WO2023072271A1

WO2023072271A1 - Method and apparatus for managing security context

Info

Publication number: WO2023072271A1
Application number: PCT/CN2022/128421
Authority: WO
Inventors: 杨林平; 胡文; 强鹂
Original assignee: 华为技术有限公司
Priority date: 2021-10-30
Filing date: 2022-10-28
Publication date: 2023-05-04
Also published as: CN116074828A

Abstract

The present application provides a method and apparatus for managing a security context. The method comprises: a terminal device sends a registration request message to a target mobility management network element, the registration request message comprising an identifier of the terminal device; the terminal device receives a non-access stratum (NAS) security mode command message from the target mobility management network element, the NAS security mode command message comprising horizontal derivation indication information; according to the horizontal derivation indication information, the terminal device generates a new key Kamf' according to a key Kamf in a first security context, wherein the first security context is a current security context of the terminal device; and in the case that a registration process is not successfully completed, the terminal device uses the first security context as the current security context. According to the solution, the problem of inconsistency between security contexts of a UE and a network side can be avoided.

Description

Method and apparatus for managing security context

This application claims priority to a Chinese patent application with application number 202111278501.2 and application title "Method and Apparatus for Managing Security Context" filed with the China Patent Office on October 30, 2021, the entire contents of which are incorporated herein by reference .

technical field

The present application relates to the field of communication technologies, and in particular to a method and device for managing a security context.

Background technique

In the fifth generation (the 5th generation) communication system, the access and mobility management function (AMF) is mainly used for UE registration, connection, mobility management, subscription information authentication, etc. When the user equipment UE moves from the area of one AMF (marked as the source AMF) to the area of another AMF (marked as the target AMF) (this refers to the location change of the UE in the idle state), the UE needs to register through the network registration process onto the target AMF. However, according to the existing technical specifications, if the network registration process of the UE fails due to some reasons at this time, it may cause inconsistency between the security contexts of the UE and the source AMF on the network side. In this case, the registration request of the UE cannot pass the integrity protection check of the NAS, so that the session information of the session established by the UE through the source AMF cannot be migrated to the target AMF, which may cause the previously established PDU session to be deleted. freed.

Therefore, in a mobile registration scenario, how to avoid problems caused by inconsistencies between security contexts of the UE and the network side.

Contents of the invention

The present application provides a method and device for managing a complete context, which can avoid the problem of inconsistency between the security context of the UE and the network side.

In a first aspect, a method for managing a security context is provided, the method comprising: a terminal device sends a registration request message to a target mobility management network element, where the registration request message includes an identifier of the terminal device; the terminal device receives a message from the target mobile The NAS security mode command message of the management network element, the NAS security mode command message includes horizontal derivation indication information; according to the horizontal derivation indication information, the terminal device generates a new key Kamf according to the first security context Key Kamf'; wherein, the first security context is the current security context of the terminal device; if the registration process is not successfully completed, the terminal device uses the first security context as the current security context.

Based on the above solution, in the registration process of the terminal device, if the terminal device performs horizontal key derivation, that is, uses the key Kamf in the first security context to perform horizontal deduction to obtain a new key Kamf', if the registration process is not successful After completion (or failure of the registration process), the terminal device uses the first security context as the current security context, thereby avoiding the problem of inconsistent security contexts between the terminal device and the network side. Therefore, in this case, when the registration process is not successfully completed, the terminal device can use the first security context to initiate the registration process again.

With reference to the first aspect, in some implementation manners of the first aspect, the method further includes: after the terminal device generates the new key Kamf', maintaining the first security context and the second security context; wherein, the The second security context includes the Kamf' and a NAS key, and the NAS key is generated according to the Kamf'.

Based on the above solution, after the terminal device performs horizontal key derivation, it can maintain the first security context and the second security context at the same time. In this case, regardless of whether the registration is successful or the registration fails, the terminal can select an appropriate security context. In order to avoid inconsistency between the security context on the terminal side and the security context on the network side.

With reference to the first aspect, in some implementation manners of the first aspect, maintaining the first security context and the second security context includes: the terminal device continues to use the first security context as the current security context, and saves the second security context. Two security contexts.

Based on the above solution, after performing horizontal key derivation, the terminal device can maintain the first security context as the current security context and save the second security context. In this case, whether the registration is successful or the registration fails, the terminal can choose Appropriate security context. For example, if the registration is successful, the terminal device can set the second security context as the current security context; if the registration fails, the terminal device can delete the second security context, and use the first security context for subsequent possible registration processes, so as to avoid terminal side The security context of the network side is inconsistent with the security context of the network side.

With reference to the first aspect, in some implementations of the first aspect, if the registration process is not successfully completed, the terminal device uses the first security context as the current security context, including: the terminal device continues to use the first security context A security context is used as the current security context, and the second security context is deleted.

Based on the above solution, after the terminal device performs horizontal key derivation, when the terminal device maintains the first security context as the current security context and saves the second security context, in this case, if the registration fails, the terminal device can continue to use The first security context is used as the current security context, so when the UE fails to register, it is also possible to avoid inconsistency between the security contexts on the terminal side and the network side.

With reference to the first aspect, in some implementation manners of the first aspect, maintaining the first security context and the second security context includes: the terminal device saves the first security context, and uses the second security context as the current security context.

Based on the above scheme, after performing horizontal key derivation, the terminal device can save the first security context and set the second security context as the current security context. In this case, regardless of whether the registration is successful or the registration fails, the terminal can choose Appropriate security context. For example, if the registration is successful, the terminal device can maintain the second security context as the current security context and delete the first security context; if the registration fails, the terminal device can set the first security context as the current security context, so that the first security context can be used Performing subsequent possible registration processes can avoid inconsistency between the security context on the terminal side and the security context on the network side.

With reference to the first aspect, in some implementation manners of the first aspect, if the registration process is not successfully completed, the terminal device uses the first security context as the current security context, including: the terminal device uses the first The security context is set as the current security context, and the second security context is deleted.

Based on the above solution, after the terminal device performs horizontal key derivation, when the terminal device sets the second security context as the current security context and saves the first security context, in this case, if the registration fails, the terminal device can save the The first security context of the UE is set as the current security context, so when the UE fails to register, it is also possible to avoid inconsistency between the security contexts on the terminal side and the network side.

With reference to the first aspect, in some implementation manners of the first aspect, the method further includes: the terminal device determines that the registration process is not successfully completed.

Based on the above solution, the terminal device can determine or judge whether the registration process fails. If the registration process is not successfully completed (or the registration process fails), the terminal device will set or maintain the first security context as the current security context, so that the first security context can be used. The security context is used to carry out subsequent possible registration processes, so as to avoid the failure of the registration process caused by the inconsistency of the security contexts on the terminal side or the network side in the subsequent registration process.

With reference to the first aspect, in some implementation manners of the first aspect, the terminal device determining that the registration process has not been successfully completed includes: the terminal device determines that the NAS security mode completion message fails to be sent before receiving the registration acceptance message; or , the terminal device determines that the link between itself and the access network device is released before receiving the registration acceptance message; the terminal device determines that the RRC connection between itself and the access network device is suspended before receiving the registration acceptance message rise or release.

Based on the above technical solution, before receiving the registration acceptance message, the terminal device can determine whether the registration process is complete according to whether the NAS security mode completion message is successfully sent, or whether the link is released abnormally, or whether the RRC connection is suspended or released, etc. fail. If the registration process is not successfully completed, the terminal device will set or maintain the first security context as the current security context, so that the first security context can be used for subsequent possible registration processes, and the subsequent registration process can be avoided due to the failure of the terminal side or the network side. Cases where the registration process fails due to inconsistent security contexts.

In a second aspect, a method for managing a security context is provided, the method comprising: a source mobility management network element receives a context request message from a target mobility management network element, and the context request message is used to request to obtain a context of a terminal device; In the case of horizontal key derivation, the source mobility management network element generates a new key Kamf' according to the key Kamf in the first security context; where the first security context is the source mobility management network element and the The current security context between terminal devices; in response to the context request message, the source mobility management network element sends a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf' and a NAS key, where the NAS key is generated according to the Kamf'; the source mobility management network element maintains the first security context and/or the second security context.

Based on the above solution, after the source mobility management network element performs horizontal key derivation, it can maintain the first security context and/or the second security context.

Specifically, for the source mobility management network element, after horizontal deduction, the first security context may be maintained as the current security context, and the second security context may be deleted. In this case, the source mobility management network element always uses the first security context, which can avoid context inconsistency between the network side and the terminal side. The source mobility management network element can use the first security context to perform security verification on subsequent possible registration requests of the terminal device, and this solution can prevent registration failures caused by inconsistencies between the security context on the network side and the terminal side.

It is also possible to set the second security context as the current security context and delete the first security context. In this case, after the source mobility management network element generates the second security context, it sets the second security context as the current security context. In the case that the terminal device generates the second security context and then sets the second security context as the current security context, problems caused by inconsistencies between the security contexts of the terminal device and the network side can be avoided.

It is also possible to maintain the first security context as the current security context and save the second security context; or set the second security context as the current security context and save the first security context. In these two cases, no matter whether the terminal device uses the first security context or the second security context as the current security context after horizontal deduction, it can ensure that the source mobility management network element side holds the corresponding security context, thereby avoiding network The problem that the security protection verification of the registration request of the terminal device cannot be successfully verified on the side.

With reference to the second aspect, in some implementations of the second aspect, when the source mobility management network element maintains the first security context and the second security context, the method further includes: the source mobility management network The element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, and the registration request message includes the terminal device's identification; the source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message; If the message security verification is successful and horizontal key derivation is required, the source mobility management network element generates a new key Kamf" based on the key in the security context of the successful verification, and sends it to the target mobility management network element A third security context, the third security context includes the new key Kamf".

Based on the above technical solution, when the source mobility management network element maintains the first security context and the second security context, if the source mobility management network element receives a context request message from another target mobility management network element, the source mobility management network element The unit can respectively use the first security context and the second security context to perform security verification on the registration request message carried in the context request message, so as to avoid the problem of verification failure caused by inconsistent security contexts on the terminal side and the network side.

With reference to the second aspect, in some implementations of the second aspect, when the source mobility management network element maintains the first security context and the second security context, the method further includes: the source mobility management network The element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, and the registration request message includes the terminal device's identification; the source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message; If the message security verification is successful and no horizontal key derivation is required, the source mobility management network element sends the security context of successful verification to the target mobility management network element.

With reference to the second aspect, in some implementations of the second aspect, the method further includes: the source mobility management network element receiving registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the The terminal device is successfully registered to the network; the source mobility management network element deletes the first security context and/or the second security context.

Based on the above technical solution, the source mobility management network element can delete the security context it maintains after receiving the registration success indication information, so as to save resources.

With reference to the second aspect, in some implementations of the second aspect, the method further includes: the source mobility management network element receives a de-registration notification message, and the de-registration notification message is used to instruct the source mobility management network element to execute the terminal De-registration of the device: the source mobility management network element deletes the first security context and/or the second security context.

Based on the above technical solution, after receiving the de-registration notification message, the source mobility management network element can delete the security context it maintains, thereby saving resources.

With reference to the second aspect, in some implementation manners of the second aspect, the method further includes: after a preset time, the source mobility management network element deletes the first security context and/or the second security context.

Based on the above technical solution, the source mobility management network element can delete the security context it maintains after the preset time elapses, thereby saving resources.

With reference to the second aspect, in some implementation manners of the second aspect, when the source mobility management network element maintains the first security context, the method further includes: the source mobility management network element deleting the second security context.

Based on the above technical solution, when the source mobility management network element maintains the first security context as the current security context, the second security context can be deleted, thereby saving resources.

In a third aspect, a method for managing a security context is provided, the method comprising: a target mobility management network element receiving a registration request message from a terminal device, where the registration request message includes an identity of the terminal device; the target mobility management network element Sending a context request message to the source mobility management network element, where the context request message is used to request to obtain the context of the terminal device; the target mobility management network element receives a context response message from the target mobility management network element, and the context response message includes security Context and horizontal derivation indication information; the target mobility management network element sends a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes the horizontal derivation indication information, and the horizontal derivation indication information is used to indicate the The terminal device performs horizontal key derivation; the target mobility management network element receives the security-protected NAS security mode completion message from the terminal device; the target mobility management network element uses the security context to secure the NAS security mode completion message Verifying: if the verification is successful, the target mobility management network element sends instruction information to the source mobility management network element, where the instruction information is used to instruct the source mobility management network element to delete the context of the terminal device.

Based on the above technical solution, after the target mobility management network element successfully verifies the NAS security mode message from the terminal device, only the source mobility management network element can delete the context of the terminal device, thereby saving resources and reducing the possibility of key leakage , improve security.

