WO2022036600A1 - Key update methods, apparatus and devices, and storage medium - Google Patents

Abstract

The present application relates to the technical field of communications and disclosed thereby are key update methods, apparatus and devices, and a storage medium. A method comprises: a core network device sends a key update message to a first terminal device when a first multicast service group is updated, the key update message being used to update a security key used by the first terminal device in the first multicast service group, and the first multicast service group being used to perform a first multicast service; and the first terminal device updates the security key according to the key update message. Embodiments of the present application enrich functions corresponding to a multicast service, ensure the security of a multicast service performed in an updated multicast service group, and improve the security guarantee mechanism of the multicast service.

Description

Key update method, device, device and storage medium technical field

The embodiments of the present application relate to the field of communication technologies, and in particular, to a key update method, apparatus, device, and storage medium.

Background technique

With the rapid development of network communication technology, people's demand for mobile communication is no longer only satisfied with telephone and message sending and receiving services, and a large number of multimedia service requirements are constantly emerging.

Some of these multimedia services require multiple UEs (User Equipment, user equipment) to be able to receive the same data at the same time, such as video-on-demand, TV broadcasting, online education, in-vehicle communication, and so on. Compared with ordinary data, these multimedia services have the characteristics of large amount of data and long duration. In order to effectively utilize mobile network resources and provide better services for UEs, a multicast (Multicast) service is produced. For V2X (Vehicle to Everything, vehicle wireless communication technology) or ProSe (Proximity Service, short-range communication service), the multicast service refers to a UE point-to-multipoint sending the same information content to the UEs in the multicast service group; for MBMS (Multimedia Broadcast/Multicast Service, Multimedia Broadcast Multicast Service) service, the multicast service refers to the wireless network point-to-multipoint sending the same information content to the UEs in the multicast service group. Multicast services can realize network resource sharing, improve the utilization rate of network resources, especially air interface resources, and efficiently provide users with high-speed and stable multimedia services.

However, how to securely send information related to multicast services to users needs further discussion and research.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a key update method, apparatus, device, and storage medium. The technical solution is as follows:

On the one hand, an embodiment of the present application provides a method for updating a key, which is applied to a terminal device, and the method includes:

Receive a key update message from a network device;

According to the key update message, the security key used by the first terminal device in the first multicast service group is updated, and the first multicast service group is used for performing the first multicast service.

On the other hand, an embodiment of the present application provides a method for updating a key, which is applied to a core network device, and the method includes:

When the first multicast service group is updated, send a key update message to the first terminal device, where the key update message is used to update the security code used by the first terminal device in the first multicast service group key, the first multicast service group is used to perform the first multicast service.

In another aspect, an embodiment of the present application provides a key update apparatus, which is set in a terminal device, and the apparatus includes:

a message receiving module for receiving a key update message from a network device;

A key update module, configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first group broadcast business.

In another aspect, an embodiment of the present application provides a key update apparatus, which is set in a core network device, and the apparatus includes:

A message sending module, configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first multicast The security key used in the service group, the first multicast service group is used to perform the first multicast service.

In another aspect, an embodiment of the present application provides a terminal device, where the terminal device includes: a processor, and a transceiver connected to the processor; wherein:

the transceiver for receiving a key update message from a network device;

The processor is configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first group broadcast business.

In another aspect, an embodiment of the present application provides a core network device, where the core network device includes: a processor, and a transceiver connected to the processor; wherein:

The transceiver is configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first group. The security key used in the multicast service group, the first multicast service group is used to perform the first multicast service.

In another aspect, an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a terminal device, so as to implement the above-mentioned first terminal device Side key update method.

In another aspect, an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a core network device, so as to implement the above-mentioned core network device Side key update method.

In another aspect, an embodiment of the present application provides a chip, where the chip includes a programmable logic circuit and/or program instructions, and when the chip runs on a terminal device, it is used to implement the above-mentioned first terminal device side encryption key update method.

On the other hand, an embodiment of the present application provides a chip, the chip includes a programmable logic circuit and/or program instructions, and when the chip runs on a core network device, it is used to implement the above-mentioned core network device side encryption key update method.

In another aspect, an embodiment of the present application provides a computer program product, which, when the computer program product runs on a terminal device, causes the computer to execute the above-mentioned first terminal device side key update method.

In another aspect, an embodiment of the present application provides a computer program product, which, when the computer program product runs on a core network device, causes a computer to execute the above method for updating a key on the core network device side.

The technical solutions provided by the embodiments of the present application may include the following beneficial effects:

When a certain multicast service group managed by the core network device is updated, send a key update message to the terminal equipment included in the updated multicast service group, and timely respond to the update of the multicast service group , which enriches the functions corresponding to multicast services. In addition, after receiving the key update message, the terminal equipment included in the updated multicast service group updates the security key used in the multicast service group in time, which ensures the security keys used in the updated multicast service group. The security of multicast services improves the security guarantee mechanism of multicast services. In addition, the core network device sends a key update message to the terminal devices included in the updated multicast service group, that is, if a certain terminal device uses the group provided by the multicast service group before the multicast service group is updated However, since the terminal equipment exits the multicast service group, the multicast service group is updated, the updated multicast service group does not include the terminal equipment, because the terminal equipment in the updated multicast service group After the security key is updated, the exiting terminal device does not receive the key update message, so it cannot learn the updated security key, thereby providing good security for the remaining terminal devices in the multicast service group to carry out multicast services. Assure.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present application more clearly, the following briefly introduces the drawings that are used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative effort.

1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

2 is a schematic diagram of a multicast communication system architecture provided by an embodiment of the present application;

3 is a schematic diagram of a multicast communication process provided by an embodiment of the present application;

4 is a schematic diagram of a multicast communication process provided by another embodiment of the present application;

5 is a schematic diagram of a key system provided by an embodiment of the present application;

6 is a schematic diagram of a key system provided by another embodiment of the present application;

7 is a flowchart of a key update method provided by an embodiment of the present application;

8 is a schematic diagram of a method for updating a multicast service group provided by an embodiment of the present application;

9 is a flowchart of a key update method provided by another embodiment of the present application;

10 is a block diagram of a key update device provided by an embodiment of the present application;

11 is a block diagram of a key update device provided by another embodiment of the present application;

12 is a block diagram of a key update device provided by another embodiment of the present application;

13 is a block diagram of a terminal device provided by an embodiment of the present application;

FIG. 14 is a block diagram of a core network device provided by an embodiment of the present application.

detailed description

In order to make the objectives, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

The network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. The evolution of new business scenarios and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

Please refer to FIG. 1 , which shows a schematic diagram of a system architecture provided by an embodiment of the present application. The system architecture 100 may include: a terminal device 10 , an access network device 20 , and a core network device 30 .

