WO2022068219A1 - 虚拟专有拨号网络接入方法、网络侧***、***和存储介质 - Google Patents

虚拟专有拨号网络接入方法、网络侧***、***和存储介质 Download PDF

Info

Publication number
WO2022068219A1
WO2022068219A1 PCT/CN2021/094571 CN2021094571W WO2022068219A1 WO 2022068219 A1 WO2022068219 A1 WO 2022068219A1 CN 2021094571 W CN2021094571 W CN 2021094571W WO 2022068219 A1 WO2022068219 A1 WO 2022068219A1
Authority
WO
WIPO (PCT)
Prior art keywords
vpdn
network
target
smf
service
Prior art date
Application number
PCT/CN2021/094571
Other languages
English (en)
French (fr)
Inventor
黎明雪
龙彪
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Priority to EP21873881.3A priority Critical patent/EP4207847A4/en
Priority to US18/028,988 priority patent/US20230336993A1/en
Priority to JP2023519727A priority patent/JP2023540403A/ja
Publication of WO2022068219A1 publication Critical patent/WO2022068219A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/16—Interfaces between hierarchically similar devices
    • H04W92/24—Interfaces between hierarchically similar devices between backbone network devices

Definitions

  • the present disclosure relates to the technical field of mobile communications, and in particular, to a VPDN (Virtual Private Dial-up Networks, virtual private dial-up network) access method, a network-side system, a system and a storage medium.
  • VPDN Virtual Private Dial-up Networks, virtual private dial-up network
  • VPDN is a virtual private network technology that communicates through encrypted tunnels on the public network. VPDN users can connect to the user network inside the user through the virtual security channel through the public network, but users on the public network cannot access the resources inside the user network through the virtual channel.
  • PAP/CHAP The authentication and authorization mechanism used in traditional VPDN services is PAP/CHAP: PAP (Password Authentiaciton Protocol, password authentication protocol) establishes authentication through two handshakes, and the peer node continues to repeatedly send ID/password (plain text) to the verifier until authentication Get a response or connection termination, which is common in PPPOE (Point-to-Point Protocol Over Ethernet) dial-up environment; CHAP (Challenge Handshake Authenticaiton Protocol, Challenge Handshake Authentication Protocol) verifies the identity of the authenticated party through a three-way handshake (cipher text), which is completed when the initial link is established. In order to improve the security, periodic verification is performed after the link is established, which is relatively common in the remote access environment of the enterprise network.
  • An object of the present disclosure is to propose a solution for accessing a VPDN through a 5G network.
  • a VPDN access method including: an AMF (Access and Mobility Management Function, access and mobility management function) receives a VPDN access request from a user, and the VPDN access request is Including the DNN (Data Network Name, data network name) of the target VPDN, the account and key of the target VPDN; AMF determines the target SMF (Session Management Function, session management function) that supports the VPDN service through NRF (NF Repository Function, network storage function).
  • AMF Access and Mobility Management Function, access and mobility management function
  • DNN Data Network Name, data network name
  • NRF NF Repository Function, network storage function
  • the SMF selects a UPF (User Plane Function, user plane function) that supports the VPDN service to establish a session, so as to establish a tunnel with the target VPDN through the UPF.
  • UPF User Plane Function, user plane function
  • the AMF determining the target SMF supporting the VPDN service through the NRF includes: the AMF sends a network function discovery request to the NRF, and the network function discovery request includes the DNN of the target VPDN; the NRF determines the SMF supporting the VPDN service according to the DNN as the target SMF feeds back to AMF.
  • the UPF that supports the VPDN service is a UPF that supports L2TP (Layer 2 Tunneling Protocol, Layer 2 Tunneling Protocol).
  • L2TP Layer 2 Tunneling Protocol, Layer 2 Tunneling Protocol
  • the VPDN access request is carried by a NAS (Non-access stratum, non-access stratum) message.
  • NAS Non-access stratum, non-access stratum
  • the VPDN access method further includes: if the NRF does not query the SMF that supports the VPDN service, the establishment of the VPDN service session fails.
  • the VPDN access method further includes: if the SMF does not find a UPF that supports the VPDN service, the establishment of the VPDN service session fails.
  • the VPDN access method further includes: the UPF receives a session establishment request from the SMF, and when it is determined that the session is a VPDN service, establishing a tunnel so that the target VPDN authenticates the account and key.
  • a VPDN access method including: a user terminal initiates a VPDN service request on a 5G network, and the VPDN service request includes the account and key of the target VPDN; VPDN access method performed by the network side.
  • a virtual private dial-up network access network side system including: an AMF configured to receive a VPDN access request from a user, where the VPDN access request includes a target VPDN DNN, the account and key of the target VPDN; determine the target SMF that supports the VPDN service through the NRF, and send a session management context request to the target SMF; NRF, is configured to determine the SMF that supports the VPDN service, and feeds it back to the AMF as the target SMF; SMF , which is configured to select a UPF that supports the VPDN service to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF.
  • the VPDN access system further includes: a UPF configured to receive a session establishment request from the SMF, and if it is determined that the session is a VPDN service, establish a tunnel so that the target VPDN can authenticate the account and key.
  • a UPF configured to receive a session establishment request from the SMF, and if it is determined that the session is a VPDN service, establish a tunnel so that the target VPDN can authenticate the account and key.
  • a virtual private dial-up network access network side system comprising: a memory; and a processor coupled to the memory, the processor being configured to execute based on instructions stored in the memory Any of the VPDN access methods mentioned above.
  • a virtual private dial-up network access system including: any one of the above-mentioned virtual private dial-up network access network side systems; and a user terminal, configured To initiate a VPDN service request on the 5G network, the VPDN service request includes the account and key of the target VPDN.
  • a non-transitory computer-readable storage medium having computer program instructions stored thereon, the instructions implementing any of the aforementioned VPDN accesses when executed by a processor steps of the method.
  • FIG. 1 is a flowchart of some embodiments of the VPDN access method of the present disclosure.
  • FIG. 2 is a flowchart of other embodiments of the VPDN access method of the present disclosure.
  • FIG. 3A is a signaling interaction diagram of some embodiments of the disclosed VPDN access method.
  • FIG. 3B is a signaling interaction diagram of other embodiments of the VPDN access method of the present disclosure.
  • FIG. 4A is a schematic diagram of some embodiments of the VPDN access network side system of the present disclosure.
  • FIG. 4B is a schematic diagram of some embodiments of the network architecture of the VPDN access network side system of the present disclosure.
  • FIG. 5 is a schematic diagram of other embodiments of the VPDN access network side system of the present disclosure.
  • FIG. 6 is a schematic diagram of further embodiments of the VPDN access network side system of the present disclosure.
