WO2018054218A1 - 一种安全模式启用方法及装置 - Google Patents

一种安全模式启用方法及装置 Download PDF

Info

Publication number
WO2018054218A1
WO2018054218A1 PCT/CN2017/100699 CN2017100699W WO2018054218A1 WO 2018054218 A1 WO2018054218 A1 WO 2018054218A1 CN 2017100699 W CN2017100699 W CN 2017100699W WO 2018054218 A1 WO2018054218 A1 WO 2018054218A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice network
terminal
network
signaling
slice
Prior art date
Application number
PCT/CN2017/100699
Other languages
English (en)
French (fr)
Inventor
谢振华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018054218A1 publication Critical patent/WO2018054218A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition

Definitions

  • the present application relates to, but is not limited to, the field of communications, and more particularly to a method and apparatus for enabling a security mode.
  • the 3rd Generation Partnership Project (3GPP) proposes a scheme for network slicing, so that one physical mobile network can be virtualized into multiple virtual mobile networks, and each virtual mobile network is called a slicing network. (slice), users can access multiple slicing networks to obtain corresponding services, which greatly increases the flexibility of the network.
  • FIG. 1 is a diagram showing an example of a relationship between a network and a slicing network.
  • a slice network is a network that is virtualized from a physical network and attached to a physical network. Because of the existence of the dependency relationship, the user accessing the slice network first needs to have access to the physical network to which the slice network is attached. Since the slicing network is virtualized from the physical network, the network element in the slicing network is attached to the network element in the physical network, that is, a certain network element in the physical network can serve the physical network or serve Attached to the network of slices on it.
  • Embodiments of the present invention provide a security mode enabling method and apparatus.
  • This application provides:
  • a security mode enablement method that includes:
  • the control plane function entity CPF sends the first signaling to the terminal, and carries the slice network security information, which is used to instruct the terminal to enable the slice network security mode.
  • a device for safe mode activation comprising:
  • the first sending unit is configured to send the first signaling to the terminal, and carry the slice network security information, to indicate that the terminal enables the slice network security mode.
  • An apparatus for secure mode enablement comprising: a processor and a memory configured to store a program for secure mode enable, the program being applied to a slice network, the processor being configured to read the use
  • the program is enabled in the security mode to perform the following operations: sending the first signaling to the terminal, and carrying the slice network security information, to indicate that the terminal enables the slice network security mode.
  • a security mode enablement method that includes:
  • the terminal receives the first signaling from the network side, and carries the slice network security information, and is used to indicate that the network side has enabled the slice network security mode.
  • a security mode enabling device comprising:
  • the second receiving unit is configured to receive the first signaling from the network side, and carry the slice network security information, to indicate that the network side has enabled the slice network security mode.
  • a security mode enabling device applied to a terminal, comprising: a processor and a memory; the memory being configured to store a program for secure mode enabling, the program for slicing a network, the processor being configured to read the A program for safe mode enablement to do the following:
  • the embodiment of the present application further provides a computer readable storage medium storing computer executable instructions, which are implemented to implement the above-mentioned security mode enabling method applied to a slice network.
  • the embodiment of the present application further provides a computer readable storage medium storing computer executable instructions, the computer executable instructions being implemented to implement the other security mode enabling method applied to the slice network.
  • the security mode enabling method and device applied to the sharding network provided by the embodiment of the present invention, in this embodiment, the signaling message and data interaction between the network side (for example, CPF) and the terminal may implement the sharding network by using the slice network related information. Safe mode enabled, can be executed when interaction is required
  • the security mode of the row terminal and the plurality of slice networks is enabled, the calculation resource consumption is reduced, the efficiency is improved, and the security processing efficiency of signaling and data interaction between the network side and the terminal is effectively improved.
  • FIG. 1 is a diagram showing an example of a relationship between a network and a slicing network
  • FIG. 2 is a schematic flowchart of a security mode enabling according to Embodiment 1 of the present invention
  • FIG. 3 is a schematic flowchart of enabling a security mode according to Embodiment 2 of the present invention.
  • FIG. 4 is a schematic flowchart of enabling a security mode according to Embodiment 3 of the present invention.
  • FIG. 5 is a schematic flowchart of a security mode enabled according to Embodiment 4 of the present invention.
  • FIG. 6 is a schematic structural diagram of a device for enabling security mode in Embodiment 7 of the present invention.
  • FIG. 7 is a schematic structural diagram of a device for enabling security mode in Embodiment 9 of the present invention.
  • the embodiment provides a security mode enabling method, which is applied to a slice network, and may include:
  • Step 202 The CPF sends the first signaling to the terminal, and carries the slice network security information, and is used to instruct the terminal to enable the slice network security mode.
  • the slice network security information may include one or more of a slice network identifier, a slice network name, and slice network selection information; and, including an integrity calculation One of the information and confidentiality algorithm information.
  • the method of this embodiment may further include: the CPF receives second signaling from the terminal, the slice network security information corresponds to a slice network; and the CPF uses the terminal and the The slice network related key processes the second signaling.
  • the foregoing method of this embodiment may further include: the CPF sends a third signaling to the terminal, where the slice network security information corresponds to a slice network; and the CPF uses the terminal and the The slice network related key processes the third signaling.
  • the method further includes: the CPF receiving fourth signaling from the terminal, carrying slice network selection information, the slice network selection information corresponding to a specified slice network, the slice network security information including an indication The information specifying the slice network; the CPF processes the fourth signaling using a key associated with the terminal and the designated slice network.
  • the method further includes: the CPF sending a fifth signaling to the terminal; the CPF processing the fifth signaling by using a key related to the terminal and the specified slice network.
  • the method may further include: Step 201, the CPF receives the message from the terminal;
  • the message from the terminal may carry the slice network selection information and the signature information, and the slice network selection information corresponds to the specified slice network.
  • the method may further include: using the CPF with the terminal and The slice network related key processes the signature information. In this manner, the CPF can verify the foregoing message from the terminal, the second signaling, the third signaling, the fourth signaling, and the fifth signaling based on the signature information, and perform the foregoing transmission or processing operation after the verification.
  • the message from the terminal may carry the slice network selection information and the signature information; the method may further include: the CPF processing the key using a key associated with the terminal but not related to any slice network Signature information.
  • the CPF can verify the foregoing message from the terminal, the second signaling, the third signaling, the fourth signaling, and the fifth signaling based on the signature information, and perform the foregoing transmission or processing operation after the verification.
  • the signaling message and data interaction between the network side (for example, CPF) and the terminal can be used to enable the security mode of the slice network, and the security mode of the terminal and the plurality of slice networks can be enabled when the interaction is required, the computing resource consumption is reduced, the efficiency is improved, and the network side and the terminal are effectively improved.
  • the efficiency of secure processing between signaling and data interaction can be used to enable the security mode of the slice network, and the security mode of the terminal and the plurality of slice networks can be enabled when the interaction is required, the computing resource consumption is reduced, the efficiency is improved, and the network side and the terminal are effectively improved.
  • this embodiment provides a security mode enabling method, which is applied to a slice network, and may include:
  • Step 302 The terminal receives the first signaling from the network side, and carries the slice network security information, and is used to indicate that the network side has enabled the slice network security mode.
