下行数据包时，可以在下行数据包上加入业务数据流识别信息。终端设备在检测到对应业务数据流的上行数据包时，可以在上行数据包上加入业务数据流识别信息。
比如，当SDF模板包含应用标识时，安全网关在下行数据包中加入业务数据流识别信息的过程如下：
首先，安全网关可以通过NEF(或数据包流描述功能(Packet Flow Description Function，PFDF)网元)获取相应的PFD。比如，安全网关向NEF(或PFDF网元)发送应用标识，NEF(或PFDF网元)向安全网关反馈应用标识对应的PFD。(注：NEF(或PFDF网元)可能从本地获取应用标识对应的PFD，也可以是向UDR获取应用标识对应的PFD)。
其次，安全网关可以根据PFD识别业务数据流的数据包。当然，安全网关也可以基于预配置信息识别应用标识对应的业务数据流。
然后，安全网关可以在识别出的业务数据流的数据包中加入该SDF模板对应的业务数据流识别信息。
可选的，安全网关也可以将上述PFD发送给终端设备，用作数据包的识别。
步骤606，PCF向SMF发送PCC规则。相应地，SMF可以接收到PCC规则。
该PCC规则包含业务数据流识别信息，该业务数据流识别信息用于UPF等网元识别数据包。可选的，PCC规则还可以包含SDF模板。
SMF接收到PCC规则后，根据PCC规则生成PDR和QoS规则。
其中，PDR包含业务数据流识别信息和QFI，因此通过PDR建立了业务数据流识别 信息与QFI之间的对应关系，该QFI所指示的QoS流包含该PCC规则对应的SDF，或者理解为该PCC规则对应的SDF归属于该QFI所指示的QoS流。
步骤607，SMF向UPF发送PDR。相应地，UPF可以接收到PDR。
UPF接收到PDR之后，可以根据PDR执行QoS控制。比如，当UPF接收到数据包之后，获取到该数据包中的业务数据流识别信息，然后根据业务数据流识别信息与QFI之间的对应关系，确定QFI，进而网络可以使用该QFI指示的QoS流对该数据包执行QoS控制。
步骤608，SMF向终端设备发送QoS规则。相应地，终端设备可以接收到QoS规则。
当终端设备需要发送上行数据包时，可以先确定该上行数据包对应的SDF模板，然后根据上述步骤605中获取到的SDF模板与业务数据流标识信息的对应关系，在上行数据包中添加业务数据流标识信息。以及，终端设备还根据QoS规则中的业务数据流标识信息与QFI的对应关系，在上行数据包中携带该QFI。然后根据QoS flow和DRB的绑定关系，将上行数据包放在对应的DRB上传输至RAN。也即，终端设备可以执行QoS控制。
基于上述方案，通过建立业务数据流识别信息与SDF模板之间的对应关系，使得PCF可以根据业务数据流识别信息生成PCC规则，从而核心网网元如UPF可以根据先识别出数据包中的业务数据流识别信息，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
如图7所示，为本申请实施例提供的另一种通信方法。该方法包括以下步骤：
步骤701，终端设备发起PDU会话建立流程，SMF和PCF之间建立策略关联。
步骤702，AF向安全网关发送业务信息，相应的，安全网关可以接收到业务信息。
该业务信息包含业务描述信息(如SDF过滤器或应用标识)和/或业务需求信息(如带宽、时延等)。
比如，安全网关可以基于接收到的业务描述信息判断是分配新的业务数据流识别信息还是重用现有的业务数据流识别信息。比如，如果一种业务描述信息已经有对应的业务数据流识别信息，则当接收到相同的业务描述信息时，可以重用该业务数据流识别信息。再比如，如果一种业务描述信息没有对应的业务数据流识别信息，则当接收到该业务描述信息时，分配新的业务数据流识别信息。再比如，安全网关还可以根据业务需求信息判断是分配新的业务数据流识别信息还是重用现有的业务数据流识别信息。比如多个业务的业务需求信息相同，即使业务描述信息不同也可以使用相同的业务数据流识别信息。即安全网关在当接收到具有和已分配业务数据流识别信息的业务相同的业务需求信息的请求时，可以重用原来已分配的业务数据流识别信息。
可选的，安全网关可以为一个业务分配两个业务数据流识别信息，分别为上行业务数据流识别信息和下行业务数据流识别信息。
步骤703，安全网关使用业务数据流识别信息为对应的业务流建立或修改安全网关与终端设备之间的安全关联(SA)。
该过程中，安全网关将业务数据流识别信息与业务描述信息的对应关系发送至终端设备。
具体的，当业务描述信息具有上行方向时，安全网关要建立或修改上行方向的SA；当业务描述信息具有下行方向时，安全网关要建立或修改下行方向的SA；当业务描述信 息同时具有上行方向和下行方向时，安全网关要建立或修改上行方向和下行方向的SA。
在安全网关与终端设备之间建立了安全关联之后，安全网关在检测到对应业务数据流的下行数据包时，可以在下行数据包上加入业务数据流识别信息。终端设备在检测到对应业务数据流的上行数据包时，可以在上行数据包上加入业务数据流识别信息。
比如，当SDF模板包含应用标识时，安全网关在下行数据包中加入业务数据流识别信息的过程如下：
首先，安全网关可以通过NEF(或PFDF网元)获取相应的PFD。比如，安全网关向NEF(或PFDF网元)发送应用标识，NEF(或PFDF网元)向安全网关反馈应用标识对应的PFD。(注：NEF(或PFDF网元)可能从本地获取应用标识对应的PFD，也可以是向UDR获取应用标识对应的PFD)。
其次，安全网关可以根据PFD识别业务数据流的数据包。当然，安全网关也可以基于预配置信息识别应用标识对应的业务数据流。
然后，安全网关可以在识别出的业务数据流的数据包中加入该SDF模板对应的业务数据流识别信息。
步骤704，安全网关向PCF发送授权请求。相应地，PCF可以接收到该授权请求。
该授权请求包含业务数据流识别信息以及业务需求信息(如带宽、时延等)。
可选的，该授权请求还可以包括业务描述信息(如SDF过滤器或应用标识)。
可选的，该授权请求还包含该业务数据流识别信息的方向，如上行方向或下行方向。
需要说明的是，上述步骤703与步骤704之间的执行顺序不限。
