WO2020238957A1

WO2020238957A1 - Verification method and apparatus

Info

Publication number: WO2020238957A1
Application number: PCT/CN2020/092605
Authority: WO
Inventors: 罗海燕; 戴明增; 曾清海; 李�赫
Original assignee: 华为技术有限公司
Priority date: 2019-05-31
Filing date: 2020-05-27
Publication date: 2020-12-03
Also published as: CN112019489A; CN112019489B

Abstract

Provided in the present application are a verification method and apparatus, relating to the technical field of communication. In the present method, a terminal receives from a first node an identifier of the first node and a first verification code generated on the basis of a first root key and the identifier of the first node, and verifies the legitimacy of the first node on the basis of the identifier of the first node, the first root key, and a first verification code. The first root key is a root key used for communication between the terminal and an access network device.

Description

Verification method and device

This application claims the priority of a Chinese patent application filed with the State Intellectual Property Office, the application number is 201910472664.0, and the application name is "Verification Method and Apparatus" on May 31, 2019, the entire content of which is incorporated into this application by reference.

Technical field

This application relates to the field of communication technology, and in particular to a verification method and device.

Background technique

For device-to-device (D2D) communication, vehicle to everything (V2X) communication (a special type of D2D communication), both the sender and the receiver separately from the server (for example, near The field communication (proximity service, ProSe) function obtains the shared key, and then performs a handshake between the two parties based on the shared key, thereby achieving the purpose of mutual authentication. This method is mainly suitable for mutual authentication between two terminals with symmetric roles (that is, the same function). In addition, since the server is located in the data network (DN for short) of the core network, it takes a long time for the sender or receiver to obtain the shared key, which causes the sender (or receiver) to verify the receiver (or The sending end) takes longer.

Summary of the invention

The embodiments of the present application provide a verification method and device, which are used to reduce the time for the sender (or the receiver) to verify the receiver (or the sender).

In order to achieve the foregoing objectives, the embodiments of this application provide the following technical solutions:

In a first aspect, a verification method is provided, which can be executed by a terminal or a chip in the terminal, and includes: the terminal receives from a first node a first verification code and a first verification code generated according to a first root key and an identity of the first node. And verify the legitimacy of the first node according to the identity of the first node, the first root key and the first verification code. Wherein, the first root key is the root key used for communication between the terminal and the access network device. In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided by the first aspect, when verifying the legitimacy of the first node, the terminal can verify the legitimacy of the first node according to the first root key, the received identification of the first node, and the first verification code, There is no need to obtain the shared key from the server, so the time for the terminal to verify the legitimacy of the first node can be shortened.

In a possible implementation manner, the terminal and the first node communicate through a side link.

In a possible implementation manner, the method further includes: the terminal sends a first request message for requesting association with the first node to the first node, the first node is responsible for allocating transmission resources of the side link, and the first request message It includes the RRC message sent by the terminal to the access network device. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation manner, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the RRC message, without requiring the first node to obtain the shared key from the server. Therefore, the verification terminal can be shortened. Time of legality.

In a possible implementation manner, the method further includes: the terminal sends a first request message for requesting association to the first node to the first node, the first node is responsible for allocating transmission resources of the side link, and the first request message It includes a third verification code, which is used to verify the legitimacy of the terminal. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the third verification code generated by the first root key sent by the terminal, without the first node from the server The shared key is obtained in the process, therefore, the time to verify the legitimacy of the terminal can be shortened.

In a possible implementation manner, the terminal sending the first request message to the first node includes: the terminal receives the notification message broadcast by the first node on the side link, and sends the first request message to the first node according to the notification message. Wherein, the notification message includes indication information used to indicate that the first node is a node responsible for allocating transmission resources of the side link.

In a possible implementation manner, the terminal verifies the legitimacy of the first node according to the identity of the first node, the first root key and the first verification code, including: the terminal according to the identity of the first node and the first root key Generate a second verification code, and verify the legitimacy of the first node according to the second verification code and the first verification code.

In a second aspect, a verification method is provided, which includes: a first node receives a first verification code generated based on a first root key and an identity of the first node from an access network device, and sends the first verification code and The identification of the first node, the identification of the first node and the first verification code are used to verify the legitimacy of the first node. Wherein, the first root key is the root key used for communication between the terminal and the access network device. In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided by the second aspect, when verifying the legitimacy of the first node, the terminal can verify the legitimacy of the first node according to the first root key, the received identity of the first node, and the first verification code, and There is no need to obtain the shared key from the server, so the time for the terminal to verify the legitimacy of the first node can be shortened.

In a possible implementation, the method further includes: the first node receives a first request message for requesting association to the first node from the terminal, the first node is responsible for allocating transmission resources of the side link, and the first request message It includes the RRC message sent by the terminal to the access network device; the first node sends a second request message including the RRC message to the access network device according to the first request message, and the RRC message is used by the access network device to verify the legitimacy of the terminal. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the RRC message, without requiring the first node to obtain the shared key from the server. Therefore, the verification terminal can be shortened. Time of legality.

In a possible implementation, the method further includes: the first node receives a first request message for requesting association to the first node from the terminal, the first node is responsible for allocating the transmission resources of the side link, and the first request message The third verification code is used to verify the legitimacy of the terminal; the first node sends a second request message including the third verification code to the access network device according to the first request message. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the third verification code generated by the first root key sent by the terminal, without the first node from the server The shared key is obtained in the process, therefore, the time for verifying the legitimacy of the terminal can be shortened.

In a possible implementation, the method further includes: the first node broadcasts a notification message on the side link, and the notification message includes indication information for indicating that the first node is a node responsible for allocating transmission resources of the side link.

In a third aspect, a verification method is provided, which can be executed by an access network device or a chip in the access network device, including: the access network device receives from a first node the RRC that the terminal sends to the access network device The second request message of the message, and decode the RRC message; if the decoding is successful, the access network device determines that the terminal is legal; if the decoding is unsuccessful, the access network device determines that the terminal is illegal. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In the method provided by the third aspect, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the RRC message without requiring the first node to obtain the shared key from the server. Therefore, the verification terminal can be shortened. Time of legality.

In a possible implementation manner, the method further includes: the access network device sends a first verification code for verifying the legitimacy of the first node to the first node.

In a fourth aspect, a verification method is provided, which may be executed by an access network device or a chip in the access network device, including: the access network device receives a second request message including a third verification code from a first node , And verify the legitimacy of the terminal according to the identity of the first node, the first root key and the third verification code. Among them, the third verification code is used to verify the legitimacy of the terminal. The third verification code is generated according to the identity of the first node and the first root key, and the first root key is used for communication between the terminal and the access network device. Root key. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In the method provided by the fourth aspect, when verifying the legitimacy of the terminal, the access network device can verify the legitimacy of the terminal according to the third verification code generated by the first root key sent by the terminal, without the first node from the server The shared key is obtained in the process, therefore, the time for verifying the legitimacy of the terminal can be shortened.

In a possible implementation manner, the access network device verifies the legitimacy of the terminal according to the identity of the first node, the first root key, and the third verification code, including: the access network device verifies the legitimacy of the terminal according to the identity of the first node Generate a fourth verification code with the first root key, and verify the legitimacy of the first node according to the fourth verification code and the third verification code.

In a fifth aspect, a verification method is provided, which can be executed by a terminal or a chip in the terminal, including: the terminal receives the identity of the first node and the first key freshness parameter from the access network device, and the first The node is the termination point of the application layer data of the terminal; the terminal receives a first verification code from the first node, the first verification code is generated according to a second root key, and the second root key is The root key used for communication between the terminal and the first node; the terminal verifies the first node according to the identity of the first node, the first key freshness parameter, and the first verification code The legitimacy of the first node. In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided by the fifth aspect, when verifying the legitimacy of the first node, the terminal verifies the legitimacy of the first node according to the identity of the first node and the first key freshness parameter obtained from the access network device. can. The terminal does not need to obtain the shared key from the server to realize the legality verification of the first node. Therefore, the time for the terminal to verify the legality of the first node can be shortened.

In a possible implementation manner, the method further includes: the terminal sends a first request message to the first node, where the first request message is used to request association with the first node, and the first node A node is responsible for allocating transmission resources of the side link, and the first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation, the terminal can send a first verification code to the first node. When verifying the legitimacy of the terminal, the first node can verify the legitimacy of the terminal according to the first verification code sent by the terminal, without The shared key is obtained from the server, therefore, the time for the first node to verify the legitimacy of the terminal can be shortened.

In a possible implementation, the terminal verifies the legitimacy of the first node according to the identity of the first node, the first key freshness parameter, and the first verification code, including: The terminal generates the second root key according to the first root key, the identifier of the first node, and the first key freshness parameter, and the first root key is the connection between the terminal and the The root key used for communication between networked devices; the terminal generates a second verification code according to the second root key; the terminal verifies the second verification code according to the second verification code and the first verification code The legitimacy of the first node.

In a possible implementation manner, sending the first request message by the terminal to the first node includes: the terminal receiving a notification message broadcast by the first node on the side link, the notification message including Indication information, where the indication information is used to indicate that the first node is a node responsible for allocating transmission resources of a side link; the terminal sends the first request message to the first node according to the notification message.

In a possible implementation manner, the first request message further includes an identifier of the terminal.

In a possible implementation manner, the method further includes: the terminal generates a security protection key for data with the first node according to the second root key; the terminal generates a security protection key according to the security Data transmission is performed between the protection key and the first node.

In a sixth aspect, a verification method is provided, which can be executed by a first node or a chip in the first node, and includes: the first node generates a first verification code according to a second root key, and the second root secret The key is the root key used for communication between the terminal and the first node, and the first node is the end point of the terminal's application layer data; the first node sends the terminal The first verification code. In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided by the sixth aspect, the access network device can send the identification of the first node and the first key freshness parameter to the terminal. When verifying the legitimacy of the first node, the terminal can use the information obtained from the access network device. The identification of the first node and the first key freshness parameter may verify the legitimacy of the first node. The terminal does not need to obtain the shared key from the server to realize the legality verification of the first node. Therefore, the time for the terminal to verify the legality of the first node can be shortened.

In a possible implementation manner, the method further includes: the first node receives a first request message from the terminal, the first request message is used to request association with the first node, and the first node A node is responsible for allocating the transmission resources of the side link, the first request message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code is based on the Two root keys are generated; the first node verifies the legitimacy of the terminal according to the second root key and the third verification code. In the prior art, the server is located in the DN. Therefore, it takes a long time for the first node to obtain the shared key from the server. In this possible implementation manner, when verifying the legitimacy of the terminal, the first node can verify the legitimacy of the terminal according to the first verification code sent by the terminal without obtaining the shared key from the server. Therefore, it can shorten The time for the first node to verify the legitimacy of the terminal.

In a possible implementation manner, the first request message includes the identification of the terminal, and the legality of the terminal is verified at the first node according to the second root key and the third verification code. Before the performance, the method further includes: the first node obtains the second root key according to the identifier of the terminal.

In a possible implementation manner, the method further includes: the first node receives the identification of the terminal and the second root key from the access network device.

In a possible implementation manner, the method further includes: the first node broadcasts a notification message on the side link, the notification message includes indication information, and the indication information is used to indicate that the first node is The node responsible for allocating the transmission resources of the side link.

In a possible implementation manner, the method further includes: the first node generates a security protection key for data with the terminal according to the second root key; Data transmission is performed between the security protection key and the terminal.

In a seventh aspect, a verification method is provided, which can be executed by a first access network device or a chip in the first access network device, including: the first access network device sends a handover to the second access network device Request message, the handover request message is used to request the second access network device for the terminal to switch from the first access network device to the second access network device, and the handover request message includes the The identification of the terminal; the first access network device receives a handover reply message from the second access network device, the handover reply message includes the identity of the second node and the second key freshness parameter, the first The second node is the node responsible for allocating side link resources for the terminal to be associated after the terminal is switched. The identifier of the second node and the second key freshness parameter are used to verify the terminal and/or The validity of the second node; the first access network device sends the identification of the second node and the second key freshness parameter to the terminal. In the method provided by the seventh aspect, in a scenario where the terminal switches from the first access network device to the second access network device, the first access network device sends the identity of the second node and the freshness of the second key to the terminal through the first access network device Parameters to ensure that the terminal can smoothly perform legality verification with the second node after switching to the second access network device.

In an eighth aspect, an authentication method is provided, which can be executed by a second access network device or a chip in the second access network device, including: the second access network device receives the handover from the first access network device Request message, the handover request message is used to request the second access network device for the terminal to switch from the first access network device to the second access network device, and the handover request message includes the The identification of the terminal; the second access network device sends a handover reply message to the first access network device, the handover reply message includes the identity of the second node and the second key freshness parameter, the first The second node is the node responsible for allocating side link resources for the terminal to be associated after the terminal is switched. The identifier of the second node and the second key freshness parameter are used to verify the terminal and/or The legitimacy of the second node; the second access network device sends the terminal's identity and a third root key to the second node, where the third root key is the terminal and the first A root key for communication between two nodes, where the third root key is used to verify the legitimacy of the terminal and/or the second node. In the method provided by the eighth aspect, in a scenario where the terminal is handed over from the first access network device to the second access network device, the first access network device sends the identity of the second node and the freshness of the second key to the terminal through the first access network device Parameters, so as to ensure that the terminal can smoothly perform legality verification with the second node after switching to the second access network device.

In a ninth aspect, a verification device is provided, including: a communication unit and a processing unit; the communication unit is configured to receive a first verification code and an identifier of the first node from a first node, and the first verification code According to the first root key and the identity of the first node, the first root key is the root key used for communication between the verification apparatus and the access network device; the processing unit is configured to Verify the legitimacy of the first node according to the identity of the first node, the first root key, and the first verification code.

In a possible implementation manner, the verification apparatus and the first node communicate through a side link.

In a possible implementation manner, the communication unit is further configured to send a first request message to the first node, where the first request message is used to request to associate with the first node, and the first The node is responsible for allocating the transmission resources of the side link, and the first request message includes the radio resource control RRC message sent by the verification apparatus to the access network device.

In a possible implementation manner, the communication unit is further configured to send a first request message to the first node, where the first request message is used to request to associate with the first node, and the first The node is responsible for allocating the transmission resources of the side link, and the first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the verification device.

In a possible implementation manner, the communication unit is further configured to receive a notification message broadcast by the first node on the side link, the notification message includes indication information, and the indication information is used to indicate the The first node is a node responsible for allocating transmission resources of the side link; the communication unit is further configured to send the first request message to the first node according to the notification message.

In a possible implementation manner, the processing unit is specifically configured to: generate a second verification code according to the identity of the first node and the first root key; and generate a second verification code according to the second verification code and the The first verification code verifies the legitimacy of the first node.

In a tenth aspect, a verification device is provided, including: a communication unit and a processing unit; the processing unit is configured to receive a first verification code from an access network device through the communication unit, and the first verification code is A key and the identification of the verification device are generated, the first root key is the root key used for communication between the terminal and the access network device; the processing unit is also used to pass the The communication unit sends the first verification code and the identification of the verification device to the terminal, and the identification of the verification device and the first verification code are used to verify the legitimacy of the verification device.

In a possible implementation manner, the terminal and the verification apparatus communicate through a side link.

In a possible implementation manner, the processing unit is further configured to receive a first request message from the terminal through the communication unit, and the first request message is used to request association with the verification device, and the The verification apparatus is responsible for allocating the transmission resources of the side link, and the first request message includes the RRC message sent by the terminal to the access network device; the processing unit is further configured to pass through according to the first request message The communication unit sends a second request message to the access network device, where the second request message includes the RRC message, and the RRC message is used by the access network device to verify the legitimacy of the terminal.

In a possible implementation manner, the processing unit is further configured to receive a first request message from the terminal through the communication unit, and the first request message is used to request association with the verification device, and The verification device is responsible for allocating the transmission resources of the side link. The first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal; the processing unit is also used to The first request message sends a second request message to the access network device through the communication unit, and the second request message includes the third verification code.

In a possible implementation manner, the processing unit is further configured to broadcast a notification message on the side link through the communication unit, the notification message includes indication information, and the indication information is used to indicate the verification device It is the node responsible for allocating the transmission resources of the side link.

In an eleventh aspect, a verification device is provided, including: a communication unit and a processing unit; the communication unit is configured to receive a second request message from a first node, and the second request message includes a terminal sent to the The RRC message of the verification device; the processing unit is configured to decode the RRC message; if the decoding is successful, the processing unit determines that the terminal is legal; if the decoding is unsuccessful, the processing unit determines that the terminal is illegal .