  • the slice network security information may include one or more of a slice network identifier, a slice network name, and slice network selection information; and may include one of integrity algorithm information and confidentiality algorithm information. .
  • the terminal may further send the second signaling to the network side, and the slice network security information corresponds to a slice network; the terminal may use a key processing system related to the slice network.
  • the second signaling is described.
  • the method may further include: the terminal receiving third signaling from the network side, and the slice network security information corresponds to one slice network; the terminal uses a key related to the slice network Processing the third signaling.
  • the method may further include: the terminal sending fourth signaling to the network side, carrying slice network selection information, the slice network selection information corresponding to a specified slice network, and the slice network security information includes Indicating information of the designated slice network; the terminal processes the fourth signaling using a key associated with the designated slice network.
  • the method may further include: the terminal receiving the fifth signaling from the network side; the terminal processing the fifth signaling by using a key associated with the specified slice network;
  • Step 301 The terminal sends a message to the network side.
  • the message sent to the network side may carry a slice network selection.
  • the terminal or the network side performs verification on the foregoing message, the second signaling, the third signaling, the fourth signaling, and the fifth signaling sent to the network side based on the signature information, and performs the foregoing sending or the verification after the verification. Processing operation.
  • the message sent to the network side may carry the slice network selection information and the signature information; and may further include: the terminal calculating the signature information by using a key that is not associated with any slice network. In this manner, the terminal or the network side performs verification on the foregoing message, the second signaling, the third signaling, the fourth signaling, and the fifth signaling sent to the network side based on the signature information, and performs the foregoing sending or the verification after the verification. Processing operation.
  • the signaling message and data interaction between the terminal and the network side can be implemented by using the slice network related information to implement the security mode of the slice network, and the terminal and the plurality of slice networks can be executed when interaction is required.
  • the security mode is enabled, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing efficiency of signaling and data interaction between the network side and the terminal.
  • FIG. 4 is a flowchart of a method for enabling a security mode in this embodiment, where the process includes:
  • Step 401 The terminal and the CPF complete the access to the physical network.
  • Step 402 The terminal sends a signaling message to the network, where the message carries the user identifier and the signature information, and the message arrives at the CPF.
  • the user identity may be an International Mobile Subscriber Identity (IMSI) or a temporary user identity assigned by the network.
  • IMSI International Mobile Subscriber Identity
  • a temporary user identity assigned by the network may be an International Mobile Subscriber Identity (IMSI) or a temporary user identity assigned by the network.
  • the terminal carries the signature information in the signaling message to perform integrity protection on the message.
  • the manner in which the terminal carries the signature information is: calculating the signature information by using a key that is not associated with any slice network.
  • Step 403 the CPF receives the signaling message, and verifies the message.
  • the verification is correct, the message is processed and the process proceeds to step 404. Otherwise, the current process may be directly ended.
  • the CPF verifies the message by using the terminal and not cutting it.
  • the chip network-related key verifies that the signature information is correct. If it is correct, the message is processed. If it is not correct, the current process can be directly ended.
  • Step 404 The CPF and the terminal perform a security mode enabling process, and send signaling to the terminal.
  • the CPF sends a Security Mode Command message to the terminal, where the message carries the slice network security information, where the slice network identifier and the slice network name are included.
  • slice network selection information which is used to indicate which slice networks can be used by the terminal, and also includes integrity algorithm information or confidentiality algorithm information, which is used to indicate an integrity algorithm or a confidentiality algorithm used by each slice network.
  • Each slice network can use different integrity or confidentiality algorithms.
  • Step 405 The terminal sends a response signaling to the CPF, for example, sending a Security Mode Complete message, and thus, the security mode is enabled.
  • the terminal protects the response signaling by using a key associated with the slice network, and the CPF verifies or decrypts the key using a key associated with the terminal and the slice network.
  • the terminal protects the response signaling using a key that is not associated with any of the slice networks, and the CPF verifies or decrypts the response signaling using a key associated with the terminal but not associated with any slice network.
  • Step 406 The CPF sends a signaling message to the terminal in response to the message in step 402.
  • the CPF protects the signaling by using a key associated with the terminal and the slice network, and the terminal uses the key associated with the slice network to verify or decrypt the letter. Otherwise, the CPF protects the signaling using a key associated with the terminal but not associated with any slicing network, and the terminal verifies or decrypts the signaling using a key that is not associated with any slicing network.
  • Step 407 The terminal subsequently sends a signaling message to the CPF, and carries the slice network selection information.
  • the terminal protects the signaling by using a key associated with the slice network, and the CPF uses the same.
  • the terminal and the slice network-related key verify or decrypt the response signaling; if the slice network security information does not include information indicating the slice network, or the slice network selection information indicates multiple slice networks, the terminal uses no slice Network phase
  • the closed key protects the signaling, and the CPF verifies or decrypts the signaling using a key associated with the terminal but not associated with any slicing network.
  • Step 408 The CPF sends a signaling message to the terminal in response to the signaling message in step 407.
  • the CPF protects the signaling by using a key associated with the terminal and the slice network, and the terminal The response signaling is verified or decrypted using a key associated with the slice network; if the slice network security information does not include information indicating the slice network, or the slice network selection information indicates a plurality of slice networks, the CPF uses a terminal associated with the terminal But the key associated with any slicing network protects the signaling, and the terminal verifies or decrypts the signaling using a key that is not associated with any slicing network.
  • FIG. 5 is a flowchart of a method for enabling a security mode in this embodiment, where the process may include:
  • Step 501 The terminal and the CPF complete the access to the physical network.
  • Step 502 The terminal sends a signaling message to the network, where the signaling message carries the user identifier, the signature information, and the slice network selection information, and the message arrives at the CPF.
  • the manner in which the terminal carries the signature information is: calculating the signature information by using a key related to the slice network; and if the slice network selection information indicates multiple slice networks, The manner in which the terminal carries the signature information is that the signature information is calculated using a key that is not associated with any slice network.
  • Step 503 The CPF receives the signaling message and verifies the message. If the verification is correct, the signaling message is processed, and the process proceeds to step 504. Otherwise, the current process may be directly ended.
  • the CPF verifies the message by: if the slice network selection information indicates multiple slice networks, verifying whether the signature information is correct by using a key related to the terminal and not related to any slice network, if the network selection information is sliced. If only one slice network is indicated, the key information associated with the terminal and the slice network is used to verify whether the signature information is correct. If correct, the message is processed. If not, the current process can be directly ended.
  • Steps 504 to 508 are the same as steps 404 to 408 in FIG.
  • a device for enabling security mode is provided, which is applied to a CPF for a slice network.
  • the device may include:
  • the first sending unit 62 is configured to send the first signaling to the terminal, and carry the slice network security information, to indicate that the terminal enables the slice network security mode.
  • the first receiving unit 61 may be further configured to receive second signaling from the terminal, where the slice network security information corresponds to a slice network; or the first sending unit is further Set to send third signaling to the terminal, where the slice network security information corresponds to a slice network;