  • FIG. 7 is a schematic diagram of some embodiments of the VPDN access system of the present disclosure.
  • FIG. 1 The flowchart of some embodiments of the VPDN access method of the present disclosure is shown in FIG. 1 .
  • the AMF receives the VPDN access request from the user.
  • the VPDN access request includes the DNN of the target VPDN, and the account number and key of the target VPDN.
  • the VPDN access request can be carried by a NAS message, for example, the ePCO information element is added to support the PAP/CHAP feature, so that it carries the VPDN service identifier: VPDN account number and password.
  • the VPDN access request may be carried by a PDU session establishment request.
  • the user terminal when a user needs to initiate a VPDN access request, the user terminal sends a VPDN access request that supports the PAP/CHAP feature, such as adding support for the PAP/CHAP feature in the ePCO cell, so that it carries the VPDN service Identification: VPDN account and password.
  • the VPDN access request further includes the DNN of the target VPDN.
  • the AMF determines the target SMF that supports the VPDN service through the NRF.
  • the NRF determines the SMF that supports the VPDN according to the stored information, and feeds it back to the AMF as the target SMF.
  • step 103 the AMF sends a session management context request to the target SMF according to the feedback information of the NRF.
  • the SMF selects a UPF that supports the VPDN service to establish a session according to the session management context request.
  • the tunnel technology adopted by the VPDN service is currently widely used L2TP, so the UPF supporting the VPDN service is the UPF supporting L2TP.
  • the session management context request may carry DNN information, so that the UPF determines that the session is for VPDN services.
  • the UPF establishes a tunnel with the target private network when determining that the session to be established is for the VPDN service.
  • This method can improve the support of 5G network element equipment for VPDN service characteristics, realize 5G network to smoothly undertake traditional VPDN services based on PAP/CHAP authentication, and improve the convenience of VPDN access; there is no need for existing enterprises on the client side.
  • the modification of private network equipment is conducive to rapid deployment and application promotion.
  • FIG. 2 The flowchart of other embodiments of the VPDN access method of the present disclosure is shown in FIG. 2 .
  • the AMF receives a VPDN access request from the user, and the VPDN access request includes the DNN of the target VPDN, and the account and key of the target VPDN.
  • step 202 the AMF sends a network function discovery request to the NRF, and the network function discovery request includes the DNN of the target VPDN.
  • step 203 the NRF determines according to the DNN that it needs to provide the AMF with an SMF supporting the VPDN service.
  • step 204 the NRF determines whether the SMF supporting the VPDN service is queried. If the SMF supporting the VPDN service cannot be queried, step 205 is executed; if the SMF supporting the VPDN service is queried, step 206 is executed.
  • step 205 it is determined that the establishment of the VPDN service session fails.
  • the session establishment failure may be reported to the user.
  • step 206 one of the found SMFs supporting the VPDN service is used as the target SMF, and the target SMF is fed back to the AMF.
  • step 207 the AMF sends a session management context request to the target SMF.
  • the SMF determines that a UPF supporting the VPDN service needs to be selected according to the session management context request.
  • the session management context request may carry the DNN information of the target VPDN, so that the SMF determines that the request is for the VPDN service, and then executes the selection of the UPF that supports the VPDN service.
  • step 209 the SMF determines whether a UPF supporting the VPDN service is queried. If the UPF that supports the VPDN service cannot be queried, step 205 is performed. If a UPF supporting the VPDN service is found, step 210 is executed.
  • step 210 the AMF establishes a session with the determined UPF in order to cause the UPF to establish a tunnel with the target VPDN.
  • the network element of the 5G network can identify and process the access request for the VPDN from the user terminal, realize the access to the VPDN through the 5G network, and improve the convenience of accessing the VPDN; in the process of session establishment, in the In the case of no UPF capable of supporting VPDN, it responds to the establishment failure in time to improve reliability.
  • the VPDN access method may further include steps 211-213.
  • the UPF receives a session establishment request from the SMF.
  • the session establishment request may include the DNN of the target VPDN, and the account number and key of the target VPDN.
  • step 212 the UPF determines whether the session to be established is for the VPDN service. If it is determined that it is for the VPDN service, step 213 is executed; if it is not for the VPDN service, the corresponding processing flow for other services in the related art is executed.
  • the UPF establishes an L2TP tunnel with the target VPDN so that the target VPDN can authenticate the account and key.
  • the LNS and AAA of the VPDN may perform PAP or CHAP authentication on the user according to the account and key of the target VPDN. If the verification is passed, the establishment of the VPDN service is successful; if the verification is not passed, the establishment of the VPDN service is unsuccessful.
  • the information required by the VPDN to authenticate the user can be further provided, thereby ensuring the security of the VPDN while ensuring that the 5G network supports access to the VPDN.
  • the signaling interaction diagram of some embodiments of the VPDN access method of the present disclosure is shown in FIG. 3A .
  • the connection relationship of the network elements involved in the VPDN access method may be as shown in FIG. 4B , the network mainly includes two parts, the 5G network and the enterprise network as the VPDN, and the user connects to the enterprise network via the 5G network.
  • the terminal UE sends a PDU Session Establishment Request (a PDU session establishment request) to the AMF, and the request includes the DNN, and the account number and key of the target VPDN carried by the information element ePCO.
  • the AMF sends an NF Discover Request to the NRF.
  • the NRF identifies the DNN that includes the VPDN in the request, and determines that the SMF that supports the VPDN needs to be queried.
  • the NRF finds an SMF supporting VPDN, it is fed back to the AMF as the target SMF.
  • the AMF provides the SMF with the DNN, and the user's account and key at the target VPDN through the Create SM Context Request (SM context establishment request).
  • the SMF initiates a Subscription Retrieval (subscription retrieval) to the UDM, and feeds back the Create SM Context Response (context establishment response) to the AMF.
  • Subscription Retrieval subscription retrieval
  • Create SM Context Response context establishment response
  • the SMF selects a UPF supporting the VPDN service characteristics, such as a UPF device supporting L2TP, according to the service characteristics of the session.
  • the SMF sends the N4 Session Establishment Request session establishment request to the selected UPF, sends the DNN and VPDN authentication information to the UPF through the request, and the UPF responds with the N4 Session Establishment Response.
  • the SMF informs the terminal that the PDU session is successfully established through the AMF and the RAN (Radio Access Network, radio access network).
  • the RAN Radio Access Network, radio access network
  • the flow of the 5G system accessing the VPDN service is shown in FIG. 3B , and the CHAP authentication mechanism is used as an example in the figure.
