WO2018019046A1 - 密钥的衍生方法及装置 - Google Patents

密钥的衍生方法及装置 Download PDF

Info

Publication number
WO2018019046A1
WO2018019046A1 PCT/CN2017/088111 CN2017088111W WO2018019046A1 WO 2018019046 A1 WO2018019046 A1 WO 2018019046A1 CN 2017088111 W CN2017088111 W CN 2017088111W WO 2018019046 A1 WO2018019046 A1 WO 2018019046A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice
identifier
network
communication device
network slice
Prior art date
Application number
PCT/CN2017/088111
Other languages
English (en)
French (fr)
Inventor
游世林
林兆骥
彭锦
刘红军
赵孝武
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US16/320,704 priority Critical patent/US11290876B2/en
Publication of WO2018019046A1 publication Critical patent/WO2018019046A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords

Definitions

  • the present invention relates to the field of communications, and in particular to a method and apparatus for deriving a key.
  • the future mobile network will provide access services for more and more IoT terminals.
  • Internet of Things access brings new challenges and opportunities to mobile networks. Different types of Internet of Things have different needs for the network. Some require the network to provide high real-time and high-reliability services, such as telemedicine, while others require regular small data transmission services, such as remote meter reading systems.
  • mobile networks may need to be properly optimized to meet business needs. More and more Internet of Things puts more and more different optimization requirements on mobile networks. Some of the optimization requirements may be contradictory. Therefore, a converged core network is increasingly unable to meet various Internet of Things. demand.
  • NFV Network Function Virtualization
  • core network functions can be built on general-purpose hardware without the need for a dedicated hardware platform.
  • the emergence of NFV makes it possible for operators to build different virtual core networks for different network business needs.
  • the virtual core network built for different network business needs is called a network slice.
  • Each network function in the virtual core network can be optimized and customized according to network service requirements.
  • Network slices based on NFV technology can be rapidly deployed according to requirements to quickly meet the needs of different scenarios.
  • FIG. 1 is a schematic diagram of a network slice in the related art.
  • a network slice forms a virtual core network that provides mobile network access services for a specific set of user terminals (UEs).
  • a typical network slice includes one
  • the core network function of the group virtualization such as the slice control plane unit, is mainly responsible for the mobility of the slice, the session management, and the functions related to the authentication authentication.
  • the slice user plane unit mainly provides the user resources for the slice, and the slice policy control unit is responsible for the user.
  • the function of the policy is that the slice charging unit is responsible for the charging function of the user.
  • the network slice is constructed by the operator according to the requirements and the operator policy.
  • the function of a network slice is also determined by the operator according to the requirements and the operator policy.
  • Some network slices may include a dedicated forwarding plane in addition to the control plane function; some network slices may include only some basic control plane functions, and other core network related functions are shared with other network slices.
  • the network also includes a user data center/certification center that maintains user subscription data and certification materials.
  • the smart authentication card and the authentication center of the terminal respectively store the user's root key (K), and then derive the encryption key (CK) and integrity using the key generation algorithm.
  • the protection key (IK) and then the terminal and the user data center derive the intermediate key (Kasme) using the key generation algorithm, and then the terminal and the mobility management entity respectively derive the non-access layer key using the key generation algorithm: encryption key Key (KNASenc) and integrity protection key (KNASint), and access network key (KAN).
  • the terminal and the access network derive the access layer key using a key derivation algorithm: a radio resource controlled encryption key (KRRCenc) and an integrity protection key (KRRCint), and a derived user plane encryption key (KUPenc). And integrity protection key (KUPint).
  • KRRCenc radio resource controlled encryption key
  • KRRCint integrity protection key
  • KUPenc integrity protection key
  • the intermediate keys generated by the same network can be used by different mobility management entities, that is, when the user moves, the mobility management entity requests a security context from a mobile management entity, including Intermediate key.
  • different slices may implement different and independent services, and the data between them needs to be isolated. Therefore, the intermediate keys are sensitive to different slices and cannot be used by each other.
  • Embodiments of the present invention provide a method and device for deriving a key to solve at least related technologies.
  • Different network slices may use the same intermediate key and the slicing function cannot be implemented normally.
  • a method for deriving a key including:
  • sending the slice identifier to the designated communication device including:
  • the designated communication device includes at least one of the following: a user data center and a user authentication center.
  • sending the slice identifier to the designated communication device including:
  • the method further includes: when the user terminal needs to switch from the currently attached network slice to the second network slice, receiving an attach request message forwarded by the access network AN, where the attach request information is carried in And determining, by the service identifier, whether the service range of the second network slice includes the service corresponding to the service identifier; if yes, sending the slice identifier to the designated communication device.
  • the slice identifier includes at least one of the following: identifier information of the network slice, and temporary identifier information that is allocated by the network slice to the user terminal.
  • a method for deriving a key including:
  • receiving the slice identifier sent by the network slice includes: receiving an authentication request sent by the network slice, where the identifier is carried in the authentication request.
  • the slice identifier includes at least one of the following: identifier information of the network slice, and temporary identifier information that the network slice allocates to a user terminal.
  • a key derivation device including:
  • An acquiring module configured to obtain a slice identifier corresponding to a network slice currently attached by the user terminal, where the slice identifier is used to uniquely identify the network slice, and the sending module is configured to send the slice identifier to the designated communication device, where And the slice identifier is used to indicate that the designated communication device derives an intermediate key required for the network slice according to the slice identifier.
  • the sending module is further configured to send a first authentication request to the designated communications device, where the first authentication request carries the slice identifier, and the designated communications device includes at least one of the following : User data center, user authentication center.
  • the sending module includes:
  • a receiving unit configured to receive response information of the first authentication request, where the response information carries a security authentication vector
  • the sending unit is configured to send a second authentication request to the designated communication device according to the security authentication vector, where the second authentication request carries the slice identifier.
  • the device further includes: a first receiving module, configured to receive an attach request message forwarded by the access network AN when the user terminal needs to switch from the currently attached network slice to the second network slice, where
  • the connection request information carries a service identifier;
  • the determining module is configured to determine whether the service range of the second network slice includes a service corresponding to the service identifier; and the sending module includes the service in the service scope When the corresponding service is identified, the slice identifier is sent to the designated communication device.
  • a key derivation device including:
  • a second receiving module configured to receive a slice identifier sent by the network slice, where the cut A slice identifier is used to uniquely identify the network slice;
  • a derivative module is configured to derive an intermediate key required for the network slice according to the slice identifier.
  • the second receiving module is further configured to receive an authentication request sent by the network slice, where the authentication request carries the slice identifier.
  • a key derivation device including:
  • a processor configured to store the processor-executable instructions; wherein the processor is configured to acquire a slice identifier corresponding to a network slice currently attached by the user terminal, and send the slice identifier to the designated communication device, where The slice identifier is used to uniquely identify the network slice, and the slice identifier is used to indicate that the designated communication device derives an intermediate key required for the network slice according to the slice identifier.
  • a storage medium is further provided, and the computer storage medium may store an execution instruction for performing the implementation of the derivation method of the key in the foregoing embodiment.
  • the embodiment of the present invention it is possible to send a slice identifier to a designated communication device, and further specify a technical solution that the communication device can derive an intermediate key corresponding to the network slice according to the received slice identifier, and solve the related technology, different network slices have The problem that the slicing function caused by the same intermediate key may not be implemented normally, so that different network slices correspond to different intermediate keys, and the same intermediate key is not allocated to different network slices, which may result in the slicing function being impossible. Normal use.
  • FIG. 1 is a schematic diagram of a network slice in the related art
  • FIG. 2 is a block diagram showing the hardware structure of a computer terminal for processing a page content according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a method for deriving a key according to Embodiment 1 of the present invention.
