Abstract: Embodiments of this application provide a communication method, apparatus, and system, to improve security of a V2X PC5 establishment procedure. The method includes: A first terminal device obtains a first security protection method, where the first security protection method is a security protection method determined in a discovery procedure between the first terminal device and a second terminal device; and the first terminal device determines a second security protection method according to the first security protection method, where the second security protection method is a security protection method for a PC5 connection between the first terminal device and the second terminal device. For example, a security level of the second security protection method is not lower than a security level of the first security protection method. The communication method is applicable to the V2X communication field.

Abstract: Embodiments of this application provide a communication method and an apparatus to resolve a PC5 unicast establishment failure due to inconsistency between security parameters of terminal devices in a V2X scenario with security negotiation introduced into a PC5 unicast establishment procedure. The communication method includes: A first direct communication discovery name management function network element obtains a security parameter of a first terminal device. A security parameter is required for establishing a PC5 connection between the first terminal device and a second terminal device.

Abstract: Embodiments of this application provide a communication method and an apparatus, to ensure a multicast service data packet transmission security requirement. An access device may determine a user plane security active state of a multicast DRB in a PDU session, and indicate the user plane security active state of the multicast DRB to a terminal, where the user plane security active state includes whether integrity protection is activated and/or whether confidentiality protection is activated. In addition, the access device configures a multicast PDCP layer entity based on the user plane security active state of the DRB for transmitting multicast service data. The access device may further determine a user plane security active state of a unicast DRB, indicate the user plane security active state to the terminal, and modify a unicast PDCP layer entity.

Abstract: A communication method, apparatus, and system, the method including sending, by a policy control network element, policy control information to a network device, where the policy control information includes a trigger event for reporting transport network information, and where the trigger event triggers the network device to report the transport network information to the policy control network element, receiving, by the policy control network element, the transport network information from the network device, formulating, by the policy control network element, a control policy based on the transport network information, and sending, by the policy control network element, the control policy to the network device.

Abstract: A method for determining a user plane security algorithm, a system, and an apparatus. The method may include: a second device selects a non-null user plane confidentiality protection algorithm based on a security capability of a first device and a security capability of the second device in a case in which user plane confidentiality protection between the second device and the first device is enabled and control plane confidentiality protection between the second device and the first device is not enabled. The second device sends a first message to the first device. The first message includes first algorithm indication information indicating the user plane confidentiality protection algorithm. Therefore, the first device can obtain the non-null user plane confidentiality protection algorithm. Embodiments can be adopted to determine an effective user plane confidentiality protection algorithm, for confidentiality protecting user plane data.

Abstract: This application provides a QoS flow control method and an apparatus. An SMF network element receives first indication information sent by an access network apparatus, where the first indication information is used to indicate that a first QoS target of a QoS flow cannot be met; and the SMF network element does not process the QoS flow if the SMF network element receives second indication information in a first preset time; or the SMF network element deletes or modifies the QoS flow if the SMF network element does not receive second indication information in a first preset time, where the second indication information is used to indicate that the first QoS target can be met.

Abstract: In a method for configuring a policy for user equipment (UE), a PCF network element receives policy information of the UE from a first network element. The policy information of the UE indicates a current policy of the UE. The PCF network element sends configuration information to the UE based on the policy information of the UE, and the configuration information instructs the UE to update the policy of the UE. The policy control function network apparatus then sends to the first network apparatus update information that comprises either the configuration information or an identifier of the configuration information.

Abstract: Embodiments of this application disclose a slice service verification method and apparatus, to improve network security. The method in embodiments of this application includes: A slice service verification function entity receives a first message sent by a terminal device, where the first message carries an identifier of a first network slice and a first message authentication code, and the first message authentication code is calculated based on a first network identifier. The slice service verification function entity verifies the first message authentication code based on a second network identifier. The slice service verification function entity sends the second network identifier to an authentication server when the verification succeeds.

Abstract: Embodiments of the present disclosure provide a method, an apparatus, and a system for changing an association relationship between an MCPTT user and an MCPTT group. A method for changing an association relationship between an MCPTT user and an MCPTT group is performed by a first network element device, including: receiving an association change request sent by first UE, where the association change request includes request information, the request information is used to indicate that a first MCPTT user requests to change an association relationship between a second MCPTT user and a first MCPTT group, and the first MCPTT user is an MCPTT user using the first UE; and setting the association relationship between the second MCPTT user and the first MCPTT group according to the association change request.

Abstract: This disclosure provides a method including: A session management network element receives a session establishment request message from a terminal device, where the session establishment request message is used to request to establish a session with a data network. The session management network element determines whether an authentication result of authentication and/or authorization by the data network on the terminal device exists. When determining that the authentication result exists, the session management network element does not initiate a secondary authentication procedure for the session, in other words, skips the secondary authentication procedure. In this disclosure, the session management network element may determine, based on that the data network has authenticated the terminal device, to skip the secondary authentication procedure.