Terminal equipment 10 may refer to a UE, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless communication device, user agent, or user equipment. Optionally, the terminal device may also be a cellular phone, a cordless phone, a SIP (Session Initiation Protocol, session initiation protocol) phone, a WLL (Wireless Local Loop, wireless local loop) station, a PDA (Personal Digita1 Assistant, personal digital processing) , handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G (5th-Generation, fifth-generation mobile communication technology), or future evolved PLMNs (Pub1ic Land Mobi1e Network, public land mobile communication network) terminal equipment and the like, which are not limited in this embodiment of the present application. For the convenience of description, the devices mentioned above are collectively referred to as terminal devices. The number of terminal devices 10 is usually multiple, and one or more terminal devices 10 may be distributed in a cell managed by each access network device 20 .

The access network device 20 is a device deployed in the access network to provide the terminal device 10 with a wireless communication function. The access network device 20 may include various forms of macro base stations, micro base stations, relay stations, access points, and the like. In systems using different wireless access technologies, the names of devices with access network device functions may be different, for example, in a 5G NR (New Radio, new air interface) system, it is called gNodeB or gNB. As communication technology evolves, the name "Access Network Equipment" may change. For convenience of description, in the embodiments of the present application, the above-mentioned apparatuses for providing a wireless communication function for the terminal device 10 are collectively referred to as access network devices. Optionally, through the access network device 20, a communication relationship can be established between the terminal device 10 and the core network device 30. Exemplarily, in an LTE (Long Term Evolution, Long Term Evolution) system, the access network device 20 may be an EUTRAN (Evolved Universal Terrestrial Radio Access Network, Evolved Universal Terrestrial Radio Access Network) or one or more eNodeBs (eNodeBs) in the EUTRAN. evolved Node B); in a 5G NR system, the access network device 20 may be a RAN (Radio Access Network, radio access network) or one or more gNBs in the RAN.

The functions of the core network device 30 are mainly to provide user connection, manage users, and carry out services, and serve as an interface for the bearer network to provide an external network. For example, the core network device 30 in the 5G NR system may include an AMF (Access and Mobility Management Function) entity, a UPF (User Plane Function, user plane function) entity and an SMF (Session Management Function, session) entity management functions) entities and other equipment.

In one example, the access network device 20 and the core network device 30 communicate with each other through some air technology, such as the NG interface in the 5G NR system. The access network device 20 and the terminal device 10 communicate with each other through some air technology, such as a Uu interface.

As can be seen from the above description, some multimedia services require multiple UEs to receive the same data at the same time. Compared with general data, these multimedia services have the characteristics of large data volume and long duration. In order to effectively utilize mobile network resources and provide better services for UEs, multicast services are generated. Multicast service types include: a UE point-to-multipoint sending the same information content to UEs in a multicast service group (such as the multicast service in V2X and the multicast service in ProSe), wireless network (application server) point-to-multipoint The point sends the same information content to the UEs in the multicast service group (such as MBMS).

Please refer to FIG. 2 , which shows a schematic diagram of the architecture of a multicast communication system provided by an embodiment of the present application. The architecture of the multicast communication system includes: an application server 210 and a terminal device 220 .

The application server 210 refers to the server corresponding to the multicast service. Exemplarily, in the LTE system, the application server 210 can be a BM-SC; in the 5G system, the application server 210 can be an MBSF (Multimedia Broadcast Service Function, multimedia broadcast service function). function) and MBSU (Multimedia Broadcast Service User plane). Optionally, the application server may be located outside the mobile network, that is, the application server is independent of the core network device. When the application server is located outside the mobile network, optionally, the interaction between the application server and the terminal device may be implemented through an application layer protocol, such as HTTP (Hyper Text Transfer Protocol, hypertext transfer protocol) protocol. Optionally, the application server may also be located within the mobile network, that is, the function of the application server is implemented by core network equipment (or referred to as network elements) and/or access network equipment (such as base stations) in the core network, For example, the function of the application server MBSF is implemented by the core network device SMF, and the function of the application server MBSU is implemented by the core network device UPF or the access network device (eg, base station). When the application server is located in the mobile network, optionally, the interaction between the application server and the terminal device may be performed through the control plane and/or the user plane, wherein the control plane interaction may use NAS (Non-Access-Stratum, non-access stratum) messages; user plane interaction can be implemented through the radio bearer of the air interface and/or the GTP (GPRS Tunneling Protocol, GPRS Tunneling Protocol) of the core network. Optionally, the above interaction may include messages related to group establishment, service request or service revocation between the terminal device and the application server, such as identity authentication request, key acquisition request or service revocation request in the following embodiments.

In one example, the multicast communication system includes at least one multicast service group. Optionally, each multicast service group corresponds to a different application server 210, that is, the number of application servers 210 in the multicast communication system is the same as the number of multicast service groups; The application server 210, that is, the multicast communication system includes an application server 210, and the application server 210 is configured to provide multicast services for different multicast service groups in the multicast communication system. Optionally, each multicast service group includes at least two terminal devices 220, and the device types of the terminal devices 220 in each multicast service group may be the same (for example, both are handheld devices), or may be different (for example, some are Handheld devices, some in-vehicle devices). Optionally, the multicast service types of the multicast services in the same multicast communication system are the same, for example, one UE sends the same information content to other UEs in the multicast service group point-to-multipoint.

Optionally, when information transmission needs to be performed in the multicast service group, in order to ensure the security and accuracy of the transmitted information, the transmitted information may be encrypted. Optionally, in order to improve the security of the transmitted information, the keys used in the information encryption process in different multicast service groups are different. The following describes the keys used in the information encryption process for several typical multicast communication systems.

V2X multicast communication system: The terminal device applies to the application server (V2X Application Server) in V2X to join the multicast service group and obtains the authorization of the group service. At this time, the terminal device will obtain the GID (Group Identifier, group identifier). After the terminal device obtains the GID, the KMF (Key Management Function, key management function) in V2X securely distributes the group key for the terminal device. Furthermore, in the multicast service group that the terminal device applies to join, each terminal device builds a secure connection with the assistance of the group key and some other keys, ID (Identity), etc., so as to realize safe and accurate multicast communication.

ProSe multicast communication system: As shown in Figure 3, the terminal device implements group service authorization with ProSe Function and ProSe KMF, and the terminal device sends a key acquisition request to ProSe KMF, which includes the GID and the security of the terminal device. After checking the key acquisition request, ProSe KMF uses the MIKEY (Multimedia Network Encryption) protocol to encrypt and issue the group key (PGK), the ID of the group key and the expiration time of the group key (or issue the group member ID, Master Key (PMK), Master Key ID, and other information). Secondly, the terminal device uses the information sent by the ProSe KMF to achieve a secure and accurate multicast service between other terminal devices in the multicast service group. The terminal device calculates the encryption key (PEK) and integrity protection based on the information sent by the ProSe KMF. Key (PIK) and other keys to protect the information transmitted in the multicast service. After the terminal equipment receiving the transmitted information receives the information, it checks the second layer header of the information to obtain the LC (Logic Channel, logical channel) ID, group identification and group member identification, and then the terminal equipment receiving the transmitted information identifies and sends the information which group key is used by the terminal device, and checks whether the group key is valid, and further calculates the encryption key and the integrity protection key to process the received message. Optionally, the multicast communication process of the V2X multicast communication system may refer to the multicast communication process of the ProSe multicast communication system.

