WO2018137351A1 - 一种网络密钥处理的方法、相关设备及系统 - Google Patents

一种网络密钥处理的方法、相关设备及系统 Download PDF

Info

Publication number
WO2018137351A1
WO2018137351A1 PCT/CN2017/102864 CN2017102864W WO2018137351A1 WO 2018137351 A1 WO2018137351 A1 WO 2018137351A1 CN 2017102864 W CN2017102864 W CN 2017102864W WO 2018137351 A1 WO2018137351 A1 WO 2018137351A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
key
network element
slice
access
Prior art date
Application number
PCT/CN2017/102864
Other languages
English (en)
French (fr)
Inventor
雷中定
李漓春
张博
刘斐
王海光
康鑫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17893726.4A priority Critical patent/EP3565210B1/en
Publication of WO2018137351A1 publication Critical patent/WO2018137351A1/zh
Priority to US16/517,645 priority patent/US11431479B2/en
Priority to US17/819,188 priority patent/US11917054B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation

Definitions

  • the present invention relates to the field of network security technologies for mobile communication networks, and in particular, to a network key processing method, related device and system.
  • the current mobile communication network (such as 3G/LTE) mainly provides three levels of security: two-way authentication between the terminal and the network, NAS (Non Access Stratum) security, AS (Access Stratum, access layer) Safety. Terminals and networks first pass two-way authentication to confirm the authenticity of each other's identities and generate a root key (K_ASME) that can be used to establish NAS security and AS security.
  • the NAS layer is located at the highest layer of the control plane in the 3GPP EPS (Evolved Packet System) protocol stack, and is used to transmit non-radio access related signaling between the terminal and the core network, mainly for mobile Signaling protocols and procedures for MM (Mobility Management) and Session Management (SM, Session Management).
  • the AS layer is mainly a wireless access protocol stack for interaction between a terminal and a base station.
  • the keys required for NAS security and AS security are derived from K_ASME.
  • a network slice is a virtualized logical private network that can be customized according to different business needs.
  • MME Mobility Management Entity
  • AMF Access and Mobility Management Function
  • SEAF Security Anchor Function
  • session management functions such as (SMF).
  • the network selects one or more slices to the terminal according to some methods.
  • the signaling interaction between the terminal and the slice is performed by AMF, AMF.
  • AMF belongs to the multi-slice sharing function. The first point described above indicates that when a terminal accesses multiple slices simultaneously, the AMF is a junction. This limitation stems from terminal mobility and consideration of the complexity of the network architecture.
  • the terminal's mobility is consistent or unique regardless of access to several slices; on the other hand, if one UE is allowed to access multiple AMFs at the same time, the network function or the link between the network elements and the interface may be significantly increased. Number and complexity.
  • the slice exchanges NAS signaling with the terminal, if the slice 1 (or slice 2) sends the NAS information to the terminal, the NAS information is unencrypted plaintext for the AMF.
  • the SMF When an attacker invades AMF, it can easily obtain the information sent by the SMF, which easily causes the leaked NAS information to leak.
  • the embodiment of the present application provides a network key processing method, related device, and system, which are used to improve the security of network signaling interaction.
  • the first aspect of the present application provides a network key processing system, including: a user equipment, a security anchor network element, and an access and mobility management network element, where:
  • the security anchor network element is configured to acquire a first key parameter from a slice selection network element, where the first key parameter includes N Identification information of the network slice, wherein the N network slices select a network slice determined by the network element for the user equipment, and generate N slice private keys according to the first key parameter; N is an integer greater than or equal to 1, and the N network slices are one or more network slices selected by the core network to the user equipment when the user equipment performs mutual authentication with the core network.
  • the user equipment first sends the identifier of the network slice to be accessed to the core network, and then the network element in the core network, for example, the network element of the slice selection function determines the corresponding network slice according to the identifier of the network slice sent by the user equipment.
  • the network element of the slice selection function may also first determine whether the network slice corresponding to the identifier can be allocated to the user equipment, and if yes, assign it to the user equipment, and if not, assign it to the user equipment. User equipment.
  • the security anchor network element is further configured to separately send the N slice private keys to the corresponding N network slices; the security anchor network element may generate the generated information according to the identifier information of the N network slices.
  • the N private keys are respectively sent to the corresponding N network slices, and each network slice receives the private key corresponding to the identifier, and if the receiving is successful, the confirmation information of the successful reception may be sent to the security anchor network element.
  • the access and mobility management network element is configured to acquire the first key parameter from the slice selection network element or the security anchor network element, and send the first key parameter to the user equipment
  • the first key parameter includes the identification information of the N network slices, and the slice selection network element and the security anchor network element in the core network have obtained the identification information, so the identification information can be sent to the access by the security anchor point.
  • the mobile management network element, or the slice selection network element sends the identification information to the access and mobility management network element.
  • the user equipment is configured to generate N slice private keys of the N network slices according to the first key parameter, and access the N network slices according to the generated N slice private keys.
  • the user equipment and the security anchor network element pre-agreed to use the same key generation rule to generate a private key.
  • the N slice private keys generated by the user equipment are the same as the N slice private keys generated by the security anchor network element, so that the user equipment can sequentially access the N networks according to the N slice private keys. slice.
  • different private keys are set for different network slices, and the user equipment can produce the same private key of the network slice, so that the user equipment can perform signaling interaction with the network slice, thereby reducing the use.
  • the security anchor network element is further configured to generate a shared key for the access and mobility management network element according to the second key parameter, and send the second key parameter to The access and mobility management network element, the shared key is used by a shared network function of the N network slices;
  • the access and mobility management network element is further configured to receive the second key parameter sent by the security anchor network element;
  • the user equipment is further configured to: after receiving the second key parameter from the access and mobility management network element, generate the same shared key to enable access to the shared network function of the N network slices.
  • different network slices may also have the same network function.
  • some common basic functions are generally set to share network functions, and such functions are generally provided when each user equipment is accessed. These network functions are not necessarily set to be specifically protected by the network slice in the network slice, so that signaling interaction with all legitimate user equipments can be performed by setting a shared key.
  • the access and mobility management network element is further configured to:
  • the shared key is used as the first key Parameters are encrypted
  • the access and mobility management network element is specifically configured to:
  • the access and mobility management network element sends the encrypted first key parameter to the user equipment by using a slice security mode command
  • the user equipment is specifically configured to receive the encrypted first key parameter that is sent by the access and mobility management network element by using a slice security mode command.
  • the access and mobility management network element sends the first key parameter to the user equipment
  • the data packet may be intercepted, so that the attacker obtains the content information of the first key parameter in the data packet, because
  • the first key parameter includes the identification information of the network slice accessed by the user equipment, so that the type of the network slice accessed by the user equipment is obtained, which may cause the personal information of the user equipment to leak, or may even cause The attacker directly accesses the corresponding network slice through the first key parameter, thereby performing an illegal operation. Therefore, in the present application, before the first key is sent to the user equipment by the access and mobility management network element, the first key may be encrypted, and the first key may be encrypted by using the shared key. After receiving the key parameter of the shared key, the user equipment can extract and parse the content of the encrypted data packet, thereby acquiring the first key parameter. In this way, the security of network communication is improved.
  • system further includes a network slice, where:
  • the network slice is configured to receive a private key sent by the security anchor network element
  • the network slice is further configured to encrypt M network functions according to an encryption parameter, where the encryption parameter includes the private key and a function identifier of the M network functions;
  • the network slice is further configured to send the encryption parameter to the access and mobility management network element
  • the access and mobility management network element is further configured to send the encryption parameter to the user equipment
  • the user equipment is further configured to receive the encryption parameter, and access the M network functions of the network slice according to the encryption parameter.
  • Each network slice may contain multiple network functions. Different network functions have different degrees of importance. More important network functions should set more complex encryption methods.
  • each of the network slices can be Network functions are encrypted to improve the security of different network functions. Specifically, the encryption algorithm of each network function may be the same or different. After being encrypted, the encrypted parameter is sent to the user equipment, so that the user equipment can access the encrypted network function according to the encrypted parameter.
  • a second aspect of the present application provides a security anchor network element, where the network element includes:
  • An acquiring unit configured to acquire a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices, and the N network slices select a network element for the slice as the user The network slice determined by the device;
  • a generating unit configured to generate N private keys according to the first key parameter
  • a sending unit configured to separately send the N slice private keys to the corresponding N network slices, so that after the user equipment receives the first key parameter from the access and mobility management network element, The same N slice private keys are generated to enable access to the N network slices.
  • the sending unit is further configured to:
  • the generating unit is further configured to:
  • the third aspect of the present application provides an access and mobility management network element, where the network element includes:
  • An acquiring unit configured to acquire the first key parameter from a slice selection network element or a security anchor network element, where the first key parameter includes identifier information of N network slices, and the N network slices are
  • the slice selection network element is a network slice determined by the user equipment; the first key parameter is used by the security anchor network element to generate N slice private keys, and the N slice private keys are sent to the phase Corresponding to the N network slices.
  • a sending unit configured to send the first key parameter to the user equipment, so that the user equipment generates the same N slice private keys according to the first key parameter, thereby being able to access the N network slices are described.
  • the network element further includes:
  • a receiving unit configured to receive a second key parameter sent by the security anchor network element, where the second key parameter is used by the security anchor network element to generate a shared secret for the access and mobility management network element a key, the shared key being used by a shared network function of the N network slices;
  • the sending unit is further configured to send the second key parameter to the user equipment, so that the user equipment generates the same shared key according to the second key parameter to enable access to the Shared network function of N network slices.
  • the network element further includes:
  • An encryption unit configured to send, by the sending unit, the shared key by using the shared key before the sending unit sends the first key parameter to the user equipment by using a slice security mode command Encrypting a key parameter
  • the sending unit is further specifically configured to:
  • the encrypted first key parameter is sent to the user equipment by using a slice security mode command.
  • the receiving unit is further configured to:
  • the transmitting unit Before the transmitting unit sends the encrypted first key parameter to the user equipment by using a slice security mode command, receiving an encryption parameter sent by the N network slices, where the encryption parameter is the N
  • the sending unit is further configured to:
  • a fourth aspect of the present application provides a network slice, where the network slice includes:
  • a receiving unit configured to receive a private key sent by the security anchor network element
  • An encryption unit configured to encrypt M network functions according to the encryption parameter, where the encryption parameter includes the private key and a function identifier of the M network functions;
  • a sending unit configured to send the encryption parameter to the access and mobility management network element, so that the access and mobility management network element sends the encryption parameter to the user equipment, so that the user equipment is encrypted according to the The parameter accesses the M network functions of the network slice.
  • a fifth aspect of the present application provides a user equipment, where the user equipment includes:
  • a receiving unit configured to receive a first key parameter sent by the access and mobility management network element, where the first key parameter includes identifier information of N network slices, and the N network slices select the slice
  • the network element is a network slice determined by the user equipment;
  • the first key parameter is used by the security anchor network element to generate N slice private keys, and the N slice private keys are sent to corresponding The N network slices;
  • a generating unit configured to generate the same N slice private keys according to the first key parameter, so as to be able to access the N network slices.
  • the receiving unit is further configured to:
  • the user equipment further includes:
  • a generating unit configured to generate the same shared key according to the second key parameter to enable access to the shared network function of the N network slices.
  • the receiving unit is further configured to:
  • the receiving unit is further configured to:
  • the access and mobility management network element Receiving, by the access and mobility management network element, the first key parameter and the encryption parameter that are encrypted according to the shared key, and the encryption parameter is in the N network slices.
  • the user equipment further includes:
  • an access unit configured to access the M network functions of the N network slices according to the encryption parameter.
  • the sixth aspect of the present application provides a method for processing a network key, which is applied to a security anchor network element side, and the method includes:
  • the security anchor network element obtains the first key parameter from the slice selection network element, where the first key parameter includes identification information of the N network slices, and the N network slices select the network element as the slice as the user The network slice determined by the device;
  • the security anchor network element generates N private keys according to the first key parameter
  • the security anchor network element separately sends the N slice private keys to the corresponding N network slices, so that the user equipment receives the first key parameter from the access and mobility management network element. Thereafter, the same N slice private keys are generated to enable access to the N network slices.
  • the method further includes:
  • the security anchor network element sends the first key parameter to the access and mobility management network element, and the access and mobility management network element sends the first key parameter to the user equipment.
  • the method further includes:
  • the security anchor network element generates a shared key for the access and mobility management network element according to the second key parameter, and sends the second key parameter to the access and mobility management network element.
