Abstract: This application provides a communication method and a communication apparatus. The method includes: A policy control function network element receives, from an application function network element, information about a first time window and information about a first parameter, where the first time window is a time window that is of data transfer of a first service, and the first parameter includes parameters of the data transfer of the first service. The policy control function network element determines the policies of the first service and then sends the policies to the application function network element. The information about each policy includes information about N time windows which are determined based on the information about the first time window and the information about the first parameter, and the N time windows are used to transmit or receive data of the first service.

Abstract: This application provides example key management methods and example communication apparatuses. In an example method, a terminal device obtains identification information of a first decryption network element in a local network. The terminal device obtains, based on the identification information and a mapping relationship, a first encryption key corresponding to the first decryption network element, where the mapping relationship indicates at least one decryption network element and an encryption key corresponding to each of the at least one decryption network element, and the at least one decryption network element includes the first decryption network element. The terminal device encrypts the user identity information by using the first encryption key, to obtain a hidden user identity. The terminal device sends a registration request to the local network through an access network device, where the registration request includes the hidden user identity.

Abstract: Embodiments of this application provide a communication method and a network element device. The method includes: A first network function network element obtains integrity-protected attestation information, where the attestation information includes an attestation result and range indication information associated with the attestation result; generates a service request message when determining that a service provided by a second network function network element is to be requested; and sends the service request message to the second network function network element, where the service request message includes the attestation information and an identifier of the first network function network element. The method disclosed in this application can prevent and mitigate a potential security risk faced by a network function in a mobile communication network, especially faced by a network function implemented in a software or virtualization manner.

Abstract: A communication method includes obtaining, by a communication apparatus, first information associated with at least one network. The first information includes an authentication mechanism supported by each of the at least one network. The communication method also includes obtaining, by the communication apparatus, a target authentication mechanism based on an authentication mechanism supported by the communication apparatus, the first information, and a network in which an application function (AF) is located. The at least one network included the network in which the AF is located. The communication method further includes establishing, by the communication apparatus, a secure communication connection to the AF by using the target authentication mechanism.

Abstract: A communications method and apparatus, where the method includes: sending, by a session management network element, first indication information when the session management network element determines, based on first information, to establish a first low-latency service flow for a session, wherein the first indication information is used to indicate to set the session to an always-on session. According to solutions of this application, when determining to establish the low-latency service flow, the session management network element flexibly indicates to a terminal apparatus to set the session to the always-on session. This avoids a resource waste caused by setting the session to the always-on session all the time, and avoids a transmission latency caused when the session is not set to the always-on session in time, such that resource utilization and transmission efficiency are improved.

Abstract: A communication method and apparatus are provided. The method may include: A mobility management network element receives a transaction identifier of a remote terminal device and a name of a data network from a relay terminal device. The mobility management network element determines a subscription permanent identifier of the remote terminal device based on the transaction identifier, and then sends the subscription permanent identifier and the name of the data network to a session management network element. After receiving the subscription permanent identifier and the name of the data network, the session management network element determines, by using a data management network element based on the subscription permanent identifier and the name of the data network, whether to perform secondary authentication on the remote terminal device. Whether to perform secondary authentication on the remote terminal device can be determined by using the provided solution.

Abstract: A communication method and apparatus are provided. The method includes: A network repository function network element receives a discovery request message including a type of a network element that requests to be discovered. The network repository function network element determines a second network element based on the type of the network element that requests to be discovered, and sends an identifier of a first dataset, a first token, and an identifier of the second network element to the first network element, where the first token authorizes the first network element to obtain the first dataset. According to the foregoing designs, the network repository function network element can provide, to the first network element, an identifier of a network element and information needed for obtaining the dataset, so that the first network element can determine, based on the dataset, whether to access the network element.

Abstract: This application provides a communication method and apparatus. A first mobility management function entity may receive event information from a unified data management function entity, where the event information indicates a first-type terminal event. Therefore, when a terminal apparatus is reachable, the first mobility management function entity may send, based on the event information, a terminal event report to an application function entity that subscribes to the first-type terminal event, thereby improving pertinence of sending the terminal event report.

Abstract: A communications method includes determining a session management function entity based on at least one of a data network name, slice information, and an application function service identifier, and sending a first message to the session management function entity, where the first message is used to subscribe to a terminal event, the first message includes service description information, and the service description information is used to indicate a service corresponding to the terminal event.

Abstract: This application provides a communication method and apparatus, to reduce a risk of user plane data exposure. In the communication method, after an IPsec connection is established between a first user plane network element and a terminal, the terminal or the first user plane network element may be used as an endpoint device on the IPsec connection. In this case, when transmission of user plane data protected by IPsec is performed between endpoint devices, an intermediate transmission device (for example, an access network device) located between the endpoint devices, that is, an access network device on the IPsec connection, may directly perform transparent transmission of the user plane data.