  • the apparatus may further include: a first processing unit 63 configured to process the second signaling or the third signaling using a key associated with the terminal and the slice network.
  • the first receiving unit 61 may be further configured to receive fourth signaling from the terminal, carrying slice network selection information, where the slice network selection information corresponds to a specified slice network, the slice The network security information includes information indicating the designated slice network; the first processing unit 63 may be further configured to process the fourth signaling using a key associated with the terminal and the designated slice network.
  • the first sending unit 62 may be further configured to send the fifth signaling to the terminal; the first processing unit may further be configured to use the terminal and the designated slice network.
  • the associated key processes the fifth signaling.
  • the apparatus may further include: a first receiving unit 61 configured to receive a message from the terminal.
  • the message from the terminal may carry the slice network selection information and the signature information, where the slice network selection information corresponds to the specified slice network; the device may further include: a second processing unit 64, configured to use The key associated with the terminal and the slice network processes the signature information, so that the first sending unit 62 and the first processing unit 63 verify the message or signaling based on the signature information, and then send or process the message. .
  • the message from the terminal may carry the slice network selection information.
  • signature information the second processing unit 64 may be further configured to process the signature information using a key associated with the terminal but not associated with any slice network. It is convenient for the first transmitting unit 62 and the first processing unit 63 to perform the transmission or processing after verifying the message or signaling based on the signature information.
  • the foregoing apparatus in this embodiment can be used to perform all operations of the method shown in Embodiment 1, and the implementation process is the same and will not be described again.
  • the signaling message and data interaction between the terminal and the network side can be implemented by using the slice network related information to implement the security mode of the slice network, and the terminal and the plurality of slice networks can be executed when interaction is required.
  • the security mode is enabled, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing efficiency of signaling and data interaction between the network side and the terminal.
  • an apparatus for enabling security mode is provided, which is applied to a control plane function entity CPF, including: a processor and a memory; the memory is configured to store a program for security mode activation, and the program is applied to A slice network, the processor being configured to read the program for secure mode enablement to perform the following operations:
  • the processor may be configured to read the program for implementing the secure operation of the slice network to perform all the operations of the method shown in the first embodiment, and the implementation process is the same, and details are not described herein.
  • the signaling message and data interaction between the terminal and the network side can be implemented by using the slice network related information to implement the security mode of the slice network, and the terminal and the plurality of slice networks can be executed when interaction is required.
  • the security mode is enabled, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing efficiency of signaling and data interaction between the network side and the terminal.
  • a device for enabling security mode is provided for a slice network, and is applied to a terminal.
  • the device may include:
  • the second receiving unit 72 is configured to receive the first signaling from the network side, and carry the slice network security information, to indicate that the network side has enabled the slice network security mode.
  • the second sending unit 71 may be further configured to send the second signaling to the network side, where the slice network security information corresponds to a slice network; or the second receiving unit further And the third network processing unit 73 is configured to use a key associated with the slice network. Processing the second signaling or the third signaling.
  • the second sending unit 71 may be further configured to send fourth signaling to the network side, carrying slice network selection information, where the slice network selection information corresponds to a specified slice network, the slice
  • the network security information includes information indicating the designated slice network; the third processing unit 73 is further configured to process the fourth signaling using a key associated with the designated slice network.
  • the second receiving unit 72 may be further configured to receive the fifth signaling from the network side; the third processing unit 73 may be further configured to use the specified slice network. Key processing the fifth signaling;
  • the device may further include: a second sending unit 71, configured to send a message to the network side.
  • the message sent to the network side may carry the slice network selection information and the signature information, where the slice network selection information corresponds to the specified slice network.
  • the device may further include: a fourth processing unit 74, configured to use The signature information is calculated by a key associated with the slice network. As such, it is convenient for the second transmitting unit 71 and the third processing unit 73 to perform the transmission or processing after verifying the message or signaling based on the signature information.
  • the message sent to the network side may carry the slice network selection information and the signature information; and the fourth processing unit 74 may be further configured to calculate the signature information using a key that is not associated with any slice network. As such, it is convenient for the second transmitting unit 71 and the third processing unit 73 to perform the transmission or processing after verifying the message or signaling based on the signature information.
  • the signaling message and data interaction between the terminal and the network side can be implemented by using the slice network related information to implement the security mode of the slice network, and the terminal and the plurality of slice networks can be executed when interaction is required.
  • the security mode is enabled, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing efficiency of signaling and data interaction between the network side and the terminal.
  • a security mode enabling apparatus which is applied to a terminal, including: a processor and a memory; the memory is configured to store a program for security mode activation, the program is used for a slice network, the processor Set to read the program for safe mode enablement to do the following:
  • the processor may be configured to read the program for implementing the secure operation of the slice network to perform all the operations of the method shown in the second embodiment, and the implementation process is the same, and details are not described herein.
  • the signaling message and data interaction between the terminal and the network side can be implemented by using the slice network related information to implement the security mode of the slice network, and the terminal and the plurality of slice networks can be executed when interaction is required.
  • the security mode is enabled, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing efficiency of signaling and data interaction between the network side and the terminal.
  • the embodiment of the present application further provides a computer readable storage medium, where computer executable instructions are executed, and when the computer executable instructions are executed, the security mode enabling method applied to the slice network in the first embodiment is implemented.
  • the embodiment of the present application further provides a computer readable storage medium, where computer executable instructions are executed, and when the computer executable instructions are executed, the security mode enabling method applied to the slice network in the second embodiment is implemented.
  • the computer readable storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • the medium in which the program code is stored may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • the processor executes the method steps of the above embodiments in accordance with program code already stored in the storage medium.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • This application is not limited to any combination of the specified forms of hardware and software.
  • the security mode enabling method and device applied to the sharding network provided by the embodiment of the present invention, in this embodiment, the signaling message and data interaction between the network side (for example, CPF) and the terminal may implement the sharding network by using the slice network related information.
  • the security mode is enabled, and the security mode of the terminal and multiple slice networks is enabled when interaction is required, which reduces computing resource consumption, improves efficiency, and effectively improves the security processing of signaling and data interaction between the network side and the terminal. effectiveness.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本文公布了一种安全模式启用方法及装置，用于切片网络，所述方法可包括：控制面功能实体CPF向终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。