步骤705至步骤707，同图6实施例中的步骤606至步骤608。
基于上述方案，通过建立业务数据流识别信息与SDF模板之间的对应关系，使得PCF可以根据业务数据流识别信息生成PCC规则，从而核心网网元如UPF可以根据先识别出数据包中的业务数据流识别信息，然后根据该业务数据流识别信息对应的QFI所指示的QoS流，执行QoS流控制。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
可以理解的是，上述各个方法实施例中，对应由策略控制网元实现的步骤或者操作，也可以由配置于策略控制网元的部件(例如芯片或者电路)实现，对应由安全网关实现的步骤或者操作，也可以由配置于安全网关的部件(例如芯片或者电路)实现。
参考图8，为本申请实施例提供的一种通信装置的示意图。该装置用于实现上述图5(a)至图5(c)，以及图6至图7实施例中对应安全网关所执行的各个步骤，如图8所示，该装置800包括发送单元810、接收单元820和处理单元830。
在第一个实施例中：
接收单元820，用于从策略控制网元接收请求消息，所述请求消息包含业务数据流描 述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；发送单元810，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述发送单元810，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
在一种可能的实现方法中，处理单元830，用于根据所述业务数据流描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；所述发送单元810，还用于发送所述业务数据流的数据包。
在一种可能的实现方法中，所述发送单元810，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：用于向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，用于向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
在第二个实施例中：
接收单元820，用于从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；发送单元810，用于向所述策略控制网元发送响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述发送单元810，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
在一种可能的实现方法中，处理单元830，用于根据所述业务数据流模板，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；所述发送单元810，还用于发送所述业务数据流的数据包。
在一种可能的实现方法中，所述SPI包括上行SPI和/或下行SPI。
在一种可能的实现方法中，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
在第三个实施例中：
接收单元820，用于从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；处理单元830，用于根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；发送单元810，用于向策略控制网元发送所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述发送单元810，还用于向所述终端设备发送所述业务 数据流识别信息与所述业务描述信息之间的对应关系。
在一种可能的实现方法中，所述处理单元830，还用于根据所述业务描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；所述发送单元810，还用于发送所述业务数据流的数据包。
在一种可能的实现方法中，所述发送单元810，用于向策略控制网元发送所述业务数据流识别信息，具体包括：用于向所述策略控制网元发送上行SPI和/或下行SPI；或者，用于向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述业务信息至少包含所述业务需求信息；所述处理单元830，用于根据所述业务信息，确定业务数据流识别信息，具体包括：用于确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
在一种可能的实现方法中，所述业务信息至少包含所述业务需求信息；所述处理单元830，用于根据所述业务信息，确定业务数据流识别信息，具体包括：用于确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
在一种可能的实现方法中，所述发送单元810，还用于向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
可选的，上述通信装置800还可以包括存储单元，该存储单元用于存储数据或者指令(也可以称为代码或者程序)，上述各个单元可以和存储单元交互或者耦合，以实现对应的方法或者功能。例如，处理单元830可以读取存储单元中的数据或者指令，使得通信装置实现上述实施例中的方法。
应理解以上装置中单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且装置中的单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元以软件通过处理元件调用的形式实现，部分单元以硬件的形式实现。例如，各个单元可以为单独设立的处理元件，也可以集成在装置的某一个芯片中实现，此外，也可以以程序的形式存储于存储器中，由装置的某一个处理元件调用并执行该单元的功能。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件又可以成为处理器，可以是一种具有信号的处理能力的集成电路。在实现过程中，上述方法的各步骤或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路实现或者以软件通过处理元件调用的形式实现。
