WO2018126452A1 - 授权验证方法和装置 - Google Patents

授权验证方法和装置 Download PDF

Info

Publication number
WO2018126452A1
WO2018126452A1 PCT/CN2017/070477 CN2017070477W WO2018126452A1 WO 2018126452 A1 WO2018126452 A1 WO 2018126452A1 CN 2017070477 W CN2017070477 W CN 2017070477W WO 2018126452 A1 WO2018126452 A1 WO 2018126452A1
Authority
WO
WIPO (PCT)
Prior art keywords
remote device
relay
key
relay device
management entity
Prior art date
Application number
PCT/CN2017/070477
Other languages
English (en)
French (fr)
Inventor
应江威
邓强
黄正磊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/070477 priority Critical patent/WO2018126452A1/zh
Priority to EP17890818.2A priority patent/EP3557898B1/en
Priority to CN201780056351.6A priority patent/CN109716810B/zh
Priority to PCT/CN2017/077271 priority patent/WO2018126534A1/zh
Priority to EP20207955.4A priority patent/EP3849227A1/en
Publication of WO2018126452A1 publication Critical patent/WO2018126452A1/zh
Priority to US16/504,009 priority patent/US20190335332A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing
    • H04W40/22—Communication route or path selection, e.g. power-based or shortest path routing using selective relaying for reaching a BTS [Base Transceiver Station] or an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/04—Access restriction performed under specific conditions based on user or terminal location or mobility data, e.g. moving direction, speed
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/14—Direct-mode setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/04—Terminal devices adapted for relaying to or from another terminal or user
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/005—Discovery of network devices, e.g. terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/047—Public Land Mobile systems, e.g. cellular systems using dedicated repeater stations

