Access control method and apparatus

[0001] This application is a continuation of International Application No. PCT/CN2023/080458, filed on Mar. 9, 2023, which claims priority to Chinese Patent Application No. 202210264265.7, filed on Mar. 17, 2022. The disclosures of the aforementioned applications are hereby incorporated by reference in their entireties.

[0002] This application relates to the field of wireless communication, and in particular, to an access control method and an apparatus.

[0003] Registration of user equipment (UE) may include the following procedure: The UE sends a registration request to an access and mobility management function network element (AMF) over a radio access network (AN). The AMF determines a corresponding unified data management (UDM) based on a UE identifier, and requests to obtain subscription data of the UE from the UDM. After receiving the request, the UDM may obtain actual subscription data of the UE from a unified data repository (UDR). In addition, the AMF can further initiate a user policy control establishment request (UEPolicyControl_Create) and an access management policy control establishment request (AMPolicyControl_Create) to a policy control function (PCF) to obtain a UE policy and an access control policy respectively. In this process, the PCF returns the access control policy to the AMF, and the AMF provides the UE policy to the UE.

[0004] After the registration is completed, the UE may request to establish a packet data unit (PDU) session. The establishment of the PDU session may include the following procedure: The UE sends a session establishment request to the AMF over the RAN. The AMF selects an SMF for the session to provide a service for the session, stores a correspondence between the SMF and the PDU session, and sends the session establishment request to the session management function (SMF). The SMF selects a corresponding user plane function (UPF) for the UE, establishes a user plane transmission path, and allocates an IP address to the established transmission path. In this process, the SMF further initiates a policy control session establishment request to the PCF, to establish a policy control session between the SMF and the PCF. In a policy control session establishment process, the SMF stores a correspondence between the policy control session and the PDU session. In addition, an application function network element (AF) may further establish an AF session with the PCF, and the PCF binds the AF session to the policy control session.

[0005] In the PDU session establishment procedure, an operator can configure a secondary authentication indication at a granularity of a data network name (DNN)/single-network slice selection assistance information (S-NSSAI). However, currently a technical solution for secondary authentication is to be improved.

[0006] This application provides an access control method and an apparatus, to resolve a problem that a terminal cannot continue to access a public network DN when failing to access a campus DN.

[0007] According to a first aspect, this application provides an access control method, including: A session management function network element SMF receives a session establishment request sent by a terminal. The SMF determines, based on the request, to send an authentication request to a campus server. The SMF receives an authentication failure response message sent by the campus server. When the SMF determines to accept the session establishment request, the SMF sends a policy association establishment request to a policy control function network element PCF, and receives a policy association establishment response sent by the PCF. The SMF enforces a policy rule for a session of the terminal according to a policy rule that is not of a campus in the policy association establishment response. The SMF sends a session establishment response message to the terminal.

[0008] In a possible implementation, before the SMF receives the authentication failure response message sent by an authentication server, the method further includes: The SMF obtains subscription information of the terminal device from a unified data management network element UDM, where the subscription information includes error handling indication information indicating that the session establishment request of the terminal is still accepted when authentication on the terminal fails. That the SMF determines to accept the session establishment request includes: The SMF determines, based on the error handling indication information, to accept the session establishment request.

[0009] In a possible implementation, that the SMF determines to accept the session establishment request includes: The SMF determines, based on local preconfiguration information, to accept the session establishment request.

[0010] In a possible implementation, the policy association establishment request includes indication information indicating that the terminal fails to access a campus data network DN, to enable a policy association response sent by the PCF not to include a policy information rule of the campus DN.

[0011] In a possible implementation, a policy association establishment response includes a policy information rule of the campus DN; and the method further includes: The SMF does not enforce the policy rule of the campus DN. The SMF sends indication information indicating that the enforcement of the policy rule of the campus DN fails to the PCF.

[0012] In a possible implementation, that the SMF determines, based on the request, to send an authentication request to a campus server includes: The SMF determines, based on location information of the terminal, the subscription information of the terminal, or the local configuration information of the SMF, to send the authentication request to the campus server.

[0013] According to a second aspect, this application provides an access control method, including: A policy control function network element PCF receives indication information indicating that authentication for a terminal to access a campus data network DN fails. The PCF sends a policy association message to an SMF based on the indication information, where the policy association message includes a policy rule that is not of a campus DN and does not include a policy rule of the campus DN.

[0014] In a possible implementation, that a PCF receives indication information indicating that authentication for a terminal to access a campus DN fails includes: The PCF receives a policy association establishment request sent by the session management function network element SMF, where the policy association establishment request includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a response message to the policy association establishment request.

[0015] In a possible implementation, that a PCF receives indication information indicating that authentication for a terminal to access a campus DN fails includes: The PCF receives a policy authorization request message sent by a campus server, where the policy authorization request message includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a policy association update message sent by the PCF to the SMF, to indicate that an updated policy rule of a session of the terminal includes the policy rule of a public network DN but does not include the policy rule of the campus DN.

[0016] According to a third aspect, this application provides an access control method, including: A campus server receives an authentication request sent by a session management function network element SMF, where the authentication request includes an identifier of a terminal that requests to access a campus data network DN. The campus server determines to reject accessing the campus DN by the terminal. The campus server sends an authentication response to the SMF, where the authentication response indicates that authentication succeeds but accessing the campus DN by the terminal is rejected.

[0017] In a possible implementation, the authentication response includes authorization profile index information, to enable the SMF to send the authorization profile index information to a policy control function network element PCF, where the authorization profile index information indicates that accessing the campus DN by the terminal is rejected.

[0018] According to a fourth aspect, an embodiment of this application provides a communication apparatus. The apparatus includes modules/units for performing the method according to any one of the first aspect to the third aspect and the possible implementations. The modules/units may be implemented by hardware, or may be implemented by hardware executing corresponding software.