在一个例子中，以上任一装置中的单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)，或这些集成电路形式中至少两种的组合。再如，当装置中的单元可以通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如中央处理器(Central Processing Unit，CPU)或其它可以调用程序的处理器。再如，这些单元可以集成在一起，以片上***(system-on-a-chip，SOC)的形式实现。
以上发送单元810是一种该装置的接口电路，用于向其它装置发送信号。例如，当该装置以芯片的方式实现时，该发送单元810是该芯片中的用于向其它芯片发送信号的接口电路。以上接收单元820是一种该装置的接口电路，用于从其它装置接收信号。例如，当 该装置以芯片的方式实现时，该接收单元820是该芯片中的用于从其它芯片接收信号的接口电路。
参考图9，为本申请实施例提供的又一种通信装置的示意图。该装置用于实现上述图5(a)至图5(c)，以及图6至图7实施例中对应策略控制网元(或PCF)所执行的各个步骤，如图9所示，该装置900包括发送单元910、接收单元920和处理单元930。
在第一个实施例中：
发送单元910，用于向安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；接收单元920，用于从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；处理单元930，用于根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述接收单元920，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；所述处理单元930，还用于根据所述业务描述信息，生成所述业务数据流描述信息。
在一种可能的实现方法中，所述接收单元920，用于从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：用于从所述安全网关接收所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，用于从所述安全网关接收所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述处理单元930，还用于确定所述业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，则向安全网关发送所述请求消息；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数不同，则向安全网关发送所述请求消息。
在第二个实施例中：
发送单元910，用于向安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；接收单元920，用于从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；处理单元930，用于根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述接收单元920，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；所述处理单元930，还用于根据所述业务描述信息，生成所述业务数据流描述信息。
在一种可能的实现方法中，所述SPI包括上行SPI和/或下行SPI。
在一种可能的实现方法中，业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
在一种可能的实现方法中，所述处理单元930，还用于确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
在第三个实施例中：
接收单元920，用于从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；处理单元930，用于根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
在一种可能的实现方法中，所述接收单元920，用于从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，具体包括：用于从所述安全网关接收所述业务信息和所述业务信息对应的上行SPI和/或下行SPI；或者，用于从所述安全网关接收所述业务信息和所述业务信息对应的上行业务数据流索引和/或下行业务数据流索引。
可选的，上述通信装置900还可以包括存储单元，该存储单元用于存储数据或者指令(也可以称为代码或者程序)，上述各个单元可以和存储单元交互或者耦合，以实现对应的方法或者功能。
应理解以上装置中单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且装置中的单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元以软件通过处理元件调用的形式实现，部分单元以硬件的形式实现。例如，各个单元可以为单独设立的处理元件，也可以集成在装置的某一个芯片中实现，此外，也可以以程序的形式存储于存储器中，由装置的某一个处理元件调用并执行该单元的功能。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件又可以成为处理器，可以是一种具有信号的处理能力的集成电路。在实现过程中，上述方法的各步骤或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路实现或者以软件通过处理元件调用的形式实现。