  • FIG. 4 is a structural block diagram (1) of a derivation device for a key according to Embodiment 2 of the present invention.
  • FIG. 5 is a structural block diagram (2) of a derivation device for a key according to Embodiment 2 of the present invention.
  • FIG. 6 is a structural block diagram (3) of a derivation device for a key according to Embodiment 2 of the present invention.
  • FIG. 7 is another flowchart of a method for deriving a key according to Embodiment 1 of the present invention.
  • FIG. 8 is a structural block diagram (4) of a derivation device for a key according to Embodiment 3 of the present invention.
  • FIG. 9 is a schematic diagram of a layer hierarchy according to a preferred embodiment 1 of the present invention.
  • FIG. 10 is a schematic diagram of an intermediate key derivation algorithm according to a preferred embodiment 2 of the present invention.
  • Figure 11 is a flow chart showing the generation of intermediate keys in accordance with a preferred embodiment 3 of the present invention.
  • FIG. 2 is a hardware structural block diagram of a computer terminal for deriving a key according to an embodiment of the present invention.
  • computer terminal 10 may include one or more (only one of which is shown) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • a memory 104 for storing data
  • a transmission module 106 for communication functions.
  • computer terminal 10 may also include more or fewer components than those shown in FIG. 2, or have a different configuration than that shown in FIG. 2.
  • the memory 104 can be used to store software programs and modules of the application software, such as program instructions/modules corresponding to the processing method of the page content in the embodiment of the present invention, and the processor 102 executes by executing the software programs and modules stored in the memory 104.
  • Various functional applications and data processing that is, the vulnerability detection method for implementing the above application.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 3 is a flowchart of a method for deriving a key according to Embodiment 1 of the present invention. As shown in FIG. 3, the method includes the following steps:
  • Step S302 Acquire a slice identifier corresponding to a network slice currently attached by the user terminal, where the slice identifier is used to uniquely identify the network slice.
  • Step S304 the foregoing slice identifier is sent to the designated communication device, where the slice identifier is used to instruct the designated communication device to derive an intermediate key required for the network slice according to the slice identifier.
  • different network slices may be The problem that the slicing function caused by the same intermediate key cannot be implemented normally, so that different network slices correspond to different intermediate keys, and the same intermediate key is allocated to different network slices, thereby causing the slicing function to be abnormal. The situation of use.
  • the executor of the foregoing step S302 to the step S304 may be a network slice or other network device on the network side, which is not limited by the present invention.
  • the designated communication device mentioned above includes: a user data center, a user authentication center, a user terminal, and other communication devices capable of completing step S304.
  • step S304 can be implemented by:
  • step S304 can be implemented by:
  • the foregoing method further includes: when the user terminal needs to cut from a currently attached network
  • the device receives an attach request message forwarded by the access network AN, where the attach request information carries a service identifier, and determines whether the service range of the second network slice includes the service identifier The service; if so, the slice identifier is sent to the designated communication device.
  • the slice identifier includes at least one of the following: identifier information of the network slice, and temporary identifier information that is allocated by the network slice to the user terminal.
  • the process of deriving the intermediate key may be summarized as follows: the slice sends an authentication request to the user data center or the authentication center, and the user data center or the authentication center derives the intermediate key using parameters such as the service network identifier and the slice identifier; the slice data from the user After obtaining the security vector, the center or the authentication center initiates a user authentication request to the user terminal. After the user terminal authenticates the slice successfully, the intermediate key is derived by using parameters such as the service network identifier and the slice identifier, and the access layer is derived by using the intermediate key. Key and non-access stratum key; after receiving the user terminal authentication request response, the slice uses the intermediate key to derive the access layer key and the access network key after the authentication user terminal succeeds.
  • the embodiment of the present invention further provides a slice key derivation terminal, wherein the user terminal is configured to: after receiving the user authentication request for handover, after the user terminal authenticates the slice successfully, the user network identifier and the slice identifier are used to derive the parameter.
  • the intermediate key while using the intermediate key, derives the access layer key and the non-access stratum key.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present invention.
  • a key derivation device is also provided, and the device is used to implement the foregoing
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 4 is a structural block diagram (1) of a derivation device for a key according to Embodiment 2 of the present invention. As shown in FIG. 4, the method includes:
  • the obtaining module 40 is configured to obtain a slice identifier corresponding to a network slice currently attached by the user terminal, where the slice identifier is used to uniquely identify the network slice.
  • the sending module 42 is configured to send the slice identifier to the designated communication device, where the slice identifier is used to indicate that the designated communication device derives an intermediate key required for the network slice according to the slice identifier.
  • the slice identifier can be sent to the designated communication device, and the technical solution that the communication device can derive the intermediate key corresponding to the network slice according to the received slice identifier is solved, and different network slices in the related art are solved. It is possible that the same intermediate key may cause the slicing function to be unable to be implemented normally, so that different network slices correspond to different intermediate keys, and the same intermediate key is allocated to different network slices to cause the slicing function. Unusable use.
  • the sending module 42 is further configured to: when the designated communication device includes at least one of: a user data center, a user authentication center, and sending a first authentication request to the designated communication device, where the first authentication The slice identifier is carried in the request.
  • the sending module 42 is further configured to: when the specified device includes: a user terminal, the method includes:
  • the receiving unit 420 is configured to receive the response information of the first authentication request, where the response information carries a security authentication vector;
  • the sending unit 422 is configured to send a second authentication request to the designated communication device according to the security authentication vector, where the second authentication request carries the slice identifier.
  • the foregoing apparatus further includes:
  • the first receiving module 44 is configured to receive an attach request message forwarded by the access network AN when the user terminal needs to switch from the currently attached network slice to the second network slice, where the attach request information carries the service Identification
  • the determining module 46 is configured to determine whether the service range of the second network slice includes a service corresponding to the service identifier
  • the sending module 42 sends the slice identifier to the designated communication device when the service range includes the service corresponding to the service identifier.
  • FIG. 6 is a structural block diagram (3) of a key deriving device according to Embodiment 2 of the present invention.
  • a key deriving device is provided. As shown in FIG. 6, the method includes:
  • a processor 60 configured to store the processor-executable instructions; wherein the processor 60 is configured to acquire a slice identifier corresponding to a network slice currently attached by the user terminal, and send the slice identifier to the designated communication device,
  • the slice identifier is used to uniquely identify the network slice, and the slice identifier is used to indicate that the designated communication device derives an intermediate key required for the network slice according to the slice identifier.
  • FIG. 7 is another flowchart of a method for deriving a key according to Embodiment 1 of the present invention. As shown in FIG. 7, the method includes the following steps:
  • Step S702 Receive a slice identifier sent by a network slice, where the slice identifier is used to uniquely identify the network slice.
  • Step S704 deriving an intermediate key required by the network slice according to the slice identifier.
  • different network slices may be The problem that the slicing function caused by the same intermediate key cannot be implemented normally, so that different network slices correspond to different intermediate keys, and the same intermediate key is allocated to different network slices, thereby causing the slicing function to be abnormal. The situation of use.
  • the method may be implemented by: receiving an authentication request sent by the network slice, where the authentication request carries the slice identifier, that is, the network slice is
  • the authentication request carries a slice identifier and is sent to the designated device, and specifically, the user terminal can be used.
  • the slice identifier includes at least one of the following: the identifier information of the network slice, and the temporary identifier information allocated by the network slice to the user terminal.
  • a key deriving device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again.
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 8 is a structural block diagram (4) of a derivation device for a key according to Embodiment 3 of the present invention. As shown in FIG. 8, the method includes:
  • the second receiving module 80 is configured to receive a slice identifier sent by the network slice, where the slice identifier is used to uniquely identify the network slice.
  • the derivation module 82 is configured to derive an intermediate key required for the network slice according to the slice identifier.
  • the second receiving module 80 is further configured to receive the authentication request sent by the network slice, where the authentication request carries the slice identifier.
  • FIG. 9 is a schematic diagram of a key layering according to a preferred embodiment 1 of the present invention.
  • a key layering diagram is shown in FIG. 9.
  • the authentication center separately stores the user's root key (K), and then uses the key generation algorithm to derive the encryption key (CK) and the integrity protection key (IK), and then the terminal and each slice are derived using the key generation algorithm.
  • the intermediate keys (Ks1 and Ks2) are output.
  • FIG. 10 is a schematic diagram of an intermediate key derivation algorithm according to a preferred embodiment 2 of the present invention. As shown in FIG. 10, an intermediate key derivation algorithm is as follows:
  • Ks1 or Ks2 key generation function KDF (slice identification, network service identification, key sequence number SQN ⁇ anonymous key AK, encryption key CK, integrity protection key IK), where the anonymous key AK is the root key K and the random number are derived according to the key derivation algorithm f5, used to hide the key sequence number SQN, and the exclusive OR algorithm. If the SQN does not need to be hidden, the AK is set to all 0s, the encryption key CK and the integrity protection secret. The key IK is derived from the root key.
  • the identifier for example, the slice identifier is 32 bits, and the user temporarily identifies 32 bits.
  • FIG. 11 is a schematic flowchart of intermediate key generation according to a preferred embodiment 3 of the present invention. As shown in FIG. 11, the steps in the preferred embodiment of the present invention are specifically described as follows:
  • Step S902 The user terminal with the smart authentication card initiates an attach message to the access network AN, where the message carries the user identifier, and the user identifier may be the International Mobile Subscriber Identification Number (IMSI) of the user.
  • the slice may be a temporary user identifier of the slice user allocated by the user; the message may further include a service identifier attached by the user;
  • Step S904 The access network AN selects slice 1 for the user according to the temporary identifier or service identifier of the slice user, and forwards the attach request message to the slice 1;
  • Step S906 The slice 1 checks the service identifier. If the service range of the slice 1 does not match, the attachment request message is rejected. If the user identifier is the IMSI, the slice 1 assigns the slice user temporary identifier to the user, and then the user data center/authentication center Sending an authentication data request message, or if it is a slice 1 user temporary identifier, if the slice 1 service has a slice pool, that is, slice 1 can use the security context together with other slices, the slice is identified to other slices according to the slice identifier in the slice user temporary identifier. (For example: slice 3) Obtain a user security context. If the acquisition is successful, perform steps S912 to S914.
  • the center/authentication center sends an authentication data request message, where the message carries a user identity IMSI, a network service identifier, and a slice identifier 1, or a slice 1 user temporary identifier;
  • Step S908 The user data center/authentication center derives the intermediate key Ks1 using the key derivation algorithm of FIG. 8;
  • Ks1 key generation function KDF (Slice ID 1 or Slice 1 User Temporary Identity, Network Service Identity, Key Sequence Number SQN ⁇ Anonymous Key AK, Encryption Key CK, Integrity Protection Key IK).
  • Step S910 The user data center/authentication center sends an authentication data request response message to the slice 1, the message carrying one or more sets of authentication vectors, where the authentication vector includes Ks1, expected response value, random number and authentication token;
  • Step S912 The slice 1 assigns a corresponding slice key index to the Ks1, and sends a user authentication request message to the user terminal, where the message carries a slice key index, a random number, an authentication token, a slice identifier 1, or a slice 1 user temporary identifier. ;
  • Step S914 The user terminal authenticates the token, finds that the slice 1 is the authentication successful network, saves the slice identifier or the slice 1 user temporary identifier, and saves the correspondence with the service identifier, and then derives the intermediate key Ks1 by using the key derivation algorithm of FIG. 8. And then derive the access layer key and the non-access stratum key;
  • Ks1 key generation function KDF (Slice ID 1 or Slice 1 User Temporary Identity, Network Service Identity, Key Sequence Number SQN ⁇ Anonymous Key AK, Encryption Key CK, Integrity Protection Key IK).
  • Step S916 The user terminal sends back a user authentication request response message to the slice 1, where the message carries the verification result;
  • Step S918 Slice 1 compares the verification result in the message with the expected response value in the authentication vector. If they are equal, slice 1 authenticates the user terminal successfully, slice 1 derives the access layer key and the non-access stratum key, and then The user data center/authentication center sends a location update request message, where the message carries a user identity IMSI;
  • Step S920 The user data center/authentication center sends a location update request response message to the slice 1, the message carrying the user subscription data;
  • Step S922 The slice 1 saves the user subscription data, and sends an attach success response to the access network AN.
  • Step S924 The access network AN forwards the attach success response to the user terminal. At this point, the user terminal successfully attaches to the slice 1 successfully, and the user terminal implements the service in the slice 1;
  • Step S926 When the user terminal moves, or the user terminal needs to implement other services (such as the car network service), the user terminal attaches a request message to the access network AN, where the message carries the user identifier, and the user identifier may be an IMSI or Slice 1 user temporary identifier, the message also carries a service identifier (for example: car networking service);
  • the message carries the user identifier, and the user identifier may be an IMSI or Slice 1 user temporary identifier, the message also carries a service identifier (for example: car networking service);
  • Step S928 The access network AN selects the slice 2 according to the service identifier, and forwards the attach request message to the slice 2;
  • Step S930 The slice 2 checks the service identifier. If the service scope of the slice 2 does not match, the attachment request message is rejected. If the user identifier is the IMSI, the slice 2 assigns the slice 2 user temporary identifier to the user, and then authenticates to the user data center/authentication. The center sends an authentication data request message, or because the slice 1 and slice 2 services are different, the security context of slice 1 cannot be used, the user identity IMSI is obtained from the user terminal, and the user 2 is temporarily assigned the slice 2 user temporary identity, and then to the user data center / The authentication center sends an authentication data request message, where the message carries the user identifier. IMSI, network service identity, and slice identity 2, or slice 2 user temporary identity;
  • Step S932 The user data center/authentication center derives the intermediate key Ks2 using the key derivation algorithm of FIG. 8;
  • Ks2 key generation function KDF (slice identification 2 or slice 2 user temporary identification, network service identification, key sequence number SQN, anonymous key AK, encryption key CK, integrity protection key IK).
  • Step S934 The subsequent user terminal is attached to the slice 2 according to steps S910 to S924. At this point, the user terminal is attached to the slice 2, and the user terminal also stores the correspondence between the service identifier and the slice 2 identifier or the slice 2 temporary identifier. If the terminal re-occurs the service change process again, the terminal selects different slice identifiers or slice user temporary identifiers to attach according to the service identifier.
  • the embodiments of the present invention achieve the following technical effects: the problem that the slicing function that different network slices may use the same intermediate key cannot be implemented normally in the related art, and thus different networks are implemented.
  • the slice corresponds to different intermediate keys, which avoids the case where the same intermediate key is allocated to different network slices and the slice function cannot be used normally.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the processing method of the page content provided in the first embodiment.
  • the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.
  • the storage medium is arranged to store program code for performing the following steps:
  • S1 Obtain a slice identifier corresponding to a network slice currently attached by the user terminal, where the slice identifier is used to uniquely identify the network slice.
  • the foregoing slice identifier is sent to the designated communication device, where the slice identifier is used to refer to The intermediate key required for the network slice to be derived from the specified communication device according to the slice identifier is shown.
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), A variety of media that can store program code, such as a hard disk, a disk, or an optical disk.
  • the foregoing technical solution provided by the embodiment of the present invention can send a slice identifier to a designated communication device, and further specify a technical solution that the communication device can derive an intermediate key corresponding to the network slice according to the received slice identifier, and solve different technologies in the related art.
  • the network slice may use the same intermediate key and the slicing function cannot be implemented normally, so that different network slices correspond to different intermediate keys, and the same intermediate key is allocated to different network slices. The condition that caused the slicing function to not work properly.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提供了一种密钥的衍生方法及装置，其中，所述方法包括：获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。采用上述技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。