In a fourth aspect, an apparatus for managing a security context is provided, and the apparatus includes: a transceiver module configured to send a registration request message to a target mobility management network element, where the registration request message includes an identity of the terminal device; the transceiver module further For receiving a non-access stratum NAS security mode command message from the target mobility management network element, the NAS security mode command message includes horizontal derivation indication information; the processing module is used for, according to the key Kamf in the first security context, Generate a new key Kamf'; wherein, the first security context is the current security context of the terminal device; the processing module is also used to use the first security context as the current security context if the registration process is not successfully completed. context.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is further configured to: after generating the new key Kamf', maintain the first security context and the second security context; wherein, the second The security context includes the Kamf' and a NAS key, and the NAS key is generated according to the Kamf'.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is specifically configured to: continue to use the first security context as the current security context, and save the second security context.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is specifically configured to: continue to use the first security context as the current security context, and delete the second security context.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is specifically configured to: the terminal device saves the first security context, and uses the second security context as a current security context.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is specifically configured to: the terminal device sets the first security context as the current security context, and deletes the second security context.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is further configured to: the terminal device determines that the registration process has not been successfully completed.

With reference to the fourth aspect, in some implementations of the fourth aspect, the processing module is specifically configured to: before the transceiver module receives the registration acceptance message, determine that the NAS security mode completion message fails to be sent; or, before the transceiver module receives the registration acceptance message; Before accepting the message, it is determined that the link between itself and the access network device is released; before the transceiver module receives the registration acceptance message, it is determined that the RRC connection between itself and the access network device is suspended or released.

In a fifth aspect, an apparatus for managing security context is provided, and the method includes: a transceiver module, configured to receive a context request message from a target mobility management network element, where the context request message is used to request to obtain a context of a terminal device; a processing module , used to generate a new key Kamf' according to the key Kamf in the first security context when horizontal key derivation is required; where the first security context is the source mobility management network element and the device The current security context between; the transceiver module is also used to send a second security context to the target mobility management network element; wherein, the second security context includes the new key Kamf' and the NAS key, the NAS key Generated according to the Kamf'; the processing module is also used to maintain the first security context and/or the second security context.

With reference to the fifth aspect, in some implementation manners of the fifth aspect, the transceiving module is further configured to: receive a context request message from another target mobility management network element, where the context request message is used to request the context of the terminal device, the The context request message includes a security-protected registration request message, the registration request message includes the identity of the terminal device; a processing module, configured to use the first security context and the second security context to perform security verification on the registration request message ; In the case that the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is required, the processing module is also used to The key in is used to generate a new key Kamf", and the transceiver module is also used to send a third security context to the target mobility management network element, where the third security context includes the new key Kamf".

With reference to the fifth aspect, in some implementation manners of the fifth aspect, the transceiving module is further configured to: receive a context request message from another target mobility management network element, where the context request message is used to request the context of the terminal device, the The context request message includes a security-protected registration request message, the registration request message includes the identity of the terminal device; the processing module is also used to use the first security context and the second security context to secure the registration request message Verification; when the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is not required, the transceiver module is also used to move to the target The management network element sends the security context of successful authentication.

With reference to the fifth aspect, in some implementations of the fifth aspect, the transceiver module is further configured to: receive registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network; the processing module is further configured to: delete the first security context and/or the second security context.

With reference to the fifth aspect, in some implementations of the fifth aspect, the transceiver module is further configured to: receive a de-registration notification message, where the de-registration notification message is used to instruct the source mobility management network element to perform de-registration of the terminal device ; The processing module is also used to: delete the first security context and/or the second security context.

With reference to the fifth aspect, in some implementation manners of the fifth aspect, the processing module is further configured to: delete the first security context and/or the second security context after a preset time.

With reference to the fifth aspect, in some implementation manners of the fifth aspect, when the processing module maintains the first security context, the processing module is further configured to: delete the second security context.

According to the sixth aspect, an apparatus for managing a security context is provided, which includes: a transceiver module, configured to receive a registration request message from a terminal device, where the registration request message includes the identity of the terminal device; The source mobility management network element sends a context request message, where the context request message is used to request to acquire the context of the terminal device; the transceiver module is also used to receive a context response message from the target mobility management network element, where the context response message includes a security context and horizontal derivation indication information; the transceiver module is also used to send a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes the horizontal derivation indication information, and the horizontal derivation indication information is used to instruct the terminal The device performs horizontal key derivation; the transceiver module is also used to receive a security-protected NAS security mode completion message from the terminal device; the processing module is also used to use the security context to perform security verification on the NAS security mode completion message ; If the verification is successful, the transceiver module is further configured to send indication information to the source mobility management network element, where the indication information is used to instruct the source mobility management network element to delete the context of the terminal device.

In a seventh aspect, a communication device is provided, and the device is configured to execute the methods provided in the first aspect to the fifth aspect. Specifically, the apparatus may include a unit and/or module for executing the methods provided in the first aspect to the third aspect, such as a processing unit and/or a communication unit.

In an implementation manner, the apparatus is a network device, for example, the apparatus is a source mobility management network element or a target mobility management network element. When the device is a network device, the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.

In another implementation manner, the apparatus is a chip, a chip system or a circuit used in a network device. When the device is a chip, chip system or circuit used in communication equipment, the communication unit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit etc.; the processing unit may be a processor, a processing circuit or a logic circuit and the like.

In one possible situation, the device is the source mobility management network element or a chip, chip system or circuit in the source mobility management network element. In this case, the device may include units and/or modules for performing the method provided by the second aspect, such as a processing unit and/or a communication unit.

In another possible situation, the device is a chip, a chip system or a circuit in the target mobility management network element. In this case, the apparatus may include units and/or modules for executing the method provided by the third aspect, such as a processing unit and/or a communication unit.

In another implementation manner, the apparatus is a terminal device. When the device is a terminal device, the communication unit may be a transceiver, or an input/output interface; the processing unit may be a processor.

In one possible situation, the device is the terminal device (10) or a chip, a chip system or a circuit in the terminal device (10). In this case, the apparatus may include units and/or modules for performing the method provided in any one of the first aspects, such as a processing unit and/or a communication unit.

Optionally, the above-mentioned transceiver may be a transceiver circuit. Optionally, the above input/output interface may be an input/output circuit.

In an eighth aspect, there is provided a communication device, which includes: a memory for storing a program; a processor for executing the program stored in the memory, and when the program stored in the memory is executed, the processor is used for executing the above-mentioned first aspect to The method provided by the third aspect.

In a ninth aspect, the present application provides a processor configured to execute the methods provided in the foregoing aspects. In the process of executing these methods, the process of sending the above information and obtaining/receiving the above information in the above method can be understood as the process of outputting the above information by the processor and the process of receiving the input of the above information by the processor. When outputting the above information, the processor outputs the above information to the transceiver for transmission by the transceiver. After the above information is output by the processor, other processing may be required before reaching the transceiver. Similarly, when the processor receives the above-mentioned input information, the transceiver acquires/receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed before being input to the processor.

Based on the above principles, for example, the receiving request message mentioned in the foregoing method may be understood as the processor receiving input information.

For the operations of transmitting, sending, and acquiring/receiving involved in the processor, if there is no special description, or if it does not conflict with its actual function or internal logic in the relevant description, it can be understood more generally as the processor Output and receive, input and other operations, rather than the transmission, transmission and reception operations performed directly by radio frequency circuits and antennas.

During implementation, the above-mentioned processor may be a processor dedicated to performing these methods, or may be a processor that executes computer instructions in a memory to perform these methods, such as a general-purpose processor. The above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged on different chips. The embodiment does not limit the type of the memory and the arrangement of the memory and the processor.

In a tenth aspect, a computer-readable storage medium is provided, where the computer-readable medium stores program code for execution by a device, and the program code includes a method for executing the methods provided in the first aspect to the third aspect above.

In an eleventh aspect, a computer program product containing instructions is provided, and when the computer program product is run on a computer, the computer is made to execute the methods provided in the first aspect to the third aspect above.

A twelfth aspect provides a chip, the chip includes a processor and a communication interface, the processor reads instructions stored in the memory through the communication interface, and executes the methods provided in the first aspect to the third aspect above.

Optionally, as an implementation manner, the chip may further include a memory, the memory stores instructions, the processor is used to execute the instructions stored in the memory, and when the instructions are executed, the processor is used to execute the above-mentioned first The method provided by the first aspect to the third aspect.

Description of drawings

Fig. 1 is a schematic diagram of a network structure applicable to the embodiment of the present application.

Fig. 2 is a schematic flowchart of a method for registering a terminal device.

Fig. 3 is an exemplary flow chart of a method for managing a security context provided by an embodiment of the present application.

Fig. 4 is an exemplary flowchart of another method for managing a security context provided by an embodiment of the present application.

Fig. 5 is an exemplary flow chart of another method for managing a security context provided by an embodiment of the present application.

Fig. 6 is an exemplary flow chart of another method for managing a security context provided by an embodiment of the present application.

Fig. 7 is a schematic block diagram of an apparatus for managing a security context provided by an embodiment of the present application.

Fig. 8 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.

Fig. 9 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.

Fig. 10 is a schematic block diagram of an apparatus for managing a security context provided by another embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described below in conjunction with the accompanying drawings. The specific operation methods in the method embodiments can also be applied to the device embodiments or system embodiments. Wherein, in the description of the present application, unless otherwise specified, "plurality" means two or more.

In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and/or descriptions between different embodiments are consistent and can be referred to each other, and the technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

It can be understood that the various numbers involved in the application are only for the convenience of description, and are not used to limit the scope of the application. The size of the serial numbers of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic.

The terms "first", "second", "third", "fourth" and other term labels (if any) in the description and claims of the application and the above drawings are used to distinguish similar objects without necessarily being used to describe a particular order or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

In order to solve the problems mentioned in the background technology, as shown in (a) of FIG. 1 , the present application provides a communication system, which includes a target mobility management network element 10 and a source mobility management network element 20 . Wherein, the target mobility management network element 10 is configured to send a context request message to the source mobility management network element after receiving the registration request message from the terminal device; receive a context response message from the target mobility management network element, and the context response The message includes the context information of the terminal device, and the context information of the terminal device includes security context and horizontal game indication information. It should be understood that the context information may also include other information, which is not limited in this application, and may refer to existing protocols for details; further, the target mobility management network element 10 sends a non-access stratum NAS security mode command message to the terminal device, and the The NAS security mode command message includes the horizontal derivation instruction information, and the horizontal derivation instruction information is used to instruct the terminal device to perform horizontal key derivation; after receiving the NAS security mode completion message from the terminal device, use the security context to secure the NAS mode completion message for security verification; after the verification is successful, if the registration process of the terminal device is successfully completed, the target mobility management network element sends instruction information to the source mobility management network element, and the instruction information is used to instruct the source mobility management network element to delete The context of this end device. The source mobility management network element 20 is used to request to obtain the context of the terminal device after receiving the context request message from the target mobility management network element; if horizontal key derivation is required, according to the first The key Kamf in the security context generates a new key Kamf'; wherein, the first security context is the current security context between the source mobility management network element and the terminal device; in response to the context request message, send the The target mobility management network element sends a second security context; wherein, the second security context includes the new key Kamf' and a NAS key, and the NAS key is generated according to the Kamf'; maintaining the first security context and/or The second security context. Optionally, the communication system may further include one or more terminal devices, such as the terminal device 30 . The terminal device 30 is configured to: send a registration request message to the target mobility management network element, where the registration request message includes the identifier of the terminal device; receive a non-access stratum NAS security mode command message from the target mobility management network element, and the NAS The security mode command message includes horizontal derivation instruction information; according to the horizontal derivation instruction information, a new key Kamf' and a new NAS key are generated according to the key Kamf in the first security context; wherein, the first security context is The current security context of the terminal device; if the registration process is not successfully completed, use the first security context as the current security context.

It should be understood that the names of the network elements in the above communication system are only used as examples, and do not cause any limitation. In the above system, both the target mobility management network element 10 and the source mobility management network element 20 are network elements for implementing mobility management and access management functions, wherein the target mobility management network element 10 may be a terminal device 30 requesting registration The source mobility management network element 20 may be the mobility management network element that provides services for the terminal device 30 before the terminal device 30 requests to register with the target mobility management network element 10 . Before the terminal device 30 requests to register with the target mobility management network element, the terminal device 30 has already registered with the source mobility management network element through a registration process. The above network element names are only used to distinguish different network elements. In different scenarios or examples, they may also have other names. In other words, network elements that implement the same function should be within the scope of protection of this application.

It should be understood that, for a specific interaction process between network elements in (a) of FIG. 1 , reference may be made to the method flow in FIG.

The technical solution provided by this application can be applied to various communication systems, such as: the fifth generation (5th generation, 5G) or new radio (new radio, NR) system, long term evolution (long term evolution, LTE) system, LTE frequency division Duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, etc. The technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The technical solution provided by this application can also be applied to device to device (device to device, D2D) communication, vehicle to everything (vehicle-to-everything, V2X) communication, machine to machine (machine to machine, M2M) communication, machine type Communication (machine type communication, MTC), and Internet of things (internet of things, IoT) communication system or other communication systems.

