WO2023041054A1 - 网络验证的方法和装置 - Google Patents

网络验证的方法和装置 Download PDF

Info

Publication number
WO2023041054A1
WO2023041054A1 PCT/CN2022/119391 CN2022119391W WO2023041054A1 WO 2023041054 A1 WO2023041054 A1 WO 2023041054A1 CN 2022119391 W CN2022119391 W CN 2022119391W WO 2023041054 A1 WO2023041054 A1 WO 2023041054A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice
terminal device
network
network element
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/119391
Other languages
English (en)
French (fr)
Inventor
孙陶然
吴义壮
朱方园
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP22869420.4A priority Critical patent/EP4391652A4/en
Publication of WO2023041054A1 publication Critical patent/WO2023041054A1/zh
Priority to US18/606,393 priority patent/US20240224098A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/08—Testing, supervising or monitoring using real traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/06—Access restriction performed under specific conditions based on traffic conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H04W4/44—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P] for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • the present application relates to the technical field of communications, and in particular to a network verification method and device.
  • the fifth generation mobile communication (the fifth generation, 5G) network needs to be able to support diversified service requirements at the same time, so as to meet the requirements of different services on network throughput, delay, quantity and reliability.
  • 5G networks need to have high bandwidth to carry virtual reality, ultra-high-definition video and other services.
  • the 5G network needs to provide massive connections and ultra-low latency to better serve the Internet of Vehicles business and industrial manufacturing.
  • 5G network slicing divides the existing network to form an independent logical network to provide customized services for differentiated services. According to different service quality requirements, the instantiation of 5G architecture is realized by allocating corresponding network functions and network resources.
  • the logical network of 5G network slicing is a collection of network function resources and the configuration of these network functions. This logical network contains network characteristics that meet specific business needs.
  • the admission control of the network slice can be realized by counting and limiting the number of registered UEs on the network slice.
  • the AMF will notify the NSACF to update the number of registered UEs on the network slice.
  • the NSACF will prevent the UE from accessing the network slice.
  • AMF may maliciously request NSACF to update the number of registered UEs on some network slices, which will cause the number of registered UEs on these network slices to quickly reach full capacity, making other UEs
  • These network slices cannot be accessed, causing a denial of service of the network slice. Therefore, how to prevent AMF from initiating DoS attacks through the UE availability check and authorization process of each network slice is an urgent problem to be solved at present.
  • the present application provides a network verification method and device to prevent a malicious mobility management network element from initiating a denial of service attack by requesting that a terminal device be included in terminal statistics of a network slice not occupied by the terminal device.
  • a network verification method comprising: a slice statistics network element (30) receives a slice registration request message (410) from a mobility management network element (30), the slice registration request message (101) Including the identifier of the terminal device (10) and the identifier of the network slice; in response to the slice registration request message, the slice statistics network element (30) judges whether the terminal device (10) occupies the resources of the network slice; according to the judgment result, The slice statistics network element (30) determines whether to count the terminal equipment (10) into the statistics of terminals accessing the network slice.
  • the slice statistics network element (30) here judges whether the terminal device (10) occupies the resources of the network slice, or the slice statistics network element (30) judges whether the terminal device (10) has access to the network A slice, or a slice statistical network element (30) judges whether the terminal device (10) is registered to the network slice.
  • the slice statistics network element determines whether to include the terminal device in the terminal statistics of the access network slice according to whether the terminal device occupies the resources of the network slice, so as to prevent malicious mobile management network elements from requesting the terminal device Include the terminal statistics of the network slice not occupied by the terminal device to launch a denial of service attack.
  • the slice statistics network element (30) determines whether the terminal device (10) occupies resources of the network slice, including: the slice statistics network element (30) Send a slice information request message (428) to the storage network element (40), the slice information request message (428) includes the identifier of the terminal device (10), and the slice information request message (428) is used to request to obtain the terminal device ( 10) slice information of occupied network slices; the slice statistics network element (30) receives the slice information from the storage network element (40), and the slice information includes any of the following: the network slice requested by the terminal device (10) slice, the network slice that the terminal device (10) is allowed to access, the indication information that the network slice requested by the terminal device (10) is empty, and the indication information that the network slice that the terminal device (10) is allowed to access is empty; the The slice statistics network element (30) judges whether the terminal device (10) occupies the resource of the network slice according to the slice information.
  • the slice statistics network element obtains the slice information of the network slice occupied by the terminal device through the storage network element, so that it can judge whether the terminal device occupies the resources of the network slice according to the slice information, so as to determine whether the Terminal devices are included in the statistics of terminals accessing the network slice.
  • the slice statistics network element (20) judges whether the terminal device (10) occupies resources of the network slice according to the slice information, including: when the slice When the information includes the network slice requested by the terminal device (10), the slice statistics network element (30) verifies whether the network slice belongs to the network slice requested by the terminal device (10); if the network slice belongs to the terminal device (10) In the case of a requested network slice, the slice statistics network element (30) determines that the terminal device occupies the resource of the network slice; or, when the slice information includes the network slice allowed by the terminal device (10), the slice The statistical network element (30) verifies whether the network slice belongs to the allowed network slice of the terminal device (10); in the case that the network slice belongs to the allowed network slice of the terminal device (10), the slice statistical network element ( 30) determining that the terminal device (10) occupies the resource of the network slice; or, when the slice information includes the indication information that the network slice requested by the terminal device (10) is empty, the slice statistics network element (30) verifies Whether the slice information includes the indication information that the network slice requested by the terminal device (
  • the slice statistics management network element can flexibly verify whether the terminal device occupies the resources of the network slice according to the content of the obtained slice information, so as to determine whether the terminal device is included in the access to the network slice. Terminal statistics.
  • the slice statistics network element (30) determines whether the terminal device (10) occupies resources of the network slice according to the slice information, including: the slice statistics The network element (30) sends a slice verification request message (421) to the storage network element (40), the slice verification request message (421) includes the identifier of the terminal device (10) and the identifier of the network slice, and the slice verification request message (421) is used to request to verify whether the terminal device (10) occupies the resources of the network slice; the slice statistics network element (30) receives the indication information (426) from the storage network element (40); the slice statistics network The element (30) determines whether the terminal device (10) occupies the resources of the network slice according to the indication information (426).
  • the slice statistics network element may request the storage network element to verify whether the terminal device occupies the resources of the network slice, so as to determine whether the terminal device is included in the statistics of terminals accessing the network slice.
  • the method further includes: the slice statistics network element (30) verifies whether the terminal device (10) is connected to the network.
  • the slice statistics network element (30) verifies whether the terminal device (10) is connected to the network, including: the slice statistics network element (30) sends a storage network The unit (40) sends a terminal information request message, and the terminal information request message includes the identification of the terminal device (10); the slice statistics network element (30) receives status indication information from the storage network element (40); the slice statistics The network element (30) determines whether the terminal equipment (10) is connected to the network according to the status indication information.
  • slice statistics network element (30) judges whether the terminal device (10) occupies the resources of the network slice, or at the same time, request the slice statistics network element (30) to verify whether the terminal device (10) accesses network.
  • the slice statistical network element (30) determines that the terminal device (10) is not connected to the network
  • the slice statistical network element (30) judges that the terminal device (10) is not connected to the network slice, or the slice statistical network element ( 30) Judging that an abnormality has occurred in the mobility management network element, or, the slice statistics network element (30) determines not to include the terminal device (10) in the statistics of terminals accessing the network slice, or, the slice statistics network element (30) ) reject or ignore the slice registration request message from the mobility management network element (20).
  • the method further includes: the slice statistics The network element (30) verifies whether the terminal device (10) is connected to the mobility management network element (20), or in other words, the slice statistics network element (30) verifies whether the terminal device (10) is connected to the mobility management network element (20) Correspondence.
  • the slice statistics network element (30) verifies whether the terminal device (10) has access to the mobility management network element (20), including: the slice statistics network The element (30) sends a slice verification request message (421) to the storage network element (40), and the slice verification request message (421) includes the identification of the mobile management network element (20); the slice statistics network element (30) receives the The indication information of the storage network element (40); the slice statistics network element (30) determines whether the terminal equipment (10) has accessed the mobility management network element (20) according to the indication information.
  • the slice statistics network element (30) judges whether the terminal device (10) occupies the resources of the network slice, or at the same time, request the slice statistics network element (30) to verify whether the terminal device (10) accesses The mobility management network element (20) is selected.
  • the slice statistical network element (30) determines that the terminal device (10) is not connected to the mobility management network element (20)
  • the slice statistical network element (30) determines that the terminal device (10) is not connected to the network slice, or , the slice statistical network element (30) judges that an abnormality has occurred in the mobility management network element, or, the slice statistical network element (30) determines not to include the terminal device (10) in the statistics of terminals accessing the network slice, or,
  • the slice statistics network element (30) rejects or ignores the slice registration request message from the mobility management network element (20).
  • the method further includes: the slice statistics network element (30) verifies whether one or more terminal devices included in the terminal statistics of the network slice occupy the network Sliced resources.
  • the slice statistical network element (30) can verify whether other terminal devices included in the terminal statistics on the network slice occupy the resources of the network slice at the same time as or after verifying the terminal device (10) , when one or more of these other terminal devices do not occupy the resources of the network slice, or when one or more of these other terminal devices do not access the network slice, the slice statistics network element (30) will One or more terminal devices are deleted from the terminal statistics of the network slice, so that the terminal statistics on the network slice can be made more accurate.
  • the method further includes: the slice statistics network element (30) determines that the number of statistics of terminals accessing the network slice is greater than or equal to a threshold.
  • the slice statistics network element judges whether the terminal device occupies the resources of the network slice, not in any case All judgments are made, which can save resources.
  • the slice statistics network element (30) determines whether to count the terminal device (10) as accessing the
  • the terminal statistics of the network slice include: when the terminal device (10) occupies the resources of the network slice, the slice statistical network element (30) counts the terminal device into the terminal statistics of the network slice; when the terminal When the device (10) does not occupy the resources of the network slice, the slice statistics network element (30) does not include the terminal device (10) in the statistics of terminals accessing the network slice.
  • the slice statistics network element can determine whether to count the terminal device into the statistics of terminals connected to the network slice according to the judgment result, so as to prevent malicious mobile management network elements from counting the terminal device Terminal statistics of occupied network slices to launch denial-of-service attacks.
  • the slice registration request message is used to request that the terminal device be included in the statistics of terminals accessing the network slice.
  • a network verification method comprising: a storage network element (40) receiving a slice verification request message (421) from a slice statistics network element (30), the slice verification request message (421) including The identification of the terminal device (10) and the identification of the network slice; in response to the slice verification request message (421), the storage network element (40) acquires slice information of the network slice occupied by the terminal device (10), the slice information includes Any of the following: the network slice requested by the terminal device (10), the network slice allowed by the terminal device (10), the indication information that the network slice requested by the terminal device (10) is empty, the terminal device (10) Indication information that the allowed network slice is empty; the storage network element (40) verifies whether the terminal device (10) occupies the resources of the network slice according to the slice information of the terminal device (10).
  • the storage network element judges whether the terminal device occupies the resources of the network slice according to the slice verification request message, so as to indicate the judgment result to the slice statistics network element, so that the slice statistics network element can determine whether to count the terminal device into the network slice.
  • malicious mobile management network elements can prevent a denial of service attack by requesting that a terminal device be included in the terminal statistics of a network slice that the terminal device does not occupy.
  • the storage network element (40) verifies whether the terminal device (10) occupies resources of the network slice according to slice information of the terminal device (10), Including: when the slice information includes the network slice requested by the terminal device (10), the storage network element (40) verifies whether the network slice belongs to the network slice requested by the terminal device (10), and the network slice belongs to the terminal In the case of the network slice requested by the device (10), the storage network element (40) determines that the terminal device (10) occupies the resources of the network slice; when the slice information includes the network slice allowed by the terminal device (10) , the storage network element (40) verifies whether the network slice belongs to the allowed network slice of the terminal device (10), and if the network slice belongs to the allowed network slice of the terminal device (10), the storage network The element (40) determines that the terminal device (10) occupies the resource of the network slice; when the slice information includes the indication information that the network slice requested by the terminal device (10) is empty, the storage network element (40) verifies the
  • the storage network element can flexibly verify whether the terminal device occupies the resources of the network slice according to the content of the obtained slice information, so that the slice management network element can determine whether the terminal device is included in accessing the network Terminal statistics for slices.
  • the storage network element (40) obtaining slice information of the network slice occupied by the terminal device (10) includes: the storage network element (40) according to the terminal The identification of the device (10) obtains the slice information locally.
  • the storage network element (40) obtains the slice information of the network slice occupied by the terminal device (10), including: there is no When the information is sliced, the storage network element (40) sends a slice information request message (423) to the terminal device (10), and the slice information request message (423) is used to request to obtain the slice information; the storage network element (40 ) receiving an integrity-protected slice information response message from the terminal device (10), where the slice information response message includes the slice information and an integrity check parameter, and the integrity check parameter is used to verify whether the slice information tampered with.
  • the storage network element can locally obtain the slice information of the network slice occupied by the terminal device, or request the slice information from the terminal device, so as to determine whether the terminal device occupies the resources of the network slice according to the slice information. So that the slice management network element can determine whether to count the terminal device into the statistics of terminals accessing the network slice.
  • the method further includes: the storage network element (40) verifies whether the terminal device (10) is connected to the network; when the terminal device (10) is not connected to the network, In the case of , the storage network element (40) sends status indication information to the slice management network element (30), the status indication information is used to indicate whether the terminal device (10) is connected to the network, or the storage network element (40) Sending indication information of verification failure to the slice management network element (30).
  • the storage network element (40) verifies whether the terminal device (10) is connected to the network, including: the storage network element (40) according to the terminal device (10 ) to obtain the context of the terminal device (10); if the storage network element (40) has obtained the context of the terminal device (10), then the storage network element (40) determines that the terminal device (10) has accessed the network; if the storage network element (40) If the network element (40) does not acquire the context of the terminal device (10), the storage network element (40) determines that the terminal device (10) does not access the network.
  • the slice verification request message (421) further includes the identification of the mobility management network element (20), and the method further includes: the storage network element (40) verifies the terminal whether the device (10) has access to the mobility management network element (20); if the terminal device (10) does not access the mobility management network element (20), the storage network element (40) sends the slice management network
  • the element (30) sends indication information, the indication information is used to indicate that the terminal device (10) does not access the mobility management network element (20), or the storage network element (40) sends the slice management network element (30) An indication of a validation failure.
  • the storage network element (40) verifies whether the terminal device (10) has accessed the mobility management network element (20), including: the storage network element ( 40) Obtain the context of the terminal device (10) according to the identifier of the terminal device (10); the storage network element (40) verifies whether the terminal device (10) has access to the mobile management network according to the context of the terminal device (10) Yuan (20).
  • the method further includes: the storage network element (40) sending a verification request message to the verification network element (50), where the verification request message includes the slice information and the Integrity verification parameters, the verification request message is used to request to verify whether the slice information has been tampered with; the storage network element (40) receives the integrity verification indication information from the verification network element (50); the storage network element (40 ) determine whether the slice information has been tampered with according to the integrity verification indication information.
  • the storage network element can verify the integrity of the slice information from the terminal device according to the integrity check parameter, thereby preventing the slice information from being tampered with.
  • the method before the storage network element (40) acquires slice information of the terminal device (10), the method further includes: the storage network element (40) determining the The identifier of the network slice belongs to the subscribed network slice of the terminal device (10).
  • the storage network element before judging whether the terminal device occupies the resources of the network slice, the storage network element first judges whether the identifier of the network slice belongs to the contracted network slice of the terminal device, and the identifier of the network slice does not belong to the contracted network of the terminal device In the case of slicing, the storage network element does not need to perform a subsequent judgment process, thereby saving resource overhead.
  • the slice verification request message (424) is used to request to verify whether the terminal device (10) occupies the resources of the network slice.
  • a method for network verification comprising: when a trigger condition is met, a terminal device (10) generates a message with integrity protection, and the message includes the network information occupied by the terminal device (10)
  • the slice information of the slice, the slice information includes any of the following: the network slice requested by the terminal device, the allowed network slice of the terminal device, the indication information that the network slice requested by the terminal device (10) is empty, the terminal device ( 10) Indication information that the allowed network slice is empty; the terminal device (10) sends the message to the storage network element (40).
  • the terminal device when the trigger condition is met, reports the slice information of the network slice occupied by the terminal device to the storage network element, so that the mobility management network element requests the slice management network element to include the terminal device in the access
  • the terminal device When collecting terminal statistics for the network slice, it may be determined whether the terminal device occupies resources of the network slice by storing network elements, so as to determine whether the terminal device is included in the statistics of terminals accessing the network slice.
  • the trigger condition includes any one or more of the following: the terminal device (10) receives a non-access stratum security mode command message; the terminal device (10) ) receives a registration acceptance message; the terminal device (10) receives a slice information request message (423) from the storage network element (40), and the slice information request message (423) is used to request to obtain the slice information.
  • the method further includes: the terminal device (10) generates an integrity check parameter by using the integrity key and the slice information, and the message also includes the integrity The integrity check parameter is used to verify whether the slice information has been tampered with.
  • the terminal device performs integrity protection on the slice information sent to the storage network element, so that the slice information can be prevented from being tampered with.
  • a method for network verification is provided, which is characterized by comprising: a terminal device (10) sending a registration request message to a mobility management network element (20), and the registration request message is used for the terminal device (10) to request Registering to the network; the terminal device (10) receives a non-access stratum security mode command message; when the registration request message carries a request for network slicing, the terminal device (10) sends slice information to the slice statistics network element (30) , the slice information includes the requested network slice; when the registration request message does not carry the requested network slice, the terminal device (10) sends the slice information to the slice statistics network element (30), the slice information includes the requested network slice Empty instructions.
  • a network authentication method which is characterized by comprising: a terminal device (10) sends a registration request message to a mobility management network element (20), and the registration request message is used for the terminal device (10) to request Registering to the network; the terminal device (10) receives a registration acceptance message from the mobility management network element (20); when the registration acceptance message includes allowing network slicing, the terminal device (10) reports to the slice statistics network element ( 30) sending slice information, the slice information including the allowed network slice; in the case that the registration acceptance message does not include the allowed network slice, the terminal device (10) sends the slice information to the slice statistics network element (30),
  • the slice information includes indication information that the allowed network slice is empty.
  • a network verification method is provided, which is characterized by comprising: after the mobility management network element (20) sends the slice information of the network slice occupied by the terminal device (10) to the storage network element (40), the mobility The management network element (20) sends a registration request message (410) to the slice statistics network element (30), and the registration request message (410) includes the identifier of the terminal device (10) and the identifier of the network slice.
  • the registration request message (410) is used to request that the terminal device (10) be included in the statistics of terminals accessing the network slice.
  • the mobility management network element (20) only Send a registration request message (410) to the slice statistics network element (30), to request the slice statistics network element (30) to perform admission control on the network slice, where the admission control process includes that the slice statistics network element (30) will occupy Terminal devices that have access to network slice resources are included in the statistics of terminals accessing the network slice.
  • the mobility management network element initiates the network slice admission control process only after sending the slice information of the terminal device to the storage network element.
  • the network slice admission control process if the storage network element If the slice information of the terminal device is not found locally, it can be determined that the terminal device does not occupy the resource of the network slice, or it is determined that the terminal device does not access the network slice, and additional verification is not required, thereby saving resources.
  • a device for network verification which is characterized in that it includes: a transceiver module, configured to receive a slice registration request message (410) from a mobility management network element (30), the slice registration request message (101) Including the identifier of the terminal device (10) and the identifier of the network slice; the processing module is used to respond to the slice registration request message and determine whether the terminal device (10) occupies the resources of the network slice; the processing module is also used to According to the judgment result, it is determined whether to count the terminal device (10) into the statistics of terminals accessing the network slice.
  • the transceiver module is specifically configured to: send a slice information request message (428) to the storage network element (40), and the slice information request message (428) includes the terminal
  • the identification of the device (10), the slice information request message (428) is used to request to obtain the slice information of the network slice occupied by the terminal device (10); the slice information received from the storage network element (40), the slice information Including any of the following: the network slice requested by the terminal device (10), the network slice that the terminal device (10) is allowed to access, the indication information that the network slice requested by the terminal device (10) is empty, the terminal device (10) (10) Indication information indicating that the allowed network slice is empty;
  • the processing module is specifically configured to: judge whether the terminal device (10) occupies resources of the network slice according to the slice information.
  • the processing module is specifically configured to: when the slice information includes a network slice requested by the terminal device (10), verify whether the network slice belongs to the terminal device (10) 10) The requested network slice; in the case that the network slice belongs to the network slice requested by the terminal device (10), it is determined that the terminal device occupies the resources of the network slice; or, the processing module is specifically used for: when the slice When the information includes the allowed network slice of the terminal device (10), verify whether the network slice belongs to the allowed network slice of the terminal device (10); if the network slice belongs to the allowed network slice of the terminal device (10), In this case, it is determined that the terminal device (10) occupies the resources of the network slice; or, the processing module is specifically configured to: when the slice information includes indication information that the network slice requested by the terminal device (10) is empty, verify Whether the network slice belongs to the default network slice of the terminal device (10); if the network slice belongs to the default network slice of the terminal device (10), it is determined that the terminal device occupies the resource
  • the transceiver module is specifically configured to: send a slice verification request message (421) to the storage network element (40), and the slice verification request message (421) includes the The identification of the terminal device (10) and the identification of the network slice, the slice verification request message (421) is used to request to verify whether the terminal device (10) occupies the resource of the network slice;
  • the indication information (426) the processing module is specifically configured to: determine whether the terminal device (10) occupies the resource of the network slice according to the indication information (426).
  • the processing module is further configured to: determine that the statistical number of terminals accessing the network slice is greater than or equal to a threshold.
  • the processing module when the terminal device (10) occupies resources of the network slice, the processing module is specifically configured to include the terminal device in the number of accessing the network slice Terminal statistics: when the terminal device (10) does not occupy the resources of the network slice, the processing module is specifically used to not include the terminal device (10) in the statistics of terminals accessing the network slice.
  • the first request message is used to request to increase the number of statistics of terminals accessing the network slice.
  • a device for network verification includes: a transceiver module, configured to receive a slice verification request message (421) from a slice statistics network element (30), the slice verification request message (421) Including the identifier of the terminal device (10) and the identifier of the network slice; the processing module is configured to respond to the slice verification request message (421), and obtain the slice information of the network slice occupied by the terminal device (10), the slice information includes the following Any item: the network slice requested by the terminal device (10), the network slice allowed by the terminal device (10), the indication information that the network slice requested by the terminal device (10) is empty, the terminal device (10) The indication information that the allowed network slice is empty; the processing module is also used to verify whether the terminal device (10) occupies the resources of the network slice according to the slice information of the terminal device (10).
  • the processing module when the slice information includes the network slice requested by the terminal device (10), the processing module is specifically configured to verify whether the network slice belongs to the terminal device (10) ) of the network slice requested by the terminal device (10), in the case that the network slice belongs to the network slice requested by the terminal device (10), the storage network element (40) determines that the terminal device (10) occupies the resource of the network slice; when the slice When the information includes the allowed network slice of the terminal device (10), the processing module is specifically configured to verify whether the network slice belongs to the allowed network slice of the terminal device (10), and when the network slice belongs to the terminal device (10) In the case of allowed network slicing, the processing module is specifically configured to determine that the terminal device (10) occupies the resources of the network slice; when the slice information includes an indication that the terminal device (10) requests that the network slice is empty , the processing module is specifically used to verify whether the network slice belongs to the default network slice of the terminal device (10), and when the network slice belongs to the default network slice of the terminal device
  • the processing module is specifically configured to locally acquire the slice information according to the identifier of the terminal device (10).
  • the transceiver module when the processing module does not acquire the slice information locally, the transceiver module is specifically configured to send a slice information request message (423) to the terminal device (10) ), the slice information request message (423) is used to request to obtain the slice information; the transceiver module is specifically configured to receive an integrity-protected slice information response message from the terminal device (10), the slice information response message includes The slice information and an integrity check parameter, the integrity check parameter is used to verify whether the slice information has been tampered with.
  • the transceiver module is further configured to send a verification request message to the verification network element (50), where the verification request message includes the slice information and the integrity check parameter,
  • the verification request message is used to request to verify whether the slice information has been tampered with; receive the integrity verification indication information from the verification network element (50); the processing module is also used to determine whether the slice information has been tampered with according to the integrity verification indication information tamper.
  • the processing module is further configured to determine that the identifier of the network slice belongs to the subscribed network slice of the terminal device (10).
  • the slice verification request message (424) is used to request to verify whether the terminal device (10) occupies the resource of the network slice.
  • a device for network verification which is characterized in that it includes: a processing module, configured to generate an integrity-protected message when the trigger condition is met, the message includes the terminal device (10) occupied
  • the slice information of the network slice of the terminal device includes any of the following: the network slice requested by the terminal device, the allowed network slice of the terminal device, the indication information that the network slice requested by the terminal device (10) is empty, the terminal device (10) The indication information that the allowed network slice of the device (10) is empty; the transceiver module, configured to send the message to the storage network element (40).
  • the trigger condition includes any one or more of the following: the transceiver module receives a non-access stratum security mode command message; the transceiver module receives a registration acceptance message The transceiver module receives a slice information request message (423) from the storage network element (40), and the slice information request message (423) is used to request to obtain the slice information.
  • the processing module is further configured to use the integrity key and the slice information to generate an integrity check parameter, and the message also includes the integrity check parameter, The integrity check parameter is used to verify whether the slice information has been tampered with.
  • a communication device is provided, and the device is configured to execute the methods provided in the first aspect to the fifth aspect.
  • the apparatus may include a unit and/or module, such as a processing unit and/or a communication unit, for executing the methods provided in the first aspect to the fifth aspect.
  • the device is a network device, for example, the device is a slice statistics network element (30), or a storage network element (40), or an authentication network element (50).
  • the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.
  • the apparatus is a chip, a chip system or a circuit used in a network device.
  • the communication unit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit etc.
  • the processing unit may be a processor, a processing circuit or a logic circuit and the like.
  • the device is a slice statistical network element (30) or a chip, a chip system or a circuit in the slice statistical network element (30).
  • the device may include units and/or modules for performing the method provided by the first aspect, such as a processing unit and/or a communication unit.
  • the device is a storage network element (40) or a chip, a chip system or a circuit in the storage network element (40).
  • the device may include units and/or modules for performing the method provided by the second aspect, such as a processing unit and/or a communication unit.
  • the device is a terminal device, for example, the device is a terminal device (10).
  • the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.
  • the device is the terminal device (10) or a chip, a chip system or a circuit in the terminal device (10).
  • the device may include a unit and/or module, such as a processing unit and/or a communication unit, for performing the method provided by any one of the third aspect to the fifth aspect.
  • the above-mentioned transceiver may be a transceiver circuit.
  • the above input/output interface may be an input/output circuit.
  • a communication device comprising: a memory for storing a program; a processor for executing the program stored in the memory, and when the program stored in the memory is executed, the processor is used for executing the above-mentioned first aspect To the method provided in the fifth aspect.
  • the present application provides a processor configured to execute the method provided in the foregoing aspects.
  • the process of sending the above information and obtaining/receiving the above information in the above method can be understood as the process of outputting the above information by the processor and the process of receiving the input of the above information by the processor.
  • the processor When outputting the above information, the processor outputs the above information to the transceiver for transmission by the transceiver. After the above information is output by the processor, other processing may be required before reaching the transceiver.
  • the transceiver acquires/receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed before being input to the processor.
  • the receiving request message mentioned in the foregoing method may be understood as the processor receiving input information.
  • processor For the operations of transmitting, sending, and acquiring/receiving involved in the processor, if there is no special description, or if it does not conflict with its actual function or internal logic in the relevant description, it can be understood more generally as the processor Output and receive, input and other operations, rather than the transmission, transmission and reception operations performed directly by radio frequency circuits and antennas.
  • the above-mentioned processor may be a processor dedicated to performing these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor.
  • the above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged on different chips.