  • the shared key is used by the shared network function of the N network slices, so that after the user equipment receives the second key parameter from the access and mobility management network element, the same The shared key is thereby able to access the shared network function of the N network slices.
  • a seventh aspect of the present application provides a network key processing method, which is applied to an access and mobility management network element side, where the method includes:
  • the access and mobility management network element obtains the first key parameter from a slice selection network element or a security anchor network element, where the first key parameter includes identifier information of N network slices, and the N network slices are
  • the slice selection network element is a network slice selected by the user equipment; the first key parameter is used by the security anchor network element to generate N slice private keys, and the N slice private key is sent The corresponding N network slices are given.
  • the access and mobility management network element sends the first key parameter to the user equipment, so that the user equipment generates the same N slice private key according to the first key parameter. Thereby the N network slices can be accessed.
  • the method further includes:
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, where the second key parameter is used by the security anchor network element as the access and mobility management network Generating a shared key, the shared key being used for shared network functions of the N network slices;
  • the access and mobility management network element sends the second key parameter to the user equipment, so that the user equipment generates the same shared key according to the second key parameter to enable access to the The shared network function of N network slices.
  • the access and mobility management network element sends the second key parameter to the user equipment, including:
  • the access and mobility management network element sends the second key parameter to the user equipment by using the slice security mode command.
  • the method before the access and mobility management network element sends the first key parameter to the user equipment by using a slice security mode command, the method further includes:
  • the access and mobility management network element encrypts the first key parameter by using the shared key
  • the accessing and the mobile management network element sends the first key parameter to the user equipment by using a slice security mode command, including:
  • the access and mobility management network element sends the encrypted first key parameter to the user equipment by using a slice security mode command.
  • the method before the access and mobility management network element sends the encrypted first key parameter to the user equipment by using a slice security mode command, the method further includes:
  • the accessing and the mobile management network element sends the encrypted first key parameter to the user equipment by using a slice security mode command, including:
  • the access and mobility management network element sends the encrypted first key parameter and the encryption parameter to the user equipment by using a slice security mode command, so that the user equipment is configured according to the encryption parameter. Accessing the M network functions of the N network slices.
  • the eighth aspect of the present application provides a method for processing a network key, which is applied to a network slice side, where the method includes:
  • the network slice encrypts M network functions according to an encryption parameter, where the encryption parameter includes the private key and a function identifier of the M network functions;
  • the network slice sends the encryption parameter to the access and mobility management network element, so that the access and mobility management network element sends the encryption parameter to the user equipment, so that the user equipment according to the encryption parameter Accessing the M network functions of the network slice.
  • a ninth aspect of the present application provides a method for processing a network key, which is applied to a user equipment side, and the method includes:
  • the first key parameter sent by the access and mobility management network element, where the first key parameter includes identification information of N network slices, and the N network slices are the slice selection network a network slice determined by the user equipment; the first key parameter is used by the security anchor network element to generate N slice private keys, and the N slice private key is sent to the corresponding location N network slices;
  • the user equipment generates the same N slice private keys according to the first key parameter, so that the N network slices can be accessed.
  • the method further includes:
  • the user equipment generates the same shared key according to the second key parameter to enable access to the shared network function of the N network slices.
  • the user equipment receives the second key parameter sent by the access and mobility management network element, including:
  • the user equipment receives the second key parameter sent by the access and mobility management network element by using the slice security mode command.
  • the receiving, by the user equipment, the second key parameter that is sent by the access and mobility management network element by using the slice security mode command includes:
  • the user equipment receives the first key parameter that is encrypted according to the shared key sent by the access and mobility management network element by using a slice security mode command.
  • the user equipment receives the first key parameter that is sent by the access and mobility management network element and is encrypted according to the shared key, and includes:
  • the user equipment accesses the M network functions of the N network slices according to the encryption parameter.
  • a tenth aspect of the present application provides a security anchor device, where the security anchor device includes a transceiver, a processor, and a memory, where the memory is used to store programs and data; and the processor calls a program in the memory.
  • the security anchor device includes a transceiver, a processor, and a memory, where the memory is used to store programs and data; and the processor calls a program in the memory.
  • An eleventh aspect of the present application provides an access and mobility management device, where the access and mobility management device includes a transceiver, a processor, and a memory, where the memory is used to store programs and data;
  • the program in the memory is for performing the method of network key processing described in any implementation of the seventh aspect.
  • a twelfth aspect of the present application provides a network slicing device, the network slicing device comprising a transceiver, a processor, and a memory, wherein the memory is used to store programs and data; the processor calls a program in the memory for A method of network key processing as described in any implementation of the eighth aspect.
  • a thirteenth aspect of the present application provides a user equipment, where the user equipment includes a transceiver, a processor, and a memory, where the memory is used to store programs and data; and the processor calls a program in the memory for executing A method of network key processing described in any of the nine aspects.
  • a fourteenth aspect of the present application provides a computer readable storage medium having stored therein instructions that, when executed on a computer, cause the computer to perform the methods described in the above aspects.
  • a fifteenth aspect of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the above aspects.
  • the embodiments of the present application have the following advantages:
  • different private keys are set for different network slices, and the user equipment can generate the same private key of the network slice, so that the user equipment can perform signaling interaction with the network slice, thereby reducing the use of shared secrets. Security risks when the key performs signaling interaction.
  • FIG. 1 is a schematic structural diagram of network key processing provided in an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of the user equipment 10, the security anchor device 30, the access and mobility management device 40, and the network slice 50 provided in the embodiment of the present application;
  • FIG. 3 is a schematic flowchart of a first embodiment of a method for processing a network key provided in an embodiment of the present application
  • FIG. 4 is a schematic flowchart of a second embodiment of a method for processing network key provided in an embodiment of the present application
  • FIG. 5 is a schematic flowchart diagram of a third embodiment of a method for processing network key provided in an embodiment of the present application
  • FIG. 6 is a schematic flowchart diagram of a fourth embodiment of a method for processing a network key according to an embodiment of the present disclosure
  • FIG. 7 is a schematic flowchart diagram of a fifth embodiment of a method for processing network key provided in an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a key architecture provided in an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another key architecture provided in the embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a network key processing system and a related network element in a network key processing system according to an embodiment of the present application;
  • 11A-11F are six schematic diagrams of key derivation performed by a first device provided in an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of key generation and distribution performed by a first device according to an embodiment of the present disclosure
  • FIG. 13 is a schematic diagram of an overall key structure provided in an embodiment of the present application.
  • the embodiment of the present application provides a network key processing method, related device, and system, which are used to improve the security of network signaling interaction.
  • Network slicing is a virtualized logical private network that can be customized to meet different business needs.
  • the operation and management methods of network slicing are diverse.
  • MNO Mobile network operator
  • a slice can be shared by different users.
  • one or more network slices of the MNO can also be leased to the vertical industry, which operates, manages, and authenticates user equipment (mobile terminals or IoT devices, etc.).
  • user equipment mobile terminals or IoT devices, etc.
  • For the user equipment accessing the slice first, the user equipment needs to access the slice through the service of the MNO, and then manage the user equipment by the slice. That is to say, the user equipment has to interact with the MNO network as well as with the network slice.
  • the MME function is decomposed into network functions such as AMF, SEAF, and SMF.
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • SEAF Security Anchor Function, Security
  • Anchor function is the name used in the current 3GPP SA2 and SA3 standard working group's manuscript and technical report (TR).
  • FIG. 1 is a schematic structural diagram of network key processing according to an embodiment of the present invention.
  • the system 100 for network key processing may include: user equipment 10, access network element 20, security anchor network element 30, access and mobility management network element 40, and network slice 50. among them:
  • the access network element 20 can be used to provide network access services for the user equipment 10.
  • the access network element 20 may include a base station (NodeB), a base station controller (Radio Network Controller, RNC), or an access gateway.
  • the user equipment 10 may include user terminals such as a mobile phone, a tablet computer, a notebook computer, a mobile Internet device (MID), and a wearable device (such as a smart watch, a smart bracelet, a pedometer, etc.). It may include an IoT device, and may also include other communication devices that can access the MNO network.
  • the security anchor network element 30 can be used to provide services such as network authentication and key generation for all UEs accessing the network, and specifically includes network functions such as SEAF configured in the core network CN.
  • the security anchor network element 30 is configured to generate a shared key for the access and mobility management network element, and is also used to generate a private key for the plurality of network slices 50 accessed by the user equipment 10.
  • the access and mobility management network element 40 is configured to generate the parameters of the shared key by the security anchor network element 30 and generate a private secret.
  • the parameters of the key are sent to the user equipment 10, which is then able to derive the private key of the network slice so that the accessed network slice can be accessed.
  • each network slice is provided with a private key, so that the NAS signaling that the user equipment interacts with the network slice is not easily acquired, thereby improving the security of the network communication.
  • the access network element 20 includes only one network entity (for example, a base station), the operations performed by the subsequently described access network element 20 are performed by the one network entity.
  • the access network element 20 includes a plurality of network entities (e.g., a base station and a base station controller), the operations performed by the subsequently described access network element 20 are performed cooperatively by the plurality of network entities.
  • the security anchor network element 30 includes only one network entity (e.g., SEAF), the operations performed by the security anchor network element 30 described subsequently are performed by the one network entity.
  • the security anchor network element 30 includes a plurality of network entities (e.g., SEAF and AMF), the operations performed by the security anchor network element 30 described subsequently are coordinated by the plurality of network entities.
  • the access and mobility management network element 40 includes only one network entity (e.g., AMF), the operations performed by the access and mobility management network element 40 described subsequently are performed by the one network entity.
  • the access and mobility management network element 40 includes a plurality of network entities (e.g., SEAF and AMF), the operations described by the access and mobility management network elements 40 described subsequently cooperate to complete the plurality of network entities.
  • the cooperation completion means that a plurality of network entities each perform some operations, and data and parameters generated by performing the operations may be transmitted between the plurality of network entities as needed.
  • the security anchor network element 30 may also include more or less network functions, and the access and mobility management network element 40 may also include more or less slice network functions.
  • the names of the security anchor network element, the access and mobility management network element, and the access network element in the present application may be other names in actual applications, and these network element names cannot be used in this application.
  • the application constitutes a limitation, and it is within the scope of the present application as long as it has the functions and functions described in the embodiments of the present application.
  • FIG. 2 is a schematic diagram of a communication apparatus according to an embodiment of the present invention.
  • the user equipment 10 or the secure anchor device 30 or the access and mobility management device 40 or network slice 50 of FIG. 1 may be implemented by the communication device (or system) 200 shown in FIG. 2.
  • the communication device (or system) 200 can include at least one processor 401, a memory 403, and at least one communication interface 404. These components can communicate over one or more communication buses 402.
  • FIG. 2 is only an implementation manner of the embodiment of the present invention.
  • the communication device 200 may further include more or less components, which are not limited herein.
  • Communication interface 404 is for receiving and transmitting radio frequency signals coupled to the receiver and transmitter of communication device 200.
  • the communication interface 404 communicates with the communication network and other communication devices through radio frequency signals, such as Ethernet, Radio Access Technology (RAN), Wireless Local Area Networks (WLAN), and the like.
  • the communication protocol supported by the communication interface 404 may include, but is not limited to, 2G/3G, LTE, Wi-Fi, 5G New Radio (NR), and the like.
  • Memory 403 is coupled to processor 401 for storing various software programs and/or sets of instructions.
  • memory 403 can include high speed random access memory, and can also include non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid state storage devices.
  • the memory 403 can store an operating system (hereinafter referred to as the system), such as ANDROID, IOS, WINDOWS, or LINUX embedded operating systems.
  • the memory 403 can be used to store implementations of embodiments of the present invention.
  • the memory 403 can also store a network communication program that can be used to communicate with one or more additional devices, one or more terminal devices, one or more network devices.
  • the processor 401 can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of the present invention. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • communication device 200 can also include an output device 405 and an input device 406.
  • Output device 405 is in communication with processor 401 and can display information in a variety of ways.
  • the output device 405 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 406 is in communication with processor 401 and can accept user input in a variety of ways.
  • input device 406 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the memory 202 may also store a user interface program that can realistically display the content of the application through a graphical user interface.
  • the user receives control of the application through input controls such as menus, dialog boxes, and buttons.
  • one or more software modules may be stored in the memory of the communication device 200, and may be used to provide an access request, a user authentication response, and the like. For details, refer to the following method embodiments.
