[go: up one dir, main page]

WO2023160390A1 - 通信方法与装置 - Google Patents

通信方法与装置 Download PDF

Info

Publication number
WO2023160390A1
WO2023160390A1 PCT/CN2023/074957 CN2023074957W WO2023160390A1 WO 2023160390 A1 WO2023160390 A1 WO 2023160390A1 CN 2023074957 W CN2023074957 W CN 2023074957W WO 2023160390 A1 WO2023160390 A1 WO 2023160390A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
interface
identifier
functional entity
indication information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/074957
Other languages
English (en)
French (fr)
Inventor
赵鹏涛
李岩
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of WO2023160390A1 publication Critical patent/WO2023160390A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements

Definitions

  • the present application relates to the communication field, and more specifically, to a communication method and device.
  • Edge computing refers to an open platform that integrates network, computing, storage, and application core capabilities on the side close to the source of objects or data, and provides the nearest end services. With edge computing, a differentiated service network can be provided from the center to the edge.
  • the edge computing platform or edge computing server
  • the user plane functional network elements such as user plane function (UPF) entities
  • UPF user plane function
  • the present application provides a communication method and device, which can improve the security of the communication system.
  • a communication method including: determining whether the first user plane function UPF entity is attacked; in the case that the first UPF entity is attacked, sending abnormal indication information to the first session management function SMF entity , the abnormality indication information is used to indicate that the first UPF entity is attacked, and the first SMF entity is connected to the first UPF entity.
  • the first SMF entity connected to the first UPF entity may indicate abnormal information to indicate that the first UPF entity is attacked, so that the first SMF entity may be related to the first UPF entity session reestablishment or user plane path adjustment to improve the security of the communication system.
  • the method further includes: acquiring connection information, where the connection information is used to indicate at least one UPF entity connected to each SMF entity in the at least one SMF entity, and the at least one The SMF entity includes the first SMF entity.
  • connection information is obtained, so as to determine the first SMF entity connected to the first UPF entity according to the connection information, so that the determination of the first SMF entity is easier.
  • the determining whether the first user plane function UPF entity is attacked includes: determining whether the first interface of the first UPF entity is abnormal, where the first interface is abnormal In case the first UPF entity is attacked.
  • the interface of the first UPF entity is abnormal, it is determined that the first UPF entity is attacked, so that the first UPF entity It is easier to judge that the entity is attacked.
  • connection information further includes an identifier of each interface in the at least one interface of the first UPF entity, and the at least one interface of the first UPF entity includes the an interface.
  • the connection information includes the identifier of each interface in the first UPF entity, so that the first UPF to which the abnormal interface belongs can be determined according to the identifier of the abnormal interface entity.
  • the acquiring connection information includes: receiving connection indication information sent by the first SMF entity, where the connection indication information is used to indicate the connection status of the first SMF entity. at least one said UPF entity.
  • connection information can be determined according to the connection indication information sent by each SMF entity. This makes it easier to obtain connection information.
  • the connection indication information includes the identifier of the second interface of the first SMF entity; the sending the abnormal indication information to the session management function SMF entity includes: according to the An identifier of the second interface, and sending the abnormal indication information.
  • the second interface of the first SMF entity may be an interface used by the first SMF entity to communicate with the device implementing the communication method of the first aspect. Therefore, the device implementing the communication method of the first aspect can address according to the identifier of the second interface of the first SMF entity, and send the abnormal indication information to the address of the addressing result, so that the abnormal indication information is sent to the first SMF entity .
  • connection indication information further includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for the connection between the first UPF entity and the first UPF entity.
  • An SMF entity connection where the abnormality indication information includes the identifier of the fourth interface.
  • the abnormal indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so as to facilitate subsequent processing by the first SMF entity.
  • the first SMF entity may disconnect from the first UPF entity according to the identifier of the fourth interface in the abnormal indication information.
  • the connection information includes an identifier of a third interface of the first SMF entity, and the third interface is used for the first SMF entity and the first UPF Entity connection
  • the method further includes: when the first UPF entity is abnormal, sending first request information to the network storage function NRF entity, where the first request information includes the identifier of the third interface; receiving The NRF entity sends first response information, and the first response information includes the identifier of the second interface of the first SMF entity; sending the abnormal indication information to the first session management function SMF entity includes: according to the An identifier of the second interface, and sending the abnormal indication information.
  • the identifier of the second interface of the first SMF entity may be requested to the NRF entity. Afterwards, abnormal indication information is sent to the first SMF entity according to the identifier of the second interface.
  • connection information is determined according to interaction information between the at least one UPF entity and the at least one SMF entity, where the first UPF entity and the at least one SMF entity
  • the first interaction information between the first SMF entities includes an identifier of the third interface and an identifier of each interface in at least one interface of the first UPF entity.
  • the identifier of the third interface of the first SMF may be determined according to the connection information and the identifier of the first interface.
  • the identification of the second interface of the first SMF may be requested from the NRF entity.
  • At least one interface of the first UPF entity includes a fourth interface, and the fourth interface is used to connect the first UPF entity to the first SMF entity,
  • the abnormal indication information includes the identifier of the fourth interface.
  • the abnormal indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so as to facilitate subsequent processing by the first SMF entity.
  • the method further includes: when the first UPF entity is abnormal, sending second request information to the unified database UDR entity, where the second request information includes the An identifier of the first UPF entity; receiving second response information sent by the UDR entity, where the second response information includes the identifier of the first SMF entity.
  • the identifier of the first SMF entity connected to the first UPF entity to which the abnormal interface belongs is obtained, so as to send abnormality indication information to the first SMF entity without storing the connection relationship between the UPF entity and the SMF entity.
  • the determining whether the first user plane function UPF entity is attacked includes: determining whether the first interface of the first UPF entity is abnormal, where the first interface is abnormal In the case where the first UPF entity is attacked; the identifier of the first UPF entity includes an identifier of an abnormal first interface in the first UPF entity.
  • the interface of the first UPF entity is abnormal, it is determined that the first UPF entity is attacked, so that it is easier to judge that the first UPF entity is attacked.
  • the identifier of the first interface is used as the identifier of the first UPF entity, and there is no need to carry out the UPF entity to which the first interface belongs. Judging, the UDR entity can determine the first SMF entity connected to the first UPF entity according to the identifier of the first interface. Therefore, the manner of determining the first SMF entity is simplified.
  • the identifier of the first SMF entity includes an identifier of a second interface of the first SMF entity, and sending the exception indication information to the first session management function SMF entity,
  • the method includes: sending the abnormal indication information according to the identifier of the second interface.
  • the UDR entity may determine the second interface of the first SMF entity connected to the first UPF entity according to the identifier of the first interface in the first UPF entity.
  • the second interface of the first SMF entity may be an interface used by the first SMF entity to communicate with the device implementing the communication method of the first aspect. Therefore, the device implementing the communication method of the first aspect can address according to the identifier of the second interface of the first SMF entity, and send the abnormal indication information to the address of the addressing result, so that the abnormal indication information is sent to the first SMF entity .
  • the second response information further includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for the first UPF entity to communicate with the The first SMF entity is connected, and the abnormal indication information includes the identifier of the fourth interface.
  • the abnormal indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so as to facilitate subsequent processing by the first SMF entity.
  • a communication device including: a processing module and a transceiver module; the processing module is used to determine Determine whether the first user plane function UPF entity is attacked; the transceiver module is configured to, in the case that the first UPF entity is attacked, send abnormal indication information to the first session management function SMF entity, and the abnormal indication information It is used to indicate that the first UPF entity is attacked, and the first SMF entity is connected to the first UPF entity.
  • the apparatus further includes an acquisition module, configured to acquire connection information, where the connection information is used to indicate the connection of each SMF entity in the at least one SMF entity.
  • the connection information is used to indicate the connection of each SMF entity in the at least one SMF entity.
  • At least one UPF entity the at least one SMF entity includes the first SMF entity.
  • the processing module is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF Entity is attacked.
  • connection information further includes an identifier of each interface in the at least one interface of the first UPF entity, and the at least one interface of the first UPF entity includes the an interface.
  • the obtaining module is specifically configured to receive connection indication information sent by the first SMF entity, where the connection indication information is used to indicate the connection information of the first SMF entity. at least one said UPF entity.
  • connection indication information includes an identifier of a second interface of the first SMF entity; the transceiver module is specifically configured to, according to the identifier of the second interface, send The abnormal indication information.
  • connection indication information further includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for the connection between the first UPF entity and the first UPF entity.
  • An SMF entity connection where the abnormality indication information includes the identifier of the fourth interface.
  • the connection information includes an identifier of a third interface of the first SMF entity, and the third interface is used for the first SMF entity and the first UPF
  • the transceiver module is further configured to, when the first UPF entity is abnormal, send first request information to the network storage function NRF entity, where the first request information includes the identifier of the third interface
  • the transceiver module is also used to receive the first response information sent by the NRF entity, and the first response information includes the identifier of the second interface of the first SMF entity; the transceiver module is specifically used to, according to the The identifier of the second interface is used to send the abnormal indication information.
  • connection information is determined according to interaction information between the at least one UPF entity and the at least one SMF entity, where the first UPF entity and the The first interaction information between the first SMF entities includes an identifier of the third interface and an identifier of each interface in at least one interface of the first UPF entity.
  • the transceiver module is further configured to, when the first UPF entity is abnormal, send second request information to the unified database UDR entity, and the second request information Including the identifier of the first UPF entity; the transceiver module is further configured to receive second response information sent by the UDR entity, where the second response information includes the identifier of the first SMF entity.
  • the processing module is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF The entity is attacked; the identifier of the first UPF entity includes an identifier of an abnormal first interface in the first UPF entity.
  • the identifier of the first SMF entity includes an identifier of a second interface of the first SMF entity, and the transceiver module is specifically configured to, according to the identifier of the second interface identify, send The abnormal indication information.
  • a communication method is provided, which is applied to a session management function SMF entity, and the method includes: receiving abnormal indication information sent by a security policy control function SPCF entity, and the abnormal indication information is used to indicate that the first UPF entity is attacked ; Disconnect from the first UPF entity.
  • the session management function SMF entity When the session management function SMF entity receives the abnormal indication information sent by the SPCF entity, it disconnects the connection with the first UPF entity, so as to provide the security of the communication system.
  • the method further includes: sending interface indication information to a network storage function NRF entity, where the interface indication information includes the identifier of the second interface of the SMF entity and the SMF The identifier of the third interface of the entity, the third interface is used for the connection between the SMF entity and the first UPF entity;
  • the abnormal indication information is the first response information sent by the SPCF entity according to the NRF entity sent, the first response information includes the identifier of the third interface, the first response information is sent by the NRF entity according to the first request information, and the first request information includes the identifier of the second interface ID, the first request information is sent by the SPCF entity when it is determined that the first UPF entity is attacked.
  • the SMF entity registers the identifier of the second interface of the SMF entity and the identifier of the third interface of the SMF entity in the NRF entity by sending interface indication information to the NRF entity. Therefore, when it is determined that the first UPF entity is abnormal, the SPCF entity may request the NRF entity for the second interface of the SMF entity according to the identifier of the third interface of the first SMF entity after determining the SMF entity connected to the first UPF entity. The ID of the interface. Afterwards, the SPCF entity may send abnormal indication information to the SMF entity according to the identifier of the second interface.
  • the method further includes: sending first connection indication information to the SPCF entity, where the first connection indication information is used to indicate at least one UPF connected to the SMF entity entities, the at least one UPF entity includes the first UPF entity.
  • the SPCF entity can determine the SMF entity connected to the attacked first UPF entity according to the first connection indication information.
  • the first connection indication information includes an identifier of a second interface of the first SMF entity, and the abnormal indication information is sent with the ID.
  • the second interface of the SMF entity may be an interface used by the SMF entity to communicate with the SPCF entity. Therefore, the SPCF entity can address according to the identifier of the second interface, and send the abnormality indication information to the address of the addressing result, so that the abnormality indication information is sent to the SMF entity.
  • the method further includes: sending second connection indication information to the unified database UDR entity, where the second connection indication information is used to indicate at least one UPF connected to the SMF entity entity, the at least one UPF entity includes the first UPF entity; the abnormal indication information is sent by the SPCF entity according to the second response information, and the second response information includes the identifier of the SMF entity, the The second response information is sent by the UDR entity according to the second request information, and the second request information includes the identifier of the first UPF entity; the second request information is that the SPCF entity determines that the first Sent when the UPF entity is attacked.
  • the SMF entity registers in the UDR entity at least one UPF entity connected to the SMF entity by sending the second connection indication information to the UDR entity.
  • the second connection indication information may include the identifier of the SMF entity and the identifier of each UPF entity in the at least one UPF entity.
  • the SPCF entity can send request information to the unified database UDR entity, acquire the identifier of the SMF entity connected to the first UPF entity to which the abnormal interface belongs, and send abnormal indication information to the SMF entity according to the identifier of the SMF entity.
  • the second connection indication information includes an identifier of the SMF entity, and the identifier of the SMF entity includes an identifier of a second interface of the SMF entity, and the abnormality indication The information is sent by the SPCF entity according to the identifier of the second interface.
  • the second connection indication information includes the identifier of the second interface of the SMF entity, so that the UDR entity can determine the second interface of the first SMF entity connected to the first UPF entity according to the identifier of the first interface in the first UPF entity .
  • the second interface of the SMF entity may be the interface used by the first SMF entity to communicate with the device implementing the communication method of the first aspect. Therefore, the SPCF entity can perform addressing according to the identifier of the second interface of the SMF entity, and send the abnormal indication information to the address of the addressing result, so that the abnormal indication information is sent to the SMF entity.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for the connection between the first UPF entity and the SMF entity connection, the second response information further includes the identifier of the fourth interface, and the abnormal indication information includes the identifier of the fourth interface.
  • the second connection indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so that the abnormal indication information may include the identification of the fourth interface, so that the first SMF entity can perform subsequent processing.
  • a communication method including: receiving interface indication information sent by a first SMF entity, where the interface indication information includes an identifier of a second interface of the first SMF entity and a second interface identifier of the first SMF entity.
  • the identification of three interfaces is used for the connection between the first SMF entity and the first UPF entity; receiving the first request information sent by the SPCF entity, the first request information includes the second interface The first request information is sent by the SPCF entity when it is determined that the first UPF entity is attacked; the first response information is sent to the SPCF entity, and the first response information includes the An identifier of a third interface, where the identifier of the third interface is used for the first SMF entity to send abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • a communication method including: receiving second connection indication information sent by a first SMF entity, where the second connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, the At least one UPF entity includes the first UPF entity; receiving second request information sent by the SPCF entity, where the second request information is sent by the SPCF entity when it is determined that the first UPF entity is attacked, and the The second request information includes the identifier of the first UPF entity; the second response information is sent to the SPCF entity, the second response information includes the identifier of the first SMF entity, and the identifier of the first SMF entity It is used for the first SMF entity to send abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the second connection indication information includes an identifier of the SMF entity, and the identifier of the SMF entity includes an identifier of a second interface of the SMF entity, and the abnormality indication The information is sent by the SPCF entity according to the identifier of the second interface.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for the connection between the first UPF entity and the SMF entity connection, the second response information further includes the identifier of the fourth interface, and the abnormal indication information includes the identifier of the fourth interface.
  • a communication device including an implementation for implementing any one of the fourth aspect to the sixth aspect The individual modules of the method in the method.
  • a communication device including a processor and a communication interface, the communication interface is used for the communication device to exchange information with other communication devices, and when the program instructions are executed in the at least one processor, so that The communication device executes the method in any one implementation manner of the first aspect, the fourth aspect to the sixth aspect.
  • a computer-readable medium stores program code for execution by a device, and the program code includes an implementation for executing any one of the first aspect, the fourth aspect to the sixth aspect methods in methods.
  • a computer program product containing instructions, and when the computer program product is run on a computer, it causes the computer to execute the method in any one of the implementation manners of the first aspect, the fourth aspect to the sixth aspect above .
  • a chip in a tenth aspect, includes a processor and a data interface, the processor reads instructions stored on the memory through the data interface, and executes the above-mentioned first aspect, the fourth aspect to the sixth aspect A method in any implementation of .
  • the chip may further include a memory, the memory stores instructions, the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the The processor is configured to execute the method in the first aspect or any one implementation manner of the fourth aspect to the sixth aspect.
  • the aforementioned chip may specifically be a field-programmable gate array (field-programmable gate array, FPGA) or an application-specific integrated circuit (application-specific integrated circuit, ASIC).
  • FPGA field-programmable gate array
  • ASIC application-specific integrated circuit
  • the method in the first aspect may specifically refer to the first aspect and the method in any of the various implementation manners in the first aspect.
  • FIG. 1 is a schematic diagram of a possible network architecture of an embodiment of the present application.
  • Fig. 2 is a schematic diagram of another possible network architecture of the embodiment of the present application.
  • Fig. 3 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • Fig. 4 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Fig. 6 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Fig. 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • Fig. 11 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, such as: global system for mobile communications (global system for mobile communications, GSM) system, code division multiple access (code division multiple access, CDMA) system, wideband code division multiple access (wideband code division multiple access, WCDMA) system, general packet radio service (general packet radio service, GPRS), long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE Time division duplex (time division duplex, TDD), universal mobile telecommunications system (universal mobile telecommunications system, UMTS), global interconnection microwave access (worldwide interoperability for microwave access, WiMAX) communication system, the future fifth generation (5th generation, 5G) system or new radio (new radio, NR), etc.
  • GSM global system for mobile communications
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • general packet radio service general packet radio service
  • GPRS general packet radio service
  • long term evolution long
  • FIG. 1 is a schematic diagram of a network architecture applicable to the communication method provided by the embodiment of the present application.
  • the network architecture 100 shown in FIG. 1 may specifically include one or more of the following network elements:
  • User equipment can be called terminal equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication equipment, User Agent or User Device.
  • the UE can also be a cellular phone, a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (wireless local loop, WLL) station, a personal digital assistant (personal digital assistant, PDA), having a wireless communication function Handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in future 5G networks or terminals in future evolved public land mobile network (PLMN) Devices, etc., can also be end devices, logical entities, smart devices, such as mobile phones, smart terminals and other terminal devices, or communication devices such as servers, gateways, base stations, and controllers, or Internet of Things devices, such as sensors, electricity meters, water meters, etc. Internet of things (IoT) devices.
  • the UE may also be a
  • Access network Provides network access functions for authorized users in a specific area, and can use transmission tunnels of different qualities according to user levels and business requirements.
  • the access network may be an access network using different access technologies.
  • 3GPP 3rd Generation Partnership Project
  • non-3GPP non-3G partnership Partnership project
  • 3GPP access technology refers to the access technology that conforms to the 3GPP standard specifications.
  • the access network using the 3GPP access technology is called a radio access network (Radio Access Network, RAN).
  • RAN radio access network
  • gNB Next generation Node Base station
  • a non-3GPP access technology refers to an access technology that does not comply with 3GPP standard specifications, for example, an air interface technology represented by an access point (access point, AP) in wifi.
  • An access network that implements access network functions based on wired communication technologies may be called a wired access network.
  • An access network that implements a network access function based on a wireless communication technology may be referred to as a radio access network (radio access network, RAN).
  • the wireless access network can manage wireless resources, provide access services for terminals, and complete the forwarding of control signals and user data between terminals and the core network.
  • the wireless access network can be, for example, a base station (NodeB), an evolved base station (evolved NodeB, eNB or eNodeB), a base station (gNB) in a 5G mobile communication system, a base station in a future mobile communication system, or an AP in a WiFi system, etc. It can also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN) scenario, or the access network device can be a relay station, an access point, a vehicle device, a wearable device, or a network in a future 5G network. network equipment or network equipment in the future evolved PLMN network.
  • the embodiment of the present application does not limit the specific technology and specific equipment form adopted by the radio access network equipment.
  • Access and mobility management function (access and mobility management function, AMF) entity mainly used for mobility management and access management, such as user location update, user registration network, user switching, etc.; can also be used to implement Functions other than session management in mobility management entity (mobility management entity, MME) functions, for example, functions such as lawful interception or access authorization (or authentication). In the embodiment of the present application, it can be used to implement functions of access and mobility management network elements.
  • AMF access and mobility management function
  • MME mobility management entity
  • Session management function session management function, SMF
  • Session management function entity: mainly used for session management (such as session establishment, modification, release, etc.), UE's Internet Protocol (internet protocol, IP) address allocation and management, and selection of manageable user planes function, policy control, or endpoint of charging function interface and downlink data notification, etc.
  • SMF session management function
  • IP Internet Protocol
  • a user plane function (UPF) entity namely, a data plane gateway. It can be used for packet routing and forwarding, or quality of service (QoS) processing of user plane data, etc.
  • User data can be accessed to a data network (data network, DN) through this network element. In the embodiment of this application, it can be used to realize the function of the user plane gateway.
  • Data network A network used to provide data transmission.
  • DN A network used to provide data transmission.
  • an operator's service network an Internet (Internet) network, a third-party service network, an Internet protocol address (internet protocol address, IP) multimedia service (IP Multi-media Service, IMS) network, and the like.
  • IP Internet protocol address
  • IMS IP Multi-media Service
  • a DN can be identified by a data network name (DNN) in a 5G network.
  • Authentication server function authentication server function, AUSF
  • AUSF authentication server function
  • Network exposure function network exposure function, NEF
  • NEF network exposure function
  • Network function (network function (NF) repository function, NRF) entity used to store the description information of the network function entity and the services it provides, and support service discovery, network element entity discovery and registration, etc.
  • Policy control function Policy control function
  • PCF Policy control function
  • Unified data management (UDM) entity used to handle user identification, access authentication, registration, or mobility management.
  • Application function Application function, AF entity: It is used for data routing affected by applications, accessing network elements with open functions, or interacting with policy frameworks for policy control, etc.
  • Unified data repository (UDR) entity Provides storage capabilities for contract data, policy data, and capability opening-related data.
  • Nausf is the service-based interface presented by AUSF
  • Namf is the service-based interface presented by AMF
  • Nsmf is the service-based interface presented by SMF
  • Nnef is the service-based interface presented by NEF
  • Nnrf is the service-based interface presented by NRF
  • Nudm is the service-based interface presented by UDM
  • Nudr is the service-based interface presented by UDR.
  • the N1 interface is the reference point between the terminal and the AMF entity; the N2 interface is the reference point between the AN and the AMF entity, and is used for sending non-access stratum (non-access stratum, NAS) messages, etc.; the N3 interface is (R)AN The reference point between the UPF entity and the UPF entity, used to transmit the data of the user plane N4 interface is the reference point between the SMF entity and the UPF entity, and is used to transmit information such as the tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages; N6 interface is between the UPF entity and the DN The reference point for transmitting user plane data, etc.
  • the name of the interface between network elements in FIG. 1 is just an example, and the name of the interface in a specific implementation may be another name, which is not specifically limited in this application.
  • the name of the message (or signaling) transmitted between the above network elements is only an example, and does not constitute any limitation on the function of the message itself.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example of a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network architecture capable of implementing the functions of the foregoing network elements is applicable to this embodiment of the present application.
  • Fig. 2 is a schematic diagram of a network architecture applicable to the communication method provided by the embodiment of the present application.
  • the network architecture 200 is based on a point-to-point interface.
  • the N13 interface is the reference point between the UDM entity and the AUSF entity
  • the N35 interface is the reference point between the UDM entity and the UDR entity
  • the N12 interface is the reference point between the AUSF and AMF entities
  • the N8 interface is between the UDM entity and the AMF entity Reference point
  • the N10 interface is the reference point between the UDM entity and the SMF entity
  • the N36 interface is the reference point between the UDR entity and the PCF entity
  • the N5 interface is the reference point between the PCF entity and the AF entity
  • the N15 interface is the PCF entity and the reference point between AMF entities.
  • the AMF network elements, SMF network elements, UPF network elements, UDR network elements, NEF network elements, AUSF network elements, NRF network elements, PCF network elements, and UDM network elements shown in Figure 1 and Figure 2 can all be understood as core Network elements used to implement different functions in the network, for example, can be combined into network slices on demand.
  • These network elements of the core network may be independent devices, or may be integrated into the same device to implement different functions, which is not limited in this application.
  • a device that performs the function of a network element of the core network may also be called a core network device or a network device.
  • Edge computing provides a differentiated service network from the center to the edge.
  • the migration of content, applications, and computing to the edge drives the development of edge computing.
  • the centralized deployment of the core network cannot meet the needs of new services.
  • the migration of the network to the edge along with the business flow is an industry trend.