Description

密钥的衍生方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种密钥的衍生方法及装置。
背景技术
移动通信在二十多年时间里得到了飞速发展，给人们的生活方式、工作方式以及社会政治、经济等各方面都带来了巨大的影响。人类社会进入高效的信息化时代，各个方面业务应用需求呈现爆发式增长，给未来无线移动带宽系统在频率、技术以及运营等各方面都带来了巨大的挑战。
未来的移动网络除了为人人通信提供服务外，还将为越来越多的物联网终端提供接入服务。物联网接入给移动网络带来了新的挑战和机遇。不同类型的物联网对网络的需求千差万别，有的要求网络提供高实时高可靠服务，如远程医疗，有的则要求提供有规律的小数据量传输服务，如远程抄表系统。针对不同的业务需求，移动网络可能需要适当优化才能满足业务需求。越来越多的物联网对移动网络提出了越来越多不同的优化需求，其中，有些优化需求还可能相互矛盾，因此，一张融合的核心网越来越无法满足各种不同的物联网需求。
随着网络功能虚拟化(NFV，Network Function Virtualization)的出现，核心网功能可以基于通用硬件构建，而毋须基于专用硬件平台。NFV的出现使得运营商为不同的网络业务需求构建不同的虚拟核心网络成为可能。为不同网络业务需求构建的虚拟核心网称为一个网络切片。虚拟核心网中的各网络功能可根据网络业务需求进行优化、定制。基于NFV技术的网络切片可根据需求快速部署，以快速满足不同场景的需求。
图1为相关技术中网络切片的示意图。在图1中，示例了三个网络切片(网络切片1、2、3)。一个网络切片构成一个虚拟核心网，为一组特定的用户终端(UE)提供移动网络接入服务。一个典型的网络切片包括一 组虚拟化的核心网功能，如切片控制面单元，主要负责切片的移动性、会话管理以及鉴权认证相关的功能，切片用户面单元主要为用户提供切片的用户资源，切片策略控制单元负责用户策略的功能，切片计费单元负责为用户的计费功能，网络切片由运营商根据需求和运营商策略进行构建，一个网络切片包括的功能也由运营商根据需求和运营商策略决定，比如，某些网络切片除了包括控制面功能外还可以包括专用的转发面；而某些网络切片可能只包括一些基本的控制面功能，其他的核心网相关功能与其他网络切片共享。网络还包含用户数据中心/认证中心，保存用户的签约数据和认证材料。
现有移动通讯系统密钥分层衍生系统中，终端的智能认证卡和认证中心分别保存着用户的根密钥(K)，然后使用密钥产生算法衍生出加密密钥(CK)和完整性保护密钥(IK)，然后终端和用户数据中心使用密钥产生算法衍生出中间密钥(Kasme)，然后终端和移动管理实体分别使用密钥产生算法衍生出非接入层密钥：加密密钥(KNASenc)和完整性保护密钥(KNASint)，以及接入网络密钥(KAN)。最后终端和接入网络使用密钥衍生算法衍生出接入层密钥：无线资源控制的加密密钥(KRRCenc)和完整性保护密钥(KRRCint)，以及衍生出用户面加密密钥(KUPenc)和完整性保护密钥(KUPint)。
在现有技术中同一个网络产生的中间密钥是可以在不同的移动管理实体相互使用的，即在用户发生移动的时候，移动管理实体会向前一个移动管理实体请求安全上下文的，其中包含中间密钥。然而在使用虚拟化技术中不同切片可能实现的是不同的而且是独立的业务，相互之间的数据也需要隔离，因此中间密钥对于不同的切片是敏感的，是不能相互使用的。
针对相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种密钥的衍生方法及装置，以至少解决相关技 术不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题。
根据本发明的一个实施例，提供了一种密钥的衍生方法，包括：
获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
可选地，向指定通信设备发送所述切片标识，包括：
向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识，所述指定通信设备包括以下至少之一：用户数据中心、用户认证中心。
可选地，向指定通信设备发送所述切片标识，包括：
接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识，所述指定通信设备包括：用户终端。
可选地，所述方法还包括：当所述用户终端需要从当前附着的网络切片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；如果是，则向指定通信设备发送所述切片标识。
可选地，所述切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为所述用户终端分配的临时标识信息。
根据本发明的一个实施例，还提供了一种密钥的衍生方法，包括：
接收网络切片发送的切片标识，其中，所述切片标识用于唯一标识所 述网络切片；根据所述切片标识衍生出所述网络切片所需的中间密钥。
可选地，接收网络切片发送的切片标识，包括：接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识。
可选地，所述切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为用户终端分配的临时标识信息。
根据本发明的另一个实施例，还提供了一种密钥的衍生装置，包括：
获取模块，设置为获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；发送模块，设置为向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
可选地，所述发送模块，还设置为向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识，所述指定通信设备包括以下至少之一：用户数据中心、用户认证中心。
可选地，所述指定设备包括用户终端时，所述发送模块，包括：
接收单元，设置为接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
发送单元，设置为根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识。
可选地，所述装置还包括：第一接收模块，设置为当所述用户终端需要从当前附着的网络切片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；判断模块，设置为判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；所述发送模块，在所述业务范围包括所述业务标识对应的业务时，向指定通信设备发送所述切片标识。
根据本发明的另一个实施例，还提供了一种密钥的衍生装置，包括：
第二接收模块，设置为接收网络切片发送的切片标识，其中，所述切 片标识用于唯一标识所述网络切片；衍生模块，设置为根据所述切片标识衍生出所述网络切片所需的中间密钥。
可选地，所述第二接收模块，还设置为接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识。
根据本发明的另一个实施例，还提供了一种密钥的衍生装置，包括：
处理器；设置为存储所述处理器可执行指令的存储器；其中，所述处理器，设置为获取用户终端当前附着的网络切片所对应的切片标识，向指定通信设备发送所述切片标识，其中，所述切片标识用于唯一标识所述网络切片，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
在本发明实施例中，还提供了一种存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的密钥的衍生方法的实现。
通过本发明实施例，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为相关技术中网络切片的示意图；
