Patent Description:
A public land mobile network (PLMN) is a public network established and operated to provide land mobile communication services to the public. With the development of network services, a non-public network (NPN) has appeared. The NPN is a network established separately for some groups of people. In a scenario where a public network and an NPN coexist, how to implement network access control becomes a technical problem that needs a prompt solution. <NPL>, discloses a solution for key issue <NUM> on supporting simultaneous access to PLMN and non-public services and session continuity when moving outside coverage of the PLMN or non-public network. (3GPP TR <NUM> v16. <NUM>) discloses <NUM>rd generation partnership project; technical specification group services and system aspects; study on enhancement of <NUM> system for vertical and local area network services. <NPL> discloses a solution on the key issue #<NUM> NW discovery & selection and access control for non-public networks and updates the solution on NW identification since SA1 decided to remove the terms type a/b. <NPL>, discloses an overall evaluation and conclusion for key issue <NUM> "Accessing PLMN services via non-public networks and vice versa". <NPL>, discloses an proposal for consolidated service requirements of AVPROD. <CIT> discloses methods and systems for mobility in enterprises networks. The methods provide a mobile wireless device with access to both an enterprise network and an external network by establishing a proxy connection between a gateway component of the enterprise network and a gateway component of the external network. Such embodiments may maintain the security of the enterprise network. Additionally, such embodiments may not require modification of the User Equipment or of components of the external works.

Embodiments of this disclosure provide a network access control method, a computer-readable medium, and an electronic device, which can effectively implement network access control in an disclosure scenario where a public network and an NPN coexist.

Other features and advantages of this disclosure become obvious through the following detailed descriptions, or may be partially learned through the practice of this disclosure.

According to an aspect of the embodiments of this disclosure, a network access control method is provided. The method is applicable to a terminal device, and includes:
receiving a network access control policy, wherein the network access control policy comprises a service priority of the public network and a service priority of the NPN; obtaining a network connection capability of the terminal device, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent; and based on the network access control policy, performing access control on the terminal device according to a network service requirement and the network connection capability of the terminal device when the terminal device is in a connected state, the network service requirement comprising a network access requirement corresponding to a network service the terminal device is to process.

According to an aspect of the embodiments of this disclosure, a network access control method is provided. The method is applicable to a network side device and includes:
generating a network access control policy, the network access control policy being used for enabling a terminal device to perform access control according to a network service requirement and a network connection capability, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent wherein the network access control policy comprises a service priority of the public network and a service priority of the NPN; and configuring the network access control policy for the terminal device, wherein the terminal device obtains a network connection capability of the terminal device, the network connection capability comprising a capability of connecting to a public network and a non-public network (NPN) that are mutually independent; and based on the network access control policy, the terminal device performs access control on the terminal device according to a network service requirement and the network connection capability of the terminal device in response to the terminal device being in a connected state; the network service requirement comprising a network access requirement corresponding to a network service the terminal device is to process.

According to an aspect of the embodiments of this disclosure, a network access control method is provided. The method is applicable to a network side device, and includes:
generating a tracking area (TA) of an NPN, the NPN being a network formed using a network slice of a public network, the TA of the NPN being different from a TA of the public network; and configuring the TA of the NPN or the TA of the public network for a terminal device within any TA configuration period, so that the terminal device in an idle state or an inactive state enters a connected state when a tracking area update (TAU) occurs, to obtain network access control information.

According to an aspect of the embodiments of this disclosure, a network access control method is provided. The method is applicable to a network side device, and includes:
obtaining identification information of an NPN, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located; and configuring the identification information of the NPN for the terminal device, so that the terminal device in an idle state or an inactive state determines, according to the identification information of the NPN, whether to search for the NPN.

According to an aspect of the embodiments of this disclosure, a network access control method is provided. The method is applicable to a terminal device, and includes:
obtaining identification information of an NPN configured by a network side device, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located; and determining, according to the identification information of the NPN when the terminal device in an idle state or an inactive state, whether to search for the NPN.

According to an aspect of the embodiments of this disclosure, a network access control apparatus is provided, the apparatus including:
an obtaining unit, configured to receive a network access control policy, wherein the network access control policy comprises a service priority of the public network and a service priority of the NPN; obtain a network connection capability of a terminal device, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent; and a control unit, configured to based on the network access control policy, perform access control on the terminal device according to a network service requirement and the network connection capability of the terminal device when the terminal device is in a connected state, the network service requirement comprising a network access requirement corresponding to a network service the terminal device is to process.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is configured to: control, when it is determined according to the network connection capability that the terminal device can support simultaneous connections to the public network and the NPN and in response to that the terminal device needs to process a public network service and an NPN service simultaneously, the terminal device to access the public network and the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is configured to: control, when it is determined according to the network connection capability that the terminal device does not support simultaneous connections to the public network and the NPN, the terminal device according to a network service the terminal device needs to process to access the public network or the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is configured to: control, in response to that the terminal device needs to process a public network service, the terminal device to access the public network; control, in response to that the terminal device needs to process an NPN service, the terminal device to access the NPN; and control, in response to that the terminal device needs to process the public network service and the NPN service simultaneously, the terminal device according to a service priority of the public network and a service priority of the NPN to access a network with a higher service priority.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is configured to: control, when it is determined according to the network connection capability that the terminal device does not support simultaneous connections to the public network and the NPN and in response to that network quality of one of the public network and the NPN cannot meet the service requirement, the terminal device to access the other network.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is configured to: when the terminal device is connected to a first network of the public network and the NPN and network quality of the first network cannot meet the service requirement and in response to that a service of the first network needs to be processed, control the terminal device to access a second network of the public network and the NPN, and access the first network via the second network to process the service of the first network.