[0019] According to a fifth aspect, an embodiment of this application provides a communication apparatus, including: a processor, and a memory and a communication interface that are separately coupled to the processor, where the communication interface is configured to communicate with another device; and the processor is configured to run instructions or a program in the memory, and perform, through the communication interface, the access control method according to any one of the first aspect to the third aspect and the possible implementations.

[0020] According to a sixth aspect, an embodiment of this application provides a computer-readable storage medium. The computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are run on a computer, the method according to any one of the first aspect to the third aspect and the possible implementations is performed.

[0021] According to a seventh aspect, an embodiment of this application provides a computer program product including instructions. When the computer program product runs on a computer, the method according to any one of the first aspect to the third aspect and the possible implementations is performed.

[0032] An access control method provided in embodiments of this application may be applied to a wireless communication system, for example, a 5G communication system or a future communication system. FIG. 1 is an example of a diagram of a wireless communication system architecture to which an embodiment of this application is applicable. The system architecture may include the following units or devices.

[0033] A terminal device may also be referred to as a terminal, a user equipment (UE), a mobile station, a mobile terminal, or the like. The terminal device may be widely used in various scenarios such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine type communication (MTC), the internet of things (IoT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, a smart grid, smart furniture, smart office, a smart wearable, smart transportation, and a smart city. The terminal device may be a mobile phone, a tablet computer, a computer with a wireless transceiver function, a wearable device, a vehicle, an uncrewed aerial vehicle, a helicopter, an airplane, a ship, a robot, a robot arm, a smart home device, or the like. A specific technology and a specific device form that are used by the terminal device are not limited in embodiments of this application.

[0034] A RAN is configured to implement a radio-related function. The radio access network may also be referred to as an access network device or a base station, and is configured to enable the terminal device to access a wireless network. The radio access network may be a base station (base station), an evolved NodeB (eNodeB) in an LTE system or an LTE-advanced system (LTE-A), a next generation NodeB (gNB) in a 5G communication system, or a transmission reception point (TRP), a baseband unit (BBU), a Wi-Fi access point (AP), a base station in a future mobile communication system, an access node in a Wi-Fi system, or the like. The radio access network may alternatively be a module or a unit that completes some functions of the base station, for example, may be a central unit (CU) or a distributed unit (DU). A specific technology and a specific device form that are used by the radio access network are not limited in embodiments of this application. For example, in a network structure, a radio access network may be a CU node, a DU node, or a radio access network including a CU node and a DU node. Specifically, the CU node is configured to support protocols such as radio resource control (RRC), a packet data convergence protocol (PDCP), and a service data adaptation protocol (SDAP). The DU node is configured to support a radio link control (RLC) layer protocol, a media access control (MAC) layer protocol, and a physical layer protocol.

[0035] The core network may include one or more of the following network elements: an access and mobility management function (AMF) network element, a session management function (SMF) network element, a user plane function (UPF) network element, an application function (AF) network element, a policy control function (PCF) network element, and a unified data management (UDM) network element. It should be noted that a 5G network includes but is not limited to the foregoing one or more network elements.

[0036] The AMF is mainly used for attachment and mobility management of a terminal in a mobile network. In addition, the AMF is responsible for transferring a user policy between the UE and the PCF.

[0037] The SMF is mainly used for session management in the mobile network, for example, session establishment, modification, and release; enforcement of a control policy delivered by the PCF; selection of a UPF that provides a packet forwarding function; internet protocol (IP) address allocation to the terminal; and the like.

[0038] The UPF is mainly responsible for processing a user packet, for example, forwarding, charging, or lawful interception. The user plane network element may also be referred to as a PDU session anchor (PSA).

[0039] The AF is mainly used for transferring a requirement of an application side on a network side, for example, a QoS requirement, a charging policy requirement, a routing policy requirement, or a user status event subscription requirement. The AF may be a third-party function entity or an application service deployed by an operator, for example, an IMS voice call service. When interacting with a core network, an application function entity of a third-party application may further perform authorization processing via a NEF. For example, the AF sends a request message to the NEF, and the NEF determines whether the AF is allowed to send the request message. If verification succeeds, the NEF forwards the request message to a corresponding PCF or UDM.

[0040] The PCF is mainly responsible for policy control functions such as charging on a session and a service flow level, QoS bandwidth guarantee, mobility management, and UE policy decision making. PCFs connected to the AMF and the SMF are respectively corresponding to an AM PCF (PCF for Access and Mobility Control) and an SM PCF (PCF for Session Management). In an actual deployment scenario, the AM PCF and the SM PCF may be a same PCF entity, or may be different PCF entities.

[0041] The UDM is mainly responsible for functions such as managing subscription data and user access authorization.

[0042] The UDR is a unified data warehouse. The UDR is responsible for functions of storage and retrieval of subscription data, policy data, application data, and another type of data.

[0043] A DN provides a data transmission service for the terminal, and may be a public data network (PDN) like the internet, or may be a local access data network (LADN) like a campus DN.

[0044] The foregoing “network element” may also be referred to as an “entity” or an “apparatus”. This is not limited in this application. In actual deployment, the network elements may be co-located. When two network elements are co-located, interaction between the two network elements provided in embodiments of this application becomes an internal operation of a co-located network element or may be omitted.

[0045] It should be understood that FIG. 1 uses a 5G communication system as an example to provide an example of the network architecture to which this embodiment of this application is applicable. An actually used network architecture may include more or fewer network elements than those shown in FIG. 1. Alternatively, this embodiment of this application may be applied to a future communication system.

[0046] A PDU session is a session service that implements PDU connectivity between the UE and the DN, and is identified by a PDU session ID. When the terminal device requests to establish the PDU session, an operator may configure a secondary authentication indication at a granularity of a DNN/S-NSSAI, to trigger the SMF to initiate an authentication procedure to a data network authentication, authorization, and accounting server (DN-AAA) in a PDU session establishment procedure, to verify whether the UE is allowed to access the DNN/S-NSSAI.

