RU2783597C2 - Method for key update and device - Google Patents

Abstract

FIELD: communication.

SUBSTANCE: invention relates to key update means. A terminal device performs access to the main network device, using both the first access technology and the second access technology at the same time. The main network device performs repeated authentication on the terminal device via the first connection corresponding to the first access technology, and, if a start condition is met, the main network device updates the key for the second connection corresponding the second access technology.

EFFECT: provision of update of NAS key in a process, in which AMF node performs repeated authentication on a terminal device, using one access technology, which impacts on normal communication, which is performed between the terminal device and AMF node, using another access technology.

24 cl, 17 dwg

Description

The field of technology to which the invention belongs

The present invention relates to the field of communication technologies and, in particular, to a key renewal method and apparatus.

State of the art

In a 5 ^th generation (5G) system, an end device can access an access and mobility management function (AMF) node while simultaneously using the 3 ^rd generation partnership project access technology. partnership project, 3GPP) and non-3GPP access technology (non-3GPP). When an end device accesses an AMF node using both 3GPP access technology and non-3GPP access technology, the AMF node maintains a registration management (RM) state machine and a connection management (CM) state machine for 3GPP access technology and technology. non-3GPP access, respectively.

The registration management state machine corresponds to the RM state, and the RM state includes the RM registration state and the RM deregistration state. The connection control state machine corresponds to the CM state, and the CM state includes the CM connected state and the CM idle state. Upon entering the connected state from the idle state, the end device may initiate the registration procedure. Upon completion of the registration procedure, the terminal may switch from the unregistration state to the registration state. In this case, the end device has security context information such as a non-access stratum (NAS) key and a security algorithm. When the end device returns to the idle state or the deregistration state, the end device still has the NAS key and security algorithm.

Although the AMF node may separately support the state machine for 3GPP access technology and the state machine for non-3GPP access technology, the terminal device and the AMF node may share a set of NAS keys when exchanging data using two access technologies. When an AMF node needs to re-authenticate with an end device using any of the access technologies, the re-authentication process includes updating the NAS key. However, when the end device and the AMF node communicate using a different access technology, the end device and the AMF still need to use a common NAS key, or the end device and the AMF node communicate using a common NAS key. In this case, updating the NAS key in a process in which an AMF node re-authenticates an end device using one access technology may affect the normal communication that is performed between the end device and the AMF node using a different access technology.

Disclosure of the essence of the invention

Embodiments of the present disclosure provide a key renewal method and apparatus for solving the technical problem that a NAS key renewal in a process in which an AMF node performs re-authentication at a terminal device using a single access technology affects the normal communication that is performed between the end device and the AMF node using a different access technology.

According to a first aspect, an embodiment of the present disclosure provides a key renewal method applied to a communication system. The communication system includes a terminal device and a main network device. The target device accesses the underlying network device using both the first access technology and the second access technology simultaneously. The method includes: performing by the main network device re-authentication on the terminal device through the first connection corresponding to the first access technology; and, if the trigger condition is met, updating the key for the second connection corresponding to the second access technology by the host network device. According to this method, the main network device can re-authenticate with the terminal device through the first connection, and the key for the first connection can be updated during the re-authentication process. When the first trigger condition is met, the underlying network device can renew the key for the second connection. When the second trigger condition is met, the end device may renew the key for the second connection. Thus, when a terminal device accesses an AMF node using a plurality of access technologies, re-authentication can be performed at the terminal device through the first connection under the condition of affecting the normal communication that is performed between the terminal device and the AMF node through the second connection, and the keys of the two connections are updated .

In an exemplary implementation, the trigger condition is the second connection state, and the second connection state is the connected state or the idle state.

According to the method, if it is determined that re-authentication should be performed at the terminal device via the first connection, the underlying network device must additionally determine the state of the second connection, perform re-authentication at the terminal device via the first connection only when the second connection is in an idle state, and update the keys for the first connection and the second connection. Since the second connection is in a pending state, the key renewal process does not affect the normal use of the second connection by the end device and the main network device.

In a possible implementation, the trigger condition is that the second connection is in a pending state; and, if the underlying network device determines to re-authenticate to the terminal device via the first connection and the second connection is in an online state, the underlying network device sends a first message to the terminal device via the first connection, where the first message is used to instruct the terminal device to suspend use of the first connection . According to this method, if the end device continues to send the NAS message to the main network device via the first connection, the NAS counting may be cycled. In this case, the end device is notified in time to suspend the use of the first connection.

In a possible implementation, the trigger condition is that the second connection is in a pending state; and the host network device obtains the first key ID in the process of re-authenticating the terminal device through the first connection, where the first key ID is used to identify the updated key for the first connection.

In an exemplary implementation, after performing re-authentication at the terminal device via the first connection corresponding to the first access technology, the host network device may send instruction information to the terminal device via the first connection, where the instruction information is used to instruct the terminal device to update the key corresponding to the second connection. According to this method, after updating the key corresponding to the second connection, the main network device promptly instructs the terminal device to update the key for the second connection. Therefore, it can be ensured that the main network device and the terminal device perform message security protection using the same key when the message is subsequently transmitted via the second connection.

Alternatively, the instruction information may be the first key identifier. Upon receiving the first key identifier, the terminal may update the key for the second connection to the key identified by the first key identifier.

In a possible implementation, the trigger condition is that the second connection is in the connected state; and an update method using the main network device, the key for the second connection corresponding to the second access technology: suspension by the main network device using the second connection; and then updating the key for the second connection by the main network device. According to this method, the main network device suspends the use of the second connection, and then renews the key for the second connection. This avoids the impact of the key renewal procedure on the normal communication that is performed by the main network device through the second connection.

In a possible implementation, in a process in which the underlying network device re-authenticates the terminal device through the first connection, the underlying network device may obtain the first key identifier and store the second key identifier and the key for the second connection that is used before the update, where the first key identifier is used to identify the updated key for the first connection, and the second key identifier is used to identify the key for the second connection, which is used before the update.

In an exemplary implementation, after performing re-authentication at the terminal device through the first connection corresponding to the first access technology, the underlying network device may start a timer.

In a possible implementation, the trigger condition is:

the main network device receives, before the timer expires, the second message that is transmitted by the terminal device through the second connection, and the security verification that is performed by the main network device in the second message using the key for the second connection, which is used until the update is successful;

the timer expires and the host network device does not receive, until the timer expires, the second message that is transmitted by the terminal device through the second connection;

after the expiration of the timer, the main network device receives a second message, which is transmitted by the end device through the second connection, and for which security protection is not performed; or

after the expiration of the timer, the main network device receives the second message that is transmitted by the end device through the second connection, and the security check performed by the main network device for the second message using the updated key for the second connection succeeds.

In an exemplary implementation, the underlying network device may transmit a third message to the terminal device over the first connection, where the third message includes a first key identifier, a second key identifier, or instruction information, and the instruction information is used to instruct the terminal device to start a timer. According to this method, when the main network device determines that re-authentication should be performed through the first connection, if the second connection is in the connected state, the main network device can directly perform re-authentication to the terminal device through the first connection; during the re-authentication process, the key for the second connection that was used before the update can be stored. Thus, even if the main network device updates the key for the first connection by re-authenticating the terminal device through the first connection, when the main network device and the end device communicate with each other through the second connection, the key for the second connection that was used before the update, can still be used and it does not affect normal communication through the second connection. Additionally, in this method, the first connection and the second connection are disconnected. When performing authentication at the end device through the first connection, the underlying network device does not need to determine the state of the second connection. After the expiration of the timer, both the main network device and the terminal device can actively update the key for the second connection, thereby reducing the overhead of signaling the interaction between the main network device and the terminal device and simplifying the implementation.

In an exemplary implementation, after the host network device renews the key for the second connection corresponding to the second access technology, the host network device may delete the key for the second connection that is in use before the update and the second key identifier.

In an exemplary implementation, if the second connection is in the connected state, after the primary network device re-authenticates the terminal device through the first connection corresponding to the first access technology, the primary network device may set a first label, where the first label is used to indicate that the host network device has re-authenticated the target device through the first connection, or is used to indicate a key update for the second connection.

In an exemplary implementation, the trigger condition is that the second connection switches to idle state and the underlying network device determines that the first label exists.

In a possible implementation, the trigger condition is that the underlying network device determines that the first label exists; and a method for updating, by the main network device, a key for the second connection corresponding to the second access technology, including: if the second connection is in a connected state, suspending by the main network device using the second connection; and then updating the key for the second connection by the main network device.

In an exemplary implementation, after the host network device updates the key for the second connection corresponding to the second access technology, the host network device can obtain a third key identifier, where the third key identifier is used to identify the updated key for the first connection and the updated key for the second connection; and then the main network device transmits the third key ID to the terminal device.

In an exemplary implementation, after performing re-authentication at the terminal device through the first connection corresponding to the first access technology, the underlying network device sends instruction information to the terminal device, where the instruction information is used to instruct the terminal device to renew the key for the second connection.

In a possible implementation, the trigger condition is that the underlying network device determines that a second label exists and the second connection is idle; and after the primary network device re-authenticates the terminal device through the first connection, the primary network device may set a second label, where the second label is used to indicate a key update for the second connection.

According to a second aspect, an embodiment of the present disclosure provides a key renewal method applied to a communication system. The communication system includes a terminal device and a main network device. The target device accesses the underlying network device using both the first access technology and the second access technology simultaneously. The method includes: performing re-authentication by the terminal device through the first connection corresponding to the first access technology; and, if the trigger condition is met, updating the key for the second connection corresponding to the second access technology by the terminal device. According to this method, the terminal only renews the key for the second connection corresponding to the second access technology when the trigger condition is met, so that re-authentication can be performed at the terminal through the first connection, provided that the normal communication that takes place between the terminal and the terminal is not affected. AMF node through the second connection.

In an exemplary implementation, the trigger condition is that the state of the second connection is an idle state.

In an exemplary implementation, performing a re-authentication by the end device over a first connection corresponding to a first access technology includes: in the process of re-authenticating over the first connection, storing by the end device a key identifier and a key for a second connection that is used before updating where the key identifier is used to determine the key for the second connection, which is used before the update.

In a possible implementation, the trigger condition is a timer expiration; and after performing re-authentication through the first connection corresponding to the first access technology, the terminal may start a timer.

In an exemplary implementation, after the terminal device starts the timer, the method further includes: before the timer expires, the terminal device sends a message to the underlying network device via the second connection, where security is performed on the keyed message for the second connection that is used before the update; after the expiration of the timer, sending the message to the main network device via the second connection by the end device, while the message is not protected; or after the timer has expired, the end device sending the message to the underlying network device via the second connection, where the message is secured using the updated key for the second connection.

In an exemplary implementation, after the terminal device updates the key for the second connection corresponding to the second access technology, the method further includes: deleting by the terminal device the key for the second connection that was in use prior to the update and the key identifier.

According to a third aspect, an embodiment of the present disclosure provides a device, and the device has a function of realizing the actions of the main network device in the above implementation of the method. The function may be implemented in hardware, or may be implemented in hardware by executing appropriate software. The hardware or software includes one or more modules corresponding to the above function. For example, the device may be a core network device or may be a chip in a core network device.

In an exemplary implementation, the device is a primary network device, and the primary network device includes a processor. The processor is configured to support the main network device while performing the corresponding function in the above method. In addition, the host network device may further include a transmitter and a receiver, wherein the transmitter and receiver are configured to communicate between the host network device and the terminal device. In addition, the main network device may further include a memory, and this memory is configured to be connected to the processor and store program instructions and data necessary for the terminal device.

According to a fourth aspect, an embodiment of the present disclosure provides a device, and the device has a function of realizing the actions of a terminal device in the above implementation of the method. The function may be implemented in hardware, or may be implemented in hardware by executing appropriate software. The hardware or software includes one or more modules corresponding to the above function. For example, the device may be a terminal device, or may be a chip in a terminal device.

In an exemplary implementation, the device is a terminal device, and the terminal device includes a processor. The processor is configured to support the terminal device in performing the corresponding function in the above method. In addition, the terminal device may further include a transmitter and a receiver, wherein the transmitter and receiver are configured to communicate between the terminal device and the underlying network device. In addition, the terminal device may further include a memory, and the memory is configured to be connected to the processor and store program instructions and data necessary for the terminal device.

According to a fifth aspect, an embodiment of the present disclosure provides a communication system in which the system includes a terminal device and a host network device described in the above aspects. Alternatively, the system may further include a base station, an N3IWF node and a terminal device, and a main network device described in the above aspects.

According to a sixth aspect, an embodiment of the present disclosure provides a computer-readable storage medium configured to store a computer software instruction used by the above main network device. The computer-readable storage medium contains a program for performing the first aspect.