  • the combination of edge computing and intelligent parks enables rapid deployment and realizes a closed-loop local business. With a more optimized network, it saves transmission for park users and ensures user experience.
  • the edge computing platform or edge computing server
  • the user plane functional network elements such as UPF
  • the security management capabilities of the internal computer rooms in the campus are weak, and there are risk of breach.
  • Attackers can attack the user plane and control plane of the mobile communication network by hijacking the UPF (for example, physically sneaking into the corresponding computer room), causing risks in the communication network.
  • an embodiment of the present application provides a communication method.
  • Fig. 3 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 300 may be executed by a security policy control function (security policy control function, SPCF) entity or other network elements.
  • the method 300 includes S310 to S320.
  • the first SMF entity connected to the first UPF entity can be abnormally indicated to indicate that the first UPF entity is attacked, so that the first SMF entity can communicate with the first UPF entity.
  • Sessions related to UPF entities perform session reestablishment or user plane path adjustment to improve the security of the communication system.
  • connection information before performing S310, connection information may be obtained, where the connection information is used to indicate at least one UPF entity connected to each SMF entity in the at least one SMF entity, and the at least one SMF entity includes the first SMF entity.
  • the first SMF entity connected to the first UPF entity may be determined according to the connection information, so that abnormality indication information can be sent to the first SMF entity at S320.
  • the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF entity is attacked.
  • connection information may further include an identifier of each interface in the at least one interface of the first UPF entity, and the at least one interface of the first UPF entity includes the first interface.
  • first interface may be any interface in the first UPF entity.
  • an identifier of each interface in at least one interface of the first UPF entity may also be acquired.
  • the first interface of the first UPF entity is abnormal, it may be determined that the first UPF entity is attacked according to the identifier of the first interface.
  • connection information may be determined according to the connection indication information sent by each SMF entity, or the connection information may be determined according to the interaction information between each UPF entity and the connected SMF entity.
  • the connection indication information sent by the first SMF entity may be received, and the connection indication information sent by the first SMF entity is used to indicate that the first SMF entity is connected At least one UPF entity of the .
  • the connection information After receiving the connection indication information sent by each SMF entity, the connection information can be determined according to the connection indication information sent by at least one SMF entity.
  • the connection indication information sent by the first SMF entity also includes the identifier of the second interface of the first SMF entity.
  • the abnormality indication information may be sent to the first SMF entity according to the identifier of the second interface.
  • the second interface of the first SMF entity may be an interface used by the first SMF entity to communicate with the SPCF entity. Therefore, at S320, the abnormality indication information may be sent according to the identifier of the second interface of the first SMF entity.
  • the connection indication information sent by the first SMF entity may also include the identifier of the fourth interface of the first UPF entity.
  • the fourth interface of the first UPF entity may be, for example, an N4 interface, which is used for connecting the first UPF entity to the first SMF entity.
  • the abnormal indication information may include the identifier of the fourth interface of the first UPF entity.
  • the abnormal indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so as to facilitate subsequent processing by the first SMF entity.
  • the first SMF entity may, according to the fourth connection in the abnormal indication information The identifier of the port, and the connection with the first UPF entity is disconnected.
  • the connection information may include the identifier of the third interface of the first SMF entity, and the third interface of the first SMF entity is used for the first SMF An entity's connection to a first UPF entity.
  • the first request information may be sent to the NRF entity.
  • the first request information includes the identifier of the third interface.
  • the first response information sent by the NRF entity may be received.
  • the first response information includes the identifier of the second interface of the first SMF entity.
  • abnormality indication information may be sent according to the identifier of the second interface.
  • the third interface used by the first SMF entity for connection with the first UPF entity may be the N4 interface of the first SMF entity.
  • the second interface of the first SMF entity may be an interface used by the first SMF entity to connect with the SPCF entity, for example, may be a service interface of the first SMF entity.
  • the NRF entity may be requested for the identifier of the second interface of the first SMF entity. Afterwards, abnormal indication information is sent to the first SMF entity according to the identifier of the second interface.
  • connection information may be determined according to interaction information between the at least one UPF entity and the at least one SMF entity.
  • the first interaction information between the first UPF entity of the at least one UPF entity and the first SMF entity of the at least one SMF entity may include the identifier of the third interface, and may include at least one of the first UPF entity An ID for each of the interfaces.
  • the identifier of the third interface of the first SMF may be determined according to the connection information and the identifier of the first interface.
  • the identification of the second interface of the first SMF may be requested from the NRF entity.
  • a security policy enhancement function may acquire information received or sent by at least one UPF entity.
  • the interaction information between the UPF entity and the SMF entity may include the identifier of each interface in the UPF entity, and the identifier of the interface used by the SMF entity to connect with the UPF entity.
  • the SPEF entity may send the identifier of the interface used by the SMF entity to connect with the UPF entity and the identifiers of the interfaces of the UPF entity connected to the SMF entity to the SPCF according to the interaction information between the UPF entity and the SMF entity.
  • the SPEF may acquire the first interaction information, and send the identifier of the third interface and the identifier of each interface in at least one interface of the first UPF entity to the SPCF entity.
  • the SPCF entity can determine the connection information according to the information sent by the SPEF.
  • At least one interface of the first UPF entity includes a fourth interface, the fourth interface is used to connect the first UPF entity to the first SMF entity, and the abnormal indication information includes an identifier of the fourth interface.
  • the first interaction information between the first UPF entity and the first SMF entity may include an identifier of the third interface and an identifier of the fourth interface. Therefore, the abnormality indication information may include the identifier of the fourth interface.
  • the fourth interface of the first UPF entity is used to connect the first UPF entity to the first SMF entity, for example, may be an N4 interface of the first UPF entity.
  • the identifier of the fourth interface in the abnormal indication information may be used to indicate the first UPF entity.
  • the abnormal indication information includes the identification of the fourth interface used by the first UPF entity to connect with the first SMF entity, so as to facilitate subsequent processing by the first SMF entity.
  • the first SMF entity may disconnect from the first UPF entity according to the identifier of the fourth interface in the abnormal indication information. That is to say, the first SMF entity is disconnected from the identification indication of the fourth interface connection of the fourth interface, that is, the connection with the first UPF entity is disconnected.
  • the second request information may be sent to the UDR entity.
  • the second request information includes the identifier of the first UPF entity.
  • the second response information sent by the UDR entity may be received.
  • the second response information includes the identifier of the first SMF entity.
  • the UDR entity may send the second request information after receiving the second response information.
  • the second response information may be understood as response information of the second request information.
  • the first interface of the first UPF entity is abnormal.
  • the first interface of the first UPF entity is abnormal, which may be understood as the first UPF entity being attacked.
  • the identifier of the first UPF entity includes the identifier of the abnormal first interface in the first UPF entity.
  • the second request information may include the identifier of the first interface in the first UPF entity.
  • the UDR entity may determine the first SMF entity connected to the first UPF entity according to the identifier of the first interface.
  • the identifier of the first SMF entity may include the identifier of the second interface of the first SMF entity.
  • abnormality indication information may be sent according to the identifier of the second interface of the first SMF entity.
  • the UDR entity may determine the second interface of the first SMF entity connected to the first UPF entity according to the identifier of the first interface in the first UPF entity.
  • the second interface of the first SMF entity is used to connect the first SMF entity with the SPCF entity, for example, the second interface of the first SMF entity may be a service interface of the first SMF entity.
  • the second response information sent by the UDR entity may include the identifier of the second interface of the first SMF entity. Therefore, at S320, sending the abnormality indication information according to the identifier of the second interface of the first SMF entity may cause the abnormality indication information to be sent to the first SMF entity.
  • the second response information may also include the identifier of the fourth interface of the first UPF entity.
  • the fourth interface of the first UPF entity is used to connect the first UPF entity to the first SMF entity, and the abnormal indication information includes an identifier of the fourth interface of the first UPF entity.
  • the fourth interface of the first UPF entity is used to connect the first UPF entity to the first SMF entity, for example, may be an N4 interface of the first UPF entity.
  • the identifier of the fourth interface in the abnormal indication information may be used to indicate the first UPF entity.
  • the abnormal indication information includes the identifier of the fourth interface of the first UPF entity, which is convenient for the first SMF entity to perform subsequent processing.
  • the first SMF entity may disconnect from the first UPF entity according to the identifier of the fourth interface in the abnormal indication information. That is to say, the first SMF entity disconnects from the fourth interface indicated by the identifier of the fourth interface, that is, disconnects from the first UPF entity.
  • the abnormality indication information may include the identifier of the fourth interface. In the case that the abnormal first interface in the first UPF entity is the fourth interface of the first UPF entity, the abnormality indication information may include or not include the identifier of the fourth interface.
  • Fig. 4 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 400 includes S401 to S413.
  • the first SMF entity sends network function registration information to the NRF entity.
  • the network function registration information may include the network function (network function, NF) type (NF type) of the first SMF entity, the NF instance (instance) identification (identification, ID) of the first SMF entity, the first SMF The identifier of the service interface of the entity and the identifier of the N4 interface of the first SMF entity.
  • NF network function
  • ID identification
  • the network function registration information may include a network function (network function, NF) type (NF type), an NF instance (instance) identification (identification, ID), an identification of the N4 interface of the SMF entity, and an SMF entity used to communicate with An identifier of an interface through which other network elements in the network architecture 200 communicate.
  • NF network function
  • ID NF instance
  • ID an identification of the N4 interface of the SMF entity
  • SMF entity's The identifier of the N4 interface may be the same as or different from the identifiers of other interfaces.
  • the NF type of the first SMF entity is used to indicate the type of the network element that sends the network function registration information, that is, indicates that the type of the first SMF entity is SMF.
  • the NF instance ID of the first SMF entity is used to indicate the first SMF entity.
  • the service interface identifier of the first SMF entity may be a fully qualified domain name (fully qualified domain name, FQDN) or IP address of the service interface of the first SMF entity, which is used to indicate the service interface of the first SMF entity.
  • the identifier of the N4 interface of the first SMF entity may be the FQDN or IP address of the N4 interface of the first SMF entity, and is used to indicate the N4 interface of the first SMF entity.
  • the method 400 is described by taking the network architecture 100 as an example.
  • the NRF entity sends registration response information to the first SMF entity.
  • the registration response information is used to indicate that the registration of the network function is successful.
  • the SPEF entity detects information related to establishing the N4 coupling between the first SMF entity and the first UPF entity.
  • the SPEF entity may acquire the interaction information of each UPF entity in at least one UPF entity interacting with the SMF entity.
  • the at least one UPF entity includes a first UPF entity.
  • the SMF entity that establishes N4 coupling with the first UPF entity is the first SMF entity.
  • the first UPF entity may be any one of the at least one UPF entity.
  • the message exchanged between the UPF entity and the SMF entity contains the identification of the N4 interface of the SMF entity and the N4 interface of the UPF entity. logo.
  • the SPEF entity may determine the correspondence information 1 according to the information exchanged between each UPF entity and the SMF entity in at least one UPF entity.
  • the identifier of the N4 interface of each SMF entity corresponds to the identifier of the N4 interface of at least one UPF entity, and there is an N4 coupling between the UPF entity and the SMF entity, that is, the N4 interface of the UPF entity and the SMF entity Physical N4 interface connection.
  • the SPEF entity sends correspondence information 1 to the SPCF.
  • the SPEF entity detects information related to session establishment and session modification between the first SMF entity and the first UPF entity.
  • the interaction information between the SMF entity and the UPF entity carries the N3 interface identifier and the N9 interface identifier of the UPF entity, which are used to identify Configure the N3 interface and N9 interface of the UPF entity.
  • the SPEF entity may determine the correspondence information 2 according to the information exchanged between each UPF entity and the SMF entity in at least one UPF entity.
  • Correspondence information 2 is used to indicate the correspondence between the identifier of the N4 interface of each UPF entity and the identifier of the N3 interface and the identifier of the N9 interface of the UPF.
  • the SPEF entity sends correspondence information 2 to the SPCF.
  • the SPEF entity judges whether the interface of the first UPF entity is abnormal.
  • the SPEF entity may detect each interface of each UPF entity in at least one UPF entity, so as to determine whether there is an abnormal interface.
  • S407 may be performed multiple times. Exemplarily, S407 may be performed periodically.
  • the first UPF entity may be any one of the at least one UPF entity.
  • the SPEF entity sends the abnormal interface information to the SPCF entity.
  • the abnormal interface information includes the identifier of the abnormal interface in the first UPF entity.
  • the SPCF entity may determine that the first UPF entity is untrustworthy, that is, the first UPF entity is attacked.
  • the SPCF entity can determine the identification of the N4 interface of the SMF entity corresponding to the identification of the abnormal interface in the UPF entity according to the correspondence information 1 .
  • the SPCF entity can determine the identifier of the N4 interface of the first UPF entity according to the correspondence information 2, and according to the correspondence information 1 Determine the identifier of the N4 interface of the first SMF entity connected to the N4 interface of the first UPF entity.
  • the SPCF entity sends interface query information to the NRF entity.
  • the interface query information may include the identifier of the N4 interface of the first SMF entity.
  • the NRF entity sends interface response information to the SPCF entity.
  • the interface response information includes the identifier of the service interface of the first SMF entity.
  • Each SMF entity may send network function registration information to the NRF entity after being powered on. According to the network function registration information sent by each SMF entity, the NRF entity can determine the corresponding relationship between the identifier of the N4 interface and the identifier of the service interface in the SMF entity.
  • the SPCF entity sends abnormal indication information according to the identifier of the service interface of the first SMF entity.
  • the SPCF entity may address the identifier of the service-oriented interface of the first SMF entity, and send abnormal indication information to the address indicated by the addressing result. Therefore, the abnormality indication information can be sent to the first SMF entity.
  • the abnormal indication information is used to indicate that the interface of the first UPF entity is abnormal.
  • the first SMF entity may process services related to the first UPF entity according to the abnormal indication information.
  • the first SMF entity may perform S412 and S413.
  • the first SMF entity disconnects the N4 coupling with the N4 interface of the first UPF entity.
  • the abnormal indication information may also include the identifier of the N4 interface in the first UPF entity.
  • the first SMF entity may disconnect the connection indicated by the identifier of the abnormal indication information, thereby disconnecting the N4association with the first UPF entity.
  • the first SMF entity may perform session reestablishment or session user plane path adjustment under the condition that a session exists with the first UPF entity.
  • the first SMF entity may perform session re-establishment under the condition that the N4 coupling with the N4 interface of the first UPF entity is disconnected. Alternatively, when the first SMF entity disconnects the N4 coupling with the N4 interface of the first UPF entity, it may determine whether to perform session reestablishment according to the role of the first UPF entity in the session. It should be understood that the session may be a protocol data unit (protocol data unit, PDU) session.
  • PDU protocol data unit
  • the first SMF entity When the first SMF entity determines that the first UPF entity is the relay UPF (intermediate UPF, I-UPF) of the session, it may perform user plane path adjustment of the session, thereby using other UPF entities other than the first UPF entity as I-UPF.
  • I-UPF intermediate UPF
  • the first SMF entity determines that the first UPF entity is the PDU session anchor point UPF (UPF of PDU session Anchor, PSA-UPF) of the session, it can perform session re-establishment, so that other UPFs other than the first UPF entity Entity as PSA-UPF.
  • UPF PDU session anchor point UPF of PDU session Anchor
  • the NRF entity provides network function registration and query services
  • the SPEF entity detects the corresponding The relationship information 1 and the corresponding relationship information 2 are reported to the SPCF entity, wherein the corresponding relationship information 1 is used to indicate the corresponding relationship between the UPF entity with N4 coupling and the N4 interface of the SMF entity, and the corresponding relationship information 2 is used to indicate the UPF entity The corresponding relationship between the N4 interface, the N3 interface, and the N9 interface in .
  • the SPCF entity determines the identifier of the N4 interface of the first SMF entity that has N4 coupling with the first UPF entity according to the correspondence information 1 and the correspondence information 2, And use the identifier of the N4 interface of the first SMF entity to query the NRF entity to obtain the identifier of the service interface of the first SMF. Afterwards, the SPCF entity may send abnormal indication information according to the identifier of the service interface of the first SMF, so as to indicate to the first SMF entity that the first UPF entity is attacked. Therefore, the first SMF entity can perform corresponding processing to ensure communication security.
  • the SPEF entity may detect disconnection-related interaction information between the first SMF entity and the first UPF entity.
  • the SPEF entity may send connection disconnection indication information to the SPCF.
  • the disconnection indication information is used to indicate that the identifier of the N4 interface of the first SMF entity does not have a corresponding relationship with the identifier of the N4 interface of the first UPF entity, that is, the N4 interface of the first SMF entity and the N4 interface of the first UPF entity have been disconnected. Open the connection.
  • the connection disconnection indication information may include the identifier of the N4 interface of the first SMF entity and the identifier of the N4 interface of the first UPF entity. Therefore, the SPCF entity can update the correspondence information 1 .
  • the SPCF entity may update the corresponding relationship information 1 .
  • the identifier of the N4 interface of the first SMF entity in the updated correspondence information 1 does not have a corresponding relationship with the identifier of the N4 interface of the first UPF entity.
  • the SPCF entity may mark the correspondence information 1 to indicate that the abnormality indication information has been sent to the first SMF entity.
  • Fig. 5 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 500 includes S501 to S509.
  • the first SMF entity establishes an N4 coupling with the first UPF entity.
  • the N4 interface of the first SMF entity establishes a connection with the N4 interface of the first UPF entity.
  • the information of the interaction between the first SMF entity and the first UPF entity carries the identifier of the N4 interface of the first UPF entity.
  • the first SMF entity sends association information 1 to the SPCF entity.
  • the association information 1 includes the identifier of the service interface of the first SMF entity, the identifier of the N4 interface of the first SMF entity, and the identifier of the N4 interface of the first UPF entity.
  • the first SMF entity establishes or modifies a session with the first UPF entity.
  • the information that the first UPF entity interacts with the first SMF entity carries the identifier of the N3 interface of the first UPF entity and/or the identifier of the N9 interface.
  • the identifier is used to configure the N3 interface and/or the N9 interface of the first UPF entity.
  • the first SMF entity sends association information 2 to the SPCF entity.
  • the association information 2 includes the identifier of the N4 interface of the first UPF entity, and the identifier of the N3 interface and/or the identifier of the N9 interface of the first UPF entity.
  • the SPCF entity may receive association information 1 and association information 2 sent by at least one SMF entity.
  • the at least one SMF entity includes a first SMF entity.
  • the SPEF entity may determine whether the interface of the first UPF entity is abnormal.
  • the SPEF entity can detect the interface of at least one UPF entity. Specifically, the SPEF entity may acquire information about communication between each interface in each UPF entity in at least one UPF entity and other network elements. And determine whether each interface is abnormal according to the information.
  • the information that any interface in each UPF entity communicates with other network elements may include the identifier of the interface.
  • the at least one UPF entity includes a first UPF entity.
  • S505 can be performed multiple times. Exemplarily, S505 may be performed periodically.
  • S506 may be performed.
  • the SPEF entity may send the abnormal interface information to the SPCF entity.
  • the SPCF entity may determine the service interface of the SMF associated with the abnormal interface in the first UPF entity according to the association information 1 .
  • the abnormal interface information includes the identifier of the abnormal interface in the first UPF entity.
  • the SPCF entity may determine the identity of the service interface of the first SMF that has N4 coupling with the first UPF entity according to the association information 1.
  • the SPCF entity can determine the first SMF that has N4 coupling with the first UPF entity according to the association information 1 and association information 2 Identification of the N4 interface.
  • the SPCF entity can determine the identifier of the N4 interface of the first UPF entity according to the association information 2; the SPCF entity can determine the identity of the service interface of the first SMF that has N4 coupling with the first UPF entity according to the association information 1 logo.
  • the SPCF entity sends abnormal indication information according to the identifier of the service interface of the first SMF entity.
  • the first SMF entity disconnects the N4 coupling with the N4 interface of the first UPF entity.
  • the first SMF entity may perform session reestablishment or session user plane path adjustment under the condition that a session exists with the first UPF entity.
  • S507 to S509 may be similar to S411 to S413, and for details, refer to the description of S411 to S413 in FIG. 4 .
  • the first SMF entity sends association information 1 and association information 2 to the SPCF entity
  • association information 1 is used to indicate the association relationship between the service interface of the first SMF entity and the N4 interface of the first UPF entity
  • association information 2 is used for Indicates the association relationship between the N4 interface of the first UPF entity, the N3 interface and the N9 interface of the first UPF entity.
  • the SPCF entity determines that there is a service interface of the first SMF entity N4 coupled to the first UPF entity to which the abnormal interface reported by the SPEF entity belongs.
  • the SPCF entity sends abnormal indication information according to the service interface, so as to notify the first SMF entity that the first UPF entity is attacked and cannot be trusted.
  • the first SMF entity can perform corresponding processing to ensure communication security.
  • the first SMF entity may release the N4 coupling with the first UPF entity according to the abnormal indication information, and may perform session reestablishment or user plane path adjustment according to session requirements.
  • the SPEF entity may detect that the first SMF entity and the first UPF entity are related to the disconnection interactive information.
  • the SPEF entity may send connection disconnection indication information to the SPCF.
  • the disconnection indication information is used to indicate that the identifier of the N4 interface of the first SMF entity does not have a corresponding relationship with the identifier of the N4 interface of the first UPF entity, that is, the first SMF
  • the N4 interface of the entity has been disconnected from the N4 interface of the first UPF entity.
  • the connection disconnection indication information may include the identifier of the N4 interface of the first SMF entity and the identifier of the N4 interface of the first UPF entity. Therefore, the SPCF entity can update the correspondence information 1 .
  • the first SMF entity may send connection disconnection indication information to the SPCF entity.
  • the disconnection indication information is used to indicate that the identifier of the N4 interface of the first SMF entity does not have a corresponding relationship with the identifier of the N4 interface of the first UPF entity, that is, the N4 interface of the first SMF entity and the N4 interface of the first UPF entity have been disconnected. Open the connection. Therefore, the SPCF entity can update the correspondence information 1 .
  • the SPCF entity may update the corresponding relationship information 1 .
  • the identifier of the N4 interface of the first SMF entity in the updated correspondence information 1 does not have a corresponding relationship with the identifier of the N4 interface of the first UPF entity.
  • the SPCF entity may mark the correspondence information 1 to indicate that the abnormal indication information has been sent to the first SMF entity.
  • Fig. 6 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 600 includes S601 to S611.
  • the first SMF entity establishes an N4 coupling with the first UPF entity.
  • the information of the interaction between the first SMF entity and the first UPF entity carries the identifier of the N4 interface of the first UPF entity.
  • the first SMF entity sends association information 1 to the UDR entity.
  • the association information 1 includes the identifier of the service interface of the first SMF entity, the identifier of the N4 interface of the first SMF entity, and the identifier of the N4 interface of the first UPF entity.
  • the first SMF entity establishes or modifies a session with the first UPF entity.
  • the information that the first UPF entity interacts with the first SMF entity carries the identifier of the N3 interface of the first UPF entity and/or the identifier of the N9 interface. logo.
  • the first SMF entity sends association information 2 to the UDR entity.
  • the association information 2 includes the identifier of the N4 interface of the first UPF entity, and the identifier of the N3 interface and/or the identifier of the N9 interface of the first UPF entity.
  • the SPCF entity may receive association information 1 and association information 2 sent by at least one SMF entity.
  • the at least one SMF entity includes a first SMF entity.
  • the SPEF entity may determine whether the interface of the first UPF entity is abnormal.
  • the SPEF entity can detect the interface of at least one UPF entity. Specifically, the SPEF entity may acquire information about communication between each interface in each UPF entity in at least one UPF entity and other network elements. And determine whether each interface is abnormal according to the information.
  • the information that any interface in each UPF entity communicates with other network elements may include the identifier of the interface.
  • the at least one UPF entity includes a first UPF entity.
  • S605 can be performed multiple times. Exemplarily, S605 may be performed periodically.
  • S606 may be performed.
  • the SPEF entity may send the abnormal interface information to the SPCF entity.
  • the abnormal interface information includes the identifier of the abnormal interface in the first UPF entity.
  • the SPCF entity sends network element query information to the UDR entity.
  • the network element query information includes the identifier of the abnormal interface in the first UPF entity.
  • the network element query information may also include a target entity type identifier, where the target entity type identifier is used to indicate that the type of the queried entity is SMF.
  • the UDR entity may determine the service interface of the SMF associated with the abnormal interface in the first UPF entity according to the association information 1 .
  • the SPCF entity may determine the identifier of the service interface of the first SMF that has N4 coupling with the first UPF entity according to the association information 1.
  • the SPCF entity can determine the first SMF that has N4 coupling with the first UPF entity according to the association information 1 and association information 2 Identification of the N4 interface.
  • the SPCF entity can determine the identifier of the N4 interface of the first UPF entity according to the association information 2; the SPCF entity can determine the identity of the service interface of the first SMF that has N4 coupling with the first UPF entity according to the association information 1 logo.
  • the UDR entity sends the network element response information to the SPCF entity.
  • the network element response information includes the identifier of the service interface of the first SMF.
  • the network element response information may also include the identifier of the N4 interface of the first UPF entity.
  • the network element response information sent by the UDR entity includes the identifier of the N4 interface of the first UPF entity; the UDR entity determines that the received network element query information
  • the network element response information sent by the UDR entity may or may not include the identifier of the N4 interface of the first UPF entity.
  • the SPCF entity sends abnormal indication information according to the identifier of the service interface of the first SMF entity.
  • the first SMF entity disconnects the N4 coupling with the N4 interface of the first UPF entity.
  • the first SMF entity may perform session re-establishment or user plane path adjustment of the session when there is a session with the first UPF entity.
  • S609 to S611 may be similar to S411 to S413, and for details, refer to the description of S411 to S413 in FIG. 4 .
  • the first SMF entity registers association information 1 and association information 2 in the UDR entity.
  • Association information 1 is used to indicate the association relationship between the service interface of the first SMF entity and the N4 interface of the first UPF entity
  • association information 2 is used to indicate the N4 interface of the first UPF entity and the N3 interface and N9 interface of the first UPF entity relationship.
  • the SPCF entity sends the identifier of the abnormal interface reported by the SPEF entity to the UDR entity.
  • the UDR entity sends to the SPCF entity the identifier of the service interface of the first SMF entity N4 coupled with the first UPF entity to which the abnormal interface belongs.
  • the SPCF entity sends abnormal indication information according to the identifier of the service interface, so as to notify the first SMF entity that the first UPF entity is under attack and cannot be trusted. Therefore, the first SMF entity can perform corresponding processing to ensure communication security.
  • the entity may send connection disconnection indication information to the UDR entity.
  • the disconnection indication information may include the identifier of the N4 interface of the first SMF entity and the identifier of the N4 interface of the first UPF entity, and the disconnection indication information is used to instruct the first SMF entity to disconnect the N4 coupling with the first UPF entity.
  • the UDR entity may delete the associated information 1 according to the connection disconnection indication information.
  • the SPCF entity may send the connection disconnection indication information to the UDR entity to instruct the UDR entity to delete the association information 1 .