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to an authorization verification method and apparatus.
  • a remote device such as a wearable device is connected to the network through a relay device, thereby reducing the power consumption of the remote device.
  • the remote device When the remote device is connected to the network through the relay device, the remote device needs to use the radio bearer of the relay device. Therefore, the mapping between the data bearing relationship between the remote device and the relay device needs to be completed on the network. Therefore, it is required.
  • the network verifies the legality of the remote device and the relay device and the association between the remote device and the relay device.
  • the relay device when the relay device is a layer 3 relay, the context of the remote device is not stored in the network, and the data channel of the remote device does not exist between the base station and the network, and the base station and the network pass the relay device.
  • the data channel transmits data of the remote device.
  • the network implements the verification of the association relationship between the remote device and the relay device in the following manner. Specifically, the remote device obtains a relay discovery parameter and a ProSe Key Management Function (PKMF) address from a Proximity Service Function (PF), and then obtains an address from the PKMF according to the PKMF address.
  • PKMF ProSe Key Management Function
  • the relay device acquires a relay discovery parameter and a PKMF address from the PF, and acquires a discovery security parameter from the PKMF; If the remote device needs to access the network through the relay device, the remote device and the relay device perform a discovery process based on parameters acquired from the PF; then, after successfully completing the discovery process, the remote device sends a communication request to the relay device.
  • the relay device thereby triggering the relay device to send an authorization and a key request to the PKMF relay, and the PKMF performs an authorization check on the remote device to access the network through the relay device, generates a short-range communication key, and feeds back the communication to the relay device.
  • the relay device forwards the key generation parameter to the remote device, and the remote device generates a communication key according to the key generation parameter. If the communication key generated by the remote device side is consistent with the communication key received by the relay device, Authentication and authorization checks are passed so that the remote device can connect to the network through the relay device.
  • the remote device can also be connected to the network through the layer 2 relay. Since the protocol stack structure of the layer 2 relay is different from the layer 3 relay, when the relay device selects the layer 2 relay, the base station and the core network are far away. The end device establishes the corresponding context information and the data channel of the remote device. If the association verification method corresponding to the layer 3 relay is still used to verify the association between the remote device and the relay device, the layer is required to be executed.
  • the complicated and cumbersome parameter configuration process and authorization check process of the 3 schemes make the network configuration requirements of the entire authentication and authorization process high, the network overhead is large, and the verification efficiency is low.
  • the embodiment of the present invention provides a method and device for verifying the authorization, which solves the problem of high network configuration requirements, high network overhead, and low verification efficiency of the association and authentication processes between the remote device and the relay device.
  • a first aspect of the embodiment of the present application provides a method for authenticating an authorization, which is described from the perspective of a mobility management entity of a relay device, where the method includes: the mobility management entity of the relay device receives the remote device, including the remote device, sent by the relay device.
  • the method is designed for the Layer 2 relay device, and a set of authentication schemes for the association between the remote device and the relay device is designed.
  • the mobile management entity side of the relay device triggers the remote request according to the first request message sent from the relay device. Verification of the association relationship between the device and the relay device.
  • the association relationship verification may be implemented on the mobile management entity side of the relay device, or the association relationship verification may be implemented on the mobile management entity side of the remote device, so that the current relationship can be avoided.
  • the complex and cumbersome parameter configuration process and authorization check process that are required to be performed in the layer 3 relay solution, so that the layer 2 solution of the present application reduces network configuration requirements and reduces network overhead compared with the existing layer 3 solution. Improve the verification efficiency.
  • the mobility management entity of the relay device triggers verification of the association relationship between the remote device and the relay device according to the first request message, and further includes: a mobility management entity of the relay device Acquiring the first authorization information according to the first request message, and according to the label of the remote device The identification of the relay device and the first authorization information verify whether the remote device is allowed to access the network through the relay device.
  • the mobility management entity of the relay device itself verifies the association relationship between the remote device and the relay device, it needs to first obtain the context of the relay device, and obtain a remote relationship with the relay device from the context.
  • the end device list that is, the first authorization information, thereby implementing the verification of the association relationship.
  • the mobility management entity of the relay device learns the identifier of the remote device, the identifier of the relay device, and the first authorization information, determining whether the first authorization information includes the association relationship between the relay device and the remote device, when the first When the authorization information includes the association relationship between the relay device and the remote device, the remote device is allowed to access the network through the relay device. Otherwise, the remote device is not allowed to access the network through the relay device.
  • the acquiring, by the mobility management entity of the relay device, the first authorization information according to the first request message includes: after the relay device successfully registers with the network, according to the identifier of the relay device, the user The data management entity and/or the close-range functional entity acquire the first authorization information. That is, after the relay device is successfully registered to the network, the first authorization information related to the remote device of the relay device is stored in the user data management entity and/or the close-range functional entity in the network. For the first authorization information related to the remote device in the user data management entity, the mobility management entity of the relay device directly obtains the first authorization information from the user data management entity.
  • the manner in which the mobility management entity of the relay device obtains the first authorization information from the short-range functional entity may be: when the mobility management entity of the relay device can directly communicate with the short-range functional entity, that is, there is a direct The interface, the mobility management entity of the relay device directly obtains the foregoing first authorization information from the short-range functional entity; and when the mobility management entity of the relay device cannot directly communicate with the short-range functional entity, that is, there is no direct interface between the two, Then, the short-range functional entity sends the foregoing first authorization information to the mobility management entity of the relay device through the HSS.
  • the mobile management entity of the relay device triggers verification of the association relationship between the remote device and the relay device according to the first request message, including: The mobile management entity of the device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the first authorization information.
  • the first request message generated by the relay device integration also includes a relay service code, where the relay service code is used to represent the remote device.
  • the type of service to be requested, different relay service codes correspond to different service types, therefore,
  • the relay service code is also used.
  • the first authorization information at this time is the remote device with the authorized relationship of the relay device and the corresponding relay. A list of relationships for service codes.
  • the authorization verification method of the present application further includes: the mobility management entity of the relay device sends a third request message including the identifier of the remote device and the identifier of the relay device to the short-range functional entity, so as to enable the short-range function.
  • the entity verifies whether the remote device is allowed to access the network through the relay device according to the third request message.
  • the mobile management entity of the terminal device triggers the implementation of the association verification of the remote device and the relay device, except that the mobile management entity of the relay device can perform self-authentication and mobile management to the remote device.
  • the entity sends a second request message to enable the mobile management entity of the remote device to verify, and the mobility management entity of the relay device may also send a third request message to the short-range functional entity to enable the proximity functional entity to perform verification.
  • the authorization verification method of the application further includes: the mobility management entity of the relay device receives the key sent by the mobility management entity of the remote device, and the security parameter required to generate the key, and the key and The security parameters required to generate the key are sent to the relay device.
  • the remote device wants to access the network through the relay device.
  • the remote device and the relay device need to have a key for protecting communication between the two. Therefore, the mobility management entity of the relay device needs to receive the remote device.
  • the key sent by the mobility management entity and the security parameters required to generate the key are sent to the relay device so that the relay device holds the key and the required security parameters to generate the key.
  • the mobile management entity of the relay device passes the verification of the association relationship between the remote device and the relay device, but the mobile management entity of the relay device receives the The second response message does not carry a key for protecting communication security between the remote device and the relay device and a security parameter required for generating the key, and then the mobility management entity of the relay device sends a key request to the security function entity.
  • the security function entity searches for and obtains a key for protecting communication security between the remote device and the relay device and a security parameter required to generate the key according to the identifier of the remote device in the key request message.
  • the mobility management entity of the relay device feeds back the key and the security parameters required to generate the key to the relay.
  • the relay device processes the key and security parameters accordingly.
  • the number of the relay device can also obtain the security key used to protect the communication between the remote device and the relay device and the security parameters required to generate the key, thereby ensuring that the remote device can access the network through the relay device.
  • the second request message further includes: a non-access stratum message of the remote device, The check code of the non-access stratum message.
  • the mobility management entity of the remote device may also verify the non-access stratum message of the remote device, specifically, the non-access stratum message of the remote device according to the non-access stratum context information of the remote device. The check code is verified.
  • a second aspect of the embodiments of the present application provides an authorization verification method, which is described from the perspective of a mobility management entity of a remote device, where the method includes: the mobility management entity of the remote device receives the mobility management entity sent by the relay device. a second request message including the identifier of the remote device, and performing security processing on the remote device according to the second request message, and sending a second response message to the mobility management entity of the relay device after the remote device performs security processing .
  • the mobility management entity of the remote device may receive the second sent by the mobility management entity of the relay device. Requesting a message, and performing security processing on the remote device according to the second request message or performing further verification processing on the association relationship between the remote device and the relay device, and generating a second response message according to the result of the security process, and The response message is fed back to the mobile management entity of the relay device.
  • the mobility management entity of the remote device authenticates the authorization relationship, which reduces network configuration requirements, reduces network overhead, and improves verification efficiency.
  • the mobility management entity of the remote device performs security processing on the remote device according to the second request message, including: the mobility management entity of the remote device acquires the second authorization information according to the second request message, according to the identifier of the remote device.
  • the identifier of the relay device and the second authorization information verify whether the remote device is allowed to access the network through the relay device.
  • the mobility management entity of the remote device acquires the second authorization information according to the second request message, including: after the remote device successfully registers with the network, the remote management device according to the remote device The identifier of the device acquires the second authorization information from the user data management entity and/or the proximity function entity; the remote device further searches for and obtains the second information in the context information according to the remote device identifier in the second request message.
  • Authorization information is accessed from the user data management entity and/or the proximity function entity.
  • the user data management entity and/or the short-range functional entity in the network stores the second authorization information related to the remote device and the relay device.
  • the identification of the remote device from the user data management entity and / or close work The entity can obtain the second authorization information, and determine whether the second authorization information includes the association relationship between the remote device and the relay device according to the identifier of the remote device, the identifier of the relay device, and the obtained second authorization information.
  • the second authorization information includes the association between the remote device and the relay device, the remote device is allowed to access the network through the relay device. Otherwise, the remote device is not allowed to access the network through the relay device.
  • the second authorization information is a list of relay devices having an authorized relationship with the remote device.
  • the mobile management entity of the remote device performs security processing on the remote device according to the second request message, including: a mobile management entity of the remote device And verifying, according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the second authorization information, whether the remote device is allowed to access the network by using the relay device.
  • the second authorization information is a relationship list of the relay device having an authorized relationship with the remote device and the corresponding relay service code. In this way, when the mobility management entity of the remote device determines the association relationship between the remote device and the relay device, the relay service code is added to the determination condition, that is, the service type of the service requested by the remote device is increased, and the determination result is more accurate.
  • the mobility management entity of the remote device performs security processing on the remote device according to the second request message, including: the mobility management entity of the remote device acquires the remote device according to the identifier of the remote device in the second request message.
  • Non-access stratum context information and verifying the check code of the non-access stratum message of the remote device according to the non-access stratum context information, where the second request message includes: the non-access stratum message of the remote device The check code of the non-access stratum message and the identifier of the remote device.
  • the second request message when the first request message further includes: a non-access stratum message of the remote device, and a check code of the non-access stratum message, the second request message also includes: non-access of the remote device Layer message, check code of non-access stratum message.
  • the mobility management entity of the remote device may also verify the non-access stratum message of the remote device, specifically, the non-access stratum message of the remote device according to the non-access stratum context information of the remote device. The check code is verified, so that the security of the remote device and the relay device is completed by checking the integrity of the non-access stratum message.
  • the authorization verification method further includes: the mobility management entity of the remote device acquires non-access stratum context information of the remote device according to the identifier of the remote device in the second request message, according to the non-access The layer context information generates a key for protecting communication security between the remote device and the relay device, and transmits the key and security parameters required to generate the key to the mobility management entity of the relay device.
  • the mobility management entity of the remote device acquires the non-access stratum context message of the remote device according to the identifier of the remote device that needs to communicate.
  • the access layer context message stores the security parameters required to generate the key.
  • a key for protecting communication security between the remote device and the relay device is generated in the mobility management entity of the remote device. After that, the key and the security parameters required to generate the key need to be sent to the mobility management entity of the relay device, and then sent to the relay device.
  • the authorization verification method further includes: the mobility management entity of the remote device sends a key request message including the identifier of the remote device to the security function entity, so that the security function entity obtains the message according to the key request message.
  • a key used to protect communication security between the remote device and the relay device and security parameters required to generate the key and feed back to the mobile management entity of the remote device, thereby implementing mobility management through the relay device
  • the entity sends to the relay device.
  • the mobility management entity of the relay device when the mobility management entity of the relay device, the mobility management entity of the remote device, or the proximity functional entity authenticates the association relationship between the remote device and the relay device, but the NAS device integrity check of the remote device does not exist. If the NAS message of the remote device does not have integrity protection, or the first request message and the second request message do not carry the NAS message of the remote device, the security function may be used to protect the remote device and the relay device.
  • the communication security key and the security parameters required to generate the key ensure normal communication between the remote device and the relay device.
  • a third aspect of the embodiments of the present application provides a method for authenticating an authorization, which is described from the perspective of a relay device.
  • the method includes: receiving, by the relay device, a communication request that is sent by the remote device, including the identifier of the remote device, according to the communication. Requesting, generating a first request message, and transmitting the first request message to the mobility management entity of the relay device, and receiving a first response message sent by the mobility management entity of the relay device after determining that the association relationship is verified, according to the The first response message sends a communication response to the remote device.
  • the remote device can be connected to the network through the relay device when the communication response is characterized by the communication device and the remote device generates a key for protecting the communication security between the remote device and the relay device.
  • the implementation scheme is simple, the network overhead is small, and the verification efficiency is low.
  • the authorization verification method further includes: the relay device receives a key sent by the mobility management entity of the relay device to protect communication security between the remote device and the relay device, and generates the secret.
  • the sending the communication response to the remote device according to the first response message includes: the relay device sends the security parameter to the remote device by using the communication response, so that the remote device A key for securing communication between the remote device and the relay device is generated according to the security parameter.
  • the relay device After receiving the key and the security parameters required to generate the key, the relay device saves the key by itself, and sends the security parameter required to generate the key to the remote device in the form of a communication response, so that the remote device
  • the device can generate a key for protecting the communication security between the remote device and the relay device according to the security parameter. If the key on the remote device side is the same as the key on the relay device, the authentication and authorization check between the remote device and the relay device is successful.
  • the remote device can send data to the network through the relay device.
  • a fourth aspect of the embodiments of the present application provides a method for authenticating an authorization, which is described from the perspective of a network side device, where the network side device may be a mobility management entity of the relay device or a mobile management entity of the remote device.
  • the method may further include: receiving, by the network device, a first request message that is sent by the relay device, including the identifier of the remote device, and triggering, by the first request message, the remote device and the relay device. Verification of the association relationship, and after determining that the association relationship is verified, the first response message is sent to the relay device.
  • the mobility management entity of the remote device and the mobility management entity of the relay device may be referred to as a network side device, that is,
  • the network side device in this embodiment may be implemented by any one of a mobility management entity of the remote device and a mobility management entity of the relay device.
  • the network side device can also be implemented by a short-range functional entity.
  • the network side device triggers the verification of the association relationship between the remote device and the relay device according to the first request message, where the network side device obtains the first authorization according to the first request message. And verifying, according to the identifier of the remote device, the identifier of the relay device, and the first authorization information, whether the remote device is allowed to access the network through the relay device.
  • the network side device obtains the first authorization information according to the first request message, and the network side device obtains the first data from the user data management entity and/or the short-range functional entity after the relay device and the remote device successfully register to the network.
  • An authorization information is stored in the remote device context information and/or the relay device context information; then, the network side device obtains the first authorization according to the remote device identifier and/or the relay device identifier in the first request message. information.
  • the network side device when the network side device is a mobility management entity of the relay device, the network side device manages the entity and/or from the user data according to the identifier of the relay device after the relay device successfully registers with the network.
  • the short-range functional entity obtains the first authorization information.
  • the first authorization information refers to the authorization information of the relay device.
  • the network side device when the network side device is a mobile management entity of the remote device, the network side device obtains the remote data device from the user data management entity and/or according to the identifier of the remote device. Or the short-range functional entity obtains the first authorization information. At this time, the first authorization information refers to the authorization information of the remote device.
  • the network side device when the network side device is a short-range functional entity, the network-side device, after the remote device and the relay device are successfully registered to the network, according to the identifier of the relay device and the identifier of the remote device.
  • the first authorization information is obtained from the user data management entity and/or the short-range functional entity, and the first authorization information includes the authorization information of the remote device and the authorization information of the relay device.
  • the network side device triggers verification of the association relationship between the remote device and the relay device according to the first request message, including: the network side device according to the far The identifier of the end device, the identifier of the relay device, the relay service code, and the first authorization information verify whether the remote device is allowed to access the network through the relay device.
  • the network side device triggers verification of the association relationship between the remote device and the relay device according to the first request message, where the network side device sends a second request message to the first mobility management entity, so that the first mobile The management entity verifies whether the remote device is allowed to access the network through the relay device according to the second request message.
  • the network side device is the mobility management entity of the relay device
  • the first mobility management entity is a short-range functional entity or a remote end.
  • the first mobile management entity is a mobile functional entity of the short-range functional entity or the relay device; or when the network-side device is a close-range functional entity,
  • the first mobility management entity is a mobility management entity of the remote device or a mobility management entity of the relay device.
  • the network side device triggers the verification of the association relationship between the remote device and the relay device according to the first request message, including: the movement of the network side device to the remote device
  • the management entity sends a second request message, so that the mobile device of the remote device according to the second request
  • the device is configured to perform security processing on the remote device.
  • the network side device is a mobile management entity of the relay device, or the network side device is a short-range functional entity.
  • the network side device when the network side device is the mobile management entity of the remote device, the network side device receives the first request message sent by the relay device, where the network side device receives the first request message that the relay device forwards and processes through the base station,
  • the first request message further includes: an identifier of the relay device.
  • the first request message includes a non-access stratum message of the remote device and a check code of the non-access stratum message
  • the network side device triggers the association between the remote device and the relay device according to the first request message.
  • the verification includes: the network side device acquires the non-access stratum context information of the remote device according to the identifier of the remote device, and verifies the check code of the non-access stratum message according to the non-access stratum context information.
  • the authorization verification method further includes: the network side device sends a second request message to the first mobility management entity, so that the first mobility management entity acquires the non-access stratum context of the remote device according to the identifier of the remote device.
  • the key of the communication security between the relay devices at this time, the network side device is a mobile management entity of the relay device, and the first mobility management entity is a mobile functional entity of the short-range functional entity or the remote device.
  • the authorization verification method further includes: the network side device acquires the non-access stratum context information of the remote device according to the identifier of the remote device, and generates, according to the non-access stratum context information, the protection for the remote device. a key for communication security with the relay device, and a security parameter required for the key and the generated key is fed back to the mobile management entity of the relay device and forwarded to the relay device, so that the relay device will The security parameter is returned to the remote device, so that the remote device generates the key for protecting communication security between the remote device and the relay device according to the security parameter; A mobile management entity or a close-range functional entity of the remote device.
  • the key is generated by a mobility management entity of the remote device according to a basic security key of the remote device.
  • the mobility management entity of the relay device stores context information of the relay device
  • the mobility management entity of the remote device stores context information of the remote device.
  • the context information of the relay device and the context information of the remote device are stored in the short-range functional entity.
  • the authorization verification method further includes: the network side device sends a key request message including the identifier of the remote device to the security function entity, so that the security function entity obtains the protection for the remote end according to the key request message.
  • a fifth aspect of embodiments of the present application provides an authorization verification apparatus, the apparatus comprising means or means for performing the methods of the first aspect and the various implementations of the first aspect described above.
  • a sixth aspect of the embodiments of the present application provides an authorization verification apparatus, the apparatus comprising means or means for performing the methods provided by the second aspect and the various implementations of the second aspect.
  • a seventh aspect of the embodiments of the present application provides an authorization verification apparatus, the apparatus comprising means or means for performing the methods provided by the third aspect and the various implementations of the third aspect.
  • An eighth aspect of the embodiments of the present application provides an authorization verification apparatus, the apparatus comprising means or means for performing the methods provided by the fourth aspect and the various implementations of the fourth aspect.
  • a ninth aspect of the embodiments of the present application provides an authorization verification apparatus, the apparatus comprising a processor and a memory, the memory is for storing a program, and the processor calls a program stored in the memory to execute the method provided by the first aspect of the application.
  • a tenth aspect of the embodiments of the present application provides an authorization verification apparatus, the apparatus comprising a processor and a memory, the memory is used to store a program, and the processor calls a program stored in the memory to execute the method provided by the second aspect of the application.
  • An eleventh aspect of the present application provides an authorization verification apparatus, the apparatus comprising a processor and a memory, the memory is for storing a program, and the processor calls a program stored in the memory to execute the method provided by the third aspect of the present application.
  • a twelfth aspect of the embodiments of the present application provides an authorization verification apparatus, where the apparatus includes a processor and a memory, the memory is used to store a program, and the processor calls a program stored in the memory to execute the program. Apply for the method provided in the fourth aspect.
  • a thirteenth aspect of the embodiments of the present application provides an authorization verification apparatus comprising at least one processing element (or chip) for performing the method of the above first aspect.
  • a fourteenth aspect of the embodiments of the present application provides an authorization verification apparatus comprising at least one processing element (or chip) for performing the method of the above second aspect.
  • a fifteenth aspect of the embodiments of the present application provides an authorization verification apparatus comprising at least one processing element (or chip) for performing the method of the above third aspect.
  • a sixteenth aspect of the embodiments of the present application provides an authorization verification apparatus comprising at least one processing element (or chip) for performing the method of the above fourth aspect.
  • a seventeenth aspect of the embodiments of the present application provides a program for performing the method of the above first aspect when executed by a processor.
  • the eighteenth aspect of the present application provides a program product, such as a computer readable storage medium, comprising the program of the seventeenth aspect.
  • a nineteenth aspect of the embodiments of the present application provides a program for performing the method of the above second aspect when executed by a processor.
  • a twentieth aspect of the embodiments of the present application provides a program product, such as a computer readable storage medium, comprising the program of the nineteenth aspect.
  • a twenty-first aspect of the embodiments of the present application provides a program for performing the method of the above third aspect when executed by a processor.
  • a twenty-second aspect of the embodiments of the present application provides a program product, such as a computer readable storage medium, comprising the program of the twenty-first aspect.
  • a twenty-third aspect of the embodiments of the present application provides a program for performing the method of the above fourth aspect when executed by a processor.
  • a twenty-fourth aspect of the embodiments of the present application provides a program product, such as a computer readable storage medium, comprising the program of the twenty-third aspect.
  • the relay device receives, by the remote device, a communication request including the identifier of the terminal device, and generates a first request message according to the communication request, and sends the first request message to the mobility management entity of the relay device,
  • the mobility management entity of the relay device receives the first request message and triggers verification of the association relationship between the remote device and the relay device, optionally, and the mobility management entity of the relay device to the mobile management entity of the remote device Send a second request message to the remote device
  • the mobile management entity receives the second request message, performs security processing on the remote device according to the second request message, and sends a second response to the mobility management entity of the relay device after performing security processing on the remote device.
  • the mobile management entity of the relay device receives the second response message, and after determining that the association relationship is verified, generates a first response message, and sends the first response message to the relay device, and the relay device sends the message to the remote end according to the first response message.
  • the device sends a communication response.
  • the technical solution of the present application is directed to a layer 2 relay device, and a set of relationship verification schemes between the remote device and the relay device is designed, which avoids the complicated and cumbersome parameter configuration process required in the existing layer 3 relay solution and
  • the authorization checking process makes the layer 2 solution of the present application reduce network configuration requirements, reduce network overhead, and improve verification efficiency compared with the existing layer 3 solution.
  • FIG. 1 is an interaction diagram of Embodiment 1 of an authorization verification method according to an embodiment of the present application
  • Embodiment 2 is a flowchart of Embodiment 2 of an authorization verification method according to an embodiment of the present application
  • FIG. 3 is a flowchart of Embodiment 3 of an authorization verification method according to an embodiment of the present application
  • Embodiment 4 is a flowchart of Embodiment 4 of an authorization verification method according to an embodiment of the present application.
  • FIG. 5 is a flowchart of Embodiment 5 of an authorization verification method according to an embodiment of the present disclosure
  • FIG. 6 is an interaction diagram of Embodiment 6 of an authorization verification method according to an embodiment of the present application.
  • FIG. 7 is an interaction diagram of Embodiment 7 of an authorization verification method according to an embodiment of the present application.
  • FIG. 8 is a flowchart of Embodiment 8 of an authorization verification method according to an embodiment of the present disclosure
  • FIG. 9 is a flowchart of Embodiment 9 of an authorization verification method according to an embodiment of the present application.
  • FIG. 10 is a flowchart of Embodiment 10 of an authorization verification method according to an embodiment of the present application.
  • FIG. 11 is an interaction diagram of Embodiment 11 of an authorization verification method according to an embodiment of the present disclosure.
  • FIG. 12 is an interaction diagram of Embodiment 12 of an authorization verification method according to an embodiment of the present disclosure.
  • FIG. 13 is an interaction diagram of Embodiment 13 of the authorization verification method according to an embodiment of the present disclosure.
  • FIG. 14 is an interaction diagram of Embodiment 14 of an authorization verification method according to an embodiment of the present disclosure.
  • FIG. 15 is an interaction diagram of Embodiment 15 of an authorization verification method according to an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of an authorization verification apparatus according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 21 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 22 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • FIG. 23 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • Remote device can be a wireless terminal that can point to a device that provides voice and/or other service data connectivity to the user, a handheld device with wireless connectivity, or other processing device that is connected to the wireless modem. In order to reduce power consumption, the remote device is generally connected to the network through the relay device.
  • the remote device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, or a remote terminal.
  • the access terminal, the user terminal (User Terminal), the user agent (User Agent), and the user device (User Device or User Equipment) are not limited herein.
  • Relay device also known as a network repeater, an instrument device connected between the remote device and the network, which may be a device that provides relaying for the network connection of the remote device at the wireless network level (such as the PDCP layer), or may be An instrument connected between the remote device and the network, which can amplify and retransmit the transmitted signal, thereby avoiding attenuation of the signal during transmission and effectively improving transmission reliability.
  • the relay device can also be understood as an interconnected device that implements the network constructively at the physical level. The embodiment of the present application does not limit the specific manifestation of the relay device.
  • MME Mobile Management Entity
  • the main function is to support non-access stratum (NAS) signaling and its security, tracking area list management, packet data network gateway (Packet Data Network Gateway) , referred to as P-GW) and Serving Gateway (S-GW), the MME selection when switching across MMEs, and the service GPRS support node during the handover to the 2G/3G access system (Service GPRS Support) Node, referred to as SGSN), user authentication, roaming control, and bearer management, mobility management between core network nodes of 3GPP different access networks, and reachability management of UEs in idle state.
  • the MME in this embodiment of the present application may include a relay device.
  • the MME of the standby device, the MME of the remote device, the MME of the relay device refers to the MME currently serving the relay device
  • the MME of the remote device refers to the MME currently serving the remote device
  • two The MMEs of the current serving relay device and the MME of the current serving remote device may be the same MME.
  • the MMEs involved in all embodiments of the present application generally refer to such MMEs.
  • This application also does not exclude another type of MME, that is, the MME of the relay device refers to the MME dedicated to the serving relay device, and the MME of the remote device refers to the MME dedicated to the service remote device.
  • the two MMEs may be different; of course, the MME that integrates the relay device and the MME of the remote device may be included. These MMEs can be used to verify whether the remote device is allowed to access the network through the relay device.
  • the MME may also be a mobility management function entity in a future 5G network, such as an access and mobility management function (AMF).
  • AMF access and mobility management function
  • a base station also known as a radio access network (RAN) device, is a device that connects a terminal to a wireless network, and can be a Global System of Mobile communication (GSM) or a code division.
  • GSM Global System of Mobile communication
  • a Base Transceiver Station (BTS) in the Code Division Multiple Access (CDMA) may be a base station (NodeB, NB for short) in Wideband Code Division Multiple Access (WCDMA). It may also be an evolved base station (Evolutional Node B, eNB or eNodeB) in the Long Term Evolution (LTE), or a relay station or an access point, or a base station in a future 5G network, etc., which is not limited herein. .
  • a plurality means two or more.
  • "and/or” describing the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the character "/" generally indicates that the contextual object is an "or" relationship.
  • the interaction between the two MMEs may be omitted or belong to the internal interaction of the MME.
  • FIG. 1 is an interaction diagram of Embodiment 1 of an authorization verification method according to an embodiment of the present application.
  • the embodiment of the present application is described by the interaction between the mobility management entity of the relay device, the terminal device mobility management entity, and the relay device.
  • the authorization verification method provided by the embodiment of the present application may include the following step:
  • Step 101 The relay device receives a communication request sent by the remote device.
  • the communication request includes an identification of the remote device.
  • the communication request further includes one or more of the following: a non-access stratum message of the remote device, a relay service code, and a first random number.
  • the first random number is generated by the remote device and can be directly carried in the communication request.
  • the first random number may also be included in a non-access stratum message of the remote device instead of being directly carried in the communication request.
  • the remote device may be a wearable device (WD), and the remote device (WD) hopes to connect to the network through a relay device, so that the remote device needs to be allowed. Before the device accesses the network through the relay device, the device verifies the association relationship between the relay device and the remote device.
  • WD wearable device
  • the relay device and the remote device need to complete the following discovery process. Specifically, both the relay device and the remote device need to access the network for acquisition.
  • the configuration parameters of the discovery process so that the mutual discovery process between the remote device and the relay device is implemented according to the configuration parameters.
  • the remote device sends a communication request to the relay device, where the communication request needs to carry at least the identifier of the remote device.
  • the identity of the remote device can be directly included in the communication request.
  • the identifier of the remote device may also be encapsulated in the NAS message by the remote device.
  • the remote device included in the communication request The NAS message includes the identifier of the remote device.
  • the identity of the remote device may also be included in both the communication request and the NAS message of the remote device in the communication request. Therefore, the implementation of the communication request including the identifier of the remote device may be various, and is not limited by the embodiment of the present application.
  • the NAS message of the remote device carries the MAC-I check value
  • the MME for the remote device performs integrity protection according to the NAS security context of the remote device
  • the remote device The MME can authenticate the remote device by verifying the MAC-I of the NAS message.
  • the identifier of the remote device in the embodiment of the present application may include at least two different forms, where one form is suitable for authorization verification and the other form is suitable for relay.
  • the mobility management entity of the device searches for a mobility management entity of the remote device and context information for acquiring the remote device.
  • the remote device identifier in the communication request includes an identifier 1 for the mobility management entity of the relay device to find the mobility management entity of the remote device; and the remote device identifier in the communication request includes the identifier 2
  • the identifier 2 is used by the mobility management entity of the relay device or the mobility management entity of the remote device to perform authorization verification on the association relationship between the relay device and the remote device; and the remote device included in the NAS message of the remote device
  • the identifier includes the identifier 3, and the identifier 3 is used to obtain the context information of the remote device.
  • the identifier 1 and the identifier 3 may be the same identifier. The specific form of the identification of the remote device is not distinguished in this embodiment.
  • the identifier 1 and the identifier 3 may be a Globally Unique Temporary UE Identity (GUTI), or an International Mobile Subscriber Identity (IMSI), or a Temporary Mobile (Temporary Mobile) Subscriber Identity, TMSI for short.
  • GUI Globally Unique Temporary UE Identity
  • IMSI International Mobile Subscriber Identity
  • TMSI Temporary Mobile Subscriber Identity
  • the identifier 2 may be an identifier assigned by the close functional entity.
  • Step 102 The relay device generates a first request message according to the communication request.
  • the first request message includes: an identifier of the remote device.
  • the first request message is a non-access stratum (NAS) message between a relay device and a mobility management entity (MME).
  • NAS non-access stratum
  • MME mobility management entity
  • the relay device may encapsulate the relevant content of the communication request into its own first request message.
  • the relay device may also encapsulate the related content of the communication request into its own first request message, and integrate other related parameters required for verifying the association relationship between the remote device and the relay device.
  • the first request message may further include an identifier of the relay device.
  • the related content encapsulated in the first request message includes the identifier of the remote device in step 101, and may further include the NAS message of the remote device in step 101.
  • the communication request in step 101 further includes a relay service code or a first random number
  • the related content encapsulated into the first request message further includes the relay service code or the first random number.
  • the relay service code is used to identify the type of service to be requested by the remote device, and is used for verification of the association relationship between the remote device and the relay device.
  • the first random number is generated by the remote device and used for generating the subsequent key. For the specific generation method of the key, refer to the description in the subsequent step 502.
  • the carrying manner of the first random number may refer to the manner described in step 101.
  • Step 103 The relay device sends the first request message to the mobility management entity of the relay device.
  • the mobile device After the relay device generates the first request message according to the communication request, the mobile device manages the association with the remote device and the relay device according to the content of the first request message. The relationship is verified.
  • Step 104 The mobility management entity of the relay device receives the first request message.
  • Step 105 The mobility management entity of the relay device triggers verification of the association relationship between the remote device and the relay device according to the first request message.
  • any one of the following operations may be performed.
  • the first operation the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device according to the content in the first request message;
  • the second operation the mobility management entity of the relay device The content of a request message is sent to the mobile management entity or the short-range functional entity of the remote device, so that the mobile device management entity or the short-range functional entity of the remote device performs further security processing;
  • the third operation performing the first operation The content corresponding to the second operation.
  • the embodiment of the present application does not limit the execution order of the first operation and the second operation.
  • the mobility management entity that operates the relay device triggers the verification of the association between the remote device and the relay device according to the content of the first request message, and may be performed in the following step 105d.
  • the verification of the association relationship between the remote device and the relay device may use the information returned in the step of step 105c, such as the identifier IMSI of the remote device.
  • Step 106 After determining that the association relationship is verified, the mobility management entity of the relay device generates a first response message, and sends the first response message to the relay device.
  • the mobility management entity of the relay device determines that the association relationship is verified, and specifically includes at least one of the following: the mobility management entity of the relay device determines the remote device and the relay device by itself. The relationship between the remote device and the relay device is verified by the mobile management entity of the remote device, and the relationship between the remote device and the relay device is verified.
  • the relay device when the association between the remote device and the relay device is verified, only the relay device is required. If the mobile management entity of the standby device, the mobile management entity of the remote device, or the short-range functional entity authenticates, and the association relationship is verified, a first response message is generated, and the first response message is fed back to the relay. device.
  • the association verification of the remote device and the relay device requires any two or three verifications in the mobility management entity of the relay device, the mobility management entity of the remote device, or the proximity functional entity.
  • the association verification is passed.
  • the mobility management entity of the relay device generates a first response message and feeds back to the relay device.
  • Step 107 The relay device receives the first response message.
  • the first response message may carry a key for protecting communication security between the remote device and the relay device, and generate a key.
  • Required security parameters when the association between the remote device and the relay device is verified, the first response message may carry a key for protecting communication security between the remote device and the relay device, and generate a key.
  • the MME the MME of the relay device or the MME of the remote device
  • the first response message may include parameters such as the cause of the failure.
  • Step 108 The relay device sends a communication response to the remote device according to the first response message.
  • the relay device sends a communication response to the result of the association verification between the remote device and the relay device according to the received first response message, and the communication response is used as a result of the communication request.
  • the first response message carries a key for protecting communication security between the remote device and the relay device and a security parameter required for generating the key
  • the communication response includes security required to generate the key. The parameters are such that the remote device also generates a key for securing communication between the remote device and the relay device.
  • the remote device When the communication response characterizes the verification relationship, and the remote device generates a protection device for the remote device and When the relay device communicates a secure key, the remote device can connect to the network through the relay device.
  • the foregoing step 105 may be implemented by using the step 105a.
  • the authorization verification method of the embodiment of the present application further includes steps 105b to 105d.
  • Step 105a The mobility management entity of the relay device sends a second request message to the mobility management entity of the remote device.
  • the second request message includes: an identifier of the remote device.
  • the mobile management entity of the remote device when the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device, the mobile management entity of the remote device may also be configured according to the identifier of the remote device in the first request message.
  • the second request message is sent, so that the mobile management entity of the remote device performs security processing on the remote device according to the second request message or performs further verification processing on the association relationship between the remote device and the relay device.
  • the second request message further includes: an identifier of the relay device.
  • the identifier of the relay device and the identifier of the remote device are used by the MME of the remote device to perform authorization verification on the association relationship between the relay device and the remote device.
  • the identifier of the relay device in the second request message may be obtained by using any one of the following manners: First, the mobility management entity of the relay device may be configured from the relay device context information stored therein Obtaining, and then encapsulating it into the second request message; second, when the identifier of the relay device is included in the first request message, the mobility management entity of the relay device may also obtain the first request message that is reported.
  • the specific manner of obtaining the identifier of the relay device is not specifically limited in the embodiment of the present application.
  • the second request message further includes: a NAS message of the remote device acquired from the first request message.
  • the second request message further includes a first random number generated by the remote device. The content of the NAS message and the carrying manner of the first random number may refer to the method in step 101.
  • the first request message includes an identifier of the remote device, where the identifier of the remote device is used by the MME of the relay device to find the MME of the remote device, and specifically, the MME of the relay device is configured according to the remote device.
  • the identity determines the MME of the remote device, and in turn sends a second request message to it.
  • the identifier of the remote device refer to the description in step 101, and details are not described herein again.
  • Step 105b The mobility management entity of the remote device receives the second request message, and performs security processing on the remote device according to the second request message.
  • the security process may include integrity verification of the NAS message of the remote device.
  • NAS non-access stratum
  • the security process may also include verifying the association relationship between the remote device and the relay device according to the identifier of the relay device in the second request message and/or the identifier of the remote device.
  • the MME of the remote device may further obtain the non-access stratum context information of the remote device according to the identifier of the remote device in the second request message, and generate the information for protecting the remote end according to the non-access stratum context information.
  • the identifier may be a GUTI, or a TMSI, or an IMSI.
  • the MME of the remote device can be directly obtained from the second request message or obtained from the NAS message of the remote device carried in the second request message.
  • the MME of the remote device sends a key request message to the security function entity to obtain communication security for protecting the remote device and the relay device.
  • the key and the security parameters required to generate the key are the following parameters:
  • the (first) key generated by the MME of the remote device may be directly used as a PC5 port communication key for communication protection of the PC5 port, that is, the Relay according to the received (first) key.
  • the WD Directly protecting the communication response (eg, integrity protection), correspondingly, the WD also generates a (first) key, ie, a PC5 port communication key, according to the received security parameters required to generate the key, and then The communication response message performs security verification (eg, integrity verification).
  • the PC5 port communication key may also be a (second) key further generated by the Relay according to the (first) key generated by the MME of the remote device in step 105c, that is, the Relay is received according to the a)
  • the key generation (second) key as a PC5 port communication key, provides security protection (eg, integrity protection) for the communication response, and accordingly, the WD selects the security parameters required to generate the key.
  • the (second) key is generated according to the (first) key
  • the (second) key is the PC5 port communication key, and then the communication response message is securely verified (eg, , integrity verification).
  • Step 105c The second response message sent by the mobility management entity of the remote device to the mobility management entity of the relay device after performing security processing on the remote device.
  • the remote management device After the remote management device performs security processing on the remote device according to the content of the second request message, the remote device generates a second response message according to the result of the security process, and feeds the second response message to the mobility management entity of the relay device. .
  • the second response message includes a key and security required to generate the key. parameter.
  • the key received by the mobility management entity of the relay device and the security parameter required to generate the key are equivalent to a representation of the content of the second response message.
  • the second response message may include a non-access stratum message generated by a mobility management entity of the remote device.
  • the non-access stratum message in the second response message is integrity-protected by using the NAS security context of the remote device, and sent to the relay device by the mobility management entity of the relay device, and then sent to the remote device.
  • the remote device is authenticated by integrity verification of the non-access stratum message.
  • the key generation parameter may be included in the non-access stratum message.
  • Step 105d The mobility management entity of the relay device receives the second response message.
  • the relay device receives the communication request sent by the remote device, where the communication request includes the identifier of the terminal device, and generates a first request message and sends the first request message according to the communication request. And to the mobility management entity of the relay device, the mobility management entity of the relay device receives the first request message, and triggers verification of the association relationship between the remote device and the relay device, and sends the first to the mobile management entity of the remote device.
  • the second request message the mobile management entity of the remote device receives the second request message, performs security processing on the remote device according to the second request message, and moves to the relay device after performing security processing on the remote device.
  • the mobile management entity of the relay device receives the second response message, and after determining that the association relationship is verified, generates a first response message, and sends the first response message to the relay device, and the relay device according to the The first response message sends a communication response to the remote device.
  • the technical solution of the present application designs a set of relationship verification schemes between the remote device and the relay device for the layer 2 relay device, which avoids the complicated and cumbersome parameter configuration process required in the existing layer 3 relay solution. And the authorization checking process, so that the layer 2 solution of the present application reduces network configuration requirements, reduces network overhead, and improves verification efficiency compared with the existing layer 3 solution.
  • FIG. 2 is a flowchart of Embodiment 2 of the authorization verification method provided by the embodiment of the present application.
  • the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device according to the first request message.
  • step 105 the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device according to the first request message.
  • Step 201 The mobility management entity of the relay device acquires the first authorization information according to the first request message.
  • the mobility management entity of the relay device itself verifies the association relationship between the remote device and the relay device, it needs to first obtain the context of the relay device, and obtain the remote end with the authorized relationship with the relay device from the context.
  • the device list that is, the first authorization information.
  • the mobility management entity of the relay device acquires the first authorization information from the user data management entity and/or the short-range functional entity according to the identifier of the relay device. .
  • the user authorization information and/or the close-range functional entity in the network store the first authorization information related to the remote device.
  • the mobility management entity of the relay device directly from the user data management entity (for example, a Home Subscriber Server (HSS), or The user data management entity (UDM) in the 5G system acquires the first authorization information.
  • HSS Home Subscriber Server
  • UDM user data management entity
  • the manner in which the mobility management entity of the relay device obtains the first authorization information from the short-range functional entity may be: when the mobility management entity of the relay device can directly communicate with the short-range functional entity, that is, there is a direct The interface, the mobility management entity of the relay device directly obtains the foregoing first authorization information from the short-range functional entity; and when the mobility management entity of the relay device cannot directly communicate with the short-range functional entity, that is, there is no direct interface between the two, Then, the short-range functional entity sends the foregoing first authorization information to the mobility management entity of the relay device through the HSS.
  • Step 202 The mobility management entity of the relay device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, and the first authorization information.
  • the mobility management entity of the relay device Before the association relationship is verified, the mobility management entity of the relay device first acquires the identity of the relay device. For details about how to obtain the identifier of the relay device, refer to the description in step 105a above. That is, the mobility management entity of the relay device may be obtained from the internal storage list or the mobile management entity of the relay device is obtained from the reported first request message, and details are not described herein again.
  • the mobility management entity of the relay device learns the identifier of the remote device, the identifier of the relay device, and the first authorization information, determining whether the first authorization information includes the association relationship between the relay device and the remote device, when the first When the authorization information includes the association relationship between the relay device and the remote device, the remote device is allowed to access the network through the relay device. Otherwise, the remote device is not allowed to access the network through the relay device.
  • the first authorization when the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device according to the first request message, the first authorization may be obtained according to the first request message.
  • the information, according to the identifier of the remote device, the identifier of the relay device, and the first authorization information, is used to verify whether the remote device is allowed to access the network through the relay device. This method of verifying the relationship is simple and easy to implement.
  • the foregoing step 105 may be implemented by using the following possible implementations, as follows:
  • the mobility management entity of the relay device obtains the first authorization information according to the first request message, and verifies whether the remote device is allowed to pass according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the first authorization information.
  • the relay device accesses the network.
  • the first authorization information is a relationship list of the remote device having the authorization relationship with the relay device and the corresponding relay service code.
  • the first request message generated by the relay device integration also includes a relay service code, where the relay service code is used to represent the remote device.
  • the service type to be requested, the different relay service codes correspond to different service types. Therefore, in this embodiment, when the mobility management entity of the relay device verifies the association relationship between the remote device and the relay device, Service code. Specifically, the mobility management entity of the relay device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the first authorization information.
  • this step is a further definition of the embodiment shown in Figure 2, except that the decision condition adds a relay service code.
  • the method for obtaining the first authorization information refer to the description in step 201.
  • the method for obtaining the identifier of the relay device refer to the description in step 105a, and details are not described herein again.
  • the authorization verification method provided by the embodiment of the present application further includes the following steps.
  • the mobility management entity of the relay device sends a third request message to the short-range functional entity, so that the short-range functional entity verifies whether the remote device is allowed to access the network through the relay device according to the third request message.
  • the third request message includes: an identifier of the remote device, and an identifier of the relay device.
  • the mobile management entity of the terminal device triggers the implementation of the association verification of the remote device and the relay device, except that the mobile management entity of the relay device can perform self-authentication and mobile management to the remote device.
  • the entity sends a second request message to enable the mobile management entity of the remote device to verify, and the mobility management entity of the relay device may also send a third request message to the short-range functional entity to enable the proximity functional entity to perform verification.
  • the third request message includes at least an identifier of the remote device and an identifier of the relay device.
  • the identifier of the remote device and the identifier of the relay device in the third request message may be obtained from the reported first request message.
  • the relay service code is included in the communication request, the first service request message, the second request message, and the third request message may include a relay service code.
  • the relay service code is used to identify the service type to be requested by the remote device, and participates in the verification of the association relationship between the remote device and the relay device.
  • FIG. 3 is a flowchart of Embodiment 3 of the authorization verification method according to the embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application further includes the following steps:
  • Step 301 The mobility management entity of the relay device sends a key request message to the security function entity, so that the security function entity obtains a key for protecting communication security between the remote device and the relay device according to the key request message. And the security parameters required to generate the key, and feedback the key and the security parameters required to generate the key to the mobile management entity of the relay device.
  • the key request message includes: an identifier of the remote device.
  • Step 302 The mobility management entity of the relay device sends the key and the security parameters required to generate the key to the relay device.
  • the mobile management entity of the relay device passes the verification of the association relationship between the remote device and the relay device, but relays
  • the second response message received by the mobility management entity of the device does not carry a key for protecting communication security between the remote device and the relay device, and a security parameter required for generating the key
  • the mobility management entity of the relay device Sending a key request message to the security function entity, the security function entity searches for and obtains a key for protecting communication security between the remote device and the relay device according to the identifier of the remote device in the key request message, and generates the key
  • the security parameters required by the key, and the security parameters required to generate the key and generate the key are fed back to the mobility management entity of the relay device, and finally the mobility management entity of the relay device then generates the key and generates the key.
  • the required security parameters are fed back to the relay device, so that the relay device processes the key and security parameters accordingly.
  • the relay device It is also possible to obtain a key for protecting the communication security between the remote device and the relay device and a security parameter required for generating the key, thereby ensuring that the remote device can access the network through the relay device.
  • FIG. 4 is a flowchart of Embodiment 4 of the authorization verification method according to the embodiment of the present application.
  • the foregoing step 105b the mobile management entity of the remote device receives the second request message, and performs security processing on the remote device according to the second request message
  • the following steps are included:
  • Step 401 The mobility management entity of the remote device acquires second authorization information according to the second request message.
  • the remote management device acquires the second authorization information from the user data management entity and/or the short-range functional entity according to the identifier of the remote device.
  • This step is similar to the foregoing step 201.
  • the step 201 is used to obtain a remote device list that has an authorization relationship with the relay device, that is, the first authorization information
  • the step is used to obtain an authorization relationship with the remote device.
  • a list of relay devices that is, second authorization information.
  • the second authorization information related to the relay device of the remote device is stored in the user data management entity and/or the close-range functional entity in the network.
  • the mobile management entity of the remote device directly obtains the second authorization information from the user data management entity.
  • the manner in which the second authorization information is obtained from the short-range functional entity may be: when there is a direct interface between the mobile management entity of the remote device and the short-range functional entity, the mobile management entity of the remote device directly functions from the short-range function. The entity obtains the foregoing second authorization information; and when there is no direct interface between the mobile management entity of the remote device and the short-range functional entity, the mobile management entity of the remote device acquires the first entity from the short-range functional entity through the HSS. Second authorization information.
  • Step 402 The mobility management entity of the remote device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, and the second authorization information.
  • the mobility management entity of the remote device verifies the association relationship between the remote device and the relay device, the mobility management entity of the remote device according to the identifier of the remote device, the identifier of the relay device, and the acquired
  • the second authorization information determines whether the second authorization information includes an association relationship between the remote device and the relay device.
  • the remote device is allowed to access the network through the relay device. Otherwise, the remote device is not allowed to access the network through the relay device.
  • the foregoing step 105b the mobile management entity of the remote device receives the second request message, and performs security processing on the remote device according to the second request message.