In a possible implementation manner, the communication unit is further configured to send a first verification code to the first node, where the first verification code is used to verify the legitimacy of the first node.

In a twelfth aspect, a verification device is provided, including: a communication unit and a processing unit; the communication unit is configured to receive a second request message from a first node, and the second request message includes a third verification code, The third verification code is used to verify the legitimacy of the terminal, and the third verification code is generated according to the identity of the first node and a first root key, and the first root key is the terminal and the The root key used for communication between verification devices; the processing unit is configured to check the legitimacy of the terminal according to the identity of the first node, the first root key, and the third verification code verification.

In a possible implementation manner, the processing unit is specifically configured to: generate a fourth verification code according to the identity of the first node and the first root key; and generate a fourth verification code according to the fourth verification code and the The third verification code verifies the legitimacy of the first node.

In a thirteenth aspect, a verification device is provided, which has the function of realizing any one of the methods provided in the fifth, sixth, seventh, or eighth aspects. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above-mentioned functions. For example, the device may include a communication unit and a processing unit, and the processing unit is configured to perform processing actions in the fifth, sixth, seventh, or eighth aspects (for example, actions other than sending and/or receiving) , The communication unit is configured to perform the sending and/or receiving actions in the fifth aspect, the sixth aspect, the seventh aspect, or the eighth aspect. Optionally, the actions performed by the communication unit are performed under the control of the processing unit. Optionally, the communication unit includes a sending unit and a receiving unit. In this case, the sending unit is used to perform the sending action in the fifth aspect, the sixth aspect, the seventh aspect, or the eighth aspect, and the receiving unit is used to execute the fifth aspect. The act of receiving in aspect, sixth aspect, seventh aspect, or eighth aspect. The device can exist in the form of a chip.

With respect to the method provided by the fifth aspect, the verification device provided by the thirteenth aspect includes: a communication unit and a processing unit; the communication unit is configured to receive the identity of the first node and the first key freshness parameter from the access network device , The first node is the end point of the application layer data of the device; the communication unit is further configured to receive a first verification code from the first node, and the first verification code is based on the second root key Generated, the second root key is the root key used for communication between the device and the first node; the processing unit is configured to be based on the identity of the first node, the first secret The key freshness parameter and the first verification code verify the legitimacy of the first node.

In a possible implementation manner, the apparatus and the first node communicate through a side link.

In a possible implementation manner, the processing unit is specifically configured to: generate the second root key according to the first root key, the identifier of the first node, and the first key freshness parameter , The first root key is a root key used for communication between the device and the access network device; a second verification code is generated according to the second root key; and a second verification code is generated according to the second verification code And the first verification code to verify the legitimacy of the first node.

In a possible implementation manner, the communication unit is further configured to send a first request message to the first node, where the first request message is used to request to associate with the first node, and the first The node is responsible for allocating the transmission resources of the side link, and the first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the device.

In a possible implementation manner, the communication unit is specifically configured to: receive a notification message broadcast by the first node on a side link, the notification message includes indication information, and the indication information is used to indicate The first node is a node responsible for allocating the transmission resources of the side link; sending the first request message to the first node according to the notification message.

In a possible implementation manner, the first request message further includes an identifier of the device.

In a possible implementation manner, the processing unit is further configured to generate a security protection key for data with the first node according to the second root key, and according to the security protection key and the first node Data transmission is performed between the first nodes.

With respect to the method provided by the sixth aspect, the verification device provided by the thirteenth aspect includes: a communication unit and a processing unit; the processing unit is configured to generate a first verification code according to a second root key, and the second root key It is the root key used for communication between the terminal and the device, and the device is the end point of the application layer data of the terminal; the communication unit is used to send the first verification code to the terminal.

In a possible implementation manner, the terminal and the device communicate through a side link.

In a possible implementation manner, the communication unit is further configured to receive a first request message from the terminal, the first request message is used to request association to the device, and the device is responsible for allocating side links The first request message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code is generated according to the second root key; The processing unit is further configured to verify the legitimacy of the terminal according to the second root key and the third verification code.

In a possible implementation manner, the first request message includes the identification of the terminal, and the processing unit is further configured to obtain the second root key according to the identification of the terminal.

In a possible implementation manner, the communication unit is further configured to receive the identification of the terminal and the second root key from the access network device.

In a possible implementation manner, the communication unit is further configured to broadcast a notification message on the side link, the notification message includes indication information, and the indication information is used to indicate that the device is responsible for allocating the side link. The node of the transmission resource.

In a possible implementation manner, the processing unit is further configured to generate a security protection key for data with the terminal according to the second root key, and according to the security protection key and the terminal Data transmission between terminals.

With respect to the method provided by the seventh aspect, the verification device provided by the thirteenth aspect includes: a communication unit and a processing unit; the processing unit is configured to send a handover request message to a second access network device through the communication unit, and The handover request message is used to request the second access network device for the terminal to switch from the apparatus to the second access network device, and the handover request message includes an identifier of the terminal; the processing unit further Is configured to receive a handover reply message from the second access network device through the communication unit, where the handover reply message includes the identifier of the second node and the second key freshness parameter, and the second node is the After the terminal is switched, the node responsible for allocating side link resources for the terminal to be associated, the identifier of the second node and the second key freshness parameter are used to verify the terminal and/or the second node Legality; the processing unit is further configured to send the identification of the second node and the second key freshness parameter to the terminal through the communication unit.

With respect to the method provided by the eighth aspect, the verification device provided by the thirteenth aspect includes: a communication unit and a processing unit; the processing unit is configured to receive a handover request message from a first access network device through the communication unit, and The handover request message is used to request the device to switch the terminal from the first access network device to the device, and the handover request message includes the identification of the terminal; the processing unit is also used to pass the The communication unit sends a handover reply message to the first access network device, where the handover reply message includes the identifier of the second node and the second key freshness parameter, and the second node is the terminal to be associated after the handover The node responsible for allocating side link resources for the terminal, the identifier of the second node and the second key freshness parameter are used to verify the legitimacy of the terminal and/or the second node; The processing unit is further configured to send the identification of the terminal and a third root key to the second node through the communication unit, where the third root key is for communication between the terminal and the second node The third root key is used to verify the legitimacy of the terminal and/or the second node.

In a fourteenth aspect, a verification device is provided, including a processor. The processor is connected to the memory, and the memory is used to store computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory, so as to implement any method provided in any one of the first aspect to the eighth aspect. Among them, the memory and the processor can be integrated together or can be independent devices. In the latter case, the memory can be located in the verification device or outside the verification device.

In a possible implementation manner, the processor includes a logic circuit and an input interface and/or an output interface. Among them, the output interface is used to execute the sending action in the corresponding method, and the input interface is used to execute the receiving action in the corresponding method.

In a possible implementation manner, the verification device further includes a communication interface and a communication bus, and the processor, memory, and communication interface are connected through the communication bus. The communication interface is used to perform the sending and receiving actions in the corresponding method. The communication interface may also be called a transceiver. Optionally, the communication interface includes a transmitter and a receiver. In this case, the transmitter is used to perform the sending action in the corresponding method, and the receiver is used to perform the receiving action in the corresponding method.

In a possible implementation, the verification device exists in the form of a chip product.

In a fifteenth aspect, a computer-readable storage medium is provided, including instructions, which when run on a computer, cause the computer to execute any method provided in any one of the first to eighth aspects.

In a sixteenth aspect, a computer program product containing instructions is provided. When the instructions run on a computer, the computer executes any method provided in any one of the first to eighth aspects.

In a seventeenth aspect, a verification device is provided to implement any method provided in any one of the first to eighth aspects.

In an eighteenth aspect, a chip is provided, the chip includes a processor and an interface circuit, the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the first aspect to the first aspect Any method provided by any one of the eight aspects.

The technical effects brought about by any one of the ninth aspect to the eighteenth aspect can be referred to the technical effects brought about by the corresponding implementation manners in the first aspect to the eighth aspect, which will not be repeated here.

Among them, it should be noted that the various possible implementation manners of any one of the above aspects can be combined on the premise that the solutions are not contradictory.

Description of the drawings

FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of this application;

2 is a schematic diagram of the composition of a communication protocol stack provided by an embodiment of the application;

3 to 10 are respectively an interaction flowchart of a verification method provided by an embodiment of this application;

11 is a schematic diagram of the composition of a verification device provided by an embodiment of the application;

12 and 13 are respectively schematic diagrams of the hardware structure of a verification device provided by an embodiment of the application;

FIG. 14 is a schematic diagram of the hardware structure of a terminal provided by an embodiment of the application;

FIG. 15 is a schematic diagram of the hardware structure of a network device provided by an embodiment of this application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Wherein, in the description of this application, unless otherwise specified, "/" means or, for example, A/B can mean A or B. "And/or" in this article is only an association relationship that describes associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B alone These three situations. Also, in the description of this application, unless otherwise specified, "plurality" means two or more than two, and "at least one" means one or more.

In addition, in order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same function and effect. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and order of execution, and words such as "first" and "second" do not limit the difference.

The technical solutions of the embodiments of the present application can be applied to various communication systems. For example: orthogonal frequency-division multiple access (OFDMA for short), single carrier frequency-division multiple access (SC-FDMA for short) and other systems. The term "system" can be interchanged with "network". Among them, the OFDMA system can implement wireless technologies such as evolved universal terrestrial radio access (E-UTRA) and ultra mobile broadband (UMB). E-UTRA is an evolved version of the Universal Mobile Telecommunications System (UMTS). The 3rd generation partnership project (3GPP) uses a new version of E-UTRA in long term evolution (LTE) and various versions based on LTE evolution. The fifth-generation (5th-generation, 5G) communication system and the new radio (NR) communication system are next-generation communication systems under study. In addition, the communication system may also be applicable to future-oriented communication technologies, all of which are applicable to the technical solutions provided in the embodiments of this application.

The method provided in the embodiments of this application can be applied to various business scenarios, for example, enhanced mobile broadband (eMBB) business scenarios, ultra-reliable and low latency communication (URLLC) business scenarios , Internet of Things (IoT) business scenarios, Industrial IoT (IIoT), etc.

The traditional cellular network communication mainly includes the communication between the access network equipment and the terminal. When the terminal and the access network equipment communicate, the data of the terminal can be transferred to the core network equipment through the access network equipment. With the introduction of D2D communication, communication between terminals has increased. When communicating between terminals, there is an end-to-end equivalent application layer between the two terminals. The user plane data of one terminal (denoted as terminal A) can be terminated in another terminal (denoted as terminal B), that is to say After the user plane data of terminal A is sent to terminal B, it can be processed at the application layer of terminal B and does not need to be sent to other devices. Later, the special D2D communication method V2X was introduced. For D2D communication or V2X communication, the transmission (here, transmission can be understood as sending and/or receiving) resources used by the terminal can be obtained by any of the following methods: Method 1. The access network equipment is the terminal semi-static scheduling (semi- Persistent scheduling (SPS) or dynamic allocation of transmission resources; Method 2. The terminal selects transmission resources from the transmission resource pool according to one or more transmission resource pools on one or more carriers broadcast by the access network equipment, such as the terminal The transmission resource can be selected according to the channel busy ratio of the resource pool after performing channel awareness; Method 3, the transmission resource is selected in the transmission resource pool pre-configured by the server (for example, the V2X control function). Wherein, in the foregoing method 2 and method 3, the transmission resource pool may include time domain resources and/or frequency domain resources. For example, the transmission resource pool may include frequency resources composed of one or more radio resource blocks (RB for short). Domain resources, and/or, time-frequency resources composed of one or more RBs in a specific time slot or time slot set.

At present, in order to improve the efficiency of resource allocation, there are proposals to use a local resource coordinator (LRC) node to allocate the transmission resources of the side link. The LRC node refers to a local area (for example, an area smaller than a cell). ) Within the node that schedules the function of local resources (for example, resource pool), for example, the LRC node can allocate transmission resources of the side link between the terminal and the LRC node, or allocate transmission resources of the side link between the terminal and the terminal Wait. The local resources that the LRC node is responsible for can be allocated by the access network equipment, or can be sensed by its own channel awareness (for example, the access network equipment broadcasts one or more transmission resource pools on one or more carriers, LRC The node selects the transmission resource from the transmission resource pool, for example, the LRC node selects the transmission resource according to the channel busy ratio of the resource pool after performing channel awareness by itself).

Fig. 1 is a schematic diagram of a communication system provided by the present application. Among them, referring to Figure 1, the terminal and the access network device can communicate through the cellular network wireless link (ie Uu port), and the LRC node and the access network device can communicate through the cellular network wireless link (ie Uu port). , The terminal and the LRC node can communicate through the side link wireless link (that is, the PC5 port). There are three ways to communicate between the terminal and the access network equipment. The first method is: the terminal can only directly communicate with the access network equipment. The second way is: the terminal can only communicate with the access network equipment through the LRC node. The third method is: the terminal can either directly communicate with the access network equipment, or communicate with the access network equipment through the LRC node.

In the first way, the terminal can establish a radio resource control (radio resource control, RRC for short) connection with the access network device (hereinafter referred to as Uu-RRC connection). In the second and third modes, the terminal can first establish a Uu-RRC connection with the access network equipment, and then establish a connection with the LRC node, or first establish a connection with the LRC node, and then pass the LRC node (at this time , The LRC node is a relay) and the access network equipment establish a Uu-RRC connection. Wherein, the connection between the terminal and the LRC node may be a side link RRC connection (also referred to as a PC5-RRC connection), or other connections (for example, establishing an association hereinafter means establishing a connection).

For the transmission between the LRC node and the terminal, in one case, the control plane signaling and/or user plane data of the access network device needs to be sent to the terminal through the LRC node, and the terminal's control plane signaling and/or user plane data It needs to be sent to the access network equipment through the LRC node. At this time, the LRC node may act as a relay between the terminal and the access network device. In another case, the user plane data of the terminal may end at the LRC node, that is, there may be an end-to-end peer application layer between the terminal and the LRC node. After the user plane data of the terminal is sent to the LRC node, the user plane data of the terminal may end at the LRC node. The application layer can do the processing and does not need to be sent to other devices.

It should be noted that the user plane data in the embodiments of the present application may also be referred to as application layer data.

It should be noted that the LRC node may have an RRC layer equivalent to the terminal (called PC5-RRC layer) and an RRC layer equivalent to the access network device (called Uu-RRC layer). In this case, the terminal The RRC message exchanged with the LRC node can be called PC5-RRC message, the RRC message exchanged between the LRC node and the access network device can be called Uu-RRC _LRC message, the RRC message exchanged between the terminal and the access network device The message can be referred to as a Uu-RRC _UE message. Or, the LRC node may not have the PC5-RRC layer equivalent to the terminal and the Uu-RRC layer equivalent to the access network device. In this case, only the terminal and the access network device can exchange RRC messages. The RRC messages exchanged between access network devices may also be referred to as Uu-RRC _UE messages. Or, there may be no PC5-RRC layer equivalent to the terminal on the LRC node, but there is a Uu-RRC layer equivalent to the access network device. In this case, the RRC message exchanged between the LRC node and the access network device can be It is called a Uu-RRC _LRC message, and the RRC message exchanged between the terminal and the access network device can also be called a Uu-RRC _UE message.

Exemplarily, refer to FIG. 2, which shows a schematic diagram of a protocol stack architecture of a terminal, an LRC node, and an access network device. This example is drawn with no PC5-RRC layer and Uu-RRC layer on the LRC node as an example. Among them, the protocol stack of the terminal includes from top to bottom: the RRC layer equivalent to the access network equipment, the packet data convergence protocol (PDCP) layer equivalent to the access network equipment, and the pairing with the LRC node The radio link control (RLC) layer, the medium access control (MAC) layer equivalent to the LRC node, and the physical (PHY) layer equivalent to the LRC node . At the PC5 port, the protocol stack of the LRC node includes from top to bottom: the RLC layer equivalent to the terminal, the MAC layer equivalent to the terminal, and the PHY layer equivalent to the terminal. On the Uu port, the protocol stack of the LRC node includes from top to bottom: an adaptation layer equivalent to the access network device, an RLC layer equivalent to the access network device, and a MAC layer equivalent to the access network device. Layer and the PHY layer equivalent to the access network equipment. The protocol stack of the access network equipment includes from top to bottom: the RRC layer equivalent to the terminal, the PDCP layer equivalent to the terminal, the Adapt layer equivalent to the LRC node, the RLC layer equivalent to the LRC node, and the LRC node Peer MAC layer and PHY layer peer to LRC node.