  • the connection relationship of the network elements involved in the VPDN access method may be as shown in FIG. 4B .
  • the PDU Session Establishment Request sent by the user terminal to the UPF includes the DNN, and the account number and key of the target VPDN.
  • the PDU Session Establishment Request is sent to the UPF through the processes of 301 to 309 above.
  • the UPF establishes an L2TP tunnel with the relevant LNS through the public network under the condition that it is determined that the session to be established is for the VPDN service.
  • the private network device of the VPDN performs CHAP authentication on the VPDN user.
  • the verification process is the same as in the related art.
  • the terminal has the DNN of the private network in the VPDN session.
  • 5G The access method combines the original authentication system and authorization mechanism to access the virtual private network of the enterprise and the closed site, so as to better realize the connection between the enterprise and each branch, between the branch and the branch, and between the enterprise and the partner. of various network communications.
  • the implementation process of such a method does not need to improve the interior of the VPDN, which improves the deployment efficiency, reduces the implementation difficulty, and is conducive to popularization and application.
  • FIG. 4A A schematic diagram of some embodiments of the VPDN access network side system of the present disclosure is shown in FIG. 4A .
  • the AMF 401 can receive the VPDN access request from the user, and the VPDN access request includes the DNN of the target VPDN, the account number and key of the target VPDN; the AMF 401 can determine the target SMF that supports the VPDN service through the NRF, and send the session to the target SMF Manage contextual requests.
  • the session management context request may carry the DNN information of the target VPDN, so that the SMF determines that the request is for the VPDN service, and then executes the selection of the UPF that supports the VPDN service.
  • the NRF 402 can determine the SMF that supports the VPDN service, and feed it back to the AMF as the target SMF.
  • the NRF can determine whether the request from the AMF includes the DNN of the VPDN, and in the case of determining that the DNN of the VPDN is included, the NRF initiates a search for an SMF that supports the VPDN service, and provides the found SMF as the target SMF to the AMF , so as to ensure the ability of subsequent nodes to support VPDN.
  • the SMF 403 can select a UPF that supports the VPDN service to establish a session according to the session management context request, so as to establish a tunnel with the target VPDN through the UPF.
  • the SMF 403 may determine whether the request from the AMF includes the DNN of the VPDN, and in the case of determining that the DNN of the VPDN is included, initiate a search for a UPF that supports the VPDN service, thereby ensuring the support capability of the subsequent node for the VPDN.
  • Such a network-side system improves the support of 5G network element equipment for VPDN service characteristics, realizes the use of 5G network access to virtual private networks, and improves the convenience of VPDN access; there is no need for existing enterprise private network equipment on the client side. Making changes is conducive to rapid deployment and promotion of applications.
  • the VPDN access system may further include a UPF 404 capable of receiving a session establishment request from the SMF and establishing a tunnel if the session is determined to be for VPDN services.
  • the UPF after completing the tunnel establishment, the UPF provides the user's account number and key to the VPDN for verification by the VPDN's equipment.
  • Such a network-side system can further provide the information required by the VPDN to authenticate the user after the tunnel is established, thereby ensuring the security of the VPDN while ensuring that the 5G network supports access to the VPDN.
  • connection relationship of each part in the VPDN access system can be as shown in FIG. 4B , so that on the basis of the existing 5G network and private network, the VPDN can be realized only by expanding the functions of the 5G network equipment access, reducing the difficulty of implementation.
  • the VPDN access network side system includes a memory 501 and a processor 502.
  • the memory 501 may be a magnetic disk, a flash memory or any other non-volatile storage medium.
  • the memory is used to store the instructions in the corresponding embodiments of the VPDN access method above.
  • the processor 502 is coupled to the memory 501 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller.
  • the processor 502 is configured to execute the instructions stored in the memory, which can improve the convenience of VPDN access and facilitate rapid deployment and popularization of applications.
  • the VPDN access network side system 600 includes a memory 601 and a processor 602 .
  • Processor 602 is coupled to memory 601 through BUS bus 603 .
  • the VPDN access network side system 600 can also be connected to an external storage device 605 through a storage interface 604 to call external data, and can also be connected to a network or another computer system (not shown) through a network interface 606 . It will not be described in detail here.
  • the data instructions are stored in the memory, and the above instructions are processed by the processor, which can improve the convenience of VPDN access, and is conducive to rapid deployment and popularization and application.
  • a computer-readable storage medium stores computer program instructions thereon, and when the instructions are executed by a processor, implements the steps of the method in the corresponding embodiment of the VPDN access method.
  • embodiments of the present disclosure may be provided as a method, apparatus, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein .
  • FIG. 7 A schematic diagram of some embodiments of the VPDN access system of the present disclosure is shown in FIG. 7 .
  • the VPDN access network side system 71 may be any of the above mentioned systems.
  • the VPDN access system further includes user terminals 721-72n, where n is a positive integer.
  • the user terminal sends a VPDN access request that supports the PAP/CHAP feature.
  • the ePCO cell adds support for the PAP/CHAP feature to carry the VPDN service identifier: VPDN account number and password .
  • the VPDN access request further includes the DNN of the target VPDN.
  • the user terminal can actively provide the relevant information of VPDN authentication when initiating a request, and the network side can identify the information, so as to select a network element capable of processing VPDN services to process the service request, and then access the virtual private network to improve the It improves the convenience and efficiency of VPDN access.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flows of the flowcharts and/or the block or blocks of the block diagrams.
  • the methods and apparatuses of the present disclosure may be implemented in many ways.
  • the methods and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware.
  • the above-described order of steps of the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above unless specifically stated otherwise.
  • the present disclosure can also be implemented as programs recorded in a recording medium, the programs including machine-readable instructions for implementing methods according to the present disclosure.
  • the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提出一种虚拟专有拨号网络接入方法、网络侧***、***和存储介质，涉及移动通信技术领域。本公开的一种虚拟专有拨号网络接入方法，包括：接入和移动管理功能AMF接收来自用户的VPDN接入请求，VPDN接入请求中包括目标VPDN的数据网络名称DNN，目标VPDN的账号和密钥；AMF通过网络存储功能NRF确定支持VPDN业务的目标会话管理功能SMF，并向目标SMF发送会话管理上下文请求；SMF根据会话管理上下文请求，选择支持VPDN业务的用户面功能UPF建立会话，以便通过UPF建立与目标VPDN之间的隧道。通过这样的方法，能够提高5G网元设备对VPDN业务特性的支持度，提高了VPDN接入的便捷度；无需对客户侧现有企业专网设备进行改动，有利于快速部署和推广应用。