In some embodiments of this disclosure, based on the foregoing solution, the control unit is further configured to: when the terminal device is connected to a first network of the public network and the NPN and network quality of a second network of the public network and the NPN cannot meet the service requirement or the terminal device cannot connect to the second network and in response to that a service of the second network needs to be processed, access the second network via the first network to process the service of the second network.

In some embodiments of this disclosure, based on the foregoing solution, a gateway device of the public network is connected to a gateway device of the NPN.

According to an aspect of the embodiments of this disclosure, a network access control apparatus is provided, the apparatus including:.

a generation unit, configured to generate a network access control policy, the network access control policy being used for enabling a terminal device to perform access control according to a network service requirement and a network connection capability, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent, wherein the network access control policy comprises a service priority of the public network and a service priority of the NPN; and a configuration unit, configured to configure the network access control policy for the terminal device, wherein the terminal device obtains a network connection capability of the terminal device, the network connection capability comprising a capability of connecting to a public network and a non-public network (NPN) that are mutually independent; and based on the network access control policy, the terminal device performs access control on the terminal device according to a network service requirement and the network connection capability of the terminal device in response to the terminal device being in a connected state; the network service requirement comprising a network access requirement corresponding to a network service the terminal device is to process.

In some embodiments of this disclosure, based on the foregoing solution, the network access control policy includes a service priority of the public network and a service priority of the NPN, the service priorities being represented by priorities of frequency information of the networks, or the service priorities being represented by priorities of network cells in the same frequency band.

In some embodiments of this disclosure, based on the foregoing solution, the configuration unit is configured to: configure, when the terminal device is in an idle state or an inactive state, the network access control policy for the terminal device by configuring a cell reselection parameter or a redirection parameter.

In some embodiments of this disclosure, based on the foregoing solution, the network access control apparatus further includes: a determining unit, configured to determine, according to identification information of the NPN and subscription information of the terminal device when it is detected that the terminal device needs to access the NPN, whether the terminal device can access the NPN.

According to an aspect of the embodiments of this disclosure, a network access control apparatus is provided, the apparatus including:
a generation unit, configured to generate a TA of an NPN, the NPN being a network formed using a network slice of a public network, the TA of the NPN being different from a TA of the public network; and a configuration unit, configured to configure the TA of the NPN or the TA of the public network for a terminal device within any TA configuration period, so that the terminal device in an idle state or an inactive state enters a connected state when a TAU occurs, to obtain network access control information.

In some embodiments of this disclosure, based on the foregoing solution, network cells in the same TA support the same network slice.

According to an aspect of the embodiments of this disclosure, a network access control apparatus is provided, the apparatus including:
an obtaining unit, configured to obtain identification information of an NPN, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located; and a configuration unit, configured to configure the identification information of the NPN for the terminal device, so that the terminal device in an idle state or an inactive state determines, according to the identification information of the NPN, whether to search for the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the network access control apparatus further includes: a transmission unit, configured to transmit configuration information to the terminal device when indication information that is transmitted by the terminal device in the idle state or the inactive state and requests access to the NPN is received, to control access of the terminal device to the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the identification information of the NPN includes at least one of the following: location information of a network cell of the NPN, information of geographic locations covered by the NPN, and frequency information of the NPN.

According to an aspect of the embodiments of this disclosure, a network access control apparatus is provided, the apparatus including:
an obtaining unit, configured to obtain identification information of an NPN configured by a network side device, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located; and a configuration unit, configured to determine, according to the identification information of the NPN when the terminal device in an idle state or an inactive state, whether to search for the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the processing unit is configured to: perform a search process on the NPN when the identification information of the NPN is detected; and stop, when the identification information of the NPN is not detected, searching for the NPN.

In some embodiments of this disclosure, based on the foregoing solution, the configuration unit is further configured to: transmit, when it is necessary to access the NPN, indication information requesting access to the NPN to the network side device, and perform a network access process according to configuration information fed back by the network side device for the indication information.

According to an aspect of the embodiments of this disclosure, a computer-readable medium is provided, storing a computer program, the computer program, when executed by a processor, implementing the network access control method performed by a terminal device or the network access control method performed by a network side device according to the foregoing embodiments.

According to an aspect of the embodiments of this disclosure, an electronic device is provided, including: one or more processors; and a storage apparatus, configured to store one or more programs, the one or more programs, when executed by the one or more processors, causing the one or more processors to implement the network access control method performed by a terminal device or the network access control method performed by a network side device according to the foregoing embodiments.

In the technical solution provided in some embodiments of this disclosure, when the terminal device is in a connected state, access control is performed on the terminal device according to the network service requirement and the network connection capability (that is, the capability to connect to a public network and an NPN that are mutually independent) of the terminal device. Therefore, in an disclosure scenario where the public network and the NPN coexist, the network access control can be implemented based on the network service requirement and the network connection capability of the terminal device, thereby ensuring that a communication system can support the processing of a public network service and an NPN service.

In the technical solution provided in some embodiments of this disclosure, the TA of the NPN is generated, and the TA of the NPN is different from the TA of the public network. The TA of the NPN or the TA of the public network is configured for the terminal device within any TA configuration period, which enables the terminal device in the idle state or the inactive state to enter a connected state when the TAU occurs to obtain network access control information (for example, the terminal device enters the TA of the public network from the TA of the NPN, or enters the TA of the NPN from the TA of the public network), to implement network access control, thereby ensuring that the communication system can support the processing of the public network service and the NPN service.

In the technical solution provided in some embodiments of this disclosure, the identification information of the NPN is obtained, and the identification information of the NPN is used for identifying an area in which the NPN is located. The identification information of the NPN is configured for the terminal device, so that the terminal device in the idle state or the inactive state may determine, according to the identification information of the NPN, whether to search for the NPN. For example, the terminal device may perform an NPN search process when the identification information of the NPN is detected, and stop, when the identification information of the NPN is not detected, searching for the NPN, thereby avoiding the increase in power consumption of the terminal device caused by frequent searches for the NPN on the premise that network access control is implemented.

