[go: up one dir, main page]

WO2018191854A1 - 接入固定网络的方法和接入网关网元 - Google Patents

接入固定网络的方法和接入网关网元 Download PDF

Info

Publication number
WO2018191854A1
WO2018191854A1 PCT/CN2017/080826 CN2017080826W WO2018191854A1 WO 2018191854 A1 WO2018191854 A1 WO 2018191854A1 CN 2017080826 W CN2017080826 W CN 2017080826W WO 2018191854 A1 WO2018191854 A1 WO 2018191854A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
authentication
message
terminal
access
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/080826
Other languages
English (en)
French (fr)
Inventor
李欢
李�赫
靳维生
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP17906028.0A priority Critical patent/EP3598693A1/en
Priority to CN201780061311.0A priority patent/CN109792389A/zh
Priority to PCT/CN2017/080826 priority patent/WO2018191854A1/zh
Publication of WO2018191854A1 publication Critical patent/WO2018191854A1/zh
Priority to US16/655,223 priority patent/US20200053131A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/324—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the data link layer [OSI layer 2], e.g. HDLC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/18—Negotiating wireless communication parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/24—Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/16—Gateway arrangements

Definitions

  • the present application relates to the field of communications, and in particular, to a method for accessing a fixed network and an access gateway network element.
  • 3GPP 3rd Generation Partnership Project
  • 5G 5th Generation
  • the fixed network and mobile network interworking schemes have tried on unified policy and charging control, and use scalable authentication protocol-authentication and key agreement (Extensible
  • the authentication method of the Authentication Protocol-Authentication and Key Agreement (EAP-AKA) authenticates the user equipment (User Equipment, UE), and solves the problem that the UE with the Subscriber Identity Module (SIM) card accesses the EPS system. problem.
  • EAP-AKA Authentication Protocol-Authentication and Key Agreement
  • SIM Subscriber Identity Module
  • the authentication method requires the AAA server in the fixed network to cooperate with the AAA server in the mobile network, and the fusion of the mobile network and the core network device of the fixed network cannot be realized.
  • the embodiment of the present application provides a method for accessing a fixed network and an access gateway network element, which can implement fusion of a mobile network and a core network device of a fixed network.
  • a method for accessing a fixed network comprising: accessing a network element of a fixed network with a terminal to perform a point-to-point protocol PPPoE negotiation on an Ethernet, to establish a PPPoE session with the terminal; accessing the gateway network element and the terminal Negotiating the PPPoE authentication mode; the access gateway network element sends a PPPoE authentication parameter to the authentication service network element of the mobile network, and the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal; the access gateway network element receives The PPPoE authentication result is sent from the authentication service network element, and the PPPoE authentication result message is sent to the terminal.
  • the PPPoE authentication result message includes the PPPoE authentication result.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the UE establishes a PPPoE session with the AGF, the AGF sends a PPPoE authentication parameter to the AUSF, and the PPPoE authentication parameter is used by the AUSF to authenticate the UE, and then the AUSF will check The result of the weight is fed back to the UE, and the fusion of the core network equipment of the mobile network and the fixed network is realized.
  • the access gateway network element sends a PPPoE authentication parameter to the authentication service network element of the mobile network, including: the access gateway network element sends an attach request message to the access and mobility management network element, and attaches
  • the request message includes a PPPoE authentication parameter, so that the access and mobility management network element sends a PPPoE authentication parameter to the authentication service network element through the authentication request message; the access gateway network element receives the PPPoE authentication from the authentication service network element.
  • the result of the right includes: access gateway network element access and mobility
  • the management network element receives the attach accept message, and the attach accept message includes the PPPoE authentication result, and the PPPoE authentication result is obtained by the access and mobility management network element from the authentication response message from the authentication service network element.
  • the attach request message and the authentication request message further include a fixed network access indication, and the fixed network access indication is used by the authentication service network element to determine to use the PPPoE authentication method; or, the PPPoE authentication parameter It is also used by the authentication service network element to determine the PPPoE authentication method.
  • This design provides an authentication service network element to determine how to use the PPPoE authentication method.
  • the method further includes: the access gateway network element receiving the security mode from the access and mobility management network element The SMC message is sent; the access gateway network element sends a first point-to-point protocol PPP message to the terminal, where the first PPP message includes an SMC message or a non-access stratum NAS encryption activation parameter; the access gateway network element receives the second PPP message from the terminal, The second PPP message includes an SMC completion message or a NAS encryption activation parameter; the access gateway network element sends an SMC completion message or a NAS encryption activation parameter to the access and mobility management network element.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the attach accept message further includes an SMC message
  • the authentication response message further includes an SMC message or a NAS encryption activation parameter
  • the method further includes: the access gateway network element receives the first network control protocol from the terminal.
  • the NCP negotiation message includes an SMC completion message or a NAS encryption activation parameter in the first NCP negotiation message; the access gateway network element sends an SMC completion message to the access and mobility management network element.
  • the method further includes: the access gateway network element sends a second NCP negotiation message to the terminal, where the second NCP negotiation message includes a source Internet protocol IP address and a destination IP address for the NAS message transmission, Or the source media access control MAC address and destination MAC address.
  • the second NCP negotiation message includes a source Internet protocol IP address and a destination IP address for the NAS message transmission, Or the source media access control MAC address and destination MAC address.
  • the method further includes: the access gateway network element receives the third NCP negotiation message from the terminal; the access gateway network element sends the packet data unit PDU session establishment request message to the access and mobility management network element.
  • the PDU session establishment request message includes a user identifier and/or a fixed network access identifier.
  • the access gateway network element receives a session establishment response message from the access and mobility management network element, where the session establishment response message includes data for transmitting user plane.
  • the IP address of the packet and the quality of service QoS and/or charging policy, the QoS and/or charging policy is obtained by the session management network element according to the user identifier and/or the fixed network access identifier; the access gateway network element sends the fourth to the terminal.
  • the NCP negotiation message includes an IP address for transmitting a user plane data packet in the fourth NCP negotiation message.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the access gateway network element can serve the terminal according to the QoS and/or charging policy.
  • the method further includes: the access gateway network element receives the fifth NCP negotiation message from the terminal, and the fifth NCP negotiation message includes the SMC request message; the access gateway network element accesses and mobility management The network element sends an SMC request message; the access gateway network element receives the access and mobility tube The network element receives the SMC response message; the access gateway network element sends a sixth NCP negotiation message to the terminal, and the sixth NCP negotiation message includes an SMC response message.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the sixth NCP negotiation message further includes a source IP address and a destination IP address, or a source MAC address and a destination MAC address, for NAS message transmission.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the method further includes: the access gateway network element receives the seventh NCP negotiation message from the terminal; the access gateway network element sends an attach complete message to the access and mobility management network element; and the access gateway network The element receives the SMC message from the access and mobility management network element; the access gateway network element sends an eighth NCP negotiation message to the terminal, and the eighth NCP negotiation message includes the SMC message; the access gateway network element receives the SMC complete message from the terminal.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the access gateway network element receives the SMC complete message from the terminal, including: the access gateway network element receives the user uplink data packet from the terminal, and the user uplink data packet includes the SMC complete message, or the access gateway The network element receives the ninth NCP negotiation message from the terminal, and the ninth NCP negotiation message includes an SMC complete message, or when the eighth NCP negotiation message includes a source IP address and a destination IP address for the NAS message transmission, or a source MAC address and When the destination MAC address is received, the access gateway network element receives the SMC complete message from the terminal, and the SMC complete message uses the source IP address and the destination IP address for the NAS message transmission, or the source MAC address and the destination MAC address.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the access gateway network element establishes and configures a link layer connection with the terminal to negotiate the authentication mode, including: the access gateway network element receives the link control protocol LCP negotiation message from the terminal to determine the adoption.
  • the challenge handshake authentication protocol CHAP authentication process ; the access gateway network element generates a first random number; the access gateway network element sends a challenge message to the terminal to initiate CHAP authentication, and the challenge request message includes the first random number;
  • the gateway network element receives the challenge response message from the terminal, where the challenge response message includes a first authentication token, where the first authentication token is generated by the terminal according to the first random number and the first authentication parameter; the method further includes: The gateway network element sends the first random number and the first authentication token to the authentication service network element, where the authentication service network element authenticates the terminal; the access gateway network element receives the second from the authentication service network element.
  • the access gateway network element sends the terminal to the terminal Second random number sum Two authentication token for network authentication of the terminal.
  • the access gateway network element establishes and configures a link layer connection with the terminal to negotiate the authentication mode, including: the access gateway network element receives the LCP negotiation message from the terminal to determine the CHAP authentication process.
  • the LCP negotiation message includes the identity information of the terminal; the access gateway network element sends an authentication information request message to the normalized data management network element, where the authentication information request message includes the identity information of the terminal;
  • the right service network element receives the authentication information response message, where the authentication information response message includes a third random number and a third authentication token, where the third random number and the third authentication token are
  • the normalized data management network element is generated according to the identity information of the terminal; the access gateway network element sends a challenge request message to the terminal to initiate CHAP authentication, and the challenge request message includes a third random number and a third authentication token.
  • the terminal authenticates the network side; the access gateway network element receives the challenge response message from the terminal, where the challenge response message includes a fourth random number and a fourth authentication token, and the fourth random number is generated by the terminal, and the fourth authentication order is generated.
  • the card is generated by the terminal according to the third random number, the fourth random number, and the third authentication parameter; the method further includes: the access gateway network element sends the fourth random number and the fourth authentication token to the authentication service network element, The authentication service network element authenticates the terminal, and is used by the authentication service network element to authenticate the terminal. This design provides a way to authenticate the terminal to the network side.
  • the access gateway network element comprises one of the following: an independent network element in the fixed network access network, an access network of the fixed network, and a broadband network gateway BNG/broadband mobile access server BRAS.
  • This design provides a specific implementation of the access gateway network element.
  • the second aspect provides a fixed network access gateway network element, including: a negotiating unit, configured to perform peer-to-peer protocol PPPoE negotiation with the terminal to establish a PPPoE session with the terminal; the negotiating unit is further used for the terminal Negotiating the PPPoE authentication mode; the sending unit is configured to send a PPPoE authentication parameter to the authentication service network element of the mobile network, the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal, and the receiving unit is configured to receive The PPPoE authentication result is sent from the authentication service network element, and the PPPoE authentication result message is sent to the terminal.
  • the PPPoE authentication result message includes the PPPoE authentication result.
  • the principle and the beneficial effects of the device can be referred to the first aspect and the possible method embodiments of the first aspect and the beneficial effects. Therefore, the implementation of the device can be referred to the first The aspects and implementations of the various possible methods of the first aspect are not repeated here.
  • an embodiment of the present application provides a fixed network access gateway network element, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor and the memory pass the bus Connecting, when the device is running, the processor executing the computer-executable instructions stored by the memory to cause the device to perform the method of any of the above first aspects; based on the same inventive concept, the processor calls the memory stored in the memory The instructions are used to implement the solution in the method design of the above first aspect.
  • an embodiment of the present application provides a computer storage medium, including instructions, when executed on a computer, causing a computer to perform the method of accessing a fixed network according to the first aspect.
  • an embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing the computer to perform the method of accessing a fixed network according to the first aspect.
  • the sixth aspect provides a method for accessing a fixed network, including: the terminal and the access gateway network element of the fixed network perform peer-to-peer protocol PPPoE negotiation on the Ethernet to establish a PPPoE session with the access gateway network element; Incoming gateway network element negotiates PPPoE authentication mode; terminal receives from mobile
  • the PPPoE authentication result message of the authentication service network element of the mobile network includes the PPPoE authentication result in the PPPoE authentication result message, and the PPPoE authentication result is obtained by the authentication service network element according to the PPPoE authentication parameter from the access gateway network element.
  • the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the UE establishes a PPPoE session with the AGF, the AGF sends a PPPoE authentication parameter to the AUSF, and the PPPoE authentication parameter is used by the AUSF to authenticate the UE, and then the AUSF will check The result of the weight is fed back to the UE, and the fusion of the core network equipment of the mobile network and the fixed network is realized.
  • the terminal receives the PPPoE authentication result from the authentication service network element, including: the terminal receives the PPPoE authentication result from the access gateway network element, and the PPPoE authentication result is the access gateway network element from the connection.
  • the attach accept message of the incoming and mobility management network element is obtained and is obtained from the authentication response message from the authentication service network element for the access and mobility management network element.
  • the method before the terminal receives the PPPoE authentication result from the authentication service network element of the mobile network, the method further includes: the terminal receiving the first point-to-point protocol PPP message from the access gateway network element, the first PPP The message includes a security mode command SMC message or a non-access stratum NAS encryption activation parameter, the SMC message is from the access and mobility management network element; the terminal sends a second PPP message to the access gateway network element, and the second PPP message includes the SMC.
  • the completion message or the NAS encryption activation parameter causes the access gateway network element to send an SMC completion message or a NAS encryption activation parameter to the access and mobility management network element. This design provides a way for NAS encryption to activate the SMC process.
  • the attach accept message further includes an SMC message
  • the PPPoE authentication result message further includes an SMC message or a NAS encryption activation parameter
  • the method further includes: the terminal sending the first network control to the access gateway network element
  • the protocol NCP negotiation message includes an SMC completion message or a NAS encryption activation parameter in the first NCP negotiation message, so that the access gateway network element sends an SMC completion message to the access and mobility management network element.
  • the method further includes: the terminal receiving the second NCP negotiation message from the access gateway network element, where the second NCP negotiation message includes a source Internet protocol IP address and a destination IP address for the NAS message transmission, Or the source media access control MAC address and destination MAC address.
  • the method further includes: the terminal sending a third NCP negotiation message to the access gateway network element; the terminal receiving the fourth NCP negotiation message from the access gateway network element, where the fourth NCP negotiation message is included
  • the IP address of the user plane data packet is transmitted, and the IP address for transmitting the user plane data packet is obtained by the access gateway network element from the session establishment response message from the access and mobility management network element.
  • the method further includes: the terminal sending a fifth NCP negotiation message to the access gateway network element, where the fifth NCP negotiation message includes an SMC request message, so that the access gateway network element accesses and mobility
  • the management network element sends an SMC request message.
  • the terminal receives the sixth NCP negotiation message from the access gateway network element.
  • the sixth NCP negotiation message includes an SMC response message, and the SMC response message is from the access and mobility management network element.
  • the sixth NCP negotiation message further includes a source IP address and a destination IP address, or a MAC address and a destination MAC address, for NAS message transmission.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the method further includes: the terminal sending a seventh NCP negotiation message to the access gateway network element; the terminal receiving the eighth NCP negotiation message from the access gateway network element, where the eighth NCP negotiation message includes the SMC message From the access and mobility management network element; the terminal sends an SMC complete message to the access gateway network element.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the terminal sends an SMC complete message to the access gateway network element, including: the terminal sends the user uplink data packet to the access gateway network element, and the user uplink data packet includes the SMC complete message, or the terminal connects to the terminal.
  • the ingress gateway network element sends and receives a ninth NCP negotiation message, and the ninth NCP negotiation message includes an SMC completion message, or when the eighth NCP negotiation message includes a source IP address and a destination IP address for the NAS message transmission, or a source MAC address.
  • the terminal sends an SMC complete message to the access gateway network element, and the SMC complete message uses the source IP address and the destination IP address for the NAS message transmission, or the source MAC address and the destination MAC address.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the terminal sends an SMC complete message to the access gateway network element, including: the terminal sends a link control protocol LCP negotiation message to the access gateway network element to determine the challenge handshake authentication protocol CHAP authentication process.
  • the terminal receives the challenge message from the access gateway network element to initiate CHAP authentication, and the challenge request message includes a first random number; the terminal generates a first authentication token according to the first random number and the first authentication parameter, where The authentication service network element authenticates the terminal; the terminal sends a challenge response message to the access gateway network element, where the challenge response message includes the first authentication token; the method further includes: the terminal receiving the second from the access gateway network element a random number and a second authentication token, wherein the second authentication token is generated by the authentication service network element according to the first random number, the second random number, and the second authentication parameter; and the terminal is configured according to the second authentication token
  • the network side authenticates the terminal; the terminal sends a second random number and a second authentication token to the authentication service network element, where the authentication service network element authenticates the
  • the terminal sends an SMC complete message to the access gateway network element, including: the terminal sends an LCP negotiation message to the access gateway network element to determine to adopt the CHAP authentication process, where the LCP negotiation message includes the identity information of the terminal.
  • the terminal receives the challenge request message from the access gateway network element to initiate CHAP authentication, and the challenge request message includes a third random number and a third authentication token, and the third random number and the third authentication token are normalized.
  • the data management network element is generated according to the identity information of the terminal; the terminal authenticates the network side according to the third random number and the third authentication token; the terminal generates a fourth random number, and according to the third random number, the fourth random number, and The third authentication parameter generates a fourth authentication token; the terminal sends a challenge response message to the access gateway network element, where the challenge response message includes a fourth random number and a fourth authentication token, which are used to authenticate the service network element pair. Terminal authentication. This design provides a way to authenticate the terminal to the network side.
  • the access gateway network element includes one of the following: fixed network access Independent network element in the network, access network of fixed network, broadband network gateway BNG/broadband mobile access server BRAS. This design provides a specific implementation of the access gateway network element.
  • a terminal including: a negotiating unit, configured to perform a point-to-point protocol PPPoE negotiation on an Ethernet with an access gateway network element of a fixed network, to establish a PPPoE session with the access gateway network element;
  • the PPPoE authentication method is used to negotiate with the access gateway network element.
  • the receiving unit is configured to receive the PPPoE authentication result message from the authentication service network element of the mobile network, and the PPPoE authentication result message includes the PPPoE authentication result, and the PPPoE authentication result.
  • the result of the weighting is that the authentication service network element is obtained according to the PPPoE authentication parameter from the access gateway network element, and the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal.
  • the principles and benefits of the device can be solved by referring to the possible method embodiments of the sixth and sixth aspects and the beneficial effects. Therefore, the implementation of the device can be referred to the sixth. Aspects and implementations of the various possible methods of the sixth aspect are not repeated here.
  • an embodiment of the present application provides a terminal, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, when the device is running
  • the processor executes the computer-executed instructions stored by the memory to cause the apparatus to perform the method of any of the above sixth aspects; based on the same inventive concept, the processor invokes instructions stored in the memory to implement the sixth aspect described above
  • the solution in the method design, the implementation manner and the beneficial effects of the device to solve the problem can be referred to the implementation manners and the beneficial effects of the above-mentioned sixth and sixth possible methods, and therefore the implementation of the device can be referred to the above method. Implementation, repetition will not be repeated.
  • an embodiment of the present application provides a computer storage medium, comprising instructions, when executed on a computer, causing a computer to perform the method of accessing a fixed network according to the sixth aspect.
  • an embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing the computer to perform the method of accessing a fixed network according to the sixth aspect.
  • a method for accessing a fixed network comprising: an authentication service network element of a mobile network receiving a PPPoE authentication parameter of an access gateway network element from a fixed network; and an authentication service network element according to the PPPoE
  • the weight parameter performs PPPoE authentication on the terminal; the authentication service network element sends a PPPoE authentication result to the terminal.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the UE establishes a PPPoE session with the AGF, the AGF sends a PPPoE authentication parameter to the AUSF, and the PPPoE authentication parameter is used by the AUSF to authenticate the UE, and then the AUSF will check The result of the weight is fed back to the UE, and the fusion of the core network equipment of the mobile network and the fixed network is realized.
  • the authentication service network element of the mobile network receives the PPPoE authentication parameter of the access gateway network element from the fixed network, including: the authentication service network element receives the authentication from the access and mobility management network element.
  • the right request message, the authentication request message includes a PPPoE authentication parameter, and the PPPoE authentication parameter is obtained by the access and mobility management network element from the attach request message from the access gateway network element; the authentication service network element sends the PPPoE to the terminal.
  • Authentication results including: authentication service network element access and mobility
  • the management network element sends an authentication response message, and the authentication response message includes the PPPoE authentication result, so that the access and mobility management network element sends the PPPoE authentication result to the access gateway network element by using the attach accept message, and the access gateway is enabled.
  • the network element sends the PPPoE authentication result to the terminal.
  • the attach request message and the authentication request message further include a fixed network access indication, and the fixed network access indication is used by the authentication service network element to determine to use the PPPoE authentication method; or, the PPPoE authentication parameter It is also used by the authentication service network element to determine the PPPoE authentication method.
  • This design provides an authentication service network element to determine how to use the PPPoE authentication method.
  • the attach request message and the authentication request message include a first random number and a first authentication token, where the first authentication token is generated by the terminal according to the first random number and the first authentication parameter.
  • the first random number is generated by the access gateway network element.
  • the method further includes: authenticating the service network element to authenticate the terminal according to the first random number and the first authentication token; and authenticating the service network element according to the first random number
  • the second random number and the second authentication parameter generate a second authentication token;
  • the attach accept message and the authentication response message further include a second random number and a second authentication token, where the terminal performs the network side Authentication.
  • the method further includes: authenticating the service network element from the normalized data management The network element receives the first authentication information response message, where the first authentication information response message includes a third random number and a third authentication token, and a key of the authentication service network element, a third random number, and a third authentication