Description

虚拟专有拨号网络接入方法、网络侧***、***和存储介质
相关申请的交叉引用
本申请是以CN申请号为202011052664.4，申请日为2020年9月29日的申请为基础，并主张其优先权，该CN申请的公开内容在此作为整体引入本申请中。
技术领域
本公开涉及移动通信技术领域，特别是一种VPDN(Virtual Private Dial-up Networks，虚拟专有拨号网络)接入方法、网络侧***、***和存储介质。
背景技术
VPDN是一种在公网上通过加密隧道进行通信的虚拟专网技术。VPDN用户可以经过公共网络，通过虚拟的安全通道与用户内部的用户网络进行连接，而公共网络上的用户则无法穿过虚拟通道访问用户网络内部的资源。
传统VPDN业务采用的认证和授权机制是PAP/CHAP：PAP(Password Authentiaciton Protocol，密码认证协议)是通过两次握手建立认证，对等节点持续重复发送ID/密码(明文)给验证者，直至认证得到响应或连接终止，常见于PPPOE(Point-to-Point Protocol Over Ethernet，以太网上的点对点协议)拨号环境中；CHAP(Challenge Handshake Authenticaiton Protocol，质询握手认证协议)通过三次握手验证被认证方的身份(密文)，在初始链路建立时完成，为了提高安全性，在链路建立之后周期性进行验证，目前在企业网的远程接入环境中比较常见。
发明内容
本公开的一个目的在于提出一种通过5G网络接入VPDN的方案。
根据本公开的一些实施例的一个方面，提出一种VPDN接入方法，包括：AMF(Access and Mobility Management Function，接入和移动管理功能)接收来自用户的VPDN接入请求，VPDN接入请求中包括目标VPDN的DNN(Data Network Name，数据网络名称)，目标VPDN的账号和密钥；AMF通过NRF(NF Repository Function，网络存储功能)确定支持VPDN业务的目标SMF(Session Management Function，会话管理功能)，并向目标SMF发送会话管理上下文请求；SMF根据会话管理上下 文请求，选择支持VPDN业务的UPF(User Plane Function，用户面功能)建立会话，以便通过UPF建立与目标VPDN之间的隧道。
在一些实施例中，AMF通过NRF确定支持VPDN业务的目标SMF包括：AMF向NRF发送网络功能发现请求，网络功能发现请求中包括目标VPDN的DNN；NRF根据DNN确定支持VPDN业务的SMF，作为目标SMF反馈给AMF。
在一些实施例中，支持VPDN业务的UPF为支持L2TP(Layer 2 Tunneling Protocol，第二层隧道协议)的UPF。
在一些实施例中，VPDN接入请求由NAS(Non-access stratum，非接入层)消息承载。
在一些实施例中，VPDN接入方法还包括：若NRF未查询到支持VPDN业务的SMF，则VPDN业务会话建立失败。
在一些实施例中，VPDN接入方法还包括：若SMF未查询到支持VPDN业务的UPF，则VPDN业务会话建立失败。
在一些实施例中，VPDN接入方法还包括：UPF接收来自SMF的会话建立请求，在确定会话为VPDN业务的情况下，建立隧道，以便目标VPDN对账号和密钥进行认证。
根据本公开的一些实施例的一个方面，提出一种VPDN接入方法，包括：用户终端在5G网络发起VPDN业务请求，VPDN业务请求中包括目标VPDN的账号和密钥；和上文中任意一种由网络侧执行的VPDN接入方法。
根据本公开的一些实施例的一个方面，提出一种虚拟专有拨号网络接入网络侧***，包括：AMF，被配置为接收来自用户的VPDN接入请求，VPDN接入请求中包括目标VPDN的DNN，目标VPDN的账号和密钥；通过NRF确定支持VPDN业务的目标SMF，并向目标SMF发送会话管理上下文请求；NRF，被配置为确定支持VPDN业务的SMF，作为目标SMF反馈给AMF；SMF，被配置为根据会话管理上下文请求，选择支持VPDN业务的UPF建立会话，以便通过UPF建立与目标VPDN之间的隧道。
在一些实施例中，VPDN接入***还包括：UPF，被配置为接收来自SMF的会话建立请求，在确定会话为VPDN业务的情况下，建立隧道，以便目标VPDN对账号和密钥进行认证。
根据本公开的一些实施例的一个方面，提出一种虚拟专有拨号网络接入网络侧***，包括：存储器；以及耦接至存储器的处理器，处理器被配置为基于存储在存储器 的指令执行上文中提到的任意一种VPDN接入方法。
根据本公开的一些实施例的一个方面，提出一种虚拟专有拨号网络接入***，包括：上文中提到的任意一种虚拟专有拨号网络接入网络侧***；和用户终端，被配置为在5G网络发起VPDN业务请求，VPDN业务请求中包括目标VPDN的账号和密钥。
根据本公开的一些实施例的一个方面，提出一种非瞬时性计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现上文中提到的任意一种VPDN接入方法的步骤。
附图说明
此处所说明的附图用来提供对本公开的进一步理解，构成本公开的一部分，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1为本公开的VPDN接入方法的一些实施例的流程图。
图2为本公开的VPDN接入方法的另一些实施例的流程图。
图3A为本公开的VPDN接入方法的一些实施例的信令交互图。
图3B为本公开的VPDN接入方法的另一些实施例的信令交互图。
图4A为本公开的VPDN接入网络侧***的一些实施例的示意图。
图4B为本公开的VPDN接入网络侧***的网络架构的一些实施例的示意图。
图5为本公开的VPDN接入网络侧***的另一些实施例的示意图。
图6为本公开的VPDN接入网络侧***的又一些实施例的示意图。
图7为本公开的VPDN接入***的一些实施例的示意图。
具体实施方式
下面通过附图和实施例，对本公开的技术方案做进一步的详细描述。
本公开的VPDN接入方法的一些实施例的流程图如图1所示。
在步骤101中，AMF接收来自用户的VPDN接入请求。在一些实施例中，VPDN接入请求中包括目标VPDN的DNN，以及目标VPDN的账号和密钥。
在一些实施例中，VPDN接入请求可以通过NAS消息承载，例如在ePCO信元新增支持PAP/CHAP特性，使其携带VPDN业务标识：VPDN账号和密码。在一些实施例中，VPDN接入请求可以通过PDU会话建立请求承载。