MBMS multicast communication system: First, the MBMS server (MBSF) authenticates the terminal device, and the terminal device can send an identity authentication request to the MBSF. After the terminal device is authenticated successfully, the MBSF stores the device information of the terminal device. After that, the terminal device may initiate a key acquisition request to the MBSF, and the key acquisition request is used to request to acquire a service key (MSK). Optionally, The key acquisition request includes the Key Domain ID and MSK ID. The server authenticates the key authentication request, and executes the distribution of the service key (MSK) and the traffic key (MTK) in sequence after the authentication is passed. Among them, the service key (MSK) uses the MIKEY message protected by the user key (MUK) to encrypt and deliver, and the service key (MSK) uses the Key Domain ID and MSK ID identification; the traffic key (MTK) uses the service key The MIKEY message protected by (MSK) is encrypted and delivered, and the traffic key (MTK) is identified by Key domain ID, MSK ID, and MTK ID. It should be noted that, in order to reduce the signaling exchange between the terminal device and the MBSF, the terminal device can send an identity authentication request and a key acquisition request to the MBSF at the same time, that is, the identity authentication request and the key authentication request can be carried in the same message, as shown in Figure 4. Optionally, the identity authentication request and the key authentication request are NAS messages. After that, each terminal device in the multicast service group that the terminal device joins can establish a secure connection through the service key and the traffic key, so as to protect the transmitted multicast information. It should be noted that MBMS may also be called MBS (Multicast Broadcast Service, multicast broadcast service) in the 5G system, and those skilled in the art should understand its meaning.

In an example, the MIKEY protocol is used to deliver the key to the terminal device by the application server, that is, the message carrying the key delivered by the application server to the terminal device may be called a MIKEY message. The MIKEY message can protect the confidentiality and integrity of the key. Optionally, the encryption algorithm used by MIKEY is AES (Advanced Encryption Standard)-CM-128 or AES-KW-128, and the message verification code is HMAC (Hash-based Message Authentication Code, Hash Message Authentication Code)-SHA (Secure Hash Algorithm, Secure Hash Algorithm)-1-160. The following takes MBMS as an example to describe the MIKEY message.

It can be seen from the above description about the MBMS multicast communication system that after the terminal device is authenticated successfully, the application server executes the distribution of the service key (MSK) and the traffic key (MTK) in sequence.

Table 1 Service Key (MSK) message structure

Common HDR
EXT (Extended Payload)
TS
MIKEY RAND (Random, random number)
IDi
IDr
{SP(Security Policy, security policy)}
KEMAC

As shown in Table 1 above, it shows the logical structure of the MIKEY message of the MSK protected by the MUK provided by an embodiment of the present application. in:

EXT: Contains the MSK ID and MSK type, and the ID of the key domain where the MSK is located;

IDi: ID of the application server (BM-SC);

IDr: ID of the terminal device;

MIKEY RAND: used to generate encryption keys and authentication keys to handle traffic keys that need to be protected (MTK);

{SP}: used in the multicast service data service, it can include: information related to the security protocol (such as the algorithm used, the length of the key, the initial value of the algorithm, etc.);

KEMAC: It includes the MSK ciphertext encrypted by MUK and the MAC (Media Access Control, media access control) of MSK, and the rest is plaintext.

Table 2 Traffic key (MTK) message structure

Common HDR
EXT (Extended Payload)
TS
KEMAC

As shown in Table 2 above, the logical structure of the MIKEY message of the MTK delivered by the application server provided by an embodiment of the present application is shown. Since the key derived from MIKEY RAND in the MIKEY message of MSK is used to protect MTK, MIKEY RAND is not required in the message structure of MTK. in:

EXT: including MTK, the ID, type and key domain ID of the MSK used to protect the MTK;

KEMAC: Contains the MTK ciphertext and MAC encrypted by the MSK-derived key.

It can be seen from the above introduction that the key used for encryption and integrity protection of multicast service information in the multicast service is derived from the root key layer by layer according to the key system. The following describes the generation of keys for encrypting and integrity-protecting multicast service information based on the key system in the V2X multicast communication system.

Please refer to FIG. 5 , which shows a schematic diagram of a key system in MBMS provided by an embodiment of the present application. As can be seen from Figure 5, in MBMS, the key system consists of the following three layers: MUK (user key), MSK (service key), and MTK (traffic key). The user key (MUK) is used to protect the delivery of the service key (MSK), and the service key (MSK) is used to protect the delivery of the traffic key (MTK). The service key (MSK) may be derived from the user key (MUK), or it may be selected and issued by the application server; the traffic key (MTK) may be derived from the service key (MSK) , or it can be selected and delivered by the application server. It should be understood that, in the key system shown in FIG. 5 , the connection between the MUK and the MSK and the connection between the MSK and the MTK are only used to represent the protection relationship, but not used to limit the derivative relationship.

Please refer to FIG. 6 , which shows a schematic diagram of a key system in a V2X multicast communication system provided by an embodiment of the present application. As can be seen from Figure 6, in the V2X multicast communication system, the key system consists of the following three layers: VGK (group key), PTK (traffic key), PEK (encryption key) and PIK (integrity protection key) key). It should be understood that in the V2X multicast communication system, the traffic key, encryption key and integrity protection key follow the names in the ProSe multicast communication system. With the evolution of communication protocols, other names may be generated, such as traffic The key is called VTK, the encryption key is called VEK, the integrity protection key is called VIK, etc. These evolved names should also belong to the protection scope of this application. in:

VGK: or root key, which occupies 256 bits.

PTK: or service key, which occupies 256 bits and is calculated and generated by the terminal device after decrypting the MIKEY message sent by the application server.

PEK and PIK: used in confidentiality algorithm and integrity algorithm respectively to protect multicast service information. PEK and PIK are calculated and generated by terminal equipment using PTK.

Table 3 PTK derived input parameters

KDF input parameters	specific value
FC	0X4A
P0	Group Member Identity
L0	P0 length
P1	PTK Identity
L1	P1 length
P2	Group Identity
L2	P2 length
Input Key	256-bit VGK

As shown in Table 3 above, it shows the input parameters required to derive the PTK provided by an embodiment of the present application. In one example, the PTK can be updated by updating the VGK.

Table 4 PEK and PIK derived input parameters

As shown in Table 4 above, it shows the input parameters required for derivation of PEK and PIK provided by an embodiment of the present application. In one example, the PEK and PIK are updated by updating the PTK.

By encrypting and protecting the integrity of the multicast service information above, the security of the multicast service information and the multicast communication system can be improved. However, the above example only considers the security guarantee when the terminal device joins the multicast service group, but does not consider how to ensure the multicast service information transmitted between the remaining terminal devices in the multicast service group when the terminal device exits the multicast service group security. Based on this, the embodiments of the present application provide a key update method, which can be used to ensure the security of multicast service information transmitted between other terminal devices when a terminal device exits a multicast service group, and reduce security risks. Hereinafter, the technical solutions of the present application will be described through several exemplary embodiments.