It is to be understood that the foregoing general descriptions and the following detailed descriptions are merely for illustration and explanation purposes and are not intended to limit this disclosure.

Accompanying drawings herein are incorporated into a specification and constitute a part of this specification, show embodiments that conform to this disclosure, and are used for describing a principle of this disclosure together with this specification. Apparently, the accompanying drawings described below are merely some embodiments of this disclosure, and a person of ordinary skill in the art may further obtain other accompanying drawings according to the accompanying drawings without creative efforts. In the accompanying drawings:.

Exemplary implementations will now be described more thoroughly with reference to the accompanying drawings. However, the exemplary implementations may be implemented in various forms, and are not to be understood as being limited to the examples described herein. Instead, the implementations are provided to make this disclosure more thorough and complete and fully convey the idea of the exemplary implementations to a person skilled in the art.

In addition, the described features, structures or characteristics may be combined in one or more embodiments in any appropriate manner. In the following descriptions, a lot of specific details are provided to give a full understanding of the embodiments of this disclosure. However, a person of ordinary skill in the art is to be aware that, the technical solutions in this disclosure may be implemented without one or more of the particular details, or another method, unit, apparatus, or step may be used. In other cases, well-known methods, apparatuses, implementations, or operations are not shown or described in detail, in order not to obscure the aspects of this disclosure.

The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, the functional entities may be implemented in at least one of a software form, or in one or more hardware modules or integrated circuits, or in different networks or processor apparatuses or microcontroller apparatuses.

The flowcharts shown in the accompanying drawings are merely examples for descriptions, do not need to include all content and operations (or steps), and do not need to be performed in the described orders either. For example, some operations or steps may be further divided, while some operations or steps may be combined or partially combined. Therefore, an actual execution order may change according to an actual case.

<FIG> is a schematic diagram of an exemplary system architecture to which a technical solution according to an embodiment of this disclosure is applicable.

As shown in <FIG>, the system architecture may include a terminal device <NUM>, a public network base station <NUM>, and an NPN base station <NUM>. The terminal device <NUM> may be a smart phone shown in <FIG>, or may be a tablet computer, a portable computer, a desktop computer, or the like, which is not limited in this disclosure. The public network base station <NUM> and the NPN base station <NUM> are independently deployed, and form a public network and an NPN respectively.

One terminal device <NUM>, one public network base station <NUM>, and one NPN base station <NUM> in <FIG> are only illustrative. According to implementation requirements, there may be any quantities of terminal devices <NUM>, public network base stations <NUM>, and NPN base stations <NUM>.

In an embodiment of this disclosure, the public network base station <NUM> may generate a network access control policy, the network access control policy being used for enabling the terminal device <NUM> to perform access control according to a network service requirement and a network connection capability, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent, so that the public network base station <NUM> may configure the network access control policy for the terminal device <NUM>.

In an embodiment of this disclosure, after the terminal device <NUM> obtains the network access control policy, when the terminal device <NUM> is in a connected state, access control can be performed on the terminal device <NUM> according to the network service requirement and the network connection capability of the terminal device <NUM>, which ensures that a communication system can support the processing of a public network service and an NPN service.

As shown in <FIG>, the system architecture may include a terminal device <NUM> and a public network base station <NUM>. The terminal device <NUM> may be a smart phone shown in <FIG>, or may be a tablet computer, a portable computer, a desktop computer, or the like, which is not limited in this disclosure. The public network base station <NUM> may construct an NPN by configuring private slices.

One terminal device <NUM> and one public network base station <NUM> in <FIG> are only illustrative. According to implementation requirements, there may be any quantities of terminal devices <NUM> and any quantity of public network base stations <NUM>.

In an embodiment of this disclosure, the public network base station <NUM> may generate a TA of an NPN, the TA of the NPN being different from a TA of the public network. In this case, the public network base station <NUM> may configure the TA of the NPN or the TA of the public network for the terminal device <NUM> within any TA configuration period, so that the terminal device <NUM> in an idle state or an inactive state enters a connected state when a TAU occurs, to obtain network access control information. That is, in this embodiment, the TAs of the public network and the NPN are not configured for the terminal device <NUM> simultaneously, which enables the terminal device <NUM> in the idle state or the inactive state to enter a connected state to obtain network access control information when the TAU occurs, to implement network access control, thereby ensuring that the communication system can support the processing of the public network service and the NPN service.

For example, the occurrence of TAU may be that the terminal device <NUM> enters the TA of the public network from the TA of the NPN, or enters the TA of the NPN from the TA of the public network, which is not limited in this disclosure.

Based on the system architecture shown in <FIG>, in an embodiment of this disclosure, the public network base station <NUM> may obtain identification information of the NPN, the identification information of the NPN being used for identifying an area in which the NPN is located. The public network base station <NUM> may then configure the identification information of the NPN for the terminal device <NUM>, so that the terminal device <NUM> in an idle state or an inactive state may determine, according to the identification information of the NPN, whether to search for the NPN. For example, the terminal device <NUM> may perform an NPN search process when the identification information of the NPN is detected, and stop, when the identification information of the NPN is not detected, searching for the NPN, thereby avoiding the increase in power consumption of the terminal device <NUM> caused by frequent searches for the NPN on the premise that network access control is implemented.

The implementation details of the technical solutions in the embodiments of this disclosure are described below in detail.

<FIG> is a flowchart of a network access control method according to an embodiment of this disclosure. The network access control method may be performed by a terminal device, and the terminal device may be the terminal device <NUM> shown in <FIG>. Referring to <FIG>, the network access control method includes at least step S310 and step S320, which are described in detail as follows:
Step S310: A terminal device obtains a network connection capability of the terminal device, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent.