在一些实施例中，当用户需要发起接入VPDN的请求时，用户终端发送携带支持PAP/CHAP特性的VPDN接入请求，如在ePCO信元新增支持PAP/CHAP特性，使其携带VPDN业务标识：VPDN账号和密码。在一些实施例中，VPDN接入请求中还包括目标VPDN的DNN。
在步骤102中，AMF通过NRF确定支持VPDN业务的目标SMF。在一些实施例中，NRF在确定当前的会话建立请求为针对VPDN业务时，根据存储的信息确定支持VPDN的SMF，作为目标SMF反馈给AMF。
在步骤103中，AMF根据NRF的反馈信息，向目标SMF发送会话管理上下文请求。
在步骤104中，SMF根据会话管理上下文请求，选择支持VPDN业务的UPF建立会话。在一些实施例中，VPDN业务采用的隧道技术，目前使用广泛的是L2TP，因此支持VPDN业务的UPF为支持L2TP的UPF。
在一些实施例中，会话管理上下文请求中可以携带DNN信息，以便UPF确定会话为针对VPDN业务。在一些实施例中，UPF在确定要建立的会话为针对VPDN业务时，建立与目标专网之间的隧道。
通过这样的方法，能够提高5G网元设备对VPDN业务特性的支持度，实现5G网络平滑承接传统基于PAP/CHAP认证的VPDN业务，提高了VPDN接入的便捷度；无需对客户侧现有企业专网设备进行改动，有利于快速部署和推广应用。
本公开的VPDN接入方法的另一些实施例的流程图如图2所示。
在步骤201中，AMF接收来自用户的VPDN接入请求，VPDN接入请求中包括目标VPDN的DNN，以及目标VPDN的账号和密钥。
在步骤202中，AMF向NRF发送网络功能发现请求，网络功能发现请求中包括目标VPDN的DNN。
在步骤203中，NRF根据DNN确定需要向AMF提供支持VPDN业务的SMF。
在步骤204中，NRF判断是否查询到支持VPDN业务的SMF。若未能查询到支持VPDN业务的SMF，则执行步骤205；若查询到支持VPDN业务的SMF，则执行步骤206。
在步骤205中，确定VPDN业务会话建立失败。在一些实施例中，可以向用户反馈会话建立失败。
在步骤206中，将查找到的其中一个支持VPDN业务的SMF作为目标SMF，并 将该目标SMF反馈给AMF。
在步骤207中，AMF向目标SMF发送会话管理上下文请求。
在步骤208中，SMF根据会话管理上下文请求，确定需要选择支持VPDN业务的UPF。在一些实施例中，会话管理上下文请求中可以携带目标VPDN的DNN信息，以便SMF确定该请求为针对VPDN业务，进而执行选择支持VPDN业务的UPF。
在步骤209中，SMF判断是否查询到支持VPDN业务的UPF。若未能查询到支持VPDN业务的UPF，则执行步骤205。若查询到支持VPDN业务的UPF，则执行步骤210。
在步骤210中，AMF与确定的UPF建立会话，以便促使UPF建立与目标VPDN之间的隧道。
通过这样的方法，5G网络的网元能够识别并处理来自用户终端的对于VPDN的接入请求，实现通过5G网络接入VPDN，提高了接入VPDN的便捷性；在会话建立的过程中，在不具备支持VPDN能力的UPF的情况下，及时做出建立失败的响应，提高可靠性。
在一些实施例中，如图2所示，VPDN接入方法还可以包括步骤211～213。
在步骤211中，UPF接收来自SMF的会话建立请求。在一些实施例中，会话建立请求中可以包括目标VPDN的DNN，以及目标VPDN的账号和密钥。
在步骤212中，UPF判断要建立的会话是否为针对VPDN业务。若确定针对VPDN业务，则执行步骤213；若并非针对VPDN业务，则执行相关技术中对其他业务的对应处理流程。
在步骤213中，UPF建立与目标VPDN之间的L2TP隧道，以便目标VPDN对账号和密钥进行认证。在一些实施例中，VPDN的LNS和AAA可以根据目标VPDN的账号和密钥对用户进行PAP或CHAP验证。若验证通过，则VPDN业务建立成功；若验证不通过，则VPDN业务建立不成功。
通过这样的方法，能够在完成隧道建立后，进一步提供VPDN对用户进行验证所需的信息，从而在保证5G网络支持接入VPDN的同时，保证VPDN的安全性。
本公开的VPDN接入方法的一些实施例的信令交互图如图3A所示。在一些实施例中，VPDN接入方法中涉及的网元的连接关系可以如图4B中所示，网络主要包括5G网络和作为VPDN的企业网两部分，用户经5G网络连接企业网。
在301中，终端UE向AMF发送PDU Session Establishment Request(PDU会 话建立请求)，该请求中包括DNN，以及通过信元ePCO携带的目标VPDN的账号和密钥。
在302中，AMF向NRF发送NF Discover Request(NF发现请求)。NRF识别该请求中包括VPDN的DNN，则确定需要查询支持VPDN的SMF。
在303中，若NRF查询到支持VPDN的SMF，则作为目标SMF反馈给AMF。
在304中，AMF通过Create SM Context Request(SM上下文建立请求)向SMF提供DNN，以及用户在目标VPDN的账号和密钥。
在305～307中，SMF向UDM发起Subscription Retrieval(订阅检索)，并向AMF反馈Create SM Context Response(上下文建立响应)。该过程可以参考相关技术中SMF与UDM的交互过程。
在308中，SMF根据该会话的业务特性，选择支持VPDN业务特性的UPF，如支持L2TP的UPF设备。
在309～310中，SMF向选中的UPF发送N4 Session Establishment Request会话建立请求，通过该请求向UPF发送DNN以及VPDN鉴权信息，UPF做出N4 Session Establishment Response响应。
在311～313中，SMF通过AMF以及RAN(Radio Access Network，无线接入网)，告知终端PDU会话建立成功。
在一些实施例中，当完成5G网络部分的流转后，5G***接入VPDN业务的流程如图3B所示，图中以CHAP认证机制为例。在一些实施例中，VPDN接入方法中涉及的网元的连接关系可以如图4B中所示。
在321中，用户终端发送给UPF的PDU Session Establishment Request中包括DNN，以及目标VPDN的账号和密钥。在一些实施例中，该PDU Session Establishment Request为通过上文中301～309的过程发送给UPF。