在一个例子中，以上任一装置中的单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(ASIC)，或，一个或多个微处理器(DSP)，或，一个或者多个现场可编程门阵列(FPGA)，或这些集成电路形式中至少两种的组合。再如，当装置中的单元可以通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如中央处理器(CPU)或其它可以调用程序的处理器。再如，这些单元可以集成在一起，以片上***(SOC)的形式实现。
以上发送单元910是一种该装置的接口电路，用于向其它装置发送信号。例如，当该装置以芯片的方式实现时，该发送单元910是该芯片中的用于向其它芯片发送信号的接口电路。以上接收单元920是一种该装置的接口电路，用于从其它装置接收信号。例如，当 该装置以芯片的方式实现时，该接收单元920是该芯片中的用于从其它芯片接收信号的接口电路。
参考图10，为本申请实施例提供的又一种通信装置示意图，用于实现以上实施例中安全网关、或策略控制网元的操作。如图10所示，该通信装置包括：处理器1010和接口1030，可选的，该通信装置还包括存储器1020。接口1030用于实现与其他设备进行通信。
以上实施例中第一网元、或会话管理网元执行的方法可以通过处理器1010调用存储器(可以是安全网关、或策略控制网元中的存储器1020，也可以是外部存储器)中存储的程序来实现。即，用于安全网关、或策略控制网元的装置可以包括处理器1010，该处理器1010通过调用存储器中的程序，以执行以上方法实施例中的安全网关、或策略控制网元执行的方法。这里的处理器可以是一种具有信号的处理能力的集成电路，例如CPU。用于第一网元、或会话管理网元的装置可以通过配置成实施以上方法的一个或多个集成电路来实现。例如：一个或多个ASIC，或，一个或多个微处理器DSP，或，一个或者多个FPGA等，或这些集成电路形式中至少两种的组合。或者，可以结合以上实现方式。
具体的，图8中的发送单元810、接收单元820和处理单元830的功能/实现过程可以通过图10所示的通信装置1000中的处理器1010调用存储器1020中存储的计算机可执行指令来实现。或者，图8中的处理单元830的功能/实现过程可以通过图10所示的通信装置1000中的处理器1010调用存储器1020中存储的计算机执行指令来实现，图8中的发送单元810和接收单元820的功能/实现过程可以通过图10中所示的通信装置1000中的接口1030来实现。
具体的，图9中的发送单元910、接收单元920和处理单元930的功能/实现过程可以通过图10所示的通信装置1000中的处理器1010调用存储器1020中存储的计算机可执行指令来实现。或者，图9中的处理单元930的功能/实现过程可以通过图10所示的通信装置1000中的处理器1010调用存储器1020中存储的计算机执行指令来实现，图9中的发送单元910和接收单元920的功能/实现过程可以通过图10中所示的通信装置1000中的接口1030来实现。
本领域普通技术人员可以理解：本申请中涉及的第一、第二、第三等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。“至少一个”是指一个或者多个。至少两个是指两个或者多个。“至少一个”、“任意一个”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个、种)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。“多个”是指两个或两个以上，其它量词与之类似。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。 当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个或多个示例性的设计中，本申请所描述的上述功能可以在硬件、软件、固件或这三者的任意组合来实现。如果在软件中实现，这些功能可以存储与电脑可读的媒介上，或以一个或多个指令或代码形式传输于电脑可读的媒介上。电脑可读媒介包括电脑存储媒介和便于使得让电脑程序从一个地方转移到其它地方的通信媒介。存储媒介可以是任何通用或特殊电脑可以接入访问的可用媒体。例如，这样的电脑可读媒体可以包括但不限于RAM、ROM、EEPROM、CD-ROM或其它光盘存储、磁盘存储或其它磁性存储装置，或其它任何可以用于承载或存储以指令或数据结构和其它可被通用或特殊电脑、或通用或特殊处理器读取形式的程序代码的媒介。此外，任何连接都可以被适当地定义为电脑可读媒介，例如，如果软件是从一个网站站点、服务器或其它远程资源通过一个同轴电缆、光纤电脑、双绞线、数字用户线(DSL)或以例如红外、无线和微波等无线方式传输的也被包含在所定义的电脑可读媒介中。所述的碟片(disk)和磁盘(disc)包括压缩磁盘、镭射盘、 光盘、数字通用光盘(英文：Digital Versatile Disc，简称：DVD)、软盘和蓝光光盘，磁盘通常以磁性复制数据，而碟片通常以激光进行光学复制数据。上述的组合也可以包含在电脑可读媒介中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。本申请说明书的上述描述可以使得本领域技术任何可以利用或实现本申请的内容，任何基于所公开内容的修改都应该被认为是本领域显而易见的，本申请所描述的基本原则可以应用到其它变形中而不偏离本申请的发明本质和范围。因此，本申请所公开的内容不仅仅局限于所描述的实施例和设计，还可以扩展到与本申请原则和所公开的新特征一致的最大范围。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (88)