Description

一种安全模式启用方法及装置 技术领域
本申请涉及但不限于通信领域，尤指一种安全模式启用方法及装置。
背景技术
第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)提出了一种网络切片的方案，使得一个物理移动网络可以被虚拟化为多个虚拟的移动网络，每个虚拟的移动网络称为切片网络(slice)，用户可以接入多个切片网络以获得相应服务，极大的增加了网络的灵活性。
图1是网络与切片网络的关系示例图。切片网络是从物理网络中虚拟出来的一个网络，依附于物理网络。因为依附关系的存在，用户访问切片网络首先需要有能力接入切片网络依附的物理网络。由于切片网络是从物理网络中虚拟出来的，因此切片网络中的网元是依附于物理网络中的网元的，即物理网络中的某个网元既可服务于该物理网络，也可以服务于依附与其上的切片网络。
目前，只有针对物理网络的安全模式启用方案，没有针对存在切片网络场景的安全模式启用方案。
发明概述
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供了一种安全模式启用方法及装置。
本申请提供了：
一种安全模式启用方法，包括：
控制面功能实体CPF向终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
一种用于安全模式启用的装置，包括：
第一发送单元，设置为向终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
一种用于安全模式启用的装置，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序应用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：向所述终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
一种安全模式启用方法，包括：
终端接收来自网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
一种安全模式启用装置，包括：
第二接收单元，设置为接收来自所述网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
一种安全模式启用装置，应用于终端，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：
接收来自网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
另一方面，本申请实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述一种应用于切片网络的安全模式启用方法。
另一方面，本申请实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述另一种应用于切片网络的安全模式启用方法。
本发明实施例提供的应用于切片网络的安全模式启用方法及装置，本实施例中，网络侧(例如CPF)和终端之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执 行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为网络与切片网络的关系示例图；
图2为本发明实施例一中安全模式启用的流程示意图；
图3为本发明实施例二中安全模式启用的流程示意图；
图4为本发明实施例三中安全模式启用的流程示意图；
图5为本发明实施例四中安全模式启用的流程示意图；
图6为本发明实施例七中用于安全模式启用的装置的组成结构示意图；
图7为本发明实施例九中用于安全模式启用的装置的组成结构示意图。
详述
下文中将结合附图对本发明的实施例进行详细说明。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
实施例一
如图2所示，本实施例提供一种安全模式启用方法，应用于切片网络，可以包括：
步骤202，所述CPF向所述终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
在一些实现方式中，所述切片网络安全信息可以包括切片网络标识、切片网络名称、和切片网络选择信息中之一或多项；以及，包括完整性算 法信息和机密性算法信息中之一。
在一些实现方式中，本实施例的方法还可以包括：所述CPF接收来自所述终端的第二信令，所述切片网络安全信息对应一个切片网络；所述CPF使用与所述终端以及所述切片网络相关的密钥处理所述第二信令。
在一些实现方式中，本实施例的上述方法还可以包括：所述CPF向所述终端发送第三信令，所述切片网络安全信息对应一个切片网络；所述CPF使用与所述终端及所述切片网络相关的密钥处理所述第三信令。
在一些实现方式中，还可以包括：所述CPF接收来自所述终端的第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；所述CPF使用与所述终端及所述指定切片网络相关的密钥处理所述第四信令。
在一些实现方式中，还可以包括：所述CPF向所述终端发送第五信令；所述CPF使用与所述终端及所述指定切片网络相关的密钥处理所述第五信令。
其中，在步骤202之前，还可以包括：步骤201，CPF接收来自终端的消息；
在一些实现方式中，所述来自终端的消息可以携带切片网络选择信息和签名信息，且所述切片网络选择信息对应于指定切片网络；上述方法还可包括：所述CPF使用与所述终端及所述切片网络相关的密钥处理所述签名信息。如此，便于CPF基于该签名信息对上述来自终端的消息、第二信令、第三信令、第四信令以及第五信令进行验证，验证之后再执行上述的发送或处理的操作。
在一些实现方式中，所述来自终端的消息可以携带切片网络选择信息和签名信息；上述方法还可以包括：所述CPF使用与所述终端相关但不与任何切片网络相关的密钥处理所述签名信息。如此，便于CPF基于该签名信息对上述来自终端的消息、第二信令、第三信令、第四信令以及第五信令进行验证，验证之后再执行上述的发送或处理的操作。
本实施例中，网络侧(例如CPF)和终端之间的信令消息和数据交互， 可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，且有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
实施例二
如图3所示，本实施例提供一种安全模式启用方法，应用于切片网络，可以包括：
步骤302，终端接收来自所述网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
在一些实现方式中，所述切片网络安全信息可以包括切片网络标识、切片网络名称、和切片网络选择信息中之一或多项；以及，可以包括完整性算法信息和机密性算法信息中之一。
在一些实现方式中，所述终端还可以向所述网络侧发送第二信令，且所述切片网络安全信息对应一个切片网络；所述终端可以使用与所述切片网络相关的密钥处理所述第二信令。