图2是本发明实施例的一种页面内容的处理方法的计算机终端的硬件结构框图；
图3是根据本发明实施例1的密钥的衍生方法的流程图；
图4是根据本发明实施例2的密钥的衍生装置的结构框图(一)；
图5是根据本发明实施例2的密钥的衍生装置的结构框图(二)；
图6是根据本发明实施例2的密钥的衍生装置的结构框图(三)；
图7是根据本发明实施例1的密钥的衍生方法的另一流程图；
图8是根据本发明实施例3的密钥的衍生装置的结构框图(四)；
图9为根据本发明优选实施例1的密钥分层示意图；
图10为根据本发明优选实施例2的中间密钥衍生算法示意图；
图11为根据本发明优选实施例3的中间密钥产生的流程示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例1
根据本发明实施例，还提供了一种密钥的衍生方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例1所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在计算机终端上为例，图2是本发明实施例的一种密钥的衍生方法的计算机终端的硬件结构框图。如图2所示，计算机终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输模块106。本领域普通技术人员可以理解，图2所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图2中所示更多或者更少的组件，或者具有与图2所示不同的配置。
存储器104可用于存储应用软件的软件程序以及模块，如本发明实施例中的页面内容的处理方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的应用程序的漏洞检测方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在上述运行环境下，本发明提供了如图3所示的密钥的衍生方法。图3是根据本发明实施例1的密钥的衍生方法的流程图，如图3所示，包括以下步骤：
步骤S302，获取用户终端当前附着的网络切片所对应的切片标识，其中，上述切片标识用于唯一标识所述网络切片；
步骤S304，向指定通信设备发送上述切片标识，其中，上述切片标识用于指示所述指定通信设备根据上述切片标识衍生出网络切片所需的中间密钥。
通过上述各个步骤，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
上述步骤S302至步骤S304的执行主体可以是网络切片，也可以是网络侧的其他网络设备，本发明对此不作限定。
需要说明的是，上述提到的指定通信设备包括：用户数据中心、用户认证中心、用户终端，也可以使其他能够完成步骤S304的通信设备。
在所述指定通信设备包括以下至少之一时：用户数据中心、用户认证中心，步骤S304可以通过以下方式实现：
向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识。
在所述指定通信设备包括：用户终端时，步骤S304可以通过以下方式实现：
接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识。
可选地，上述方法还包括：当所述用户终端需要从当前附着的网络切 片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；如果是，则向指定通信设备发送所述切片标识。
在本发明实施例中，所述切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为所述用户终端分配的临时标识信息。
上述中间密钥的衍生过程，可以大致概括如下：切片向用户数据中心或认证中心发送认证请求，用户数据中心或认证中心使用服务网络标识以及切片标识等参数衍生出中间密钥；切片从用户数据中心或认证中心获得安全向量后，向用户终端发起用户认证请求，用户终端认证切片成功后，使用服务网络标识以及切片标识等参数衍生出中间密钥，同时使用中间密钥衍生出接入层密钥和非接入层密钥；切片收到用户终端认证请求响应后，认证用户终端成功后，使用中间密钥衍生出接入层密钥和接入网络密钥。
本发明实施例还提供了一种切片密钥衍生终端，其中，用户终端，用于在收到切换发送的用户认证请求，用户终端认证切片成功后，使用服务网络标识以及切片标识等参数衍生出中间密钥，同时使用中间密钥衍生出接入层密钥和非接入层密钥。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
实施例2
在本实施例中还提供了一种密钥的衍生装置，该装置用于实现上述实 施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图4是根据本发明实施例2的密钥的衍生装置的结构框图(一)，如图4所示，包括：
获取模块40，设置为获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
发送模块42，设置为向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
通过上述模块的综合作用，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
可选地，发送模块42，还设置为在所述指定通信设备包括以下至少之一时：用户数据中心、用户认证中心，向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识。
图5是根据本发明实施例2的密钥的衍生装置的结构框图(二)，上述发送模块42，还设置为在所述指定设备包括：用户终端时，包括：
接收单元420，设置为接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
发送单元422，设置为根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识。
在本发明实施例中，上述装置还包括：
第一接收模块44，设置为当所述用户终端需要从当前附着的网络切片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；
判断模块46，设置为判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；
上述发送模块42，在所述业务范围包括所述业务标识对应的业务时，向指定通信设备发送所述切片标识。
图6是根据本发明实施例2的密钥的衍生装置的结构框图(三)，在本发明实施例中，还提供了一种密钥的衍生装置，如图6所示，包括：
处理器60；设置为存储所述处理器可执行指令的存储器62；其中，处理器60，设置为获取用户终端当前附着的网络切片所对应的切片标识，向指定通信设备发送所述切片标识，其中，所述切片标识用于唯一标识所述网络切片，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
实施例3
在本发明实施例中，还提供了一种密钥的衍生方法。图7是根据本发明实施例1的密钥的衍生方法的另一流程图，如图7所示，包括以下步骤：
步骤S702,接收网络切片发送的切片标识，其中，上述切片标识用于唯一标识上述网络切片；
步骤S704,根据上述切片标识衍生出所述网络切片所需的中间密钥.
通过上述各个步骤，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
步骤S702可以有多种实现方式，在本发明实施例中，可以通过以下方式实现：接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识，即网络切片在认证请求中携带有切片标识发送给指定设备，具体可以使用户终端。
在本发明实施例中，切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为用户终端分配的临时标识信息。