  • the SPCF entity may send notification indication information to the UDR entity, and the notification indication information is used to indicate that the SPCF entity has sent the abnormality indication information to the first SMF entity Instructions.
  • Fig. 7 is a schematic flowchart of a communication method provided by the embodiment of the application.
  • the method 700 includes S710 to S720.
  • Method 700 may be performed by a first SMF entity.
  • At S710 receive abnormal indication information sent by the security policy control function SPCF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the first SMF entity When receiving the abnormal indication information sent by the SPCF entity, the first SMF entity disconnects the connection with the first UPF entity, so as to provide the security of the communication system.
  • connection between the first SMF entity and the first UPF entity may be an N4 association (N4association) between the first SMF entity and the first UPF entity.
  • the first SMF entity may send interface indication information to the NRF entity.
  • the interface indication information includes the identifier of the second interface of the first SMF entity and the identifier of the third interface of the first SMF entity.
  • the third interface is used for the connection between the first SMF entity and the first UPF entity.
  • the abnormal indication information is sent by the SPCF entity according to the first response information sent by the NRF entity, the first response information includes the identifier of the third interface, and the first response information is the NRF entity
  • the first request information is sent according to the first request information, where the first request information includes the identifier of the second interface, and the first request information is sent by the SPCF entity when the first UPF entity is attacked.
  • the SPCF entity may determine the third interface of the first SMF entity connected to the first UPF entity when the first UPF entity is attacked. Afterwards, the SPCF entity may send first request information to the NRF entity, where the first request information includes the identifier of the third interface. The SPCF entity may receive the first response information sent by the NRF entity, where the first response information includes the identifier of the second interface of the first SMF entity. Therefore, the SPCF entity may send the abnormal indication information according to the identifier of the second interface, so that the abnormal indication information is sent to the first SMF entity.
  • the interface indication information may be carried in the network function registration information in FIG. 4 .
  • the first request information may be the interface query information in FIG. 4 .
  • the second response information may be the query response information in FIG. 4 .
  • the first SMF entity may send first connection indication information to the SPCF entity, where the first connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, and the at least one UPF entity A first UPF entity is included.
  • the SPCF entity may receive first connection indication information sent by at least one SMF entity.
  • the at least one SMF entity includes a first SMF entity. Therefore, the SPCF entity may determine that the SMF entity connected to the first UPF entity is the first SMF entity.
  • the first connection indication information may include the identifier of the second interface of the first SMF entity, and the abnormality indication information is sent by the SPCF entity according to the identifier of the second interface.
  • the first connection indication information may include association information 1 and association information 2 shown in FIG. 5 .
  • the first SMF entity may send second connection indication information to the UDR entity, where the second connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, and the at least one UPF entity Including the first UPF entity.
  • the abnormal indication information is sent by the SPCF entity according to the second response information, the second response information includes the identifier of the first SMF entity, and the second response information is sent by the UDR entity according to the second request information , the second request information includes the identifier of the first UPF entity; the second request information is sent by the SPCF entity when it is determined that the first UPF entity is attacked.
  • the SPCF entity may send the second request information to the UDR entity, where the second request information includes the identifier of the first UPF entity.
  • the SPCF entity may receive the second response information sent by the UDR entity, where the second response information includes the identifier of the first SMF entity. Therefore, the SPCF entity may send abnormality indication information to the first SMF entity.
  • the second connection indication information may include the identifier of the first SMF entity, and the identifier of the first SMF entity includes the identifier of the second interface of the first SMF entity.
  • the abnormal indication information may be sent by the SPCF entity according to the identifier of the second interface.
  • the second connection indication information may include an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for connecting the first UPF entity to the first SMF entity.
  • the second response information may further include an identifier of the fourth interface, and the abnormality indication information includes the identifier of the fourth interface.
  • the identifier of the first UPF entity may include an identifier of the first interface in the first UPF entity.
  • the first interface may be an abnormal interface in the first UPF entity.
  • the second connection indication information may include an identifier of each interface of each UPF entity connected to the first SMF entity.
  • the SPCF entity may determine that the first UPF entity is attacked in a case where an abnormal interface exists in the first UPF entity.
  • the second connection indication information may include association information 1 and association information 2 shown in FIG. 6 .
  • the second request information may be the network element query information in FIG. 6 .
  • the second response information may be the network element response information in FIG. 6 .
  • Fig. 8 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 800 includes S810 to S830.
  • Method 800 may be performed by an NRF entity.
  • At S810 receive interface indication information sent by the first SMF entity, where the interface indication information includes an identifier of a second interface of the first SMF entity and an identifier of a third interface of the first SMF entity, the third interface The interface is used for the connection between the first SMF entity and the first UPF entity.
  • the first request information sent by the SPCF entity includes the identifier of the second interface, and the first request information is that the SPCF entity determines that the first UPF entity is attacked sent under the circumstances.
  • the entity sends first response information to the SPCF entity, where the first response information includes the identifier of the third interface, and the identifier of the third interface is used for sending the first SMF entity to the first SMF
  • the entity sends an exception indication information, where the abnormality indication information is used to indicate that the first UPF entity is attacked.
  • a query function may be provided to the SPCF entity, and in the case of receiving the identification of the second interface of the first SMF entity sent by the SPCF entity, the identification of the third interface of the first SMF entity is sent to the SPCF entity, so that the SPCF When the entity determines that the first UPF entity is attacked, it sends abnormal indication information to the first SMF entity connected to the first UPF entity, thereby improving the security of the communication system.
  • FIG. 9 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • the method 900 includes S910 to S930.
  • Method 900 may be performed by a UDR entity.
  • the second connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, and the at least one UPF entity includes the first UPF entity.
  • the second request information is sent by the SPCF entity when it is determined that the first UPF entity is attacked, and the second request information includes the first UPF entity The identifier of a UPF entity.
  • An SMF entity sends abnormal indication information, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • a query function can be provided to the SPCF entity, and in the case of receiving the identifier of the first UPF entity sent by the SPCF entity, the identifier of the first SMF entity connected to the first UPF entity is sent to the SPCF entity, so that the SPCF entity When it is determined that the first UPF entity is attacked, abnormality indication information can be sent to the first SMF entity, thereby improving the security of the communication system.
  • the second connection indication information may include the identifier of the first SMF entity
  • the identifier of the first SMF entity may include the identifier of the second interface of the first SMF entity
  • the abnormal indication information is the SPCF entity according to The identifier of the second interface is sent.
  • the second connection indication information may include an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for connecting the first UPF entity to the SMF entity.
  • the second response information may also include an identifier of the fourth interface.
  • the abnormal indication information may include the identifier of the fourth interface.
  • the second connection indication information may include an identifier of at least one interface in each connected UPF entity.
  • the second request information may include the identifier of the first interface in the first UPF entity.
  • the identifier of at least one interface in the first UPF entity includes the identifier of the first interface.
  • the first interface may be an abnormal interface in the first UPF entity.
  • Fig. 10 is a schematic structural diagram of a data processing device provided by an embodiment of the present application.
  • the communication device 2000 includes a processing module 2010 and a transceiver module 2020 .
  • the communication device 2000 may be used to realize the function of the SPCF entity mentioned above.
  • the processing module 2010 is configured to determine whether the first user plane function UPF entity is attacked.
  • the transceiver module 2020 is configured to, when the first UPF entity is attacked, send abnormal indication information to the first session management function SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked, so The first SMF entity is connected to the first UPF entity.
  • the communication device 2000 further includes an acquisition module.
  • the obtaining module is used to obtain connection information
  • the connection information is used to indicate at least one UPF entity connected to each SMF entity in at least one SMF entity, and the at least one SMF entity includes the first SMF entity.
  • the processing module 2010 is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF entity is attacked.
  • connection information further includes an identifier of each interface in the at least one interface of the first UPF entity, and the at least one interface of the first UPF entity includes the first interface.
  • the obtaining module is configured to receive connection indication information sent by the first SMF entity, where the connection indication information is used to indicate at least one UPF entity to which the first SMF entity is connected.
  • connection indication information includes the identifier of the second interface of the first SMF entity.
  • the transceiver module 2020 is specifically configured to send the abnormal indication information according to the identifier of the second interface.
  • connection indication information further includes an identifier of a fourth interface of the first UPF entity, the fourth interface is used to connect the first UPF entity to the first SMF entity, and the abnormality indication The information includes an identifier of the fourth interface.
  • connection information includes an identifier of a third interface of the first SMF entity, and the third interface is used for the connection between the first SMF entity and the first UPF entity.
  • the transceiver module 2020 is further configured to, when the first UPF entity is abnormal, send first request information to the network storage function NRF entity, where the first request information includes the identifier of the third interface.
  • the transceiver module 2020 is also configured to receive first response information sent by the NRF entity, where the first response information includes the identifier of the second interface of the first SMF entity;
  • the transceiver module 2020 is specifically configured to send the abnormal indication information according to the identifier of the second interface.
  • connection information is determined according to interaction information between the at least one UPF entity and the at least one SMF entity, where the first UPF entity and the first SMF entity
  • the interaction information includes the identifier of the third interface and the identifier of each interface in the at least one interface of the first UPF entity.
  • At least one interface of the first UPF entity includes a fourth interface
  • the fourth interface is used to connect the first UPF entity to the first SMF entity
  • the abnormality indication information includes the fourth interface. Identification of four interfaces.
  • the transceiving module 2020 is further configured to, when the first UPF entity is abnormal, send second request information to the unified database UDR entity, where the second request information includes the identifier of the first UPF entity.
  • the transceiver module 2020 is further configured to receive second response information sent by the UDR entity, where the second response information includes the identifier of the first SMF entity.
  • the processing module 2010 is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF entity is attacked.
  • the identifier of the first UPF entity includes an identifier of an abnormal first interface in the first UPF entity.
  • the identifier of the first SMF entity includes an identifier of a second interface of the first SMF entity.
  • the transceiver module 2020 is specifically configured to send the abnormal indication information according to the identifier of the second interface.
  • the second response information further includes an identifier of a fourth interface of the first UPF entity, and the fourth The interface is used to connect the first UPF entity to the first SMF entity.
  • the abnormal indication information includes the identifier of the fourth interface.
  • the communication device 2000 may be used to realize the function of the first SMF entity mentioned above.
  • the transceiver module 2020 is configured to receive abnormal indication information sent by the security policy control function entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the processing module 2010 is configured to disconnect the connection with the first UPF entity.
  • the transceiver module 2020 is further configured to send interface indication information to the NRF entity, where the interface indication information includes the identifier of the second interface of the device 2000 and the identifier of the third interface of the device 2000, the first Three interfaces are used to connect the device 2000 with the first UPF entity.
  • the abnormal indication information is sent by the security policy control function entity according to the first response information sent by the NRF entity, and the first response information includes the identifier of the third interface.
  • the first response information is sent by the NRF entity according to the first request information, the first request information includes the identifier of the second interface, and the first request information is the sent when the first UPF entity is attacked.
  • the transceiver module 2020 is further configured to send first connection indication information to the security policy control function entity, where the first connection indication information is used to indicate at least one UPF entity connected to the apparatus 2000, the at least One UPF entity includes the first UPF entity.
  • the first connection indication information includes the identifier of the second interface of the apparatus 2000, and the abnormality indication information is sent by the security policy control function entity according to the identifier of the second interface.
  • the transceiver module 2020 is further configured to send second connection indication information to the UDR entity, where the second connection indication information is used to indicate at least one UPF entity connected to the device 2000, and the at least one UPF entity includes the first UPF entity.
  • the transceiver module 2020 is further configured to send second connection indication information to the UDR entity, where the second connection indication information is used to indicate at least one UPF entity connected to the device 2000, and the at least one UPF entity includes the first UPF entity. A UPF entity.
  • the abnormality indication information is sent by the security policy control function entity according to the second response information, and the second response information includes the identifier of the device 2000 .
  • the second response information is sent by the UDR entity according to the second request information, and the second request information includes the identifier of the first UPF entity.
  • the second request information is sent by the security policy control function entity when the first UPF entity is attacked.
  • the second connection indication information includes an identifier of the device 2000, and the identifier of the device 2000 includes an identifier of a second interface of the device 2000, and the abnormality indication information is that the security policy control functional entity follows the second interface sent with the ID.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for connecting the first UPF entity to the apparatus 2000 .
  • the second response information further includes the identifier of the fourth interface, and the abnormality indication information includes the identifier of the fourth interface.
  • the communication device 2000 may be used to realize the function of the NRF entity mentioned above.
  • the transceiver module 2020 is further configured to receive interface indication information sent by the first SMF entity, where the interface indication information includes the identifier of the second interface of the first SMF entity and the identifier of the third interface of the first SMF entity,
  • the third interface is used for the connection between the first SMF entity and the first UPF entity;
  • the transceiver module 2020 is further configured to receive first request information sent by the security policy control functional entity, where the first request information includes the identifier of the second interface, and the first request information is that the security policy control functional entity Sent when the first UPF entity is attacked;
  • the transceiver module 2020 is further configured to send first response information to the security policy control functional entity, where the first response information includes the identifier of the third interface, and the identifier of the third interface is used by the first SMF
  • the entity sends abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the processing module 2010 may be used to control the transceiver module 2020, so that the transceiver module 2020 realizes the above functions.
  • the communication device 2000 may be a UDR entity, or be configured to implement the functions of the UDR entity mentioned above.
  • the transceiver module 2020 is configured to receive second connection indication information sent by the first SMF entity, where the second connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, and the at least one UPF entity includes the Describe the first UPF entity.
  • the transceiver module 2020 is further configured to receive second request information sent by the security policy control functional entity, where the second request information is sent by the security policy control functional entity when the first UPF entity is attacked, and the The second request information includes the identifier of the first UPF entity.
  • the transceiver module 2020 is further configured to send second response information to the security policy control function entity, where the second response information includes the identifier of the first SMF entity, and the identifier of the first SMF entity is used for the first SMF entity.
  • An SMF entity sends abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the second connection indication information includes the identifier of the first SMF entity
  • the identifier of the first SMF entity includes the identifier of the second interface of the first SMF entity
  • the abnormality indication information is the sent by the security policy control function entity according to the identifier of the second interface.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, the fourth interface is used to connect the first UPF entity to the SMF entity, and the second response The information further includes an identifier of the fourth interface, and the abnormality indication information includes the identifier of the fourth interface.
  • the processing module 2010 may be used to control the transceiver module 2020, so that the transceiver module 2020 realizes the above functions.
  • Fig. 8 is a schematic structural diagram of a data processing device provided by an embodiment of the present application.
  • the communication device 3000 includes at least one processor 3010 and a communication interface 3020 .
  • the communication interface 3020 is used for the communication device 3000 to exchange information with other communication devices.
  • the at least one processor 3010 When the program instructions are executed in the at least one processor 3010, the at least one processor 3010 is used to execute the method described above.
  • the communication device 3000 may be used to realize the function of the SPCF entity mentioned above.
  • the processor 3010 is configured to determine whether the first user plane function UPF entity is attacked.
  • the communication interface 3020 is configured to, when the first UPF entity is attacked, send abnormal indication information to the first session management function SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked, so The first SMF entity is connected to the first UPF entity.
  • the communication interface 3020 is further configured to obtain connection information, the connection information is used to indicate at least one UPF entity connected to each SMF entity in at least one SMF entity, and the at least one SMF entity includes the first SMF entity.
  • the processor 3010 is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF entity is attacked.
  • connection information further includes an identifier of each interface in the at least one interface of the first UPF entity, and the at least one interface of the first UPF entity includes the first interface.
  • the communication interface 3020 is further configured to receive connection indication information sent by the first SMF entity, where the connection indication information is used to indicate at least one UPF entity to which the first SMF entity is connected.
  • connection indication information includes the identifier of the second interface of the first SMF entity.
  • the communication interface 3020 is further configured to send the abnormality indication information according to the identifier of the second interface.
  • connection indication information further includes an identifier of a fourth interface of the first UPF entity, the fourth interface is used to connect the first UPF entity to the first SMF entity, and the abnormality indication The information includes an identifier of the fourth interface.
  • connection information includes an identifier of a third interface of the first SMF entity, and the third interface is used for the connection between the first SMF entity and the first UPF entity.
  • the communication interface 3020 is further configured to, when the first UPF entity is abnormal, send first request information to the network storage function NRF entity, where the first request information includes the identifier of the third interface.
  • the communication interface 3020 is further configured to receive first response information sent by the NRF entity, where the first response information includes the identifier of the second interface of the first SMF entity.
  • the communication interface 3020 is further configured to send the abnormality indication information according to the identifier of the second interface.
  • connection information is determined according to interaction information between the at least one UPF entity and the at least one SMF entity, where the first UPF entity and the first SMF entity
  • the interaction information includes the identifier of the third interface and the identifier of each interface in the at least one interface of the first UPF entity.
  • At least one interface of the first UPF entity includes a fourth interface
  • the fourth interface is used to connect the first UPF entity to the first SMF entity
  • the abnormality indication information includes the fourth interface. Identification of four interfaces.
  • the communication interface 3020 is further configured to, when the first UPF entity is abnormal, send second request information to the unified database UDR entity, where the second request information includes the identifier of the first UPF entity.
  • the communication interface 3020 is further configured to receive second response information sent by the UDR entity, where the second response information includes the identifier of the first SMF entity.
  • the processor 3010 is specifically configured to determine whether the first interface of the first UPF entity is abnormal, and if the first interface is abnormal, the first UPF entity is attacked.
  • the identifier of the first UPF entity includes an identifier of an abnormal first interface in the first UPF entity.
  • the identifier of the first SMF entity includes an identifier of a second interface of the first SMF entity.
  • the communication interface 3020 is further configured to send the abnormality indication information according to the identifier of the second interface.
  • the second response information further includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for connecting the first UPF entity to the first SMF entity.
  • the abnormal indication information includes the identifier of the fourth interface.
  • the communication device 3000 may be used to realize the function of the first SMF entity mentioned above.
  • the communication interface 3020 is configured to receive abnormal indication information sent by the security policy control function entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the processor 3010 is configured to disconnect the connection with the first UPF entity.
  • the communication interface 3020 is further configured to send interface indication information to the NRF entity, where the interface indication information includes an identifier of a second interface of the device 3000 and an identifier of a third interface of the device 3000, and the first Three interfaces are used to connect the device 3000 with the first UPF entity.
  • the abnormal indication information is sent by the security policy control function entity according to the first response information sent by the NRF entity, and the first response information includes the identifier of the third interface.
  • the first response information is sent by the NRF entity according to the first request information, the first request information includes the identifier of the second interface, and the first request information is the sent when the first UPF entity is attacked.
  • the communication interface 3020 is further configured to send first connection indication information to the security policy control function entity, where the first connection indication information is used to indicate at least one UPF entity connected to the apparatus 3000, the at least One UPF entity includes the first UPF entity.
  • the first connection indication information includes the identifier of the second interface of the apparatus 3000, and the abnormality indication information is sent by the security policy control function entity according to the identifier of the second interface.
  • the communication interface 3020 is further configured to send second connection indication information to the UDR entity, where the second connection indication information is used to indicate at least one UPF entity connected to the device 3000, and the at least one UPF entity includes the first UPF entity.
  • the communication interface 3020 is further configured to send second connection indication information to the UDR entity, where the second connection indication information is used to indicate at least one UPF entity connected to the device 3000, and the at least one UPF entity includes the first UPF entity. A UPF entity.
  • the abnormal indication information is sent by the security policy control function entity according to the second response information, and the second response information includes the identifier of the device 3000 .
  • the second response information is sent by the UDR entity according to the second request information, and the second request information includes the identifier of the first UPF entity.
  • the second request information is sent by the security policy control function entity when the first UPF entity is attacked.
  • the second connection indication information includes an identifier of the device 3000, and the identifier of the device 3000 includes an identifier of a second interface of the device 3000, and the abnormality indication information is that the security policy control functional entity follows the second interface sent with the ID.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, and the fourth interface is used for connecting the first UPF entity to the apparatus 3000 .
  • the second response information further includes the identifier of the fourth interface, and the abnormality indication information includes the identifier of the fourth interface.
  • the communication device 3000 may be used to realize the function of the NRF entity mentioned above.
  • the communication interface 3020 is further configured to receive interface indication information sent by the first SMF entity, where the interface indication information includes the identifier of the second interface of the first SMF entity and the identifier of the third interface of the first SMF entity,
  • the third interface is used for the connection between the first SMF entity and the first UPF entity;
  • the communication interface 3020 is further configured to receive first request information sent by the security policy control functional entity, where the first request information includes the identifier of the second interface, and the first request information is the Sent when the first UPF entity is attacked;
  • the communication interface 3020 is further configured to send first response information to the security policy control function entity, where the first response information includes the identifier of the third interface, and the identifier of the third interface is used by the first SMF
  • the entity sends abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the processor 3010 may be used to control the communication interface 3020, so that the communication interface 3020 realizes the above functions.
  • the communication device 3000 may be a UDR entity, or be configured to implement the functions of the UDR entity mentioned above.
  • the communication interface 3020 is configured to receive second connection indication information sent by the first SMF entity, where the second connection indication information is used to indicate at least one UPF entity connected to the first SMF entity, and the at least one UPF entity includes the Describe the first UPF entity.
  • the communication interface 3020 is further configured to receive second request information sent by the security policy control function entity, where the second request information is sent by the security policy control function entity when the first UPF entity is attacked, and the The second request information includes the identifier of the first UPF entity.
  • the communication interface 3020 is further configured to send second response information to the security policy control function entity, where the second response information includes the identifier of the first SMF entity, and the identifier of the first SMF entity is used for the first SMF entity.
  • An SMF entity sends abnormal indication information to the first SMF entity, where the abnormal indication information is used to indicate that the first UPF entity is attacked.
  • the second connection indication information includes the identifier of the first SMF entity
  • the identifier of the first SMF entity includes the identifier of the second interface of the first SMF entity
  • the abnormality indication information is the sent by the security policy control function entity according to the identifier of the second interface.
  • the second connection indication information includes an identifier of a fourth interface of the first UPF entity, the fourth interface is used to connect the first UPF entity to the SMF entity, and the second response The information further includes an identifier of the fourth interface, and the abnormality indication information includes the identifier of the fourth interface.
  • the processor 3010 may be used to control the communication interface 3020, so that the communication interface 3020 realizes the above functions.
  • SOC system-on-a-chip
  • the SOC may include at least one processor for implementing any of the above methods or realizing the functions of each unit of the device.
  • the at least one processor may be of different types, such as including CPU and FPGA, CPU and artificial intelligence processor, CPU and graphics processing unit (graphics processing unit, GPU), etc.
  • An embodiment of the present application further provides a computer program storage medium, wherein the computer program storage medium has program instructions, and when the program instructions are executed, the foregoing method is executed.
  • An embodiment of the present application further provides a system-on-a-chip, wherein the system-on-a-chip includes at least one processor, and when program instructions are executed on the at least one processor, the foregoing method is executed.
  • An embodiment of the present application further provides a program product, where the computer program product includes program instructions, and when the program instructions are executed in a computer device, the foregoing data processing method is executed.
  • the embodiment of the present application also provides a communication system, including at least one SMF entity, at least one UPF entity, and the aforementioned communication device. At least one SMF entity includes the first SMF entity, and at least one UPF entity includes the first SMF entity.
  • the communication system may also include NRF entities or UDR entities.
  • the processor in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and the processor may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • static random access memory static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory Access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product comprises one or more computer instructions or computer programs.
  • the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive.
  • At least one means one or more, and “multiple” means two or more.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .
  • sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种通信方法和装置，能够提高通信系统的安全性。通信方法包括：确定第一用户面功能UPF实体是否被攻击；在第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，第一SMF实体与第一UPF实体连接，异常指示信息用于指示第一UPF实体被攻击。