  • ROM read-only memory
  • a computer-readable storage medium stores program code for execution by a device, and the program code includes a method for executing the methods provided in the first aspect to the fifth aspect.
  • a computer program product containing instructions is provided, and when the computer program product is run on a computer, it causes the computer to execute the methods provided in the first aspect to the fifth aspect.
  • a fifteenth aspect provides a chip, the chip includes a processor and a communication interface, the processor reads instructions stored in the memory through the communication interface, and executes the methods provided in the first aspect to the fifth aspect above.
  • the chip may further include a memory, the memory stores instructions, the processor is used to execute the instructions stored in the memory, and when the instructions are executed, the processor is used to execute the above-mentioned first The methods provided in the first aspect to the fifth aspect.
  • Fig. 1 is a schematic diagram of a network structure applicable to the embodiment of the present application.
  • Fig. 2 is a schematic flowchart of a method for network slice admission control.
  • Fig. 3 is a schematic flowchart of another method for network slice admission control.
  • Fig. 4 is an exemplary flow chart of a network verification method provided by an embodiment of the present application.
  • Fig. 5 is an exemplary flow chart of another network verification method provided by an embodiment of the present application.
  • Fig. 6 is an exemplary flowchart of another network verification method provided by the embodiment of the present application.
  • Fig. 7 is a schematic block diagram of an apparatus for network verification provided by an embodiment of the present application.
  • Fig. 8 is a schematic block diagram of an apparatus for network authentication provided by another embodiment of the present application.
  • Fig. 9 is a schematic block diagram of an apparatus for network authentication provided by another embodiment of the present application.
  • Fig. 10 is a schematic block diagram of an apparatus for network authentication provided by another embodiment of the present application.
  • the present application provides a communication system, which includes a terminal device (10), a mobility management network element (20) and a slice statistics network element (30).
  • the slice statistics network element (30) is used to receive a slice registration request message (410) from the mobility management network element (30), and the slice registration request message (410) includes the identifier of the terminal device (10) and the network slice identification; in response to the slice registration request being small, the slice statistics network element (30) judges whether the terminal device (10) occupies the resources of the first network slice; according to the judgment result, the slice statistics network element (30) determines whether to The terminal device (10) is included in the terminal statistics of the network slice.
  • the system also includes a storage network element (40) and an authentication network element (50).
  • the storage network element (40) is used to receive a slice verification request message (421) from the slice statistics network element (30), and the slice verification request message (421) includes the identifier of the terminal device (10) and the network An identification of a slice; in response to the slice verification request message (421), the storage network element (40) obtains slice information of the network slice occupied by the terminal device (10), and the slice information includes any of the following: the terminal device ( 10) The requested network slice, the allowed network slice of the terminal device (10), the indication information that the network slice requested by the terminal device (10) is empty, the indication that the allowed network slice of the terminal device (10) is empty information; the storage network element (40) verifies whether the terminal device (10) occupies resources of the network slice according to the slice information of the terminal device (10).
  • the authentication network element (50) is used to receive a verification request message from the storage network element, the verification request message includes slice information and integrity check parameters of the network slice occupied by the terminal device (10), and the integrity check The parameter is used to verify whether the slice information has been tampered with; the authentication network element (50) generates an integrity check parameter according to the slice information and the integrity key, and the integrity check parameter and the integrity check parameter generated by the authentication network element (50) When the integrity check parameters carried in the verification request message are the same, the authentication network element (50) determines that the slice information has not been tampered with.
  • the technical solution provided by this application can be applied to various communication systems, such as: the fifth generation (5th generation, 5G) or new radio (new radio, NR) system, long term evolution (long term evolution, LTE) system, LTE frequency division Duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, etc.
  • 5G fifth generation
  • NR new radio
  • long term evolution long term evolution
  • LTE long term evolution
  • LTE frequency division Duplex frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • the technical solution provided by this application can also be applied to device to device (device to device, D2D) communication, vehicle to everything (vehicle-to-everything, V2X) communication, machine to machine (machine to machine, M2M) communication, machine type Communication (machine type communication, MTC), and Internet of things (internet of things, IoT) communication system or other communication systems.
  • D2D device to device
  • V2X vehicle-to-everything
  • M2M machine to machine
  • M2M machine type Communication
  • MTC machine type communication
  • IoT Internet of things
  • FIG. 1 it is a schematic diagram of a fifth generation (5th generation, 5G) network architecture based on a service architecture.
  • the mobility management network element (20) in (a) of FIG. 1 may be the AMF in (b) of FIG. 1
  • the storage network element (40) in (a) of FIG. 1 may be the ( The UDM in b)
  • the authentication network element (50) in (a) in Figure 1 can be the AUSF in (b) in Figure 1
  • the terminal device (10) in (a) in Figure 1 can be the UE in (b).
  • the slice management network element (30) in (a) of FIG. 1 may be an NSACF.
  • the 5G network architecture shown in (b) of FIG. 1 may include three parts, namely a terminal device part, a data network (data network, DN) and an operator network part.
  • a terminal device part namely a terminal device part, a data network (data network, DN) and an operator network part.
  • DN data network
  • operator network part namely a data network (data network, DN) and a operator network part.
  • the operator network may include one or more of the following network elements: authentication server function (authentication server function, AUSF) network element, network exposure function (network exposure function, NEF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, unified database (unified data repository, UDR), network storage function (network repository function, NRF) network element, application function (application function, AF) ) network elements, access and mobility management function (access and mobility management function, AMF) network elements, session management function (session management function, SMF) network elements, radio access network (radioaccess network, RAN) and user plane functions (user plane function, UPF) network element, etc.
  • authentication server function authentication server function, AUSF
  • NEF network exposure function
  • policy control function policy control function
  • PCF policy control function
  • unified data management unified data management
  • UDM unified database
  • NRF network repository function
  • application function application function, AF
  • AMF access and mobility management function
  • Terminal device it can also be called user equipment (UE), which is a device with wireless transceiver function, which can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed in On the water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • the terminal device may be a mobile phone, a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control ), wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the terminal device here refers to a 3rd generation partnership project (3rd generation partnership project, 3GPP) terminal.
  • 3rd generation partnership project 3rd generation partnership project
  • the above-mentioned terminal device can establish a connection with the operator network through an interface provided by the operator network (such as N1, etc.), and use services such as data and/or voice provided by the operator network.
  • the terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN, and/or the service provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and the terminal device, and may provide other services such as data and/or voice for the terminal device.
  • the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.
  • Wireless access network radio access network, RAN
  • RAN radio access network
  • the RAN is a sub-network of the operator's network and an implementation system between service nodes and terminal equipment in the operator's network.
  • the terminal equipment To access the operator's network, the terminal equipment first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN.
  • the RAN device in this application is a device that provides a wireless communication function for a terminal device, and the RAN device is also called an access network device.
  • the RAN equipment in this application includes but is not limited to: next-generation base station (g nodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • next-generation base station g nodeB, gNB
  • eNB evolved node B
  • RNC radio network controller
  • node B node B
  • base station controller base station controller
  • BTS base transceiver station
  • home base station for example, home evolved nodeB, or home node B, HNB
  • baseband unit baseBand
  • the user plane network element may be a user plane function (user plane function, UPF) network element.
  • UPF user plane function
  • the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.
  • Multicast/broadcast-user plane function (MB-UPF)
  • MB-UPF is mainly responsible for sending multicast broadcast streams to RAN (or UPF), which can perform packet filtering and distribution of multicast broadcast streams, and realize QoS enhancement and counting/reporting of multicast broadcast services.
  • RAN or UPF
  • MB-UPF and UPF are not strictly distinguished, and (MB-)UPF is used to represent MB-UPF or UPF.
  • Data network used to provide a network for transmitting data.
  • the data network element may be a data network element.
  • the data network element may still be a DN network element, or may have other names, which are not limited in this application.
  • Access and mobility management network elements are mainly used for mobility management and access management, etc., and can be used to implement other functions in MME functions except session management, such as lawful interception and access authorization/authentication.
  • the access and mobility management network element may be an access and mobility management function (access and mobility management function, AMF).
  • AMF access and mobility management function
  • the access and mobility management device may still be an AMF, or may have other names, which are not limited in this application.
  • Session management function (session management function, SMF): mainly used for session management, user equipment network interconnection protocol (internet protocol, IP) address allocation and management, selection of manageable user plane functions, policy control and charging function interface endpoints and downlink data notifications, etc.
  • SMF session management function
  • the session management network element may be a session management function network element.
  • the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.
  • Multicast/broadcast-session management function (MB-SMF)
  • MB-SMF is mainly responsible for multicast broadcast session management and control of multicast broadcast transmission. According to the policy rules of multicast broadcast services provided by PCF or locally configured, MB-UPF and RAN are configured accordingly to complete the transmission of multicast broadcast streams. . In this application, MB-SMF and SMF are not strictly distinguished, and (MB-)SMF is used to represent MB-SMF or SMF.
  • PCF Policy control function
  • the policy control network element may be a policy and charging rules function (policy and charging rules function, PCRF) network element.
  • policy control network element may be a policy control function PCF network element.
  • the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.
  • Application function (Application function, AF): It is used for data routing influenced by applications, wireless access network open function network elements, and interaction with policy frameworks for policy control, etc.
  • the application network element may be an application function network element.
  • the application network element may still be an AF network element, or may have other names, which are not limited in this application.
  • Unified data management used to process UE identification, access authentication, registration and mobility management.
  • the data management network element may be a unified data management network element; in a 4G communication system, the data management network element may be a home subscriber server (HSS) network element.
  • HSS home subscriber server
  • the unified data management may still be a UDM network element, or may have other names, which are not limited in this application.
  • Unified data repository It mainly includes the following functions: the access function of contract data, policy data, application data and other types of data.
  • AUSF Authentication server function
  • the authentication server may be an authentication server functional network element.
  • the authentication server functional network element may still be an AUSF network element, or may have other names, which are not limited in this application.
  • Data network is a network located outside the operator's network.
  • the operator's network can access multiple DNs, and multiple services can be deployed on the DN, which can provide data and/or voice for terminal equipment. and other services.
  • DN is a private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminal devices.
  • the control server of the sensor is deployed in the DN, and the control server can provide services for the sensor.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • DN is a company's internal office network, and the mobile phone or computer of the company's employees can be a terminal device, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.
  • Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • interface serial numbers refer to the meaning defined in the 3GPP standard agreement, and no limitation is made here.
  • various network elements can communicate through the interfaces shown in the figure.
  • the UE and the AMF may interact through the N1 interface, and the interaction message may be called an N1 message (N1Message), for example.
  • N1Message N1 message
  • the RAN and the AMF can interact through the N2 interface, and the N2 interface can be used for sending non-access stratum (non-access stratum, NAS) messages, etc.
  • the RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc.
  • the SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as the tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages.
  • the UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit data on the user plane.
  • the relationship between other interfaces and each network element is shown in FIG. 1 , and for the sake of brevity, details are not described here one by one.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network element that can implement the above-mentioned All functional network architectures are applicable to this embodiment of the application.
  • Functional network elements can be combined into network slices on demand.
  • These core network elements may be independent devices, or may be integrated into the same device to implement different functions. This application does not limit the specific forms of the above network elements.
  • the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform).
  • the network device is the access and mobility management network element AMF
  • the base station is the radio access network RAN as an example for description.
  • the terminal equipment (10), mobile management network element (20), slice statistics network element (30), storage network element (40) and authentication network element (50) in this application can be UE, AMF, NSACF in the 5G system , UDM, and AUSF, and may also be network elements that have the functions of the UE, AMF, NSACF, UDM, and AUSF in future communications such as the sixth generation (6G) network, which is not limited in this application.
  • 6G sixth generation
  • network functional network element entities such as AMF, SMF network element, PCF network element, BSF network element, and UDM network element are all called network function (network function, NF) network elements; or, in another
  • network function network function, NF
  • a collection of network elements such as AMF, SMF, PCF, BSF, and UDM can be called control plane functional network elements.
  • Computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices e.g., hard disk, floppy disk, or tape, etc.
  • optical disks e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • the NSSAI provided by the serving PLMN eg during the registration procedure indicates the S-NSSAI value that the UE can use for the current registration area in the serving PLMN.
  • Request network slice selection auxiliary information (Requested NSSAI):
  • the NSSAI provided by the UE to the serving PLMN during registration.
  • Network slice selection auxiliary information (Subscribed S-NSSAI):
  • the UE subscribes for use in the PLMN.
  • the slice with the Default indication in the Subscribed NSSAI is the network slice that the UE accesses by default when there is no network slice that can be accessed by the UE.
  • Reject network slice selection auxiliary information (Reject NSSAI):
  • the UE requests the NSSAI for access during eg registration, but the serving PLMN rejects the UE access, indicating that the UE cannot use the S-NSSAI value for the current registration area in the serving PLMN.
  • Method 200 includes:
  • the AMF sends a UE number per network slice availability check and update request (Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request) message to the NSACF.
  • Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request a UE number per network slice availability check and update request
  • AMF will initiate the availability check and update process of the number of UEs per network slice. Examples of several possible scenarios initiated by this process are as follows:
  • the AMF may initiate a UE quantity availability check and update procedure for each network slice during UE registration procedures (including initial registration and mobility registration).
  • the AMF can initiate the process before sending the registration accept message to the UE; in the case where the EAC mode is not activated, the AMF can send the registration message to the UE The process is initiated after a message is accepted.
  • EAC early admission control
  • the AMF may initiate a check and update process of the availability of the number of UEs per network slice during the UE de-registration process.
  • the AMF may initiate the UE quantity availability check and update procedure per network slice during the UE configuration update procedure due to network slice authentication and authorization procedure or UE subscription slice change.
  • the AMF initiates the procedure before the UE configuration update procedure; when the EAC mode is not activated, the AMF initiates the procedure after the UE configuration update procedure.
  • the AMF After the AMF determines to initiate the check and update process of the availability of the number of UEs per network slice, it sends a request message for the availability check and update of the number of UEs per network slice to the NSACF, and the request message includes the UE ID (the UE ID is, for example, a subscription permanent identifier , SUPI)), access type, S-NSSAI and update flag, where the update flag is used to indicate to increase the number of registered UEs on the slice, or to decrease the number of registered UEs on the slice.
  • the request message may carry one or more S-NSSAI, which is not limited in this application.
  • the update flag indicates to increase the number of registered UEs on the slice; when the UE is deregistered from the S-NSSAI, the update flag indicates to decrease the number of registered UEs on the slice.
  • the NSACF updates the number of registered UEs on the S-NSSAI.
  • the NSACF after receiving the availability check and update request message of the number of UEs per network slice from the AMF, the NSACF updates the number of registered UEs on the S-NSSAI according to the information carried in the request message.
  • the update flag carried in the availability check of the number of UEs per network slice and the update request message indicates to increase the number of registered UEs on the slice, then the NSACF checks whether the UE ID is already in the list of UEs registered to the S-NSSAI, or NSACF Check whether there is a UE ID carried in the request message in the UE list of the S-NSSAI, that is, check whether the S-NSSAI has counted the UE ID.
  • the NSACF does not need to update the number of registered UEs on the S-NSSAI.
  • NSACF creates new entries associated with this update and temporarily maintains old entries (if any) associated with previous updates. The NSACF deletes the old entry when receiving the request message including the update flag indicating to reduce the number of registered UEs on the slice.
  • NSACF will add the UE ID to the list of UEs registered in S-NSSAI, and increase The number of UEs currently registered to the S-NSSAI.
  • the NSACF returns the result parameter to indicate that the number of registered UEs on the S-NSSAI has reached maximum value.
  • the NSACF checks the number of entries associated with the UE ID.
  • the NSACF removes the UE ID from the list of registered UEs in the S-NSSAI.
  • NSACF In case there are two entries associated with UE ID, NSACF shall delete the old entry and keep the new entry.
  • the NSACF sends a UE quantity per network slice availability check and update response message to the AMF (NSACF returns Nnsacf_UEsPerSliceAvailabilityCheckAndUpdate_Response).
  • the availability check and update response message of the number of UEs per network slice includes an S-NSSAI(s) whose number of registered UEs has reached the maximum value and a result parameter, where the result parameter is used to indicate that the S-NSSAI(s) The number of registered UEs on has reached the maximum value.
  • the AMF sends a registration acceptance message to the UE, and at the same time AMF also sends a reject NSSAI (Reject NSSAI), the list includes the S-NSSAI(s) whose number of registered UEs reaches the maximum value.
  • the MAF may also carry a reason for rejection (for example, the maximum number of UEs per network slice has been reached) and an optional backoff timer in the response message.
  • AMF can decide to include these Default S-NSSAI in Allowed NSSAI. Otherwise, the AMF rejects the UE's registration request. In the Registration Reject message, the AMF includes the rejected S-NSSAI in the Rejected NSSAI parameter.
  • Method 300 includes:
  • the UE sends a network slice registration request message to the AMF.
  • the network slice registration request message includes S-NSSAI1 and S-NSSAI2, that is, the UE requests to register with S-NSSAI1 and S-NSSAI2 (or requests to register with the network slice identified by S-NSSAI1 and S-NSSAI2 superior).
  • the AMF sends an availability check and update request message for the number of UEs per network slice to the NSACF.
  • the AMF is a malicious AMF (for example, the AMF is compromised by an attacker), and the UE quantity availability check and update request message for each network slice carries S-NSSAI1, S-NSSAI2 and S-NSSAI3, and also carries UE ID, access type, update identification, etc., the update identification is used to indicate to increase the number of registered UEs on the network slices S-NSSAI1, S-NSSAI2 and S-NSSAI3.
  • the NSACF updates the number of registered UEs on S-NSSAI1, S-NSSAI2 and S-NSSAI3.
  • the NSACF increases the number of registered UEs on S-NSSAI3 due to the attacker's request. After the malicious AMF launches several attacks, the number of registered UEs on the S-NSSAI3 will soon reach full capacity, so that other UEs cannot access the network slice.
  • the present application provides an authorization verification method, which can prevent malicious AMFs from launching DoS attacks through the availability check and update process of the number of UEs per network slice.
  • FIG. 4 shows an exemplary flowchart of a method 400 provided by an embodiment of the present application.
  • the method 400 includes:
  • the mobility management network element (20) sends a slice registration request message to the slice statistics network element (30).
  • the slice registration request message includes the identifier of the terminal device (10) and the identifier of the network slice.
  • the slice registration request message may be used to request to increase the number of terminal statistics counted on the network slice.
  • the mobility management network element (20) may be an AMF
  • the slice statistics network element (30) may be an NSACF.
  • the slice statistics network element (30) judges whether the terminal device (10) occupies the resource of the network slice.
  • the slice statistics network element (30) judges whether the terminal device (10) occupies the resources of the network slice, or in other words, the slice statistics network element (30) judges that the terminal device ( 10) Whether the network slice has been accessed, or in other words, the slice statistics network element (30) judges whether the terminal device (10) has registered to the network slice.
  • the slice statistics network element (30) judges whether the number of terminal statistics included in the network slice is greater than or equal to a set threshold.
  • the slice statistical network element (30) determines that the number of terminal statistics included in the network slice is greater than or equal to the set threshold, the slice statistical network element (30) judges whether the terminal device (10) occupies the network slice resource. That is to say, if the number of terminal statistics included in the network slice is less than the set threshold, it is not necessary to verify whether the terminal device (10) occupies the resources of the network slice, thereby reducing resource overhead.
  • the slice statistics network element (30) first judges the terminal Whether the device (10) occupies the resources of the network slice, if the judgment result shows that the terminal device (10) occupies the resources of the network slice, then the slice statistics network element (30) verifies the terminals included in the terminal statistics of the network slice Whether the device occupies the resources of the network slice. If one or more terminal devices among the terminal devices do not occupy the resources of the network slice, the slice statistics network element (30) deletes the one or more terminal devices from the terminal statistics included in the network slice.
  • the slice statistics network element (30) requests the storage network element (40) to judge whether the terminal device (10) occupies the resource of the network slice.
  • the slice statistics network element (30) sends a slice verification request message to the storage network element (40).
  • the slice verification request message includes the identifier of the terminal device (10) and the identifier of the network slice.
  • the slice verification request message may be used to request the storage network element (40) to verify whether the terminal device (10) occupies the resource of the network slice.
  • the storage network element (40) receives the slice verification request message from the slice statistics network element (30). Then in response to the slice verification request message, at 422, the storage network element (40) acquires slice information of the terminal device (10).
  • the storage network element (40) acquires slice information of the terminal device (10) locally according to the identifier of the terminal device (10). If the storage network element (40) fails to obtain the slice information of the terminal device (10) locally, or in other words, if the storage network element (40) does not store the slice information of the terminal device (10) locally, the storage network element (40) determines The terminal device (10) does not occupy the resources of the network slice, or the storage network element (40) requests the terminal device (10) to obtain slice information of the terminal device (10), and then judges the terminal device (10) according to the slice information ) whether the resource of the network slice is occupied.
  • the terminal device (10) when the trigger condition is met, the terminal device (10) generates an integrity-protected message, which includes slice information of the network slice occupied by the terminal device (10), and then the terminal device ( 10) Send the message to the storage network element (40), and after receiving the slice information, the storage network element (40) saves the slice information locally, and the slice information is associated with the identifier of the terminal device (10).
  • the trigger condition here is, for example, that the terminal device (10) receives a non-access stratum security mode command message, or the terminal device (10) receives a registration acceptance message.
  • the mobility management network element (20) if the mobility management network element (20) is configured to send slice information from the terminal device (10) to the storage network element (40), at the same time the network slice is included in the terminal device (10) In the allowed network slice, and the network slice is required to perform network slice admission control, the mobility management network element (20) initiates the slice registration request message in step 410, then in this case, if the storage network element (40 ) after receiving the slice verification request message from the slice statistics network element (30), if the slice information associated with the identification of the terminal device (10) is not found locally, the storage network element can determine that the terminal device (10) does not occupy the Resources for network slicing.
  • the storage network element (40) can send the The terminal device (10) requests to obtain the slice information. For example:
  • the storage network element (40) sends a slice information request message to the terminal device (10).
  • the storage network element (40) sends a slice information request message to the terminal device (10) through the mobility management network element (20), the slice information request message includes the identifier of the terminal device (10), and the slice information request message The method is used to request to acquire slice information of the network slice occupied by the terminal device (10).
  • the terminal device (10) sends a slice information response message to the storage network element (40), where the slice information response message includes the slice information.
  • the terminal device (10) after receiving the slice information request message from the storage network element (40), the terminal device (10) generates a slice information response message, and the response message includes slice information of the network slice occupied by the terminal device (10).
  • the slice information includes The requested network slice carried in the request message; if the terminal device does not carry the requested network slice in the registration request message, or in other words, the requested network slice carried by the terminal device (10) in the registration request message is empty, then the slice information Including indication information that the network slice requested by the terminal device (10) is empty.
  • the slice information includes the allowed network slice of the terminal device (10) if the terminal device (10) has received a registration acceptance message, and the registration acceptance message carries the allowed network slice of the terminal device (10), the slice information includes the allowed network slice of the terminal device (10) if the terminal device (10) has received the registration acceptance message, and the registration acceptance message does not carry the allowed network slice of the terminal device (10), or the terminal device (10) carried in the registration acceptance message
  • the allowed network slice of the terminal device (10) is empty, then the slice information includes indication information that the allowed network slice of the terminal device (10) is empty.
  • the terminal device (10) performs integrity protection on the slice information response message. For example, the terminal device (10) uses the integrity key and the slice information to generate an integrity check parameter, the terminal device (10) carries the integrity check parameter in the slice information response message, and the integrity check parameter is used To verify whether the slice information has been tampered with, the integrity key is a shared key between the terminal device (10) and the authentication network element (50), and this key is generated during the main authentication process of the terminal device (10) of.
  • the storage network element (40) determines whether the terminal device (10) occupies resources of the network slice according to the slice information.
  • the storage network element (40) after receiving the slice information response message from the terminal device (10), the storage network element (40) obtains the integrity check parameter and slice information in the slice information response message, and verifies the slice information according to the integrity check parameter Whether the slice information has been tampered with. For example: the storage network element (40) sends a verification request message to the authentication network element (50), the verification request message includes the integrity check parameter and the slice information, and the verification request message is used to request to verify whether the slice information has been tampered with.
  • the authentication network element (50) receives the verification request message, and then uses the integrity key and the slice information to generate an integrity check parameter, if the integrity check parameter and the verification request message generated by the authentication network element (50) Integrity check parameters carried in the same, then the verification is passed, otherwise the verification fails. Then the authentication network element (50) sends integrity verification indication information to the storage network element (40), where the integrity verification indication information is used to indicate whether the slice information has been tampered with.
  • the storage network element (40) receives the integrity verification indication information, and determines whether the slice information has been tampered with according to the integrity verification indication information.
  • the storage network element (40) sends a verification request message to the authentication network element (50), and the verification request message is used to request to obtain the integrity key shared between the terminal device (10) and the authentication network element.
  • the authentication network element (50) sends the integrity key to the storage network element (40) according to the verification request message.
  • the storage network element (40) generates an integrity check parameter according to the integrity key and the slice information, if the integrity check parameter generated by the storage network element (40) is the same as the integrity check parameter carried in the verification request message , the verification passes, otherwise the verification fails.
  • the storage network element (40) judges whether the terminal device (10) occupies resources of the network slice according to the slice information.
  • the terminal device (10) occupies resources of the network slice according to the slice information.
  • the storage network element (40) verifies whether the network slice belongs to the network slice requested by the terminal device (10); if the network slice belongs to the terminal device ( 10) In the case of the requested network slice, the storage network element (40) determines that the terminal device occupies the resources of the network slice; or,
  • the storage network element (40) verifies whether the network slice belongs to the allowed network slice of the terminal device (10); In the case that the device (10) is allowed to slice the network, the storage network element (40) determines that the terminal device (10) occupies the resource of the network slice; or,
  • the storage network element (40) verifies whether the network slice belongs to the default network slice of the terminal device (10); In the case of the default network slice belonging to the terminal device (10), the storage network element (40) determines that the terminal device occupies resources of the network slice; or
  • the storage network element (40) determines that the terminal device (10) does not occupy resources of the network slice.
  • the storage network element (40) may verify whether the terminal device (10) is connected to the network.
  • the storage network element (40) obtains the context of the terminal device (10) according to the identifier of the terminal device (10); if the storage network element (40) obtains the context of the terminal device (10), the storage network element (40) Determine that the terminal device (10) has accessed the network; if the storage network element (40) does not obtain the context of the terminal device (10), then the storage network element (40) determines that the terminal device (10) does not have access to the network .
  • the storage network element (40) sends status indication information to the slice management network element (30), and the status indication information is used to indicate whether the terminal device (10) is connected to the network The network, or the storage network element (40) sends verification failure indication information to the slice management network element (30).
  • the slice verification request message in step 421 also includes a mobility management network element (20), and before step 422, the storage network element (40) verifies the mobility management network element (20) after receiving the slice verification request message Whether it is a mobility management network element accessed by the terminal device (10), or in other words, verify whether the mobility management network element (20) matches the terminal device (10), or in other words, verify whether the terminal device (10) is connected to The mobility management network element (20) is selected.
  • the storage network element (40) acquires the context of the terminal device (10) according to the identifier of the terminal device (10); the storage network element (40) verifies the terminal device (10) according to the context of the terminal device (10) ) is connected to the mobility management network element (20).
  • the storage network element (40) acquires the identifier of the mobility management network element accessed by the terminal equipment (10) from the context of the terminal equipment (10), if the mobility management network element accessed by the terminal equipment (10) If the identifier is the same as the identifier of the mobility management network element (20), it means that the mobility management network element (20) is the mobility management network element accessed by the terminal device (10).
  • the storage network element (40) sends indication information to the slice management network element (30), and the indication information is used to instruct the terminal equipment (10)
  • the mobility management network element (20) is not accessed, or the storage network element (40) sends verification failure indication information to the slice management network element (30).
  • the storage network element (40) sends indication information to the slice statistics network element (30).
  • the indication information is used to indicate whether the terminal device (10) occupies the resource of the network slice, or the indication information is used to indicate whether the terminal device (10) accesses the network slice, or the indication information It is used to indicate to the terminal device (10) the identity of the terminal device that has not accessed the network slice, or the indication information is used to indicate to the terminal device (10) that all terminal devices have accessed the network slice, or the indication information is used It is used to indicate to the terminal device (10) the identity of the terminal device that has accessed the network slice.
  • the slice statistics network element (30) receives the indication information, and judges whether the terminal device (10) occupies the resource of the network slice according to the indication information.
  • the slice statistics network element (30) can verify all terminal devices included in the terminal statistics of the network slice in the above manner, and delete terminal devices that fail the verification from the terminal statistics included in the network slice.
  • the slice statistics network element (30) can set a flag and a timer corresponding to the flag.
  • the flag is used to indicate that all terminal devices included in the network slice have been verified, and the timer is used to indicate the valid time of the flag.
  • the slice statistics network element (30) only It is necessary to verify the terminal device that the mobility management network element requests statistics, and does not need to verify other terminal devices that have been included in the network slice.
  • the slice statistical network element (30) obtains the slice information of the network slice occupied by the terminal device (10) from the storage network element (40), so as to judge the network slice occupied by the terminal device (10) Whether the resource of the network slice is occupied.
  • the slice statistical network element (30) obtains the slice information of the network slice occupied by the terminal device (10) from the storage network element (40), so as to judge the network slice occupied by the terminal device (10) Whether the resource of the network slice is occupied.
  • the slice statistics management network element (20) sends a slice information request message to the storage network element (40), the slice information request message includes the identifier of the terminal device (10), and the slice information request message is used to request to obtain the terminal device (10) Slice information of occupied network slices.
  • the storage network element (40) receives the slice information request message.