Abstract: A user plane security enforcement information determining method and an apparatus are provided, to ensure a security requirement of transmitted data of a remote device. In this application, a session management network element may receive a first request for creating a relay-type session of a first terminal device. Then, the session management network element determines first user plane security enforcement information of the session based on first information, and sends the first user plane security enforcement information of the session to an access network device, where the first user plane security enforcement information of the session is for determining a first user plane security activation status of the session between the first terminal device and the access network device.

Abstract: This application provides a key management method, a device, and a system. The method includes: A terminal device sends a first application session establishment request message to a first application function network element, where the establishment request message carries identification information of a first key, and the first key is an authentication and key management for applications AKMA key. The terminal device receives a first authentication request message in a procedure of the re-authentication. The terminal device sends a response message for the first authentication request message in the procedure of the re-authentication. The terminal device receives a response message for the establishment request message. The terminal device derives a communication key between the terminal device and the first application function network element by using the first key.

Abstract: A communications method includes determining a session management function entity based on at least one of a data network name, slice information, and an application function service identifier, and sending a first message to the session management function entity, where the first message is used to subscribe to a terminal event, the first message includes service description information, and the service description information is used to indicate a service corresponding to the terminal event.

Abstract: A visible-light-photocatalyzed composite light-transmitting concrete contains several bundles of optical fibers, the optical fibers are coated with a protective layer on their outer surface, the protective layer contains a visible light photocatalyst, and the concrete has several gas-permeable pores. Such concrete is prepared by mixing a visible light photocatalyst and a light-transmitting glue, applying the mixture to the surface of optical fibers to form a protective layer, and using optical fibers in the concrete. The resulting concrete has dual properties of light transmittance and photocatalytic oxidation of gas-phase pollutants under visible light irradiation. The visible-light-photocatalyzed composite light-transmitting concrete significantly breaks through the limitation of photocatalytic concrete to light sources, so that gas-phase pollutants can be removed under visible light irradiation through photocatalysis of light-transmitting concrete.

Abstract: An address obtaining method includes obtaining, by a third network device, an identifier of a first application from a terminal device. The identifier of the first application indicates a request for obtaining an address of an instance of the first application. The address obtaining method further includes sending, by the third network device, a first message to a first network device, wherein the first message comprises the identifier of the first application, and the first message is useable to request the address of the instance of the first application. The address obtaining method further includes receiving, by the third network device, the address of the instance of the first application from the first network device, and sending the address of the instance of the first application to the terminal device.

Abstract: This application provides a QoS flow control method and an apparatus. An SMF network element receives first indication information sent by an access network apparatus, where the first indication information is used to indicate that a first QoS target of a QoS flow cannot be met; and the SMF network element does not process the QoS flow if the SMF network element receives second indication information in a first preset time; or the SMF network element deletes or modifies the QoS flow if the SMF network element does not receive second indication information in a first preset time, where the second indication information is used to indicate that the first QoS target can be met.

Abstract: This application provides a communication system, method, and apparatus, to resolve a prior-art problem that a terminal device does not know how to initiate a correct procedure to establish a communication connection to an application function AF to obtain a business service. A principle of the method is as follows: An AF sends a service mode supported by the AF to UE by using a core network. Therefore, before initiating a service to the AF, the UE can sense the service mode supported by the AF, and the UE initiates a correct connection establishment procedure to the AF based on the service mode supported by the AF.

Abstract: A multicast communication method and a communication apparatus provide for transmission of data of a multicast service using a PDU session established by a terminal device to improve network element utilization. An AF network element sends first multicast service indication information to a session management network element indicating a first multicast service. The session management network element sends, based on the first multicast service indication information, multicast service information to an access network device that serves a terminal device. The access network device establishes an association relationship between the terminal device and the first multicast service based on the multicast service information, so that the access network device can send, when receiving data of the first multicast service, the data of the first multicast service to the terminal device using a PDU session.

Abstract: This application provides a communication system, method, and apparatus. The system is applied to implement AKMA service-based data transmission between a terminal device and an application function network element, and the system includes an AKMA anchor function network element and a network exposure function network element. The network exposure function network element obtains first identification information from a unified data management network element, where the first identification information is used to determine an authentication server function network element corresponding to the terminal device, and sends the first identification information to the AKMA anchor function network element. The AKMA anchor function network element obtains, from the unified data management network element based on the first identification information, identification information of the authentication server function network element corresponding to the terminal device.

Abstract: A method for obtaining an identifier of a terminal device includes a key management network element receiving, from a first terminal device, a first key request including a first identifier, where the first identifier is an anonymous identifier or a temporary identifier of a second terminal device. The key management network element sends, to a unified data management network element, a first request including the first identifier. The unified data management network element determines a SUPI of the second terminal device based on the first identifier, and sends, to the key management network element, a first response including the SUPI. In response to an authorization check performed on the second terminal device based on the SUPI succeeds, the key management network element sends a first key response to the first terminal device, where the first key response includes a secure communication parameter.