Description

通信方法与装置
本申请要求于2022年02月28日提交中国专利局、申请号为202210190092.9、申请名称为“通信方法与装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信方法与装置。
背景技术
边缘计算，是指在靠近物或数据源头的一侧，采用网络、计算、存储、应用核心能力为一体的开放平台，就近提供最近端服务。利用边缘计算，可以从中心到边缘提供差异化服务网络。
在园区的边缘计算场景中，边缘计算平台(或者边缘计算服务器)以及移动通信网络中的用户面功能网元(如用户平面功能(user plane function，UPF)实体等)以分布式的方式部署在园区内部，而园区内部机房的安全管理能力较弱，可能被攻破，从而使得通信系统存在风险。
发明内容
本申请提供一种通信方法和装置，能够提高通信系统的安全性。
第一方面，提供了一种通信方法，包括：确定第一用户面功能UPF实体是否被攻击；在所述第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击，所述第一SMF实体与所述第一UPF实体连接。
在第一UPF实体被攻击的情况下，可以向与第一UPF实体连接的第一SMF实体异常指示信息，以指示第一UPF实体被攻击，从而第一SMF实体可以对与第一UPF实体相关的会话进行会话重建或进行用户面路径调整，提高通信系统的安全性。
结合第一方面，在一些可能的实现方式中，所述方法还包括：获取连接信息，所述连接信息用于指示至少一个SMF实体中每个SMF实体连接的至少一个UPF实体，所述至少一个SMF实体包括所述第一SMF实体。
获取连接信息，从而根据连接信息确定与第一UPF实体连接的第一SMF实体，使得第一SMF实体的确定更加简便。
结合第一方面，在一些可能的实现方式中，所述确定第一用户面功能UPF实体是否被攻击，包括：确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
在第一UPF实体的接口异常的情况下，确定第一UPF实体被攻击，使得对第一UPF 实体被攻击的判断更为简便。
结合第一方面，在一些可能的实现方式中，所述连接信息还包括所述第一UPF实体的至少一个接口中每个接口的标识，所述第一UPF实体的至少一个接口包括所述第一接口。
在根据第一UPF实体的接口异常确定第一UPF实体被攻击的情况下，连接信息包括第一UPF实体中每个接口的标识，从而能够根据异常接口的标识，确定异常接口所属的第一UPF实体。
结合第一方面，在一些可能的实现方式中，所述获取连接信息，包括：接收所述第一SMF实体发送的连接指示信息，所述连接指示信息用于指示所述第一SMF实体连接的至少一个所述UPF实体。
可以根据每个SMF实体发送的连接指示信息，可以确定连接信息。使得连接信息的获取更加简便。
结合第一方面，在一些可能的实现方式中，所述连接指示信息包括所述第一SMF实体的第二接口的标识；所述向会话管理功能SMF实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
第一SMF实体的第二接口可以是第一SMF实体用于与执行第一方面的通信方法的装置进行通信的接口。从而，执行第一方面的通信方法的装置可以按照第一SMF实体的第二接口的标识进行寻址，并向寻址结果的地址发送异常指示信息，以使得异常指示信息发送至第一SMF实体。
结合第一方面，在一些可能的实现方式中，所述连接指示信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
异常指示信息向包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，便于第一SMF实体进行后续处理。例如，第一SMF实体可以根据异常指示信息中的第四接口的标识，断开与第一UPF实体的连接。
结合第一方面，在一些可能的实现方式中，所述连接信息包括所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接，所述方法还包括：在所述第一UPF实体异常的情况下，向网络存储功能NRF实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识；接收所述NRF实体发送第一响应信息，所述第一响应信息包括所述第一SMF实体的第二接口的标识；所述向第一会话管理功能SMF实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
在第一UPF实体异常的情况下，可以在确定第一SMF实体之后，根据第一SMF实体的第三接口的标识，向NRF实体请求第一SMF实体的第二接口的标识。之后，按照第二接口的标识向第一SMF实体发送异常指示信息。
结合第一方面，在一些可能的实现方式中，所述连接信息是根据所述至少一个UPF实体与所述至少一个SMF实体之间的交互信息确定的，其中，所述第一UPF实体与所述第一SMF实体之间的第一交互信息包括所述第三接口的标识以及所述第一UPF实体的至少一个接口中每个接口的标识。
在确定第一UPF实体的第一接口异常的情况下，可以根据连接信息和第一接口的标识，确定第一SMF的第三接口的标识。从而，可以向NRF实体请求第一SMF的第二接口的标识。
结合第一方面，在一些可能的实现方式中，所述第一UPF实体的至少一个接口包括第四接口，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
异常指示信息向包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，便于第一SMF实体进行后续处理。
结合第一方面，在一些可能的实现方式中，所述方法还包括：在所述第一UPF实体异常的情况下，向统一数据库UDR实体发送第二请求信息，所述第二请求信息包括所述第一UPF实体的标识；接收所述UDR实体发送的第二响应信息，所述第二响应信息包括所述第一SMF实体的标识。
通过向统一数据库UDR实体发送请求信息，获取异常接口所属的第一UPF实体连接的第一SMF实体的标识，从而向第一SMF实体发送异常指示信息，无需存储UPF实体与SMF实体的连接关系。
结合第一方面，在一些可能的实现方式中，所述确定第一用户面功能UPF实体是否被攻击，包括：确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击；所述第一UPF实体的标识包括所述第一UPF实体中异常的第一接口的标识。
在第一UPF实体的接口异常的情况下，确定第一UPF实体被攻击，使得对第一UPF实体被攻击的判断更为简便。
在确定第一UPF实体的第一接口异常的情况下，向UDR实体发送的第一请求信息中，将第一接口的标识作为第一UPF实体的标识，无需对第一接口所属的UPF实体进行判断，UDR实体根据第一接口的标识，可以确定与第一UPF实体连接的第一SMF实体。从而使得确定第一SMF实体的方式更加简便。
结合第一方面，在一些可能的实现方式中，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识，所述向第一会话管理功能SMF实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
UDR实体根据第一UPF实体中第一接口的标识，可以确定与第一UPF实体中连接的第一SMF实体的第二接口。第一SMF实体的第二接口可以是第一SMF实体用于与执行第一方面的通信方法的装置进行通信的接口。从而，执行第一方面的通信方法的装置可以按照第一SMF实体的第二接口的标识进行寻址，并向寻址结果的地址发送异常指示信息，以使得异常指示信息发送至第一SMF实体。
结合第一方面，在一些可能的实现方式中，所述第二响应信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
异常指示信息向包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，便于第一SMF实体进行后续处理。
第二方面，提供一种通信装置，包括：处理模块和收发模块；所述处理模块用于，确 定第一用户面功能UPF实体是否被攻击；所述收发模块用于，在所述第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击，所述第一SMF实体与所述第一UPF实体连接。
结合第二方面，在一些可能的实现方式中，所述装置还包括获取模块，所述获取模块，用于获取连接信息，所述连接信息用于指示至少一个SMF实体中每个SMF实体连接的至少一个UPF实体，所述至少一个SMF实体包括所述第一SMF实体。
结合第二方面，在一些可能的实现方式中，所述处理模块具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
结合第二方面，在一些可能的实现方式中，所述连接信息还包括所述第一UPF实体的至少一个接口中每个接口的标识，所述第一UPF实体的至少一个接口包括所述第一接口。
结合第二方面，在一些可能的实现方式中，所述获取模块具体用于，接收所述第一SMF实体发送的连接指示信息，所述连接指示信息用于指示所述第一SMF实体连接的至少一个所述UPF实体。
结合第二方面，在一些可能的实现方式中，所述连接指示信息包括所述第一SMF实体的第二接口的标识；所述收发模块具体用于，按照所述第二接口的标识，发送所述异常指示信息。
结合第二方面，在一些可能的实现方式中，所述连接指示信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
结合第二方面，在一些可能的实现方式中，所述连接信息包括所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接，所述收发模块还用于，在所述第一UPF实体异常的情况下，向网络存储功能NRF实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识；所述收发模块还用于，接收所述NRF实体发送第一响应信息，所述第一响应信息包括所述第一SMF实体的第二接口的标识；所述收发模块具体用于，按照所述第二接口的标识，发送所述异常指示信息。
结合第二方面，在一些可能的实现方式中，所述连接信息是根据所述至少一个UPF实体与所述至少一个SMF实体之间的交互信息确定的，其中，所述第一UPF实体与所述第一SMF实体之间的第一交互信息包括所述第三接口的标识以及所述第一UPF实体的至少一个接口中每个接口的标识。
结合第二方面，在一些可能的实现方式中，所述收发模块还用于，在所述第一UPF实体异常的情况下，向统一数据库UDR实体发送第二请求信息，所述第二请求信息包括所述第一UPF实体的标识；所述收发模块还用于，接收所述UDR实体发送的第二响应信息，所述第二响应信息包括所述第一SMF实体的标识。
结合第二方面，在一些可能的实现方式中，所述处理模块具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击；所述第一UPF实体的标识包括所述第一UPF实体中异常的第一接口的标识。
结合第二方面，在一些可能的实现方式中，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识，所述收发模块具体用于，按照所述第二接口的标识，发送 所述异常指示信息。
第三方面，提供一种通信方法，应用于会话管理功能SMF实体，所述方法包括：接收安全策略控制功能SPCF实体发送的异常指示信息，所述异常指示信息用于指示第一UPF实体被攻击；断开与所述第一UPF实体的连接。
会话管理功能SMF实体在接收SPCF实体发送的异常指示信息的情况下，断开与第一UPF实体的连接，提供通信系统的安全性。
结合第三方面，在一些可能的实现方式中，所述方法还包括：向网络存储功能NRF实体发送接口指示信息，所述接口指示信息包括所述SMF实体的第二接口的标识和所述SMF实体的第三接口的标识，所述第三接口用于所述SMF实体与所述第一UPF实体的连接；所述异常指示信息是所述SPCF实体根据所述NRF实体发送的第一响应信息发送的，所述第一响应信息包括所述第三接口的标识，所述第一响应信息是所述NRF实体根据第一请求信息发送的，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的。
SMF实体通过向NRF实体发送接口指示信息，在NRF实体中注册SMF实体的第二接口的标识和SMF实体的第三接口的标识。从而，在确定第一UPF实体异常的情况下，SPCF实体可以在确定与第一UPF实体连接的SMF实体之后，根据第一SMF实体的第三接口的标识，向NRF实体请求SMF实体的第二接口的标识。之后，SPCF实体可以按照第二接口的标识向SMF实体发送异常指示信息。
结合第三方面，在一些可能的实现方式中，所述方法还包括：向所述SPCF实体发送第一连接指示信息，所述第一连接指示信息用于指示所述SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
从而，SPCF实体可以根据第一连接指示信息确定被攻击的第一UPF实体连接的SMF实体。
结合第三方面，在一些可能的实现方式中，所述第一连接指示信息包括所述第一SMF实体的第二接口的标识，所述异常指示信息是所述SPCF实体按照所述第二接口的标识发送的。
SMF实体的第二接口可以是SMF实体用于与SPCF实体进行通信的接口。从而，SPCF实体可以按照第二接口的标识进行寻址，并向寻址结果的地址发送异常指示信息，以使得异常指示信息发送至SMF实体。
结合第三方面，在一些可能的实现方式中，所述方法还包括：向统一数据库UDR实体发送第二连接指示信息，所述第二连接指示信息用于指示所述SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体；所述异常指示信息是所述SPCF实体根据第二响应信息发送的，所述第二响应信息包括所述SMF实体的标识，所述第二响应信息是所述UDR实体根据第二请求信息发送的，所述第二请求信息包括所述第一UPF实体的标识；所述第二请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的。
SMF实体通过向UDR实体发送第二连接指示信息，在UDR实体中注册SMF实体连接的至少一个UPF实体。第二连接指示信息可以包括SMF实体的标识和该至少一个UPF实体中每个UPF实体的标识。
从而，SPCF实体可以向统一数据库UDR实体发送请求信息，获取异常接口所属的第一UPF实体连接的SMF实体的标识，并根据SMF实体的标识向该SMF实体发送异常指示信息。
结合第三方面，在一些可能的实现方式中，所述第二连接指示信息包括所述SMF实体的标识，所述SMF实体的标识包括所述SMF实体的第二接口的标识，所述异常指示信息是所述SPCF实体按照所述第二接口的标识发送的。
第二连接指示信息包括所述SMF实体的第二接口的标识，从而UDR实体根据第一UPF实体中第一接口的标识，可以确定与第一UPF实体中连接的第一SMF实体的第二接口。SMF实体的第二接口可以是第一SMF实体用于与执行第一方面的通信方法的装置进行通信的接口。从而，SPCF实体可以按照SMF实体的第二接口的标识进行寻址，并向寻址结果的地址发送异常指示信息，以使得异常指示信息发送至SMF实体。
结合第三方面，在一些可能的实现方式中，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述SMF实体连接，所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
第二连接指示信息包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，从而异常指示信息可以向包括第四接口的标识，便于第一SMF实体进行后续处理。
第四方面，提供一种通信方法，包括：接收第一SMF实体发送的接口指示信息，所述接口指示信息包括所述第一SMF实体的第二接口的标识和所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接；接收SPCF实体发送的第一请求信息，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的；向所述SPCF实体发送第一响应信息，所述第一响应信息包括所述第三接口的标识，所述第三接口的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
第五方面，提供一种通信方法，包括：接收第一SMF实体发送的第二连接指示信息，所述第二连接指示信息用于指示所述第一SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体；接收SPCF实体发送的第二请求信息，所述第二请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的，所述第二请求信息包括所述第一UPF实体的标识；向所述SPCF实体发送第二响应信息，所述第二响应信息包括所述第一SMF实体的标识，所述第一SMF实体的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
结合第五方面，在一些可能的实现方式中，所述第二连接指示信息包括所述SMF实体的标识，所述SMF实体的标识包括所述SMF实体的第二接口的标识，所述异常指示信息是所述SPCF实体按照所述第二接口的标识发送的。
结合第五方面，在一些可能的实现方式中，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述SMF实体连接，所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
第六方面，提供一种通信装置，包括用于执行第四方面至第六方面中的任意一种实现 方式中的方法的各个模块。
第七方面，提供一种通信装置，包括处理器和通信接口，所述通信接口用于所述通信装置与其他通信装置进行信息交互，当程序指令在所述至少一个处理器中执行时，使得所述通信装置执行第一方面、第四方面至第六方面中的任意一种实现方式中的方法。
第八方面，提供一种计算机可读介质，该计算机可读介质存储用于设备执行的程序代码，该程序代码包括用于执行第一方面、第四方面至第六方面中的任意一种实现方式中的方法。
第九方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面、第四方面至第六方面中的任意一种实现方式中的方法。
第十方面，提供一种芯片，所述芯片包括处理器与数据接口，所述处理器通过所述数据接口读取存储器上存储的指令，执行上述第一方面、第四方面至第六方面中的任意一种实现方式中的方法。
可选地，作为一种实现方式，所述芯片还可以包括存储器，所述存储器中存储有指令，所述处理器用于执行所述存储器上存储的指令，当所述指令被执行时，所述处理器用于执行第一方面或第四方面至第六方面中的任意一种实现方式中的方法。
上述芯片具体可以是现场可编程门阵列(field－programmable gate array，FPGA)或者专用集成电路(application-specific integrated circuit，ASIC)。
应理解，本申请中，第一方面的方法具体可以是指第一方面以及第一方面中各种实现方式中的任意一种实现方式中的方法。
上述第二方面至第十方面中任一方面中的任一可能实现方式可以达到的技术效果，可以相应参照上述第一方面中任一方面中的任一可能实现方式可以达到的技术效果描述，重复之处不予论述。
附图说明
图1是本申请实施例的一种可能的网络架构示意图。
图2是本申请实施例的另一种可能的网络架构示意图。
图3是本申请实施例提供的一种通信方法的示意性流程图。
图4是本申请实施例提供的另一种通信方法的示意性流程图。
图5是本申请实施例提供的又一种通信方法的示意性流程图。
图6是本申请实施例提供的又一种通信方法的示意性流程图。
图7是本申请实施例提供的又一种通信方法的示意性流程图。
图8是本申请实施例提供的又一种通信方法的示意性流程图。
图9是本申请实施例提供的又一种通信方法的示意性流程图。
图10是本申请实施例提供的一种通信装置的示意性结构图。
图11是本申请实施例提供的另一种通信装置的示意性结构图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通信(global system for mobile communications，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、未来的第五代(5th generation，5G)系统或新无线(new radio，NR)等。
为便于理解本申请实施例，首先结合图1和图2详细说明本申请实施例的应用场景。
图1是适用于本申请实施例提供的通信方法的一种网络架构的示意图。图1所示的网络架构100具体可以包括下列网元中的一个或多个：
1、用户设备(user equipment，UE)：可以称终端设备、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。UE还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，还可以是端设备，逻辑实体，智能设备，如手机，智能终端等终端设备，或者服务器，网关，基站，控制器等通信设备，或者物联网设备，如传感器，电表，水表等物联网(Internet of things，IoT)设备。UE还可以是有线设备，如计算机、笔记本电脑等。本申请实施例对此并不限定。
2、接入网(access network，AN)：为特定区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等使用不同质量的传输隧道。接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如3G、4G或5G系统中采用的无线接入技术)和非第三代合作伙伴计划(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网络称为无线接入网络(Radio Access Network，RAN)，其中，5G系统中的接入网设备称为下一代基站节点(next generation Node Base station，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi中的接入点(access point，AP)为代表的空口技术。
基于有线通信技术实现接入网络功能的接入网可以称为有线接入网。
基于无线通信技术实现接入网络功能的接入网可以称为无线接入网(radio access network，RAN)。无线接入网能够管理无线资源，为终端提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网例如可以是基站(NodeB)、演进型基站(evolved NodeB，eNB或eNodeB)、5G移动通信系统中的基站(gNB)、未来移动通信系统中的基站或WiFi系统中的AP等，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该接入网设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网 络设备或者未来演进的PLMN网络中的网络设备等。本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
3、接入和移动管理功能(access and mobility management function，AMF)实体：主要用于移动性管理和接入管理等，例如，用户位置更新、用户注册网络、用户切换等；也可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听、或接入授权(或鉴权)等功能。在本申请实施例中，可用于实现接入和移动管理网元的功能。