The LRC node is mainly responsible for allocating side link (Sidelink) transmission resources. Allocating side link transmission resources includes one or more of the following: allocating side link transmission resources between the terminal and the terminal, allocating side link transmission resources between the LRC node and the terminal, and connecting The transmission resources of the side link configured by the network access device to the terminal are forwarded to the terminal.

In the case that the access network device configures the transmission resources of the side link for the terminal, a possible implementation is that the access network device configures the side link resource pool for the terminal, and the terminal can subsequently configure the resources in the side link resource pool Perform channel awareness, and then select resources from the side link resource pool for side link data transmission. In another possible implementation manner, the access network device configures side link resources for the terminal, and the terminal performs side link data transmission on the given side link resources.

The LRC node may be an Internet of Things terminal, a relay node (RN for short), an integrated access and backhaul (IAB) node, a controller in the IIoT, a car networking terminal, etc. The LRC node may also be referred to as a local manager (local manager), a local control node, a user group header (UE header or header UE), a scheduling user (scheduling UE), and so on. The LRC node in the embodiment of this application may be designated by the access network equipment, or elected by the terminal, or pre-configured (for example, some terminals are pre-configured as LRC nodes). There is no specific limitation.

The access network device is an entity on the network side that is used to send signals, receive signals, or send signals and receive signals. The access network device may be a device deployed in a radio access network (RAN for short) to provide a wireless communication function for the terminal, for example, it may be a base station. The access network equipment can be various forms of macro base stations, micro base stations (also called small stations), relay stations, access points (AP for short), etc., and can also include various forms of control nodes, such as network control Device. The control node may be connected to multiple base stations, and configure resources for multiple terminals covered by the multiple base stations. In systems that use different wireless access technologies, the names of devices with base station functions may be different. For example, the global system for mobile communication (GSM) or code division multiple access (CDMA) network can be called base transceiver station (BTS), and broadband code It can be called a base station (NodeB) in wideband code division multiple access (WCDMA), it can be called an evolved NodeB (evolved NodeB, eNB or eNodeB) in a 5G communication system or an NR communication system It is called the next generation node base station (gNB for short), and this application does not limit the specific name of the base station. The access network equipment can also be the wireless controller in the cloud radio access network (CRAN) scenario, or the access network in the future evolution of the public land mobile network (PLMN) network Equipment, transmission and reception point (transmission and reception point, TRP), etc.

A terminal is an entity on the user side that is used to receive signals, or send signals, or receive signals and send signals. The terminal is used to provide users with one or more of voice services and data connectivity services. The terminal can be called user equipment (UE), terminal equipment, access terminal, user unit, user station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent or user Device. The terminal can be a mobile station (MS), subscriber unit (subscriber unit), drone, IoT device, station (ST) in wireless local area networks (WLAN), cell phone (cellular phone), smart phone (smart phone), cordless phone, wireless data card, tablet computer, session initiation protocol (SIP) phone, wireless local loop (wireless local loop, WLL) station, Personal digital assistant (PDA) equipment, laptop computer, machine type communication (MTC) terminal, handheld device with wireless communication function, computing device or connected to wireless modem Other processing equipment, vehicle-mounted equipment, wearable equipment (also called wearable smart equipment). The terminal may also be a terminal in a next-generation communication system, for example, a terminal in a 5G communication system or a terminal in a future evolved PLMN, a terminal in an NR communication system, and so on.

For the communication system shown in Figure 1, when the terminal and the LRC node perform legality verification, if the method in the prior art is used, both the terminal and the LRC node need to obtain the shared key from the server (for example, ProSe function) , And then conduct a handshake between the two parties based on the shared key to achieve mutual authentication. Since the server is located in the DN of the core network, it takes a long time for the terminal and the LRC node to obtain the shared key, which results in the terminal verifying the legitimacy of the LRC node, or the LRC node verifies the legitimacy of the terminal for a longer time. In order to solve this problem, the embodiments of the present application provide multiple verification methods. In these verification methods, the LRC node and the terminal do not need to obtain a shared key from the server. Therefore, the legality of the first node and/or the terminal can be shortened. Time for sexual verification.

In order to make the embodiments of the present application clearer, firstly, some concepts mentioned in the embodiments of the present application are briefly introduced.

(1) Security protection key

The security protection key refers to a key that can be used to implement data security protection.

The security protection key may include one or more of the following: encryption key, decryption key, integrity protection key, etc.

Among them, the sender encrypts the plaintext according to the encryption key and encryption algorithm to generate the ciphertext. The receiving end decrypts the ciphertext according to the decryption key and decryption algorithm to generate plaintext. If symmetric encryption is used, the encryption key and decryption key are the same. The sending end uses a key to encrypt (in this case, the key is an encryption key), and the receiving end uses this key to decrypt (in this case, the key is a decryption key).

The integrity protection key is a parameter input when the sender performs integrity protection on the plaintext or ciphertext according to the integrity protection algorithm. The receiving end can perform integrity verification on the integrity-protected data according to the same integrity protection algorithm and integrity protection key.

Among them, the encryption key may include the encryption key of the control plane and the encryption key of the user plane. The decryption key may include the decryption key of the control plane and the decryption key of the user plane. The integrity protection key may include the integrity protection key of the control plane and the integrity protection key of the user plane.

(2) Root key

The root key in the embodiments of the present application refers to the verification code used to generate the legality verification between the terminal and other devices on the access network side, and/or to generate the security between the terminal and other devices The key to protect the key. The other device may be an LRC node or an access network device.

The root key involved in the embodiments of this application includes the root key used for communication between the terminal and the access network device (for example, the first root key hereinafter), and the root key used for communication between the terminal and the LRC node The root key (for example, the second root key and the third root key below).

The root key used for communication between the terminal and the access network device can be recorded as K _eNB /K _gNB , and the root key used for communication between the terminal and the LRC node can be recorded as K _LRC . K _LRC can be generated according to K _eNB /K _gNB . In addition, based on K _LRC , the encryption key of the control plane and the integrity protection key of the control plane between the terminal and the LRC node can be generated.

(3) Key freshness parameters

The key freshness parameter refers to the freshness parameter used to update the key. For example, the key freshness parameter may be a freshness parameter used to update the root key.

(4) Sidelink

The side link refers to the communication link between the terminal and the LRC node, or the communication link between the terminal and the terminal. The side link can also be called a PC5 port link.

(5) Identification of the terminal

The identifier of the terminal in the embodiment of the present application may be a cell radio network temporary identifier (C-RNTI) of the terminal in the cellular network, or C-RNTI + cell identifier, or Logo etc.

The identification of the terminal on the side link refers to the identification used by the LRC node to identify the terminal on the side link. The identification of the terminal on the side link may also be referred to as the ProSe UE ID or the identification of the terminal on the PC5 port.

Exemplarily, referring to FIG. 2, the identification of the terminal on the side link may be carried in the MAC layer header, and may also be carried in the MAC layer header and the PHY layer header. For example, the ProSe UE ID has a length of 24 bits, and the 24 bits can all be included in the MAC layer header. In this case, the terminal's side link identification can also be referred to as the terminal's layer 2 identification (which can be recorded as UE L2ID). Or 8 bits are included in the PHY layer header, and the remaining 16 bits are included in the MAC layer header.

(6) Identification of LRC node

In the embodiment of the present application, the identifier of the LRC node may be allocated by the access network device to the first node, or may be generated by itself.

The identification of the LRC node (for example, the first node and the second node hereinafter) may be the identification of the LRC node on the side link. At this time, the identification of the LRC node is used to identify the LRC node on the side link (at this time, The identifier of the LRC node is carried in the MAC layer header, or carried in the MAC layer header and the PHY layer header. Specifically, when the LRC node is used as the sender, the LRC node identifier or part of the identifier can be carried in the MAC layer header Source (Source, SRC) address field). Exemplarily, the identifier of the LRC node on the side link may be the C-RNTI of the LRC node.

The identifier of the LRC node may also be the identifier of the LRC node in the cellular network (for example, C-RNTI).

The identifier of the LRC node may also be an identifier used by the LRC node in the routing process, for example, the MAC address of the LRC node or the Internet protocol (IP) address of the LRC node.

(7) Notification message

The notification message in the embodiment of the present application is a message broadcast by the first node (for example, the LRC node) on the side link. The notification message includes indication information (denoted as the first indication information). The first indication information is used to indicate that the first node is the node responsible for allocating the transmission resources of the side link (or it can be understood that the first indication information is used to indicate the first The node is an LRC node), for example, the notification message contains a scheduling header indication. When the value of the scheduling header indication is configured as 1, it means that the first node is the node responsible for allocating the transmission resources of the side link . For another example, the first indication information may be implemented by the message type included in the notification message. For example, when the message type is a certain message type, the message type indicates that the node that sends the notification message (ie, the first node) is A node responsible for allocating the transmission resources of the side link (or can be understood as the first indication information for indicating that the first node is an LRC node).

Optionally, the notification message may also include information for indicating the first node, and the information for indicating the first node may include one or more of the following: the identity of the first node (refer to the above-mentioned LRC node identity Related content) and regional information.

The area identifier is the identifier of the area served by the first node. There is a corresponding relationship between the first node and the area identifier of the served area, the terminal may have the corresponding relationship, and the terminal may determine the first node according to the area identifier. The correspondence between the first node in the terminal and the area identifier of the served area may be sent (or broadcast) by the access network device to the terminal.

The area information is information used to indicate the area served by the first node. The area information may include area identification and/or location information of the area (for example, information such as longitude, latitude, radius, length, and width of the area). The terminal may determine the first node according to the area information. For example, there is a correspondence between the first node and the area information of the served area, and the terminal may determine the first node according to the correspondence between the first node and the area information of the served area. In this case, the correspondence between the first node in the terminal and the area information of the served area may be sent (or broadcast) by the access network device to the terminal. For another example, the terminal may determine the area identifier according to the location information of the area, and determine the first node according to the area identifier. For example, the terminal may determine the corresponding relationship between the first node and the area identifier of the served area, and the relationship between the area identifier and the area identifier of the area. The corresponding relationship between the location information of the area determines the first node. In this case, the correspondence between the first node in the terminal and the area identifier of the serviced area, and the correspondence between the area identifier of the area and the location information of the area may be sent (or broadcast) by the access network device For the terminal.

(8) Signalling radio bearer (SRB for short)

SRB includes SRB0 and SRB1. SRB0 is the default SRB. When the terminal initially accesses the cellular network, it sends an RRC connection establishment request message through SRB0, such as an RRC setup request (RRC Setup request), an RRC reestablishment request (RRC reestablishment request), and an RRC resume request (RRC resume request). )Wait. SRB1 is an SRB established in the process of establishing a Uu-RRC connection between a terminal and an access network device, and can be used to transmit Uu-RRC _UE messages.

It should be noted that, in each embodiment of the present application, the meanings and obtaining methods of the first root key and the second root key can be referred to each other, and there is no limitation. In addition, in the following embodiments, the terminal identifier is the terminal identifier on the side link as an example for description. In specific implementation, the terminal identifier may also be the terminal identifier on the cellular network.

Example one

After the terminal establishes a Uu-RRC connection with the access network device, the core network will authenticate the terminal. After the authentication is successful, a root key (denoted as the first root key) used for communication between the terminal and the access network device is generated, and the first root key is stored in the terminal and the access network device. Embodiment 1 provides a verification method. In the verification method, the terminal verifies the legitimacy of the first node based on the first root key, and the access network equipment is based on the first root key or the Uu-RRC _UE sent by the terminal. The message verifies the legitimacy of the terminal. Among them, legitimacy can also be called credibility. The lawfulness in each embodiment of the present application can be regarded as credible, and the illegality can be regarded as untrustworthy, and will not be repeated hereafter.

As shown in Figure 3, the verification method includes:

301. The terminal sends a first request message to a first node. Correspondingly, the first node receives the first request message from the terminal.

Wherein, the first request message is used to request to associate with the first node. In the case that there is a PC5-RRC layer equivalent to the terminal in the protocol stack of the first node, the first request message may be a PC5-RRC message.

Optionally, the first request message includes the identification of the terminal on the side link, and the first node may determine the terminal to which association is requested according to the identification of the terminal on the side link. The identification of the terminal on the side link may be carried in the SRC address field of the MAC layer header of the first request message. In each embodiment of the present application, the description of the identification of the terminal on the side link can be referred to the above, and will not be repeated.

Optionally, the first node is a node responsible for allocating transmission resources of the side link, that is, the first node is an LRC node.

Optionally, the terminal and the first node communicate through a side link.

Optionally, the first node is the termination point of the application layer data of the terminal, that is, the application layer data of the terminal is terminated at the first node.

The terminal determines that the scenario for performing step 301 may be scenario 1 or scenario 2 below.

scene 1,

Before step 301, when the access network device determines that the terminal is within the communication distance of the first node according to the measurement report of the terminal or the location information reported by the terminal, the access network device can notify the terminal to be associated with the first node through a Uu-RRC _UE message. node. The terminal may execute step 301 under the trigger of the Uu-RRC _UE message. The Uu-RRC _UE message includes the identity of the first node and may also include an association indication. The terminal determines to be associated with the first node according to the association indication and the identification of the first node. For the description of the identifier of the first node in the embodiments of the present application, please refer to the above, and will not be repeated.

In scenario 1, when the access network device sends the identity of the first node, what it sends may be the identity of the first node on the side link, so that the terminal can identify the first node on the side link.

In the first case, the identification of the first node on the side link can be generated by itself. In this case, the process of obtaining the identification of the first node on the side link by the access network device may include: the LRC node serves as the terminal access interface When the device is connected to the network, the access network device will assign the LRC node an identifier in the cellular network. The LRC node as a terminal can report to the access network device through a Uu-RRC _LRC message after establishing a Uu-RRC connection with the access network device The identification of the LRC node on the side link. After receiving the Uu-RRC _LRC message, the access network device obtains the identity of the LRC node on the side link, and establishes a correspondence between the identity of the LRC node on the side link and the identity of the LRC node on the cellular network. In this case, if the first node subsequently sends a Uu-RRC _LRC message to the access network device, the access network device can determine that the first node is in the cellular network according to the time-frequency resources contained in the uplink grant previously allocated to the first node The identification of the network, and then the identification of the first node on the side link is determined according to the identification of the first node in the cellular network. It should be noted that, in this method, there is a correspondence between the time-frequency resources allocated by the access network device to the LRC node and the LRC node.

In the second case, the identification of the first node on the side link may be allocated by the access network device. For example, the identification of the first node on the side link may be the C-RNTI allocated by the access network device to the first node. . In this case, the access network device can directly obtain the identification of the first node on the side link.

Scene 2,

The first node broadcasts a notification message on the side link, and the notification message includes first indication information. The first indication information is used to indicate that the first node is a node responsible for allocating transmission resources of the side link. The implementation method of the first indication information can be referred to above, and will not be repeated here. In this case, when step 301 is specifically implemented, it may include: the terminal receives the notification message broadcast by the first node on the side link, and sends the first request message to the first node according to the notification message.

In scenario 2, a possible implementation manner. If the terminal receives the notification message broadcast by the first node, it means that the terminal is located in the coverage or communication range of the first node. In this case, the terminal can send to the first node The first request message. In another possible implementation manner, the notification message may also include information for indicating the first node. In this other implementation, before step 301, the access network device may indicate to the terminal one or more LRC nodes that are allowed to associate with the terminal. At this time, if the information contained in the notification message received by the terminal indicates the first When the node is one of one or more LRC nodes that allow the terminal to associate, that is, if the terminal finds that the first node is an LRC node that the access network device allows itself to associate, the terminal sends a first request message to the first node.

302. The first node sends a second request message to the access network device according to the first request message.

Correspondingly, the access network device receives the second request message from the first node.

Wherein, the second request message is used for the access network device to verify the legitimacy of the terminal. Optionally, the second request message includes the identification of the terminal on the side link, and the access network device may determine which terminal to verify the legitimacy according to the identification of the terminal on the side link.

303. The access network device verifies the legitimacy of the terminal according to the second request message.

There are two possible implementations for verifying the legitimacy of the terminal, which are denoted as implementation 1 and implementation 2. The following describes implementation 1 and implementation 2 respectively.