在一些实现方式中，还可以包括：所述终端接收来自所述网络侧的第三信令，且所述切片网络安全信息对应一个切片网络；所述终端使用与所述切片网络相关的密钥处理所述第三信令。
在一些实现方式中，还可以包括：所述终端向所述网络侧发送第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，且所述切片网络安全信息包含指示所述指定切片网络的信息；所述终端使用与所述指定切片网络相关的密钥处理所述第四信令。
在一些实现方式中，还可以包括：所述终端接收来自所述网络侧的第五信令；所述终端使用与所述指定切片网络相关的密钥处理所述第五信令；
其中，步骤302之前，还可以包括：步骤301，终端向网络侧发送消息。
在一些实现方式中，所述向网络侧发送的消息可以携带切片网络选择 信息和签名信息，所述切片网络选择信息对应指定切片网络；还可以包括：所述终端使用与所述切片网络相关的密钥计算所述签名信息。如此，便于终端或网络侧基于该签名信息对上述向网络侧发送的消息、第二信令、第三信令、第四信令以及第五信令进行验证，验证之后再执行上述的发送或处理的操作。
在一些实现方式中，所述向网络侧发送的消息可以携带切片网络选择信息和签名信息；还可以包括：所述终端使用不与任何切片网络相关的密钥计算所述签名信息。如此，便于终端或网络侧基于该签名信息对上述向网络侧发送的消息、第二信令、第三信令、第四信令以及第五信令进行验证，验证之后再执行上述的发送或处理的操作。
本实施例中，终端和网络侧(例如CPF)之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，且有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
实施例三
图4是本实施例中安全模式启用方法的流程图，该流程包括：
步骤401，终端与CPF间完成对物理网络的接入。
步骤402，终端向网络发送信令消息，该消息携带用户标识和签名信息，该消息到达CPF。
例如，用户标识可以是国际移动用户识别码(IMSI，International Mobile Subscriber Identity)或网络分配的临时用户标识。
本实施例中，终端在所述信令消息中携带签名信息，以对消息进行完整性保护。其中，终端携带签名信息的方式为：使用不与任何切片网络相关的密钥计算该签名信息。
步骤403，CPF接收该信令消息，并验证该消息，在验证正确时处理该消息并继续步骤404，否则，可以直接结束当前流程；
其中，CPF验证该消息的方式为：使用与该终端相关的且不与任何切 片网络相关的密钥验证该签名信息是否正确，如果正确则处理该消息，如果不正确，则可以直接结束当前流程。
步骤404，CPF与终端执行安全模式启用过程，向终端发送信令，比如，CPF向终端发送安全模式命令(Security Mode Command)消息，消息携带切片网络安全信息，其中包含切片网络标识、切片网络名称、或切片网络选择信息，这些信息用于指示哪些切片网络可以被终端使用，还包括完整性算法信息或机密性算法信息，这些算法信息用于指示各个切片网络使用的完整性算法或机密性算法，各切片网络可以使用不同的完整性或机密性算法。
步骤405，终端再向CPF发送响应信令，比如发送安全模式完成(Security Mode Complete)消息，如此，安全模式启用完成。
本实施例中，如果切片网络安全信息指示仅一个切片网络，则终端使用与该切片网络相关的密钥保护该响应信令，CPF使用与该终端和该切片网络相关的密钥验证或解密该响应信令，否则，终端使用不与任何切片网络相关的密钥保护该响应信令，CPF使用与该终端相关但不与任何切片网络相关的密钥验证或解密该响应信令。
步骤406，CPF向终端发送信令消息，以响应步骤402中的消息。
本实施例中，如果切片网络安全信息指示仅一个切片网络，则CPF使用与该终端和该切片网络相关的密钥保护该信令，终端使用与该切片网络相关的密钥验证或解密该信令，否则，CPF使用与该终端相关但不与任何切片网络相关的密钥保护该信令，终端使用不与任何切片网络相关的密钥验证或解密该信令。
步骤407，终端后续向CPF发送信令消息，携带切片网络选择信息。
本实施例中，如果切片网络选择信息仅对应一个切片网络，且切片网络安全信息中包含指示该切片网络的信息，则终端使用与该切片网络相关的密钥保护该信令，CPF使用与该终端和该切片网络相关的密钥验证或解密该响应信令；如果切片网络安全信息中不包含指示该切片网络的信息，或切片网络选择信息指示多个切片网络，则终端使用不与任何切片网络相 关的密钥保护该信令，CPF使用与该终端相关但不与任何切片网络相关的密钥验证或解密该信令。
步骤408，CPF向终端发送信令消息，以响应步骤407中的信令消息。
本实施例中，如果切片网络选择信息仅对应一个切片网络，且切片网络安全信息中包含指示该切片网络的信息，则CPF使用与该终端和该切片网络相关的密钥保护该信令，终端使用与该切片网络相关的密钥验证或解密该响应信令；如果切片网络安全信息中不包含指示该切片网络的信息，或切片网络选择信息指示多个切片网络，则CPF使用与该终端相关但不与任何切片网络相关的密钥保护该信令，终端使用不与任何切片网络相关的密钥验证或解密该信令。
实施例四
图5是本实施例中安全模式启用方法的流程图，该流程可以包括：
步骤501，终端与CPF间完成对物理网络的接入。
步骤502，终端向网络发送信令消息，该信令消息中携带用户标识、签名信息以及切片网络选择信息，该消息到达CPF；
本实施例中，如果切片网络选择信息指示仅一个切片网络，则终端携带签名信息的方式为：使用与该切片网络相关的密钥计算该签名信息；如果切片网络选择信息指示多个切片网络，则终端携带签名信息的方式为：使用不与任何切片网络相关的密钥计算该签名信息。
步骤503，CPF接收该信令消息，并验证该消息，如果验证正确，则处理该信令消息，继续步骤504，否则可以直接结束当前流程。
其中，CPF验证该消息的方式为：如果切片网络选择信息指示多个切片网络，则使用与该终端相关的且不与任何切片网络相关的密钥验证该签名信息是否正确，如果切片网络选择信息指示仅一个切片网络，则使用与该终端和该切片网络相关的密钥验证该签名信息是否正确，如果正确则处理该消息，如果不正确，则可以直接结束当前流程。
步骤504～508：与图4中的步骤404～408相同。
实施例五
本实施例中，提供一种用于安全模式启用的装置，应用于CPF，用于切片网络，如图6所示，该装置可包括：
第一发送单元62，设置为向所述终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
在一些实现方式中，所述第一接收单元61，还可以设置为接收来自所述终端的第二信令，所述切片网络安全信息对应一个切片网络；或，所述第一发送单元，还设置为向所述终端发送第三信令，所述切片网络安全信息对应一个切片网络；
上述装置还可以包括：第一处理单元63，设置为使用与所述终端及所述切片网络相关的密钥处理所述第二信令或第三信令。