4、会话管理功能(session management function，SMF)实体：主要用于会话管理(如会话建立、修改、释放等)、UE的网际协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在本申请实施例中，可用于实现会话管理网元的功能。
5、用户平面功能(user plane function，UPF)实体：即，数据面网关。可用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过该网元接入到数据网络(data network，DN)。在本申请实施例中，可用于实现用户面网关的功能。
6、数据网络(DN)：用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络、互联网协议地址(internet protocol address，IP)多媒体业务(IP Multi-media Service，IMS)网络等。DN在5G网络中可以通过数据网络名称(data network name，DNN)进行标识。
7、认证服务功能(authentication server function，AUSF)实体：主要用于用户鉴权，即对UE接入5G网络的授权等。
8、网络开放功能(network exposure function，NEF)实体：用于安全地向外部开放由5G网络功能提供的业务和能力等。
9、网络存储功能((network function(NF)repository function，NRF)实体：用于保存网络功能实体以及其提供服务的描述信息，以及支持服务发现，网元实体发现和注册等。
10、策略控制功能(policy control function，PCF)实体：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
11、统一数据管理(unified data management，UDM)实体：用于处理用户标识、接入鉴权、注册、或移动性管理等。
12、应用功能(application function，AF)实体：用于进行应用影响的数据路由，接入网络开放功能网元，或，与策略框架交互进行策略控制等。
13、统一数据库(unified data repository，UDR)实体：提供签约数据、策略数据及能力开放相关数据的存储能力。
在该网络架构中，Nausf为AUSF展现的基于服务的接口，Namf为AMF展现的基于服务的接口，Nsmf为SMF展现的基于服务的接口，Nnef为NEF展现的基于服务的接口，Nnrf为NRF展现的基于服务的接口，Npcf为PCF展现的基于服务的接口，Nudm为UDM展现的基于服务的接口，Nudr为UDR展现的基于服务的接口。N1接口为终端与AMF实体之间的参考点；N2接口为AN和AMF实体的参考点，用于非接入层(non-access stratum，NAS)消息的发送等；N3接口为(R)AN和UPF实体之间的参考点，用于传输用户面的数 据等；N4接口为SMF实体和UPF实体之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF实体和DN之间的参考点，用于传输用户面的数据等。
图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
图2是适用于本申请实施例提供的通信方法的一种网络架构的示意图。
网络架构200为基于点到点接口的架构。N13接口为UDM实体与AUSF实体之间的参考点，N35接口为UDM实体和UDR实体的参考点，N12接口为AUSF和AMF实体之间的参考点，N8接口为UDM实体和AMF实体之间的参考点，N10接口为UDM实体和SMF实体之间的参考点，N36接口为UDR实体和PCF实体之间的参考点，N5接口为PCF实体和AF实体之间的参考点，N15接口为PCF实体和AMF实体之间的参考点。
图1和图2中所示的AMF网元、SMF网元、UPF网元、UDR网元、NEF网元、AUSF网元、NRF网元、PCF网元、UDM网元，均可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对此不做限定。执行核心网网元功能的设备又可以称为核心网设备或网络设备。
上述命名仅为用于区分不同的功能，并不代表这些网元分别为独立的物理设备，本申请对于上述网元的具体形态不作限定，例如，可以集成在同一个物理设备中，也可以分别是不同的物理设备。此外，上述命名仅为便于区分不同的功能，而不应对本申请构成任何限定，本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。在此进行统一说明，以下不再赘述。
边缘计算从中心到边缘提供差异化服务网络。内容、应用、计算向边缘迁移驱动边缘计算的发展，核心网集中式部署不能满足新业务需求，网络随业务流向边缘迁移是产业趋势。边缘计算与智能园区相结合，进行快速部署，实现了本地业务闭环，以更优化的网络，为园区用户节省传输，保证体验。
但是在园区边缘计算场景中，边缘计算平台(或者边缘计算服务器)以及移动通信网络中的用户面功能网元(如UPF)部署在园区内部，而园区内部机房的安全管理能力较弱，存在被攻破的风险。攻击者可以通过挟持UPF(例如物理上潜入了对应机房)对移动通信网络的用户面和控制面进行攻击，导致通信网络存在风险。
为了解决上述问题，本申请实施例提供了一种通信方法。
图3是本申请实施例提供的一种通信方法的示意性流程图。
方法300可以由安全策略控制功能(security policy control function，SPCF)实体或其他网元执行。方法300包括S310至S320。
在S310，确定第一UPF实体是否被攻击。
在S320，在所述第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，所述第一SMF实体与所述第一UPF实体连接，所述异常指示信息用于指示所述第一UPF实体被攻击。
通过方法300，在第一UPF实体被攻击的情况下，可以向与第一UPF实体连接的第一SMF实体异常指示信息以指示第一UPF实体被攻击，从而第一SMF实体可以对与第一UPF实体相关的会话进行会话重建或进行用户面路径调整，提高通信系统的安全性。
在一些实施例中，在进行S310之前，可以获取连接信息，连接信息用于指示至少一个SMF实体中每个SMF实体连接的至少一个UPF实体，该至少一个SMF实体包括第一SMF实体。
也就是说，在S320之前，如果确定第一UPF实体被攻击，可以根据连接信息，确定与第一UPF实体连接的第一SMF实体，从而能够在S320向第一SMF实体发送异常指示信息。
具体地，在S310，可以确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
也就是说，可以通过对第一UPF实体的接口进行检测，在第一UPF实体的接口的任一个接口异常的情况下，可以确定第一UPF实体被攻击。
可选地，连接信息还可以包括所述第一UPF实体的至少一个接口中每个接口的标识，第一UPF实体的至少一个接口包括第一接口。
应当理解，第一接口可以是第一UPF实体中的任一个接口。
也就是说，在S310之前，还可以获取第一UPF实体的至少一个接口中每个接口的标识。在第一UPF实体的第一接口异常的情况下，可以根据第一接口的标识，确定第一UPF实体被攻击。
连接信息可以是根据每个SMF实体发送的连接指示信息确定的，或者，连接信息可以是根据每个UPF实体与连接的SMF实体之间的交互信息确定的。
根据每个SMF实体发送的连接指示信息确定连接信息的情况下，在S310之前，可以接收第一SMF实体发送的连接指示信息，第一SMF实体发送的连接指示信息用于指示第一SMF实体连接的至少一个UPF实体。
接收每个SMF实体发送的连接指示信息后，可以根据至少一个SMF实体发送的连接指示信息，可以确定连接信息。
第一SMF实体发送的连接指示信息还包括第一SMF实体的第二接口的标识。在S320，可以按照所述第二接口的标识，向第一SMF实体发送所述异常指示信息。
也就是说，第一SMF实体的第二接口可以是第一SMF实体用于与SPCF实体进行通信的接口。从而，在S320，可以按照第一SMF实体的第二接口的标识，发送所述异常指示信息。
第一SMF实体发送的连接指示信息还可以包括第一UPF实体的第四接口的标识。第一UPF实体的第四接口例如可以是N4接口，用于第一UPF实体与第一SMF实体连接。异常指示信息可以包括第一UPF实体的第四接口的标识。
异常指示信息向包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，便于第一SMF实体进行后续处理。例如，第一SMF实体可以根据异常指示信息中的第四接 口的标识，断开与第一UPF实体的连接。
根据每个UPF实体与连接的SMF实体之间的交互信息确定连接信息的情况下，连接信息可以包括第一SMF实体的第三接口的标识，第一SMF实体的第三接口用于第一SMF实体与第一UPF实体的连接。
在第一UPF实体异常的情况下，在S320之前，可以向NRF实体发送第一请求信息。第一请求信息包括所述第三接口的标识。
之后，可以接收所述NRF实体发送第一响应信息。第一响应信息包括所述第一SMF实体的第二接口的标识。
在S320，可以按照第二接口的标识，发送异常指示信息。
第一SMF实体用于与第一UPF实体的连接的第三接口可以是第一SMF实体的N4接口。第一SMF实体的第二接口可以是第一SMF实体用于与SPCF实体连接的接口，例如可以是第一SMF实体的服务化接口。
也就是说，在第一UPF实体异常的情况下，可以在确定第一SMF实体之后，根据第一SMF实体的N4接口的标识，向NRF实体请求第一SMF实体的第二接口的标识。之后，按照第二接口的标识向第一SMF实体发送异常指示信息。
可选地，连接信息可以是根据所述至少一个UPF实体与所述至少一个SMF实体之间的交互信息确定的。该至少一个UPF实体中的第一UPF实体与该至少一个SMF实体中的第一SMF实体之间的第一交互信息，可以包括第三接口的标识，并且，可以包括第一UPF实体的至少一个接口中每个接口的标识。
从而，在确定第一UPF实体的第一接口异常的情况下，可以根据连接信息和第一接口的标识，确定第一SMF的第三接口的标识。从而，可以向NRF实体请求第一SMF的第二接口的标识。
示例性地，安全策略增强功能(security policy enhancement function，SPEF)可以获取至少一个UPF实体接收或发送的信息。UPF实体与SMF实体之间的交互信息可以包括该UPF实体中的各个接口的标识，以及SMF实体用于与UPF实体连接的接口的标识。SPEF实体可以根据UPF实体与SMF实体之间的交互信息，向SPCF发送该SMF实体用于与UPF实体连接的接口的标识，以及该SMF实体连接的UPF实体的各个接口的标识。
具体地，SPEF可以获取第一交互信息，并将第三接口的标识以及第一UPF实体的至少一个接口中每个接口的标识发送至SPCF实体。
从而，SPCF实体可以根据SPEF发送的信息，确定连接信息。
第一UPF实体的至少一个接口包括第四接口，第四接口用于所述第一UPF实体与所述第一SMF实体连接，异常指示信息包括第四接口的标识。
第一UPF实体与第一SMF实体之间的第一交互信息，可以包括第三接口的标识、第四接口的标识。从而，异常指示信息可以包括第四接口的标识。
第一UPF实体的第四接口用于第一UPF实体与第一SMF实体连接，例如可以是第一UPF实体的N4接口。异常指示信息中的第四接口的标识可以用于指示第一UPF实体。异常指示信息向包括第一UPF实体用于与第一SMF实体连接的第四接口的标识，便于第一SMF实体进行后续处理。例如，第一SMF实体可以根据异常指示信息中的第四接口的标识，断开与第一UPF实体的连接。也就是说，第一SMF实体断开与第四接口的标识指示 的第四接口的连接，即断开了与第一UPF实体的连接。
在另一些实施例中，在第一UPF实体异常的情况下，可以向UDR实体发送第二请求信息。第二请求信息包括所述第一UPF实体的标识。
之后，可以接收UDR实体发送的第二响应信息。第二响应信息包括所述第一SMF实体的标识。UDR实体可以在接收第二响应信息之后，发送第二请求信息。第二响应信息可以理解为第二请求信息的响应信息。
在S310，可以确定第一UPF实体的第一接口是否异常。第一UPF实体的第一接口异常，可以理解为第一UPF实体被攻击。
第一UPF实体的标识包括第一UPF实体中异常的第一接口的标识。
也就是说，第二请求信息可以包括第一UPF实体中第一接口的标识。UDR实体根据第一接口的标识，可以确定与第一UPF实体连接的第一SMF实体。
第一SMF实体的标识可以包括第一SMF实体的第二接口的标识。在S320，可以按照第一SMF实体的第二接口的标识，发送异常指示信息。
UDR实体根据第一UPF实体中第一接口的标识，可以确定与第一UPF实体中连接的第一SMF实体的第二接口。第一SMF实体的第二接口用于第一SMF实体与SPCF实体连接，例如第一SMF实体的第二接口可以是第一SMF实体的服务化接口。UDR实体发送的第二响应信息可以包括第一SMF实体的第二接口的标识。从而，在S320，按照第一SMF实体的第二接口的标识发送所述异常指示信息，可以使得异常指示信息发送至第一SMF实体。
第二响应信息还可以包括第一UPF实体的第四接口的标识。第一UPF实体的第四接口用于第一UPF实体与第一SMF实体连接，异常指示信息包括第一UPF实体的第四接口的标识。
第一UPF实体的第四接口用于第一UPF实体与第一SMF实体连接，例如可以是第一UPF实体的N4接口。异常指示信息中的第四接口的标识可以用于指示第一UPF实体。异常指示信息包括第一UPF实体的第四接口的标识，便于第一SMF实体进行后续处理。例如，第一SMF实体可以根据异常指示信息中的第四接口的标识，断开与第一UPF实体的连接。也就是说，第一SMF实体断开与第四接口的标识指示的第四接口的连接，即断开了与第一UPF实体的连接。
在第一UPF实体中异常的第一接口不是第一UPF实体的第四接口的情况下，异常指示信息可以包括第四接口的标识。在第一UPF实体中异常的第一接口为第一UPF实体的第四接口的情况下，异常指示信息可以包括或不包括第四接口的标识。
图4是本申请实施例提供的一种通信方法的示意性流程图。方法400包括S401至S413。
在S401，第一SMF实体向NRF实体进行发送网络功能注册信息。
对于网络架构100，网络功能注册信息可以包括第一SMF实体的网络功能(network function，NF)类型(NF type)、第一SMF实体的NF实例(instance)标识(identification，ID)、第一SMF实体的服务化接口标识、第一SMF实体的N4接口的标识。
对于网络架构200，网络功能注册信息可以包括网络功能(network function，NF)类型(NF type)、NF实例(instance)标识(identification，ID)、SMF实体的N4接口的标识以及SMF实体用于与网络架构200中其他网元进行通信的接口的标识。SMF实体的 N4接口的标识以及与的其他接口的标识可以相同或不同。
第一SMF实体的NF type用于指示发送网络功能注册信息的网元的类型，即指示第一SMF实体的类型为SMF。第一SMF实体的NF instance ID用于指示第一SMF实体。第一SMF实体的服务化接口标识可以是第一SMF实体的服务化接口的全限定域名(fully qualified domain name，FQDN)或IP地址，用于指示第一SMF实体的服务化接口。第一SMF实体的N4接口的标识可以是第一SMF实体的N4接口的FQDN或IP地址，用于指示第一SMF实体的N4接口。
方法400以网络架构100为例进行说明。
在S402，NRF实体向第一SMF实体发送注册响应信息。
注册响应信息用于指示网络功能注册成功。
在S403，SPEF实体检测第一SMF实体与第一UPF实体之间与建立N4偶联相关的信息。
SPEF实体可以获取至少一个UPF实体中每个UPF实体与SMF实体进行交互的交互信息。该至少一个UPF实体包括第一UPF实体。与第一UPF实体建立N4偶联的SMF实体为第一SMF实体。第一UPF实体可以是该至少一个UPF实体中的任一个。
在UPF实体与SMF实体建立连接(也可以理解为建立N4偶联(N4association))的过程中，UPF实体与SMF实体交互的消息中带有SMF实体的N4接口的标识和UPF实体的N4接口的标识。
因此，SPEF实体可以根据至少一个UPF实体中每个UPF实体与SMF实体之间交互的信息，确定对应关系信息1。对应关系信息1中，每个SMF实体的N4接口的标识对应至少一个UPF实体的N4接口的标识，该UPF实体与该SMF实体之间具有N4偶联，即该UPF实体的N4接口与该SMF实体的N4接口连接。
在S404，SPEF实体向SPCF发送对应关系信息1。
在S405，SPEF实体检测第一SMF实体与第一UPF实体之间与会话建立、会话修改相关的信息。
在UPF实体与SMF实体之间进行与会话建立、会话修改等于会话相关的消息传输过程中，SMF实体与UPF实体的交互信息中携带该UPF实体的N3接口标识、N9接口的标识，用于对UPF实体的N3接口、N9接口进行配置。
SPEF实体可以根据至少一个UPF实体中每个UPF实体与SMF实体之间交互的信息，确定对应关系信息2。对应关系信息2用于表示每个UPF实体的N4接口的标识与该UPF的N3接口的标识、N9接口的标识之间的对应关系。
在S406，SPEF实体向SPCF发送对应关系信息2。
在S407，SPEF实体判断第一UPF实体的接口是否异常。
SPEF实体可以对至少一个UPF实体中每个UPF实体的各个接口进行检测，以确定是否存在异常的接口。
应当理解，S407可以多次进行。示例性地，可以周期性进行S407。
在第一UPF实体的接口异常的情况下，可以进行S408。第一UPF实体可以是该至少一个UPF实体中的任一个UPF实体。
在S408，SPEF实体向SPCF实体发送异常接口信息。
异常接口信息包括第一UPF实体中异常的接口的标识。
SPCF实体根据异常指示信息，可以确定第一UPF实体不可信，即第一UPF实体被攻击。
在异常接口信息中异常接口的标识为第一UPF实体的N4接口的标识的情况下，SPCF实体可以根据对应关系信息1，确定UPF实体中异常的接口的标识对应的SMF实体的N4接口的标识。
在异常接口信息中异常接口的标识为第一UPF实体的N3接口或N9接口的情况下，SPCF实体可以根据对应关系信息2，确定第一UPF实体的N4接口的标识，并根据对应关系信息1确定第一UPF实体的N4接口连接的第一SMF实体的N4接口的标识。
在S409，SPCF实体向NRF实体发送接口查询信息。
接口查询信息可以包括第一SMF实体的N4接口的标识。
在S410，NRF实体向SPCF实体发送接口响应信息。
接口响应信息包括第一SMF实体的服务化接口的标识。
每个SMF实体在上电之后可以向NRF实体进行发送网络功能注册信息。NRF实体根据每个SMF实体发送的网络功能注册信息，可以确定该SMF实体中N4接口的标识和服务化接口的标识的对应关系。
在S411，SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息。
SPCF实体可以对第一SMF实体的服务化接口的标识进行寻址，向寻址结果指示的地址发送异常指示信息。从而，异常指示信息能够发送至第一SMF实体。
异常指示信息用于指示第一UPF实体的接口异常。
第一SMF实体可以根据异常指示信息，对于与第一UPF实体相关的业务进行处理。
示例性地，第一SMF实体可以进行S412和S413。
在S412，第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联。
异常指示信息还可以包括第一UPF实体中N4接口的标识。
第一SMF实体可以断开与异常指示信息标识指示的连接，从而断开与第一UPF实体的N4association。
在S413，第一SMF实体可以在与第一UPF实体存在会话的情况下，进行会话重建或会话的用户面路径调整。
第一SMF实体可以在断开与第一UPF实体的N4接口之间的N4偶联的情况下，进行会话重建。或者，第一SMF实体在断开与第一UPF实体的N4接口之间的N4偶联的情况下，可以根据第一UPF实体在会话中的作用，确定是否进行会话重建。应当理解，会话可以是协议数据单元(protocol data unit，PDU)会话。
第一SMF实体在确定第一UPF实体为会话的中继UPF(intermediate UPF，I-UPF)的情况下，可以进行会话的用户面路径调整，从而将第一UPF实体之外的其他UPF实体作为I-UPF。
第一SMF实体在确定第一UPF实体为会话的PDU会话锚点UPF(UPF of PDU session Anchor，PSA-UPF)的情况下，可以进行会话重建，从而从而将第一UPF实体之外的其他UPF实体作为PSA-UPF。
方法400中，NRF实体提供网络功能注册和查询服务，SPEF实体将检测到的对应关 系信息1和对应关系信息2上报给SPCF实体，其中，对应关系信息1用于表示分别属于具有N4偶联的UPF实体与SMF实体的N4接口的对应关系，对应关系信息2用于表示UPF实体中的N4接口与N3接口、N9接口的对应关系。在SPEF实体检测到第一UPF实体的接口异常的情况下，SPCF实体根据对应关系信息1和对应关系信息2，确定与第一UPF实体具有N4偶联的第一SMF实体的N4接口的标识，并利用第一SMF实体的N4接口的标识向NRF实体查询得到第一SMF的服务化接口的标识。之后，SPCF实体可以按照第一SMF的服务化接口的标识发送异常指示信息，以向第一SMF实体指示第一UPF实体被攻击。从而，第一SMF实体可以进行相应处理，以保证通信安全。
在第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联的情况下，SPEF实体可以检测到第一SMF实体与第一UPF实体之间与断开连接相关的交互信息。SPEF实体可以向SPCF发送连接断开指示信息。连接断开指示信息用于指示第一SMF实体的N4接口的标识与第一UPF实体的N4接口的标识不具有对应关系，即第一SMF实体的N4接口与第一UPF实体的N4接口已经断开连接。连接断开指示信息可以包括第一SMF实体的N4接口的标识、第一UPF实体的N4接口的标识。从而，SPCF实体可以更新对应关系信息1。
或者，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以更新对应关系信息1。更新后的对应关系信息1中第一SMF实体的N4接口的标识与第一UPF实体的N4接口的标识不具有对应关系。
又或者，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以在对应关系信息1进行标注，以指示已向第一SMF实体发送异常指示信息。
图5是本申请实施例提供的一种通信方法的示意性流程图。方法500包括S501至S509。
在S501，第一SMF实体与第一UPF实体建立N4偶联。
也就是所，第一SMF实体的N4接口与第一UPF实体的N4接口建立连接。
在第一SMF实体与第一UPF实体建立N4偶联的过程中，第一SMF实体与第一UPF实体进行交互的信息中携带第一UPF实体的N4接口的标识。
在S502，第一SMF实体向SPCF实体发送关联信息1。
关联信息1包括第一SMF实体的服务化接口标识、第一SMF实体的N4接口的标识、第一UPF实体的N4接口的标识。
在S503，第一SMF实体与第一UPF实体进行会话建立或会话修改。
在第一SMF实体与第一UPF实体进行会话建立或会话修改的过程中，第一UPF实体与第一SMF实体进行交互的信息中携带第一UPF实体的N3接口的标识和/或N9接口的标识，用于对第一UPF实体的N3接口和/或N9接口进行配置。
在S504，第一SMF实体向SPCF实体发送关联信息2。