实施例4
在本实施例中还提供了一种密钥的衍生装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图8是根据本发明实施例3的密钥的衍生装置的结构框图(四)，如图8所示，包括：
第二接收模块80，设置为接收网络切片发送的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
衍生模块82，设置为根据所述切片标识衍生出所述网络切片所需的中间密钥。
通过上述各个模块的综合作用，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
可选地，第二接收模块80，还设置为接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识。
为了更好的理解上述密钥的衍生过程，以下结合优选实施例进行说明， 以下优选实施例不用于限定本发明实施例的技术方案。
优选实施例1
图9为根据本发明优选实施例1的密钥分层示意图，如图9所示，如图9所示密钥分层的示意图，在切片密钥分层衍生系统中，终端的智能认证卡和认证中心分别保存着用户的根密钥(K)，然后使用密钥产生算法衍生出加密密钥(CK)和完整性保护密钥(IK)，然后终端和各切片使用密钥产生算法衍生出中间密钥(Ks1和Ks2)。
优选实施例2
图10为根据本发明优选实施例2的中间密钥衍生算法示意图，如图10所示，中间密钥衍生算法示意图：
Ks1或者Ks2＝密钥产生函数KDF(切片标识，网络服务标识，密钥序列号SQN⊕匿名密钥AK，加密密钥CK，完整性保护密钥IK)，其中匿名密钥AK是根密钥K和随机数根据密钥衍生算法f5衍生所得，用于隐藏密钥序列号SQN，⊕是异或算法，如果SQN不需要隐藏，则AK设置为全0，加密密钥CK和完整性保护密钥IK有根密钥衍生得到。
需要说明的是，切片标识中可以仅仅包括切片的标识信息，也可以包括用户临时标识信息，即切片标识也可以是切片为用户分配的切片用户临时标识，切片用户临时标识＝切片标识+用户临时标识，比如切片标识32位(bit)，用户临时标识32位(bit)。
优选实施例3
图11为根据本发明优选实施例3的中间密钥产生的流程示意图，如图11所示，本发明优选实施例中的步骤具体说明如下：
步骤S902：装有智能认证卡的用户终端向接入网络AN发起附着消息，消息携带用户标识，所述用户标识可以是用户的国际移动用户识别码(International Mobile Subscriber Identification Number，简称IMSI)，也可以是切片为用户分配的切片用户临时标识；所述消息还可以包括用户附着的业务标识；
步骤S904：接入网络AN根据切片用户临时标识或者业务标识为用户选择切片1，向切片1转发附着请求消息；
步骤S906：切片1检查业务标识，如果和切片1的业务范围不符，则拒绝该附着请求消息，如果用户标识为IMSI，则切片1为用户分配切片用户临时标识，然后向用户数据中心/认证中心发送认证数据请求消息，或者如果为切片1用户临时标识，如果切片1的业务存在切片池，即切片1可以和其他切片共同使用安全上下文，则根据切片用户临时标识中的切片标识向其他的切片(例如：切片3)获取用户安全上下文，如果获取成功，则执行步骤S912到S914，如果获取上下文失败，则向用户终端获取用户标识IMSI，再为用户分配切片1用户临时标识，然后向用户数据中心/认证中心发送认证数据请求消息，所述消息携带用户标识IMSI，网络服务标识，和切片标识1，或者切片1用户临时标识；
步骤S908：用户数据中心/认证中心使用图8密钥衍生算法衍生出中间密钥Ks1；
即Ks1＝密钥产生函数KDF(切片标识1或者切片1用户临时标识，网络服务标识，密钥序列号SQN⊕匿名密钥AK，加密密钥CK，完整性保护密钥IK)。
步骤S910：用户数据中心/认证中心向切片1回送认证数据请求响应消息，所述消息携带一组或者多组认证向量，其中认证向量包括Ks1，预期响应值，随机数和认证令牌；
步骤S912：切片1为Ks1分配对应的切片密钥索引，向用户终端发送用户认证请求消息，所述消息携带切片密钥索引，随机数，认证令牌，切片标识1，或者切片1用户临时标识；
步骤S914：用户终端认证令牌，发现切片1为认证成功网络，保存切片标识或者切片1用户临时标识，以及保存与业务标识的对应关系，然后使用图8密钥衍生算法衍生出中间密钥Ks1，然后在衍生出接入层密钥和非接入层密钥；
即Ks1＝密钥产生函数KDF(切片标识1或者切片1用户临时标识，网络服务标识，密钥序列号SQN⊕匿名密钥AK，加密密钥CK，完整性保护密钥IK)。
步骤S916：用户终端向切片1回送用户认证请求响应消息，所述消息携带验证结果；
步骤S918：切片1将消息中验证结果与认证向量中的预期响应值比较，如果相等，则切片1认证用户终端成功，切片1衍生出接入层密钥和非接入层密钥，然后向用户数据中心/认证中心发送位置更新请求消息，所述消息携带用户标识IMSI；
步骤S920：用户数据中心/认证中心向切片1回送位置更新请求响应消息，所述消息携带用户签约数据；
步骤S922：切片1保存用户签约数据，向接入网络AN回送附着成功响应；
步骤S924：接入网络AN向用户终端转发附着成功响应，至此，用户终端成功在切片1附着成功，用户终端在切片1实现业务；
步骤S926：当用户终端发生移动，或者用户终端需要实现其他业务时(比如车联网业务)，用户终端向接入网络AN附着请求消息，所述消息携带用户标识，所述用户标识可以为IMSI或者切片1用户临时标识，所述消息还携带业务标识(例如：车联网业务)；
步骤S928：接入网络AN根据业务标识选择切片2，向切片2转发附着请求消息；
步骤S930：切片2检查业务标识，如果和切片2的业务范围不符，则拒绝该附着请求消息，如果用户标识为IMSI，则切片2为用户分配切片2用户临时标识，然后向用户数据中心/认证中心发送认证数据请求消息，或者由于切片1和切片2业务不同，不能使用切片1的安全上下文，则向用户终端获取用户标识IMSI，再为用户分配切片2用户临时标识，然后向用户数据中心/认证中心发送认证数据请求消息，所述消息携带用户标识 IMSI，网络服务标识，和切片标识2，或者切片2用户临时标识；
步骤S932：用户数据中心/认证中心使用图8密钥衍生算法衍生出中间密钥Ks2；
即Ks2＝密钥产生函数KDF(切片标识2或者切片2用户临时标识，网络服务标识，密钥序列号SQN⊕匿名密钥AK，加密密钥CK，完整性保护密钥IK)。
步骤S934：按照步骤S910到S924完成后续的用户终端附着到切片2上，至此，用户终端附着到切片2上，用户终端也保存着业务标识与切片2标识或者切片2临时标识的对应关系，用户终端如果再次发生业务改变的附着过程，将根据业务标识选择不同切片标识或者切片用户临时标识进行附着。
综上所述，本发明实施例达到了以下技术效果：解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例一所提供的页面内容的处理方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：
S1，获取用户终端当前附着的网络切片所对应的切片标识，其中，上述切片标识用于唯一标识所述网络切片；
S2，向指定通信设备发送上述切片标识，其中，上述切片标识用于指 示所述指定通信设备根据上述切片标识衍生出网络切片所需的中间密钥。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、 移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例提供的上述技术方案，能够向指定通信设备发送切片标识，进而指定通信设备能够根据接收到的切片标识衍生出网络切片对应的中间密钥的技术方案，解决了相关技术中，不同的网络切片有可能会使用相同的中间密钥而导致的切片功能无法正常实现的问题，进而使得不同的网络切片对应不同的中间密钥，避免了相同的中间密钥分配给不同的网络切片进而导致切片功能无法正常使用的情况。