As shown in (b) of FIG. 1 , it is a schematic diagram of a fifth generation (5th generation, 5G) network architecture based on a service architecture.

The 5G network architecture shown in (b) of FIG. 1 may include three parts, namely a terminal device part, a data network (data network, DN) and an operator network part. The functions of some of the network elements are briefly introduced and described below.

Wherein, the operator network may include one or more of the following network elements: authentication server function (authentication server function, AUSF) network element, network exposure function (network exposure function, NEF) network element, policy control function (policy control function, PCF) network element, unified data management (unified data management, UDM) network element, unified database (unified data repository, UDR), network storage function (network repository function, NRF) network element, application function (application function, AF) ) network elements, access and mobility management function (access and mobility management function, AMF) network elements, session management function (session management function, SMF) network elements, radio access network (radioaccess network, RAN) and user plane functions (user plane function, UPF) network element, etc. In the above operator network, the part other than the radio access network part may be referred to as the core network part.

1. Terminal device: it can also be called user equipment (UE), which is a device with wireless transceiver function, which can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed in On the water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.). The terminal device may be a mobile phone, a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control ), wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, etc. The terminal device here refers to a 3rd generation partnership project (3rd generation partnership project, 3GPP) terminal. For ease of description, the following descriptions in this application will take UE as an example to refer to terminal equipment.

The above-mentioned terminal device can establish a connection with the operator network through an interface provided by the operator network (such as N1, etc.), and use services such as data and/or voice provided by the operator network. The terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN, and/or the service provided by a third party. Wherein, the above-mentioned third party may be a service party other than the operator's network and the terminal device, and may provide other services such as data and/or voice for the terminal device. Among them, the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.

2. Wireless access network (radio access network, RAN) network element: hereinafter referred to as RAN, corresponding to access network equipment.

The RAN is a sub-network of the operator's network and an implementation system between service nodes and terminal equipment in the operator's network. To access the operator's network, the terminal equipment first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN. The RAN device in this application is a device that provides a wireless communication function for a terminal device, and the RAN device is also called an access network device. The RAN equipment in this application includes but is not limited to: next-generation base station (g nodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.

3. User plane function (UPF): used for packet routing and forwarding and quality of service (QoS) processing of user plane data.

In a 5G communication system, the user plane network element may be a user plane function (user plane function, UPF) network element. In the future communication system, the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.

4. Access and mobility management network elements

The access and mobility management network element is mainly used for mobility management and access management, etc., and can be used to implement other functions in the MME function except session management, for example, functions such as access authorization/authentication.

In a 5G communication system, the access and mobility management network element may be an access and mobility management function (access and mobility management function, AMF). In the future communication system, the access and mobility management device may still be an AMF, or may have other names, which are not limited in this application.

5. Session management function (session management function, SMF): mainly used for session management, user equipment network interconnection protocol (internet protocol, IP) address allocation and management, selection of manageable user plane functions, policy control and charging function interface endpoints and downlink data notifications, etc.

In a 5G communication system, the session management network element may be a session management function network element. In the future communication system, the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.

6. Policy control function (PCF): A unified policy framework for guiding network behavior, providing policy rule information for control plane functional network elements (such as AMF, SMF, etc.).

In the 4G communication system, the policy control network element may be a policy and charging rules function (policy and charging rules function, PCRF) network element. In a 5G communication system, the policy control network element may be a policy control function PCF network element. In the future communication system, the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.

7. Application function (Application function, AF): It is used for data routing affected by applications, open function network elements of wireless access networks, and interacts with policy frameworks for policy control, etc.

In a 5G communication system, the application network element may be an application function network element. In the future communication system, the application network element may still be an AF network element, or may have other names, which are not limited in this application.

8. Unified data management (UDM): used to process UE identification, access authentication, registration and mobility management.

In a 5G communication system, the data management network element may be a unified data management network element; in a 4G communication system, the data management network element may be a home subscriber server (HSS) network element. In future communication systems, The unified data management may still be a UDM network element, or may have other names, which are not limited in this application.

9. Authentication server function (AUSF): used for authentication services, generating keys to realize two-way authentication of user equipment, and supporting a unified authentication framework.

In a 5G communication system, the authentication server may be an authentication server functional network element. In the future communication system, the authentication server functional network element may still be an AUSF network element, or may have other names, which are not limited in this application.

10. Data network (data network, DN): DN is a network located outside the operator's network. The operator's network can access multiple DNs, and multiple services can be deployed on the DN, which can provide data and/or voice for terminal equipment. and other services. For example, DN is a private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminal devices. The control server of the sensor is deployed in the DN, and the control server can provide services for the sensor. The sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is a company's internal office network, and the mobile phone or computer of the company's employees can be a terminal device, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.

In (b) of FIG. 1 , Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For the meanings of these interface serial numbers, refer to the meanings defined in the 3GPP standard protocol, and there is no limitation here.

In the network architecture shown in (b) of FIG. 1 , various network elements can communicate through the interfaces shown in the figure. As shown in the figure, the UE and the AMF can interact through the N1 interface, and the interaction message can be called an N1 message (N1 Message), for example. The RAN and the AMF can interact through the N2 interface, and the N2 interface can be used for sending non-access stratum (non-access stratum, NAS) messages, etc. The RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc. The SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as the tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages. The UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit data on the user plane. The relationship between other interfaces and each network element is shown in FIG. 1 , and for the sake of brevity, details are not described here one by one.

It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only an example network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network element that can implement the above-mentioned All functional network architectures are applicable to this embodiment of the application.

It should also be understood that AMF, SMF, UPF, network slice selection function (network slice selection function, NSSF), NEF, AUSF, NRF, PCF, and UDM shown in FIG. Functional network elements, for example, can be combined into network slices on demand. These core network elements may be independent devices, or may be integrated into the same device to implement different functions. This application does not limit the specific forms of the above network elements.

It should also be understood that the above names are only defined for the convenience of distinguishing different functions, and shall not constitute any limitation to the present application. This application does not exclude the possibility of using other names in the 5G network and other networks in the future. For example, in a 6G network, some or all of the above network elements may use the terms in 5G, or may use other names. The name of the interface between network elements in FIG. 1 is just an example, and the name of the interface in a specific implementation may be another name, which is not specifically limited in this application. In addition, the name of the message (or signaling) transmitted between the above network elements is only an example, and does not constitute any limitation on the function of the message itself.

It can be understood that the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform). For the convenience of description, in the follow-up of this application, the network device is the access and mobility management network element AMF, and the base station is the radio access network RAN as an example for description.

It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only an example, and the network architecture applicable to the embodiment of the present application is not limited thereto. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to this application. Application example.

The network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application. For the evolution of architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

Various aspects or features of the embodiments of the present application may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques. The term "article of manufacture" as used in this application covers a computer program accessible from any computer readable device, carrier or media. For example, computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disk, floppy disk, or tape, etc.), optical disks (e.g., compact disc (compact disc, CD), digital versatile disc (digital versatile disc, DVD) etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.). Additionally, various storage media described herein can represent one or more devices and/or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.

In order to facilitate the understanding of the embodiments of the present application, a brief description of the terms involved in the present application is given first.

1. NAS security context: information that can be used to implement data encryption/decryption and/or integrity protection/verification at the NAS layer.

The NAS security context corresponding to the UE includes: key identifier (eg ngKSI), Kamf, security capability of the UE, uplink NAS COUNT and downlink NAS COUNT. Optionally, the integrity protection key and the selected integrity protection algorithm, the encryption key and the selected encryption algorithm are also included. Among them, the encryption key and the selected encryption algorithm are used to encrypt and protect the NAS message transmitted between the UE and the AMF; the integrity key and the selected integrity protection algorithm are used to protect the NAS message transmitted between the UE and the AMF Integrity protection. The UE's security capability is used to characterize the encryption algorithm and integrity protection algorithm supported by the UE.

In the mobile registration scenario, if the source AMF decides to perform horizontal Kamf deduction according to the local policy, the source AMF can perform horizontal Kamf according to the key Kamf in the current NAS security context and the uplink NAS count value in the received registration request message. Deduce the new key Kamf'. The source AMF may then send the new key Kamf', the new ngKSI, the UE security capabilities and the level derivation indication (keyAmfHDerivationInd) to the target AMF. It should be understood that the new ngKSI here is the same as the previous (ie pre-derivation) ngKSI. If the target AMF decides to use the new key Kamf' received from the source AMF, the target AMF can send a K_AMF_change_flag with a value of 1 to the UE through a NASSMC message, where the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal key derivation. The NASSMC message here also includes UE security capability, selected NAS algorithm and ngKSI. If the UE receives K_AMF_change_flag with a value of 1, the UE performs horizontal Kamf derivation to obtain a new key Kamf'.

2. Current NAS security context (currentNAS security context): the NAS security context in use or active state.

3. Non-current NAS security context (non-current NAS security context): A NAS security context that is not currently in use or is in an inactive state. A method 200 for managing a security context is introduced below with reference to FIG. 2 . The method 200 includes:

201. The UE sends a registration request message to a target AMF.

Due to location movement, the UE triggers a Registration Request message to the network. For example, the UE moves to a new AMF area (denoted as the target AMF), and the registration request message of the UE is delivered to the target AMF. Exemplarily, the UE sends a registration request (registration request, RR) message to a target AMF (target AMF), and the RR message carries an identifier of the UE, such as a 5G globally unique temporary user equipment identity (5G generation globally unique temporary user equipment identity, 5G-GUTI). It should be understood that the UE has protected the integrity of the RR message through the current NAS security context, and the current NAS security context is the NAS security context used by the UE to protect the NAS message transmitted between the UE and the source AMF before the registration process , or the current NAS security context is the NAS security context used by the source AMF before performing horizontal K _AMF deduction in 203 .

202. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the identity of the UE (such as 5G-GUTI), and the Namf_Communication_UEContextTransfer also includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 201 in the Namf_Communication_UEContextTransfer.

203. The source AMF performs horizontal deduction according to the local policy to generate a new NAS security context.

Exemplarily, after receiving the UE context transfer request message, the source AMF acquires UE data (including the current NAS security context corresponding to the UE) in the database according to the UE identifier, and the source AMF uses the current NAS security context to verify the received integrity of the RR message. If the integrity verification of the RR message passes, the source AMF decides whether to deduce a new NAS security context according to the local policy. If the source AMF decides to deduce a new NAS security context, the source AMF performs horizontal K _AMF deduction to obtain a new NAS security context. Specifically, the source AMF uses the currently activated Kamf and the uplink NAScount carried in the registration request message to perform horizontal deduction to obtain a new key Kamf'. The new key Kamf' is included in the security context of the new NAS. The new NAS security context here is relative to the NAS security context before the source AMF performs horizontal deduction. Therefore, at this time, the NAS security context before the source AMF performs horizontal deduction can also be recorded as the old NAS security context.

The source AMF then deletes the NAS security context it holds.

204. The source AMF sends a UE context transfer response message to the target AMF.

Exemplarily, if the source AMF finds the data corresponding to the UE in the database, and performs horizontal key derivation according to the local policy, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the response message carries UE Context, SUPI, horizontal K _AMF derivation indication (keyAmfHDerivationInd indication). The UE context includes a security context. If the source AMF has deduced the horizontal K _AMF according to the local policy, the security context carried in the response message is the new security context deduced by the source AMF in 203 .

205. The target AMF sends a security mode command message to the UE.

Exemplarily, the target AMF receives the UE context transfer response message from the source AMF, and if the response message carries the SUPI of the UE, the target AMF saves the NAS security context carried in the UE context transfer response message. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new NAS security context deduced by the source AMF, the target AMF initiates a non access stratum security mode command (NAS SMC ) message to the UE, which is used to establish the NAS security context between the UE and the target AMF. The security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP). The HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K _AMF derivation. The NASSMC message also includes selected NAS algorithms, including NAS encryption algorithms and NAS integrity protection algorithms.

The target AMF sets the non-access stratum count value (NAScounts) to 0, and derives a new key NASkeys according to the new key Kamf' and the selected NAS algorithm, including the NAS encryption key and the NAS integrity protection key. This new security context is then used to encrypt and integrity-protect the security mode command messages (using derived new NAS keys).

206. The UE performs horizontal deduction to generate a new NAS security context.

Exemplarily, the UE receives a security mode command message from the target AMF. If the security mode command message carries K_AMF_change_flag with a value of 1, the UE performs KAMF deduction based on the key Kamf in the current security context to generate a new key Kamf', thereby obtaining a new NAS security context. The new NAS security context Including the new key Kamf' and the NAS key, the NAS key is generated according to the algorithm generated and selected by the Kamf'. The NAS key includes a NAS encryption key and a NAS integrity key. The UE uses the NAS key in the new NAS security context (specifically, it can be the NAS integrity key in the NAS key) to perform integrity check on the security mode command message, if the security mode command message If the integrity check passes, the UE sends a security mode completion message to the target AMF.