  • the mobility management entity of the remote device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the second authorization information.
  • the second authorization information is a relationship list of the relay device having an authorized relationship with the remote device and the corresponding relay service code.
  • This step is a further description of the foregoing step 402.
  • the determining condition increases the relay service code, that is, the service type of the remote device requesting the service is increased, and the specific determining mode and the mobile device managing the remote device are based on the remote device.
  • the manner of verifying the association between the remote device and the relay device is similar to that of the identifier, the identifier of the relay device, the relay service code, and the first authorization information, and is not described here.
  • step 105b further includes the following steps:
  • Step 403 The mobility management entity of the remote device acquires the non-access stratum context information of the remote device according to the identifier of the remote device in the second request message, and performs non-connection to the remote device according to the non-access stratum context information. The checksum of the incoming message is verified.
  • the second request message includes: a non-access stratum message of the remote device, and a check code of the non-access stratum message.
  • the second request message when the first request message further includes: a non-access stratum message of the remote device, and a check code of the non-access stratum message, the second request message also includes: non-access of the remote device Layer message, check code of non-access stratum message.
  • the mobility management entity of the remote device may also verify the non-access stratum message of the remote device, specifically, the non-access stratum message of the remote device according to the non-access stratum context information of the remote device. The check code is verified.
  • steps 401, 402, and 403 are all optional methods for the remote device to perform security processing on the remote device, that is, in an embodiment, the remote end
  • the mobile management entity of the device may perform one or more of step 401, step 402, and step 403, and the embodiment of the present application does not limit the execution order of each step when performing multiple steps.
  • the mobility management entity of the remote device not only acquires the second authorization information according to the second request message, but also according to the identifier of the remote device when the second request message further includes the relay service code.
  • the identifier of the relay device, the relay service code, and the second authorization information are used to verify whether the remote device is allowed to access the network through the relay device.
  • the remote device is obtained according to the identifier of the remote device in the second request message.
  • FIG. 5 is a flowchart of Embodiment 5 of the authorization verification method according to the embodiment of the present application. As shown in FIG. 5, in the authorization verification method provided by the embodiment of the present application, the method further includes:
  • Step 501 The mobility management entity of the remote device acquires non-access stratum context information of the remote device according to the identifier of the remote device in the second request message.
  • the mobility management entity of the remote device acquires the non-access stratum context message of the remote device according to the identifier of the remote device that needs to communicate.
  • the access layer context message stores the security parameters required to generate the key.
  • Step 502 The mobility management entity of the remote device generates a key for protecting communication security between the remote device and the relay device according to the non-access stratum context information.
  • the mobility management entity of the remote device may generate a key for protecting communication security between the remote device and the relay device according to the non-access layer context information.
  • the mobility management entity of the remote device uses the first random number as an input parameter for generating the key.
  • the first random number is generated by the remote device.
  • the mobility management entity of the remote device uses the second random number as an input parameter for generating the key.
  • the first random number is encapsulated in a mobile management entity that is sent by the remote device to the relay device along with the communication request, and then encapsulated into the first request message by the relay device and sent to the relay device, and finally sent by the The mobile management entity of the device sends the second request message to the mobile management entity of the remote device.
  • the mobility management entity of the remote device acquires the security context of the remote device NAS message according to the identifier of the remote device, and then generates a security for protecting the communication between the remote device and the relay device based on the security context of the NAS message.
  • the key ie, the key generation parameter, is a parameter in the security context of the remote device NAS message.
  • the security parameter required to generate the key may be the key Kasme in the security context of the remote device NAS message.
  • the security parameters required to generate the key may also include other parameters, such as a second random number generated by the MME-WD, and/or a first random number generated by the WD.
  • Step 503 The mobility management entity of the remote device sends the key and the security parameter required to generate the key to the mobility management entity of the relay device.
  • the security of the communication between the remote device and the relay device is generated in the mobility management entity of the remote device.
  • the key, the key and the security parameters required to generate the key need to be sent to the mobility management entity of the relay device, and then sent to the relay device.
  • the first random number is generated by the remote device, and the security parameter required to generate the key is mainly included in the second embodiment.
  • a random number, and the second random number is encapsulated in a non-access stratum message of a mobility management entity of the remote device.
  • a corresponding receiving operation needs to be performed. Refer specifically to the content shown in step 504.
  • Step 504 The mobility management entity of the relay device receives the key sent by the mobility management entity of the remote device and the security parameter required to generate the key.
  • the key received by the mobility management entity of the relay device and the security parameter required to generate the key are equivalent to a representation of the content of the second response message.
  • the second response message may include a non-access stratum message generated by a mobility management entity of the remote device.
  • the non-access stratum message in the second response message is integrity-protected by using the NAS security context of the remote device, and sent to the relay device by the mobility management entity of the relay device, and then sent to the remote device.
  • the remote device is authenticated by integrity verification of the non-access stratum message.
  • the key generation parameter may be included in the non-access stratum message.
  • Step 505 The mobility management entity of the relay device sends the key and the security parameters required to generate the key to the relay device.
  • the remote device wants to access the network through the relay device.
  • the remote device and the relay device need to have a key for protecting communication between the two. Therefore, the mobility management entity of the relay device needs to receive the received secret.
  • the key and the security parameters required to generate the key are sent to the relay device such that the relay device holds the key and the required security parameters to generate the key.
  • Step 506 The relay device receives a key used to protect communication security between the remote device and the relay device and a security parameter required to generate the key.
  • step 108 can be replaced by step 507:
  • Step 507 The relay device sends the security parameter to the remote device through the communication response, so that the remote device generates a key for protecting communication security between the remote device and the relay device according to the security parameter.
  • the relay device After receiving the key and the security parameters required to generate the key, the relay device saves the key by itself, and sends the security parameter required to generate the key to the remote device in the form of a communication response, so that the remote device
  • the device can generate a key for protecting the communication security between the remote device and the relay device according to the security parameter. If the key on the remote device side is the same as the key on the relay device, the authentication and authorization check between the remote device and the relay device is successful.
  • the remote device can send data to the network through the relay device.
  • the mobility management entity of the remote device generates a key for protecting communication security between the remote device and the relay device according to the identifier of the remote device in the second request message, and
  • the key and the security parameter required to generate the key are sent to the mobility management entity of the relay device, and the mobility management entity of the relay device sends the received key and the security parameters required to generate the key to the relay device.
  • the relay device sends the security parameters to the remote device through the communication response.
  • the remote device generates a key for protecting communication security between the remote device and the relay device according to the security parameter, so that the remote device can be protected by using a key when accessing the network through the relay device.
  • Short-range communication is safe and safe.
  • the mobility management entity of the remote device when the mobility management entity of the relay device, the mobility management entity of the remote device, or the short-range functional entity verifies the association relationship between the remote device and the relay device, However, the mobility management entity of the remote device does not perform the operation of generating a key in step 502, that is, the NAS message of the remote device is not carried in the communication request sent by the remote device to the relay device, or the remote device sends
  • the communication request to the relay device carries the NAS message of the remote device but the integrity check of the NAS message fails, or the NAS message carrying the remote device in the communication request sent by the remote device to the relay device has no integrity protection.
  • the mobile management entity of the remote device can also perform the following operations:
  • the mobility management entity of the remote device sends a key request message to the security function entity, so that the security function entity obtains a key for protecting communication security between the remote device and the relay device according to the key request message, and generates the secret.
  • the security parameters required by the key are fed back to the mobile management entity of the remote device.
  • the key request message includes: a remote device identifier.
  • the mobility management entity of the relay device in the embodiment shown in FIG. 3 sends a key request message to the security function entity to obtain a key for securing communication security between the remote device and the relay device and a key generation method.
  • the steps of the required security parameters are similar and will not be described here.
  • the remote device is a wearable device (WD), a relay device (Relay), a mobile device management entity (MME-WD) of the remote device, a mobility management entity (MME-relay) of the relay device, and a base station (eNB). ), Home Subscriber Server (HSS) and ProSe Function (PF) are described.
  • WD wearable device
  • Relay relay device
  • MME-WD mobile device management entity
  • MME-relay mobility management entity
  • eNB base station
  • HSS Home Subscriber Server
  • PF ProSe Function
  • FIG. 6 is an interaction diagram of Embodiment 6 of the authorization verification method according to the embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application includes:
  • Step 601 WD and Relay are successfully registered to the network.
  • Step 602 The WD sends a communication request to the Relay.
  • the communication request includes the NAS message of the remote device.
  • the communication request includes the NAS message of the remote device.
  • Step 603 The Relay generates a first request message, and sends the first request message to the MME-relay.
  • the Relay encapsulates the content of the WD communication request into its own NAS message, that is, generates the first request message.
  • the first request message is a NAS message between a relay device and a mobility management entity (MME).
  • MME mobility management entity
  • Step 604 The MME-relay verifies the association relationship between the Relay and the WD according to the first request message.
  • any one or more of the following operations may be performed.
  • the first operation the MME-relay triggers the verification of the association relationship between the Relay and the WD according to the content in the first request message;
  • the second operation the MME-relay sends the content in the first request message to the MME-WD or PF.
  • a third operation performing the first operation and the content corresponding to the second operation.
  • Step 605 The MME-relay sends a second request message to the MME-WD.
  • step 105a For the content of the second request message, refer to the description of step 105a in the embodiment shown in FIG. 1, and details are not described herein again.
  • the MME-relay may find the corresponding MME-WD according to the WD ID carried in the first request message.
  • Step 606 The MME-WD verifies the integrity of the second request message, and verifies the association relationship between the Relay and the WD, and generates a key.
  • the MME-WD may perform one or more of the following operations: verifying the integrity of the second request message, verifying the association relationship between the Relay and the WD, and generating a key.
  • This key is a key used to secure communication between the remote device and the relay device.
  • the key may be a PC5 port communication key, and the security parameters required for generating the key include: a first random number (optional), a second random number generated by the MME-WD (optional), and a basic secret.
  • a key eg, Kasme
  • a relay service code optionally, the second random number encapsulation is finally returned to the WD in the second NAS message.
  • Step 607 The MME-WD returns the key and the security parameters required to generate the key to the MME-relay.
  • the MME-WD when the MME-WD generates a key for protecting communication security between the remote device and the relay device, the MME-WD returns it to the MME-relay. Or, when the MME-WD verifies the association between the Relay and the WD, the verified result is fed back to the MME-relay.
  • the security parameter required to generate the key mainly refers to a second random number generated by the mobility management entity of the remote device.
  • the MME-WD encapsulates the second random number in its own NAS message and sends it to the MME-relay.
  • Step 608 The MME-relay returns the key and the security parameter required to generate the key to the relay through the first response message.
  • Step 609 The relay receives the key and the security parameter required to generate the key, and sends the security parameter required to generate the key to the WD through the communication response.
  • the relay When the relay receives the key (for example, the PC5 communication key) and the security parameters required to generate the key, it indicates that the authentication and authorization of the WD and the relay are passed, and the WD can perform the service through the relay.
  • the key for example, the PC5 communication key
  • Step 610 The WD performs integrity verification on the communication response, and generates a key according to the security parameter required to generate the key.
  • the communication response includes a second NAS message generated by the mobility management entity of the remote device, and specifically, the WD performs integrity verification on the second NAS message in the communication response.
  • the (first) key generated by the MME-WD can be directly used as a PC5 port communication key for communication protection of the PC5 port, that is, the Relay directly directly according to the received (first) key.
  • the communication response is secured (eg, integrity protection), and accordingly, the WD also generates a (first) key, ie, a PC5 port communication key, based on the received security parameters required to generate the key, and then responds to the communication.
  • the message is verified for security (eg, integrity verification).
  • the PC5 port communication key may also be a (second) key that is further generated by the Relay according to the (first) key generated by the MME-WD in step 606, that is, the Relay according to the received (first)
  • the key generation (second) key secures the communication response (eg, integrity protection), and accordingly, the WD generates according to the received security parameters required to generate the key ( After the first key, the (second) key is generated according to the (first) key, and the (second) key is the PC5 port communication key, and then the communication response message is securely verified (eg, complete) Sexual verification).
  • association relationship between the remote device and the relay device may be expressed in the form of a buddy list or a service type:
  • Service type For example, WD ID: (relay service code1: service1-1, service1-2, ...); (relay service code2: service2-1, service2-2, ...);
  • authorization verification method of this application may also need to pay attention to the following points:
  • the first: the relationship verification in step 604 and step 606 may only need to be performed one or both.
  • the second: a key for protecting communication security between the remote device and the relay device is optional, ie, the key may not need to be generated in step 606.
  • the first random number and the second random number do not need to be generated and delivered.
  • the NAS message of the remote device and the NAS message of the MME-WD still need to be transmitted, and the role is to check the NAS message of the remote device. Integrity to complete the security certification between WD and relay.
  • the interaction between the WD and the MME-WD may not need to be encapsulated in the NAS message. That is, the first random number and the WD ID do not need to be encapsulated in the NAS message of the remote device, and the second random number does not need to be encapsulated in the NAS message of the MME-WD.
  • step 604 if the WD ID is not included in the NAS message of the remote device in the communication request, then in step 604 and step 605, the first request message and the NAS message of the remote device in the second request The WD ID is also not included. At this time, in step 605, the WD ID is used as a cell of the communication request.
  • FIG. 7 is an interaction diagram of Embodiment 7 of an authorization verification method according to an embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application is similar to the embodiment shown in FIG. 6, except that the PF can also perform authorization verification.
  • step 604 in FIG. 6 above may be replaced by steps 701-703, and step 606 is replaced by step 704.
  • Step 701 The MME-relay sends a third request message to the PF according to the first request message.
  • the third request message includes: an identifier of the remote device, and an identifier of the relay device.
  • the third service message further includes a relay service code.
  • Step 702 The PF verifies the association relationship between the Relay and the WD, and generates a third response message.
  • the PF verifies the association relationship between the Relay and the WD according to the third request message.
  • the user authorization information and/or the short-range functional entity in the network store the first authorization information related to the remote device and the second authorization information related to the remote device.
  • the PF verifies the association relationship between the relay device and the remote device according to the identifier of the remote device and the identifier of the relay device.
  • Step 703 The PF feeds back a third response message to the MME-relay.
  • This third response message is the result of PF verification.
  • Step 704 The MME-WD verifies the integrity of the second request message, and generates a key for protecting communication security between the remote device and the relay device and a security parameter required for generating the key.
  • step 501 and step 502 For the method for the MME-WD to verify the integrity of the second request message and the method for generating the key, refer to the description in step 501 and step 502 in the embodiment shown in FIG. 5, and details are not described herein again.
  • Relay APP ID The WD1 app ID (identity of the first remote device client), WD2 app ID, ....
  • FIG. 8 is a flowchart of Embodiment 8 of the authorization verification method provided by the embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application includes:
  • Step 801 The network side device receives the first request message sent by the relay device.
  • the first request message includes: an identifier of the remote device.
  • Step 802 The network side device triggers verification of the association relationship between the remote device and the relay device according to the first request message.
  • Step 803 After determining that the association relationship is verified, the network side device sends a first response message to the relay device.
  • the mobility management entity and the relay device of the remote device may be The mobility management entity is referred to as a network side device, that is, in this embodiment.
  • the network side device may be implemented by any one of a mobility management entity of the remote device and a mobility management entity of the relay device.
  • the network side device may also be implemented by a short-range functional entity.
  • the mobility management entity of the relay device triggers the verification of the association relationship between the remote device and the relay device according to the first request message sent by the received relay device.
  • the verification of the association between the remote device and the relay device by the mobility management entity of the remote device refer to the descriptions of steps 105a to 105d in the embodiment shown in FIG. 1 , and the implementation principle thereof is described in steps 101 to 106 .
  • the technical solution is similar to the implementation of the mobility management entity of the remote device and the mobility management entity of the relay device in the embodiment shown in FIG. 1 , and details are not described herein again.
  • the verification of the association between the remote device and the relay device by the short-range functional entity is similar to the verification method of the mobile device and the remote device of the relay device, and is not described here.
  • FIG. 9 is a flowchart of Embodiment 9 of the authorization verification method according to the embodiment of the present application.
  • the foregoing step 802 (the network side device triggers the verification of the association relationship between the remote device and the relay device according to the first request message) includes:
  • Step 901 The network side device acquires the first authorization information according to the first request message.
  • the network side device acquires the first authorization information from the user data management entity and/or the short-range functional entity according to the first request message.
  • the network side device when the network side device is a mobility management entity of the relay device, the network side device manages the entity and/or from the user data according to the identifier of the relay device after the relay device successfully registers with the network.
  • the short-range functional entity obtains the first authorization information.
  • the first authorization information refers to the authorization information of the relay device.
  • the specific method for obtaining the authorization information of the relay device refer to the description in step 201, and details are not described herein again.
  • the network side device when the network side device is a mobile management entity of the remote device, the network side device obtains the remote data device from the user data management entity and/or according to the identifier of the remote device. Or the short-range functional entity obtains the first authorization information.
  • the first authorization information refers to the authorization information of the remote device.
  • the specific method for obtaining the authorization information of the remote device refer to the description in step 401, and details are not described herein again.
  • the network side device when the network side device is a short-range functional entity, the network-side device, after the remote device and the relay device are successfully registered to the network, according to the identifier of the relay device and the identifier of the remote device.
  • the first authorization information is obtained from the user data management entity and/or the short-range functional entity, and the first authorization information includes the authorization information of the remote device and the authorization information of the relay device.
  • Step 902 The network side device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, and the first authorization information.
  • the relay device in the embodiment shown in FIG. 2 verifies whether the remote device is allowed to access the network through the relay device, or whether the remote device in the embodiment shown in FIG.
  • the technical solutions of the remote device accessing the network through the relay device are similar. For details, refer to the description in the embodiment shown in FIG. 2 and FIG. 4, and details are not described herein again.
  • the foregoing step 802 (the network side device triggers verification of the association relationship between the remote device and the relay device according to the first request message) is replaceable. For the following steps:
  • the network side device verifies whether the remote device is allowed to access the network through the relay device according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the first authorization information.
  • the specific implementation of the step is as described in step 202.
  • the network side device is the mobile device management entity of the remote device
  • the specific implementation of the step is implemented.
  • the scheme refer to the description in step 402.
  • the verification method of the short-range functional entity is similar.
  • details refer to the description in the embodiment shown in FIG. 2 and FIG. 4, and details are not described herein again.
  • the foregoing step 802 (the network side device triggers the verification of the association between the remote device and the relay device according to the first request message) may include the following steps:
  • the network side device sends a second request message to the first mobility management entity, so that the first mobility management entity verifies whether the remote device is allowed to access the network through the relay device according to the second request message.
  • the first mobility management entity when the network side device is implemented in different manners, the first mobility management entity is also different, and the multiple possible combinations are as follows:
  • the first mode when the network side device is a mobility management entity of the relay device, the first mobility management entity is a mobile functional entity of the short-range functional entity or the remote device; or
  • the second mode when the network side device is a mobile management entity of the remote device, the first mobile tube
  • the physical entity is a mobile management entity of a short-range functional entity or a relay device;
  • the second mode when the network side device is a short-range functional entity, the first mobility management entity is a mobility management entity of the remote device or a mobility management entity of the relay device.
  • This step is a scheme when the association between the remote device and the relay device is verified at any two of the mobility management entity of the relay device, the mobility management entity of the remote device, or the proximity functional entity, and each verification operation is performed.
  • the specific verification method refer to the description in the embodiment shown in FIG. 9 , and details are not described herein again.
  • the second The request message when the first request message includes the non-access stratum message of the remote device and the check code of the non-access stratum message, the second The request message also includes: a non-access stratum message of the remote device, and a check code of the non-access stratum message.
  • step 802 the network side device triggers the verification of the association relationship between the remote device and the relay device according to the first request message, including:
  • the network side device sends a second request message to the mobile management entity of the remote device, so that the mobile management entity of the remote device performs security processing on the remote device according to the second request message.
  • the network side device is a mobile management entity of the relay device, or the network side device is a short-range functional entity.
  • the mobility management entity or the short-range functional entity of the relay device When the network side device is any one of a mobility management entity or a short-range functional entity of the relay device, the mobility management entity or the short-range functional entity of the relay device further sends a second request message to the mobility management entity of the remote device, Therefore, the mobility management entity of the remote device performs security processing on the remote device according to the second request message.
  • the security processing of the remote device refer to the description in steps 105a to 105d in the embodiment shown in FIG. 1 , and details are not described herein again.
  • the foregoing step 801 (the network side device receives the relay device)
  • the first request message sent) is implemented by the following possible implementations:
  • the network side device receives the first request message that is processed by the relay device by the base station, and the first request message further includes: an identifier of the relay device.
  • the relay device may also send the first request message to the base station, and the base station selects the mobile management entity of the corresponding remote device, and reports the identifier of the remote device by using the initial remote device information. Following the identification of the device and other related content.
  • the network side device is a mobile management entity of the remote device
  • the first request message includes the remote device
  • the foregoing step 802 the network side device triggers the verification of the association relationship between the remote device and the relay device according to the first request message
  • the network side device obtains the non-access stratum context information of the remote device according to the identifier of the remote device, and verifies the check code of the non-access stratum message according to the non-access stratum context information.
  • the mobility management entity of the remote device and the remote device agree to have a complete set of integrity protection keys and a set of NAS algorithms, NAS message calculators (upstream and downlink), and the mobility management entity of the remote device will complete the integrity.
  • the protection key, the value of the NAS message calculator, the NAS message itself, etc. are input to the NAS algorithm, which generates a check value (mac-integrity) that is placed at the end of the NAS message.
  • the remote device also performs the operation of the above NAS algorithm, and also generates a check value, and the remote device compares the two check values. If the two are consistent, the integrity check passes, otherwise it indicates The integrity check failed.
  • the short-range functional entity and the mobile management entity of the remote device are capable of generating a key for protecting communication security between the remote device and the relay device according to the identifier of the remote device
  • the network-side device For the mobility management entity of the relay device the mobility management entity of the short-range functional entity and the remote device is configured as a first mobility management entity
  • the authorization verification method provided by the embodiment of the present application further includes the following steps.
  • FIG. 10 is a flowchart of Embodiment 10 of an authorization verification method according to an embodiment of the present application. As shown in FIG. 10, the authorization verification method provided by the embodiment of the present application further includes:
  • Step 1001 The network side device sends a second request message to the first mobility management entity.
  • Step 1002 The first mobility management entity acquires non-access stratum context information of the remote device according to the identifier of the remote device in the second request message, and generates, according to the non-access stratum context information, the A key for secure communication between relay devices.
  • Step 1003 The first mobility management entity feeds back the key and security parameters required to generate the key to the network side device.
  • Step 1004 The network side device sends the received key and security parameters required to generate the key to the relay device.
  • Step 1005 The relay device returns the security parameters required to generate the key to the remote device.
  • Step 1006 The remote device generates the key for protecting communication security between the remote device and the relay device according to the received security parameter.
  • the authorization verification method provided in this embodiment is to generate a key for protecting the communication security between the remote device and the relay device by using the first mobility management entity (the mobile functional entity of the short-range functional entity or the remote device),
  • the implementation principle and the beneficial effects are similar to those of the embodiment shown in FIG. 5 .
  • the embodiment shown in FIG. 5 and details are not described herein again.
  • the method for generating a key may be performed by itself, as follows:
  • the network side device obtains the non-access stratum context information of the remote device according to the identifier of the remote device, and generates a key for protecting the communication security between the remote device and the relay device according to the non-access stratum context information. And feeding back the security parameters required by the key and the generated key to the mobile device of the relay device, and forwarding the security parameter to the remote device, so that the remote device returns the security parameter to the remote device, so that the remote device can The security parameters generate a key that is used to secure communication between the remote device and the relay device.
  • the network side device is a mobile management entity or a short-range functional entity of the remote device.
  • the foregoing key is generated by the mobile management entity of the remote device according to the basic security key of the remote device.
  • the mobility management entity of the relay device stores the context information of the relay device
  • the mobility management entity of the remote device stores the context information of the remote device
  • the short-range functional entity stores the context information of the relay device and Context information of the remote device.
  • the authorization verification method provided by the embodiment of the present application further includes:
  • the network side device sends a key request message to the security function entity, so that the security function entity acquires a key for protecting communication security between the remote device and the relay device and generates a key according to the key request message.
  • the security parameter is fed back to the network side device, and the key request message includes: the identifier of the remote device.
  • the network side device determines that the association between the remote device and the relay device is verified, but the response message obtained by the network device does not carry the security for protecting the communication between the remote device and the relay device.
  • the key and the security parameters required to generate the key then directly send a key request message to the security function entity, so that the security function entity obtains a key for protecting the communication security between the remote device and the relay device.
  • the remote devices in the following figures are a wearable device (WD), a relay device, a mobile device (MME-WD) of the remote device, and a relay device.
  • the mobility management entity (MME-relay), the base station (eNB), the home subscriber server (HSS), and the ProSe Function (PF) are described.
  • FIG. 11 is an interaction diagram of Embodiment 11 of the authorization verification method according to an embodiment of the present application. As shown in FIG. 11, the authorization verification method provided by the embodiment of the present application is similar to the embodiment shown in FIG. 6, and the specific steps are as follows:
  • Step 1101 WD, and Relay are successfully registered to the network.
  • Step 1102 The WD sends a communication request to the Relay.
  • the communication request carries the identifier (WD ID) of the remote device.
  • the communication request further includes a first NAS message (NAS message of the WD) and/or a relay service code.
  • Step 1103 The Relay sends RRC signaling to the base station (eNB).
  • the RRC signaling includes related content in the foregoing communication request.
  • the RRC signaling further includes an identifier of the relay.
  • Step 1104 The eNB initiates an S1-AP connection establishment with the MME-WD, and sends related content in the RRC signaling to the MME-WD by using an initial remote device message.
  • Step 1105 The MME-WD verifies the integrity of the first NAS message, and verifies the association relationship between the Relay and the WD.
  • the specific operation after the MME-WD receives the first NAS message may be referred to the description of step 604 in the embodiment shown in FIG. 6, and details are not described herein again.
  • the MME-WD verifies the integrity of the first NAS message. For details about the integrity check, refer to the description in step 403, and details are not described herein again.
  • Step 1106 The MME-WD sends the WD ID and the Relay ID to the MME-relay.
  • the MME-WD may also send other relevant parameters required to verify the association relationship between the Relay and the WD to the MME-relay.
  • MME-WD may also send MME-relay Send a relay service code and other content.
  • Step 1107 The MME-relay verifies the association relationship between the Relay and the WD, and feeds back a second response message to the MME-WD.
  • Step 1108 the MME-WD generates a key.
  • the MME-WD acquires a security parameter required to generate a key according to the WD ID, and then generates a key for protecting communication security between the WD and the Relay.
  • Step 1109 The MME-WD returns the key and the security parameters required to generate the key to the eNB.
  • the MME-WD returns the key and the security parameters required to generate the key to the eNB through the initial context request.
  • Step 1110 The eNB establishes bearer mapping and binding of the WD and the Relay.
  • Step 1111 The eNB feeds back the key and the security parameters required to generate the key to the Relay, and implements a wireless control protocol connection configuration between the eNB and the Relay.
  • Step 1112 The eNB feeds back the security parameters required for generating the key to the WD, and implements a wireless control protocol connection configuration between the eNB and the WD.
  • Step 1113 The WD generates a key according to the security parameters required to generate the key.
  • Step 1114 The WD sends a message to the eNB that the radio control protocol connection configuration is completed.
  • Step 1115 The eNB feeds back an initial context complete message to the MME-WD.
  • the first: the relationship verification in step 1105 and step 1107 may only need to be performed one or both.
  • the second key is used to protect the communication security between the remote device and the relay device, that is, the key may not be generated in step 1108.
  • the first random number generated by the WD and the second random number generated by the MME-WD need not be generated and transmitted.
  • the NAS message of the remote device and the NAS message of the MME-WD still need to be transmitted, and the role is passed. Check the integrity of the NAS message of the remote device to complete the security authentication between the WD and the relay.
  • the key used to secure communication between the remote device and the relay device Need to generate, optionally, the interaction between the WD and the MME-WD may not need to be encapsulated in the NAS message, that is, the first random number and the WD ID do not need to be encapsulated in the NAS message of the remote device, and the second random number It also does not need to be encapsulated in the NAS message of the MME-WD.
  • step 604 if the WD ID is not included in the NAS message of the remote device in the communication request, then in step 604 and step 605, the first request message and the NAS message of the remote device in the second request The WD ID is also not included.
  • FIG. 12 is an interaction diagram of Embodiment 12 of the authorization verification method according to the embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application is similar to the embodiment shown in FIG. 11 except that the PF can also perform authorization verification.
  • step 1106 in FIG. 11 above may be replaced with step 1201
  • step 1107 may be replaced with step 1202.
  • Step 1201 The MME-WD sends a WD ID and a Relay ID to the PF.
  • the MME-WD may also send other relevant parameters required to verify the association relationship between the Relay and the WD to the PF.
  • the MME-WD may also send content such as a relay service code to the MME-relay.
  • Step 1202 The PF verifies the association relationship between the Relay and the WD, and feeds back a second response message to the MME-WD.
  • the first: a key for protecting communication security between the remote device and the relay device is optional, that is, the key may not be generated in step 1108.
  • the first random number generated by the WD and the second random number generated by the MME-WD need not be generated and transmitted.
  • the NAS message of the remote device and the NAS message of the MME-WD still need to be transmitted, and the role is passed. Check the integrity of the NAS message of the remote device to complete the security authentication between the WD and the relay.
  • the interaction between the WD and the MME-WD may not need to be encapsulated in the NAS message. That is, the first random number and the WD ID do not need to be encapsulated in the NAS message of the remote device, and the second random number does not need to be encapsulated in the NAS message of the MME-WD.
  • step 604 if the WD ID does not contain the NAS message of the remote device in the communication request In step 604 and step 605, the WD ID is also not included in the NAS message of the remote device in the first request message and the second request.
  • FIG. 13 is an interaction diagram of Embodiment 13 of the authorization verification method according to the embodiment of the present application. As shown in FIG. 13, the authorization verification method provided by the embodiment of the present application has the following specific steps:
  • Step 1301, WD, and Relay are successfully registered to the network.
  • the update of the authorization information occurs on step 1302, PF or HSS.
  • the PF and/or the HSS may have a first authorization information update related to the relay, and/or a second authorization information update related to the WD.
  • Step 1303, MME-WD and/or MME-relay implements update of the authorization information.
  • the PF and/or the HSS configure the updated first authorization information on the MME-relay.
  • the PF and/or the HSS configure the updated second authorization information on the MME-WD.
  • Step 1304 The MME-WD stores the second authorization information related to the WD.
  • the MME-relay stores the first authorization information related to the relay.
  • Step 1305, WD and Relay implement a discovery process of the communication interface.
  • Step 1306 The WD sends a communication request to the Relay.
  • the communication request carries the identifier (WD ID) of the remote device.
  • the communication request further includes a first NAS message (NAS message of the WD) and/or a relay service code.
  • Step 1307 The Relay generates a first request message, and sends the first request message to the PF.
  • Step 1308 The PF verifies the association relationship between the Relay and the WD, and generates a key.
  • the PF may perform one or more of the following operations: first, the PF verifies the association relationship between the Relay and the WD; and second, the PF generates the key.
  • the key is a security key used to protect communication between the WD and the Relay.
  • Step 1309 The PF feeds back the key and the security parameters required to generate the key to the Relay.
  • the PF feeds back the key and the security parameters required to generate the key to the Relay through the first response message.
  • Step 1310 The Relay feeds back the security parameters required to generate the key to the WD.
  • the Relay feeds back the security parameters required to generate the key through the communication response. WD.
  • Step 1311 the WD sends a service request to the MME-WD.
  • the service request carries a WD-ID and a relay-ID.
  • the service request further carries a relay service code.
  • Step 1312 The MME-WD verifies the association relationship between the Relay and the WD.
  • the step may further verify the association between the Relay and the WD by using the MME-relay, or the step of verifying the association between the Relay and the WD by using both the MME-WD and the MME-relay.
  • the MME-WD generates a security key for protecting communication between the WD and the Relay.
  • Step 1313 The MME-WD sends an initial context request to the eNB, where the initial context request carries the WD-ID and the relay-ID.
  • Step 1314 The eNB completes bearer mapping and binding of the WD and the Relay.
  • Step 1315 A wireless control protocol connection configuration is implemented between the eNB and the Relay.
  • Step 1316 A wireless control protocol connection configuration is implemented between the eNB and the WD.
  • Step 1317 The eNB feeds back an initial context complete message to the MME-WD.
  • FIG. 14 is an interaction diagram of Embodiment 14 of the authorization verification method according to the embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application is similar to the embodiment shown in FIG. 6, and specifically includes the following steps:
  • Step 1401 WD, and Relay are successfully registered to the network.
  • Step 1402 The WD sends a NAS message of the remote device to the MME-WD.
  • the NAS message of the remote device carries the identifier of the remote device (WD ID) and the identifier of the relay device (Relay ID).
  • the NAS message of the remote device further includes a relay service code and/or a first random number.
  • Step 1403 The MME-WD verifies the integrity of the NAS message of the remote device, and verifies the association relationship between the Relay and the WD.
  • the MME-WD may perform one or more of the following operations: verifying the integrity of the NAS message of the remote device, and verifying the association between the Relay and the WD.
  • Step 1404 The MME-WD sends a first authorization verification request message to the MME-relay.
  • Step 1405 The MME-relay verifies the association relationship between the Relay and the WD, and feeds back the first authorization verification response message to the MME-WD.
  • step 1406 the MME-WD generates a key.
  • the MME-WD generates a key for protecting the communication security between the WD and the Relay and a security parameter required to generate the key according to the WD ID.
  • a key for protecting the communication security between the WD and the Relay and a security parameter required to generate the key according to the WD ID.
  • the key generation refer to step 502 in the embodiment shown in Figure 5, and details are not described herein.
  • Step 1407 The MME-WD returns the key and the security parameters required to generate the key to the eNB.
  • the MME-WD returns the key and the security parameters required to generate the key to the eNB through the pairing request.
  • Step 1408 The eNB establishes bearer mapping and binding of the WD and the Relay.
  • Step 1409 The eNB feeds back the key and the security parameters required to generate the key to the Relay, and the eNB and the Relay implement a wireless control protocol connection configuration.
  • Step 1410 The eNB feeds back the pairing response to the MME-WD.
  • Step 1411 The MME-WD feeds back the security parameters required to generate the key to the WD.
  • Step 1412 The WD generates a key according to a security parameter required to generate a key.
  • Step 1413 The WD sends a communication request to the Relay.
  • step 1414 the Relay feeds back the communication response to the WD.
  • the first: the relationship verification in step 1403 and step 1405 may only need to be performed one or both.
  • the second key used to protect the communication security between the remote device and the relay device is optional, that is, the key may not be generated in step 1406.
  • the first random number generated by the WD required to generate the key and the second random number generated by the MME-WD are also not required to be generated and transmitted.
  • FIG. 15 is an interaction diagram of Embodiment 15 of the authorization verification method according to an embodiment of the present application.
  • the authorization verification method provided by the embodiment of the present application is similar to the embodiment shown in FIG.
  • Authorization verification is also possible only for PF.
  • step 1403 in FIG. 14 above may be replaced by steps 1501 to 1504.
  • Step 1501 The MME-WD verifies the integrity of the NAS message of the remote device.
  • Step 1502 The MME-WD sends a second authorization verification request message to the PF.
  • the MME-WD sends a second authorization verification request message to the PF according to the NAS message of the remote device.
  • Step 1503 The PF verifies the association relationship between the Relay and the WD, and generates a second authorization verification response message.
  • the PF verifies the association relationship between the Relay and the WD according to the authorization verification request message.
  • Step 1504 The PF feeds back a second authorization verification response message to the MME-WD.
  • the content carried in the third request message is consistent with the content in the first request message.
  • FIG. 16 is a schematic structural diagram of an authorization verification apparatus according to an embodiment of the present application.
  • the device may be located in a mobility management entity of the relay device. As shown in FIG. 16, the device in this embodiment may include: a receiving module 1601, a processing module 1602, and a sending module 1603.
  • the receiving module 1601 is configured to receive a first request message sent by the relay device, where the first request message includes: an identifier of the remote device.
  • the processing module 1602 is configured to trigger verification of an association relationship between the remote device and the relay device according to the first request message.
  • the sending module 1603 is configured to: after the processing module 1602 determines that the association relationship is verified, generate a first response message, and send the first response message to the relay device.
  • the sending module 1603 is further configured to send a second request message to the mobility management entity of the remote device, where the second request message includes: an identifier of the remote device.
  • the receiving module 1601 is further configured to receive, by the mobile management entity of the remote device, according to the The second response message sent by the second request message after performing security processing on the remote device.
  • the device in this embodiment may be used to implement the technical solution of the mobility management entity of the relay device in the method embodiment shown in FIG. 1.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • the processing module 1602 is configured to obtain the first authorization information according to the first request message, and according to the identifier of the remote device, the identifier of the relay device, and the first authorization information. And verifying whether the remote device is allowed to access the network through the relay device.
  • the processing module 1602 is specifically configured to: after the relay device successfully registers with the network, according to the identifier of the relay device, from any one or two of a user data management entity and a short-range functional entity. Obtaining the first authorization information.
  • the method further includes: when the service code is relayed, the processing module 1602 is configured to acquire the first authorization information according to the first request message, and according to the identifier of the remote device, And determining, by the identifier of the relay device, the relay service code, and the first authorization information, whether the remote device is allowed to access the network by using the relay device.
  • the receiving module 1601 is further configured to receive a key sent by a mobility management entity of the remote device and a security parameter required to generate the key.
  • the sending module 1603 is further configured to send the key and a security parameter required to generate the key to the relay device.
  • the sending module 1603 is further configured to send a key request message to the security function entity, so that the security function entity obtains, according to the key request message, the protection Securing a secure key between the remote device and the relay device and a security parameter required to generate the key, and feeding back the key and security parameters required to generate the key to the middle Following the mobility management entity of the device, the key request message includes: an identifier of the remote device.
  • the sending module 1603 is further configured to send the key and a security parameter required to generate the key to the relay device.
  • the sending module 1603 is further configured to send a third request message to the short-range functional entity, so that the short-range functional entity verifies whether the permission is allowed according to the third request message.
  • the remote device accesses the network by using the relay device, and the third request message includes: an identifier of the remote device, and an identifier of the relay device.
  • the second request message when the first request message further includes: a non-access stratum message of the remote device, and a check code of the non-access stratum message, the second request message further includes: Far a non-access stratum message of the end device, and a check code of the non-access stratum message.
  • the foregoing device may be used to perform the method provided in the foregoing method embodiment, and the specific implementation manner and the technical effect are similar, and details are not described herein again.
  • FIG. 17 is a schematic structural diagram of another authorization verification apparatus according to an embodiment of the present application.
  • the device can be located in a mobility management entity of the remote device.
  • the apparatus in this embodiment may include: a receiving module 1701, a processing module 1702, and a sending module 1703.
  • the receiving module 1701 is configured to receive a second request message sent by a mobility management entity of the relay device, where the second request message includes: an identifier of the remote device.
  • the processing module 1702 is configured to perform security processing on the remote device according to the second request message by the mobility management entity of the remote device.
  • the sending module 1703 is configured to send a second response message to the mobility management entity of the relay device after the processing module 1702 performs security processing on the remote device.
  • the device in this embodiment may be used to implement the technical solution of the mobility management entity of the remote device in the method embodiment shown in FIG. 1.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • the processing module 1702 is configured to obtain second authorization information according to the second request message, and according to the identifier of the remote device, the identifier of the relay device, and The second authorization information is used to verify whether the remote device is allowed to access the network through the relay device.
  • the processing module 1702 is specifically configured to: after the remote device successfully registers with the network, acquire the second from the user data management entity and/or the short-range functional entity according to the identifier of the remote device. Authorization information.
  • the processing module 1702 is configured to obtain second authorization information according to the second request message, and according to the Determining, by the identifier of the remote device, the identifier of the relay device, the relay service code, and the second authorization information, whether the remote device is allowed to access the network through the relay device.
  • the processing module 1702 is configured to acquire non-access stratum context information of the remote device according to the identifier of the remote device in the second request message. And verifying, according to the non-access stratum context information, a check code of the non-access stratum message of the remote device, where the second request message includes: a non-access stratum message of the remote device, Said The check code of the non-access stratum message and the identity of the remote device.
  • the processing module 1702 is further configured to acquire non-access stratum context information of the remote device according to the identifier of the remote device in the second request message. Generating a key for protecting communication security between the remote device and the relay device according to the non-access stratum context information;
  • the sending module 1703 is further configured to send the key and a security parameter required to generate the key to a mobility management entity of the relay device.
  • the sending module 1703 is further configured to send a key request message to the security function entity, so that the security function entity obtains, according to the key request message, a protection Determining a security key between the remote device and the relay device and a security parameter required to generate the key, and feeding back the key and security parameters required to generate the key to the The mobility management entity of the remote device, the key request message, including: the remote device identifier.
  • the foregoing device may be used to perform the method provided in the foregoing method embodiment, and the specific implementation manner and the technical effect are similar, and details are not described herein again.
  • FIG. 18 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the device can be located in a relay device.
  • the apparatus in this embodiment may include: a receiving module 1801, a processing module 1802, and a sending module 1803.
  • the receiving module 1801 is configured to receive a communication request sent by the remote device, where the communication request includes: an identifier of the remote device.
  • the processing module 1802 is configured to generate a first request message according to the communication request, where the first request message includes: an identifier of the remote device.
  • the sending module 1803 is configured to send the first request message to a mobility management entity of the relay device.
  • the receiving module 1801 is further configured to receive a first response message that is sent by the mobility management entity of the relay device after determining that the association relationship is verified.
  • the sending module 1803 is further configured to send a communication response to the remote device according to the first response message.
  • the device in this embodiment may be used to implement the technical solution of the relay device in the method embodiment shown in FIG. 1.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • the receiving module 1801 is further configured to receive, by the mobility management entity of the relay device, between the remote device and the relay device. Communication security key and security parameters required to generate the key.
  • the sending module 1803 is further configured to send the security parameter to the remote device by using the communication response, so that the remote device generates, according to the security parameter, a protection device for protecting the remote device and the remote device. Said key for communication security between relay devices.
  • the foregoing device may be used to perform the method provided in the foregoing method embodiment, and the specific implementation manner and the technical effect are similar, and details are not described herein again.
  • FIG. 19 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the device may be located in a mobility management entity of the relay device, or may be located in a mobility management entity of the remote device, or may be located in a close-range functional entity.
  • the apparatus in this embodiment may include: a receiving module 1901, a processing module 1902, and a sending module 1903.
  • the receiving module 1901 is configured to receive a first request message sent by the relay device, where the first request message includes: an identifier of the remote device;
  • the processing module 1902 is configured to trigger verification of an association relationship between the remote device and the relay device according to the first request message.
  • the sending module 1903 is configured to send a first response message to the relay device after the processing module 1902 determines that the association relationship is verified.
  • the processing module 1902 is configured to obtain, according to the first request message, the first authorization information, and according to the identifier of the remote device, the relay device And the identifier and the first authorization information, verifying whether the remote device is allowed to access the network through the relay device.
  • the processing module 1902 is specifically configured to: after the relay device and the remote device successfully register to the network, according to the first request message, from the user data management entity and the short-range functional entity.
  • the first authorization information is obtained in any one or two.
  • the processing module 1902 is specifically configured to acquire the first authorization according to the first request message. And verifying, according to the identifier of the remote device, the identifier of the relay device, the relay service code, and the first authorization information, whether the remote device is allowed to be connected through the relay device. Into the network.
  • the sending module 1903 is further configured to send a second request message to the first mobility management entity, so that the first mobility management entity is configured according to the second request.
  • the message verifies whether the remote device is allowed to access the network through the relay device.
  • the first mobility management entity when the authorization verification device is located in a mobility management entity of the relay device, the first mobility management entity is a short-range functional entity or a mobility management entity of the remote device; or when the authorization is verified When the device is located in a mobility management entity of the remote device, the first mobility management entity is a short-range functional entity or a mobility management entity of the relay device; or when the authorization verification device is located at a close-range functional entity, The first mobility management entity is a mobility management entity of the remote device or a mobility management entity of the relay device.
  • the second The request message includes: a non-access stratum message of the remote device, a check code of the non-access stratum message, and an identifier of the remote device, where the processing module 1902 is configured to send to the remote end
  • the mobility management entity of the device sends a second request message, so that the mobility management entity of the remote device performs security processing on the remote device according to the second request message.
  • the authorization verification device may be located in a mobility management entity of the relay device, or the authorization verification device may be located in a close-range functional entity.
  • the receiving module 1901 when the authorization verification device is located in a mobility management entity of the remote device, the receiving module 1901 is specifically configured to receive, by the relay device, the relay device to forward Processing the first request message, the first request message further includes: an identifier of the relay device.
  • the processing module 1902. when the first request message includes a non-access stratum message of the remote device and a check code of the non-access stratum message, the processing module 1902. The method is used to obtain the non-access stratum context information of the remote device according to the identifier of the remote device, and check the non-access stratum message according to the non-access stratum context information. authenticating.
  • the sending module 1903 is further configured to send a second request message to the first mobility management entity, so that the first mobility management entity is configured according to the far An identifier of the end device, acquiring non-access stratum context information of the remote device, and according to the non- The access layer context information generates a key for protecting communication security between the remote device and the relay device, and feeds back the key and security parameters required to generate the key to the authorization verification Device.
  • the sending module 1903 is further configured to send the key and a security parameter required to generate the key to the relay device, so that the relay device returns the security parameter to the far
  • the end device causes the remote device to generate the key for protecting communication security between the remote device and the relay device according to the security parameter.
  • the authorization verification device may be located in a mobility management entity of the relay device, where the first mobility management entity is a short-range functional entity or a mobility management entity of the remote device.
  • the processing module 1902 is further configured to acquire non-access stratum context information of the remote device according to the identifier of the remote device, and according to the Non-access stratum context information generates a key for protecting communication security between the remote device and the relay device, and feedback the key and security parameters required to generate the key to the a mobility management entity of the relay device and forwarding the same to the relay device, so that the relay device returns the security parameter to the remote device, so that the remote device generates the security parameter according to the security parameter The key that secures communication between the remote device and the relay device.
  • the authorization verification device may be located in a mobility management entity or a close-range functional entity of the remote device.
  • the key is generated by a mobility management entity of the remote device according to a basic security key of the remote device.
  • the mobility management entity of the relay device stores context information of the relay device, where the remote management device stores the remote device
  • the context information of the device, the context information of the relay device and the context information of the remote device are stored in the close-range functional entity.
  • the sending module 1903 is further configured to send a key request message to the security function entity, so that the security function entity obtains the information according to the key request message.
  • the key request message includes: an identifier of the remote device.
  • authorization verification apparatus provided in the embodiment of the present application can also implement the foregoing various options.
  • the specific implementation principle and the beneficial effects are referred to the foregoing method embodiments, and details are not described herein again.
  • each module of the above device is only a division of a logical function, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated.
  • these modules can all be implemented by software in the form of processing component calls; or all of them can be implemented in hardware form; some modules can be realized by processing component calling software, and some modules are realized by hardware.
  • the determining module may be a separately set processing element, or may be integrated in one of the above-mentioned devices, or may be stored in the memory of the above device in the form of program code, by a processing element of the above device. Call and execute the functions of the above determination module.
  • the implementation of other modules is similar.
  • all or part of these modules can be integrated or implemented independently.
  • the processing elements described herein can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules may be completed by an integrated logic circuit of hardware in the processor element or an instruction in a form of software.
  • the above modules may be one or more integrated circuits configured to implement the above method, such as one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors ( Digital singnal processor (DSP), or one or more Field Programmable Gate Array (FPGA).
  • ASICs Application Specific Integrated Circuits
  • DSP Digital singnal processor
  • FPGA Field Programmable Gate Array
  • the processing component may be a general purpose processor, such as a central processing unit (CPU) or other processor that can call the program code.
  • CPU central processing unit
  • these modules can be integrated and implemented in the form of a system-on-a-chip (SOC).
  • SOC system-on-a-chip
  • FIG. 20 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the authorization verification apparatus provided by the present example includes: a processor 2001, a memory 2002, a transceiver 2003, a communication interface 2004, and a system bus 2005.
  • the memory 2002 and the communication interface 2004 are connected and completed by the system bus 2005 and the processor 2001 and the transceiver 2003. Communication with each other, the memory 2002 is used to store computer execution instructions, the communication interface 2004 is used to communicate with other devices, and the processor 2001 and the transceiver 2003 are used to run computer execution instructions to cause the authorization verification device to perform the above application to the authorization verification method.
  • the various steps of the mobile management entity of the relay device includes: a processor 2001, a memory 2002, a transceiver 2003, a communication interface 2004, and a system bus 2005.
  • the memory 2002 and the communication interface 2004 are connected and completed by the system bus 2005 and the processor 2001 and the transceiver 2003. Communication with each other, the memory 2002 is used to store computer execution instructions,
  • the receiving module 1601 and the transmitting module 1603 correspond to the transceiver 2003
  • the processing module 1602 corresponds to the processor 2001 and the like.
  • FIG. 21 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the authorization verification apparatus provided in this example includes: a processor 2101, a memory 2102, a transceiver 2103, a communication interface 2104, and a system bus 2105.
  • the memory 2102 and the communication interface 2104 are connected to the processor 2101 and the transceiver 2103 through the system bus 2105 and are completed.
  • the memory 2102 is used to store computer execution instructions
  • the communication interface 2104 is used to communicate with other devices
  • the processor 2101 and the transceiver 2103 are configured to execute computer execution instructions to cause the authorization verification device to perform the above application to the authorization verification method.
  • the steps of the mobile management entity of the mid-range and far-end devices are configured to execute computer execution instructions to cause the authorization verification device to perform the above application to the authorization verification method.
  • the receiving module 1701 and the transmitting module 1703 correspond to the transceiver 2103
  • the processing module 1702 corresponds to the processor 2101 and the like.
  • FIG. 22 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the authorization verification apparatus provided in this example includes: a processor 2201, a memory 2202, a transceiver 2203, a communication interface 2204, and a system bus 2205.
  • the memory 2202 and the communication interface 2204 are connected to the processor 2201 and the transceiver 2203 through the system bus 2205 and are completed.
  • the memory 2202 is used to store computer execution instructions
  • the communication interface 2204 is used to communicate with other devices
  • the processor 2201 and the transceiver 2203 are configured to execute computer execution instructions to cause the authorization verification device terminal authentication device to perform the above application.
  • the steps of the relay device in the authorization verification method includes: a processor 2201, a memory 2202, a transceiver 2203, a communication interface 2204, and a system bus 2205.
  • the memory 2202 and the communication interface 2204 are connected to the processor 2201 and the transceiver 2203 through the system bus
  • the receiving module 1801 and the transmitting module 1803 correspond to the transceiver 2203
  • the processing module 1802 corresponds to the processor 2201 and the like.
  • FIG. 23 is a schematic structural diagram of still another authorization verification apparatus according to an embodiment of the present application.
  • the authorization verification apparatus provided in this example includes: a processor 2301, a memory 2302, a transceiver 2303, a communication interface 2304, and a system bus 2305.
  • the memory 2302 and the communication interface 2304 are connected to the processor 2301 and the transceiver 2303 through the system bus 2305 and are completed.
  • the memory 2302 is used to store computer execution instructions
  • the communication interface 2304 is used to communicate with other devices
  • the processor 2301 and the transceiver 2303 are configured to execute computer execution instructions to cause the authorization verification device to perform the above application to the authorization verification method.
  • the steps of the network side device includes: a processor 2301, a memory 2302, a transceiver 2303, a communication interface 2304, and a system bus 2305.
  • the memory 2302 and the communication interface 2304 are connected to the processor 2301 and the transceiver 2303 through the system bus 2305
  • the receiving module 1901 and the transmitting module 1903 correspond to the transceiver 2303
  • the processing module 1902 corresponds to the processor 2301 and the like.
  • the system bus mentioned in the above Figures 20 to 23 can be a Peripheral Component Interconnect Standard (Peripheral). Pomponent Interconnect (PCI) bus or Extended Industry Standard Architecture (EISA) bus.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the system bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.
  • the communication interface is used to implement communication between the database access device and other devices such as clients, read-write libraries, and read-only libraries.
  • the memory may include a random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage.
  • the above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor, NP for short), or a digital signal processor (DSP). , Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • CPU central processing unit
  • NP Network Processor
  • DSP digital signal processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例提供一种授权验证方法和装置。其中，该方法包括：中继设备接收远端设备发送的包括远端设备的标识的通信请求，根据该通信请求生成第一请求消息并发送给中继设备的移动管理实体，中继设备的移动管理实体根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证，并在判断关联关系验证通过后生成第一响应消息，以及向中继设备发送第一响应消息。该技术方案利用层2中继对远端设备和中继设备进行授权验证，降低了网络配置需求、减少了网络开销、提高了验证效率。