[0047] Specifically, a secondary authentication process may be shown in FIG. 2, and includes the following procedure.

[0048] 1: After the SMF receives a PDU session establishment request sent by the UE, a session establishment procedure is performed between the SMF and the UPF.

[0049] 2: The SMF determines, based on local configuration information or subscription indication information sent by the UDM, to trigger secondary authentication, and sends, via the UPF, an authentication/authorization request to the DN-AAA.

[0050] In the secondary authentication process, the DN needs to exchange an extensible authentication protocol (EAP) message with the UE via the UPF or the SMF, to obtain information needed for the secondary authentication. Specifically, the following may be included.

[0051] 3a: The DN-AAA sends an authentication/authorization response to the SMF via the UPF.

[0052] 3b: The SMF performs message transmission with the AMF, to indicate the AMF to indicate the UE to upload the information needed for the secondary authentication.

[0053] 3c: The AMF sends an authentication message to the UE over the RAN.

[0054] 3d. The UE returns an authentication message to the AMF over the RAN, where the authentication message includes the information needed for the secondary authentication.

[0055] 3e: The AMF sends a PDU session context update (PDUsession_updateSMcontext) message to the SMF.

[0056] 3f: The SMF sends an authentication/authorization request to the DN-AAA via the UPF.

[0057] 4: The DN-AAA returns an authentication/authorization response to the SMF via the UPF, where the authentication/authorization response includes indication information indicating that the authentication succeeds or the authentication fails.

[0058] 5: If the authentication succeeds, the SMF continues to perform the PDU session establishment procedure.

[0059] 6: Optionally, the SMF sends an IP address notification to the DN-AAA via the UPF.

[0060] If the authentication/authorization response returned by the DN-AAA indicates that the authentication fails, the SMF sends a PDU session establishment failure message to the UE.

[0061] To reduce a service access delay, an operator may deploy the UPF near an application access point, so that a user can access an application service nearby. As shown in FIG. 3, a UPF uplink classifier (UL CL) distinguishes a local service (for example, a service used inside a campus or an edge service deployed by a service provider) from a normal service, sends the local service to a central DN via a primary anchor UPF (UPF PDU session anchors 1) and sends the normal service to the campus DN via a secondary anchor UPF (UPF PDU session anchors 2). A UL CL-based traffic steering mode greatly improves convenience for a user of a network. In the foregoing traffic steering process, the UE has no awareness, and the SMF determines, based on a location of the UE, a type of a currently initiated service, campus service matching information, and the like, whether to allow the UE to access the campus DN.

[0062] A secondary authentication procedure may need to be performed to enable the terminal to access the campus DN. However, a current secondary authentication procedure for a terminal is allowed to be performed only once. As a result, when accessing the campus DN by the terminal is rejected, the terminal cannot continue to initiate a public network service. For example, for a campus network registered terminal, an operator may allow, via the UL CL UPF architecture, the terminal to access a public network service while accessing a campus network. After receiving a session establishment request of a terminal A, an SMF may determine, based on location information of the terminal A, subscription information of the terminal A, local configuration information, or the like, to initiate secondary authentication to an authentication server of the campus network. If the terminal A does not register with the campus network, or the authentication on the terminal A in the campus network fails due to another reason, accessing the campus network by the terminal A is rejected. However, because a secondary authentication procedure for a terminal is allowed to be performed only once, after a PDU session establishment request initiated by the terminal A is rejected, the terminal A cannot continue to initiate a public network service.

[0063] In view of this, an embodiment of this application provides an access control method, applied to a secondary authentication process, to resolve a problem that a terminal cannot continue to access a public network DN when failing to access a campus DN.

[0064] The method may be applied to the network architectures shown in FIG. 1 and FIG. 3. However, this embodiment of this application is not limited to be applicable only to a 5G communication system. This embodiment of this application may be further applied to a 4G communication system or a future communication system. The following uses a 5G communication system as an example for description.

[0065] FIG. 4 is a schematic flowchart of an access control method according to an embodiment of this application. As shown in the figure, the method may include the following steps.

[0066] Step 401: An SMF receives a session establishment request sent by a terminal.

[0067] Specifically, the terminal may send the session establishment request to an AMF, and the AMF selects the SMF, and then sends the session establishment request of the terminal to the SMF. The session establishment request sent by the terminal may be a PDU session establishment request, and is used to establish a PDU session. The PDU session that is requested to be established may include an IP-based PDU session (for example, an IPv4 PDU session or an IPv6 PDU session), or may be an Ethernet-type PDU session. In other words, a user address corresponds to a MAC address. This is not limited in the present invention.

[0068] The session establishment request sent by the terminal may include an identifier of a DNN or an S-NSSAI of a network that the terminal requests to access. In this case, the SMF may determine, based on the identifier of the DNN included in the session establishment request, a DN that the terminal requests to access. Alternatively, the session establishment request sent by the terminal may not include a DNN. In other words, the terminal does not need to determine a DN that the terminal requests to access, and the SMF determines the DN.

[0069] After receiving the session establishment request, the SMF may further request to obtain subscription data of the terminal from a UDM. Optionally, the subscription data may include indication information indicating that secondary authentication needs to be performed on the terminal, and the SMF determines to initiate the secondary authentication for the terminal. Alternatively, the SMF may determine, based on local configuration information, that secondary authentication needs to be initiated.

[0070] Step 402: The SMF determines, based on the session establishment request, to send an authentication request to a campus server.

[0071] The campus server is a server configured to perform authentication/authorization on an access request of a user, and may determine, based on a user identity and/or authentication information, whether to allow or reject the access request initiated by the user, in other words, return an authentication success/failure response to the SMF.

[0072] The campus server herein may be a campus DN-AAA. The campus server may be deployed in a campus, or may be deployed in a centralized manner with an operator network. This is not limited in the present invention.