Abstract: This application discloses a communication control method and a communication apparatus, to provide a technical solution for performing communication control on a terminal device based on relative location information between terminal devices, so as to improve precision and flexibility of performing communication control such as access control or service control on the terminal device. In the method, a first network element obtains control indication information for a first terminal device from a second network element, where the control indication information includes a device identifier of a second terminal device that has a location binding relationship with the first terminal device. The first network element obtains relative location information between the first terminal device and the second terminal device. The first network element performs communication control on the first terminal device based on the control indication information and the relative location information.

Abstract: This application relates to communication technologies, and provides a channel key-based encryption method and an apparatus, to resolve a problem that a terminal cannot avoid an attack from a false base station before a security mode is enabled, and a security risk. The method includes: A network device broadcasts a system information block, indicating that channel key generation is supported, where the system information block includes a preamble and a resource configuration of a physical random access channel; receives, on the physical random access channel, a first message from a user equipment, where the first message includes the preamble; sends a second message to the user equipment, where the second message includes configuration information of a first time-frequency resource; receives, on the first time-frequency resource, a third message from the user equipment; and performs channel measurement based on the third message, to obtain a channel key.

Abstract: A communication method and apparatus. One method includes: a session management network element obtains an identifier of a DN accessed by a terminal device and/or an identifier of a network slice accessed by the terminal device. The session management network element determines, based on the identifier of the DN and/or the identifier of the network slice, a service type requested by the terminal device. The session management network element requests, from an access network device on a satellite, tunnel information corresponding to the service type. The session management network element receives, from the access network device, the tunnel information corresponding to the service type.

Abstract: This application pertains to the field of communication technologies, and provides a communication method and apparatus, to implement false base station detection. A false base station may attack a terminal in a denial of service manner, and consequently, the terminal cannot access the false base station after selecting the false base station, in other words, the terminal fails to set up a connection to a cell. In this case, if a first message indicates that a first terminal fails to set up a connection to a cell, it may be determined, based on the first message, that a false base station attack exists in the cell, to implement false base station detection.

Abstract: The present disclosure provides an authorization method and an apparatus to verify whether a terminal device is authorized to provide or use a relay service. The method includes: a policy control function network element receives an authorization request message from an access and mobility management function network element, and determines, based on proximity-based services authorization information of a terminal device, whether the terminal device is authorized to use a relay service code. The authorization request message includes the relay service code from the terminal device. The authorization request message is for requesting to verify whether the terminal device is authorized to use the relay service code. The relay service code identifies a connection service provided by a relay device for a remote device, and the proximity-based services authorization information indicates a relay service with which the terminal device is authorized.

Abstract: A method, an apparatus, and a system for managing a background data transfer policy, such that a policy control function network element can obtain a background data transfer policy corresponding to a terminal. The method includes: A first policy control function network element receives a first message. The first message carries a first identifier, and the first identifier may be a background data transfer reference identifier or an application function identifier. Then, the first policy control function network element sends a second message to a first data storage network element, facilitating obtaining of a background data transfer policy. The second message carries the first identifier. Finally, the first policy control function network element receives a third message from the first data storage network element. The third message includes a first background data transfer policy corresponding to the first identifier.

Abstract: A session establishment method and apparatus is provided, to resolve a problem that a terminal device cannot establish a plurality of PDU sessions for a same APP based on a URSP. The method includes: A terminal apparatus receives indication information from a first network apparatus, where the indication information is used to indicate that a first application needs to be associated with at least two sessions; and establishes at least one session for the first application based on at least the indication information, so that the first application is associated with at least two sessions.

Abstract: This application provides a QoS flow control method and an apparatus. An SMF network element receives first indication information sent by an access network apparatus, where the first indication information is used to indicate that a first QoS target of a QoS flow cannot be met; and the SMF network element does not process the QoS flow if the SMF network element receives second indication information in a first preset time; or the SMF network element deletes or modifies the QoS flow if the SMF network element does not receive second indication information in a first preset time, where the second indication information is used to indicate that the first QoS target can be met.

Abstract: This application provides a communication method and apparatus, and relates to the communication field, to ensure proximity based service relay communication security. In the method, proximity based service authentication information #1 provided by a data management network element is used, so that a remote terminal and a network may authenticate each other and generate a proximity based service key used for communication between the remote terminal and a relay terminal. Further, the remote terminal device and the relay terminal device derive a communication protection key for a PC5 connection (namely, a connection between the remote terminal and the relay terminal) based on the proximity based service key, which may include at least one of an encryption key and an integrity protection key, so that proximity based service relay communication security is ensured, and a case such as user information leakage caused by an attack is avoided.

Abstract: Embodiments of this application provide a method, an apparatus, and a system for reporting data usage, so that for a PDU session into which a UL CL user plane network element or a BP user plane network element is inserted, statistics can be accurately collected on data usage. The method includes: An aggregate user plane network element determines discarded data usage of the aggregate user plane network element, and sends the discarded data usage to a session management network element. The first session management network element receives the discarded data usage, and receives transport data usage of one or a plurality of anchor user plane network elements, which are anchor user plane network elements connected to the aggregate user plane network element. The first session management network element determines actual data usage of a terminal device based on the discarded data usage and the transport data usage.