In an embodiment of this disclosure, the capability of the terminal device to connect to a public network and an NPN that are mutually independent may include whether the terminal device can connect to a public network, whether the terminal device can connect to an NPN, and whether the terminal device can support simultaneous connections to a public network and an NPN, which is not limited in this disclosure.

Step S320: The terminal device performs access control according to a network service requirement and the network connection capability of the terminal device of the terminal device in response to the terminal device is in a connected state.

In an embodiment of this disclosure, a process of performing, by the terminal device, access control according to a network service requirement and the network connection capability of the terminal device of the terminal device in step S320 may be: If it is determined according to the network connection capability that the terminal device can support simultaneous connections to a public network and an NPN, when a public network service and an NPN service need to be processed simultaneously, the terminal device is controlled to access the public network and the NPN. The technical solution of this embodiment enables simultaneous access to the public network and the NPN according to the network connection capability of the terminal device, to process the public network service and the NPN service simultaneously.

In an embodiment of this disclosure, a process of performing, by the terminal device, access control according to a network service requirement and the network connection capability of the terminal device of the terminal device in step S320 may be alternatively as follows: If it is determined according to the network connection capability of the terminal device that the terminal device does not support simultaneous connections to the public network and the NPN, the terminal device is controlled according to a network service the terminal device needs to process to access the public network or the NPN. For example, the terminal device is controlled, in response to that the terminal device needs to process a public network service, to access the public network; the terminal device is controlled, in response to that the terminal device needs to process an NPN service, to access the NPN; and the terminal device is controlled, in response to that the terminal device needs to process the public network service and the NPN service simultaneously, according to a service priority of the public network and a service priority of the NPN to access a network with a higher service priority.

In an embodiment of this disclosure, a process of performing, by the terminal device, access control according to a network service requirement and the network connection capability of the terminal device of the terminal device in step S320 may be alternatively as follows: When it is determined according to the network connection capability of the terminal device that the terminal device does not support simultaneous connections to the public network and the NPN and in response to that network quality of one of the public network and the NPN cannot meet the service requirement, the terminal device is controlled to access the other network. The technical solution of this embodiment enables the terminal device to preferentially access, when the terminal device does not support simultaneous connections to a public network and an NPN, a network that meets a service requirement.

In an embodiment of this disclosure, a process of performing, by the terminal device, access control according to a network service requirement and the network connection capability of the terminal device of the terminal device in step S320 may be alternatively as follows: When the terminal device is connected to a first network of the public network and the NPN and network quality of the first network cannot meet the service requirement and in response to that a service of the first network needs to be processed, the terminal device accesses a second network of the public network and the NPN and accesses the first network via the second network to process the service of the first network. In the technical solution of this embodiment, when the terminal device accesses the first network and network quality of the first network cannot meet the service requirement and in response to that a service of the first network needs to be processed, the terminal device may access the second network to indirectly access the first network to process the service of the first network. In this embodiment, a gateway device of the public network and a gateway device of the NPN may be connected to facilitate indirect access to the first network via the second network to process the service of the first network.

In an embodiment of this disclosure, when the terminal device is connected to a first network of the public network and the NPN and network quality of a second network of the public network and the NPN cannot meet the service requirement or the terminal device cannot connect to the second network and in response to that a service of the second network needs to be processed, the second network is indirectly accessed via the first network to process the service of the second network. In the technical solution of this embodiment, when the terminal device accesses the first network, when the terminal device fails to connect to the second network or the network quality of the second network cannot meet the service requirement, the terminal device can access the second network indirectly via the first network to process the service of the second network. In this embodiment, a gateway device of the public network and a gateway device of the NPN may be connected to facilitate indirect access to the second network via the first network to process the service of the second network.

The technical solution of the embodiment shown in <FIG> makes it possible to implement network access control based on the network service requirement and the network connection capability of the terminal device in an disclosure scenario where a public network and an NPN coexist, thereby ensuring that a communication system can support the processing of a public network service and an NPN service. For example, the communication system may be a fifth-generation mobile communications technology (<NUM>) system.

<FIG> is a flowchart of a network access control method according to an embodiment of this disclosure. The network access control method may be performed by a network side device, and the network side device may be the public network base station <NUM> shown in <FIG>, or may be a network management device independent of the public network base station <NUM> and the NPN base station <NUM>. Referring to <FIG>, the network access control method includes at least step S410 and step S420, which are described in detail as follows:
Step S410: A network side device generates a network access control policy, the network access control policy being used for enabling a terminal device to perform access control according to a network service requirement and a network connection capability, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent.

In an embodiment of this disclosure, the network access control policy may include a service priority of the public network and a service priority of the NPN. Therefore, when the terminal device cannot process a public network service and an NPN service simultaneously, the terminal device can select a service with a higher service priority according to the service priority of the public network and the service priority of the NPN.

In an embodiment of this disclosure, the service priorities may be represented by priorities of frequency information of networks. For example, if the priority of the frequency information in which the public network is located is higher than the priority of the frequency information in which the NPN is located, it is determined that the service priority of the public network is higher than the service priority of the NPN.

In an embodiment of this disclosure, the service priorities may be represented by priorities of network cells in the same frequency band. For example, when a network cell of the public network and a network cell of the NPN are in the same frequency band, if a priority of the network cell of the public network is higher than a priority of the network cell of the NPN, the service priority of the public network is higher than the service priority of the NPN.

Step S420: The network side device configures the network access control policy for the terminal device.

In an embodiment of this disclosure, if the terminal device is in a connected state, the network side device may directly configure the network access control policy for the terminal device by using configuration signaling. The network side device may configure, when the terminal device is in an idle state or an inactive state, the network access control policy for the terminal device by configuring a cell reselection parameter or a redirection parameter.