[0073] Optionally, when the session establishment request received by the SMF includes the identifier of the DNN, the SMF may send the authentication request to a campus server corresponding to the identifier of the DNN, in other words, the DNN is a DNN corresponding to a campus service. When the session establishment request received by the SMF does not include the identifier of the DNN, the SMF may determine, based on location information of the terminal, subscription information of the terminal, or the local configuration information of the SMF, that the terminal requests to access a campus DN, and send an authentication request to a campus server corresponding to the campus DN; or the SMF may determine, based on service information of the session establishment request of the terminal, that the terminal requests to establish a session for a campus service, and the SMF may determine to send an authentication request to a campus server.

[0074] Alternatively, even if the session establishment request includes an identifier of a public network DN, the SMF may determine, based on location information of the terminal, subscription information of the terminal, the local configuration information of the SMF, or service information of the session request, to send an authentication request to a campus server.

[0075] Specifically, when the SMF sends the authentication request to the campus server, the authentication request may be forwarded via a UPF. To be specific, the SMF sends the authentication request to the UPF, and the UPF forwards the authentication request to the corresponding campus server.

[0076] Step 403: The campus server determines whether the terminal is allowed to access the campus DN.

[0077] Specifically, the campus server may obtain authentication information of the terminal to perform authentication on the terminal, and determine whether to allow the terminal to access the campus DN. For example, the campus server may exchange an EAP message with the terminal via the UPF, the SMF, and the AMF, as shown in step 3a to step 3f in FIG. 2, to obtain the information needed for performing authentication on the terminal.

[0078] If the campus server determines to allow the terminal to access the campus DN, the campus server sends an authentication success response message to the SMF. Optionally, the message may include a campus DN authorization profile index, used to index a policy rule configured on the SMF or a PCF, and may further include a campus DN authorization session aggregation maximum bit rate (DN authorized session AMBR) parameter and the like, so that the SMF establishes the session for the terminal according to an existing procedure, and the terminal can obtain a service of the campus service based on the established session.

[0079] When the campus server determines that the terminal is not allowed to access the campus DN, step 404 is performed.

[0080] Step 404: The campus server sends an authentication failure response message to the SMF.

[0081] The authentication failure response message sent by the campus server indicates that accessing the campus DN by the terminal is rejected. Optionally, the authentication failure response message may include information such as an authentication failure cause.

[0082] Step 405: When determining to accept the session establishment request of the terminal, the SMF sends a policy association establishment request to the PCF.

[0083] In a possible design, policy information of the terminal is locally configured on the SMF, to indicate that the session is still allowed to be established for the terminal even if the secondary authentication fails.

[0084] In another possible design, the SMF may obtain the subscription data of the terminal from the UDM after step 401. The obtained subscription data includes error handling indication information, and the error handling indication information indicates that the terminal is allowed to establish the session even if the secondary authentication on the terminal fails.

[0085] The SMF determines, based on the locally configured policy information or the obtained subscription data, to accept the session establishment request of the terminal, continues to perform a procedure of establishing the session for the terminal, and sends the policy association establishment request to the PCF. The request may include an ID of the session of the terminal, to request to obtain a policy rule of the session of the terminal.

[0086] Optionally, the policy association establishment request sent by the SMF to the PCF may include indication information indicating that accessing the campus DN by the terminal is rejected, so that the PCF does not send a policy rule of a campus.

[0087] Step 406: The PCF sends a policy association establishment response to the SMF.

[0088] The policy association establishment response sent by the PCF to the SMF includes the policy rule of the session determined by the PCF for the terminal, for example, a QoS control policy, a gating control policy, a flow forwarding policy, or a charging policy.

[0089] As described above, the policy association establishment request sent by the SMF may include the indication information indicating that accessing the campus DN by the terminal is rejected. In this case, the PCF does not send the policy rule of the campus DN to the SMF, and may send a policy rule of a public network.

[0090] Alternatively, if the policy association establishment request received by the PCF does not include the indication information indicating that accessing the campus DN by the terminal is rejected, the PCF may send both the policy rule of the campus DN and a policy rule of the public network DN to the SMF.

[0091] For example, the policy rule of the campus DN may include a data network access identifier (DNAI) corresponding to the campus service, routing information corresponding to the campus service, a policy and charging rule corresponding to the campus service, and the like.

[0092] Step 407: The SMF enforces the policy rule for the session of the terminal according to the policy rule in the policy association establishment response.

[0093] If the SMF sends, to the PCF in step 405, the indication information indicating that accessing the campus DN by the terminal is rejected, the policy association establishment response received by the SMF does not include the policy rule of the campus, and the SMF may directly enforce the policy rule for the session according to the policy rule carried in the policy association establishment response.

[0094] If the SMF does not send, to the PCF, the indication information indicating that accessing the campus DN by the terminal is rejected, the policy association establishment response received by the PCF may include the policy rule of the campus DN. In this case, the SMF needs to determine, in the received policy rules, which policy rule is the policy rule of the campus DN and which policy rule is the policy rule of the public network DN, enforce the policy rule of the public network DN, and reject enforcing the policy rule of the campus DN. Specifically, the SMF may determine, based on flow description information in a policy rule, whether the policy rule is the policy rule of the campus DN. For example, if an application identifier in the flow description information is a campus application, or IP 5-tuple information in the flow description information includes information such as a campus address segment, the SMF may determine that the policy rule is the policy rule of the campus DN. Optionally, the SMF may alternatively determine, based on DNAI access point information in a policy rule, that the rule is the policy rule of the campus. For example, if the policy rule includes a DNAI access point corresponding to the campus service, or includes a traffic steering destination address segment corresponding to the campus service, the SMF may determine that the policy rule is the policy rule of the campus.

[0095] Optionally, the SMF may further send, to the PCF, indication information indicating that enforcement of the policy of the campus DN fails, or the SMF may send a policy enforcement response message to the PCF, and use the message to carry a cause value of the enforcement failure, to indicate that the current terminal does not support access to the campus service.