Description

授权验证方法和装置 技术领域
本申请涉及无线通信技术领域，尤其涉及一种授权验证方法和装置。
背景技术
在演进分组系统(Evolved Packet System，简称EPS)中，可穿戴设备等远端设备通过中继设备连接到网络中，从而达到降低远端设备功耗的目的。在远端设备通过中继设备连接到网络中时，远端设备需要用到中继设备的无线承载，故网络上需要完成远端设备与中继设备之间数据承载关系的映射，因此，需要网络来验证远端设备和中继设备的合法性以及远端设备和中继设备的关联关系。
现有技术中，当中继设备是层3中继时，网络中没有存储远端设备的上下文关系，基站与网络之间不存在远端设备的数据通道，此时基站与网络通过中继设备的数据通道对远端设备的数据进行传输。此时，网络通过如下方式实现远端设备和中继设备之间关联关系的验证。具体的，首先，远端设备从短距离功能实体(Proximity Service Function，简称PF)获取中继发现参数和密钥管理功能实体(ProSe key Management Function，简称PKMF)的地址，然后根据PKMF地址从PKMF获取发现安全参数，以及向PKMF发送密钥请求以获取用于中继通信的根密钥；其次，中继设备从PF获取中继发现参数和PKMF的地址，并从PKMF获取发现安全参数；进而如果远端设备需要通过中继设备接入网络，则远端设备与中继设备基于从PF获取的参数进行发现过程；然后，在成功完成发现过程后，远端设备向中继设备发送通信请求，从而触发中继设备向PKMF中继发送授权和密钥请求，PKMF对远端设备是否允许通过中继设备接入网络进行授权检查并生成短距离通信密钥，并向中继设备反馈包含通信密钥、密钥生成参数等内容的密钥响应。中继设备将密钥生成参数转发给远端设备，远端设备根据密钥生成参数生成通信密钥，若远端设备侧生成的通信密钥与中继设备接收到的通信密钥一致则表明认证和授权检查通过，从而远端设备可通过中继设备连接到网络。
然而，远端设备也可通过层2中继连接到网络，由于层2中继的协议栈结构与层3中继的不同，当中继设备选用层2中继时，基站与核心网络上为远端设备建立了相应的上下文信息以及远端设备的数据通道，此时若仍然采用层3中继对应的授权验证方法来验证远端设备与中继设备之间的关联关系，会要求执行上述层3方案的复杂繁琐的参数配置流程和授权检查流程，使得整个认证和授权过程的网络配置需求高、网络开销大、验证效率低。
发明内容
本申请实施例提供一种授权验证方法和装置，以解决远端设备和中继设备之间的关联关系认证和授权过程网络配置需求高、网络开销大、验证效率低的问题。
本申请实施例第一方面提供一种授权验证方法，该方法是从中继设备的移动管理实体的角度描述，该方法包括：中继设备的移动管理实体接收中继设备发送的包括远端设备的标识的第一请求消息，并根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证，以及在判断该关联关系验证通过后，生成第一响应消息，将该第一响应消息发送给中继设备，其中，根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：向远端设备的移动管理实体发送包括远端设备的标识的第二请求消息，并接收远端设备的移动管理实体根据第二请求消息对远端设备进行安全处理后发送的第二响应消息。
该方法针对层2中继设备，设计了一套远端设备与中继设备的关联关系验证方案，在中继设备的移动管理实体侧根据从中继设备发送来的第一请求消息触发对远端设备和中继设备的关联关系的验证，可选的，可以在中继设备的移动管理实体侧实现关联关系验证，也可以在远端设备的移动管理实体侧实现关联关系验证，这样能够避免现有层3中继方案中所需执行的复杂繁琐的参数配置流程和授权检查流程，使得本申请的层2解决方案与现有层3解决方案相比，降低了网络配置需求、减少了网络开销、提高了验证效率。
可选的，所述中继设备的移动管理实体根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证，还包括：中继设备的移动管理实体根据所述第一请求消息获取第一授权信息，并根据远端设备的标 识、中继设备的标识以及该第一授权信息，验证是否允许远端设备通过中继设备接入网络。可选的，当中继设备的移动管理实体自身来验证远端设备和中继设备的关联关系时，其需要首先获取中继设备的上下文，从上下文中获取与该中继设备有授权关系的远端设备列表，即第一授权信息，进而实现关联关系的验证。当中继设备的移动管理实体获知远端设备的标识、中继设备的标识以及上述第一授权信息后，判断该第一授权信息中是否包含中继设备与远端设备的关联关系，当该第一授权信息中包含中继设备与远端设备的关联关系时，表明允许该远端设备通过该中继设备接入网络，否则，不允许该远端设备通过该中继设备接入网络。
可选的，所述中继设备的移动管理实体根据所述第一请求消息获取第一授权信息，包括：在所述中继设备成功注册到网络之后，根据所述中继设备的标识从用户数据管理实体和/或近距离功能实体获取所述第一授权信息。也即，在中继设备成功注册到网络之后，网络中用户数据管理实体和/或近距离功能实体中均存储有中继设备的与远端设备相关的第一授权信息。对于用户数据管理实体中的中继设备与远端设备相关的第一授权信息，中继设备的移动管理实体直接从用户数据管理实体获取上述第一授权信息。而对于中继设备的移动管理实体从近距离功能实体获取该第一授权信息的方式，可以为：当中继设备的移动管理实体可直接与近距离功能实体通信时，即两者之间存在直接接口，中继设备的移动管理实体直接从近距离功能实体获取上述第一授权信息；而当中继设备的移动管理实体不能直接与近距离功能实体通信时，即两者之间不存在直接接口，则近距离功能实体通过HSS将上述第一授权信息发送给中继设备的移动管理实体。
可选的，若第一请求消息，还包括：中继服务码；则中继设备的移动管理实体根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：中继设备的移动管理实体根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息，验证是否允许远端设备通过中继设备接入网络。
当远端设备发送给中继设备的通信请求中还包括中继服务码时，中继设备整合生成的第一请求消息中也包括中继服务码，该中继服务码用于表征远端设备要请求的业务类型，不同的中继服务码对应不同的业务类型，因此， 中继设备的移动管理实体验证远端设备与中继设备的关联关系时，还依据中继服务码，此时的第一授权信息为中继设备有授权关系的远端设备以及对应的中继服务码的关系列表。
可选的，本申请的授权验证方法，还包括：中继设备的移动管理实体向近距离功能实体发送包括远端设备的标识、中继设备的标识的第三请求消息，以使近距离功能实体根据第三请求消息验证是否允许远端设备通过中继设备接入网络。作为一种示例，关于终端设备的移动管理实体触发对远端设备和中继设备的关联关系验证的实现方式，除了中继设备的移动管理实体可自身进行验证、以及向远端设备的移动管理实体发送第二请求消息，以使该远端设备的移动管理实体验证外，中继设备的移动管理实体还可向近距离功能实体发送第三请求消息，以使该近距离功能实体进行验证。
可选的，本申请的授权验证方法，还包括：中继设备的移动管理实体接收远端设备的移动管理实体发送的密钥和生成该密钥所需的安全参数，并将该密钥和生成密钥所需的安全参数发送给所述中继设备。
远端设备想要通过中继设备接入到网络中，远端设备和中继设备需要具有保护两者之间通信的密钥，所以，中继设备的移动管理实体还需要接收远端设备的移动管理实体发送的密钥和生成该密钥所需的安全参数，并将其发送给中继设备，以使中继设备持有该密钥和生成该密钥的所需的安全参数。
可选的，当中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体对远端设备和中继设备关联关系的验证通过时，但中继设备的移动管理实体接收到的第二响应消息中未携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数，那么中继设备的移动管理实体向安全功能实体发送密钥请求消息，安全功能实体则根据该密钥请求消息中远端设备的标识，查找并获取用于保护远端设备和中继设备之间通信安全的密钥和生成该密钥所需的安全参数，以及将该密钥和生成密钥所需的安全参数反馈给中继设备的移动管理实体，最后中继设备的移动管理实体再将密钥和生成该密钥所需的安全参数反馈给中继设备，以使中继设备对该密钥和安全参数进行相应处理。
这样，即使中继设备的移动管理实体生成的第一响应消息中未携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参 数，中继设备也能获取到用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数，从而保证远端设备可通过该中继设备接入网络
可选的，在第一请求消息还包括：远端设备的非接入层消息、非接入层消息的校验码时，第二请求消息还包括：远端设备的非接入层消息、非接入层消息的校验码。此时，远端设备的移动管理实体还可对远端设备的非接入层消息进行验证，具体的是根据远端设备的非接入层上下文信息对远端设备的非接入层消息的校验码进行验证。
本申请实施例第二方面提供一种授权验证方法，该方法是从远端设备的移动管理实体的角度描述，该方法包括：远端设备的移动管理实体接收中继设备的移动管理实体发送的包括远端设备的标识的第二请求消息，并根据第二请求消息对远端设备进行安全处理，以及在远端设备进行安全处理后，向中继设备的移动管理实体发送的第二响应消息。
作为一种示例，在中继设备的移动管理实体触发对远端设备和中继设备的关联关系的验证时，该远端设备的移动管理实体可接收中继设备的移动管理实体发送的第二请求消息，并根据第二请求消息对远端设备进行安全处理或者对远端设备与中继设备的关联关系进行进一步验证处理，以及根据安全处理的结果生成第二响应消息，并将该第二响应消息反馈给中继设备的移动管理实体。通过远端设备的移动管理实体对授权关系进行验证，降低了网络配置需求，减少了网络开销、提高了验证效率。
可选的，远端设备的移动管理实体根据第二请求消息对远端设备进行安全处理，包括：远端设备的移动管理实体根据第二请求消息获取第二授权信息，根据远端设备的标识、中继设备的标识以及第二授权信息，验证是否允许远端设备通过中继设备接入网络。可选的，远端设备的移动管理实体根据第二请求消息获取第二授权信息，包括：所述远端设备的移动管理实体在所述远端设备成功注册到网络之后，根据所述远端设备的标识从用户数据管理实体和/或近距离功能实体获取所述第二授权信息；该远端设备再根据第二请求消息中的远端设备标识，查找并获取其上下文信息中的第二授权信息。
远端设备的移动管理实体在远端设备成功注册到网络之后，网络中用户数据管理实体和/或近距离功能实体中存储有远端设备与中继设备相关的第二授权信息，便可根据远端设备的标识从用户数据管理实体和/或近距离功 能实体获取第二授权信息，进而可根据远端设备的标识、中继设备的标识以及获取的第二授权信息，判断该第二授权信息中是否包含远端设备与中继设备的关联关系。当第二授权信息中包含远端设备与中继设备的关联关系时，表明允许该远端设备通过该中继设备接入网络，否则，不允许该远端设备通过该中继设备接入网络。可选地，第二授权信息为与远端设备有授权关系的中继设备的列表。
可选的，若第二请求消息，还包括：中继服务码；则远端设备的移动管理实体根据第二请求消息对所述远端设备进行安全处理，包括：远端设备的移动管理实体根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。此时，第二授权信息为与远端设备有授权关系的中继设备以及对应的中继服务码的关系列表。这样远端设备的移动管理实体在判定远端设备和中继设备的关联关系时，在判定条件中增加了中继服务码，即增加了远端设备请求业务的业务类型，判定结果更准确。
可选的，远端设备的移动管理实体根据第二请求消息对远端设备进行安全处理，包括：远端设备的移动管理实体根据第二请求消息中的远端设备的标识，获取远端设备的非接入层上下文信息，并根据非接入层上下文信息对远端设备的非接入层消息的校验码进行验证，此时第二请求消息包括：远端设备的非接入层消息、非接入层消息的校验码以及远端设备的标识。
在本实施例中，在第一请求消息还包括：远端设备的非接入层消息、非接入层消息的校验码时，第二请求消息中也包括：远端设备的非接入层消息、非接入层消息的校验码。此时，远端设备的移动管理实体还可对远端设备的非接入层消息进行验证，具体的是根据远端设备的非接入层上下文信息对远端设备的非接入层消息的校验码进行验证，这样通过检查非接入层消息的完整性从而完成远端设备和中继设备的安全认证。
可选的，所述授权验证方法，还包括：远端设备的移动管理实体根据第二请求消息中远端设备的标识，获取远端设备的非接入层上下文信息，根据所述非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥，将该密钥和生成所述密钥所需的安全参数发送给中继设备的移动管理实体。
在本实施例中，为了保证远端设备与中继设备的通信安全，远端设备的移动管理实体根据需要通信的远端设备的标识获取该远端设备的非接入层上下文消息，该非接入层上下文消息中存储有生成密钥所需的安全参数。此外，由于远端设备的移动管理实体与中继设备之间一般不直接通信，所以，当远端设备的移动管理实体中生成用于保护远端设备和中继设备之间通信安全的密钥之后，需要将该密钥和生成密钥所需的安全参数发送给中继设备的移动管理实体，进而使其发送给中继设备。
可选的，所述授权验证方法，还包括：远端设备的移动管理实体向安全功能实体发送包括远端设备的标识的密钥请求消息，以使得安全功能实体根据该密钥请求消息，获取用于保护远端设备和中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将其反馈给远端设备的移动管理实体，进而通过中继设备的移动管理实体发送给中继设备。
可选地，当中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体对远端设备和中继设备的关联关系验证通过，但远端设备的NAS消息完整性校验没有通过，或者远端设备的NAS消息没有完整性保护，或者第一请求消息和第二请求消息没有携带远端设备的NAS消息，则可以通过安全功能实体获取用于保护远端设备和中继设备之间通信安全的密钥和生成该密钥所需的安全参数，能够保证远端设备和中继设备之间的正常通信。
本申请实施例第三方面提供一种授权验证方法，该方法是从中继设备的角度描述，该方法包括：中继设备接收远端设备发送的包括远端设备的标识的通信请求，根据该通信请求，生成第一请求消息，并将第一请求消息发送给中继设备的移动管理实体，以及接收中继设备的移动管理实体在判断关联关系验证通过后发送的第一响应消息，根据所述第一响应消息向所述远端设备发送通信响应。
本方法在通信响应表征验证关系通过，且远端设备生成了用于保护远端设备和中继设备两者通信安全的密钥时，远端设备则可通过该中继设备连接到网络中，实现方案简单，网络开销小，验证效率低。
可选的，该授权验证方法，还包括：中继设备接收中继设备的移动管理实体发送的用于保护远端设备和中继设备之间通信安全的密钥和生成所述密 钥所需的安全参数时，上述根据所述第一响应消息向所述远端设备发送通信响应，包括：中继设备将安全参数通过通信响应发送给所述远端设备，以使远端设备根据安全参数生成用于保护远端设备和中继设备之间通信安全的密钥。
中继设备接收到密钥和生成密钥所需的安全参数后，则其自己保存该密钥，并且通过通信响应的形式将生成密钥所需的安全参数发送给远端设备，这样远端设备则可根据该安全参数自己生成保护远端设备和中继设备之间通信安全的密钥。如果远端设备侧的密钥与中继设备侧的密钥一致，则表明远端设备和中继设备之间的认证和授权检查成功，远端设备可以通过中继设备发送数据到网络。
本申请实施例第四方面提供一种授权验证方法，该方法是从网络侧设备的角度描述，该网络侧设备可以是中继设备的移动管理实体，也可以是远端设备的移动管理实体，还可以是近距离功能实体，该方法包括：网络侧设备接收中继设备发送的包括远端设备的标识的第一请求消息，根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证，并在判断该关联关系验证通过后，向中继设备发送第一响应消息。
当远端设备的移动管理实体和中继设备的移动管理实体为同一个移动管理实体时，可以将上述远端设备的移动管理实体和中继设备的移动管理实体称为网络侧设备，也即，本实施例中的网络侧设备可通过远端设备的移动管理实体、中继设备的移动管理实体其中的任意一个实现。当然，在一实施例中，该网络侧设备也可通过近距离功能实体实现。
可选的，上述网络侧设备根据所述第一请求消息，触发对所述远端设备和中继设备的关联关系的验证，包括：所述网络侧设备根据第一请求消息，获取第一授权信息，并根据远端设备的标识、中继设备的标识以及第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。其中，网络侧设备根据第一请求消息，获取第一授权信息，包括：在中继设备、远端设备成功注册到网络之后，网络侧设备从用户数据管理实体和/或近距离功能实体获取第一授权信息并存储在远端设备上下文信息中和/或中继设备上下文信息中；然后，网络侧设备根据第一请求消息中的远端设备标识和/或中继设备标识查找获取第一授权信息。
在一种实施例中，当该网络侧设备为中继设备的移动管理实体时，该网络侧设备在中继设备成功注册到网络之后，根据中继设备的标识从用户数据管理实体和/或近距离功能实体获取第一授权信息，此时，第一授权信息指的是中继设备的授权信息。
在另一种实施例中，当该网络侧设备为远端设备的移动管理实体时，该网络侧设备在远端设备成功注册到网络之后，根据远端设备的标识从用户数据管理实体和/或近距离功能实体获取该第一授权信息，此时，第一授权信息指的是远端设备的授权信息。
在再一种实施例中，当该网络侧设备为近距离功能实体时，该网络侧设备在远端设备、中继设备成功注册到网络之后，根据中继设备的标识、远端设备的标识分别从用户数据管理实体和/或近距离功能实体获取第一授权信息，此时，第一授权信息既包括远端设备的授权信息，也包括中继设备的授权信息。
可选的，若第一请求消息，还包括：中继服务码；则网络侧设备根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：网络侧设备根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息，验证是否允许远端设备通过中继设备接入网络。
可选的，网络侧设备根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：网络侧设备向第一移动管理实体发送第二请求消息，以使第一移动管理实体根据第二请求消息验证是否允许远端设备通过中继设备接入网络；此时，网络侧设备为中继设备的移动管理实体时，第一移动管理实体为近距离功能实体或远端设备的移动管理实体；或者网络侧设备为远端设备的移动管理实体时，第一移动管理实体为近距离功能实体或中继设备的移动管理实体；或者网络侧设备为近距离功能实体时，第一移动管理实体为远端设备的移动管理实体或中继设备的移动管理实体。
可选的，在第一请求消息中包括远端设备的非接入层消息以及非接入层消息的校验码时，第二请求消息包括：远端设备的非接入层消息、非接入层消息的校验码以及远端设备的标识，则网络侧设备根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：网络侧设备向远端设备的移动管理实体发送第二请求消息，以使远端设备的移动管理实体根据第二请 求消息对远端设备进行安全处理；此时，网络侧设备为中继设备的移动管理实体，或者网络侧设备为近距离功能实体。
可选的，网络侧设备为远端设备的移动管理实体时，网络侧设备接收中继设备发送的第一请求消息，包括：网络侧设备接收中继设备通过基站转发处理的第一请求消息，该第一请求消息还包括：中继设备的标识。
可选的，第一请求消息包括远端设备的非接入层消息以及非接入层消息的校验码，网络侧设备根据第一请求消息，触发对远端设备和中继设备的关联关系的验证，包括：网络侧设备根据远端设备的标识，获取远端设备的非接入层上下文信息，并根据所述非接入层上下文信息对非接入层消息的校验码进行验证。
可选的，该授权验证方法还包括：网络侧设备向第一移动管理实体发送第二请求消息，以使第一移动管理实体根据远端设备的标识，获取远端设备的非接入层上下文信息，并根据非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥，以及将密钥和生成该密钥所需的安全参数反馈给网络侧设备，网络侧设备将密钥和生成该密钥所需的安全参数发送给中继设备，从而使中继设备将安全参数返回给远端设备，使远端设备根据安全参数生成用于保护远端设备和中继设备之间通信安全的所述密钥；此时，网络侧设备为中继设备的移动管理实体，第一移动管理实体为近距离功能实体或远端设备的移动管理实体。
可选的，该授权验证方法还包括：网络侧设备根据远端设备的标识，获取远端设备的非接入层上下文信息，并根据非接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥，以及将该密钥和生成密钥所需的安全参数反馈给中继设备的移动管理实体并转发给中继设备，以使中继设备将所述安全参数返回给远端设备，从而使远端设备根据安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥；此时，网络侧设备为远端设备的移动管理实体或者近距离功能实体。
可选的，所述密钥由所述远端设备的移动管理实体根据所述远端设备的基础安全密钥生成。
可选的，所述中继设备的移动管理实体中存储有所述中继设备的上下文信息，所述远端设备的移动管理实体中存储有所述远端设备的上下文信息， 近距离功能实体中存储有所述中继设备的上下文信息和所述远端设备的上下文信息。
可选的，该授权验证方法还包括：网络侧设备向安全功能实体发送包括远端设备的标识的密钥请求消息，以使得安全功能实体根据所述密钥请求消息，获取用于保护远端设备和中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将密钥和生成该密钥所需的安全参数反馈给网络侧设备，所述密钥请求消息，包括：所述远端设备的标识。
本申请实施例第五方面提供一种授权验证装置，所述装置包括用于执行上述第一方面以及第一方面的各种实现方式所提供的方法的模块或手段(means)。
本申请实施例第六方面提供一种授权验证装置，所述装置包括用于执行上述第二方面以及第二方面的各种实现方式所提供的方法的模块或手段(means)。
本申请实施例第七方面提供一种授权验证装置，所述装置包括用于执行上述第三方面以及第三方面的各种实现方式所提供的方法的模块或手段(means)。
本申请实施例第八方面提供一种授权验证装置，所述装置包括用于执行上述第四方面以及第四方面的各种实现方式所提供的方法的模块或手段(means)。
本申请实施例第九方面提供一种授权验证装置，所述装置包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行本申请第一方面提供的方法。
本申请实施例第十方面提供一种授权验证装置，所述装置包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行本申请第二方面提供的方法。
本申请实施例第十一方面提供一种授权验证装置，所述装置包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行本申请第三方面提供的方法。
本申请实施例第十二方面提供一种授权验证装置，所述装置包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行本 申请第四方面提供的方法。
本申请实施例第十三方面提供一种授权验证装置，包括用于执行以上第一方面的方法的至少一个处理元件(或芯片)。
本申请实施例第十四方面提供一种授权验证装置，包括用于执行以上第二方面的方法的至少一个处理元件(或芯片)。
本申请实施例第十五方面提供一种授权验证装置，包括用于执行以上第三方面的方法的至少一个处理元件(或芯片)。
本申请实施例第十六方面提供一种授权验证装置，包括用于执行以上第四方面的方法的至少一个处理元件(或芯片)。
本申请实施例第十七方面提供一种程序，该程序在被处理器执行时用于执行以上第一方面的方法。
本申请实施例第十八方面提供一种程序产品，例如计算机可读存储介质，包括第十七方面的程序。
本申请实施例第十九方面提供一种程序，该程序在被处理器执行时用于执行以上第二方面的方法。
本申请实施例第二十方面提供一种程序产品，例如计算机可读存储介质，包括第十九方面的程序。
本申请实施例第二十一方面提供一种程序，该程序在被处理器执行时用于执行以上第三方面的方法。
本申请实施例第二十二方面提供一种程序产品，例如计算机可读存储介质，包括第二十一方面的程序。
本申请实施例第二十三方面提供一种程序，该程序在被处理器执行时用于执行以上第四方面的方法。
本申请实施例第二十四方面提供一种程序产品，例如计算机可读存储介质，包括第二十三方面的程序。
在以上各个方面中，中继设备接收远端设备发送包括终端设备的标识的通信请求，并根据该通信请求，生成第一请求消息以及将第一请求消息发送给中继设备的移动管理实体，中继设备的移动管理实体接收该第一请求消息，并触发对远端设备和中继设备的关联关系的验证，可选的，以及中继设备的移动管理实体向远端设备的移动管理实体发送第二请求消息，远端设备 的移动管理实体接收该第二请求消息，并根据该第二请求消息对远端设备进行安全处理，以及在对远端设备进行安全处理后，向中继设备的移动管理实体发送的第二响应消息，中继设备的移动管理实体接收该第二响应消息，并在判断上述关联关系验证通过后生成第一响应消息，并发送给中继设备，中继设备根据该第一响应消息向远端设备发送通信响应。本申请的技术方案针对层2中继设备，设计了一套远端设备与中继设备的关联关系验证方案，避免了现有层3中继方案中所需执行的复杂繁琐的参数配置流程和授权检查流程，使得本申请的层2解决方案和现有层3解决方案相比，降低了网络配置需求、减少了网络开销、提高了验证效率。
附图说明
图1为本申请实施例提供的授权验证方法实施例一的交互图；
图2为本申请实施例提供的授权验证方法实施例二的流程图；
图3为本申请实施例提供的授权验证方法实施例三的流程图；
图4为本申请实施例提供的授权验证方法实施例四的流程图；
图5为本申请实施例提供的授权验证方法实施例五的流程图；
图6为本申请实施例提供的授权验证方法实施例六的交互图；
图7为本申请实施例提供的授权验证方法实施例七的交互图；
图8为本申请实施例提供的授权验证方法实施例八的流程图；
图9为本申请实施例提供的授权验证方法实施例九的流程图；
图10为本申请实施例提供的授权验证方法实施例十的流程图；
图11为本申请实施例提供的授权验证方法实施例十一的交互图；
图12为本申请实施例提供的授权验证方法实施例十二的交互图；
图13为本申请实施例提供的授权验证方法实施例十三的交互图；
图14为本申请实施例提供的授权验证方法实施例十四的交互图；
图15为本申请实施例提供的授权验证方法实施例十五的交互图；
图16为本申请实施例提供的一种授权验证装置的结构示意图；
图17为本申请实施例提供的另一种授权验证装置的结构示意图；
图18为本申请实施例提供的再一种授权验证装置的结构示意图；
图19为本申请实施例提供的又一种授权验证装置的结构示意图；
图20为本申请实施例提供的又一种授权验证装置的结构示意图；
图21为本申请实施例提供的又一种授权验证装置的结构示意图；
图22为本申请实施例提供的又一种授权验证装置的结构示意图；
图23为本申请实施例提供的又一种授权验证装置的结构示意图。
具体实施方式
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解：
远端设备：可以是一种无线终端，其可以指向用户提供语音和/或其他业务数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。为了降低功耗，远端设备一般通过中继设备接入到网络中。远端设备也可以称为系统、订户单元(Subscriber Unit)、订户站(Subscriber Station)、移动站(Mobile Station)、移动台(Mobile)、远程站(Remote Station)、远程终端(Remote Terminal)、接入终端(Access Terminal)、用户终端(User Terminal)、用户代理(User Agent)、用户设备(User Device or User Equipment)，在此不作限定。
中继设备：也称网络中继器，连接在远端设备与网络中间的仪器设备，可以是在无线网络层面(如PDCP层)为远端设备的网络连接提供中继的设备，也可以是连接在远端设备与网络中间的仪器设备，它可以对传输的信号进行放大并可重发，从而可以避免信号在传输过程中的衰减，有效地提高传输的可靠性。中继设备也可以被理解为在物理层面建设性地实现网络的互联设备，本申请实施例并不对中继设备的具体表现形式进行限定。
移动性管理实体(Mobile Managenment Entity，简称MME)：主要功能是支持非接入层(Non Access stratum，简称NAS)信令及其安全、跟踪区域列表的管理、分组数据网络网关(Packet Data Network Gateway，简称P-GW)和服务网关(Serving Gateway，简称S-GW)的选择、跨MME切换时进行MME的选择、在向2G/3G接入系统切换过程中进行服务GPRS支持节点(Service GPRS Support Node，简称SGSN)的选择、用户的鉴权、漫游控制以及承载管理、3GPP不同接入网络的核心网络节点之间的移动性管理，以及UE在空闲状态下可达性管理。本申请实施例中的MME可以包括中继设 备的MME、远端设备的MME，中继设备的MME指的是当前服务该中继设备的MME，远端设备的MME指的是当前服务该远端设备的MME，从功能上来说，两个MME没有区别，因此，当前服务中继设备的MME与当前服务远端设备的MME可以是同一个MME，本申请所有实施例中的涉及的MME一般指此类MME。本申请也不排除另一类MME，即，中继设备的MME指的是专门用于服务中继设备的MME，远端设备的MME指的是专门用于服务远端设备的MME，此时从功能上来说，两个MME可能有所区别；当然也可以包括集成中继设备的MME和远端设备的MME功能于一体的MME。这些MME可以用于验证是否允许远端设备通过中继设备接入网络。该MME还可以是未来5G网络中的移动性管理功能实体，如访问移动性管理功能实体(access and mobility management function，简称AMF)。
基站：又称为无线接入网(Radio Access Network，RAN)设备，是一种将终端接入到无线网络的设备，可以是全球移动通讯(Global System of Mobile communication，简称GSM)或码分多址(Code Division Multiple Access，简称CDMA)中的基站(Base Transceiver Station，简称BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，简称WCDMA)中的基站(NodeB，简称NB)，还可以是长期演进(Long Term Evolution，简称LTE)中的演进型基站(Evolutional Node B，简称eNB或eNodeB)，或者中继站或接入点，或者未来5G网络中的基站等，在此并不限定。
本申请实施例中，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本申请所有实施例中，如果当前服务中继设备的MME与当前服务远端设备的MME是同一个MME时，则两个MME之间的交互可以省略或者属于MME内部交互。
图1为本申请实施例提供的授权验证方法实施例一的交互图。本申请实施例以中继设备的移动管理实体、终端设备移动管理实体以及中继设备的交互进行说明。如图1所示，本申请实施例提供的授权验证方法可以包括如下 步骤：
步骤101、中继设备接收远端设备发送的通信请求。
作为一种示例，该通信请求包括：远端设备的标识。
可选的，该通信请求中还包括以下内容中的一个或几个：远端设备的非接入层消息、中继服务码(Relay service code)、第一随机数。可选的，该第一随机数是远端设备生成的，可以直接携带在通信请求中。可选地，如果存在第一随机数，所述第一随机数还可以包含在远端设备的非接入层消息中，而不是直接携带在通信请求中。
在本申请实施例中，远端设备可选为可穿戴设备(wearable device，简称WD)，该远端设备(WD)希望通过中继设备(relay)连接到网络中，从而需要在允许远端设备通过中继设备接入到网络之前，实现对中继设备和远端设备的关联关系验证。
可选的，在中继设备接收远端设备发送的通信请求之前，中继设备和远端设备需完成以下发现过程，具体的，中继设备和远端设备均需要接入到网络中获取用于发现过程的配置参数，从而根据这些配置参数实现远端设备和中继设备之间的互相发现过程。
可选的，远端设备向中继设备发送通信请求，该通信请求中至少需携带远端设备的标识。
作为一种示例，远端设备的标识可以直接包含在通信请求中。作为另一种示例，若通信请求还包含远端设备的NAS消息，则远端设备的标识也可以被远端设备封装在自己的NAS消息中，此时，通信请求中包含的远端设备的NAS消息中包括该远端设备的标识。作为再一种示例，远端设备的标识还可以同时包含在通信请求中以及通信请求中的远端设备的NAS消息中。因此，通信请求包含远端设备的标识的实现形式可以有多种，本申请实施例并不对其进行限定。
在本申请实施例中，可选地，远端设备的NAS消息中携带有MAC-I校验值，用于远端设备的MME根据远端设备的NAS安全上下文进行完整性保护，远端设备的MME可以通过验证该NAS消息的MAC-I来认证远端设备。
值得说明的是，本申请实施例所述的远端设备的标识可能包含至少两种不同的形式，其中，一种形式适用于进行授权验证，另一种形式适用于中继 设备的移动管理实体寻找远端设备的移动管理实体以及用于获取远端设备的上下文信息。例如，可选地，通信请求中的远端设备标识包括标识1，该标识1用于中继设备的移动管理实体寻找远端设备的移动管理实体；通信请求中的远端设备标识包括标识2，该标识2用于中继设备的移动管理实体或者远端设备的移动管理实体实现对中继设备和远端设备的关联关系进行授权验证；包含在远端设备的NAS消息中的远端设备标识包括标识3，标识3用于获取远端设备的上下文信息，可选地，标识1和标识3可以是同一个标识。本实施例中并没有对远端设备的标识的具体形式进行区分。
可选的，标识1和标识3可以是全球唯一临时UE标识(Globally Unique Temporary UE Identity，简称GUTI)，或国际移动用户识别码(International Mobile Subscriber Identity，简称IMSI)，或者临时识别码(Temporary Mobile Subscriber Identity，简称TMSI)等。可选地，标识2可以是近距离功能实体分配的标识。
步骤102、中继设备根据通信请求，生成第一请求消息。
该第一请求消息包括：远端设备的标识。可选的，该第一请求消息为中继设备(relay)和移动管理实体(MME)之间的非接入层(NAS)消息。
作为一种示例，中继设备接收到远端设备的通信请求之后，可以将该通信请求的相关内容封装到自己的第一请求消息中。
作为另一种示例，中继设备还可以既将通信请求的相关内容封装到自己的第一请求消息中，也将验证远端设备与中继设备的关联关系所需要的其他相关参数整合到第一请求消息中，例如，可选地，该第一请求消息中还可以包括中继设备的标识。
具体的，封装到第一请求消息中的相关内容，包括步骤101中的远端设备的标识，还可能包括步骤101中的远端设备的NAS消息。可选的，在步骤101中的通信请求还包括中继服务码(Relay service code)或者第一随机数时，封装到第一请求消息中的相关内容还包括该中继服务码或者第一随机数。中继服务码用于表征远端设备要请求的业务类型，用于远端设备和中继设备关联关系的验证。第一随机数是远端设备生成的，用于后续密钥的生成，关于密钥的具体生成方式参见后续步骤502中的记载。其中，第一随机数的携带方式可以参考步骤101中所述的方式。
步骤103、中继设备将该第一请求消息发送给中继设备的移动管理实体。
当中继设备根据通信请求生成第一请求消息后，便发送给中继设备的移动管理实体，由中继设备的移动管理实体根据第一请求消息的内容触发对远端设备和中继设备的关联关系进行验证。
步骤104、中继设备的移动管理实体接收第一请求消息。
该第一请求消息中的内容参见步骤102中的记载。
步骤105、中继设备的移动管理实体根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证。
可选的，在本申请的一实施例中，当中继设备的移动管理实体接收到中继设备发送的第一请求消息之后，可以执行如下多种操作中的任意一种。第一种操作：中继设备的移动管理实体根据第一请求消息中的内容触发自身对远端设备和中继设备的关联关系的验证；第二种操作：中继设备的移动管理实体将第一请求消息中内容发送给远端设备的移动管理实体或者近距离功能实体，以使远端设备的移动管理实体或者近距离功能实体进行进一步的安全处理；第三种操作：执行第一种操作和第二种操作对应的内容。
可选地，中继设备的移动管理实体在按照第三种操作执行时，本申请实施例并不限定第一种操作和第二种操作的执行顺序。例如，第一种操作中继设备的移动管理实体根据第一请求消息中的内容触发自身对远端设备和中继设备的关联关系的验证，可以放在如下步骤105d中执行，可选地，远端设备和中继设备的关联关系的验证可能用到如下步骤105c步骤中返回的信息，如远端设备的标识IMSI。
步骤106、中继设备的移动管理实体在判断关联关系验证通过后，生成第一响应消息，并向中继设备发送该第一响应消息。