Implementation method 1,

The first request message includes the Uu-RRC _UE message sent by the terminal to the access network device. For example, the Uu-RRC _UE message sent by the terminal to the access network device may be encapsulated in the first request message. After receiving the first request message, the first node carries the Uu-RRC _UE message in the first request message in the second request message and sends it to the access network device. In addition, when the first node carries the Uu-RRC _UE message in the second request message and sends it to the access network device, it can obtain the terminal's identification on the side link in the first request message, and set the terminal on the side link The identifier of is carried in the Adapt layer header of the second request message. In this case, step 303 can be implemented specifically to include: the access network device decodes the Uu-RRC _UE message, if the decoding is successful, the access network device determines that the terminal is legal; if the decoding is unsuccessful, the access network device determines that the terminal is not legitimate. Specifically, the access network device sends the Uu-RRC _UE message to the PDCP layer entity corresponding to the SRB1 of the terminal for processing according to the side link identification of the terminal included in the Adapt layer of the second request message. In particular, when the Adapt layer contains the identification of the terminal on the side link (assuming that the terminal has previously reported its identification on the side link to the access network device), the access network device can be based on the terminal's identification Identify the side link and find the PDCP entity corresponding to the terminal’s SRB1. The access network device sends the Uu-RRC _UE message to the PDCP entity for decoding. If the decoding is successful, the access network device determines that the terminal is legal; otherwise, the terminal is considered not legitimate.

Under Implementation Mode 1, it should be noted that after a Uu-RRC connection is established between the terminal and the access network device, the Uu-RRC _UE message between the terminal and the access network device itself passes through the communication between the terminal and the access network device. Control plane key encryption. Therefore, when the Uu-RRC _UE message of the terminal is forwarded to the access network device through the first node, and the access network device successfully decodes the Uu-RRC _UE message sent by the terminal, it indicates that the terminal is legal.

In implementation 1, the method further includes: the terminal sends indication information (denoted as second indication information) to the first node, and the second indication information is used to indicate that the Uu-RRC _UE message in the first request message is sent to the receiver. Uu-RRC message of the connected device.

In one case, the second indication information may be carried in the first request message. Exemplarily, it may be carried in the MAC layer header of the first request message. Specifically, the function of the second indication information may be implemented by a logical channel identity (logical channel identity, LCID for short) parameter in the MAC layer header in the first request message. For example, when the value of the LCID parameter is 0 (or 1), the LCID parameter may indicate that the Uu-RRC _UE message in the first request message is a Uu-RRC message sent to the access network device.

In another case, the second indication information may not be carried in the first request message, and the second indication information may be carried in a sidelink control indicator (SCI for short).

Realization 2,

The first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal. The terminal may generate the third verification code according to the first root key, and at least one of the identification of the first node and the identification of the terminal on the side link. After receiving the first request message, the first node may carry the third verification code in the first request message in the second request message and send it to the access network device. In this case, step 303 may include in specific implementation: the access network device verifies the terminal's status according to at least one of the first node's identity and the terminal's identity on the side link, and the first root key and the third verification code. legality.

In implementation manner 2, when step 303 is specifically implemented, it may include: the access network device generates a fourth verification code according to the first root key, and at least one of the identification of the first node and the identification of the terminal on the side link , The access network device verifies the legitimacy of the terminal according to the third verification code and the fourth verification code. The method for generating the fourth verification code by the access network device is the same as that for the terminal generating the third verification code. Optionally, the terminal and the access network device can be pre-configured or negotiated between the terminal to generate the third verification code and the access network device. For the method of generating the fourth verification code, for example, the terminal and the access network device can be pre-configured to generate the third verification code according to the first root key and the identity of the first node, and the access network device is pre-configured according to the first root key. The key and the identity of the first node generate a fourth verification code. When the access network device determines that the third verification code is the same as the fourth verification code, it is determined that the terminal is legal; otherwise, it is determined that the terminal is illegal.

In the specific implementation of step 303, when the access network device needs to use the identity of the first node in the process of generating the fourth verification code, the identity of the first node is the LRC node that the terminal requests to associate (in the embodiment of the present application, the terminal The identification of the LRC node requesting the association (that is, the first node), the access network device also needs to determine the node to which the terminal requests the association, which can be obtained by any of the following methods: Method 1. The access network device can determine the terminal requesting the association The node is the node that sends the second request message (that is, the first node). Method 2. The second request message may also include the identifier of the node to which the terminal requests association (that is, the identifier of the first node), and the access network device determines the node to which the terminal requests the association according to the identifier.

In implementation 2, the second request message may include the identification of the terminal on the side link. Before step 303, the access network device may obtain the first root link according to the identification of the terminal on the side link contained in the second request message. Key to verify the legitimacy of the terminal according to the first root key.

The manner in which the access network device obtains the first root key may include a first possible implementation manner and a second possible implementation manner. Among them, the first possible implementation is a way of obtaining the first root key after establishing a Uu-RRC connection between the terminal and the access network device, and the second possible implementation is that the terminal and the access network device The way to obtain the first root key when establishing a Uu-RRC connection. specific:

In the first possible implementation manner, a Uu-RRC connection has been established between the terminal and the access network device, and the access network device saves the context of the terminal, and the context of the terminal includes the first root key. The access network device may determine the context of the terminal according to the identification of the terminal on the side link, and obtain the first root key from the context of the terminal.

In the second possible implementation manner, the Uu-RRC connection has not been established between the terminal and the access network device, and the terminal may send a Uu-RRC _UE message requesting to establish a Uu-RRC connection to the first node. The first node forwards the Uu-RRC _UE message (for example, the Uu-RRC _UE connection establishment request message, that is, the RRC connection establishment request message sent by the terminal to the access network device) to the access network device, and the access network device passes the first The node replies a Uu-RRC _UE message to the terminal (for example, a Uu-RRC _UE connection establishment message, that is, an RRC connection establishment message sent by the access network device to the terminal), thereby establishing Uu-RRC between the access network device and the terminal connection. The subsequent core network can authenticate the terminal through the Uu-RRC connection between the terminal and the access network device. Finally, the access network device can obtain the first key from the core network. For the method for the first node to determine whether the Uu-RRC message sent by the terminal is a Uu-RRC message sent to the access network device, refer to the description of the relevant part in the implementation manner 1, which will not be repeated here.

In implementation 2, optionally, the second request message further includes node association information (for example, the identity of the first node), and the node association information is used to inform the access network device that a terminal requests to associate with the first node , Thereby triggering the access network device to authenticate the terminal. In the implementation manner 2, the second request message may be a Uu-RRC _LRC message.

304. The access network device sends a second response message to the first node, where the second response message is used to indicate the verification result or the association result. Correspondingly, the first node receives the second response message from the access network device.

The second response message may be a Uu-RRC _LRC message (for example, a Uu-RRC _LRC reconfiguration message, that is, an RRC reconfiguration message sent by the access network device to the first node). The verification result is used to indicate the verification result of the legitimacy of the terminal, which can be success or failure. Success means that the terminal is legal, and failure means that the terminal is illegal. The association result is used to indicate whether the terminal is allowed to associate with the first node.

The verification result or the association result can be indicated by the message type of the second response message. For example, if the association result is that the terminal is allowed to associate with the first node, the second response message can be an association allowed message, and if the association result is that the terminal is not allowed to associate with For the first node, the second response message may be a disallowed association message.

The verification result or the association result may also be indicated by an indication information in the second response message. For example, when the indication information corresponding to the association result is true (or 1), it means that the terminal is allowed to associate with the first node, and when the indication information corresponding to the association result is false (or 0), it means that the terminal is not allowed to associate with the first node.

It should be noted that in the embodiments of the present application, since the first node has already accessed the access network device, the first node trusts the access network device. When the access network device verifies the legitimacy of the terminal, if the access network device indicates to the first node that the terminal is legal, the first node considers the terminal to be legal.

305. The first node sends a first response message to the terminal according to the second response message, where the first response message is used to indicate the association result.

The association result may be indicated by the message type of the first response message. For example, if the association result is that the terminal is allowed to associate with the first node, the first response message may be an association success message; if the association result is that the terminal is not allowed to associate with the first node , The first response message may be an association failure message.

The association result may also be indicated by an indication information in the first response message. For example, when the indication information corresponding to the association result is true (or 1), it means that the terminal is successfully associated with the first node, and when the indication information corresponding to the association result is false (or 0), it means that the terminal is not successfully associated with the first node.

Wherein, when there is a PC5-RRC layer equivalent to the terminal in the protocol stack of the first node, the first response message may be a PC5-RRC message.

The above steps 301 to 305 are optional steps.

306. The access network device sends a first verification code to the first node.

Correspondingly, the first node receives the first verification code from the access network device.

The first verification code is used for the terminal to verify the legitimacy of the first node. The first verification code is generated according to the first root key, and at least one of the identification of the first node and the identification of the terminal on the side link.

It should be noted that the access network device may carry the first verification code in the above-mentioned second response message and send it to the first node. At this time, step 304 and step 306 can be combined into the same step. In this case, for the second response message, there is a possible implementation manner. Regardless of whether the access network device has successfully verified the legitimacy of the terminal in step 303, the second response message contains the terminal's identification on the side link, the first Verification code and verification result (or associated result). In another possible implementation, when the verification result in step 303 is failure or the association result is not allowed, the second response message only contains the verification result or the association result; when the verification result in step 303 is successful or the association result is allowed At this time, the second response message may only include the identification of the terminal on the side link and the first verification code.

307. The first node sends the first verification code and the identity of the first node to the terminal.

Correspondingly, the terminal receives the first verification code and the identity of the first node from the first node.

The first verification code and the identity of the first node sent by the first node to the terminal are used by the terminal to verify the legitimacy of the first node.

In this embodiment of the application, the access network device generates the first verification code and sends it to the first node, and the first node sends the first verification code and the first node's identity to the terminal so that the terminal can verify the legitimacy of the first node .

It should be noted that the first node may carry the first verification code and the identity of the first node in the above-mentioned first response message and send it to the terminal. At this time, step 305 and step 307 can be combined into the same step. In this case, the identifier of the first node may be carried in the SRC address field of the MAC layer header of the first response message. The first verification code may be carried in the MAC layer header of the first response message, and may also be carried in the payload of the first response message.

308. The terminal verifies the legitimacy of the first node according to the first root key, the first verification code, and at least one of the identification of the first node and the identification of the terminal on the side link.

Optionally, step 308 includes in specific implementation:

11) The terminal generates a second verification code according to the first root key, and at least one of the identification of the first node and the identification of the terminal on the side link.

12) The terminal verifies the legitimacy of the first node according to the second verification code and the first verification code.

The method for generating the first verification code by the access network device is the same as the method for generating the second verification code by the terminal. Optionally, the method for generating the first verification code by the access network device and the method for generating the second verification code by the terminal may be preconfigured or negotiated between the terminal and the access network device. For example, the access network device may be preconfigured according to the first password. The key and the identity of the first node generate a first verification code, and the pre-configured terminal generates a second verification code according to the first root key and the identity of the first node. Step 12) In specific implementation, if the terminal determines that the first verification code is the same as the second verification code, the terminal determines that the first node is legal; otherwise, the terminal determines that the first node is illegal.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the first embodiment, when verifying the legitimacy of the first node, the terminal can verify the legitimacy of the first node according to the first root key, the received identification of the first node, and the first verification code. There is no need to obtain the shared key from the server, so the time for the terminal to verify the legitimacy of the first node can be shortened. When verifying the legitimacy of the terminal, the access network device verifies the legitimacy of the terminal according to the Uu-RRC _UE message, or the access network device verifies the legitimacy of the terminal according to the third verification code and the fourth verification code generated by the first root key , And notify the first node, without the first node obtaining the shared key from the server, so the time for the first node to verify the legitimacy of the terminal can be shortened. In addition, in the first embodiment, since the first root key is stored in the access network device and the terminal, the legitimacy of the terminal and the first node can be easily and quickly verified between the terminal and the access network device.

It should be noted that when verifying the legitimacy of the terminal and the first node in the first embodiment, the legitimacy of the terminal can be verified first, or the legitimacy of the first node can be verified first (in this case, step 306 to step 308 can be The execution is before step 301). The embodiment of the application does not specifically limit this.

Example two

The second embodiment provides a verification method. The main differences from the verification method provided in the first embodiment include but are not limited to: 1. The legality verification of the terminal is no longer performed by the access network device, but by the first node. 2. The verification of the legitimacy of the terminal by the first node and the verification of the legitimacy of the first node by the terminal are no longer based on the first root key, but based on the second root key. The second root key is a root key used for communication between the terminal and the first node, and the second root key can be generated according to the first root key. For the description related to the first root key, please refer to Embodiment 1, which will not be repeated here.

As shown in Figure 4, the verification method provided in the second embodiment includes:

400. The access network device sends the identification of the side link of the terminal and the second root key to the first node. Correspondingly, the first node receives the identification of the terminal on the side link and the second root key from the access network device. The first node may determine the terminal that uses the second root key to communicate with the first node according to the identification of the terminal on the side link.

Wherein, before step 400, the access network device may generate the second root key according to the first root key and the first key freshness parameter. The access network device can be specifically implemented in the following manner 1 or manner 2 or manner 3.

Manner 1. The second root key is generated according to the first root key, the identification of the first node, and the first key freshness parameter.

Manner 2: The second root key is generated according to the first root key, the identification of the first node, the freshness parameter of the first key, and the identification of the terminal on the side link.

Manner 3: Generate the second root key according to the first root key, the first key freshness parameter, and the terminal's identification on the side link.

401. The access network device sends the identification of the first node and the first key freshness parameter to the terminal.

Correspondingly, the terminal receives the identification of the first node and the first key freshness parameter from the access network device.

Exemplarily, the identity of the first node and the first key freshness parameter may be carried in a Uu-RRC _UE message (for example, a Uu-RRC _UE reconfiguration message, that is, an RRC reconfiguration message sent by the access network device to the terminal) in.

Before step 401, if the access network device receives the Uu-RRC _UE message sent by the terminal and carries the terminal's identification on the side link, the access network device can find the context of the terminal according to the terminal's identification on the side link. The context includes the first key freshness parameter, and the access network device may carry the first key freshness parameter in a Uu-RRC _UE message and send it to the terminal. Exemplarily, the Uu-RRC _UE message may be a Uu-RRC _UE reconfiguration message.

The terminal may generate the second root key according to the first root key and the first key freshness parameter. The method for the terminal to generate the second root key is the same as the method for the access network device to generate the second root key. For example, the terminal and the access network device can both generate the second root key by using the above method 1 or method 2 or method 3. The specific method used can be pre-configured or determined through negotiation between the access network device and the terminal.

Wherein, the order of execution of step 401 and step 400 is in no particular order.

402. The terminal sends a first request message to the first node. Correspondingly, the first node receives the first request message from the terminal.

The first request message is used to request to associate with the first node, the first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal.

The terminal may generate the third verification code according to the second root key, and one or more of the identification of the terminal on the side link and the identification of the first node. Specifically, it can be implemented in the following way one or way two or way three.

Manner 1: The terminal directly generates the third verification code according to the second root key, and one or more of the identification of the terminal on the side link and the identification of the first node.

Method 2: The terminal first generates the encryption key of the control plane between the terminal and the LRC node according to the second root key, and then according to the encryption key of the control plane between the terminal and the LRC node, and the terminal's identification on the side link And one or more of the identifiers of the first node to generate a third verification code.

Method 3: The terminal first generates the integrity protection key of the control plane between the terminal and the LRC node according to the second root key, and then according to the integrity protection key of the control plane between the terminal and the LRC node, and the terminal on the side One or more of the identification of the link and the identification of the first node generates a third verification code.

Optionally, the first request message further includes one or more of the identification of the terminal on the side link, the association request information, and the identification of the first node.

It should be noted that the role of the first request message may be characterized by the association request information in the first request message, or may be characterized by the message type of the first request message. If it is the latter, the first request message may be an association request (at this time, the first request message does not include association request information). The identification of the terminal on the side link is used for the node receiving the first request message to determine the terminal requesting the association. The identifier of the first node is used to indicate the node to which the terminal requests association.

403. The first node verifies the legitimacy of the terminal according to the second root key and the third verification code.

When step 403 is implemented, it may include: the first node generates a fourth verification code according to the second root key, and the first node verifies the legitimacy of the terminal according to the fourth verification code and the third verification code.