在322～323中，UPF在确定需要建立的会话针对VPDN业务的情况下，通过公网与相关LNS建立L2TP的隧道。
在324～328中，VPDN的专网设备对VPDN用户进行CHAP认证。在一些实施例中，该验证过程与相关技术中相同。
通过这样的方法，终端在VPDN会话中带有专网的DNN，通过扩展UE和网络交互的NAS消息的相关信元特性，以及增强5G网元设备对VPDN业务特性的支持，VPDN用户可以通过5G接入的方式结合原有的认证***和授权机制，访问本企业、 封闭站点的虚拟专有网络，以更好地实现企业与各分支机构间、分支机构与分支机构间、企业与合作伙伴间的多种网络通信。另外，这样的方法的实现过程无需对VPDN内部做出改进，提高了部署效率、降低了实现难度，有利于推广应用。
本公开的VPDN接入网络侧***的一些实施例的示意图如图4A所示。
AMF 401能够接收来自用户的VPDN接入请求，VPDN接入请求中包括目标VPDN的DNN，目标VPDN的账号和密钥；AMF 401能够通过NRF确定支持VPDN业务的目标SMF，并向目标SMF发送会话管理上下文请求。在一些实施例中，会话管理上下文请求中可以携带目标VPDN的DNN信息，以便SMF确定该请求为针对VPDN业务，进而执行选择支持VPDN业务的UPF。
NRF 402能够确定支持VPDN业务的SMF，作为目标SMF反馈给AMF。在一些实施例中，NRF可以判断来自AMF的请求中是否包括VPDN的DNN，在确定包括VPDN的DNN的情况下，则发起查找支持VPDN业务的SMF，并将找到的SMF作为目标SMF提供给AMF，从而保证后续节点对于VPDN的支持能力。
SMF 403能够根据会话管理上下文请求，选择支持VPDN业务的UPF建立会话，以便通过UPF建立与目标VPDN之间的隧道。在一些实施例中，SMF 403可以判断来自AMF的请求中是否包括VPDN的DNN，在确定包括VPDN的DNN的情况下，则发起查找支持VPDN业务的UPF，从而保证后续节点对于VPDN的支持能力。
这样的网络侧***提高了5G网元设备对VPDN业务特性的支持度，实现用于5G网络接入虚拟专有网络，提高了VPDN接入的便捷度；无需对客户侧现有企业专网设备进行改动，有利于快速部署和推广应用。
在一些实施例中，如图4A所示，VPDN接入***还可以包括UPF 404，能够接收来自SMF的会话建立请求，并在确定会话为针对VPDN业务的情况下，建立隧道。在一些实施例中，在完成隧道建立后，UPF向VPDN提供用户的账号和密钥，以便VPDN的设备进行验证。
这样的网络侧***能够在完成隧道建立后，进一步提供VPDN对用户进行验证所需的信息，从而在保证5G网络支持接入VPDN的同时，保证VPDN的安全性。
在一些实施例中，VPDN接入***中各部分的连接关系可以如图4B中所示，从而在现有5G网络和专网的基础上，只需对5G网络设备做功能拓展即可实现VPDN接入，降低了实现难度。
本公开VPDN接入***的一个实施例的结构示意图如图5所示。VPDN接入网 络侧***包括存储器501和处理器502。其中：存储器501可以是磁盘、闪存或其它任何非易失性存储介质。存储器用于存储上文中VPDN接入方法的对应实施例中的指令。处理器502耦接至存储器501，可以作为一个或多个集成电路来实施，例如微处理器或微控制器。该处理器502用于执行存储器中存储的指令，能够提高VPDN接入的便捷度，有利于快速部署和推广应用。
在一个实施例中，还可以如图6所示，VPDN接入网络侧***600包括存储器601和处理器602。处理器602通过BUS总线603耦合至存储器601。该VPDN接入网络侧***600还可以通过存储接口604连接至外部存储装置605以便调用外部数据，还可以通过网络接口606连接至网络或者另外一台计算机***(未标出)。此处不再进行详细介绍。
在该实施例中，通过存储器存储数据指令，再通过处理器处理上述指令，能够提高VPDN接入的便捷度，有利于快速部署和推广应用。
在另一个实施例中，一种计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现VPDN接入方法对应实施例中的方法的步骤。本领域内的技术人员应明白，本公开的实施例可提供为方法、装置、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用非瞬时性存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本公开的VPDN接入***的一些实施例的示意图如图7所示。
VPDN接入网络侧***71可以为上文中提到的任意一种。VPDN接入***还包括用户终端721～72n，其中，n为正整数。当用户需要发起接入VPDN的请求时，用户终端发送携带支持PAP/CHAP特性的VPDN接入请求，如在ePCO信元新增支持PAP/CHAP特性，使其携带VPDN业务标识：VPDN账号和密码。在一些实施例中，VPDN接入请求中还包括目标VPDN的DNN。
这样的***中，用户终端在发起请求时能够主动提供VPDN认证的相关信息，网络侧能够识别该信息，从而选择具备处理VPDN业务能力的网元处理业务请求，继而接入虚拟专有网，提高了VPDN接入的便捷度和效率。
本公开是参照根据本公开实施例的方法、设备(***)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的 每一流程和/或方框以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
至此，已经详细描述了本公开。为了避免遮蔽本公开的构思，没有描述本领域所公知的一些细节。本领域技术人员根据上面的描述，完全可以明白如何实施这里公开的技术方案。
可能以许多方式来实现本公开的方法以及装置。例如，可通过软件、硬件、固件或者软件、硬件、固件的任何组合来实现本公开的方法以及装置。用于所述方法的步骤的上述顺序仅是为了进行说明，本公开的方法的步骤不限于以上具体描述的顺序，除非以其它方式特别说明。此外，在一些实施例中，还可将本公开实施为记录在记录介质中的程序，这些程序包括用于实现根据本公开的方法的机器可读指令。因而，本公开还覆盖存储用于执行根据本公开的方法的程序的记录介质。
最后应当说明的是：以上实施例仅用以说明本公开的技术方案而非对其限制；尽管参照较佳实施例对本公开进行了详细的说明，所属领域的普通技术人员应当理解：依然可以对本公开的具体实施方式进行修改或者对部分技术特征进行等同替换；而不脱离本公开技术方案的精神，其均应涵盖在本公开请求保护的技术方案范围当中。