  • the communication device 200 shown in FIG. 2 is implemented as the security anchor device 30 shown in FIG. 1
  • one or more software modules may be stored in the memory of the communication device 200, which may be used to provide functions such as generating a key, specifically Reference is made to subsequent method embodiments.
  • the communication device 200 shown in FIG. 2 is implemented as the access and mobility management device 40 shown in FIG. 1, one or more software modules may be stored in the memory of the communication device 200, which may be used to provide encryption of key parameters.
  • one or more software modules may be stored in the memory of the communication device 200, and may be used to provide a function of encrypting network functions, specifically Reference is made to subsequent method embodiments.
  • FIG. 3 is a schematic flowchart diagram of a first embodiment of a method for processing network key according to an embodiment of the present invention.
  • the security anchor network element generates a slice-specific control plane key, which is described below:
  • S101 user equipment and core network (SEAF), and network slice perform mutual authentication.
  • SEAF user equipment and core network
  • the core network when the user equipment performs authentication, the core network generates a root-density K_SEAF.
  • a slice selection network element e.g., NSSF
  • N network slices e.g., slice IDs
  • Slc-ID1...Slc-IDN e.g., Slc-ID1...Slc-IDN for the user equipment. That is, the slice selection network element obtains the identification information of the determined N network slices.
  • the security anchor network element generates a shared key for the access and mobility management network element according to the K_SEAF and the second key parameter, where the shared key is a control plane shared key.
  • the control plane shared key is used by a shared network function of a control plane of the N network slices, where the second key parameter includes a key algorithm type discrimination code (Algorithm Distinguisher) and a key algorithm ID ( Algorithm ID) and other information.
  • the second key parameter includes a key algorithm type discrimination code (Algorithm Distinguisher) and a key algorithm ID ( Algorithm ID) and other information.
  • the security anchor network element obtains a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices.
  • the security anchor network element generates N slice private keys according to the K_SEAF and the first key parameter, where the private key is a control plane private key.
  • KCP-S1 . . . KCP-SN slice-specific control plane root key
  • the security anchor network element may further generate, according to the second key parameter, a key algorithm type discrimination code, a key algorithm ID, or the like as a key parameter.
  • the key algorithm type distinguishing code needs to be set to a value corresponding to the slice-specific control plane key algorithm.
  • the security anchor network element separately sends the N slice private keys to the corresponding N network slices.
  • the network slice may also reply to the security anchor network element respectively.
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, and a parameter such as a K_SEAF identification code, a terminal security capability, and a NAS message authentication code.
  • the access and mobility management network element sends the second key parameter, a K_SEAF identification code, a terminal security capability, and a NAS message authentication code to the user equipment.
  • the first key parameter sent by the security anchor network element is sent to the access and mobility management network element.
  • the first key parameter may also be sent by the slice selection network element (such as NSSF) to the access and mobility management network element.
  • the slice selection network element such as NSSF
  • the access and mobility management network element sends the first key parameter to the user equipment.
  • the first key parameter may include information such as a slice ID: Slc-ID1...Slc-IDN and a value corresponding to a key algorithm type discrimination code set to a slice-specific control plane key algorithm (NAS-Slc),
  • NAS-Slc slice-specific control plane key algorithm
  • the existing transmission command cannot carry the identification information, and the sending command defined in this application is a Slice Security Mode Command (SSMC), and the first secret is sent by the SSMC. Key to the user device.
  • SSMC Slice Security Mode Command
  • the user equipment derives a control plane slice sharing key (AMF or CCNF) according to parameters such as receiving the second key parameter and the K_SEAF identification code.
  • AMF control plane slice sharing key
  • CCNF control plane slice sharing key
  • the user equipment is configured according to the received first key parameter and the second key parameter (where the key algorithm type distinguishing code needs to be set to a value corresponding to a slice-specific control plane key algorithm) and a K_SEAF identification code. Parameters, derivation control plane slice private key.
  • the parameter of the generation function KDF of the key for generating the Nth slice is: KDF (K_SEAF, Slc-ID1, NAS-Slc, Alg-ID), wherein KDF is a security anchor network element generated for each network slice.
  • KDF is a security anchor network element generated for each network slice.
  • the generation function used by the private key, NAS-Slc sets the key algorithm type discrimination code parameter to the value corresponding to the slice-specific control plane key algorithm
  • the Alg-ID is the key algorithm ID).
  • the user equipment obtains the key parameter of the dedicated control plane key generated by the security anchor network element for each network slice, and can generate a corresponding key according to the key parameter and access each network slice accessed. , that is, improve the network
  • the security of the communication ensures the normal communication of the user equipment.
  • FIG. 4 is a schematic flowchart diagram of a second embodiment of a method for network key processing according to an embodiment of the present invention.
  • the parameter for generating the slice-specific control plane key is further encrypted before being sent to the user equipment, and the following description is expanded:
  • S201 user equipment and core network (SEAF), and network slice perform mutual authentication.
  • SEAF user equipment and core network
  • the security anchor network element generates a control plane shared key for the access and mobility management network element according to the K_SEAF and the second key parameter.
  • the security anchor network element obtains a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices.
  • the security anchor network element generates N slice-specific control plane keys according to the K_SEAF and the first key parameter.
  • the security anchor network element separately sends the control plane keys dedicated to the N slices to the corresponding N network slices.
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, and a parameter such as a K_SEAF identification code, a terminal security capability, and a NAS message authentication code.
  • the access and mobility management network element sends the second key parameter, a K_SEAF identification code, a terminal security capability, and a NAS message authentication code to the user equipment.
  • the first key parameter sent by the security anchor network element is sent to the access and mobility management network element.
  • the access and mobility management network element encrypts the first key parameter by using the shared key.
  • the identification information of the network slice that is accessed by the user equipment has a certain privacy in the actual application, and the attacker obtains the network slice accessed by the user equipment.
  • the identifier is obtained, so that the type of the network slice accessed by the user equipment may be obtained, so that other attacks are launched, which poses a certain security risk to the user equipment. Therefore, the first key parameter is encrypted before the first key parameter is transmitted.
  • encryption integrity protection is also needed, and a piece of data may be added to the encrypted data packet, so that the receiving end determines whether the data packet is modify.
  • the access and mobility management network element embeds the encrypted first key parameter into the SSMC command, and sends the encrypted first key parameter to the user equipment by using the access network element.
  • the user equipment derives a control plane slice sharing key (AMF or CCNF) according to parameters such as receiving the second key parameter and the K_SEAF identification code.
  • AMF control plane slice sharing key
  • CCNF control plane slice sharing key
  • the user equipment decrypts the first key parameter according to the control plane slice sharing key obtained by the derivation, according to the decrypted first key parameter and the second key parameter (where the key algorithm type distinguishing code needs)
  • the parameters corresponding to the slice-specific control plane key algorithm are set, and the K_SEAF identification code and other parameters are derived from the control plane slice private key.
  • FIG. 5 is a schematic flowchart diagram of a third embodiment of a method for processing network key according to an embodiment of the present invention.
  • the number of signaling transmissions is optimized and reduced, and parameters of the shared control key of the slice control plane and the parameters of the slice-specific control plane key are transmitted by sending an SSMC signaling, thereby saving air interface resources.
  • S301 user equipment and core network (SEAF), and network slice perform mutual authentication.
  • SEAF user equipment and core network
  • the security anchor network element generates a shared key for the access and mobility management network element according to the K_SEAF and the second key parameter.
  • the security anchor network element obtains a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices.
  • the security anchor network element generates N slice private keys according to the first key parameter K_SEAF.
  • the security anchor network element separately sends the control plane keys dedicated to the N slices to the corresponding N network slices.
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, and a parameter such as a K_SEAF identification code, a terminal security capability, and a NAS message authentication code.
  • the security anchor network element sends the first key parameter, a K_SEAF identification code, a terminal security capability, a NAS message authentication code, and the like to the access and mobility management network element.
  • the access and mobility management network element sends the second key parameter, the K_SEAF identification code, the terminal security capability, the NAS message authentication code, and the first key parameter to the user equipment through the SSMC.
  • the user equipment derives a control plane slice shared key (AMF or CCNF) according to parameters such as receiving the second key parameter and the K_SEAF identification code.
  • AMF control plane slice shared key
  • CCNF control plane slice shared key
  • the user equipment is configured according to the received first key parameter and the second key parameter (where the key algorithm type distinguishing code needs to be set to a value corresponding to a slice-specific control plane key algorithm) and a K_SEAF identification code. Parameters, derivation control plane slice private key.
  • FIG. 6 is a schematic flowchart diagram of a fourth embodiment of a method for processing network key according to an embodiment of the present invention.
  • the number of signaling transmissions is optimized and reduced, and the parameters of the slice sharing key and the parameters of the slice private key are transmitted by sending an SSMC signaling, thereby achieving the purpose of saving air interface resources, and Before sending the SSMC, encrypt the parameters of the slice private key.
  • the following description is expanded:
  • S401 user equipment and core network (SEAF), and network slice perform mutual authentication.
  • SEAF user equipment and core network
  • the security anchor network element generates a slice control plane shared key for the access and mobility management network element according to the K_SEAF and the second key parameter.
  • the security anchor network element obtains a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices.
  • the security anchor network element generates N slice-specific control plane keys according to the K_SEAF and the first key parameter.
  • the security anchor network element separately sends the control plane keys dedicated to the N slices to the corresponding N network slices.
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, and a parameter such as a K_SEAF identification code, a terminal security capability, and a NAS message authentication code.
  • the first key parameter sent by the security anchor network element a K_SEAF identification code, a terminal security capability, The NAS message authentication code and other parameters are given to the access and mobility management network element.
  • the access and mobility management network element encrypts the first key parameter by using the slice control plane shared key.
  • the access and mobility management network element sends the second key parameter, the K_SEAF identification code, the terminal security capability, the NAS message authentication code, and the like, and the encrypted first key parameter to the user equipment through the SSMC. .
  • the user equipment derives a control plane slice shared key (AMF or CCNF) according to parameters such as receiving the second key parameter and the K_SEAF identification code.
  • AMF control plane slice shared key
  • CCNF control plane slice shared key
  • the user equipment decrypts the first key parameter according to the control plane slice shared key obtained by the derivation, according to the decrypted first key parameter and the second key parameter (where the key algorithm type distinguishing code is needed)
  • the parameters corresponding to the slice-specific control plane key algorithm are set, and the K_SEAF identification code and other parameters are derived from the control plane slice private key.
  • FIG. 7 is a schematic flowchart diagram of a fifth embodiment of a method for network key processing according to an embodiment of the present invention.
  • the number of signaling transmissions is optimized and reduced, and the parameters of the slice sharing key and the parameters of the slice private key are transmitted by sending an SSMC signaling, thereby achieving the purpose of saving air interface resources, and Before sending the SSMC, encrypt the parameters of the slice private key, and perform encryption (and key generation and distribution) of the network element granularity for the case where multiple control plane network functions are included in each slice. :
  • S501 user equipment and core network (SEAF), and network slice perform mutual authentication.
  • SEAF user equipment and core network
  • the security anchor network element generates a slice control plane shared key for the access and mobility management network element according to the K_SEAF and the second key parameter.
  • the security anchor network element obtains a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices.
  • the security anchor network element generates N slice private keys according to the K_SEAF and the first key parameter.
  • the security anchor network element separately sends the control plane keys dedicated to the N slices to the corresponding N network slices.
  • the N network slices perform control of M network element functions in each slice according to the N slice control plane private keys and IDs of M network functions in the slice: NF-ID1...NF-IDM Face key.
  • the derivation function can be KDF (KCP-sn, NF-IDm, Slc-NF, Alg-ID).
  • the encryption parameters used to generate the network element function key are then encrypted with each slice-specific control plane key, the encryption parameters including the functional identification of the M network functions. For example, enc (KCP-sn, NF-IDm), where KCP-sn is the control plane private key of the network slice, and NF-IDm is the function identifier of the mth network function.
  • the network slice sends the encrypted network element key generation parameter and other generation parameters, such as Slc-NF and Alg-ID, to the access and mobility management network element.
  • the access and mobility management network element receives a second key parameter sent by the security anchor network element, and a parameter such as a K_SEAF identification code, a terminal security capability, and a NAS message authentication code.
  • the first key parameter and the K_SEAF identification code, the terminal security capability, and the NAS message authentication code sent by the security anchor network element are sent to the access and mobility management network element.
  • the access and mobility management network element encrypts the first key parameter by using the slice control plane shared key.
  • the access and mobility management network element generates the encrypted network element key generation parameter and other generated parameters, such as parameters such as Slc-NF and Alg-ID, and a second key parameter, and the first encrypted element.
  • the key parameters are sent to the user equipment through the SSMC.
  • S512 The user equipment derives a control plane slice sharing key (AMF or CCNF) according to the received second key parameter and a K_SEAF identification code.
  • AMF control plane slice sharing key
  • CCNF control plane slice sharing key
  • the user equipment decrypts the encrypted first key parameter according to the derived control plane slice sharing key, and deduces the control plane slice according to the decrypted first key parameter, the second key parameter, and the K_SEAF identification code.
  • Private key Decrypting the network function generation parameters encrypted in the slice according to the derivation control slice private key, and continuing to push the private key of the network function in the control plane slice.
  • a key KDF KCP-sn, NF-ID1, Slc-NF, Alg-ID
  • the finally obtained key and its mutual derivation relationship can be represented by a tree structure diagram (ie, a key architecture).
  • a key architecture (same) corresponding to the first to fourth embodiments