Claims (15)

  1. 一种密钥的衍生方法，包括：
    获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
    向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
  2. 根据权利要求1所述的方法，其中，向指定通信设备发送所述切片标识，包括：
    向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识，所述指定通信设备包括以下至少之一：用户数据中心、用户认证中心。
  3. 根据权利要求2所述的方法，其中，向指定通信设备发送所述切片标识，包括：
    接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
    根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识，所述指定通信设备包括：用户终端。
  4. 根据权利要求1所述的方法，其中，所述方法还包括：
    当所述用户终端需要从当前附着的网络切片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；
    判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；
    如果是，则向指定通信设备发送所述切片标识。
  5. 根据权利要求1-4任一项所述的方法，其中，所述切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为所述用户终端分配的临时标识信息。
  6. 一种密钥的衍生方法，包括：
    接收网络切片发送的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
    根据所述切片标识衍生出所述网络切片所需的中间密钥。
  7. 根据权利要求6所述的方法，其中，接收网络切片发送的切片标识，包括：
    接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识。
  8. 根据权利要求6或7所述的方法，其中，所述切片标识包括以下至少之一：所述网络切片的标识信息、所述网络切片为用户终端分配的临时标识信息。
  9. 一种密钥的衍生装置，包括：
    获取模块，设置为获取用户终端当前附着的网络切片所对应的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
    发送模块，设置为向指定通信设备发送所述切片标识，其中，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所 述网络切片所需的中间密钥。
  10. 根据权利要求9所述的装置，其中，所述发送模块，还设置为向所述指定通信设备发送第一认证请求，其中，所述第一认证请求中携带有所述切片标识，所述指定通信设备包括以下至少之一：用户数据中心、用户认证中心。
  11. 根据权利要求10所述的装置，其中，所述指定设备包括用户终端时，所述发送模块，包括：
    接收单元，设置为接收所述第一认证请求的响应信息，其中，所述响应信息中携带有安全认证向量；
    发送单元，设置为根据所述安全认证向量向所述指定通信设备发送第二认证请求，其中，所述第二认证请求中携带有所述切片标识。
  12. 根据权利要求9所述的装置，其中，所述装置还包括：
    第一接收模块，设置为当所述用户终端需要从当前附着的网络切片切换至第二网络切片时，接收接入网络AN转发的附着请求消息，其中，所述附着请求信息中携带有业务标识；
    判断模块，设置为判断所述第二网络切片的业务范围是否包括所述业务标识对应的业务；
    所述发送模块，在所述业务范围包括所述业务标识对应的业务时，向指定通信设备发送所述切片标识。
  13. 一种密钥的衍生装置，包括：
    第二接收模块，设置为接收网络切片发送的切片标识，其中，所述切片标识用于唯一标识所述网络切片；
    衍生模块，设置为根据所述切片标识衍生出所述网络切片所需的中间密钥。
  14. 根据权利要求13所述的装置，其中，所述第二接收模块，还设置为接收所述网络切片发送的认证请求，其中，所述认证请求中携带有所述切片标识。
  15. 一种密钥的衍生装置，包括：
    处理器；
    设置为存储所述处理器可执行指令的存储器；
    其中，所述处理器，设置为获取用户终端当前附着的网络切片所对应的切片标识，向指定通信设备发送所述切片标识，其中，所述切片标识用于唯一标识所述网络切片，所述切片标识用于指示所述指定通信设备根据所述切片标识衍生出所述网络切片所需的中间密钥。
PCT/CN2017/088111 2016-07-27 2017-06-13 密钥的衍生方法及装置 WO2018019046A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/320,704 US11290876B2 (en) 2016-07-27 2017-06-13 Key derivation method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610599048.8 2016-07-27
CN201610599048.8A CN107666666B (zh) 2016-07-27 2016-07-27 密钥的衍生方法及装置

Publications (1)

Publication Number Publication Date
WO2018019046A1 true WO2018019046A1 (zh) 2018-02-01

Family

ID=61017393

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/088111 WO2018019046A1 (zh) 2016-07-27 2017-06-13 密钥的衍生方法及装置

Country Status (3)

Country Link
US (1) US11290876B2 (zh)
CN (1) CN107666666B (zh)
WO (1) WO2018019046A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3820182A4 (en) * 2018-09-15 2021-09-08 Huawei Technologies Co., Ltd. METHOD AND APPARATUS FOR ACQUIRING A SECURITY CONTEXT