According to a seventh aspect, an embodiment of the present disclosure provides a computer-readable storage medium configured to store computer software instructions used by the aforementioned terminal. The computer software instructions include a program for performing the second aspect.

According to an eighth aspect, an embodiment of the present disclosure provides a computer-readable program product including instructions. When the computer-readable software product is running on the computer, the computer is enabled to perform the method described in the first aspect.

According to a ninth aspect, an embodiment of the present disclosure provides a computer-readable program product including instructions. When the computer-readable software product is run on the computer, the computer is enabled to perform the method described in the second aspect.

According to a tenth aspect, an embodiment of the present disclosure provides a chip system applied to a mainstream network device. The chip system includes at least one processor, memory, and a transceiver circuit. The memory, the transceiver circuitry, and at least one processor are connected to each other by communication lines. At least one memory stores instructions. The instructions are executed by the processor to perform the operations of the main network device in the manner described in the first aspect.

According to an eleventh aspect, an embodiment of the present disclosure provides a chip system applied in a terminal device. The chip system includes at least one processor, memory, and a transceiver circuit. The memory, the transceiver circuitry, and at least one processor are connected to each other by communication lines. At least one memory stores instructions. The instructions are executed by the processor to perform terminal operations in the manner described in the second aspect.

According to the method provided in the embodiments of the present disclosure, the underlying network device may re-authenticate with the terminal device through the first connection, and the key for the first connection may be updated during the re-authentication process. When the first trigger condition is met, the underlying network device can renew the key for the second connection. When the second trigger condition is met, the end device may renew the key for the second connection. Thus, when a terminal device accesses an AMF node using a plurality of access technologies, re-authentication can be performed at the terminal device through the first connection under the condition of affecting the normal communication that is performed between the terminal device and the AMF node through the second connection, and the keys of the two connections are updated .

Brief description of the drawings

Fig. 1 is a diagram of a possible network architecture according to an embodiment of the present disclosure;

Fig. 2 is a diagram of another possible network architecture according to an embodiment of the present disclosure;

Fig. 3 is a diagram of a key architecture according to an embodiment of the present disclosure;

Fig. 4 is a flowchart of a key generation method according to an embodiment of the present disclosure;

Fig. 5 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 6 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 7 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 8 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 9 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 10 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 11 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 12 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 13 is a flowchart of another key generation method according to an embodiment of the present disclosure;

Fig. 14 is a block diagram of an apparatus according to an embodiment of the present disclosure;

Fig. 15 is a block diagram of a main network device according to an embodiment of the present disclosure;

Fig. 16 is a block diagram of another device according to an embodiment of the present disclosure; and

Fig. 17 is a block diagram of an apparatus according to an embodiment of the present disclosure.

Implementation of the invention

The following describes the present invention in further detail with reference to the accompanying drawings. The particular mode of operation in the method embodiments may also apply to a device embodiment or a system embodiment. In the description of the present disclosure, unless otherwise indicated, "multiple" means two or more than two.

The system architectures and service scenarios described in this document are intended to more clearly describe the technical solutions in the present invention, but are not intended to limit the technical solutions presented in this document. One skilled in the art may be aware that as the system architecture evolves and a new service scenario emerges, the technical solutions presented in this document are applicable to a similar technical problem.

It should be noted that in the present invention, the words "example" or "for example" are used to represent an example, illustration or description. Any embodiment or implementations described as "example" or "for example" in the present invention should not be explained as preferable or having more advantages than another embodiment or implementation. More precisely, the use of the word "example" or "for example" or the like is intended to represent a relative concept in a particular way.

Embodiments of the present disclosure may be applied to a communication system that supports terminal device access to a network using at least two access technologies. For example, the communication system may be a next generation wireless communication system, such as a 5G communication system. Fig. 1 is a diagram of a possible network architecture in accordance with the present invention. The network architecture includes the following:

AMF node: An AMF node is a network element responsible for mobility management, and may be configured to implement functions other than session management in functions of a mobility management entity (MME), such as functions such as lawful interception and access authorization.

Session management function (SMF) node: The SMF node is configured to allocate a user plane session resource.

Authentication server function (AUSF) node: When performing authentication on the terminal device, the AUSF is configured to perform authentication and transmission of a parameter to be authenticated, and perform authentication for the authenticity of the terminal device. The main functions include receiving an authentication request sent by a security anchor function (SEAF) node and selecting an authentication method. When an extensible authentication protocol authentication and key agreement (EAP-AKA') authentication method is used, the AUSF node can complete the authentication performed by the network side at the end device.

SEAF node: A SEAF node may be part of an AMF node or may be an independent network element. The SEAF node is generally configured to initiate an authentication request for the AUSF and complete the authentication performed by the network side at the terminal in an evolved packet system authentication and key agreement (EPS-AKA*) process.

User plane function (UPF) node: The UPF node is a user plane data output and is configured to be connected to an external network.

Data network (DN): A DN is a network used to provide external data, such as the internet.

A (radio) access network (R)AN node): A (R)AN may use different access technologies. Currently, there are two types of radio access technologies: 3GPP access technology (eg, radio access technology used in 3G, 4G or 5G systems) and non-3GPP access technology. 3GPP access technology is an access technology conforming to the 3GPP standard specification. The access network using 3GPP access technology is called a radio access network (RAN), and the network access device in the 5G system is referred to as a next generation node base-station (gNB). Non-3GPP access technology is an access technology that does not comply with the specification of the 3GPP standard, such as the air interface technology represented by a WiFi access point (AP).

Terminal device: The terminal device in the present invention is a device having functions of receiving and sending wirelessly, and can be deployed on land, including indoors or outdoors, portable or in a vehicle. It can also be deployed on water (such as ships) or in the air (such as aircraft, balloons, and satellites). The terminal device may include various types of user equipment (user equipment, UE), mobile phones (mobile phones), tablet computers (pad), computers with wireless receiving and sending functions, wireless data cards, virtual reality terminal device (virtual reality, VR) augmented reality (AR) devices, machine type communication (MTC) terminal devices, industrial control terminal devices, self-driving terminal devices, remote medical system, smart grid terminal devices, transportation safety terminal devices, smart city terminal devices, wearable devices (such as smart watches) , smart bracelet and pedometer) and the like. In systems using different radio access technologies, the names of terminal devices with similar wireless communication functions may be different. For ease of description only, in the embodiments of the present disclosure, the aforementioned devices having wireless communication functions for receiving and sending are collectively referred to as terminal devices.

In particular, the tag in the present invention stores a durable key and an associated function. When performing bi-directional authentication with a primary network device (eg, AMF node, AUSF node, or SEAF node), the end device can authenticate the network with a durable key pair and associated function.

Network access device: The network access device in the embodiments of the present disclosure is a device that provides a wireless communication function to a terminal device. For example, the network access device may be a base station (base station, BS), and the base station may include various forms of macro base stations, micro base stations, relay stations, access points, and the like. In systems using different radio access technologies, the names of devices that perform the function of a base station may be different. For example, in a 5G system, the device is referred to as a next generation node base station, which can be represented as a gNB. In a Long Term Evolution (LTE) system, a device is called an evolved NodeB (evolved NodeB, eNB or eNodeB). In the 3rd ^generation (3G) communication system, the device is referred to as Node B, and so on. For ease of description, in embodiments of the present disclosure, the aforementioned devices that provide a wireless communication function for a terminal device are collectively referred to as network access devices.

Network exposure function (NEF) node: The NEF node is generally configured to interoperate with a third party such that the third party can indirectly interact with some network elements in a 3GPP network.

Network repository function (NRF) node: The NRF node is configured to discover a specific network element and maintain a network function (NF).

Policy control function (PCF) node: The PCF node stores the latest quality of service (QoS) rule. The base station may allocate an appropriate resource to the user plane transmission channel based on the QoS rule provided to the SMF by the node.

Unified data management (UDM) node: The UDM node is configured to store user subscription information.

Application function node (AF): An AF node may be located within a DN and belongs to a functional network element deployed to a third party. This NE is primarily used to notify the host PCF of the latest service requirements for a third party application. The PCF node may generate an appropriate QoS rule based on the service requirement to ensure that the service provided by the network meets the requirement proposed by the third party.

In embodiments of the present disclosure, a terminal may access an AMF node using at least two access technologies. For example, at least two access technologies include 3GPP access technology and non-3GPP access technology. Embodiments of the present disclosure further provide a diagram of a possible network architecture as shown in FIG. 2. The network architecture includes an AMF node, an AUSF node, an SMF node, a UPF node, a UDM node (or an authentication credential storage and processing function (APRF) node), an end device, and a non-3GPP node of the interworking function (non-3GPP interworking function, N3IWF).

For AMF node, AUSF node, SMF node, UPF node, UDM node, and terminal, see the description in FIG. 1. Details are not described here again.

The N3IWF node is configured to support the tag to access the AMF node using non-3GPP access technology.

With regard to the network architecture shown in FIG. 2, a terminal can access an AMF node using both 3GPP access technology and non-3GPP access technology. The network access device in 3GPP access technology may be a base station in a 5G network, a base station in a 4G network, or a base station used in a future telecommunications network. The non-3GPP access technology may be a network access technology used by a non-telecommunications network such as a Wi-Fi network or a fixed network. A 3GPP access technology may simply be represented as 3GPP, and a non-3GPP access technology may simply be represented as non-3GPP. Path 1 in FIG. 2 is the route that the terminal device accesses the AMF node using 3GPP access technology, and path 2 is the route that the terminal device accesses the AMF node using non-3GPP access technology. The terminal may access the AMF node using a gateway corresponding to the appropriate access technology, a functional entity co-deployed with the gateway, or an entity having a gateway function. The non-3GPP technology compliant gateway may be an N3IWF node, or may be a gateway used when an end device accesses an AMF node using a fixed network access technology such as BNG (Broadband Network Gateway, Fixed Network Gateway). The gateway entity is a peer connected to an AMF node, such as the other end of the N2 interface in a 5G network and the other end of an S1 interface in a 4G network.

When a tag accesses an AMF node using both 3GPP and non-3GPP access technology, if the tag needs to send a NAS message to the AMF node, in an exemplary implementation the NAS message can be split into at least two message blocks. Some message blocks are sent using 3GPP access technology and some other message blocks are sent using non-3GPP access technology. For example, a NAS message may be divided into five message blocks: 1, 2, 3, 4, and 5. Message blocks 2 and 4 are transmitted using 3GPP access technology, and message blocks 1, 3, and 5 are transmitted using non-3GPP access technology. . In another possible implementation, the terminal may send the entire NAS message using 3GPP access technology and send another full NAS message using non-3GPP access technology.

First, terms related to embodiments of the present disclosure are explained.

(1) RM condition

RM is used to manage the end device and the network. The RM state includes two states: a registration state and a deregistration state.

When the terminal is in the deregistration state, the terminal may attempt to enter the registration state by sending a registration procedure to the underlying network device (eg, an AMF node). Upon receipt of a registration accept message, to which the node responds with an AMF, the terminal enters the registration state. When the tag is turned off or fails to enter the registration state, the tag returns to the unregister state.

When the terminal is in the registration state, the AMF node has location information, routing information, and security context information of the terminal, and the terminal has security context information.

When the terminal is in the deregistration state, the AMF node has no location or routing information of the terminal, and both the AMF node and the terminal have security context information. The security context information includes the NAS key and the associated algorithm. If the tag returns from the registration state to the deregistration state, then not only saves the security context information, but also saves the temporary identity information allocated by the AMF node during the previous registration so that the tag cannot initiate the authentication procedure when the tag registers again on the network, thereby reducing network access latency.

(2) CM state

The CM state includes a connected state and an idle state.

When the end device is in the connected state, there is a communication connection between the end device and the network, i.e., data is exchanged between the end device and the AMF node.

When the terminal device is idle, there is no communication connection between the terminal device and the network, i.e., there is currently no communication between the terminal device and the AMF node.

(3) State switching

When the terminal device has not gained access to the network, the terminal device is in the idle state and the deregistration state. In this case, there is no security context information between the end device and the AMF node. The terminal device first switches from the idle state to the connected state, and then the terminal device can initiate the registration procedure and switches from the deregistration state to the registration state. In this case, the target device has a NAS key and a security algorithm. If the terminal does not subsequently need to communicate with the network, the terminal may return to the idle state and the terminal is still in the registration state after returning to the idle state.

When the end device returns from the connected state to the idle state, the security context information stored by the end device is the NAS key and the security algorithm. When the tag returns from the registration state to the non-registration state, the tag stores the NAS key, security algorithm, and temporary identification information allocated by the AMF during the previous registration.