  • FIG. 9 is a slice key architecture corresponding to the fifth embodiment.
  • enc represents the encryption key
  • int represents the integrity protection key (ie the key required to generate the message authentication code MAC)
  • CP refers to the control plane.
  • Kcp-c represents the control plane shared key
  • Kcp-s1 represents the control plane private key of slice
  • Kcp-c-NF1-enc represents the encryption key of the control plane shared network function
  • Kcp-c-NF1-int represents The control plane shares the integrity protection key of network function
  • Kcp-s1-NF1-enc represents the encryption key of control plane dedicated network function 1 of slice
  • Kcp-s1-NF1-enc represents the control plane private network of slice 1.
  • Function 1 integrity protection key is the integrity protection key.
  • FIG. 10 is a schematic structural diagram of a network authentication system and related network elements in the network authentication system according to an embodiment of the present invention.
  • the network key processing system 300 can include a security anchor network element 301, an access and mobility management network element 302, a network slice 303, a user equipment 304, and an access network element 305. The description is expanded below.
  • the security anchor network element 301 may include an obtaining unit 3011, a generating unit 3012, and a transmitting unit 3013, where:
  • the obtaining unit 3011 is configured to obtain a first key parameter from the slice selection network element, where the first key parameter includes identifier information of N network slices, and the N network slices select the network element for the slice as a network slice determined by the user equipment;
  • a generating unit 3012 configured to generate N private keys according to the first key parameter
  • the sending unit 3013 is configured to separately send the N slice private keys to the corresponding N network slices, so that the user equipment receives the first key parameter from the access and mobility management network element. Generating the same N slice private keys to enable access to the N network slices.
  • the sending unit 3013 is further configured to:
  • the generating unit 3012 is further configured to:
  • the shared network function of the N network slices is used to enable the user equipment to generate the phase after receiving the second key parameter from the access and mobility management network element.
  • the same shared key is thereby able to access the shared network function of the N network slices.
  • the access and mobility management network element 302 can include an obtaining unit 3021, a sending unit 3022, a receiving unit 3023, and an encryption unit 3024, where:
  • the obtaining unit 3021 is configured to acquire the first key parameter from a slice selection network element or a security anchor network element, where the first key parameter includes identifier information of N network slices, and the N network slices are
  • the slice selection network element is a network slice determined by the user equipment; the first key parameter is used by the security anchor network element to generate N slice private keys, and the N slice private key is sent to Corresponding to the N network slices.
  • the sending unit 3022 is configured to send the first key parameter to the user equipment, so that the user equipment generates the same N slice private keys according to the first key parameter, so as to be accessible.
  • the N network slices are configured to send the first key parameter to the user equipment, so that the user equipment generates the same N slice private keys according to the first key parameter, so as to be accessible.
  • the sending unit 3022 is specifically configured to:
  • the first key parameter is sent to the user equipment by a slice security mode command.
  • the receiving unit 3023 is configured to receive a second key parameter sent by the security anchor network element, where the second key parameter is used by the security anchor network element for the access and
  • the mobility management network element generates a shared key, and the shared key is used by the shared network function of the N network slices;
  • the sending unit 3022 is further configured to send the second key parameter to the user equipment, so that the user equipment generates the same shared key according to the second key parameter to enable access to the The shared network function of N network slices.
  • the sending unit 3022 is specifically configured to:
  • the encryption unit 3024 is configured to use the access and mobility management network element before the sending unit 3022 sends the first key parameter to the user equipment by using a slice security mode command.
  • the shared key encrypts the first key parameter
  • the sending unit 3022 is further specifically configured to:
  • the encrypted first key parameter is sent to the user equipment by using a slice security mode command.
  • the receiving unit 3023 is further configured to:
  • the sending unit 3022 Before the sending unit 3022 sends the encrypted first key parameter to the user equipment by using a slice security mode command, receiving an encryption parameter sent by the N network slices, where the encryption parameter is Parameters used by each of the N network slices to encrypt the M network functions;
  • the sending unit 3022 is further configured to:
  • the network slice 303 may include a receiving unit 3031, an encryption unit 3032, and a transmitting unit 3033, where:
  • the receiving unit 3031 is configured to receive a private key sent by the security anchor network element.
  • the encryption unit 3032 is configured to encrypt M network functions according to the encryption parameter, where the encryption parameter includes the a private key and a function identifier of the M network functions;
  • the sending unit 3033 is configured to send the encryption parameter to the access and mobility management network element, so that the access and mobility management network element sends the encryption parameter to the user equipment, so that the user equipment is configured according to the The encryption parameters access the M network functions of the network slice.
  • the user equipment 304 may include a receiving unit 3041, a generating unit 3042, and an access unit 3043, where:
  • the receiving unit 3041 is configured to receive a first key parameter sent by the access and mobility management network element, where the first key parameter includes identifier information of N network slices, and the N network slices are the slice Selecting, by the network element, a network slice determined by the user equipment; the first key parameter is used by the security anchor network element to generate N slice private keys, and sending the N slice private keys to corresponding The N network slices;
  • the generating unit 3042 is configured to generate the same N slice private keys according to the first key parameter, so as to be able to access the N network slices.
  • the receiving unit 3041 is specifically configured to:
  • the receiving unit 3041 is further configured to:
  • the generating unit 3042 is configured to generate the same shared key according to the second key parameter to enable access to the shared network function of the N network slices.
  • the receiving unit 3041 is further configured to:
  • the receiving unit 3041 is further configured to:
  • the receiving unit 3041 is further configured to:
  • the access and mobility management network element Receiving, by the access and mobility management network element, the first key parameter and the encryption parameter that are encrypted according to the shared key, and the encryption parameter is in the N network slices.
  • the accessing unit 3043 is configured to access the M network functions of the N network slices according to the encryption parameter.
  • each functional unit in the security anchor network element 301, the access and mobility management network element 302, the network slice 303, and the user equipment 304 may also refer to the network density in the corresponding embodiment in FIG. 3-7. The description of the key processing method will not be described here.
  • the first device may use the intermediate key for each Each session of the slice generates a set of user plane keys, each set of user plane keys including a user plane cryptographic key Kij-Uenc, a user plane integrity key Kij-Uint, where i represents the serial number of the slice, j Represents the sequence number of the session in the slice.
  • the first device may generate a set of control plane keys for each slice according to the intermediate key, and each set of control plane keys includes a control plane encryption key Ki-Cenc and a control plane integrity key Ki-Uint, where i Indicates the serial number of the slice.
  • the first device may generate the user plane encryption key K11-Uenc and the user plane integrity key K11-Uint according to the intermediate key Kan for the first session of the first slice, and the first device may be based on the intermediate key Kan.
  • Generating a user plane encryption key K12-Uenc and a user plane integrity key K12-Uint for the second session of the first slice, and so on, the first device may be the mth session of the nth slice according to the intermediate key Kan
  • a user plane cryptographic key Knm-Uenc and a user plane integrity key Knm-Uint are generated.
  • the first device may generate the control plane encryption key K1-Cenc and the control plane integrity key K1-Cint according to the intermediate key Kan for the first slice, and the first device may generate the control for the second slice according to the intermediate key Kan.
  • the face encryption key K2-Cenc and the control plane integrity key K2-Cint, and so on, the first device can generate the control plane encryption key Kn-Cenc and the control plane integrity for the nth slice according to the intermediate key Kan Key Kn-Cint.
  • each slice includes H1 to Hm sessions
  • the first device may use each of the intermediate keys.
  • Each session of the slice produces a set of user plane keys, each set of user plane keys including a user plane cryptographic key Kij-Uenc, a user plane integrity key Kij-Uint, where i represents the serial number of the slice, and j represents The serial number of the session in the slice.
  • the first device may generate a set of control plane keys according to the intermediate key, and the set of control plane keys includes a control plane encryption key KCenc and a control plane integrity key KCint.
  • the control plane key is used to secure the control plane data of the slices S1 SSn, that is, the control plane data of each slice uses the same control plane key for security protection.
  • the first device may generate the user plane encryption key K11-Uenc and the user plane integrity key K11-Uint according to the intermediate key Kan for the first session of the first slice, and the first device may be based on the intermediate key Kan.
  • the first device may be the mth session of the nth slice according to the intermediate key Kan A user plane cryptographic key Knm-Uenc and a user plane integrity key Knm-Uint are generated.
  • the first device may generate the control plane encryption key KCenc and the control plane integrity key KCint according to the intermediate key Kan.
  • the first device may use the intermediate key for each The slices produce a set of user plane keys, each set of user plane keys including a user plane cryptographic key Ki-Uenc, a user plane integrity key Ki-Uint, where i represents the serial number of the slice.
  • Each set of user plane keys is used to secure each session of the corresponding slice, that is, the sessions in the same slice use the same user plane key for security protection.
  • the first device may generate a set of control plane keys for each slice according to the intermediate key, and each set of control plane keys includes a control plane encryption key Ki-Cenc and a control plane integrity key Ki-Uint, where i Indicates the serial number of the slice.
  • the first device may generate the user plane encryption key K1-Uenc and the user plane integrity key for the first slice according to the intermediate key Kan.
  • the first device may generate a user plane encryption key K2-Uenc and a user plane integrity key K2-Uint according to the intermediate key Kan for the second slice, and so on, the first device may be based on the intermediate key Kan A user plane cryptographic key Kn-Uenc and a user plane integrity key Kn-Uint are generated for the nth slice.
  • the first device may generate the control plane encryption key K1-Cenc and the control plane integrity key K1-Cint according to the intermediate key Kan for the first slice, and the first device may generate the control for the second slice according to the intermediate key Kan.
  • the first device may use each of the intermediate keys.
  • the slice generates a set of user plane keys, and each set of user plane keys includes a user plane encryption key Ki-Uenc, a user plane integrity key Ki-Uint, where i represents the serial number of the slice.
  • Each set of user plane keys is used to secure each session of the corresponding slice, that is, the sessions in the same slice use the same user plane key for security protection.
  • the first device may generate a set of control plane keys according to the intermediate key, and the set of control plane keys includes a control plane encryption key KCenc and a control plane integrity key KCint.
  • the control plane key is used to secure the control plane data of the slices S1 SSn, that is, the control plane data of each slice uses the same control plane key for security protection.
  • the first device may generate the user plane encryption key K1-Uenc and the user plane integrity key K1-Uint for the first slice according to the intermediate key Kan, and the first device may use the intermediate key Kan as the second slice.
  • Generating a user plane encryption key K2-Uenc and a user plane integrity key K2-Uint, and so on the first device may generate a user plane encryption key Kn-Uenc and a user plane according to the intermediate key Kan for the nth slice.
  • Integrity key Kn-Uint The first device may generate the control plane encryption key KCenc and the control plane integrity key KCint according to the intermediate key Kan.
  • the first device may use each of the intermediate keys.
  • the slice generates a slice root key Ki-root, where i represents the serial number of the slice.
  • the first device generates a user plane key ij-root for each session in the slice i according to the root key Ki-root of the slice i, where i represents the serial number of the slice and j is the sequence number of the session in the slice.
  • the first device generates a user plane encryption key Kij-Uenc and a user plane integrity key Kij-Uint for each session according to the user plane key ij-root of each session.
  • the first device may generate a set of control plane keys for each slice according to the slice root key Ki-root, and each set of control plane keys includes a control plane encryption key Ki-Cenc and a control plane integrity key Ki-Uint Where i represents the serial number of the slice. That is, the user plane control key ij-root for each session of each slice and the control plane key of the slice are generated from the root key of the slice.
  • the embodiment is mainly used to supplement a key generation method and a flow in a multi-slice, multi-session (in-slice) scenario.
  • the core idea of this embodiment is to derive the session root key of different slices by K_SEAF, and further derive the session key corresponding to the encryption endpoint in the UP-GW.
  • the generated key architecture is as shown in the following figure. Where "sn" is used to identify the nth slice, and "UP-GWm" is used to identify the mth session in the slice. For the sake of simplicity, assume that each slice has the same number of (m) sessions. In practice, different slices can have different numbers of sessions.
  • the UE and the core network eg, a certified network element (SEAF) and/or a slice authentication network element
  • SEAF certified network element
  • the core network determines the slice for the UE, and the ID of the slice can be expressed as Slc-ID1...Slc-IDN.
  • the session security policy is negotiated in the core network to determine that the user plane key of the endpoint in the UP-GW needs to be generated.
  • the core network (such as SEAF) generates a root key K_UP-s1...K_UP-sn of each slice, and sends it to each slice separately (only the key corresponding to each slice is sent, such as sending K_UP-sn to slice n ).
  • each slice derives all session keys (eg, the m session keys of the nth slice are KUP-Sn-GWm (-enc, -int), and "enc” represents the encryption and decryption key. , "int” stands for integrity protection key).
  • KDF UP-GW-enc-alg, Bearerm, SliceIDn
  • KDF UP-GW-int-alg, Bearerm, SliceIDn
  • Bearerm and SliceIDn are the input of the bearer ID and the slice ID as KDF, respectively.
  • Other inputs include UP-GW-enc-alg and UP-GW-int-alg, which represent the algorithms used for encryption and security, respectively.
  • Each slice sends the generated key to the UP-GW.
  • the response is received.
  • Each slice sends the input parameters required for key generation to CCNF (AMF).
  • AMF CCNF
  • the AMF sends the foregoing parameters to the UE through the AN through the SSMC.
  • the UE generates all the keys according to the received parameters (similar to the generating method of step 803).
  • FIG. 13 is a schematic diagram of an overall key structure provided in an embodiment of the present application, where a core network control plane key architecture part is as shown in the embodiment of FIG. 9 , and a core network user plane key architecture part is as follows. As shown in the embodiment of FIG. 11F, the access network key architecture is shown in the embodiment of FIG. 11A to FIG. 11E, and details are not described herein.
  • each slice has equal.
  • each slice may have an unequal number of sessions, or at least two.
  • the slices have the same number of sessions, which is not specifically limited in this application.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product.
  • the computer software product is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • wire eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例公开了一种网络密钥处理的系统，包括：用户设备、安全锚点网元、接入及移动管理网元，其中：安全锚点网元用于从切片选择网元获取第一密钥参数，第一密钥参数包括N个网络切片的标识信息，并根据第一密钥参数生成N个切片专用密钥，并将N个切片专用密钥分别发送给相对应的N个网络切片；接入及移动管理网元用于获取第一密钥参数，并将第一密钥参数发送给用户设备；用户设备用于根据第一密钥参数生成N个网络切片的N个切片专用密钥，并根据所生成的N个切片专用密钥访问N个网络切片。这样，针对不同的网络切片设置了不同的专用密钥，从而降低了使用共享密钥进行信令交互时的安全隐患。