  • the weight token is obtained by the normalized data management network element according to the identity information of the terminal; the authentication service network element sends a second authentication information response message to the access gateway network element, and the second authentication information response message includes the third random number And the third authentication token, so that the access gateway network element sends the third random number and the third authentication token to the terminal by using the challenge request message, and is used for the terminal to authenticate the network side;
  • the authentication request message and the attaching The request message further includes a fourth random number and a fourth authentication token, where the fourth random number is generated by the terminal, and the fourth authentication token is generated by the terminal
  • the access gateway network element comprises one of the following: an independent network element in the fixed network access network, an access network of the fixed network, and a broadband network gateway BNG/broadband mobile access server BRAS.
  • This design provides a specific implementation of the access gateway network element.
  • a twelfth aspect provides an authentication service network element of a mobile network, comprising: a receiving unit, configured to receive a PPPoE authentication parameter of an access gateway network element from a fixed network; and an authentication unit configured to use the PPPoE
  • the weight parameter performs PPPoE authentication on the terminal
  • the sending unit is configured to send a PPPoE authentication result to the terminal.
  • an embodiment of the present application provides an authentication service network element of a mobile network, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, where The processor is coupled to the memory via the bus, and when the device is running, the processor executes the computer-executed instructions stored by the memory to cause the device to perform the method of any one of the eleventh aspects above; based on the same inventive concept
  • the processor invokes the instructions stored in the memory to implement the solution in the method design of the eleventh aspect above.
  • the embodiment of the present application provides a computer storage medium, comprising instructions, when executed on a computer, causing a computer to perform the method of accessing a fixed network according to the eleventh aspect.
  • the embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing the computer to perform the method of accessing a fixed network according to the eleventh aspect.
  • a method for accessing a fixed network comprising: accessing and mobility management network elements of a mobile network receiving PPPoE authentication parameters from an access gateway network element of a fixed network, and authenticating to the mobile network
  • the right service network element sends a PPPoE authentication parameter, and the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal;
  • the access and mobility management network element receives the PPPoE authentication result from the authentication service network element, and
  • the terminal sends PPPoE authentication result information.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the UE establishes a PPPoE session with the AGF, the AGF sends a PPPoE authentication parameter to the AUSF, and the PPPoE authentication parameter is used by the AUSF to authenticate the UE, and then the AUSF will check The result of the weight is fed back to the UE, and the fusion of the core network equipment of the mobile network and the fixed network is realized.
  • the access and mobility management network element of the mobile network receives the PPPoE authentication parameter from the access gateway network element of the fixed network, and sends the PPPoE authentication parameter to the authentication service network element of the mobile network.
  • the method includes: the access and mobility management network element receives an attach request message from the access gateway network element, where the attach request message includes a PPPoE authentication parameter; the access and mobility management network element sends an authentication request message to the authentication service network element.
  • the authentication request message includes a PPPoE authentication parameter; the access and mobility management network element receives the PPPoE authentication result from the authentication service network element, and sends a PPPoE authentication result information message to the terminal, including: access and mobility.
  • the management network element receives the authentication response message from the authentication service network element, and the authentication response message includes the PPPoE authentication result; the access and mobility management network element sends an attach accept message to the access gateway network element, and the attach accept message includes As a result of the PPPoE authentication, the access gateway network element sends a PPPoE authentication result to the terminal.
  • This design provides a way to carry PPPoE authentication parameters and PPPoE authentication results.
  • the attach request message and the authentication request message further include a fixed network access indication, and the fixed network access indication is used by the authentication service network element to determine to use the PPPoE authentication method; or, the PPPoE authentication parameter It is also used by the authentication service network element to determine the PPPoE authentication method.
  • This design provides an authentication service network element to determine how to use the PPPoE authentication method.
  • the method further includes: the access and mobility management network element sends a security mode command SMC to the access gateway network element.
  • the message is such that the access gateway network element sends an SMC message or a non-access stratum NAS encryption activation parameter to the terminal through the first PPP point-to-point protocol message; the access and mobility management network element receives the SMC completion message or NAS from the access gateway network element.
  • the encryption activation parameter, the SMC completion message or the NAS encryption activation parameter is obtained from the second PPP message from the terminal for the access and mobility management network element.
  • the attach accept message further includes an SMC message, so that the access gateway network element sends an SMC message or a NAS encryption activation parameter to the terminal
  • the method further includes: accessing and mobility management network element accessing The gateway network element receives the SMC complete message, and the SMC complete message is obtained by the access gateway network element from the first network control protocol NCP negotiation message from the terminal, where the first NCP negotiation message includes an SMC complete message or a NAS encryption activation parameter.
  • the method further includes: the access and mobility management network element receiving a packet data unit PDU session establishment request message from the access gateway network element, the PDU session establishment request message including the user identifier and/or the fixed network
  • the access and mobility management network element sends a PDU session establishment service request message to the session management network element, where the PDU session establishment service request message includes the user identifier and/or the fixed network access identifier; the access and mobility management network
  • the eNB receives a PDU session establishment service response message from the session management network element, and the PDU session establishment service response message includes a quality of service QoS and a charging policy, and the QoS and charging policy is the session management network element according to the user identifier and/or the fixed network access.
  • the access and mobility management network element sends a session establishment response message to the access gateway network element, where the session establishment response message includes an IP address for transmitting the user plane data packet, and a QoS and charging policy for accessing
  • the gateway network element sends an IP address for transmitting the user plane data packet to the terminal through the fourth NCP negotiation message.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the access gateway network element can serve the terminal according to the QoS and/or charging policy.
  • the method further includes: the access and mobility management network element receives an SMC request message from the access gateway network element, and the SMC request message is a fifth NCP negotiation message from the terminal by the access gateway network element.
  • the access and mobility management network element sends an SMC response message to the access gateway network element, so that the access gateway network element sends an SMC response message to the terminal through the sixth NCP negotiation message.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the sixth NCP negotiation message further includes a source IP address and a destination IP address for NAS message transmission.
  • This design allows the UE to interact with the 5G core network using NAS messages encapsulated with IP addresses or MAC addresses.
  • the method further includes: the access and mobility management network element receives an attach complete message from the access gateway network element; the access and mobility management network element sends an SMC message to the access gateway network element, The access gateway network element sends an SMC message to the terminal through the eighth NCP negotiation message, and causes the access gateway network element to obtain an SMC complete message from the user uplink data packet from the terminal.
  • This design provides a way for NAS encryption to activate the SMC process.
  • the attach request message and the authentication request message further include a first random number and a first authentication token, where the authentication service network element authenticates the terminal, and the first random number is connected.
  • the inbound gateway network element is generated, where the first authentication token is generated by the terminal according to the first random number and the first authentication parameter;
  • the attach accept message and the authentication response message further include a second random number and a second authentication token, The second random number is generated by the authentication service network element, and the second authentication token is generated by the authentication service network element according to the first random number, the second random number, and the second authentication parameter.
  • the method further includes: accessing and mobility management network element from The access gateway network element receives the authentication information request message, and sends an authentication information request message to the normalized data management network element, where the authentication information request message includes the identity information of the terminal; the access and mobility management network element The right service network element receives the authentication information response message, and sends an authentication information response message to the access gateway network element, where the authentication information response message includes a third random number and a third authentication token, a third random number and a
  • the third authentication token is generated by the normalized data management network element according to the identity information of the terminal, and is used for the terminal to authenticate the network side; the access and mobility management network element receives the fourth random number and the first from the access gateway network element.
  • the fourth authentication token is generated by the terminal, and the fourth authentication token is generated by the terminal according to the third random number, the fourth random number, and the third authentication parameter; the access and mobility management network element Right service network element Fourth random number and transmitting the fourth authentication token, an authentication service for authenticating the terminal network element.
  • This design provides a way to authenticate the terminal to the network side.
  • the access gateway network element comprises one of the following: an independent network element in the fixed network access network, an access network of the fixed network, and a broadband network gateway BNG/broadband mobile access server BRAS.
  • This design provides a specific implementation of the access gateway network element.
  • the seventh aspect provides a mobile network access and mobility management network element, including: a receiving unit, configured to receive a PPPoE authentication parameter from an access gateway network element of a fixed network; and a sending unit, configured to move to The network authentication service network element sends a PPPoE authentication parameter, and the PPPoE authentication parameter is used by the authentication service network element to perform PPPoE authentication on the terminal.
  • the receiving unit is further configured to receive the PPPoE authentication result from the authentication service network element, and send the PPPoE authentication result.
  • the unit is further configured to send PPPoE authentication result information to the terminal.
  • an embodiment of the present application provides a mobile network access and mobility management network element, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor and the The memory is connected by the bus, and when the device is running, the processor executes the computer-executed instruction stored by the memory, so that the device performs the method of any one of the sixteenth aspects; the processor calls based on the same inventive concept
  • the instructions stored in the memory to implement the solution in the method design of the sixteenth aspect above, and the implementation of each possible method of the sixteenth aspect and the sixteenth aspect can be referred to due to the implementation of the problem and the beneficial effects of the device. Ways and benefits, so the implementation of the device can be seen in the implementation of the above method, repeated No longer.
  • the embodiment of the present application provides a computer storage medium, including instructions, when executed on a computer, causing a computer to perform the method of accessing a fixed network according to the sixteenth aspect.
  • the embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing the computer to perform the method of accessing a fixed network according to the sixteenth aspect.
  • a twenty-first aspect a system for accessing a fixed network, comprising: an access gateway network element of a fixed network according to the second aspect, a terminal of the seventh aspect, and an authentication of the mobile network according to the twelfth aspect a service network element, and an access and mobility management network element of the mobile network according to the seventeenth aspect; or an access gateway network element including a fixed network according to the third aspect, a terminal such as the eighth aspect, such as the tenth
  • the authentication service network element receives the fixed network from the fixed network through the access and mobility management network element
  • the peer-to-peer protocol PPPoE authentication parameter on the Ethernet of the access gateway network element, the authentication service network element performs PPPoE authentication on the terminal according to the PPPoE authentication parameter, and accesses the mobility management network element and the access gateway network element
  • the terminal sends a PPPoE
  • the first aspect, the sixth aspect, the eleventh aspect, the sixteenth aspect, and the possible method embodiments and the beneficial effects can be seen by the principle and the beneficial effects of the system. Therefore, the implementation of the device can be referred to the first aspect, the sixth aspect, the eleventh aspect, the sixteenth aspect, and the implementation manner of each possible method, and the repeated description is not repeated.
  • FIG. 1 is a schematic structural diagram of a system for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of a method for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart of a method for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a third method for accessing a fixed network according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart diagram of a fourth method for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart diagram of a fifth method for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 7 is a schematic flowchart diagram of a sixth method for accessing a fixed network according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart diagram of a seventh method for accessing a fixed network according to an embodiment of the present disclosure
  • FIG. 9 is a schematic flowchart diagram of a method for accessing a fixed network according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic flowchart diagram of a method for accessing a fixed network according to a ninth embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a hardware of a terminal according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of hardware of another terminal according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another hardware of a terminal according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of hardware of an access gateway network element according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of another hardware structure of an access gateway network element according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic structural diagram of another hardware structure of an access gateway network element according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram of hardware of an access and mobility management network element according to an embodiment of the present disclosure.
  • FIG. 18 is a schematic structural diagram of hardware of another access and mobility management network element according to an embodiment of the present disclosure.
  • FIG. 19 is a schematic structural diagram of hardware of another access and mobility management network element according to an embodiment of the present disclosure.
  • FIG. 20 is a schematic structural diagram of hardware of an authentication service network element according to an embodiment of the present disclosure.
  • FIG. 21 is a schematic structural diagram of hardware of another authentication service network element according to an embodiment of the present disclosure.
  • FIG. 22 is a schematic structural diagram of hardware of another authentication service network element according to an embodiment of the present disclosure.
  • the embodiment of the present application provides a system architecture for accessing a fixed network.
  • the system includes: an access gateway network element, a user plane network element, an access and mobility management network element, and a session management network.
  • the access gateway network element is an Access Gateway Function (AGF) 102
  • the user plane network element is a User Plane Function (UPF) 103
  • the access and mobility management network element is The access and Mobility Management Function (AMF) 104
  • the session management network element is a Session Management Function (SMF) 105
  • the policy control network element is a Policy Control Function (PCF).
  • the authentication service network element is an Authentication Server Function (AUSF) 107
  • the normalized data management network element is a Unified Data Management (UDM) 108
  • the network open network element is open to the network.
  • the network response network element is a Network Response Function (NRF) 110
  • the application network element is an Application Function (AF) 111.
  • AMF Access Gateway Function
  • UPF User Plane Function
  • AF Application Function
  • the AGF 102 and the UPF 103 belong to a fixed network network element, and the UE (or terminal) 101 accesses the data network in the fixed network through the AGF 102 and the UPF 103.
  • the AMF 104, the SMF 105, the PCF 106, the AUSF 107, the UDM 108, the NEF 109, and the NRF 110 belong to a network element of a 5G control plane in a mobile network.
  • the AGF 102 may be an independent network element in a fixed network, or may be set on an access network (AN) of a fixed network, or may be a Broadband Network Gateway (BNG) or a broadband mobile access server. (Broadband Remote Access Server, BRAS).
  • BNG Broadband Network Gateway
  • the UE can access the AGF 102 through a WIFI access point (AP).
  • the AGF 102 supports the N2 interface to interact with the AMF 104; the AUSF 107 supports the Point to Point Protocol over Ethernet (PPPoE) authentication method; the Broadband Forum (BBF) network authentication, authorization, and Bookkeeping (Authentication, Authorization, Accounting, AAA)
  • PPPoE Point to Point Protocol over Ethernet
  • BBF Broadband Forum
  • AAA Authentication, Authorization, Accounting
  • the embodiment of the present application provides a method for accessing a fixed network.
  • the method includes:
  • the AGF performs PPPoE negotiation with the UE, so that the UE discovers the AGF and establishes a PPPoE session with the UE.
  • the UE may send an indication to the AGF indicating an extended PPP protocol interaction defined using the present invention.
  • the indication may be a capability indication of the UE, or an extended PPP protocol indication, or a 5G access indication or the like. This indication can help the UE discover the AGF with this capability, for example, only the AGF with this capability will reply to the response message.
  • the message sent to the UE in this process may also carry an indication indicating that the extended PPP protocol interaction defined by the present invention is used.
  • the indication may be an indication of capability of the AGF, or an extended PPP protocol indication, or a 5G access indication or the like.
  • PPPoE negotiation includes:
  • the UE sends a PPPoE Active Discovery Initiation (PADI) to the AGF.
  • PADI PPPoE Active Discovery Initiation
  • the AGF sends a PPPoE Active Discovery Offer (PADO) to the UE.
  • PADO PPPoE Active Discovery Offer
  • S0013 The UE sends a PPPoE Active Discovery Request to the AGF.
  • the AGF sends a PPPoE Active Discovery Session-Confirmation (PADS) to the UE.
  • PADS PPPoE Active Discovery Session-Confirmation
  • S002 Establish and configure a link layer connection between the UE and the AGF to negotiate an authentication mode.
  • the UE may send an indication to the AGF indicating that the extended authentication mode defined by the present invention is used.
  • the indication may be an indication of capabilities of the UE, or an indication of an extended authentication mode, or a 5G access indication or the like. If the AGF supports the extended authentication protocol, the message sent to the UE in this process may also carry an indication indicating that the extended PPP protocol interaction defined by the present invention is used.
  • the indication may be an capability indication of the AGF, or an extended authentication mode indication, or a 5G access indication or the like.
  • the specific step S002 includes:
  • LCP Link Control Protocol
  • PAP Password Authentication Protocol
  • CHAP Challenge Handshake Authentication Protocol
  • S0022 The AGF sends a challenge message Challenge to the UE.
  • S0023 The UE encrypts the challenge packet, configures a password generation key, and sends a challenge response message to the AGF, where the generated key and the username are included.
  • the AGF sends a PPPoE authentication parameter to the AMF.
  • the PPPoE authentication parameter needs to be forwarded by the AMF to the AUSF for the AUSF to perform PPPoE authentication on the UE.
  • the PPPoE authentication parameter may include at least one of the following messages: a challenge packet identifier (Challenge packet ID), a password (password), and Key (key), user name and other parameters. .
  • the PPPoE authentication parameters can be placed in a PPPoE Container (PPPoE Container) and sent to the AMF in the request message.
  • the AGF may also send a fixed network access indication to the AMF, and the PPPoE authentication parameter or the fixed network access indication is used by the AUSF to determine the PPPoE authentication method.
  • the PPPoE authentication parameter and/or the fixed network access indication may be included in an attach request message sent by the AGF to the AMF.
  • the above PPPoE authentication parameter may be included in an Authentication Request message sent to the AUSF.
  • the AUSF After receiving the PPPoE authentication parameter, the AUSF performs PPPoE authentication on the UE according to the PPPoE authentication parameter.
  • the UE may perform PPPoE authentication on the PPPoE authentication parameter in the received authentication request message.
  • the AUSF sends a PPPoE authentication result to the AMF, and the PPPoE authentication result may be included in the PPPoE container.
  • the PPPoE authentication result may refer to the success or failure of authenticating the UE. And the PPPoE authentication result finally needs to be forwarded to the UE by the AMF and the AGF.
  • the PPPoE authentication result may be included in an Authentication Response message sent to the AMF.
  • the AMF After receiving the PPPoE authentication result, the AMF sends the PPPoE authentication result to the AGF.
  • the PPPoE authentication result may be included in an Attach Accept message sent to the AGF.
  • the AGF After receiving the PPPoE authentication result from the AMF, the AGF sends a PPPoE authentication result message to the UE.
  • the PPPoE authentication result message includes the PPPoE authentication result.
  • the UE receives a PPPoE authentication result message.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the UE establishes a PPPoE session with the AGF, the AGF sends a PPPoE authentication parameter to the AUSF, and the PPPoE authentication parameter is used by the AUSF to authenticate the UE, and then the AUSF will check The result of the weight is fed back to the UE, and the fusion of the core network equipment of the mobile network and the fixed network is realized.
  • An embodiment of the present application provides another method for accessing a fixed network. Referring to FIG. 3, the method includes:
  • S101-S102 is the same as steps S001-S002, and details are not described herein again.
  • the AGF sends an attach request message (Attach Request) to the AMF.
  • the attach request message includes a PPPoE authentication parameter and/or a fixed network access indication.
  • the attach request message may be, for example, a 5G Non-Access Stratum (NAS) attach request message.
  • NAS Non-Access Stratum
  • the AMF After receiving the attach request message, the AMF sends an authentication request message to the AUSF.
  • the authentication request message includes a PPPoE authentication parameter and/or a fixed network access indication.
  • the AUSF After receiving the authentication request message, the AUSF determines, according to the PPPoE authentication parameter or the fixed network access indication, the PPPoE authentication method, and obtains a user data service (Subscriber Data Service) from the UDM to perform PPPoE authentication on the UE. right.
  • a user data service Subscriber Data Service
  • the AUSF sends an authentication response message to the AMF.
  • the authentication response message includes the PPPoE authentication result.
  • the Attach Accept message includes the PPPoE authentication result.
  • the AGF After receiving the attach accept message, the AGF sends a PPPoE authentication result message to the UE.
  • the PPPoE authentication result message includes the PPPoE authentication result.
  • the UE receives a PPPoE authentication result message.
  • the method for accessing a fixed network provided by the embodiment of the present application, after the AGF and the UE perform PPPoE negotiation, the AGF sends the PPPoE authentication parameter and/or the fixed network access indication to the AUSF through the AMF; then, the AUSF performs the PPPoE authentication according to the PPPoE.
  • the parameter and/or the fixed network access indication determine that the PPPoE authentication method is used, and the UE is authenticated according to the PPPoE authentication parameter.
  • the 5G core network is supported to support the PPPoE authentication process.
  • the method may further include S110-S113:
  • the AMF sends a Security Mode Command (SMC) message to the AGF.
  • SMC Security Mode Command
  • the message is encapsulated using the 5G architecture N2 interface protocol.
  • the AGF After receiving the SMC message, the AGF sends a first Point to Point Protocol (PPP) message to the UE.
  • the first PPP message may be an extended LCP message or a newly defined PPP protocol message.
  • the first PPP message includes an SMC message or a NAS encryption activation parameter.
  • the UE After receiving the first PPP message, the UE sends a second PPP message to the AGF.
  • the second PPP message may be an extended LCP message or a newly defined PPP protocol message.
  • the SMC command message or the NAS encryption activation parameter needs to be uploaded to the NAS layer by the UE.
  • the second PPP message includes an SMC completion message or a NAS encryption activation parameter.
  • the AGF After receiving the second PPP message, the AGF sends an SMC complete message or a NAS encryption activation parameter to the AMF.
  • S114-S116 may be further included after step S109:
  • the UE sends a first Network Control Protocol (NCP) Negotiation message to the AGF.
  • NCP Network Control Protocol
  • the AGF After receiving the first NCP negotiation message, the AGF sends a second NCP negotiation message to the UE.
  • the second NCP negotiation message includes a source Internet protocol (IP protocol) for transmitting NAS messages (ie, subsequent session management (Session Management) messages, mobility management (Mobility Management) messages, deregistration messages, etc.).
  • IP protocol Internet protocol
  • Address and destination IP address, or source media access control (Media Access Control) address or destination MAC address may include at least one of the following information: an IP address for the AGF to send and receive subsequent NAS messages, and an IP address, a source MAC address, and a destination MAC address for the UE to send and receive subsequent NAS messages.
  • the IP address of the AGF receiving the subsequent NAS message may be the same as the IP address of the subsequent NAS message.
  • the MAC address of the AGF receiving the subsequent NAS message may be the same as the MAC address of the subsequent NAS message.
  • the UE receives the subsequent address.
  • the IP address of the NAS message and the IP address of the subsequent NAS message may be the same address.
  • the MAC address of the UE receiving the subsequent NAS message may be the same address as the MAC address of the subsequent NAS message.
  • the UE receives the second NCP negotiation message.
  • the method for accessing the fixed network implements the NAS encryption activation SMC process between the UE and the 5G core network through the extended or newly added PPP message.
  • the UE may encapsulate the NAS message by using an IP packet or a MAC packet, and interact with the 5G core network via the AGF, so that the 5G core network does not perceive multiple accesses (the received message and the processing flow are the same) the goal of.
  • step S107 the AMF sends an Attach Accept message (Attach Accept) to the AGF, and further includes an SMC command message or a NAS encryption activation parameter; in step S108, the AGF sends the PPPoE to the UE.
  • the authentication result message also includes an SMC command message or a NAS encryption activation parameter.
  • the method may further include S117-S121:
  • the UE sends a third NCP negotiation message to the AGF.
  • the third NCP negotiation message includes an SMC completion message or a NAS encryption activation parameter.
  • the AGF After receiving the third NCP negotiation message, the AGF sends a fourth NCP negotiation message to the UE.
  • the fourth NCP negotiation message includes a source IP address and a destination IP address for NAS message transmission, or a source MAC address and a destination MAC address.
  • a source IP address and a destination IP address for NAS message transmission or a source MAC address and a destination MAC address.
  • the UE receives a fourth NCP negotiation message.
  • the AGF sends an SMC complete message to the AMF.
  • the AMF receives the SMC completion message.