In an embodiment of this disclosure, the network side device may determine, according to identification information of the NPN and subscription information of the terminal device when it is detected that the terminal device needs to access the NPN, whether the terminal device can access the NPN. For example, if the terminal device signs an access protocol with an NPN, the network side device may allow the terminal device to access the NPN; and if the terminal device does not sign an access protocol with an NPN, the network side device may deny access of the terminal device to the NPN.

The technical solution of the embodiment shown in <FIG> also makes it possible to implement network access control based on the network service requirement and the network connection capability of the terminal device in an disclosure scenario where a public network and an NPN coexist, thereby ensuring that a communication system can support the processing of a public network service and an NPN service.

<FIG> is a flowchart of a network access control method according to an embodiment of this disclosure. The network access control method may be performed by a network side device, and the network side device may be the public network base station <NUM> shown in <FIG>. Referring to <FIG>, the network access control method includes at least step S510 and step S520, which are described in detail as follows:
Step S510: A network side device generates a TA of an NPN, the NPN being a network formed using a network slice of a public network, the TA of the NPN being different from a TA of the public network.

In an embodiment of this disclosure, network cells in the same TA support the same network slice.

Step S520: The network side device configures the TA of the NPN or the TA of the public network for a terminal device within any TA configuration period, so that the terminal device in an idle state or an inactive state enters a connected state when a TAU occurs, to obtain network access control information.

The technical solution of the embodiment shown in <FIG> prevents the TA of the NPN and the TA of the public network from being configured for the terminal device simultaneously. Therefore, when the terminal device is in an idle state or an inactive state and TAU does not occur, the terminal device neither moves to the public network from the NPN nor moves to the NPN from the public network. When the terminal device is in an idle state or an inactive state and TAU occurs, the terminal device enters a connected state to obtain network access control information, to implement network access control, thereby ensuring that the communication system can support the processing of the public network service and the NPN service.

<FIG> is a flowchart of a network access control method according to an embodiment of this disclosure. The network access control method may be performed by a network side device, and the network side device may be the public network base station <NUM> shown in <FIG>. Referring to <FIG>, the network access control method includes at least step S610 and step S620, which are described in detail as follows:
Step S610: A network side device obtains identification information of an NPN, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located.

In an embodiment of this disclosure, the network side device may obtain the identification information of the NPN from an disclosure function (AF) entity or a core network entity. The identification information of the NPN may include at least one of the following: location information of a network cell of the NPN, information of geographic locations covered by the NPN, and frequency information of the NPN, which is not limited in this disclosure.

Step S620: The network side device configures the identification information of the NPN for the terminal device, so that the terminal device in an idle state or an inactive state determines, according to the identification information of the NPN, whether to search for the NPN.

In an embodiment of this disclosure, the terminal device may perform an NPN search process when the identification information of the NPN is detected, and stop, when the identification information of the NPN is not detected, searching for the NPN, thereby avoiding the increase in power consumption of the terminal device caused by frequent searches for the NPN on the premise that network access control is implemented.

In an embodiment of this disclosure, the network side device may transmit configuration information to the terminal device when indication information that is transmitted by the terminal device in the idle state or the inactive state and requests access to the NPN is received, to control access of the terminal device to the NPN. The network side device may transmit configuration information to the terminal device by using radio resource control (RRC) signaling, and the configuration information may include measurement configuration information, which is not limited in this disclosure.

<FIG> is a flowchart of a network access control method according to an embodiment of this disclosure. The network access control method may be performed by a terminal device, and the terminal device may be the terminal device <NUM> shown in <FIG>. Referring to <FIG>, the network access control method includes at least step S710 and step S720, which are described in detail as follows:.

In an embodiment of this disclosure, after the NPN is found, the terminal device transmits, when it is necessary to access the NPN, indication information requesting access to the NPN to the network side device, and performs a network access process according to configuration information fed back by the network side device for the indication information. The configuration information fed back by the network side device may include measurement configuration information, which is not limited in this disclosure.

The foregoing embodiments respectively describe the network access control solutions of the embodiments of this disclosure from the perspective of a terminal device and a network side device for the system architecture shown in <FIG> and the system architecture shown in <FIG>. Details of implementing the technical solutions of the embodiments of this disclosure are described below from the perspective of a whole system (including a terminal device and a network side device).

As shown in <FIG>, deployment modes between a PLMN and an NPN may include the following two modes:.

In Mode <NUM>, core network elements in the NPN are all deployed by a third party, and the third party solves the spectrum problem independently without relying on functions provided in the public network. This mode is suitable for scenarios and industries that have strong demands for local networks. This mode can strictly isolate a local network from a public network.

In Mode <NUM>, core network elements (including base stations) in the NPN are all shared with the PLMN. The NPN implements the isolation of service data from the PLMN in a manner of a private slice, and introduces a new user group management mechanism to implement management. This mode is suitable for a scenario where local deployment of hardware is unexpected. The isolated NPN and PLMN may be distinguished by using network slices or protocol data unit (PDU) sessions and quality of service (QoS) flows.

For Mode <NUM>, when the terminal device is in a connected state, the access control problem of the terminal device may be solved in the following ways:.

In an embodiment of this disclosure, when the terminal device is in a connected state, a network service requirement and a network connection capability of the terminal device need to be considered for the handover between the PLMN and the NPN. For example, if it is necessary to support the processing of a PLMN service and an NPN service simultaneously and the network connection capability of the terminal device supports the establishment of connections to the two networks simultaneously, the terminal device may initiate another connection without interrupting the PLMN service or the NPN service in the handover process. That is, the terminal device can connect to the PLMN and the NPN simultaneously, unless the coverage of the NPN or the PLMN can no longer support the network connection of the terminal device.