  1. 一种通信方法，其特征在于，包括：
    策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；
    所述策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  2. 如权利要求1所述的通信方法，其特征在于，还包括：
    所述策略控制网元从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；
    所述策略控制网元根据所述业务描述信息，生成所述业务数据流描述信息。
  3. 如权利要求1或2所述的通信方法，其特征在于，所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息，包括：
    所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，
    所述策略控制网元从所述安全网关接收所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
  4. 如权利要求1-3任一所述的通信方法，其特征在于，还包括：
    所述策略控制网元确定所述业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，则向安全网关发送所述请求消息；或者，
    所述策略控制网元确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数不同，则向安全网关发送所述请求消息。
  5. 一种通信方法，其特征在于，包括：
    安全网关从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  6. 如权利要求5所述的通信方法，其特征在于，还包括：
    所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  7. 如权利要求5或6所述的通信方法，其特征在于，还包括：
    所述安全网关根据所述业务数据流描述信息，识别接收的业务数据流；
    所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述安全网关发送所述业务数据流的数据包。
  8. 如权利要求5-7任一所述的通信方法，其特征在于，所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，包括：
    所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，
    所述安全网关向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
  9. 一种通信方法，其特征在于，包括：
    安全网关从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；
    所述安全网关根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    所述安全网关向策略控制网元发送所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  10. 如权利要求9所述的通信方法，其特征在于，还包括：
    所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务描述信息之间的对应关系。
  11. 如权利要求9或10所述的通信方法，其特征在于，还包括：
    所述安全网关根据所述业务描述信息，识别接收的业务数据流；
    所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述安全网关发送所述业务数据流的数据包。
  12. 如权利要求9-11任一所述的通信方法，其特征在于，所述安全网关向策略控制网元发送所述业务数据流识别信息，包括：
    所述安全网关向所述策略控制网元发送上行SPI和/或下行SPI；或者，
    所述安全网关向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
  13. 如权利要求9-12任一所述的通信方法，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述安全网关根据所述业务信息，确定业务数据流识别信息，包括：
    所述安全网关确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
  14. 如权利要求9-13任一所述的通信方法，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述安全网关根据所述业务信息，确定业务数据流识别信息，包括：
    所述安全网关确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
  15. 如权利要求9-14任一所述的通信方法，其特征在于，还包括：
    所述安全网关向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
  16. 一种通信方法，其特征在于，包括：
    策略控制网元从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    所述策略控制网元根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  17. 如权利要求16所述的通信方法，其特征在于，所述策略控制网元从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，包括：
    所述策略控制网元从所述安全网关接收所述业务信息和所述业务信息对应的上行SPI和/或下行SPI；或者，
    所述策略控制网元从所述安全网关接收所述业务信息和所述业务信息对应的上行业务数据流索引和/或下行业务数据流索引。
  18. 一种通信方法，其特征在于，包括：
    安全网关从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    所述安全网关向所述策略控制网元发送响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  19. 如权利要求18所述的通信方法，其特征在于，还包括：
    所述安全网关向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  20. 如权利要求18或19所述的通信方法，其特征在于，还包括：
    所述安全网关根据所述业务数据流模板，识别接收的业务数据流；
    所述安全网关将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述安全网关发送所述业务数据流的数据包。
  21. 如权利要求18-20任一所述的通信方法，其特征在于，所述SPI包括上行SPI和/或下行SPI。
  22. 如权利要求18-20任一所述的通信方法，其特征在于，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
  23. 一种通信方法，其特征在于，包括：
    策略控制网元向安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    所述策略控制网元从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    所述策略控制网元根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  24. 如权利要求23所述的通信方法，其特征在于，还包括：
    所述策略控制网元从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；
    所述策略控制网元根据所述业务描述信息，生成所述业务数据流描述信息。
  25. 如权利要求23或24所述的通信方法，其特征在于，所述SPI包括上行SPI和/或下行SPI。
  26. 如权利要求23或24所述的通信方法，其特征在于，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
  27. 如权利要求23-26任一所述的通信方法，其特征在于，还包括：
    所述策略控制网元确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，
    所述策略控制网元确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
  28. 一种通信装置，其特征在于，包括：
    发送单元，用于向安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    接收单元，用于从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；
    处理单元，用于根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  29. 如权利要求28所述的通信装置，其特征在于，所述接收单元，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；
    所述处理单元，还用于根据所述业务描述信息，生成所述业务数据流描述信息。
  30. 如权利要求28或29所述的通信装置，其特征在于，所述接收单元，用于从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：
    用于从所述安全网关接收所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，
