# US 2021/0344680 A1 · Method, Device, And System For Enhancing Cross-Network Access Security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344680 A1 - Document ID: US20210344680A1 - Status: Published application - Kind: A1 - Application number: 17/374,405 - Filed: 2021-07-13 - Published: 2021-11-04 - Earliest claimed: 2019-01-21 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Longhua GUO; He LI - Web page: https://patentgrep.com/patent/US20210344680A1 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1458: {Denial of Service} - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/71: Hardware identity - H04L 63/102: {Entity profiles} - H04L 2463/142: Denial of service attacks against network infrastructure - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Example methods and apparatus for enhancing cross-network access security are described. In one example method, a terminal accesses a second network by using a packet data unit (PDI) session established in a first network. A session management network element in the first network receives a first request message for the PDIJ session, where the first request message comprises address information of the terminal, an identifier of the second network, and indication information for prohibiting the terminal from accessing the second network. Based on the first request message, the session management network element stores the information for prohibiting the terminal from accessing the second network, and blocks access of the terminal to the second network. ## Claims ### Claim 1 A method for enhancing cross-network access security, wherein the method is used by a. terminal to access a second network by using a packet data unit (PDU) session established in a. first network, and the method comprises: receiving, by a session management network element in the first network, a first request message for the PDU session, wherein the first request message comprises address information of the terminal, an identifier of the second network, and information for prohibiting the terminal from accessing the second network; storing, by the session management network element based on the first request message, the information for prohibiting the terminal from accessing the second network; and blocking, by the session management network element, access of the terminal to the second. network. ### Claim 2 (depends on 1) The method according to claim 1, wherein: the information for prohibiting the terminal from accessing the second network comprises an identifier of the terminal in the first network and the identifier of the second network; and the storing, by the session management network element based on the first request message, the information for prohibiting the terminal from accessing the second network comprises: determining the identifier of the terminal in the first network based on the address information of the terminal; and associating the identifier of the terminal in the first network with the identifier of the second network and storing the identifier of the terminal in the first network and the identifier of the second network, ### Claim 3 (depends on 1) The method according to claim 1, wherein: the information for prohibiting the terminal from accessing the second network comprises an identifier of the terminal in the first network and the identifier of the second network; and the storing, by the session management network element based on the first request message, the information for prohibiting the terminal from accessing the second network comprises: determining the identifier of the terminal in the first network based on the address information of the terminal; associating the identifier of the terminal in the first nets network with the identifier of the second network; and storing the identifier of the terminal in the first network and the identifier of the second network in subscription data of the terminal in a unified data management (UDM) network element in the first network, or storing the identifier of the terminal in the first network and the identifier of the second network in a security gateway in the first network. ### Claim 4 (depends on 1) The method according to claim 1, wherein the blocking access of the terminal to the second network comprises: sending, by the session management network element, a second request message for blocking the terminal from accessing the second network to a user plane function network element that serves the PDU session in the first network; and blocking, by the user plane function network element, the access of the terminal to the second network based on the second request message. ### Claim 5 (depends on 1) The method according to claim 1, wherein the blocking access of the terminal to le second network comprises: releasing, by the session management network element, the HAI session. ### Claim 6 (depends on 1) The method according to claim 1, wherein the method further comprises: when the terminal re-initiates a PDU session establishment request used to access the second network, blocking the access of the terminal to the second network based on the information for prohibiting the terminal from accessing the second network, ### Claim 7 (depends on 1) The method according to claim 1, wherein: the first request message further comprises a validity period in which the terminal is prohibited from accessing the second network; and. the information for prohibiting the terminal from accessing the second nets pork further comprises the validity period, ### Claim 8 A method for enhancing cross-network access security, wherein the method is used by a terminal to access a second network by using a packet data unit (PDU) session established in a first network, and the method comprises: when authentication of the LI fails, recording, by a network element in the second network, a result of authentication failure; determining, by the network element in the second network based on the result of the authentication failure, to stop the terminal from accessing the second network; and sending, by the network element in the second network, an authentication response to a network element in the first network, wherein the authentication response comprises address information of the terminal and information for prohibiting the terminal from accessing the second network. ### Claim 9 (depends on 8) The method according to claim 8, wherein the authentication response further comprises a validity period in which the terminal is prohibited from accessing the second network. ### Claim 10 (depends on 8) The method according to claim 8, wherein the determining to stop the terminal from accessing the second network comprises: determining, by the network element in the second network, that a quantity of authentication failures of the terminal is greater than a preset threshold. ### Claim 11 (depends on 8) The method according to claim 8, wherein the network element in the second network is a non-3GPP interworking function (N3IWF) network element. ### Claim 12 An apparatus for enhancing cross-network access security, wherein the apparatus is used by a terminal to access a second network by using a packet data unit (PDU) session established in a first network, and the apparatus comprises: at least one processor; and one or more memories coupled to the at least one processor and storing programming instructions for execution by the at least one processor to: receive a first request message for the PDU session, wherein the first request message comprises address information of the terminal, an identifier of the second network, and information for prohibiting the terminal from accessing the second network; store, based on the first request message, the information for prohibiting the terminal from accessing the second network; and block access of the terminal to the second network. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein: the information for prohibiting the terminal from accessing the second network comprises an identifier of the terminal in the first network and the identifier of the second network; and storing the information for prohibiting the terminal from accessing the second network comprises: determining the identifier of the terminal in the first network based on the address information of the terminal; and associating the identifier of the terminal in the first network with the identifier of the second network and storing the identifier of the terminal in the first network and the identifier of the second network. ### Claim 14 (depends on 12) The apparatus according to claim 12, wherein: the information for prohibiting the terminal from accessing the second network comprises an identifier of the terminal in the first network and the identifier of the second network; and storing the information for prohibiting the terminal from accessing the second network comprises: determining the identifier of the terminal in the first network based on the address information of the terminal; associating the identifier of the terminal in the first network with the identifier of the second network; and storing the identifier of the terminal in the first network and the identifier of the second network in subscription data of the terminal in a unified data management (UDM) network element in the first network, or storing the identifier of the terminal in the first network and the identifier of the second network in a security gateway in the first network. ### Claim 15 (depends on 12) The apparatus according to claim 12, wherein blocking access of the terminal to the second network comprises: sending a second request message for blocking the terminal from accessing the second network to a user plane function network element that serves the PDU session in the first network, wherein the second request message indicates the user plane function network element to block the access of the terminal to the second network. ### Claim 16 (depends on 12) The apparatus according to claim 12, wherein blocking access of the terminal to the second network comprises: releasing the PDU session. ### Claim 17 (depends on 12) The apparatus according to claim 12, wherein the one or more memories store the programming instructions for execution by the at least one processor to: when the terminal re-initiates a PDU session establishment request used to access the second network, block the access of the terminal to the second network based on the information for prohibiting the terminal froth accessing the second network. ### Claim 18 (depends on 12) The apparatus according to claim 12, wherein: the first request message further comprises a validity period in which the terminal is prohibited from accessing the second network; and the information for prohibiting the terminal from accessing the second network further comprises the validity period.