It should be noted that state switching in the present invention means that the SM state of the terminal device in the main network device returns from one state to another state. For example, switching from the connected state to the idle state means that the SM state of the terminal device in the main network device returns from the connected state to the idle state. For example, when the tag sends a registration request message to the underlying network device, the tag is in an online state. After the host network device sends a registration complete message to the terminal device, if the terminal device does not immediately send a message to the main network device or the terminal device does not send a message to the main network device within a certain period of time controlled by a timer, the terminal device returns to waiting state.

Additionally, the time used for the "switch" action is not limited in the embodiments of the present disclosure. In particular, the time required to switch the second connection from the connected state to the idle state may be controlled by a timer or may be controlled by a switching procedure. This is not limited in the present invention.

(4) First access technology and second access technology.

The terminal device supports network access using both the first access technology and the second access technology at the same time. The first access technology is a 3GPP access technology, and the second access technology is a non-3GPP access technology. Alternatively, the first access technology is a non-3GPP access technology and the second access technology is a 3GPP access technology. Of course, the present invention is not limited to this. The first access technology and the second access technology may alternatively be another access technology supported when the terminal communicates with the underlying network device.

The first connection is a connection through which the terminal device accesses the first underlying network device using the first access technology.

The second connection is a connection through which a terminal device accesses a second underlying network device using a second access technology.

The terminal device using the first connection and the second connection is the same terminal device, but the first primary network device and the second primary network device may be the same or different. This document uses an example where the end device supports access to the same underlying network device using both the first and the second connection.

Additionally, the first connection and the second connection in the present invention may be direct connections or indirect connections between a terminal device and a main network device. For example, the second connection is a connection through which the terminal device accesses the gateway device using the second access technology and accesses the core network element using the gateway device. Fig. 2 is used as an example. The terminal device can access the AMF node using 3GPP access technology. The first connection can be understood as a communication path between the terminal device and the AMF node when the terminal device uses 3GPP access technology, that is, path 1. Alternatively, the terminal device can access the AMF node using non-3GPP access technology / When the terminal device accesses the AMF node using a non-3GPP access technology, the end device does not communicate directly with the AMF node, and communicates with the AMF node using the N3IWF node. The second connection is the connection between the end device and the N3IWF node and the connection between the N3IWF node and the AMF node, and can also be considered as path 2.

(5) Reauthentication

Re-authentication means that: when the main network device detects that the parameter type is expected to be unavailable, for example, NAS COUNT is about to loop, or the start condition is met based on the operator's configuration requirement, the main network device authenticates to the end device again. In a process in which the core network device performs re-authentication with the terminal device, the core network device exchanges a message with the terminal device. The tag compares the verifiable parameter provided by the core network with another parameter generated by the tag, and the core network device compares the verifiable parameter provided by the tag with another parameter generated by the core network device. If the parameter to be verified provided by the main network device matches the parameter generated by the target device, or if the parameter to be verified provided by the end device matches the parameter generated by the main network device authentication verification performed between the end device and the main network device , completes successfully.

For example, the authentication verification procedure may be a 5G AKA procedure in a 5G network, an EAP-AKA' procedure, or an EPS AKA procedure in an LTE network.

Alternatively, the re-authentication procedure in embodiments of the present disclosure may include an authentication verification procedure and a key activation procedure. In particular, in the authentication verification procedure, the main network device and the terminal device can check whether the information to be verified sent by each other is correct. In the key activation procedure, the host network device sends a NAS (security mode command, SMC) message to the end device and receives a security mode complete (SMP) NAS message from the end device.

(6) Main network device

The core network device is a device in the 3GPP network other than the access network device. The underlying network device may be an AMF node, an SMF node, or may be a network device such as a SEAF node, AUSF node, or UDM node.

The main network device is not limited to the device that checks the end device, such as an AUSF node in a 5G network. Alternatively, the underlying network device may be a device participating in the authentication procedure, such as a device (eg, an AMF node) configured to forward messages in the authentication procedure. Alternatively, the core network device may further have an independent function, such as SEAF, deployed with the core network device.

Additionally, the underlying network device that initiates the re-authentication procedure for the terminal device may be the same or different from the main network device that performs the authentication check on the terminal device. Authentication verification means that the main network device checks the correctness of the information to be authenticated sent by the end device. For example, in the 5G AKA scenario, the main network device that initiates the re-authentication procedure is an AMF node or a SEAF node deployed along with an AMF node. In this scenario, the primary network device that initiates the re-authentication procedure may be the AMF node, and the primary network device that performs the authentication check on the terminal device is the SEAF node in the AMF node. In this case, it can be considered that the main network device that initiates the re-authentication procedure for the end device is the same as the main network device that performs the authentication check on the end device, and both are AMF nodes. In this scenario, if the SEAF node is not deployed along with the AMF node, that is, the SEAF node is also an independent primary network device, the primary network device that initiates the re-authentication procedure for the end device is different from the device. which performs an authentication check on the end device.

For another example, in a 5G EAP-AKA' scenario, the main network device that initiates the re-authentication procedure may be an AMF node, and the device that performs authentication checks at the terminal device is an AUSF node. In this case, the main network device that initiates the re-authentication procedure for the end device is different from the main network device that performs the authentication check on the end device.

(7) Key

Both the key for the first connection and the key for the second connection are NAS keys. The NAS key includes an encryption key and an integrity protection key. The key for the first connection is used to protect the message that is sent between the end device and the main network device through the first connection, and the key for the second connection is used to protect the message being sent between the end device and the main network device through the second connection.

The key architecture in embodiments of the present disclosure is shown in FIG. 3. In FIG. 3, the high level key may be used as a low level key generation parameter. Alternatively, the re-authentication process may generate a key for the first connection and another key used to obtain the first connection. For example, in FIG. 3, all keys except the first level key, K, are updated during the re-authentication process. For example, the key for the first connection could be KNASint, KNASenc, KRRCint, KRRCenc, KUPint, KUPenc, and so on.

Alternatively, if the old key needs to be preserved during the key renewal process, the stored old key may be at least one of KNASint, KNASenc, KgNB, NH, KRRCint, KRRCenc, KUPint, KUPenc, or KN3IWF. Possibly KAMF, KSEAF or KAUSF are also retained.

With reference to FIG. 1-fig. 3 embodiment of the present disclosure provides a key renewal method applied to a communication system. The communication system includes a main network device and a terminal device. The target device accesses the underlying network device using both the first access technology and the second access technology simultaneously. As shown in FIG. 4, the method includes the following steps.

Step 401: The main network device performs re-authentication at the terminal device through the first connection corresponding to the first access technology; accordingly, the terminal device performs re-authentication on the main network device through the first connection corresponding to the first access technology.

In a process in which the main network device re-authenticates the terminal device through the first connection, both the main network device and the end device can renew the key for the first connection. For example, the host network device and end device can generate new keys for the first connection, such as keys such as KAUSF, KSEAF, KAMF, KNASint, or KNASenc.

Alternatively, in a process in which the host network device re-authenticates the terminal device through the first connection, the host network device may further obtain a first key identifier, where the first key identifier is used to identify the updated key for the first connection. When the primary network node is an AMF node, there are three ways for the node to obtain the first AMF key ID:

Method 1: The AMF node generates the first key identifier.

Method 2: The AMF node obtains the first key ID from another primary network device. For example, the first key ID is obtained from the node's SEAF.

Method 3: The AMF node obtains from the other main network device the information used to generate the first key ID, and then generates the first key ID based on the information used to generate the first key ID.

Alternatively, during the re-authentication process, the underlying network device may send the first key identifier to the end device.

It can be understood that upon receiving the first key identifier, the terminal may update the key for the first connection to the key identified by the first key identifier.

Step 402: If the first trigger condition is met, the host network device updates the key for the second connection corresponding to the second access technology.

Alternatively, the first trigger condition may be a second connection state, and the second connection state may be an idle state or a connected state.

Alternatively, the first trigger condition may alternatively be that the second connection is in a deregistration state. If the primary network device determines that the second connection is in a deregistration state, this indicates that the primary network device and the terminal device are not currently using the second connection. In this case, neither the re-authentication process performed on the end device nor the key renewal process for the second connection affects the use of the second connection by the main network device and the end device.

Step 403: If the second trigger condition is met, the terminal updates the key for the second connection corresponding to the second access technology.

According to the method provided in this embodiment of the present disclosure, the main network device may re-authenticate with the terminal device through the first connection, and the key for the first connection may be updated during the re-authentication process. When the first trigger condition is met, the underlying network device can renew the key for the second connection. When the second trigger condition is met, the end device may renew the key for the second connection. Thus, when a terminal device accesses an AMF node using a plurality of access technologies, re-authentication can be performed at the terminal device through the first connection, as long as the normal communication that takes place between the terminal device and the AMF node through the second connection is not affected, and the keys of the two connections are updated.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. Additionally, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need be performed.

With respect to the embodiment shown in FIG. 4, in an exemplary implementation scenario, the first trigger condition is that the second connection is in a pending state. If the main network device determines that the main network device needs to re-authenticate the terminal device through the first connection, but the second connection is in a connected state at the time, as shown in FIG. 5, the method includes steps 501 to 505.

501. The main network device sends the first message to the terminal device through the first connection, where the first message is used to instruct the terminal device to suspend use of the first connection. Accordingly, the terminal device receives the first message from the main network device through the first connection.

It can be understood that when the second connection is in the connected state, in order to avoid the impact of the re-authentication process on the communication that is performed between the end device and the main network device through the second connection, the re-authentication of the end device through the first connection can be suspended. After the second connection switches from the connected state to the idle state, re-authentication is performed at the end device through the first connection. Due to reasons such as that the NAS COUNT used by the end device is about to change, the main network device needs to re-authenticate with the end device. If the end device continues to send the NAS message to the primary network device via the first connection, the NAS COUNT may continue. In this case, the underlying network device can instruct the terminal device to suspend using the first connection. Alternatively, if the security context of the first connection can be additionally used once, the underlying network device may instruct the terminal device to send to the underlying network device, only over the first connection or the second connection, the NAS message protected with the security context of the existing first connection before performing re-authentication.

Step 502: After the second connection switches from the connected state to the idle state, the host network device re-authenticates the terminal device through the first connection corresponding to the first access technology. Accordingly, the terminal performs re-authentication through the first connection corresponding to the first access technology.

Alternatively, after the second connection switches from the connected state to the idle state, if the first connection is still in the connected state, the method of step 502 is performed.

Alternatively, after the second connection switches from the connected state to the idle state, if the first connection is in the idle state, the underlying network device may re-authenticate the terminal device through the first connection corresponding to the first access technology or the second connection corresponding to the second access technologies. It can be appreciated that since both connections are in the idle state, the end device can access the network again using either connection. When this case occurs, the second connection can be considered to become the first connection in this embodiment of the present disclosure, and the original first connection becomes the second connection.

Alternatively, in the process of performing re-authentication at the terminal device through the first connection, the host network device may further update the key for the second connection and obtain a third key identifier, where the third key identifier is used to determine the updated key for the second connection. It should be noted that if the first connection and the second connection share a set of NAS keys, the third key ID is the same as the first key ID, or it can be understood that the main network device does not need to obtain the third key ID, and the first key ID can be further used to identify updated key for the second connection.

In another possible implementation, upon detecting that the second connection is returning to the idle state, the terminal may send a message to the primary network device over the first connection or the second connection to cause the primary network device to re-initiate authentication at the terminal. In yet another possible implementation, when the first connection is in the idle state, after the end device receives a procedure completion message over the second connection, and before the second connection switches to the idle state, the end device may send a message to the underlying network device. to start the main network device to perform re-authentication on the target device through the second connection. In this case, the second connection can be considered to become the first connection in the present invention, and the original first connection becomes the second connection.

Alternatively, the key for the second connection may be updated after the primary network device re-authenticates the terminal device through the first connection, i.e., after step 502, step 503 can be additionally performed.

Step 503: The main network device updates the key for the second connection corresponding to the second access technology.

In particular, if the second connection is in the idle state, the main network device can renew the key for the second connection corresponding to the second access technology after re-authentication.

Alternatively, the underlying network device may further obtain a third key ID.

Step 504: The main network device transmits the first instruction information to the terminal device through the first connection.

The first connection is used to tell the end device to update the key for the second connection.

Alternatively, the first instruction information may be a first key identifier or a second key identifier. Alternatively, the first instruction information may be a first key identifier and a second key identifier.

Step 505: The terminal updates the key for the second connection.

It can be understood that the second trigger condition is that the target device receives information about the first instruction from the main network device through the first connection.

Alternatively, if the first instruction information is a first key identifier, the terminal may update the key for the second connection to the key indicated by the first key identifier; or, if the first instruction information is the second key identifier, the terminal may update the key for the second connection to the key indicated by the second key identifier.

It should be noted that in any embodiment of the present disclosure, if the host network device instructs the terminal device by sending a key identifier to the terminal device to update the key for the second connection, the terminal device may update the key for the second connection with the key indicated by the key identifier sent by the primary network device. .