Furthermore, the UE may fail the registration process due to some internal or external reasons. For example, the UE's security mode completion message fails to be sent, or the UE's link is released before the registration is completed, or due to some other reasons, the UE's registration process may fail. In this embodiment, the registration failure caused by the failure to send the security mode completion message of the UE is taken as an example for illustration. Exemplarily, at 207, the UE sends a security mode completion message to the target AMF, but the security mode completion message fails to be sent, the UE receives an underlying instruction, and determines that the security mode completion message fails to be sent according to the underlying instruction.

208. The UE sends a registration request message to the target AMF.

Exemplarily, after the UE determines that the last registration procedure fails, the UE resends the registration request to the target AMF. It should be understood that the UE performs integrity protection on the registration request message.

209. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 208 in the Namf_Communication_UEContextTransfer.

Correspondingly, after the source AMF receives the UE context request from the target AMF, the source AMF performs integrity verification on the received RR message. There may be two situations here that cause the source AMF to fail the integrity verification of the RR message:

In one case, after 204, the source AMF continues to maintain and use the old security context as the current security context, and the UE uses the new security context to perform integrity protection on the registration request message in 208, then the source AMF uses the old security context in 209 The security context verification of the integrity of the RR message will fail;

In another case, after 204, the source AMF deletes the old security context and uses the new security context as the current security context, and the UE uses the old security context to perform integrity protection on the registration request message in 208, then If the source AMF uses the new security context to verify the integrity of the RR message in 209, the verification fails.

If the integrity check fails, the source AMF sends a UE context transfer response message to the target AMF at 210, where the response message is used to indicate that the temporary identifier 5G-GUTI cannot be obtained.

211. The target AMF performs an identity authentication and authentication process with the UE.

Exemplarily, the target AMF receives the UE context transfer response message from the source AMF, and determines that the UE identity cannot be identified through the response message, and then the target AMF starts the UE identity authentication and authentication process.

212. The target AMF sends a registration acceptance message to the UE.

Exemplarily, after the identity authentication and authentication procedures are completed, the target AMF sends a registration acceptance message to the UE. However, since the network re-authenticates and authenticates the UE, all PDU session information previously established by the UE may not be migrated to the target AMF, resulting in the release of the previously activated PDU session.

From the above analysis, it can be seen that since the above scenario is not specified in the existing technical specifications (UE moves to the target AMF, when the source AMF requests the target AMF for the context of the UE, the source AMF determines that a new security context has been deduced, and thereafter appears In the case where the UE fails to register with the target AMF), how should the UE and the source AMF maintain the current NAS security context, which may cause inconsistencies between the current NAS security context on the UE and the source AMF. Aiming at the problem of inconsistency between the UE and the current NAS security context on the source AMF in the above scenario, different solutions are proposed in the following embodiments of the present application.

FIG. 3 shows an exemplary flow chart of a method 300 for managing a security context provided by an embodiment of the present application. The method 300 includes: 301, the terminal device 30 sends a registration request message to the target mobility management network element 10 .

Exemplarily, the terminal device 30 sends a registration request message to the target mobility management network element 10 to request to register with the target mobility management network element 10 , and the registration request message includes the identifier of the terminal device 30 . The identifier of the terminal device 30 is, for example, the GUTI of the terminal device 30 .

Optionally, the terminal device 30 uses the first security context to perform security protection on the registration request message, for example, the terminal device 30 uses the first security context and the registration request message to generate an integrity check parameter, and the integrity check parameter It is used to verify whether the registration request message has been tampered with. The first security context is the current security context of the source mobility management network element 20 of the terminal device 30 . The first security context includes the key Kamf and the NAS key set identifier ngKSI. The first security context may also include other information elements (information element, IE), such as the selected algorithm, uplink NAScount, downlink NAScount, etc., which are not limited in this application, and may refer to existing standards for details. It should be understood that, unless otherwise specified, the security contexts in the embodiments of the present application are non-access stratum NAS security contexts.

The registration request message may also include an uplink non-access stratum count (NAScount) value.

302. The target mobility management network element 10 sends a context request message to the source mobility management network element 20.

Exemplarily, the target mobility management network element 10 receives the registration request message from the terminal equipment 30, and determines the source mobility management network element 20 corresponding to the identifier of the terminal equipment 30 according to the identifier of the terminal equipment 30, denoted as the source mobility management network element 20 The element 20 targets the mobility management network element 10 . According to the registration request message, the target mobility management network element 10 sends a context request message to the source mobility management network element 20, where the context request message is used to request to obtain the context of the terminal device 30. The context request message includes the identification of the terminal device 30 .

Optionally, the target mobility management network element 10 carries a complete registration request message from the terminal device 30 in the context request message, or in other words, the target mobility management network element 10 will receive the security protection in step 301 The registration request message of is carried in the context request message.

303. When horizontal key derivation is required, the source mobility management network element 20 generates a new key Kamf' according to the key Kamf in the first security context.

Exemplarily, the source mobility management network element 20 receives the context request message from the target mobility management network element 10 . The source mobility management network element 20 searches the local database for the context information of the terminal device 30 according to the identifier of the terminal device 30 carried in the context request message, the context information includes the first security context, and the first security context is the The current security context between the source mobility management network element 20 and the terminal device 30 .

Optionally, the source mobility management network element 20 uses the first security context to perform security verification on the registration request message carried in the context request message. If the verification is successful, the source mobility management network element 20 judges whether to perform horizontal key derivation. If the source mobility management network element 20 determines that horizontal key derivation is required, further, the source mobility management network element 20 generates a new key Kamf' according to the key Kamf in the first security context. For example, the source mobility management network element 20 uses Kamf in the first security context and the non-access stratum count value carried in the registration request message to perform horizontal key derivation to obtain a new key Kamf'.

304. The source mobility management network element 20 sends the second security context to the target mobility management network element 10.

Exemplarily, in response to the context request message, the source mobility management network element 20 sends a context response message to the target mobility management network element 10, the context response message includes the second security context, and the second security context includes the new key Kamf '. The second security context may also include other IEs, such as NAS key set identifier ngKSI', selected algorithm, uplink NAScount, downlink NAScount, etc., which are not limited in this application, and can refer to existing standards for details.

The context response message includes the identifier of the terminal device 30 , such as the SUPI of the terminal device 30 .

305. The target mobility management network element 10 sends a security mode command message to the terminal device 30.

Exemplarily, the target mobility management network element 10 receives a context response message from the source mobility management network element 20 from the terminal device 30, and if the context response message carries a horizontal derivation instruction, the target mobility management network element 10 then uses the new key Kamf' and the selected algorithm deduce the new key NASkeys, and then save the second security context carried in the context response message. If the target mobility management network element 10 enables the second security context according to the local policy, the target mobility management network element 10 sends a security mode command message to the terminal device 30, the security mode command message includes horizontal derivation indication information, and the horizontal derivation indication The information is used to instruct the terminal device 30 to perform horizontal key derivation.

306. The terminal device 30 generates a new key Kamf' according to the key Kamf in the first security context.

Exemplarily, the terminal device 30 receives a security mode command message from the target mobility management network element 10, and according to the horizontal derivation instruction information in the security mode command message, the terminal device 30 generates a new key Kamf according to the first security context. The key Kamf'. For example, the target mobility management network element 10, the terminal device 30 uses the key Kamf in the first security context and the uplink non-access stratum count value carried in the registration request message to perform horizontal key derivation to obtain the key Kamf', and then uses the The new key Kamf' and the algorithm identifier (ngKSI) in the security mode completion message are used to deduce the new NAS key (NASkeys).

Several possible ways of maintaining the first security context and the second security context by the source mobility management network element 20 and the terminal device 30 are exemplified below.

A possible implementation (denoted as scheme 1):

307. The source mobility management network element 20 maintains the first security context as the current security context.

Exemplarily, after the source mobility management network element 20 generates Kamf' according to Kamf, it maintains the first security context as the first security context, or continues to use the first security context as the current security context, or does not delete the first security context. context.

The maintenance here can be that after the terminal device deduces the new kamf', it does not immediately set the new security context as the current context, but continues to maintain the first security context as the current security context. After the registration process is successful, the new The security context (the second security context) is set as the current security context, and the first security context is deleted.

Optionally, the source mobility management network element 20 deletes the second security context.

It should be understood that 307 may be performed before 304 or after 304, which is not limited in this application.

Optionally, under certain conditions, the source mobility management network element 20 deletes the first security context. For example, the source mobility management network element 20 receives indication information from the target mobility management network element 10, and the source mobility management network element 20 deletes the context of the terminal device 30 according to the indication information. In one example, the indication information is used to indicate that the terminal device 30 has successfully registered to the network; in another example, the indication information indicates that the context of the terminal device 30 is deleted. According to the indication information, the source mobility management network element 20 deletes the first security context. For another example, the source mobility management network element 20 receives a de-registration notification message, for example, the source mobility management network element 20 receives a de-registration notification message from a unified data management network element, and the de-registration notification message is used to indicate that the source mobility management network element 20 To perform de-registration of the terminal device 30, the unified data management network element may be, for example, a UDM in a 5G network. For another example, after a preset time, the source mobility management network element 20 deletes the second security context. Specifically, for example, after the source mobility management network element 20 sends the second security context to the target mobility management network element 10, a timer is started. When When the timer expires, the source mobility management network element 20 still does not receive a response message, then the source mobility management network element 20 deletes the second security context; or, the source mobility management network element 20 starts the timer after generating a new key Kamf' When the timer expires and the source mobility management network element 20 still does not receive the response message, the source mobility management network element 20 deletes the second security context. It should be understood that the present application does not limit the specific timing for starting the timer. It should be understood that the registration success indication information may be carried in an existing message, or in a message newly added by the source mobility management network element 20, which is not limited in this application.

Optionally, the terminal device 30 determines that the registration process has not been successfully completed. It should be understood that the successful registration here refers to the situation that the registration process of the terminal device cannot be successfully completed due to abnormal conditions, or the failure of the registration process can be interpreted as a failure of the registration process. It should also be understood that this application does not limit the specific reasons for the unsuccessful completion of the registration process. Several possible situations in which the terminal device 30 determines that the registration process has not been successfully completed are illustrated below: In one example, the terminal device does not receive a registration acceptance message within a preset time. For example, after the terminal device 30 sends the registration request message, the timer is started, and after the timer expires, if the registration acceptance message is not received, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 receives Receive a registration rejection message, the registration rejection message is used to deny the terminal device 30 access to the network, or in other words, the registration rejection message is used to deny the terminal device 30 to register with the target mobility management network element, according to the registration rejection message, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 needs to re-trigger the registration process before receiving the registration acceptance message. For example, before the current registration process is completed, the terminal device 30 enters a new tracking area, so that the registration process needs to be triggered again. In this case, the terminal device 30 determines that the registration process fails; in another example, the terminal device 30 bottom layer Failure (Lower layer failure) indication information, according to the underlying failure indication information, the terminal device 30 determines that the registration process has not been successfully completed; in another example, the terminal device 30 determines that the NAS security mode completes the message sending before receiving the registration acceptance message Failure; in another example, before receiving the registration acceptance message, the terminal device 30 determines that the link between itself and the access network device is released; The RRC connection between network devices is suspended or released.

308. When the registration process fails, the terminal device 30 uses the first security context as the current security context.

Exemplarily, after the terminal device 30 generates the new key Kamf', it maintains the first security context and the second security context, wherein the second security context includes the Kamf' and the NAS key, and the NAS key is based on the Kamf' generate. The NAS keys may include NAS encryption keys and NAS integrity keys.

Specifically, as a possible implementation, after the terminal device 30 generates a new key Kamf', it continues to use the first security context as the current security context, and saves the second security context, that is, the terminal device network maintains the first security context The context is the current security context. Here, the first security context is the current security context, which means that after the terminal device deduces the new Kamf', it will not immediately set the new security context (second security context) as the current context. , but continue to maintain the first security context as the current security context, and after the registration process is successful, set the new security context as the current security context and delete the first security context. In this implementation, when the registration process fails, if the reason for the registration process failure is that the terminal device receives a registration rejection message, and the registration rejection message causes the security context to be deleted, the terminal device deletes the first security context and the second security context. security context. If the failure of the registration process does not cause the terminal device to delete the security context, the terminal device 30 continues to use the first security context as the current security context and delete the second security context. If the registration is successful, the terminal device 30 sets the second security context as the current security context, and deletes the first security context. For example, after the terminal device 30 uses the second security context to successfully verify the security of the NAS security mode command message, it sends a NAS security mode completion message to the target mobility management network element 10. If the security mode completion message is sent successfully, or the terminal device 30 receives a message from A registration acceptance message of the target mobility management network element 10, the registration acceptance message is used to indicate that the terminal device 30 has successfully registered to the network, then the terminal device 30 sets the second security context as the current security context, and deletes the first security context.