在一些实现方式中，所述第一接收单元61，还可以设置为接收来自所述终端的第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；所述第一处理单元63，还可以设置为使用与所述终端及所述指定切片网络相关的密钥处理所述第四信令。
在一些实现方式中，所述第一发送单元62，还可以设置为向所述终端发送第五信令；所述第一处理单元，还可以设置为使用与所述终端及所述指定切片网络相关的密钥处理所述第五信令。
其中，所述装置还可包括：第一接收单元61，设置为接收来自终端的消息。
在一些实现方式中，所述来自终端的消息可以携带切片网络选择信息和签名信息，所述切片网络选择信息对应于指定切片网络；上述装置还可以还包括：第二处理单元64，设置为使用与所述终端及所述切片网络相关的密钥处理所述签名信息，便于第一发送单元62和第一处理单元63基于该签名信息对所述消息或信令进行验证之后再进行发送或处理。
在一些实现方式中，所述来自终端的消息可以携带切片网络选择信息 和签名信息；第二处理单元64，还可以设置为使用与所述终端相关但不与任何切片网络相关的密钥处理所述签名信息。便于第一发送单元62和第一处理单元63基于该签名信息对所述消息或信令进行验证之后再进行发送或处理。
本实施例中的上述装置可用于执行实施例一所示方法的所有操作，其实现过程相同，不再赘述。
本实施例中，终端和网络侧(例如CPF)之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，且有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
实施例六
本实施例中，提供一种用于安全模式启用的装置，应用于控制面功能实体CPF，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序应用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：
向所述终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
本实施例中的上述装置中，所述处理器可设置为读取所述用于实现切片网络安全启用的程序来执行实施例一所示方法的所有操作，其实现过程相同，不再赘述。
本实施例中，终端和网络侧(例如CPF)之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，且有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
实施例七
本实施例中，提供一种用于安全模式启用的装置，用于切片网络，应用于终端，如图7所示，该装置可包括：
第二接收单元72，设置为接收来自所述网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
在一些实现方式中，所述第二发送单元71，还可以设置为向所述网络侧发送第二信令，所述切片网络安全信息对应一个切片网络；或者，所述第二接收单元，还设置为接收来自所述网络侧的第三信令，且所述切片网络安全信息对应一个切片网络；上述装置还可包括：第三处理单元73，设置为使用与所述切片网络相关的密钥处理所述第二信令或第三信令。
在一些实现方式中，所述第二发送单元71，还可以设置为向所述网络侧发送第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；所述第三处理单元73，还设置为使用与所述指定切片网络相关的密钥处理所述第四信令。
在一些实现方式中，所述第二接收单元72，还可以设置为接收来自所述网络侧的第五信令；所述第三处理单元73，还可以设置为使用与所述指定切片网络相关的密钥处理所述第五信令；
其中，所述装置还可以包括：第二发送单元71，设置为向网络侧发送消息。
在一些实现方式中，所述向网络侧发送的消息可以携带切片网络选择信息和签名信息，所述切片网络选择信息对应指定切片网络；上述装置还可以包括：第四处理单元74，设置为使用与所述切片网络相关的密钥计算所述签名信息。如此，便于第二发送单元71和第三处理单元73基于该签名信息对所述消息或信令进行验证之后再进行发送或处理。
在一些实现方式中，所述向网络侧发送的消息可以携带切片网络选择信息和签名信息；第四处理单元74，还可以设置为使用不与任何切片网络相关的密钥计算所述签名信息。如此，便于第二发送单元71和第三处理单元73基于该签名信息对所述消息或信令进行验证之后再进行发送或处理。
本实施例中的上述装置可用于执行实施例二所示方法的所有操作，其实现过程相同，不再赘述。
本实施例中，终端和网络侧(例如CPF)之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
实施例八
本实施例中，提供一种安全模式启用装置，应用于终端，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：
接收来自所述网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
本实施例中的上述装置中，所述处理器可设置为读取所述用于实现切片网络安全启用的程序来执行实施例二所示方法的所有操作，其实现过程相同，不再赘述。
本实施例中，终端和网络侧(例如CPF)之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，有效提高了网络侧与终端之间信令和数据交互的安全处理效率。
此外，本申请实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述实施例一中应用于切片网络的安全模式启用方法。
此外，本申请实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述实施例二中应用于切片网络的安全模式启用方法。
上述计算机可读存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
在本实施例中，处理器根据存储介质中已存储的程序代码执行上述实施例的方法步骤。
本实施例中的示例可以参考上述实施例及实施方式中所描述的示例，本实施例在此不再赘述。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本申请不限制于任何指定形式的硬件和软件的结合。
以上显示和描述了本申请的基本原理和主要特征和本申请的优点。本申请不受上述实施例的限制，上述实施例和说明书中描述的只是说明本申请的原理，在不脱离本申请精神和范围的前提下，本申请还会有各种变化和改进，这些变化和改进都落入要求保护的本申请范围内。
工业实用性
本发明实施例提供的应用于切片网络的安全模式启用方法及装置，本实施例中，网络侧(例如CPF)和终端之间的信令消息和数据交互，可以采用切片网络相关信息实现切片网络的安全模式启用，可在需要交互时才执行终端与多个切片网络的安全模式启用，减少了计算资源消耗，提高了效率，有效提高了网络侧与终端之间信令和数据交互的安全处理效率。