可选的，在本申请实施例中，中继设备的移动管理实体判断关联关系验证通过，具体可以包括如下至少一种：中继设备的移动管理实体自身判断得出远端设备和中继设备的关联关系验证通过、远端设备的移动管理实体判断远端设备和中继设备的关联关系验证通过，或者近距离功能实体判断得出远端设备和中继设备的关联关系验证通过。
作为一种示例，当远端设备和中继设备的关联关系验证仅需要在中继设 备的移动管理实体、远端设备的移动管理实体或者近距离功能实体中的任意一处验证，并且关联关系验证通过时，会生成第一响应消息，并将该第一响应消息反馈给中继设备。
作为另一种示例，当远端设备和中继设备的关联关系验证需要在中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体中的任意两处、或者三处验证时，只有对应的两处或者三处均验证通过，才表明关联关系验证通过，此时，中继设备的移动管理实体生成第一响应消息，并反馈给中继设备。
步骤107、中继设备接收该第一响应消息。
作为一种示例，在远端设备和中继设备的关联关系验证通过时，该第一响应消息中可以携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数。
作为另一种示例，在远端设备和中继设备的关联关系验证通过时，但远端设备的NAS消息完整性校验没有通过，或者远端设备的NAS消息没有完整性保护，或者第一请求消息和第二请求消息没有携带远端设备的NAS消息，那么MME(中继设备的MME或者远端设备的MME)则向安全功能实体发送密钥请求消息，以获取用于保护远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数。
作为再一种示例，在远端设备和中继设备的关联关系验证失败时，该第一响应消息中可以包含失败的原因等参数。
值得说明的是，上述关于第一响应消息的具体包含内容，本申请实施例并不对其进行限定。
步骤108、中继设备根据第一响应消息向远端设备发送通信响应。
可选的，中继设备会根据接收到的第一响应消息将远端设备与中继设备之间的关联关系验证的结果生成通信响应发送给终端设备，该通信响应作为上述通信请求的结果一种表现形式。可选地，若第一响应消息中携带有用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数，则通信响应中包含生成密钥所需的安全参数，以使得远端设备同样生成用于保护远端设备和中继设备两者通信安全的密钥。
当通信响应表征验证关系通过，且远端设备生成了用于保护远端设备和 中继设备两者通信安全的密钥时，远端设备则可通过该中继设备连接到网络中。
可选的，在本申请的一实施例中，上述步骤105，可通过步骤105a实现，相应的，本申请实施例的授权验证方法，还包括步骤105b～步骤105d。
步骤105a、中继设备的移动管理实体向远端设备的移动管理实体发送第二请求消息。
该第二请求消息包括：远端设备的标识。
作为一种示例，在中继设备的移动管理实体触发对远端设备和中继设备的关联关系的验证时，还可根据第一请求消息中远端设备的标识向远端设备的移动管理实体发送第二请求消息，以使远端设备的移动管理实体根据第二请求消息对远端设备进行安全处理或者对远端设备与中继设备的关联关系进行进一步验证处理。
可选地，该第二请求消息还包括：中继设备的标识。该中继设备的标识和远端设备的标识用于远端设备的MME实现对中继设备和远端设备的关联关系进行授权验证。
可选的，该第二请求消息中中继设备的标识可以通过如下方式中的任意一种方式获取到：其一，中继设备的移动管理实体可以从其内部存储的中继设备上下文信息中获取，进而将其封装到第二请求消息中；其二，当第一请求消息中包含中继设备的标识时，中继设备的移动管理实体也可以从上报的第一请求消息中获取到。关于中继设备的标识的具体获取方式本申请实施例并不具体限定。
可选地，该第二请求消息还包括：从第一请求消息中获取的远端设备的NAS消息。可选的，该第二请求消息还包括远端设备生成的第一随机数。其中，NAS消息的内容，以及第一随机数的携带方式可以参考步骤101中的所述方法。
可选地，第一请求消息中包括远端设备的标识，该远端设备的标识用于中继设备的MME寻找远端设备的MME，具体的，中继设备的MME根据该远端设备的标识确定远端设备的MME，进而向其发送第二请求消息。此处，远端设备的标识的具体体现形式参见步骤101中的记载，此处不再赘述，
步骤105b、远端设备的移动管理实体接收第二请求消息，并根据第二请求消息对远端设备进行安全处理。
可选的，如果第二请求消息包括：从第一请求消息中获取的远端设备的非接入层(NAS)消息，该安全处理可以包括对远端设备的NAS消息的完整性验证。
可选地，该安全处理也可以包括根据第二请求消息中的中继设备的标识和/或远端设备的标识，对远端设备和中继设备的关联关系的验证。
可选地，远端设备的MME还可以根据第二请求消息中远端设备的标识，获取远端设备的非接入层上下文信息，并根据该非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥。可选的，该标识可以是GUTI，或TMSI，或IMSI等；具体的，可参见步骤101中的记载，此处不再赘述。关于远端设备的标识的获取方式，远端设备的MME可以直接从第二请求消息中直接获取，或者从第二请求消息中携带的远端设备的NAS消息中获取。
可选地，在远端设备和中继设备的关联关系验证通过时，但远端设备的NAS消息完整性校验没有通过，或者远端设备的NAS消息没有完整性保护，或者第一请求消息和第二请求消息没有携带远端设备的NAS消息，那么远端设备的MME则向安全功能实体发送密钥请求消息，以获取用于保护远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数。
可选地，在步骤105b中，远端设备的MME生成的(第一)密钥可以直接作为PC5口通信密钥用于PC5口的通信保护，即Relay根据接收到的(第一)密钥直接对通信响应进行安全保护(如，完整性保护)，则相应地，WD也根据接收到的生成密钥所需的安全参数生成(第一)密钥，即PC5口通信密钥，然后对通信响应消息进行安全验证(如，完整性验证)。可选地，PC5口通信密钥也可以为Relay根据步骤105c中远端设备的MME所生成的(第一)密钥再进一步生成的(第二)密钥，即Relay根据接收到的(第一)密钥生成(第二)密钥，作为PC5口通信密钥，对通信响应进行安全保护(如，完整性保护)，则相应地，WD根据接收到的生成密钥所需的安全参数生成(第一)密钥后，再根据(第一)密钥生成(第二)密钥，该(第二)密钥即为PC5口通信密钥，然后对通信响应消息进行安全验证(如，完整性验证)。
步骤105c、远端设备的移动管理实体在对远端设备进行安全处理后，向中继设备的移动管理实体发送的第二响应消息。
远端设备的移动管理实体根据第二请求消息的内容对远端设备进行安全处理后，根据安全处理的结果生成第二响应消息，并将该第二响应消息反馈给中继设备的移动管理实体。
可选的，当远端设备的MME生成了用于保护远端设备和中继设备之间通信安全的密钥时，该第二响应消息中包含有密钥和生成该密钥所需的安全参数。
可选的，中继设备的移动管理实体接收的密钥和生成密钥所需的安全参数相当于第二响应消息内容的一种表现形式。可选的，该第二响应消息可以包含远端设备的移动管理实体生成的非接入层消息。可选地，该第二响应消息中的非接入层消息使用远端设备的NAS安全上下文进行完整性保护，并通过中继设备的移动管理实体发送给中继设备进而发送给远端设备，以使得远端设备通过对所述非接入层消息的完整性验证来认证网络。可选地，所述密钥生成参数可以包含在所述非接入层消息中。
步骤105d、中继设备的移动管理实体接收该第二响应消息。
本申请实施例提供的授权验证方法，中继设备接收远端设备发送的通信请求，该通信请求中包括终端设备的标识，并根据该通信请求，生成第一请求消息以及将第一请求消息发送给中继设备的移动管理实体，中继设备的移动管理实体接收该第一请求消息，并触发对远端设备和中继设备的关联关系的验证，以及向远端设备的移动管理实体发送第二请求消息，远端设备的移动管理实体接收该第二请求消息，并根据该第二请求消息对远端设备进行安全处理，以及在对远端设备进行安全处理后，向中继设备的移动管理实体发送的第二响应消息，中继设备的移动管理实体接收该第二响应消息，并在判断上述关联关系验证通过后生成第一响应消息，并发送给中继设备，中继设备根据该第一响应消息向远端设备发送通信响应。本申请的技术方案，针对层2中继设备，设计了一套远端设备与中继设备的关联关系验证方案，避免了现有层3中继方案中所需执行的复杂繁琐的参数配置流程和授权检查流程，使得本申请的层2解决方案和现有层3解决方案相比，降低了网络配置需求、减少了网络开销、提高了验证效率。
在图1所示实施例的基础上，图2为本申请实施例提供的授权验证方法实施例二的流程图。如图2所示，在本申请实施例提供的授权验证方法中，上述步骤105(中继设备的移动管理实体根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)还可包括如下步骤：
步骤201、中继设备的移动管理实体根据第一请求消息获取第一授权信息。
具体的，当中继设备的移动管理实体自身来验证远端设备和中继设备的关联关系时，其需要首先获取中继设备的上下文，从上下文中获取与该中继设备有授权关系的远端设备列表，即第一授权信息。
可选的，作为一种示例，中继设备的移动管理实体在中继设备成功注册到网络之后，根据中继设备的标识从用户数据管理实体和/或近距离功能实体获取该第一授权信息。
在本实施例中，当中继设备成功注册到网络之后，网络中用户数据管理实体和/或近距离功能实体中均存储有中继设备与远端设备相关的第一授权信息。对于用户数据管理实体中的中继设备与远端设备相关的第一授权信息，中继设备的移动管理实体直接从用户数据管理实体(例如，归属用户服务器(Home Subscriber Server，简称HSS)，或者，5G系统中的用户数据管理实体(User data manangement，简称UDM))获取上述第一授权信息。而对于中继设备的移动管理实体从近距离功能实体获取该第一授权信息的方式，可以为：当中继设备的移动管理实体可直接与近距离功能实体通信时，即两者之间存在直接接口，中继设备的移动管理实体直接从近距离功能实体获取上述第一授权信息；而当中继设备的移动管理实体不能直接与近距离功能实体通信时，即两者之间不存在直接接口，则近距离功能实体通过HSS将上述第一授权信息发送给中继设备的移动管理实体。
步骤202、中继设备的移动管理实体根据远端设备的标识、中继设备的标识以及上述第一授权信息，验证是否允许远端设备通过该中继设备接入网络。
在关联关系验证之前，中继设备的移动管理实体首先获取中继设备的标识。关于中继设备的标识的获取方式，具体可参见上述步骤105a中记载， 即，可选的，中继设备的移动管理实体可以从其内部存储列表中获取或者中继设备的移动管理实体从上报的第一请求消息中获取，此处不再赘述。
当中继设备的移动管理实体获知远端设备的标识、中继设备的标识以及上述第一授权信息后，判断该第一授权信息中是否包含中继设备与远端设备的关联关系，当该第一授权信息中包含中继设备与远端设备的关联关系时，表明允许该远端设备通过该中继设备接入网络，否则，不允许该远端设备通过该中继设备接入网络。
本申请实施例提供的授权验证方法，当中继设备的移动管理实体根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证时，可根据第一请求消息获取第一授权信息，进而根据远端设备的标识、中继设备的标识以及上述第一授权信息，验证是否允许远端设备通过该中继设备接入网络。这样关联关系验证方法简单，容易实现。
可选的，在图1所示实施例的基础上，作为一种示例，当第一请求消息，还包括：中继服务码时，上述步骤105可通过如下可能实现方式实现，具体如下：
中继设备的移动管理实体根据第一请求消息获取第一授权信息，并根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息，验证是否允许该远端设备通过中继设备接入网络。此时，第一授权信息为与中继设备有授权关系的远端设备以及对应的中继服务码的关系列表。
当远端设备发送给中继设备的通信请求中还包括中继服务码时，中继设备整合生成的第一请求消息中也包括中继服务码，该中继服务码用于表征远端设备要请求的业务类型，不同的中继服务码对应不同的业务类型，所以，在本实施例中，中继设备的移动管理实体验证远端设备与中继设备的关联关系时，还依据中继服务码。具体的，中继设备的移动管理实体根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息，验证是否允许该远端设备通过中继设备接入网络。
实际上，该步骤是对图2所示实施例的进一步限定，只是判定条件增加了中继服务码。对于第一授权信息的获取方式参见步骤201中的记载，对于中继设备的标识的获取方式参见步骤105a中的记载，此处不再赘述。
可选的，在上述实施例的基础上，本申请实施例提供的授权验证方法，还包括如下步骤。
中继设备的移动管理实体向近距离功能实体发送第三请求消息，以使近距离功能实体根据该第三请求消息验证是否允许远端设备通过中继设备接入网络。
其中，第三请求消息包括：远端设备的标识、中继设备的标识。
作为一种示例，关于终端设备的移动管理实体触发对远端设备和中继设备的关联关系验证的实现方式，除了中继设备的移动管理实体可自身进行验证、以及向远端设备的移动管理实体发送第二请求消息，以使该远端设备的移动管理实体验证外，中继设备的移动管理实体还可向近距离功能实体发送第三请求消息，以使该近距离功能实体进行验证。
值得说明的是，该第三请求消息中至少包括远端设备的标识、中继设备的标识。可选的，第三请求消息中远端设备的标识、中继设备的标识可以从上报的第一请求消息中获取到。可选的，当通信请求中包括中继服务码时，第一请求消息、第二请求消息以及第三请求消息中均可能包括中继服务码。可选的，中继服务码用于表征远端设备要请求的业务类型，参与到远端设备和中继设备关联关系的验证中。
进一步的，在上述任一实施例的基础上，图3为本申请实施例提供的授权验证方法实施例三的流程图。如图3所示，本申请实施例提供的授权验证方法还包括如下步骤：
步骤301、中继设备的移动管理实体向安全功能实体发送密钥请求消息，以使得该安全功能实体根据密钥请求消息，获取用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数，并将密钥和生成密钥所需的安全参数反馈给中继设备的移动管理实体。
该所述密钥请求消息，包括：远端设备的标识。
步骤302、中继设备的移动管理实体将密钥和生成该密钥所需的安全参数发送给中继设备。
作为一种示例，当中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体对远端设备和中继设备关联关系的验证通过时，但中继 设备的移动管理实体接收到的第二响应消息中未携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数，那么中继设备的移动管理实体向安全功能实体发送密钥请求消息，安全功能实体则根据该密钥请求消息中远端设备的标识，查找并获取用于保护远端设备和中继设备之间通信安全的密钥和生成该密钥所需的安全参数，以及将该密钥和生成密钥所需的安全参数反馈给中继设备的移动管理实体，最后中继设备的移动管理实体再将密钥和生成该密钥所需的安全参数反馈给中继设备，以使中继设备对该密钥和安全参数进行相应处理。
这样，即使中继设备的移动管理实体接收到的第二响应消息中未携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数，中继设备也能获取到用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数，从而保证远端设备可通过该中继设备接入网络。
在图1所示实施例的基础上，图4为本申请实施例提供的授权验证方法实施例四的流程图。如图4所示，在本申请实施例提供的授权验证方法中，上述步骤105b(远端设备的移动管理实体接收第二请求消息，并根据第二请求消息对远端设备进行安全处理)可具体包括如下步骤：
步骤401、远端设备的移动管理实体根据第二请求消息获取第二授权信息。
具体的，远端设备的移动管理实体在远端设备成功注册到网络之后，根据远端设备的标识从用户数据管理实体和/或近距离功能实体获取第二授权信息。
本步骤与上述步骤201类似，区别在于步骤201用于获取与该中继设备有授权关系的远端设备列表，即第一授权信息，而本步骤用于获取与该远端设备有授权关系的中继设备列表，即第二授权信息。类似的，当远端设备成功注册到网络之后，网络中用户数据管理实体和/或近距离功能实体中均存储有远端设备的与中继设备相关的第二授权信息。对于用户数据管理实体中的中继设备与远端设备相关的第二授权信息，远端设备的移动管理实体直接从用户数据管理实体获取上述第二授权信息。而对于远端设备的移动管理实 体从近距离功能实体获取该第二授权信息的方式，可以为：在远端设备的移动管理实体与近距离功能实体之间存在直接接口时，远端设备的移动管理实体直接从近距离功能实体获取上述第二授权信息；而当远端设备的移动管理实体与近距离功能实体通信之间不存在直接接口时，则远端设备的移动管理实体通过HSS从近距离功能实体中获取该第二授权信息。
步骤402、远端设备的移动管理实体根据远端设备的标识、中继设备的标识以及第二授权信息，验证是否允许远端设备通过中继设备接入网络。
与上述步骤202类似，远端设备的移动管理实体在验证远端设备和中继设备的关联关系时，远端设备的移动管理实体根据远端设备的标识、中继设备的标识以及获取的第二授权信息，判断该第二授权信息中是否包含远端设备与中继设备的关联关系。当第二授权信息中包含远端设备与中继设备的关联关系时，表明允许该远端设备通过该中继设备接入网络，否则，不允许该远端设备通过该中继设备接入网络。
作为一种示例，在第二请求消息，还包括：中继服务码时，上述步骤105b(远端设备的移动管理实体接收第二请求消息，并根据第二请求消息对远端设备进行安全处理)的具体实现方式如下：
远端设备的移动管理实体根据远端设备的标识、中继设备的标识、中继服务码以及第二授权信息，验证是否允许远端设备通过中继设备接入网络。此时，第二授权信息为与远端设备有授权关系的中继设备以及对应的中继服务码的关系列表。
该步骤是对上述步骤402的进一步说明，判定条件增加了中继服务码，即增加了远端设备请求业务的业务类型，关于具体的判定方式与中继设备的移动管理实体根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息对远端设备和中继设备的关联关系进行验证的方式类似，此处不再赘述。
可选的，如图4所示，在本申请实施例提供的授权验证方法中，上述步骤105b还包括如下步骤：
步骤403：远端设备的移动管理实体根据第二请求消息中的远端设备的标识，获取远端设备的非接入层上下文信息，并根据非接入层上下文信息对远端设备的非接入层消息的校验码进行验证。
其中，第二请求消息包括：远端设备的非接入层消息、非接入层消息的校验码。
在本实施例中，在第一请求消息还包括：远端设备的非接入层消息、非接入层消息的校验码时，第二请求消息中也包括：远端设备的非接入层消息、非接入层消息的校验码。此时，远端设备的移动管理实体还可对远端设备的非接入层消息进行验证，具体的是根据远端设备的非接入层上下文信息对远端设备的非接入层消息的校验码进行验证。
值得说明的是，上述步骤401、步骤402和步骤403的执行均是远端设备的移动管理实体对远端设备进行安全处理的一种可选方式，也即，在一实施例中，远端设备的移动管理实体可以执行步骤401、步骤402和步骤403中的一个或多个，而且，在执行多个步骤时，本申请实施例也不限定每个步骤的执行顺序。
本申请实施例提供的授权验证方法，远端设备的移动管理实体不仅根据第二请求消息获取第二授权信息，还在第二请求消息还包括中继服务码时，根据远端设备的标识、中继设备的标识、中继服务码以及第二授权信息，验证是否允许远端设备通过中继设备接入网络，此外，还根据第二请求消息中的远端设备的标识，获取远端设备的非接入层上下文信息，并根据非接入层上下文信息对远端设备的非接入层消息的校验码进行验证，这样通过检查非接入层消息的完整性从而完成远端设备和中继设备的安全认证。
进一步的，在上述实施例的基础上，图5为本申请实施例提供的授权验证方法实施例五的流程图。如图5所示，在本申请实施例提供的授权验证方法中，还包括：
步骤501、远端设备的移动管理实体根据第二请求消息中远端设备的标识，获取远端设备的非接入层上下文信息。
在本实施例中，为了保证远端设备与中继设备的通信安全，远端设备的移动管理实体根据需要通信的远端设备的标识获取该远端设备的非接入层上下文消息，该非接入层上下文消息中存储有生成密钥所需的安全参数。
步骤502、远端设备的移动管理实体根据该非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥。
为了实现远端设备和中继设备的通信安全，远端设备的移动管理实体可根据该非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥。可选的，在远端设备发送的通信请求中附带第一随机数时，远端设备的移动管理实体将第一随机数作为生成该密钥的输入参数。其中，第一随机数是远端设备生成的。可选地，在远端设备的移动管理实体生成第二随机数时，远端设备的移动管理实体将第二随机数作为生成该密钥的输入参数。可选的，第一随机数是被封装在随通信请求由远端设备发送给中继设备，随后被中继设备封装到第一请求消息中发送给中继设备的移动管理实体，最后被中继设备的移动管理实体通过第二请求消息发送给远端设备的移动管理实体。
可选地，远端设备的移动管理实体根据远端设备的标识获取远端设备NAS消息的安全上下文，然后基于NAS消息的安全上下文生成用于保护远端设备和中继设备之间通信安全的密钥，即，密钥生成参数为远端设备NAS消息的安全上下文中的参数。可选地，进一步地，生成密钥所需的安全参数可以为远端设备NAS消息的安全上下文中的密钥Kasme。可选地，生成密钥所需的安全参数还可以包括其它参数，比如，MME-WD生成的第二随机数，和/或WD生成的第一随机数。
步骤503、远端设备的移动管理实体将该密钥和生成密钥所需的安全参数发送给中继设备的移动管理实体。
具体的，由于远端设备的移动管理实体与中继设备之间一般不直接通信，所以，当远端设备的移动管理实体中生成用于保护远端设备和中继设备之间通信安全的密钥之后，需要将该密钥和生成密钥所需的安全参数发送给中继设备的移动管理实体，进而使其发送给中继设备。可选的，由于第一随机数是远端设备自己生成的，其可后续生成密钥时不需获取，所以，本申请实施例中所述的生成密钥所需的安全参数主要包括第二随机数，且该第二随机数被封装在远端设备的移动管理实体的非接入层消息中。
相应的，在中继设备的移动管理实体和中继设备侧，均还需要执行相应的接收操作。具体参照步骤504所示的内容。
步骤504、中继设备的移动管理实体接收远端设备的移动管理实体发送的密钥和生成密钥所需的安全参数。
可选的，中继设备的移动管理实体接收的密钥和生成密钥所需的安全参数相当于第二响应消息内容的一种表现形式。可选的，该第二响应消息可以包含远端设备的移动管理实体生成的非接入层消息。可选地，该第二响应消息中的非接入层消息使用远端设备的NAS安全上下文进行完整性保护，并通过中继设备的移动管理实体发送给中继设备进而发送给远端设备，以使得远端设备通过对所述非接入层消息的完整性验证来认证网络。可选地，所述密钥生成参数可以包含在所述非接入层消息中。
步骤505、中继设备的移动管理实体将密钥和生成该密钥所需的安全参数发送给中继设备。
远端设备想要通过中继设备接入到网络中，远端设备和中继设备需要具有保护两者之间通信的密钥，所以，中继设备的移动管理实体还需要将接收到的密钥和生成该密钥所需的安全参数发送给中继设备，以使中继设备持有该密钥和生成该密钥的所需的安全参数。
步骤506、中继设备接收用于保护该远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数。
相应的，上述步骤108可替换为步骤507：
步骤507：中继设备将安全参数通过通信响应发送给远端设备，以使远端设备根据安全参数生成用于保护远端设备和中继设备之间通信安全的密钥。
当中继设备接收到密钥和生成密钥所需的安全参数后，则其自己保存该密钥，并且通过通信响应的形式将生成密钥所需的安全参数发送给远端设备，这样远端设备则可根据该安全参数自己生成保护远端设备和中继设备之间通信安全的密钥。如果远端设备侧的密钥与中继设备侧的密钥一致，则表明远端设备和中继设备之间的认证和授权检查成功，远端设备可以通过中继设备发送数据到网络。
本申请实施例提供的授权验证方法，远端设备的移动管理实体根据第二请求消息中远端设备的标识，生成用于保护远端设备和中继设备之间通信安全的密钥，并将该密钥和生成密钥所需的安全参数发送给中继设备的移动管理实体，中继设备的移动管理实体将接收到的密钥和生成该密钥所需的安全参数发送给中继设备，中继设备再将安全参数通过通信响应发送给远端设 备，以使远端设备根据安全参数生成用于保护远端设备和中继设备之间通信安全的密钥，这样远端设备在通过中继设备接入网络时，使可通过利用密钥保护短距离通信的安全，安全性高。
可选的，在本申请实施例提供的授权验证请求中，当中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体对远端设备和中继设备的关联关系验证通过，但远端设备的移动管理实体并没有执行上述步骤502中生成密钥的操作，也即当远端设备发送给中继设备的通信请求中不携带远端设备的NAS消息，或者远端设备发送给中继设备的通信请求中携带远端设备的NAS消息但该NAS消息的完整性校验失败，或者远端设备发送给中继设备的通信请求中携带远端设备的NAS消息没有完整性保护，那么远端设备的移动管理实体还可执行如下操作：
远端设备的移动管理实体向安全功能实体发送密钥请求消息，以使得安全功能实体根据密钥请求消息，获取用于保护远端设备和中继设备之间通信安全的密钥和生成该密钥所需的安全参数，并将其反馈给远端设备的移动管理实体。
其中，密钥请求消息，包括：远端设备标识。
该步骤与上述图3所示实施例中中继设备的移动管理实体向安全功能实体发送密钥请求消息，以获取保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数的步骤类似，此处不再赘述。
结合以上实施例，下述实施例对授权验证方法的完整流程进行说明。在下图中远端设备以可穿戴设备(WD)、中继设备(Relay)、远端设备的移动管理实体(MME-WD)、中继设备的移动管理实体(MME-relay)、基站(eNB)、归属用户服务器(Home Subscriber Server，简称HSS)以及近距离功能实体(ProSe Function，简称PF)等进行说明。
图6为本申请实施例提供的授权验证方法实施例六的交互图。如图6所示，本申请实施例提供的授权验证方法，包括：
步骤601、WD和Relay成功注册到网络。
步骤602、WD向Relay发送通信请求。
该通信请求中包含远端设备的NAS消息，关于通信请求中的其他内容参照图1所示实施例中步骤101的记载，此处不再赘述。
步骤603、Relay生成了第一请求消息，并将该第一请求消息发给MME-relay。
具体的，Relay将WD的通信请求中的内容封装到自己的NAS消息中，即生成了第一请求消息。可选的，该第一请求消息为中继设备(relay)和移动管理实体(MME)之间的NAS消息。
步骤604、MME-relay根据该第一请求消息验证Relay和WD的关联关系。
可选的，当MME-relay接收到Relay发送的第一请求消息之后，可以执行如下多种操作中的任意一种或几种。第一种操作：MME-relay根据第一请求消息中的内容触发自身对Relay和WD的关联关系的验证；第二种操作：MME-relay将第一请求消息中内容发送给MME-WD或者PF，以使MME-WD或者PF进行进一步的安全处理；第三种操作：执行第一种操作和第二种操作对应的内容。
对于MME-relay根据该第一请求消息验证Relay和WD的关联关系的具体实现参见图1所示实施例中步骤105中的记载，此处不再赘述。
步骤605、MME-relay向MME-WD发送第二请求消息。
关于第二请求消息中的内容参见图1所示实施例中步骤105a的记载，此处不再赘述。
其中，MME-relay可以根据第一请求消息中携带的WD ID找到对应的MME-WD。
步骤606、MME-WD验证第二请求消息的完整性，对Relay和WD的关联关系进行验证，生成密钥。
可选的，MME-WD接收到第二请求消息之后，可以执行如下操作中的一种或几种：验证第二请求消息的完整性、对Relay和WD的关联关系进行验证、生成密钥。该密钥是用于保护远端设备和中继设备之间通信安全的密钥。
其中，该密钥可以是PC5口通信密钥，生成密钥所需的安全参数包括：第一随机数(可选的)、MME-WD生成的第二随机数(可选的)、基础密钥(例如，Kasme)以及中继服务码(Relay service code)(可选的)，可选的，第二随机数封装在第二NAS消息中最终返回给WD。关于密钥生成的具体操 作参见图5所示实施例中的步骤502，此处不再赘述。
步骤607、MME-WD将密钥和生成密钥所需的安全参数返回给MME-relay。
可选的，在MME-WD生成用于保护远端设备和中继设备之间通信安全的密钥时，MME-WD则将其返回给MME-relay。或者在MME-WD对Relay和WD的关联关系验证时，将验证后的结果反馈给MME-relay。
可选的，生成密钥所需的安全参数主要指远端设备的移动管理实体生成的第二随机数。此时，可选地，MME-WD将该第二随机数封装在自己的NAS消息中发送给MME-relay。
步骤608、MME-relay通过第一响应消息将密钥和生成密钥所需的安全参数返回给relay。
步骤609、relay接收该密钥和生成密钥所需的安全参数，将生成密钥所需的安全参数通过通信响应发给WD。
当relay接收到密钥(比如，PC5通信密钥)和生成密钥所需的安全参数，则表明对WD和relay的认证和授权通过，WD可以通过relay进行业务。
步骤610、WD对通信响应进行完整性验证，根据生成密钥所需的安全参数生成密钥。
可选地，通信响应中包括远端设备的移动性管理实体生成的第二NAS消息，则具体的，WD对通信响应中的第二NAS消息进行完整性验证。
可选地，在步骤606中，MME-WD生成的(第一)密钥可以直接作为PC5口通信密钥用于PC5口的通信保护，即Relay根据接收到的(第一)密钥直接对通信响应进行安全保护(如，完整性保护)，则相应地，WD也根据接收到的生成密钥所需的安全参数生成(第一)密钥，即PC5口通信密钥，然后对通信响应消息进行安全验证(如，完整性验证)。可选地，PC5口通信密钥也可以为Relay根据步骤606中MME-WD所生成的(第一)密钥再进一步生成的(第二)密钥，即Relay根据接收到的(第一)密钥生成(第二)密钥，作为PC5口通信密钥，对通信响应进行安全保护(如，完整性保护)，则相应地，WD根据接收到的生成密钥所需的安全参数生成(第一)密钥后，再根据(第一)密钥生成(第二)密钥，该(第二)密钥即为PC5口通信密钥，然后对通信响应消息进行安全验证(如，完整性验证)。
可选的，关于远端设备和中继设备的关联关系可以采用好友列表或者业务类型的形式表示：
好友列表：比如，Relay ID：WD1 ID、WD2 ID、……。
业务类型：比如，WD ID：(relay service code1:service1-1,service1-2,…)；(relay service code2:service2-1,service2-2,…)；……。
值得说明的是，上述关联关系还可以是其它类型的权限，本申请实施例不作限定。
此外，本申请的授权验证方法可能还需要注意如下几点：
可选地，第一：步骤604和步骤606中的关联关系验证，可能只需要执行其中一个，也可能两处都执行。
可选地，第二：用于保护远端设备和中继设备之间通信安全的密钥是可选的，即步骤606中可能不需要生成密钥。此时，上述第一随机数和第二随机数也不需要生成及传递，但是，远端设备的NAS消息和MME-WD的NAS消息还是需要传递的，作用是通过检查远端设备的NAS消息的完整性来完成WD和relay之间的安全认证。
可选地，第三：如果用于保护远端设备和中继设备之间通信安全的密钥需要生成，可选的，WD和MME-WD之间的交互也可能不需要封装在NAS消息中，即第一随机数和WD ID不需要封装在远端设备的NAS消息中，第二随机数也不需要封装在MME-WD的NAS消息中。
可选地，第四：若WD ID不包含在通信请求中的远端设备的NAS消息中，则在步骤604和步骤605中，第一请求消息和第二请求中的远端设备的NAS消息中也不包括WD ID，此时，步骤605中，WD ID作为通信请求的一个信元。
本实施例中各步骤的实现原理参见图1至图5所示实施例中的相关记载，此处不再赘述。
图7为本申请实施例提供的授权验证方法实施例七的交互图。如图7所示，本申请实施例提供的授权验证方法与图6所示实施例类似，区别仅在于PF也可进行授权验证。可选的，如图7所示，上述图6中的步骤604可替换为步骤701～703，步骤606替换为步骤704。
步骤701、MME-relay根据第一请求消息向PF发送第三请求消息。
其中，第三请求消息包括：远端设备的标识、中继设备的标识。可选的，第三请求消息中还包括中继服务码。
步骤702、PF对Relay和WD的关联关系进行验证并生成第三响应消息。
具体的，PF根据第三请求消息对Relay和WD的关联关系进行验证。可选的，网络中用户数据管理实体和/或近距离功能实体中均存储有中继设备与远端设备相关的第一授权信息以及远端设备与中继设备相关的第二授权信息，因此，当PF接收到第三请求消息后，其根据远端设备的标识和中继设备的标识对中继设备与远端设备的关联关系进行验证。
步骤703、PF向MME-relay反馈第三响应消息。
该第三响应消息是PF验证的结果。
步骤704、MME-WD验证第二请求消息的完整性，并生成用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数。
关于MME-WD对第二请求消息完整性的验证和密钥的生成方法参见图5所示实施例中步骤501和步骤502中的记载，此处不再赘述。
值得说明的是，本申请的授权验证方法除了需要注意图6所示实施例需要注意的几点之外，还需要注意：
Relay APP ID(中继设备客户端的标识)：WD1 app ID(第一远端设备客户端的标识)、WD2 app ID、……。
可选的，图8为本申请实施例提供的授权验证方法实施例八的流程图。如图8所示，本申请实施例提供的授权验证方法，包括：
步骤801、网络侧设备接收中继设备发送的第一请求消息。
该第一请求消息包括：远端设备的标识。
步骤802、网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证。
步骤803、该网络侧设备在判断上述关联关系验证通过后，向中继设备发送第一响应消息。
值得说明的是，当上述实施例中远端设备的移动管理实体和中继设备的移动管理实体集成到同一个移动管理实体上时，可以将上述远端设备的移动管理实体和中继设备的移动管理实体称为网络侧设备，也即，本实施例中的 网络侧设备可通过远端设备的移动管理实体、中继设备的移动管理实体其中的任意一个实现。
可选的，在本申请的另一实施例中，该网络侧设备也可通过近距离功能实体实现。
在本申请实施例中，中继设备的移动管理实体根据接收到的中继设备发送的第一请求消息触发对远端设备和中继设备的关联关系的验证，具体参见图1所示实施例中步骤101至步骤106的记载，远端设备的移动管理实体对远端设备和中继设备的关联关系的验证，具体参见图1所示实施例中步骤105a至步骤105d的记载，其实现原理和技术效果与图1所示实施例中的远端设备的移动管理实体、中继设备的移动管理实体的实现方案类似，此处不再赘述。近距离功能实体对远端设备和中继设备的关联关系的验证与中继设备的移动管理实体、远端设备的验证方法类似，此处也不再赘述。
可选的，在图8所示实施例的基础上，图9为本申请实施例提供的授权验证方法实施例九的流程图。如图9所示，在本申请实施例提供的授权验证方法中，上述步骤802(网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)，包括：
步骤901、网络侧设备根据第一请求消息，获取第一授权信息。
具体的，在中继设备、远端设备成功注册到网络之后，该网络侧设备根据第一请求消息，从用户数据管理实体和/或近距离功能实体获取第一授权信息。
在一种实施例中，当该网络侧设备为中继设备的移动管理实体时，该网络侧设备在中继设备成功注册到网络之后，根据中继设备的标识从用户数据管理实体和/或近距离功能实体获取第一授权信息，此时，第一授权信息指的是中继设备的授权信息。可选的，中继设备的授权信息的具体获取方法参见步骤201中的记载，此处不再赘述。
在另一种实施例中，当该网络侧设备为远端设备的移动管理实体时，该网络侧设备在远端设备成功注册到网络之后，根据远端设备的标识从用户数据管理实体和/或近距离功能实体获取该第一授权信息，此时，第一授权信息指的是远端设备的授权信息。可选的，远端设备的授权信息的具体获取方法参见步骤401中的记载，此处不再赘述。
在再一种实施例中，当该网络侧设备为近距离功能实体时，该网络侧设备在远端设备、中继设备成功注册到网络之后，根据中继设备的标识、远端设备的标识分别从用户数据管理实体和/或近距离功能实体获取第一授权信息，此时，第一授权信息既包括远端设备的授权信息，也包括中继设备的授权信息。
步骤902、网络侧设备根据远端设备的标识、中继设备的标识以及第一授权信息，验证是否允许远端设备通过所述中继设备接入网络。
本实施例的技术方案，与图2所示实施例中中继设备验证是否允许远端设备通过中继设备接入网络的技术方案，或者与图4所示实施例中远端设备验证是否允许远端设备通过中继设备接入网络的技术方案类似，具体参见图2和图4所示实施例中的记载，此处不再赘述。
进一步的，当上述第一请求消息，还包括：中继服务码时，上述步骤802(网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)可替换为如下步骤：
网络侧设备根据远端设备的标识、中继设备的标识、中继服务码以及第一授权信息，验证是否允许远端设备通过中继设备接入网络。