  • the method for accessing the fixed network implements the NAS encryption activation SMC process between the UE and the 5G core network through the enhanced or newly added PPP protocol.
  • the UE may encapsulate the NAS message by using an IP packet or a MAC packet, and interact with the 5G core network via the AGF, so that the 5G core network does not perceive multiple accesses (the received message and the processing flow are the same) the goal of.
  • the method may further include S122-S129:
  • the UE sends a fifth NCP negotiation message to the AGF.
  • the UE may send an indication to the AGF indicating that the extended NCP negotiation mode defined by the present invention is used.
  • the indication may be an indication of capabilities of the UE, or an indication of an extended NCP negotiation mode, or a 5G access indication, or a PDU session establishment indication.
  • the AGF After receiving the fifth NCP negotiation message, the AGF sends a Packet Data Unit (PDU) session establishment request message (PDU Session Establishment) to the AMF, where the user identifier and/or the fixed network access identifier are included.
  • PDU Packet Data Unit
  • the AMF After receiving the PDU session establishment request message, the AMF sends a PDU Session Establishment Service Request (SPDU) to the SMF, where the user identifier and/or the fixed network access identifier are included.
  • SPDU PDU Session Establishment Service Request
  • the SMF After receiving the PDU session establishment service request message, the SMF selects the corresponding UPF, and allocates resources for the UE and an IP address for transmitting the user plane data packet.
  • the SMF uses a corresponding Quality of Service (QoS) and charging policy according to the user identifier and/or the fixed network access identifier.
  • QoS and charging policy may be SMF local configuration or obtained from the policy control function PCF.
  • the SMF sends a PDU Session Establishment Service Response (APDU) to the AMF, where the QoS and the charging policy are included.
  • APDU PDU Session Establishment Service Response
  • the PDU session establishment service response message includes the above-mentioned IP address for transmitting the user plane data packet.
  • the AMF After receiving the PDU session establishment service response message, the AMF sends a session establishment response message (Session Establishment Response) to the AGF.
  • Session Establishment Response a session establishment response message
  • the session establishment response message includes the above-mentioned IP address for transmitting the user plane data packet, and the QoS and/or charging policy.
  • the AGF After receiving the session establishment response message, the AGF sends a sixth NCP negotiation message to the UE.
  • the AGF can translate the QoS and/or charging policies into corresponding parameters of the fixed network QoS and/or charging policy.
  • the sixth NCP negotiation message includes the above IP address for transmitting a user plane data packet.
  • the AGF allocates a source IP address and a destination IP address for the subsequent NAS message transmission, or the source MAC address and the destination MAC address are sent to the UE together in the sixth NCP negotiation message.
  • the IP address and the MAC address refer to step S115, and details are not described herein again.
  • the UE receives a sixth NCP negotiation message.
  • the method for accessing the fixed network is implemented by converting the NCP negotiation process into a PDU session establishment process, so that the 5G core network does not perceive multiple accesses (the processing is the same).
  • the method may further include S130-S134:
  • the UE sends a seventh NCP negotiation message to the AGF.
  • the seventh NCP negotiation message includes an SMC Request message (SMC Request) or a NAS encryption activation parameter.
  • the AGF After receiving the seventh NCP negotiation message, the AGF sends an SMC request message to the AMF.
  • the AMF After receiving the SMC request message, the AMF sends an SMC response message (SMC Response) to the AGF.
  • SMC Response SMC response message
  • the AGF After receiving the SMC response message, the AGF sends an eighth NCP negotiation message to the UE.
  • the eighth NCP negotiation message includes an SMC response message or a NAS encryption activation parameter.
  • the AGF allocates a source IP address and a destination IP address for the subsequent NAS message transmission, or the source MAC address and the destination MAC address are sent to the UE together in the eighth NCP negotiation message.
  • the IP address and the MAC address refer to step S115, and details are not described herein again.
  • the UE receives an eighth NCP negotiation message.
  • the foregoing method for accessing a fixed network implements a NAS encryption activation SMC process between the UE and the 5G core network by enhancing the PPP protocol. And the SMC interaction is initiated by the UE, and no new PPP message needs to be added. After the NCP process, the UE can encapsulate the NAS message with the IP packet to interact with the 5G core network, so that the 5G core network does not perceive multiple accesses (the processing is the same).
  • the method may further include S135-S140:
  • the UE sends a ninth NCP negotiation message to the AGF.
  • the UE may send an indication to the AGF indicating that the extended NCP negotiation mode defined by the present invention is used.
  • the indication may be an indication of capabilities of the UE, or an indication of an extended NCP negotiation mode, or a 5G access indication or the like.
  • the AMF After receiving the attach complete message, the AMF sends an SMC message to the AGF.
  • the AGF After receiving the SMC message, the AGF sends a tenth NCP negotiation message to the UE.
  • the SMC command message is included in the tenth NCP negotiation message.
  • the AGF allocates a source IP address and a destination IP address for the subsequent NAS message transmission, or the source MAC address and the destination MAC address are sent to the UE together in the tenth NCP negotiation message.
  • the IP address and the MAC address refer to step S115, and details are not described herein again.
  • the UE After receiving the tenth NCP negotiation message, the UE sends an SMC complete message (SMC Complete) to the AGF.
  • SMC Complete SMC complete
  • the UE sends a user uplink data packet to the AGF, and the user uplink data packet includes an SMC complete message.
  • the UE sends an eleventh NCP negotiation message to the AGF, including an SMC complete message.
  • the UE sends an SMC complete message to the AGF by using the IP address or MAC address of the subsequent NAS message transmission received in S138.
  • the AGF receives the SMC completion message.
  • the AGF receives the user uplink data packet, or receives the eleventh NCP negotiation message, or receives the SMC completion message of the IP address or MAC address transmitted by the subsequent NAS message.
  • the above method for accessing a fixed network implementing the NAS sent by the 5G core network by enhancing the NCP protocol Encryption activates the SMC command message.
  • SMC complete is passed by the user plane and does not require new PPP messages.
  • the UE can encapsulate the NAS message with the IP packet to interact with the 5G core network, so that the 5G core network does not perceive multiple accesses (the processing is the same).
  • step S002 includes S141-S146:
  • the UE sends an LCP negotiation message to the AGF to perform an LCP negotiation to determine to adopt a CHAP authentication process.
  • This step is used to perform an extension enhancement on step S0021.
  • the traditional CHAP authentication method is one-way authentication, that is, the core network authentication UE.
  • the enhanced CHAP authentication method described in this application is a two-way authentication method, that is, the UE also authenticates the core network.
  • the indication condition of the indication information may be that the AGF knows that the access to the UE is the 3GPP core network, so the indication information is sent to the UE during the LCP negotiation process.
  • the indication information may be a certain bit in the LCP negotiation message, such as an idle bit or a reserved bit in the LCP negotiation message.
  • the original CHAP authentication method is adopted.
  • the enhanced CHAP authentication method is adopted; or when the bit is 1, the original CHAP authentication method is adopted.
  • the enhanced CHAP authentication method is adopted.
  • the network element AGF can decide to use the traditional or enhanced CHAP authentication method according to the configuration information.
  • the configuration information includes: configuration information that the two-way authentication must be configured by the operator, and the configuration information of the two-way authentication or the configuration information of the AGF itself is required by the UE during the negotiation process.
  • the AGF After receiving the LCP negotiation message, the AGF generates a first random number.
  • the AGF sends a challenge message (Challenge) to the UE to initiate CHAP authentication.
  • the first random number may be included in the challenge request message. This step is used to perform an extension enhancement on step S0022.
  • the UE After receiving the challenge request message, the UE generates a first authentication token according to the first random number and the first authentication parameter.
  • the first authentication parameter may include: a key configured in advance or other parameters (for example, IMSI information of the UE, or other information of the UE, the identity requires the network side to know)
  • the UE returns a challenge response message (Response).
  • the first authentication token may also be included in the challenge response message. This step is used to perform an extension enhancement on step S0023.
  • the AGF receives the challenge response message.
  • the first random number and the first authentication token are further included in the attach request message of step S103 and the authentication request message of S104, so that the AUSF obtains the first random number and the first authentication token.
  • Equivalent to the AGF sending a first random number and a first authentication token to the AUSF through the AMF, for the AUSF to authenticate the UE.
  • the AMF does not repeat the process of receiving and transmitting the first random number and the first authentication token.
  • the method further includes:
  • the AUSF verifies the first authentication token, and if the verification succeeds, generating a second The number of machines and the second authentication token.
  • the AUSF generates a temporary authentication token according to the first random number and the second authentication parameter, and then compares the temporary authentication token with the first authentication token, and if the same, indicates the first authentication token The verification succeeds, that is, the network side successfully authenticates the UE.
  • the AUSF generates a second authentication token according to the first random number, the second random number, and the third authentication parameter.
  • the second random number and the second authentication token are further included in the authentication response message of step S106, the attach accept message of S107, and the PPPoE authentication result message of step S108.
  • the AUSF sends the second random number and the second authentication token to the UE through the AMF and the AGF, and is used for the UE to authenticate the network side.
  • the AMF and the AGF do not repeat the process of receiving and transmitting the second random number and the second authentication token.
  • step S109 the method further includes:
  • the UE verifies the second authentication token.
  • the UE generates a temporary authentication token according to the first random number, the second random number, and the fourth authentication parameter, and then compares the temporary authentication token with the second authentication token, and if the same, the description
  • the authentication of the second authentication token is successful, that is, the UE successfully authenticates the network side.
  • the foregoing steps implement a method in which the network side first authenticates the UE, and then the UE authenticates the network side.
  • steps S141-S148 shown in FIG. 9 can be combined with other steps in FIGS. 3-8. The details will not be described again.
  • the embodiment of the present application may further perform another extended enhancement on step S002, and the method may further include S149-S157:
  • the UE sends an LCP negotiation message to the AGF to perform an LCP negotiation to determine to adopt a CHAP authentication process.
  • the LCP negotiation message includes the identity information of the UE. This step is used to perform an extension enhancement on step S0021.
  • the AGF sends an authentication information request message (Authentication Information Info Request) to the UDM to request authentication information.
  • Authentication Information Info Request an authentication information request message
  • the authentication information request message includes the identity information of the UE.
  • the request information is forwarded by AMF and AUSF.
  • the UDM After receiving the authentication information request message, the UDM generates a third random number and a third authentication token according to the identity information of the UE.
  • the UDM finds the LTE root key of the UE according to the identity information of the UE, and generates a third random number and a third authentication token according to the LTE root key, and an AUSF key to be used later.
  • the UDM sends a UE Authentication Information Info (UE) to the AUSF.
  • UE UE Authentication Information Info
  • the UE authentication information response message includes a third random number and a third authentication token, and an AUSF key.
  • the AUSF receives the UE authentication information response message and acquires an AUSF key, and sends an authentication information response message to the AGF by using the AMF.
  • the AGF After receiving the authentication information response message, the AGF sends a challenge message (Challenge) to the UE to initiate CHAP authentication.
  • a challenge message (Challenge)
  • the challenge request message may include a third random number and a third authentication token for the UE to authenticate to the network side. This step is used to perform an extension enhancement on step S0022.
  • the UE After receiving the challenge request message, the UE verifies the third authentication token according to the third random number and the identity information of the UE. If the verification succeeds, the fourth random number is generated, and according to the third random number, the fourth random number. The number and the fifth key generate a fourth authentication token.
  • the UE returns a challenge response message (Response).
  • the fourth response number and the fourth authentication token are further included in the challenge response message. This step is used to perform an extension enhancement on step S0023.
  • the AGF receives the challenge response message.
  • the fourth random number and the fourth authentication token are further included in the attach request message and the authentication request message, so that the AUSF obtains the fourth random number and the fourth authentication token.
  • Equivalent to the AGF sending a fourth random number and a fourth authentication token to the AUSF through the AMF, for the AUSF to authenticate the UE.
  • the AMF does not repeat the process of receiving and transmitting the fourth random number and the fourth authentication token.
  • the method further includes:
  • the AUSF verifies the fourth authentication token according to the AUSF key and the fourth random number.
  • the AUSF successfully authenticates the UE.
  • the foregoing steps implement a method in which the UE first authenticates the network side, and then the network side authenticates the UE.
  • steps S149-S158 shown in FIG. 10 can be combined with other steps in FIGS.
  • the embodiment of the present application provides a terminal for performing the foregoing method.
  • the embodiment of the present application may divide the function module into the terminal according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 11 is a schematic diagram showing a possible structure of a terminal involved in the foregoing embodiment.
  • the terminal 50 includes a negotiation unit 5011, a sending unit 5012, and a receiving unit 5013.
  • the negotiation unit 5011 is configured to support the terminal to perform the processes S001 and S002 in FIG. 2, the processes S001 and S002 in FIG. 3, the processes S001 and S002 in FIG. 4, the processes S001 and S002 in FIG. 5, and the process S001 in FIG. S002, the process S001, S002 in FIG. 7, the processes S001, S002 in FIG. 8, the processes S001, S144, S148 in FIG. 9, the processes S001, S155 in FIG.
  • the sending unit 5012 is configured to support the terminal to execute the map Process S112, S114 in 4, process S117 in FIG. 5, process S122 in FIG. 6, process S130 in FIG. 7, process S135, S139 in FIG. 8, process S141, S145 in FIG. 9, in FIG. Process S149, S156;
  • the receiving unit 5013 is configured to support the terminal 50 to perform the process S009 in FIG. 2, the process S109 in FIG. 3, the processes S109 and S116 in FIG. 4, the processes S109 and S119 in FIG. 5, and the processes S109 and S122 in FIG. Processes S109, S134 in Fig. 7, process S109 in Fig. 8, process S109 in Fig. 9, and process S109 in Fig. 10. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • FIG. 12 shows a possible structural diagram of the terminal involved in the above embodiment.
  • the terminal 50 includes a processing module 5022 and a communication module 5023.
  • the processing module 5022 is configured to control and control the action of the terminal 50.
  • the processing module 5022 is configured to support the terminal to perform the processes S001 and S002 in FIG. 2, the processes S001 and S002 in FIG. 3, and the processes S001 and S002 in FIG. Process S001, S002 in FIG. 5, processes S001, S002 in FIG. 6, processes S001, S002 in FIG. 7, processes S001, S002 in FIG. 8, processes S001, S144, S148 in FIG. 9, FIG. Processes S001, S155.
  • Communication module 5023 is used to support communication between the terminal and other entities, such as with the functional modules or network entities shown in FIG.
  • the terminal 50 may further include a storage module 5021 for storing program codes and data of the terminal.
  • the processing module 5022 may be a processor or a controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 5023 can be a transceiver, a transceiver circuit, or a network communication interface or the like.
  • the storage module 5021 can be a memory.
  • the terminal involved in the embodiment of the present application may be a terminal as described below.
  • the terminal 50 includes a processor 5032, a transceiver 5033, a memory 5031, and a bus 5034.
  • the terminal 50 may further include an output device 5035 and an input device 5036.
  • the transceiver 5033, the processor 5032, the memory 5031, the output device 5035, and the input device 5036 are connected to each other through a bus 5034.
  • the processor 5032 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the program of the present application. integrated circuit.
  • the processor 5032 can also be a plurality of processors, each of which can be a single-CPU processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • the memory 5031 may be a Read-Only Memory (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM), or other types that can store information and instructions.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • EEPROM Electrically erasable programmable read-only memory
  • CD-ROM Compact Disc Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • optical disc storage including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • disks A storage medium or other magnetic storage device, or any other medium that can be used to carry
  • the memory 5031 can exist independently and be coupled to the processor 5032 via a bus.
  • the memory 5031 can also be integrated with the processor 5032.
  • the memory 5031 is configured to store application code for executing the solution of the present application, and is controlled by the processor 5032 for execution.
  • the processor 5032 is configured to execute the computer program code stored in the memory 5031 to implement the method described in the embodiments of the present application.
  • the transceiver 5033 can use any device such as a transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc. .
  • the transceiver 5033 includes a transmitter Tx and a receiver Rx.
  • the bus 5034 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.
  • Output device 5035 is in communication with processor 5032 and can display information in a variety of ways.
  • the output device 5035 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 5036 is in communication with processor 5032 and can accept user input in a variety of ways.
  • input device 5036 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • An embodiment of the present application provides an access gateway network element of a fixed network, which is used to implement the foregoing method.
  • the function module of the access gateway network element may be divided according to the foregoing method.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 14 is a schematic diagram of a possible structure of an access gateway network element involved in the foregoing embodiment, where the access gateway network element 60 includes: a negotiating unit 6011.
  • the negotiating unit 6011 is configured to support the access gateway network element to perform the processes S001 and S002 in FIG. 2, the processes S101 and S102 in FIG. 3, the processes S101 and S102 in FIG. 4, and the processes S101 and S102 in FIG. 5, FIG. Processes S101, S102, processes S101, S102 in FIG. 7, processes S101, S102 in FIG. 8, processes S101, S142 in FIG. 9, process S101 in FIG.
  • receiving unit 6012 is used to support access gateways Net yuan Processes S003, S008 in FIG. 2, processes S103, S108 in FIG. 3, processes S103, S108, S111, S113, S115 in FIG. 4, processes S103, S108, S118 in FIG. 5, processes in FIG. S103, S108, S123, S128, processes S103, S108, S131, S133 in Fig. 7, processes S103, S108, S136, S138, S140 in Fig. 8, processes S103, S108, S142, S146 in Fig. 9, Process S103, S108, S150, S154, S157 in 10; sending unit 6013 is configured to support access gateway network element to perform processes S003, S008 in FIG.
  • FIG. 15 shows a possible structural diagram of the access gateway network element involved in the above embodiment.
  • the access gateway network element 60 includes a processing module 6022 and a communication module 6023.
  • the processing module 6022 is configured to control and control the action of the access gateway network element 60.
  • the processing module 6022 is configured to support the access gateway network element to perform the processes S001 and S002 in FIG. 2, and the processes S101 and S102 in FIG. Processes S101, S102 in FIG. 4, processes S101, S102 in FIG. 5, processes S101, S102 in FIG. 6, processes S101, S102 in FIG. 7, processes S101, S102 in FIG. 8, and FIG. Processes S101, S142, process S101 in FIG.
  • the communication module 6023 is configured to support communication between the access gateway network element and other entities, such as communication with the functional modules or network entities shown in FIG.
  • the access gateway network element 60 may further include a storage module 6021 for storing program codes and data of the access gateway network element.
  • the processing module 6022 can be a processor or a controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (application-specific). Integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 6023 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 6021 can be a memory.
  • the access gateway network element involved in the embodiment of the present application may be an access gateway network element as described below.
  • the access gateway network element 60 includes a processor 6032, a memory 6031, and a bus 6034.
  • the access gateway network element is used as a different network element, at least one transceiver 6033 and/or at least one network interface 6035 may also be included.
  • the transceiver 6033, the processor 6032, the network interface 6035, and the memory 6031 are connected to each other through a bus 6034.
  • Network interface 6035 is used to interface with other network elements of a network element via a wired or wireless link.
  • Access gateway network element 60 internal The functions of the remaining devices are described with reference to the functions of the corresponding devices in the terminal 50, and details are not described herein again.
  • An embodiment of the present application provides an access and mobility management network element for performing the foregoing method.
  • the embodiment of the present application may divide the function module of the access and mobility management network element according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one process.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 17 shows a possible structural diagram of the access and mobility management network element involved in the foregoing embodiment, and the access and mobility management network element 70, in the case where the respective functional modules are divided by corresponding functions.
  • the method includes a receiving unit 7011 and a sending unit 7012.
  • the receiving unit 7011 is configured to support the access and mobility management network element to perform the processes S004, S007 in FIG. 2, the processes S104, S107 in FIG. 3, the processes S104, S107, S110 in FIG. 4, and the process S104 in FIG. , S107, S121, processes S104, S107, S124, S127 in FIG. 6, processes S104, S107, S132 in FIG. 7, processes S104, S107, S137 in FIG. 8, processes S104, S107 in FIG.
  • Process S104, S107, S150, S153 in 10; the transmitting unit 7012 is configured to support the access and mobility management network element to perform the processes S004, S007 in FIG. 2, the processes S104, S107 in FIG. 3, and the process in FIG. S104, S107, S110, processes S104, S107 in Fig. 5, processes S104, S107, S124, S127 in Fig. 6, processes S104, S107, S132 in Fig. 7, processes S104, S107, S137 in Fig. 8, Processes S104, S107 in Fig. 9, processes S104, S107, S150, S153 in Fig. 10. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • FIG. 18 shows a possible structural diagram of the access and mobility management network element involved in the above embodiment.
  • the access and mobility management network element 70 includes a processing module 7022 and a communication module 7023.
  • the processing module 7022 is configured to control and manage the actions of the access and mobility management network element 70.
  • Communication module 7023 is used to support communication between access and mobility management network elements and other entities, such as with the functional modules or network entities shown in FIG.
  • the access and mobility management network element 70 can also include a storage module 7021 for storing program code and data of the access and mobility management network elements.
  • the processing module 7022 can be a processor or a controller, and can be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (application-specific). Integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 7023 may be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 7021 can be a memory.
  • the access and mobility management network element involved in the embodiment of the present application may be an access and mobility management network as described below. yuan.
  • the access and mobility management network element 70 includes a processor 7032, a network interface 7033, a memory 7031, and a bus 7034.
  • the network interface 7033, the processor 7032, and the memory 7031 are connected to each other through a bus 7034.
  • the functions of the devices in the access and mobility management network element 70 are described with reference to the functions of the corresponding devices in the terminal 50 and the access gateway network element 60, and are not described here.
  • An embodiment of the present application provides an authentication service network element of a mobile network, for performing the foregoing method.
  • the embodiment of the present application may divide the function module of the authentication service network element according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 20 is a schematic diagram showing a possible structure of the authentication service network element involved in the foregoing embodiment.
  • the authentication service network element 80 includes: an authentication unit 8011.
  • the authentication unit 8011 is configured to support the access gateway network element to perform the process S005 in FIG. 2, the process S105 in FIG. 3, the process S1052 in FIG. 4, the process S105 in FIG. 5, and the process S105 in FIG. 6, FIG. Process S105, process S105 in FIG. 8, process S105, S147 in FIG. 9, process S101, S158 in FIG. 10;
  • receiving unit 8012 is configured to support the access gateway network element to perform process S005 in FIG. Process S105 in 3, process S105 in FIG. 4, process S105 in FIG.
  • the process S105, S153; the sending unit 8013 is configured to support the authentication service network element to perform the process S006 in FIG. 2, the process S106 in FIG. 3, the process S106 in FIG. 4, the process S106 in FIG. 5, in FIG. Process S106, process S106 in Fig. 7, process S106 in Fig. 8, process S106 in Fig. 9, and processes S106, S153 in Fig. 10. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional descriptions of the corresponding functional modules, and details are not described herein again.
  • FIG. 21 shows a possible structural diagram of the authentication service network element involved in the above embodiment.
  • the authentication service network element 80 includes a processing module 8022 and a communication module 8023.
  • the processing module 8022 is configured to control and manage the action of the authentication service network element 80.
  • the processing module 8022 is configured to support the authentication service network element 80 to perform the process S005 in FIG. 2, the process S105 in FIG. 3, in FIG. Process S1052, process S105 in Fig. 5, process S105 in Fig. 6, process S105 in Fig. 7, process S105 in Fig. 8, processes S105, S147 in Fig. 9, and processes S101, S158 in Fig. 10.
  • Communication module 8023 is used to support communication of authentication service network elements with other entities, such as with the functional modules or network entities shown in FIG.
  • the authentication service network element 80 may further include a storage module 8021 for storing the authentication service network element. Program code and data.
  • the processing module 8022 can be a processor or a controller, for example, can be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (application-specific). Integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 8023 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 8021 can be a memory.
  • the authentication service network element involved in the embodiment of the present application may be an authentication service network element as described below.
  • the authentication service network element 80 includes a processor 8032, a network interface 8033, a memory 8031, and a bus 8034.
  • the network interface 8033, the processor 8032, and the memory 8031 are mutually connected by a bus 8034.
  • the functions of the devices in the access and authentication service network element 80 are described with reference to the functions of the corresponding devices in the terminal 50 and the access gateway network element 60, and are not described here.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not be applied to the embodiment of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, may be located in one place. Or it can be distributed to multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device that includes one or more servers, data centers, etc. that can be integrated with the media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium such as a Solid State Disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种接入固定网络的方法和接入网关网元，涉及通信领域，用于实现移动网络和固定网络的核心网设备的融合。接入固定网络的方法包括：固定网络的接入网关网元与终端进行以太网上的点对点协议PPPoE协商，以与终端建立PPPoE会话；接入网关网元与终端协商PPPoE鉴权方式；接入网关网元向移动网络的鉴权服务网元发送PPPoE鉴权参数，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权；接入网关网元接收来自鉴权服务网元的PPPoE鉴权结果，并向终端发送PPPoE鉴权结果消息，PPPoE鉴权结果消息中包括PPPoE鉴权结果。本申请实施例应用于固定网络接入移动网络的鉴权。