Please refer to FIG. 7 , which shows a flowchart of a key update method provided by an embodiment of the present application. The method can be applied to the system architectures shown in FIG. 1 and FIG. 2 , and the method may include the following steps (710 ~720):

Step 710, when the first multicast service group is updated, the core network device sends a key update message to the first terminal device, and the key update message is used to update the first terminal device to use in the first multicast service group. The first multicast service group is used to perform the first multicast service.

The core network device refers to a device that can provide multicast service services for the first terminal device. Optionally, the core network device is a server (ie, an application server) of a multicast service. For other introductions to the application server, please refer to the above implementation. For example, I won't go into details here. The first multicast service group is used to perform the first multicast service. In this embodiment of the present application, the core network device may provide at least one multicast service, that is, the core network device manages at least one multicast service group. Optionally, the number of terminal devices in the first multicast service group is greater than or equal to two.

As the service requirements of the terminal equipment change, the first multicast service group will also be updated. This embodiment of the present application does not limit the situation in which the first multicast service group is updated. Optionally, when the first multicast service group is updated, it means that a terminal device in the first multicast service group exits (or cancels). Please refer to In the following embodiments, details are not repeated here; or, the update of the first multicast service group is manifested as a change in the security requirements of the terminal equipment in the first multicast service group for the multicast service. The security requirements of the service are more stringent, and it is expected that the purpose of strictly protecting the information related to the multicast service can be achieved by continuously updating the security key. For example, when the core network device determines that the subscription service of a terminal device for the first multicast service expires, the terminal device is withdrawn from the first multicast service group, or the core network device is When the security policy of the first multicast service group is updated, the terminal equipment in the first multicast service group is actively cancelled.

When determining that the first multicast service group is updated, the core network device generates a key update message, and delivers the key update message to the first terminal device in the first multicast service group, and responds to the The update of the first multicast service group. Wherein, when the update of the first multicast service group indicates that the terminal device is withdrawn, the first terminal device is the remaining terminal equipment in the first multicast service group except the withdrawn terminal equipment. The key update message is used to update the security key used by the first terminal device in the first multicast service group, where the security key is used to encrypt and protect the integrity of information related to the first multicast service. Optionally, the key update message is a MIKEY message, that is, the key update message is delivered by the core network device to the first terminal device through the MIKEY protocol. This embodiment of the present application does not limit the specific content of the key update message. Optionally, the key update message includes a random number required for deriving the security key or a root key for deriving the security key. For the introduction and description of the content, please refer to the following embodiments, and details are not repeated here.

Step 720: The first terminal device updates the security key according to the key update message.

After receiving the key update message, the first terminal device parses the key update message to extract the update content carried in the key update message, and updates the security key according to the update content. Optionally, when the key update message is a MIKEY message, the first terminal device needs to use the encryption key of the key update message to parse the key update message. Exemplarily, in MBMS, the key update message Encrypted by user key (MUK). Since the key update message carries the content required for deriving the security key, after parsing the key update message to obtain the update content, the first terminal device may regenerate a new security key according to the update content.

To sum up, the technical solutions provided by the embodiments of the present application, when a certain multicast service group managed by the core network device is updated, send a key to the terminal equipment included in the updated multicast service group The update message, in response to the update of the multicast service group in time, enriches the functions corresponding to the multicast service. In addition, after receiving the key update message, the terminal equipment included in the updated multicast service group updates the security key used in the multicast service group in time, which ensures the security keys used in the updated multicast service group. The security of multicast services improves the security guarantee mechanism of multicast services. In addition, the core network device sends a key update message to the terminal devices included in the updated multicast service group, that is, if a certain terminal device uses the group provided by the multicast service group before the multicast service group is updated However, since the terminal equipment exits the multicast service group, the multicast service group is updated, the updated multicast service group does not include the terminal equipment, because the terminal equipment in the updated multicast service group After the security key is updated, the exiting terminal device does not receive the key update message, so it cannot learn the updated security key, thereby providing good security for the remaining terminal devices in the multicast service group to carry out multicast services. Assure.

The following describes the security key update process.

In an example, the above step 720 includes the following steps:

Step 722: The first terminal device updates the service key corresponding to the first multicast service according to the key update message.

It can be seen from the above description of the key system that the security key is not directly issued by the core network device to the terminal device, but is derived by the terminal device layer by layer according to the root key issued by the core network device. In order to be compatible with the established key system, in this embodiment of the present application, after receiving the key update message from the core network device, the first terminal device first updates the service key corresponding to the first multicast service, and then The business key further updates the security key.

In different multicast service communication systems, the names of service keys are different. Exemplarily, when the first multicast service includes the multicast service in V2X or the multicast service in ProSe, the service key is called the service key; when the first multicast service includes MBMS, The service key may be called a service key or a service key. It should be understood that during the evolution of the communication protocol, the service key may generate new names, but all perform the same function, and these new names should also fall within the protection scope of this application.

Referring to Table 3 above, in the process of derivation of the service key, the parameters used include a group key (or called a root key) and a key calculation parameter. Optionally, the key calculation parameter includes a random number. For example, for the service key (PTK) in the V2X multicast communication system, the original P0 is designed as a random number in its derived input parameters. That is, on the basis of the above Table 3, the P0 (group member identifier) is modified to (Nonce_1), as shown in the following Table 5.

Table 5 PTK derived input parameters

KDF input parameters	specific value
FC	0X4A
P0	Nonce_1 (random number)
L0	P0 length
P1	PTK Identity
L1	P1 length
P2	Group Identity
L2	P2 length
Input Key	256-bit VGK

Among them, P0 (Nonce_1) is a random number, and L0 represents the length of the random number Nonce_1. It can be seen from the above Table 5 that in order to update the service key, it is necessary to update the parameters used in the service key derivation process. Based on this, in an example, the key update message includes at least one of the following: the updated key Calculation parameters, updated group key.

Since updating the group key requires more computing resources than updating the key calculation parameters, in order to reduce the computing resources required by the core network device to calculate the updated group key and avoid frequent updating of the group key, in an example , the core network device checks whether the group key corresponding to the first multicast service group expires when the first multicast service group is updated, optionally, the use time limit set by the core network device for the group key, When the group key is outside the usage time limit, it means that the group key has expired, and when the group key is within the usage time limit, it means that the group key has not expired; When the group key expires, the core network device generates an updated group key and issues it to the first terminal device, that is, the key update message includes the updated group key; In the case where the group key of the device has not expired, the core network device generates the updated key calculation parameter and delivers it to the first terminal device, that is, the key update message includes the updated key calculation parameter.

Step 724, the first terminal device updates the security key according to the updated service key.

After deriving the updated service key according to the key update message, the first terminal device further updates the security key according to the updated service key in order to be compatible with the established key system. For the manner in which the first terminal device updates the security key according to the updated service key, reference may be made to the foregoing Table 4, and details are not repeated here.

In different multicast service communication systems, the content and name of the security key are different. Exemplarily, when the first multicast service includes the multicast service in V2X or the multicast service in ProSe, the security key includes at least one of the following: an encryption key, an integrity protection key; When the multicast service includes MBMS, the security key may include a traffic key, or at least one of the following: an encryption key and an integrity protection key. It should be understood that during the evolution of the communication protocol, the service key may generate new names, but all perform the same function, and these new names should also fall within the protection scope of this application.