  • the storage network element (40) acquires slice information of the network slice occupied by the terminal device (10), where the slice information includes any of the following: the network slice requested by the terminal device (10), the The network slice allowed by the terminal device (10), the indication information that the network slice requested by the terminal device (10) is empty, and the indication information that the network slice allowed by the terminal device (10) is empty. It should be understood that the manner in which the storage network element (10) obtains the slice information of the terminal device (10) is similar to S422, and will not be repeated here.
  • the storage network element (40) sends the slice information to the slice statistics network element (30).
  • the slice statistics network element (30) determines whether the terminal device (10) occupies resources of the network slice according to the slice information.
  • the slice statistics network element (30) verifies whether the network slice belongs to the network slice requested by the terminal device (10); If it belongs to the network slice requested by the terminal device (10), the slice statistics network element (30) determines that the terminal device occupies the resources of the network slice; or,
  • the slice statistics network element (30) verifies whether the network slice belongs to the allowed network slice of the terminal device (10); In the case that the terminal device (10) is allowed to slice the network, the slice statistics network element (30) determines that the terminal device (10) occupies the resource of the network slice; or,
  • the slice statistics network element (30) verifies whether the network slice belongs to the default network slice of the terminal device (10); When the slice belongs to the default network slice of the terminal device (10), the slice statistics network element (30) determines that the terminal device occupies the resources of the network slice; or
  • the slice statistics network element (30) determines that the terminal device (10) does not occupy resources of the network slice.
  • the slice statistics management network element (20) determines whether to include the terminal device (10) in the statistics of terminals accessing the network slice.
  • the slice statistical network element (30) counts the terminal device into the statistics of terminals accessing the network slice; when the judgment result is When the terminal device (10) does not occupy the resources of the network slice, the slice statistics network element (30) does not include the terminal device (10) in the statistics of terminals accessing the network slice.
  • the slice statistics network element determines whether to include the terminal device in the terminal statistics of the access network slice according to whether the terminal device occupies the resources of the network slice, so as to prevent malicious mobile management network elements from requesting the terminal device Include the terminal statistics of the network slice not occupied by the terminal device to launch a denial of service attack.
  • FIG. 5 shows an exemplary flowchart of a method 500 provided by an embodiment of the present application.
  • the method 500 includes:
  • the UE sends a registration request (Registration Request) message to the AMF.
  • the registration request message includes the identification of the UE (UE ID, such as UE's SUPI).
  • the Registration Request message may also include Requested NSSAI, and the Requested NSSAI may include one or more S-NSSAIs, and the Registration Request message is used for the UE to request to register with the one or more S-NSSAIs, or The registration request message is used for the UE to register on the network side.
  • the UE requesting to register with the one or more S-NSSAIs here means that the UE requests to register with the network slice identified or associated with the one or more S-NSSAIs, similar expressions in subsequent embodiments may also be A similar explanation will be made without repeating the description.
  • the UE ID can be SUCI; if this registration is not initial registration, the UE ID can be GUTI.
  • the UE and the network side complete the main authentication process.
  • UE and AUSF In the main authentication process, UE and AUSF generate key Kausf respectively.
  • the UDM will decrypt the SUCI into SUPI and send the SUPI to the AMF. for that SUPI. If the UE ID carried in the registration request message is a GUTI, the AMF will map the GUTI to a SUPI after receiving the registration request, and the UE ID used in the subsequent procedures is the SUPI.
  • the AMF sends a registration accept (Registration accept) message to the UE.
  • a registration accept Registration accept
  • the AMF sends a registration acceptance message to the UE, and the registration acceptance message includes Allowed NSSAI.
  • the Allowed NSSAI belongs to the Requested NSSAI, that is, the slices in the Allowed NSSAI are part or all of the slices in the Requested NSSAI; or the Allowed NSSAI does not belong to the Requested NSSAI, that is, the slices in the Allowed NSSAI do not include the slices in the Requested NSSAI.
  • the Allowed NSSAI belongs to the Default NSSAI.
  • the UE sends the registered slice information to the AMF through a NAS message.
  • the UE may send the registration slice information to the AMF through the NAS message according to the registration context stored in the UE.
  • the NAS message also includes UE ID, message type and slice information of the network slice occupied by the UE, and the message type is used to indicate that the NAS message is used to report slice information.
  • the slice information includes at least one of Requested NSSAI, Allowed NSSAI, Requested NSSAI empty indication information, and Allowed NSSAI empty indication information.
  • the slice information can be carried in the network slice container, and the network slice container also includes the UE ID, container type, message authentication code MAC-I, and optionally the network slice container may also include freshness parameters.
  • the container type is used to indicate that the network slice container includes slice information corresponding to the UE ID.
  • the NAS message includes UE ID, message type, message authentication code MAC-I, and at least one of Requested NSSAI, Allowed NSSAI, Requested NSSAI is empty indication information, and Allowed NSSAI is empty indication information , optionally including the freshness parameter.
  • the message type is used to indicate that the NAS message needs to be transmitted to the UDM corresponding to the UE ID
  • the Message Type also indicates that the NSA message is used to report slice information.
  • the message authentication code MAC-I may be generated according to all parameters in the NAS message. It should be noted that the message authentication code MAC-I is used to verify the integrity of the network slice container, that is, to verify whether the information in the network slice container has been tampered with.
  • the UE can use the key Kausf generated in the main authentication process and the UE ID, slice information, and container type in the network slice container as input parameters to generate a MAC-I.
  • the UE can also use Kausf, freshness parameters, and container type as input parameters to generate the key Ks, and then use Ks and the UE ID, slice information, and container type in the Network Slice container as input parameters to generate MAC-I.
  • the slice information may include at least one item of Requested NSSAI, Allowed NSSAI, indication information that Requested NSSAI is empty, and indication information that Allowed NSSAI is empty.
  • the network slicing information may include an indication that the Requested NSSAI is empty, and the indication that the Requested NSSAI is empty may be used to indicate that the UE has not requested network slicing; for another example, the registration process has been completed, but the registration acceptance message does not carry the Allowed NSSAI , or the Allowed NSSAI list is empty, at this time, the network slice information may include an indication that the Allowed NSSAI is empty, and the indication that the Allowed NSSAI is empty, and the indication that the Allowed NSSAI is empty, and the indication that the Allowed NSSAI is empty, and the indication that the Allowed NSSAI is empty, and the indication that the Allowed NSSAI is empty.
  • the slice information can include either the Allowed NSSAI or the indication that the Requested NSSAI is empty.
  • the indication that the Requested NSSAI is empty is used to indicate that the UE does not request network slicing when the registration is initiated.
  • the AMF sends slice information to the UDM.
  • the AMF after receiving the NAS message from the UE, the AMF sends the network slice container to the UDM according to the message type in the NAS message.
  • the network slice container includes slice information, UE ID, container type, and message authentication code MAC-I.
  • the network slice container also includes a freshness parameter.
  • the UDM verifies the integrity of the message through the AUSF.
  • UDM after UDM receives the network slice container from AMF, it determines according to the container type that the network slice container includes slice information reported by the UE, and finds the UE root key Kausf according to the UE ID and the corresponding AUSF in the UE context. AUSF, and request the AUSF to verify the integrity of the network slice container.
  • This application does not limit the specific method of verifying message integrity. Two specific examples are given below:
  • UDM sends the parameters for generating MAC-I to AUSF, including UE ID, slice information, and container type. If MAC-I is generated through Ks, the freshness parameter should also be sent to AUSF. After receiving the parameters, AUSF generates MAC-I-AUSF with Kausf, UE ID, slice information, and container type as input parameters. If the parameters contain freshness parameters, AUSF first generates Kausf, freshness parameters, and container type as input parameters. Key Ks, and then Ks, UE ID, slice information, and container type are used as input parameters to generate MAC-I-AUSF.
  • the AUSF returns the generated MAC-I-AUSF to the UDM, and the UDM compares the MAC-I-AUSF with the MAC-I. If the values are the same, the verification succeeds, and if the values are different, the verification fails.
  • UDM sends the network slice container to AUSF, AUSF generates MAC-I-AUSF according to the above method, and then compares MAC-I-AUSF with MAC-I, if the values are the same, the verification succeeds, and if the values are different, the verification fails .
  • AUSF returns the verification result to UDM.
  • the UDM saves slice information.
  • the UDM stores the slice information reported by the UE as the UE context.
  • the AMF sends a registration accept (Registration accept) message to the UE.
  • a registration accept Registration accept
  • the UE can either report the slice information to the UDM through the AMF during the registration process, or After the registration process, slice information is reported to UDM through AMF. Therefore, if the registration process is not completed at 503, that is, the AMF does not send a registration acceptance message to the UE at 503, the AMF may send a registration acceptance message to the UE at 508, and the registration acceptance message carries Allowed NSSAI.
  • the AMF sends a UE number per network slice availability check and update request (Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request) message to the NSACF.
  • Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request a UE number per network slice availability check and update request
  • the AMF determines the number of UEs per network slice that initiates Availability check and update process, and send an availability check and update request message for the number of UEs per network slice to NSACF, the request message includes UE ID, AMF ID#1, access type, S-NSSAI and update flag, the AMF ID# 1 is used to identify the AMF.
  • the availability check and update request message for the number of UEs per network slice is used to request to update the number of registered UEs on the first network slice, and the first network slice corresponds to the S-NSSAI.
  • the update flag is used to indicate to increase the number of registered UEs on the first network slice or to decrease the number of registered UEs on the first network slice.
  • the request message may carry one or more S-NSSAI, which is not limited in this application.
  • the NSACF checks whether the slice is full and whether the UE ID has been counted.
  • the NSACF receives the availability check and update request message of the number of UEs per network slice from the AMF, and if the update identifier carried in the request message is used to indicate to increase the number of registered UEs on the first network slice, the NSACF checks the first network slice Whether the number of registered UEs on the slice is full, that is, check whether the number of registered UEs on the first network slice has reached the maximum value, or check whether the number of registered UEs on the first network slice has reached a set threshold.
  • the NSACF sends an indication that the first network slice is full to the AMF.
  • the NSACF also checks whether the UE corresponding to the UE ID has been counted on the first network slice, or whether the UE ID is already in the registered UE list of the first network slice middle. If the UE has been counted, the NSACF generates a new entry and sends the corresponding result parameters to the AMF.
  • NSACF If the first network slice is not full and the UE is not counted on the first network slice, NSACF first counts the UE on the first network slice. The statistics process is shown in S202. A slice UE number availability check and update response (Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Response) message, as shown in S203, and optionally, the NSACF judges whether the number of UEs on the first network slice reaches a set threshold.
  • the NSAFC further verifies all registered UEs (denoted as UEs) on the first network slice, the UEs include the UEs identified by the UE ID in 509, and the verification content includes the status of these UEs, whether the UEs are compatible with The AMF matches, whether the UEs match the first network slice.
  • the NSACF requests the UDM to perform authentication.
  • the NSACF sends a verification request message to the UDM.
  • the UE involved in the embodiment of the present application (that is, the UE corresponding to the UE ID in step 509) is used as an example for illustration, and the verification methods for other UEs are similar to this, and will not be described again.
  • the NSACF may request the UDM to verify all UEs in the UEs at the same time, and may also verify other UEs in other UEs after the UE is verified. In the latter case, the UE is verified first, and then other UEs can be verified when the UE fails to be verified. If the UE is successfully verified, other UEs in the UEs may not be verified.
  • This application is not limited.
  • the NSACF finds the UDM corresponding to the UE according to the UE ID, and sends a verification request message to the UDM, and the verification request message includes the UE ID, AMF ID#1 and S-NSSAI.
  • the UDM verifies the UE status and AMF ID#1.
  • the UDM detects the UE context corresponding to the UE according to the UE ID. If the UE context is not detected, it means that the UE does not access the network, and the verification fails.
  • the UDM returns a verification failure response message to the AMF, and carries a reason value;
  • the UDM further verifies the AMF ID#1 according to the AMF information stored in the UE context, or in other words, the UDM further verifies whether the AMF ID#1 carried in the verification request message matches the AMF actually accessed by the UE, Specifically, the UDM obtains the AMF ID#2 through the AMF information in the UE context, and the AMF ID#2 is used to identify the AMF accessed by the UE, and the UDM verifies whether the AMF ID#1 and the AMF ID#2 are the same. If they are the same, the verification is passed; if they are not the same, the UE verification fails, and UDM records the UE ID of the failed UE.
  • the UDM checks whether the S-NSSAI is in the Subscribed NSSAI (Subscribed NSSAI).
  • the UDM finds the UE subscription information stored locally according to the UE ID and obtains the Subscribed NSSAI corresponding to the UE, and then checks whether the S-NSSAI carried in the verification request message is in the Subscribed NSSAI. If not, the verification fails, and the UDM sends The NSACF sends a response message of verification failure and carries a cause value.
  • the verification is passed, further verify whether the UE has access to the S-NSSAI (or further verify whether the UE occupies the resources of the S-NSSAI, or further verify whether the UE is registered to the S-NSSAI, or further verify Whether the S-NSSAI matches the slice information of the UE, or further verify whether the S-NSSAI belongs to the Requested NSSAI/Allowed NSSAI/Default NSSAI of the UE).
  • the UDM requests the slice information of the UE from the UE through the AMF.
  • UDM sends a slice information request message to UE through AMF.
  • the slice information request message is used to request slice information of UE.
  • the slice information request message carries UE ID and Message type, where the Message type is used to indicate the request message Used to request slice information.
  • a timer can be set. If the timer expires and the slice information reported by the UE has not been received, the UDM will judge that the verification has failed, and send a verification failure response message to the NSACF with the reason value.
  • the AMF will send the slice information request message to the UE.
  • the UE reports the slice information of this slice registration to the UDM through the AMF. . It should be understood that the UE will perform integrity protection on the slice information to prevent the slice information from being tampered with. 514.
  • the UDM verifies whether the UE has accessed the S-NSSAI.
  • the UDM verifies whether the UE has accessed the S-NSSAI according to slice information reported by the UE.
  • the slice information includes an indication that the Allowed NSSAI is empty, it means that the Allowed NSSAI list in the Registration Accept message received by the UE is empty, and the verification fails.
  • the slice information includes an indication that the Requested NSSAI is empty, it means that the UE has not requested network slicing, and the UDM verifies whether the S-NSSAI belongs to the Default NSSAI. If it does, the verification succeeds; if it does not, the verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the Requested NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the Allowed NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • UDM verifies whether the S-NSSAI in the request message belongs to Allowed NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • the UDM sends the verification result to the NSACF.
  • the verification result includes the UE ID.
  • the verification result includes all UE IDs and failure reason values that failed verification. If there is no UE that fails the verification, the verification result includes indications that all UEs have passed the verification.
  • the NSACF obtains verification information from the UDM, and then performs verification according to the verification information.
  • verification information obtained from the UDM, and then performs verification according to the verification information.
  • the NSACF sends a slice information request message to the UDM.
  • the NSACF finds the corresponding UDM according to the UE ID, and sends a slice information request message to the UDM, the slice information request message is used to request slice information of the UE, and the slice information request message includes the UE ID of the UE.
  • the UDM receives the slice information request message.
  • the UDM finds the corresponding UE context according to the UE ID in the slice information request message. If the corresponding UE context is not stored in the UDM, the UDM returns an indication that the UE context does not exist to the NSACF. If there is a UE context in the UDM, proceed to 517. step.
  • the UDM sends the slice information of the UE to the NSACF.
  • the UDM sends the slice information reported by the UE to the NSACF.
  • the UDM also sends the information of the AMF accessed by the UE to the NSACF.
  • the information of the AMF is (or includes) AMF ID#2, for example, and the AMF ID#2 is used to identify the AMF actually accessed by the UE.
  • the NSACF verifies whether the S-NSSAI matches the slice information.
  • the NSACF judges whether the AMF that sends the availability check and update request message for the number of UEs per network slice is the AMF accessed by the UE according to the information of the AMF accessed by the UE. For example, the NSACF verifies whether the AMF ID#1 is the same as the AMF ID#2. If , the verification passes, if not, the verification fails;
  • the NSACF verifies whether the S-NSSAI carried in the availability check of the number of UEs per network slice and the update request message matches the slice information of the UE.
  • the verification steps are the same as in 514. If the slice information includes the indication that the Requested NSSAI is empty, it means that the UE has not requested a network slice, and the UDM verifies whether the S-NSSAI belongs to the Default NSSAI. If it does, the verification succeeds. If not, then verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the Requested NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the Allowed NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • UDM verifies whether the S-NSSAI in the request message belongs to Allowed NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • FIG. 6 shows an exemplary flowchart of a method 600 provided by an embodiment of the present application.
  • the method 600 includes:
  • the UE sends a registration request (Registration Request) message to the AMF.
  • Registration Request Registration Request
  • the UE and the network side complete the main authentication process.
  • the AMF sends a registration accept (Registration accept) message to the UE.
  • a registration accept Registration accept
  • steps 601-603 are similar to steps S501-S503 in method 500, and will not be repeated here.
  • the AMF sends a Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request message to the NSACF, where the request message includes UE ID, AMF ID#1, access type, S-NSSAI and update flag.
  • the NSACF checks whether the slice is full and whether the UE ID has been counted.
  • steps 604-605 are similar to steps S509-S510 in method 500, and will not be repeated here.
  • the NSACF judges whether the number of UEs on the first network slice reaches a set threshold. If the set threshold is reached, the NSAFC further verifies the status of the UE, whether the UE matches the AMF, and whether the UE matches the first network slice.
  • the first network slice corresponds to the S-NSSAI in the UE Quantity Availability Check and Update Request message per network slice.
  • the NSACF requests the UDM to perform authentication.
  • the NSACF sends a verification request message to the UDM.
  • the NSACF finds the corresponding UDM according to the UE ID, and sends a verification request message to the UDM, and the verification request message includes the UE ID, S-NSSAI, and AMF ID.
  • the UDM verifies the UE status and AMF ID#1.
  • step 607 is similar to S512 in the method 500, and will not be repeated here.
  • the UDM checks whether the S-NSSAI is in the contracted NSSAI.
  • the UDM acquires the Subscribed NSSAI corresponding to the UE according to the locally stored UE subscription information, and then checks whether the S-NSSAI carried in the verification request message is in the Subscribed NSSAI.
  • the UDM can also detect whether the S-NSSAI is in the Default NSSAI.
  • UDM can send a response message of successful verification to NSACF; if S-NSSAI does not belong to Subscribed NSSAI, UDM can send a response message of failed verification to NSACF, and carry the reason value; if S-NSSAI If it belongs to the Subscribed NSSAI but not the Default NSSAI, the UDM can further request the UE to obtain slice information of the UE through the AMF.
  • S-NSSAI belongs to Default NSSAI
  • the UDM sends a slice information request message to the UE through the AMF.
  • the slice information request message is used to request slice information of the UE, and the slice information request message carries UE ID and Message type, wherein the Message type is used to indicate that the request message is used to request slice information.
  • a timer can be set. If the timer expires and the slice information reported by the UE has not been received, the UDM will judge that the verification has failed, and send a verification failure response message to the NSACF with the reason value.
  • the AMF will send the slice information request message to the UE,
  • the UE reports the slice information to the UDM through the AMF.
  • the UE reports the registered slice information and the message authentication code MAC-I to the UDM through the AMF.
  • the message authentication code is used to protect the integrity of the slice information, so as to prevent the slice information from being tampered with.
  • the specific method is similar to the method of generating the message authentication code introduced in S504 of the method 500, and will not be described again.
  • the UDM verifies message integrity.
  • the method for verifying message integrity in 611 is similar to the solution introduced in S506 in method 500, and will not be described again.
  • the UDM verifies whether the UE has accessed the S-NSSAI.
  • the UDM verifies whether the UE has access to the S-NSSAI according to the slice information reported by the UE.
  • the slice information includes an indication that the Allowed NSSAI is empty, it means that the Allowed NSSAI list in the Registration Accept message received by the UE is empty, and the verification fails.
  • the slice information includes an indication that the Requested NSSAI is empty, it means that the UE has not requested network slicing, and the UDM verifies whether the S-NSSAI belongs to the Default NSSAI. If it does, the verification succeeds; if it does not, the verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the Requested NSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • the UDM verifies whether the S-NSSAI belongs to the AllowedNSSAI, and if it does, the verification succeeds; if it does not, the verification fails.
  • the UDM sends the verification result to the NSACF.
  • the verification result includes UE ID. If the verification result is a verification failure, the failure reason may also be carried.
  • the NSACF obtains verification information from the UDM, and then performs verification according to the verification information.
  • verification information obtained from the UDM, and then performs verification according to the verification information.
  • the NSACF sends a slice information request message to the UDM.
  • the NSACF finds the corresponding UDM according to the UE ID, and sends a slice information request message to the UDM, the slice information request message is used to request slice information of the UE, and the slice information request message includes the UE ID of the UE.
  • the UDM sends a slice information request message to the UE through the AMF.
  • the UE reports slice information to the UDM through the AMF.
  • the UDM verifies message integrity.
  • 615-617 are similar to 609-611 and will not be repeated here.
  • the UDM sends slice information to the NSACF.
  • the UDM sends the slice information reported by the UE to the NSACF.
  • the UDM also sends the UE status indication information and the information of the AMF accessed by the UE to the NSACF.
  • the information of the AMF is (or includes) AMF ID#2, for example, and the AMF ID#2 is used to identify the AMF actually accessed by the UE.
  • the NSACF verifies whether the UE has accessed the S-NSSAI.
  • step 619 is similar to S518 in method 500, and will not be described repeatedly.
  • the NSACF sends the number of UEs per network slice availability check and update response (Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Response) message to the AMF.
  • the NSACF updates the number of registered UEs on the first network slice according to the request message, and returns the number of UEs per network slice to the AMF Availability check and update response message, which is used to indicate that the number of UEs has been successfully updated; if the verification of the information carried in the availability check and update request message of the number of UEs per network slice fails, the NSACF returns the availability check and the number of UEs per network slice to the AMF An update response message, where the response message is used to indicate that the verification fails, or the response message is used to reject the availability check of the number of UEs per network slice and the update request message.
  • a reason for failure or rejection may also be carried.
  • the AMF sends a registration accept message to the UE.
  • the above procedure can occur during the registration procedure of the UE, and can also occur after the registration procedure. If the above process is sent after the UE registration process, the AMF may send a registration acceptance message to the UE after completing the above-mentioned UE number availability check and update process per network slice, and the registration acceptance message includes Allowed NSSAI.
  • FIG. 7 is a schematic block diagram of an apparatus 10 for network verification provided by an embodiment of the present application.
  • the device 10 includes a transceiver module 11 and a processing module 12 .
  • the transceiver module 11 can realize corresponding communication functions, and the processing module 12 is used for data processing.
  • the transceiver module 11 can also be called a communication interface or a communication unit.
  • the device 10 may correspond to the slice statistics network element (20) (or NSACF) in the method embodiment above.
  • the device 10 may correspond to the slice statistics network element (20) in the method 400 of the embodiment of the present application, or the UDM in the methods 500 to 600.
  • the apparatus 10 may include a module for executing the method performed by the slice statistical network element (20) (or NSACF) in FIG. 4 to FIG. 6 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are for realizing the corresponding processes of the methods shown in FIG. 4 to FIG. 6 .
  • the transceiver module 11 in the device 10 executes the receiving and sending operations performed by the slice statistics network element (20) (or NSACF) in the above method embodiments, and the processing module 12 executes the receiving and sending operations in addition to the receiving and sending operations operation.
  • the apparatus 10 may correspond to the terminal device (10) (or UE) in the above method embodiments.
  • the apparatus 10 may correspond to the terminal device (10) in the method 400 of the embodiment of the present application, or the UE in the methods 500 to 600.
  • the apparatus 10 may include modules for performing the methods performed by the terminal device (10) (or UE) in FIG. 4 to FIG. 6 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are for realizing the corresponding processes of the methods shown in FIG. 4 to FIG. 6 .
  • the transceiver module 11 in the apparatus 10 performs the receiving and sending operations performed by the terminal equipment (10) (or UE) in the above method embodiments, and the processing module 12 performs operations other than the receiving and sending operations .
  • the device 10 may correspond to the storage network element (40) (or UDM) in the above method embodiment.
  • the communication device 10 may correspond to the storage network element (40) in the method 400 of the embodiment of the present application, or the NSACF in the methods 500 to 600.
  • the apparatus 10 may include a module for executing the method executed by the storage network element (40) (or UDM) in FIG. 4 to FIG. 6 .
  • each unit in the device 10 and the above-mentioned other operations and/or functions are for realizing the corresponding processes of the methods shown in FIG. 4 to FIG. 6 .
  • the transceiver module 11 in the device 10 executes the receiving and sending operations performed by the storage network element (40) (or UDM) in the above method embodiments, and the processing module 12 executes other than the receiving and sending operations operate.
  • FIG. 8 is a schematic diagram of an apparatus 20 for network verification provided by an embodiment of the present application.
  • the device 20 may correspond to the slice statistics network element (20) (or NSACF) in the method embodiment above; in another possible design, the device 10 may correspond to the above The terminal device (10) (or UE) in the method embodiment; in yet another possible design, the device 10 may correspond to the storage network element (40) (or UDM) in the method embodiment above.
  • the device 20 may include a processor 21 (ie, an example of a processing module) and a memory 22 .
  • the memory 22 is used to store instructions
  • the processor 21 is used to execute the instructions stored in the memory 22, so that the apparatus 20 implements the steps performed by the terminal device or the network device in the methods corresponding to FIG. 4 to FIG. 6 .
  • the device 20 may also include an input port 23 (ie, an example of a transceiver module) and an output port 24 (ie, another example of a transceiver module).
  • the processor 21 , the memory 22 , the input port 23 and the output port 24 can communicate with each other through internal connection paths, and transmit control and/or data signals.
  • the memory 22 is used to store a computer program, and the processor 21 can be used to call and run the computer program from the memory 22, to control the input port 23 to receive signals, and to control the output port 24 to send signals, so as to complete the terminal equipment or Steps for network devices.
  • the memory 22 can be integrated in the processor 21 or can be set separately from the processor 21 .
  • the input port 23 is a receiver
  • the output port 24 is a transmitter.
  • the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.
  • the input port 23 is an input interface
  • the output port 24 is an output interface
  • the functions of the input port 23 and the output port 24 may be realized by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 21 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer to implement the communication device provided in the embodiment of the present application.
  • the program codes to realize the functions of the processor 21 , the input port 23 and the output port 24 are stored in the memory 22 , and the general processor realizes the functions of the processor 21 , the input port 23 and the output port 24 by executing the codes in the memory 22 .
  • FIG. 9 shows a schematic structural diagram of a simplified network device 30 .
  • the network equipment includes 31 parts and 32 parts.
  • Part 31 is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; part 32 is mainly used for baseband processing and control of network equipment.
  • Part 31 may generally be referred to as a transceiver module, a transceiver, a transceiver circuit, or a transceiver.
  • the part 32 is usually the control center of the network device, which can be generally referred to as a processing module, and is used to control the network device to perform the processing operations on the network device side in the foregoing method embodiments.
  • the transceiver module of Part 31, which may also be referred to as a transceiver or transceiver, etc., includes an antenna and a radio frequency circuit, wherein the radio frequency circuit is mainly used for radio frequency processing.
  • the device used to realize the receiving function in Part 31 can be regarded as a receiving module
  • the device used to realize the sending function can be regarded as a sending module, that is, Part 31 includes a receiving module and a sending module.
  • the receiving module may also be called a receiver, receiver, or receiving circuit, etc.
  • the sending module may be called a transmitter, transmitter, or transmitting circuit, etc.
  • Section 32 may include one or more single boards, and each single board may include one or more processors and one or more memories.
  • the processor is used to read and execute programs in the memory to implement baseband processing functions and control network devices. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, it is also possible that multiple single boards share one or more processors, or that multiple single boards share one or more memories, or that multiple single boards share one or more processors at the same time. device.
  • the network device shown in FIG. 9 may be any network device shown in the methods shown in FIG. 4 to FIG. ), storage network element (40), authentication network element (50), etc.
  • the transceiver module of part 31 is used to execute the steps related to the sending and receiving of any network device in the method shown in Fig. 4 to Fig. 6; the part 32 is used to execute the steps related to the processing of any network device in the method shown in Fig. 4 to Fig. 6 step.
  • FIG. 9 is only an example rather than a limitation, and the foregoing network device including a transceiver module and a processing module may not depend on the structure shown in FIG. 9 .
  • the chip When the device 40 is a chip, the chip includes a transceiver module and a processing module.
  • the transceiver module may be an input-output circuit or a communication interface;
  • the processing module is a processor or a microprocessor or an integrated circuit integrated on the chip.
  • FIG. 10 is a schematic structural diagram of a terminal device 40 provided in the present application.
  • the terminal device 40 includes a processor, a memory, a control circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program. described action.
  • the memory is mainly used for storing software programs and data, such as storing the codebook described in the above embodiments.
  • the control circuit is mainly used for conversion of baseband signal and radio frequency signal and processing of radio frequency signal.
  • the control circuit and the antenna can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users.
  • the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 10 only shows a memory and a processor. In an actual terminal device, there may be multiple processors and memories.
  • a storage may also be called a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.
  • the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used to process communication protocols and communication data, and the central processor is mainly used to control the entire terminal device, execute A software program that processes data for a software program.
  • the processor in FIG. 10 integrates the functions of the baseband processor and the central processing unit.
  • the baseband processor and the central processing unit can also be independent processors, interconnected through technologies such as a bus.
  • a terminal device may include multiple baseband processors to adapt to different network standards, a terminal device may include multiple central processors to enhance its processing capability, and various components of the terminal device may be connected through various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit may also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the terminal device 40 includes a transceiver unit 41 and a processing unit 42 .
  • the transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like.
  • the device in the transceiver unit 41 for realizing the receiving function can be regarded as a receiving unit
  • the device in the transceiver unit 41 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 41 includes a receiving unit and a sending unit.
  • the receiving unit may also be called a receiver, receiver, receiving circuit, etc.
  • the sending unit may be called a transmitter, transmitter, or transmitting circuit, etc.
  • the terminal device shown in FIG. 10 can execute various actions performed by the terminal device in the methods shown in FIG. 4 to FIG. 6 , and detailed description thereof is omitted here to avoid redundant description.
  • the embodiment of the present application further provides a computer-readable storage medium, on which computer instructions for implementing the method executed by the first network device in the above method embodiment are stored.
  • the computer program when executed by a computer, the computer can implement the method performed by the network device in the foregoing method embodiments.
  • the embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.
  • An embodiment of the present application further provides a communication system, where the communication system includes the network device in the foregoing embodiments.
  • the network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer may include hardware such as a central processing unit (central processing unit, CPU), a memory management unit (memory management unit, MMU), and memory (also called main memory).
  • the operating system of the operating system layer can be any one or more computer operating systems that realize business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer may include applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as the program that records the code of the method provided in the embodiment of the present application can be executed according to the method provided in the embodiment of the present application Just communicate.
  • the execution subject of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program.
  • Computer-readable media may include, but are not limited to, magnetic storage devices (such as hard disks, floppy disks, or tapes, etc.), optical disks (such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc. ), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).
  • magnetic storage devices such as hard disks, floppy disks, or tapes, etc.
  • optical disks such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc.
  • smart cards and flash memory devices for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.
  • Various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.
  • processors mentioned in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits ( application specific integrated circuit (ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM may include the following forms: static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM synchronous DRAM
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • Direct memory bus random access memory direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module may be integrated in the processor.
  • memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.
  • the disclosed devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to implement the solutions provided in this application.
  • each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer may be a personal computer, a server, or a network device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium, (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, DVD
  • a semiconductor medium for example, a solid state disk (SSD)
  • the aforementioned available The medium may include but not limited to: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种网络验证的方法和装置，该方法可以包括：切片统计网元(30)接收来自移动管理网元(20)的切片注册请求消息(410)，该切片注册请求消息(410)包括终端设备(10)的标识和网络切片的标识；响应于该切片注册请求消息(410)，该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源；根据判断结果，该切片统计网元(30)确定是否将该终端设备(10)计入接入该网络切片的终端统计。