    用于从所述安全网关接收所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
  31. 如权利要求28-30任一所述的通信装置，其特征在于，所述处理单元，还用于确定所述业务数据流描述信息不能够与其他业务数据流描述信息合并至同一个PCC规则，则向安全网关发送所述请求消息；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数不同，则向安全网关发送所述请求消息。
  32. 一种通信装置，其特征在于，包括：
    接收单元，用于从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    发送单元，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  33. 如权利要求32所述的通信装置，其特征在于，所述发送单元，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  34. 如权利要求32或33所述的通信装置，其特征在于，所述装置还包括处理单元，用于根据所述业务数据流描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述发送单元，还用于发送所述业务数据流的数据包。
  35. 如权利要求32-34任一所述的通信装置，其特征在于，所述发送单元，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：
    用于向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，
    用于向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
  36. 一种通信装置，其特征在于，包括：
    接收单元，用于从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；
    处理单元，用于根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    发送单元，用于向策略控制网元发送所述业务数据流识别信息，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  37. 如权利要求36所述的通信装置，其特征在于，所述发送单元，还用于向所述终端设备发送所述业务数据流识别信息与所述业务描述信息之间的对应关系。
  38. 如权利要求36或37所述的通信装置，其特征在于，所述处理单元，还用于根据所述业务描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述发送单元，还用于发送所述业务数据流的数据包。
  39. 如权利要求36-38任一所述的通信装置，其特征在于，所述发送单元，用于向策略控制网元发送所述业务数据流识别信息，具体包括：
    用于向所述策略控制网元发送上行SPI和/或下行SPI；或者，
    用于向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
  40. 如权利要求36-39任一所述的通信装置，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述处理单元，用于根据所述业务信息，确定业务数据流识别信息，具体包括：
    用于确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
  41. 如权利要求36-39任一所述的通信装置，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述处理单元，用于根据所述业务信息，确定业务数据流识别信息，具体包括：
    用于确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
  42. 如权利要求36-41任一所述的通信装置，其特征在于，所述发送单元，还用于向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
  43. 一种通信装置，其特征在于，包括：
    接收单元，用于从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；
    处理单元，用于根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  44. 如权利要求43所述的通信装置，其特征在于，所述接收单元，用于从安全网关接收业务信息和所述业务信息对应的业务数据流识别信息，具体包括：
    用于从所述安全网关接收所述业务信息和所述业务信息对应的上行SPI和/或下行SPI；或者，
    用于从所述安全网关接收所述业务信息和所述业务信息对应的上行业务数据流索引和/或下行业务数据流索引。
  45. 一种通信装置，其特征在于，包括：
    接收单元，用于从策略控制网元接收请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    发送单元，用于向所述策略控制网元发送响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系，所述业务数据流识别信息用于生成策略控制计费PCC规则，以及用于识别携带所述业务数据流识别信息的数据包。
  46. 如权利要求45所述的通信装置，其特征在于，所述发送单元，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  47. 如权利要求45或46所述的通信装置，其特征在于，所述装置还包括处理单元，用于根据所述业务数据流模板，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；
    所述发送单元，还用于发送所述业务数据流的数据包。
  48. 如权利要求45-47任一所述的通信装置，其特征在于，所述SPI包括上行SPI和/或下行SPI。
  49. 如权利要求45-47任一所述的通信装置，其特征在于，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
  50. 一种通信装置，其特征在于，包括：
    发送单元，用于向安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    接收单元，用于从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；
    处理单元，用于根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  51. 如权利要求50所述的通信装置，其特征在于，所述接收单元，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；
    所述处理单元，还用于根据所述业务描述信息，生成所述业务数据流描述信息。
  52. 如权利要求50或51所述的通信装置，其特征在于，所述SPI包括上行SPI和/或下行SPI。
  53. 如权利要求50或51所述的通信装置，其特征在于，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
  54. 如权利要求50-53任一所述的通信装置，其特征在于，所述处理单元，还用于确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
  55. 一种通信***，其特征在于，包括安全网关和策略控制网元；
    所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求获取所述业务数据流描述信息对应的业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；从所述安全网关接收所述业务数据流描述信息对应的所述业务数据流识别信息；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包；
    所述安全网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息。
  56. 如权利要求55所述的通信***，其特征在于，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  57. 如权利要求55或56所述的通信***，其特征在于，所述安全网关，还用于根据所述业务数据流描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业务数据流的数据包。
  58. 如权利要求55-57任一所述的通信***，其特征在于，所述安全网关，用于向所述策略控制网元发送所述业务数据流描述信息对应的所述业务数据流识别信息，具体包括：
    用于向所述策略控制网元发送所述业务数据流描述信息对应的上行SPI和/或下行SPI；或者，
    用于向所述策略控制网元发送所述业务数据流描述信息对应的上行业务数据流索引和/或下行业务数据流索引。
  59. 如权利要求55-58任一所述的通信***，其特征在于，所述策略控制网元，还用于从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；根据所述业务描述信息，生成所述业务数据流描述信息。
  60. 如权利要求55-59任一所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
  61. 如权利要求60所述的通信***，其特征在于，所述***还包括所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