The method for the first node to generate the fourth verification code is the same as the method for the terminal to generate the third verification code. Optionally, the method for generating the third verification code by the terminal and the fourth verification code by the first node may be pre-configured or negotiated between the terminal and the first node. For example, the method for generating the third verification code by the terminal and the first node may be pre-configured between the terminal and the first node. The root key and the identity of the first node generate a third verification code, and the first node is preconfigured to generate a fourth verification code according to the second root key and the identity of the first node. If the first node determines that the fourth verification code is the same as the third verification code, the terminal is determined to be legal; otherwise, the terminal is determined to be illegal.

Wherein, before step 403, optionally, the method further includes: the first node obtains the second root key according to the identification of the terminal on the side link.

404. The first node sends a first response message to the terminal, where the first response message is used to indicate the association result.

Wherein, when the first node verifies that the terminal is legal, the association result is that the association is successful. When the first node verifies that the terminal is illegal, the association result is an association failure.

The association result may be indicated by the message type of the first response message, or may be indicated by one piece of indication information in the first response message. For details, please refer to the related description in step 305 in the first embodiment, which will not be repeated here.

405. The first node generates a first verification code according to the second root key.

The first verification code is used for the terminal to verify the legitimacy of the first node.

406. The first node sends a first verification code to the terminal. Correspondingly, the terminal receives the first verification code from the first node.

Optionally, the terminal and the first node communicate through a side link.

The first node may carry the first verification code in the first response message in step 404 and send it to the terminal. In this case, step 404 and step 406 can be combined into the same step.

407. The terminal verifies the legitimacy of the first node according to the second root key.

When step 407 is specifically implemented, the terminal may generate a second verification code according to the second root key, and verify the legitimacy of the first node according to the second verification code and the first verification code.

The method for generating the first verification code by the first node is the same as the method for generating the second verification code by the terminal. Optionally, the method for generating the second verification code by the terminal and the first node for generating the first verification code may be pre-configured or negotiated between the terminal and the first node. For example, the method for generating the second verification code by the terminal and the first node may be pre-configured between the terminal and the first node. The root key and the identity of the first node generate a second verification code, and the first node is preconfigured to generate the first verification code according to the second root key and the identity of the first node. When step 407 is specifically implemented, if the terminal determines that the first verification code is the same as the second verification code, the terminal determines that the first node is legal; otherwise, the terminal determines that the first node is illegal.

In the embodiment shown in FIG. 4, step 400, step 402, step 403, and step 404 are all optional steps.

It should be noted that when verifying the legitimacy of the terminal and the first node in the second embodiment, the legitimacy of the terminal may be verified first, or the legitimacy of the first node may be verified first (in this case, step 405, step 406, and step 406) Step 407 may be performed before step 402). The embodiment of the application does not specifically limit this.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the second embodiment, when verifying the legitimacy of the first node, the terminal generates a second verification according to the first root key, the identity of the first node obtained from the access network device, and the first key freshness parameter Code, and then verify the legality of the first node according to the first verification code and the second verification code. The terminal does not need to obtain the shared key from the server to realize the legality verification of the first node. Therefore, the time for the terminal to verify the legality of the first node can be shortened. When verifying the legitimacy of the terminal, the first node may generate a fourth verification code according to the second root key sent by the access network device, and then verify the legitimacy of the terminal according to the third verification code and the fourth verification sent by the terminal, There is no need to obtain the shared key from the server, so the time for the first node to verify the legitimacy of the terminal can be shortened.

Optionally, the above method further includes: the terminal generates a security protection key for data with the first node according to the second root key; and the terminal performs data transmission with the first node according to the security protection key.

Optionally, the above method further includes: the first node generates a security protection key for data with the terminal according to the second root key; the first node performs data transmission with the terminal according to the security protection key.

Wherein, the security protection key for data between the first node and the terminal may include the security protection key for user plane data and/or control plane data, and the communication between the terminal and the first node is performed through the security protection key for user plane data. User plane data transmission, through the control plane data security protection key for control plane data transmission, thereby ensuring data security.

Example three

This embodiment provides a verification method, and the verification process for the legitimacy of the first node is the same as the verification process for the legitimacy of the first node in the second embodiment. There may be three implementation manners for verifying the legitimacy of the terminal, and two of the three implementation manners are the same as the implementation manner one and the implementation manner two in the first embodiment, respectively. As shown in Figure 5, the verification method provided in the third embodiment is described in detail below, and the verification method includes:

501. Same as step 402 above.

502. Same as step 301 above.

503. Same as step 302 above.

504. Same as step 303 above.

505. Same as step 304 above.

506. Same as step 305 above.

There are three ways to verify the legitimacy of the terminal in step 502 to step 506. The first implementation of the three implementations is the same as implementation 1 in the first embodiment. The second implementation manner of the three implementation manners is the same as the implementation manner 2 in the first embodiment. In the third of the three implementations, the terminal can generate the second root key according to the first root key (for the specific generation method, please refer to the description of the relevant part in the second embodiment), and according to the second root key Generate a third verification code, and send the third verification code in the first request message to the first node. The first node includes the third verification code in the first request message in the second request message to the access network The device sends it, and the access network device compares the received third verification code with the fourth verification code generated according to the second key. If they are the same, the terminal is determined to be legal, and if they are different, the terminal is determined to be illegal. . Among them, in the third implementation manner, the method for the terminal to generate the third verification code is the same as the method for the access network device to generate the fourth verification code. This method can be pre-configured or negotiated between the access network device and the terminal. For example, the terminal may be pre-configured to generate the third verification code according to the second root key and the identity of the first node, and the pre-configured access network device may also generate the fourth verification code according to the second root key and the identity of the first node.

507. Same as step 400 described above.

Wherein, before step 507, the access network device can generate the second root key, and the generation method can refer to the description of the relevant part in the second embodiment, which will not be repeated here. Wherein, the access network device may carry the identification of the terminal on the side link and the second root key in the second response message in step 505 and send it to the first node. In this case, step 505 and step 507 can be combined into the same step.

508. Same as step 405 above.

Step 507 and step 508 may be performed before any one of steps 501 to 506.

509. Same as step 406 above.

Wherein, in the case where step 507 and step 508 are performed before step 506, the access network device may carry the first verification code in the first response message in step 506 and send it to the first node. In this case, step 506 and step 509 can be combined into the same step.

510. Same as step 407 above.

Wherein, if the verification of the legitimacy of the terminal in step 502 to step 506 adopts the first implementation manner or the second implementation manner, step 501 can be executed before step 510, which is the same as the execution of the steps in step 502 to step 509. The order is in no particular order. Exemplarily, the identification of the first node and the first key freshness parameter in step 501 may be forwarded to the terminal through the first node, for example, carried in the second response message and the first response message and sent to the terminal.

It should be noted that when verifying the legitimacy of the terminal and the first node in the third embodiment, the legitimacy of the terminal may be verified first, or the legitimacy of the first node may be verified first (in this case, step 508 to step 510 can be Execution before step 504). The embodiment of the application does not specifically limit this.

In the embodiment shown in FIG. 5, steps 502 to 507 are optional steps.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the third embodiment, when verifying the legitimacy of the first node, the terminal generates a second verification according to the first root key, the identity of the first node obtained from the access network device, and the first key freshness parameter Code, and then verify the legality of the first node according to the first verification code and the second verification code. The terminal does not need to obtain the shared key from the server to realize the legality verification of the first node. Therefore, the time for the terminal to verify the legality of the first node can be shortened. When verifying the legitimacy of the terminal, the access network equipment according to the Uu-RRC _UE message, or, the access network equipment according to the third verification code and the fourth verification code generated by the first root key, or, the access network equipment According to the third verification code and the fourth verification code generated by the second root key, the legitimacy of the terminal is verified, and the first node is notified, and the first node does not need to obtain the shared key from the server. Therefore, it can be shortened The time for the first node to verify the legitimacy of the terminal.

Optionally, the above method further includes: the terminal generates a security protection key for data with the first node according to the second root key; and the terminal performs data transmission with the first node according to the security protection key. For the specific description of this optional method, please refer to the related description in the second embodiment, which will not be repeated here.

Optionally, the above method further includes: the first node generates a security protection key for data with the terminal according to the second root key; the first node performs data transmission with the terminal according to the security protection key. For the specific description of this optional method, please refer to the related description in the second embodiment, which will not be repeated here.

Example four

If the terminal needs to switch from one access network device (denoted as the first access network device) to another access network device (denoted as the second access network device). In order to ensure that the terminal smoothly performs legality verification with the LRC node after the handover, the fourth embodiment provides a verification method, as shown in Figure 6, including:

601. The first access network device sends a handover request message to the second access network device.

Correspondingly, the second access network device receives the handover request message from the first access network device.

The handover request message is used to request the second access network device for the terminal to switch from the first access network device to the second access network device, and the handover request message includes the identification of the terminal.

602. The second access network device sends a handover reply message to the first access network device.

Correspondingly, the first access network device receives the handover reply message from the second access network device.

The handover reply message includes the identifier of the second node and the second key freshness parameter. The second node is the LRC node, and the second node is the node responsible for allocating the transmission resources of the side link after the terminal handover. For example, after the handover is completed, the second node can allocate the side link transmission for the terminal after the terminal is associated with the second node. Resources. The second node and the first node may be the same node or different nodes. Among them, the second key freshness parameter is used to update the third root key. The third root key is the root key for communication between the terminal and the second node, and the third root key is used to verify the legitimacy of the terminal and/or the second node.

Before step 602, the second access network device may determine the second node.

603. The first access network device sends the identifier of the second node and the second key freshness parameter to the terminal.

Correspondingly, the terminal receives the identifier of the second node and the second key freshness parameter from the first access network device.

After the terminal is switched from the first access network device to the second access network device, when the second access network device is the access network device in the second and third embodiments above, the second access network device may The method shown in Figure 4 or Figure 5 is used to verify the legitimacy of the terminal and the second node. In specific implementation, only the first node in Figure 4 or Figure 5 needs to be replaced with the second node. Replace the key with the third key. In addition, step 401 in FIG. 4 may not be executed, and step 501 in FIG. 5 may not be executed.

The method provided in the fourth embodiment can send the identity of the second node and the second key to the terminal through the first access network device when the terminal is switched from the first access network device to the second access network device. This parameter ensures that the terminal can smoothly perform legality verification with the second node after switching to the second access network device.

Example five

This embodiment provides a verification method, wherein the process of verifying the legitimacy of the terminal is the same as that in the second embodiment. The verification of the legitimacy of the first node differs from Embodiment 1, Embodiment 2 and Embodiment 3 in that the terminals in Embodiment 1, Embodiment 2 and Embodiment 3 all need to generate a verification code, but in this embodiment The terminal does not need to generate a verification code, and the terminal can directly use the verification code sent by the access network device and the first node to verify the legitimacy of the first node.

As shown in Figure 7, the verification method includes:

701. The access network device sends the identity of the first node, the first verification code, and the third verification code to the terminal.

The first verification code is used to verify the legitimacy of the first node, and the third verification code is used to verify the legitimacy of the terminal. Both the first verification code and the second verification code can be generated according to the second root key. For details, please refer to the description of the relevant part in the second embodiment.

702. The terminal sends a first request message to the first node.

Correspondingly, the first node receives the first request message from the terminal.

Wherein, the first request message is used to request to associate with the first node. The first request message contains the third verification code.

Optionally, the first request message may also include the identification of the terminal on the side link.

Optionally, the terminal and the first node communicate through a side link. The first node is the termination point of the terminal's application layer data, that is, the terminal's application layer data is terminated at the first node.

The scenario where the terminal determines to perform step 702 may also be scenario 1 or scenario 2 in Embodiment 1, which will not be repeated here.

703. The first node verifies the legitimacy of the terminal according to the second root key and the third verification code.

Before step 703, the method may further include: the access network device sends the second root key to the first node, and correspondingly, the first node receives the second root key from the access network device.

For related descriptions of step 703, refer to the descriptions related to step 403 in the second embodiment, which will not be repeated here.

704. The first node sends a first response message to the terminal.

Correspondingly, the terminal receives the first response message from the first node.

The first response message is used to indicate the association result. For specific implementation, refer to step 404 in the second embodiment. The first response message includes the second verification code. The second verification code is generated by the first node. The method for the first node to generate the second verification code is the same as the method for the access network device to generate the first verification code. For details, please refer to the description of the relevant part in the second embodiment. No longer.

705. The terminal verifies the legitimacy of the first node according to the first verification code and the second verification code.

For related descriptions of step 705, refer to the descriptions related to step 407 in the second embodiment, which will not be repeated here.

After step 705, the first node and the terminal may also generate a security protection key for communication between the first node and the terminal according to the second root key. For details, please refer to the description of the relevant part in the second embodiment, which will not be repeated here.

In the fifth embodiment, when verifying the legitimacy of the terminal and the first node, the legitimacy of the terminal can be verified first, or the legitimacy of the first node can be verified first (in this case, step 704 and step 705 can be performed before step 702 ). The embodiment of the application does not specifically limit this.

It should be noted that in FIG. 7, the legality of the first node is verified and the legality of the terminal is also verified. In actual implementation, only the legitimacy of the terminal can be verified. In this case, step 704 and step 705 are optional steps, or only the legitimacy of the first node can be verified. In this case, step 702 and step 703 are optional step.

It should be noted that, in addition to generating the first verification code and the third verification code by using the method in the second embodiment above, the first verification code and the third verification code can also be based on the communication between the first node and the access network device. The root key used is generated. At this time, the method of generating the verification code is similar to the method of generating the verification code in the first or second embodiment, the only difference is that the first root key or the second root key is replaced It is the root key used for communication between the first node and the access network device, and will not be repeated here.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the fifth embodiment, the first node and the terminal can directly verify the legality of each other based on the verification code sent by the access network device, and there is no need to obtain the shared key from the server. Therefore, the first node and the terminal can be shortened. The time for the legality verification of the terminal. In addition, the terminal does not need to generate a verification code. Therefore, it is possible to avoid increasing the implementation complexity of the terminal, thereby avoiding increasing the power consumption of the terminal.

Example Six

This embodiment provides a verification method. The same as the fifth embodiment is that the terminal does not need to generate a verification code. The difference from the fifth embodiment is that the first node in the fifth embodiment needs to generate a verification code, and this implementation In the example, the first node does not need to generate a verification code. The verification code in the terminal and the first node can be sent by the access network device. The terminal and the first node can compare the terminal and the first node based on the verification code sent by the access network device. Perform legality verification.

As shown in Figure 8, the verification method includes:

801. The access network device sends the first verification code and the third verification code to the terminal. Correspondingly, the terminal receives the first verification code and the third verification code from the access network device.

The first verification code is used to verify the legitimacy of the first node, and the third verification code is used to verify the legitimacy of the terminal.

The first verification code can be generated according to the first root key or the second root key. For details, please refer to the description of the relevant part in the first or second embodiment.

The third verification code may be assigned to the terminal by the access network device, and is used to identify the identity (for example, a local identity) of the terminal between the access network device and the first node. Alternatively, the third verification code may also be allocated by the first node to the terminal, and is used to identify the terminal between the access network device and the first node. Alternatively, the third verification code is generated by the access network device according to the first root key or the second root key. For details, please refer to the description of the relevant part in the first or second embodiment.

Optionally, the terminal may first send a verification code request message 1 for requesting the first verification code and the third verification code to the first node, and then the first node sends to the access network device a verification code request message for requesting the first verification code and the third verification code. The verification code request message 2 of the three verification codes. The verification code request message 2 contains the identification of the terminal on the side link (or the identification of the terminal on the cellular network). The access network device finds the terminal according to the identification of the terminal on the side link (or the identification of the terminal on the cellular network), and sends the first verification code and the third verification code to the terminal through a Uu-RRC _UE message. In the case where the first node assigns an identifier to the terminal, the verification code request message 2 may contain the identifier assigned by the first node to the terminal. In the case where the first node does not assign an identifier to the terminal, the verification code request message 2 does not Contains the identification assigned by the first node to the terminal.

Optionally, the access network device also sends the identification of the first node to the terminal, so that the terminal can determine the node to be associated.

802. The access network device sends a first verification code and a third verification code to the first node. Correspondingly, the first node receives the first verification code and the third verification code from the access network device.

Step 801 and step 802 are executed in no particular order.

803. The terminal sends a third verification code to the first node. Correspondingly, the first node receives the third verification code from the terminal.

Wherein, the third verification code may be carried in the first request message, and the first request message is used to request to associate with the first node.

The scenario where the terminal determines to perform step 803 may also be scenario 1 or scenario 2 in Embodiment 1, and details are not described herein again.