To sum up, in the technical solutions provided by the embodiments of the present application, the updated service key is derived from the updated key update message by the terminal equipment included in the updated multicast service group, and further derived from the updated service key. The updated security key is effectively compatible with the established key system in the multicast service. In addition, in the embodiment of the present application, the core network device adopts different key update methods to determine whether the group key corresponding to the multicast service expires. When the key is not expired, the key calculation parameters are updated. Since the computing resources required to update the key calculation parameters are less than the computing resources required to update the group key, the embodiment of the present application proposes a lightweight key update. In this way, it helps to reduce the calculation overhead of the core network device to generate updated content, and to reduce the calculation overhead of the terminal device to derive the security key.

The following describes a situation in which the first multicast service group is updated. It can be seen from the description of the above embodiment that the update of the first multicast service group includes at least one of the following possibilities: there is a UE in the first multicast service group that actively withdraws, and the core network device cancels the terminal equipment in the first multicast service group. . The following describes these situations respectively.

In an example, as shown in Figure 8, the above method further includes the following steps:

Step 801, the second terminal device sends a service cancellation request to the core network device.

The second terminal device refers to a terminal device that needs to cancel the multicast service in the first multicast service group before the update. The second terminal device can send a service cancellation request to the core network device to request to quit the first multicast service group. Optionally, the service withdrawal request is a NAS message. This embodiment of the present application does not limit the content of the service revocation request. Optionally, the service revocation request includes at least one of the following: a multicast service group identifier (GID) and an identifier of the first terminal device.

Step 803, the core network device cancels the second terminal device from the first multicast service group according to the service cancellation request.

After receiving the service cancellation request from the second terminal equipment, the core network device parses the service cancellation request, and can determine the terminal equipment that requests to withdraw from the multicast service, that is, the second terminal equipment, and determine the multicast group where the second terminal equipment is located. Service group, that is, the first multicast service group. Thus, the core network device withdraws the second terminal device from the first multicast service group in response to the service withdrawal request of the second terminal device. Optionally, the core network device revoking the second terminal device from the first multicast service group includes: deleting information related to the second terminal device, such as the identifier of the second terminal device, from the member list corresponding to the first multicast service group. .

In order to make the second terminal equipment clear whether to successfully withdraw from the multicast service after sending the service cancellation request, optionally, after the above step 803, step 805 is further included: the core network equipment sends a service cancellation response to the second terminal equipment, and the service withdraws The response is used to instruct the second terminal device to complete the withdrawal from the first multicast service group. In the embodiment of the present application, in order to reduce the signaling exchange between the core network device and the terminal device, and reduce the signaling overhead of the core network device, the core network device may not send a service cancellation response to the second terminal device, because after the subsequent update The remaining terminal devices in the multicast service group of the first terminal have updated their security keys, and the second terminal device cannot use its explicit security key to continue the multicast service. Optionally, after sending the service cancellation request, the second terminal device defaults to withdraw from the multicast service, that is, defaults to withdraw from the first multicast service group; or, after the second terminal device sends the service cancellation request If it does not receive a response message from the core network device to the service cancellation request within a period of time, it quits the multicast service by default. Start the timer. If the second terminal device receives a service cancellation response from the core network device within the working time of the timer, it is determined to be cancelled from the first multicast service group. If the second terminal device expires in the timer If the service revocation response has not been received from the core network device, it will be revoked from the first multicast service group by default. Optionally, when the timer expires, the second terminal device has not yet received a service cancellation response from the core network device, and may also default that it has not been withdrawn from the first multicast service group. The terminal device may re-send the service cancellation request to the core network device.

In another example, as shown in Figure 8, the above method further includes the following steps:

Step 802, the core network device cancels the third terminal device from the first multicast service group when the subscription service of the third terminal device for the first multicast service expires.

The third terminal device refers to the terminal device in the first multicast service group before the update. During the process of providing the terminal equipment in the first multicast service group with the multicast service, the core network equipment determines whether the subscription service of each terminal equipment for the first multicast service expires. Optionally, the core network device determines in real time whether the subscription server of each terminal device expires; or, the core network device determines whether the subscription service of each terminal device expires every preset time. In the case that the core network device determines that the subscription service of the third terminal device in the first multicast service group expires, the third terminal device is withdrawn from the first multicast service group.

Optionally, in this embodiment of the present application, a subscription duration or subscription termination time is set for each terminal device to subscribe to the first multicast service, so that the core network device can determine whether each terminal device can obtain the first multicast service. For example, when each terminal device corresponds to a subscription duration, the core network device determines whether the duration for each terminal device to obtain the first multicast service reaches the subscription duration. 's subscription service expires. For another example, in the case where each terminal device corresponds to a subscription termination time, the core network device determines whether the current time at which each terminal device obtains the first multicast service reaches the subscription termination time, and if it reaches the subscription termination time, then determines that the terminal device targets the subscription termination time. The subscription service of the first multicast service expires. Optionally, for each terminal device in the first multicast service group, the same subscription duration or subscription termination time is set; or, for different terminal devices in the first multicast service group, different subscription durations or different subscription durations are set. The subscription termination time, for example, for a terminal device that pays more fees, a longer subscription duration is set.

In order to make the terminal equipment whose subscription service expires clearly know that the subscription service for the first multicast service expires in time, so as to facilitate the timely restoration of the first multicast service, optionally, after the above step 802, step 804 is further included: the core network equipment sends The third terminal device sends revocation prompt information, where the revocation prompt information is used to instruct the third terminal device to complete the revocation from the first multicast service group. In order for the third terminal device to further clarify the reason for its cancellation from the first multicast service group, optionally, the core network device sends the service cancellation reason to the third terminal device, and the service cancellation reason is used to instruct the core network device to Three reasons for the terminal equipment to be withdrawn from the first multicast service group, for example, the reason for the service withdrawal is that the subscription service of the third terminal equipment for the first multicast service expires. Optionally, the reason for service revocation is carried in the revocation prompt information, so as to reduce the signaling exchange between the core network device and the terminal device, and reduce the signaling overhead of the core network device.

To sum up, the technical solutions provided by the embodiments of the present application enable the terminal equipment to send a service cancellation request to the core network equipment when there is a need for cancellation of the multicast service, so as to withdraw from the multicast service group in which it is located, thereby enriching the group. The function of multicast service realizes the purpose of flexibly withdrawing from multicast service. In addition, in this embodiment of the present application, the core network device sends a service revocation response to the terminal device after revoking the terminal device that sends the service revocation request from the multicast service group, so that the terminal device can clearly grasp whether it has successfully withdrawn from the multicast service. business.