Description

网络验证的方法和装置
本申请要求于2021年09月18日提交中国专利局、申请号为202111101901.6、申请名称为“网络验证的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种网络验证的方法和装置。
背景技术
为了应对网络流量的爆炸性增长，第五代移动通信(the fifth generation,5G)网络需要能够同时支持多样化的服务需求，以满足不同服务对网络吞吐量、延迟、数量和可靠性等指标要求。5G网络需要具有高带宽以承载虚拟现实、超高清视频和其他服务。同时5G网络需要提供海量连接和超低时延以更好的服务车联网业务、工业制造等。
不同的应用场景对网络功能、系统性能、安全性、用户体验等有不同的要求。如果使用同一网络提供服务，网络势必会非常复杂、繁琐，而且还会造成高额的网络维护费用。相反，如果对不同服务需求的不同业务提供专有网络，而且专有网络仅包含此类业务所需的功能，则该业务的服务效率将大大提高，网络性能也会得保障。这将会保证应用程序方案所需的网络性能，网络的操作和维护也会变得简单。
5G网络切片将现有网络进行分割，形成独立的逻辑网络，为差异化业务提供定制服务。根据不同的服务质量要求，通过分配相应的网络功能和网络资源，实现5G架构的实例化。5G网络切片的逻辑网络是网络功能资源和这些网络功能配置的集合。这个逻辑网络包含满足特定业务需求的网络特征。
5G网络中，可以通过对网络切片上的注册UE的数量的统计和限制实现对网络切片的准入控制。在UE通过AMF接入网络切片后，AMF会通知NSACF更新网络切片上的注册UE的数量，当网络切片上的注册UE数量达到最大值时，NSACF会阻止UE接入此网络切片。然而，当AMF发生异常或被攻击者攻破后，AMF可能会恶意向NSACF请求更新一些的网络切片上的注册UE数量，这会导致这些网络切片上的注册UE数量很快达到满额，使得其他UE无法接入这些网络切片，从而引起网络切片的拒绝服务。因此，如何防止AMF通过每网络切片UE可用性检查和授权流程发起DoS攻击，是当前亟待解决的问题。
发明内容
本申请提供了一种网络验证的方法和装置，以防止恶意的移动管理网元通过请求将终端设备计入该终端设备未占用的网络切片的终端统计，来发起拒绝服务攻击。
第一方面，提供了一种网络验证的方法，该方法包括：切片统计网元(30)接收来自移动管理网元(30)的切片注册请求消息(410)，该切片注册请求消息(101)包括终端 设备(10)的标识和网络切片的标识；响应于该切片注册请求消息，该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源；根据判断结果，该切片统计网元(30)确定是否将该终端设备(10)计入接入该网络切片的终端统计。
应理解，这里的切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源，还可以是切片统计网元(30)判断终端设备(10)是否接入了该网络切片，或者是切片统计网元(30)判断终端设备(10)是否注册到了该网络切片。
基于上述技术方案，切片统计网元根据终端设备是否占用了网络切片的资源，来确定是否将终端设备计入接入网络切片的终端统计，从而可以防止恶意的移动管理网元通过请求将终端设备计入该终端设备未占用的网络切片的终端统计，来发起拒绝服务攻击。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源，包括：该切片统计网元(30)向存储网元(40)发送切片信息请求消息(428)，该切片信息请求消息(428)包括该终端设备(10)的标识，该切片信息请求消息(428)用于请求获取该终端设备(10)占用的网络切片的切片信息；该切片统计网元(30)接收来自该存储网元(40)的该切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许接入的网络切片、该终端设备(10)的请求网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；该切片统计网元(30)根据该切片信息，判断该终端设备(10)是否占用了该网络切片的资源。
基于上述技术方案，切片统计网元通过存储网元获取终端设备占用的网络切片的切片信息，从而可以根据该切片信息来判断该终端设备是否占用了该网络切片的资源，从而可以确定是否将该终端设备计入接入该网络切片的终端统计。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(20)根据该切片信息，判断该终端设备(10)是否占用了该网络切片的资源，包括：当该切片信息包括该终端设备(10)请求的网络切片时，该切片统计网元(30)验证该网络切片是否属于该终端设备(10)请求的网络切片；在该网络切片属于该终端设备(10)请求的网络切片的情况下，该切片统计网元(30)确定该终端设备占用了该网络切片的资源；或者，当该切片信息包括该终端设备(10)被允许的网络切片时，该切片统计网元(30)验证该网络切片是否属于该终端设备(10)被允许的网络切片；在该网络切片属于该终端设备(10)被允许的网络切片的情况下，该切片统计网元(30)确定该终端设备(10)占用了该网络切片的资源；或者，当该切片信息包括该终端设备(10)请求的网络切片为空的指示信息时，该切片统计网元(30)验证该网络切片是否属于该终端设备(10)的默认网络切片；在该网络切片属于该终端设备(10)的默认网络切片的情况下，该切片统计网元(30)确定该终端设备占用了该网络切片的资源；或者，当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，该切片统计网元(30)确定该终端设备(10)没有占用该网络切片的资源。
基于上述技术方案，切片统计管理网元可以根据获取到的切片信息的内容，灵活验证该终端设备是否占用了该网络切片的资源，从而可以确定是否将该终端设备计入接入该网络切片的终端统计。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(30)根据该切片信 息，判断该终端设备(10)是否占用了该网络切片的资源，包括：该切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，该切片验证请求消息(421)包括该终端设备(10)的标识和该网络切片的标识，该切片验证请求消息(421)用于请求验证该终端设备(10)是否占用了该网络切片的资源；该切片统计网元(30)接收来自该存储网元(40)的指示信息(426)；该切片统计网元(30)根据该指示信息(426)确定该终端设备(10)是否占用了该网络切片的资源。
基于上述技术方案，切片统计网元可以请求存储网元验证该终端设备是否占用了该网络切片的资源，从而可以确定是否将该终端设备计入接入该网络切片的终端统计。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该切片统计网元(30)验证该终端设备(10)是否接入了网络。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(30)验证该终端设备(10)是否接入了网络，包括：该切片统计网元(30)向存储网元(40)发送终端信息请求消息，该终端信息请求消息包括该终端设备(10)的标识；该切片统计网元(30)接收来自该存储网元(40)的状态指示信息；该切片统计网元(30)根据该状态指示信息确定该终端设备(10)是否接入了网络。
应理解，在该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源之前，或同时，请求切片统计网元(30)验证该终端设备(10)是否接入了网络。
在该切片统计网元(30)确定终端设备(10)没有接入网络时，切片统计网元(30)判断该终端设备(10)没有接入该网络切片，或者，该切片统计网元(30)判断该移动管理网元发生了异常，或者，该切片统计网元(30)确定不将终端设备(10)计入接入该网络切片的终端统计，或者，该切片统计网元(30)拒绝或忽略来自移动管理网元(20)的切片注册请求消息。
结合第一方面，在第一方面的某些实现方式中，在该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源之前，该方法还包括：该切片统计网元(30)验证该终端设备(10)是否接入了该移动管理网元(20)，或者说，该切片统计网元(30)验证该终端设备(10)是否与该移动管理网元(20)对应。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(30)验证该终端设备(10)是否接入了该移动管理网元(20)，包括：该切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，该切片验证请求消息(421)包括该移动管理网元(20)的标识；该切片统计网元(30)接收来自该存储网元(40)的指示信息；该切片统计网元(30)根据该指示信息确定该终端设备(10)是否接入了该移动管理网元(20)。
应理解，在该切片统计网元(30)判断该终端设备(10)是否占用了该网络切片的资源之前，或同时，请求切片统计网元(30)验证该终端设备(10)是否接入了该移动管理网元(20)。
在该切片统计网元(30)确定终端设备(10)未接入该移动管理网元(20)时，切片统计网元(30)判断该终端设备(10)没有接入该网络切片，或者，该切片统计网元(30)判断该移动管理网元发生了异常，或者，该切片统计网元(30)确定不将终端设备(10)计入接入该网络切片的终端统计，或者，该切片统计网元(30)拒绝或忽略来自移动管理网元(20)的切片注册请求消息。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该切片统计网元(30)验证计入该网络切片的终端统计的一个或多个终端设备是否占用了该网络切片的资源。
在该实现方式中，切片统计网元(30)可以在验证了终端设备(10)的同时，或者之后，验证计入该网络切片上的终端统计的其他终端设备是否占用了该网络切片的资源，当这些其他终端设备中的一个或多个没有占用该网络切片的资源，或者说当这些其他终端设备中的一个或多个没有接入该网络切片，则切片统计网元(30)将该一个或多个终端设备从该网络切片的终端统计中删除，从而可以使得该网络切片上的终端统计更加准确。
结合第一方面，在第一方面的某些实现方式中，该方法还包括：该切片统计网元(30)确定接入该网络切片的终端统计的数量大于或等于阈值。
基于上述技术方案，接入该网络切片的终端统计的数量大于或等于设定的阈值的情况下，切片统计网元才去判断该终端设备是否占用了该网络切片的资源，而不是在任意情况都进行判断，从而可以节省资源。
结合第一方面，在第一方面的某些实现方式中，该切片统计网元(30)根据判断结果，该切片统计网元(30)确定是否将该终端设备(10)计入接入该网络切片的终端统计，包括：当该终端设备(10)占用了该网络切片的资源时，该切片统计网元(30)将该终端设备计入接入该网络切片的终端统计；当该终端设备(10)没有占用该网络切片的资源时，该切片统计网元(30)不将该终端设备(10)计入接入该网络切片的终端统计。
基于上述技术方案，切片统计网元可以根据判断结果确定是否将该终端设备计入接入该网络切片的终端统计，从而可以防止恶意的移动管理网元通过请求将终端设备计入该终端设备未占用的网络切片的终端统计，来发起拒绝服务攻击。
结合第一方面，在第一方面的某些实现方式中，该切片注册请求消息用于请求将该终端设备计入接入该网络切片上的终端统计。
第二方面，提供了一种网络验证的方法，该方法包括：存储网元(40)接收来自切片统计网元(30)的切片验证请求消息(421)，该切片验证请求消息(421)包括终端设备(10)的标识和网络切片的标识；响应于该切片验证请求消息(421)，该存储网元(40)获取该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许的网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；该存储网元(40)根据该终端设备(10)的切片信息，验证该终端设备(10)是否占用了该网络切片的资源。
基于上述技术方案，存储网元根据切片验证请求消息，判断终端设备是否占用了网络切片的资源，从而可以向切片统计网元指示判断结果，以便切片统计网元可以确定是否将终端设备计入接入网络切片的终端统计，从而可以防止恶意的移动管理网元通过请求将终端设备计入该终端设备未占用的网络切片的终端统计，来发起拒绝服务攻击。
结合第二方面，在第二方面的某些实现方式中，该存储网元(40)根据该终端设备(10)的切片信息，验证该终端设备(10)是否占用了该网络切片的资源，包括：当该切片信息包括该终端设备(10)请求的网络切片时，该存储网元(40)验证该网络切片是否属于该终端设备(10)请求的网络切片，在该网络切片属于该终端设备(10)请求的网络切片的情况下，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源；当该切片信 息包括该终端设备(10)被允许的网络切片时，该存储网元(40)验证该网络切片是否属于该终端设备(10)被允许的网络切片，在该网络切片属于该终端设备(10)被允许的网络切片的情况下，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源；当该切片信息包括该终端设备(10)的请求网络切片为空的指示信息时，该存储网元(40)验证该网络切片是否属于该终端设备(10)的默认网络切片，在该网络切片属于该终端设备(10)的默认网络切片的情况下，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源；当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源。
基于上述技术方案，存储网元可以根据获取到的切片信息的内容，灵活验证该终端设备是否占用了该网络切片的资源，以便切片管理网元可以确定是否将该终端设备计入接入该网络切片的终端统计。
结合第二方面，在第二方面的某些实现方式中，该存储网元(40)获取该终端设备(10)占用的网络切片的切片信息，包括：该存储网元(40)根据该终端设备(10)的标识，在本地获取该切片信息。
结合第二方面，在第二方面的某些实现方式中，该存储网元(40)获取该终端设备(10)占用的网络切片的切片信息，包括：在该存储网元(40)本地没有该切片信息时，该存储网元(40)向该终端设备(10)发送切片信息请求消息(423)，该切片信息请求消息(423)用于请求获取该切片信息；该存储网元(40)接收来自该终端设备(10)的受到了完整性保护的切片信息响应消息，该切片信息响应消息包括该切片信息和完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改。
基于上述技术方案，存储网元可以从本地获取该终端设备占用的网络切片的切片信息，或者向终端设备请求该切片信息，从而可以根据该切片信息判断终端设备是否占用了该网络切片的资源，以便切片管理网元可以确定是否将该终端设备计入接入该网络切片的终端统计。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：存储网元(40)验证该终端设备(10)是否接入了网络；在终端设备(10)没有接入网络的情况下，该存储网元(40)向切片管理网元(30)发送状态指示信息，该状态指示信息用于指示终端设备(10)是否接入了网络，或者，存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
结合第二方面，在第二方面的某些实现方式中，该存储网元(40)验证该终端设备(10)是否接入了网络，包括：该存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；如果存储网元(40)获取到了该终端设备(10)的上下文，则存储网元(40)确定终端设备(10)接入了网络；如果存储网元(40)没有获取到该终端设备(10)的上下文，则存储网元(40)确定终端设备(10)没有接入网络。
结合第二方面，在第二方面的某些实现方式中，该切片验证请求消息(421)还包括移动管理网元(20)的标识，该方法还包括：存储网元(40)验证该终端设备(10)是否接入了该移动管理网元(20)；在该终端设备(10)没有接入该移动管理网元(20)的情况下，该存储网元(40)向切片管理网元(30)发送指示信息，该指示信息用于指示该终端设备(10)没有接入该移动管理网元(20)，或者，该存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
结合第二方面，在第二方面的某些实现方式中，该存储网元(40)验证该终端设备(10)是否接入了该移动管理网元(20)，包括：该存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；该存储网元(40)根据该终端设备(10)的上下文验证该终端设备(10)是否接入了该移动管理网元(20)。
结合第二方面，在第二方面的某些实现方式中，该方法还包括：该存储网元(40)向验证网元(50)发送验证请求消息，该验证请求消息包括该切片信息和该完整性校验参数，该验证请求消息用于请求验证该切片信息是否被篡改；该存储网元(40)接收来自该验证网元(50)的完整性验证指示信息；该存储网元(40)根据该完整性验证指示信息确定该切片信息是否被篡改。
基于上述技术方案，存储网元可以根据完整性校验参数验证来自终端设备的切片信息的完整性，从而防止切片信息被篡改。
结合第二方面，在第二方面的某些实现方式中，在该存储网元(40)获取该终端设备(10)的切片信息之前，该方法还包括：该储存网元(40)确定该网络切片的标识属于该终端设备(10)的签约网络切片。
基于上述技术方案，存储网元在判断终端设备是否占用了该网络切片的资源之前，先判断网络切片的标识是否属于终端设备的签约网络切片，在该网络切片的标识不属于终端设备的签约网络切片的情况下，存储网元便不需要执行后续判断流程，从而可以节省资源开销。
结合第二方面，在第二方面的某些实现方式中，该切片验证请求消息(424)用于请求验证该终端设备(10)是否占用了该网络切片的资源。
第三方面，提供了一种网络验证的方法，该方法包括：在满足触发条件的情况下，终端设备(10)生成具有完整性保护的消息，该消息包括该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任意一项：该终端设备的请求网络切片、该终端设备的允许网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；该终端设备(10)将该消息发送给存储网元(40)。
基于上述技术方案，终端设备在满足触发条件的情况下，向存储网元上报该终端设备占用的网络切片的切片信息，以便移动管理网元向切片管理网元请求将该终端设备计入接入该网络切片的终端统计时，可以通过存储网元判断该终端设备是否占用了该网络切片的资源，从而确定是否将该终端设备计入接入该网络切片的终端统计。
结合第三方面，在第三方面的某些实现方式中，该触发条件包括以下任意一项或多项：该终端设备(10)接收到非接入层安全模式命令消息；该终端设备(10)接收到注册接受消息；该终端设备(10)接收到来自该存储网元(40)的切片信息请求消息(423)，该切片信息请求消息(423)用于请求获取该切片信息。
结合第三方面，在第三方面的某些实现方式中，该方法还包括：该终端设备(10)利用完整性密钥和该切片信息生成完整性校验参数，该消息中还包括该完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改。
终端设备将发送给存储网元的切片信息进行了完整性保护，从而可以避免该切片信息被篡改。
第四方面，提供了一种网络验证的方法，其特征在于，包括：终端设备(10)向移动 管理网元(20)发送注册请求消息，该注册请求消息用于该终端设备(10)请求注册到网络；该终端设备(10)接收非接入层安全模式命令消息；在该注册请求消息携带请求网络切片的情况下，该终端设备(10)向切片统计网元(30)发送切片信息，该切片信息包括该请求网络切片；在该注册请求消息没有携带请求网络切片的情况下，该终端设备(10)向切片统计网元(30)发送切片信息，该切片信息包括该请求网络切片为空的指示信息。
第五方面，提供了一种网络验证的方法，其特征在于，包括：终端设备(10)向移动管理网元(20)发送注册请求消息，该注册请求消息用于该终端设备(10)请求注册到网络；该终端设备(10)接收来自该移动管理网元(20)的注册接受消息；在该注册接受消息包括允许网络切片的情况下，该终端设备(10)向切片统计网元(30)发送切片信息，该切片信息包括该允许网络切片；在该注册接受消息不包括该允许网络切片的-情况下，该终端设备(10)向该切片统计网元(30)发送切片信息，该切片信息包括该允许网络切片为空的指示信息。
第六方面，提供了一种网络验证的方法，其特征在于，包括：移动管理网元(20)向存储网元(40)发送终端设备(10)占用的网络切片的切片信息之后，该移动管理网元(20)向切片统计网元(30)发送注册请求消息(410)，该注册请求消息(410)包括终端设备(10)的标识和网络切片的标识。可选地，该注册请求消息(410)用于请求将终端设备(10)计入接入该网络切片上的终端统计的数量。
在一种实现方式中，当该网络切片被包括在终端设备(10)的被允许的网络切片中，且这个网络切片被要求进行网络切片的准入控制时，移动管理网元(20)才向切片统计网元(30)发送注册请求消息(410)，以请求切片统计网元(30)对该网络切片进行准入控制，这里的准入控制流程包括切片统计网元(30)将占用了网络切片资源的终端设备计入接入该网络切片的终端统计。
基于上述技术方案，移动管理网元在向存储网元发送了终端设备的切片信息之后，才发起网络切片准入控制流程，在这种情况下的网络切片准入控制流程中，如果存储网元在本地没有找到该终端设备的切片信息，则可以确定该终端设备没有占用该网络切片的资源，或者确定该终端设备没有接入该网络切片，而不需要额外的验证，从而可以节省资源。
第七方面，提供了一种网络验证的装置，其特征在于，包括：收发模块，用于接收来自移动管理网元(30)的切片注册请求消息(410)，该切片注册请求消息(101)包括终端设备(10)的标识和网络切片的标识；处理模块，用于响应于该切片注册请求消息，判断该终端设备(10)是否占用了该网络切片的资源；该处理模块，还用于根据判断结果，确定是否将该终端设备(10)计入接入该网络切片的终端统计。
结合第七方面，在第七方面的某些实现方式中，该收发模块具体用于：向存储网元(40)发送切片信息请求消息(428)，该切片信息请求消息(428)包括该终端设备(10)的标识，该切片信息请求消息(428)用于请求获取该终端设备(10)占用的网络切片的切片信息；接收来自该存储网元(40)的该切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许接入的网络切片、该终端设备(10)的请求网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；该处理模块具体用于：根据该切片信息，判断该终端设备(10)是否占用了该网络切片的资源。
结合第七方面，在第七方面的某些实现方式中，该处理模块具体用于：当该切片信息包括该终端设备(10)请求的网络切片时，验证该网络切片是否属于该终端设备(10)请求的网络切片；在该网络切片属于该终端设备(10)请求的网络切片的情况下，确定该终端设备占用了该网络切片的资源；或者，该处理模块具体用于：当该切片信息包括该终端设备(10)被允许的网络切片时，验证该网络切片是否属于该终端设备(10)被允许的网络切片；在该网络切片属于该终端设备(10)被允许的网络切片的情况下，确定该终端设备(10)占用了该网络切片的资源；或者，该处理模块具体用于：当该切片信息包括该终端设备(10)请求的网络切片为空的指示信息时，验证该网络切片是否属于该终端设备(10)的默认网络切片；在该网络切片属于该终端设备(10)的默认网络切片的情况下，确定该终端设备占用了该网络切片的资源；或者，该处理模块具体用于：当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，确定该终端设备(10)没有占用该网络切片的资源。
结合第七方面，在第七方面的某些实现方式中，该收发模块具体用于：所向存储网元(40)发送切片验证请求消息(421)，该切片验证请求消息(421)包括该终端设备(10)的标识和该网络切片的标识，该切片验证请求消息(421)用于请求验证该终端设备(10)是否占用了该网络切片的资源；接收来自该存储网元(40)的指示信息(426)；该处理模块具体用于：根据该指示信息(426)确定该终端设备(10)是否占用了该网络切片的资源。
结合第七方面，在第七方面的某些实现方式中，该处理模块还用于：确定接入该网络切片的终端统计的数量大于或等于阈值。
结合第七方面，在第七方面的某些实现方式中，当该终端设备(10)占用了该网络切片的资源时，该处理模块具体用于将该终端设备计入接入该网络切片的终端统计；当该终端设备(10)没有占用该网络切片的资源时，该处理模块具体用于不将该终端设备(10)计入接入该网络切片的终端统计。
结合第七方面，在第七方面的某些实现方式中，该第一请求消息用于请求增加接入该网络切片上的终端统计的数量。
第八方面，提供了一种网络验证的装置，其特征在于，包括：收发模块，用于接收来自切片统计网元(30)的切片验证请求消息(421)，该切片验证请求消息(421)包括终端设备(10)的标识和网络切片的标识；处理模块，用于响应于该切片验证请求消息(421)，获取该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许的网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；该处理模块，还用于根据该终端设备(10)的切片信息，验证该终端设备(10)是否占用了该网络切片的资源。
结合第八方面，在第八方面的某些实现方式中，当该切片信息包括该终端设备(10)请求的网络切片时，该处理模块具体用于验证该网络切片是否属于该终端设备(10)请求的网络切片，在该网络切片属于该终端设备(10)请求的网络切片的情况下，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源；当该切片信息包括该终端设备(10)被允许的网络切片时，该处理模块具体用于验证该网络切片是否属于该终端设备(10)被 允许的网络切片，在该网络切片属于该终端设备(10)被允许的网络切片的情况下，该处理模块具体用于确定该终端设备(10)占用了该网络切片的资源；当该切片信息包括该终端设备(10)的请求网络切片为空的指示信息时，该处理模块具体用于验证该网络切片是否属于该终端设备(10)的默认网络切片，在该网络切片属于该终端设备(10)的默认网络切片的情况下，该处理模块具体用于确定该终端设备(10)占用了该网络切片的资源；当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，该处理模块具体用于确定该终端设备(10)占用了该网络切片的资源。
结合第八方面，在第八方面的某些实现方式中，该处理模块具体用于根据该终端设备(10)的标识，在本地获取该切片信息。