804. The first node determines whether the third verification code received from the access network device is the same as the third verification code received from the terminal. If so, the first node determines that the terminal is legal; otherwise, it determines that the terminal is illegal.

805. The first node sends a first verification code to the terminal. Correspondingly, the terminal receives the first verification code from the first node.

Optionally, the first verification code may be carried in a reply message of the first request message sent by the first node to the terminal.

806. The terminal determines whether the first verification code received from the access network device is the same as the first verification code received from the first node. If so, the terminal determines that the first node is legal; otherwise, determines that the first node is illegal of.

In the sixth embodiment, when verifying the legitimacy of the terminal and the first node, the legitimacy of the terminal can be verified first, or the legitimacy of the first node can be verified first (in this case, step 805 and step 806 can be performed before step 803 ). The embodiment of the application does not specifically limit this.

It should be noted that, in Fig. 8, the legality of the first node is verified and the legality of the terminal is also verified. In actual implementation, only the legitimacy of the terminal can be verified. In this case, step 805 and step 806 are optional steps. It is also possible to verify only the legitimacy of the first node. In this case, step 803 to step 804 are optional steps.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the sixth embodiment, the first node and the terminal can directly verify each other's legality based on the verification code sent by the access network device without obtaining the shared key from the server. Therefore, the first node and the terminal can be shortened. The time for the legality verification of the terminal. In addition, the terminal and the first node do not need to generate a verification code. Therefore, it is possible to avoid increasing the complexity of the implementation of the terminal and the first node, thereby avoiding increasing the power consumption of the terminal.

Example Seven

This embodiment provides a verification method. The same as the sixth embodiment is that the terminal and the first node do not need to generate a verification code. The difference from the sixth embodiment is that the first node and the terminal do not need to obtain a verification code. , The terminal and the first node transfer the trust through the transmission of information, thereby verifying the legitimacy of the first node and the terminal. As shown in Figure 9, the verification method includes:

901. The terminal sends a first request message to the first node.

The first request message is used to request to associate with the first node, and the first request message contains the first Uu-RRC _UE message that the terminal sends to the access network device.

The scenario where the terminal determines to perform step 901 may also be scenario 1 or scenario 2 in Embodiment 1, and details are not described herein again.

902. The first node sends the first Uu-RRC _UE message in the first request message to the access network device.

Correspondingly, the access network device receives the first Uu-RRC _UE message sent by the terminal from the first node.

Exemplarily, the first Uu-RRC _UE message may be carried in the second request message.

903. The access network device verifies the legitimacy of the terminal according to the first Uu-RRC _UE message sent by the first node.

When step 903 is specifically implemented, the method for verifying the legitimacy of the terminal can refer to the related description in the implementation manner 1 in the first embodiment, which will not be repeated here.

904. If the terminal is legal, the access network device sends the second root key to the first node, or sends the second root key and the identification of the terminal on the side link.

Correspondingly, the first node receives the second root key from the access network device, or receives the second root key and the identification of the terminal on the side link.

Exemplarily, the second root key, or the second root key and the identification of the terminal on the side link may be carried in the second response message, and the second response message is a response message of the second request message.

905. The first node determines that the terminal is legal according to the second root key, or according to the second root key and the identification of the terminal on the side link.

It should be noted that after the access network device verifies that the terminal is legal, it sends the second root key, or the second root key and the identification of the terminal on the side link to the first node, which is equivalent to transferring trust to the terminal To the first node, as long as the first node receives the second root key, or the second root key and the terminal's identification on the side link, it will recognize the legitimacy of the terminal.

After step 905, the first node may send the association result to the terminal. Correspondingly, the terminal receives the association result from the first node, and the terminal can determine whether it is successfully associated with the first node according to the association result. Specifically, if the association result is that the association is successful, the terminal determines that it is successfully associated with the first node according to the association result; otherwise, the terminal determines that it is not associated with the first node. For the description of the association result, please refer to the related description in the first embodiment, which will not be repeated here.

906. If the terminal is legal, the access network device sends a second Uu-RRCUE message to the terminal through the first node. Correspondingly, the terminal receives the second Uu-RRCUE message sent by the terminal from the access network device through the first node.

The second Uu-RRC _UE message is a reply message of the first Uu-RRC _UE message. The second Uu-RRC _UE message may include the identity of the first node.

The information (the second root key, or the second root key and the identification of the terminal on the side link) sent by the access network device to the first node in step 904 and the information sent by the access network device to the first node in step 906 The information (the second Uu-RRC _UE message) can be carried in the same message and sent in a different message, which is not specifically limited in the embodiment of the present application. For example, the information sent by the access network device to the first node in step 904 and the information sent by the access network device to the first node in step 906 may both be carried in a second response message, and the second response message is a second request. The response message of the message.

The association result sent by the first node to the terminal and the second Uu-RRC _UE message may be carried in the same message for transmission, or carried in different messages for transmission. For example, the association result and the second Uu-RRC _UE message sent by the first node to the terminal may both be carried in a first response message, and the first response message is a response message of the first request message.

907. The terminal determines the legitimacy of the first node according to the second Uu-RRC _UE message received from the access network device.

It should be noted that the access network device sends the second Uu-RRC _UE message to the terminal through the first node, which is equivalent to transferring the trust in the first node to the terminal, and the terminal successfully parses the second Uu-RRC forwarded by the first node. After the RRC _UE message, it is determined that the first node is legal, otherwise it is determined that the first node is illegal.

In the seventh embodiment, it should be noted that the first request message may not be a request for associating with the first node. In this case, the terminal may send to the first node after step 905 for requesting associating with the first node. A request from a node. At this time, when the first node receives a request for being associated with the first node sent from the terminal on the side link, the first node recognizes the legitimacy of the terminal.

In the seventh embodiment, when verifying the legitimacy of the terminal and the first node, the legitimacy of the terminal can be verified first, or the legitimacy of the first node can be verified first (in this case, step 906 and step 907 can be performed before step 901 ). The embodiment of the application does not specifically limit this.

It should be noted that, in FIG. 9, the legality of the first node and the legality of the terminal are also verified for drawing. In actual implementation, only the legitimacy of the terminal can be verified. In this case, step 906 and step 907 are optional steps, or only the legitimacy of the first node can be verified. In this case, step 901 to step 905 are optional step.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the seventh embodiment, the first node and the terminal can directly verify each other's legality based on the information sent by the access network device, and there is no need to obtain the shared key from the server. Therefore, the first node and the terminal can be shortened. The legality verification time. In addition, the terminal and the first node do not need to generate a verification code. Therefore, it is possible to avoid increasing the complexity of the implementation of the terminal and the first node, thereby avoiding increasing the power consumption of the terminal.

Example eight

This embodiment provides a verification method. In this embodiment, the process for the access network equipment to verify the legitimacy of the terminal and the process for the terminal to verify the legitimacy of the first node are the same as those in the seventh embodiment. The seventh difference is that the first node does not verify the legitimacy of the terminal based on the second root key, or the second root key and the terminal's identification on the side link, but based on the association result sent by the access network device Or the verification result verifies the legitimacy of the terminal. As shown in Figure 10, the verification method includes:

1001 is the same as step 901.

1002. The first node sends a second request message to the access network device, where the second request message includes the first Uu-RRC _UE message.

Optionally, the second request message also includes node association information, and the access network device may determine according to the node association information that a terminal requests association with the first node. For the description of the node association information, please refer to the related description of the first embodiment, which is not repeated here.

1003. Same as step 903.

1004. The access network device sends an association result (or verification result) to the first node. Correspondingly, the first node receives the association result (or verification result) from the access network device.

For the description of the association result and the verification result, please refer to the related description in the first embodiment, which will not be repeated here.

1005. The first node determines whether the terminal is legal according to the association result (or verification result).

When step 1005 is specifically implemented, if the association result is that the association is allowed (or the verification result is that the verification is successful), the first node determines that the terminal is legal; otherwise, the first node determines that the terminal is illegal.

After step 1005, the first node may send the association result to the terminal. Correspondingly, the terminal receives the association result from the first node, and the terminal can determine whether it is successfully associated with the first node according to the association result. Specifically, if the association result is that the association is successful, the terminal determines that it is successfully associated with the first node according to the association result; otherwise, the terminal determines that it is not associated with the first node. For the description of the association result, please refer to the related description in the first embodiment, which will not be repeated here.

1006. If the terminal is legal, the access network device sends a second Uu-RRC _UE message to the terminal through the first node. Correspondingly, the terminal receives the second Uu-RRC _UE message sent by the terminal from the access network device through the first node.

The information (association result or verification result) sent by the access network device to the first node in step 1004 and the information (second Uu-RRC _UE message) sent by the access network device to the first node in step 1006 can be carried in the same item. The message is sent, or it can be carried in a different message and sent, which is not specifically limited in the embodiment of the present application. For example, the information sent by the access network device to the first node in step 1004 and the information sent by the access network device to the first node in step 1006 may both be carried in a second response message, and the second response message is the second request. The response message of the message.

1007. Same as step 907.

In the eighth embodiment, it should be noted that the first request message may not be used to request association to the first node. In this case, the terminal may send to the first node after step 1005 to request association to the first node. A request from a node. At this time, when the first node receives a request for being associated with the first node sent from the terminal on the side link, the first node recognizes the legitimacy of the terminal.

In the eighth embodiment, when verifying the legitimacy of the terminal and the first node, the legitimacy of the terminal can be verified first, or the legitimacy of the first node can be verified first (in this case, step 1006 and step 1007 can be performed before step 1001 ). The embodiment of the application does not specifically limit this.

It should be noted that, in FIG. 10, the legality of the first node and the legality of the terminal are also verified for drawing. In actual implementation, only the legitimacy of the terminal can be verified. In this case, step 1006 and step 1007 are optional steps, or only the legitimacy of the first node can be verified. In this case, step 1001 to step 1005 are optional step.

In the prior art, the server is located in the DN. Therefore, it takes a long time for the terminal to obtain the shared key from the server. In the method provided in the eighth embodiment, the first node and the terminal can directly verify each other's legality based on the information sent by the access network device, and there is no need to obtain the shared key from the server. Therefore, the first node and the terminal can be shortened. The legality verification time. In addition, the terminal and the first node do not need to generate a verification code. Therefore, it is possible to avoid increasing the implementation complexity of the terminal and the first node, thereby avoiding increasing the power consumption of the terminal.

It should be noted that the various solutions or technical features shown in the various embodiments of the present application can all be combined without contradiction.

The foregoing mainly introduces the solution of the embodiment of the present application from the perspective of interaction between various network elements. It can be understood that each network element, for example, an access network device, a first node, and a terminal, in order to implement the above-mentioned functions, includes at least one of a hardware structure and a software module corresponding to each function. Those skilled in the art should easily realize that in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

The embodiments of the present application can divide the access network device, the first node, and the terminal into functional units according to the foregoing method examples. For example, each functional unit can be divided corresponding to each function, or two or more functions can be integrated in One processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

In the case of using an integrated unit, FIG. 11 shows a possible structural schematic diagram of the verification device (denoted as the verification device 110) involved in the above embodiment. The verification device 110 includes a processing unit 1101 and a communication unit 1102. , May also include a storage unit 1103. The schematic structural diagram shown in FIG. 11 may be used to illustrate the structures of the access network device, the first node, and the terminal involved in the foregoing embodiment.

When the schematic structural diagram shown in FIG. 11 is used to illustrate the structure of the terminal involved in the foregoing embodiment, the processing unit 1101 is used to control and manage the actions of the terminal. For example, the processing unit 1101 is used to execute 301, 305, 307, and 308, 401, 402, 404, 406, and 407 in Figure 4, 501, 502, 506, 509, and 510 in Figure 5, 603 in Figure 6, and 701, 702, 704, and 701 in Figure 7 705, 801, 803, 805, and 806 in Figure 8, 901, 906, and 907 in Figure 9, 1001, 1006, and 1007 in Figure 10, and/or terminals in other processes described in the embodiments of this application Action performed. The processing unit 1101 may communicate with other network entities through the communication unit 1102, for example, communicate with the first node shown in FIG. 3. The storage unit 1103 is used to store program codes and data of the terminal.

When the schematic structural diagram shown in FIG. 11 is used to illustrate the structure of the terminal involved in the foregoing embodiment, the verification apparatus 110 may be a terminal or a chip in the terminal.

When the schematic structural diagram shown in FIG. 11 is used to illustrate the structure of the access network device involved in the above embodiment, the processing unit 1101 is used to control and manage the actions of the access network device, for example, the processing unit 1101 is used to execute 302-304, 306 in Figure 3, 400-401 in Figure 4, 501, 503-505, 507 in Figure 5, 601-602 in Figure 6, 701 in Figure 7, and 801- in Figure 8 802, 902-904 and 906 in FIG. 9, 1002-1004 and 1006 in FIG. 10, and/or actions performed by the access network device in other processes described in the embodiments of this application. The processing unit 1101 may communicate with other network entities through the communication unit 1102, for example, communicate with the first node shown in FIG. 3. The storage unit 1103 is used to store the program code and data of the access network device.

When the schematic structural diagram shown in FIG. 11 is used to illustrate the structure of the access network device involved in the foregoing embodiment, the verification apparatus 110 may be an access network device or a chip in the access network device.

When the structural diagram shown in FIG. 11 is used to illustrate the structure of the first node involved in the above-mentioned embodiment, the processing unit 1101 is used to control and manage the actions of the first node. For example, the processing unit 1101 is used to execute FIG. 3 301-302, 304-307 in Figure 4, 400, 402-406 in Figure 4, 502-503, 505-509 in Figure 5, 601-603 in Figure 6, 702-704 in Figure 7, and Figure 8 802-805 in Figure 9, 901-902, 904-906 in Figure 9, 1001-1002, 1004-1006 in Figure 10, and/or executed by the first node in other processes described in the embodiments of this application action. The processing unit 1101 may communicate with other network entities through the communication unit 1102, for example, communicate with the terminal shown in FIG. 3. The storage unit 1103 is used to store the program code and data of the first node.

When the schematic structural diagram shown in FIG. 11 is used to illustrate the structure of the first node involved in the foregoing embodiment, the verification apparatus 110 may be the first node or a chip in the first node.

Wherein, when the verification device 110 is a terminal, a first node or an access network device, the processing unit 1101 may be a processor or a controller, and the communication unit 1102 may be a communication interface, a transceiver, a transceiver, a transceiver circuit, a transceiver, etc. . Among them, the communication interface is a general term and may include one or more interfaces. The storage unit 1103 may be a memory. When the verification device 110 is a terminal, a first node, or a chip in an access network device, the processing unit 1101 may be a processor or a controller, and the communication unit 1102 may be an input/output interface, a pin, or a circuit. The storage unit 1103 may be a storage unit in the chip (for example, a register, a cache, etc.), or a storage unit located outside the chip in a terminal or an access network device (for example, a read-only memory (read-only memory) ROM), random access memory (random access memory, RAM for short, etc.).

Among them, the communication unit may also be referred to as a transceiver unit. The antenna and control circuit with the transceiver function in the verification device 110 can be regarded as the communication unit 1102 of the verification device 110, and the processor with processing function can be regarded as the processing unit 1101 of the verification device 110. Optionally, the device for implementing the receiving function in the communication unit 1102 may be regarded as a receiving unit, which is used to perform the receiving steps in the embodiment of the present application, and the receiving unit may be a receiver, a receiver, a receiving circuit, and the like. The device used for implementing the sending function in the communication unit 1102 can be regarded as a sending unit, the sending unit is used to execute the sending steps in the embodiment of the present application, and the sending unit can be a sender, a sender, a sending circuit, etc.

If the integrated unit in FIG. 11 is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or the part that contributes to the prior art or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage The medium includes several instructions to enable a computer device (which may be a personal computer, a server, or an access network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. Storage media for storing computer software products include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program code.

The unit in FIG. 11 may also be called a module, for example, the processing unit may be called a processing module.

The embodiment of the present application also provides a schematic diagram of the hardware structure of a verification device. Referring to FIG. 12 or FIG. 13, the verification device includes a processor 1201, and optionally, a memory 1202 connected to the processor 1201.

The processor 1201 may be a general-purpose central processing unit (central processing unit, CPU for short), microprocessor, application-specific integrated circuit (ASIC for short), or one or more programs used to control the program Implementation of integrated circuits. The processor 1201 may also include multiple CPUs, and the processor 1201 may be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, or processing cores for processing data (for example, computer program instructions).