Claims (32)

  1. 一种安全模式启用方法，包括：
    控制面功能实体CPF向终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
  2. 根据权利要求1所述的方法，其中，所述切片网络安全信息包括切片网络标识、切片网络名称、和切片网络选择信息中之一或多项；以及，包括完整性算法信息和机密性算法信息中之一。
  3. 根据权利要求1所述的方法，还包括：
    所述CPF接收来自所述终端的第二信令，所述切片网络安全信息对应一个切片网络；
    所述CPF使用与所述终端以及所述切片网络相关的密钥处理所述第二信令。
  4. 根据权利要求1所述的方法，还包括：
    所述CPF向所述终端发送第三信令，所述切片网络安全信息对应一个切片网络；
    所述CPF使用与所述终端及所述切片网络相关的密钥处理所述第三信令。
  5. 根据权利要求1所述的方法，还包括：
    所述CPF接收来自所述终端的第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；
    所述CPF使用与所述终端及所述指定切片网络相关的密钥处理所述第四信令。
  6. 根据权利要求5所述的方法，还包括：
    所述CPF向所述终端发送第五信令；
    所述CPF使用与所述终端及所述指定切片网络相关的密钥处理所述第五信令。
  7. 根据权利要求1所述的方法，还包括：
    所述CPF接收来自所述终端的消息，所述消息携带切片网络选择信息和签名信息，且所述切片网络选择信息对应于指定切片网络；
    所述CPF使用与所述终端及所述切片网络相关的密钥处理所述签名信息。
  8. 根据权利要求1所述的方法，还包括：
    所述CPF接收来自所述终端的消息，所述消息携带切片网络选择信息和签名信息；
    所述CPF使用与所述终端相关但不与任何切片网络相关的密钥处理所述签名信息。
  9. 一种用于安全模式启用的装置，包括：
    第一发送单元，设置为向终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
  10. 根据权利要求9所述的装置，其中，
    所述第一发送单元，还设置为向所述终端发送第三信令，所述切片网络安全信息对应一个切片网络；
    还包括：第一处理单元，设置为使用与所述终端及所述切片网络相关的密钥处理所述第三信令。
  11. 根据权利要求9所述的装置，还包括：
    第一接收单元，设置为接收来自所述终端的消息，所述消息携带切片网络选择信息和签名信息，所述切片网络选择信息对应于指定切片网络；
    第二处理单元，设置为使用与所述终端及所述切片网络相关的密钥处理所述签名信息。
  12. 根据权利要求9所述的装置，还包括：
    第一接收单元，设置为接收来自所述终端的消息，所述消息携带切片网络选择信息和签名信息；
    第二处理单元，设置为使用与所述终端相关但不与任何切片网络相关的 密钥处理所述签名信息。
  13. 根据权利要求11或12所述的装置，其中，
    所述第一接收单元，还设置为接收来自所述终端的第二信令，所述切片网络安全信息对应一个切片网络；
    还包括：第一处理单元，设置为使用与所述终端及所述切片网络相关的密钥处理所述第二信令。
  14. 根据权利要求11或12所述的装置，其中，
    所述第一接收单元，还设置为接收来自所述终端的第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；
    还包括：第一处理单元，设置为使用与所述终端及所述指定切片网络相关的密钥处理所述第四信令。
  15. 根据权利要求14所述的装置，其中，
    所述第一发送单元，还设置为向所述终端发送第五信令；
    所述第一处理单元，还设置为使用与所述终端及所述指定切片网络相关的密钥处理所述第五信令。
  16. 一种用于安全模式启用的装置，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序应用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：
    向所述终端发送第一信令，携带切片网络安全信息，用于指示所述终端启用切片网络安全模式。
  17. 一种安全模式启用方法，包括：
    终端接收来自网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
  18. 根据权利要求17所述的方法，其中，所述切片网络安全信息包括切片网络标识、切片网络名称、和切片网络选择信息中之一或多项；以及，包括完整性算法信息和机密性算法信息中之一。
  19. 根据权利要求17所述的方法，还包括：
    所述终端向所述网络侧发送第二信令，且所述切片网络安全信息对应一个切片网络；
    所述终端使用与所述切片网络相关的密钥处理所述第二信令。
  20. 根据权利要求17所述的方法，还包括：
    所述终端接收来自所述网络侧的第三信令，且所述切片网络安全信息对应一个切片网络；
    所述终端使用与所述切片网络相关的密钥处理所述第三信令。
  21. 根据权利要求17所述的方法，还包括：
    所述终端向所述网络侧发送第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，且所述切片网络安全信息包含指示所述指定切片网络的信息；
    所述终端使用与所述指定切片网络相关的密钥处理所述第四信令。
  22. 根据权利要求21所述的方法，还包括：
    所述终端接收来自所述网络侧的第五信令；
    所述终端使用与所述指定切片网络相关的密钥处理所述第五信令。
  23. 根据权利要求17所述的方法，还包括：
    所述终端向网络侧发送消息，所述消息携带切片网络选择信息和签名信息，所述切片网络选择信息对应指定切片网络；
    所述终端使用与所述切片网络相关的密钥计算所述签名信息。
  24. 根据权利要求17所述的方法，其中
    所述终端向网络侧发送消息，所述消息携带切片网络选择信息和签名信息；
    所述终端使用不与任何切片网络相关的密钥计算所述签名信息。
  25. 一种安全模式启用装置，包括：
    第二接收单元，设置为接收来自所述网络侧的第一信令，携带切片网络 安全信息，用于指示所述网络侧已启用切片网络安全模式。
  26. 根据权利要求25所述的装置，其中，
    所述第二接收单元，还设置为接收来自所述网络侧的第三信令，且所述切片网络安全信息对应一个切片网络；
    还包括：第三处理单元，设置为使用与所述切片网络相关的密钥处理所述第三信令。
  27. 根据权利要求25所述的装置，还包括：
    第二发送单元，设置为向网络侧发送消息，所述消息携带切片网络选择信息和签名信息，所述切片网络选择信息对应指定切片网络；
    第四处理单元，设置为使用与所述切片网络相关的密钥计算所述签名信息。
  28. 根据权利要求25所述的装置，还包括：
    第二发送单元，设置为向网络侧发送的消息携带切片网络选择信息和签名信息；
    第四处理单元，设置为使用不与任何切片网络相关的密钥计算所述签名信息。
  29. 根据权利要求27或28所述的装置，其中，
    所述第二发送单元，还设置为向所述网络侧发送第二信令，所述切片网络安全信息对应一个切片网络；
    还包括：第三处理单元，设置为使用与所述切片网络相关的密钥处理所述第三信令。
  30. 根据权利要求27或28所述的装置，其中，
    所述第二发送单元，还设置为向所述网络侧发送第四信令，携带切片网络选择信息，所述切片网络选择信息对应于指定切片网络，所述切片网络安全信息包含指示所述指定切片网络的信息；
    还包括：第三处理单元，设置为使用与所述指定切片网络相关的密钥处理所述第四信令。
  31. 根据权利要求30所述的装置，其中，
    所述第二接收单元，还设置为接收来自所述网络侧的第五信令；
    所述第三处理单元，还设置为使用与所述指定切片网络相关的密钥处理所述第五信令。
  32. 一种安全模式启用装置，包括：处理器和存储器；所述存储器设置为存储用于安全模式启用的程序，所述程序用于切片网络，所述处理器设置为读取所述用于安全模式启用的程序来执行如下操作：
    接收来自网络侧的第一信令，携带切片网络安全信息，用于指示所述网络侧已启用切片网络安全模式。
PCT/CN2017/100699 2016-09-20 2017-09-06 一种安全模式启用方法及装置 WO2018054218A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610836537.0 2016-09-20
CN201610836537.0A CN107846387A (zh) 2016-09-20 2016-09-20 一种安全模式启用方法及装置