结合第八方面，在第八方面的某些实现方式中，在该处理模块没有从本地获取到该切片信息时，该收发模块具体用于向该终端设备(10)发送切片信息请求消息(423)，该切片信息请求消息(423)用于请求获取该切片信息；该收发模块具体用于接收来自该终端设备(10)的受到了完整性保护的切片信息响应消息，该切片信息响应消息包括该切片信息和完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改。
结合第八方面，在第八方面的某些实现方式中，该收发模块还用于向验证网元(50)发送验证请求消息，该验证请求消息包括该切片信息和该完整性校验参数，该验证请求消息用于请求验证该切片信息是否被篡改；接收来自该验证网元(50)的完整性验证指示信息；该处理模块还用于根据该完整性验证指示信息确定该切片信息是否被篡改。
结合第八方面，在第八方面的某些实现方式中，该处理模块还用于确定该网络切片的标识属于该终端设备(10)的签约网络切片。
结合第八方面，在第八方面的某些实现方式中，该切片验证请求消息(424)用于请求验证该终端设备(10)是否占用了该网络切片的资源。
第九方面，提供了一种网络验证的装置，其特征在于，包括：处理模块，用于在满足触发条件的情况下，生成具有完整性保护的消息，该消息包括该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任意一项：该终端设备的请求网络切片、该终端设备的允许网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息；收发模块，用于将该消息发送给存储网元(40)。
结合第九方面，在第九方面的某些实现方式中，该触发条件包括以下任意一项或多项：该收发模块接收到非接入层安全模式命令消息；该收发模块接收到注册接受消息；该收发模块接收到来自该存储网元(40)的切片信息请求消息(423)，该切片信息请求消息(423)用于请求获取该切片信息。
结合第九方面，在第九方面的某些实现方式中，该处理模块还用于利用完整性密钥和该切片信息生成完整性校验参数，该消息中还包括该完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改。
第十方面，提供一种通信装置，该装置用于执行上述第一方面至第五方面提供的方法。具体地，该装置可以包括用于执行第一方面至第五方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
在一种实现方式中，该装置为网络设备，例如该装置为切片统计网元(30)，或存储网元(40)，或认证网元(50)。当该装置为网络设备时，通信单元可以是收发器，或， 输入/输出接口；处理单元可以是处理器。
在另一种实现方式中，该装置为用于网络设备中的芯片、芯片系统或电路。当该装置为用于通信设备中的芯片、芯片系统或电路时，通信单元可以是该芯片、芯片系统或电路上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等；处理单元可以是处理器、处理电路或逻辑电路等。
一种可能情况，该装置为切片统计网元(30)或切片统计网元(30)中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第一方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
又一种可能情况，该装置为存储网元(40)或存储网元(40)中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第二方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
在另一种实现方式中，该装置为终端设备，例如该装置为终端设备(10)。当该装置为终端设备时，通信单元可以是收发器，或，输入/输出接口；处理单元可以是处理器。
一种可能情况，该装置为终端设备(10)或终端设备(10)中的芯片、芯片系统或电路。在该情况下，该装置可以包括用于执行第三方面至第五方面中任一方面提供的方法的单元和/或模块，如处理单元和/或通信单元。
可选地，上述收发器可以为收发电路。可选地，上述输入/输出接口可以为输入/输出电路。
第十一方面，提供一种通信装置，该装置包括：存储器，用于存储程序；处理器，用于执行存储器存储的程序，当存储器存储的程序被执行时，处理器用于执行上述第一方面至第五方面提供的方法。
第十二方面，本申请提供一种处理器，用于执行上述各方面提供的方法。在执行这些方法的过程中，上述方法中有关发送上述信息和获取/接收上述信息的过程，可以理解为由处理器输出上述信息的过程，以及处理器接收输入的上述信息的过程。在输出上述信息时，处理器将该上述信息输出给收发器，以便由收发器进行发射。该上述信息在由处理器输出之后，还可能需要进行其他的处理，然后才到达收发器。类似的，处理器接收输入的上述信息时，收发器获取/接收该上述信息，并将其输入处理器。更进一步的，在收发器收到该上述信息之后，该上述信息可能需要进行其他的处理，然后才输入处理器。
基于上述原理，举例来说，前述方法中提及的接收请求消息可以理解为处理器接收输入的信息。
对于处理器所涉及的发射、发送和获取/接收等操作，如果没有特殊说明，或者，如果未与其在相关描述中的实际作用或者内在逻辑相抵触，则均可以更加一般性的理解为处理器输出和接收、输入等操作，而不是直接由射频电路和天线所进行的发射、发送和接收操作。
在实现过程中，上述处理器可以是专门用于执行这些方法的处理器，也可以是执行存储器中的计算机指令来执行这些方法的处理器，例如通用处理器。上述存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第十三方面，提供一种计算机可读存储介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行上述第一方面至第五方面提供的方法。
第十四方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面至第五方面提供的方法。
第十五方面，提供一种芯片，该芯片包括处理器与通信接口，该处理器通过该通信接口读取存储器上存储的指令，执行上述第一方面至第五方面提供的方法。
可选地，作为一种实现方式，该芯片还可以包括存储器，该存储器中存储有指令，该处理器用于执行该存储器上存储的指令，当该指令被执行时，该处理器用于执行上述第一方面至第五方面提供的方法。
附图说明
图1是一种适用于本申请实施例的网络结构的示意图。
图2是一种网络切片准入控制的方法的示意性流程图。
图3是另一种网络切片准入控制的方法的示意性流程图。
图4是本申请实施例提供的一种网络验证方法的示例性流程图。
图5是本申请实施例提供的另一种网络验证方法的示例性流程图。
图6是本申请实施例提供的又一种网络验证方法的示例性流程图。
图7是本申请一个实施例提供的网络验证的装置的示意性框图。
图8是本申请另一个实施例提供的网络验证的装置的示意性框图。
图9是本申请又一个实施例提供的网络验证的装置的示意性框图。
图10是本申请又一个实施例提供的网络验证的装置的示意性框图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图，对本申请中的技术方案进行描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
为了解决背景技术提及的问题，如图1的(a)所示，本申请提供了一种通信系统，该通信系统包括终端设备(10)、移动管理网元(20)和切片统计网元(30)。其中，该切片统计网元(30)用于接收来自移动管理网元(30)的切片注册请求消息(410)，该切片注册请求消息(410)包括终端设备(10)的标识和网络切片的标识；响应于该切片注册请求小，该切片统计网元(30)判断该终端设备(10)是否占用了第一网络切片的资源；根据判断结果，该切片统计网元(30)确定是否将该终端设备(10)计入该网络切片的终端统计。
可选地，该系统中还包括存储网元(40)和认证网元(50)。其中，该存储网元(40)用于接收来自该切片统计网元(30)的切片验证请求消息(421)，该切片验证请求消息(421)包括该终端设备(10)的标识和该网络切片的标识；响应于该切片验证请求消息(421)，该存储网元(40)获取该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许的网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的 网络切片为空的指示信息；该存储网元(40)根据该终端设备(10)的切片信息，验证该终端设备(10)是否占用了该网络切片的资源。该认证网元(50)用于接收来自该存储网元的验证请求消息，该验证请求消息包括该终端设备(10)占用的网络切片的切片信息和完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改；该认证网元(50)根据该切片信息和完整性密钥生成完整性校验参数，在认证网元(50)生成的该完整性校验参数和该验证请求消息中携带的完整性校验参数相同的情况下，该认证网元(50)确定该切片信息没有被篡改。
应理解，图1的(a)中各网元之间的具体交互过程可以参照图4中的方法流程，具体实现的方案见方法400中的详细说明。
本申请提供的技术方案可以应用于各种通信系统，例如：第五代(5th generation，5G)或新无线(new radio，NR)系统、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)系统等。本申请提供的技术方案还可以应用于未来的通信系统，如第六代移动通信系统。本申请提供的技术方案还可以应用于设备到设备(device to device，D2D)通信，车到万物(vehicle-to-everything，V2X)通信，机器到机器(machine to machine，M2M)通信，机器类型通信(machine type communication，MTC)，以及物联网(internet of things，IoT)通信系统或者其他通信系统。
如图1的(b)所示，为基于服务化架构的第五代(5th generation，5G)网络架构示意图。应理解，图1的(a)中的移动管理网元(20)可以是图1的(b)中的AMF，图1的(a)中的存储网元(40)可以是图1的(b)中的UDM，图1的(a)中的认证网元(50)可以是图1的(b)中的AUSF，图1的(a)中的终端设备(10)可以是图1的(b)中的UE。图1的(a)中的切片管理网元(30)可以是NSACF。
图1的(b)所示的5G网络架构中可包括三部分，分别是终端设备部分、数据网络(data network，DN)和运营商网络部分。下面对其中的部分网元的功能进行简单介绍说明。
其中，运营商网络可包括以下网元中的一个或多个：鉴权服务器功能(authentication server function，AUSF)网元、网络开放功能(network exposure function，NEF)网元、策略控制功能(policy control function，PCF)网元、统一数据管理(unified data management，UDM)网元、统一数据库(unified data repository，UDR)、网络存储功能(network repository function，NRF)网元、应用功能(application function，AF)网元、接入与移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、无线接入网(radioaccess network，RAN)以及用户面功能(user plane function，UPF)网元等。上述运营商网络中，除无线接入网部分之外的部分可以称为核心网络部分。
1、终端设备(terminal device)：也可以成为用户设备(user equipment，UE)，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical) 中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。这里的终端设备，指的是第三代合作伙伴计划(3rd generation partnership project，3GPP)终端。为便于说明，本申请后续以UE代指终端设备为例进行说明。
上述终端设备可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备还可通过运营商网络访问DN，使用DN上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为运营商网络和终端设备之外的服务方，可为终端设备提供他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
2、无线接入网络(radio access network，RAN)网元：在下文中简称为RAN，对应接入网设备。
RAN是运营商网络的子网络，是运营商网络中业务节点与终端设备之间的实施系统。终端设备要接入运营商网络，首先是经过RAN，进而可通过RAN与运营商网络的业务节点连接。本申请中的RAN设备，是一种为终端设备提供无线通信功能的设备，RAN设备也称为接入网设备。本申请中的RAN设备包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。3、用户面功能(user plane function，UPF)：用于分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。
在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
4、多播/广播用户面功能(multicast/broadcast-user plane function，MB-UPF)
MB-UPF主要负责将多播广播流传送到RAN(或者UPF)，可以进行多播广播流的包过滤、分发，实现多播广播服务的QoS增强以及计数/上报等。本申请中的MB-UPF和UPF不做严格区分，使用(MB-)UPF表示MB-UPF或者UPF。
5、数据网络(data network，DN)：用于提供传输数据的网络。
在5G通信系统中，该数据网络网元可以是数据网络网元。在未来通信系统中，数据网络网元仍可以是DN网元，或者，还可以有其它的名称，本申请不做限定。
6、接入和移动管理网元
接入和移动管理网元主要用于移动性管理和接入管理等，可以用于实现MME功能中除会话管理之外的其它功能，例如，合法监听以及接入授权/鉴权等功能。
在5G通信系统中，该接入和移动管理网元可以是接入和移动管理功能(access and mobility management function，AMF)。在未来通信系统中，接入和移动管理设备仍可以是AMF，或者，还可以有其它的名称，本申请不做限定。
7、会话管理功能(session management function，SMF)：主要用于会话管理、用户 设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
在5G通信系统中，该会话管理网元可以是会话管理功能网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。
8、多播/广播会话管理功能(multicast/broadcast-session management function，MB-SMF)
MB-SMF主要负责多播广播会话管理，控制多播广播传输，根据PCF提供或本地配置的多播广播服务是策略规则对MB-UPF和RAN进行相应的配置，以完成多播广播流的传输。本申请中的MB-SMF和SMF不做严格区分，使用(MB-)SMF表示MB-SMF或者SMF。
9、策略控制功能(policy control function，PCF)：用于指导网络行为的统一策略框架，为控制面功能网元(例如AMF，SMF等)提供策略规则信息等。
在4G通信系统中，该策略控制网元可以是策略和计费规则功能(policy and charging rules function，PCRF)网元。在5G通信系统中，该策略控制网元可以是策略控制功能PCF网元。在未来通信系统中，策略控制网元仍可以是PCF网元，或者，还可以有其它的名称，本申请不做限定。
10、应用功能(application function，AF)：用于进行应用影响的数据路由，无线接入网络开放功能网元，与策略框架交互进行策略控制等。
在5G通信系统中，该应用网元可以是应用功能网元。在未来通信系统中，应用网元仍可以是AF网元，或者，还可以有其它的名称，本申请不做限定。
11、统一数据管理(unified data management，UDM)：用于处理UE标识，接入鉴权，注册以及移动性管理等。
在5G通信系统中，该数据管理网元可以是统一数据管理网元；在4G通信系统中，该数据管理网元可以是归属用户服务器(home subscriber server，HSS)网元在未来通信系统中，统一数据管理仍可以是UDM网元，或者，还可以有其它的名称，本申请不做限定。
12、统一数据存储(unified data repository，UDR)：主要包括以下功能：签约数据、策略数据、应用数据等类型数据的存取功能。
13、认证服务器(authentication server function，AUSF)：用于鉴权服务、产生密钥实现对用户设备的双向鉴权，支持统一的鉴权框架。
在5G通信系统中，该认证服务器可以是认证服务器功能网元。在未来通信系统中，认证服务器功能网元仍可以是AUSF网元，或者，还可以有其它的名称，本申请不做限定。
14、数据网络(data network，DN)：DN是位于运营商网络之外的网络，运营商网络可以接入多个DN，DN上可部署多种业务，可为终端设备提供数据和/或语音等服务。例如，DN是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备，DN中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，DN是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
图1的(b)中Nausf、Nnef、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号。这些接口序列号的含义可参见3GPP标准协议中定义的含义，在 此不做限制。
在图1的(b)所示的网络架构中，各网元之间可以通过图中所示的接口通信。如图所示，UE和AMF之间可以通过N1接口进行交互，交互消息例如可以称为N1消息(N1Message)。RAN和AMF之间可以通过N2接口进行交互，N2接口可以用于非接入层(non-access stratum，NAS)消息的发送等。RAN和UPF之间可以通过N3接口进行交互，N3接口可以用于传输用户面的数据等。SMF和UPF之间可以通过N4接口进行交互，N4接口可以用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息。UPF和DN之间可以通过N6接口进行交互，N6接口可以于传输用户面的数据等。其他接口与各网元之间的关系如图1中所示，为了简洁，这里不一一详述。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF、SMF、UPF、网络切片选择功能网元(network slice selection function，NSSF)、NEF、AUSF、NRF、PCF、UDM可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。为方便说明，本申请后续，以网络设备为接入和移动管理网元AMF，基站为无线接入网络RAN为例进行说明。
本申请中的终端设备(10)、移动管理网元(20)、切片统计网元(30)、存储网元(40)和认证网元(50)可以是5G系统中的UE、AMF、NSACF、UDM、AUSF，也可以是未来通信如第六代(6th generation，6G)网络中具有上述UE、AMF、NSACF、UDM、AUSF的功能的网元，本申请对此不限定。
应理解，上述应用于本申请实施例的网络架构仅是一种举例说明，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
例如，在某些网络架构中，AMF、SMF网元、PCF网元、BSF网元以及UDM网元等网络功能网元实体都称为网络功能(network function，NF)网元；或者，在另一些网络架构中，AMF，SMF网元，PCF网元，BSF网元，UDM网元等网元的集合都可以称为控制面功能网元。
本申请实施例的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问 的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
为便于理解本申请实施例，首先对本申请中涉及到的术语做简单说明。
1、允许网络切片选择辅助信息(Allowed NSSAI)：
服务PLMN在例如注册过程期间提供的NSSAI，指示UE可以在服务PLMN中用于当前注册区域的S-NSSAI值。
2、请求网络切片选择辅助信息(Requested NSSAI)：
UE在注册时向服务PLMN提供的NSSAI。
3、签约单网络切片选择辅助信息(Subscribed S-NSSAI)：
基于用户信息的S-NSSAI,UE在PLMN中签约使用。
4、默认单网络切片选择辅助信息(Default S-NSSAI)：
Subscribed NSSAI中带有Default指示的切片，当UE没有可以接入的网络切片时，默认接入的网络切片。
5、拒绝网络切片选择辅助信息(Reject NSSAI)：
UE在例如注册过程中请求接入的NSSAI，但服务PLMN拒绝UE接入，指示UE不可以在服务PLMN中用于当前注册区域的S-NSSAI值。
下面结合图2介绍一种网络切片准入控制方法200。方法200包括：
S201，AMF向NSACF发送每网络切片UE数量可用性检查和更新请求(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request)消息。
示例性地，当一个网络切片被包含在一个UE的允许NSSAI(Allowed NSSAI)中或在一个UE的Allowed NSSAI中被移除，且这个网络切片被要求进行网络切片准入控制(network slice admission control，NSAC)，AMF会发起每网络切片UE数量可用性检查和更新流程，该流程发起的几种可能的场景示例如下：
一示例，AMF可以在UE的注册流程(包括初始注册，移动性注册)中发起每网络切片UE数量可用性检查和更新流程。在提前接入控制(early admission control，EAC)模式被激活的情形下，AMF可以在向UE发送注册接受消息之前发起该流程；在EAC模式没有被激活的情形下，AMF可以在向UE发送注册接受消息之后发起该流程。
另一示例，AMF可以在UE去注册流程中发起每网络切片UE数量可用性检查和更新流程。
又一示例，AMF可以在由于网络切片认证和授权流程或UE签约切片改变所导致的UE配置更新流程中发起每网络切片UE数量可用性检查和更新流程。在EAC模式被激活的情形下，AMF在UE配置更新流程之前发起该流程；在EAC模式没被激活的情形下，AMF在UE配置更新流程之后发起该流程。
AMF确定发起每网络切片UE数量可用性检查和更新流程后，向NSACF发送每网络切片UE数量可用性检查和更新请求消息，该请求消息中包括UE ID(该UE ID例如是用 户永久标识(subscription permanent identifier，SUPI))，接入类型，S-NSSAI和更新标志，其中，该更新标志用于指示增加切片上的注册UE数量，或减少切片上的注册UE数量。另外该请求消息中可以携带一个或多个S-NSSAI，本申请不做限定。
当UE已经注册到S-NSSAI上时，该更新标志指示增加切片上的注册UE数量；当UE从S-NSSAI上去注册时，该更新标志指示减少切片上的注册UE数量。
S202，NSACF更新S-NSSAI上的注册UE数量。
示例性地，NSACF接收来自AMF的每网络切片UE数量可用性检查和更新请求消息之后，然后根据该请求消息中携带的信息，更新S-NSSAI上的注册UE数量。
一示例，该每网络切片UE数量可用性检查和更新请求消息中携带的更新标志指示增加切片上的注册UE数量，则NSACF检查UE ID是否已经在注册到了S-NSSAI的UE列表中，或者说NSACF检查S-NSSAI的UE列表中是否有请求消息中携带的UE ID，也就是检查S-NSSAI是否已经统计了该UE ID。
在UE ID已经在注册到了S-NSSAI的UE列表的情形下，说明该UE ID已经被统计为注册到了S-NSSAI(或者说该UE ID已经被统计为注册到了该S-NSSAI所标识的网络切片中)，此时NSACF无需更新S-NSSAI上的注册UE的数量。NSACF创建与此次更新关联的新条目，并临时维护与先前更新关联的旧条目(如果存在的话)。NSACF在接收到包括指示减少切片上的注册UE的数量的更新标志的请求消息时，删除旧条目。
在UE ID没有注册到S-NSSAI的UE列表，并且S-NSSAI上的注册UE的数量还没有达到最大值的情形下，NSACF将UE ID添加到注册到S-NSSAI的UE列表中，并增加当前注册到S-NSSAI的UE数量。
在UE ID没有注册到S-NSSAI的UE列表，但S-NSSAI上的注册UE的数量已经达到最大值的情形下，则NSACF返回结果参数以指示S-NSSAI上的注册UE的数量已经达到了最大值。
另一示例，该每网络切片UE数量可用性检查和更新请求消息中携带的更新标志指示减少切片上的注册UE数量，则NSACF检查与UE ID关联的条目的数量。
在只有一个与UE ID关联的条目的情形下，NSACF将UE ID从S-NSSAI的注册UE列表中删除该UE ID。
在有两个与UE ID关联的条目的情形下，NSACF将删除旧条目，并保留新条目。
S203，NSACF向AMF发送每网络切片UE数量可用性检查和更新响应消息(NSACF返回Nnsacf_UEsPerSliceAvailabilityCheckAndUpdate_Response)。
示例性地，该每网络切片UE数量可用性检查和更新响应消息中包括注册UE的数量已经达到最大值的S-NSSAI(s)以及结果参数，该结果参数用于指示该S-NSSAI(s)上的注册UE的数量已经达到了最大值。
在UE注册过程，如果UE请求向多个S-NSSAI进行注册，其中只有部分S-NSSAI达到了每网络切片的最大UE数量，则AMF向UE发送注册接受消息，同时AMF还发送拒绝NSSAI(Reject NSSAI)，该列表中包括注册UE的数量达到了最大值的S-NSSAI(s)。对于每个被拒绝的S-NSSAI，MAF还可以在响应消息中携带拒绝原因(例如每网络切片达到了最大UE数量)和可选的回退定时器。
如果UE在注册过程请求的一个或多个S-NSSAI均达到了最大UE数量，但是若一个 或多个签约的S-NSSAI在签约数据中标记为Default(记为Default S-NSSAI)，并且其不受网络切片准入控制，则AMF可以决定将这些Default S-NSSAI包括在Allowed NSSAI中。否则，AMF拒绝UE的注册请求。在注册拒绝消息中，AMF在被拒绝的NSSAI参数中包括被拒绝的S-NSSAI。