Description

一种网络密钥处理的方法、相关设备及系统
本申请要求于2017年1月25日提交中国专利局、申请号为201710064224.2、发明名称为“一种网络密钥处理的方法、相关设备及系统”的中国专利申请的优先权。
技术领域
本申请涉及移动通信网络的网络安全技术领域，尤其涉及一种网络密钥处理的方法、相关设备及系统。
背景技术
当前移动通信网络(如3G/LTE)主要提供了三个层面的安全：终端和网络之间的双向认证、NAS(Non Access Stratum，非接入层)安全、AS(Access Stratum，接入层)安全。终端和网络首先是经过双向认证来确认彼此身份的真实性，并生成可以用来建立NAS安全及AS安全的根密钥(K_ASME)。NAS层位于3GPP EPS(Evolved Packet System，演进分组系统)协议栈中控制面的最高层，它是用来传递终端与核心网之间的非无线接入相关的信令，主要包括了用于移动性管理(MM，Mobility Management)和会话管理(SM，Session Management)的信令协议及流程。而AS层主要是用于终端和基站之间交互的无线接入协议栈。NAS安全和AS安全所需要的密钥都是从K_ASME派生而来的。
在3GPP下一代无线通信网络架构中，引入了网络切片(Network Slicing)的架构。一个网络切片是一种虚拟化的逻辑专网，可以根据不同业务需求而定制。为了更好的支持网络切片的定制化，首先需要将当前的网元进行细化。当前LTE核心网中的MME(Mobility Management Entity，移动性管理网元)的功能网元，在下一代网络中将会被细化为多个功能。比如在3GPP SA2TR 23.799V14.0.0(2016-12)的技术报告中，MME功能被分解为接入及移动管理功能(AMF，Access and Mobility Management Function)、安全锚点功能(SEAF)、会话管理功能(SMF)等网络功能。
当一个终端接入网络时，网络会根据某些方法选择一个或多个切片给这个终端，当一个终端同时接入多个切片时，终端与切片之间的信令交互都是经过AMF，AMF为NAS信令的加解密终结点，AMF属于多切片共享功能，上述第一点说明，当一个终端同时接入多个切片时，AMF是一个交汇点。这一限制是来源于终端移动性和对网络架构的复杂性的考虑。一方面，终端不管接入几个切片，它的移动性是一致的或唯一的；另一方面，如果允许一个UE同时接入多个AMF，会显著增加网络功能或网元间链接、接口的数目及复杂性。
切片在同终端交互NAS信令时，如切片1(或切片2)发送NAS信息给终端，NAS信息对于AMF来说是没有加密的明文。当攻击者入侵了AMF时，它可以轻易获得SMF发出的信息，从而容易造成了切片的NAS信息泄露。
发明内容
本申请实施例提供了一种网络密钥处理的方法、相关设备及系统，用于提高网络信令交互的安全性。
本申请第一方面提供一种网络密钥处理的系统，包括：用户设备、安全锚点网元、接入及移动管理网元，其中：
所述安全锚点网元用于从切片选择网元获取第一密钥参数，所述第一密钥参数包括N 个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片，并根据所述第一密钥参数生成N个切片专用密钥；其中，N为大于或等于1的整数，N个网络切片为用户设备在与核心网进行双向认证时核心网所选择给用户设备的一个或多个网络切片。或者由用户设备先发送需要接入的网络切片的标识给核心网，再由核心网中的网元，比如切片选择功能的网元根据用户设备发送的网络切片的标识确定所对应的网络切片，其中，该切片选择功能的网元还可以先判断该标识所对应的网络切片是否可以分配给该用户设备，若可以，则将其分配给用户设备，若不可以，则不将其分配给所述用户设备。
所述安全锚点网元还用于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片；安全锚点网元可以根据N个网络切片的标识信息将所生成的N个专用密钥分别发送给所对应的N个网络切片，每个网络切片接收到与其标识对应的专用密钥，若接收成功，则可以向安全锚点网元发送接收成功的确认信息。
所述接入及移动管理网元用于从所述切片选择网元或者所述安全锚点网元获取所述第一密钥参数，并将所述第一密钥参数发送给所述用户设备；第一密钥参数包括N个网络切片的标识信息，核心网中的切片选择网元与安全锚点网元均已获得该标识信息，所以可以由安全锚点将该标识信息发送给接入及移动管理网元，或者由切片选择网元将该标识信息发送给接入及移动管理网元。
所述用户设备用于根据所述第一密钥参数生成所述N个网络切片的N个切片专用密钥，并根据所生成的所述N个切片专用密钥访问所述N个网络切片。用户设备与安全锚点网元预先约定使用相同的密钥生成规则进行专用密钥的生成，当用户设备与安全锚点网元均使用同样的第一密钥参数进行专用密钥生成时，那么用户设备所生成的N个切片专用密钥则与安全锚点网元所生成的N个切片专用密钥是相同的，从而使得用户设备能够根据N个切片专用密钥去依次访问该N个网络切片。这样，在本申请中，针对不同的网络切片设置了不同的专用密钥，并且用户设备能够生产相同的网络切片的专用密钥，使得用户设备能够与网络切片进行信令交互，从而降低了使用共享密钥进行信令交互时的安全隐患。
一种可能的实现方式中，所述安全锚点网元还用于根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述接入及移动管理网元还用于接收所述安全锚点网元发送的所述第二密钥参数；
所述用户设备还用于从所述接入及移动管理网元接收到所述第二密钥参数后，并生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。由于在实际应用中，不同的网络切片也可能会存在相同的网络功能，比如一些普遍的基础功能一般均设置为共享网络功能，这类的功能一般每个用户设备在接入时都具备，从而这些网络功能不必要设置在网络切片内被网络切片进行专用保护，从而可以通过设置共享密钥的方式进行与所有合法用户设备进行信令交互。
另一种可能的实现方式中，所述接入及移动管理网元还用于：
在将所述第一密钥参数发送给所述用户设备之前，通过所述共享密钥为所述第一密钥 参数进行加密；
所述接入及移动管理网元具体用于：
所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备；
所述用户设备具体用于接收所述接入及移动管理网元通过切片安全模式命令发送的进行加密后的所述第一密钥参数。
由于在接入及移动管理网元发送第一密钥参数给用户设备的过程中，可能会导致数据包被拦截，从而使得攻击者获取该数据包中第一密钥参数的内容信息，由于该第一密钥参数包含所述用户设备所接入的网络切片的标识信息，从而获知所述用户设备所接入的网络切片的类型，则可能导致所述用户设备的个人信息泄露，甚至可能造成攻击者直接通过该第一密钥参数接入所对应的网络切片，从而进行不法行为的操作。因此，在本申请中，在接入及移动管理网元发送第一密钥给用户设备之前，还可以对该第一密钥进行加密，具体可以通过共享密钥对该第一密钥进行加密，用户设备在接收到共享密钥的密钥参数后，则能够推演解析出加密数据包的内容，从而获取第一密钥参数。这样，提高了网络通信的安全性。
另一种可能的实现方式中，所述系统还包括网络切片，其中：
所述网络切片用于接收所述安全锚点网元发送的专用密钥；
所述网络切片还用于根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
所述网络切片还用于将所述加密参数发送给所述接入及移动管理网元；
所述接入及移动管理网元还用于将所述加密参数发送给用户设备；
所述用户设备还用于接收所述加密参数，并能够根据所述加密参数访问所述网络切片的所述M个网络功能。
每个网络切片可能包含多个网络功能，不同的网络功能的重要性程度不一样，更重要的网络功能应该设置更复杂的加密方法，在本申请中，可以通过对每个网络切片中的各个网络功能进行加密，从而提高不同网络功能的安全性。具体的，每个网络功能的加密算法可以相同，也可以不同，加密后，将加密的参数发送给用户设备，从而使得用户设备能够根据加密的参数访问该加密后的网络功能。
本申请第第二方面提供一种安全锚点网元，所述网元包括：
获取单元，用于从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；
生成单元，用于根据所述第一密钥参数生成N个专用密钥；
发送单元，用于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片，以使得用户设备从接入及移动管理网元接收到所述第一密钥参数后，生成相同的所述N个切片专用密钥从而能够访问所述N个网络切片。
一种可能的实现方式中，所述发送单元还用于：
将所述第一密钥参数发送给接入及移动管理网元，用于所述接入及移动管理网元发送所述第一密钥参数至用户设备。
另一种可能的实现方式中，所述生成单元还用于：
根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用，以使得所述用户设备从所述接入及移动管理网元接收到所述第二密钥参数后，生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
本申请第三方面提供一种接入及移动管理网元，所述网元包括：
获取单元，用于从切片选择网元或者安全锚点网元获取所述第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片。
发送单元，用于将所述第一密钥参数发送给所述用户设备，以使得所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
一种可能的实现方式中，所述网元还包括：
接收单元，用于接收所述安全锚点网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述发送单元还用于，将所述第二密钥参数发送给所述用户设备，以使得所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
另一种可能的实现方式中，所述网元还包括：
加密单元，在所述发送单元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备之前，用于所述接入及移动管理网元通过所述共享密钥为所述第一密钥参数进行加密；
所述发送单元具体还用于：
通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备。
另一种可能的实现方式中，所述所述接收单元还用于：
在所述发送单元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备之前，接收所述N个网络切片发送的加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
所述发送单元还用于：
通过切片安全模式命令将将进行加密后的所述第一密钥参数以及所述加密参数发送给所述用户设备，以使得所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
本申请第四方面提供一种网络切片，所述网络切片包括：
接收单元，用于接收安全锚点网元发送的专用密钥；
加密单元，用于根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
发送单元，用于将所述加密参数发送给接入及移动管理网元，以使得所述接入及移动管理网元将所述加密参数发送给用户设备，使得所述用户设备根据所述加密参数访问所述网络切片的所述M个网络功能。
本申请第五方面提供一种用户设备，所述用户设备包括：
接收单元，用于接收所述接入及移动管理网元发送的第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
生成单元，用于根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
一种可能的实现方式中，所述接收单元还用于：
接收所述接入及移动管理网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述用户设备还包括：
生成单元，用于根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
另一种可能的实现方式中，所述接收单元具体还用于：
接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数。
另一种可能的实现方式中，所述接收单元具体还用于：
接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数以及加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
所述用户设备还包括：
访问单元，用于根据所述加密参数访问所述N个网络切片的所述M个网络功能。
本申请第六方面提供一种网络密钥处理的方法，应用于安全锚点网元侧，所述方法包括：
安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；
所述安全锚点网元根据所述第一密钥参数生成N个专用密钥；
所述安全锚点网元将所述N个切片专用密钥分别发送给相对应的所述N个网络切片，以使得用户设备从接入及移动管理网元接收到所述第一密钥参数后，生成相同的所述N个切片专用密钥从而能够访问所述N个网络切片。
一种可能的实现方式中，所述方法还包括：
所述安全锚点网元将所述第一密钥参数发送给接入及移动管理网元，用于所述接入及移动管理网元发送所述第一密钥参数至用户设备。
另一种可能的实现方式中，所述方法还包括：
所述安全锚点网元根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用，以使得所述用户设备从所述接入及移动管理网元接收到所述第二密钥参数后，生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
本申请第七方面提供一种网络密钥处理的方法，应用于接入及移动管理网元侧，所述方法包括：
接入及移动管理网元从切片选择网元或者安全锚点网元获取所述第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所选择的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片。
所述接入及移动管理网元将所述第一密钥参数发送给所述用户设备，以使得所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
一种可能的实现方式中，所述方法还包括：
所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述接入及移动管理网元将所述第二密钥参数发送给所述用户设备，以使得所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
另一种可能的实现方式中，所述接入及移动管理网元将所述第二密钥参数发送给所述用户设备，包括：
所述接入及移动管理网元通过所述切片安全模式命令将所述第二密钥参数发送给所述用户设备。
另一种可能的实现方式中，在所述接入及移动管理网元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备之前，所述方法还包括：
所述接入及移动管理网元通过所述共享密钥为所述第一密钥参数进行加密；
所述接入及移动管理网元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备，包括：
所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备。
另一种可能的实现方式中，在所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备之前，所述方法还包括：
接收所述N个网络切片发送的加密参数，所述加密参数为所述N个网络切片中每个网 络切片为M个网络功能进行加密所使用的参数；
所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备，包括：
所述接入及移动管理网元通过切片安全模式命令将将进行加密后的所述第一密钥参数以及所述加密参数发送给所述用户设备，以使得所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
本申请第八方面提供一种网络密钥处理的方法，应用网络切片侧，所述方法包括：
所述网络切片接收安全锚点网元发送的专用密钥；
所述网络切片根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
所述网络切片将所述加密参数发送给接入及移动管理网元，以使得所述接入及移动管理网元将所述加密参数发送给用户设备，使得所述用户设备根据所述加密参数访问所述网络切片的所述M个网络功能。
本申请第九方面提供一种网络密钥处理的方法，应用于用户设备侧，所述方法包括：
所述用户设备接收所述接入及移动管理网元发送的第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
一种可能的实现方式中，所述方法还包括：
所述用户设备接收所述接入及移动管理网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
另一种可能的实现方式中，所述用户设备接收所述接入及移动管理网元发送的第二密钥参数，包括：
所述用户设备接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数。
另一种可能的实现方式中，所述用户设备接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数，包括：
所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数。
另一种可能的实现方式中，所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数，包括：
所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共 享密钥进行加密后的所述第一密钥参数以及加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
本申请第十方面提供一种安全锚点设备，所述安全锚点设备包括收发器、处理器和存储器，所述存储器用于存储程序和数据；所述处理器调用所述存储器中的程序用于执行第六方面的任意实现方式描述的网络密钥处理的方法。
本申请第十一方面提供一种接入及移动管理设备，所述接入及移动管理设备包括收发器、处理器和存储器，所述存储器用于存储程序和数据；所述处理器调用所述存储器中的程序用于执行第七方面的任意实现方式描述的网络密钥处理的方法。
本申请第十二方面提供一种网络切片设备，所述网络切片设备包括收发器、处理器和存储器，所述存储器用于存储程序和数据；所述处理器调用所述存储器中的程序用于执行第八方面的任意实现方式描述的网络密钥处理的方法。
本申请第十三方面提供一种用户设备，所述用户设备包括收发器、处理器和存储器，所述存储器用于存储程序和数据；所述处理器调用所述存储器中的程序用于执行第九方面的任意实现方式描述的网络密钥处理的方法。