According to the key renewal method provided in this embodiment of the present disclosure, if it is determined that re-authentication should be performed at the terminal device through the first connection, the main network device further needs to determine the state of the second connection, performs re-authentication at the terminal device through the first connection, only when the second connection is pending, and updates the keys for the first and second connections. Since the second connection is in a pending state, the key renewal process does not affect the normal use of the second connection by the end device and the main network device.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need to be performed.

With respect to the method shown in FIG. 4, alternatively, in another possible implementation scenario, the first trigger condition is that the second connection is in the connected state. When the main network device determines that the main network device should re-authenticate to the end device through the first connection, if the second connection is in the connected state, the main network device may suspend the use of the second connection, and then re-authenticate to the end device through the first connection, to update the keys for the first connection and the second connection.

Alternatively, in another possible implementation scenario, the timer may be pre-configured for the node and terminal AMF. After the core network device re-authenticates the terminal device through the first connection and renews the key for the first connection, if the second connection is in an online state, the core network device and the terminal device can start a timer. Once the core network and end device determine that the timer has expired, the old key for the second connection cannot be used. On the other hand,

after the main network device re-authenticates the terminal device through the first connection and renews the key for the first connection, if the second connection is in the connected state, the main network device starts a timer after re-authentication is completed; and the terminal automatically starts the timer. Once the core network determines that the timer has expired, the old key for the second connection can no longer be used. Likewise, after determining that the timer expires, the end device can no longer use the old key for the second connection. On the other hand,

in a process in which the main network device re-authenticates the terminal device through the first connection or after the re-authentication is completed, the main network device transmits the first key ID to the terminal device, and then the main network device and the terminal device each set label information to indicate that if the second connection switches to the idle state, the main network device and the end device update the key for the second connection.

With reference to FIG. 4, alternatively, in another possible implementation scenario, the first trigger condition is timer or label information. As shown in FIG. 6, the method includes the following steps.

Step 601: The main network device re-authenticates with the terminal device through the first connection corresponding to the first access technology. Accordingly, the terminal device performs re-authentication on the main network device through the first connection corresponding to the first access technology.

Alternatively, in a process in which the primary network device re-authenticates the terminal device through the first connection, the primary network device obtains the first key ID and stores the second key ID and key for the second connection that is used before the update where the first key ID is used to identify the updated key for the first connection, and the second key identifier is used to identify the key for the second connection, which is used before the update.

Accordingly, in the process of re-authenticating over the first connection, the terminal stores the second key ID and the key for the second connection that is used before the update, where the second key ID is used to identify the key for the second connection that is used before the update.

It should be noted that in this embodiment of the present disclosure, the key for the second connection that is used before the update is the old key for the second connection, and the updated key for the second connection is the new key for the second connection. The new key for the second connection is associated with the key generated during the re-authentication of the end device through the first connection.

Step 602: The underlying network device starts a timer.

The value that causes the timer to expire may be a timer value that is currently in use, such as a non-3GPP access technology related timer value, such as a deregistration timer value, or may be a timer value related to 3GPP access technology, for example, by the value of the periodic registration timer. When starting the timer, the underlying network device may directly use the value of the timer that is counting down, may set a value less than the value of the timer that is counting down, or may set a value unrelated to the value of an existing timer. Alternatively, the operator may pre-configure the value at which the timer expires so that the value at which the timer expires represents the actual key duration for the second connection that is in use before the update, i.e., the duration at which the key for the second connection that was in use before the update , can still be used.

Step 603: The host network device transmits the second message to the terminal device via the first connection. Accordingly, the terminal device receives the second message.

Alternatively, the second message conveys instruction information, and the instruction information is used to instruct the tag to start the timer. Alternatively, the second message may be a NAS SMC message.

Alternatively, the second message further conveys a first key identifier or a second key identifier.

Step 604: The terminal starts a timer.

Alternatively, if the second message received by the terminal transmits a first key identifier or a second key identifier, the terminal may determine that the key for the second connection needs to be updated and then start a timer; or, if the second message received by the terminal conveys instruction information, the terminal may start the timer in accordance with the instruction information.

Alternatively, the value at which the timer started by the terminal device expires may be the same or different from the value at which the timer started by the underlying network device expires. If the values differ, the value at which the timer started by the terminal device expires may be less than the value at which the timer started by the underlying network device expires. The value at which the timer started by the terminal expires may be a timer value that is currently in use, such as a non-3GPP access technology related timer value, such as a deregistration timer value, or may be a timer value related to the 3GPP access technology, for example, a periodic update timer value (periodic registration timer). When starting the timer, the underlying network device may directly use the value of the timer that is counting down, may set a value less than the value of the timer that is counting down, or may set a value unrelated to the value of an existing timer. Alternatively, the operator may pre-configure the value at which the timer expires so that the value at which the timer expires represents the actual key duration for the second connection that is in use before the update, i.e., the duration for which the key for the second connection that was in use before the update, you can still use it.

Step 605: If the second trigger condition is met, the terminal updates the key for the second connection.

Alternatively, the second trigger condition may be that the tag's timer expires. After the timer expires, the terminal may reset the key for the second connection that is used before the update, or the terminal may update, based on the new key generated during the re-authentication process, the key used for the second connection. For example, the NAS tier key newly generated during the re-authentication process is used as the new key, or the new NAS tier key is derived using the key newly generated during the re-authentication process, such as Kamf.

It should be noted that the sequence of step 605 and step 606 is not limited in the present invention. Step 605 may be performed before step 606, or may be performed after step 606 and step 607. In FIG. 6, step 605 is used as an example, which is performed first.

Step 606: The tag sends the third message to the underlying network device via the second connection. Accordingly, the host network device receives the third message from the terminal device via the second connection.

The third message is a NAS message and may be, for example, a registration request message or a session establishment request message. There are at least several of the following cases in which the end device sends the third message to the main network device via the second connection:

Case 1: Before the timer expires, the end device sends the third message to the main network device via the second connection, where security protection is performed on the third message using the key for the second connection, which is used before the update.

Case 2: After the timer expires, the end device sends the third message to the main network device through the second connection, where no security protection is performed for the third message. It can be understood that in this case, if the timer expires, the terminal cannot actively renew the key for the second connection. Alternatively, the tag may send a third message over the second connection, and then perform step 607. After step 607, the underlying network device may send a message to the tag over the second connection used to update and activate the new key. For example, the message contains instruction information for instructing the tag to update the second connection key or the third key identifier, and then the tag performs step 605. According to this case, the second trigger condition in step 605 is that the tag receives the instruction information or third key identifier. Alternatively, in this case, the terminal may renew the key for the second connection after sending the third message to the primary network device, i.e., the second trigger condition is that the terminal's timer expires, i.e., the terminal executes step 605 after step 606.

Case 3: After the timer expires, the end device sends the third message to the main network device via the second connection, where the third message is secured with the updated key for the second connection.

Alternatively, in case 3, after the timer expires, the terminal may actively renew the key for the second connection, i.e., step 605 is performed after step 606. According to this case, the second trigger condition in step 605 is that the terminal's timer device expires.

Step 607: If the first trigger condition is met, the underlying network device updates the key for the second connection.

According to the three cases at step 605, there are also three types of first trigger conditions:

According to case 1, the first type of trigger condition is: the main network device receives before the expiration of the timer the third message, which is transmitted by the terminal device through the second connection, and the security check performed by the main network device in the third message, using the key for the second connection, which is used until successful update.

Alternatively, in this case, the end device does not renew the key for the second connection before sending the third message to the main network device. Therefore, after updating the key for the second connection, the main network device can instruct the terminal device to update the key for the second connection, for example, update the key for the second connection in a subsequent key activation procedure, for example, NAS SMC process.

Alternatively, in the process in which the main network device processes the third message, the timer expires and the main network device can send an error message to the terminal device. The error message may contain a failure reason value, and the reason value is used to notify the end device that the key for the second connection is in use before the update expires.

Alternatively, in a process in which the host network device processes the third message, if the timer expires, security protection may be performed using the updated key for the second connection for the message subsequently sent by the host network device to the terminal device. Since the tag updates the key for the second connection after the tag's timer expires, the tag can perform, using the updated key for the second connection, a security check on the message received over the second connection after the timer expires.

According to case 2, the second type of triggering condition: after the timer expires, the main network device receives the third message, which is transmitted by the terminal device through the second connection and on which security protection is not performed. In this case, the main network device includes an updated key for the second connection in a subsequent key activation procedure, such as a NAS SMC procedure.

According to case 3, the third type of trigger condition: after the timer expires, the main network device receives the third message, which is transmitted by the end device through the second connection, where security protection is performed for the third message by using the renewed key for the second connection. Accordingly, the underlying network device performs a security check on the third message using the updated key for the second connection.

Alternatively, a fourth type of trigger condition may additionally be used: the timer expires and the host network device does not receive, before the timer expires, the third message that is transmitted by the terminal device over the second connection.

For the fourth type of trigger condition, that is, the end device does not send a third message to the core network device from the time the core network device timer starts until the time the core network timer expires, the core network device resets the key for the second connection, which is used before update, after the timer of the main network device has expired. Alternatively, the primary network device further renews the key for the second connection. Alternatively, the host network device instructs the terminal device to renew the key for the second connection.

Alternatively, after the timer expires, the second connection does not immediately return to the pending state. In the time period from when the timer expires to when the second connection returns to the idle state, if the terminal device sends a registration request message to the main network device, the main network device may re-authenticate with the terminal device.

It should be noted that before the timer expires, if the primary network device has updated the key for the second connection, the primary network device may stop the timer. Similarly, if the end device renews the key for the second connection before the timer expires, the end device may also stop the timer.

Step 608: The underlying network device deletes the key for the second connection that is in use before the update and the second key identifier.

It can be understood that at step 607, after the key update for the second connection, the main network device can perform step 608.

Step 609: The terminal deletes the key for the second pre-renewal connection and the second key identifier.

It can be understood that at step 605, after updating the key for the second connection, the terminal may perform step 609.

According to the key renewal method provided in this embodiment of the present disclosure, when the core network determines that the core network should perform re-authentication through the first connection, if the second connection is in the connected state, the core network device can directly perform re-authentication to the terminal device through the first connection and may store the key for the second connection, which is used before updating during the re-authentication process. Thus, even if the main network device re-authenticates the terminal device through the first connection and updates the key for the first connection, when the main network device and the end device communicate with each other through the second connection, the key for the second connection that was used before the update is all can still be used and it does not affect normal communication through the second connection. Additionally, in this method, the first connection and the second connection are severed. When performing authentication at the end device through the first connection, the underlying network device does not need to determine the state of the second connection. After the expiration of the timer, both the main network device and the terminal device can actively renew the key for the second connection, thereby reducing the signaling overhead between the main network device and the terminal device, and simplifying the implementation.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need be performed.

Alternatively, as shown in FIG. 4, in another possible implementation scenario, when the core network determines that the core network needs to re-authenticate at the terminal device through the first connection, as shown in FIG. 7, the method includes the following steps.

Step 701: The main network device performs re-authentication at the terminal device through the first connection corresponding to the first access technology; accordingly, the terminal performs re-authentication on the main network device through the first connection corresponding to the first access technology.

Step 702: The primary network device sets the first label. Alternatively, the second connection is in the connected state.

The first label is used to indicate that the underlying network device has re-authenticated to the terminal device through the first connection, or is used to indicate a key update for the second connection.

It should be noted that if the first label is used to indicate that the primary network device has re-authenticated at the end device through the first connection, it also implicitly indicates that the primary network device needs to renew the key for the second connection.

Step 703: If the first trigger condition is met, the host network device updates the key for the second connection.

Alternatively, in a process in which the host network device re-authenticates the terminal device through the first connection, the second connection may return to the idle state. Based on this, the first trigger condition is that the second connection is in the pending state and the underlying network device detects the presence of the first label.

Alternatively, after the primary network device re-authenticates the end device through the first connection and the second connection is still connected, the first trigger condition in this case is that the primary network device determines that the first label exists, and the corresponding way to update the key for the second connection by the main network device: if the second connection is in the connecting state, it is first suspended by the main network device using the second connection, and then the key for the second connection is updated. Alternatively, before replying to the end device with a message over the second connection, the host network device first exchanges a key update and activation procedure with the end device to renew the key for the second connection. The host network device then sends a response message to the end device. For example, the key for the second connection is updated in the NAS SMC procedure.

It should be noted that if the second connection is returned to the idle state in a process in which the main network device re-authenticates the end device through the first connection, the main network device can update the key for the second connection when the main network device receives the NAS message again, for example a registration request message that is sent by the end device over the second connection, and the underlying network device determines the presence of the first label. For example, the key for the second connection is updated by exchanging the key renewal and activation procedure with the end device.