As another possible implementation manner, after the terminal device 30 generates a new key Kamf', it saves the first security context, and sets the second security context as the current security context. It should be understood that setting the second security context here as the current security context means that after the terminal device generates a new security context (the second security context), it sets the new security context as the current security context while saving the old security context (the second security context) A security context), if it is determined that the registration process fails, the current security context is rolled back, that is, the first security context is re-set as the current security context. In this implementation, if the registration process fails, if the reason for the registration process failure is that the terminal device receives a registration rejection message, and the registration rejection message causes the security context to be deleted, the terminal device deletes the first security context and the second security context. Two security contexts. If the failure of the registration process does not cause the terminal device to delete the security context, the terminal device 30 sets the first security context as the current security context and deletes the second security context. If the registration is successful, the terminal device 30 deletes the first security context. Optionally, after the security mode complete message fails to be sent, or after the registration process fails, the terminal device 30 re-initiates the registration process. For example, after the registration process fails, the terminal device 30 sends a registration request message to another target mobility management network element, the registration request message includes the identifier of the terminal device 30, and the registration request message is secured by the first security context. It should be understood that the further target mobility management network element may be the same as or may be different from the target mobility management network element 10 .

After the target mobility management network element 10 receives the registration request message from the terminal device 30, according to the registration request message, the target mobility management network element 10 sends a context request message to the source mobility management network element 20, and the context request message is used to request to obtain The context of the terminal device 30 . The second target mobility management network element 10 carries the complete registration request message received from the terminal device 30 in the context request message. Correspondingly, the source mobility management network element 20 receives the context request message from the second target mobility management network element 10, and then, the source mobility management network element 20 uses the first security context to secure the registration request message carried in the context request message. verify. If the verification is passed, the source mobility management network element 20 continues to perform subsequent procedures. It should be understood that the registration process here is similar to the processes in 301 to 303, and for the sake of brevity, repeated content will not be repeated.

Another possible implementation (denoted as scheme 2):

309. The source mobility management network element 20 sets the second security context as the current security context.

Exemplarily, after the source mobility management network element 20 generates the new key Kamf', it sets the second security context as the current security context, and the second security context includes the new key Kamf' and deduced NASkeys.

It should be understood that 309 may be performed before 304 or after 304, which is not limited in this application.

Optionally, the source mobility management network element 20 deletes the first security context.

310. The terminal device 30 sets the second security context as the current security context.

Exemplarily, after the terminal device 30 generates a new key Kamf', it sets the second security context as the current security context.

It should be understood that in this implementation manner, the source mobility management network element 20 uses the new key Kamf' and the selected algorithm to derive a new NAS key.

Optionally, the terminal device 30 deletes the first security context.

Further, the terminal device 30 sends a security mode completion message to the target mobility management network element 10, and the NAS security mode completion message is used to respond to the NAS security mode command message.

If the registration process is not successfully completed, for example, the security mode completion message fails to be sent, the terminal device 30 may re-initiate the registration process. For example, the terminal device 30 sends a registration request message to the target mobility management network element 10, where the registration request message includes the identifier of the terminal device 30. The terminal device 30 performs integrity protection on the registration request message through the second security context. The second target mobility management network element 10 sends a second context request message to the source mobility management network element 20 according to the registration request message, and the second context request message carries the received complete registration request message. After receiving the second context request message, the source mobility management network element 20 uses the second security context to perform security verification on the registration request message. If the verification is passed, proceed to the subsequent process.

Yet another possible implementation (denoted as scheme 3):

311. The source mobility management network element 20 maintains the first security context and the second security context.

Exemplarily, after the source mobility management network element 20 generates a new key kamf', it maintains the first security context and the second security context. For example, the source mobility management network element 20 continues to use the first security context as the current security context between the mobility management network element and the terminal device 30, and saves the second security context. For another example, the source mobility management network element 20 saves the first security context, and uses the second security context as the current security context between the source mobility management network element 20 and the terminal device 30

312. The terminal device 30 maintains the first security context as the current security context, or sets the second security context as the current security context.

Exemplarily, as a possible implementation, the terminal device 30 maintains the first security context as the current security context after generating the new key Kamf', and saves the second security context. When the registration process is not successfully completed, then The terminal device 30 deletes the second security context; or the terminal device 30 saves the first security context after generating a new key Kamf', and sets the second security context as the current security context. When the registration process is not successfully completed, the terminal device 30. Set the first security context as the current security context, and delete the second security context. That is, the terminal device 30 can implement the solution performed by 308 in solution 1; or, as another possible implementation, after the terminal device 30 uses the first security context to perform horizontal key derivation to obtain the second security context, set the second security context. The security context is the current security context, and the first security context is deleted. That is, the terminal device 30 may execute the solution performed by 310 in solution 2.

When the security mode completion message of the terminal device 30 fails to be sent, or the terminal device 30 fails to complete the registration process due to other reasons, the terminal device 30 may re-initiate the registration process. For example, the terminal device 30 sends a security-protected registration request message to the target mobility management network element 10 . Correspondingly, the target mobility management network element 10 receives the registration request message, and according to the registration request message, the target mobility management network element 10 sends a context request message to the source mobility management network element 20, and carries the received The complete registration request message. After receiving the context request message, the source mobility management network element 20 uses the first security context and the second security context to perform security verification on the registration request message. When the source mobility management network element 20 uses the first security context to successfully verify the registration request message, the source mobility management network element 20 deletes the second security context; when the source mobility management network element 20 uses the second When the security verification of the registration request message by the security context succeeds, the source mobility management network element 20 sets the second security context as the current security context, and deletes the first security context. If the source mobility management network element 20 fails to verify the registration request message using the first security context and the second security context, the source mobility management network element 20 may delete the first security context and the second security context.

It should be understood that this application does not limit the sequence of security verification using the first security context and the second security context, that is, the source mobility management network element 20 can first use the first security Context to verify.

It should also be understood that after the source mobility management network element 20 successfully authenticates the registration request message using one of the security contexts, it may not need to use another security context for authentication. For example, the source mobility management network element 20 first uses the first security context to perform security verification on the registration request message. If the verification is successful, it may no longer use the second security context to verify the registration request message, and may delete the second security context. Context; if the verification fails, the source mobility management network element 20 can then use the second security context to perform security verification on the registration request message, and if the verification is successful, the source mobility management network element 20 sets the second security context as the current security context, And delete the first security context.

Based on the above technical solution, by defining the terminal device and the source mobility management network element after performing horizontal key derivation, the new security context (such as the second security context in the above embodiment) and the old security context (such as the above embodiment The processing method of the first security context) can avoid that the registration request of the terminal device cannot pass the integrity protection check of the NAS at the source mobility management network element due to the inconsistency of the security contexts on the terminal side and the network side, so that the terminal device has already The established security context cannot be migrated to the target mobility management network element, thereby avoiding the release of the previously activated PDU session of the terminal device and affecting user experience. On the other hand, it can avoid the problem of increasing signaling overhead due to the identity authentication and re-authentication process caused by the registration request of the terminal device failing to pass the integrity protection check of the NAS at the source mobility management network element.

FIG. 4 shows an exemplary flow chart of a method 400 for managing a security context provided by an embodiment of the present application. The method 400 includes:

401. The UE sends a registration request message to a target AMF.

Due to location movement, the UE triggers a Registration Request message to the network. For example, the UE moves to a new AMF area (denoted as the target AMF), and the registration request message of the UE is delivered to the target AMF. Exemplarily, the UE sends a registration request (registration request, RR) message to a target AMF (target AMF), and the RR message carries an identifier of the UE, such as a 5G globally unique temporary user equipment identity (5G generation globally unique temporary user equipment identity, 5G-GUTI). It should be understood that the UE has protected the integrity of the RR message through the current NAS security context, and the current NAS security context is the NAS security context used by the UE to protect the NAS message transmitted between the UE and the source AMF before the registration process , or the current security context is the current security context of the NAS used by the source AMF before performing horizontal K _AMF deduction in 403 .

402. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the identity of the UE (such as 5G-GUTI), and the Namf_Communication_UEContextTransfer also includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 401 in the Namf_Communication_UEContextTransfer.

403. The source AMF performs horizontal deduction according to the local policy to generate a new security context #1.

Exemplarily, after the source AMF receives the UE context transfer request message, it obtains the data of the UE (including the current NAS security context corresponding to the UE) in the database according to the identifier of the UE, and the source AMF uses the current security context to verify the received Integrity of RR messages. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF uses the Kamf in the old security context to perform horizontal Kamf deduction to obtain a new key Kamf', thereby generating a new security context #1, the new security context# 1 includes the new key Kamf'. Specifically, the source AMF uses the currently activated Kamf and the uplink NAScount carried in the registration request message to perform horizontal deduction to obtain a new key Kamf'. The new key Kamf' is included in the security context of the new NAS. The new security context #1 here is relative to the current NAS security context before the source AMF performs horizontal deduction. Therefore, the NAS security context before the source AMF performs horizontal deduction can be recorded as the old security context.

404. The source AMF sends a UE context transfer response message to the target AMF.

Exemplarily, if the source AMF finds the data corresponding to the UE in the database, and performs horizontal key derivation according to the local policy, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message Carries UE context, SUPI, horizontal K _AMF derivation indication (keyAmfHDerivationInd indication). The UE context includes a security context. If the source AMF has deduced the horizontal K _AMF according to the local policy, the UE context carried in the response message is the new security context #1 derived by the source AMF in 403 .

405. The source AMF maintains the old security context as the current security context.

Exemplarily, after the source AMF generates a new key Kamf', or in other words, after the source AMF generates a new security context #1, the source AMF maintains the old security context as the current security context between the source AMF and the UE, In other words, the source AMF continues to use the old security context as the current security context between the source AMF and the UE, that is, the source AMF does not delete the old security context and the non-current security context, and does not change the security context between the source AMF and the UE. The current security context.

At this time, the source AMF may not need to maintain the new security context #1, that is, after 403, the source AMF may delete the new security context #1.

406. The target AMF sends a security mode command message to the UE.

Exemplarily, the target AMF receives the UE context transfer response message from the source AMF, and if the UE context transfer response message carries the SUPI of the UE, the target AMF saves the new NAS security context# carried in the UE context transfer response message 1. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new security context #1 deduced by the source AMF, the target AMF initiates a non access stratum security mode command (non access stratum security mode command, NAS SMC) message to the UE to establish the NAS security context between the UE and the target AMF. The security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP). The HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K _AMF derivation. The NASSMC message may also include selected NAS algorithms, including NAS encryption algorithms and NAS integrity protection algorithms. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context #1.

407. The UE horizontally deduces and generates a new security context #1.

Exemplarily, the UE receives a security mode command message from the target AMF, and performs K _AMF derivation according to the horizontal K _AMF derivation indication carried in the security mode command message, that is, the UE performs Kamf derivation generation according to the key Kamf in the current security context A new key Kamf' is obtained, so as to obtain a new security context #1, and the new security context #1 includes the new key Kamf'. The UE uses the new security context #1 to check the integrity of the security mode command message, and if the integrity check of the security mode command message passes, the UE sends a security mode completion message to the target AMF.

408. The UE maintains the old security context and the new security context #1.

In one implementation, after successfully verifying the security mode command message using the new security context #1, the UE saves the old security context, and then sets the new security context #1 as the current security context; or, in another In the implementation manner, after the UE successfully verifies the security model command message through the new security context #1, it saves the new security context #1, and at the same time, the UE continues to maintain the old security context as the current security context.

After 408, if the UE receives a registration acceptance message from the target AMF, if the UE saves the old security context at 408 and sets the new security context #1 as the current security context, then according to the registration acceptance message, the UE deletes the old security context If the UE saves the new security context #1 in 408 and maintains the old security context as the current security context, according to the registration acceptance message, the UE sets the second security context as the current security context and deletes the first Security context, that is, when the second security context is used for the current access, the UE deletes the stored old security context (and Kamf).

409, the UE sends a registration request message to the target AMF.

Exemplarily, if the UE saves the old security context at 408, and sets the new security context #1 as the current security context, in this case, if the registration process is not successfully completed, or if the registration process fails, or That is, if the security mode completion message fails to be sent, the UE sets the old security context as the current security context (or the UE maintains Kamf and the NAS security context associated with Kamf), or the UE uses the old security context as the current security context, In other words, the UE makes the old security context the current security context, and the UE deletes the new security context #1. It should be understood that the old security context here can also be referred to as the previous security context, or the security context before horizontal deduction, or the security context used before registration; if the UE saves the new security context #1 at 408 and maintains the old security context The context is the current security context. In this case, if the registration process is not successfully completed, or if the registration process fails, or the security mode completion message fails to be sent, the UE deletes the new security context #1.