[0096] Step 408: The SMF sends a session establishment response message to the terminal.

[0097] After enforcing the corresponding policy rule for the session of the terminal, the SMF may send a session establishment response to the terminal. Specifically, the SMF may send the session establishment response message to the terminal via the AMF.

[0098] In a possible implementation, the access control method in the foregoing embodiment of this application may also be applied to a process of modifying a secondary authentication result of the terminal.

[0099] For example, if the terminal is originally allowed to access the campus DN, a result of the secondary authentication process that is first performed by the terminal is that the authentication succeeds. However, if the campus server receives an information deletion indication for the terminal, the campus server may send information indicating that the authentication result becomes invalid to the SMF. The SMF may send a policy association update request to the PCF based on the information indicating that the authentication result becomes invalid, where the update request may include indication information indicating that accessing the campus DN by the terminal is rejected, to obtain an updated policy rule from the PCF, so that the terminal cannot continue to access the campus service; or the SMF may delete the policy rule of the campus DN from one or more enforced policy rules, so that continuing to access the campus service by the terminal is rejected.

[0100] For another example, if the terminal is originally not allowed to access the campus DN, a result of the secondary authentication process that is first performed by the terminal is that the authentication fails. After step 408, the campus server receives valid identity authentication information or updated authentication information for the terminal. The campus server may also actively send authentication success information to the SMF. The SMF may send a policy association update request to the PCF based on the authentication success information, to obtain the policy rule of the campus DN. Then, the SMF may enforce the policy rule of the campus DN for the session of the terminal.

[0101] In a conventional secondary authentication process, because secondary authentication for a terminal is performed only once, if accessing a campus DN by the terminal is rejected in the secondary authentication process, the terminal cannot continue to access a public network DN and initiate a public network service. However, in the foregoing method embodiment of this application, in a process of establishing the session for the terminal, although access by the terminal is rejected by the campus DN during the secondary authentication, the SMF still allows the terminal to continue to establish the session, and only rejects associating the terminal with the policy rule of the campus DN, but may still enforce the policy rule of the public network DN for the terminal. Therefore, accessing the campus DN by the terminal is rejected, and the terminal cannot initiate the campus service, but can still initiate a public network service, to resolve a valid requirement of the terminal to access a data network.

[0102] To better understand the operation procedure in the foregoing embodiment of this application, the following provides examples with reference to FIG. 5 and FIG. 6.

[0103] Refer to the specific embodiment shown in FIG. 5. An access control method may include the following steps.

[0104] Step 501: A terminal sends a session establishment request to an SMF.

[0105] Specifically, the terminal may first send the session establishment request to an AMF, and then the AMF sends the session establishment request to the SMF.

[0106] Step 502: The SMF obtains subscription data of the terminal from a UDM.

[0107] The obtained subscription data includes indication information (secondary authentication indication) indicating that secondary authentication needs to be performed, and an error handling indication (error handling indication). The error handling indication indicates that the terminal is allowed to establish a session even if the secondary authentication on the terminal fails.

[0108] Optionally, the subscription data obtained by the SMF from the UDM may alternatively not include an error handling indication, and error handling indication information of the terminal may be locally configured in the SMF.

[0109] Step 503: The SMF sends an authentication/authorization request (authentication/authorization request) to a campus DN via a UPF. The authentication/authorization request is the authentication request in the foregoing embodiment.

[0110] Optionally, the campus DN performs secondary authentication on the terminal by exchanging an EAP message with the UE via the UPF and the SMF. For example, a secondary authentication process may be shown in step 3a to step 3f in FIG. 2.

[0111] Step 504: A campus server determines that the secondary authentication on the terminal fails, and rejects accessing the campus DN by the terminal.

[0112] Step 505: The campus server sends an authentication/authorization response to the SMF via the UPF. The authentication/authorization response indicates that the authentication fails, and accessing the campus DN by the terminal is rejected. The authentication/authorization response is the authentication failure response message in the foregoing embodiment.

[0113] Step 506: The SMF sends a policy association establishment request to the PCF, where the request includes indication information indicating that accessing the campus DN by the terminal is rejected.

[0114] Step 507: The PCF determines, based on the indication information indicating that accessing the campus DN by the terminal is rejected, a policy rule for establishing the session by the terminal.

[0115] Step 508: The PCF sends a policy association establishment response to the SMF, where the response includes the policy rule determined by the PCF in step 507.

[0116] Step 509: The SMF enforces the policy rule sent by the PCF, and sends a session establishment response to the terminal.

[0117] FIG. 6 also provides an example of an access control method. As shown in FIG. 6, the method may include the following steps.

[0118] Step 601 to step 605 are similar to step 501 to step 505, and are not repeated herein.

[0119] Step 606: The SMF sends a policy association establishment request to the PCF.

[0120] A difference from step 506 in the foregoing embodiment lies in that, in step 506, the indication information indicating that accessing the campus DN by the terminal is rejected needs to be carried, but in step 606, the indication information indicating that accessing the campus DN by the terminal is rejected may not be carried.

[0121] Step 607: The PCF sends a policy association establishment response to the SMF.

[0122] Because the PCF does not obtain the indication information indicating that accessing the campus DN by the terminal is rejected, the policy association establishment response sent by the PCF includes a policy rule of the campus DN.

[0123] Step 608: The SMF enforces a policy rule that is not of the campus DN, and does not enforce the policy rule of the campus DN.

[0124] Step 609: The SMF sends, to the PCF, indication information indicating that the enforcement of the policy of the campus DN fails.

[0125] Step 610: The SMF sends a session establishment response message to the terminal.