The memory 1202 may be ROM or other types of static storage devices that can store static information and instructions, RAM, or other types of dynamic storage devices that can store information and instructions, or may be an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory). read-only memory, EEPROM for short), compact disc read-only memory (CD-ROM for short) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.) , A magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer. The embodiments of this application do not impose any limitation on this. The memory 1202 may exist independently, or may be integrated with the processor 1201. Wherein, the memory 1202 may contain computer program code. The processor 1201 is configured to execute the computer program code stored in the memory 1202, so as to implement the method provided in the embodiment of the present application.

In the first possible implementation manner, referring to FIG. 12, the verification apparatus further includes a transceiver 1203. The processor 1201, the memory 1202, and the transceiver 1203 are connected by a bus. The transceiver 1203 is used to communicate with other devices or communication networks. Optionally, the transceiver 1203 may include a transmitter and a receiver. The device used for implementing the receiving function in the transceiver 1203 can be regarded as a receiver, and the receiver is used to perform the receiving steps in the embodiment of the present application. The device in the transceiver 1203 for implementing the sending function can be regarded as a transmitter, and the transmitter is used to perform the sending steps in the embodiment of the present application.

Based on the first possible implementation manner, the schematic structural diagram shown in FIG. 12 may be used to illustrate the structure of the access network device, the first node, or the terminal involved in the foregoing embodiment.

When the schematic structural diagram shown in FIG. 12 is used to illustrate the structure of the terminal involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the terminal. For example, the processor 1201 is used to support the terminal to execute the terminal in FIG. 3 301, 305, 307, and 308, 401, 402, 404, 406, and 407 in Figure 4, 501, 502, 506, 509, and 510 in Figure 5, 603 in Figure 6, 701, 702, and 701 in Figure 7 704 and 705, 801, 803, 805, and 806 in Figure 8, 901, 906, and 907 in Figure 9, 1001, 1006, and 1007 in Figure 10, and/or other processes described in the embodiments of this application The actions performed by the terminal. The processor 1201 may communicate with other network entities through the transceiver 1203, for example, communicate with the first node shown in FIG. 3. The memory 1202 is used to store program codes and data of the terminal.

When the schematic structural diagram shown in FIG. 12 is used to illustrate the structure of the access network device involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the access network device. For example, the processor 1201 is used to support The access network equipment executes 302-304, 306 in Figure 3, 400-401 in Figure 4, 501, 503-505, 507 in Figure 5, 601-602 in Figure 6, 701 in Figure 7, 801-802 in 8, 902-904 and 906 in FIG. 9, 1002-1004 and 1006 in FIG. 10, and/or actions performed by the access network device in other processes described in the embodiments of this application. The processor 1201 may communicate with other network entities through the transceiver 1203, for example, communicate with the first node shown in FIG. 3. The memory 1202 is used to store program codes and data of the access network device.

When the schematic structural diagram shown in FIG. 12 is used to illustrate the structure of the first node involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the first node. For example, the processor 1201 is used to support the first node. The node executes 301-302, 304-307 in Figure 3, 400, 402-406 in Figure 4, 502-503, 505-509 in Figure 5, 601-603 in Figure 6, and 702- in Figure 7 704, 802-805 in Fig. 8, 901-902, 904-906 in Fig. 9, 1001-1002, 1004-1006 in Fig. 10, and/or the first steps in other processes described in the embodiments of this application An action performed by a node. The processor 1201 may communicate with other network entities through the transceiver 1203, for example, communicate with the terminal shown in FIG. 3. The memory 1202 is used to store the program code and data of the first node.

In a second possible implementation manner, the processor 1201 includes a logic circuit and at least one of an input interface and an output interface. Among them, the output interface is used to execute the sending action in the corresponding method, and the input interface is used to execute the receiving action in the corresponding method.

Based on the second possible implementation manner, refer to FIG. 13. The schematic structural diagram shown in FIG. 13 may be used to illustrate the structure of the access network device, the first node, or the terminal involved in the foregoing embodiment.

When the schematic structural diagram shown in FIG. 13 is used to illustrate the structure of the terminal involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the terminal. For example, the processor 1201 is used to support the terminal to execute the terminal in FIG. 3 301, 305, 307, and 308, 401, 402, 404, 406, and 407 in Figure 4, 501, 502, 506, 509, and 510 in Figure 5, 603 in Figure 6, 701, 702, and Figure 7 704 and 705, 801, 803, 805, and 806 in Figure 8, 901, 906, and 907 in Figure 9, 1001, 1006, and 1007 in Figure 10, and/or other processes described in the embodiments of this application The actions performed by the terminal. The processor 1201 may communicate with other network entities through at least one of the input interface and the output interface, for example, communicate with the first node shown in FIG. 3. The memory 1202 is used to store program codes and data of the terminal.

When the schematic structural diagram shown in FIG. 13 is used to illustrate the structure of the access network device involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the access network device. For example, the processor 1201 is used to support The access network equipment executes 302-304, 306 in Figure 3, 400-401 in Figure 4, 501, 503-505, 507 in Figure 5, 601-602 in Figure 6, 701 in Figure 7, 801-802 in 8, 902-904 and 906 in FIG. 9, 1002-1004 and 1006 in FIG. 10, and/or actions performed by the access network device in other processes described in the embodiments of this application. The processor 1201 may communicate with other network entities through at least one of the input interface and the output interface, for example, communicate with the first node shown in FIG. 3. The memory 1202 is used to store program codes and data of the access network device.

When the schematic structural diagram shown in FIG. 13 is used to illustrate the structure of the first node involved in the foregoing embodiment, the processor 1201 is used to control and manage the actions of the first node. For example, the processor 1201 is used to support the first node. The node executes 301-302, 304-307 in Figure 3, 400, 402-406 in Figure 4, 502-503, 505-509 in Figure 5, 601-603 in Figure 6, and 702- in Figure 7 704, 802-805 in Fig. 8, 901-902, 904-906 in Fig. 9, 1001-1002, 1004-1006 in Fig. 10, and/or the first steps in other processes described in the embodiments of this application An action performed by a node. The processor 1201 may communicate with other network entities through at least one of the input interface and the output interface, for example, communicate with the terminal shown in FIG. 3. The memory 1202 is used to store the program code and data of the first node.

Among them, FIG. 12 and FIG. 13 may also illustrate the system chip in the access network device. In this case, the actions performed by the above-mentioned access network device can be implemented by the system chip, and the specific actions performed can be referred to the above, and will not be repeated here. Figures 12 and 13 can also illustrate the system chip in the terminal. In this case, the actions performed by the above-mentioned terminal can be implemented by the system chip, and the specific actions performed can be referred to above, which will not be repeated here. Figures 12 and 13 may also illustrate the system chip in the first node. In this case, the actions performed by the above-mentioned first node can be implemented by the system chip, and the specific actions performed can be referred to above, which will not be repeated here.

In addition, the embodiment of the present application also provides a schematic diagram of the hardware structure of a terminal (denoted as terminal 140) and a network device (denoted as network device 150). For details, refer to FIG. 14 and FIG. 15 respectively.

FIG. 14 is a schematic diagram of the hardware structure of the terminal 140. For ease of description, FIG. 14 only shows the main components of the terminal. As shown in FIG. 14, the terminal 140 includes a processor, a memory, a control circuit, an antenna, and an input and output device.

The processor is mainly used to process the communication protocol and communication data, and to control the entire terminal, execute the software program, and process the data of the software program. For example, it is used to control the terminal to execute 301, 305, 307 and 308 in Figure 3, 401, 402, 404, 406, and 407 in Figure 4, 501, 502, 506, 509, and 510 in Figure 5, 603 in Figure 6, 701, 702, 704, and 705 in Figure 7, and in Figure 8 801, 803, 805, and 806, 901, 906, and 907 in FIG. 9, 1001, 1006, and 1007 in FIG. 10, and/or actions performed by the terminal in other processes described in the embodiments of the present application. The memory is mainly used to store software programs and data. The control circuit (also called radio frequency circuit) is mainly used for conversion of baseband signals and radio frequency signals and processing of radio frequency signals. The control circuit and the antenna together can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users.

When the terminal is turned on, the processor can read the software program in the memory, interpret and execute the instructions of the software program, and process the data of the software program. When data needs to be sent through the antenna, the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the control circuit in the control circuit. The control circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal through the antenna in the form of electromagnetic waves. send. When data is sent to the terminal, the control circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.

Those skilled in the art can understand that, for ease of description, FIG. 14 only shows a memory and a processor. In an actual terminal, there may be multiple processors and memories. The memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.

As an optional implementation, the processor may include a baseband processor and a central processing unit. The baseband processor is mainly used to process communication protocols and communication data. The central processing unit is mainly used to control the entire terminal and execute software. Programs, which process the data of software programs. The processor in FIG. 14 integrates the functions of the baseband processor and the central processing unit. Those skilled in the art can understand that the baseband processor and the central processing unit may also be independent processors and are interconnected by technologies such as buses. Those skilled in the art can understand that the terminal may include multiple baseband processors to adapt to different network standards, the terminal may include multiple central processors to enhance its processing capabilities, and various components of the terminal may be connected through various buses. The baseband processor can also be expressed as a baseband processing circuit or a baseband processing chip. The central processing unit can also be expressed as a central processing circuit or a central processing chip. The function of processing the communication protocol and communication data can be built in the processor, or can be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.

FIG. 15 is a schematic diagram of the hardware structure of the network device 150. The network device 150 may be the aforementioned access network device or the first node. The network device 150 may include one or more radio frequency units, such as a remote radio unit (RRU for short) 1501 and one or more baseband units (BBU for short) (also known as digital units for short). DU)) 1502.

The RRU 1501 may be called a transceiver unit, a transceiver, a transceiver circuit, or a transceiver, etc., and it may include at least one antenna 1511 and a radio frequency unit 1512. The RRU1501 part is mainly used for the transceiver of radio frequency signals and the conversion of radio frequency signals and baseband signals. The RRU 1501 and the BBU 1502 may be physically set together, or may be physically separated, for example, a distributed base station.

The BBU 1502 is the control center of the network equipment, and can also be called the processing unit, which is mainly used to complete the baseband processing functions, such as channel coding, multiplexing, modulation, spread spectrum and so on.

In one embodiment, the BBU 1502 may be composed of one or more single boards, and multiple single boards may jointly support a wireless access network with a single access standard (such as an LTE network), or can respectively support wireless access networks with different access standards. Access network (such as LTE network, 5G network or other network). The BBU 1502 also includes a memory 1521 and a processor 1522, and the memory 1521 is used to store necessary instructions and data. The processor 1522 is used to control the network device to perform necessary actions. The memory 1521 and the processor 1522 may serve one or more single boards. In other words, the memory and the processor can be set separately on each board. It can also be that multiple boards share the same memory and processor. In addition, necessary circuits can be provided on each board.

It should be understood that when the network device 150 is the access network device in the above embodiment, the network device 150 can execute 302-304, 306 in FIG. 3, 400-401 in FIG. 4, and 501, 503- in FIG. 505, 507, 601-602 in Figure 6, 701 in Figure 7, 801-802 in Figure 8, 902-904 and 906 in Figure 9, 1002-1004 and 1006 in Figure 10, and/or this Actions performed by the access network device in other processes described in the application embodiment. When the network device 150 is the first node in the above embodiment, the network device 150 can execute 301-302, 304-307 in FIG. 3, 400, 402-406 in FIG. 4, and 502-503, FIG. 505-509, 601-603 in Figure 6, 702-704 in Figure 7, 802-805 in Figure 8, 901-902, 904-906 in Figure 9, 1001-1002, 1004- in Figure 10 1006, and/or an action performed by the first node in other processes described in the embodiment of the present application. The operation, function, or operation and function of each module in the network device 150 are respectively set to implement the corresponding process in the foregoing method embodiment. For details, please refer to the descriptions in the above method embodiments. To avoid repetition, detailed descriptions are appropriately omitted here.

In the implementation process, each step in the method provided in this embodiment can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor. For other descriptions about the processor in FIG. 14 and FIG. 15, please refer to the description about the processor in FIG. 12 and FIG. 13, and details are not repeated here.

The embodiment of the present application also provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute any of the foregoing methods.

The embodiments of the present application also provide a computer program product containing instructions, which when run on a computer, cause the computer to execute any of the foregoing methods.

An embodiment of the present application also provides a communication system, including: a first node and a terminal. Optionally, it also includes access network equipment.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it may be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from a website, computer, server, or data center through a cable (such as Coaxial cable, optical fiber, digital subscriber line (digital subscriber line, referred to as DSL)) or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or may include one or more data storage devices such as a server or a data center that can be integrated with the medium. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Although the present application is described in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art can understand and realize the disclosure by looking at the drawings, the disclosure, and the appended claims. Other changes to the embodiment. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "one" does not exclude multiple. A single processor or other unit may implement several functions listed in the claims. Certain measures are described in mutually different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

Although the present application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made without departing from the spirit and scope of the present application. Accordingly, this specification and drawings are merely exemplary descriptions of the application defined by the appended claims, and are deemed to have covered any and all modifications, changes, combinations or equivalents within the scope of the application. Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application also intends to include these modifications and variations.

Claims

A verification method, characterized by comprising:

The terminal receives a first verification code and an identification of the first node from a first node, the first verification code is generated according to the first root key and the identification of the first node, and the first root key is The root key used for communication between the terminal and the access network device;

The terminal verifies the legitimacy of the first node according to the identity of the first node, the first root key, and the first verification code.
The method according to claim 1, wherein the terminal and the first node communicate through a side link.
The method according to claim 1 or 2, wherein the method further comprises:

The terminal sends a first request message to the first node, the first request message is used to request to associate with the first node, and the first request message includes that the terminal sends to the access network The radio resource control RRC message of the device.
The method according to claim 1 or 2, wherein the method further comprises:

The terminal sends a first request message to the first node, the first request message is used to request to associate with the first node, the first request message includes a third verification code, and the third verification The code is generated according to the identity of the first node and the first root key, and the third verification code is used to verify the legitimacy of the terminal.
The method according to claim 3 or 4, wherein the sending of the first request message by the terminal to the first node comprises:

The terminal receives the notification message broadcast by the first node on the side link, the notification message includes indication information, and the indication information is used to indicate that the first node is the node responsible for allocating transmission resources of the side link ；

The terminal sends the first request message to the first node according to the notification message.
The method according to any one of claims 1-5, wherein the terminal verifies the first node according to the identity of the first node, the first root key, and the first verification code The legality of including:

Generating, by the terminal, a second verification code according to the identifier of the first node and the first root key;

The terminal verifies the legitimacy of the first node according to the second verification code and the first verification code.
A verification method, characterized in that it comprises:

The first node receives a first verification code from the access network device, the first verification code is generated according to the first root key and the identity of the first node, and the first root key is the terminal and the access The root key used for communication between network devices;

The first node sends the first verification code and the identity of the first node to the terminal, and the identity of the first node and the first verification code are used to verify the legitimacy of the first node .
The method according to claim 7, wherein the terminal and the first node communicate through a side link.
The method according to claim 7 or 8, wherein the method further comprises:

The first node receives a first request message from the terminal, the first request message is used to request to associate with the first node, and the first request message includes the terminal sent to the access network The radio resource control RRC message of the device;

The first node sends a second request message to the access network device according to the first request message, the second request message includes the RRC message, and the RRC message is used for the access network device Verify the legitimacy of the terminal.
The method according to claim 7 or 8, wherein the method further comprises:

The first node receives a first request message from the terminal, the first request message is used to request to associate with the first node, the first request message includes a third verification code, and the third verification A code is generated according to the identity of the first node and the first root key, and the third verification code is used to verify the legitimacy of the terminal;

The first node sends a second request message to the access network device according to the first request message, where the second request message includes the third verification code.
The method according to any one of claims 7-10, wherein the method further comprises:

The first node broadcasts a notification message on the side link, and the notification message includes indication information used to indicate that the first node is a node responsible for allocating transmission resources of the side link.
A verification method, characterized by comprising:

The access network device receives a second request message from the first node, where the second request message includes a radio resource control RRC message sent by the terminal to the access network device;

The access network device decodes the RRC message;

If the decoding is successful, the access network device determines that the terminal is legal;

If the decoding is unsuccessful, the access network device determines that the terminal is illegal.
The method of claim 12, wherein the method further comprises:

The access network device sends a first verification code to the first node, the first verification code is generated according to the first root key and the identity of the first node, and the first verification code is used to verify the The legality of the first node is described.
A verification method, characterized in that it comprises:

The access network device receives a second request message from the first node, the second request message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code is based on the Generating an identifier of the first node and a first root key, where the first root key is a root key used for communication between the terminal and the access network device;

The access network device verifies the legitimacy of the terminal according to the identity of the first node, the first root key, and the third verification code.
The method according to claim 14, wherein the access network device checks the legitimacy of the terminal according to the identity of the first node, the first root key, and the third verification code. Verification, including:

Generating, by the access network device, a fourth verification code according to the identity of the first node and the first root key;

The access network device verifies the legitimacy of the first node according to the fourth verification code and the third verification code.
The method according to claim 14 or 15, wherein the method further comprises:

The access network device sends a first verification code to the first node, the first verification code is generated according to the first root key and the identity of the first node, and the first verification code is used to verify the The legality of the first node is described.
A verification method, characterized by comprising:

The terminal receives the identity of the first node and the first key freshness parameter from the access network device, where the first node is the termination point of application layer data of the terminal;

The terminal receives a first verification code from the first node, the first verification code is generated according to a second root key, and the second root key is used for communication between the terminal and the first node The root key used;

The terminal verifies the legitimacy of the first node according to the identity of the first node, the first key freshness parameter, and the first verification code.
The method according to claim 17, wherein the terminal and the first node communicate through a side link.
The method according to claim 17 or 18, wherein the terminal verifies the first node's identity according to the identity of the first node, the first key freshness parameter, and the first verification code. Legality, including:

The terminal generates the second root key according to the first root key, the identifier of the first node, and the first key freshness parameter, and the first root key is the terminal and the The root key used for communication between access network devices;

Generating, by the terminal, a second verification code according to the second root key;

The terminal verifies the legitimacy of the first node according to the second verification code and the first verification code.
The method according to any one of claims 17-19, wherein the method further comprises:

The terminal sends a first request message to the first node, where the first request message is used to request to be associated with the first node, and the first node is responsible for allocating transmission resources of the side link. The request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal.
The method according to claim 20, wherein the sending of the first request message by the terminal to the first node comprises:

The terminal receives a notification message broadcast by the first node on the side link, the notification message includes indication information, and the indication information is used to indicate that the first node is a node responsible for allocating transmission resources of the side link ；

The terminal sends the first request message to the first node according to the notification message.
The method according to claim 20 or 21, wherein the first request message further includes an identification of the terminal.
The method according to any one of claims 17-22, wherein the method further comprises:

Generating, by the terminal, a security protection key for data with the first node according to the second root key;

The terminal performs data transmission with the first node according to the security protection key.
A verification method, characterized in that it comprises:

The first node generates a first verification code according to a second root key, the second root key is the root key used for communication between the terminal and the first node, and the first node is the terminal’s The end point of application layer data;

The first node sends the first verification code to the terminal.
The method according to claim 24, wherein the terminal and the first node communicate through a side link.
The method according to claim 24 or 25, wherein the method further comprises:

The first node receives a first request message from the terminal, the first request message is used to request association to the first node, and the first node is responsible for allocating the transmission resources of the side link. The request message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code is generated according to the second root key;

The first node verifies the legitimacy of the terminal according to the second root key and the third verification code.
The method according to claim 26, wherein the first request message includes the identification of the terminal, and the first node verifies the terminal according to the second root key and the third verification code. Before the legality of the terminal is described, the method further includes:

The first node obtains the second root key according to the identifier of the terminal.
The method according to any one of claims 24-27, wherein the method further comprises:

The first node receives the identification of the terminal and the second root key from the access network device.
The method according to any one of claims 24-28, wherein the method further comprises:

The first node broadcasts a notification message on the side link, and the notification message includes indication information used to indicate that the first node is a node responsible for allocating transmission resources of the side link.
The method according to any one of claims 24-29, wherein the method further comprises:

Generating, by the first node, a security protection key for data with the terminal according to the second root key;

The first node performs data transmission with the terminal according to the security protection key.
A verification method, characterized by comprising:

The first access network device sends a handover request message to the second access network device, where the handover request message is used to request the second access network device for the terminal to switch from the first access network device to the second access network device. 2. Access network equipment, where the handover request message includes the terminal identifier;

The first access network device receives a handover reply message from the second access network device, the handover reply message includes the identifier of the second node and the second key freshness parameter, and the second node is The node responsible for allocating side link resources for the terminal to be associated after the terminal is switched, and the identifier of the second node and the second key freshness parameter are used to verify the terminal and/or the second node Legality

The first access network device sends the identifier of the second node and the second key freshness parameter to the terminal.
A verification method, characterized by comprising:

The second access network device receives a handover request message from the first access network device, where the handover request message is used to request the second access network device for the terminal to switch from the first access network device to the second access network device. 2. Access network equipment, where the handover request message includes the terminal identifier;

The second access network device sends a handover reply message to the first access network device, where the handover reply message includes the identifier of the second node and the second key freshness parameter, and the second node is The node responsible for allocating side link resources for the terminal to be associated after the terminal is switched, and the identifier of the second node and the second key freshness parameter are used to verify the terminal and/or the second node Legality

The second access network device sends the identification of the terminal and a third root key to the second node, where the third root key is the root secret of the communication between the terminal and the second node The third root key is used to verify the legitimacy of the terminal and/or the second node.
A verification device, characterized by comprising: a communication unit and a processing unit;

The communication unit is configured to receive a first verification code and an identifier of the first node from a first node, the first verification code is generated according to a first root key and the identifier of the first node, and the first node A key is the root key used for communication between the verification device and the access network device;

The processing unit is configured to verify the legitimacy of the first node according to the identity of the first node, the first root key, and the first verification code.
The device according to claim 33, wherein the verification device and the first node communicate through a side link.
The device according to claim 33 or 34, wherein:

The communication unit is further configured to send a first request message to the first node, where the first request message is used to request association to the first node, and the first node is responsible for allocating transmission resources of the side link , The first request message includes a radio resource control RRC message sent by the verification apparatus to the access network device.
The device according to claim 33 or 34, wherein:

The communication unit is further configured to send a first request message to the first node, where the first request message is used to request association to the first node, and the first node is responsible for allocating transmission resources of the side link , The first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the verification device.
The device according to claim 35 or 36, wherein:

The communication unit is further configured to receive a notification message broadcast by the first node on the side link, where the notification message includes indication information, and the indication information is used to indicate that the first node is responsible for allocating the side link. The communication unit is further configured to send the first request message to the first node according to the notification message.
The device according to any one of claims 33-37, wherein:

The processing unit is specifically configured to: generate a second verification code according to the identity of the first node and the first root key; verify the first verification code according to the second verification code and the first verification code The legitimacy of the node.
A verification device, characterized by comprising: a communication unit and a processing unit;

The processing unit is configured to receive a first verification code from an access network device through the communication unit, the first verification code being generated according to the first root key and the identification of the verification device, and the first root secret The key is the root key used for communication between the terminal and the access network device;

The processing unit is further configured to send the first verification code and the identification of the verification device to the terminal through the communication unit, and the identification of the verification device and the first verification code are used to verify the Verify the legality of the device.
The device according to claim 39, wherein the terminal and the verification device communicate through a side link.
The device according to claim 39 or 40, wherein:

The processing unit is further configured to receive a first request message from the terminal through the communication unit, the first request message is used to request association to the verification device, and the verification device is responsible for the transmission of the distribution side link Resource, the first request message includes a radio resource control RRC message sent by the terminal to the access network device;

The processing unit is further configured to send a second request message to the access network device through the communication unit according to the first request message, where the second request message includes the RRC message, and the RRC message Used by the access network device to verify the legitimacy of the terminal.
The device according to claim 39 or 40, wherein:

The processing unit is further configured to receive a first request message from the terminal through the communication unit, the first request message is used to request association to the verification device, and the verification device is responsible for the transmission of the distribution side link Resource, the first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the terminal;

The processing unit is further configured to send a second request message to the access network device through the communication unit according to the first request message, where the second request message includes the third verification code.
The device according to any one of claims 39-42, wherein:

The processing unit is further configured to broadcast a notification message on the side link through the communication unit, the notification message includes indication information, and the indication information is used to indicate that the verification device is responsible for allocating transmission resources of the side link Node.
A verification device, including: a communication unit and a processing unit;

The communication unit is configured to receive a second request message from a first node, where the second request message includes a radio resource control RRC message sent by the terminal to the verification device;

The processing unit is configured to decode the RRC message;

If the decoding is successful, the processing unit determines that the terminal is legal;

If the decoding is unsuccessful, the processing unit determines that the terminal is illegal.
The device of claim 44, wherein:

The communication unit is further configured to send a first verification code to the first node, where the first verification code is used to verify the legitimacy of the first node.
A verification device, characterized by comprising: a communication unit and a processing unit;

The communication unit is configured to receive a second request message from a first node, the second request message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code Generated according to the identity of the first node and a first root key, where the first root key is a root key used for communication between the terminal and the verification device; the processing unit is configured to The identification of the first node, the first root key and the third verification code verify the legitimacy of the terminal.
The device of claim 46, wherein:

The processing unit is specifically configured to: generate a fourth verification code according to the identity of the first node and the first root key; verify the first verification code according to the fourth verification code and the third verification code The legitimacy of the node.
The device according to claim 46 or 47, wherein:

The communication unit is further configured to send a first verification code to the first node, where the first verification code is used to verify the legitimacy of the first node.
A verification device, characterized by comprising: a communication unit and a processing unit;

The communication unit is configured to receive an identifier of a first node and a first key freshness parameter from an access network device, where the first node is an end point of application layer data of the device;

The communication unit is further configured to receive a first verification code from the first node, the first verification code is generated according to a second root key, and the second root key is the connection between the device and the first Root key used for communication between nodes;

The processing unit is configured to verify the legitimacy of the first node according to the identity of the first node, the first key freshness parameter, and the first verification code.
The device according to claim 49, wherein the device and the first node communicate through a side link.
The device according to claim 49 or 50, wherein the processing unit is specifically configured to:

The second root key is generated according to the first root key, the identifier of the first node, and the first key freshness parameter, and the first root key is the device and the access network The root key used for communication between devices;

Generate a second verification code according to the second root key;

Verify the legitimacy of the first node according to the second verification code and the first verification code.
The device according to any one of claims 49-51, wherein:

The communication unit is further configured to send a first request message to the first node, where the first request message is used to request association to the first node, and the first node is responsible for allocating the transmission resources of the side link , The first request message includes a third verification code, and the third verification code is used to verify the legitimacy of the device.
The device according to claim 52, wherein the communication unit is specifically configured to:

Receiving a notification message broadcast by the first node on a side link, where the notification message includes indication information, where the indication information is used to indicate that the first node is a node responsible for allocating transmission resources of the side link;

Sending the first request message to the first node according to the notification message.
The device according to claim 52 or 53, wherein the first request message further includes an identifier of the device.
The device according to any one of claims 49-54, wherein:

The processing unit is further configured to generate a security protection key for data with the first node according to the second root key, and perform data communication with the first node according to the security protection key. transmission.
A verification device, characterized by comprising: a communication unit and a processing unit;

The processing unit is configured to generate a first verification code according to a second root key, where the second root key is a root key used for communication between the terminal and the device, and the device is the terminal's The end point of application layer data;

The communication unit is configured to send the first verification code to the terminal.
The device according to claim 56, wherein the terminal and the device communicate through a side link.
The device according to claim 56 or 57, wherein:

The communication unit is further configured to receive a first request message from the terminal, the first request message is used to request association to the device, and the device is responsible for allocating the transmission resources of the side link. The message includes a third verification code, the third verification code is used to verify the legitimacy of the terminal, and the third verification code is generated according to the second root key;

The processing unit is further configured to verify the legitimacy of the terminal according to the second root key and the third verification code.
The apparatus according to claim 58, wherein the first request message includes an identification of the terminal,

The processing unit is further configured to obtain the second root key according to the identification of the terminal.
The device according to any one of claims 56-59, wherein:

The communication unit is further configured to receive the identification of the terminal and the second root key from the access network device.
The device according to any one of claims 56-60, wherein:

The communication unit is further configured to broadcast a notification message on the side link, the notification message includes indication information, and the indication information is used to indicate that the device is a node responsible for allocating transmission resources of the side link.
The device according to any one of claims 56-61, wherein:

The processing unit is further configured to generate a security protection key for data with the terminal according to the second root key, and perform data transmission with the terminal according to the security protection key.
A verification device, characterized by comprising: a communication unit and a processing unit;

The processing unit is configured to send a handover request message to the second access network device through the communication unit, and the handover request message is used to request the second access network device to switch the terminal from the apparatus to the For the second access network device, the handover request message includes the identification of the terminal;

The processing unit is further configured to receive a handover reply message from the second access network device through the communication unit, where the handover reply message includes the identifier of the second node and the second key freshness parameter, and The second node is the node responsible for allocating side link resources for the terminal to be associated after the terminal is switched, and the identity of the second node and the second key freshness parameter are used to verify the terminal and/or The legitimacy of the second node;

The processing unit is further configured to send the identifier of the second node and the second key freshness parameter to the terminal through the communication unit.
A verification device, characterized by comprising: a communication unit and a processing unit;

The processing unit is configured to receive a handover request message from a first access network device through the communication unit, and the handover request message is used to request the apparatus to switch the terminal from the first access network device to the An apparatus, the handover request message includes an identifier of the terminal;

The processing unit is further configured to send a handover reply message to the first access network device through the communication unit, where the handover reply message includes the identifier of the second node and the second key freshness parameter, the The second node is the node responsible for allocating side link resources for the terminal to be associated after the terminal is switched, and the identity of the second node and the second key freshness parameter are used to verify the terminal and/or The legitimacy of the second node;

The processing unit is further configured to send an identification of the terminal and a third root key to the second node through the communication unit, where the third root key is the difference between the terminal and the second node A root key for inter-communication, where the third root key is used to verify the legitimacy of the terminal and/or the second node.
A verification device, characterized by comprising: a processor, the processor is coupled with a memory, the memory is used for storing computer programs or instructions, and the processor is used for executing the computer programs or instructions stored in the memory, The verification device is caused to execute the method according to any one of claims 1 to 6, or the verification device is caused to execute the method according to any one of claims 7 to 11, or the verification device is caused to execute The method according to claim 12 or 13, or the verification device is caused to perform the method according to any one of claims 14 to 16, or the verification device is caused to perform any one of claims 17 to 23 The method, or causes the verification device to execute the method according to any one of claims 24 to 30, or causes the verification device to execute the method according to claim 31, or causes the verification The device executes the method according to claim 32.
A computer-readable storage medium, characterized in that the storage medium is used to store a computer program or instruction, and when the computer program or instruction is executed, the computer executes any one of claims 1 to 6 , Or cause the computer to execute the method according to any one of claims 7 to 11, or cause the computer to execute the method according to claim 12 or 13, or cause the computer to execute the method as described in The method according to any one of claims 14 to 16, or the computer is caused to execute the method according to any one of claims 17 to 23, or the computer is caused to execute any one of claims 24 to 30 The method either causes the computer to execute the method according to claim 31, or causes the computer to execute the method according to claim 32.
A computer program product containing instructions, wherein when the instructions run on a computer, the computer is caused to execute the method according to any one of claims 1 to 6, or the computer is caused to execute The method according to any one of claims 7 to 11, or the computer is caused to execute the method according to claim 12 or 13, or the computer is caused to execute the method according to any one of claims 14 to 16 Method, or causing the computer to execute the method according to any one of claims 17 to 23, or causing the computer to execute the method according to any one of claims 24 to 30, or causing the computer The method according to claim 31 is executed, or the computer is caused to execute the method according to claim 32.
A chip, characterized in that the chip comprises a processor and an interface circuit, the interface circuit is coupled to the processor, and the processor is used to run a computer program or instruction to implement any one of claims 1 to 6 The method described in item, or the method described in any one of claims 7 to 11, or the method described in claim 12 or 13, or the method described in any one of claims 14 to 16. The method described, or implements the method according to any one of claims 17 to 23, or implements the method according to any one of claims 24 to 30, or implements the method according to claim 31, Alternatively, the method according to claim 32 is implemented.
A verification device, characterized in that the verification device is used to implement the method according to any one of claims 1 to 6, or to implement the method according to any one of claims 7 to 11, or to implement The method according to claim 12 or 13, or the method according to any one of claims 14 to 16, or the method according to any one of claims 17 to 23, or the method according to any one of claims The method according to any one of claims 24 to 30, or implements the method according to claim 31, or implements the method according to claim 32.