可选的，在网络侧设备为中继设备的移动管理实体时，该步骤的具体实现方案参见步骤202中的记载，在网络侧设备为远端设备的移动管理实体时，该步骤的具体实现方案参见步骤402中的记载，近距离功能实体的验证方法类似，具体可参见图2和图4所示实施例中的记载，此处不再赘述。
作为一种示例，在图8所示的实施例中，上述步骤802(网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)，可包括如下步骤：
网络侧设备向第一移动管理实体发送第二请求消息，以使第一移动管理实体根据该第二请求消息验证是否允许远端设备通过中继设备接入网络。
在本实施例中，当网络侧设备通过不同方式实现时，第一移动管理实体也不相同，关于多种可能组合方式具体如下：
第一种方式：网络侧设备为中继设备的移动管理实体时，该第一移动管理实体为近距离功能实体或远端设备的移动管理实体；或者
第二种方式：网络侧设备为远端设备的移动管理实体时，该第一移动管 理实体为近距离功能实体或中继设备的移动管理实体；或者
第二种方式：网络侧设备为近距离功能实体时，第一移动管理实体为远端设备的移动管理实体或中继设备的移动管理实体。
该步骤是远端设备和中继设备的关联关系验证在中继设备的移动管理实体、远端设备的移动管理实体或者近距离功能实体中的任意两处执行时的方案，每处验证操作的均相互独立，具体验证方法参见图9所示实施例中的记载，此处不再赘述。
可选的，在本申请图8或图9中的任一实施例中，在第一请求消息中包括远端设备的非接入层消息以及非接入层消息的校验码时，第二请求消息中也包括：远端设备的非接入层消息、该非接入层消息的校验码。
相应的，上述步骤802(网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)，包括：
网络侧设备向远端设备的移动管理实体发送第二请求消息，以使远端设备的移动管理实体根据该第二请求消息对远端设备进行安全处理。
其中，该网络侧设备为中继设备的移动管理实体，或者该网络侧设备为近距离功能实体。
当网络侧设备为中继设备的移动管理实体或近距离功能实体中的任意一个时，中继设备的移动管理实体或近距离功能实体还向远端设备的移动管理实体发送第二请求消息，从而使远端设备的移动管理实体根据该第二请求消息对远端设备进行安全处理。对远端设备的安全处理参见图1所示实施例中步骤105a至步骤105d中的记载，此处不再赘述。
可选的，在本申请图8或图9中的任一实施例中，作为一种示例，若网络侧设备为远端设备的移动管理实体，则上述步骤801(网络侧设备接收中继设备发送的第一请求消息)通过如下可能实现方式实现：
网络侧设备接收中继设备通过基站转发处理的第一请求消息，该第一请求消息还包括：中继设备的标识。
在一种可行实现方式中，中继设备还可将第一请求消息发送给基站，经过基站选择对应的远端设备的移动管理实体，并通过初始远端设备信息上报远端设备的标识、中继设备的标识等相关内容。
当网络侧设备为远端设备的移动管理实体，且第一请求消息包括远端设 备的非接入层消息以及非接入层消息的校验码时，上述步骤802(网络侧设备根据该第一请求消息，触发对远端设备和中继设备的关联关系的验证)的一种可能实现方式如下：
网络侧设备根据远端设备的标识，获取该远端设备的非接入层上下文信息，并根据非接入层上下文信息对非接入层消息的校验码进行验证。
具体的，远端设备和远端设备的移动管理实体之间约定有一套完整性保护密钥和一套NAS算法、NAS消息计算器(上行和下行)，远端设备的移动管理实体将完整性保护密钥、NAS消息计算器的数值、NAS消息本身等作为NAS算法的输入，其会生成一个校验值(mac-integrity)，置于NAS消息的末尾。同理，远端设备也执行上述NAS算法的操作，也会产生一个校验值，远端设备将这两个校验值进行比较，若两者一致，则表明完整性校验通过，否则表明完整性校验未通过。
可选的，由于近距离功能实体和远端设备的移动管理实体均能够根据远端设备的标识生成用于保护远端设备和中继设备之间通信安全的密钥，那么，当网络侧设备为中继设备的移动管理实体时，将近距离功能实体和远端设备的移动管理实体上位成第一移动管理实体进行说明，故本申请实施例提供的授权验证方法，还包括如下步骤，具体参见图10所示实施例。
图10为本申请实施例提供的授权验证方法实施例十的流程图。如图10所示，本申请实施例提供的授权验证方法，还包括：
步骤1001、网络侧设备向第一移动管理实体发送第二请求消息。
步骤1002、该第一移动管理实体根据第二请求消息中远端设备的标识，获取远端设备的非接入层上下文信息，并根据该非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥。
步骤1003、第一移动管理实体将该密钥和生成密钥所需的安全参数反馈给网络侧设备。
步骤1004、网络侧设备将接收到的密钥和生成密钥所需的安全参数发送给中继设备。
步骤1005、中继设备将生成密钥所需的安全参数返回给远端设备。
步骤1006、远端设备根据接收到的安全参数生成用于保护远端设备和中继设备之间通信安全的所述密钥。
本实施例提供的授权验证方法，以第一移动管理实体(近距离功能实体或远端设备的移动管理实体)生成用于保护远端设备和中继设备之间通信安全的密钥进行说明，其实现原理与有益效果与图5所示实施例的技术方案类似，具体参见图5所示实施例，此处不再赘述。
可选的，当网络侧设备为远端设备的移动管理实体或者近距离功能实体时，其自身可执行密钥生成的方式，具体操作如下所示：
网络侧设备根据远端设备的标识，获取远端设备的非接入层上下文信息，并根据该非接入层上下文信息生成用于保护远端设备和中继设备之间通信安全的密钥，以及将密钥和生成密钥所需的安全参数反馈给中继设备的移动管理实体并转发给中继设备，以使中继设备将该安全参数返回给远端设备，进而使远端设备根据安全参数生成用于保护远端设备和中继设备之间通信安全的密钥。
其中，网络侧设备为远端设备的移动管理实体或者近距离功能实体。
可选的，上述密钥由远端设备的移动管理实体根据远端设备的基础安全密钥生成。
此外，中继设备的移动管理实体中存储有中继设备的上下文信息，远端设备的移动管理实体中存储有远端设备的上下文信息，近距离功能实体中存储有中继设备的上下文信息和远端设备的上下文信息。
进一步的，在上述各实施例的基础上，本申请实施例提供的授权验证方法，还包括：
网络侧设备向安全功能实体发送密钥请求消息，以使得该安全功能实体根据密钥请求消息，获取用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数，并将密钥和生成密钥所需的安全参数反馈给网络侧设备，该密钥请求消息，包括：远端设备的标识。
该步骤是在网络侧设备判断出远端设备和中继设备的关联关系验证通过，但网络侧设备最后得到的响应消息中未携带用于保护远端设备和中继设备两者通信安全的密钥以及生成密钥所需的安全参数，那么，其则直接向安全功能实体发送密钥请求消息，进而使安全功能实体获取用于保护远端设备和中继设备之间通信安全的密钥和生成密钥所需的安全参数，从而保证远端 设备可通过该中继设备接入网络。
下面结合上述实施例，列举详细的示例对授权验证方法进行具体说明：
与图6和图7所示实施例类似，以下各图中远端设备为可穿戴设备(WD)、中继设备(Relay)、远端设备的移动管理实体(MME-WD)、中继设备的移动管理实体(MME-relay)、基站(eNB)、归属用户服务器(Home Subscriber Server，简称HSS)以及近距离功能实体(ProSe Function，简称PF)等进行说明。
图11为本申请实施例提供的授权验证方法实施例十一的交互图。如图11所示，本申请实施例提供的授权验证方法与图6所示实施例类似，具体步骤如下：
步骤1101、WD和Relay成功注册到网络。
步骤1102、WD向Relay发送通信请求。
该通信请求中携带远端设备的标识(WD ID)。可选的，该通信请求中还包括第一NAS消息(WD的NAS消息)和/或中继服务码(Relay service code)。关于通信请求中的具体内容参见图1所示实施例中步骤101中的记载，此处不再赘述。
步骤1103、Relay给基站(eNB)发送RRC信令。
其中，RRC信令中包括上述通信请求中的相关内容。可选的，RRC信令中还包括relay的标识。
步骤1104、eNB发起与MME-WD的S1-AP连接建立，并通过初始远端设备消息将RRC信令中的相关内容发送给MME-WD。
步骤1105、MME-WD验证第一NAS消息的完整性，对Relay和WD的关联关系进行验证。
可选的，MME-WD接收到第一NAS消息之后的具体操作可参见图6所示实施例中步骤604的记载，此处不再赘述。当通信请求中包括第一NAS消息时，MME-WD验证第一NAS消息的完整性。关于完整性校验的具体实现参见步骤403中的记载此处不再赘述。
步骤1106、MME-WD向MME-relay发送WD ID、Relay ID。
可选的，MME-WD还可能向MME-relay发送包含验证Relay和WD的关联关系所需要的其他相关参数。此外，MME-WD还可能向MME-relay发 送中继服务码等内容。
步骤1107、MME-relay对Relay和WD的关联关系进行验证，并向MME-WD反馈第二响应消息。
步骤1108、MME-WD生成密钥。
具体的，MME-WD根据WD ID获取生成密钥所需的安全参数，然后生成用于保护WD和Relay之间通信安全的密钥。
关于密钥具体生成的方法以及所需要的安全参数具体可参见步骤502中的记载，此处不再赘述。
步骤1109、MME-WD将密钥和生成密钥所需的安全参数返回给eNB。
可选的，MME-WD通过初始上下文请求将密钥和生成密钥所需的安全参数返回给eNB。
步骤1110、eNB建立WD和Relay的承载映射和绑定。
步骤1111、eNB将密钥和生成密钥所需的安全参数反馈给Relay，eNB与Relay之间实现无线控制协议连接配置。
步骤1112、eNB将生成密钥所需的安全参数反馈给WD，eNB与WD之间实现无线控制协议连接配置。
步骤1113、WD根据生成密钥所需的安全参数生成密钥。
步骤1114、WD向eNB发送无线控制协议连接配置完成的消息。
步骤1115、eNB向MME-WD反馈初始上下文完成消息。
本实施例中各步骤的实现原理参见上述实施例中的相关记载，此处不再赘述。
值得说明的是，本申请的授权验证方法还可能需要注意如下几点：
可选的，第一：步骤1105和步骤1107中的关联关系验证，可能只需要执行其中一个，也可能两处都执行。
可选的，第二：用于保护远端设备和中继设备之间通信安全的密钥是可选的，即步骤1108中可能不需要生成密钥。此时，WD生成的第一随机数和MME-WD生成的第二随机数也不需要生成及传递，但是，远端设备的NAS消息和MME-WD的NAS消息还是需要传递的，作用是通过检查远端设备的NAS消息的完整性来完成WD和relay之间的安全认证。
可选的，第三：如果用于保护远端设备和中继设备之间通信安全的密钥 需要生成，可选的，WD和MME-WD之间的交互也可能不需要封装在NAS消息中，即第一随机数和WD ID不需要封装在远端设备的NAS消息中，第二随机数也不需要封装在MME-WD的NAS消息中。
可选的，第四：若WD ID不包含在通信请求中的远端设备的NAS消息中，则在步骤604和步骤605中，第一请求消息和第二请求中的远端设备的NAS消息中也不包括WD ID。
图12为本申请实施例提供的授权验证方法实施例十二的交互图。如图12所示，本申请实施例提供的授权验证方法与图11所示实施例类似，区别仅在于PF也可进行授权验证。具体的，如图12所示，上述图11中的步骤1106可替换为步骤1201、步骤1107可替换为步骤1202。
步骤1201、MME-WD向PF发送WD ID、Relay ID。
可选的，与上述步骤1106类似，MME-WD还可能向PF发送包含验证Relay和WD的关联关系所需要的其他相关参数。此外，MME-WD还可能向MME-relay发送中继服务码等内容。
步骤1202、PF对Relay和WD的关联关系进行验证，并向MME-WD反馈第二响应消息。
关于PF对Relay和WD的关联关系验证的具体实现方案参见上述步骤702中的记载，此处不再赘述。
值得说明的是，本申请实施例提供的授权验证方法，还可能需要注意如下几点：
可选的，第一：用于保护远端设备和中继设备之间通信安全的密钥是可选的，即步骤1108中可能不需要生成密钥。此时，WD生成的第一随机数和MME-WD生成的第二随机数也不需要生成及传递，但是，远端设备的NAS消息和MME-WD的NAS消息还是需要传递的，作用是通过检查远端设备的NAS消息的完整性来完成WD和relay之间的安全认证。
可选的，第二：如果用于保护远端设备和中继设备之间通信安全的密钥需要生成，可选的，WD和MME-WD之间的交互也可能不需要封装在NAS消息中，即第一随机数和WD ID不需要封装在远端设备的NAS消息中，第二随机数也不需要封装在MME-WD的NAS消息中。
可选的，第三：若WD ID不包含在通信请求中的远端设备的NAS消息 中，则在步骤604和步骤605中，第一请求消息和第二请求中的远端设备的NAS消息中也不包括WD ID。
图13为本申请实施例提供的授权验证方法实施例十三的交互图。如图13所示，本申请实施例提供的授权验证方法，具体步骤如下：
步骤1301、WD和Relay成功注册到网络。
步骤1302、PF或者HSS上发生了授权信息的更新。
可选的，PF和/或HSS可能会发生relay相关的第一授权信息更新，和/或WD相关的第二授权信息更新。
步骤1303、MME-WD和/或MME-relay实现授权信息的更新。
可选的，PF和/或HSS将更新的第一授权信息配置到MME-relay上。
可选的，PF和/或HSS将更新的第二授权信息配置到MME-WD上。
步骤1304、MME-WD存储WD相关的第二授权信息。MME-relay存储relay相关的第一授权信息。
步骤1305、WD和Relay之间实现通信接口的发现过程。
步骤1306、WD向Relay发送通信请求。
该通信请求中携带远端设备的标识(WD ID)。可选的，该通信请求中还包括第一NAS消息(WD的NAS消息)和/或中继服务码(Relay service code)。关于通信请求中的其他内容参照图1所示实施例中步骤101的记载，此处不再赘述。
步骤1307、Relay生成第一请求消息，并将该第一请求消息发送给PF。
步骤1308、PF对Relay和WD的关联关系进行验证，并生成密钥。
可选的，PF接收到第一请求消息后，可执行如下操作中的一种或几种：第一，PF对Relay和WD的关联关系进行验证；第二，PF生成密钥。可选的，该密钥是用于保护WD和Relay之间通信的安全密钥。
步骤1309、PF将密钥和生成密钥所需的安全参数反馈给Relay。
可选的，PF通过第一响应消息将密钥和生成密钥所需的安全参数反馈给Relay。
步骤1310、Relay将生成密钥所需的安全参数反馈给WD。
在一实施例中，Relay通过通信响应将生成密钥所需的安全参数反馈给 WD。
步骤1311、WD向MME-WD发送服务请求。
可选的，该服务请求中携带WD-ID、relay-ID。可选地，该服务请求中还携带中继服务码。
步骤1312、MME-WD对Relay和WD的关联关系进行验证。
可选的，该步骤还可以通过MME-relay对Relay和WD的关联关系进行验证，或者该步骤通过MME-WD和MME-relay两者对Relay和WD的关联关系进行验证。
可选地，如果步骤1308中没有生成密钥，则MME-WD生成用于保护WD和Relay之间通信的安全密钥。
步骤1313、MME-WD向eNB发送建立初始上下文请求，该初始上下文请求中携带WD-ID和relay-ID。
步骤1314、eNB完成WD和Relay的承载映射和绑定。
步骤1315、eNB与Relay之间实现无线控制协议连接配置。
步骤1316、eNB与WD之间实现无线控制协议连接配置。
步骤1317、eNB向MME-WD反馈初始上下文完成消息。
本实施例中各步骤的实现原理和技术效果参见上述所示实施例中的相关记载，此处不再赘述。
图14为本申请实施例提供的授权验证方法实施例十四的交互图。如图14所示，本申请实施例提供的授权验证方法与图6所示实施例类似，具体包括如下步骤：
步骤1401、WD和Relay成功注册到网络。
步骤1402、WD向MME-WD发送远端设备的NAS消息。
该远端设备的NAS消息中携带远端设备的标识(WD ID)、中继设备的标识(Relay ID)。可选地，该远端设备的NAS消息中还包括中继服务码(Relay service code)和/或第一随机数。
步骤1403、MME-WD验证远端设备的NAS消息的完整性，并对Relay和WD的关联关系进行验证。
可选的，MME-WD可以执行如下操作中的一种或几种：验证远端设备的NAS消息的完整性、对Relay和WD的关联关系进行验证。
步骤1404、MME-WD向MME-relay发送第一授权验证请求消息。
步骤1405、MME-relay验证Relay和WD的关联关系，并向MME-WD反馈第一授权验证响应消息。
对于MME-relay验证Relay和WD的关联关系的具体实现参见图1所示实施例中步骤105中的记载，此处不再赘述。
步骤1406、MME-WD生成密钥。
具体的，MME-WD根据WD ID生成用于保护WD和Relay之间通信安全的密钥和生成密钥所需的安全参数。关于密钥生成的具体操作参见图5所示实施例中的步骤502，此处不再赘述
步骤1407、MME-WD将密钥和生成密钥所需的安全参数返回给eNB。
可选的，MME-WD通过配对请求将密钥和生成密钥所需的安全参数返回给eNB。
步骤1408、eNB建立WD和Relay的承载映射和绑定。
步骤1409、eNB将密钥和生成密钥所需的安全参数反馈给Relay，eNB与Relay之间实现无线控制协议连接配置。
步骤1410、eNB向MME-WD反馈配对响应。
步骤1411、MME-WD将生成密钥所需的安全参数反馈给WD。
步骤1412、WD根据生成密钥所需的安全参数，生成密钥。
步骤1413、WD向Relay发送通信请求。
步骤1414、Relay向WD反馈通信响应。
值得说明的是，本申请的授权验证方法还可能需要注意如下几点：
可选的，第一：步骤1403和步骤1405中的关联关系验证，可能只需要执行其中一个，也可能两处都执行。
可选的，第二：用于保护远端设备和中继设备之间通信安全的密钥是可选的，即步骤1406中可能不需要生成密钥。此时，生成密钥所需要的WD生成的第一随机数和MME-WD生成的第二随机数也不需要生成及传递。
本实施例中各步骤的实现原理参见上述实施例中的相关记载，此处不再赘述。
图15为本申请实施例提供的授权验证方法实施例十五的交互图。如图15所示，本申请实施例提供的授权验证方法与图14所示实施例类似，区别 仅在于PF也可进行授权验证。具体的，如图15所示，上述图14中的步骤1403可替换为步骤1501～1504。
步骤1501、MME-WD验证远端设备的NAS消息的完整性。
关于MME-WD对远端设备的NAS消息的完整性验证参见图5所示实施例中步骤501中的记载，此处不再赘述。
步骤1502、MME-WD向PF发送第二授权验证请求消息。
MME-WD根据远端设备的NAS消息向PF发送第二授权验证请求消息。
步骤1503、PF对Relay和WD的关联关系进行验证，生成第二授权验证响应消息。
可选的，PF根据授权验证请求消息对Relay和WD的关联关系进行验证。
关于PF对Relay和WD的关联关系验证的具体实现方案参见上述步骤702中的记载，此处不再赘述。
步骤1504、PF向MME-WD反馈第二授权验证响应消息。
其中，第三请求消息中携带的内容与第一请求消息中的内容一致。
本实施例中各步骤的实现原理和技术效果参见图1至图5所示实施例中的相关记载，此处不再赘述。
图16为本申请实施例提供的一种授权验证装置的结构示意图。该装置可以位于中继设备的移动管理实体中，如图16所示，本实施例的装置可以包括：接收模块1601、处理模块1602和发送模块1603。
其中，接收模块1601，用于接收中继设备发送的第一请求消息，该第一请求消息包括：远端设备的标识。
处理模块1602，用于根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证。
发送模块1603，用于在处理模块1602判断所述关联关系验证通过后，生成第一响应消息，向所述中继设备发送所述第一响应消息。
该发送模块1603，还用于向所述远端设备的移动管理实体发送第二请求消息，所述第二请求消息包括：远端设备的标识。
该接收模块1601，还用于接收所述远端设备的移动管理实体根据所述第 二请求消息对所述远端设备进行安全处理后发送的第二响应消息。
本实施例的装置，可以用于执行图1所示方法实施例中中继设备的移动管理实体的技术方案，其实现原理和技术效果类似，此处不再赘述。
可选的，所述处理模块1602，具体用于根据所述第一请求消息获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
可选的，所述处理模块1602，具体用于在所述中继设备成功注册到网络之后，根据所述中继设备的标识从用户数据管理实体和近距离功能实体中的任意一个或两个中获取所述第一授权信息。
进一步的，在上述第一请求消息，还包括：中继服务码时，上述处理模块1602，具体用于根据所述第一请求消息获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
作为一种示例，所述接收模块1601，还用于接收所述远端设备的移动管理实体发送的密钥和生成所述密钥所需的安全参数。
所述发送模块1603，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
可选的，在一实施例中，所述发送模块1603，还用于向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述中继设备的移动管理实体，所述密钥请求消息，包括：所述远端设备的标识。
所述发送模块1603，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
可选的，在另一实施例中，所述发送模块1603，还用于向近距离功能实体发送第三请求消息，以使所述近距离功能实体根据所述第三请求消息验证是否允许所述远端设备通过所述中继设备接入网络，所述第三请求消息包括：远端设备的标识、中继设备的标识。
进一步的，在上述各实施例中，当第一请求消息还包括：远端设备的非接入层消息、非接入层消息的校验码时，所述第二请求消息还包括：所述远 端设备的非接入层消息、所述非接入层消息的校验码。
上述装置可用于执行上述方法实施例提供的方法，具体实现方式和技术效果类似，这里不再赘述。
图17为本申请实施例提供的另一种授权验证装置的结构示意图。该装置可以位于远端设备的移动管理实体中。如图17所示，本实施例的装置可以包括：接收模块1701、处理模块1702和发送模块1703。
该接收模块1701，用于接收中继设备的移动管理实体发送的第二请求消息，所述第二请求消息包括：远端设备的标识。
处理模块1702，用于所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理。
发送模块1703，用于在所述处理模块1702对所述远端设备进行安全处理后，向所述中继设备的移动管理实体发送的第二响应消息。
本实施例的装置，可以用于执行图1所示方法实施例中远端设备的移动管理实体的技术方案，其实现原理和技术效果类似，此处不再赘述。
可选的，在一实施例中，所述处理模块1702，具体用于根据所述第二请求消息获取第二授权信息，并根据所述远端设备的标识、所述中继设备的标识以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
作为一种示例，该处理模块1702，具体用于在所述远端设备成功注册到网络之后，根据所述远端设备的标识从用户数据管理实体和/或近距离功能实体获取所述第二授权信息。
可选的，在另一实施例中，当第二请求消息，还包括：中继服务码时，所述处理模块1702，用于根据所述第二请求消息获取第二授权信息，并根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
可选的，在再一实施例中，所述处理模块1702，具体用于根据所述第二请求消息中的所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非接入层上下文信息对所述远端设备的非接入层消息的校验码进行验证，所述第二请求消息包括：所述远端设备的非接入层消息、所述 非接入层消息的校验码以及所述远端设备的标识。
可选的，在又一实施例中，所述处理模块1702，还用于根据所述第二请求消息中所述远端设备的标识，获取所述远端设备的非接入层上下文信息，根据所述非接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥；
所述发送模块1703，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备的移动管理实体。
可选的，在又一实施例中，所述发送模块1703，还用于向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述远端设备的移动管理实体，所述密钥请求消息，包括：所述远端设备标识。
上述装置可用于执行上述方法实施例提供的方法，具体实现方式和技术效果类似，这里不再赘述。
图18为本申请实施例提供的再一种授权验证装置的结构示意图。该装置可以位于中继设备中。如图18所示，本实施例的装置可以包括：接收模块1801、处理模块1802和发送模块1803。
接收模块1801，用于接收远端设备发送的通信请求，所述通信请求包括：远端设备的标识。
处理模块1802，用于根据所述通信请求，生成第一请求消息，所述第一请求消息包括：远端设备的标识。
发送模块1803，用于将所述第一请求消息发送给所述中继设备的移动管理实体。
所述接收模块1801，还用于接收所述中继设备的移动管理实体在判断所述关联关系验证通过后发送的第一响应消息。
所述发送模块1803，还用于根据所述第一响应消息向所述远端设备发送通信响应。
本实施例的装置，可以用于执行图1所示方法实施例中中继设备的技术方案，其实现原理和技术效果类似，此处不再赘述。
可选的，在本申请的一实施例中，所述接收模块1801，还用于接收所述中继设备的移动管理实体发送的用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数.
所述发送模块1803，还用于将所述安全参数通过所述通信响应发送给所述远端设备，以使所述远端设备根据所述安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥。
上述装置可用于执行上述方法实施例提供的方法，具体实现方式和技术效果类似，这里不再赘述。
图19为本申请实施例提供的又一种授权验证装置的结构示意图。该装置可以位于中继设备的移动管理实体中，也可以位于远端设备的移动管理实体，还可以位于近距离功能实体中。如图19所示，本实施例的装置可以包括：接收模块1901、处理模块1902和发送模块1903。
接收模块1901，用于接收中继设备发送的第一请求消息，所述第一请求消息包括：远端设备的标识；
处理模块1902，用于根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证；
发送模块1903，用于在所述处理模块1902判断所述关联关系验证通过后，向所述中继设备发送第一响应消息。
可选的，在本申请的一实施例中，所述处理模块1902，具体用于根据第一请求消息，获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
作为一种示例，所述处理模块1902，具体用于在所述中继设备、所述远端设备成功注册到网络之后，根据第一请求消息，从用户数据管理实体和近距离功能实体中的任意一个或两个中获取所述第一授权信息。
可选的，在本申请的另一实施例中，当所述第一请求消息，还包括：中继服务码时，所述处理模块1902，具体用于根据第一请求消息，获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接 入网络。
可选的，在本申请的再一实施例中，所述发送模块1903，还用于向第一移动管理实体发送第二请求消息，以使所述第一移动管理实体根据所述第二请求消息验证是否允许所述远端设备通过所述中继设备接入网络。
在该实施例中，当该授权验证装置位于中继设备的移动管理实体中时，所述第一移动管理实体为近距离功能实体或所述远端设备的移动管理实体；或者当该授权验证装置位于远端设备的移动管理实体中时，所述第一移动管理实体为近距离功能实体或所述中继设备的移动管理实体；或者当该授权验证装置位于近距离功能实体时，所述第一移动管理实体为所述远端设备的移动管理实体或所述中继设备的移动管理实体。
可选的，在本申请的又一实施例中，在第一请求消息中包括所述远端设备的非接入层消息以及所述非接入层消息的校验码时，所述第二请求消息包括：所述远端设备的非接入层消息、所述非接入层消息的校验码以及所述远端设备的标识时，所述处理模块1902，用于向所述远端设备的移动管理实体发送第二请求消息，以使所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理。
在本实施例中，该授权验证装置可以位于中继设备的移动管理实体中，或者该授权验证装置可以位于近距离功能实体中。
可选的，在本申请的又一实施例中，当该授权验证装置位于远端设备的移动管理实体中时，所述接收模块1901，具体用于接收所述中继设备通过所述基站转发处理的所述第一请求消息，所述第一请求消息还包括：所述中继设备的标识。
可选的，在本申请的上述实施例中，当所述第一请求消息包括所述远端设备的非接入层消息以及所述非接入层消息的校验码时，所述处理模块1902，具体用于根据所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非接入层上下文信息对所述非接入层消息的校验码进行验证。
可选的，在本申请的又一实施例中，所述发送模块1903，还用于向所述第一移动管理实体发送第二请求消息，以使所述第一移动管理实体根据所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非 接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥，以及将所述密钥和生成所述密钥所需的安全参数反馈给该授权验证装置。
所述发送模块1903，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备，以使所述中继设备将所述安全参数返回给所述远端设备，使所述远端设备根据所述安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥。
在本实施例中，该授权验证装置可以位于中继设备的移动管理实体中，所述第一移动管理实体为近距离功能实体或所述远端设备的移动管理实体。
可选的，在本申请的又一实施例中，所述处理模块1902，还用于根据所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥，以及将所述密钥和生成所述密钥所需的安全参数反馈给所述中继设备的移动管理实体并转发给所述中继设备，以使所述中继设备将所述安全参数返回给所述远端设备，使所述远端设备根据所述安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥。
在本实施例中，该授权验证装置可以位于远端设备的移动管理实体或者近距离功能实体中。
可选的，在本申请的上述实施例中，所述密钥由所述远端设备的移动管理实体根据所述远端设备的基础安全密钥生成。
可选的，在本申请的上述实施例中，所述中继设备的移动管理实体中存储有所述中继设备的上下文信息，所述远端设备的移动管理实体中存储有所述远端设备的上下文信息，近距离功能实体中存储有所述中继设备的上下文信息和所述远端设备的上下文信息。
可选的，在本申请的又一实施例中，所述发送模块1903，还用于向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述网络侧设备，所述密钥请求消息，包括：所述远端设备的标识。
另外，本申请实施例提供的授权验证装置，还可以实现上述各种可选实 施例中用于授权验证装置的方法的各个步骤，具体实现原理和有益效果请参照上述方法实施例，此处不再赘述。
需要说明的是，应理解以上装置的各个模块的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分模块通过处理元件调用软件的形式实现，部分模块通过硬件的形式实现。例如，确定模块可以为单独设立的处理元件，也可以集成在上述装置的某一个芯片中实现，此外，也可以以程序代码的形式存储于上述装置的存储器中，由上述装置的某一个处理元件调用并执行以上确定模块的功能。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件可以是一种集成电路，具有信号的处理能力。在实现过程中，上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如，以上这些模块可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(Application Specific Integrated Circuit，简称ASIC)，或，一个或多个微处理器(digital singnal processor，简称DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，简称FPGA)等。再如，当以上某个模块通过处理元件调度程序代码的形式实现时，该处理元件可以是通用处理器，例如中央处理器(Central Processing Unit，简称CPU)或其它可以调用程序代码的处理器。再如，这些模块可以集成在一起，以片上系统(system-on-a-chip，简称SOC)的形式实现。
图20为本申请实施例提供的又一种授权验证装置的结构示意图。本实例提供的授权验证装置，包括：处理器2001、存储器2002、收发器2003、通信接口2004和系统总线2005，存储器2002和通信接口2004通过系统总线2005与处理器2001和收发器2003连接并完成相互间的通信，存储器2002用于存储计算机执行指令，通信接口2004用于和其他设备进行通信，处理器2001和收发器2003用于运行计算机执行指令，使授权验证装置执行如上应用于授权验证方法中中继设备的移动管理实体的各个步骤。
具体的，在上述图16中，接收模块1601和发送模块1603对应收发器2003，处理模块1602对应处理器2001等。
图21为本申请实施例提供的又一种授权验证装置的结构示意图。本实例提供的授权验证装置，包括：处理器2101、存储器2102、收发器2103、通信接口2104和系统总线2105，存储器2102和通信接口2104通过系统总线2105与处理器2101和收发器2103连接并完成相互间的通信，存储器2102用于存储计算机执行指令，通信接口2104用于和其他设备进行通信，处理器2101和收发器2103用于运行计算机执行指令，使授权验证装置执行如上应用于授权验证方法中远端设备的移动管理实体的各个步骤。
具体的，在上述图17中，接收模块1701和发送模块1703对应收发器2103，处理模块1702对应处理器2101等。
图22为本申请实施例提供的又一种授权验证装置的结构示意图。本实例提供的授权验证装置，包括：处理器2201、存储器2202、收发器2203、通信接口2204和系统总线2205，存储器2202和通信接口2204通过系统总线2205与处理器2201和收发器2203连接并完成相互间的通信，存储器2202用于存储计算机执行指令，通信接口2204用于和其他设备进行通信，处理器2201和收发器2203用于运行计算机执行指令，使授权验证装置终端认证装置执行如上应用于授权验证方法中中继设备的各个步骤。
具体的，在上述图18中，接收模块1801和发送模块1803对应收发器2203，处理模块1802对应处理器2201等。
图23为本申请实施例提供的又一种授权验证装置的结构示意图。本实例提供的授权验证装置，包括：处理器2301、存储器2302、收发器2303、通信接口2304和系统总线2305，存储器2302和通信接口2304通过系统总线2305与处理器2301和收发器2303连接并完成相互间的通信，存储器2302用于存储计算机执行指令，通信接口2304用于和其他设备进行通信，处理器2301和收发器2303用于运行计算机执行指令，使授权验证装置执行如上应用于授权验证方法中网络侧设备的各个步骤。
具体的，在上述图19中，接收模块1901和发送模块1903对应收发器2303，处理模块1902对应处理器2301等。
上述图20至图23中提到的系统总线可以是外设部件互连标准(Peripheral  Pomponent Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。该系统总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。通信接口用于实现数据库访问装置与其他设备(例如客户端、读写库和只读库)之间的通信。存储器可能包含随机存取存储器(Random Access Memory，简称RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。
上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(Digital Signal Processing，简称DSP)、专用集成电路(Application Specific Integrated Circuit，简称ASIC)、现场可编程门阵列(Field－Programmable Gate Array，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (30)