Description

接入固定网络的方法和接入网关网元 技术领域
本申请涉及通信领域，尤其涉及一种接入固定网络的方法和接入网关网元。
背景技术
移动网络和固定网络融合一直是一个热门的话题。在第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)对5代(5th Generation，5G)的研究报告中，明确说明了3GPP定义的5G核心网要允许固定网络接入。
目前，在演进分组系统(Evolved Packet System，EPS)中，固定网络和移动网络互通方案在统一策略与计费控制上作了尝试，并使用可扩展鉴权协议-鉴权与密钥协商(Extensible Authentication Protocol-Authentication and Key Agreement，EAP-AKA)的鉴权方式对用户设备(User Equipment，UE)进行鉴权，解决了具有客户识别模块(Subscriber Identity Module，SIM)卡的UE接入EPS系统的问题。然而，该鉴权方法需要固定网络中的AAA服务器与移动网络中的AAA服务器相互配合，无法实现移动网络和固定网络的核心网设备的融合。
发明内容
本申请实施例提供一种接入固定网络的方法和接入网关网元，能够实现移动网络和固定网络的核心网设备的融合。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，提供了一种接入固定网络的方法，包括：固定网络的接入网关网元与终端进行以太网上的点对点协议PPPoE协商，以与终端建立PPPoE会话；接入网关网元与终端协商PPPoE鉴权方式；接入网关网元向移动网络的鉴权服务网元发送PPPoE鉴权参数，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权；接入网关网元接收来自鉴权服务网元的PPPoE鉴权结果，并向终端发送PPPoE鉴权结果消息，PPPoE鉴权结果消息中包括PPPoE鉴权结果。本申请实施例提供的接入固定网络的方法，UE与AGF建立PPPoE会话后，由AGF向AUSF发送PPPoE鉴权参数，该PPPoE鉴权参数用于AUSF对UE进行鉴权，然后由AUSF将鉴权结果反馈给UE，实现了实现移动网络和固定网络的核心网设备的融合。
在一种可能的设计中，接入网关网元向移动网络的鉴权服务网元发送PPPoE鉴权参数，包括：接入网关网元向接入和移动性管理网元发送附着请求消息，附着请求消息中包括PPPoE鉴权参数，使得接入和移动性管理网元通过鉴权请求消息向鉴权服务网元发送PPPoE鉴权参数；接入网关网元接收来自鉴权服务网元的PPPoE鉴权结果，包括：接入网关网元从接入和移动性 管理网元接收附着接受消息，附着接受消息中包括PPPoE鉴权结果，PPPoE鉴权结果由接入和移动性管理网元从来自鉴权服务网元的鉴权响应消息中得到。该设计提供了一种承载PPPoE鉴权参数和PPPoE鉴权结果的方式。
在一种可能的设计中，附着请求消息和鉴权请求消息中还包括固网接入指示，固网接入指示用于鉴权服务网元确定使用PPPoE鉴权方法；或者，PPPoE鉴权参数还用于鉴权服务网元确定使用PPPoE鉴权方法。该设计提供了一种鉴权服务网元确定使用PPPoE鉴权方法的方式。
在一种可能的设计中，在接入网关网元接收来自鉴权服务网元的PPPoE鉴权结果之前，该方法还包括：接入网关网元从接入和移动性管理网元接收安全模式命令SMC消息；接入网关网元向终端发送第一点对点协议PPP消息，第一PPP消息中包括SMC消息或者非接入层NAS加密激活参数；接入网关网元从终端接收第二PPP消息，第二PPP消息中包括SMC完成消息或者NAS加密激活参数；接入网关网元向接入和移动性管理网元发送SMC完成消息或者NAS加密激活参数。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，附着接受消息中还包括SMC消息，鉴权响应消息中还包括SMC消息或者NAS加密激活参数，该方法还包括：接入网关网元从终端接收第一网络控制协议NCP协商消息，第一NCP协商消息中包括SMC完成消息或者NAS加密激活参数；接入网关网元向接入和移动性管理网元发送SMC完成消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，该方法还包括：接入网关网元向终端发送第二NCP协商消息，第二NCP协商消息中包括用于NAS消息传输的源互联网协议IP地址和目的IP地址，或者源媒体访问控制MAC地址和目的MAC地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，该方法还包括：接入网关网元从终端接收第三NCP协商消息；接入网关网元向接入和移动性管理网元发送分组数据单元PDU会话建立请求消息，PDU会话建立请求消息包括用户标识和/或固网接入标识；接入网关网元从接入和移动性管理网元接收会话建立响应消息，会话建立响应消息中包括用于传输用户面数据包的IP地址以及服务质量QoS和/或计费策略，QoS和/或计费策略为会话管理网元根据用户标识和/或固网接入标识得到；接入网关网元向终端发送第四NCP协商消息，第四NCP协商消息中包括用于传输用户面数据包的IP地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。同时使得接入网关网元可以根据QoS和/或计费策略为终端服务。
在一种可能的设计中，该方法还包括：接入网关网元从终端接收第五NCP协商消息，第五NCP协商消息中包括SMC请求消息；接入网关网元向接入和移动性管理网元发送SMC请求消息；接入网关网元从接入和移动性管 理网元接收SMC响应消息；接入网关网元向终端发送第六NCP协商消息，第六NCP协商消息中包括SMC响应消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，第六NCP协商消息中还包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，该方法还包括：接入网关网元从终端接收第七NCP协商消息；接入网关网元向接入和移动性管理网元发送附着完成消息；接入网关网元从接入和移动性管理网元接收SMC消息；接入网关网元向终端发送第八NCP协商消息，第八NCP协商消息中包括SMC消息；接入网关网元从终端接收SMC完成消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，接入网关网元从终端接收SMC完成消息，包括：接入网关网元从终端接收用户上行数据包，用户上行数据包中包括SMC完成消息，或者，接入网关网元从终端接收第九NCP协商消息，第九NCP协商消息中包括SMC完成消息，或者，当第八NCP协商消息包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址时，接入网关网元从终端接收SMC完成消息，SMC完成消息使用用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，接入网关网元与终端建立及配置链路层连接，以协商鉴权方式，包括：接入网关网元从终端接收链路控制协议LCP协商消息，以确定采用挑战握手鉴权协议CHAP鉴权流程；接入网关网元生成第一随机数；接入网关网元向终端发送挑战消息，以发起CHAP鉴权，挑战请求消息中包括第一随机数；接入网关网元从终端接收挑战响应消息，挑战响应消息中包括第一鉴权令牌，第一鉴权令牌为终端根据第一随机数和第一鉴权参数生成；该方法还包括：接入网关网元向鉴权服务网元发送第一随机数和第一鉴权令牌，用于鉴权服务网元对终端进行鉴权；接入网关网元接收来自鉴权服务网元的第二随机数和第二鉴权令牌，其中，第二鉴权令牌为鉴权服务网元根据第一随机数、第二随机数和第二鉴权参数生成；接入网关网元向终端发送第二随机数和第二鉴权令牌，用于终端对网络侧鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，接入网关网元与终端建立及配置链路层连接，以协商鉴权方式，包括：接入网关网元从终端接收LCP协商消息，以确定采用CHAP鉴权流程，LCP协商消息中包括终端的身份信息；接入网关网元向归一化数据管理网元发送鉴权信息请求消息，鉴权信息请求消息中包括终端的身份信息；接入网关网元从鉴权服务网元接收鉴权信息响应消息，鉴权信息响应消息中包括第三随机数和第三鉴权令牌，第三随机数和第三鉴权令牌为 归一化数据管理网元根据终端的身份信息生成；接入网关网元向终端发送挑战请求消息，以发起CHAP鉴权，挑战请求消息中包括第三随机数和第三鉴权令牌，用于终端对网络侧鉴权；接入网关网元从终端接收挑战响应消息，挑战响应消息中包括第四随机数和第四鉴权令牌，第四随机数为终端生成，第四鉴权令牌为终端根据第三随机数、第四随机数和第三鉴权参数生成；该方法还包括：接入网关网元向鉴权服务网元发送第四随机数和第四鉴权令牌，用于鉴权服务网元对终端进行鉴权，用于鉴权服务网元对终端鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，接入网关网元包括以下中的一个：固定网络接入网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。该设计提供了一种接入网关网元的具体实现方式。
第二方面，提供了一种固定网络的接入网关网元，包括：协商单元，用于与终端进行以太网上的点对点协议PPPoE协商，以与终端建立PPPoE会话；协商单元，还用于与终端协商PPPoE鉴权方式；发送单元，用于向移动网络的鉴权服务网元发送PPPoE鉴权参数，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权；接收单元，用于接收来自鉴权服务网元的PPPoE鉴权结果，并向终端发送PPPoE鉴权结果消息，PPPoE鉴权结果消息中包括PPPoE鉴权结果。基于同一发明构思，由于该装置解决问题的原理以及有益效果可以参见上述第一方面和第一方面的各可能的方法实施方式以及所带来的有益效果，因此该装置的实施可以参见上述第一方面和第一方面的各可能的方法的实施方式，重复之处不再赘述。
第三方面，本申请实施例提供一种固定网络的接入网关网元，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当该设备运行时，该处理器执行该存储器存储的该计算机执行指令，以使该设备执行上述第一方面中任意一项的方法；基于同一发明构思，处理器调用存储在存储器中的指令以实现上述第一方面的方法设计中的方案，由于该设备解决问题的实施方式以及有益效果可以参见上述第一方面和第一方面的各可能的方法的实施方式以及有益效果，因此该设备的实施可以参见上述方法的实施，重复之处不再赘述。
第四方面，本申请实施例提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第一方面的接入固定网络的方法。
第五方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如第一方面的接入固定网络的方法。
另外，第三方面至第五方面中任一种设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
第六方面，提供了一种接入固定网络的方法，包括：终端与固定网络的接入网关网元进行以太网上的点对点协议PPPoE协商，以与接入网关网元建立PPPoE会话；终端与接入网关网元协商PPPoE鉴权方式；终端接收来自移 动网络的鉴权服务网元的PPPoE鉴权结果消息，PPPoE鉴权结果消息中包括PPPoE鉴权结果，PPPoE鉴权结果为鉴权服务网元根据来自接入网关网元的PPPoE鉴权参数得到，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权。本申请实施例提供的接入固定网络的方法，UE与AGF建立PPPoE会话后，由AGF向AUSF发送PPPoE鉴权参数，该PPPoE鉴权参数用于AUSF对UE进行鉴权，然后由AUSF将鉴权结果反馈给UE，实现了实现移动网络和固定网络的核心网设备的融合。
在一种可能的设计中，终端接收来自鉴权服务网元的PPPoE鉴权结果，包括：终端从接入网关网元接收PPPoE鉴权结果，PPPoE鉴权结果为接入网关网元从来自接入和移动性管理网元的附着接受消息得到，并且为接入和移动性管理网元从来自鉴权服务网元的鉴权响应消息中得到。该设计提供了一种承载PPPoE鉴权结果的方式。
在一种可能的设计中，在终端接收来自移动网络的鉴权服务网元的PPPoE鉴权结果之前，该方法还包括：终端从接入网关网元接收第一点对点协议PPP消息，第一PPP消息中包括安全模式命令SMC消息或者非接入层NAS加密激活参数，SMC消息来自接入和移动性管理网元；终端向接入网关网元发送第二PPP消息，第二PPP消息中包括SMC完成消息或者NAS加密激活参数，使得接入网关网元向接入和移动性管理网元发送SMC完成消息或者NAS加密激活参数。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，附着接受消息中还包括SMC消息，PPPoE鉴权结果消息中还包括SMC消息或者NAS加密激活参数，该方法还包括：终端向接入网关网元发送第一网络控制协议NCP协商消息，第一NCP协商消息中包括SMC完成消息或者NAS加密激活参数，使得接入网关网元向接入和移动性管理网元发送SMC完成消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，该方法还包括：终端从接入网关网元接收第二NCP协商消息，第二NCP协商消息中包括用于NAS消息传输的源互联网协议IP地址和目的IP地址，或者源媒体访问控制MAC地址和目的MAC地址。
在一种可能的设计中，该方法还包括：终端向接入网关网元发送第三NCP协商消息；终端从接入网关网元接收第四NCP协商消息，第四NCP协商消息中包括用于传输用户面数据包的IP地址，用于传输用户面数据包的IP地址为接入网关网元从来自接入和移动性管理网元的会话建立响应消息得到。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，该方法还包括：终端向接入网关网元发送第五NCP协商消息，第五NCP协商消息中包括SMC请求消息，使得接入网关网元向接入和移动性管理网元发送SMC请求消息；终端从接入网关网元接收第六NCP协商消息，第六NCP协商消息中包括SMC响应消息，SMC响应消息来自接入和移动性管理网元。该设计提供了一种NAS加密激活SMC过程的 方式。
在一种可能的设计中，第六NCP协商消息中还包括用于NAS消息传输的源IP地址和目的IP地址，或者MAC地址和目的MAC地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，该方法还包括：终端向接入网关网元发送第七NCP协商消息；终端从接入网关网元接收第八NCP协商消息，第八NCP协商消息中包括SMC消息，来自接入和移动性管理网元；终端向接入网关网元发送SMC完成消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，终端向接入网关网元发送SMC完成消息，包括：终端向接入网关网元发送用户上行数据包，用户上行数据包中包括SMC完成消息，或者，终端向接入网关网元发送接收第九NCP协商消息，第九NCP协商消息中包括SMC完成消息，或者，当第八NCP协商消息包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址时，终端向接入网关网元发送SMC完成消息，SMC完成消息使用用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，终端向接入网关网元发送SMC完成消息，包括：终端向接入网关网元发送链路控制协议LCP协商消息，以确定采用挑战握手鉴权协议CHAP鉴权流程；终端从接入网关网元接收挑战消息，以发起CHAP鉴权，挑战请求消息中包括第一随机数；终端根据第一随机数和第一鉴权参数生成第一鉴权令牌，用于鉴权服务网元对终端进行鉴权；终端向接入网关网元发送挑战响应消息，挑战响应消息中包括第一鉴权令牌；该方法还包括：终端从接入网关网元接收第二随机数和第二鉴权令牌，其中，第二鉴权令牌为鉴权服务网元根据第一随机数、第二随机数和第二鉴权参数生成；终端根据第二鉴权令牌对网络侧鉴权；终端向鉴权服务网元发送第二随机数和第二鉴权令牌，用于鉴权服务网元对终端进行鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，终端向接入网关网元发送SMC完成消息，包括：终端向接入网关网元发送LCP协商消息，以确定采用CHAP鉴权流程，LCP协商消息包括终端的身份信息；终端从接入网关网元接收挑战请求消息，以发起CHAP鉴权，挑战请求消息中包括第三随机数和第三鉴权令牌，第三随机数和第三鉴权令牌为归一化数据管理网元根据终端的身份信息生成；终端根据第三随机数和第三鉴权令牌对网络侧鉴权；终端生成第四随机数，并根据第三随机数、第四随机数和第三鉴权参数生成第四鉴权令牌；终端向接入网关网元发送挑战响应消息，挑战响应消息中包括第四随机数和第四鉴权令牌，用于鉴权服务网元对终端鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，接入网关网元包括以下中的一个：固定网络接入 网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。该设计提供了一种接入网关网元的具体实现方式。
第七方面，提供了一种终端，包括：协商单元，用于与固定网络的接入网关网元进行以太网上的点对点协议PPPoE协商，以与接入网关网元建立PPPoE会话；协商单元，还用于与接入网关网元协商PPPoE鉴权方式；接收单元，用于接收来自移动网络的鉴权服务网元的PPPoE鉴权结果消息，PPPoE鉴权结果消息中包括PPPoE鉴权结果，PPPoE鉴权结果为鉴权服务网元根据来自接入网关网元的PPPoE鉴权参数得到，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权。基于同一发明构思，由于该装置解决问题的原理以及有益效果可以参见上述第六方面和第六方面的各可能的方法实施方式以及所带来的有益效果，因此该装置的实施可以参见上述第六方面和第六方面的各可能的方法的实施方式，重复之处不再赘述。
第八方面，本申请实施例提供一种终端，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当该设备运行时，该处理器执行该存储器存储的该计算机执行指令，以使该设备执行上述第六方面中任意一项的方法；基于同一发明构思，处理器调用存储在存储器中的指令以实现上述第六方面的方法设计中的方案，由于该设备解决问题的实施方式以及有益效果可以参见上述第六方面和第六方面的各可能的方法的实施方式以及有益效果，因此该设备的实施可以参见上述方法的实施，重复之处不再赘述。
第九方面，本申请实施例提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第六方面的接入固定网络的方法。
第十方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如第六方面的接入固定网络的方法。
另外，第八方面至第十方面中任一种设计方式所带来的技术效果可参见第六方面中不同设计方式所带来的技术效果，此处不再赘述。
第十一方面，提供了一种接入固定网络的方法，包括：移动网络的鉴权服务网元接收来自固定网络的接入网关网元的PPPoE鉴权参数；鉴权服务网元根据PPPoE鉴权参数对终端进行PPPoE鉴权；鉴权服务网元向终端发送PPPoE鉴权结果。本申请实施例提供的接入固定网络的方法，UE与AGF建立PPPoE会话后，由AGF向AUSF发送PPPoE鉴权参数，该PPPoE鉴权参数用于AUSF对UE进行鉴权，然后由AUSF将鉴权结果反馈给UE，实现了实现移动网络和固定网络的核心网设备的融合。
在一种可能的设计中，移动网络的鉴权服务网元接收来自固定网络的接入网关网元的PPPoE鉴权参数，包括：鉴权服务网元从接入和移动性管理网元接收鉴权请求消息，鉴权请求消息中包括PPPoE鉴权参数，PPPoE鉴权参数为接入和移动性管理网元从来自接入网关网元的附着请求消息得到；鉴权服务网元向终端发送PPPoE鉴权结果，包括：鉴权服务网元向接入和移动性 管理网元发送鉴权响应消息，鉴权响应消息中包括PPPoE鉴权结果，使得接入和移动性管理网元通过附着接受消息向接入网关网元发送PPPoE鉴权结果，并且使得接入网关网元向终端发送PPPoE鉴权结果。该设计提供了一种承载PPPoE鉴权参数和PPPoE鉴权结果的方式。
在一种可能的设计中，附着请求消息和鉴权请求消息中还包括固网接入指示，固网接入指示用于鉴权服务网元确定使用PPPoE鉴权方法；或者，PPPoE鉴权参数还用于鉴权服务网元确定使用PPPoE鉴权方法。该设计提供了一种鉴权服务网元确定使用PPPoE鉴权方法的方式。
在一种可能的设计中，附着请求消息和鉴权请求消息中包括第一随机数和第一鉴权令牌，第一鉴权令牌为终端根据第一随机数和第一鉴权参数生成，第一随机数为接入网关网元生成；该方法还包括：鉴权服务网元根据第一随机数、第一鉴权令牌对终端进行鉴权；鉴权服务网元根据第一随机数、第二随机数和第二鉴权参数生成第二鉴权令牌；附着接受消息和鉴权响应消息中还包括第二随机数和第二鉴权令牌，用于终端对网络侧进行鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，在移动网络的鉴权服务网元接收来自固定网络的接入网关网元的PPPoE鉴权参数之前，该方法还包括：鉴权服务网元从归一化数据管理网元接收第一鉴权信息响应消息，第一鉴权信息响应消息中包括第三随机数和第三鉴权令牌，以及鉴权服务网元的密钥，第三随机数和第三鉴权令牌为归一化数据管理网元根据终端的身份信息得到；鉴权服务网元向接入网关网元发送第二鉴权信息响应消息，第二鉴权信息响应消息中包括第三随机数和第三鉴权令牌，使得接入网关网元通过挑战请求消息向终端发送第三随机数和第三鉴权令牌，并且用于终端对网络侧鉴权；鉴权请求消息和附着请求消息中还包括第四随机数和第四鉴权令牌，第四随机数为终端生成，第四鉴权令牌为终端根据第三随机数、第四随机数和第三鉴权参数生成；鉴权服务网元根据第四随机数和第四鉴权令牌对终端鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，接入网关网元包括以下中的一个：固定网络接入网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。该设计提供了一种接入网关网元的具体实现方式。
第十二方面，提供了一种移动网络的鉴权服务网元，包括：接收单元，用于接收来自固定网络的接入网关网元的PPPoE鉴权参数；鉴权单元，用于根据PPPoE鉴权参数对终端进行PPPoE鉴权；发送单元，用于向终端发送PPPoE鉴权结果。基于同一发明构思，由于该装置解决问题的原理以及有益效果可以参见上述第十一方面和第十一方面的各可能的方法实施方式以及所带来的有益效果，因此该装置的实施可以参见上述第十一方面和第十一方面的各可能的方法的实施方式，重复之处不再赘述。
第十三方面，本申请实施例提供一种移动网络的鉴权服务网元，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该 处理器与该存储器通过该总线连接，当该设备运行时，该处理器执行该存储器存储的该计算机执行指令，以使该设备执行上述第十一方面中任意一项的方法；基于同一发明构思，处理器调用存储在存储器中的指令以实现上述第十一方面的方法设计中的方案，由于该设备解决问题的实施方式以及有益效果可以参见上述第十一方面和第十一方面的各可能的方法的实施方式以及有益效果，因此该设备的实施可以参见上述方法的实施，重复之处不再赘述。
第十四方面，本申请实施例提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第十一方面的接入固定网络的方法。
第十五方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如第十一方面的接入固定网络的方法。
另外，第十三方面至第十五方面中任一种设计方式所带来的技术效果可参见第十一方面中不同设计方式所带来的技术效果，此处不再赘述。
第十六方面，提供了一种接入固定网络的方法，包括：移动网络的接入和移动性管理网元从固定网络的接入网关网元接收PPPoE鉴权参数，并向移动网络的鉴权服务网元发送PPPoE鉴权参数，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权；接入和移动性管理网元从鉴权服务网元接收PPPoE鉴权结果，并向终端发送PPPoE鉴权结果信息。本申请实施例提供的接入固定网络的方法，UE与AGF建立PPPoE会话后，由AGF向AUSF发送PPPoE鉴权参数，该PPPoE鉴权参数用于AUSF对UE进行鉴权，然后由AUSF将鉴权结果反馈给UE，实现了实现移动网络和固定网络的核心网设备的融合。