Alternatively, the host network device may determine, based on the key identifier information carried in the message sent by the terminal device, the particular set of keys used by the terminal device. In this case, the host network device determines the keys based on the key ID and verifies, using the keys corresponding to the key ID, the message sent by the terminal device. After successful validation, the key set is used as the updated keys for the second connection.

It can be understood that: after the key update for the second connection, the main network device can resume using the second connection; and when the NAS message is subsequently sent via the second connection, the underlying network device can perform integrity protection of the NAS message using the updated key for the second connection.

Step 704: The main network device obtains the third key identifier.

The third key identifier is used to identify the updated key for the second connection.

Alternatively, if the first connection and the second connection share a set of NAS keys, the primary network device may not obtain the first key ID during the re-authentication process, but will receive the third key ID after the key update for the second connection. In this case, the third key identifier may be used to identify the updated key for the first connection and the updated key for the second connection.

Alternatively, if the first connection and the second connection share a set of NAS keys, the main network device may not obtain the third key ID, but directly use the first key ID obtained during the re-authentication process. In other words, the first key identifier obtained during the re-authentication process can be used to identify the updated key for the first connection and the updated key for the second connection.

Step 705: The main network device transmits the third key identifier to the terminal device. Accordingly, the terminal device receives the third key identifier from the main network device.

It should be noted that after the main network device updates the key for the second connection, if the second connection is in the connecting state, the main network device can send the third key identifier to the terminal device through the second connection, where integrity protection is performed for the third key identifier using the updated key for the second connection; if the second connection is pending, the main network device can send the third key ID to the end device via the first connection, and integrity protection is performed on the third key ID using the updated key for the first connection.

Alternatively, if the first connection and the second connection share a set of NAS keys, and the primary network device does not receive the third key ID, the primary network device may send the first key ID to the terminal device.

Alternatively, the host network device may further send to the terminal at least one parameter used to update the key for the second connection, such as an encryption algorithm and an integrity protection algorithm, which are selected when the host network device updates the key for the second connection. and type of access technology.

Step 706: The terminal updates the key for the second connection.

It can be understood that in this case, the second trigger condition is that the target device receives the third key ID from the main network device.

Alternatively, a third key identifier may be carried in the NAS message. If the terminal device receives the third key identifier over the second connection, the terminal device may update the key for the second connection based on the third key identifier, that is, update the key for the second connection to the key identified by the third key identifier, and perform a NAS message integrity protection check using updated key for the second connection. After successful validation, the updated key for the second connection becomes valid. If the terminal device receives the third key identifier via the first connection, the terminal device may perform an integrity check on the NAS message using the updated key for the second connection, and update the key for the second connection after successful verification.

According to the key generation method provided in this embodiment of the present disclosure, regardless of whether the second connection is in the idle state, the main network device may first renew the key for the first connection. After updating the key for the first connection, if the second connection returns to the pending state, the key for the second connection may be updated after the tag next sends a registration request message to the primary network device via the second connection. If the second connection is still in the connected state, in order to avoid the main network device and the end device to perform security protection, still using the key for the second connection, which is used before the update when sending a message to each other over the second connection and therefore the security check message fails, the main network device can suspend the use of the second connection, that is, first suspend the NAS messaging that is performed between the main network device and the end device through the second connection, and then renew the key for the second connection. After the upgrade, NAS messaging between the main network device and the end device can be resumed through the second connection. In this case, security protection is performed on the NAS message using the updated key for the second connection. After the underlying network device performs re-authentication at the end device via the first connection, the security check of the message that is transmitted via the second connection is prevented from failing.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need to be performed.

With reference to FIG. 4, in the foregoing exemplary implementation scenario, when the core network determines that the core network should re-authenticate at the terminal through the first connection if the second connection is in the connected state, an embodiment of the present disclosure further provides another possible implementation. As shown in FIG. 8, the method includes the following steps.

Step 801: The main network device performs re-authentication at the terminal device through the first connection corresponding to the first access technology; accordingly, the terminal device performs re-authentication on the main network device through the first connection corresponding to the first access technology.

Step 802: The host network device transmits the second instruction information to the terminal device via the first connection. Accordingly, the terminal device receives the second instruction information from the main network device.

The second instruction information is used to instruct the end device to renew the key for the second connection.

In this implementation, the ability to update the key for the second connection is not limited. To be specific, it is not limited whether the tag updates the key immediately after receiving the second instruction information or updates the key after a period of time after receiving the second instruction information. This method emphasizes that the terminal device performs a key renewal action for the second connection after receiving the second instruction information.

Step 803: The primary network device sets the second label.

The second label is used to indicate to update the key for the second connection.

It should be noted that the sequence of step 802 and step 803 is not limited in the present invention. The two steps may be performed simultaneously, or either of the two steps is performed first.

Step 804: The terminal sets the third label.

The third label is used to indicate to update the key for the second connection.

Step 805: If the underlying network device detects the presence of the second label and the second connection switches to idle state, the core network device updates the key for the second connection.

It can be understood that in this case, the first trigger condition is that the underlying network device detects the presence of the second label, and the second connection switches to the idle state.

Step 806: If the tag determines the presence of the third label and the second connection switches to idle state, the tag updates the key for the second connection.

It can be understood that in this case the second trigger condition is that the terminal detects the presence of the third label and the second connection switches to the idle state.

Alternatively, the terminal may not set the third label. After updating the key for the second connection, the host network device may send instruction information to the terminal device to instruct the terminal device to update the key for the second connection.

Alternatively, after the second connection switches to the idle state, the terminal may temporarily not renew the key for the second connection. When the tag needs to send a message to the main network device over the second connection, if it is determined that a third label exists, the tag updates the key for the second connection.

It can be understood that after the end device updates the key for the second connection, integrity protection can be performed using the updated key for the second connection in the NAS message that is transmitted by the end device to the main network device via the second connection.

According to the key renewal method provided in this embodiment of the present disclosure, when the main network device determines that the main network device needs to re-authenticate to the terminal device through the first connection, if the second connection is in the connected state, the main network device can first re-authenticate on the end device via the first connection. After re-authentication, the host network device may set a second label, and the terminal device may set a third label. After the second connection switches to the idle state, both the main network device and the end device can update the key for the second connection based on the labels set by the main network device and the end device, thereby reducing the overhead generated during the key update process. for the second connection.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need be performed.

The key generation method provided in the embodiments of the present disclosure is described below with reference to a specific scenario. With reference to FIG. 4 and FIG. 6 in the implementation scenario corresponding to FIG. 6 as shown in FIG. 9, the method specifically includes the following steps.

Step 901: The tag sends the NAS message to the AMF node via the first connection. Accordingly, the AMF node receives the NAS message through the first connection.

For example, the NAS message may be a Registration Request message, a Service Request message, or a Session PDU Establishment Request message, or may be another NAS message. This is not limited in the present invention.

The NAS message contains a key identifier used to identify the first connection key, and the NAS message is protected with the first connection key.

Step 902: The AMF node performs an integrity check on the NAS message, where the check succeeds, and determines that the AMF node needs to re-authenticate to the tag through the first connection.

The AMF node determines the key for the first connection based on the key identifier carried in the NAS message. After verifying the integrity of the NAS message using the key for the first connection, which is determined based on the key identifier, when the verification succeeds, the AMF node can determine if re-authentication is required at the terminal device. For example, upon determining that the NAS COUNT used by the end device is about to change, the AMF node determines that the end device must be re-authenticated. As an alternative to AMF, the node may determine, based on the operator's configuration information, whether to perform re-authentication at the terminal. Of course, the present invention is not limited to the above two methods for determining whether a terminal needs to re-authenticate.

Step 903: The AMF node initiates a re-authentication at the terminal through the first connection. Accordingly, the terminal performs re-authentication through the first connection.

The re-authentication includes an authentication verification procedure and a key activation procedure.

Step 904: The AMF node updates the key corresponding to the first connection and obtains the first key identifier.

The first key identifier may be obtained during the authentication process, and the first key identifier is used to identify the updated key for the first connection.

It should be noted that if the first connection and the second connection use different keys, after updating the key for the first AMF connection, the node can delete the key for the first connection that is in use before the update, and keep the key for the second connection and the second key identifier, where the second key identifier used to identify the key for the second connection, which is used before the update; or

if the first connection and the second connection share a set of keys, when the AMF node renews the key for the first connection, alternatively, the AMF node must still save for the second connection the key for the first connection in use before the update and the second identifier key. The second key identifier is used to determine the key for the second connection, which is used before the update. It can be understood that the key for the second connection, which is used before the update, is the same as the key for the first connection, which is used before the update. In particular, if the second connection is in the connected state, in the manner in which the AMF node sets the identity information or the timer value, the AMF node still needs to store for the second connection the key for the first used connection before the update and the second key identifier.

Step 905: The AMF node sends an SMC message to the NAS via the first connection. Accordingly, the tag receives the NAS SMC message from the AMF node via the first connection.

The SMC NAS message is equivalent to the second message in step 603. Alternatively, the SMC NAS message contains a first key identifier, a second key identifier, or indication information, where the indication information is used to instruct the tag to start the timer.

Alternatively, if the NAS SMC message received by the tag contains instruction information that is used to direct the tag to start a timer, the tag starts the timer. Alternatively, if the terminal determines that the SMC message received by the NAS contains a first key identifier or a second key identifier, the terminal may start a timer.

Alternatively, when the timer method is used, even if the NAS SMC message does not contain a first key identifier, a second key identifier, or instruction information, the terminal may start the timer after checking that the NAS SMC integrity protection is correct or after sending the SMP NAS message. The start of the timer can be performed by the end device very short time after the end device confirms that the integrity of the NAS SMC message is properly protected, or after the end device sends an SMP message to the NAS. For example, the timer starts immediately after the NAS checks the SMC message, or immediately after the SMP NAS sends it. In this method, the first key identifier has been passed to the end device in the authentication procedure.

Note that the AMF node may alternatively start the timer before executing step 905 or start the timer after step 908.

The value that causes the timer to expire is the actual key duration for the second connection, which is used before the update. For example, it is assumed that the first connection and the second connection have a common set of keys. Until the timer expires, the key for the first connection that was in use before the update can still be used by the second connection; after the timer expires, the key for the first connection that was in use before the update cannot be used to secure the message sent between the AMF node and the end device over the second connection.

Step 906: The terminal updates the key for the first connection.

It can be understood that in the re-authentication process, the end device receives the NAS SMC message from the AMF node through the first connection and renews the key corresponding to the first connection.

After updating the key for the first connection, the terminal may delete the key for the first connection that was in use before the update and keep the key for the second connection and the second key identifier. Deleting the key for the first connection that was in use before the upgrade means that the key cannot be used again by the first connection. This action only applies to the first connection and is not related to the second connection.

Step 907: The tag sends an SMP NAS message to the AMF node over the first connection. Accordingly, the AMF node receives the SMP NAS message.

The NAS SMP node performs integrity protection using the updated key for the first connection.

It should be noted that steps 904 to step 907 can also be understood as a process in which the underlying network device performs re-authentication at the terminal device through the first connection.

Step 908: The AMF node sends a completion message to the terminal via the first connection; accordingly, the end device receives a completion message from the node's AMF.

The completion message is a response message to the NAS message in step 901. For example, if the NAS message in step 901 is a registration request message, the NAS message is a registration complete message.

Step 909: The tag sends the NAS message to the AMF node via the second connection. Accordingly, the AMF node receives the NAS message through the second connection.

The NAS message contains a second key identifier, and the NAS message is secured with a key for the second connection, which is used before updating.

Alternatively, the NAS message further comprises a first key identifier.

Similarly, the NAS message may alternatively be a Registration Request message, a Service Request message, or a Session Establishment Request PDU message. Of course, the present invention is not limited to this.

The NAS message is equivalent to the third message in step 606. In the case where the tag sends the NAS message to the AMF node via the second connection, see the description of step 606. Details are not described here again.

Step 910: The AMF node updates the key for the second connection.

The AMF node can only renew the key for the second connection when the first trigger condition is met. The description of the first trigger condition can be understood from the corresponding description of step 607. Again, details are not described here.

Alternatively, the AMF node may obtain a third key identifier corresponding to the updated key for the second connection, where the third key identifier is used to identify the updated key for the second connection. Alternatively, if the first connection and the second connection share a set of NAS keys, the AMF node may not generate a third key ID, but uses the first key ID to identify the updated key for the first connection and the updated key for the second connection.

It should be noted that after updating the key for the second AMF connection, the node may delete the key for the second connection that was used before the update and the key ID used to identify the key for the second connection that was used before the update. As an alternative to the AMF, the node may choose, based on various trigger conditions, to remove the key for the second connection that is used before the update and the key identifier used to identify the key for the second connection that is used before the update, before the key for the second connection is updated.