关联信息2包括第一UPF实体的N4接口的标识，以及第一UPF实体的N3接口的标识和/或N9接口的标识。
应当理解，SPCF实体可以接收至少一个SMF实体发送的关联信息1和关联信息2。该至少一个SMF实体包括第一SMF实体。
之后可以进行S505至S506。
在S505，SPEF实体可以判断第一UPF实体的接口是否异常。
SPEF实体可以对至少一个UPF实体的接口进行检测。具体地，SPEF实体可以获取至少一个UPF实体中每个UPF实体中各个接口与其他网元进行通信的信息。并根据该信息确定各个接口是否异常。
每个UPF实体中任一个接口与其他网元进行通信的信息可以包括该接口的标识。
该至少一个UPF实体包括第一UPF实体。
S505可以多次进行。示例性地，可以周期性进行S505。
在第一UPF实体的接口异常的情况下，可以进行S506。
在S506，SPEF实体可以向SPCF实体发送异常接口信息。
SPCF实体可以根据关联信息1，确定与第一UPF实体中异常的接口相关联的SMF的服务化接口。
异常接口信息包括第一UPF实体中异常的接口的标识。
第一UPF实体中异常的接口为第一UPF实体的N4接口的情况下，SPCF实体根据关联信息1，可以确定与第一UPF实体具有N4偶联的第一SMF的服务化接口的标识。
第一UPF实体中异常的接口为第一UPF实体的N3接口或N9接口的情况下，SPCF实体根据关联信息1和关联信息2，可以确定与第一UPF实体具有N4偶联的第一SMF的N4接口的标识。示例性地，SPCF实体根据关联信息2，可以确定第一UPF实体的N4接口的标识；SPCF实体根据关联信息1，可以确定与第一UPF实体具有N4偶联的第一SMF的服务化接口的标识。
之后，可以进行S507至S509。
在S507，SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息。
在S508，第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联。
在S509，第一SMF实体可以在与第一UPF实体存在会话的情况下，进行会话重建或会话的用户面路径调整。
应当理解，S507至S509可以与S411至S413类似，具体可以参见图4中对S411至S413的说明。
方法500中，第一SMF实体向SPCF实体发送关联信息1和关联信息2，关联信息1用于表示第一SMF实体的服务化接口与第一UPF实体的N4接口的关联关系，关联信息2用于表示第一UPF实体的N4接口和第一UPF实体的N3接口、N9接口的关联关系。SPCF实体根据关联信息1和关联信息2，确定与SPEF实体上报的存在异常的接口所属的第一UPF实体存在N4偶联的第一SMF实体的服务化接口。SPCF实体按照服务化接口，发送异常指示信息，以向第一SMF实体通知第一UPF实体被攻击，不可信。从而，第一SMF实体可以进行相应处理，以保证通信安全。示例性地，第一SMF实体可以根据异常指示信息释放与第一UPF实体的N4偶联，可以根据会话的需求进行会话重建或者用户面路径调整。
示例性地，在第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联的情况下，SPEF实体可以检测到第一SMF实体与第一UPF实体之间与断开连接相关的交互信息。SPEF实体可以向SPCF发送连接断开指示信息。连接断开指示信息用于指示第一SMF实体的N4接口的标识与第一UPF实体的N4接口的标识不具有对应关系，即第一SMF 实体的N4接口与第一UPF实体的N4接口已经断开连接。连接断开指示信息可以包括第一SMF实体的N4接口的标识、第一UPF实体的N4接口的标识。从而，SPCF实体可以更新对应关系信息1。
示例性地，在第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联之后，第一SMF实体可以向SPCF实体发送连接断开指示信息。连接断开指示信息用于指示第一SMF实体的N4接口的标识与第一UPF实体的N4接口的标识不具有对应关系，即第一SMF实体的N4接口与第一UPF实体的N4接口已经断开连接。从而，SPCF实体可以更新对应关系信息1。
示例性地，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以更新对应关系信息1。更新后的对应关系信息1中第一SMF实体的N4接口的标识与第一UPF实体的N4接口的标识不具有对应关系。
示例性地，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以在对应关系信息1进行标注，以指示已向第一SMF实体发送异常指示信息。
图6是本申请实施例提供的一种通信方法的示意性流程图。方法600包括S601至S611。
在S601，第一SMF实体与第一UPF实体建立N4偶联。
在第一SMF实体与第一UPF实体建立N4偶联的过程中，第一SMF实体与第一UPF实体进行交互的信息中携带第一UPF实体的N4接口的标识。
在S602，第一SMF实体向UDR实体发送关联信息1。
关联信息1包括第一SMF实体的服务化接口标识、第一SMF实体的N4接口的标识、第一UPF实体的N4接口的标识。
在S603，第一SMF实体与第一UPF实体进行会话建立或会话修改。
在第一SMF实体与第一UPF实体进行会话建立或会话修改的过程中，第一UPF实体与第一SMF实体进行交互的信息中携带第一UPF实体的N3接口的标识和/或N9接口的标识。
在S604，第一SMF实体向UDR实体发送关联信息2。
关联信息2包括第一UPF实体的N4接口的标识，以及第一UPF实体的N3接口的标识和/或N9接口的标识。
应当理解，SPCF实体可以接收至少一个SMF实体发送的关联信息1和关联信息2。该至少一个SMF实体包括第一SMF实体。
之后可以进行S605至S606。
在S605，SPEF实体可以判断第一UPF实体的接口是否异常。
SPEF实体可以对至少一个UPF实体的接口进行检测。具体地，SPEF实体可以获取至少一个UPF实体中每个UPF实体中各个接口与其他网元进行通信的信息。并根据该信息确定各个接口是否异常。
每个UPF实体中任一个接口与其他网元进行通信的信息可以包括该接口的标识。
该至少一个UPF实体包括第一UPF实体。
S605可以多次进行。示例性地，可以周期性进行S605。
在第一UPF实体的接口异常的情况下，可以进行S606。
在S606，SPEF实体可以向SPCF实体发送异常接口信息。
异常接口信息包括第一UPF实体中异常的接口的标识。
之后，可以进行S607和S608。
在S607，SPCF实体向UDR实体发送网元查询信息。
网元查询信息包括第一UPF实体中异常的接口的标识。
网元查询信息还可以包括目标实体类型标识，目标实体类型标识用于指示查询的实体的类型为SMF。
UDR实体可以根据关联信息1，确定与第一UPF实体中异常的接口相关联的SMF的服务化接口。
第一UPF实体中异常的接口为第一UPF实体的N4接口的情况下，SPCF实体根据关联信息1，可以确定与第一UPF实体具有N4偶联的第一SMF的服务化接口的标识。
第一UPF实体中异常的接口为第一UPF实体的N3接口或N9接口的情况下，SPCF实体根据关联信息1和关联信息2，可以确定与第一UPF实体具有N4偶联的第一SMF的N4接口的标识。示例性地，SPCF实体根据关联信息2，可以确定第一UPF实体的N4接口的标识；SPCF实体根据关联信息1，可以确定与第一UPF实体具有N4偶联的第一SMF的服务化接口的标识。
在S608，UDR实体向SPCF实体发送网元响应信息。
网元响应信息包括第一SMF的服务化接口的标识。
网元响应信息还可以包括第一UPF实体的N4接口的标识。
示例性地，UDR实体确定异常的接口不是第一UPF实体的N4接口的情况下，UDR实体发送的网元响应信息包括第一UPF实体的N4接口的标识；UDR实体确定接收的网元查询信息中第一UPF实体中异常的接口为第一UPF实体的N4接口的情况下，UDR实体发送的网元响应信息可以包括或不包括第一UPF实体的N4接口的标识。
之后，可以进行S609至S611。
在S609，SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息。
在S610，第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联。
在S611，第一SMF实体可以在与第一UPF实体存在会话的情况下，进行会话重建或会话的用户面路径调整。
应当理解，S609至S611可以与S411至S413类似，具体可以参见图4中对S411至S413的说明。
方法600中，第一SMF实体将关联信息1和关联信息2注册在UDR实体中。关联信息1用于表示第一SMF实体的服务化接口与第一UPF实体的N4接口的关联关系，关联信息2用于表示第一UPF实体的N4接口和第一UPF实体的N3接口、N9接口的关联关系。SPCF实体将SPEF实体上报的存在异常的接口的标识发送至UDR实体。UDR实体根据关联信息1和关联信息2，向SPCF实体发送与异常接口所属第一UPF实体存在N4偶联的第一SMF实体的服务化接口的标识。SPCF实体按照服务化接口的标识，发送异常指示信息，以向第一SMF实体通知第一UPF实体被攻击，不可信。从而，第一SMF实体可以进行相应处理，以保证通信安全。
在第一SMF实体断开与第一UPF实体的N4接口之间的N4偶联之后，第一SMF实 体可以向UDR实体发送连接断开指示信息。连接断开指示信息可以包括第一SMF实体的N4接口的标识、第一UPF实体的N4接口的标识，连接断开指示信息用于指示第一SMF实体与第一UPF实体断开N4偶联。UDR实体可以根据连接断开指示信息删除关联信息1。
或者，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以向UDR实体发送连接断开指示信息，以指示UDR实体删除关联信息1。
又或者，在SPCF实体按照第一SMF实体的服务化接口的标识发送异常指示信息之后，SPCF实体可以向UDR实体发送通知指示信息，通知指示信息用于指示SPCF实体已向第一SMF实体发送异常指示信息。
图7是申请实施例提供的一种通信方法是示意性流程图。方法700包括S710至S720。方法700可以由第一SMF实体执行。
在S710，接收安全策略控制功能SPCF实体发送的异常指示信息，所述异常指示信息用于指示第一UPF实体被攻击。
在S710，断开与所述第一UPF实体的连接。
第一SMF实体在接收SPCF实体发送的异常指示信息的情况下，断开与第一UPF实体的连接，提供通信系统的安全性。
也就是说，在S710之前，第一SMF实体与第一UPF实体之间存在连接。第一SMF实体与第一UPF实体之间的连接可以是第一SMF实体与第一UPF实体的N4偶联(N4association)。
在一些实施例中，在S710之前，第一SMF实体可以向NRF实体发送接口指示信息。接口指示信息包括第一SMF实体的第二接口的标识和第一SMF实体的第三接口的标识。其中，第三接口用于第一SMF实体与第一UPF实体的连接。
所述异常指示信息是所述SPCF实体根据所述NRF实体发送的第一响应信息发送的，所述第一响应信息包括所述第三接口的标识，所述第一响应信息是所述NRF实体根据第一请求信息发送的，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述SPCF实体在第一UPF实体被攻击的情况下发送的。
也就是说，SPCF实体在第一UPF实体被攻击的情况下，可以确定与第一UPF实体连接的第一SMF实体的第三接口。之后，SPCF实体可以向NRF实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识。SPCF实体可以接收NRF实体发送的第一响应信息，所述第一响应信息包括所述第一SMF实体的第二接口的标识。从而，SPCF实体可以按照第二接口的标识发送异常指示信息，以使得异常指示信息发送至第一SMF实体。
具体地，可以参见图3和图4的说明。接口指示信息可以携带在图4的网络功能注册信息中。第一请求信息可以是图4中的接口查询信息。第二响应信息可以是图4中的查询响应信息。
在另一些实施例中，在S710之前，第一SMF实体可以向SPCF实体发送第一连接指示信息，第一连接指示信息用于指示第一SMF实体连接的至少一个UPF实体，该至少一个UPF实体包括第一UPF实体。
SPCF实体可以接收至少一个SMF实体发送的第一连接指示信息。该至少一个SMF实体包括第一SMF实体。从而，SPCF实体可以确定第一UPF实体连接的SMF实体为第一SMF实体。
第一连接指示信息可以包括第一SMF实体的第二接口的标识，所述异常指示信息是所述SPCF实体按照所述第二接口的标识发送的。
具体地，可以参见图3和图5的说明。第一连接指示信息可以包括图5所示的关联信息1和关联信息2。
在又一些实施例中，在S710之前，第一SMF实体可以向UDR实体发送第二连接指示信息，第二连接指示信息用于指示第一SMF实体连接的至少一个UPF实体，该至少一个UPF实体包括所述第一UPF实体。
所述异常指示信息是所述SPCF实体根据第二响应信息发送的，所述第二响应信息包括第一SMF实体的标识，所述第二响应信息是所述UDR实体根据第二请求信息发送的，所述第二请求信息包括所述第一UPF实体的标识；所述第二请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的。
也就是说，SPCF实体在第一UPF实体被攻击的情况下，可以向UDR实体发送第二请求信息，第二请求信息包括第一UPF实体的标识。SPCF实体可以接收UDR实体发送的第二响应信息，第二响应信息包括第一SMF实体的标识。从而，SPCF实体可以向第一SMF实体发送异常指示信息。
示例性地，第二连接指示信息可以包括第一SMF实体的标识，第一SMF实体的标识包括第一SMF实体的第二接口的标识。异常指示信息可以是所述SPCF实体按照第二接口的标识发送的。
示例性地，第二连接指示信息可以包括所述第一UPF实体的第四接口的标识，第四接口用于第一UPF实体与第一SMF实体连接。第二响应信息还可以包括第四接口的标识，异常指示信息包括所述第四接口的标识。
示例性地，第一UPF实体的标识可以包括第一UPF实体中第一接口的标识。第一接口可以是第一UPF实体中存在异常的接口。第二连接指示信息可以包括第一SMF实体连接的每个UPF实体的各个接口的标识。
SPCF实体可以在第一UPF实体中存在异常的接口的情况下，确定第一UPF实体被攻击。
具体地，可以参见图3和图6的说明。第二连接指示信息可以包括图6所示的关联信息1和关联信息2。第二请求信息可以是图6中的网元查询信息。第二响应信息可以是图6中的网元响应信息。
图8是本申请实施例提供的一种通信方法的示意性流程图。方法800包括S810至S830。方法800可以由NRF实体执行。
在S810，接收第一SMF实体发送的接口指示信息，所述接口指示信息包括所述第一SMF实体的第二接口的标识和所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接。
在S820，接收SPCF实体发送的第一请求信息，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的。
在S830，向所述SPCF实体发送第一响应信息，所述第一响应信息包括所述第三接口的标识，所述第三接口的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示 信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
通过方法800，可以向SPCF实体提供查询功能，在接收SPCF实体发送的第一SMF实体的第二接口的标识的情况下，向SPCF实体发送第一SMF实体的第三接口的标识，从而使得SPCF实体在确定第一UPF实体被攻击的情况下，向与第一UPF实体连接的第一SMF实体发送异常指示信息，提高通信系统的安全性。
具体地，可以参见图3和图5的说明。
图9是本申请实施例提供的一种通信方法的示意性流程图。方法900包括S910至S930。方法900可以由UDR实体执行。
在S910，接收第一SMF实体发送的第二连接指示信息，所述第二连接指示信息用于指示所述第一SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
在S910，接收SPCF实体发送的第二请求信息，所述第二请求信息是所述SPCF实体在确定所述第一UPF实体被攻击的情况下发送的，所述第二请求信息包括所述第一UPF实体的标识。
在S910，向所述SPCF实体发送第二响应信息，所述第二响应信息包括所述第一SMF实体的标识，所述第一SMF实体的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
通过方法900，可以向SPCF实体提供查询功能，在接收SPCF实体发送的第一UPF实体的标识的情况下，向SPCF实体发送与第一UPF实体连接的第一SMF实体的标识，从而使得SPCF实体在确定第一UPF实体被攻击的情况下，能够向第一SMF实体发送异常指示信息，提高通信系统的安全性。
示例性地，第二连接指示信息可以包括第一SMF实体的标识，第一SMF实体的标识可以包括所述第一SMF实体的第二接口的标识，所述异常指示信息是所述SPCF实体按照所述第二接口的标识发送的。
示例性地，第二连接指示信息可以包括所述第一UPF实体的第四接口的标识，第四接口用于第一UPF实体与SMF实体连接。
第二响应信息还可以包括所述第四接口的标识。异常指示信息可以包括第四接口的标识。
示例性地，第二连接指示信息可以包括连接的每个UPF实体中至少一个接口的标识。第二请求信息可以包括第一UPF实体中第一接口的标识。第一UPF实体中至少一个接口的标识包括第一接口的标识。第一接口可以是第一UPF实体中存在异常的接口。
具体地，可以参见图3和图5的说明。
上文结合图1至图9的描述了本申请实施例的方法实施例，下面结合图10至图11，描述本申请实施例的装置实施例。应理解，方法实施例的描述与装置实施例的描述相互对应，因此，未详细描述的部分可以参见前面方法实施例。
图10是本申请实施例提供的一种数据处理装置的示意性结构图。
通信装置2000包括处理模块2010和收发模块2020。
在一些实施例中，通信装置2000可以用于实现前文中SPCF实体的功能。
处理模块2010用于，确定第一用户面功能UPF实体是否被攻击。
收发模块2020用于，在所述第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击，所述第一SMF实体与所述第一UPF实体连接。
可选地，通信装置2000还包括获取模块。获取模块用于获取连接信息，所述连接信息用于指示至少一个SMF实体中每个SMF实体连接的至少一个UPF实体，所述至少一个SMF实体包括所述第一SMF实体。
可选地，处理模块2010具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
可选地，所述连接信息还包括所述第一UPF实体的至少一个接口中每个接口的标识，所述第一UPF实体的至少一个接口包括所述第一接口。
可选地，获取模块用于，接收所述第一SMF实体发送的连接指示信息，所述连接指示信息用于指示所述第一SMF实体连接的至少一个所述UPF实体。
可选地，所述连接指示信息包括所述第一SMF实体的第二接口的标识。
收发模块2020具体用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述连接指示信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
可选地，所述连接信息包括所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接。
收发模块2020还用于，在所述第一UPF实体异常的情况下，向网络存储功能NRF实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识。
收发模块2020还用于，接收所述NRF实体发送第一响应信息，所述第一响应信息包括所述第一SMF实体的第二接口的标识；
收发模块2020具体用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述连接信息是根据所述至少一个UPF实体与所述至少一个SMF实体之间的交互信息确定的，其中，所述第一UPF实体与所述第一SMF实体之间的第一交互信息包括所述第三接口的标识以及所述第一UPF实体的至少一个接口中每个接口的标识。
可选地，所述第一UPF实体的至少一个接口包括第四接口，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
可选地，收发模块2020还用于，在所述第一UPF实体异常的情况下，向统一数据库UDR实体发送第二请求信息，所述第二请求信息包括所述第一UPF实体的标识。
收发模块2020还用于，接收所述UDR实体发送的第二响应信息，所述第二响应信息包括所述第一SMF实体的标识。
可选地，处理模块2010具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
所述第一UPF实体的标识包括所述第一UPF实体中异常的第一接口的标识。
可选地，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识。
收发模块2020具体用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述第二响应信息还包括所述第一UPF实体的第四接口的标识，所述第四 接口用于所述第一UPF实体与所述第一SMF实体连接。
所述异常指示信息包括所述第四接口的标识。
在另一些实施例中，通信装置2000可以用于实现前文中第一SMF实体的功能。
收发模块2020用于，接收安全策略控制功能实体发送的异常指示信息，所述异常指示信息用于指示第一UPF实体被攻击。
处理模块2010用于，断开与所述第一UPF实体的连接。
可选地，收发模块2020还用于，向NRF实体发送接口指示信息，所述接口指示信息包括所述装置2000的第二接口的标识和所述装置2000的第三接口的标识，所述第三接口用于所述装置2000与所述第一UPF实体的连接。
所述异常指示信息是所述安全策略控制功能实体根据所述NRF实体发送的第一响应信息发送的，所述第一响应信息包括所述第三接口的标识。
所述第一响应信息是所述NRF实体根据第一请求信息发送的，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的。
可选地，收发模块2020还用于，向所述安全策略控制功能实体发送第一连接指示信息，所述第一连接指示信息用于指示所述装置2000连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
可选地，所述第一连接指示信息包括所述装置2000的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，收发模块2020还用于，向UDR实体发送第二连接指示信息，所述第二连接指示信息用于指示装置2000连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
所述异常指示信息是所述安全策略控制功能实体根据第二响应信息发送的，所述第二响应信息包括装置2000的标识。
所述第二响应信息是所述UDR实体根据第二请求信息发送的，所述第二请求信息包括所述第一UPF实体的标识。
所述第二请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的。
可选地，所述第二连接指示信息包括装置2000的标识，装置2000的标识包括装置2000的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与装置2000连接。