In an embodiment of this disclosure, if it is necessary to support the processing of a PLMN service and an NPN service simultaneously but the terminal device does not support the establishment of connections to the two networks simultaneously and if the coverage and signal strength of both the two networks meet a service requirement, a connection to the PLMN or the NPN may be selected according to a service priority. If the coverage and signal strength of only one network of the two networks meet a service requirement, the terminal device connects to the network.

In an embodiment of this disclosure, it may be determined based on a network identifier and subscription information of a user whether the terminal device can access the NPN.

In an embodiment of this disclosure, the network side device needs to configure corresponding policies such as a service priority and an access control policy for the terminal device in advance. The service priority may be represented by location information such as frequency information or cell identification within the same frequency.

In an embodiment of this disclosure, for the terminal device in an idle state and an inactive state, an NPN-related priority and location range information may be configured by configuring a cell reselection parameter or a redirection parameter in an RRC connection release process.

For Mode <NUM>, when the terminal device is in a connected state, access control may be implemented directly by using a network slice. When the terminal device is in an idle state and an inactive state, the access control problem of the terminal device may be solved in the following ways:.

In an embodiment of this disclosure, dedicated TAs may be configured for NPN cells. Space division multiplexing may be performed on the TAs. That is, the TAs may appear in different locations and are exclusive to the NPN. As shown in <FIG>, a cell <NUM>, a cell <NUM>, and a cell <NUM> are PLMN cells, and are configured with a TA1; and a cell <NUM> is an NPN cell, and is configured with a TA2. The cells in the same TA support the same slice. For example, all the three cells in the TA1 support a slice S1, and the cell in the TA2 supports a slice S2. In addition, the network side device needs to be configured to ensure that the TA of the PLMN cells and the TA of the NPN cell are not configured for the terminal device simultaneously.

According to the technical solution of this embodiment, the terminal device in an idle state and an inactive state undergoes a TAU process during reselection from the PLMN to the NPN or from the NPN to the PLMN, and the terminal device then enters a connected state to obtain NPN-related configuration and implement access control. In addition, if TAU does not occur for the terminal device, there is no transition from accessing the PLMN to accessing the NPN or from accessing the NPN to accessing the PLMN.

With the support of the foregoing scheme, the terminal device may perform an access control process without using a closed access group (CAG) identification mechanism.

For Mode <NUM>, in another embodiment of this disclosure, a controllable NPN search may be implemented based on location information and a fingerprint. For example, a third-party disclosure server AF may be used to implement a controllable NPN discovery process based on fingerprint information. Specifically, an AF or other core network elements may push NPN fingerprint information to the terminal device. The fingerprint information may include location information formed by cell identification, global navigation satellite system (GNSS) geographic location information, frequency information, and the like. Therefore, when the terminal device is moving in an idle state or an inactive state, it may be determined according to fingerprint information of the NPN whether the terminal device needs to search for an NPN, thereby avoiding the increase in power consumption of the terminal device caused by frequent searches.

In an embodiment of this disclosure, if the terminal device needs to enter a connected state to perform an access authentication process, the terminal device may indicate to the network side device that the terminal device intends to perform access control and therefore enters a connected state. The network side device may perform measurement configuration or other configuration on the terminal device by using RRC signaling to complete an access control process in Mode <NUM>.

The following describes apparatus embodiments of this disclosure, which may be used for implementing the network access control method in the foregoing embodiments of this disclosure. For details that are not disclosed in the apparatus embodiments of this disclosure, refer to the foregoing embodiments of the network access control method of this disclosure.

<FIG> is a block diagram of a network access control apparatus according to an embodiment of this disclosure.

Referring to <FIG>, a network access control apparatus <NUM> according to an embodiment of this disclosure includes an obtaining unit <NUM> and a control unit <NUM>.

The obtaining unit <NUM> is configured to obtain a network connection capability of a terminal device, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent. The control unit <NUM> is configured to perform access control on the terminal device according to a network service requirement and the network connection capability of the terminal device when the terminal device is in a connected state.

In some embodiments of this disclosure, the control unit <NUM> is configured to control, when it is determined according to the network connection capability that the terminal device can support simultaneous connections to the public network and the NPN and in response to that the terminal device needs to process a public network service and an NPN service simultaneously, the terminal device to access the public network and the NPN.

In some embodiments of this disclosure, the control unit <NUM> is configured to: control, when it is determined according to the network connection capability that the terminal device does not support simultaneous connections to the public network and the NPN, the terminal device according to a network service the terminal device needs to process to access the public network or the NPN.

In some embodiments of this disclosure, the control unit <NUM> is configured to: control, in response to that the terminal device needs to process a public network service, the terminal device to access the public network; control, in response to that the terminal device needs to process an NPN service, the terminal device to access the NPN; and control, in response to that the terminal device needs to process the public network service and the NPN service simultaneously, the terminal device according to a service priority of the public network and a service priority of the NPN to access a network with a higher service priority.

In some embodiments of this disclosure, the control unit <NUM> is configured to: control, when it is determined according to the network connection capability that the terminal device does not support simultaneous connections to the public network and the NPN and in response to that network quality of one of the public network and the NPN cannot meet the service requirement, the terminal device to access the other network.

In some embodiments of this disclosure, the control unit <NUM> is configured to: when the terminal device is connected to a first network of the public network and the NPN and network quality of the first network cannot meet the service requirement and in response to that a service of the first network needs to be processed, control the terminal device to access a second network of the public network and the NPN, and access the first network via the second network to process the service of the first network.

In some embodiments of this disclosure, the control unit <NUM> is further configured to: when the terminal device is connected to a first network of the public network and the NPN and network quality of a second network of the public network and the NPN cannot meet the service requirement or the terminal device cannot connect to the second network and in response to that a service of the second network needs to be processed, access the second network via the first network to process the service of the second network.