Step 911: The AMF node sends the NAS SMC message to the tag through the second connection. Accordingly, the end device receives the NAS SMC message from the AMF node via the second connection.

If the first connection and the second connection share a set of keys, the NAS SMC message contains the identifier of the first key.

Alternatively, if the first connection and the second connection use different keys, the NAS SMC message contains a third key identifier.

Step 912: The terminal updates the key for the second connection.

Alternatively, upon receipt of the NAS SMC message, the end device renews the key for the second connection. Alternatively, the key for the second connection may be updated based on the first key ID or the third key ID carried in the NAS SMC message.

Possibly after the end device starts the timer, if the end device timer does not expire, the end device stops the timer after re-keying for the second connection.

After updating the key for the second connection, the terminal may delete the key for the second connection that is used before the update and the key ID used to identify the key for the second connection that is used before the update.

Step 913: The tag sends the NAS SMP message to the AMF node over the second connection. Accordingly, the AMF node receives the NAS SMP message through the second connection.

The integrity of the NAS SMP message is protected based on the updated key.

Alternatively, after the primary network device starts a timer, if the primary network device timer does not expire, the primary network device stops the timer after the key update for the second connection.

Step 914: The AMF node sends a completion message to the terminal via the second connection. Accordingly, the end device receives the completion message via the second connection.

The completion message is a response message to the NAS message in step 901. For example, if the NAS message in step 901 is a registration request message, the completion message is a registration completion message.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need be performed.

Alternatively, in the implementation scenario corresponding to FIG. 5, when the AMF node determines that the AMF node should re-authenticate to the terminal device via the first connection, the AMF node must determine the state of the second connection, and may re-authenticate to the terminal device via the first connection only when the second connection state is an idle state. As shown in FIG. 10, the method includes steps 1001 to 1012.

Steps 1001-1002 are similar to steps 901-902, and details are not described here again.

Step 1003: The AMF node determines the state of the second connection.

When the AMF node determines that the AMF node must re-authenticate with the terminal device, the re-authentication method used when the second connection is in the connected state is different from the authentication method used when the second connection is in the idle or unregistered state. Therefore, the AMF node needs to determine if the second connection is in the connected state.

Alternatively, for example, the terminal supports access to an AMF node using both 3GPP access technology and non-3GPP access technology. The AMF node may first determine if the terminal is accessing the AMF node using 3GPP access technology and non-3GPP access technology. If a terminal accesses an AMF node using both 3GPP access technology and non-3GPP access technology, it indicates that a second connection exists between the AMF node and the terminal device, and then it is determined whether the second connection of the terminal device is in the connected state.

To quickly determine if the second connection is in the connected state, the AMF node may first determine if the second connection of the tag is in the registration state. If it is determined that the second tag connection is in a deregistration state, the AMF node may determine that the second tag connection cannot be in the connected state. If it is determined that the second terminal connection is in the registered state, the AMF node further determines whether the second terminal connection is in the connected state.

At least the following three methods are used for an AMF node to determine if a terminal is accessing an AMF node using two access technologies simultaneously:

(1) The NAS message in step 1001 contains indication information used to indicate that the second connection of the terminal device is in the registration state, and the AMF node can determine based on the indication information that the second connection of the terminal device is in the registration state, that is, the terminal the device accesses the AMF node using two access technologies.

In this AMF method, the node can directly determine the state of the second connection of the terminal based on the received indication information. This is convenient and fast, and the AMF node does not need to perform other requests.

(2) The AMF node determines, by querying the terminal state machine maintained by the AMF node, that the terminal still has a different registration state associated with a different access technology than the access technology corresponding to the first connection.

In this AMF method, the node can determine the state of the second connection with a simple query operation, and the terminal does not need to additionally add indication information to the NAS message used to indicate the state of the second connection.

(3) The AMF node stores instruction information used to instruct the terminal device to use two access technologies simultaneously for access.

For example, when a terminal has accessed an AMF node using an access technology (eg, 3GPP access technology), if the AMF node determines that the terminal successfully accesses the AMF node using a different access technology (eg, non-3GPP access technology), The AMF node may set the ID in the context of the end device. The identifier is used to indicate the number of access technologies with which the end device is currently accessing the AMF node. For example, when the ID is 0, it indicates that the terminal is accessing the AMF node using the same access technology. When the identifier is 1, it indicates that the terminal is accessing the AMF node using two access technologies at the same time, or indicates that the terminal is in a dual registration state. The dual registration state is a state in which a terminal registers with an AMF node using two access technologies.

As another example of an AMF, a node may set indication information for a file shared by two access technologies to indicate that the content in the shared file is shared by the two access technologies. Before the content of a file can be deleted or changed, it must be determined whether the content of the file is in use. The content of the file may be a NAS key and an associated security algorithm shared by the two access technologies. The AMF node may determine, based on the indication information corresponding to the file, that the terminal is accessing the AMF node using two access technologies at the same time.

Additionally, there are at least three of the following possible implementations for an AMF node to determine if a second terminal connection is in an online state:

(1) The AMF node determines that the AMF node is communicating with the end device via the second connection.

For example, the AMF node sends a NAS message to the tag via the second connection, or the AMF node paging the tag via the second connection.

(2) The AMF node determines, by querying the tag state machine maintained by the AMF node, that the second tag connection is in the connected state.

(3) The AMF node determines, using the indication information stored in the AMF node, that the second terminal connection is in the connected state.

For example, if the AMF node detects an identifier that is stored by the AMF node and that indicates that the terminal is in a dual registration state or a dual connected state, for example, detects an identifier that is 1, the AMF node determines that the terminal's second connection is in the connected condition.

For another example, if the AMF node detects that the indication information corresponding to a file stored in the AMF node indicates that the content of the file is shared by two access technologies and the content of the file cannot be changed, this indicates that the content of the file is being used by the second connection, and the AMF node may further determine that the second terminal connection is in the connected state.

In this embodiment, an example is used for description in which the state of the second connection is the connected state.

Step 1004: The AMF node sends a reject message or an accept message to the terminal over the first connection.

The first message in step 501 may be a reject message or an acceptance message in this step. The reject message indicates that the AMF node rejects the NAS message sent by the terminal in step 1001, eg, rejects the registration request message sent by the terminal. Alternatively, the reject message contains a reason value, and the reason value is used to notify the end device that the reject reason is that the second connection is in an online state. In this case, re-authentication on the end device is not possible. Alternatively, the cause value is further used to indicate that the integrity check performed by the AMF node in the NAS message sent by the tag in step 1101 was successful.

Alternatively, if the NAS COUNT corresponding to the first connection does not temporarily go into a loop, the AMF node further allows the end device to continue to send the specified number of NAS messages, or the end device sends a periodic registration message to the AMF node over the first AMF connection, the node can send to the end device acceptance message over the first connection.

The acceptance message contains information about the re-authentication flag bits, and the information about the re-authentication flag bits is used to notify the terminal device that re-authentication should be performed on the terminal device. However, since the second connection is in the connected state, re-authentication cannot be temporarily initiated. After the tag receives the re-authentication flag bit, the tag's action is restricted. For example, the reauthentication identifier may be used to instruct the end device to suspend use of the first connection, or the end device may only transmit user plane data over the first connection, or the end device may send a certain number (e.g., one) of NAS messages over the first connection only (which means that the security context of the first connection may additionally be used once), or the terminal may only send a registration request message over the first connection for which no integrity protection is performed.

The re-authentication flag bit information may alternatively be timer information. If re-authentication is not performed on the end device before the timer expires, the AMF node puts the end device into a deregistration state. Alternatively, the AMF node removes the entire security context of the end device, so that the end device needs to re-authenticate the next time it accesses the network.

Step 1005: The terminal determines that the second connection has been switched to the idle state.

Step 1006: The tag sends the NAS message to the AMF node using any connection. Accordingly, the AMF node receives the NAS message. The connection to send the NAS message becomes the first connection in the present invention.

Alternatively, the NAS message may be a registration request message.

If the tag receives the reject message at 1004, the tag may send a NAS message to the AMF node using any connection.

If the tag receives an accept message in step 1004 and the re-authentication flag bit indicates that the tag can send the specified number of NAS messages over the first connection, the tag can send a single NAS message to the AMF node over the first connection for which integrity protection is performed. . If the re-authentication flag bit indicates that the terminal device can send a registration request message for which security is not secured, the terminal device may send a registration request message for which security is not performed to the primary network device via the first or second connection.

It can be understood that if an AMF node receives a NAS message for which integrity protection is performed, the AMF node first performs an integrity protection check on the NAS message.

Step 1005 and step 1006 are possible steps, that is, after step 1004, step 1007 can be performed directly.

Step 1007: The AMF node determines that the second connection is in an idle state.

For a method for determining the state of the second AMF connection by the node, see the corresponding description of step 1003. Again, details are not described here.

Step 1008: The AMF node re-authenticates with the tag through the first connection.

Alternatively, if the tag sends a NAS message to the AMF node via the second connection in step 1006, the AMF node may re-authenticate the tag via the second connection in this step. Below, an example is used for description in which the AMF node performs re-authentication at the end device through the first connection.

Alternatively, at this point in the AMF, the node may update the key for the first connection and the key for the second connection, and the terminal may update the key for the first connection. Alternatively, if the first connection and the second connection share a set of NAS keys, the AMF node may obtain the first key ID in the process of performing re-authentication at the end device, where the first key ID is used to identify the updated key for the first connection and the updated key for the second connection. .

Alternatively, if the first connection and the second connection individually use different NAS keys, the AMF node may obtain the first key identifier in the process of performing re-authentication on the end device. Alternatively, the AMF node may additionally obtain a third key identifier. In this case, the first key identifier is used to identify the updated key for the first connection, and the third key identifier is used to indicate the updated key for the second connection.

Step 1009: The AMF node sends a NAS SMC message to the tag. Accordingly, the end device receives the NAS SMC message.

Alternatively, the NAS SMC message may convey the first instruction information at step 504.

The first instruction information is used to direct the terminal to update the key for the second connection.

Alternatively, the first instruction information may be a first key identifier or a second key identifier. Alternatively, the first instruction information may be a first key identifier and a second key identifier.

Integrity protection may be performed on the NAS SMC message using the updated key for the first connection, and the end device may perform an integrity protection check on the NAS SMC message using the updated key for the first connection.

Step 1010: The tag updates the key for the second connection based on the first instruction information.

Step 1011: The tag sends a NAS SMP message to the AMF node via the first connection; accordingly, the AMF node receives the NAS SMP message through the first connection.

Integrity protection is performed in the NAS SMP message using the updated key for the first connection.

Alternatively, the end device may optionally send a NAS SMP message to the AMF node via the second connection. In this case, the NAS SMP message is integrity protected using the updated key for the second connection.

Step 1012: The AMF node sends a completion message to the terminal via the first connection. Accordingly, the end device receives a completion message from the node's AMF via the first connection.

The completion message is a response message to the NAS message in step 1001. For example, if the NAS message in step 1001 is a registration request message, the completion message is a registration completion message.

It can be appreciated that if the tag subsequently transmits the NAS message to the tag via the second connection, integrity protection may be performed on the NAS message using the updated key for the second connection.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need to be performed.

Alternatively, in the implementation scenarios of FIG. 7 and FIG. 8, when the AMF node determines that the AMF node needs to re-authenticate with the terminal device through the first connection, if the second branch is in the connected state, the main network device may first re-authenticate with the terminal device through the first connection. As shown in FIG. 11, the method includes steps 1101-1115.

Steps 1101-1103 are similar to steps 1001-1003, and details are not described here again.

Step 1104: The AMF node re-authenticates with the tag through the first connection.

The AMF node and end device may renew the key for the first connection during the re-authentication process.

Step 1105: The AMF node sends the NAS SMC message to the tag through the first connection. Accordingly, the end device receives the NAS SMC message from the AMF node through the first connection.

Integrity protection is performed on the NAS SMC message using the updated key for the first connection, and the end device may perform integrity protection checks on the NAS SMC message using the updated key for the first connection.

Alternatively, the NAS SMC message contains second instruction information in step 802, where the second instruction information is used to direct the tag to update the key for the second connection, or the second instruction information may be used to direct the tag not to update the key for the second connection.

Step 1106: The tag sends the NAS SMP message to the AMF node over the first connection.

Step 1107: The AMF node sets the first label.

The first label is used to indicate that the underlying network device has re-authenticated to the terminal device through the first connection, or is used to indicate a key update for the second connection.

Step 1108: The terminal sets the second label.

The second label is used to indicate to update the key for the second connection.

Alternatively, step 1108 should only be performed when the second instruction information received by the tag is used to direct the tag to update the key for the second connection.