在一种可能的设计中，移动网络的接入和移动性管理网元从固定网络的接入网关网元接收PPPoE鉴权参数，并向移动网络的鉴权服务网元发送PPPoE鉴权参数，包括：接入和移动性管理网元从接入网关网元接收附着请求消息，附着请求消息中包括PPPoE鉴权参数；接入和移动性管理网元向鉴权服务网元发送鉴权请求消息，鉴权请求消息中包括PPPoE鉴权参数；接入和移动性管理网元从鉴权服务网元接收PPPoE鉴权结果，并向终端发送PPPoE鉴权结果信息消息，包括：接入和移动性管理网元从鉴权服务网元接收鉴权响应消息，鉴权响应消息中包括PPPoE鉴权结果；接入和移动性管理网元向接入网关网元发送附着接受消息，附着接受消息中包括PPPoE鉴权结果，使得接入网关网元向终端发送PPPoE鉴权结果。该设计提供了一种承载PPPoE鉴权参数和PPPoE鉴权结果的方式。
在一种可能的设计中，附着请求消息和鉴权请求消息中还包括固网接入指示，固网接入指示用于鉴权服务网元确定使用PPPoE鉴权方法；或者，PPPoE鉴权参数还用于鉴权服务网元确定使用PPPoE鉴权方法。该设计提供了一种鉴权服务网元确定使用PPPoE鉴权方法的方式。
在一种可能的设计中，在接入和移动性管理网元向终端发送PPPoE鉴权结果之前，该方法还包括：接入和移动性管理网元向接入网关网元发送安全模式命令SMC消息，使得接入网关网元通过第一PPP点对点协议消息向终端发送SMC消息或者非接入层NAS加密激活参数；接入和移动性管理网元从接入网关网元接收SMC完成消息或者NAS加密激活参数，SMC完成消息或者NAS加密激活参数为接入和移动性管理网元从来自终端的第二PPP消息中得到。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，附着接受消息中还包括SMC消息，使得接入网关网元向终端发送SMC消息或者NAS加密激活参数，该方法还包括：接入和移动性管理网元从接入网关网元接收SMC完成消息，SMC完成消息为接入网关网元从来自终端的第一网络控制协议NCP协商消息中得到，第一NCP协商消息中包括SMC完成消息或者NAS加密激活参数。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，该方法还包括：接入和移动性管理网元从接入网关网元接收分组数据单元PDU会话建立请求消息，PDU会话建立请求消息包括用户标识和/或固网接入标识；接入和移动性管理网元向会话管理网元发送PDU会话建立服务请求消息，PDU会话建立服务请求消息包括用户标识和/或固网接入标识；接入和移动性管理网元从会话管理网元接收PDU会话建立服务响应消息，PDU会话建立服务响应消息中包括服务质量QoS和计费策略，QoS和计费策略为会话管理网元根据用户标识和/或固网接入标识得到；接入和移动性管理网元向接入网关网元发送会话建立响应消息，会话建立响应消息中包括用于传输用户面数据包的IP地址以及QoS和计费策略，用于接入网关网元通过第四NCP协商消息向终端发送用于传输用户面数据包的IP地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。同时使得接入网关网元可以根据QoS和/或计费策略为终端服务。
在一种可能的设计中，该方法还包括：接入和移动性管理网元从接入网关网元接收SMC请求消息，SMC请求消息为接入网关网元从来自终端的第五NCP协商消息中得到；接入和移动性管理网元向接入网关网元发送SMC响应消息，使得接入网关网元通过第六NCP协商消息向终端发送SMC响应消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，第六NCP协商消息中还包括用于NAS消息传输的源IP地址和目的IP地址。该设计使得UE可以使用IP地址或MAC地址封装的NAS消息与5G核心网进行交互。
在一种可能的设计中，该方法还包括：接入和移动性管理网元从接入网关网元接收附着完成消息；接入和移动性管理网元向接入网关网元发送SMC消息，使得接入网关网元通过第八NCP协商消息向终端发送SMC消息，并且使得接入网关网元从来自终端的用户上行数据包中得到SMC完成消息。该设计提供了一种NAS加密激活SMC过程的方式。
在一种可能的设计中，附着请求消息和鉴权请求消息中还包括第一随机数和第一鉴权令牌，用于鉴权服务网元对终端进行鉴权，第一随机数为接入网关网元生成，第一鉴权令牌为终端根据第一随机数和第一鉴权参数生成；附着接受消息和鉴权响应消息中还包括第二随机数和第二鉴权令牌，第二随机数为鉴权服务网元生成，第二鉴权令牌为鉴权服务网元根据第一随机数、第二随机数和第二鉴权参数生成。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，在移动网络的接入和移动性管理网元从固定网络的接入网关网元接收PPPoE鉴权参数之前，该方法还包括：接入和移动性管理网元从接入网关网元接收鉴权信息请求消息，并向归一化数据管理网元发送鉴权信息请求消息，鉴权信息请求消息中包括终端的身份信息；接入和移动性管理网元从鉴权服务网元接收鉴权信息响应消息，并向接入网关网元发送鉴权信息响应消息，鉴权信息响应消息中包括第三随机数和第三鉴权令牌，第三随机数和第三鉴权令牌为归一化数据管理网元根据终端的身份信息生成，用于终端对网络侧鉴权；接入和移动性管理网元从接入网关网元接收第四随机数和第四鉴权令牌，第四随机数为终端生成，第四鉴权令牌为终端根据第三随机数、第四随机数和第三鉴权参数生成；接入和移动性管理网元向鉴权服务网元发送第四随机数和第四鉴权令牌，用于鉴权服务网元对终端鉴权。该设计提供了一种对终端与网络侧相互鉴权的方式。
在一种可能的设计中，接入网关网元包括以下中的一个：固定网络接入网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。该设计提供了一种接入网关网元的具体实现方式。
第十七方面，提供了一种移动网络的接入和移动性管理网元，包括：接收单元，用于从固定网络的接入网关网元接收PPPoE鉴权参数；发送单元，用于向移动网络的鉴权服务网元发送PPPoE鉴权参数，PPPoE鉴权参数用于鉴权服务网元对终端进行PPPoE鉴权；接收单元，还用于从鉴权服务网元接收PPPoE鉴权结果，发送单元，还用于向终端发送PPPoE鉴权结果信息。基于同一发明构思，由于该装置解决问题的原理以及有益效果可以参见上述第十六方面和第十六方面的各可能的方法实施方式以及所带来的有益效果，因此该装置的实施可以参见上述第十六方面和第十六方面的各可能的方法的实施方式，重复之处不再赘述。
第十八方面，本申请实施例提供一种移动网络的接入和移动性管理网元，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当该设备运行时，该处理器执行该存储器存储的该计算机执行指令，以使该设备执行上述第十六方面中任意一项的方法；基于同一发明构思，处理器调用存储在存储器中的指令以实现上述第十六方面的方法设计中的方案，由于该设备解决问题的实施方式以及有益效果可以参见上述第十六方面和第十六方面的各可能的方法的实施方式以及有益效果，因此该设备的实施可以参见上述方法的实施，重复之处 不再赘述。
第十九方面，本申请实施例提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行如第十六方面的接入固定网络的方法。
第二十方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如第十六方面的接入固定网络的方法。
另外，第十八方面至第二十方面中任一种设计方式所带来的技术效果可参见第十六方面中不同设计方式所带来的技术效果，此处不再赘述。
第二十一方面，提供了一种接入固定网络的系统，包括如第二方面的固定网络的接入网关网元、如第七方面的终端、如第十二方面的移动网络的鉴权服务网元、以及如第十七方面的移动网络的接入和移动性管理网元；或者，包括如第三方面的固定网络的接入网关网元、如第八方面的终端、如第十三方面的移动网络的鉴权服务网元、以及如第十八方面的移动网络的接入和移动性管理网元；鉴权服务网元通过接入和移动性管理网元接收来自固定网络的接入网关网元的以太网上的点对点协议PPPoE鉴权参数，鉴权服务网元根据PPPoE鉴权参数对终端进行PPPoE鉴权，并通过接入和移动性管理网元和接入网关网元向终端发送PPPoE鉴权结果。基于同一发明构思，由于该系统解决问题的原理以及有益效果可以参见上述第一方面、第六方面、第十一方面、第十六方面和各可能的方法实施方式以及所带来的有益效果，因此该装置的实施可以参见上述第一方面、第六方面、第十一方面、第十六方面和各可能的方法的实施方式，重复之处不再赘述。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。
图1为本申请实施例提供的一种接入固定网络的系统架构示意图；
图2为本申请实施例提供的第一种接入固定网络的方法的流程示意图；
图3为本申请实施例提供的第二种接入固定网络的方法的流程示意图；
图4为本申请实施例提供的第三种接入固定网络的方法的流程示意图；
图5为本申请实施例提供的第四种接入固定网络的方法的流程示意图；
图6为本申请实施例提供的第五种接入固定网络的方法的流程示意图；
图7为本申请实施例提供的第六种接入固定网络的方法的流程示意图；
图8为本申请实施例提供的第七种接入固定网络的方法的流程示意图；
图9为本申请实施例提供的第八种接入固定网络的方法的流程示意图；
图10为本申请实施例提供的第九种接入固定网络的方法的流程示意图；
图11为本申请实施例提供的一种终端的硬件结构示意图；
图12为本申请实施例提供的另一种终端的硬件结构示意图；
图13为本申请实施例提供的又一种终端的硬件结构示意图；
图14为本申请实施例提供的一种接入网关网元的硬件结构示意图；
图15为本申请实施例提供的另一种接入网关网元的硬件结构示意图；
图16为本申请实施例提供的又一种接入网关网元的硬件结构示意图；
图17为本申请实施例提供的一种接入和移动性管理网元的硬件结构示意图；
图18为本申请实施例提供的另一种接入和移动性管理网元的硬件结构示意图；
图19为本申请实施例提供的又一种接入和移动性管理网元的硬件结构示意图；
图20为本申请实施例提供的一种鉴权服务网元的硬件结构示意图；
图21为本申请实施例提供的另一种鉴权服务网元的硬件结构示意图；
图22为本申请实施例提供的又一种鉴权服务网元的硬件结构示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述。
本申请实施例提供了一种接入固定网络的系统架构，参照图1中所示，该系统包括：接入网关网元、用户面网元、接入和移动性管理网元、会话管理网元、策略控制网元、鉴权服务网元、归一化数据管理网元、网络开放网元、网络响应网元和应用网元。在本申请，以接入网关网元为接入网关功能(Access Gateway Function，AGF)102、用户面网元为用户面功能(User Plane Function，UPF)103、接入和移动性管理网元为接入和移动性管理功能(Access and Mobility Management Function，AMF)104、会话管理网元为会话管理功能(Session Management Function，SMF)105、策略控制网元为策略控制功能(Policy Control Function，PCF)106、鉴权服务网元为鉴权服务功能(Authentication Server Function，AUSF)107、归一化数据管理网元为归一化数据管理(Unified Data Management，UDM)108、网络开放网元为网络开放功能(Network Exposure Function，NEF)109、网络响应网元为网络响应功能(Network Response Function，NRF)110和应用网元为应用功能(Application Function，AF)111进行举例说明。
AGF 102和UPF 103属于固定网络的网元，UE(或终端)101通过AGF102、UPF 103接入固定网络内的数据网络。AMF 104、SMF 105、PCF 106、AUSF 107、UDM 108、NEF 109和NRF 110属于移动网络中5G控制面的网元。AGF 102可以是固定网络中的一个独立网元，也可以设置在固定网络的接入网络(Access Network，AN)上，也可以是宽带网络网关(Broadband Network Gateway，BNG)或宽带移动接入服务器(Broadband Remote Access Server，BRAS)。可选的，UE可以通过WIFI接入点(Access Point，AP)接入AGF 102。可选的，AGF 102支持N2接口与AMF 104交互；AUSF 107支持太网上的点对点协议(Point to Point Protocol over Ethernet，PPPoE)鉴权方式；宽带论坛(Broadband Forum，BBF)网络的验证、授权和记账 (Authentication、Authorization、Accounting，AAA)服务器与策略功能分别融合到5G控制面中。
本申请实施例提供了一种接入固定网络的方法，参照图2中所示，包括：
S001、AGF与UE进行PPPoE协商，使得UE发现AGF并与之建立PPPoE会话。
可选地，在此过程中，UE可以发送一个指示给AGF，表示使用本发明定义的扩展的PPP协议交互。该指示可以是UE的能力指示，或者扩展的PPP协议指示，或者5G接入指示等。该指示可以帮助UE发现具有此能力的AGF，比如只有具有此能力的AGF才会回复响应消息。如果AGF支持该扩展的PPP协议，也可以在此过程发送给UE的消息中携带一个指示，表示使用本发明定义的扩展的PPP协议交互。该指示可以是AGF的能力指示，或者扩展的PPP协议指示，或者5G接入指示等。
具体的，PPPoE协商包括：
S0011、UE向AGF发送PPPoE主动发现发起分组(PPPoE Active Discovery Initiation，PADI)。
S0012、AGF向UE发送PPPoE主动发现提供(PPPoE Active Discovery Offer，PADO)。
S0013、UE向AGF发送PPPoE主动发现请求(PPPoE Active Discovery Request)。
S0014、AGF向UE发送PPPoE主动发现会话确认(PPPoE Active Discovery Session-confirmation，PADS)。
具体参见现有的PPPoE协商机制，即PPPoE发现阶段(Discovery Stage)的描述，在此不再赘述。
S002、UE与AGF之间建立及配置链路层连接，以协商鉴权方式。
可选地，在此过程中，UE可以发送一个指示给AGF，表示使用本发明定义的扩展的鉴权方式。该指示可以是UE的能力指示，或者扩展的鉴权方式的指示，或者5G接入指示等。如果AGF支持该扩展的鉴权协议，也可以在此过程发送给UE的消息中携带一个指示，表示使用本发明定义的扩展的PPP协议交互。该指示可以是AGF的能力指示，或者扩展的鉴权方式指示，或者5G接入指示等。
具体的步骤S002包括：
S0021、UE向AGF发送链路控制协议(Link Control Protocol，LCP)协商消息，其中包括指示信息用于指示使用的鉴权方式，如密码鉴权协议(Password Authentication Protocol，PAP)或挑战握手鉴权协议(Challenge Handshake Authentication Protocol，CHAP)。
S0022、AGF向UE发送挑战消息Challenge。
S0023、UE加密该挑战报文，并配置密码生成密钥，发送挑战响应消息给AGF，其中包括生成的密钥及用户名。
S003、AGF向AMF发送PPPoE鉴权参数。
该PPPoE鉴权参数最终需要由AMF转发给AUSF，用于AUSF对UE进行PPPoE鉴权，PPPoE鉴权参数可以包括以下消息中的至少一个：挑战包标识(Challenge packet ID)、密码(password)和密钥(key)、用户名等参数。。PPPoE鉴权参数可以放在一个PPPoE容器(PPPoE Container)中，在请求消息中发送给AMF。AGF还可以向AMF发送固网接入指示，PPPoE鉴权参数或固网接入指示用于AUSF确定使用PPPoE鉴权方法
示例性的，可以在AGF向AMF发送的附着请求消息中包括上述PPPoE鉴权参数/或固网接入指示。
S004、AMF接收PPPoE鉴权参数后，向AUSF发送该PPPoE鉴权参数。
示例性的，可以在向AUSF发送的鉴权请求消息(Authentication Request)中包括上述PPPoE鉴权参数。
S005、AUSF接收PPPoE鉴权参数后，根据PPPoE鉴权参数对UE进行PPPoE鉴权。
示例性的，可以在接收的鉴权请求消息中的PPPoE鉴权参数对UE进行PPPoE鉴权。
S006、AUSF向AMF发送PPPoE鉴权结果，PPPoE鉴权结果可以包含在PPPoE容器中。
该PPPoE鉴权结果可以指对UE鉴权成功或失败。并且该PPPoE鉴权结果最终需要由AMF和AGF转发给UE。
示例性的，可以在向AMF发送的鉴权响应消息(Authentication Response)中包括PPPoE鉴权结果
S007、AMF接收PPPoE鉴权结果后，向AGF发送PPPoE鉴权结果。
示例性的，可以在向AGF发送的附着接受消息(Attach Accept)中包括PPPoE鉴权结果。
S008、AGF从AMF接收PPPoE鉴权结果后，向UE发送PPPoE鉴权结果消息。PPPoE鉴权结果消息中包括PPPoE鉴权结果。
S009、UE接收PPPoE鉴权结果消息。
本申请实施例提供的接入固定网络的方法，UE与AGF建立PPPoE会话后，由AGF向AUSF发送PPPoE鉴权参数，该PPPoE鉴权参数用于AUSF对UE进行鉴权，然后由AUSF将鉴权结果反馈给UE，实现了实现移动网络和固定网络的核心网设备的融合。
下面示例性的以具体消息对上述接入固定网络的方法进行说明，本领域技术人员可以理解，本申请实施例并不限制具体消息名称。
本申请实施例提供了另一种接入固定网络的方法，参照图3中所示，该方法包括：
S101-S102与步骤S001-S002相同，在此不再赘述。
S103、AGF向AMF发送附着请求消息(Attach Request)。
附着请求消息中包括PPPoE鉴权参数和/或固网接入指示。
附着请求消息可以是例如5G非接入层(Non-Access Stratum，NAS)的附着请求消息。
S104、AMF接收附着请求消息后，向AUSF发送鉴权请求消息。
鉴权请求消息中包括PPPoE鉴权参数和/或固网接入指示。
S105、AUSF接收鉴权请求消息后，AUSF根据其中的PPPoE鉴权参数或固网接入指示，确定使用PPPoE鉴权方法，并从UDM获取用户数据服务(Subscriber Data Service)以对UE进行PPPoE鉴权。
S106、AUSF向AMF发送鉴权响应消息。
鉴权响应消息中包括PPPoE鉴权结果。
S107、AMF接收鉴权响应消息后，AMF向AGF发送附着接受消息(Attach Accept)。
附着接受消息中包括PPPoE鉴权结果。
S108、AGF接收附着接受消息后，向UE发送PPPoE鉴权结果消息。
PPPoE鉴权结果消息中包括PPPoE鉴权结果。
S109、UE接收PPPoE鉴权结果消息。
本申请实施例提供的接入固定网络的方法，通过在AGF与UE进行PPPoE协商之后，AGF通过AMF将PPPoE鉴权参数和/或固网接入指示发送给AUSF；然后，AUSF根据PPPoE鉴权参数和/或固网接入指示，判断使用PPPoE鉴权方法，并根据PPPoE鉴权参数对UE进行鉴权。实现了5G核心网支持PPPoE鉴权流程。
可选的，参照图4中所示，在步骤S107之前，该方法还可以包括S110-S113：
S110、AMF向AGF发送安全模式命令(Security Mode Command，SMC)消息。该消息使用5G架构N2接口协议进行封装。
S111、AGF接收SMC消息后，向UE发送第一点对点协议(Point to Point Protocol，PPP)消息。该第一PPP消息可以为扩展的LCP报文，也可以是新定义的PPP协议报文。
第一PPP消息中包括SMC消息或者NAS加密激活参数。
S112、UE接收第一PPP消息后，向AGF发送第二PPP消息。相应地，该第二PPP消息可以为扩展的LCP报文，也可以是新定义的PPP协议报文。
SMC命令消息或者NAS加密激活参数需要UE上传给NAS层。第二PPP消息中包括SMC完成消息或者NAS加密激活参数。
S113、AGF接收第二PPP消息后，向AMF发送SMC完成消息或者NAS加密激活参数。
可选的，在步骤S109之后还可以包括S114-S116：
S114、UE向AGF发送第一网络控制协议(Network Control Protocol，NCP)协商(Negotiation)消息。
S115、AGF接收第一NCP协商消息后，向UE发送第二NCP协商消息。
第二NCP协商消息中包括用于NAS消息(即后续的会话管理(Session Management)消息、移动性管理(Mobility Management)消息、去注册(Deregistration)消息等)传输的源互联网协议(Internet Protocol，IP)地址和目的IP地址，或者源媒体访问控制(Media Access Control)地址或目的MAC地址。具体的可以包括以下信息中的至少一种：AGF发送和接收后续NAS消息的IP地址，以及UE发送和接收后续NAS消息的IP地址，源MAC地址和目的MAC地址。AGF接收后续NAS消息的IP地址与发送后续NAS消息的IP地址可以是同一个地址，AGF接收后续NAS消息的MAC地址与发送后续NAS消息的MAC地址可以是同一个地址；同样地，UE接收后续NAS消息的IP地址与发送后续NAS消息的IP地址可以是同一个地址，UE接收后续NAS消息的MAC地址与发送后续NAS消息的MAC地址可以是同一个地址。
S116、UE接收第二NCP协商消息。
上述接入固定网络的方法，通过扩展的或新增的PPP消息实现UE与5G核心网之间的NAS加密激活SMC过程。在NCP协商过程之后，UE可以用IP包或者MAC包封装NAS消息，经由AGF与5G核心网进行交互，从而达到5G核心网对多种接入不感知(接收的消息以及处理的流程都相同)的目的。
可选的，参照图5中所示，在步骤S107中，AMF向AGF发送附着接受消息(Attach Accept)中还包括SMC命令消息或者NAS加密激活参数；在步骤S108中，AGF向UE发送的PPPoE鉴权结果消息中还包括SMC命令消息或者NAS加密激活参数。那么在步骤S109之后，该方法还可以包括S117-S121：
S117、UE向AGF发送第三NCP协商消息。
第三NCP协商消息中包括SMC完成消息或者NAS加密激活参数。
S118、AGF接收第三NCP协商消息后，向UE发送第四NCP协商消息。
第四NCP协商消息中包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。IP地址和MAC地址的具体描述参照步骤S115，在此不再赘述。
S119、UE接收第四NCP协商消息。
S120、AGF向AMF发送SMC完成消息。
S121、AMF接收SMC完成消息。
上述接入固定网络的方法，通过增强的或新增的PPP协议实现UE与5G核心网之间的NAS加密激活SMC过程。在NCP协商过程之后，UE可以用IP包或者MAC包封装NAS消息，经由AGF与5G核心网进行交互，从而达到5G核心网对多种接入不感知(接收的消息以及处理的流程都相同)的目的。
可选的，参照图6中所示，在步骤S109之后，该方法还可以包括 S122-S129：
S122、UE向AGF发送第五NCP协商消息。
可选地，在此过程中，UE可以发送一个指示给AGF，表示使用本发明定义的扩展的NCP协商方式。该指示可以是UE的能力指示，或者扩展的NCP协商方式的指示，或者5G接入指示，或者PDU会话建立指示等。
S123、AGF接收第五NCP协商消息后，向AMF发送分组数据单元(Packet Data Unit，PDU)会话建立请求消息(PDU Session Establishment)，其中包括用户标识和/或固网接入标识。
S124、AMF接收PDU会话建立请求消息后，向SMF发送PDU会话建立服务请求消息(PDU Session Establishment Service Request)，其中包括用户标识和/或固网接入标识。
S125、SMF接收PDU会话建立服务请求消息后，选择对应UPF，并为UE分配资源和用于传输用户面数据包的IP地址。可选地，SMF根据用户标识和/或固网接入标识使用相应的服务质量(Quality of Service，QoS)和计费策略。该QoS和计费策略可以是SMF本地配置，或者从策略控制功能PCF获得。
S126、SMF向AMF发送PDU会话建立服务响应消息(PDU Session Establishment Service Response)，其中包括QoS和计费策略。
PDU会话建立服务响应消息中包括上述用于传输用户面数据包的IP地址。
S127、AMF接收PDU会话建立服务响应消息后，向AGF发送会话建立响应消息(Session Establishment Response)。
会话建立响应消息中包括上述用于传输用户面数据包的IP地址，以及QoS和/或计费策略。
S128、AGF接收会话建立响应消息后，向UE发送第六NCP协商消息。AGF可以将QoS和/或计费策略转换为固网的QoS和/或计费策略相应参数。