Publications (1)

Publication Number Publication Date
WO2018054218A1 true WO2018054218A1 (zh) 2018-03-29

Family

ID=61657024

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100699 WO2018054218A1 (zh) 2016-09-20 2017-09-06 一种安全模式启用方法及装置

Country Status (2)

Country Link
CN (1) CN107846387A (zh)
WO (1) WO2018054218A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005064977A1 (en) * 2003-12-29 2005-07-14 Nokia Corporation Method and system for controlling access bearer in a real-time data service
CN101336000A (zh) * 2008-08-06 2008-12-31 中兴通讯股份有限公司 协议配置选项传输方法及系统、用户终端
CN102740266A (zh) * 2011-04-12 2012-10-17 中兴通讯股份有限公司 一种上下文的同步方法及系统
CN103945560A (zh) * 2013-01-17 2014-07-23 中兴通讯股份有限公司 小数据传输路径的建立方法及系统、基站、服务网关

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005064977A1 (en) * 2003-12-29 2005-07-14 Nokia Corporation Method and system for controlling access bearer in a real-time data service
CN101336000A (zh) * 2008-08-06 2008-12-31 中兴通讯股份有限公司 协议配置选项传输方法及系统、用户终端
CN102740266A (zh) * 2011-04-12 2012-10-17 中兴通讯股份有限公司 一种上下文的同步方法及系统
CN103945560A (zh) * 2013-01-17 2014-07-23 中兴通讯股份有限公司 小数据传输路径的建立方法及系统、基站、服务网关

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZTE: "Solution for UE access network and slices", 3GPP TSG SA WG3 (SECURITY) ADHOC MEETING ON FS_NSA, vol. 29, 29 September 2016 (2016-09-29), XP051170403 *

Also Published As

Publication number Publication date
CN107846387A (zh) 2018-03-27

Similar Documents

Publication Publication Date Title
CN108809646B (zh) 安全共享密钥共享系统
JP6769014B2 (ja) セキュリティ保護ネゴシエーション方法およびネットワークエレメント
WO2018054220A1 (zh) 切片网络安全隔离的方法及装置
CN106529308B (zh) 一种数据加密方法、装置及移动终端
US9094823B2 (en) Data processing for securing local resources in a mobile device
US9813400B2 (en) Computer-implemented systems and methods of device based, internet-centric, authentication
CN106714139B (zh) 电子订户身份模块的预个性化
US20170208049A1 (en) Key agreement method and device for verification information
WO2015192670A1 (zh) 用户身份认证方法、终端和服务端
CA2982539C (en) Method of operating a computing device, computing device and computer program
JP2017520953A (ja) 電子加入者識別モジュールのプロビジョニング
WO2012097723A1 (zh) 数据的安全保护方法、网络侧实体和通信终端
US11714914B2 (en) Secure storage of passwords
WO2019109968A1 (zh) 一种解锁sim卡的方法及移动终端
EP3952241A1 (en) Parameter sending method and apparatus
JP2012191270A (ja) 認証システム、端末装置、認証サーバ、およびプログラム
US20200233947A1 (en) System and method for facilitating authentication via a short-range wireless token
US20230289456A1 (en) Certificates in data storage devices
CN105787376A (zh) 一种数据安全存取方法和装置
US9215069B2 (en) Methods and apparatus for device authentication with one-time credentials
CN111835691B (zh) 一种认证信息处理方法、终端和网络设备
WO2018054218A1 (zh) 一种安全模式启用方法及装置
CN112287324B (zh) 图片验证方法、服务器、终端设备及存储介质
KR20220124940A (ko) 허위 기지국 대응을 위한 전자서명 기반의 SIB(System Information Block) 메시지 송/수신 방법 및 장치
WO2019205895A1 (zh) 寻呼方法、网络设备及终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17852286

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17852286

Country of ref document: EP

Kind code of ref document: A1