然而，当AMF发生异常或者被攻击者攻破时，AMF可能会向NSACF请求更新UE没有请求或者签约的网络切片上的注册UE的数量，这可能会导致网络切片上注册UE的数量很快达到满额，使得其他UE无法接入到该网络切片，从而引起网络切片的拒绝服务。下面结合图3中的方法300介绍一种恶意AMF发起拒绝服务(denial of service，DoS)的方法流程。方法300包括：
S301，UE向AMF发送网络切片注册请求消息。
示例性地，该网络切片注册请求消息中包括S-NSSAI1和S-NSSAI2，即UE请求注册S-NSSAI1和S-NSSAI2上(或者说请求注册到S-NSSAI1和S-NSSAI2所标识的网络切片上)。
S302，AMF向NSACF发送每网络切片UE数量可用性检查和更新请求消息。
示例性地，该AMF为恶意的AMF(例如该AMF被攻击者攻破)，该每网络切片UE数量可用性检查和更新请求消息中携带了S-NSSAI1、S-NSSAI2和S-NSSAI3，另外还携带了UE ID、接入类型、更新标识等，该更新标识用于指示增加网络切片S-NSSAI1、S-NSSAI2和S-NSSAI3上的注册UE数量。
S303，NSACF更新S-NSSAI1、S-NSSAI2和S-NSSAI3上的注册UE的数量。
由于UE没有请求注册到S-NSSAI3，因此NSACF因为攻击者的请求增加了S-NSSAI3上的注册UE数量。恶意的AMF多次发起攻击后，S-NSSAI3上的注册UE的数量很快就会达到满额，从而使得其他UE无法接入到该网络切片中。
鉴于此，本申请提供了一种授权验证的方法，可以防止恶意的AMF通过每网络切片UE数量可用性检查和更新流程发起DoS攻击。
图4示出了本申请实施例提供的方法400的示例性流程图。该方法400包括：
410，移动管理网元(20)向切片统计网元(30)发送切片注册请求消息。
示例性地，该切片注册请求消息包括终端设备(10)的标识和网络切片的标识。
可选地，该切片注册请求消息可以用于请求增加计入该网络切片上的终端统计的数量。
应理解，在5G系统中，该移动管理网元(20)可以是AMF，该切片统计网元(30)可以是NSACF。
420，切片统计网元(30)判断终端设备(10)是否占用了该网络切片的资源。
示例性地，响应于该切片注册请求消息，该切片统计网元(30)判断终端设备(10)是否占用了该网络切片的资源，或者说，该切片统计网元(30)判断终端设备(10)是否已经接入了该网络切片，或者说，该切片统计网元(30)判断终端设备(10)是否已经注册到了该网络切片。
可选地，在420之前，切片统计网元(30)判断计入该网络切片的终端统计的数量是否大于或等于设定的阈值。在切片统计网元(30)确定计入该网络切片的终端统计的数量大于或等于设定的阈值的情况下，切片统计网元(30)判断终端设备(10)是否占用了该网络切片的资源。也就是说，在计入该网络切片上的终端统计的数量小于设定的阈值的情 况下，可以不必验证该终端设备(10)是否占用了该网络切片的资源，从而可以减少资源开销。
另一方面，还可以验证计入该网络切片的终端统计的其他终端设备是否占用了该网络切片的资源。一种方式中，可以在确定了该网络切片的终端统计的数量大于或等于设定的阈值的情况下，同步验证计入该网络切片的终端统计的所有(或部分)终端设备，以及终端设备(10)是否占用了该网络切片的资源；另一种方式中，在确定了该网络切片的终端统计的数量大于或等于设定的阈值的情况下，切片统计网元(30)先判断终端设备(10)是否占用了该网络切片的资源，如果判断结果显示终端设备(10)占用了该网络切片的资源的话，切片统计网元(30)再验证计入该网络切片的终端统计的终端设备是否占用了该网络切片的资源。如果这些终端设备中存在一个或多个终端设备没有占用该网络切片的资源，则切片统计网元(30)将该一个或多个终端设备从计入该网络切片的终端统计中删除。
下面以终端设备(10)为例，介绍两种切片统计网元(30)判断终端设备(10)是否占用了该网络切片的资源的两种可能的实现方式。应理解，其他终端设备的验证方式类似，不再赘述。一种可能的实现方式中(记为方案a)，切片统计网元(30)请求存储网元(40)判断终端设备(10)是否占用了该网络切片的资源。示例性地：
421，切片统计网元(30)向存储网元(40)发送切片验证请求消息。
示例性的，该切片验证请求消息包括终端设备(10)的标识和该网络切片的标识。
可选地，该切片验证请求消息可以用于请求存储网元(40)验证终端设备(10)是否占用了该网络切片的资源。
对应的，存储网元(40)接收来自切片统计网元(30)的切片验证请求消息。然后响应于该切片验证请求消息，在422，存储网元(40)获取终端设备(10)的切片信息。
示例性地，存储网元(40)根据终端设备(10)的标识从本地获取该终端设备(10)的切片信息。如果存储网元(40)从本地获取终端设备(10)的切片信息失败，或者说，如果存储网元(40)本地没有保存终端设备(10)的切片信息，则存储网元(40)确定该终端设备(10)没有占用该网络切片的资源，或者该存储网元(40)向终端设备(10)请求获取该终端设备(10)的切片信息，然后根据该切片信息判断终端设备(10)是否占用了该网络切片的资源。下面通过示例详细说明：
一种可能的实现方式中，在满足触发条件的情况下，终端设备(10)生成具有完整性保护的消息，该消息中包括终端设备(10)占用的网络切片的切片信息，然后终端设备(10)将该消息发送给存储网元(40)，存储网元(40)接收到该切片信息之后，在本地保存该切片信息，该切片信息与该终端设备(10)的标识相关联。这里的触发条件例如是终端设备(10)接收到非接入层安全模式命令消息，或者终端设备(10)接收到注册接受消息。在该实现方式中，如果配置了移动管理网元(20)在向存储网元(40)发送了来自终端设备(10)的切片信息之后，同时该网络切片被包含在终端设备(10)的被允许的网络切片中，且该网络切片被要求进行网络切片准入控制，移动管理网元(20)才发起步骤410的切片注册请求消息，则在这种情况下，若存储网元(40)接收到来自切片统计网元(30)的切片验证请求消息后，在本地没有找到与终端设备(10)的标识相关联的切片信息，则存储网元可以确定终端设备(10)没有占用该网络切片的资源。或者，若存储网元(40)接收到来自切片统计网元(30)的切片验证请求消息后，在本地没有找到与终端设备(10) 的标识相关联的切片信息，则存储网元可以向终端设备(10)请求获取该切片信息。例如：
423，存储网元(40)向终端设备(10)发送切片信息请求消息。
示例性地，存储网元(40)通过移动管理网元(20)向终端设备(10)发送切片信息请求消息，该切片信息请求消息包括该终端设备(10)的标识，该切片信息请求消息用于请求获取该终端设备(10)占用的网络切片的切片信息。
424，终端设备(10)向存储网元(40)发送切片信息响应消息，该切片信息响应消息包括该切片信息。
示例性地，终端设备(10)接收到来自存储网元(40)的切片信息请求消息之后，生成切片信息响应消息，该响应消息中包括终端设备(10)占用的网络切片的切片信息。一种情况，如果终端设备(10)已经发送了注册请求消息，但终端设备(10)还没有收到响应于该注册请求消息的注册接受消息，则该切片信息包括终端设备(10)在注册请求消息中携带的请求网络切片；如果终端设备在注册请求消息中没有携带请求的网络切片，或者说，终端设备(10)在注册请求消息中携带的请求的网络切片为空，则该切片信息包括终端设备(10)请求的网络切片为空的指示信息。另一种情况，如果终端设备(10)已经接收到了注册接受消息，且该注册接受消息携带了终端设备(10)的被允许的网络切片，则该切片信息包括该终端设备(10)被允许的网络切片；如果终端设备(10)已经接收到了注册接受消息，且该注册接受消息没有携带终端设备(10)的被允许的网络切片，或者说该注册接受消息中携带的终端设备(10)的被允许的网络切片为空，则该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息。
另一方面，终端设备(10)对该切片信息响应消息进行完整性保护。例如，终端设备(10)利用完整性密钥和该切片信息生成完整性校验参数，终端设备(10)在该切片信息响应消息中携带该完整性校验参数，该完整性校验参数用于验证该切片信息是否被篡改，该完整性密钥是终端设备(10)和认证网元(50)之间的共同拥有的密钥，此密钥是在终端设备(10)主认证过程产生的。
425，存储网元(40)根据该切片信息判断终端设备(10)是否占用了网络切片的资源。
示例性地，存储网元(40)接收来自终端设备(10)的切片信息响应消息之后，获取该切片信息响应消息中的完整性校验参数和切片信息，并根据该完整性校验参数验证该切片信息是否被篡改。例如：存储网元(40)向认证网元(50)发送验证请求消息，该验证请求消息包括该完整性校验参数和该切片信息，该验证请求消息用于请求验证该切片信息是否篡改。对应地，认证网元(50)接收该验证请求消息，然后利用完整性密钥和该切片信息生成完整性校验参数，如果认证网元(50)生成的完整性校验参数和验证请求消息中携带的完整性校验参数相同，则验证通过，否则验证失败。然后认证网元(50)向存储网元(40)发送完整性验证指示信息，该完整性验证指示信息用于指示该切片信息是否被篡改。对应地，存储网元(40)接收该完整性验证指示信息，并根据该完整性验证指示信息确定切片信息是否被篡改。又例如，存储网元(40)向认证网元(50)发送验证请求消息，该验证请求消息用于请求获取终端设备(10)和认证网元之间共享的完整性密钥。认证网元(50)根据该验证请求消息，向存储网元(40)发送完整性密钥。存储网元(40)根据该完整性密钥和该切片信息生成完整性校验参数，如果存储网元(40)生成的完整性校验 参数和验证请求消息中携带的完整性校验参数相同，则验证通过，否则验证失败。
根据验证结果，如果切片信息没有被篡改，则存储网元(40)根据该切片信息判断终端设备(10)是否占用了网络切片的资源。示例性地：
当该切片信息包括该终端设备(10)请求的网络切片时，该存储网元(40)验证该网络切片是否属于该终端设备(10)请求的网络切片；在该网络切片属于该终端设备(10)请求的网络切片的情况下，该存储网元(40)确定该终端设备占用了该网络切片的资源；或者，
当该切片信息包括该终端设备(10)被允许的网络切片时，该存储网元(40)验证该网络切片是否属于该终端设备(10)被允许的网络切片；在该网络切片属于该终端设备(10)被允许的网络切片的情况下，该存储网元(40)确定该终端设备(10)占用了该网络切片的资源；或者，
当该切片信息包括该终端设备(10)请求的网络切片为空的指示信息时，该存储网元(40)验证该网络切片是否属于该终端设备(10)的默认网络切片；在该网络切片属于该终端设备(10)的默认网络切片的情况下，该存储网元(40)确定该终端设备占用了该网络切片的资源；或者
当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，该存储网元(40)确定该终端设备(10)没有占用该网络切片的资源。
可选地，在步骤422之前，存储网元(40)在接收到切片验证请求消息之后，可以验证终端设备(10)是否接入了网络。示例性地，该存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；如果存储网元(40)获取到了该终端设备(10)的上下文，则存储网元(40)确定终端设备(10)接入了网络；如果存储网元(40)没有获取到该终端设备(10)的上下文，则存储网元(40)确定终端设备(10)没有接入网络。
在终端设备(10)没有接入网络的情况下，该存储网元(40)向切片管理网元(30)发送状态指示信息，该状态指示信息用于指示终端设备(10)是否接入了网络，或者，存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
可选地，步骤421的切片验证请求消息还包括移动管理网元(20)，在步骤422之前，存储网元(40)在接收到切片验证请求消息之后，验证该移动管理网元(20)是否是终端设备(10)接入的移动管理网元，或者说，验证该移动管理网元(20)与该终端设备(10)是否匹配，或者说，验证该终端设备(10)是否接入了该移动管理网元(20)。示例性地，该存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；该存储网元(40)根据该终端设备(10)的上下文验证该终端设备(10)是否接入了该移动管理网元(20)。例如，该存储网元(40)从该终端设备(10)的上下文中获取该终端设备(10)接入的移动管理网元的标识，如果该终端设备(10)接入的移动管理网元的标识与移动管理网元(20)的标识相同，则表示该移动管理网元(20)是该终端设备(10)接入的移动管理网元。在该终端设备(10)没有接入该移动管理网元(20)的情况下，该存储网元(40)向切片管理网元(30)发送指示信息，该指示信息用于指示该终端设备(10)没有接入该移动管理网元(20)，或者，该存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
426，存储网元(40)向切片统计网元(30)发送指示信息。
可选地，该指示信息用于指示该终端设备(10)是否占用了该网络切片的资源，或者，该指示信息用于指示终端设备(10)是否接入该网络切片，或者，该指示信息用于向终端设备(10)指示未接入该网络切片的终端设备的标识，或者该指示信息用于向终端设备(10)指示所有终端设备均接入了该网络切片，或者该指示信息用于向终端设备(10)指示接入了该网络切片的终端设备的标识。
对应的，切片统计网元(30)接收该指示信息，并根据该指示信息判断该终端设备(10)是否占用了该网络切片的资源。
应理解，切片统计网元(30)可以通过以上方式对计入网络切片的终端统计的所有终端设备的进行验证，并将验证失败的终端设备从计入该网络切片的终端统计中删除。
如果切片统计网元(30)对计入第一网络切片的所有会话均进行了验证，则在验证完成后，切片统计网元可以设置一个flag，以及和该flag对应的timer。该flag用于指示计入网络切片的所有终端设备已经进行了验证，该timer用于指示该flag的有效时间。此时，如果后续有某个移动管理网元向该切片统计网元(30)请求对计入该网络切片的终端统计进行更新，而该flag还在有效期内，切片统计网元(30)只需要验证该移动管理网元请求统计的终端设备，而不需要对已经计入该网络切片的其他终端设备进行验证。
另一种可能的实现方式中(记为方案b)，切片统计网元(30)从存储网元(40)获取终端设备(10)占用的网络切片的切片信息，以判断终端设备(10)是否占用了网络切片的资源。示例性地：
428，切片统计管理网元(20)向存储网元(40)发送切片信息请求消息，该切片信息请求消息中包括终端设备(10)的标识，该切片信息请求消息用于请求获取该终端设备(10)占用的网络切片的切片信息。
对应地，存储网元(40)接收该切片信息请求消息。响应于该切片信息请求消息，存储网元(40)获取该终端设备(10)占用的网络切片的切片信息，该切片信息包括以下任一项：该终端设备(10)请求的网络切片、该终端设备(10)被允许的网络切片、该终端设备(10)请求的网络切片为空的指示信息、该终端设备(10)被允许的网络切片为空的指示信息。应理解，存储网元(10)获取终端设备(10)的切片信息的方式与S422类似，这里不再赘述。
429，存储网元(40)向切片统计网元(30)发送该切片信息。
430，切片统计网元(30)根据切片信息判断终端设备(10)是否占用了网络切片的资源。
示例性地，当该切片信息包括该终端设备(10)请求的网络切片时，该切片统计网元(30)验证该网络切片是否属于该终端设备(10)请求的网络切片；在该网络切片属于该终端设备(10)请求的网络切片的情况下，该切片统计网元(30)确定该终端设备占用了该网络切片的资源；或者，
当该切片信息包括该终端设备(10)被允许的网络切片时，该切片统计网元(30)验证该网络切片是否属于该终端设备(10)被允许的网络切片；在该网络切片属于该终端设备(10)被允许的网络切片的情况下，该切片统计网元(30)确定该终端设备(10)占用了该网络切片的资源；或者，
当该切片信息包括该终端设备(10)请求的网络切片为空的指示信息时，该切片统计 网元(30)验证该网络切片是否属于该终端设备(10)的默认网络切片；在该网络切片属于该终端设备(10)的默认网络切片的情况下，该切片统计网元(30)确定该终端设备占用了该网络切片的资源；或者
当该切片信息包括该终端设备(10)被允许的网络切片为空的指示信息时，该切片统计网元(30)确定该终端设备(10)没有占用该网络切片的资源。
440，根据判断结果，该切片统计管理网元(20)确定是否将终端设备(10)计入接入该网络切片的终端统计。
示例性地，当判断结果是终端设备(10)占用了该网络切片的资源时，该切片统计网元(30)将该终端设备计入接入所述网络切片的终端统计；当判断结果是终端设备(10)没有占用该网络切片的资源时，该切片统计网元(30)不将该终端设备(10)计入接入该网络切片的终端统计。
基于上述技术方案，切片统计网元根据终端设备是否占用了网络切片的资源，来确定是否将终端设备计入接入网络切片的终端统计，从而可以防止恶意的移动管理网元通过请求将终端设备计入该终端设备未占用的网络切片的终端统计，来发起拒绝服务攻击。
图5示出了本申请实施例提供的方法500的示例性流程图。该方法500包括：
501，UE向AMF发送注册请求(Registration Request)消息。
示例性地，该注册请求消息中包括该UE的标识(UE ID，例如UE的SUPI)。可选地，该注册请求消息中还可以包括Requested NSSAI，该Requested NSSAI可以包括一个或多个S-NSSAI，该注册请求消息用于该UE请求注册到该一个或多个S-NSSAI，或者说该注册请求消息用于该UE在网络侧进行注册。应理解，这里的UE请求注册到该一个或多个S-NSSAI，指的是UE请求注册到该一个或多个S-NSSAI所标识或关联的网络切片，后续实施例中的类似表达也可进行类似的解释，不再重复说明。
如果本次注册为初始注册，则该UE ID可以为SUCI；如果本次注册不是初始注册，则该UE ID可以为GUTI。
502，UE和网络侧完成主认证流程。
在主认证流程中，UE和AUSF分别生成密钥Kausf。
需要说明的是，如果注册请求消息中携带的UE ID为SUPI，则在主认证流程之后，UDM会将该SUCI解密为SUPI，并将该SUPI发送给AMF，后续流程中所使用的UE ID均为该SUPI。如果注册请求消息中携带的UE ID为GUTI，则AMF在收到注册请求后会将GUTI映射为SUPI，后续流程中所使用的UE ID均为该SUPI。
可选地，503，AMF向UE发送注册接受(Registration accept)消息。
示例性地，主认证流程完成之后，AMF向UE发送注册接受消息，该注册接受消息中包括Allowed NSSAI。应理解，该Allowed NSSAI属于Requested NSSAI，即Allowed NSSAI中的切片为Requested NSSAI中的部分或全部切片；或者该Allowed NSSAI不属于Requested NSSAI，即Allowed NSSAI中的切片不包括Requested NSSAI中的切片，此时该Allowed NSSAI属于Default NSSAI。
504，UE通过NAS消息向AMF发送此次注册的切片信息。
示例性地，UE可以在主认证流程之后，也可以在接收到注册接受消息之后，根据UE中储存的此次注册的上下文，通过NAS消息向AMF发送此次注册的切片信息。
一种示例，该NAS消息中还包括UE ID、message type和UE占用的网络切片的切片信息，该message type用于指示该NAS消息是用于上报切片信息的。该切片信息包括Requested NSSAI、Allowed NSSAI、Requested NSSAI为空的指示信息、Allowed NSSAI为空的指示信息中的至少一项，该切片信息可以承载于network slice container中，该network slice container中还包括UE ID、container type、消息认证码MAC-I，可选地该network slice container中还可以包括新鲜性参数。其中，该container type用于指示network slice container中包括UE ID对应的切片信息。
另一种示例，该NAS消息中包括UE ID、message type、消息认证码MAC-I，以及Requested NSSAI、Allowed NSSAI、Requested NSSAI为空的指示信息、Allowed NSSAI为空的指示信息中的至少一项，可选地还包括新鲜性参数。其中，该message type用于指示该NAS消息需要传输给该UE ID对应的UDM，且该Message Type还指示该NSA消息用于上报切片信息。该消息认证码MAC-I可以是根据该NAS消息中的所有参数生成的。需要说明的是，消息认证码MAC-I用于验证network slice container的完整性，即用于验证network slice container内的信息是否被篡改。本申请对MAC-I的生成方式不作限定。一种示例，UE可以将主认证流程中生成的密钥Kausf和network slice container中的UE ID、切片信息、container type作为输入参数生成MAC-I。另一种示例，UE也可以使用Kausf、新鲜性参数、container type作为输入参数生成密钥Ks，再将Ks和Network Slice container中的UE ID、切片信息、container type作为输入参数生成MAC-I。
示例性地，该切片信息可以包括Requested NSSAI、Allowed NSSAI、Requested NSSAI为空的指示信息、Allowed NSSAI为空的指示信息中的至少一项。
例如，如果注册流程还没有完成，即UE没有收到注册接受消息，UE的上下文也就没有Allowed NSSAI，此时该切片信息包括Requested NSSAI；又例如，如果注册流程已经完成，即UE上下文保存有Allowed NSSAI，此时该切片信息包括Allowed NSSAI，或者，该切片信息包括Allowed NSSAI和Requested NSSAI；又例如，如果UE在注册发起时没有请求网络切片(即注册请求消息中没有携带Requested NSSAI)，此时该网络切片信息可以包括Requested NSSAI为空的指示信息，该Requested NSSAI为空的指示信息可以用于指示UE未请求网络切片；又例如，注册流程已经完成，但注册接受消息中没有携带Allowed NSSAI，或者说Allowed NSSAI列表为空，此时该网络切片信息可以包括Allowed NSSAI为空的指示信息，该Allowed NSSAI为空的指示信息可以用于指示Allowed NSSAI列表为空。应理解，如果UE在注册发起时没有请求网络切片，但UE从注册接受消息中获取到了Allowed NSSAI，此时该切片信息既可以包括Allowed NSSAI，也可以包括Requested NSSAI为空的指示信息，此时该Requested NSSAI为空的指示信息用于指示UE在注册发起时没有请求网络切片。
505，AMF向UDM发送切片信息。
示例性地，AMF接收到来自UE的NAS消息之后，根据该NAS消息中的message type将network slice container发送给UDM。该network slice container中包括切片信息、UE ID、container type、消息认证码MAC-I，可选地该network slice container中还包括新鲜性参数。
506，UDM通过AUSF验证消息的完整性。
示例性地，UDM接收到来自AMF的network slice container后，根据container type 确定确定network slice container包括UE上报的切片信息，并根据UE ID和UE上下文中对应的AUSF找到储存有UE根密钥Kausf的AUSF，并向该AUSF请求验证该network slice container的完整性。本申请对验证消息完整性的具体方式不作限定。下面给出两种具体示例：
一示例，UDM将生成MAC-I的参数发送给AUSF，其中包括UE ID、切片信息、container type，如果MAC-I是通过Ks生成的，则也应将新鲜性参数发送给AUSF。AUSF收到参数后将Kausf、UE ID、切片信息、container type作为输入参数生成MAC-I-AUSF，如果参数中包含新鲜性参数，则AUSF先将Kausf、新鲜性参数和container type作为输入参数生成密钥Ks，再将Ks、UE ID、切片信息、container type作为输入参数生成MAC-I-AUSF。AUSF将生成的MAC-I-AUSF返回给UDM，UDM将MAC-I-AUSF与MAC-I对比，如果值相同则验证成功，如果值不同则验证失败。
另一示例，UDM将network slice container发送给AUSF，AUSF根据上述方式生成MAC-I-AUSF，然后将MAC-I-AUSF与MAC-I对比，如果值相同则验证成功，如果值不同则验证失败。AUSF将验证结果返回给UDM。
507，UDM保存切片信息。
示例性地，如果506中的消息完整性验证通过，则UDM将UE上报的切片信息作为UE上下文储存。
可选地，508，AMF向UE发送注册接受(Registration accept)消息。
需要说明的是，由于每网络切片UE数量可用性检查和更新流程可以发生在注册流程之中，也可以发生在注册流程之后，所以UE既可以在注册流程中通过AMF向UDM上报切片信息，也可以在注册流程之后通过AMF向UDM上报切片信息。因此，如果注册流程在503没有完成，即AMF没有在503向UE发送注册接受消息，则AMF可以在508向UE发送注册接受消息，该注册接受消息中携带Allowed NSSAI。
509，AMF向NSACF发送每网络切片UE数量可用性检查和更新请求(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request)消息。
示例性地，当AMF向UDM发送了切片信息之后，同时当一个网络切片被包含在UE被允许的NSSAI中，且这个网络切片被要求进行网络切片准入控制，AMF确定发起每网络切片UE数量可用性检查和更新流程，并向NSACF发送每网络切片UE数量可用性检查和更新请求消息，该请求消息中包括UE ID，AMF ID#1，接入类型，S-NSSAI和更新标志，该AMF ID#1用于标识该AMF。该每网络切片UE数量可用性检查和更新请求消息用于请求更新第一网络切片上的注册UE数量，该第一网络切片与该S-NSSAI对应。该更新标志用于指示增加第一网络切片上的注册UE数量或减少第一网络切片上的注册UE数量。另外该请求消息中可以携带一个或多个S-NSSAI，本申请不做限定。
510，NSACF检查切片是否满额，以及是否已经统计了该UE ID。
示例性地，NSACF接收来自AMF的每网络切片UE数量可用性检查和更新请求消息，如果该请求消息中携带的更新标识用于指示增加第一网络切片上注册UE数量，则NSACF检查该第一网络切片上的注册UE数量是否已经满额，即检查该第一网络切片上的注册UE数量是否已经达到最大值，或者说检查该第一网络切片上的注册UE的数量是否已经达到设定的阈值。
如果第一网络切片上的注册UE数量已经满额，则NSACF向AMF发送第一网络切片已经满额的指示。