In addition, the technical solutions provided by the embodiments of the present application determine whether the subscription service of each terminal device in the multicast service group for the multicast service has expired through the core network device, and cancel the terminal device whose subscription service has expired in time to avoid these terminal devices. Free access to multicast services, thus avoiding unnecessary losses to providers of multicast services. In addition, in the embodiment of the present application, after revoking the terminal device whose subscription service has expired, the core network device further sends revocation prompt information to the terminal device, so as to notify the terminal device in time, so that the terminal device can timely grasp the fact that it cannot obtain the multicast service. situation, so as to deal with the situation in time to restore the multicast service.

Hereinafter, the technical solution of the present application will be introduced and explained by taking the V2X multicast communication system as an example. It should be understood that FIG. 9 only takes the V2X multicast communication system as an example, and does not constitute a limitation on the technical solution of the present application. After understanding the technical solution shown in FIG. The technical solution of the invention is applicable to other multicast communication systems, such as MBMS (or referred to as MBS), which shall fall within the protection scope of the present application.

Please refer to FIG. 9 , which shows a flowchart of a key update method provided by an embodiment of the present application. The method can be applied to the system architecture shown in FIG. 1 and FIG. 2 , and the method may include the following steps:

Step 910, the second terminal device sends a service cancellation request to the core network device. The second terminal device refers to a terminal device in the first multicast service group that needs to cancel the multicast service. The service withdrawal request is used to request to withdraw from the first multicast service group. Optionally, the service revocation request includes at least one of the following: a multicast service group identifier and an identifier of the first terminal device.

Step 920: The core network device cancels the second terminal device from the first multicast service group according to the service cancellation request. Optionally, the core network device revoking the second terminal device from the first multicast service group includes: deleting information related to the second terminal device, such as the identifier of the second terminal device, from the member list corresponding to the first multicast service group. .

Step 930: The core network device sends a service cancellation response to the second terminal device. The service revocation response is used to instruct the second terminal device to complete revocation from the first multicast service group. Optionally, the core network device directly cancels the second terminal device from the first multicast service group without sending a service cancellation response to the second terminal device (step 930 does not need to be executed).

Step 940, the core network device determines whether the group key corresponding to the first multicast service group expires. Optionally, the use time limit set by the core network device for the group key, when the group key is outside the use time limit, indicates that the group key expires, and when the group key is within the use time limit, Indicates that the group key has not expired. It should be noted that this embodiment of the present application does not limit the execution sequence of step 940 and step 930 . FIG. 9 is only for convenience of description, and step 940 is executed after step 930 .

Step 950: The core network device sends a key update message to the first terminal device. The first terminal device refers to the terminal device included in the updated first multicast service group, that is, the first terminal device is a terminal device other than the revoked terminal device (second terminal device) in the first multicast service group. remaining terminal equipment. The key update message is used to update the security key used by the first terminal device in the first multicast service group. When the group key corresponding to the first multicast service group expires, the key update message includes the updated group key; when the group key corresponding to the first multicast service group has not expired, the key The update message includes the updated key calculation parameters. Optionally, the key calculation parameter includes a random number. Optionally, the core network device directly sends the key update information to the first terminal device when it is determined that the first multicast service group is updated (eg, receiving a service revocation request from the second terminal device). That is, the core network device does not need to determine whether the group key corresponding to the first multicast service group expires (the above step 940 does not need to be performed), and at this time, the key update message may carry the updated group key by default, Alternatively, the updated key calculation parameters are carried by default. It should be noted that this embodiment of the present application does not limit the execution timing of step 950. Optionally, step 950 is executed after step 910; or, step 950 is executed after step 920; or, step 950 and step 920 are executed simultaneously .

Step 960, the first terminal device updates the service key (PTK) corresponding to the first multicast service according to the key update message; and updates the security keys (PEK and PIK) according to the updated service key (PTK).

It should be noted that, in the above method embodiments, the key update method provided by the present application is described mainly from the perspective of interaction between the first terminal device, the second terminal device and the core network device. The above-mentioned steps performed by the first terminal device can be independently implemented as a key update method on the first terminal device side; the above-mentioned steps performed by the core network device can be implemented independently as a key network device side key update method.

The following are apparatus embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

Please refer to FIG. 10 , which shows a block diagram of a key update apparatus provided by an embodiment of the present application. The apparatus has the function of implementing the above-mentioned first terminal device-side method example, and the function may be implemented by hardware or by executing corresponding software in hardware. The apparatus may be the above-mentioned terminal equipment, or may be set in the terminal equipment. As shown in FIG. 10 , the apparatus 1000 may include: a message receiving module 1010 and a key updating module 1020 .

The message receiving module 1010 is configured to receive a key update message from a network device.

A key update module 1020, configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first Multicast service.

In an example, the key update module is configured to: update the service key corresponding to the first multicast service according to the key update message; update the security key according to the updated service key key.

In one example, the key update message includes at least one of the following: an updated key calculation parameter, and an updated group key.

In one example, the key calculation parameter includes a random number.

In an example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; If the key is not expired, the key update message includes the updated key calculation parameter.

In an example, the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

In one example, the service key includes a service key; and the first multicast service includes MBMS.

In an example, the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a group in ProSe broadcast service, MBMS.

In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

To sum up, the technical solutions provided by the embodiments of the present application, when a certain multicast service group managed by the core network device is updated, send a key to the terminal equipment included in the updated multicast service group The update message, in response to the update of the multicast service group in time, enriches the functions corresponding to the multicast service. In addition, after receiving the key update message, the terminal equipment included in the updated multicast service group updates the security key used in the multicast service group in time, which ensures the security keys used in the updated multicast service group. The security of multicast services improves the security guarantee mechanism of multicast services. In addition, the core network device sends a key update message to the terminal devices included in the updated multicast service group, that is, if a certain terminal device uses the group provided by the multicast service group before the multicast service group is updated However, since the terminal equipment exits the multicast service group, the multicast service group is updated, the updated multicast service group does not include the terminal equipment, because the terminal equipment in the updated multicast service group After the security key is updated, the exiting terminal device does not receive the key update message, so it cannot learn the updated security key, thereby providing good security for the remaining terminal devices in the multicast service group to carry out multicast services. Assure.

Please refer to FIG. 11 , which shows a block diagram of a key update apparatus provided by an embodiment of the present application. The apparatus has the function of implementing the above-mentioned method example on the device side of the core network, and the function may be implemented by hardware, or by executing corresponding software in the hardware. The apparatus may be the core network equipment described above, or may be provided in the core network equipment. As shown in FIG. 11 , the apparatus 1100 may include: a message sending module 1110 .

The message sending module 1110 is configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first group. The security key used in the multicast service group, the first multicast service group is used to perform the first multicast service.

In one example, the key update message includes at least one of the following: an updated key calculation parameter, and an updated group key.

In one example, the key calculation parameter includes a random number.

In an example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; If the key is not expired, the key update message includes the updated key calculation parameter.

In an example, the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a group in ProSe broadcast service, MBMS.

In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

In an example, as shown in FIG. 12 , the apparatus 1100 further includes: a request receiving module 1120 for receiving a service cancellation request from the second terminal device; a device cancellation module 1130 for receiving a service cancellation request according to the service cancellation request , withdraw the second terminal device from the first multicast service group.