  1. 一种授权验证方法，其特征在于，包括：
    中继设备的移动管理实体接收中继设备发送的第一请求消息，所述第一请求消息包括：所述中继设备对应的远端设备的标识；
    所述中继设备的移动管理实体根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证；
    所述中继设备的移动管理实体在判断所述关联关系验证通过后，生成第一响应消息，向所述中继设备发送所述第一响应消息；
    所述中继设备的移动管理实体根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证，包括：
    所述中继设备的移动管理实体向所述远端设备的移动管理实体发送第二请求消息，所述第二请求消息包括：远端设备的标识；
    所述中继设备的移动管理实体接收所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理后发送的第二响应消息。
  2. 根据权利要求1所述的方法，其特征在于，所述中继设备的移动管理实体根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证，还包括：
    所述中继设备的移动管理实体根据所述第一请求消息获取第一授权信息；
    所述中继设备的移动管理实体根据所述远端设备的标识、所述中继设备的标识以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  3. 根据权利要求2所述的方法，其特征在于，所述中继设备的移动管理实体根据所述第一请求消息获取第一授权信息，包括：
    所述中继设备的移动管理实体在所述中继设备成功注册到网络之后，根据所述中继设备的标识从用户数据管理实体和/或近距离功能实体获取所述第一授权信息。
  4. 根据权利要求2或3所述的方法，其特征在于，所述第一请求消息，还包括：中继服务码；
    所述中继设备的移动管理实体根据所述第一请求消息，触发对所述远端 设备和所述中继设备的关联关系的验证，包括：
    所述中继设备的移动管理实体根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  5. 根据权利要求1～4任一项所述的方法，其特征在于，所述方法，还包括：
    所述中继设备的移动管理实体向近距离功能实体发送第三请求消息，以使所述近距离功能实体根据所述第三请求消息验证是否允许所述远端设备通过所述中继设备接入网络，所述第三请求消息包括：远端设备的标识、中继设备的标识。
  6. 根据权利要求1～5任一项所述的方法，其特征在于，所述方法，还包括：
    所述中继设备的移动管理实体接收所述远端设备的移动管理实体发送的密钥和生成所述密钥所需的安全参数；
    所述中继设备的移动管理实体将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
  7. 根据权利要求1～6任一项所述的方法，其特征在于，所述方法还包括：
    所述中继设备的移动管理实体向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述中继设备的移动管理实体，所述密钥请求消息，包括：所述远端设备的标识；
    所述中继设备的移动管理实体将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
  8. 根据权利要求1所述方法，其特征在于，在所述第一请求消息还包括：所述远端设备的非接入层消息、所述非接入层消息的校验码时，所述第二请求消息还包括：所述远端设备的非接入层消息、所述非接入层消息的校验码。
  9. 一种授权验证方法，其特征在于，包括：
    远端设备的移动管理实体接收中继设备的移动管理实体发送的第二请求消息，所述第二请求消息包括：远端设备的标识；
    所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理；
    所述远端设备的移动管理实体在对所述远端设备进行安全处理后，向所述中继设备的移动管理实体发送的第二响应消息。
  10. 根据权利要求9所述的方法，其特征在于，所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理，包括：
    所述远端设备的移动管理实体根据所述第二请求消息获取第二授权信息；
    所述远端设备的移动管理实体根据所述远端设备的标识、所述中继设备的标识以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  11. 根据权利要求10所述的方法，其特征在于，所述远端设备的移动管理实体根据所述第二请求消息获取第二授权信息，包括：
    所述远端设备的移动管理实体在所述远端设备成功注册到网络之后，根据所述远端设备的标识从用户数据管理实体和/或近距离功能实体获取所述第二授权信息。
  12. 根据权利要求10或11所述的方法，其特征在于，所述第二请求消息，还包括：中继服务码；
    所述远端设备的移动管理实体根据第二请求消息对所述远端设备进行安全处理，包括：
    所述远端设备的移动管理实体根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  13. 根据权利要求9～12任一项所述的方法，其特征在于，所述远端设备的移动管理实体根据第二请求消息对所述远端设备进行安全处理，包括：
    所述远端设备的移动管理实体根据所述第二请求消息中的所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非接入层上下文信息对所述远端设备的非接入层消息的校验码进行验证，所述第二请求 消息包括：所述远端设备的非接入层消息、所述非接入层消息的校验码以及所述远端设备的标识。
  14. 根据权利要求9～13任一项所述的方法，其特征在于，所述方法，还包括：
    所述远端设备的移动管理实体根据所述第二请求消息中所述远端设备的标识，获取所述远端设备的非接入层上下文信息；
    所述远端设备的移动管理实体根据所述非接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥；
    所述远端设备的移动管理实体将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备的移动管理实体。
  15. 根据权利要求9～14任一项所述的方法，其特征在于，所述方法还包括：
    所述远端设备的移动管理实体向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述远端设备的移动管理实体，所述密钥请求消息，包括：所述远端设备标识。
  16. 一种授权验证方法，其特征在于，包括：
    中继设备接收远端设备发送的通信请求，所述通信请求包括：远端设备的标识；
    所述中继设备根据所述通信请求，生成第一请求消息，并将所述第一请求消息发送给所述中继设备的移动管理实体，所述第一请求消息包括：远端设备的标识；
    所述中继设备接收所述中继设备的移动管理实体在判断所述关联关系验证通过后发送的第一响应消息；
    所述中继设备根据所述第一响应消息向所述远端设备发送通信响应。
  17. 根据权利要求16所述的方法，其特征在于，所述方法，还包括：
    所述中继设备接收所述中继设备的移动管理实体发送的用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数；
    所述中继设备根据所述第一响应消息向所述远端设备发送通信响应，包括：
    所述中继设备将所述安全参数通过所述通信响应发送给所述远端设备，以使所述远端设备根据所述安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥。
  18. 一种授权验证装置，其特征在于，包括：
    接收模块，用于接收中继设备发送的第一请求消息，所述第一请求消息包括：远端设备的标识；
    处理模块，用于根据所述第一请求消息，触发对所述远端设备和所述中继设备的关联关系的验证；
    发送模块，用于在所述处理模块判断所述关联关系验证通过后，生成第一响应消息，向所述中继设备发送所述第一响应消息；
    所述发送模块，还用于向所述远端设备的移动管理实体发送第二请求消息，所述第二请求消息包括：远端设备的标识；
    所述接收模块，还用于接收所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理后发送的第二响应消息。
  19. 根据权利要求18所述的装置，其特征在于，所述处理模块，具体用于根据所述第一请求消息获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  20. 根据权利要求18所述的装置，其特征在于，所述第一请求消息，还包括：中继服务码；则所述处理模块，具体用于根据所述第一请求消息获取第一授权信息，并根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第一授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  21. 根据权利要求18～20任一项所述的装置，其特征在于，所述接收模块，还用于接收所述远端设备的移动管理实体发送的密钥和生成所述密钥所需的安全参数；
    所述发送模块，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
  22. 根据权利要求18～20任一项所述的装置，其特征在于，所述发送模块，还用于向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述中继设备的移动管理实体，所述密钥请求消息，包括：所述远端设备的标识；
    所述发送模块，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备。
  23. 一种授权验证装置，其特征在于，包括：
    接收模块，用于接收中继设备的移动管理实体发送的第二请求消息，所述第二请求消息包括：远端设备的标识；
    处理模块，用于所述远端设备的移动管理实体根据所述第二请求消息对所述远端设备进行安全处理；
    发送模块，用于在所述处理模块对所述远端设备进行安全处理后，向所述中继设备的移动管理实体发送的第二响应消息。
  24. 根据权利要求23所述的装置，其特征在于，所述处理模块，具体用于根据所述第二请求消息获取第二授权信息，并根据所述远端设备的标识、所述中继设备的标识以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  25. 根据权利要求23所述的装置，其特征在于，所述第二请求消息，还包括：中继服务码；则所述处理模块，用于根据所述第二请求消息获取第二授权信息，并根据所述远端设备的标识、所述中继设备的标识、所述中继服务码以及所述第二授权信息，验证是否允许所述远端设备通过所述中继设备接入网络。
  26. 根据权利要求23～25任一项所述的装置，其特征在于，所述处理模块，具体用于根据所述第二请求消息中的所述远端设备的标识，获取所述远端设备的非接入层上下文信息，并根据所述非接入层上下文信息对所述远端设备的非接入层消息的校验码进行验证，所述第二请求消息包括：所述远端设备的非接入层消息、所述非接入层消息的校验码以及所述远端设备的标识。
  27. 根据权利要求23～26任一项所述的装置，其特征在于，所述处理模块，还用于根据所述第二请求消息中所述远端设备的标识，获取所述远端设备的非接入层上下文信息，根据所述非接入层上下文信息生成用于保护所述远端设备和所述中继设备之间通信安全的密钥；
    所述发送模块，还用于将所述密钥和生成所述密钥所需的安全参数发送给所述中继设备的移动管理实体。
  28. 根据权利要求23～26任一项所述的装置，其特征在于，所述发送模块，还用于向安全功能实体发送密钥请求消息，以使得所述安全功能实体根据所述密钥请求消息，获取用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数，并将所述密钥和生成所述密钥所需的安全参数反馈给所述远端设备的移动管理实体，所述密钥请求消息，包括：所述远端设备标识。
  29. 一种授权验证装置，其特征在于，包括：
    接收模块，用于接收远端设备发送的通信请求，所述通信请求包括：远端设备的标识；
    处理模块，用于根据所述通信请求，生成第一请求消息，所述第一请求消息包括：远端设备的标识；
    发送模块，用于将所述第一请求消息发送给所述中继设备的移动管理实体；
    所述接收模块，还用于接收所述中继设备的移动管理实体在判断所述关联关系验证通过后发送的第一响应消息；
    所述发送模块，还用于根据所述第一响应消息向所述远端设备发送通信响应。
  30. 根据权利要求29所述的装置，其特征在于，所述接收模块，还用于接收所述中继设备的移动管理实体发送的用于保护所述远端设备和所述中继设备之间通信安全的密钥和生成所述密钥所需的安全参数；
    所述发送模块，还用于将所述安全参数通过所述通信响应发送给所述远端设备，以使所述远端设备根据所述安全参数生成用于保护所述远端设备和所述中继设备之间通信安全的所述密钥。
PCT/CN2017/070477 2017-01-06 2017-01-06 授权验证方法和装置 WO2018126452A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
PCT/CN2017/070477 WO2018126452A1 (zh) 2017-01-06 2017-01-06 授权验证方法和装置
EP17890818.2A EP3557898B1 (en) 2017-01-06 2017-03-20 Authorisation verification method and apparatus
CN201780056351.6A CN109716810B (zh) 2017-01-06 2017-03-20 授权验证方法和装置
PCT/CN2017/077271 WO2018126534A1 (zh) 2017-01-06 2017-03-20 授权验证方法和装置
EP20207955.4A EP3849227A1 (en) 2017-01-06 2017-03-20 Authorization and verification method and apparatus
US16/504,009 US20190335332A1 (en) 2017-01-06 2019-07-05 Authorization and Verification Method and Apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/070477 WO2018126452A1 (zh) 2017-01-06 2017-01-06 授权验证方法和装置