所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
在又一些实施例中，通信装置2000可以用于实现前文中NRF实体的功能。
收发模块2020还用于，接收第一SMF实体发送的接口指示信息，所述接口指示信息包括所述第一SMF实体的第二接口的标识和所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接；
收发模块2020还用于，接收安全策略控制功能实体发送的第一请求信息，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的；
收发模块2020还用于，向所述安全策略控制功能实体发送第一响应信息，所述第一响应信息包括所述第三接口的标识，所述第三接口的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
处理模块2010可以用于控制收发模块2020，以使得收发模块2020实现上述功能。
在又一些实施例中，通信装置2000可以是UDR实体，或用于实现前文中UDR实体的功能。
收发模块2020用于，接收第一SMF实体发送的第二连接指示信息，所述第二连接指示信息用于指示所述第一SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
收发模块2020还用于，接收安全策略控制功能实体发送的第二请求信息，所述第二请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的，所述第二请求信息包括所述第一UPF实体的标识。
收发模块2020还用于，向所述安全策略控制功能实体发送第二响应信息，所述第二响应信息包括所述第一SMF实体的标识，所述第一SMF实体的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
可选地，所述第二连接指示信息包括所述第一SMF实体的标识，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述SMF实体连接，所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
处理模块2010可以用于控制收发模块2020，以使得收发模块2020实现上述功能。
图8是本申请实施例提供的一种数据处理装置的示意性结构图。
通信装置3000包括至少一个处理器3010和通信接口3020。
通信接口3020用于通信装置3000与其他通信装置进行信息交互。
当程序指令在至少一个处理器3010中执行时，至少一个处理器3010用于执行上文所述的方法。
在一些实施例中，通信装置3000可以用于实现前文中SPCF实体的功能。
处理器3010用于，确定第一用户面功能UPF实体是否被攻击。
通信接口3020用于，在所述第一UPF实体被攻击的情况下，向第一会话管理功能SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击，所述第一SMF实体与所述第一UPF实体连接。
可选地，通信接口3020还用于，获取连接信息，所述连接信息用于指示至少一个SMF实体中每个SMF实体连接的至少一个UPF实体，所述至少一个SMF实体包括所述第一SMF实体。
可选地，处理器3010具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
可选地，所述连接信息还包括所述第一UPF实体的至少一个接口中每个接口的标识，所述第一UPF实体的至少一个接口包括所述第一接口。
可选地，通信接口3020还用于，接收所述第一SMF实体发送的连接指示信息，所述连接指示信息用于指示所述第一SMF实体连接的至少一个所述UPF实体。
可选地，所述连接指示信息包括所述第一SMF实体的第二接口的标识。
通信接口3020还用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述连接指示信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
可选地，所述连接信息包括所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接。
通信接口3020还用于，在所述第一UPF实体异常的情况下，向网络存储功能NRF实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识。
通信接口3020还用于，接收所述NRF实体发送第一响应信息，所述第一响应信息包括所述第一SMF实体的第二接口的标识。
通信接口3020还用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述连接信息是根据所述至少一个UPF实体与所述至少一个SMF实体之间的交互信息确定的，其中，所述第一UPF实体与所述第一SMF实体之间的第一交互信息包括所述第三接口的标识以及所述第一UPF实体的至少一个接口中每个接口的标识。
可选地，所述第一UPF实体的至少一个接口包括第四接口，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接，所述异常指示信息包括所述第四接口的标识。
可选地，通信接口3020还用于，在所述第一UPF实体异常的情况下，向统一数据库UDR实体发送第二请求信息，所述第二请求信息包括所述第一UPF实体的标识。
通信接口3020还用于，接收所述UDR实体发送的第二响应信息，所述第二响应信息包括所述第一SMF实体的标识。
可选地，处理器3010具体用于，确定所述第一UPF实体的第一接口是否异常，在所述第一接口异常的情况下所述第一UPF实体被攻击。
所述第一UPF实体的标识包括所述第一UPF实体中异常的第一接口的标识。
可选地，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识。
通信接口3020还用于，按照所述第二接口的标识，发送所述异常指示信息。
可选地，所述第二响应信息还包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述第一SMF实体连接。
所述异常指示信息包括所述第四接口的标识。
在另一些实施例中，通信装置3000可以用于实现前文中第一SMF实体的功能。
通信接口3020用于，接收安全策略控制功能实体发送的异常指示信息，所述异常指示信息用于指示第一UPF实体被攻击。
处理器3010用于，断开与所述第一UPF实体的连接。
可选地，通信接口3020还用于，向NRF实体发送接口指示信息，所述接口指示信息包括所述装置3000的第二接口的标识和所述装置3000的第三接口的标识，所述第三接口用于所述装置3000与所述第一UPF实体的连接。
所述异常指示信息是所述安全策略控制功能实体根据所述NRF实体发送的第一响应信息发送的，所述第一响应信息包括所述第三接口的标识。
所述第一响应信息是所述NRF实体根据第一请求信息发送的，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的。
可选地，通信接口3020还用于，向所述安全策略控制功能实体发送第一连接指示信息，所述第一连接指示信息用于指示所述装置3000连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
可选地，所述第一连接指示信息包括所述装置3000的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，通信接口3020还用于，向UDR实体发送第二连接指示信息，所述第二连接指示信息用于指示装置3000连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
所述异常指示信息是所述安全策略控制功能实体根据第二响应信息发送的，所述第二响应信息包括装置3000的标识。
所述第二响应信息是所述UDR实体根据第二请求信息发送的，所述第二请求信息包括所述第一UPF实体的标识。
所述第二请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的。
可选地，所述第二连接指示信息包括装置3000的标识，装置3000的标识包括装置3000的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与装置3000连接。
所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
在又一些实施例中，通信装置3000可以用于实现前文中NRF实体的功能。
通信接口3020还用于，接收第一SMF实体发送的接口指示信息，所述接口指示信息包括所述第一SMF实体的第二接口的标识和所述第一SMF实体的第三接口的标识，所述第三接口用于所述第一SMF实体与所述第一UPF实体的连接；
通信接口3020还用于，接收安全策略控制功能实体发送的第一请求信息，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的；
通信接口3020还用于，向所述安全策略控制功能实体发送第一响应信息，所述第一响应信息包括所述第三接口的标识，所述第三接口的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
处理器3010可以用于控制通信接口3020，以使得通信接口3020实现上述功能。
在又一些实施例中，通信装置3000可以是UDR实体，或用于实现前文中UDR实体的功能。
通信接口3020用于，接收第一SMF实体发送的第二连接指示信息，所述第二连接指示信息用于指示所述第一SMF实体连接的至少一个UPF实体，所述至少一个UPF实体包括所述第一UPF实体。
通信接口3020还用于，接收安全策略控制功能实体发送的第二请求信息，所述第二请求信息是所述安全策略控制功能实体在所述第一UPF实体被攻击的情况下发送的，所述第二请求信息包括所述第一UPF实体的标识。
通信接口3020还用于，向所述安全策略控制功能实体发送第二响应信息，所述第二响应信息包括所述第一SMF实体的标识，所述第一SMF实体的标识用于所述第一SMF实体向所述第一SMF实体发送异常指示信息，所述异常指示信息用于指示所述第一UPF实体被攻击。
可选地，所述第二连接指示信息包括所述第一SMF实体的标识，所述第一SMF实体的标识包括所述第一SMF实体的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
可选地，所述第二连接指示信息包括所述第一UPF实体的第四接口的标识，所述第四接口用于所述第一UPF实体与所述SMF实体连接，所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
处理器3010可以用于控制通信接口3020，以使得通信接口3020实现上述功能。
此外，以上装置中的各单元可以全部或部分可以集成在一起，或者可以独立实现。在一种实现中，这些单元集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。该SOC中可以包括至少一个处理器，用于实现以上任一种方法或实现该装置各单元的功能，该至少一个处理器的种类可以不同，例如包括CPU和FPGA，CPU和人工智能处理器，CPU和图形处理器(graphics processing unit，GPU)等。
本申请实施例还提供一种计算机程序存储介质，其特征在于，所述计算机程序存储介质具有程序指令，当所述程序指令被执行时，使得前文中的方法被执行。
本申请实施例还提供一种芯片系统，其特征在于，所述芯片系统包括至少一个处理器，当程序指令在所述至少一个处理器中执行时，使得前文中的方法被执行。
本申请实施例还提供一种程序产品，所述计算机程序产品包括程序指令，当所述程序指令在计算机设备中被执行时，使得前文的数据处理方法被执行。
本申请实施例还提供一种通信系统，包括至少一个SMF实体，至少一个UPF实体、前文所述的通信装置。至少一个SMF实体包括第一SMF实体，至少一个UPF实体包括第一SMF实体。
通信系统还可以包括NRF实体或UDR实体。
应理解，本申请实施例中的处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、 分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
本申请实施例中采用诸如“第一”、“第二”的前缀词，仅仅为了区分不同的描述对象，对被描述对象的位置、顺序、优先级、数量或内容等没有限定作用。例如，被描述对象为“接口”，则“第一接口”和“第二接口”中“接口”之前的序数词并不限制“接口”之间的位置或顺序或优先级；再如，被描述对象为“请求信息”，则“第一请求信息”和“第二请求信息”中“请求信息”之前的序数词并不限制“请求信息”之间的位置或顺序或优先级。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种通信方法，其特征在于，包括：
    确定第一用户面功能实体是否被攻击；
    在所述第一用户面功能实体被攻击的情况下，向第一会话管理功能实体发送异常指示信息，所述第一会话管理功能实体与所述第一用户面功能实体连接，所述异常指示信息用于指示所述第一用户面功能实体被攻击。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取连接信息，所述连接信息用于指示至少一个会话管理功能实体中每个会话管理功能实体连接的至少一个用户面功能实体，所述至少一个会话管理功能实体包括所述第一会话管理功能实体。
  3. 根据权利要求2所述的方法，其特征在于，所述确定第一用户面功能实体是否被攻击，包括：确定所述第一用户面功能实体的第一接口是否异常，在所述第一接口异常的情况下所述第一用户面功能实体被攻击。
  4. 根据权利要求3所述的方法，其特征在于，所述连接信息还包括所述第一用户面功能实体的至少一个接口中每个接口的标识，所述第一用户面功能实体的至少一个接口包括所述第一接口。
  5. 根据权利要求2-4中任一项所述的方法，其特征在于，所述获取连接信息，包括：
    接收所述第一会话管理功能实体发送的连接指示信息，所述连接指示信息用于指示所述第一会话管理功能实体连接的至少一个所述用户面功能实体。
  6. 根据权利要求5所述的方法，其特征在于，所述连接指示信息包括所述第一会话管理功能实体的第二接口的标识；
    所述向第一会话管理功能实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述连接指示信息还包括所述第一用户面功能实体的第四接口的标识，所述第四接口用于所述第一用户面功能实体与所述第一会话管理功能实体连接，所述异常指示信息包括所述第四接口的标识。
  8. 根据权利要求2-4中任一项所述的方法，其特征在于，所述连接信息包括所述第一会话管理功能实体的第三接口的标识，所述第三接口用于所述第一会话管理功能实体与所述第一用户面功能实体的连接，所述方法还包括：
    在所述第一用户面功能实体异常的情况下，向网络存储功能实体发送第一请求信息，所述第一请求信息包括所述第三接口的标识；
    接收所述网络存储功能实体发送第一响应信息，所述第一响应信息包括所述第一会话管理功能实体的第二接口的标识；
    所述向第一会话管理功能实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
  9. 根据权利要求8所述的方法，其特征在于，
    所述连接信息是根据所述至少一个用户面功能实体与所述至少一个会话管理功能实 体之间的交互信息确定的，其中，所述第一用户面功能实体与所述第一会话管理功能实体之间的第一交互信息包括所述第三接口的标识以及所述第一用户面功能实体的至少一个接口中每个接口的标识。
  10. 根据权利要求9所述的方法，其特征在于，
    所述第一用户面功能实体的至少一个接口包括包括第四接口，所述第四接口用于所述第一用户面功能实体与所述第一会话管理功能实体连接，所述异常指示信息包括所述第四接口的标识。
  11. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述第一用户面功能实体异常的情况下，向统一数据库实体发送第二请求信息，所述第二请求信息包括所述第一用户面功能实体的标识；
    接收所述统一数据库实体发送的第二响应信息，所述第二响应信息包括所述第一会话管理功能实体的标识。
  12. 根据权利要求11所述的方法，其特征在于，所述确定第一用户面功能实体是否被攻击，包括：确定所述第一用户面功能实体的第一接口是否异常，在所述第一接口异常的情况下所述第一用户面功能实体被攻击；
    所述第一用户面功能实体的标识包括所述第一用户面功能实体中异常的第一接口的标识。
  13. 根据权利要求11或12所述的方法，其特征在于，所述第一会话管理功能实体的标识包括所述第一会话管理功能实体的第二接口的标识，
    所述向第一会话管理功能实体发送异常指示信息，包括：按照所述第二接口的标识，发送所述异常指示信息。
  14. 根据权利要求11-13中任一项所述的方法，其特征在于，
    所述第二响应信息还包括所述第一用户面功能实体的第四接口的标识，所述第四接口用于所述第一用户面功能实体与所述第一会话管理功能实体连接，
    所述异常指示信息包括所述第四接口的标识。
  15. 一种通信方法，其特征在于，应用于会话管理功能实体，所述方法包括：
    接收安全策略控制功能实体发送的异常指示信息，所述异常指示信息用于指示第一用户面功能实体被攻击；
    断开与所述第一用户面功能实体的连接。
  16. 根据权利要求15所述的方法，其特征在于，
    所述方法还包括：向网络存储功能实体发送接口指示信息，所述接口指示信息包括所述会话管理功能实体的第二接口的标识和所述会话管理功能实体的第三接口的标识，所述第三接口用于所述会话管理功能实体与所述第一用户面功能实体的连接；
    所述异常指示信息是所述安全策略控制功能实体根据所述网络存储功能实体发送的第一响应信息发送的，所述第一响应信息包括所述第三接口的标识，
    所述第一响应信息是所述网络存储功能实体根据第一请求信息发送的，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一用户面功能实体被攻击的情况下发送的。
  17. 根据权利要求15所述的方法，其特征在于，
    所述方法还包括：向所述安全策略控制功能实体发送第一连接指示信息，所述第一连接指示信息用于指示所述会话管理功能实体连接的至少一个用户面功能实体，所述至少一个用户面功能实体包括所述第一用户面功能实体。
  18. 根据权利要求17所述的方法，其特征在于，所述第一连接指示信息包括所述会话管理功能实体的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
  19. 根据权利要求15所述的方法，其特征在于，
    所述方法还包括：向统一数据库实体发送第二连接指示信息，所述第二连接指示信息用于指示所述会话管理功能实体连接的至少一个用户面功能实体，所述至少一个用户面功能实体包括所述第一用户面功能实体；
    所述异常指示信息是所述安全策略控制功能实体根据第二响应信息发送的，所述第二响应信息包括所述会话管理功能实体的标识，
    所述第二响应信息是所述统一数据库实体根据第二请求信息发送的，所述第二请求信息包括所述第一用户面功能实体的标识；
    所述第二请求信息是所述安全策略控制功能实体在所述第一用户面功能实体被攻击的情况下发送的。
  20. 根据权利要求19所述的方法，其特征在于，所述第二连接指示信息包括所述会话管理功能实体的标识，所述会话管理功能实体的标识包括所述会话管理功能实体的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
  21. 根据权利要求19或20中任一项所述的方法，其特征在于，所述第二连接指示信息包括所述第一用户面功能实体的第四接口的标识，所述第四接口用于所述第一用户面功能实体与所述会话管理功能实体连接，
    所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
  22. 一种通信方法，其特征在于，包括：
    接收第一会话管理功能实体发送的接口指示信息，所述接口指示信息包括所述第一会话管理功能实体的第二接口的标识和所述第一会话管理功能实体的第三接口的标识，所述第三接口用于所述第一会话管理功能实体与所述第一用户面功能实体的连接；
    接收安全策略控制功能实体发送的第一请求信息，所述第一请求信息包括所述第二接口的标识，所述第一请求信息是所述安全策略控制功能实体在所述第一用户面功能实体被攻击的情况下发送的；
    向所述安全策略控制功能实体发送第一响应信息，所述第一响应信息包括所述第三接口的标识，所述第三接口的标识用于所述第一会话管理功能实体向所述第一会话管理功能实体发送异常指示信息，所述异常指示信息用于指示所述第一用户面功能实体被攻击。
  23. 一种通信方法，其特征在于，包括：
    接收第一会话管理功能实体发送的第二连接指示信息，所述第二连接指示信息用于指示所述第一会话管理功能实体连接的至少一个用户面功能实体，所述至少一个用户面功能实体包括所述第一用户面功能实体；
    接收安全策略控制功能实体发送的第二请求信息，所述第二请求信息是所述安全策略控制功能实体在所述第一用户面功能实体被攻击的情况下发送的，所述第二请求信息包括所述第一用户面功能实体的标识；
    向所述安全策略控制功能实体发送第二响应信息，所述第二响应信息包括所述第一会话管理功能实体的标识，所述第一会话管理功能实体的标识用于所述第一会话管理功能实体向所述第一会话管理功能实体发送异常指示信息，所述异常指示信息用于指示所述第一用户面功能实体被攻击。
  24. 根据权利要求23所述的方法，其特征在于，所述第二连接指示信息包括所述第一会话管理功能实体的标识，所述第一会话管理功能实体的标识包括所述第一会话管理功能实体的第二接口的标识，所述异常指示信息是所述安全策略控制功能实体按照所述第二接口的标识发送的。
  25. 根据权利要求23或24所述的方法，其特征在于，所述第二连接指示信息包括所述第一用户面功能实体的第四接口的标识，所述第四接口用于所述第一用户面功能实体与所述会话管理功能实体连接，
    所述第二响应信息还包括所述第四接口的标识，所述异常指示信息包括所述第四接口的标识。
  26. 一种通信装置，其特征在于，包括用于执行权利要求1-25中任一项所述的方法的各个模块。
  27. 一种通信装置，其特征在于，包括至少一个处理器和通信接口，所述通信接口用于所述通信装置与其他通信装置进行信息交互，当程序指令在所述至少一个处理器中执行时，使得所述通信装置执行如权利要求1至25中任一项所述的方法。
  28. 一种计算机程序产品，其特征在于，包括程序指令，当所述程序指令被执行时，如权利要求1至25中任一项所述的方法被执行。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读介质存储用于设备执行的程序代码，当所述程序指令被执行时，如权利要求1至25中任一项所述的方法被执行。
  30. 一种芯片，其特征在于，所述芯片包括至少一个处理器，当程序指令被所述至少一个处理器中执行时，使得如权利要求1至25中任一项所述的方法被执行。
PCT/CN2023/074957 2022-02-28 2023-02-08 通信方法与装置 Ceased WO2023160390A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210190092.9A CN116709337A (zh) 2022-02-28 2022-02-28 通信方法与装置
CN202210190092.9 2022-02-28