本申请第十四方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请第十五方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
在本申请中，针对不同的网络切片设置了不同的专用密钥，并且用户设备能够生产相同的网络切片的专用密钥，使得用户设备能够与网络切片进行信令交互，从而降低了使用共享密钥进行信令交互时的安全隐患。
附图说明
图1为本申请实施例中提供的网络密钥处理的架构示意图；
图2为本申请实施例中提供的用户设备10、安全锚点设备30、接入及移动管理设备40及网络切片50对应的结构示意图；
图3为本申请实施例中提供的网络密钥处理的方法的第一个实施例的流程示意图；
图4为本申请实施例中提供的网络密钥处理的方法的第二个实施例的流程示意图；
图5为本申请实施例中提供的网络密钥处理的方法的第三个实施例的流程示意图；
图6为本申请实施例中提供的网络密钥处理的方法的第四个实施例的流程示意图；
图7为本申请实施例中提供的网络密钥处理的方法的第五个实施例的流程示意图；
图8为本申请实施例中提供的一个密钥架构的示意图；
图9为本申请实施例中提供的另一个密钥架构的示意图；
图10为本申请实施例中提供的网络密钥处理的系统及网络密钥处理的系统中相关网元的结构示意图；
图11A-图11F为本申请实施例中提供的第一设备进行密钥推演的六种示意图；
图12为本申请实施例中提供的第一设备进行密钥生成与分发的一个流程示意图；
图13为本申请实施例中提供的总体密钥架构示意图。
具体实施方式
本申请实施例提供了一种网络密钥处理的方法、相关设备及系统，用于提高网络信令交互的安全性。
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
网络切片是一种虚拟化的逻辑专网，可以根据不同业务需求而定制。网络切片的运营、管理方式是多样的。MNO(Mobile network operator,移动网络运营商)可以自行运营、管理切片，一个切片可以由不同用户共享。当然，为了配合垂直行业的发展，MNO的一个或多个网络切片也可以出租给垂直行业，由其自行运营、管理、认证用户设备(移动终端或IoT设备等)。对于接入切片的用户设备，首先用户设备需要通过MNO的服务去接入切片，然后由切片对用户设备进行管理。也就是说，用户设备既要和MNO网络交互，也要和网络切片有交互。
为了更好的支持网络切片的定制化，首先会将当前的网络功能进行细化。比如在3GPP SA2TR 23.799V14.0.0(2016-12)的技术报告中，MME功能被分解为AMF、SEAF、SMF)等网络功能。需要指出的是，本申请中所述的各个网络功能，如AMF(Access and Mobility Management Function，接入及移动管理功能)、SMF(Session Management Function，会话管理功能)、SEAF(Security Anchor Function，安全锚点功能)等，是目前3GPP SA2和SA3标准工作组的文稿及技术报告(TR)中所采用的名称。这些名称还有可能更改，如更名、网络功能合并、分拆等，本申请并不局限于这些网络功能的名称及其位置(设在或合设于哪个网元中，比如，在4G网络中，MMF和SEAF是合设在一起的，即MME)。在后续通信标准的制定中，上述功能网元的划分方式可能发生变化，这种变化不影响本申请实施例的实施。
图1是本发明实施例提供的一种网络密钥处理的架构示意图。如图1所示，网络密钥处理的系统100可包括：用户设备10、接入网网元20、安全锚点网元30以、接入及移动管理网元40以及网络切片50。其中：
接入网网元20可用于为用户设备10提供网络接入服务。具体实现中，接入网网元20可包括基站(NodeB)、基站控制器(Radio Network Controller，RNC)或接入网关等。具体实现中，用户设备10可以包括手机、平板电脑、笔记本电脑、移动互联网设备(Mobile Internet Device，MID)、可穿戴设备(例如智能手表、智能手环、计步器等)等用户终端，也可以包括IoT设备，还可以包括其他可接入MNO网络的通信设备。
安全锚点网元30可用于为所有接入网络的UE提供网络认证、密钥生成等服务，具体可包括配置在核心网CN中的SEAF等网络功能。
本发明实施例中，安全锚点网元30用于为接入及移动管理网元生成共享密钥，还用于为用户设备10所接入的多个网络切片50生成专用密钥。
接入及移动管理网元40用于将安全锚点网元30生成共享密钥的参数以及生成专用密 钥的参数发送给用户设备10，用户设备则能够推演出网络切片的专用密钥，从而能够访问所接入的网络切片。这样，每个网络切片都设置有专用密钥，使得用户设备与网络切片所交互的NAS信令不易被获取，提高了网络通信的安全性。
应理解的，当接入网网元20只包括一个网络实体(例如基站)时，后续描述到的接入网网元20所执行的操作均由该一个网络实体完成。当接入网网元20包括多个网络实体(例如基站和基站控制器)时，后续描述到的接入网网元20所执行的操作由所述多个网络实体协作完成。
应理解的，当安全锚点网元30只包括一个网络实体(例如SEAF)时，后续描述到的安全锚点网元30所执行的操作均由该一个网络实体完成。当该安全锚点网元30包括多个网络实体(例如SEAF和AMF)时，后续描述到的安全锚点网元30所执行的操作由所述多个网络实体协作完成。
应理解的，当接入及移动管理网元40只包括一个网络实体(例如AMF)时，后续描述到的接入及移动管理网元40所执行的操作均由该一个网络实体完成。当该接入及移动管理网元40包括多个网络实体(例如SEAF和AMF)时，后续描述到的接入及移动管理网元40所执行的操作所述多个网络实体协作完成。
这里，所述协作完成是指多个网络实体各执行一些操作，执行操作所产生的数据、参数均可以根据需要在这多个网络实体各之间传输。
需要说明的是，不限于图1所示，安全锚点网元30还可包括更多或更少网络功能，接入及移动管理网元40还可包括更多或更少切片网络功能。
需要说明的是，本申请中的所描述的安全锚点网元、接入及移动管理网元、接入网网元等名称在实际应用中可能为其它的名称，这些网元名称并不能对本申请构成限定，只要是具备本申请实施例中所描述的功能和作用，均属于本申请所保护的范围。
图2是本发明实施例提供的通信装置示意图。图1中的用户设备10或者安全锚点设备30或者接入及移动管理设备40或者网络切片50可以通过图2所示的通信装置(或系统)200来实现。
如图2所示，通信装置(或系统)200可包括至少一个处理器401，存储器403以及至少一个通信接口404。这些部件可在一个或多个通信总线402上通信。
需要说明的，图2仅仅是本发明实施例的一种实现方式，实际应用中，通信装置200还可以包括更多或更少的部件，这里不作限制。
通信接口404用于接收和发送射频信号，耦合于通信装置200的接收器和发射器。通信接口404通过射频信号与通信网络和其他通信设备通信，如以太网(Ethernet)，无线接入网(Radio Access Technology，RAN)，无线局域网Wireless Local Area Networks，WLAN)等。具体实现中，通信接口404支持的通信协议可包括但不限于：2G/3G、LTE、Wi-Fi、5G New Radio(NR)等等。
存储器403与处理器401耦合，用于存储各种软件程序和/或多组指令。具体实现中，存储器403可包括高速随机存取的存储器，并且也可包括非易失性存储器，例如一个或多个磁盘存储设备、闪存设备或其他非易失性固态存储设备。存储器403可以存储操作系统 (下述简称系统)，例如ANDROID，IOS，WINDOWS，或者LINUX等嵌入式操作系统。存储器403可用于存储本发明实施例的实现程序。存储器403还可以存储网络通信程序，该网络通信程序可用于与一个或多个附加设备，一个或多个终端设备，一个或多个网络设备进行通信。
处理器401可以是一个通用中央处理器(Central Processing Unit，CPU)，微处理器，特定应用集成电路(Application-Specific Integrated Circuit，ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
在一些实施例中，通信装置200还可以包括输出设备405和输入设备406。输出设备405和处理器401通信，可以以多种方式来显示信息。例如，输出设备405可以是液晶显示器(Liquid Crystal Display，LCD)，发光二级管(Light Emitting Diode，LED)显示设备，阴极射线管(Cathode Ray Tube，CRT)显示设备，或投影仪(projector)等。输入设备406和处理器401通信，可以以多种方式接受用户的输入。例如，输入设备406可以是鼠标、键盘、触摸屏设备或传感设备等。为了便于输出设备405和输入设备406的用户使用，在一些实施例中，存储器202还可以存储用户接口程序，该用户接口程序可以通过图形化的操作界面将应用程序的内容形象逼真的显示出来，并通过菜单、对话框以及按键等输入控件接收用户对应用程序的控制操作。
当图2所示的通信装置200实现为图1所示的用户设备10时，通信装置200的存储器中可以存储了一个或多个软件模块，可用于提供接入请求、用户认证响应等功能，具体可参考后续方法实施例。当图2所示的通信装置200实现为图1所示的安全锚点设备30时，通信装置200的存储器中可以存储了一个或多个软件模块，可用于提供生成密钥等功能，具体可参考后续方法实施例。当图2所示的通信装置200实现为图1所示的接入及移动管理设备40时，通信装置200的存储器中可以存储了一个或多个软件模块，可用于提供对密钥参数进行加密的功能，具体可参考后续方法实施例。当图2所示的通信装置200实现为图1所示的网络切片50时，通信装置200的存储器中可以存储了一个或多个软件模块，可用于提供对网络功能进行加密的功能，具体可参考后续方法实施例。
下面结合图3-7的几个实施例详细描述本发明实施例提供的网络密钥处理的方法。
图3是本发明实施例提供的网络密钥处理的方法的第一实施例的流程示意图。图3实施例中，安全锚点网元生成了切片专用控制面密钥，下面展开描述：
S101、用户设备和核心网(SEAF)、网络切片进行双向认证。
具体的，用户设备进行认证时，核心网生成根密K_SEAF。核心网中的切片选择网元(如NSSF)为用户设备选择了N个网络切片(如确定了切片ID)Slc-ID1…Slc-IDN。即切片选择网元获取了所确定的N个网络切片的标识信息。
S102、所述安全锚点网元根据K_SEAF以及第二密钥参数为接入及移动管理网元生成共享密钥，所述共享密钥为控制面共享密钥。
其中，所述控制面共享密钥用于所述N个网络切片的控制面的共享网络功能使用，所述第二密钥参数包括密钥算法类型区分码(Algorithm Distinguisher)、密钥算法ID(Algorithm ID)等信息。
S103、所述安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息。
S104、所述安全锚点网元根据K_SEAF以及所述第一密钥参数生成N个切片专用密钥，所述专用密钥为控制面专用密钥。
其中，第一密钥参数可以包括网络切片ID：Slc-ID1…Slc-IDN，分别为网络切片n＝1…N生成切片专用的控制面根密钥(KCP-S1…KCP-SN)。
需要说明的是，安全锚点网元在为每个网络切片生成专用密钥时，还可以根据第二密钥参数包括密钥算法类型区分码、密钥算法ID等作为密钥参数进行生成。其中，密钥算法类型区分码需要设定为切片专用的控制面密钥算法所对应的值。
S105、所述安全锚点网元于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片。
需要说明的是，网络切片在接收到专用控制面密钥后也可以分别回复接收成功的消息给安全锚点网元。
S106、所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数。
S107、所述接入及移动管理网元将所述第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数发送给用户设备。
S108、所述安全锚点网元发送的所述第一密钥参数给所述接入及移动管理网元。
需要说明的是，第一密钥参数也可以由切片选择网元(如NSSF)发送给接入及移动管理网元。
S109、所述接入及移动管理网元将所述第一密钥参数发送给所述用户设备。
第一密钥参数可以包括(如切片ID：Slc-ID1…Slc-IDN)和密钥算法类型区分码设定为切片专用的控制面密钥算法(NAS-Slc)所对应的值等信息，由于其中包含切片的标识信息，现有的发送命令无法携带该标识信息，因此本申请所定义的发送命令为切片安全模式命令SSMC(Slice Security Mode Command)，通过该SSMC来发送所述第一密钥给用户设备。
S110、用户设备根据收到第二密钥参数以及K_SEAF标识码等参数，推演控制面切片共享密钥(AMF或CCNF)。
S111、用户设备根据收到的第一密钥参数、第二密钥参数(其中，密钥算法类型区分码需要设定为切片专用的控制面密钥算法所对应的值)以及K_SEAF标识码等参数，推演控制面切片专用密钥。
如，生成第N个切片的密钥的生成函数KDF的参数为：KDF(K_SEAF,Slc-ID1,NAS-Slc,Alg-ID)，其中，KDF为安全锚点网元为每个网络切片生成专用密钥所使用的生成函数，NAS-Slc为密钥算法类型区分码参数设定为切片专用的控制面密钥算法所对应的值，Alg-ID为密钥算法ID)。
这样，用户设备获取到安全锚点网元为每个网络切片所生成专用控制面密钥的密钥参数，则能够根据该密钥参数生成相应的密钥并访问所接入的每个网络切片，即提高了网络 通信的安全性，又保证了用户设备的正常通信。
图4是本发明实施例提供的网络密钥处理的方法的第二实施例的流程示意图。图4实施例中，进一步对生成切片专用的控制面密钥的参数在发送给用户设备之前进行加密，下面展开描述：
S201、用户设备和核心网(SEAF)、网络切片进行双向认证。
S202、所述安全锚点网元根据K_SEAF以及第二密钥参数为接入及移动管理网元生成控制面共享密钥。
S203、所述安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息。
S204、所述安全锚点网元根据K_SEAF以及所述第一密钥参数生成N个切片专用的控制面密钥。
S205、所述安全锚点网元于将所述N个切片专用的控制面密钥分别发送给相对应的所述N个网络切片。
S206、所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数。
S207、所述接入及移动管理网元将所述第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数发送给用户设备。
S208、所述安全锚点网元发送的所述第一密钥参数给所述接入及移动管理网元。
S209、所述接入及移动管理网元使用所述共享密钥为所述第一密钥参数进行加密。
由于第一密钥参数中包含了用户设备所接入的网络切片的标识信息，在实际应用中，网络切片的标识信息具有一定私密性，当攻击者获取到了用户设备所接入的网络切片的标识，从而则可能获取该用户设备所接入的网络切片的类型，从而展开其它攻击，对该用户设备造成一定的安全隐患。因此在传输该第一密钥参数之前，对该第一密钥参数进行加密处理。
需要说明的是，在对该第一密钥参数进行加密时，还需进行加密完整性保护，即可通过生成一段数据添加到加密后的数据包中，从而让接收端判断该数据包是否被修改。
S210、所述接入及移动管理网元将加密后的第一密钥参数嵌入SSMC命令，通过接入网网元发给所述用户设备。
S211、用户设备根据收到第二密钥参数以及K_SEAF标识码等参数，推演控制面切片共享密钥(AMF或CCNF)。
S212、用户设备根据所述推演得到的控制面切片共享密钥对第一密钥参数进行解密，根据解密得到的第一密钥参数以及第二密钥参数(其中，密钥算法类型区分码需要设定为切片专用的控制面密钥算法所对应的值)、K_SEAF标识码等参数推演控制面切片专用密钥。
图5是本发明实施例提供的网络密钥处理的方法的第三实施例的流程示意图。图5实施例中，用于优化、减少信令传送的个数，通过发送一个SSMC信令来传送切片控制面共享密钥的参数和切片专用的控制面密钥的参数，从而达到节省空口资源的目的，下面展开描述：
S301、用户设备和核心网(SEAF)、网络切片进行双向认证。
S302、所述安全锚点网元根据K_SEAF以及第二密钥参数为接入及移动管理网元生成共享密钥。
S303、所述安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息。
S304、所述安全锚点网元根据所述第一密钥参数K_SEAF以及生成N个切片专用密钥。
S305、所述安全锚点网元于将所述N个切片专用的控制面密钥分别发送给相对应的所述N个网络切片。
S306、所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数。
S307、所述安全锚点网元发送所述第一密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数给所述接入及移动管理网元。
S308、所述接入及移动管理网元将所述第二密钥参数、K_SEAF标识码、终端安全能力、NAS消息认证码等参数以及第一密钥参数通过SSMC发送给用户设备。
这样，通过发送一个SSMC信令来传送切片控制面共享密钥的参数和切片专用的控制面密钥的参数，从而达到节省空口资源的目的。
S309、用户设备根据收到第二密钥参数以及K_SEAF标识码等参数，推演控制面切片共享密钥(AMF或CCNF)。
S310、用户设备根据收到的第一密钥参数、第二密钥参数(其中，密钥算法类型区分码需要设定为切片专用的控制面密钥算法所对应的值)以及K_SEAF标识码等参数，推演控制面切片专用密钥。
图6是本发明实施例提供的网络密钥处理的方法的第四实施例的流程示意图。图6实施例中，用于优化、减少信令传送的个数，通过发送一个SSMC信令来传送切片共享密钥的参数和切片专用密钥的参数，从而达到节省空口资源的目的，并在发送SSMC之前，对切片专用密钥的参数进行加密处理，下面展开描述：
S401、用户设备和核心网(SEAF)、网络切片进行双向认证。
S402、所述安全锚点网元根据K_SEAF以及第二密钥参数为接入及移动管理网元生成切片控制面共享密钥。
S403、所述安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息。
S404、所述安全锚点网元根据所述K_SEAF以及第一密钥参数生成N个切片专用的控制面密钥。
S405、所述安全锚点网元于将所述N个切片专用的控制面密钥分别发送给相对应的所述N个网络切片。
S406、所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数。
S407、所述安全锚点网元发送的所述第一密钥参数以及K_SEAF标识码、终端安全能力、 NAS消息认证码等参数给所述接入及移动管理网元。
S408、所述接入及移动管理网元通过所述切片控制面共享密钥为所述第一密钥参数进行加密。
S409、所述接入及移动管理网元将所述第二密钥参数、K_SEAF标识码、终端安全能力、NAS消息认证码等参数以及进行加密后的第一密钥参数通过SSMC发送给用户设备。