Publications (1)

Publication Number Publication Date
WO2018126452A1 true WO2018126452A1 (zh) 2018-07-12

Family

ID=62788827

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2017/070477 WO2018126452A1 (zh) 2017-01-06 2017-01-06 授权验证方法和装置
PCT/CN2017/077271 WO2018126534A1 (zh) 2017-01-06 2017-03-20 授权验证方法和装置

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/077271 WO2018126534A1 (zh) 2017-01-06 2017-03-20 授权验证方法和装置

Country Status (4)

Country Link
US (1) US20190335332A1 (zh)
EP (2) EP3849227A1 (zh)
CN (1) CN109716810B (zh)
WO (2) WO2018126452A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111404944A (zh) * 2020-03-19 2020-07-10 中国电子科技集团公司第三十研究所 一种实现主认证增强的安全udm/hss设计方法及系统
WO2021136211A1 (zh) * 2019-12-31 2021-07-08 华为技术有限公司 授权结果的确定方法及装置
CN113498615A (zh) * 2019-08-16 2021-10-12 Oppo广东移动通信有限公司 通信方法、终端设备和网络设备
CN113596789A (zh) * 2020-04-30 2021-11-02 维沃移动通信有限公司 设备交互方法及核心网设备
WO2022147846A1 (zh) * 2021-01-11 2022-07-14 华为技术有限公司 一种生成设备间通信的密钥的方法、系统和装置
WO2024067641A1 (zh) * 2022-09-30 2024-04-04 华为技术有限公司 一种通信方法及装置、计算机可读存储介质和通信系统

Families Citing this family (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018138381A1 (en) * 2017-01-30 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Wireless communications
CN112911583A (zh) 2017-07-11 2021-06-04 华为技术有限公司 设备接入方法、设备及系统
WO2019031865A1 (ko) * 2017-08-09 2019-02-14 엘지전자 주식회사 무선 통신 시스템에서 rrc 연결 절차 수행 방법 및 이를 위한 장치
CN109561429B (zh) * 2017-09-25 2020-11-17 华为技术有限公司 一种鉴权方法及设备
WO2019240544A1 (en) * 2018-06-14 2019-12-19 Lg Electronics Inc. Method and apparatus for performing sidelink communication by ue in nr v2x
WO2021066452A1 (ko) * 2019-10-04 2021-04-08 삼성전자 주식회사 5g 사용자 활성화 방법 및 장치
CN113132985A (zh) * 2019-12-30 2021-07-16 华为技术有限公司 通信方法及装置
CN114885439A (zh) * 2019-12-30 2022-08-09 华为技术有限公司 建立连接和获取中继服务代码的方法和通信装置
CN113179515B (zh) * 2020-01-08 2023-07-18 华为技术有限公司 一种校验中继用户设备的方法及装置
US11201958B2 (en) * 2020-01-20 2021-12-14 Ppip, Llc Alternative transport in data communication for mobile device
US11825330B2 (en) 2020-03-13 2023-11-21 Qualcomm Incorporated Techniques for quality of service support in sidelink communications
US11689957B2 (en) * 2020-03-13 2023-06-27 Qualcomm Incorporated Quality of service support for sidelink relay service
CN111414645B (zh) * 2020-03-19 2022-07-05 中国电子科技集团公司第三十研究所 一种实现隐私保护功能的安全hss/udm设计方法及系统
CN115336303A (zh) * 2020-03-31 2022-11-11 华为技术有限公司 一种终端设备标识的获取方法、装置及系统
CN113518319B (zh) * 2020-04-09 2023-03-17 华为技术有限公司 一种临近服务的业务处理方法、设备及系统
CN113543135B (zh) * 2020-04-13 2023-07-11 华为技术有限公司 授权方法、策略控制功能设备和接入和移动管理功能设备
US20210345104A1 (en) * 2020-05-01 2021-11-04 Qualcomm Incorporated Relay sidelink communications for secure link establishment
CN113873613A (zh) * 2020-06-30 2021-12-31 华为技术有限公司 接入控制方法及相关装置
EP4169278A4 (en) * 2020-07-23 2023-12-06 Samsung Electronics Co., Ltd. METHODS AND SYSTEMS FOR IDENTIFYING EXHIBITS AND ACCESSING RELATED KEYS IN 5G PROSE
CA3197006A1 (en) * 2020-10-30 2022-05-05 Huawei Technologies Co., Ltd. Key obtaining method and communication apparatus
CN114650537A (zh) * 2020-12-17 2022-06-21 维沃移动通信有限公司 授信中继通信方法、装置、终端及网络侧设备
CN114915407A (zh) * 2021-02-10 2022-08-16 大唐移动通信设备有限公司 Pc5根密钥处理方法、装置、ausf及远程终端
US20220360966A1 (en) * 2021-05-07 2022-11-10 Qualcomm Incorporated Secure link establishment
CN115499890A (zh) * 2021-06-18 2022-12-20 华为技术有限公司 中继通信的方法、装置和系统
US20230007710A1 (en) * 2021-07-02 2023-01-05 Mediatek Singapore Pte. Ltd. Security mechanism for connection establishment over multi-hop sidelinks
CN115996437A (zh) * 2021-10-20 2023-04-21 华为技术有限公司 中继通信的方法和装置
CN116567590A (zh) * 2022-01-29 2023-08-08 华为技术有限公司 授权方法及装置
CN116866900A (zh) * 2022-03-24 2023-10-10 华为技术有限公司 一种基于信道秘钥的加密方法及装置
WO2023178689A1 (zh) * 2022-03-25 2023-09-28 Oppo广东移动通信有限公司 安全实现方法及装置、设备、网元

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101500229A (zh) * 2008-01-30 2009-08-05 华为技术有限公司 建立安全关联的方法和通信网络系统
US20160269942A1 (en) * 2013-12-20 2016-09-15 Telefonaktiebolaget L M Ericsson (Publ) Restoration of user equipment control in the presence of communication link failure between packet switched and circuit switched controlling nodes
CN106162803A (zh) * 2015-04-02 2016-11-23 中兴通讯股份有限公司 一种中继ue接入控制方法及装置
CN106304036A (zh) * 2015-05-19 2017-01-04 华为技术有限公司 一种提供中继业务的方法和装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101902835B (zh) * 2009-05-27 2014-09-10 中国移动通信集团公司 中继节点识别方法、基站、中继节点及移动管理实体
CN101931935B (zh) * 2009-06-25 2013-09-11 华为技术有限公司 终端接入方法、网络设备和通信系统
CN102595395A (zh) * 2011-01-14 2012-07-18 中兴通讯股份有限公司 一种中继节点的认证方法及系统
JP5021820B1 (ja) * 2011-04-01 2012-09-12 株式会社エヌ・ティ・ティ・ドコモ 移動通信方法及び移動管理ノード
US9521644B2 (en) * 2012-01-31 2016-12-13 Qualcomm Incorporated Methods and apparatus for providing network-assisted end-to-end paging between LTE devices
CN103856927B (zh) * 2012-12-05 2017-05-31 电信科学技术研究院 一种确定用户设备之间邻近关系的方法、设备及通信系统
US8934401B2 (en) * 2013-02-22 2015-01-13 General Dynamics C4 Systems, Inc. Apparatus and methods for relay-assisted uplink communication
US8934400B2 (en) * 2013-02-22 2015-01-13 General Dynamics C4 Systems, Inc. Apparatus and methods for relay-assisted uplink communication
CN104066200B (zh) * 2013-03-21 2020-11-06 北京三星通信技术研究有限公司 一种ue间端到端通信的实现方法及用户设备
WO2015114052A1 (en) * 2014-01-31 2015-08-06 Telefonaktiebolaget L M Ericsson (Publ) Interference mitigation of d2d communications in different coverage scenarios
KR102385539B1 (ko) * 2015-03-02 2022-04-12 삼성전자 주식회사 무선 통신 시스템에서 서비스 제공 방법 및 장치
CN106470382A (zh) * 2015-08-14 2017-03-01 中兴通讯股份有限公司 授权验证方法、配置信息接收方法、装置、基站及终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101500229A (zh) * 2008-01-30 2009-08-05 华为技术有限公司 建立安全关联的方法和通信网络系统
US20160269942A1 (en) * 2013-12-20 2016-09-15 Telefonaktiebolaget L M Ericsson (Publ) Restoration of user equipment control in the presence of communication link failure between packet switched and circuit switched controlling nodes
CN106162803A (zh) * 2015-04-02 2016-11-23 中兴通讯股份有限公司 一种中继ue接入控制方法及装置
CN106304036A (zh) * 2015-05-19 2017-01-04 华为技术有限公司 一种提供中继业务的方法和装置

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113498615A (zh) * 2019-08-16 2021-10-12 Oppo广东移动通信有限公司 通信方法、终端设备和网络设备
WO2021136211A1 (zh) * 2019-12-31 2021-07-08 华为技术有限公司 授权结果的确定方法及装置
CN113132334A (zh) * 2019-12-31 2021-07-16 华为技术有限公司 授权结果的确定方法及装置
CN113132334B (zh) * 2019-12-31 2022-12-27 华为技术有限公司 授权结果的确定方法及装置
CN111404944A (zh) * 2020-03-19 2020-07-10 中国电子科技集团公司第三十研究所 一种实现主认证增强的安全udm/hss设计方法及系统
CN111404944B (zh) * 2020-03-19 2022-03-18 中国电子科技集团公司第三十研究所 一种实现主认证增强的安全udm/hss设计方法及系统
CN113596789A (zh) * 2020-04-30 2021-11-02 维沃移动通信有限公司 设备交互方法及核心网设备
WO2021219102A1 (zh) * 2020-04-30 2021-11-04 维沃移动通信有限公司 设备交互方法及核心网设备
WO2022147846A1 (zh) * 2021-01-11 2022-07-14 华为技术有限公司 一种生成设备间通信的密钥的方法、系统和装置
WO2024067641A1 (zh) * 2022-09-30 2024-04-04 华为技术有限公司 一种通信方法及装置、计算机可读存储介质和通信系统

Also Published As

Publication number Publication date
CN109716810B (zh) 2020-08-25
EP3557898A4 (en) 2019-10-30
EP3557898A1 (en) 2019-10-23
WO2018126534A1 (zh) 2018-07-12
EP3849227A1 (en) 2021-07-14
US20190335332A1 (en) 2019-10-31
CN109716810A (zh) 2019-05-03
EP3557898B1 (en) 2020-11-25

Similar Documents

Publication Publication Date Title
WO2018126452A1 (zh) 授权验证方法和装置
US9749377B2 (en) Method and system for network access control
WO2020024764A1 (zh) 一种鉴权过程中验证用户设备标识的方法及装置
WO2017190590A1 (en) System and method for device identification and authentication
KR20180030034A (ko) 암호화된 클라이언트 디바이스 컨텍스트들에 의한 네트워크 아키텍처 및 보안
JP2017528030A (ja) デバイスを別のデバイスのネットワークサブスクリプションと関係付けること
CN108293223A (zh) 一种数据传输方法、用户设备和网络侧设备
US20130189955A1 (en) Method for context establishment in telecommunication networks
US20220272607A1 (en) Network Access Method and Communication Apparatus
US10904756B2 (en) Authentication for next generation systems
CN110495199B (zh) 无线网络中的安全小区重定向
US11889301B2 (en) Security verification when resuming an RRC connection
WO2018090986A1 (zh) 一种鉴权方法、基站、用户设备和核心网网元
WO2021203891A1 (zh) 控制网络切片认证的方法、装置、设备及存储介质
CN113055879B (zh) 一种用户标识接入方法及通信装置
US10887754B2 (en) Method of registering a mobile terminal in a mobile communication network
WO2018137152A1 (zh) 短消息传输方法、设备和系统
WO2018137195A1 (zh) 消息保护方法、用户设备和核心网设备
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
WO2022228455A1 (zh) 一种通信方法以及相关装置
WO2023004683A1 (zh) 一种通信方法、装置及设备
JP2020505845A (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
CN115942305A (zh) 一种会话建立方法和相关装置
WO2019141135A1 (zh) 支持无线网络切换的可信服务管理方法以及装置
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17890630

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17890630

Country of ref document: EP

Kind code of ref document: A1