第六NCP协商消息中包括上述用于传输用户面数据包的IP地址。可选地，AGF分配用于后续NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址，在第六NCP协商消息中一并发送给UE。IP地址和MAC地址的具体描述参照步骤S115，在此不再赘述。
S129、UE接收第六NCP协商消息。
上述接入固定网络的方法，通过将NCP协商过程转化为PDU会话建立过程，从而达到5G核心网对多种接入不感知(处理都相同)的目的。
可选的，参照图7中所示，在步骤S109之后，该方法还可以包括S130-S134：
S130、UE向AGF发送第七NCP协商消息。
第七NCP协商消息中包括SMC请求消息(SMC Request)或者NAS加密激活参数。
S131、AGF接收第七NCP协商消息后，向AMF发送SMC请求消息。
S132、AMF接收SMC请求消息后，向AGF发送SMC响应消息(SMC Response)。
S133、AGF接收SMC响应消息后，向UE发送第八NCP协商消息。
第八NCP协商消息中包括SMC响应消息或者NAS加密激活参数。可选地，AGF分配用于后续NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址，在第八NCP协商消息中一并发送给UE。IP地址和MAC地址的具体描述参照步骤S115，在此不再赘述。
S134、UE接收第八NCP协商消息。
上述接入固定网络的方法，通过增强PPP协议实现UE与5G核心网之间的NAS加密激活SMC过程。并且SMC交互由UE发起，不需要新增PPP消息。在NCP过程之后，UE可以用IP包封装NAS消息与5G核心网进行交互，从而达到5G核心网对多种接入不感知(处理都相同)的目的。
可选的，参照图8中所示，在步骤S109之后，该方法还可以包括S135-S140：
S135、UE向AGF发送第九NCP协商消息。
可选地，在此过程中，UE可以发送一个指示给AGF，表示使用本发明定义的扩展的NCP协商方式。该指示可以是UE的能力指示，或者扩展的NCP协商方式的指示，或者5G接入指示等。
S136、AGF接收第九NCP协商消息后，向AMF发送附着完成消息(Attach Complete)。
S137、AMF接收附着完成消息后，向AGF发送SMC消息。
S138、AGF接收SMC消息后，向UE发送第十NCP协商消息。
第十NCP协商消息中包括SMC命令消息。可选地，AGF分配用于后续NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址，在第十NCP协商消息中一并发送给UE。IP地址和MAC地址的具体描述参照步骤S115，在此不再赘述。
S139、UE接收第十NCP协商消息后，向AGF发送SMC完成消息(SMC Complete)。
具体的，UE向AGF发送用户上行数据包，用户上行数据包中包括SMC完成消息。
或者，UE向AGF发送第十一NCP协商消息，其中包括SMC完成消息。
或者，UE使用S138中收到的后续NAS消息传输的IP地址或者MAC地址向AGF发送SMC完成消息。
S140、AGF接收SMC完成消息。
具体的，AGF接收用户上行数据包，或者接收第十一NCP协商消息，或者接收使用后续NAS消息传输的IP地址或者MAC地址的SMC完成消息。
上述接入固定网络的方法，通过增强NCP协议实现5G核心网发送的NAS 加密激活SMC command消息。SMC complete由用户面传递，不需要新增PPP消息。在NCP过程之后，UE可以用IP包封装NAS消息与5G核心网进行交互，从而达到5G核心网对多种接入不感知(处理都相同)的目的。
可选的，参照图9中所示，本申请实施例还可以对步骤S002进行扩展增强，步骤S002包括S141-S146：
S141、UE向AGF发送LCP协商消息以进行LCP协商(Negotiation)，以确定采用CHAP鉴权流程。
该步骤用于对步骤S0021进行扩展增强。
传统的CHAP鉴权方法为单向鉴权，即核心网鉴权UE。本申请所述的增强的CHAP鉴权方法为双向鉴权方法，即还包括UE对核心网的鉴权。该指示信息的下发条件可以是AGF知道自身接入的是3GPP核心网，所以在LCP协商过程中向UE下发该指示信息。
具体的，所述指示信息可以是LCP协商消息中的某个比特位，例如是LCP协商消息中的空闲比特位或保留比特位。当该比特位为0时，采用原有CHAP鉴权方法，当该比特位为1时，采用增强CHAP鉴权方法；或者，当该比特位为1时，采用原有CHAP鉴权方法，当该比特位为0时，采用增强CHAP鉴权方法。网元AGF可以根据配置信息决定使用传统或增强的CHAP鉴权方法。配置信息包括：运营商配置的必须使用双向鉴权的配置信息，UE在协商过程中要求进行双向鉴权的配置信息，或者AGF本身的配置信息。
S142、AGF接收LCP协商消息后，生成第一随机数。
S143、AGF向UE发送挑战消息(Challenge)，以发起CHAP鉴权。
在挑战请求消息中可以包括第一随机数。该步骤用于对步骤S0022进行扩展增强。
S144、UE接收挑战请求消息后，根据第一随机数和第一鉴权参数生成第一鉴权令牌。
第一鉴权参数可以包括：提前配置好的密钥或其他参数(例如UE的IMSI信息，或者UE的其他信息，此身份要求网络侧知道)
S145、UE返回挑战响应消息(Response)。
在挑战响应消息中还可以包括第一鉴权令牌。该步骤用于对步骤S0023进行扩展增强。
S146、AGF接收挑战响应消息。
此时，在步骤S103的附着请求消息和S104的鉴权请求消息中还包括上述第一随机数和第一鉴权令牌，使AUSF获得第一随机数和第一鉴权令牌。相当于AGF通过AMF向AUSF发送第一随机数和第一鉴权令牌，用于AUSF对UE进行鉴权。其中，AMF对第一随机数和第一鉴权令牌的接收和发送过程不再赘述。
可选的，在步骤S106之前，该方法还包括：
S147、AUSF对第一鉴权令牌进行验证，如果验证成功，则生成第二随 机数和第二鉴权令牌。
具体的，AUSF根据第一随机数和第二鉴权参数生成临时鉴权令牌，然后将临时鉴权令牌与第一鉴权令牌进行比较，如果相同则说明对第一鉴权令牌进行验证成功，即网络侧对UE鉴权成功。
具体的，AUSF根据第一随机数、第二随机数以及第三鉴权参数生成第二鉴权令牌。
此时，在步骤S106的鉴权响应消息中、S107的附着接受消息中和步骤S108的PPPoE鉴权结果消息中还包括第二随机数和第二鉴权令牌。相当于AUSF通过AMF和AGF向UE发送第二随机数和第二鉴权令牌，用于UE对网络侧鉴权。其中，AMF和AGF对第二随机数和第二鉴权令牌的接收和发送过程不再赘述。
可选的，在步骤S109之后，该方法还包括：
S148、UE对第二鉴权令牌进行验证。
具体的，UE根据第一随机数、第二随机数和第四鉴权参数生成临时鉴权令牌，然后将临时鉴权令牌与第二鉴权令牌进行比较，如果相同则说明对第二鉴权令牌进行验证成功，即UE对网络侧鉴权成功。
上述步骤实现了网络侧先鉴权UE，再由UE鉴权网络侧的方法。
需要说明的是，图9中所示的步骤S141-S148可以与图3-图8中的其他步骤相结合。具体不再赘述。
参照图10中所示，本申请实施例还可以对步骤S002进行另一种扩展增强，该方法还可以包括S149-S157：
S149、UE向AGF发送LCP协商消息以进行LCP协商(Negotiation)，以确定采用CHAP鉴权流程。
LCP协商消息中包括UE的身份信息。该步骤用于对步骤S0021进行扩展增强。
S150、AGF向UDM发送鉴权信息请求消息(Authentication Information Info Request)，以请求鉴权信息。
鉴权信息请求消息中包括上述UE的身份信息。该请求信息要经过AMF和AUSF转发。
S151、UDM接收鉴权信息请求消息后，根据UE的身份信息生成第三随机数和第三鉴权令牌。
具体的，UDM根据UE的身份信息找到UE的LTE根密钥，并且根据LTE根密钥生成第三随机数和第三鉴权令牌，以及待后续使用的AUSF密钥。
S152、UDM向AUSF发送UE鉴权信息响应消息(UE Authentication Information Info Response)。
UE鉴权信息响应消息中包括第三随机数和第三鉴权令牌，以及AUSF密钥。
S153、AUSF接收UE鉴权信息响应消息并获取AUSF密钥，通过AMF向AGF发送鉴权信息响应消息。
S154、AGF接收鉴权信息响应消息后，向UE发送挑战消息(Challenge)，以发起CHAP鉴权。
挑战请求消息中可以包括第三随机数和第三鉴权令牌，用于UE对网络侧鉴权。该步骤用于对步骤S0022进行扩展增强。
S155、UE接收挑战请求消息后，根据第三随机数和UE的身份信息对第三鉴权令牌进行验证，如果验证成功，则生成第四随机数，并根据第三随机数、第四随机数以及第五密钥生成第四鉴权令牌。
S156、UE返回挑战响应消息(Response)。
挑战响应消息中还包括第四随机数和第四鉴权令牌。该步骤用于对步骤S0023进行扩展增强。
S157、AGF接收挑战响应消息。
此时，此时，在附着请求消息中和鉴权请求消息中还包括上述第四随机数和第四鉴权令牌，使AUSF获得第四随机数和第四鉴权令牌。相当于AGF通过AMF向AUSF发送第四随机数和第四鉴权令牌，用于AUSF对UE进行鉴权。其中，AMF对第四随机数和第四鉴权令牌的接收和发送过程不再赘述。
可选的，在步骤S105之前，该方法还包括：
S158、AUSF根据AUSF密钥、第四随机数对第四鉴权令牌进行验证。
如果验证成功则说明AUSF对UE鉴权成功。
上述步骤实现了UE先鉴权网络侧，再由网络侧鉴权UE的方法。
需要说明的是，图10中所示的步骤S149-S158可以与图3-图8中的其他步骤相结合。
本申请实施例提供一种终端，用于执行上述方法。本申请实施例可以根据上述方法示例对终端进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图11示出了上述实施例中所涉及的终端的一种可能的结构示意图，终端50包括：协商单元5011、发送单元5012、接收单元5013。协商单元5011用于支持终端执行图2中的过程S001、S002，图3中的过程S001、S002，图4中的过程S001、S002，图5中的过程S001、S002，图6中的过程S001、S002，图7中的过程S001、S002，图8中的过程S001、S002，图9中的过程S001、S144、S148，图10中的过程S001、S155；发送单元5012用于支持终端执行图4中的过程S112、S114，图5中的过程S117，图6中的过程S122，图7中的过程S130，图8中的过程S135、S139，图9中的过程S141、S145，图10中的过程S149、S156； 接收单元5013用于支持终端50执行图2中的过程S009，图3中的过程S109，图4中的过程S109、S116，图5中的过程S109、S119，图6中的过程S109、S122，图7中的过程S109、S134，图8中的过程S109，图9中的过程S109，图10中的过程S109。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图12示出了上述实施例中所涉及的终端的一种可能的结构示意图。终端50包括：处理模块5022和通信模块5023。处理模块5022用于对终端50的动作进行控制管理，例如，处理模块5022用于支持终端执行图2中的过程S001、S002，图3中的过程S001、S002，图4中的过程S001、S002，图5中的过程S001、S002，图6中的过程S001、S002，图7中的过程S001、S002，图8中的过程S001、S002，图9中的过程S001、S144、S148，图10中的过程S001、S155。通信模块5023用于支持终端与其他实体的通信，例如与图1中示出的功能模块或网络实体之间的通信。终端50还可以包括存储模块5021，用于存储终端的程序代码和数据。
其中，处理模块5022可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块5023可以是收发器、收发电路或网络通信接口等。存储模块5021可以是存储器。
当处理模块5022为处理器，通信模块5023为收发器，存储模块5021为存储器时，本申请实施例所涉及的终端可以为如下所述的终端。
参照图13所示，该终端50包括：处理器5032、收发器5033、存储器5031、总线5034。可选的，终端50还可以包括输出设备5035和输入设备5036。其中，收发器5033、处理器5032、存储器5031、输出设备5035和输入设备5036通过总线5034相互连接。
处理器5032可以是一个通用中央处理器(Central Processing Unit，CPU)、微处理器、特定应用集成电路(Application-Specific Integrated Circuit，ASIC)，或者一个或多个用于控制本申请方案程序执行的集成电路。处理器5032也可以是多个处理器，每一个处理器可以是一个单核(single-CPU)处理器或多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路和/或用于处理数据(例如计算机程序指令)的处理核。
存储器5031可以是只读存储器(Read-Only Memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备、随机存取存储器(Random Access Memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable  Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器5031可以是独立存在，通过总线与处理器5032相连接。存储器5031也可以和处理器5032集成在一起。其中，存储器5031用于存储执行本申请方案的应用程序代码，并由处理器5032来控制执行。处理器5032用于执行存储器5031中存储的计算机程序代码，从而实现本申请实施例中所述的方法。
收发器5033可以使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网、无线接入网(Radio Access Network，RAN)、无线局域网(Wireless Local Area Networks，WLAN)等。收发器5033包括发射机Tx和接收机Rx。
总线5034可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
输出设备5035和处理器5032通信，可以以多种方式来显示信息。例如，输出设备5035可以是液晶显示器(Liquid Crystal Display，LCD)，发光二级管(Light Emitting Diode，LED)显示设备，阴极射线管(Cathode Ray Tube，CRT)显示设备，或投影仪(projector)等。输入设备5036和处理器5032通信，可以以多种方式接受用户的输入。例如，输入设备5036可以是鼠标、键盘、触摸屏设备或传感设备等。
本申请实施例提供一种固定网络的接入网关网元，用于执行上述方法。本申请实施例可以根据上述方法示例对接入网关网元进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图14示出了上述实施例中所涉及的接入网关网元的一种可能的结构示意图，接入网关网元60包括：协商单元6011、接收单元6012、发送单元6013。协商单元6011用于支持接入网关网元执行图2中的过程S001、S002，图3中的过程S101、S102，图4中的过程S101、S102，图5中的过程S101、S102，图6中的过程S101、S102，图7中的过程S101、S102，图8中的过程S101、S102，图9中的过程S101、S142，图10中的过程S101；接收单元6012用于支持接入网关网元执 行图2中的过程S003、S008，图3中的过程S103、S108，图4中的过程S103、S108、S111、S113、S115，图5中的过程S103、S108、S118，图6中的过程S103、S108、S123、S128，图7中的过程S103、S108、S131、S133，图8中的过程S103、S108、S136、S138、S140，图9中的过程S103、S108、S142、S146，图10中的过程S103、S108、S150、S154、S157；发送单元6013用于支持接入网关网元执行图2中的过程S003、S008，图3中的过程S103、S108，图4中的过程S103、S108、S111、S113、S115，图5中的过程S103、S108、S118，图6中的过程S103、S108、S123、S128，图7中的过程S103、S108、S131、S133，图8中的过程S103、S108、S136、S138，图9中的过程S103、S108，图10中的过程S103、S108、S150、S154。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图15示出了上述实施例中所涉及的接入网关网元的一种可能的结构示意图。接入网关网元60包括：处理模块6022和通信模块6023。处理模块6022用于对接入网关网元60的动作进行控制管理，例如，处理模块6022用于支持支持接入网关网元执行图2中的过程S001、S002，图3中的过程S101、S102，图4中的过程S101、S102，图5中的过程S101、S102，图6中的过程S101、S102，图7中的过程S101、S102，图8中的过程S101、S102，图9中的过程S101、S142，图10中的过程S101。通信模块6023用于支持接入网关网元与其他实体的通信，例如与图1中示出的功能模块或网络实体之间的通信。接入网关网元60还可以包括存储模块6021，用于存储接入网关网元的程序代码和数据。
其中，处理模块6022可以是处理器或控制器，例如可以是中央处理器(central processing unit，CPU)，通用处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块6023可以是收发器、收发电路或通信接口等。存储模块6021可以是存储器。
当处理模块6022为处理器，通信模块6023为收发器或网络接口，存储模块6021为存储器时，本申请实施例所涉及的接入网关网元可以为如下所述的接入网关网元。
参照图16所示，该接入网关网元60包括：处理器6032、存储器6031、总线6034。根据接入网关网元实际情况作为不同网元时，还可以包括至少一个收发器6033和/或至少一个网络接口6035。其中，收发器6033、处理器6032、网络接口6035、存储器6031通过总线6034相互连接。网络接口6035用于通过有线或无线链路与其他网元的网络接口连接。接入网关网元60内部 其余各器件的功能参照对终端50内部对应器件的功能描述，在此不再赘述。
本申请实施例提供一种接入和移动性管理网元，用于执行上述方法。本申请实施例可以根据上述方法示例对接入和移动性管理网元进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图17示出了上述实施例中所涉及的接入和移动性管理网元的一种可能的结构示意图，接入和移动性管理网元70包括：接收单元7011、发送单元7012。接收单元7011用于支持接入和移动性管理网元执行图2中的过程S004、S007，图3中的过程S104、S107，图4中的过程S104、S107、S110，图5中的过程S104、S107、S121，图6中的过程S104、S107、S124、S127，图7中的过程S104、S107、S132，图8中的过程S104、S107、S137，图9中的过程S104、S107，图10中的过程S104、S107、S150、S153；发送单元7012用于支持接入和移动性管理网元执行图2中的过程S004、S007，图3中的过程S104、S107，图4中的过程S104、S107、S110，图5中的过程S104、S107，图6中的过程S104、S107、S124、S127，图7中的过程S104、S107、S132，图8中的过程S104、S107、S137，图9中的过程S104、S107，图10中的过程S104、S107、S150、S153。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图18示出了上述实施例中所涉及的接入和移动性管理网元的一种可能的结构示意图。接入和移动性管理网元70包括：处理模块7022和通信模块7023。处理模块7022用于对接入和移动性管理网元70的动作进行控制管理。通信模块7023用于支持接入和移动性管理网元与其他实体的通信，例如与图1中示出的功能模块或网络实体之间的通信。接入和移动性管理网元70还可以包括存储模块7021，用于存储接入和移动性管理网元的程序代码和数据。
其中，处理模块7022可以是处理器或控制器，例如可以是中央处理器(central processing unit，CPU)，通用处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块7023可以是收发器、收发电路或通信接口等。存储模块7021可以是存储器。
当处理模块7022为处理器，通信模块7023为网络接口，存储模块7021为存储器时，本申请实施例所涉及的接入和移动性管理网元可以为如下所述的接入和移动性管理网元。
参照图19所示，该接入和移动性管理网元70包括：处理器7032、网络接口7033、存储器7031、总线7034。其中，网络接口7033、处理器7032、存储器7031通过总线7034相互连接。接入和移动性管理网元70内部各器件的功能参照对终端50和接入网关网元60内部对应器件的功能描述，在此不再赘述。
本申请实施例提供一种移动网络的鉴权服务网元，用于执行上述方法。本申请实施例可以根据上述方法示例对鉴权服务网元进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图20示出了上述实施例中所涉及的鉴权服务网元的一种可能的结构示意图，鉴权服务网元80包括：鉴权单元8011、接收单元8012、发送单元8013。鉴权单元8011用于支持接入网关网元执行图2中的过程S005，图3中的过程S105，图4中的过程S1052，图5中的过程S105，图6中的过程S105，图7中的过程S105，图8中的过程S105，图9中的过程S105、S147，图10中的过程S101、S158；接收单元8012用于支持接入网关网元执行图2中的过程S005，图3中的过程S105，图4中的过程S105，图5中的过程S105，图6中的过程S105，图7中的过程S105，图8中的过程S105，图9中的过程S105，图10中的过程S105、S153；发送单元8013用于支持鉴权服务网元执行图2中的过程S006，图3中的过程S106，图4中的过程S106，图5中的过程S106，图6中的过程S106，图7中的过程S106，图8中的过程S106，图9中的过程S106，图10中的过程S106、S153。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图21示出了上述实施例中所涉及的鉴权服务网元的一种可能的结构示意图。鉴权服务网元80包括：处理模块8022和通信模块8023。处理模块8022用于对鉴权服务网元80的动作进行控制管理，例如，处理模块8022用于支持鉴权服务网元80执行图2中的过程S005，图3中的过程S105，图4中的过程S1052，图5中的过程S105，图6中的过程S105，图7中的过程S105，图8中的过程S105，图9中的过程S105、S147，图10中的过程S101、S158。通信模块8023用于支持鉴权服务网元与其他实体的通信，例如与图1中示出的功能模块或网络实体之间的通信。鉴权服务网元80还可以包括存储模块8021，用于存储鉴权服务网元的 程序代码和数据。
其中，处理模块8022可以是处理器或控制器，例如可以是中央处理器(central processing unit，CPU)，通用处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块8023可以是收发器、收发电路或通信接口等。存储模块8021可以是存储器。
当处理模块8022为处理器，通信模块8023为网络接口，存储模块8021为存储器时，本申请实施例所涉及的鉴权服务网元可以为如下所述的鉴权服务网元。
参照图22所示，该鉴权服务网元80包括：处理器8032、网络接口8033、存储器8031、总线8034。其中，网络接口8033、处理器8032、存储器8031通过总线8034相互连接。接入和鉴权服务网元80内部各器件的功能参照对终端50和接入网关网元60内部对应器件的功能描述，在此不再赘述。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、设备和方法，可以通过其它的方式实现。例如，以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方， 或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (30)