The technical solution of the embodiments of this disclosure makes it possible to implement network access control based on the network service requirement and the network connection capability of the terminal device in an disclosure scenario where a public network and an NPN coexist, thereby ensuring that a communication system can support the processing of a public network service and an NPN service.

Referring to <FIG>, a network access control apparatus <NUM> according to an embodiment of this disclosure includes a generation unit <NUM> and a configuration unit <NUM>.

The generation unit <NUM> is configured to generate a network access control policy, the network access control policy being used for enabling a terminal device to perform access control according to a network service requirement and a network connection capability, the network connection capability including a capability to connect to a public network and an NPN that are mutually independent; and the configuration unit <NUM> is configured to configure the network access control policy for the terminal device.

In some embodiments of this disclosure, the network access control policy includes a service priority of the public network and a service priority of the NPN, the service priorities being represented by priorities of frequency information of the networks, or the service priorities being represented by priorities of network cells in the same frequency band.

In some embodiments of this disclosure, the configuration unit <NUM> is configured to: configure, when the terminal device is in an idle state or an inactive state, the network access control policy for the terminal device by configuring a cell reselection parameter or a redirection parameter.

In some embodiments of this disclosure, the network access control apparatus <NUM> further includes: a determining unit, configured to determine according to identification information of the NPN and subscription information of the terminal device when it is detected that the terminal device needs to access the NPN, whether the terminal device can access the NPN.

The technical solution of the embodiments of this disclosure also makes it possible to implement network access control based on the network service requirement and the network connection capability of the terminal device in an disclosure scenario where a public network and an NPN coexist, thereby ensuring that a communication system can support the processing of a public network service and an NPN service.

The generation unit <NUM> is configured to generate a TA of an NPN, the NPN being a network formed using a network slice of a public network, the TA of the NPN being different from a TA of the public network. The configuration unit <NUM> is configured to configure the TA of the NPN or the TA of the public network for a terminal device within any TA configuration period, so that the terminal device in an idle state or an inactive state enters a connected state when a TAU occurs, to obtain network access control information.

The technical solution of the embodiments of this disclosure prevents the TA of the NPN and the TA of the public network from being configured for the terminal device simultaneously. Therefore, when the terminal device is in an idle state or an inactive state and TAU does not occur, the terminal device neither moves to the public network from the NPN nor moves to the NPN from the public network. When the terminal device is in an idle state or an inactive state and TAU occurs, the terminal device can enter a connected state to obtain network access control information, to implement network access control, thereby ensuring that the communication system can support the processing of the public network service and the NPN service.

Referring to <FIG>, a network access control apparatus <NUM> according to an embodiment of this disclosure includes an obtaining unit <NUM> and a configuration unit <NUM>.

The obtaining unit <NUM> is configured to obtain identification information of an NPN, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located. The configuration unit <NUM> is configured to configure the identification information of the NPN for the terminal device, so that the terminal device in an idle state or an inactive state determines, according to the identification information of the NPN, whether to search for the NPN.

In some embodiments of this disclosure, the network access control apparatus <NUM> further includes: a transmission unit, configured to transmit configuration information to the terminal device when indication information that is transmitted by the terminal device in the idle state or the inactive state and requests access to the NPN is received, to control access of the terminal device to the NPN.

In some embodiments of this disclosure, the identification information of the NPN includes at least one of the following: location information of a network cell of the NPN, information of geographic locations covered by the NPN, and frequency information of the NPN.

In the technical solution provided in the embodiments of this disclosure, the identification information of the NPN is obtained, and the identification information of the NPN is used for identifying an area in which the NPN is located. The identification information of the NPN is configured for the terminal device, so that the terminal device in the idle state or the inactive state may determine, according to the identification information of the NPN, whether to search for the NPN. For example, the terminal device may perform an NPN search process when the identification information of the NPN is detected, and stop, when the identification information of the NPN is not detected, searching for the NPN, thereby avoiding the increase in power consumption of the terminal device caused by frequent searches for the NPN on the premise that network access control is implemented.

The obtaining unit <NUM> is configured to obtain identification information of an NPN configured by a network side device, the NPN being a network formed using a network slice of a public network, the identification information of the NPN being used for identifying an area in which the NPN is located. The configuration unit <NUM> is configured to determine, according to the identification information of the NPN when the terminal device in an idle state or an inactive state, whether to search for the NPN.

In some embodiments of this disclosure, the configuration unit <NUM> is configured to: perform a search process on the NPN when the identification information of the NPN is detected; and stop, when the identification information of the NPN is not detected, searching for the NPN.

In some embodiments of this disclosure, the configuration unit <NUM> is further configured to: transmit, when it is necessary to access the NPN, indication information requesting access to the NPN to the network side device, and perform a network access process according to configuration information fed back by the network side device for the indication information.

<FIG> is a schematic structural diagram of a computer system adapted to implement an electronic device according to an embodiment of this disclosure.

A computer system <NUM> of the electronic device shown in <FIG> is merely an example, and does not constitute any limitation on functions and use ranges of the embodiments of this disclosure.

As shown in <FIG>, the computer system <NUM> includes a central processing unit (CPU) <NUM>, which may perform various suitable actions and processing based on a program stored in a ROM <NUM> or a program loaded from a storage part <NUM> into a random access memory (RAM) <NUM>, for example, perform the method described in the foregoing embodiments. The RAM <NUM> further stores various programs and data required for system operations. The CPU <NUM>, the ROM <NUM>, and the RAM <NUM> are connected to each other through a bus <NUM>. An input/output (I/O) interface <NUM> is also connected to the bus <NUM>.

