# US 12,114,154 B2 · Communication method and related device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,114,154 B2 - Document ID: US12114154B2 - Status: Granted - Kind: B2 - Application number: 17/672,391 - Filed: 2022-02-15 - Published: 2022-06-02 - Granted: 2024-10-08 - Earliest claimed: 2019-08-15 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Zhongding Lei - Web page: https://patentgrep.com/patent/US12114154B2 ## CPC - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04W 12/06: Authentication - H04W 12/082: using revocation of authorisation - H04W 12/61: Time-dependent - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments provide a communication method and a related product. The method includes: After primary authentication between a core network and a user equipment succeeds, a network function entity in the core network assists a data network in performing secondary authentication between the data network and the user equipment if the secondary authentication further needs to be performed between the data network and the user equipment; the network function entity obtains an authentication result of the secondary authentication and a restriction condition of the secondary authentication from the data network; and the network function entity stores the authentication result and the restriction condition into the core network. The restriction condition may be introduced for the secondary authentication, to make it possible that the authentication result is properly restricted for use, and to lay a foundation for effective management of the authentication result of the secondary authentication. ## Claims ### Claim 1 A communication method, comprising: after primary authentication between a core network and a user equipment succeeds, assisting, by a network function entity in the core network, a data network in performing secondary authentication between the data network and the user equipment when the secondary authentication further needs to be performed between the data network and the user equipment; obtaining, by the network function entity, an authentication result of the secondary authentication and a restriction condition of the secondary authentication from the data network; and storing, by the network function entity, the obtained authentication result of the secondary authentication and the obtained restriction condition of the secondary authentication into the core network. ### Claim 2 (depends on 1) The method according to claim 1, wherein the restriction condition of the secondary authentication comprises a validity period of the authentication result of the secondary authentication. ### Claim 3 (depends on 2) The method according to claim 2, wherein the authentication result of the secondary authentication and an authentication result of the primary authentication are bound for storage or stored separately; or the authentication result of the secondary authentication and a context of the user equipment are bound for storage or stored separately, or the validity period of the secondary authentication is not equal to a validity period of a context of the user equipment, or the validity period of the secondary authentication is not equal to a validity period of the primary authentication. ### Claim 4 (depends on 1) The method according to claim 1, wherein the restriction condition of the secondary authentication comprises an authorization level of the secondary authentication. ### Claim 5 (depends on 1) The method according to claim 1, wherein the assisting, by a network function entity in the core network, a data network in performing secondary authentication between the data network and the user equipment is performed in response to a determination that a condition for initiating the secondary authentication for the user equipment is met. ### Claim 6 (depends on 5) The method according to claim 5, wherein the method further comprises: obtaining, by the network function entity, assistance information of the secondary authentication from the data network, and storing, by the network function entity, the obtained assistance information of the secondary authentication into the core network, wherein the assistance information is for determining a condition for initiating next secondary authentication for the user equipment or another user equipment. ### Claim 7 (depends on 5) The method according to claim 5, wherein the method further comprises: sending, by the network function entity, the obtained authentication result of the secondary authentication and the obtained restriction condition of the secondary authentication to the user equipment. ### Claim 8 (depends on 1) The method according to claim 1, wherein the method further comprises: when receiving, from the data network, an update request for requesting to update the restriction condition of the secondary authentication, updating, by the network function entity based on the update request, the restriction condition of the secondary authentication stored in the core network. ### Claim 9 (depends on 1) The method according to claim 1, further comprising: performing, by an authentication server in the data network, secondary authentication between the data network and the user equipment with the assistance of the core network; sending, by the authentication server, the authentication result of the secondary authentication and the restriction condition of the secondary authentication to the network function entity. ### Claim 10 A communication method, comprising: after primary authentication between a core network and a user equipment succeeds, performing, by the user equipment, secondary authentication with a data network with the assistance of the core network when the secondary authentication further needs to be performed between the user equipment and the data network; receiving, by the user equipment from the core network, an authentication result of the secondary authentication and a restriction condition of the secondary authentication; and storing, by the user equipment, the received authentication result of the secondary authentication and the received restriction condition of the secondary authentication. ### Claim 11 (depends on 10) The method according to claim 10, wherein when the authentication result of the secondary authentication is an authentication failure and the restriction