如果第一网络切片上的注册UE数量没有满额，则NSACF还检查该UE ID对应的UE是否已经在第一网络切片上被统计，或者说该UE ID是否已经在第一网络切片的注册UE列表中。如果该UE已经被统计，则NSACF生成新的条目，并向AMF发送对应的结果参数。
如果第一网络切片没有满额，且该UE也没有在第一网络切片上被统计，NSACF先将该UE统计到第一网络切片上，统计过程如S202所示，统计完成后向AMF发送每网络切片UE数量可用性检查和更新响应(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Response)消息，如S203所示，并可选地，NSACF判断第一网络切片上的UE数量是否达到了设定的阈值。如果达到了设定的阈值，则NSAFC进一步验证第一网络切片上所有注册UE(记为UEs)，该UEs包括509中的UE ID所标识的UE，验证内容包括这些UEs的状态、UEs是否与该AMF相匹配、UEs是否与该第一网络切片相匹配。
一种可能的实现方案(记为方案1)中，NSACF请求UDM进行验证。示例性地：
511，NSACF向UDM发送验证请求消息。
这里以本申请实施例中所涉及的UE(即步骤509中的UE ID所对应的UE)为例进行说明，对其他UE的验证方式与此类似，不再赘述。应理解，NSACF可以同时请求UDM验证UEs中的所有UE，也可以在验证了该UE之后，再验证其他UEs中的其他UE。如果是后一种情况，即先验证该UE，可以在该UE验证失败的情况下再验证其他UE，如果该UE验证成功，也可以不验证UEs中的其他UE。本申请不作限定。
示例性地，NSACF根据UE ID找到该UE对应的UDM，并向该UDM发送验证请求消息，该验证请求消息中包括UE ID，AMF ID#1和S-NSSAI。
512，UDM验证UE状态和AMF ID#1。
示例性地，UDM根据UE ID检测UE对应的UE上下文，如果没有检测到UE上下文，表示UE没有接入网络，则验证失败，UDM向AMF返回验证失败的响应消息，并携带原因值；如果检测到了UE上下文，则UDM进一步根据UE上下文中储存的AMF的信息来验证AMF ID#1，或者说，UDM进一步验证验证请求消息中携带的AMF ID#1是否与UE实际接入的AMF相匹配，具体地，UDM通过UE上下文中的AMF信息获取AMF ID#2，该AMF ID#2用于标识UE接入的AMF，UDM验证AMF ID#1与AMF ID#2是否相同。如果相同的话，则验证通过；如果不相同的话，则该UE验证失败，UDM记录失败UE的UE ID。
可选地，513，UDM检查S-NSSAI是否在签约NSSAI(Subscribed NSSAI)中。
示例性地，UDM根据UE ID找到本地保存的UE签约信息并获取UE对应的Subscribed NSSAI，然后检查验证请求消息中携带的S-NSSAI是否在该Subscribed NSSAI中，如果不在，则验证失败，UDM向NSACF发送验证失败的响应消息，并携带原因值。如果验证通过，则进一步验证UE是否接入了S-NSSAI(，或者说，进一步验证UE是否占用了该S-NSSAI的资源，或者说进一步验证UE是否注册到了该S-NSSAI，或者说进一步验证S-NSSAI与该UE的切片信息是否匹配，或者说进一步验证S-NSSAI是否属于该UE的 Requested NSSAI/Allowed NSSAI/Default NSSAI)。
示例性地，如果UDM没有存储与UE ID相关联的切片信息，则验证失败。
或者，在另一种可能的实现方式中，如果UDM没有存储与UE ID相关联的切片信息，则UDM通过AMF向UE请求UE的切片信息。例如：UDM通过AMF向UE发送切片信息请求消息，该切片信息请求消息用于请求UE的切片信息，该切片信息请求消息中携带UE ID和Message type，其中，该Message type用于指示该请求消息用于请求切片信息。UDM在向AMF发送该切片信息请求消息之后可以设置定时器，如果定时器超时还未收到UE上报的切片信息的话，则UDM判断验证失败，并向NSACF发送验证失败的响应消息，并携带原因值。对应的，AMF接收到UDM发送的切片信息请求消息之后，AMF会将该切片信息请求消息发送给UE，UE在收到切片信息请求消息后，UE通过AMF向UDM上报此次切片注册的切片信息。应理解，UE会对该切片信息进行完整性保护，以防止该切片信息被篡改。514，UDM验证UE是否接入了S-NSSAI。
示例性地，UDM根据UE上报的切片信息，来验证UE是否接入了S-NSSAI。
如果切片信息中包括Allowed NSSAI为空的指示信息，则表示UE接收到的注册接受消息中的Allowed NSSAI列表为空，则验证失败。
如果切片信息中包括Requested NSSAI为空的指示信息，则表示UE未请求网络切片，则UDM验证S-NSSAI是否属于Default NSSAI，如果属于，则验证成功，如果不属于，则验证失败。
如果切片信息中包括Requested NSSAI，则UDM验证S-NSSAI是否属于该Requested NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
如果切片信息中包括Allowed NSSAI，则UDM验证S-NSSAI是否属于该Allowed NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
如果切片信息中包括Requested NSSAI和Allowed NSSAI，则UDM验证请求消息中的S-NSSAI是否属于Allowed NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
515，UDM向NSACF发送验证结果。
示例性地，如果验证失败，则验证结果包括该UE ID。
应理解，如果NSACF请求UDM验证UEs中所有UE，则该验证结果中包括所有验证失败的UE ID和失败原因值。如果没有验证失败的UE，则该验证结果中包含所有UE验证成功的指示。
另一种可能的实现方案(记为方案2)中，NSACF从UDM获取验证信息，然后根据该验证信息进行验证。示例性地：
516，NSACF向UDM发送切片信息请求消息。
示例性地，NSACF根据UE ID找到对应的UDM，并向该UDM发送切片信息请求消息，该切片信息请求消息用于请求获取UE的切片信息，该切片信息请求消息中包括该UE的UE ID。
对应地，UDM接收切片信息请求消息。
UDM根据切片信息请求消息中的UE ID找到对应的UE上下文，如果UDM中没有储存对应的UE上下文，则UDM向NSACF返回UE上下文不存在的指示，如果UDM中存有UE上下文，则继续进行517步。
517，UDM向NSACF发送UE的切片信息。
示例性地，UDM将UE上报的切片信息发送给NSACF。
UDM还向NSACF发送UE接入的AMF的信息，该AMF的信息例如是(或者包括)AMF ID#2，该AMF ID#2用于标识UE实际接入的AMF。
518，NSACF验证S-NSSAI是否与切片信息相匹配。
NSACF根据UE接入的AMF的信息判断发送每网络切片UE数量可用性检查和更新请求消息的AMF是否是UE接入的AMF，例如，NSACF验证AMF ID#1是否和AMF ID#2相同，如果相同的话，则验证通过，如果不相同，则验证失败；
NSACF验证每网络切片UE数量可用性检查和更新请求消息中携带的S-NSSAI是否与UE的切片信息相匹配。
和514的验证步骤相同，如果切片信息中包括Requested NSSAI为空的指示信息，则表示UE未请求网络切片，则UDM验证S-NSSAI是否属于Default NSSAI，如果属于，则验证成功，如果不属于，则验证失败。
如果切片信息中包括Requested NSSAI，则UDM验证S-NSSAI是否属于该Requested NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
如果切片信息中包括Allowed NSSAI，则UDM验证S-NSSAI是否属于该Allowed NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
如果切片信息中包括Requested NSSAI和Allowed NSSAI，则UDM验证请求消息中的S-NSSAI是否属于Allowed NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
519，NSACF根据验证结果，对于验证失败的UE，NSACF删除此UE的计数信息，当某一AMF上的验证UE数量超过阈值时，NSACF认为此AMF被攻击，忽略后续此AMF发送的每网络切片UE数量可用性检查和更新响应(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Response)消息。图6示出了本申请实施例提供的方法600的示例性流程图。该方法600包括：
601，UE向AMF发送注册请求(Registration Request)消息。
602，UE和网络侧完成主认证流程。
可选地，603，AMF向UE发送注册接受(Registration accept)消息。
应理解，601～603与方法500中的S501～S503类似，这里不再赘述。
604，AMF向NSACF发送每网络切片UE数量可用性检查和更新请求(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Request)消息，该请求消息中包括UE ID，AMF ID#1，接入类型，S-NSSAI和更新标志。
605，NSACF检查切片是否满额，以及是否已经统计了该UE ID。
应理解，604～605与方法500中的S509～S510类似，这里不再赘述。
如果第一网络切片没有满额，且该UE也没有在第一网络切片上被统计，则可选地，NSACF判断第一网络切片上的UE数量是否达到了设定的阈值。如果达到了设定的阈值，则NSAFC进一步验证该UE的状态、该UE是否与该AMF相匹配、该UE是否与该第一网络切片相匹配。该第一网络切片与每网络切片UE数量可用性检查和更新请求消息中的S-NSSAI对应。
一种可能的实现方案(记为方案3)中，NSACF请求UDM进行验证。示例性地：
606，NSACF向UDM发送验证请求消息。
示例性地，NSACF根据UE ID找到对应的UDM，并向该UDM发送验证请求消息，该验证请求消息中包括UE ID、S-NSSAI、AMF ID。
607，UDM验证UE状态和AMF ID#1。
应理解，该607与方法500中的S512类似，这里不再重复说明。
608，UDM检查S-NSSAI是否在签约NSSAI中。
示例性地，UDM根据本地保存的UE签约信息获取UE对应的Subscribed NSSAI，然后检查验证请求消息中携带的S-NSSAI是否在该Subscribed NSSAI中。
进一步可选地，UDM还可以检测S-NSSAI是否在Default NSSAI中。
如果S-NSSAI属于Default NSSAI，则UDM可以向NSACF发送验证成功的响应消息；如果S-NSSAI不属于Subscribed NSSAI，则UDM可以向NSACF发送验证失败的响应消息，并携带原因值；如果S-NSSAI属于Subscribed NSSAI但不属于Default NSSAI，则UDM进一步可以通过AMF向UE请求获取UE的切片信息。示例性地：
609，UDM通过AMF向UE发送切片信息请求消息。
该切片信息请求消息用于请求UE的切片信息，该切片信息请求消息中携带UE ID和Message type，其中，该Message type用于指示该请求消息用于请求切片信息。UDM在向AMF发送该切片信息请求消息之后可以设置定时器，如果定时器超时还未收到UE上报的切片信息的话，则UDM判断验证失败，并向NSACF发送验证失败的响应消息，并携带原因值。对应的，AMF接收到UDM发送的切片信息请求消息之后，AMF会将该切片信息请求消息发送给UE，
610，UE通过AMF向UDM上报切片信息。
示例性地，UE在收到切片信息请求消息后，UE通过AMF向UDM上报此次注册的切片信息，以及消息认证码MAC-I。
该消息认证码用于对该切片信息进行完整性保护，以防止该切片信息被篡改。具体方式与方法500中S504里介绍的消息认证码的生成方式类似，不再重复说明。
611，UDM验证消息完整性。
611中验证消息完整性的方法与方法500中的S506介绍的方案类似，不再重复说明。
612，UDM验证UE是否接入了该S-NSSAI。
示例性地，UDM根据UE上报的切片信息，来验证UE是够接入了该S-NSSAI。
如果切片信息中包括Allowed NSSAI为空的指示信息，则表示UE接收到的注册接受消息中的Allowed NSSAI列表为空，则验证失败。
如果切片信息中包括Requested NSSAI为空的指示信息，则表示UE未请求网络切片，则UDM验证S-NSSAI是否属于Default NSSAI，如果属于，则验证成功，如果不属于，则验证失败。
如果切片信息中包括Requested NSSAI，则UDM验证S-NSSAI是否属于该Requested NSSAI，如果属于，则验证成功；如果不属于，则验证失败。
如果切片信息中包括Allowed NSSAI，则UDM验证S-NSSAI是否属于该AllowedNSSAI，如果属于，则验证成功；如果不属于，则验证失败。
613，UDM向NSACF发送验证结果。
示例性地，该验证结果中包括UE ID。如果该验证结果为验证失败，还可以携带失败原因。
另一种可能的实现方案(记为方案4)中，NSACF从UDM获取验证信息，然后根据该验证信息进行验证。示例性地：
614，NSACF向UDM发送切片信息请求消息。
示例性地，NSACF根据UE ID找到对应的UDM，并向该UDM发送切片信息请求消息，该切片信息请求消息用于请求获取UE的切片信息，该切片信息请求消息中包括该UE的UE ID。
615，UDM通过AMF向UE发送切片信息请求消息。
616，UE通过AMF向UDM上报切片信息。
617，UDM验证消息完整性。
615～617与609～611类似，不再赘述。
618，UDM向NSACF发送切片信息。示例性地，UDM将UE上报的切片信息发送给NSACF。
UDM还向NSACF发送UE状态指示信息以及UE接入的AMF的信息，该AMF的信息例如是(或者包括)AMF ID#2，该AMF ID#2用于标识UE实际接入的AMF。
619，NSACF验证UE是否接入了S-NSSAI。
应理解，619与方法500中的S518类似，不再重复说明。
620，NSACF向AMF发送每网络切片UE数量可用性检查和更新响应(Nnsacf_NumberOfUEsPerSliceAvailabilityCheckAndUpdate_Response)消息。
示例性地，如果每网络切片UE数量可用性检查和更新请求消息内携带的信息验证成功，则NSACF根据该请求消息更新第一网络切片上的注册UE的数量，并向AMF返回每网络切片UE数量可用性检查和更新响应消息，该响应消息用于指示UE数量更新成功；如果每网络切片UE数量可用性检查和更新请求消息内携带的信息验证失败，则NSACF向AMF返回每网络切片UE数量可用性检查和更新响应消息，该响应消息用于指示验证失败，或者该响应消息用于拒绝每网络切片UE数量可用性检查和更新请求消息。可选地，还可以携带失败或拒绝的原因。
可选地，在621，AMF向UE发送注册接受消息。
示例性地，上述流程既可以发生在UE的注册流程之中，也可以发生在注册流程之后。如果上述流程发送在UE注册流程之后，则可以在完成上述每网络切片UE数量可用性检查和更新流程之后，AMF向UE发送注册接受消息，该注册接受消息包括Allowed NSSAI。
以上，结合图4至图6详细说明了本申请实施例提供的方法。以下，结合图7至图10详细说明本申请实施例提供的装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
图7是本申请实施例提供的用于网络验证的装置10的示意性框图。该装置10包括收发模块11和处理模块12。收发模块11可以实现相应的通信功能，处理模块12用于进行数据处理。收发模块11还可以称为通信接口或通信单元。
在一种可能的设计中，该装置10可对应于上文方法实施例中的切片统计网元(20) (或者NSACF)。
示例性地，该装置10可对应于本申请实施例的方法400中的切片统计网元(20)，或者方法500至方法600中的UDM。该装置10可以包括用于执行图4至图6中的切片统计网元(20)(或者NSACF)所执行的方法的模块。并且，该装置10中的各单元和上述其他操作和/或功能分别为了实现图4至图6所示方法的相应流程。
该装置10中的该收发模块11执行上述各方法实施例中的切片统计网元(20)(或者NSACF)所执行的接收和发送操作，该处理模块12则执行除了该接收和发送操作之外的操作。
在另一种可能的设计中，该装置10可对应于上文方法实施例中的终端设备(10)(或者UE)。
示例性地，该装置10可对应于本申请实施例的方法400中的终端设备(10)，或者方法500至方法600中的UE。该装置10可以包括用于执行图4至图6中的终端设备(10)(或者UE)所执行的方法的模块。并且，该装置10中的各单元和上述其他操作和/或功能分别为了实现图4至图6所示方法的相应流程。
该装置10中的该收发模块11执行上述各方法实施例中的终端设备(10)(或者UE)所执行的接收和发送操作，该处理模块12则执行除了该接收和发送操作之外的操作。
在又一种可能的设计中，该装置10可对应于上文方法实施例中的存储网元(40)(或者UDM)。
示例性地，该通信装置10可对应于本申请实施例的方法400中的存储网元(40)，或者方法500至方法600中的NSACF。该装置10可以包括用于执行图4至图6中的存储网元(40)(或者UDM)所执行的方法的模块。并且，该装置10中的各单元和上述其他操作和/或功能分别为了实现图4至图6所示方法的相应流程。
该装置10中的该收发模块11执行上述各方法实施例中的存储网元(40)(或者UDM)所执行的接收和发送操作，该处理模块12则执行除了该接收和发送操作之外的操作。
根据前述方法，图8为本申请实施例提供的用于网络验证的装置20的示意图。在一种可能的设计中，该装置20可对应于上文方法实施例中的切片统计网元(20)(或者NSACF)；在另一种可能的设计中，该装置10可对应于上文方法实施例中的终端设备(10)(或者UE)；在又一种可能的设计中，该装置10可对应于上文方法实施例中的存储网元(40)(或者UDM)。
该装置20可以包括处理器21(即，处理模块的一例)和存储器22。该存储器22用于存储指令，该处理器21用于执行该存储器22存储的指令，以使该装置20实现如图4至图6对应的方法中终端设备或网络设备执行的步骤。
进一步地，该装置20还可以包括输入口23(即，收发模块的一例)和输出口24(即，收发模块的另一例)。进一步地，该处理器21、存储器22、输入口23和输出口24可以通过内部连接通路互相通信，传递控制和/或数据信号。该存储器22用于存储计算机程序，该处理器21可以用于从该存储器22中调用并运行该计算机程序，以控制输入口23接收信号，控制输出口24发送信号，完成上述方法中终端设备或网络设备的步骤。该存储器22可以集成在处理器21中，也可以与处理器21分开设置。
可选地，若该通信装置20为通信设备，该输入口23为接收器，该输出口24为发送 器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该通信装置20为芯片或电路，该输入口23为输入接口，该输出口24为输出接口。
作为一种实现方式，输入口23和输出口24的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器21可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的通信设备。即将实现处理器21、输入口23和输出口24功能的程序代码存储在存储器22中，通用处理器通过执行存储器22中的代码来实现处理器21、输入口23和输出口24的功能。
该装置20所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
图9示出了一种简化的网络设备30的结构示意图。网络设备包括31部分以及32部分。31部分主要用于射频信号的收发以及射频信号与基带信号的转换；32部分主要用于基带处理，对网络设备进行控制等。31部分通常可以称为收发模块、收发机、收发电路、或者收发器等。32部分通常是网络设备的控制中心，通常可以称为处理模块，用于控制网络设备执行上述方法实施例中网络设备侧的处理操作。
31部分的收发模块，也可以称为收发机或收发器等，其包括天线和射频电路，其中射频电路主要用于进行射频处理。例如，可以将31部分中用于实现接收功能的器件视为接收模块，将用于实现发送功能的器件视为发送模块，即31部分包括接收模块和发送模块。接收模块也可以称为接收机、接收器、或接收电路等，发送模块可以称为发射机、发射器或者发射电路等。
32部分可以包括一个或多个单板，每个单板可以包括一个或多个处理器和一个或多个存储器。处理器用于读取和执行存储器中的程序以实现基带处理功能以及对网络设备的控制。若存在多个单板，各个单板之间可以互联以增强处理能力。作为一种可选的实施方式，也可以是多个单板共用一个或多个处理器，或者是多个单板共用一个或多个存储器，或者是多个单板同时共用一个或多个处理器。
例如，在一种实现方式中，图9所示的网络设备可以是图4至图6所示的方法中所示的任意网络设备，例如移动管理网元(20)、切片统计网元(30)、存储网元(40)、认证网元(50)等。
31部分的收发模块用于执行图4至图6所示的方法中任意网络设备的收发相关的步骤；32部分用于执行图4至图6所示的方法中的任意网络设备的处理相关的步骤。
应理解，图9仅为示例而非限定，上述包括收发模块和处理模块的网络设备可以不依赖于图9所示的结构。
当该装置40为芯片时，该芯片包括收发模块和处理模块。其中，收发模块可以是输入输出电路、通信接口；处理模块为该芯片上集成的处理器或者微处理器或者集成电路。
图10为本申请提供的一种终端设备40的结构示意图。为了便于说明，图10仅示出了通信装置的主要部件。如图10所示，终端设备40包括处理器、存储器、控制电路、天线以及输入输出装置。
处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端设备进行控制，执行软件程序，处理软件程序的数据，例如用于支持终端设备执行上述传输预编码矩阵的指示方法实施例中所描述的动作。存储器主要用于存储软件程序和数据，例如存储上述实施例中所描述的码本。控制电路主要用于基带信号与射频信号的转换以及对射频信号的处理。控制电路和天线一起也可以叫做收发器，主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。
当通信装置开机后，处理器可以读取存储单元中的软件程序，解释并执行软件程序的指令，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
本领域技术人员可以理解，为了便于说明，图10仅示出了一个存储器和处理器。在实际的终端设备中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端设备进行控制，执行软件程序，处理软件程序的数据。图10中的处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。本领域技术人员可以理解，终端设备可以包括多个基带处理器以适应不同的网络制式，终端设备可以包括多个中央处理器以增强其处理能力，终端设备的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
如图10所示，终端设备40包括收发单元41和处理单元42。收发单元也可以称为收发器、收发机、收发装置等。可选的，可以将收发单元41中用于实现接收功能的器件视为接收单元，将收发单元41中用于实现发送功能的器件视为发送单元，即收发单元41包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
图10所示的终端设备可以执行图4至图6所示的方法中终端设所执行的各动作，这里，为了避免赘述，省略其详细说明。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由第网络设备执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由网络设备执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被计算机执行时使得该计算机实现上述方法实施例中由第一设备执行的方法，或由第二设备执行的方法。
本申请实施例还提供一种通信系统，该通信系统包括上文实施例中的网络设备。
上述提供的任一种装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
在本申请实施例中，网络设备可以包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。其中，硬件层可以包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。操作系统层的操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。应用层可以包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构进行特别限定，只要能够通过运行记录有本申请实施例提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可。例如，本申请实施例提供的方法的执行主体可以是网络设备，或者，是网络设备中能够调用程序并执行程序的功能模块。
本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本文中使用的术语“制品”可以涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。
本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质”可以包括但不限于：无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM可以包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的保护范围。
所属领域的技术人员可以清楚地了解到，为描述方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元实现本申请提供的方案。
另外，在本申请各个实施例中的各功能单元可以集成在一个单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，所述计算机可以是个人计算机，服务器，或者网络设备等。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，(SSD))等。例如，前述的可用介质可以包括但不限于：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟 悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求和说明书的保护范围为准。