If the registration procedure or in other words, if the registration procedure fails, the UE may re-initiate the registration procedure, for example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the old security context. It should also be understood that the target AMF here may be different from the target AMF receiving the registration request message in step 401, that is, the UE may have moved to the area of another target AMF.

In the actual communication process, there may be various reasons that cause the registration process of the UE to fail to complete successfully. This application does not limit the reason why the UE registration process is not successfully completed. Several possible situations are described as examples below.

For example, before the UE receives the registration acceptance message, the link is released, then the UE deletes the new security context #1, and sets the old security context as the current security context;

In another example, the UE receives a registration rejection message from the network. If the registration rejection message causes the security context to be deleted, the UE deletes the new security context #1 and the old security context; if the registration rejection message does not cause the security context to be deleted , the UE deletes the new security context #1, and sets the old security context as the current security context;

In another example, if the transmission of the security mode complete message of the UE fails, the UE deletes the new security context #1 and sets the old security context as the current security context.

410. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 409 in the Namf_Communication_UEContextTransfer.

411. The source AMF performs horizontal deduction according to the local policy to generate a new security context #2.

Exemplarily, after the source AMF receives the UE context transfer request message, the source AMF uses the old security context to verify the integrity of the RR message in the UE context transfer request message. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF performs horizontal K _AMF deduction to obtain a new security context #2.

412. The source AMF sends a UE context transfer response message to the target AMF.

Exemplarily, in response to the UE context transfer request message, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message carries the UE context, SUPI, and horizontal K _AMF derivation indication (keyAmfHDerivationInd indication) . The UE context includes a security context. If the source AMF has deduced the horizontal K _AMF according to the local policy, the UE context carried in the response message is the new security context #2 derived by the source AMF in step 411 .

413. The target AMF sends a security mode command message to the UE.

Exemplarily, the target AMF receives the UE context transfer response message from the source AMF, and if the UE context transfer response message carries the SUPI of the UE, the target AMF saves the new NAS security context# carried in the UE context transfer response message 2. If the target AMF activates the security context carried in the response message according to the local policy, that is, the new security context #2 deduced by the source AMF, the target AMF initiates a non-access stratum security mode command message to the UE to establish UE and NAS security context between target AMFs. The security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP). The HDP may be K_AMF_change_flag with a value of 1, wherein the K_AMF_change_flag with a value of 1 is used to instruct the UE to perform horizontal K _AMF derivation. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context #2.

414. The UE horizontally deduces to obtain a new security context.

Exemplarily, the UE receives a security mode command message from the target AMF, performs K _AMF derivation according to the horizontal K _AMF derivation indication carried in the security mode command message, and generates a new security context #2. The UE uses the new security context #2 to check the integrity of the security mode command message.

415. The UE sends a security mode completion message to the target AMF.

Exemplarily, if the security context #2 used by the UE passes the integrity check of the security mode command message, the UE sends a security mode completion message to the target AMF.

416. The UE sets new security context #2 as the current security context.

Exemplarily, after the UE passes the integrity check of the security mode command message using the new security context #2, it saves the old security context, and then sets the new security context #2 as the current security context. It should be understood that 416 may be performed before 415 or after 415, which is not limited in this application.

417. The target AMF sends a registration acceptance message to the UE.

Exemplarily, the target AMF sends a registration acceptance message to the UE. It should be understood that the target AMF uses the new security context #2 deduced at 414 to perform integrity protection on the registration acceptance message.

418. The UE deletes the old security context.

Exemplarily, after receiving the registration acceptance message from the target AMF, the UE determines that the registration is successful, and then the UE deletes the old security context.

Or in another possible implementation manner, at 416, the UE maintains the old security context as the current security context, and saves the new security context #2. After the UE receives the registration acceptance message from the target mobility management network element, the UE sets the new security context #2 as the current security context, and deletes the old security context.

Based on the above technical solution, the source mobility management network element maintains the first security context as the current security context after performing horizontal key derivation, and the terminal device maintains or sets The first security context is the current security context, thereby avoiding the problem that the security contexts maintained by the terminal side and the network side are inconsistent, which may lead to subsequent failure of the registration process.

FIG. 5 shows an exemplary flow chart of a method 500 for managing security context provided by an embodiment of the present application. Method 500 includes:

501. The UE sends a registration request message to a target AMF.

502. The target AMF sends a UE context transfer request message to the source AMF.

503. The source AMF performs horizontal deduction according to the local policy to generate a new security context #1.

504. The source AMF sends a UE context transfer response message to the target AMF.

It should be understood that steps 501 to 504 are similar to steps 401 to 404 of the method 400, and for the sake of brevity, no detailed description is given.

505. The source AMF sets new security context #1 as the current security context.

Exemplarily, after the source AMF obtains the new key Kamf' through derivation, or after the source AMF obtains the new security context #1, it sets the new security context #1 as the current security context. Optionally, the source AMF deletes the old security context and the non-current security context.

It should be understood that 505 may be performed before 504, may be performed after 504, or may be performed at the same time, which is not limited in this application.

506. The target AMF sends a security mode command message to the UE.

507. The UE performs horizontal derivation to obtain a new security context #1.

It should be understood that steps 506 to 507 are similar to steps 406 to 407 in the method 400 and will not be repeated here.

508. The UE sets new security context #1 as the current security context.

Exemplarily, after obtaining the new security context #1 through horizontal derivation, the UE sets the new security context #1 as the current security context. Optionally, the UE deletes the old security context and the non-current security context.

509, the UE sends a registration request message to the target AMF.

Exemplarily, after the registration procedure is not successfully completed, the UE may re-initiate the registration procedure. For example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the new security context #1. It should also be understood that the present application does not limit the reasons for UE registration failure.

510. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received at 510 in the Namf_Communication_UEContextTransfer.

511. Optionally, the source AMF performs horizontal deduction according to the local policy to generate a new security context #2.

Exemplarily, after the source AMF receives the UE context request, the source AMF uses the old security context to verify the integrity of the received RR message. If the integrity verification of the RR message passes, the source AMF decides whether to derive a new security context according to the local policy. If the source AMF decides to deduce a new security context, the source AMF performs horizontal K _AMF deduction to obtain a new security context #2.

Since in this embodiment, the source AMF has obtained the new security context #1 by performing horizontal K _AMF derivation in step 503, and in step 505, the source AMF sets the new security context #1 as the current security context, therefore, the source The AMF may also not perform step 511 .

512. The source AMF sends a UE context transfer response message to the target AMF

Exemplarily, in response to the UE context transfer request message, the source AMF sends a UE context transfer response (Namf_Communication_UEContextTransfer Response) message to the target AMF, and the UE context transfer response message carries UE context and SUPI. The UE context includes a security context. If the source AMF executes step 511, the security context is the new security context #2 obtained by the source AMF through horizontal derivation in step 511, and the response message also carries a horizontal K _AMF derivation indication (keyAmfHDerivationInd indication); if the source AMF If step 511 is not executed, the security context is the new security context #1 obtained by the source AMF through horizontal derivation in step 503 .

513. The target AMF sends a security mode command message to the UE.

Exemplarily, the target AMF receives the UE context transmission response message from the source AMF, and obtains the new security context deduced by the source AMF from the response message. If the source AMF executes step 511, the new security context is new security context #2; if the source AMF does not execute step 511, then the new security context is new security context #1.

The target AMF initiates a non-access stratum security mode command message to the UE for establishing a NAS security context between the UE and the target AMF. Optionally, the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP), and the HDP includes K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K _AMF derivation. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context carried in the response message.

514. Optionally, the UE performs horizontal deduction to generate a new security context.

Exemplarily, the UE receives a security mode command message from the target AMF, and if the security mode command message carries a horizontal K _AMF derivation indication, the UE performs horizontal K _AMF derivation to generate a new security context #2.

515. The UE sends a security mode completion message to the target AMF.

Exemplarily, if the UE performs step 514, the UE uses the new security context #2 to perform integrity verification on the security mode command message; if the UE does not perform step 514, the UE uses the new security context #1 to verify the security mode command messages for integrity verification. If the verification is passed, the UE sends a security mode completion message to the target AMF.

If the UE successfully verifies the integrity of the security mode complete message through the new security context #2, the UE sets the new security context #2 as the current security context. And the UE deletes the old security context.

516. The target AMF uses the new security context to send a registration acceptance message to the UE.

Based on the above technical solution, the source mobility management network element sets the second security context as the current security context after performing horizontal key derivation, and the terminal device also sets the second security context as the current security context after performing horizontal key derivation, so that To avoid the inconsistency of the security context maintained on the terminal side and the network side, resulting in the possible subsequent failure of the registration process.

FIG. 6 shows an exemplary flowchart of a method 600 for managing a full context provided by an embodiment of the present application. Method 600 includes:

601. The UE sends a registration request message to a target AMF.

602. The target AMF sends a UE context transfer request message to the source AMF.

603. The source AMF performs horizontal deduction according to the local policy to generate a new security context #1.

604. The source AMF sends a UE context transfer response message to the target AMF.

It should be understood that steps 601 to 604 are similar to steps 401 to 404 of the method 400, and for the sake of brevity, no detailed description is given.

605. The source AMF saves the old security context and the new security context #1.

After the source AMF generates the new security context #1 through horizontal deduction, it saves the new security context #1 and the old security context at the same time, or in other words, maintains the new security context #1 and the old security context at the same time, or in other words, saves the new security context #1, retaining the old security context. In one example, the source AMF saves the old security context and sets the new security context #1 as the current security context; in another example, the source AMF continues to maintain the old security context as the current security context while saving the new security context # 1.

606. The target AMF sends a security mode command message to the UE.

607. The UE performs horizontal derivation to obtain a new security context #1.

It should be understood that steps 606 to 607 are similar to steps 406 to 407 in the method 400 and will not be repeated here.

608. The UE sets new security context #1 as the current security context.

609, the UE sends a registration request message to the target AMF.

Exemplarily, when the UE fails to register, the UE re-initiates the registration procedure. For example, the UE sends a registration request message to the target AMF. It should be understood that the UE performs integrity protection on the registration request message through the new security context #1. This application does not limit the reasons for UE registration failure.

610. The target AMF sends a UE context transfer request message to the source AMF.

Exemplarily, the target AMF receives the registration request message from the UE, and according to the GUTI carried in the message, determines the AMF that served the UE last time (referred to as the source AMF). Then the target AMF calls the UE context transfer service (Namf_Communication_UEContextTransfer) operation provided by the source AMF to request the context information of the UE. The Namf_Communication_UEContextTransfer includes the complete RR message received by the target AMF, that is, the target AMF sends the RR message received in 609 in the Namf_Communication_UEContextTransfer.

611. The source AMF uses the new security context and the old security context to check the integrity of the registration request message.

Exemplarily, after receiving the UE context transfer request message from the target AMF, the source AMF uses the new security context #1 and the old security context to verify the integrity of the registration request message in the UE context transfer request message.

If the source AMF successfully checks the integrity of the registration request message using the new security context #1, the source AMF deletes the old security context. If the source AMF sets the old security context as the current security context in step 605, then the source AMF deletes the old security context and sets the new security context #1 as the current security context;

If the source AMF fails to verify the integrity of the registration request message using the new security context #1, the source AMF uses the old security context to verify the integrity of the registration request message. If the verification is successful, the source AMF Delete the new security context #1, and if the source AMF sets the new security context #1 as the current security context in step 605, then the source AMF sets the old security context as the current security context at this time;

If the source AMF fails to check the integrity of the registration request message using the new security context #1 and the old security context, the source AMF can delete both the new security context #1 and the old security context. Alternatively, the source AMF returns a UE context transmission response message to the target AMF, where the response message is used to indicate that the temporary identifier 5G-GUTI cannot be obtained.

It should be understood that the present application does not limit the sequence of integrity verification using the new security context #1 and the old security context. That is to say, the source AMF can first use the new security context #1 to verify the integrity of the registration request message, or use the old security context to first verify the integrity of the registration request message, which is not limited in this application .

612. Optionally, the source AMF performs horizontal deduction according to the local policy to generate a new security context #2.

Exemplarily, after the source AMF successfully checks the integrity of the registration request message through the new security context #1 or the old security context, if the source AMF decides to deduce a new security context according to the local policy, the source AMF performs level K _AMF Deduction, get the new security context #2.

If at 611, the source AMF successfully checks the integrity of the registration request message using the new security context #1, step 612 may not be executed.