Step 1109: The AMF node sends a registration acceptance message to the terminal over the first connection. Accordingly, the tag receives the registration accept message from the AMF node via the first connection.

Step 1110: The terminal determines that the second connection has been switched to the idle state. If a third label is determined, the terminal updates the key for the second connection.

Alternatively, if the terminal does not set the third flag, step 1111 should be performed when the second connection switches to the idle state.

Step 1111: The AMF node determines that the second connection has switched to idle state. If the presence of the first label is determined, the AMF node updates the key for the second connection.

Alternatively, if the second connection is still in the connected state, the AMF node may suspend use of the second connection. Alternatively, when the NAS is processing a message that is sent by the endpoint over the second connection, if the AMF node detects the first label, the AMF node may suspend use of the second connection, then update the key for the second connection and use a key ID to identify the updated key for the second connection, and sending the NAS SMC message to the end device via the second connection. The NAS SMC message contains a key ID used to identify the updated key for the second connection, so that the end device can update the key for the second connection based on the key ID. It can be understood that after both the AMF node and the terminal update the key for the second connection, the AMF node can resume using the second connection and perform, using the updated key for the second connection, integrity protection of the NAS message transmitted over the second connection.

Step 1112: The tag sends a registration request message to the AMF node over the second connection. Accordingly, the AMF node receives a registration request message from the terminal via the second connection.

Integrity protection is performed in the registration request message using the updated key for the second connection.

Step 1113: The AMF node sends the NAS SMC message to the tag through the second connection. Accordingly, the end device receives the NAS SMC message from the AMF node via the second connection.

The NAS SMC message contains a key identifier used to identify the updated key for the second connection. Alternatively, the NAS SMP message may further contain at least one parameter used to update the key for the second connection.

Step 1114: The tag sends the NAS SMP message to the AMF node over the second connection. Accordingly, the AMF node receives the NAS SMP message from the tag through the second connection.

Integrity protection is performed in the NAS SMP message using the updated key for the second connection.

Step 1115: The AMF node responds to the terminal with a Registration Accept message over the second connection. Accordingly, the terminal receives the registration acceptance message from the AMF node via the second connection.

Integrity protection is performed on the registration accept message using the updated key for the second connection.

It can be understood that a terminal device or a host network device may perform some or all of the steps in the above embodiment. These steps or operations are merely examples. In embodiments of the present disclosure, other operations or variants of various operations may additionally be performed. In addition, the steps may be performed in a different order from the sequence shown in the previous embodiment, and alternatively, not all operations in the previous embodiment need to be performed.

In another possible implementation scenario, the condition for triggering a key update for the second connection is related to the timer and the state of the second connection. As shown in FIG. 12, the method includes steps 1201-1212.

In steps 1201-1208, the terminal device communicates with the main network device through the first connection.

Step 1201: The terminal device sends a registration request message to the main network device via the first connection; accordingly, the AMF node receives a registration request message.

Alternatively, the registration request message may alternatively be a NAS message in step 901. See the corresponding description of step 901 for details. Again, details are not described here.

Step 1202: The underlying network device triggers a re-authentication.

Step 1203: The main network device and the terminal device perform a re-authentication procedure.

Step 1204: The primary network device sends the NAS SMC a message to the terminal device. Accordingly, the end device receives the NAS SMC message.

Step 1205: The terminal activates the new key for the first connection and starts a timer.

The fact that the end device activates the new key for the first connection means that the key for the first connection has been updated, and then the end device performs security protection using the updated key for the first connection, in the message transmitted by the NAS from the end device subsequently to the main network device through the first compound.

Step 1206: The terminal device sends the NAS SMP message to the underlying network device. Accordingly, the end device receives the NAS SMP message from the main network device.

Step 1207: The main network device activates the new key for the first connection and starts the timer.

The fact that the primary network device activates the new key for the first connection means that the key for the first connection has been updated, and then the primary network device performs security protection using the updated first connection key on the NAS message, which is transmitted by the primary network device subsequently to the endpoint. device through the first connection.

Step 1208: The host network device sends a registration complete message to the terminal device. Accordingly, the terminal device receives a registration completed message.

In steps 1209-1212, the tag establishes communication with the main network device via the second connection.

Step 1209: Before the timer expires, if the second connection is pending, the terminal removes the old second connection key and the old key identifier, activates the new second connection key, and stops the timer.

If the first connection and the second connection share a set of keys, the new key for the second connection will be the same as the new key for the first connection. The first key identifier is used to specify the new key for the first connection and the new key for the second connection.

Alternatively, before the timer expires, if the second connection is in the connected state, the end device may still use the old key for the second connection.

Step 1210: The tag sends a registration request message to the host network device. Accordingly, the host network device receives the registration request message.

Integrity protection is performed in the registration request message using the new key for the second connection, and the registration request message conveys the first key identifier.

Step 1211. The main network device determines, based on the first key ID, to activate a new key for the second connection, deletes the old key for the second connection, and stops the timer.

After receiving the registration request message, the host network device can determine, based on the first key ID, that the new key for the second connection matches the new key for the first connection, and further perform an integrity check on the registration request message using the new key for the second connection. . After successful verification, the main network device deletes the old key for the second connection and stops the timer.

Step 1212: The host network device sends a registration complete message to the terminal device; accordingly, the terminal device receives a registration completion message from the main network device.

Integrity protection is performed to report registration completion using the new key for the second connection.

In another possible implementation, as shown in FIG. 13, the condition for triggering the key update for the second connection is irrelevant to the state of the second connection. As shown in FIG. 13, the method includes steps 1301-1314.

Steps 1301-1308 are similar to steps 1201-1208, and the details are again not described here.

In steps 1309-1314, the tag communicates with the underlying network device via the second connection.

Step 1309: Before the timer expires, the terminal decides to use the old key for the second connection.

The second key identifier is used to identify the old key for the second connection. It can be understood that in this embodiment of the present disclosure, the new key is the updated key and the old key is the key that is in use prior to the update. When the first connection and the second connection share a set of keys, the old key for the second connection is the same as the key before the first connection is used for re-authentication.

Step 1310: The tag sends a registration request message to the host network device that is integrity protected using the old key for the second connection, where the registration request message contains the second key identifier. Accordingly, the host network device receives the registration request message.

Step 1311: Based on the second key ID, the main network device determines the old key for the second connection, and performs an integrity check on the registration request message using the old key for the second connection.

Step 1312: The host network device sends a registration complete message to the terminal device.

Step 1313: After the timer expires, the terminal removes the old key for the second connection and the second key identifier.

Step 1314: When the timer expires, the host network device deletes the old key for the second connection and the second key identifier.

After deleting the old key for the second connection and the second key ID, the terminal device and the underlying network device can use the new key for the first connection as the new key for the second connection.

Alternatively, in the method procedure of FIG. 13, before the timers of the terminal device and the main network device expire, if the main network device starts the re-authentication procedure again, the timers of the terminal device and the main network device can continue to synchronize. Upon expiration of the timers, steps 1313 and 1314 are performed. Alternatively, the terminal device and the host network device may restart synchronization and, after the timer expires, perform step 1313 and step 1314.

The foregoing mainly describes the solutions provided in the embodiments of the present disclosure in terms of interaction between a network core device and a terminal device. It can be understood that in order to implement the above functions, the terminal device and the underlying network device include respective hardware structures and/or software modules to perform these functions. With respect to the blocks and steps of the algorithm in the examples described in the embodiments disclosed in the present invention, the embodiments of the present disclosure may be implemented in hardware or a combination of hardware and computer software. The performance of a function by hardware or hardware controlled by computer software depends on the particular application and design constraints of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be understood that the implementation is beyond the technical solutions in the embodiments of the present disclosure.

In embodiments of the present disclosure, functional blocking may be performed at the terminal device and the main network device based on the method examples above. For example, each function block may be obtained by splitting based on a corresponding function, or two or more functions may be integrated into one processing block. An integrated block may be implemented in hardware or may be implemented in a software function block. It should be noted that in the embodiments of the present disclosure, block division is used as an example and is simply a division of logical functions. In a real implementation, a different partitioning method may be used.

When an integrated block is used, FIG. 14 is a block diagram of an apparatus according to an embodiment of the present disclosure. The device may be implemented in the form of software, or may be a core network device, or may be a chip in a core network device. The device 1400 includes a processing unit 1402 and a communication unit 1403. Processing unit 1402 is configured to control the operation of device 1400. For example, processing unit 1402 is configured to support device 1400 in performing steps 401 and 402 in FIG. 4, steps 502 and 503 in FIG. 5, steps 601, 602, 607 and 608 in FIG. 6, steps 701, 702, 703, and 704 in FIG. 7, steps 801, 803 and 805 in FIG. 8, steps 902, 903, 904, and 910 in FIG. 9, steps 1002, 1003, 1005, 1007, and 1008 in FIG. 10 and steps 1102, 1103, 1104, 1107, and 1112 in FIG. 11, steps 1202, 1203, 1207, and 1211 in FIG. 12, steps 1302, 1303, 1307, 1311, and 1314 in FIG. 13 and/or another process of the technology described herein. The communication unit 1403 is configured to communicate between the device 1400 and another network element (eg, terminal). For example, communication unit 1403 may support device 1400 while executing steps 501 and 504 in FIG. 5, step 603 in FIG. 6, step 705 in FIG. 7, step 802 in FIG. 8, steps 905, 908, 911, and 914 in FIG. 9, steps 1004, 1009 and 1014 in FIG. 10, steps 1105, 1109, 1113 and 1115 in FIG. 11, steps 1204, 1208, and 1212 in FIG. 12 and steps 1304, 1308 and 1312 in FIG. 13. Device 1400 may further include a storage unit 1401 configured to store program code and data of device 1400.

Processing unit 1402 may be a processor or controller such as a Central Processing Unit (CPU), a general purpose processor, a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a programmable gate matrix (Field Programmable Gate Array, FPGA) or other programmable logic device, transistorized logic device, hardware component, or a combination of both. The controller/processor may implement or execute various examples of logical blocks, modules, and circuits described with reference to the content disclosed in the present invention. The processor may be a combination of processors that implement a computing function, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor. The communication unit 1403 may be a communication interface, and communication interface is a general term. In a specific implementation, the communication interface may include a plurality of interfaces and may include, for example, an interface between access network devices, an interface between an access network device and a host network device, and/or another interface. The storage unit 1401 may be a memory.

When the processing unit 1402 is a processor, the communication unit 1403 is a communication interface, and the storage unit 1401 is a memory, the structure of the device 1400 in this embodiment of the present disclosure may be that of a main network device shown in FIG. fifteen.

In FIG. 15 shows a possible diagram of a basic network device according to an embodiment of the present disclosure.

As shown in FIG. 15, the main network device 1500 includes a processor 1502, a communication interface 1503, and a memory 1501. Alternatively, the main network device 1500 may further include a bus 1504. The communication interface 1503, the processor 1502, and the memory 1501 may be connected to each other. using bus 1504. Bus 1504 may be a PCI bus, an EISA bus, or the like. Bus 1504 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, the bus in FIG. 2 is indicated by only one thick line 15, but this does not mean that there is only one tire or only one type of tire.

When an integrated block is used, FIG. 16 shows a schematic block diagram of another device according to an embodiment of the present disclosure. Device 1600 may be implemented in software, or may be a terminal device, or may be a chip in a terminal device. The device 1600 includes: a processing unit 1602 and a communication unit 1603. Processing unit 1602 is configured to direct and control the operation of device 1600. For example, processing unit 1602 is configured to support device 1600 while performing steps 401 and 403 in FIG. 4, step 505 in FIG. 5, steps 604, 605 and 609 in FIG. 6, step 706 in FIG. 7 and steps 801, 804 and 806 in FIG. 8, steps 903, 906 and 912 in FIG. 9, steps 1008 and 1010 in FIG. 10, steps 1104, 1108 and 1110 in FIG. 11, steps 1205 and 1209 in FIG. 12 and steps 1305, 1309 and 1313 in FIG. 13 and/or another process of the technology described in this specification. The communication unit 1603 is configured to communicate between the device 1600 and another network element (such as a core network device and an N3IWF node). For example, communication unit 1603 is configured to support device 1600 in step 606 of FIG. 6, steps 901, 907, 909 and 913 in FIG. 9, steps 1001, 1006 and 1011 in FIG. 10, steps 1101, 1106, 1111 and 1114 in FIG. 11, steps 1201, 1206 and 1210 in FIG. 12 and steps 1301, 1306 and 1310 in FIG. 13. Device 1600 may further include a memory unit 1601 configured to store program code and data of device 1600.