  1. 一种接入固定网络的方法，其特征在于，包括：
    固定网络的接入网关网元与终端进行以太网上的点对点协议PPPoE协商，以与所述终端建立PPPoE会话；
    所述接入网关网元协商PPPoE鉴权方式；
    所述接入网关网元向移动网络的鉴权服务网元发送PPPoE鉴权参数，所述PPPoE鉴权参数用于所述鉴权服务网元对所述终端进行PPPoE鉴权；
    所述接入网关网元接收来自所述鉴权服务网元的PPPoE鉴权结果，并向所述终端发送PPPoE鉴权结果消息，所述PPPoE鉴权结果消息中包括所述PPPoE鉴权结果。
  2. 根据权利要求1所述的方法，其特征在于，
    所述接入网关网元向移动网络的鉴权服务网元发送PPPoE鉴权参数，包括：
    所述接入网关网元向接入和移动性管理网元发送附着请求消息，所述附着请求消息中包括所述PPPoE鉴权参数，使得所述接入和移动性管理网元通过鉴权请求消息向所述鉴权服务网元发送所述PPPoE鉴权参数；
    所述接入网关网元接收来自所述鉴权服务网元的PPPoE鉴权结果，包括：
    所述接入网关网元从所述接入和移动性管理网元接收附着接受消息，所述附着接受消息中包括所述PPPoE鉴权结果，所述PPPoE鉴权结果由所述接入和移动性管理网元从来自所述鉴权服务网元的鉴权响应消息中得到。
  3. 根据权利要求2所述的方法，其特征在于，所述附着请求消息和所述鉴权请求消息中还包括固网接入指示，所述固网接入指示用于所述鉴权服务网元确定使用PPPoE鉴权方法；或者，所述PPPoE鉴权参数还用于所述鉴权服务网元确定使用PPPoE鉴权方法。
  4. 根据权利要求1所述的方法，其特征在于，在所述接入网关网元接收来自所述鉴权服务网元的PPPoE鉴权结果之前，所述方法还包括：
    所述接入网关网元从所述接入和移动性管理网元接收安全模式命令SMC消息；
    所述接入网关网元向所述终端发送第一点对点协议PPP消息，所述第一PPP消息中包括所述SMC消息或者非接入层NAS加密激活参数；
    所述接入网关网元从所述终端接收第二PPP消息，所述第二PPP消息中包括SMC完成消息或者所述NAS加密激活参数；
    所述接入网关网元向所述接入和移动性管理网元发送所述SMC完成消息或者所述NAS加密激活参数。
  5. 根据权利要求2所述的方法，其特征在于，所述附着接受消息中还包括SMC消息，所述鉴权响应消息中还包括所述SMC消息或者NAS加密激活参数，所述方法还包括：
    所述接入网关网元从所述终端接收第一网络控制协议NCP协商消息，所述第一NCP协商消息中包括SMC完成消息或者所述NAS加密激活参数；
    所述接入网关网元向所述接入和移动性管理网元发送所述SMC完成消息。
  6. 根据权利要求4或5所述的方法，其特征在于，所述方法还包括：
    所述接入网关网元向所述终端发送第二NCP协商消息，所述第二NCP协商消息中包括用于NAS消息传输的源互联网协议IP地址和目的IP地址，或者源媒体访问控制MAC地址和目的MAC地址。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入网关网元从所述终端接收第三NCP协商消息；
    所述接入网关网元向所述接入和移动性管理网元发送分组数据单元PDU会话建立请求消息，所述PDU会话建立请求消息包括用户标识和/或固网接入标识；
    所述接入网关网元从所述接入和移动性管理网元接收会话建立响应消息，所述会话建立响应消息中包括用于传输用户面数据包的IP地址以及服务质量QoS和/或计费策略，所述QoS和/或计费策略为会话管理网元根据所述用户标识和/或固网接入标识得到；
    所述接入网关网元向所述终端发送第四NCP协商消息，所述第四NCP协商消息中包括所述用于传输用户面数据包的IP地址。
  8. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入网关网元从所述终端接收第五NCP协商消息，所述第五NCP协商消息中包括SMC请求消息；
    所述接入网关网元向所述接入和移动性管理网元发送所述SMC请求消息；
    所述接入网关网元从所述接入和移动性管理网元接收SMC响应消息；
    所述接入网关网元向所述终端发送第六NCP协商消息，所述第六NCP协商消息中包括所述SMC响应消息。
  9. 根据权利要求8所述的方法，其特征在于，所述第六NCP协商消息中还包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。
  10. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述接入网关网元从所述终端接收第七NCP协商消息；
    所述接入网关网元向所述接入和移动性管理网元发送附着完成消息；
    所述接入网关网元从所述接入和移动性管理网元接收SMC消息；
    所述接入网关网元向所述终端发送第八NCP协商消息，所述第八NCP协商消息中包括所述SMC消息；
    所述接入网关网元从所述终端接收SMC完成消息。
  11. 根据权利要求10所述的方法，其特征在于，所述接入网关网元从所述终端接收SMC完成消息，包括：
    所述接入网关网元从所述终端接收用户上行数据包，所述用户上行数据包中包括所述SMC完成消息，或者，
    所述接入网关网元从所述终端接收第九NCP协商消息，所述第九NCP协商消息中包括所述SMC完成消息，或者，
    当所述第八NCP协商消息包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址时，所述接入网关网元从所述终端接收SMC完成消息，所述SMC完成消息使用所述用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。
  12. 根据权利要求1-11中任一项所述的方法，其特征在于，所述接入网关网元与所述终端建立及配置链路层连接，以协商鉴权方式，包括：
    所述接入网关网元从所述终端接收链路控制协议LCP协商消息，以确定采用挑战握手鉴权协议CHAP鉴权流程；
    所述接入网关网元生成第一随机数；
    所述接入网关网元向所述终端发送挑战消息，以发起CHAP鉴权，所述挑战请求消息中包括所述第一随机数；
    所述接入网关网元从所述终端接收挑战响应消息，所述挑战响应消息中包括第一鉴权令牌，所述第一鉴权令牌为所述终端根据所述第一随机数和第一鉴权参数生成；
    所述方法还包括：
    所述接入网关网元向所述鉴权服务网元发送所述第一随机数和所述第一鉴权令牌，用于所述鉴权服务网元对所述终端进行鉴权；
    所述接入网关网元接收来自所述鉴权服务网元的第二随机数和第二鉴权令牌，其中，所述第二鉴权令牌为所述鉴权服务网元根据所述第一随机数、第二随机数和第二鉴权参数生成；
    所述接入网关网元向所述终端发送所述第二随机数和所述第二鉴权令牌，用于所述终端对网络侧鉴权。
  13. 根据权利要求1-11中任一项所述的方法，其特征在于，所述接入网关网元与所述终端建立及配置链路层连接，以协商鉴权方式，包括：
    所述接入网关网元从所述终端接收LCP协商消息，以确定采用CHAP鉴权流程，所述LCP协商消息中包括所述终端的身份信息；
    所述接入网关网元向归一化数据管理网元发送鉴权信息请求消息，所述鉴权信息请求消息中包括所述终端的身份信息；
    所述接入网关网元从所述鉴权服务网元接收鉴权信息响应消息，所述鉴权信息响应消息中包括第三随机数和第三鉴权令牌，所述第三随机数和第三鉴权令牌为所述归一化数据管理网元根据所述终端的身份信息生成；
    所述接入网关网元向所述终端发送挑战请求消息，以发起CHAP鉴权，所述挑战请求消息中包括所述第三随机数和第三鉴权令牌，用于所述终端对网络侧鉴权；
    所述接入网关网元从所述终端接收挑战响应消息，所述挑战响应消息中包括第四随机数和第四鉴权令牌，所述第四随机数为所述终端生成，所述第四鉴权令牌为所述终端根据所述第三随机数、第四随机数和第三鉴权参数生成；
    所述方法还包括：
    所述接入网关网元向所述鉴权服务网元发送所述第四随机数和所述第四鉴权令牌，用于所述鉴权服务网元对所述终端进行鉴权，用于所述鉴权服务网元对所述终端鉴权。
  14. 根据权利要求1-13中任一项所述的方法，其特征在于，所述接入网关网元包括以下中的一个：固定网络接入网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。
  15. 一种固定网络的接入网关网元，其特征在于，包括：
    协商单元，用于与终端进行以太网上的点对点协议PPPoE协商，以与所述终端建立PPPoE会话；
    所述协商单元，还用于与所述终端协商PPPoE鉴权方式；
    发送单元，用于向移动网络的鉴权服务网元发送PPPoE鉴权参数，所述PPPoE鉴权参数用于所述鉴权服务网元对所述终端进行PPPoE鉴权；
    接收单元，用于接收来自所述鉴权服务网元的PPPoE鉴权结果，并向所述终端发送PPPoE鉴权结果消息，所述PPPoE鉴权结果消息中包括所述PPPoE鉴权结果。
  16. 根据权利要求15所述的网元，其特征在于，
    所述发送单元，具体用于向接入和移动性管理网元发送附着请求消息，所述附着请求消息中包括所述PPPoE鉴权参数，使得所述接入和移动性管理网元通过鉴权请求消息向所述鉴权服务网元发送所述PPPoE鉴权参数；
    所述接收单元，具体用于从所述接入和移动性管理网元接收附着接受消息，所述附着接受消息中包括所述PPPoE鉴权结果，所述PPPoE鉴权结果由所述接入和移动性管理网元从来自所述鉴权服务网元的鉴权响应消息中得到。
  17. 根据权利要求16所述的网元，其特征在于，所述附着请求消息和所述鉴权请求消息中还包括固网接入指示，所述固网接入指示用于所述鉴权服务网元确定使用PPPoE鉴权方法；或者，所述PPPoE鉴权参数还用于所述鉴权服务网元确定使用PPPoE鉴权方法。
  18. 根据权利要求15所述的网元，其特征在于，
    所述接收单元，还用于在所述接收单元接收来自所述鉴权服务网元的PPPoE鉴权结果之前，从所述接入和移动性管理网元接收安全模式命令SMC消息；
    所述发送单元，还用于向所述终端发送第一点对点协议PPP消息，所述第一PPP消息中包括所述SMC消息或者非接入层NAS加密激活参数；
    所述接收单元，还用于从所述终端接收第二PPP消息，所述第二PPP消息中包括SMC完成消息或者所述NAS加密激活参数；
    所述发送单元，还用于向所述接入和移动性管理网元发送所述SMC完成消息或者所述NAS加密激活参数。
  19. 根据权利要求16所述的网元，其特征在于，所述附着接受消息中还 包括SMC消息，所述鉴权响应消息中还包括所述SMC消息或者NAS加密激活参数，
    所述接收单元，还用于从所述终端接收第一网络控制协议NCP协商消息，所述第一NCP协商消息中包括SMC完成消息或者所述NAS加密激活参数；
    所述发送单元，还用于向所述接入和移动性管理网元发送所述SMC完成消息。
  20. 根据权利要求18或19所述的网元，其特征在于，
    所述发送单元，还用于向所述终端发送第二NCP协商消息，所述第二NCP协商消息中包括用于NAS消息传输的源互联网协议IP地址和目的IP地址，或者源媒体访问控制MAC地址和目的MAC地址。
  21. 根据权利要求15所述的网元，其特征在于，
    所述接收单元，还用于从所述终端接收第三NCP协商消息；
    所述发送单元，还用于向所述接入和移动性管理网元发送分组数据单元PDU会话建立请求消息，所述PDU会话建立请求消息包括用户标识和/或固网接入标识；
    所述接收单元，还用于从所述接入和移动性管理网元接收会话建立响应消息，所述会话建立响应消息中包括用于传输用户面数据包的IP地址以及服务质量QoS和/或计费策略，所述QoS和/或计费策略为会话管理网元根据所述用户标识和/或固网接入标识得到；
    所述发送单元，还用于向所述终端发送第四NCP协商消息，所述第四NCP协商消息中包括所述用于传输用户面数据包的IP地址。
  22. 根据权利要求15所述的网元，其特征在于，
    所述接收单元，还用于从所述终端接收第五NCP协商消息，所述第五NCP协商消息中包括SMC请求消息；
    所述发送单元，还用于向所述接入和移动性管理网元发送所述SMC请求消息；
    所述接收单元，还用于从所述接入和移动性管理网元接收SMC响应消息；
    所述发送单元，还用于向所述终端发送第六NCP协商消息，所述第六NCP协商消息中包括所述SMC响应消息。
  23. 根据权利要求22所述的网元，其特征在于，所述第六NCP协商消息中还包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。
  24. 根据权利要求15所述的网元，其特征在于，
    所述接收单元，还用于从所述终端接收第七NCP协商消息；
    所述发送单元，还用于向所述接入和移动性管理网元发送附着完成消息；
    所述接收单元，还用于从所述接入和移动性管理网元接收SMC消息；
    所述发送单元，还用于向所述终端发送第八NCP协商消息，所述第八 NCP协商消息中包括所述SMC消息；
    所述接收单元，还用于从所述终端接收SMC完成消息。
  25. 根据权利要求24所述的网元，其特征在于，所述接收单元，具体用于：
    从所述终端接收用户上行数据包，所述用户上行数据包中包括所述SMC完成消息，或者，
    从所述终端接收第九NCP协商消息，所述第九NCP协商消息中包括所述SMC完成消息，或者，
    当所述第八NCP协商消息包括用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址时，从所述终端接收SMC完成消息，所述SMC完成消息使用所述用于NAS消息传输的源IP地址和目的IP地址，或者源MAC地址和目的MAC地址。
  26. 根据权利要求15-25中任一项所述的网元，其特征在于，
    所述接收单元，还用于从所述终端接收链路控制协议LCP协商消息，以确定采用挑战握手鉴权协议CHAP鉴权流程；
    所述协商单元，具体用于生成第一随机数；
    所述发送单元，还用于向所述终端发送挑战消息，以发起CHAP鉴权，所述挑战请求消息中包括所述第一随机数；
    所述接收单元，还用于从所述终端接收挑战响应消息，所述挑战响应消息中包括第一鉴权令牌，所述第一鉴权令牌为所述终端根据所述第一随机数和第一鉴权参数生成；
    所述发送单元，还用于向所述鉴权服务网元发送所述第一随机数和所述第一鉴权令牌，用于所述鉴权服务网元对所述终端进行鉴权；
    所述接收单元，还用于接收来自所述鉴权服务网元的第二随机数和第二鉴权令牌，其中，所述第二鉴权令牌为所述鉴权服务网元根据所述第一随机数、第二随机数和第二鉴权参数生成；
    所述发送单元，还用于向所述终端发送所述第二随机数和所述第二鉴权令牌，用于所述终端对网络侧鉴权。
  27. 根据权利要求15-25中任一项所述的网元，其特征在于，
    所述接收单元，还用于从所述终端接收LCP协商消息，以确定采用CHAP鉴权流程，所述LCP协商消息中包括所述终端的身份信息；
    所述发送单元，还用于向归一化数据管理网元发送鉴权信息请求消息，所述鉴权信息请求消息中包括所述终端的身份信息；
    所述接收单元，还用于从所述鉴权服务网元接收鉴权信息响应消息，所述鉴权信息响应消息中包括第三随机数和第三鉴权令牌，所述第三随机数和第三鉴权令牌为所述归一化数据管理网元根据所述终端的身份信息生成；
    所述发送单元，还用于向所述终端发送挑战请求消息，以发起CHAP鉴权，所述挑战请求消息中包括所述第三随机数和第三鉴权令牌，用于所述终端对网络侧鉴权；
    所述接收单元，还用于从所述终端接收挑战响应消息，所述挑战响应消息中包括第四随机数和第四鉴权令牌，所述第四随机数为所述终端生成，所述第四鉴权令牌为所述终端根据所述第三随机数、第四随机数和第三鉴权参数生成；
    所述发送单元，还用于向所述鉴权服务网元发送所述第四随机数和所述第四鉴权令牌，用于所述鉴权服务网元对所述终端进行鉴权，用于所述鉴权服务网元对所述终端鉴权。
  28. 根据权利要求15-27中任一项所述的网元，其特征在于，所述接入网关网元包括以下中的一个：固定网络接入网络中的独立网元，固定网络的接入网络，宽带网络网关BNG/宽带移动接入服务器BRAS。
  29. 一种固定网络的接入网关网元，其特征在于，包括：处理器、存储器、总线和通信接口；所述存储器用于存储计算机执行指令，所述处理器与所述存储器通过所述总线连接，当所述网元运行时，所述处理器执行所述存储器存储的计算机执行指令，以使所述网元执行如权利要求1-14任意一项所述的方法。
  30. 一种计算机存储介质，其特征在于，包括指令，当其在计算机上运行时，使得所述计算机执行如权利要求1-14任意一项所述的方法。
PCT/CN2017/080826 2017-04-17 2017-04-17 接入固定网络的方法和接入网关网元 Ceased WO2018191854A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP17906028.0A EP3598693A1 (en) 2017-04-17 2017-04-17 Method for accessing fixed network and access gateway network element
CN201780061311.0A CN109792389A (zh) 2017-04-17 2017-04-17 接入固定网络的方法和接入网关网元
PCT/CN2017/080826 WO2018191854A1 (zh) 2017-04-17 2017-04-17 接入固定网络的方法和接入网关网元
US16/655,223 US20200053131A1 (en) 2017-04-17 2019-10-16 Method for accessing fixed network and access gateway network element