613. The source AMF sends a UE context transfer response message to the target AMF.

Exemplarily, in response to the UE context transfer request message, the source AMF sends a UE context transfer response message to the target AMF, and the response message carries the UE context and SUPI. The UE context includes a security context. If the source AMF executes step 612, the security context is the new security context #2 obtained by the source AMF through horizontal derivation in step 612, and the response message carries the level K _AMF derivation indication (keyAmfHDerivationInd indication); if the source AMF does not Step 612 is executed, and the security context is the new security context #1 obtained by the source AMF through horizontal derivation in step 603 .

614. The target AMF sends a security mode command message to the UE.

Exemplarily, the target AMF receives the UE context transmission response message from the source AMF, and obtains the new security context deduced by the source AMF from the response message. If the source AMF executes 612, the new security context is new security context #2; if the source AMF does not execute 612, then the new security context is new security context #1.

The target AMF initiates a non-access stratum security mode command message to the UE for establishing a NAS security context between the UE and the target AMF. Optionally, the security mode command message carries a horizontal derivation parameter (horizontal derivation parameter, HDP), and the HDP includes K_AMF_change_flag with a value of 1, which is used to instruct the UE to perform horizontal K _AMF derivation. It should be understood that the target AMF performs integrity protection on the security mode command message through the new security context.

615. Optionally, a new security context is generated through UE horizontal deduction.

616. The UE sends a security mode completion message to the target AMF.

Exemplarily, if the UE performs step 615, the UE uses the new security context #2 to verify the integrity of the security mode command message; if the UE does not perform step 615, the UE uses the new security context #1 to verify the security mode command messages for integrity verification. If the verification is passed, the UE sends a security mode complete message to the target AMF.

Exemplarily, if the UE successfully verifies the integrity of the security mode command message through the new security context #2, the UE sets the new security context #2 as the current security context. And the UE deletes the old security context.

617. The target AMF uses the new security context to send a registration acceptance message to the UE.

Based on the above technical solution, the source mobility management network element maintains the first security context and the second security context at the same time after performing horizontal key derivation, so that no matter whether the terminal device side sets the first security context or the second security context as the current security context , can avoid the problem of inconsistency of the security context maintained by the terminal side and the network side.

It should be understood that the method for managing the security context provided by the embodiment of the present application is described by taking the registration process applied to the terminal device as an example, but it should be understood that the method is also applicable to scenarios where other network devices perform horizontal key derivation, for example In other processes in the future, the network device performs horizontal key derivation according to the local policy, and the method for managing the security context provided by the embodiment of the present application can be used to solve the problem of inconsistency between the security context maintained by the network side and the terminal side.

Above, the method provided by the embodiment of the present application is described in detail with reference to FIG. 3 to FIG. 6 . Hereinafter, the device provided by the embodiment of the present application will be described in detail with reference to FIG. 7 to FIG. 10 . It should be understood that the descriptions of the device embodiments correspond to the descriptions of the method embodiments. Therefore, for details that are not described in detail, reference may be made to the method embodiments above. For brevity, details are not repeated here.

FIG. 7 is a schematic block diagram of an apparatus 10 for managing a security context provided by an embodiment of the present application. The device 10 includes a transceiver module 11 and a processing module 12 . The transceiver module 11 can realize corresponding communication functions, the processing module 12 is used for data processing, or the transceiver module 11 is used for performing receiving and sending related operations, and the processing module 12 is used for performing other operations except receiving and sending . The transceiver module 11 can also be called a communication interface or a communication unit.

In a possible design, the device 10 may correspond to the mobility management network element in the above method embodiment, for example, the source mobility management network element, or the target mobility management network element (including the first target mobility management network element or the second 2. The target mobility management network element), or the source AMF, or the target AMF.

Exemplarily, the apparatus 10 may correspond to the target mobility management network element 20 or the source mobility management network element 30 in the method 300 of the embodiment of the present application, or the target AMF or the source AMF in the methods 400 to 600 . The apparatus 10 may include a module for executing the method performed by the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in FIGS. 3 to 6 . Moreover, each unit in the device 10 and the above-mentioned other operations and/or functions are respectively for realizing the corresponding flow of the method shown in FIG. 3 to FIG. 6 .

The transceiver module 11 in the device 10 executes the receiving and sending operations performed by the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in the above method embodiments, and the processing module 12 then Perform operations other than this receive and send operation.

In another possible design, the apparatus 10 may correspond to the terminal device 30 (or UE) in the above method embodiments.

Exemplarily, the apparatus 10 may correspond to the terminal device 30 in the method 300 of the embodiment of the present application, or the UE in the methods 400 to 600. The apparatus 10 may include modules for executing the methods performed by the terminal device 30 (or UE) in FIG. 3 to FIG. 6 . Moreover, each unit in the device 10 and the above-mentioned other operations and/or functions are respectively for realizing the corresponding flow of the method shown in FIG. 3 to FIG. 6 .

The transceiver module 11 in the apparatus 10 executes the receiving and sending operations performed by the terminal equipment 30 (or UE) in the above method embodiments, and the processing module 12 executes operations other than the receiving and sending operations.

According to the foregoing method, FIG. 8 is a schematic diagram of an apparatus 20 for managing a security context provided by an embodiment of the present application. In a possible design, the device 20 may correspond to the target mobility management network element 20 or the source mobility management network element 30 (target AMF or source AMF) in the above method embodiment; in another possible design , the apparatus 10 may correspond to the terminal device 30 (or UE) in the above method embodiments.

The device 20 may include a processor 21 (ie, an example of a processing module) and a memory 22 . The memory 22 is used to store instructions, and the processor 21 is used to execute the instructions stored in the memory 22, so that the device 20 implements the steps performed by the terminal device or the network device in the method corresponding to FIG. 3 to FIG. 6 , the network device It may be the target mobility management network element in methods 300 to 600, or the source mobility management network element, or the target AMF, or the source AMF.

Further, the device 20 may also include an input port 23 (ie, an example of a transceiver module) and an output port 24 (ie, another example of a transceiver module). Further, the processor 21 , the memory 22 , the input port 23 and the output port 24 can communicate with each other through internal connection paths, and transmit control and/or data signals. The memory 22 is used to store a computer program, and the processor 21 can be used to call and run the computer program from the memory 22, to control the input port 23 to receive signals, and to control the output port 24 to send signals, so as to complete the terminal equipment or Steps for network devices. The memory 22 can be integrated in the processor 21 or can be set separately from the processor 21 .

Optionally, if the communication device 20 is a communication device, the input port 23 is a receiver, and the output port 24 is a transmitter. Wherein, the receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.

Optionally, if the communication device 20 is a chip or a circuit, the input port 23 is an input interface, and the output port 24 is an output interface.

As an implementation, the functions of the input port 23 and the output port 24 may be realized by a transceiver circuit or a dedicated chip for transceiver. The processor 21 may be realized by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

As another implementation manner, it may be considered to use a general-purpose computer to implement the communication device provided in the embodiment of the present application. The program codes to realize the functions of the processor 21 , the input port 23 and the output port 24 are stored in the memory 22 , and the general processor realizes the functions of the processor 21 , the input port 23 and the output port 24 by executing the codes in the memory 22 .

For the concepts, explanations, detailed descriptions and other steps involved in the device 20 related to the technical solutions provided by the embodiments of the present application, please refer to the foregoing methods or descriptions of these contents in other embodiments, and details are not repeated here.

FIG. 9 shows a schematic structural diagram of a simplified network device 30 . The network equipment includes 31 parts and 32 parts. Part 31 is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; part 32 is mainly used for baseband processing and control of network equipment. Part 31 may generally be referred to as a transceiver module, a transceiver, a transceiver circuit, or a transceiver. The part 32 is usually the control center of the network device, which can be generally referred to as a processing module, and is used to control the network device to perform the processing operations on the network device side in the foregoing method embodiments.

The transceiver module of Part 31, which may also be referred to as a transceiver or transceiver, etc., includes an antenna and a radio frequency circuit, wherein the radio frequency circuit is mainly used for radio frequency processing. For example, the device used to realize the receiving function in Part 31 can be regarded as a receiving module, and the device used to realize the sending function can be regarded as a sending module, that is, Part 31 includes a receiving module and a sending module. The receiving module may also be called a receiver, receiver, or receiving circuit, etc., and the sending module may be called a transmitter, transmitter, or transmitting circuit, etc.

Section 32 may include one or more single boards, and each single board may include one or more processors and one or more memories. The processor is used to read and execute programs in the memory to realize baseband processing functions and control of network devices. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, it is also possible that multiple single boards share one or more processors, or that multiple single boards share one or more memories, or that multiple single boards share one or more processors at the same time. device.

For example, in an implementation manner, the network device shown in FIG. 9 may be any network device shown in the methods shown in FIGS. 3 to 6, such as the source mobility management network element (20), the target mobility management network element (10) etc.

The transceiver module of part 31 is used to execute the steps related to the sending and receiving of any network device in the methods shown in Figures 3 to 6; the part 32 is used to execute the steps related to the processing of any network device in the methods shown in Figures 3 to 6 step.

It should be understood that FIG. 9 is only an example rather than a limitation, and the foregoing network device including a transceiver module and a processing module may not depend on the structure shown in FIG. 9 .

When the device 40 is a chip, the chip includes a transceiver module and a processing module. Wherein, the transceiver module may be an input-output circuit or a communication interface; the processing module is a processor or a microprocessor or an integrated circuit integrated on the chip.

FIG. 10 is a schematic structural diagram of a terminal device 40 provided in the present application. For ease of illustration, FIG. 10 only shows the main components of the communication device. As shown in FIG. 10 , the terminal device 40 includes a processor, a memory, a control circuit, an antenna, and an input and output device.

The processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program. described action. The memory is mainly used for storing software programs and data, such as storing the codebook described in the above embodiments. The control circuit is mainly used for conversion of baseband signal and radio frequency signal and processing of radio frequency signal. The control circuit and the antenna can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users.

When the communication device is turned on, the processor can read the software program in the storage unit, interpret and execute the instructions of the software program, and process the data of the software program. When data needs to be sent wirelessly, the processor performs baseband processing on the data to be sent, and then outputs the baseband signal to the radio frequency circuit. When data is sent to the terminal device, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.

Those skilled in the art can understand that, for ease of illustration, FIG. 10 only shows a memory and a processor. In an actual terminal device, there may be multiple processors and memories. A storage may also be called a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.

As an optional implementation, the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used to process communication protocols and communication data, and the central processor is mainly used to control the entire terminal device, execute A software program that processes data for a software program. The processor in FIG. 10 integrates the functions of the baseband processor and the central processing unit. Those skilled in the art can understand that the baseband processor and the central processing unit may also be independent processors, interconnected through technologies such as a bus. Those skilled in the art can understand that a terminal device may include multiple baseband processors to adapt to different network standards, a terminal device may include multiple central processors to enhance its processing capability, and various components of the terminal device may be connected through various buses. The baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip. The central processing unit may also be expressed as a central processing circuit or a central processing chip. The function of processing the communication protocol and communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.

As shown in FIG. 10 , the terminal device 40 includes a transceiver unit 41 and a processing unit 42 . The transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like. Optionally, the device in the transceiver unit 41 for realizing the receiving function can be regarded as a receiving unit, and the device in the transceiver unit 41 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 41 includes a receiving unit and a sending unit. Exemplarily, the receiving unit may also be called a receiver, receiver, receiving circuit, etc., and the sending unit may be called a transmitter, transmitter, or transmitting circuit, etc.

The terminal device shown in FIG. 10 may perform the actions performed by the terminal device in the methods shown in FIGS. 3 to 6 . Here, to avoid redundant descriptions, detailed descriptions thereof are omitted.

The embodiment of the present application further provides a computer-readable storage medium, on which computer instructions for implementing the method executed by the first network device in the above method embodiment are stored.

For example, when the computer program is executed by a computer, the computer can implement the method performed by the network device in the foregoing method embodiments.

The embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.

An embodiment of the present application further provides a communication system, where the communication system includes the network device in the foregoing embodiments.

For explanations and beneficial effects of relevant content in any of the devices provided above, reference may be made to the corresponding method embodiments provided above, and details are not repeated here.

In the embodiment of the present application, the network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. Wherein, the hardware layer may include hardware such as a central processing unit (central processing unit, CPU), a memory management unit (memory management unit, MMU), and memory (also called main memory). The operating system of the operating system layer can be any one or more computer operating systems that realize business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

The embodiment of the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application, as long as the program that records the code of the method provided in the embodiment of the present application can be executed according to the method provided in the embodiment of the present application Just communicate. For example, the execution subject of the method provided by the embodiment of the present application may be a network device, or a functional module in the network device that can call a program and execute the program.

Various aspects or features of the present application can be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques. The term "article of manufacture" as used herein may encompass a computer program accessible from any computer readable device, carrier or media. For example, computer-readable media may include, but are not limited to, magnetic storage devices (such as hard disks, floppy disks, or tapes, etc.), optical disks (such as compact discs (compact disc, CD), digital versatile discs (digital versatile disc, DVD), etc. ), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc.).