Claims (66)

  1. 一种网络验证的方法，其特征在于，包括：
    切片统计网元(30)接收来自移动管理网元(20)的切片注册请求消息(410)，所述切片注册请求消息(410)包括终端设备(10)的标识和网络切片的标识；
    响应于所述切片注册请求消息(410)，所述切片统计网元(30)判断所述终端设备(10)是否占用了所述网络切片的资源；
    根据判断结果，所述切片统计网元(30)确定是否将所述终端设备(10)计入接入所述网络切片的终端统计。
  2. 根据权利要求1所述的方法，其特征在于，所述切片统计网元(30)判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    所述切片统计网元(30)向存储网元(40)发送切片信息请求消息(428)，所述切片信息请求消息(428)包括所述终端设备(10)的标识，所述切片信息请求消息(428)用于请求获取所述终端设备(10)占用的网络切片的切片信息；
    所述切片统计网元(30)接收来自所述存储网元(40)的所述切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许接入的网络切片、所述终端设备(10)的请求网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述切片统计网元(30)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源。
  3. 根据权利要求2所述的方法，其特征在于，所述切片统计网元(20)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    当所述切片信息包括所述终端设备(10)请求的网络切片时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)请求的网络切片；在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，所述切片统计网元(30)确定所述终端设备占用了所述网络切片的资源；或者，
    当所述切片信息包括所述终端设备(10)被允许的网络切片时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)被允许的网络切片；在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，所述切片统计网元(30)确定所述终端设备(10)占用了所述网络切片的资源；或者，
    当所述切片信息包括所述终端设备(10)请求的网络切片为空的指示信息时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)的默认网络切片；在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，所述切片统计网元(30)确定所述终端设备占用了所述网络切片的资源；或者
    当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，所述切片统计网元(30)确定所述终端设备(10)没有占用所述网络切片的资源。
  4. 根据权利要求1所述的方法，其特征在于，所述切片统计网元(30)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    所述切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括所述终端设备(10)的标识和所述网络切片的标识，所述切片验证请求消息(421)用于请求验证所述终端设备(10)是否占用了所述网络切片的资源；
    所述切片统计网元(30)接收来自所述存储网元(40)的指示信息(426)；
    所述切片统计网元(30)根据所述指示信息(426)确定所述终端设备(10)是否占用了所述网络切片的资源。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    所述切片统计网元(30)验证所述终端设备(10)是否接入了网络。
  6. 根据权利要求5所述的方法，其特征在于，所述切片统计网元(30)验证所述终端设备(10)是否接入了网络，包括：
    所述切片统计网元(30)向存储网元(40)发送终端信息请求消息，所述终端信息请求消息包括所述终端设备(10)的标识；
    所述切片统计网元(30)接收来自所述存储网元(40)的状态指示信息；
    所述切片统计网元(30)根据所述状态指示信息确定所述终端设备(10)是否接入了网络。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    在所述切片统计网元(30)确定终端设备(10)没有接入网络的情况下，所述切片统计网元(30)拒绝或忽略所述切片注册请求消息(410)。
  8. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    所述切片统计网元(30)验证所述终端设备(10)是否接入了所述移动管理网元(20)。
  9. 根据权利要求8所述的方法，其特征在于，所述切片统计网元(30)验证所述终端设备(10)是否接入了所述移动管理网元(20)，包括：
    所述切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括所述移动管理网元(20)的标识；
    所述切片统计网元(30)接收来自所述存储网元(40)的指示信息；
    所述切片统计网元(30)根据所述指示信息确定所述终端设备(10)是否接入了所述移动管理网元(20)。
  10. 根据权利要求8或9所述的方法，其特征在于，所述方法还包括：
    在所述切片统计网元(30)确定终端设备(10)未接入所述移动管理网元(20)的情况下，所述切片统计网元(30)拒绝或忽略所述切片注册请求消息(410)。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述方法还包括：
    所述切片统计网元(30)验证计入所述网络切片的终端统计的一个或多个终端设备是否占用了所述网络切片的资源。
  12. 根据权利要求1至11中任一项所述的方法，其特征在于，所述方法还包括：
    所述切片统计网元(30)确定接入所述网络切片的终端统计的数量大于或等于阈值。
  13. 根据权利要求1至12中任一项所述的方法，其特征在于，所述根据判断结果，所述切片统计网元(30)确定是否将所述终端设备(10)计入接入所述网络切片的终端统计，包括：
    当所述终端设备(10)占用了所述网络切片的资源时，所述切片统计网元(30)将所述终端设备计入接入所述网络切片的终端统计；
    当所述终端设备(10)没有占用所述网络切片的资源时，所述切片统计网元(30)不将所述终端设备(10)计入接入所述网络切片的终端统计。
  14. 根据权利要求1至13中任一项所述的方法，其特征在于，所述切片注册请求消息(410)用于请求将终端设备(10)计入接入所述网络切片上的终端统计的数量。
  15. 一种网络验证的方法，其特征在于，包括：
    存储网元(40)接收来自切片统计网元(30)的切片验证请求消息(421)，所述切片验证请求消息(421)包括终端设备(10)的标识和网络切片的标识；
    响应于所述切片验证请求消息(421)，所述存储网元(40)获取所述终端设备(10)占用的网络切片的切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许的网络切片、所述终端设备(10)请求的网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述存储网元(40)根据所述终端设备(10)的切片信息，验证所述终端设备(10)是否占用了所述网络切片的资源。
  16. 根据权利要求15所述的方法，其特征在于，所述存储网元(40)根据所述终端设备(10)的切片信息，验证所述终端设备(10)是否占用了所述网络切片的资源，包括：
    当所述切片信息包括所述终端设备(10)请求的网络切片时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)请求的网络切片，在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)被允许的网络切片，在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)的请求网络切片为空的指示信息时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)的默认网络切片，在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源。
  17. 根据权利要求15或16所述的方法，其特征在于，所述存储网元(40)获取所述终端设备(10)占用的网络切片的切片信息，包括：
    所述存储网元(40)根据所述终端设备(10)的标识，在本地获取所述切片信息。
  18. 根据权利要求17所述的方法，其特征在于，所述存储网元(40)获取所述终端设备(10)占用的网络切片的切片信息，包括：
    在所述存储网元(40)本地没有所述切片信息时，所述存储网元(40)向所述终端设备(10)发送切片信息请求消息(423)，所述切片信息请求消息(423)用于请求获取所述切片信息；
    所述存储网元(40)接收来自所述终端设备(10)的受到了完整性保护的切片信息响应消息(424)，所述切片信息响应消息(424)包括所述切片信息和完整性校验参数，所述完整性校验参数用于验证所述切片信息是否被篡改。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    所述存储网元(40)向验证网元(50)发送验证请求消息，所述验证请求消息包括所述切片信息和所述完整性校验参数，所述验证请求消息用于请求验证所述切片信息是否被篡改；
    所述存储网元(40)接收来自所述验证网元(50)的完整性验证指示信息；
    所述存储网元(40)根据所述完整性验证指示信息确定所述切片信息是否被篡改。
  20. 根据权利要求15至19中任一项所述的方法，其特征在于，所述方法还包括：
    所述存储网元(40)验证所述终端设备(10)是否接入了网络；
    在所述终端设备(10)没有接入网络的情况下，所述存储网元(40)向切片管理网元(30)发送状态指示信息，所述状态指示信息用于指示终端设备(10)是否接入了网络，或者，所述存储网元(40)向所述切片管理网元(30)发送验证失败的指示信息。
  21. 根据权利要求20所述的方法，其特征在于，所述存储网元(40)验证所述终端设备(10)是否接入了网络，包括：
    所述存储网元(40)根据终端设备(10)的标识请求获取终端设备(10)的上下文；
    在所述存储网元(40)获取到了所述终端设备(10)的上下文的情况下，所述存储网元(40)确定所述终端设备(10)接入了网络；
    在所述存储网元(40)没有获取到所述终端设备(10)的上下文的情况下，所述存储网元(40)确定所述终端设备(10)没有接入网络。
  22. 根据权利要求20或21所述的方法，其特征在于，所述切片验证请求消息(421)还包括移动管理网元(20)的标识，所述方法还包括：
    所述存储网元(40)验证所述终端设备(10)是否接入了所述移动管理网元(20)；
    在所述终端设备(10)没有接入所述移动管理网元(20)的情况下，所述存储网元(40)向切片管理网元(30)发送指示信息，所述指示信息用于指示所述终端设备(10)没有接入所述移动管理网元(20)，或者，所述存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
  23. 根据权利要求22所述的方法，其特征在于，所述存储网元(40)验证所述终端设备(10)是否接入了所述移动管理网元(20)，包括：
    所述存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；
    所述存储网元(40)根据所述终端设备(10)的上下文验证所述终端设备(10)是否接入了所述移动管理网元(20)。
  24. 根据权利要求15至23中任一项所述的方法，其特征在于，在所述存储网元(40)获取所述终端设备(10)的切片信息之前，所述方法还包括：
    所述储存网元(40)确定所述网络切片的标识属于所述终端设备(10)的签约网络切片。
  25. 根据权利要求15至24中任一项所述的方法，其特征在于，所述切片验证请求消息(421)用于请求验证所述终端设备(10)是否占用了所述网络切片的资源。
  26. 一种网络验证的方法，其特征在于，包括：
    在满足触发条件的情况下，终端设备(10)生成具有完整性保护的消息，所述消息包括所述终端设备(10)占用的网络切片的切片信息，所述切片信息包括以下任意一项：所述终端设备的请求网络切片、所述终端设备的允许网络切片、所述终端设备(10)请求的网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述终端设备(10)将所述消息发送给存储网元(40)。
  27. 根据权利要求26所述的方法，其特征在于，所述触发条件包括以下任意一项或多项：
    所述终端设备(10)接收到非接入层安全模式命令消息；
    所述终端设备(10)接收到注册接受消息；
    所述终端设备(10)接收到来自所述存储网元(40)的切片信息请求消息(423)，所述切片信息请求消息(423)用于请求获取所述切片信息。
  28. 根据权利要求26或27所述的方法，其特征在于，所述方法还包括：
    所述终端设备(10)利用完整性密钥和所述切片信息生成完整性校验参数，所述消息中还包括所述完整性校验参数，所述完整性校验参数用于验证所述切片信息是否被篡改。
  29. 一种网络验证的方法，其特征在于，包括：
    移动管理网元(20)向切片统计网元(30)发送切片注册请求消息(410)，所述切片注册请求消息(410)包括终端设备(10)的标识和网络切片的标识；
    切片统计网元(30)接收来自移动管理网元(20)的切片注册请求消息(410)；
    响应于所述切片注册请求消息(410)，所述切片统计网元(30)判断所述终端设备(10)是否占用了所述网络切片的资源；
    根据判断结果，所述切片统计网元(30)确定是否将所述终端设备(10)计入接入所述网络切片的终端统计。
  30. 根据权利要求29所述的方法，其特征在于，所述切片统计网元(30)判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    所述切片统计网元(30)向存储网元(40)发送切片信息请求消息(428)，所述切片信息请求消息(428)包括所述终端设备(10)的标识，所述切片信息请求消息(428)用于请求获取所述终端设备(10)占用的网络切片的切片信息；
    所述切片统计网元(30)接收来自所述存储网元(40)的所述切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许接入的网络切片、所述终端设备(10)的请求网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述切片统计网元(30)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源。
  31. 根据权利要求30所述的方法，其特征在于，所述切片统计网元(20)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    当所述切片信息包括所述终端设备(10)请求的网络切片时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)请求的网络切片；在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，所述切片统计网元(30)确定所述终端设备 占用了所述网络切片的资源；或者，
    当所述切片信息包括所述终端设备(10)被允许的网络切片时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)被允许的网络切片；在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，所述切片统计网元(30)确定所述终端设备(10)占用了所述网络切片的资源；或者，
    当所述切片信息包括所述终端设备(10)请求的网络切片为空的指示信息时，所述切片统计网元(30)验证所述网络切片是否属于所述终端设备(10)的默认网络切片；在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，所述切片统计网元(30)确定所述终端设备占用了所述网络切片的资源；或者
    当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，所述切片统计网元(30)确定所述终端设备(10)没有占用所述网络切片的资源。
  32. 根据权利要求29所述的方法，其特征在于，所述切片统计网元(30)根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源，包括：
    所述切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括所述终端设备(10)的标识和所述网络切片的标识，所述切片验证请求消息(421)用于请求验证所述终端设备(10)是否占用了所述网络切片的资源；
    所述切片统计网元(30)接收来自所述存储网元(40)的指示信息(426)；
    所述切片统计网元(30)根据所述指示信息(426)确定所述终端设备(10)是否占用了所述网络切片的资源。
  33. 一种网络验证的方法，其特征在于，包括：
    切片统计网元(30)接收来自移动管理网元(20)的切片注册请求消息(410)，所述切片注册请求消息(410)包括终端设备(10)的标识和网络切片的标识；
    响应于所述切片注册请求消息(410)，所述切片统计网元(30)向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括终端设备(10)的标识和网络切片的标识；
    存储网元(40)接收来自切片统计网元(30)的所述切片验证请求消息(421)；
    响应于所述切片验证请求消息(421)，所述存储网元(40)获取所述终端设备(10)占用的网络切片的切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许的网络切片、所述终端设备(10)请求的网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述存储网元(40)根据所述终端设备(10)的切片信息，验证所述终端设备(10)是否占用了所述网络切片的资源。
  34. 根据权利要求33所述的方法，其特征在于，所述存储网元(40)根据所述终端设备(10)的切片信息，验证所述终端设备(10)是否占用了所述网络切片的资源，包括：
    当所述切片信息包括所述终端设备(10)请求的网络切片时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)请求的网络切片，在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)被允许的网络切片，在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)的请求网络切片为空的指示信息时，所述存储网元(40)验证所述网络切片是否属于所述终端设备(10)的默认网络切片，在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源。
  35. 根据权利要求33或34所述的方法，其特征在于，所述存储网元(40)获取所述终端设备(10)占用的网络切片的切片信息，包括：
    所述存储网元(40)根据所述终端设备(10)的标识，在本地获取所述切片信息。
  36. 一种网络验证的装置，其特征在于，包括：
    收发模块(11)，用于接收来自移动管理网元(30)的切片注册请求消息(410)，所述切片注册请求消息(101)包括终端设备(10)的标识和网络切片的标识；
    处理模块(12)，用于响应于所述切片注册请求消息，判断所述终端设备(10)是否占用了所述网络切片的资源；
    所述处理模块(12)，还用于根据判断结果，确定是否将所述终端设备(10)计入接入所述网络切片的终端统计。
  37. 根据权利要求36所述的装置，其特征在于，
    所述收发模块(11)具体用于：向存储网元(40)发送切片信息请求消息(428)，所述切片信息请求消息(428)包括所述终端设备(10)的标识，所述切片信息请求消息(428)用于请求获取所述终端设备(10)占用的网络切片的切片信息；
    接收来自所述存储网元(40)的所述切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许接入的网络切片、所述终端设备(10)的请求网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述处理模块(12)具体用于：根据所述切片信息，判断所述终端设备(10)是否占用了所述网络切片的资源。
  38. 根据权利要求37所述的装置，其特征在于，
    所述处理模块(12)具体用于：当所述切片信息包括所述终端设备(10)请求的网络切片时，验证所述网络切片是否属于所述终端设备(10)请求的网络切片；在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，确定所述终端设备占用了所述网络切片的资源；或者，
    所述处理模块(12)具体用于：当所述切片信息包括所述终端设备(10)被允许的网络切片时，验证所述网络切片是否属于所述终端设备(10)被允许的网络切片；在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，确定所述终端设备(10)占用了所述网络切片的资源；或者，
    所述处理模块(12)具体用于：当所述切片信息包括所述终端设备(10)请求的网络切片为空的指示信息时，验证所述网络切片是否属于所述终端设备(10)的默认网络切片；在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，确定所述终端设备占用了所述网络切片的资源；或者
    所述处理模块(12)具体用于：当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，确定所述终端设备(10)没有占用所述网络切片的资源。
  39. 根据权利要求36所述的装置，其特征在于，
    所述收发模块(11)具体用于：所向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括所述终端设备(10)的标识和所述网络切片的标识，所述切片验证请求消息(421)用于请求验证所述终端设备(10)是否占用了所述网络切片的资源；
    接收来自所述存储网元(40)的指示信息(426)；
    所述处理模块(12)具体用于：根据所述指示信息(426)确定所述终端设备(10)是否占用了所述网络切片的资源。
  40. 根据权利要求36至39中任一项所述的装置，其特征在于，所述处理模块(12)，还用于：验证所述终端设备(10)是否接入了网络。
  41. 根据权利要求40所述的装置，其特征在于，
    所述收发模块(11)具体用于：向存储网元(40)发送终端信息请求消息，所述终端信息请求消息包括所述终端设备(10)的标识；以及接收来自所述存储网元(40)的状态指示信息；
    所述处理模块(12)具体用于：所述切片统计网元(30)根据所述状态指示信息确定所述终端设备(10)是否接入了网络。
  42. 根据权利要求40或41所述的装置，其特征在于，所述处理模块(12)，还用于：在所述切片统计网元(30)确定终端设备(10)没有接入网络的情况下，拒绝或忽略所述切片注册请求消息(410)。
  43. 根据权利要求40至42中任一项所述的装置，其特征在于，所述处理模块(12)，还用于：验证所述终端设备(10)是否接入了所述移动管理网元(20)。
  44. 根据权利要求43所述的装置，其特征在于，
    所述收发模块(11)具体用于：向存储网元(40)发送切片验证请求消息(421)，所述切片验证请求消息(421)包括所述移动管理网元(20)的标识；以及，接收来自所述存储网元(40)的指示信息；
    所述处理模块(12)具体用于：根据所述指示信息确定所述终端设备(10)是否接入了所述移动管理网元(20)。
  45. 根据权利要求43或44所述的装置，其特征在于，所述处理模块(12)，还用于：
    在确定所述终端设备(10)未接入所述移动管理网元(20)的情况下，拒绝或忽略所述切片注册请求消息(410)。
  46. 根据权利要求36至45中任一项所述的装置，其特征在于，所述处理模块(12)还用于：
    验证计入所述网络切片的终端统计的一个或多个终端设备是否占用了所述网络切片 的资源。
  47. 根据权利要求36至46中任一项所述的装置，其特征在于，所述处理模块(12)还用于：
    确定接入所述网络切片的终端统计的数量大于或等于阈值。
  48. 根据权利要求36至47中任一项所述的装置，其特征在于，
    当所述终端设备(10)占用了所述网络切片的资源时，所述处理模块(12)具体用于将所述终端设备计入接入所述网络切片的终端统计；
    当所述终端设备(10)没有占用所述网络切片的资源时，所述处理模块(12)具体用于不将所述终端设备(10)计入接入所述网络切片的终端统计。
  49. 根据权利要求36至48中任一项所述的装置，其特征在于，所述切片注册请求消息用于请求将该终端设备计入接入所述网络切片上的终端统计。
  50. 一种网络验证的装置，其特征在于，包括：
    收发模块(11)，用于接收来自切片统计网元(30)的切片验证请求消息(421)，所述切片验证请求消息(421)包括终端设备(10)的标识和网络切片的标识；
    处理模块(12)，用于响应于所述切片验证请求消息(421)，获取所述终端设备(10)占用的网络切片的切片信息，所述切片信息包括以下任一项：所述终端设备(10)请求的网络切片、所述终端设备(10)被允许的网络切片、所述终端设备(10)请求的网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    所述处理模块(12)，还用于根据所述终端设备(10)的切片信息，验证所述终端设备(10)是否占用了所述网络切片的资源。
  51. 根据权利要求50所述的装置，其特征在于，
    当所述切片信息包括所述终端设备(10)请求的网络切片时，所述处理模块(12)具体用于验证所述网络切片是否属于所述终端设备(10)请求的网络切片，在所述网络切片属于所述终端设备(10)请求的网络切片的情况下，所述存储网元(40)确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片时，所述处理模块(12)具体用于验证所述网络切片是否属于所述终端设备(10)被允许的网络切片，在所述网络切片属于所述终端设备(10)被允许的网络切片的情况下，所述处理模块(12)具体用于确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)的请求网络切片为空的指示信息时，所述处理模块(12)具体用于验证所述网络切片是否属于所述终端设备(10)的默认网络切片，在所述网络切片属于所述终端设备(10)的默认网络切片的情况下，所述处理模块(12)具体用于确定所述终端设备(10)占用了所述网络切片的资源；
    当所述切片信息包括所述终端设备(10)被允许的网络切片为空的指示信息时，所述处理模块(12)具体用于确定所述终端设备(10)占用了所述网络切片的资源。
  52. 根据权利要求50或51所述的装置，其特征在于，
    所述处理模块(12)具体用于根据所述终端设备(10)的标识，在本地获取所述切片信息。
  53. 根据权利要求52所述的装置，其特征在于，
    在所述处理模块(12)没有从本地获取到所述切片信息时，所述收发模块(11)具体用于向所述终端设备(10)发送切片信息请求消息(423)，所述切片信息请求消息(423)用于请求获取所述切片信息；
    所述收发模块(11)具体用于接收来自所述终端设备(10)的受到了完整性保护的切片信息响应消息，所述切片信息响应消息包括所述切片信息和完整性校验参数，所述完整性校验参数用于验证所述切片信息是否被篡改。
  54. 根据权利要求53所述的装置，其特征在于，所述收发模块(11)还用于向验证网元(50)发送验证请求消息，所述验证请求消息包括所述切片信息和所述完整性校验参数，所述验证请求消息用于请求验证所述切片信息是否被篡改；
    接收来自所述验证网元(50)的完整性验证指示信息；
    所述处理模块(12)还用于根据所述完整性验证指示信息确定所述切片信息是否被篡改。
  55. 根据权利要求50至54中任一项所述的装置，其特征在于，所述方法还包括：
    所述存储网元(40)验证所述终端设备(10)是否接入了网络；
    在所述终端设备(10)没有接入网络的情况下，所述存储网元(40)向切片管理网元(30)发送状态指示信息，所述状态指示信息用于指示终端设备(10)是否接入了网络，或者，所述存储网元(40)向所述切片管理网元(30)发送验证失败的指示信息。
  56. 根据权利要求55所述的装置，其特征在于，所述存储网元(40)验证所述终端设备(10)是否接入了网络，包括：
    所述存储网元(40)根据终端设备(10)的标识请求获取终端设备(10)的上下文；
    在所述存储网元(40)获取到了所述终端设备(10)的上下文的情况下，所述存储网元(40)确定所述终端设备(10)接入了网络；
    在所述存储网元(40)没有获取到所述终端设备(10)的上下文的情况下，所述存储网元(40)确定所述终端设备(10)没有接入网络。
  57. 根据权利要求55或56所述的装置，其特征在于，所述切片验证请求消息(421)还包括移动管理网元(20)的标识，所述方法还包括：
    所述存储网元(40)验证所述终端设备(10)是否接入了所述移动管理网元(20)；
    在所述终端设备(10)没有接入所述移动管理网元(20)的情况下，所述存储网元(40)向切片管理网元(30)发送指示信息，所述指示信息用于指示所述终端设备(10)没有接入所述移动管理网元(20)，或者，所述存储网元(40)向切片管理网元(30)发送验证失败的指示信息。
  58. 根据权利要求57所述的装置，其特征在于，所述存储网元(40)验证所述终端设备(10)是否接入了所述移动管理网元(20)，包括：
    所述存储网元(40)根据终端设备(10)的标识获取终端设备(10)的上下文；
    所述存储网元(40)根据所述终端设备(10)的上下文验证所述终端设备(10)是否接入了所述移动管理网元(20)。
  59. 根据权利要求50至58中任一项所述的装置，其特征在于，
    所述处理模块(12)还用于确定所述网络切片的标识属于所述终端设备(10)的签约网络切片。
  60. 根据权利要求50至59中任一项所述的装置，其特征在于，所述切片验证请求消息(424)用于请求验证所述终端设备(10)是否占用了所述网络切片的资源。
  61. 一种网络验证的装置，其特征在于，包括：
    处理模块(12)，用于在满足触发条件的情况下，生成具有完整性保护的消息，所述消息包括所述终端设备(10)占用的网络切片的切片信息，所述切片信息包括以下任意一项：所述终端设备的请求网络切片、所述终端设备的允许网络切片、所述终端设备(10)请求的网络切片为空的指示信息、所述终端设备(10)被允许的网络切片为空的指示信息；
    收发模块(11)，用于将所述消息发送给存储网元(40)。
  62. 根据权利要求61所述的装置，其特征在于，所述触发条件包括以下任意一项或多项：
    所述收发模块(11)接收到非接入层安全模式命令消息；
    所述收发模块(11)接收到注册接受消息；
    所述收发模块(11)接收到来自所述存储网元(40)的切片信息请求消息(423)，所述切片信息请求消息(423)用于请求获取所述切片信息。
  63. 根据权利要求41或42所述的装置，其特征在于，
    所述处理模块(12)还用于利用完整性密钥和所述切片信息生成完整性校验参数，所述消息中还包括所述完整性校验参数，所述完整性校验参数用于验证所述切片信息是否被篡改。
  64. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，当所述计算机程序在计算机上运行时，使得计算机执行如权利要求1至28中任一项所述的方法。
  65. 一种计算机程序产品，其特征在于，包括计算机程序指令，所述计算机程序指令在计算机上运行时，使得计算机执行如权利要求1至28中任一项所述的方法。
  66. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器用于执行存储在存储器中的计算机程序或指令，以执行如权利要求1至28中任一项所述的方法。
PCT/CN2022/119391 2021-09-18 2022-09-16 网络验证的方法和装置 Ceased WO2023041054A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22869420.4A EP4391652A4 (en) 2021-09-18 2022-09-16 METHOD AND DEVICE FOR NETWORK TESTING
US18/606,393 US20240224098A1 (en) 2021-09-18 2024-03-15 Network verification method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111101901.6A CN115843029A (zh) 2021-09-18 2021-09-18 网络验证的方法和装置
CN202111101901.6 2021-09-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/606,393 Continuation US20240224098A1 (en) 2021-09-18 2024-03-15 Network verification method and apparatus

Publications (1)

Publication Number Publication Date
WO2023041054A1 true WO2023041054A1 (zh) 2023-03-23

Family

ID=85575204

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/119391 Ceased WO2023041054A1 (zh) 2021-09-18 2022-09-16 网络验证的方法和装置

Country Status (4)

Country Link
US (1) US20240224098A1 (zh)
EP (1) EP4391652A4 (zh)
CN (1) CN115843029A (zh)
WO (1) WO2023041054A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115134869B (zh) * 2021-03-29 2025-02-25 华为技术有限公司 网络切片的准入控制方法及装置
US12363076B2 (en) * 2022-06-29 2025-07-15 Verizon Patent And Licensing Inc. Network exposure function (NEF) for SUCI-based UE-initiated service authorization
CN117204044A (zh) * 2023-07-12 2023-12-08 北京小米移动软件有限公司 信息传输方法及装置、通信设备、通信系统及存储介质
US20250247417A1 (en) * 2024-01-29 2025-07-31 Verizon Patent And Licensing Inc. 5g network functions to prevent cyber security threats
CN119448537B (zh) * 2024-09-30 2026-01-09 北京智芯微电子科技有限公司 基于5g通信的配电终端即插即用接入方法及拓扑识别系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021054231A1 (ja) * 2019-09-18 2021-03-25 日本電気株式会社 無線端末、通信方法、及びコアネットワークノード
WO2021070028A1 (en) * 2019-10-08 2021-04-15 Telefonaktiebolaget Lm Ericsson (Publ) Network slicing scalability attributes
CN112996087A (zh) * 2016-09-28 2021-06-18 华为技术有限公司 一种网络切片选择方法、终端设备及网络设备
WO2021159415A1 (zh) * 2020-02-13 2021-08-19 华为技术有限公司 通信方法、装置及系统

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3641424B1 (en) * 2017-06-17 2022-05-04 LG Electronics Inc. Method for registering a user equipment with a network slice in a wireless communication system and user equipment therefor
US11019528B2 (en) * 2018-10-29 2021-05-25 Verizon Patent And Licensing Inc. Method and system for admission control with network slice capability
WO2021028193A1 (en) * 2019-08-09 2021-02-18 Telefonaktiebolaget Lm Ericsson (Publ) Slice selection subscription data enhancement
CN114651482B (zh) * 2019-11-06 2025-03-28 三星电子株式会社 在无线通信系统中控制网络切片的方法和装置
KR20210059467A (ko) * 2019-11-15 2021-05-25 삼성전자주식회사 무선 통신 시스템에서 네트워크 슬라이스 제어의 정확도를 높이는 방법 및 장치
WO2021119627A1 (en) * 2019-12-13 2021-06-17 Ofinno, Llc Control of network slice
US12335854B2 (en) * 2020-02-18 2025-06-17 Lg Electronics Inc. Communication related to network slice
WO2021167233A1 (ko) * 2020-02-18 2021-08-26 엘지전자 주식회사 네트워크 슬라이스와 관련된 통신
US12363616B2 (en) * 2020-05-21 2025-07-15 Apple Inc. Enhancements for handling network slice quota
US20230262457A1 (en) * 2020-06-26 2023-08-17 Lenovo (Singapore) Pte. Ltd. Authentication using slice capability indication
CN115551122A (zh) * 2021-06-30 2022-12-30 华为技术有限公司 切片准入控制的方法和通信装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112996087A (zh) * 2016-09-28 2021-06-18 华为技术有限公司 一种网络切片选择方法、终端设备及网络设备
WO2021054231A1 (ja) * 2019-09-18 2021-03-25 日本電気株式会社 無線端末、通信方法、及びコアネットワークノード
WO2021070028A1 (en) * 2019-10-08 2021-04-15 Telefonaktiebolaget Lm Ericsson (Publ) Network slicing scalability attributes
WO2021159415A1 (zh) * 2020-02-13 2021-08-19 华为技术有限公司 通信方法、装置及系统

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on enhancement of network slicing; Phase 2 (Release 17)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 23.700-40, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V0.3.0, 30 January 2020 (2020-01-30), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 62, XP051860860 *
MOTOROLA MOBILITY, LENOVO: "Solution for network slice authentication and authorisation", 3GPP DRAFT; S2-188261_ENS_SOL-SLICEAUTH_V02, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Sophia Antipolis, France; 20180820 - 20180824, 14 August 2018 (2018-08-14), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051537180 *
See also references of EP4391652A4

Also Published As

Publication number Publication date
EP4391652A1 (en) 2024-06-26
EP4391652A4 (en) 2024-12-25
US20240224098A1 (en) 2024-07-04
CN115843029A (zh) 2023-03-24

Similar Documents

Publication Publication Date Title
US20250350946A1 (en) Communication method, communication apparatus, and communication system
US20240171647A1 (en) Method and apparatus for discovering edge application server
US11558813B2 (en) Apparatus and method for network automation in wireless communication system
US12231946B2 (en) Communications method and apparatus
KR102224248B1 (ko) 통신 시스템에서 PDU(Protocol Data Unit) 세션을 설립하는 방법
WO2023041054A1 (zh) 网络验证的方法和装置
US20200296142A1 (en) User Group Establishment Method and Apparatus
EP3745757B1 (en) Communication method and communication apparatus
US12457542B2 (en) Method and apparatus for verifying compliance with UE route selection policy
WO2023213177A1 (zh) 一种通信方法及装置
US20250184731A1 (en) Communication method and communication apparatus
EP3687135B1 (en) Device monitoring, and deregistration method and apparatus
US20250168281A1 (en) Method and apparatus for traffic processing using traffic classification in wireless communication system
WO2022237733A1 (zh) 组寻呼的方法和装置
WO2023072271A1 (zh) 管理安全上下文的方法和装置
KR20220152950A (ko) 네트워크 슬라이스 승인 제어(nsac) 발견 및 로밍 향상들
CN116723507A (zh) 针对边缘网络的终端安全方法及装置
CN116569571A (zh) 通信方法和通信装置
CN115915114A (zh) 注册方法及装置
CN117413616A (zh) 用于在无线通信系统中管理基于回程信息的会话的方法和设备
CN120457712A (zh) 用于集成感测和通信的本地感测集成
WO2022262611A1 (zh) 一种通信方法及装置
US20240244087A1 (en) Data invocation method and apparatus
CN115412911A (zh) 一种鉴权方法、通信装置和系统
WO2023041056A1 (zh) 网络验证的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22869420

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022869420

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 202447023933

Country of ref document: IN

ENP Entry into the national phase

Ref document number: 2022869420

Country of ref document: EP

Effective date: 20240321

NENP Non-entry into the national phase

Ref country code: DE