Processing unit 1602 may be a processor or controller such as a Central Processing Unit (CPU), a general purpose processor, a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a programmable gate matrix (Field Programmable Gate Array, FPGA) or other programmable logic device, transistorized logic device, hardware component, or a combination of both. The controller/processor may implement or execute various examples of logical blocks, modules, and circuits described with reference to the content disclosed in the present invention. The processor may be a combination of processors that implement a computing function, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor. The communication unit 1603 may be a transceiver, a transceiver circuit, a communication interface, or the like. The storage unit 1601 may be a memory.

When the processing unit 1602 is a processor, the communication unit 1603 is a transceiver, and the storage unit 1601 is a memory, the device 1600 in this embodiment of the present disclosure may be the terminal device shown in FIG. 17.

In FIG. 17 shows a simplified diagram of a possible structural structure of a terminal device in an embodiment of the present disclosure. Terminal 1700 includes a transmitter 1701, a receiver 1702, and a processor 1703. Alternatively, processor 1703 may be a controller, and is represented as "controller/processor 1703" in FIG. 17. Alternatively, tag 1700 may further include a modem processor 1705, and modem processor 1705 may include an encoder 1706, a modulator 1707, a decoder 1708, and a demodulator 1709.

In an example, transmitter 1701 adjusts (eg, through analog conversion, filtering, amplification, and upconversion) an output sample and generates an uplink signal. The uplink signal is transmitted by the antenna to the base station in the above embodiments. In the downlink, the antenna receives the downlink signal transmitted by the base station in the above embodiments. Receiver 1702 adjusts (eg, through filtering, amplifying, downconverting, and digitizing) the signal received from the antenna and provides an input sample. At modem processor 1705, encoder 1706 receives the overhead and signaling message to be sent on the uplink and processes (eg, through formatting, encoding, and interleaving) the overhead and signaling message. Modulator 1707 further processes (eg, through symbol mapping and modulation) the encoded overhead and the signaling message and provides a sample output signal. A demodulator 1709 processes (eg, through demodulation) the input sample and provides a symbol estimate. Decoder 1708 processes (eg, through deinterleaving and decoding) the symbol estimate and provides decoded data and a signaling message that is sent to terminal 1700. Encoder 1706, modulator 1707, demodulator 1709, and decoder 1708 may be implemented by modem composite processor 1705. These blocks perform processing based on the radio access technology (eg, LTE access technology or other evolutionary system) used by the radio access network. It should be noted that when tag 1700 does not include modem processor 1705, the aforementioned functions of modem processor 1705 may alternatively be performed by processor 1703.

The processor 1703 controls and controls the actions of the tag 1700 and is configured to perform processing procedures performed by the tag 1700 in the embodiments of the present disclosure. For example, processor 1703 is further configured to perform tag processing in the manners shown in FIG. 4 - fig. 13 and/or other process of technical solutions described in the present invention.

Additionally, tag 1700 may further include memory 1704, where memory 1704 is configured to store program code and data of tag 1700.

The steps of a method or algorithm described in conjunction with the content disclosed in the present invention may be implemented in hardware, or may be implemented by a processor by executing a software instruction. The program instruction may include a corresponding program module. A software module can be stored in Random Access Memory (RAM), Flash Memory, Read Only Memory (ROM), Erasable Programmable ROM (EPROM), Electrically Erasable Programmable Read Only Memory (EPROM). Electrically EPROM, EEPROM), register, hard drive, mobile hard drive, compact disc read only memory (CD-ROM), or any other storage medium well known in the art. For example, an example storage medium is coupled to the processor such that the processor can read information from, or write information to, the storage medium. Of course, the storage medium may be a component of the processor. The processor and storage medium may be located in an ASIC. Additionally, the ASIC may be located in the main network device or terminal device. Of course, the processor and the storage medium may be installed in the main network device or terminal device as discrete components.

In several embodiments presented in the present invention, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described are merely examples. For example, the division into blocks is simply a division of logical functions and may be another division in the actual implementation. For example, many blocks or components may be combined or integrated into another system, or certain functions may be ignored or not performed. Additionally, displayed or discussed reciprocal links or direct links or communication connections can be implemented through some interfaces. Indirect connections or communication connections between devices or units may be implemented in electrical or other forms.

Blocks described as separate parts may or may not be physically separate, and parts displayed as blocks may or may not be physical blocks, may be located in the same position, or may be distributed over multiple network devices. Some or all of the blocks may be selected based on actual requirements to achieve the goals of the solutions of the embodiments.

Additionally, the functional blocks in the embodiments of the present disclosure may be integrated into one processing block, or each of the functional blocks may exist independently, or two or more blocks may be integrated into one block. The integrated block may be implemented in hardware, or may be implemented in hardware in addition to the software functional block.

Based on the foregoing description of the implementations, one skilled in the art can clearly understand that the present invention can be implemented with software in addition to the required general hardware, or with hardware alone. In most cases, the preceding is the implementation. Based on this understanding, the technical solutions of the present disclosure, in essence, or part of it in the prior art, can be implemented in the form of a software product. The software product is stored on a readable storage medium, such as a floppy disk, hard disk, or optical disk of a computer, and includes several instructions for instructing a computing device (which may be a personal computer, a server, a network device, or the like) to perform the methods described in embodiments of the present disclosure.

The above descriptions are merely specific implementations of the present disclosure, but are not intended to limit the protection scope of the present disclosure. Any changes or substitutions within the technical scope disclosed in the present invention fall within the protection scope of this disclosure. Thus, the scope of the present disclosure should be that of the claims.

Claims (64)

1. A key renewal method implemented in a communication system comprising a main network device, a first connection corresponding to a first access technology, and a second connection corresponding to a second access technology between the main network device and a terminal device, wherein the first connection and the second connection share the first key containing the steps in which: update (904), using the main network device, the first key to obtain an updated key for the first connection and obtain the identifier of the first key; wherein the first key identifier identifies the updated key; store, by the main network device, the first key for the second connection and the second key identifier, and when the second connection is in the connected state, the first key is still used for the second connection, when the main network device communicates with the terminal device through the second connection before updating the first key for the second connection; wherein the second key identifier identifies the first key. 2. The method of claim 1, further comprising the steps of: transmitting (905), with the host network device, a first non-access layer (NAS) Security Mode Command (SMC) message to the terminal device via the first connection; wherein the first NAS SMC message contains the first key identifier; and receiving (907), with the host network device, a first NAS Security Mode Completion (SMP) message from the terminal device via the first connection, in which integrity protection is performed for the first NAS SMP message based on the first key. 3. The method according to claim 1 or 2, further comprising the step of: updating (910), with the host network device, the first key for the second connection, so that the first connection and the second connection share the updated key. 4. The method of claim 3, further comprising the step of: starting, by the main network device, when the second connection is in the connected state, a timer after updating the first key for the first connection; wherein the step of updating the first key for the second connection using the updated key comprises a sub-step of: when the timer expires, updating (910) by the main network device of the first key for the second connection using the updated key. 5. The method according to claim 3 or 4, further comprising the steps of: transmitting (911), using the main network device, the second NAS SMC message to the terminal device through the second connection; wherein the second NAS SMC message contains the first key identifier; and receive (913), with the main network device, the second NAS SMP message from the terminal device through the second connection, which performs integrity protection for the second NAS SMP message based on the updated key. 6. The method according to any one of claims 3 to 5, further comprising the step of: deleting, by the main network device, the first key and the second key identifier after updating the first key for the second connection. 7. The method according to any one of claims 1-6, further comprising, before the step of updating the key for the first connection, the step of: it is determined, by the main network device, according to the configuration information of the operator or NAS COUNT used by the terminal device, so that a round-robin occurs that the terminal device must be re-authenticated. 8. The method according to any one of claims 1 to 7, further comprising the step of: determine, with the help of the main network device, that the second connection is in the connected state. 9. A key renewal method implemented by a communication system comprising a terminal device, a first connection corresponding to a first access technology, and a second connection corresponding to a second access technology between the terminal device and the main network device, wherein the first connection and the second connection share the first key, containing the steps in which: receiving (905), by the terminal device, a first non-access layer (NAS) security mode command (SMC) message from the main network device via the first connection; wherein the first NAS SMC message contains the first key identifier; update (906), using the terminal device, the first key to obtain an updated key for the first connection; transmitting (907), by the tag, the NAS a first security mode completion (SMP) message to the underlying network device, via the first connection on which integrity protection is performed for the first NAS SMP message based on the updated key; receive (911), using the end device, the second NAS SMC message, from the main network device, through the second connection; wherein the second NAS SMC message contains the first key identifier; update (912), using the terminal device, the first key for the second connection using the updated key; and transmitting (913), by the end device, the second NAS SMP message to the main network device via the second connection, in which integrity protection is performed for the second NAS SMP message based on the updated key. 10. The method of claim 9, further comprising the steps of: deleting, by the terminal device, the first key and the second key identifier after updating the first key for the second connection using the updated key; wherein the second key identifier identifies the first key. 11. The method of claim 10, wherein the first key is still used for the second connection when the terminal communicates with the primary network device over the second connection before updating the first key for the second connection. 12. The main network device for updating the key contained in the communication system containing the main network device, the first connection corresponding to the first access technology, and the second connection corresponding to the second access technology, between the main network device and the terminal device, while the first connection and the second the connection shares the first key, and the underlying network device includes a processing unit (1402), wherein the processing unit (1402) is configured to: updating the first key to obtain an updated key for the first connection and obtain a first key identifier; wherein the first key identifier identifies the updated key; storing a first key for the second connection and a second key identifier when the second connection is in a connected state; wherein the second key identifier identifies the first key; and the first key is still used for the second connection when the main network device communicates with the terminal device through the second connection before updating the first key for the second connection. 13. The main network device according to claim 12, further comprising a communication unit (1403); wherein the communication unit (1403) is configured to: transmitting a first non-access layer (NAS) Security Mode Command (SMC) message to the terminal via the first connection; wherein the first NAS SMC message contains a first key identifier; and receiving a first NAS Security Mode Completion (SMP) message from the tag through a first connection in which integrity protection is performed for the first NAS SMP message based on the first key. 14. The main network device according to claim 12 or 13, wherein the processing unit (1402) is further configured to: updating the first key for the second connection such that the first connection and the second connection share the updated key. 15. The main network device of claim 14, wherein the processing unit (1402) is further configured to: starting, when the second connection is in the connected state, a timer after updating the first key for the first connection; and update, after the expiration of the timer, the first key for the second connection, using the updated key. 16. The main network device according to claim 14 or 15, in which the communication unit (1403) is further configured to: transmitting the second NAS SMC message to the end device via the second connection; wherein the second NAS SMC message contains the first key identifier; and receiving a second NAS SMP message from the end device via a second connection in which integrity protection is performed for the second NAS SMP message based on the updated key. 17. The main network device according to any one of claims 14-16, wherein the processing unit (1402) is further configured to: deleting the first key and the second key ID after updating the first key for the second connection. 18. The main network device according to any one of claims 12-17, wherein the processing unit (1402) is further configured to: determining, according to the operator configuration information or NAS COUNT used by the terminal device, such that a round-robin occurs that the terminal device must be re-authenticated. 19. The main network device according to any one of claims 12-18, wherein the processing unit (1402) is further configured to: determining that the second connection is in the connected state. 20. A communication device contained in a communication system comprising said device, a first connection corresponding to a first access technology, and a second connection corresponding to a second access technology between the device and the main network device, the first connection and the second connection sharing the first key, and the device comprises a processing unit (1602) and a communication unit (1603), wherein: the communication unit (1603) is configured to receive a first non-access layer (NAS) security mode command (SMC) message from the main network device via the first connection; wherein the first NAS SMC message contains a first key identifier; the processing unit (1602) is configured to update the first key to obtain an updated key for the first connection; the communication unit (1603) is further configured to: transmitting the first NAS Security Mode Completion (SMP) message to the underlying network device via the first connection in which integrity protection is performed for the first NAS SMP message based on the updated key; receiving a second NAS SMC message from the main network device via the second connection; wherein the second NAS SMC message contains the first key identifier; the processing unit (1602) is further configured to update the first key for the second connection using the updated key; and the communication unit (1603) is further configured to transmit the second NAS SMP message to the main network device via the second connection, which performs integrity protection for the second NAS SMP message based on the updated key. 21. The communications device of claim 20, wherein the processing unit (1602) is further configured to delete the first key and the second key identifier after updating the first key for the second connection using the updated key; wherein the second key identifier identifies the first key. 22. The communications device of claim 20 or 21, wherein the first key is still used for the second connection when the terminal communicates with the primary network device over the second connection before updating the first key for the second connection. 23. Communication device, containing: at least one processor; and a memory coupled to said at least one processor and storing program instructions causing, when executed by the at least one processor, the device to execute the method according to any one of claims 1-11. 24. A computer-readable storage medium containing instructions causing, when executed by at least one processor, the device to execute the method according to any one of claims 1-11.

Images