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6879471B2 (ja) * 2016-04-29 2021-06-02 日本電気株式会社 スライスセキュリティの分離を可能にする方法
CN108012267B (zh) * 2016-10-31 2022-05-24 华为技术有限公司 一种网络认证方法、相关设备及系统
US10764789B2 (en) * 2017-08-11 2020-09-01 Comcast Cable Communications, Llc Application-initiated network slices in a wireless network
CN109511115B (zh) * 2017-09-14 2020-09-29 华为技术有限公司 一种授权方法和网元
US10779155B2 (en) 2018-07-17 2020-09-15 At&T Intellectual Property I, L.P. Customizable and low-latency architecture for cellular core networks
CN111147436B (zh) * 2018-11-05 2022-03-11 华为技术有限公司 一种网络切片授权的方法及通信装置
CN111465012B (zh) * 2019-01-21 2021-12-10 华为技术有限公司 通信方法和相关产品
CN111865872B (zh) * 2019-04-26 2021-08-27 大唐移动通信设备有限公司 一种网络切片内终端安全策略实现方法及设备
CN113302958B (zh) * 2019-04-26 2023-01-06 华为技术有限公司 一种通信方法及装置
CN112492584B (zh) * 2019-08-23 2022-07-22 华为技术有限公司 终端设备和用户面网元之间的安全通信方法、装置及系统
CN113784351B (zh) * 2020-06-10 2024-03-01 华为技术有限公司 切片服务验证方法、实体及设备
WO2024113132A1 (en) * 2022-11-29 2024-06-06 Nokia Shanghai Bell Co., Ltd. Devices, methods, apparatuses, and computer readable media for network slice security

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104951353A (zh) * 2014-03-28 2015-09-30 华为技术有限公司 一种对vnf实现加速处理的方法及装置
CN105224385A (zh) * 2015-09-03 2016-01-06 成都中机盈科科技有限公司 一种基于云计算的虚拟化系统及方法
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术
WO2016107203A1 (zh) * 2015-01-04 2016-07-07 华为技术有限公司 一种身份认证方法及装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101123993B1 (ko) * 2006-04-18 2012-04-16 인터디지탈 테크날러지 코포레이션 무선 통신 보호 방법 및 시스템
CN101232731B (zh) * 2008-02-04 2012-12-19 中兴通讯股份有限公司 用于ue从utran切换到eutran的密钥生成方法和系统
CN101610147A (zh) * 2008-06-16 2009-12-23 华为技术有限公司 密钥处理方法、系统、设备及终端
CN102594569B (zh) * 2012-03-24 2014-10-08 成都大学 一种建立Tor匿名通道时所采用的无证书密钥协商方法
WO2016017886A1 (en) * 2014-08-01 2016-02-04 Lg Electronics Inc. A method of performing an initial access by protecting privacy on a network and user equipment therefor
JP6307173B2 (ja) * 2015-03-20 2018-04-04 株式会社Ｎｔｔドコモ システム及び方法
US20160353367A1 (en) * 2015-06-01 2016-12-01 Huawei Technologies Co., Ltd. System and Method for Virtualized Functions in Control and Data Planes
KR102304147B1 (ko) * 2015-06-05 2021-09-23 콘비다 와이어리스, 엘엘씨 통합된 스몰 셀 및 wi-fi 네트워크를 위한 통합 인증
CN106375987B (zh) * 2015-07-22 2021-08-20 中兴通讯股份有限公司 一种网络切片的选择方法及系统
US10129235B2 (en) * 2015-10-16 2018-11-13 Qualcomm Incorporated Key hierarchy for network slicing
WO2017121482A1 (en) * 2016-01-14 2017-07-20 Telefonaktiebolaget Lm Ericsson (Publ) Methods, nodes and communication device for establishing a key related to at least two network instances
US10028128B2 (en) * 2016-04-29 2018-07-17 Motorola Mobility Llc Procedures to support network slicing in a wireless communication system
KR102358918B1 (ko) * 2016-07-04 2022-02-07 삼성전자 주식회사 무선 통신 시스템에서 서비스에 따른 보안 관리 방법 및 장치
CN107579948B (zh) * 2016-07-05 2022-05-10 华为技术有限公司 一种网络安全的管理系统、方法及装置
CN117998503A (zh) * 2017-06-16 2024-05-07 华为技术有限公司 通信方法及接入网设备、核心网设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104951353A (zh) * 2014-03-28 2015-09-30 华为技术有限公司 一种对vnf实现加速处理的方法及装置
CN105577637A (zh) * 2014-10-31 2016-05-11 英特尔公司 用于安全虚拟网络功能间通信的技术
WO2016107203A1 (zh) * 2015-01-04 2016-07-07 华为技术有限公司 一种身份认证方法及装置
CN105224385A (zh) * 2015-09-03 2016-01-06 成都中机盈科科技有限公司 一种基于云计算的虚拟化系统及方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3820182A4 (en) * 2018-09-15 2021-09-08 Huawei Technologies Co., Ltd. METHOD AND APPARATUS FOR ACQUIRING A SECURITY CONTEXT
US11722888B2 (en) 2018-09-15 2023-08-08 Huawei Technologies Co., Ltd. Security context obtaining method and apparatus

Also Published As

Publication number Publication date
US11290876B2 (en) 2022-03-29
CN107666666A (zh) 2018-02-06
CN107666666B (zh) 2022-11-08
US20190166493A1 (en) 2019-05-30

Similar Documents

Publication Publication Date Title
WO2018019046A1 (zh) 密钥的衍生方法及装置
CN111669276B (zh) 一种网络验证方法、装置及系统
US10219153B2 (en) Mutual authentication between user equipment and an evolved packet core
US9538373B2 (en) Method and device for negotiating security capability when terminal moves
WO2018077232A1 (zh) 一种网络认证方法、相关设备及系统
US11778458B2 (en) Network access authentication method and device
US20160119316A1 (en) Wireless network authentication method and wireless network authentication apparatus
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
US20200228981A1 (en) Authentication method and device
US20170150355A1 (en) Cellular network authentication control
CN107205208B (zh) 鉴权的方法、终端和服务器
WO2018054220A1 (zh) 切片网络安全隔离的方法及装置
WO2018045983A1 (zh) 信息处理方法、装置以及网络系统
CN102761870A (zh) 一种终端身份验证和服务鉴权的方法、系统和终端
WO2013127190A1 (zh) 一种nas算法的传输方法及装置
CN111148094A (zh) 5g用户终端的注册方法、用户终端设备及介质
US9906953B2 (en) Method and user equipment for discovering device user
KR20220076491A (ko) 사전 공유 키를 사용하는 무선 네트워크 프로비저닝
WO2020147854A1 (zh) 认证方法、装置、系统以及存储介质
CN106537962B (zh) 无线网络配置、接入和访问方法、装置及设备
WO2022078058A1 (zh) 解密方法、服务器及存储介质
CN111132167B (zh) 5g用户终端接入5g网络的方法、用户终端设备及介质
US10390224B2 (en) Exception handling in cellular authentication
CN113285805B (zh) 一种通信方法及装置
EP3512229B1 (en) Network access authentication processing method and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17833350

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17833350

Country of ref document: EP

Kind code of ref document: A1