[0126] An embodiment of this application further provides an access control method, and the method can also resolve a problem that a terminal cannot continue to access a public network DN when failing to access a campus DN. A difference between the method and the foregoing embodiment lies in that, when accessing the campus DN by the terminal is rejected, in the foregoing embodiment, the SMF determines, based on the obtained subscription information or the local configuration information, whether to continue to establish the session for the terminal, while in the method embodiment, a DN may determine whether to continue to establish a session for the terminal.

[0127] FIG. 7 is a schematic flowchart of an access control method according to an embodiment of this application. As shown in the figure, the method may include the following procedure.

[0128] Step 701: An SMF sends an authentication request to a campus server.

[0129] The authentication request includes an identifier of a terminal that requests to access a campus DN, so that the campus server performs authentication on the terminal.

[0130] Step 702: The campus server determines to reject accessing the campus DN by the terminal.

[0131] Specifically, the campus server may obtain authentication information of the terminal to perform authentication on the terminal, and determine whether to allow the terminal to access the campus DN. For example, the campus server may exchange an EAP message with the terminal via a UPF, the SMF, and an AMF, as shown in step 3a to step 3f in FIG. 2, to obtain the information needed for performing authentication on the terminal.

[0132] The campus server determines, based on the obtained authentication information, that the terminal is not a valid registered terminal of the campus DN, or that the authentication fails due to another reason, and as a result, rejects accessing the campus DN by the terminal.

[0133] Step 703: The campus server sends an authentication response to the SMF, where the authentication response indicates that the authentication succeeds but accessing the campus DN by the terminal is rejected.

[0134] The campus server may determine, based on the obtained authentication information of the terminal, that the terminal is still allowed to establish a session even if accessing the campus DN by the terminal is rejected; or the campus server may determine, based on locally configured information, that the terminal is still allowed to establish a session even if accessing the campus DN by the terminal is rejected.

[0135] Optionally, the authentication success response sent by the campus server may carry an authorization profile index (DN authorization profile index), used to index policy information configured on the SMF or a PCF. When the campus server rejects accessing the campus DN by the terminal, the authorization profile index cannot be used to index a policy rule of the campus DN, but should be used to index a policy rule that is not of the campus DN. Therefore, the authorization profile index may be used as indication information indicating that accessing the campus DN by the terminal is rejected. Alternatively, the authorization profile index may directly indicate that accessing the campus DN by the terminal is rejected.

[0136] Alternatively, the campus server may set a new field in the authentication response, to indicate that although the authentication succeeds, accessing the campus DN by the terminal is rejected.

[0137] Step 704: The SMF sends a policy association establishment request to the PCF based on the received authentication response.

[0138] After the SMF receives the authentication response, because the authentication response indicates that the authentication succeeds, the SMF sends the policy association establishment request to the PCF, to obtain a policy rule of the session of terminal.

[0139] Optionally, the SMF may use the policy association establishment request sent to the PCF to carry the authorization profile index that is in the received authentication response. The PCF may determine, based on the authorization profile index, the policy rule that needs to be sent. Further, the PCF can indicate, based on the authorization profile index, that the policy rule of the campus DN is not indexed, so that the PCF is indicated that accessing the campus DN by the terminal is rejected. Alternatively, the authorization profile index may explicitly indicate that the terminal is not allowed to access the campus DN, and then the PCF selects a policy rule that is not of the campus DN based on the authorization profile index. In this process, the SMF may be unaware of an event that accessing the campus DN by the terminal is rejected. Because the SMF receives an authentication success response message, the SMF sends the policy association establishment request to the PCF based on the authorization profile index. This is consistent with a normal procedure of establishing a session for the terminal. However, the policy rule sent by the PCF based on the authorization profile index does not include the policy rule of the campus DN. Therefore, even if the SMF does not know that accessing the campus DN by the terminal is rejected, the SMF does not enforce the policy rule of the campus DN for the session of the terminal.

[0140] Alternatively, if the DN indicates, by using other indication information, that accessing the campus DN by the terminal is rejected, the SMF may determine, based on the indication information, that accessing the campus DN by the terminal is rejected. In this case, the SMF may indicate, to the PCF with reference to the operations in the embodiment shown in FIG. 4, that accessing the campus DN by the terminal is rejected. Alternatively, the SMF may not indicate to the PCF that accessing the campus DN by the terminal is rejected. After receiving the policy rule, the SMF enforces the policy rule that is not of the campus DN, and does not enforce the policy rule of the campus DN.

[0141] Step 705: The SMF establishes the session for the terminal according to the policy rule obtained from the PCF.

[0142] In a conventional secondary authentication process, because secondary authentication for a terminal is performed only once, if accessing the campus DN by the terminal is rejected in the secondary authentication process, the terminal cannot continue to access a public network DN and initiate a public network service. In the foregoing method embodiment of this application, when performing secondary authentication on the terminal, the campus server may determine, based on the locally configured information or the obtained authentication information of the terminal, that the terminal is still allowed to establish the session even if accessing the campus DN by the terminal is rejected, and then send, to the SMF, the authentication response indicating that the authentication succeeds but accessing the campus DN by the terminal is rejected, so that the SMF and the PCF can configure the policy rule that is not of the campus DN for the terminal, and the terminal can still initiate a public network service to access a public network DN, to resolve a valid requirement of a terminal to access a data network.

[0143] In another possible implementation, the authentication response sent by the campus server to the SMF may indicate only that the authentication succeeds, and does not indicate accessing the campus DN by the terminal is rejected. Then, the campus server may send indication information to the PCF, to indicate the PCF not to provide the policy rule of the campus DN for the terminal. FIG. 8 is an example of a schematic flowchart in this implementation. As shown in the figure, the following steps are included.

[0144] Step 801 to step 804 are similar to step 501 to step 504, and details are not described herein again.

[0145] Step 805: The campus server sends an authentication/authorization response to the SMF via the UPF, where the response indicates that the authentication succeeds.

[0146] Step 806: The SMF sends a policy association establishment request to a PCF.