condition of the secondary authentication is a validity period of the authentication result, the method further comprises: re-initiating, by the user equipment, the secondary authentication with the data network after it is determined that the validity period of the authentication result ends; or suspending, by the user equipment, initiation of the secondary authentication with the data network before it is determined that the validity period of the authentication result ends. ### Claim 12 (depends on 10) The method according to claim 10, wherein the method further comprises: receiving, by the user equipment from the core network, assistance information of the secondary authentication; and re-initiating, by the user equipment, the secondary authentication with the data network when it is determined that a condition for initiating the secondary authentication for the user equipment is met based on the assistance information; or suspending, by the user equipment, initiation of the secondary authentication with the data network when it is determined that a condition for initiating the secondary authentication for the user equipment is not met based on the assistance information; wherein the assistance information is used to determine a condition for initiating a next secondary authentication for the user equipment. ### Claim 13 A communication apparatus in a core network, comprising: a memory configured to store instructions; a processor coupled to the memory; and a receiver coupled to the processor, wherein the instructions cause the processor to be configured to: after primary authentication between the core network and a user equipment succeeds, assist a data network in performing secondary authentication between the data network and the user equipment when the secondary authentication further needs to be performed between the data network and the user equipment; obtain an authentication result of the secondary authentication and a restriction condition of the secondary authentication from the data network; and store the obtained authentication result of the secondary authentication and the obtained restriction condition of the secondary authentication into the core network. ### Claim 14 (depends on 13) The communication apparatus according to claim 13, wherein the restriction condition of the secondary authentication comprises a validity period of the authentication result of the secondary authentication. ### Claim 15 (depends on 13) The communication apparatus according to claim 13, wherein the authentication result of the secondary authentication and an authentication result of the primary authentication are bound for storage or stored separately; or the authentication result of the secondary authentication and a context of the user equipment are bound for storage or stored separately, or the validity period of the secondary authentication is not equal to a validity period of a context of the user equipment, or the validity period of the secondary authentication is not equal to a validity period of the primary authentication. ### Claim 16 (depends on 13) The communication apparatus according to claim 13, wherein the instructions father cause the apparatus to: obtain assistance information of the secondary authentication from the data network; store the assistance information of the secondary authentication; and when it is determined that a condition for initiating the secondary authentication for the user equipment is met according to the assistance information of the secondary authentication, assist the data network in performing the secondary authentication between the data network and the user equipment. ### Claim 17 (depends on 13) The communication apparatus according to claim 13, wherein the instructions further cause the apparatus to: receive, from the data network, an update request for requesting to update the restriction condition of the secondary authentication, and update, based on the update request, the restriction condition of the secondary authentication stored in the core network. ### Claim 18 A communication apparatus in a core network, comprising: a memory configured to store instructions; a processor coupled to the memory; and a receiver coupled to the processor, wherein the instructions, when executed by the processor, cause the apparatus to: after primary authentication between a core network and the communication apparatus succeeds, perform secondary authentication with a data network with the assistance of the core network when the secondary authentication further needs to be performed between the user equipment and the data network; receive an authentication result of the secondary authentication and a restriction condition of the secondary authentication from the core network; and store the authentication result of the secondary authentication and the restriction condition of the secondary authentication. ### Claim 19 (depends on 18) The communication apparatus according to claim 18, wherein when the authentication result of the secondary authentication is an authentication failure and the restriction condition of the secondary authentication is a validity period of the authentication result, the instructions further cause the apparatus to: reinitiate the secondary authentication with the data network after it is determined that the validity period of the authentication result ends; or suspend initiation of the secondary authentication with the data network before it is determined that the validity period of the authentication result ends. ### Claim 20 (depends on 18) The communication apparatus according to claim 18, wherein the instructions further cause the apparatus to: receive, from the core network, assistance information of the secondary authentication; and reinitiate the secondary authentication with the data network when it is determined that a condition for initiating the secondary authentication for the communication apparatus is met based on the assistance information; or suspend initiation of the secondary authentication with the data network when it is determined that a condition for initiating the secondary authentication for the communication apparatus is not met based on the assistance information; wherein the assistance information is used to determine a condition for initiating next secondary authentication for the communication apparatus.