Claims (13)

  1. 一种虚拟专有拨号网络接入方法，包括：
    接入和移动管理功能AMF接收来自用户的虚拟专有拨号网络VPDN接入请求，所述VPDN接入请求中包括目标VPDN的数据网络名称DNN，以及所述目标VPDN的账号和密钥；
    所述AMF通过网络存储功能NRF确定支持VPDN业务的目标会话管理功能SMF，并向所述目标SMF发送会话管理上下文请求；和
    所述SMF根据所述会话管理上下文请求，选择支持VPDN业务的用户面功能UPF建立会话，以便通过UPF建立与所述目标VPDN之间的隧道。
  2. 根据权利要求1所述的虚拟专有拨号网络接入方法，其中，所述AMF通过NRF获取支持VPDN业务的目标SMF包括：
    所述AMF向NRF发送网络功能发现请求，所述网络功能发现请求中包括目标VPDN的DNN；和
    所述NRF根据所述DNN确定支持VPDN业务的SMF，作为所述目标SMF反馈给所述AMF。
  3. 根据权利要求1所述的虚拟专有拨号网络接入方法，其中，所述支持VPDN业务的UPF为支持L2TP的UPF。
  4. 根据权利要求1所述的虚拟专有拨号网络接入方法，其中，所述VPDN接入请求由非接入层NAS消息承载。
  5. 根据权利要求2所述的虚拟专有拨号网络接入方法，还包括：
    若所述NRF未查询到支持VPDN业务的SMF，则VPDN业务会话建立失败。
  6. 根据权利要求1所述的方法，还包括：
    若所述SMF未查询到支持VPDN业务的UPF，则VPDN业务会话建立失败。
  7. 根据权利要求1所述的虚拟专有拨号网络接入方法，还包括：
    所述UPF接收来自所述SMF的会话建立请求，在确定会话为VPDN业务的情况下，建立隧道，以便目标VPDN对所述账号和密钥进行认证。
  8. 一种虚拟专有拨号网络接入方法，包括：
    用户终端在5G网络发起虚拟专有拨号网络VPDN业务请求，所述VPDN业务请 求中包括目标VPDN的账号和密钥；和
    上文中任意一种由网络侧执行的VPDN接入方法。
  9. 一种虚拟专有拨号网络接入网络侧***，包括：
    接入和移动管理功能AMF，被配置为接收来自用户的虚拟专有拨号网络VPDN接入请求，所述VPDN接入请求中包括目标VPDN的数据网络名称DNN，以及所述目标VPDN的账号和密钥；通过网络存储功能NRF获取支持VPDN业务的目标会话管理功能SMF，并向所述目标SMF发送会话管理上下文请求；
    所述NRF，被配置为确定支持VPDN业务的SMF，作为所述目标SMF反馈给所述AMF；和
    所述SMF，被配置为根据所述会话管理上下文请求，选择支持VPDN业务的用户面功能UPF建立会话，以便通过UPF建立与所述目标VPDN之间的隧道。
  10. 根据权利要求9所述的虚拟专有拨号网络接入网络侧***，还包括：
    所述UPF，被配置为接收来自所述SMF的会话建立请求，在确定会话为VPDN业务的情况下，建立隧道，以便目标VPDN对所述账号和密钥进行认证。
  11. 一种虚拟专有拨号网络接入网络侧***，包括：
    存储器；以及
    耦接至所述存储器的处理器，所述处理器被配置为基于存储在所述存储器的指令执行如权利要求1至7任一项所述的方法。
  12. 一种虚拟专有网络接入***，包括：
    权利要求9～11任意一项所述的虚拟专有网络接入网络侧***；和
    用户终端，被配置为在5G网络发起VPDN业务请求，所述VPDN业务请求中包括目标VPDN的账号和密钥。
  13. 一种计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现权利要求1至8任意一项所述的方法的步骤。
PCT/CN2021/094571 2020-09-29 2021-05-19 虚拟专有拨号网络接入方法、网络侧***、***和存储介质 WO2022068219A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21873881.3A EP4207847A4 (en) 2020-09-29 2021-05-19 ACCESS METHOD FOR VIRTUAL PRIVATE DIAL-UP NETWORK, NETWORK-SIDE SYSTEM, SYSTEM AND STORAGE MEDIA
US18/028,988 US20230336993A1 (en) 2020-09-29 2021-05-19 Virtual private dial-up network access method, network-side system, system and storage medium
JP2023519727A JP2023540403A (ja) 2020-09-29 2021-05-19 仮想プライベートダイヤルアップネットワークにアクセスするための方法、ネットワーク側システム及びシステム、並びに記憶媒体