[0147] Step 807: The PCF sends a policy association establishment response to the SMF.

[0148] Step 808: The SMF sends a session establishment response to the terminal.

[0149] Step 809: The campus server sends a policy authorization request message (policy authorization create request) to the PCF, where the policy authorization request message is used to request the PCF to stop providing a policy rule of the campus DN for the terminal.

[0150] Step 810: The PCF sends a policy association update message to the SMF, where the message does not carry the policy rule of the campus DN.

[0151] Step 811: The SMF updates an associated policy rule for the session of the terminal according to a policy rule in the policy association update message.

[0152] FIG. 9 is a diagram of a communication apparatus according to an embodiment of this application. The communication apparatus includes a processing module 901 and a transceiver module 902. The processing module 901 is configured to implement data processing by the communication apparatus. The transceiver module 902 is configured to perform information receiving and sending processing in the foregoing method embodiments. It should be understood that, in this embodiment of this application, the processing module 901 may be implemented by a processor or a processor-related circuit component (or referred to as a processing circuit). The transceiver module 902 may be implemented by a receiver or a receiver-related circuit, and a transmitter or a transmitter-related circuit component.

[0153] For example, the communication apparatus may be a communication apparatus device, or may be a chip used in the communication apparatus device, or another combined device or component that has a function of the communication apparatus device.

[0154] When the communication apparatus is a session management function network element SMF, the transceiver module 902 is configured to receive a session establishment request sent by a terminal, and the processing module 901 is configured to determine, based on the request, to send an authentication request to a campus server via the transceiver module 902. The transceiver module 902 is further configured to receive an authentication failure response message sent by the campus server. The processing module 901 is further configured to: when determining to accept the session establishment request, send a policy association establishment request to a policy control function network element PCF via the transceiver module 902, and receive a policy association establishment response sent by the PCF. The processing module 901 is further configured to enforce a policy rule for a session of the terminal according to a policy rule in the policy association establishment response. The transceiver module 902 is further configured to send a session establishment response message to the terminal.

[0155] In addition, the foregoing modules may be further configured to support another process performed by the SMF in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0156] When the communication apparatus is a policy control function network element PCF, the transceiver module 902 is configured to receive indication information indicating that authentication for a terminal to access a campus data network DN fails. The processing module 901 is configured to send a policy association message to an SMF based on the indication information via the transceiver module 902, where the policy association message includes a policy rule that is not of the campus DN and does not include a policy rule of the campus DN.

[0157] Optionally, when receiving the indication information indicating that the authentication for the terminal to access the campus DN fails, the transceiver module 902 is specifically configured to receive a policy association establishment request sent by the session management function network element SMF, where the policy association establishment request includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a response message to the policy association establishment request.

[0158] Optionally, when receiving the indication information indicating that the authentication for the terminal to access the campus DN fails, the transceiver module 902 is specifically configured to receive a policy authorization request message sent by a campus server, where the policy authorization request message includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a policy association update message sent to the SMF, to indicate that an updated policy rule of a session of the terminal includes the policy rule of a public network DN but does not include the policy rule of the campus DN.

[0159] In addition, the foregoing modules may be further configured to support another process performed by the PCF in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0160] When the communication apparatus is a campus server, the transceiver module 902 is configured to receive an authentication request sent by a session management function network element SMF, where the authentication request includes an identifier of a terminal that requests to access a campus data network DN. The processing module 901 is configured to determine to reject accessing the campus DN by the terminal. The transceiver module 902 is further configured to send an authentication response to the SMF, where the authentication response indicates that authentication succeeds but accessing the campus DN by the terminal is rejected.

[0161] In addition, the foregoing modules may be further configured to support another process performed by the campus server in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0162] FIG. 10 is a diagram of another communication apparatus according to an embodiment of this application. The communication apparatus includes a processor 1001 shown in FIG. 10 and a communication interface 1002 connected to the processor 1001.

[0163] The processor 1001 may be a general-purpose processor, a microprocessor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or another programmable logic device, a discrete gate or a transistor logic device, or one or more integrated circuits configured to control program execution of the solutions in this application. The general-purpose processor may be a microprocessor, any conventional processor, or the like. The steps of the method disclosed with reference to embodiments of this application may be directly performed by a hardware processor, or may be performed by using a combination of hardware in the processor and a software module.

[0164] The communication interface 1002 uses any apparatus like a transceiver, and is configured to communicate with another device or a communication network, for example, a RAN.

[0165] In this embodiment of this application, the processor 1001 is configured to invoke the communication interface 1002 to perform a receiving and/or sending function, and perform the user plane function redundancy method according to any one of the foregoing possible implementations.

[0166] Further, the communication apparatus may further include a memory 1003 and a communication bus 1004.

[0167] The memory 1003 is configured to store program instructions and/or data, so that the processor 1001 invokes the instructions and/or the data stored in the memory 1003, to implement the foregoing functions of the processor 1001. The memory 1003 may be a read-only memory (read-only memory, ROM) or another type of static storage device capable of storing static information and instructions, a random access memory (RAM) or another type of dynamic storage device capable of storing information and instructions. It may alternatively be an electrically erasable programmable read-only memory (EEPROM) or any other medium for carrying or storing expected program code in a form of an instruction or a data structure and accessible by a computer, but is not limited thereto. The memory 1003 may exist independently, for example, an off-chip memory, and is connected to the processor 1001 through the communication bus 1004. The memory 1003 may alternatively be integrated with the processor 1001.

[0168] The communication bus 1004 may include a path for transferring information between the foregoing components.

[0169] When the communication apparatus is a session management function network element SMF, the processor 1001 performs, through the communication interface 1002, the following operations: receiving a session establishment request sent by a terminal, and determining, based on the request, to send an authentication request to a campus server; receiving an authentication failure response message sent by the campus server; when determining to accept the session establishment request, sending a policy association establishment request to a policy control function network element (PCF), and receiving a policy association establishment response sent by the PCF; enforcing a policy rule for a session of the terminal according to a policy rule in the policy association establishment response; and sending a session establishment response message to the terminal.