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/080826 WO2018191854A1 (zh) 2017-04-17 2017-04-17 接入固定网络的方法和接入网关网元

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/655,223 Continuation US20200053131A1 (en) 2017-04-17 2019-10-16 Method for accessing fixed network and access gateway network element

Publications (1)

Publication Number Publication Date
WO2018191854A1 true WO2018191854A1 (zh) 2018-10-25

Family

ID=63855455

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/080826 Ceased WO2018191854A1 (zh) 2017-04-17 2017-04-17 接入固定网络的方法和接入网关网元

Country Status (4)

Country Link
US (1) US20200053131A1 (zh)
EP (1) EP3598693A1 (zh)
CN (1) CN109792389A (zh)
WO (1) WO2018191854A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023001046A1 (zh) * 2021-07-19 2023-01-26 华为技术有限公司 一种通信方法及装置

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109429363B (zh) 2017-06-20 2021-04-20 华为技术有限公司 会话管理方法、及装置
CN109104448B (zh) 2017-06-20 2021-10-01 华为技术有限公司 会话管理方法、及装置
EP3846508B1 (en) * 2017-10-09 2025-10-01 Comcast Cable Communications, LLC Policy control for ethernet packet data
US12052787B2 (en) * 2018-03-28 2024-07-30 Cable Television Laboratories, Inc. Converged core communication networks and associated methods
CN111093262B (zh) * 2019-07-31 2024-07-05 中兴通讯股份有限公司 一种实现5g用户注册的方法、网元设备及存储介质
US11166326B2 (en) 2020-01-21 2021-11-02 Juniper Networks, Inc. Utilizing a transport protocol for fifth generation (5G) client devices to carry messages on wireline access
CN113747373B (zh) * 2020-05-28 2023-05-12 阿里巴巴集团控股有限公司 消息处理系统、装置和方法
CN114158028B (zh) * 2020-09-07 2025-04-01 中国移动通信有限公司研究院 数据网络鉴权方式适配方法、装置及可读存储介质
CN113206827B (zh) * 2021-03-29 2022-10-21 北京华三通信技术有限公司 报文处理方法及装置
CN114070604B (zh) * 2021-11-12 2023-06-20 中国联合网络通信集团有限公司 一种新型的网络认证方法、服务器和存储介质
US20240106701A1 (en) * 2022-09-26 2024-03-28 Plume Design, Inc. Automatically configuring a gateway device arranged in a network
CN115580836B (zh) * 2022-11-02 2025-08-22 中国联合网络通信集团有限公司 通信方法、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577915A (zh) * 2008-12-17 2009-11-11 中兴通讯股份有限公司 Dsl网络接入的认证方法以及系统
CN101645774A (zh) * 2008-08-07 2010-02-10 深圳华为通信技术有限公司 鉴权方法、装置及系统
CN101707773A (zh) * 2009-11-23 2010-05-12 中国电信股份有限公司 Wlan接入网关、移动网与无线宽带网的融合方法和系统
CN101729599A (zh) * 2009-11-20 2010-06-09 中国电信股份有限公司 移动终端利用宽带网络访问互联网的方法及系统
US20130142065A1 (en) * 2011-12-01 2013-06-06 Vodafone Ip Licensing Limited Routing telecommunications traffic

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103781073B (zh) * 2012-10-26 2018-10-19 中兴通讯股份有限公司 移动用户固网的接入方法及系统
CN103916853A (zh) * 2012-12-31 2014-07-09 中兴通讯股份有限公司 一种无线局域网中接入节点的控制方法及通信系统
CN103916854A (zh) * 2013-01-08 2014-07-09 中兴通讯股份有限公司 一种无线局域网络用户接入固定宽带网络的方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645774A (zh) * 2008-08-07 2010-02-10 深圳华为通信技术有限公司 鉴权方法、装置及系统
CN101577915A (zh) * 2008-12-17 2009-11-11 中兴通讯股份有限公司 Dsl网络接入的认证方法以及系统
CN101729599A (zh) * 2009-11-20 2010-06-09 中国电信股份有限公司 移动终端利用宽带网络访问互联网的方法及系统
CN101707773A (zh) * 2009-11-23 2010-05-12 中国电信股份有限公司 Wlan接入网关、移动网与无线宽带网的融合方法和系统
US20130142065A1 (en) * 2011-12-01 2013-06-06 Vodafone Ip Licensing Limited Routing telecommunications traffic

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3598693A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023001046A1 (zh) * 2021-07-19 2023-01-26 华为技术有限公司 一种通信方法及装置

Also Published As

Publication number Publication date
EP3598693A4 (en) 2020-01-22
CN109792389A (zh) 2019-05-21
US20200053131A1 (en) 2020-02-13
EP3598693A1 (en) 2020-01-22

Similar Documents

Publication Publication Date Title
WO2018191854A1 (zh) 接入固定网络的方法和接入网关网元
JP7421591B2 (ja) マシンツーマシン通信のためのネットワーク支援型ブートストラッピング
US7194763B2 (en) Method and apparatus for determining authentication capabilities
JP5934364B2 (ja) Ｓｏａｐ−ｘｍｌ技術を使用したｗｉ−ｆｉホットスポットのための安全なオンラインサインアップ及び提供のためのモバイルデバイス及び方法
US8800007B1 (en) VPN session migration across clients
CN108738019B (zh) 融合网络中的用户认证方法及装置
CN101682569B (zh) 用于在固定网络架构中漫游Wi-Fi接入的PANA
WO2018188082A1 (zh) 一种实现策略控制的方法、装置和系统
WO2019017837A1 (zh) 网络安全管理的方法及装置
CN113923650A (zh) 网络接入方法、装置和通信系统
CN108781216A (zh) 用于网络接入的方法和设备
US9215227B2 (en) Systems and methods for network communications
KR20100100641A (ko) 듀얼 모뎀 디바이스
CN107113319A (zh) 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
CN116368833A (zh) 针对边缘计算服务的安全连接的建立和认证的方法和系统
WO2012051868A1 (zh) 防火墙策略分发方法、客户端、接入服务器及系统
WO2010094244A1 (zh) 一种进行接入认证的方法、装置及系统
US20240388896A1 (en) Access network device selection method and apparatus
WO2013029381A1 (zh) 认证ip电话机和协商语音域的方法、系统以及设备
WO2012130048A1 (zh) 设备管理系统中对网关进行初始化的方法及装置
CN109819440A (zh) 鉴权的方法和装置
CN117413555A (zh) Wwc的多会话pap/chap支持
WO2024164968A1 (zh) 一种通信方法及通信装置
CN102143601A (zh) 宽带接入处理方法、无线接入网和通信系统
WO2010063190A1 (zh) 协商认证方式的方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17906028

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017906028

Country of ref document: EP

Effective date: 20191017