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011052664.4 2020-09-29
CN202011052664.4A CN114339747A (zh) 2020-09-29 2020-09-29 虚拟专有拨号网络接入方法、网络侧***、***和存储介质

Publications (1)

Publication Number Publication Date
WO2022068219A1 true WO2022068219A1 (zh) 2022-04-07

Family

ID=80949526

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/094571 WO2022068219A1 (zh) 2020-09-29 2021-05-19 虚拟专有拨号网络接入方法、网络侧***、***和存储介质

Country Status (5)

Country Link
US (1) US20230336993A1 (zh)
EP (1) EP4207847A4 (zh)
JP (1) JP2023540403A (zh)
CN (1) CN114339747A (zh)
WO (1) WO2022068219A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115460606A (zh) * 2022-11-10 2022-12-09 之江实验室 一种基于5g核心网控制面安全性增强的方法及装置
US20230036645A1 (en) * 2021-01-12 2023-02-02 Ofinno, Llc Tunnel Failure Procedures
US12010610B2 (en) 2020-12-29 2024-06-11 Ofinno, Llc Support for tunneling

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114845355B (zh) * 2022-04-29 2024-06-28 中国电信股份有限公司 网络接入方法及装置、终端设备、网络设备、存储介质
CN114885009B (zh) * 2022-06-08 2024-02-27 中国电信股份有限公司 一种信息更新方法、***、电子设备及存储介质
CN115550900B (zh) * 2022-09-28 2024-05-28 中国电信股份有限公司 业务的实现方法、***、amf网元及nrf网元
CN116528397B (zh) * 2023-06-29 2023-09-19 新华三技术有限公司 5g双域专网的实现方法及装置、5g双域专网***

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111010673A (zh) * 2018-10-08 2020-04-14 华为技术有限公司 一种通信方法及装置
CN111263346A (zh) * 2018-11-30 2020-06-09 中国电信股份有限公司 用户面选择方法、***和接入控制网元

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111010673A (zh) * 2018-10-08 2020-04-14 华为技术有限公司 一种通信方法及装置
CN111263346A (zh) * 2018-11-30 2020-06-09 中国电信股份有限公司 用户面选择方法、***和接入控制网元

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on Enhanced IMS to 5GC Integration (Release 16)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 23.794, vol. SA WG2, no. V0.4.0, 15 June 2018 (2018-06-15), pages 1 - 65, XP051451742 *
INTEL: "EPC support for mobility with low latency communication: discussion and solution proposal", 3GPP DRAFT; S2-180849_WAS0433_LLC_MOB_DP, vol. SA WG2, 23 January 2018 (2018-01-23), Gothenburg, Sweden, pages 1 - 7, XP051382351 *
See also references of EP4207847A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12010610B2 (en) 2020-12-29 2024-06-11 Ofinno, Llc Support for tunneling
US20230036645A1 (en) * 2021-01-12 2023-02-02 Ofinno, Llc Tunnel Failure Procedures
CN115460606A (zh) * 2022-11-10 2022-12-09 之江实验室 一种基于5g核心网控制面安全性增强的方法及装置
CN115460606B (zh) * 2022-11-10 2023-03-24 之江实验室 一种基于5g核心网控制面安全性增强的方法及装置

Also Published As

Publication number Publication date
JP2023540403A (ja) 2023-09-22
EP4207847A4 (en) 2024-01-03
CN114339747A (zh) 2022-04-12
US20230336993A1 (en) 2023-10-19
EP4207847A1 (en) 2023-07-05

Similar Documents

Publication Publication Date Title
WO2022068219A1 (zh) 虚拟专有拨号网络接入方法、网络侧***、***和存储介质
US11405780B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
US10027664B2 (en) Secure simple enrollment
WO2019017837A1 (zh) 网络安全管理的方法及装置
WO2020253736A1 (zh) 一种认证方法、装置及***
WO2010034257A1 (zh) 一种终端配置和管理方法及终端装置
AU2020200523B2 (en) Methods and arrangements for authenticating a communication device
CN104982053B (zh) 用于获得认证无线设备的永久身份的方法和网络节点
WO2009152749A1 (zh) 一种绑定认证的方法、***和装置
JP2008236754A (ja) 移動通信ネットワークと移動通信ネットワークにおける移動ノードの認証を遂行する方法及び装置
US20220182822A1 (en) Methods and apparatus relating to authentication of a wireless device
WO2022147803A1 (zh) 安全通信方法及设备
WO2013166908A1 (zh) 密钥信息生成方法及***、终端设备、接入网设备
CN113507705A (zh) 一种基于eap-tls协议的5g二次认证方法及***
WO2008098510A1 (fr) Procédé et appareil d'acquisition d'informations de contrôleur d'accès dans un réseau local sans fil
WO2013149426A1 (zh) 应用接入智能卡的认证方法、装置和***
WO2008011826A1 (fr) Procédé et dispositif permettant d'exécuter plusieurs authentifications au cours d'un processus epa
CN115989689A (zh) 用于边缘数据网络的用户装备认证和授权规程
WO2022067831A1 (zh) 一种建立安全通信方法及装置
WO2013023475A1 (zh) 共享网络中用户数据的方法和身份提供服务器
US9602493B2 (en) Implicit challenge authentication process
WO2019196794A1 (zh) 认证方法、设备和计算机可读存储介质
WO2013166909A1 (zh) Eap认证触发方法及***、接入网设备、终端设备
WO2010060296A1 (zh) 认证方法、可信任环境单元及家庭基站

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21873881

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023519727

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021873881

Country of ref document: EP

Effective date: 20230330

NENP Non-entry into the national phase

Ref country code: DE