S410、用户设备根据收到第二密钥参数以及K_SEAF标识码等参数，推演控制面切片共享密钥(AMF或CCNF)。
S411、用户设备根据所述推演得到的控制面切片共享密钥对第一密钥参数进行解密，根据解密得到的第一密钥参数以及第二密钥参数(其中，密钥算法类型区分码需要设定为切片专用的控制面密钥算法所对应的值)、K_SEAF标识码等参数推演控制面切片专用密钥。
图7是本发明实施例提供的网络密钥处理的方法的第五实施例的流程示意图。图7实施例中，用于优化、减少信令传送的个数，通过发送一个SSMC信令来传送切片共享密钥的参数和切片专用密钥的参数，从而达到节省空口资源的目的，并在发送SSMC之前，对切片专用密钥的参数进行加密处理，并且，针对每个切片内包含多个控制面网络功能的情况，进行网元粒度的加密(及密钥生成、分发)，下面展开描述：
S501、用户设备和核心网(SEAF)、网络切片进行双向认证。
S502、所述安全锚点网元根据K_SEAF以及第二密钥参数为接入及移动管理网元生成切片控制面共享密钥。
S503、所述安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息。
S504、所述安全锚点网元根据所述K_SEAF以及第一密钥参数生成N个切片专用密钥。
S505、所述安全锚点网元于将所述N个切片专用的控制面密钥分别发送给相对应的所述N个网络切片。
S506、所述N个网络切片根据所述N个切片控制面专用密钥以及切片中的M个网络功能的ID：NF-ID1…NF-IDM推演出每个切片内M个网元功能的控制面密钥。比如，推演函数可以是KDF(KCP-sn,NF-IDm,Slc-NF,Alg-ID)。然后，用每个切片专用的控制面密钥来加密用于生成网元功能密钥的加密参数，所述加密参数包括所述M个网络功能的功能标识。比如enc(KCP-sn,NF-IDm)，其中，KCP-sn为该网络切片的控制面专用密钥，NF-IDm为第m个网络功能的功能标识。
S507、所述网络切片将所述加密后的网元密钥生成参数以及其他生成参数如Slc-NF和Alg-ID等发送给接入及移动管理网元。
S508、所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数。
S509、所述安全锚点网元发送的所述第一密钥参数以及K_SEAF标识码、终端安全能力、NAS消息认证码等参数给所述接入及移动管理网元。
S510、所述接入及移动管理网元通过所述切片控制面共享密钥为所述第一密钥参数进行加密。
S511、所述接入及移动管理网元将所述加密后的网元密钥生成参数以及其他生成参数如Slc-NF和Alg-ID等参数、第二密钥参数以及进行加密后的第一密钥参数通过SSMC发送给用户设备。
S512、用户设备根据收到的第二密钥参数以及K_SEAF标识码等参数，推演控制面切片共享密钥(AMF或CCNF)。
S513、用户设备根据所述推演的控制面切片共享密钥对加密的第一密钥参数进行解密，根据解密的第一密钥参数以及第二密钥参数、K_SEAF标识码等参数推演控制面切片专用密钥。根据所述推演得到的控制面切片专用密钥，对所述切片内加密的网络功能生成参数进行解密并继续推演出控制面切片内网络功能的专用密钥。对每个切片n:用密钥生成函数生成第m个网络功能的密钥KDF(KCP-sn,NF-ID1,Slc-NF,Alg-ID)。
在本申请中，通过密钥的推演，最终得到的密钥及其相互推演关系，可以用一个树状的结构图(即密钥架构)来表示。图8中是第一至第四个实施例所对应的切片密钥架构(同样的)，而图9是第五个实施例所对应的切片密钥架构。其中，enc代表加密密钥，int代表完整性保护密钥(即生成消息认证码MAC所需密钥)，“CP”是指控制面。Kcp-c表示控制面共享密钥，Kcp-s1表示切片1的控制面专用密钥，Kcp-c-NF1-enc表示控制面共享网络功能1的加密密钥，Kcp-c-NF1-int表示控制面共享网络功能1的完整性保护密钥，Kcp-s1-NF1-enc表示切片1的控制面专用网络功能1的加密密钥，Kcp-s1-NF1-enc表示切片1的控制面专用网络功能1的完整性保护密钥。
图10是本发明实施例提供的网络认证系统以及所述网络认证系统中的相关网元的结构示意图。如图10所示，网络密钥处理的系统300可包括：安全锚点网元301、接入及移动管理网元302、网络切片303、用户设备304以及接入网网元305。下面展开描述。
如图10所示，安全锚点网元301可以包括获取单元3011、生成单元3012和发送单元3013，其中：
获取单元3011，用于从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；
生成单元3012，用于根据所述第一密钥参数生成N个专用密钥；
发送单元3013，用于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片，以使得用户设备从接入及移动管理网元接收到所述第一密钥参数后，生成相同的所述N个切片专用密钥从而能够访问所述N个网络切片。
可选的，所述发送单元3013还用于：
将所述第一密钥参数发送给接入及移动管理网元，用于所述接入及移动管理网元发送所述第一密钥参数至用户设备。
可选的，所述生成单元3012还用于：
根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用，以使得所述用户设备从所述接入及移动管理网元接收到所述第二密钥参数后，生成相 同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
如图10所示，接入及移动管理网元302可以包括获取单元3021、发送单元3022、接收单元3023以及加密单元3024，其中：
获取单元3021，用于从切片选择网元或者安全锚点网元获取所述第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片。
发送单元3022，用于将所述第一密钥参数发送给所述用户设备，以使得所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
可选的，所述发送单元3022具体用于：
通过切片安全模式命令将所述第一密钥参数发送给所述用户设备。
可选的，所述接收单元3023，用于接收所述安全锚点网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
所述发送单元3022还用于，将所述第二密钥参数发送给所述用户设备，以使得所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
可选的，所述发送单元3022具体还用于：
通过所述切片安全模式命令将所述第二密钥参数发送给所述用户设备。
可选的，所述加密单元3024，在所述发送单元3022通过切片安全模式命令将所述第一密钥参数发送给所述用户设备之前，用于所述接入及移动管理网元通过所述共享密钥为所述第一密钥参数进行加密；
所述发送单元3022具体还用于：
通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备。
可选的，所述所述接收单元3023还用于：
在所述发送单元3022通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备之前，接收所述N个网络切片发送的加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
所述发送单元3022还用于：
通过切片安全模式命令将将进行加密后的所述第一密钥参数以及所述加密参数发送给所述用户设备，以使得所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
如图10所示，网络切片303可以包括接收单元3031、加密单元3032以及发送单元3033，其中：
接收单元3031，用于接收安全锚点网元发送的专用密钥；
加密单元3032，用于根据加密参数对M个网络功能进行加密，所述加密参数包括所述 专用密钥以及所述M个网络功能的功能标识；
发送单元3033，用于将所述加密参数发送给接入及移动管理网元，以使得所述接入及移动管理网元将所述加密参数发送给用户设备，使得所述用户设备根据所述加密参数访问所述网络切片的所述M个网络功能。
如图10所示，用户设备304可以包括接收单元3041、生成单元3042以及访问单元3043，其中：
接收单元3041，用于接收所述接入及移动管理网元发送的第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
生成单元3042，用于根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
可选的，所述接收单元3041具体用于：
接收所述接入及移动管理网元通过切片安全模式命令发送的所述第一密钥参数。
可选的，所述接收单元3041还用于：
接收所述接入及移动管理网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
生成单元3042，用于根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
可选的，所述接收单元3041具体还用于：
接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数。
可选的，所述接收单元3041具体还用于：
接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数。
可选的，所述接收单元3041具体还用于：
接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数以及加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
可选的，访问单元3043，用于根据所述加密参数访问所述N个网络切片的所述M个网络功能。
需要说明的，安全锚点网元301、接入及移动管理网元302、网络切片303及用户设备304中各个功能单元的具体实现还可参考图3-7分别对应实施例中所述网络密钥的处理方法所对应的描述，这里不再赘述。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
下面结合图11A至图11F说明本发明实施例提供的几种第一设备根据中间密钥推衍出至少一个密钥的实施方式。
在第一种实施方式中，如图11A所示，假设本实施方式的应用场景为包括S1～Sn个切片，每个切片包括H1～Hm个会话，则第一设备可以根据中间密钥为每个切片的每个会话生成一组用户平面密钥，每组用户平面密钥包括用户面加密性密钥Kij-Uenc、用户面完整性密钥Kij-Uint、其中，i表示切片的序号，j表示会话在切片中的序号。第一设备可以根据中间密钥为每个切片生成一组控制面密钥，每组控制面密钥包括控制面加密性密钥Ki-Cenc以及控制面完整性密钥Ki-Uint，其中，i表示切片的序号。例如，第一设备可以根据中间密钥Kan为第一切片的第一会话生成用户面加密性密钥K11-Uenc以及用户面完整性密钥K11-Uint，第一设备可以根据中间密钥Kan为第一切片的第二会话生成用户面加密性密钥K12-Uenc以及用户面完整性密钥K12-Uint，依次类推，第一设备可以根据中间密钥Kan为第n切片的第m会话生成用户面加密性密钥Knm-Uenc以及用户面完整性密钥Knm-Uint。第一设备可以根据中间密钥Kan为第一切片生成控制面加密性密钥K1-Cenc以及控制面完整性密钥K1-Cint，第一设备可以根据中间密钥Kan为第二切片生成控制面加密性密钥K2-Cenc以及控制面完整性密钥K2-Cint，依次类推，第一设备可以根据中间密钥Kan为第n切片生成控制面加密性密钥Kn-Cenc以及控制面完整性密钥Kn-Cint。
在第二种实施方式中，如图11B所示，假设本实施方式的应用场景为包括切片S1～Sn，每个切片包括H1～Hm个会话，则第一设备可以根据中间密钥为每个切片的每个会话生产一组用户平面密钥，每组用户平面密钥包括用户面加密性密钥Kij-Uenc、用户面完整性密钥Kij-Uint、其中，i表示切片的序号，j表示会话在切片的序号。第一设备可以根据中间密钥为生成一组控制面密钥，该组控制面密钥包括控制面加密性密钥KCenc以及控制面完整性密钥KCint。该组控制面密钥用于对切片S1～Sn的控制面数据进行安全性保护，即，每个切片的控制面数据使用相同的控制面密钥进行安全性保护。例如，第一设备可以根据中间密钥Kan为第一切片的第一会话生成用户面加密性密钥K11-Uenc以及用户面完整性密钥K11-Uint，第一设备可以根据中间密钥Kan为第一切片的第二会话生成用户面加密性密钥K12-Uenc以及用户面完整性密钥K12-Uint，依次类推，第一设备可以根据中间密钥Kan为第n切片的第m会话生成用户面加密性密钥Knm-Uenc以及用户面完整性密钥Knm-Uint。第一设备可以根据中间密钥Kan为生成控制面加密性密钥KCenc以及控制面完整性密钥KCint。
在第三种实施方式中，如图11C所示，假设本实施方式的应用场景为包括S1～Sn个切片，每个切片包括H1～Hm个会话，则第一设备可以根据中间密钥为每个切片的生产一组用户平面密钥，每组用户平面密钥包括用户面加密性密钥Ki-Uenc、用户面完整性密钥Ki-Uint、其中，i表示切片的序号。每组用户平面密钥用于对对应切片的每个会话进行安全性保护，即，同一切片内的会话使用相同的用户平面密钥进行安全性保护。第一设备可以根据中间密钥为每个切片生成一组控制面密钥，每组控制面密钥包括控制面加密性密钥Ki-Cenc以及控制面完整性密钥Ki-Uint，其中，i表示切片的序号。例如，第一设备可以根据中间密钥Kan为第一切片生成用户面加密性密钥K1-Uenc以及用户面完整性密钥 K1-Uint，第一设备可以根据中间密钥Kan为第二切片生成用户面加密性密钥K2-Uenc以及用户面完整性密钥K2-Uint，依次类推，第一设备可以根据中间密钥Kan为第n切片生成用户面加密性密钥Kn-Uenc以及用户面完整性密钥Kn-Uint。第一设备可以根据中间密钥Kan为第一切片生成控制面加密性密钥K1-Cenc以及控制面完整性密钥K1-Cint，第一设备可以根据中间密钥Kan为第二切片生成控制面加密性密钥K2-Cenc以及控制面完整性密钥K2-Cint，依次类推，第一设备可以根据中间密钥Kan为第n切片生成控制面加密性密钥Kn-Cenc以及控制面完整性密钥Kn-Cint。
在第四种实施方式中，如图11D所示，假设本实施方式的应用场景为包括切片S1～Sn，每个切片包括H1～Hm个会话，则第一设备可以根据中间密钥为每个切片的生成一组用户平面密钥，每组用户平面密钥包括用户面加密性密钥Ki-Uenc、用户面完整性密钥Ki-Uint、其中，i表示切片的序号。每组用户平面密钥用于对对应切片的每个会话进行安全性保护，即，同一切片内的会话使用相同的用户平面密钥进行安全性保护。第一设备可以根据中间密钥为生成一组控制面密钥，该组控制面密钥包括控制面加密性密钥KCenc以及控制面完整性密钥KCint。该组控制面密钥用于对切片S1～Sn的控制面数据进行安全性保护，即，每个切片的控制面数据使用相同的控制面密钥进行安全性保护。例如，第一设备可以根据中间密钥Kan为第一切片生成用户面加密性密钥K1-Uenc以及用户面完整性密钥K1-Uint，第一设备可以根据中间密钥Kan为第二切片生成用户面加密性密钥K2-Uenc以及用户面完整性密钥K2-Uint，依次类推，第一设备可以根据中间密钥Kan为第n切片生成用户面加密性密钥Kn-Uenc以及用户面完整性密钥Kn-Uint。第一设备可以根据中间密钥Kan为生成控制面加密性密钥KCenc以及控制面完整性密钥KCint。
在第五种实施方式中，如图11E所示，假设本实施方式的应用场景为包括切片S1～Sn，每个切片包括H1～Hm个会话，则第一设备可以根据中间密钥为每个切片生成一个切片根密钥Ki-root，其中，i表示切片的序号。第一设备根据切片i的根密钥Ki-root为切片i中的每个会话生成一个用户面密钥ij-root，其中，i表示切片的序号，j为会话在切片中的序号。第一设备再根据每个会话的用户面密钥ij-root为每个会话生成用户面加密性密钥Kij-Uenc以及用户面完整性密钥Kij-Uint。第一设备可以根据切片根密钥Ki-root为每个切片生成一组控制面密钥，每组控制面密钥包括控制面加密性密钥Ki-Cenc以及控制面完整性密钥Ki-Uint，其中，i表示切片的序号。即，每个切片的每个会话的用户面控制密钥ij-root以及切片的控制面密钥都是根据切片的根密钥生成的。
在第六种实施方式中，如图11F所示，本实施例主要是用来补充描述多切片、多会话(切片内)场景下的密钥生成方法及流程。本实施例的核心思想是由K_SEAF推衍生成不同切片的会话根密钥，并进一步推衍对应于加密终结点在UP-GW的会话密钥，生成的密钥架构如下图所示。其中，“sn”用来标识第n个切片，“UP-GWm”用来标识切片中的第m个会话。为了简单起见，假设每个切片有同样个数的(m个)会话。实际当中，不同切片可以有不同数量的会话。
参照图12所示，图11F的密钥生成与分发的具体步骤如下所述：
801、UE和核心网(如，认证网元(SEAF)和/或切片认证网元)进行双向认证，并生 成根密钥K_SEAF。核心网为UE确定切片，切片的ID可以表示为Slc-ID1…Slc-IDN。
802、在会话建立过程，核心网内通过会话安全策略的协商，确定需要生成终结点在UP-GW的用户面密钥。
803、核心网(如SEAF)生成每个切片的根密钥K_UP-s1…K_UP-sn，并分别发送给各个切片(只发送每个切片所对应的密钥，如发送K_UP-sn给切片n)。基于切片根密钥，每个切片推衍所有会话密钥(如：第n个切片的m个会话密钥为KUP-Sn-GWm(-enc,-int)，“enc”代表加解密密钥，“int”代表完整性保护密钥)。加解密和完整性保护密钥的生成函数分别为KDF(UP-GW-enc-alg,Bearerm,SliceIDn…)和KDF(UP-GW-int-alg,Bearerm,SliceIDn…)。其中KDF代表密钥生成函数，Bearerm和SliceIDn分别为承载ID和切片ID作为KDF的输入。其他输入包括UP-GW-enc-alg和UP-GW-int-alg，分别代表加密和完保所使用的算法。
804、每个切片给UP-GW发送生成的密钥。
805、UP-GW收到后应答。
806、每个切片把密钥生成所需输入参数发送给CCNF(AMF)。
807、AMF将上述参数通过SSMC经过AN发送给UE。
808、UE根据收到的参数，生成所有密钥(类似第803步骤的生成方法)。
参照图13所示，图13为本申请实施例中所提供的总体密钥架构示意图，其中，核心网控制面密钥架构部分如图9实施例所示，核心网用户面密钥架构部分如图11F实施例所示，接入网密钥架构部分如图11A至图11E实施例所示，此处不做赘述。
可以理解的是，为了陈述简便，上述例子中是以每个切片具有的会话的数量相等来进行描述的，在实际应用中，每个切片具有的会话的数量可以均不相等，或者，至少两个切片具有的会话数量相等，本申请不作具体的限定。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出 来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。