  62. 如权利要求55-59任一所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
  63. 一种通信***，其特征在于，包括安全网关和策略控制网元；
    所述安全网关，用于从应用功能网元接收业务信息，所述业务信息包含业务描述信息和/或业务需求信息，所述业务描述信息包含业务数据流过滤器或应用标识；根据所述业务信息，确定业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引；向策略控制网元发送所述业务数据流识别信息和所述业务信息；
    所述策略控制网元，用于从所述安全网关接收所述业务信息和所述业务数据流识别信息；根据所述业务数据流识别信息生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包。
  64. 如权利要求63所述的通信***，其特征在于，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务描述信息之间的对应关系。
  65. 如权利要求63或64所述的通信***，其特征在于，所述安全网关，还用于根据所述业务描述信息，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业务数据流的数据包。
  66. 如权利要求63-65任一所述的通信***，其特征在于，所述安全网关，用于向策略控制网元发送所述业务数据流识别信息，具体包括：
    用于向所述策略控制网元发送上行SPI和/或下行SPI；或者，
    用于向所述策略控制网元发送上行业务数据流索引和/或下行业务数据流索引。
  67. 如权利要求63-66任一所述的通信***，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述安全网关，用于根据所述业务信息，确定业务数据流识别信息，具体包括：
    用于确定所述业务需求信息与其他业务需求信息相同、且所述其他业务需求信息对应 所述业务数据流识别信息，则确定所述业务信息对应所述业务数据流识别信息。
  68. 如权利要求63-66任一所述的通信***，其特征在于，所述业务信息至少包含所述业务需求信息；
    所述安全网关，用于根据所述业务信息，确定业务数据流识别信息，具体包括：
    用于确定所述业务需求信息与其他业务需求信息不同、或者所述其他业务需求信息没有对应的业务数据流识别信息，则为所述业务信息生成所述业务数据流识别信息。
  69. 如权利要求63-68任一所述的通信***，其特征在于，所述安全网关，还用于向所述策略控制网元发送所述业务数据流识别信息与所述业务需求信息的对应关系。
  70. 如权利要求63-69任一所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
  71. 如权利要求70所述的通信***，其特征在于，所述***还包括所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
  72. 如权利要求63-69任所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
  73. 一种通信***，其特征在于，包括安全网关和策略控制网元；
    所述策略控制网元，用于向所述安全网关发送请求消息，所述请求消息包含业务数据流描述信息和业务数据流识别信息，所述业务数据流识别信息为安全参数索引SPI或业务数据流索引，所述业务数据流描述信息包含业务数据流过滤器或应用标识，所述请求消息用于请求建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；从所述安全网关接收响应消息，所述响应消息用于指示已经建立所述业务数据流描述信息与所述业务数据流识别信息的对应关系；根据所述业务数据流识别信息，生成策略控制计费PCC规则，所述业务数据流识别信息用于识别携带所述业务数据流识别信息的数据包；
    所述安全网关，用于从所述策略控制网元接收所述请求消息；向所述策略控制网元发送所述响应消息。
  74. 如权利要求73所述的通信***，其特征在于，所述安全网关，还用于向所述终端设备发送所述业务数据流识别信息与所述业务数据流描述信息之间的对应关系。
  75. 如权利要求73或74所述的通信***，其特征在于，所述安全网关，还用于根据所述业务数据流模板，识别接收的业务数据流；将所述业务数据流识别信息添加至所述业务数据流的数据包；发送所述业务数据流的数据包。
  76. 如权利要求73-75任一所述的通信***，其特征在于，所述SPI包括上行SPI和/或下行SPI。
  77. 如权利要求73-75任一所述的通信***，其特征在于，所述业务数据流索引包括上行业务数据流索引和/或下行业务数据流索引。
  78. 如权利要求73-77任一所述的通信***，其特征在于，所述策略控制网元，还用于 从应用功能网元接收授权请求，所述授权请求包含业务描述信息，所述业务描述信息包含所述业务数据流过滤器或所述应用标识；根据所述业务描述信息，生成所述业务数据流描述信息。
  79. 如权利要求73-78任一所述的通信***，其特征在于，所述策略控制网元，还用于确定所述业务数据流描述信息能够与其他业务数据流描述信息合并至同一个PCC规则，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系；或者，确定所述业务数据流描述信息对应的PCC规则的绑定参数与其他业务数据流描述信息对应的PCC规则的绑定参数相同，则确定建立所述业务数据流识别信息与所述业务数据流描述信息的对应关系。
  80. 如权利要求73-79任一所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包检测规则PDR，所述PDR包含所述业务数据流识别信息和服务质量流标识QFI；向用户面网元发送所述PDR。
  81. 如权利要求80所述的通信***，其特征在于，所述***还包括所述用户面网元，用于从所述会话管理网元接收所述PDR；识别携带所述业务数据流识别信息的数据包；根据所述业务数据流识别信息对应的所述QFI，执行服务质量QoS控制。
  82. 如权利要求73-79任一所述的通信***，其特征在于，所述***还包括会话管理网元；
    所述策略控制网元，还用于向所述会话管理网元发送所述PCC规则；
    所述会话管理网元，用于根据所述PCC规则生成包服务质量QoS规则，所述QoS规则包含所述业务数据流识别信息和QFI；向终端设备发送所述QoS规则。
  83. 一种策略控制网元，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述策略控制网元运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述策略控制网元执行如权利要求1-4任一项所述的通信方法、或执行如权利要求16或17所述的通信方法、或执行如权利要求23-27任一项所述的通信方法。
  84. 一种安全网关，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述安全网关运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述安全网关执行如权利要求5-8任一项所述的通信方法，或执行如权利要求9-15任一项所述的通信方法，或执行如权利要求18-22任一项所述的通信方法。
  85. 一种通信装置，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于从所述存储器调用并运行所述计算机程序，以执行如权利要求1-4任一项所述的通信方法，或执行如权利要求5-8任一项所述的通信方法，或执行如权利要求9-15任一项所述的通信方法，或执行如权利要求16或17所述的通信方法，或执行如权利要求18-22任一项所述的通信方法，或执行如权利要求23-27任一项所述的通信方法。
  86. 一种芯片***，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于从所述存储器调用并运行所述计算机程序，使得安装有所述芯片***的设备执行如权利要求1-4任一项所述的通信方法，或执行如权利要求5-8任一项所述的通 信方法，或执行如权利要求9-15任一项所述的通信方法，或执行如权利要求16或17所述的通信方法，或执行如权利要求18-22任一项所述的通信方法，或执行如权利要求23-27任一项所述的通信方法。
  87. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机程序或指令，当所述计算机程序或指令在处理器上运行时，使得处理器执行如权利要求1-4任一项所述的通信方法，或执行如权利要求5-8任一项所述的通信方法，或执行如权利要求9-15任一项所述的通信方法，或执行如权利要求16或17所述的通信方法，或执行如权利要求18-22任一项所述的通信方法，或执行如权利要求23-27任一项所述的通信方法。
  88. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1-4任一项所述的通信方法，或实现如权利要求5-8任一项所述的通信方法，或实现如权利要求9-15任一项所述的通信方法，或实现如权利要求16或17所述的通信方法，或实现如权利要求18-22任一项所述的通信方法，或实现如权利要求23-27任一项所述的通信方法。
PCT/CN2021/089411 2020-06-29 2021-04-23 通信方法、装置及*** WO2022001324A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010607276.1 2020-06-29
CN202010607276.1A CN113873453B (zh) 2020-06-29 2020-06-29 通信方法、装置、***及介质