The following components are connected to the I/O interface <NUM>: an input part <NUM> including a keyboard, a mouse, or the like, an output part <NUM> including a cathode ray tube (CRT), a liquid crystal display (LCD), a speaker, or the like, a storage part <NUM> including a hard disk, or the like, and a communication part <NUM> including a network interface card such as a local area network (LAN) card or a modem. The communication part <NUM> performs communication processing by using a network such as the Internet. A driver <NUM> is also connected to the I/O interface <NUM> as required. A removable medium <NUM>, such as a magnetic disk, an optical disc, a magneto-optical disk, or a semiconductor memory, is installed on the drive <NUM> as required, so that a computer program read from the removable medium is installed into the storage part <NUM> as required.

Particularly, according to an embodiment of this disclosure, the processes described in the following by referring to the flowcharts may be implemented as computer software programs. For example, an embodiment of this disclosure includes a computer program product. The computer program product includes a computer program hosted on a computer-readable medium. The computer program includes program code for performing the method shown in the flowchart. In such an embodiment, the computer program may be downloaded and installed through the communication part <NUM> from a network, and/or installed from the removable medium <NUM>. When the computer program is executed by the CPU <NUM>, the various functions defined in the system of this disclosure are executed.

The computer-readable medium shown in the embodiments of this disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but is not limited to, an electric, magnetic, optical, electromagnetic, infrared, or semi-conductive system, apparatus, or component, or any combination thereof. A more specific example of the computer-readable storage medium may include but is not limited to: an electrical connection having one or more wires, a portable computer magnetic disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program, and the program may be used by or used in combination with an instruction execution system, an apparatus, or a device. In this disclosure, a computer-readable signal medium may include a data signal being in a baseband or propagated as a part of a carrier wave, the data signal carrying computer-readable program code. A data signal propagated in such a way may assume a plurality of forms, including, but not limited to, an electromagnetic signal, an optical signal, or any appropriate combination thereof. The computer-readable signal medium may be further any computer-readable medium in addition to a computer-readable storage medium. The computer-readable medium may send, propagate, or transmit a program that is used by or used in conjunction with an instruction execution system, an apparatus, or a device. The program code included in the computer-readable medium may be transmitted by using any suitable medium, including but not limited to: a wireless medium, a wire, or the like, or any suitable combination thereof.

The flowcharts and block diagrams in the accompanying drawings illustrate possible system architectures, functions and operations that may be implemented by a system, a method, and a computer program product according to various embodiments of this disclosure. Each box in a flowchart or a block diagram may represent a module, a program segment, or a part of code. The module, the program segment, or the part of code includes one or more executable instructions used for implementing specified logic functions. In some implementations used as substitutes, functions annotated in boxes may alternatively occur in a sequence different from that annotated in an accompanying drawing. For example, actually two boxes shown in succession may be performed basically in parallel, and sometimes the two boxes may be performed in a reverse sequence. This is determined by a related function. It is also to be noted that, each box in a block diagram and/or a flowchart and a combination of boxes in the block diagram and/or the flowchart may be implemented by using a dedicated hardware-based system configured to perform a specified function or operation, or may be implemented by using a combination of dedicated hardware and a computer instruction.

A related unit described in the embodiments of this disclosure may be implemented in a software manner, or may be implemented in a hardware manner, and the unit described can also be set in a processor. Names of the units do not constitute a limitation on the units in a specific case.

That is, the technical solution in the embodiments of this disclosure provides an electronic device, including:.

That is, the technical solution in the embodiments of this disclosure further provides an electronic device, including:.

That is, the technical solution in the embodiments of this disclosure further provides an electronic device, including: one or more processors; and
a storage apparatus, configured to store one or more programs, the one or more programs, when executed by the one or more processors, causing the one or more processors to implement the network access control method shown in <FIG> according to the embodiments.

According to another aspect, this disclosure further provides a computer-readable medium. The computer-readable medium may be included in the electronic device described in the foregoing embodiments, or may exist alone and is not disposed in the electronic device. The computer-readable medium carries one or more programs, the one or more programs, when executed by the electronic device, causing the electronic device to implement the network access control method performed by a terminal device or the network access control method performed by a network side device according to the foregoing embodiments.

Although a plurality of modules or units of a device configured to perform actions are discussed in the foregoing detailed description, such division is not mandatory. According to the implementations of this disclosure, the features and functions of two or more modules or units described above may be specifically implemented in one module or unit. On the contrary, the features and functions of one module or unit described above may be further divided to be embodied by a plurality of modules or units.

According to the foregoing descriptions of the implementations, a person skilled in the art may readily understand that the exemplary implementations described herein may be implemented by using software, or may be implemented by combining software and necessary hardware. Therefore, the technical solutions of the implementations of this disclosure may be implemented in a form of a software product. The software product may be stored in a non-volatile storage medium (which may be a CD-ROM, a USB flash drive, a removable hard disk, or the like) or on a network, and includes several instructions for instructing a computing device (which may be a personal computer, a server, a touch terminal, network side device, or the like) to perform the methods according to the implementations of this disclosure.

After considering the specification and practicing the implementations of the present disclosure, a person skilled in the art may easily conceive of other implementations of this disclosure. This disclosure is intended to cover any variations, uses, or adaptive changes of this disclosure. These variations, uses, or adaptive changes follow the general principles of this disclosure and include common general knowledge or common technical means in the art, which are not disclosed in this disclosure.

Claim 1:
A network access control method, performed by a terminal device, characterized by, comprising:
receiving a network access control policy, wherein the network access control policy comprises a service priority of the public network and a service priority of the NPN;
obtaining (S310) a network connection capability of the terminal device, the network connection capability comprising a capability of connecting to a public network and a non-public network (NPN) that are mutually independent; and
based on the network access control policy, performing (S320) access control on the terminal device according to a network service requirement and the network connection capability of the terminal device in response to the terminal device being in a connected state, the network service requirement comprising a network access requirement corresponding to a network service the terminal device is to process.