[0170] In addition, the foregoing modules may be further configured to support another process performed by the SMF in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0171] When the communication apparatus is a policy control function network element (PCF), the processor 1001 performs, through the communication interface 1002, the following operations: receiving indication information indicating that authentication for a terminal to access a campus data network (DN) fails; and sending a policy association message to an SMF based on the indication information, where the policy association message includes a policy rule that is not of the campus DN and does not include a policy rule of the campus DN.

[0172] Optionally, when receiving, through the communication interface 1002, the indication information indicating that the authentication for the terminal to access the campus DN fails, the processor 1001 is specifically configured to receive a policy association establishment request sent by the session management function network element SMF, where the policy association establishment request includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a response message to the policy association establishment request.

[0173] Optionally, when receiving, through the communication interface 1002, the indication information indicating that the authentication for the terminal to access the campus DN fails, the processor 1001 is specifically configured to receive a policy authorization request message sent by a campus server, where the policy authorization request message includes the indication information indicating that the authentication for the terminal to access the campus DN fails, and the policy association message is a policy association update message sent by the PCF to the SMF, to indicate that an updated policy rule of a session of the terminal includes the policy rule of a public network DN but does not include the policy rule of the campus DN.

[0174] In addition, the foregoing modules may be further configured to support another process performed by the PCF in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0175] When the communication apparatus is a campus server, the processor 1001 performs, through the communication interface 1002, the following operations: receiving an authentication request sent by a session management function network element (SMF), where the authentication request includes an identifier of a terminal that requests to access a campus data network (DN); determining to reject accessing the campus DN by the terminal; and sending an authentication response to the SMF, where the authentication response indicates that authentication succeeds but accessing the campus DN by the terminal is rejected.

[0176] In addition, the foregoing modules may be further configured to support another process performed by the campus server in any one of the embodiments and the implementations of the embodiments shown in FIG. 4 to FIG. 8. For beneficial effects, refer to the foregoing descriptions. Details are not described herein again.

[0177] Based on a same technical concept, an embodiment of this application further provides a computer-readable storage medium. The computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are run on a computer, the access control method according to any one of the foregoing possible implementations is performed.

[0178] An embodiment of this application provides a computer program product including instructions. When the computer program product runs on a computer, the method embodiments are performed.

[0179] In descriptions of embodiments of this application, the term “and/or” describes an association relationship between associated objects and indicates that three relationships may exist. For example, A and/or B may indicate the following three cases: Only A exists, both A and B exist, and only B exists. “A plurality of” in this application means two or more.

[0180] In addition, it should be understood that, in the descriptions of this application, the terms “first”, “second”, and “third” are merely intended for differentiation and description and shall not be understood as indication or implication of relative importance, or indication or implication of an order. Reference to “an embodiment”, “some embodiments”, or the like described in this specification indicates that one or more embodiments of this application include a specific feature, structure, or characteristic described with reference to embodiments. Therefore, statements such as “in an embodiment”, “in some embodiments”, “in some other embodiments”, and “in other embodiments” that appear at different places in this specification do not necessarily mean referring to a same embodiment. Instead, the statements mean “one or more but not all of embodiments”, unless otherwise specifically emphasized in another manner. The terms “include”, “have”, and their variants all mean “include but are not limited to”, unless otherwise specifically emphasized in another manner.

[0181] An embodiment of this application provides a computer-readable storage medium storing a computer program. The computer program includes instructions for performing the foregoing method embodiments.

[0182] An embodiment of this application provides a computer program product including instructions. When the computer program product runs on a computer, the computer performs the foregoing method embodiments.

[0183] Persons skilled in the art should understand that embodiments of this application may be provided as a method, a system, or a computer program product. Therefore, this application may use a form of hardware only embodiments, software only embodiments, or embodiments with a combination of software and hardware. In addition, this application may use a form of a computer program product that is implemented on one or more computer-usable storage media (including but not limited to a disk memory, a CD-ROM, an optical memory, and the like) that include computer-usable program code.

[0184] This application is described with reference to the flowcharts and/or block diagrams of the method, the device (system), and the computer program product according to embodiments of this application. It should be understood that computer program instructions may be used to implement each procedure and/or each block in the flowcharts and/or the block diagrams and a combination of procedures and/or blocks in the flowcharts and/or the block diagrams. These computer program instructions may be provided for a general-purpose computer, a dedicated computer, an embedded processor, or a processor of another programmable data processing device to generate a machine, so that the instructions executed by a computer or the processor of the another programmable data processing device generate an apparatus for implementing a specific function in one or more procedures in the flowcharts and/or one or more blocks in the block diagrams.

[0185] These computer program instructions may alternatively be stored in a computer-readable memory that can indicate a computer or another programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate an artifact that includes an instruction apparatus. The instruction apparatus implements a specific function in one or more procedures in the flowcharts and/or one or more blocks in the block diagrams.

[0186] These computer program instructions may alternatively be loaded onto the computer or the another programmable data processing device, so that a series of operation steps are performed on the computer or the another programmable device to generate computer-implemented processing, and instructions executed on the computer or the another programmable device provide steps for implementing a function specified in one or more procedures in the flowchart and/or one or more blocks in the block diagram.

[0187] Although embodiments of this application are described, persons skilled in the art can make changes and modifications to these embodiments after they learn of a basic inventive concept. Therefore, the following claims are intended to be construed as to cover the preferred embodiments and all changes and modifications falling within the scope of this application.

[0188] It is clearly that persons skilled in the art can make various modifications and variations to embodiments of this application without departing from the scope of embodiments of this application. In this case, this application is intended to cover these modifications and variations of embodiments of this application provided that they fall within the scope of the following claims and their equivalent technologies.