In an example, the service revocation request includes at least one of the following items: a multicast service group identifier, and an identifier of the first terminal device.

In an example, as shown in FIG. 12 , the apparatus 1100 further includes: a response sending module 1140, configured to send a service withdrawal response to the second terminal device, where the service withdrawal response is used to instruct the second terminal The revocation of the device from the first multicast service group is completed.

To sum up, the technical solutions provided by the embodiments of the present application, when a certain multicast service group managed by the core network device is updated, send a key to the terminal equipment included in the updated multicast service group The update message, in response to the update of the multicast service group in time, enriches the functions corresponding to the multicast service. In addition, after receiving the key update message, the terminal equipment included in the updated multicast service group updates the security key used in the multicast service group in time, which ensures the security keys used in the updated multicast service group. The security of multicast services improves the security guarantee mechanism of multicast services. In addition, the core network device sends a key update message to the terminal devices included in the updated multicast service group, that is, if a certain terminal device uses the group provided by the multicast service group before the multicast service group is updated However, since the terminal equipment exits the multicast service group, the multicast service group is updated, the updated multicast service group does not include the terminal equipment, because the terminal equipment in the updated multicast service group After the security key is updated, the exiting terminal device does not receive the key update message, so it cannot learn the updated security key, thereby providing good security for the remaining terminal devices in the multicast service group to carry out multicast services. Assure.

It should be noted that, when the device provided in the above embodiment realizes its functions, only the division of the above functional modules is used as an example for illustration. In practical applications, the above functions can be allocated to different functional modules according to actual needs. That is, the content structure of the device is divided into different functional modules to complete all or part of the functions described above.

Regarding the apparatus in the above-mentioned embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be described in detail here.

Please refer to FIG. 13 , which shows a schematic structural diagram of a terminal device 130 provided by an embodiment of the present application. For example, the terminal device can be used to execute the above-mentioned first terminal device side key update method. Specifically, the terminal device 130 may include: a processor 131, and a transceiver 132 connected to the processor 131; wherein:

The processor 131 includes one or more processing cores, and the processor 131 executes various functional applications and information processing by running software programs and modules.

Transceiver 132 includes a receiver and a transmitter. Optionally, transceiver 132 is a communication chip.

In one example, the terminal device 130 further includes: a memory and a bus. The memory is connected to the processor through a bus. The memory can be used to store a computer program, and the processor is used to execute the computer program, so as to implement each step performed by the first terminal device in the above method embodiment.

In addition, the memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof. Volatile or non-volatile storage devices include but are not limited to: RAM (Random-Access Memory, random access memory) and ROM (Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory, Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory, Electrically Erasable Programmable Read-Only Memory) ), flash memory or other solid-state storage technology, CD-ROM (Compact Disc Read-Only Memory), DVD (Digital Video Disc, high-density digital video disc) or other optical storage, tape cassettes, tapes, disk storage or other magnetic storage devices. in:

The transceiver 132 is configured to receive a key update message from a network device.

The processor 131 is configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first Multicast service.

In an example, the processor 131 is configured to: update the service key corresponding to the first multicast service according to the key update message; update the security key according to the updated service key .

In one example, the key update message includes at least one of the following: an updated key calculation parameter, and an updated group key.

In one example, the key calculation parameter includes a random number.

In an example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; If the key is not expired, the key update message includes the updated key calculation parameter.

In an example, the first multicast service includes any one of the following: a multicast service in V2X, a multicast service in ProSe, and MBMS.

In one example, the service key includes a service key; and the first multicast service includes MBMS.

In an example, the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a group in ProSe broadcast service, MBMS.

In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

Please refer to FIG. 14 , which shows a schematic structural diagram of a core network device 1413 provided by an embodiment of the present application. For example, the core network device can be used to execute the above-mentioned core network device-side key update method. Specifically, the core network device 1413 may include: a processor 141, and a transceiver 142 connected to the processor 141; wherein:

The processor 141 includes one or more processing cores, and the processor 141 executes various functional applications and information processing by running software programs and modules.

Transceiver 142 includes a receiver and a transmitter. Optionally, transceiver 142 is a communication chip.

In one example, the core network device 1413 further includes: a memory and a bus. The memory is connected to the processor through a bus. The memory can be used to store a computer program, and the processor is used to execute the computer program, so as to implement various steps performed by the core network device in the above method embodiments.

Furthermore, the memory may be implemented by any type or combination of volatile or non-volatile storage devices including, but not limited to: RAM and ROM, EPROM, EEPROM, flash memory or other Solid-state storage technology, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices. in:

The transceiver 142 is configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first terminal device. The security key used in the multicast service group, the first multicast service group is used to perform the first multicast service.

In one example, the key update message includes at least one of the following: an updated key calculation parameter, and an updated group key.

In one example, the key calculation parameter includes a random number.

In an example, when the group key corresponding to the first multicast service expires, the key update message includes the updated group key; If the key is not expired, the key update message includes the updated key calculation parameter.

In an example, the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following: a multicast service in V2X, a group in ProSe broadcast service, MBMS.

In one example, the security key includes a traffic key; and the first multicast service includes MBMS.

In an example, the transceiver 142 is configured to receive a service withdrawal request from the second terminal device; the processor 141 is configured to withdraw all services from the first multicast service group according to the service withdrawal request. the second terminal device.

In an example, the service withdrawal request includes at least one of the following items: a multicast service group identifier, and an identifier of the first terminal device.

In an example, the transceiver 142 is configured to send a service withdrawal response to the second terminal device, where the service withdrawal response is used to instruct the second terminal device to withdraw from the first multicast service group Finish.

Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a terminal device to implement the first terminal device side key as described above. Update method.

Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a core network device, so as to implement the above-mentioned core network device side key Update method.

An embodiment of the present application further provides a chip, where the chip includes a programmable logic circuit and/or program instructions, and when the chip runs on a terminal device, it is used to implement the above-mentioned first method for updating a key on the terminal device side .

An embodiment of the present application further provides a chip, where the chip includes a programmable logic circuit and/or program instructions, and when the chip runs on a core network device, it is used to implement the above method for updating a key on the core network device side .

The embodiments of the present application further provide a computer program product, which, when the computer program product runs on the terminal device, causes the computer to execute the above-mentioned first method for updating the key on the side of the terminal device.

The embodiment of the present application also provides a computer program product, which when the computer program product runs on the core network device, causes the computer to execute the above-mentioned method for updating the key on the side of the core network device.

Those skilled in the art should realize that, in one or more of the above examples, the functions described in the embodiments of the present application may be implemented by hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

The above are only exemplary embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection of the present application. within the range.