Publications (1)

Publication Number Publication Date
WO2022001324A1 true WO2022001324A1 (zh) 2022-01-06

Family

ID=78980972

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/089411 WO2022001324A1 (zh) 2020-06-29 2021-04-23 通信方法、装置及***

Country Status (2)

Country Link
CN (1) CN113873453B (zh)
WO (1) WO2022001324A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114466347B (zh) * 2022-01-10 2023-11-24 海能达通信股份有限公司 数据报文处理方法及装置
CN114885332B (zh) * 2022-05-05 2023-08-08 中国电信股份有限公司 流量处理方法及装置、存储介质及电子设备
CN117062210A (zh) * 2022-05-06 2023-11-14 中国电信股份有限公司 一种通信方法及相关设备
CN117376900A (zh) * 2022-06-29 2024-01-09 华为技术有限公司 一种通信方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103248451A (zh) * 2012-02-09 2013-08-14 华为技术有限公司 业务速率控制方法和***以及设备
CN103392352A (zh) * 2012-12-31 2013-11-13 华为技术有限公司 策略和计费控制方法及设备
CN104955085A (zh) * 2014-03-24 2015-09-30 中兴通讯股份有限公司 一种漫游场景下的应用检测控制方法及v-pcrf
US20190254118A1 (en) * 2018-02-15 2019-08-15 Huawei Technologies Co., Ltd. Supporting multiple qos flows for unstructured pdu sessions in wireless system using non-standardized application information

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090300207A1 (en) * 2008-06-02 2009-12-03 Qualcomm Incorporated Pcc enhancements for ciphering support
WO2018006079A1 (en) * 2016-06-30 2018-01-04 Parallel Wireless, Inc. Intelligent ran flow management and distributed policy enforcement
CN108064032A (zh) * 2016-11-07 2018-05-22 中兴通讯股份有限公司 一种应用检测控制方法及装置
CN109286567B (zh) * 2018-11-23 2020-07-28 腾讯科技（深圳）有限公司 路由选择策略的获取方法、装置及设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103248451A (zh) * 2012-02-09 2013-08-14 华为技术有限公司 业务速率控制方法和***以及设备
CN103392352A (zh) * 2012-12-31 2013-11-13 华为技术有限公司 策略和计费控制方法及设备
CN104955085A (zh) * 2014-03-24 2015-09-30 中兴通讯股份有限公司 一种漫游场景下的应用检测控制方法及v-pcrf
US20190254118A1 (en) * 2018-02-15 2019-08-15 Huawei Technologies Co., Ltd. Supporting multiple qos flows for unstructured pdu sessions in wireless system using non-standardized application information

Also Published As

Publication number Publication date
CN113873453B (zh) 2022-11-18
CN113873453A (zh) 2021-12-31

Similar Documents

Publication Publication Date Title
US11695742B2 (en) Security implementation method, device, and system
WO2022001324A1 (zh) 通信方法、装置及***
CN107409125B (zh) 用于服务-用户平面方法的使用网络令牌的高效策略实施
WO2019033920A1 (zh) 网络侧对远端用户设备的识别和控制方法以及设备
JP2018517352A (ja) ネットワークアクセストークンを使用したダウンリンクトラフィックのための効率的なポリシー実施−制御プレーン手法
WO2020052414A1 (zh) 一种数据保护方法、设备及***
US11516118B2 (en) Methods and nodes for enabling management of traffic
WO2021227559A1 (zh) 通信方法、装置及***
WO2020135011A1 (zh) 传输方法、装置、报文发送端和接收端
US20210219137A1 (en) Security management between edge proxy and internetwork exchange node in a communication system
WO2022021971A1 (zh) 通信方法、第一策略控制网元及通信***
CN110024427B (zh) 用于更新安全密钥的方法、装置以及计算机可读介质
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
WO2022222745A1 (zh) 一种通信方法及装置
WO2021204277A1 (zh) 通信方法、装置及***
US20210168614A1 (en) Data Transmission Method and Device
WO2018176187A1 (zh) 数据传输方法、用户设备和控制面节点
WO2022067736A1 (zh) 一种通信方法及装置
JP2022507141A (ja) ショートメッセージに適したメッセージ認証コードを提供するための方法及び装置
WO2023001010A1 (zh) 一种通信方法以及装置
US20230336535A1 (en) Method, device, and system for authentication and authorization with edge data network
WO2024001524A1 (zh) 一种通信方法及装置
WO2022067699A1 (zh) 业务数据流的传输方法、通信装置及通信***
US11902260B2 (en) Securing control/user plane traffic
NZ755869B2 (en) Security implementation method, device and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21831499

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21831499

Country of ref document: EP

Kind code of ref document: A1