Various storage media described herein can represent one or more devices and/or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and/or carrying instructions and/or data.

It should be understood that the processor mentioned in the embodiment of the present application may be a central processing unit (central processing unit, CPU), and may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits ( application specific integrated circuit (ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (RAM). For example, RAM can be used as an external cache. As an example and not limitation, RAM may include the following forms: static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, the memory (storage module) may be integrated in the processor.

It should also be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

Those skilled in the art can appreciate that the units and steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Professionals may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the protection scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the above-described devices and units can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to implement the solutions provided in this application.

In addition, each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. For example, the computer may be a personal computer, a server, or a network device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium, (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a solid state disk (SSD)). For example, the aforementioned available The medium may include but not limited to: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes .

The above is only a specific embodiment of the application, but the scope of protection of the application is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. All should be covered within the scope of protection of this application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims and the specification.

Claims

A method for managing a security context, comprising:

The terminal device sends a registration request message to the target mobility management network element, where the registration request message includes the identifier of the terminal device;

The terminal device receives a non-access stratum NAS security mode command message from the target mobility management network element, and the NAS security mode command message includes horizontal derivation indication information;

According to the horizontal derivation instruction information, the terminal device generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the current security context of the terminal device;

If the registration process is not successfully completed, the terminal device uses the first security context as the current security context.
The method according to claim 1, further comprising:

After generating the new key Kamf', the terminal device maintains the first security context and the second security context; wherein the second security context includes the Kamf' and the NAS key, and the NAS Keys are generated according to the Kamf'.
The method according to claim 2, wherein the maintaining the first security context and the second security context comprises:

The terminal device continues to use the first security context as the current security context, and saves the second security context.
The method according to claim 3, wherein when the registration process is not successfully completed, the terminal device uses the first security context as the current security context, including:

The terminal device continues to use the first security context as the current security context, and deletes the second security context.
The method according to claim 2, wherein the maintaining the first security context and the second security context comprises:

The terminal device saves the first security context, and uses the second security context as a current security context.
The method according to claim 5, wherein when the registration process is not successfully completed, the terminal device uses the first security context as the current security context, comprising:

The terminal device sets the first security context as the current security context, and deletes the second security context.
The method according to any one of claims 1 to 6, further comprising:

The terminal device determines that the registration procedure has not been successfully completed.
The method according to claim 7, wherein the terminal device determines that the registration process has not been successfully completed, comprising:

Within a preset time, the terminal device does not receive a registration acceptance message, and the terminal device determines that the registration process has not been successfully completed; or,

The terminal device receives a registration rejection message, the terminal device determines that the registration process has not been successfully completed according to the registration determination message, and the registration rejection message is used to deny the terminal device access to the network; or,

Before receiving the registration acceptance message, the terminal device determines that the registration process needs to be re-initiated; or,

The terminal device receives indication information of a bottom layer failure; or,

Before receiving the registration acceptance message, the terminal device determines that the NAS security mode completion message fails to be sent; or,

The terminal device determines that the link between itself and the access network device is released before receiving the registration acceptance message; or,

Before receiving the registration acceptance message, the terminal device determines that the RRC connection between itself and the access network device is suspended or released.
A method for managing a security context, comprising:

The source mobility management network element receives a context request message from the target mobility management network element, where the context request message is used to request to acquire the context of the terminal device;

When horizontal key derivation is required, the source mobility management network element generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the source mobility managing the current security context between the network element and the terminal device;

In response to the context request message, the source mobility management network element sends a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf';

The source mobility management network element maintains the first security context and/or the second security context.
The method according to claim 9, wherein when the source mobility management network element maintains the first security context and the second security context, the method further comprises:

The source mobility management network element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, the The registration request message includes the identifier of the terminal device;

The source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message;

If the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is required, the source mobility management network element generate a new key Kamf", and send a third security context to the target mobility management network element, where the third security context includes the new key Kamf".
The method according to claim 9, wherein when the source mobility management network element maintains the first security context and the second security context, the method further comprises:

The source mobility management network element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, the The registration request message includes the identifier of the terminal device;

The source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message;

If the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is not required, the source mobility management network element sends The target mobility management network element sends the security context of successful verification.
The method according to any one of claims 9 to 11, further comprising:

The source mobility management network element receives registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network;

The source mobility management network element deletes the first security context and/or the second security context.
The method according to any one of claims 9 to 11, further comprising:

The source mobility management network element receives a de-registration notification message, where the de-registration notification message is used to instruct the source mobility management network element to perform de-registration of the terminal device;

The source mobility management network element deletes the first security context and/or the second security context.
The method according to any one of claims 9 to 11, further comprising:

After a preset time, the source mobility management network element deletes the first security context and/or the second security context.
The method according to any one of claims 9 to 11, wherein when the source mobility management network element maintains the first security context, the method further comprises:

The source mobility management network element deletes the second security context.
A method for managing a security context, comprising:

The target mobility management network element receives a registration request message from the terminal device, where the registration request message includes the identifier of the terminal device;

The target mobility management network element sends a context request message to the source mobility management network element according to the registration request message, where the context request message is used to request to obtain the context of the terminal device;

The source mobility management network element receives the context request message from the target mobility management network element;

When horizontal key derivation is required, the source mobility management network element generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the source mobility managing the current security context between the network element and the terminal device;

In response to the context request message, the source mobility management network element sends a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf';

receiving, by the target mobility management network element, the second security context from the source mobility management network element;

The target mobility management network element sends a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes horizontal derivation indication information, and the horizontal derivation indication information is used to instruct the terminal equipment to The Kamf in the first security context performs horizontal key derivation;

The source mobility management network element maintains the first security context.
The method according to claim 16, further comprising:

The source mobility management network element maintains the second security context.
The method according to claim 17, further comprising:

The source mobility management network element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, the The registration request message includes the identifier of the terminal device;

The source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message;

If the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is required, the source mobility management network element generate a new key Kamf", and send a third security context to the target mobility management network element, where the third security context includes the new key Kamf".
The method according to claim 17, further comprising:

The source mobility management network element receives a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, the The registration request message includes the identifier of the terminal device;

The source mobility management network element uses the first security context and the second security context to perform security verification on the registration request message;

If the security verification of the registration request message is successful using any one of the first security context and the second security context, and horizontal key derivation is not required, the source mobility management network element sends The target mobility management network element sends the security context of successful verification.
The method according to any one of claims 16 to 19, further comprising:

The target mobility management network element sends registration success indication information to the source migration management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network;

The source mobility management network element receives the registration success indication information from the target mobility management network element;

The source mobility management network element deletes the first security context.
The method according to claims 16 to 21, wherein the terminal device receives the NAS security mode command message from the target mobility management network element;

According to the horizontal derivation instruction information, the terminal device generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the current security context of the terminal device;

If the registration process is not successfully completed, the terminal device uses the first security context as the current security context.
A method for managing a security context, comprising:

The target mobility management network element receives the registration request message from the terminal device, where the registration request message includes the identifier of the terminal device;

The target mobility management network element sends a context request message to the source mobility management network element according to the registration request message, where the context request message is used to request to obtain the context of the terminal device;

The source mobility management network element receives the context request message from the target mobility management network element;

When horizontal key derivation is required, the source mobility management network element generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the source mobility managing the current security context between the network element and the terminal device;

In response to the context request message, the source mobility management network element sends a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf';

receiving, by the target mobility management network element, the second security context from the source mobility management network element;

The target mobility management network element sends a non-access stratum NAS security mode command message to the terminal device, the NAS security mode command message includes horizontal derivation indication information, and the horizontal derivation indication information is used to instruct the terminal equipment to The Kamf in the first security context performs horizontal key derivation;

The source mobility management network element maintains the second security context.
The method according to claim 22, further comprising:

The target mobility management network element sends registration success indication information to the source mobility management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network;

The source mobility management network element receives the registration success indication information from the target mobility management network element;

The source mobility management network element deletes the second security context.
The method according to claim 20, further comprising:

The source mobility management network element receives a de-registration notification message, where the de-registration notification message is used to instruct the source mobility management network element to perform de-registration of the terminal device;

The source mobility management network element deletes the second security context.
The method according to claim 22, further comprising:

After a preset time, the source mobility management network element deletes the second security context.
The method according to any one of claims 22 to 25, further comprising:

The source mobility management network element deletes the first security context.
The method according to claims 22 to 26, further comprising:

The terminal device receives the NAS security mode command message from the target mobility management network element;

According to the horizontal derivation instruction information, the terminal device generates a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the current security context of the terminal device;

If the registration process is not successfully completed, the terminal device sets the second security context as the current security context.
A communication device, characterized by comprising:

A transceiver module, configured to send a registration request message to a target mobility management network element, where the registration request message includes the identity of the terminal device;

The transceiver module is further configured to receive a non-access stratum NAS security mode command message from the target mobility management network element, where the NAS security mode command message includes horizontal derivation indication information;

The processing module is configured to generate a new key Kamf' according to the key Kamf in the first security context; wherein, the first security context is the current security context of the terminal device; the processing module is also configured to, If the registration process is not successfully completed, the first security context is used as the current security context.
The apparatus according to claim 28, characterized in that,

The processing module is further configured to maintain the first security context and the second security context after generating the new key Kamf'; wherein the second security context includes the Kamf' and the NAS key, The NAS key is generated according to the Kamf'.
The device according to claim 29, wherein the processing module is specifically configured to: continue to use the first security context as the current security context, and save the second security context.
The device according to claim 30, wherein the processing module is specifically configured to: continue to use the first security context as the current security context, and delete the second security context.
The device according to claim 29, wherein the processing module is specifically configured to: save the first security context, and use the second security context as the current security context.
The device according to claim 32, wherein the processing module is specifically configured to: set the first security context as the current security context, and delete the second security context.
The method according to any one of claims 28 to 33, wherein the processing module is further configured to: the terminal device determines that the registration process has not been successfully completed.
The device according to claim 34, wherein the processing module is specifically configured to: determine that the NAS security mode completion message fails to be sent before the transceiver module receives the registration acceptance message; or, before the transceiver module receives the registration acceptance message Before, it is determined that the link between itself and the access network device is released; before the transceiver module receives the registration acceptance message, it is determined that the RRC connection between itself and the access network device is suspended or released.
A communication device, characterized by comprising:

A transceiver module, configured to receive a context request message from a target mobility management network element, where the context request message is used to request to acquire the context of the terminal device;

A processing module, configured to generate a new key Kamf' according to the key Kamf in the first security context when horizontal key derivation is required; wherein the first security context is the source mobile management network the current security context between the element and the device;

The transceiver module is further configured to send a second security context to the target mobility management network element; wherein the second security context includes the new key Kamf' and a NAS key, and the NAS key is based on the Kamf' generation;

The processing module is further configured to maintain the first security context and/or the second security context.
The device according to claim 36, wherein the transceiver module is also used for:

Receive a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, the registration request message includes the The identity of the terminal device;

A processing module, configured to use the first security context and the second security context to perform security verification on the registration request message; If the security verification of the registration request message is successful and horizontal key derivation is required, the processing module is further configured to generate a new key Kamf" according to the key in the security context of the successful verification, and the transceiver module is also It is used to send a third security context to the target mobility management network element, where the third security context includes the new key Kamf".
Apparatus according to claim 36, characterized in that,

The transceiver module is further configured to receive a context request message from another target mobility management network element, the context request message is used to request the context of the terminal device, the context request message includes a security-protected registration request message, The registration request message includes the identity of the terminal device;

The processing module is further configured to use the first security context and the second security context to perform security verification on the registration request message; using any of the first security context and the second security context In a case where the security verification of the registration request message is successful and horizontal key derivation is not required, the transceiver module is further configured to send a security context of successful verification to the target mobility management network element.
Apparatus according to any one of claims 36 to 38 wherein,

The transceiver module is further configured to receive registration success indication information from the target mobility management network element, where the registration success indication information is used to indicate that the terminal device has successfully registered to the network;

The processing module is further configured to: delete the first security context and/or the second security context.
Apparatus according to any one of claims 36 to 38 wherein,

The transceiver module is further configured to receive a de-registration notification message, where the de-registration notification message is used to instruct the source mobility management network element to perform de-registration of the terminal device;

The processing module is further configured to delete the first security context and/or the second security context.
The device according to any one of claims 36 to 38, wherein the processing module is further configured to: delete the first security context and/or the second security context after a preset time.
The device according to any one of claims 36 to 38, wherein when the processing module is used to maintain the first security context, the processing module is further used to: delete the second security context.
A communication device, characterized in that the device is used to execute the method according to any one of claims 1-15.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is run on a computer, the computer executes the computer program described in any one of claims 1 to 15. Methods.
A computer program product, characterized by comprising computer program instructions, which, when run on a computer, cause the computer to execute the method according to any one of claims 1 to 15.