Publications (1)

Publication Number Publication Date
WO2023160390A1 true WO2023160390A1 (zh) 2023-08-31

Family

ID=87764800

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/074957 Ceased WO2023160390A1 (zh) 2022-02-28 2023-02-08 通信方法与装置

Country Status (2)

Country Link
CN (1) CN116709337A (zh)
WO (1) WO2023160390A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190254083A1 (en) * 2018-02-12 2019-08-15 Cisco Technology, Inc. Methods and apparatus for selecting network slice, session management and user plane functions
CN110557791A (zh) * 2018-05-31 2019-12-10 华为技术有限公司 会话管理方法、设备及系统
CN112492573A (zh) * 2017-02-21 2021-03-12 华为技术有限公司 一种选择会话管理功能实体的方法、装置和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112492573A (zh) * 2017-02-21 2021-03-12 华为技术有限公司 一种选择会话管理功能实体的方法、装置和系统
US20190254083A1 (en) * 2018-02-12 2019-08-15 Cisco Technology, Inc. Methods and apparatus for selecting network slice, session management and user plane functions
CN110557791A (zh) * 2018-05-31 2019-12-10 华为技术有限公司 会话管理方法、设备及系统

Also Published As

Publication number Publication date
CN116709337A (zh) 2023-09-05

Similar Documents

Publication Publication Date Title
US11778459B2 (en) Secure session method and apparatus
CN113630749B (zh) 一种获取边缘服务的方法和装置
US12445837B2 (en) Key obtaining method and communication apparatus
EP4406208A1 (en) Restricting onboard traffic
CN116193431B (zh) 切片认证方法及装置
EP3681182B1 (en) Method, apparatus and device for determining state of terminal device
CN113873492B (zh) 一种通信方法以及相关装置
EP4376461A1 (en) Method and device for operating terminal in wireless communication system
WO2022199451A1 (zh) 会话切换的方法和装置
CN114071639A (zh) 接入网络的方法、通信系统和通信装置
WO2022237857A1 (zh) 确定安全保护开启方式的方法、通信方法及通信装置
US20240380730A1 (en) Enabling distributed non-access stratum terminations
WO2023051427A1 (zh) 通信的方法和装置
WO2023160394A1 (zh) 通信的方法和装置
US20240267433A1 (en) Communication method, apparatus, and system
WO2018176187A1 (zh) 数据传输方法、用户设备和控制面节点
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2023143212A1 (zh) 一种通信方法及装置
WO2023116556A1 (zh) 会话切换的方法和装置
US20250184863A1 (en) Message routing method and apparatus
WO2023160390A1 (zh) 通信方法与装置
CN117098129A (zh) 通信方法和装置
WO2022174729A1 (zh) 保护身份标识隐私的方法与通信装置
CN116866893A (zh) 通信的方法和装置
WO2022067736A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23759015

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 23759015

Country of ref document: EP

Kind code of ref document: A1