Claims (44)

1. A key update method, characterized in that, applied to a first terminal device, the method comprising:

   Receive a key update message from a network device;

   According to the key update message, the security key used by the first terminal device in the first multicast service group is updated, and the first multicast service group is used for performing the first multicast service.
2. The method according to claim 1, wherein, according to the key update message, updating the security key used by the first terminal device in the first multicast service group comprises:

   updating the service key corresponding to the first multicast service according to the key update message;

   The security key is updated according to the updated service key.
3. The method according to claim 2, wherein the key update message includes at least one of the following: an updated key calculation parameter and an updated group key.
4. The method according to claim 3, wherein the key calculation parameter comprises a random number.
5. The method of claim 2, wherein:

   When the group key corresponding to the first multicast service expires, the key update message includes the updated group key;

   In the case that the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.
6. The method according to any one of claims 2 to 5, wherein the first multicast service includes any one of the following: a multicast service in the vehicle wireless communication technology V2X, and a short-range communication service ProSe. Multicast service, multimedia broadcast multicast service MBMS.
7. The method according to any one of claims 2 to 5, wherein the service key comprises a service key; and the first multicast service comprises MBMS.
8. The method according to any one of claims 1 to 5, wherein the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following Items: multicast service in V2X, multicast service in ProSe, MBMS.
9. The method according to any one of claims 1 to 5, wherein the security key comprises a traffic key; and the first multicast service comprises MBMS.
10. A key update method, characterized in that, applied to core network equipment, the method comprising:

    When the first multicast service group is updated, send a key update message to the first terminal device, where the key update message is used to update the security code used by the first terminal device in the first multicast service group key, the first multicast service group is used to perform the first multicast service.
11. The method according to claim 10, wherein the key update message includes at least one of the following: an updated key calculation parameter and an updated group key.
12. The method of claim 11, wherein the key calculation parameter comprises a random number.
13. The method of claim 10, wherein:

    When the group key corresponding to the first multicast service expires, the key update message includes the updated group key;

    In the case that the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.
14. The method according to any one of claims 10 to 13, wherein the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following Items: Multicast service in vehicle wireless communication technology V2X, multicast service in short-range communication service ProSe, multimedia broadcast multicast service MBMS.
15. The method according to any one of claims 10 to 13, wherein the security key comprises a traffic key; and the first multicast service comprises MBMS.
16. The method according to any one of claims 10 to 15, wherein the method further comprises:

    receiving a service cancellation request from the second terminal device;

    According to the service revocation request, the second terminal device is revoked from the first multicast service group.
17. The method according to claim 16, wherein the service revocation request comprises at least one of the following: a multicast service group identifier and an identifier of the first terminal device.
18. The method according to claim 10 or 17, wherein the method further comprises:

    Sending a service revocation response to the second terminal device, where the service revocation response is used to instruct the second terminal device to complete the revocation from the first multicast service group.
19. The method according to any one of claims 10 to 18, wherein the method further comprises:

    In the case that the subscription service of the third terminal device for the first multicast service expires, the third terminal device is withdrawn from the first multicast service group.
20. The method according to claim 19, wherein after the revocation of the third terminal device from the first multicast service group, the method further comprises:

    Sending revocation prompt information to the third terminal device, where the revocation prompt information is used to instruct the third terminal device to complete the revocation from the first multicast service group.
21. A key update device, characterized in that it is set in a first terminal device, and the device includes:

    a message receiving module for receiving a key update message from a network device;

    A key update module, configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first group broadcast business.
22. The device according to claim 21, wherein the key update module is used for:

    updating the service key corresponding to the first multicast service according to the key update message;

    The security key is updated according to the updated service key.
23. The apparatus according to claim 22, wherein the key update message includes at least one of the following: an updated key calculation parameter and an updated group key.
24. The apparatus of claim 23, wherein the key calculation parameter comprises a random number.
25. The apparatus of claim 22, wherein:

    When the group key corresponding to the first multicast service expires, the key update message includes the updated group key;

    In the case that the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.
26. The device according to any one of claims 22 to 25, wherein the first multicast service includes any one of the following: a multicast service in the vehicle wireless communication technology V2X, a short-range communication service ProSe Multicast service, multimedia broadcast multicast service MBMS.
27. The apparatus according to any one of claims 22 to 25, wherein the service key comprises a service key; and the first multicast service comprises MBMS.
28. The apparatus according to any one of claims 21 to 25, wherein the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following Items: multicast service in V2X, multicast service in ProSe, MBMS.
29. The apparatus according to any one of claims 21 to 25, wherein the security key comprises a traffic key; and the first multicast service comprises MBMS.
30. A key update device, characterized in that it is set in core network equipment, and the device includes:

    A message sending module, configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first multicast The security key used in the service group, the first multicast service group is used to perform the first multicast service.
31. The apparatus according to claim 30, wherein the key update message includes at least one of the following: an updated key calculation parameter and an updated group key.
32. The apparatus of claim 31, wherein the key calculation parameter comprises a random number.
33. The apparatus of claim 30, wherein:

    When the group key corresponding to the first multicast service expires, the key update message includes the updated group key;

    In the case that the group key corresponding to the first multicast service has not expired, the key update message includes the updated key calculation parameter.
34. The apparatus according to any one of claims 30 to 33, wherein the security key includes at least one of the following: an encryption key and an integrity protection key; the first multicast service includes any one of the following Items: multicast service in V2X, multicast service in ProSe, MBMS.
35. The apparatus according to any one of claims 30 to 33, wherein the security key comprises a traffic key; or the first multicast service comprises MBMS.
36. The device according to any one of claims 30 to 35, wherein the device further comprises:

    a request receiving module, configured to receive a service cancellation request from the second terminal device;

    A first device revocation module, configured to revoke the second terminal device from the first multicast service group according to the service revocation request.
37. The apparatus according to claim 36, wherein the service cancellation request comprises at least one of the following: a multicast service group identifier and an identifier of the first terminal device.
38. The device according to claim 36 or 37, wherein the device further comprises:

    A response sending module, configured to send a service revocation response to the second terminal device, where the service revocation response is used to instruct the second terminal device to complete the revocation from the first multicast service group.
39. The device according to any one of claims 30 to 38, wherein the device further comprises:

    A second device revocation module, configured to revoke the third terminal device from the first multicast service group when the subscription service of the third terminal device for the first multicast service expires.
40. The apparatus of claim 39, wherein the apparatus further comprises:

    The prompt information sending module is configured to send revocation prompt information to the third terminal device, where the revocation prompt information is used to instruct the third terminal device to complete the revocation from the first multicast service group.
41. A terminal device, characterized in that the terminal device comprises: a processor, and a transceiver connected to the processor; wherein:

    the transceiver for receiving a key update message from a network device;

    The processor is configured to update the security key used by the first terminal device in the first multicast service group according to the key update message, and the first multicast service group is used to perform the first group broadcast business.
42. A core network device, characterized in that the core network device comprises: a processor, and a transceiver connected to the processor; wherein:

    The transceiver is configured to send a key update message to the first terminal device when the first multicast service group is updated, where the key update message is used to update the first terminal device in the first group. The security key used in the multicast service group, the first multicast service group is used to perform the first multicast service.
43. A computer-readable storage medium, characterized in that a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a terminal device, so as to realize the method according to any one of claims 1 to 9. Key update method.
44. A computer-readable storage medium, characterized in that, a computer program is stored in the storage medium, and the computer program is used to be executed by a processor of a core network device, so as to realize any one of claims 10 to 20. key update method.

Images