Claims (36)

  1. 一种网络密钥处理的系统，其特征在于，包括：用户设备、安全锚点网元、接入及移动管理网元，其中：
    所述安全锚点网元用于从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片，并根据所述第一密钥参数生成N个切片专用密钥；
    所述安全锚点网元还用于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片；
    所述接入及移动管理网元用于从所述切片选择网元或者所述安全锚点网元获取所述第一密钥参数，并将所述第一密钥参数发送给所述用户设备；
    所述用户设备用于根据所述第一密钥参数生成所述N个网络切片的N个切片专用密钥，并根据所生成的所述N个切片专用密钥访问所述N个网络切片。
  2. 根据权利要求1所述的系统，其特征在于，所述安全锚点网元还用于根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用；
    所述接入及移动管理网元还用于接收所述安全锚点网元发送的所述第二密钥参数；
    所述用户设备还用于从所述接入及移动管理网元接收到所述第二密钥参数后，并生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  3. 根据权利要求2所述的系统，其特征在于，所述接入及移动管理网元还用于：
    在将所述第一密钥参数发送给所述用户设备之前，通过所述共享密钥为所述第一密钥参数进行加密；
    所述接入及移动管理网元具体用于：
    所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备；
    所述用户设备具体用于接收所述接入及移动管理网元通过切片安全模式命令发送的进行加密后的所述第一密钥参数。
  4. 根据权利要求1至3其中任意一项所述的系统，其特征在于，所述系统还包括网络切片，其中：
    所述网络切片用于接收所述安全锚点网元发送的专用密钥；
    所述网络切片还用于根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
    所述网络切片还用于将所述加密参数发送给所述接入及移动管理网元；
    所述接入及移动管理网元还用于将所述加密参数发送给用户设备；
    所述用户设备还用于接收所述加密参数，并能够根据所述加密参数访问所述网络切片的所述M个网络功能。
  5. 一种安全锚点网元，其特征在于，所述网元包括：
    获取单元，用于从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络 切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；
    生成单元，用于根据所述第一密钥参数生成N个专用密钥；
    发送单元，用于将所述N个切片专用密钥分别发送给相对应的所述N个网络切片，以使得用户设备从接入及移动管理网元接收到所述第一密钥参数后，生成相同的所述N个切片专用密钥从而能够访问所述N个网络切片。
  6. 根据权利要求5所述的网元，其特征在于，所述发送单元还用于：
    将所述第一密钥参数发送给接入及移动管理网元，用于所述接入及移动管理网元发送所述第一密钥参数至用户设备。
  7. 根据权利要求5或6所述的网元，其特征在于，所述生成单元还用于：
    根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用，以使得所述用户设备从所述接入及移动管理网元接收到所述第二密钥参数后，生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  8. 一种接入及移动管理网元，其特征在于，所述网元包括：
    获取单元，用于从切片选择网元或者安全锚点网元获取所述第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
    发送单元，用于将所述第一密钥参数发送给所述用户设备，以使得所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
  9. 根据权利要求8所述的网元，其特征在于，所述发送单元具体用于：
    通过切片安全模式命令将所述第一密钥参数发送给所述用户设备。
  10. 根据权利要求9所述的网元，其特征在于，所述网元还包括：
    接收单元，用于接收所述安全锚点网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
    所述发送单元还用于，将所述第二密钥参数发送给所述用户设备，以使得所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  11. 根据权利要求10所述的网元，其特征在于，所述发送单元具体还用于：
    通过所述切片安全模式命令将所述第二密钥参数发送给所述用户设备。
  12. 根据权利要求11所述的网元，其特征在于，所述网元还包括：
    加密单元，在所述发送单元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备之前，用于所述接入及移动管理网元通过所述共享密钥为所述第一密钥参数进行加密；
    所述发送单元具体还用于：
    通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备。
  13. 根据权利要求12所述的网元，其特征在于，所述所述接收单元还用于：
    在所述发送单元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备之前，接收所述N个网络切片发送的加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
    所述发送单元还用于：
    通过切片安全模式命令将将进行加密后的所述第一密钥参数以及所述加密参数发送给所述用户设备，以使得所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
  14. 一种网络切片，其特征在于，所述网络切片包括：
    接收单元，用于接收安全锚点网元发送的专用密钥；
    加密单元，用于根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
    发送单元，用于将所述加密参数发送给接入及移动管理网元，以使得所述接入及移动管理网元将所述加密参数发送给用户设备，使得所述用户设备根据所述加密参数访问所述网络切片的所述M个网络功能。
  15. 一种用户设备，其特征在于，所述用户设备包括：
    接收单元，用于接收所述接入及移动管理网元发送的第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
    生成单元，用于根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
  16. 根据权利要求15所述的用户设备，其特征在于，所述接收单元具体用于：
    接收所述接入及移动管理网元通过切片安全模式命令发送的所述第一密钥参数。
  17. 根据权利要求16所述的用户设备，其特征在于，所述接收单元还用于：
    接收所述接入及移动管理网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
    所述生成单元还用于，用于根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  18. 根据权利要求17所述的用户设备，其特征在于，所述接收单元具体还用于：
    接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数。
  19. 根据权利要求18所述的用户设备，其特征在于，所述接收单元具体还用于：
    接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数。
  20. 根据权利要求19所述的用户设备，其特征在于，所述接收单元具体还用于：
    接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数以及加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
    所述用户设备还包括：
    访问单元，用于根据所述加密参数访问所述N个网络切片的所述M个网络功能。
  21. 一种网络密钥处理的方法，应用于安全锚点网元侧，其特征在于，所述方法包括：
    安全锚点网元从切片选择网元获取第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；
    所述安全锚点网元根据所述第一密钥参数生成N个专用密钥；
    所述安全锚点网元将所述N个切片专用密钥分别发送给相对应的所述N个网络切片，以使得用户设备从接入及移动管理网元接收到所述第一密钥参数后，生成相同的所述N个切片专用密钥从而能够访问所述N个网络切片。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    所述安全锚点网元将所述第一密钥参数发送给接入及移动管理网元，用于所述接入及移动管理网元发送所述第一密钥参数至用户设备。
  23. 根据权利要求21或22所述的方法，其特征在于，所述方法还包括：
    所述安全锚点网元根据第二密钥参数为所述接入及移动管理网元生成共享密钥，并将所述第二密钥参数发送给所述接入及移动管理网元，所述共享密钥用于所述N个网络切片的共享网络功能使用，以使得所述用户设备从所述接入及移动管理网元接收到所述第二密钥参数后，生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  24. 一种网络密钥处理的方法，应用于接入及移动管理网元侧，其特征在于，所述方法包括：
    接入及移动管理网元从切片选择网元或者安全锚点网元获取所述第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
    所述接入及移动管理网元将所述第一密钥参数发送给所述用户设备，以使得所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访问所述N个网络切片。
  25. 根据权利要求24所述的方法，其特征在于，所述接入及移动管理网元将所述第一密钥参数发送给所述用户设备，包括：
    所述接入及移动管理网元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备。
  26. 根据权利要求25所述的方法，其特征在于，所述方法还包括：
    所述接入及移动管理网元接收所述安全锚点网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
    所述接入及移动管理网元将所述第二密钥参数发送给所述用户设备，以使得所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  27. 根据权利要求26所述的方法，其特征在于，所述接入及移动管理网元将所述第二密钥参数发送给所述用户设备，包括：
    所述接入及移动管理网元通过所述切片安全模式命令将所述第二密钥参数发送给所述用户设备。
  28. 根据权利要求27所述的方法，其特征在于，在所述接入及移动管理网元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备之前，所述方法还包括：
    所述接入及移动管理网元通过所述共享密钥为所述第一密钥参数进行加密；
    所述接入及移动管理网元通过切片安全模式命令将所述第一密钥参数发送给所述用户设备，包括：
    所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备。
  29. 根据权利要求28所述的方法，其特征在于，在所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备之前，所述方法还包括：
    接收所述N个网络切片发送的加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
    所述接入及移动管理网元通过切片安全模式命令将进行加密后的所述第一密钥参数发送给所述用户设备，包括：
    所述接入及移动管理网元通过切片安全模式命令将将进行加密后的所述第一密钥参数以及所述加密参数发送给所述用户设备，以使得所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
  30. 一种网络密钥处理的方法，应用于网络切片侧，其特征在于，所述方法包括：
    所述网络切片接收安全锚点网元发送的专用密钥；
    所述网络切片根据加密参数对M个网络功能进行加密，所述加密参数包括所述专用密钥以及所述M个网络功能的功能标识；
    所述网络切片将所述加密参数发送给接入及移动管理网元，以使得所述接入及移动管理网元将所述加密参数发送给用户设备，使得所述用户设备根据所述加密参数访问所述网络切片的所述M个网络功能。
  31. 一种网络密钥处理的方法，应用于用户设备侧，其特征在于，所述方法包括：
    所述用户设备接收所述接入及移动管理网元发送的第一密钥参数，所述第一密钥参数包括N个网络切片的标识信息，所述N个网络切片为所述切片选择网元为所述用户设备所确定的网络切片；所述第一密钥参数用于安全锚点网元生成N个切片专用密钥，并将所述N个切片专用密钥发送给相对应的所述N个网络切片；
    所述用户设备根据所述第一密钥参数生成相同的所述N个切片专用密钥，从而能够访 问所述N个网络切片。
  32. 根据权利要求31所述的方法，其特征在于，所述用户设备接收所述接入及移动管理网元发送的第一密钥参数，包括：
    所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的所述第一密钥参数。
  33. 根据权利要求32所述的方法，其特征在于，所述方法还包括：
    所述用户设备接收所述接入及移动管理网元发送的第二密钥参数，所述第二密钥参数用于所述安全锚点网元为所述接入及移动管理网元生成共享密钥，所述共享密钥用于所述N个网络切片的共享网络功能使用；
    所述用户设备根据所述第二密钥参数生成相同的所述共享密钥从而能够访问所述N个网络切片的共享网络功能。
  34. 根据权利要求33所述的方法，其特征在于，所述用户设备接收所述接入及移动管理网元发送的第二密钥参数，包括：
    所述用户设备接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数。
  35. 根据权利要求34所述的方法，其特征在于，所述用户设备接收所述接入及移动管理网元通过所述切片安全模式命令发送的所述第二密钥参数，包括：
    所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数。
  36. 根据权利要求35所述的方法，其特征在于，所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数，包括：
    所述用户设备接收所述接入及移动管理网元通过切片安全模式命令发送的根据所述共享密钥进行加密后的所述第一密钥参数以及加密参数，所述加密参数为所述N个网络切片中每个网络切片为M个网络功能进行加密所使用的参数；
    所述用户设备根据所述加密参数访问所述N个网络切片的所述M个网络功能。
PCT/CN2017/102864 2017-01-25 2017-09-22 一种网络密钥处理的方法、相关设备及系统 WO2018137351A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17893726.4A EP3565210B1 (en) 2017-01-25 2017-09-22 Method, relevant device and system for processing network key
US16/517,645 US11431479B2 (en) 2017-01-25 2019-07-21 Network key processing method and system and related device
US17/819,188 US11917054B2 (en) 2017-01-25 2022-08-11 Network key processing method and system and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710064224.2A CN108347420B (zh) 2017-01-25 2017-01-25 一种网络密钥处理的方法、相关设备及系统
CN201710064224.2 2017-01-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/517,645 Continuation US11431479B2 (en) 2017-01-25 2019-07-21 Network key processing method and system and related device

Publications (1)

Publication Number Publication Date
WO2018137351A1 true WO2018137351A1 (zh) 2018-08-02

Family

ID=62963203

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/102864 WO2018137351A1 (zh) 2017-01-25 2017-09-22 一种网络密钥处理的方法、相关设备及系统

Country Status (4)

Country Link
US (2) US11431479B2 (zh)
EP (1) EP3565210B1 (zh)
CN (1) CN108347420B (zh)
WO (1) WO2018137351A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111865872A (zh) * 2019-04-26 2020-10-30 大唐移动通信设备有限公司 一种网络切片内终端安全策略实现方法及设备
WO2020254302A1 (en) * 2019-06-17 2020-12-24 Telefonaktiebolaget Lm Ericsson (Publ) Home controlled network slice privacy
US11108636B2 (en) 2019-10-23 2021-08-31 Cisco Technology, Inc. Integrity verification for managing network configurations

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102208868B1 (ko) 2017-01-30 2021-01-29 텔레호낙티에볼라게트 엘엠 에릭슨(피유비엘) 5g 시스템들에서의 보안 앵커 펑션
CN110972135A (zh) * 2018-09-28 2020-04-07 华为技术有限公司 一种安全通信方法、加密信息确定方法及装置
WO2020087286A1 (zh) * 2018-10-30 2020-05-07 华为技术有限公司 一种密钥生成方法、设备及系统
CN110087239B (zh) * 2019-05-20 2020-10-13 北京航空航天大学 基于5g网络中的匿名接入认证与密钥协商方法及装置
CN112492584B (zh) * 2019-08-23 2022-07-22 华为技术有限公司 终端设备和用户面网元之间的安全通信方法、装置及系统
CN111131144B (zh) * 2019-11-05 2021-11-16 远景智能国际私人投资有限公司 IoT设备管理方法、装置、服务器及存储介质
CN114930887A (zh) * 2020-02-06 2022-08-19 华为技术有限公司 一种密钥管理方法、通信装置
CN112738800A (zh) * 2020-12-25 2021-04-30 中盈优创资讯科技有限公司 一种网络切片的数据安全传输实现方法
CN113055175B (zh) * 2021-06-02 2021-08-06 杭州链城数字科技有限公司 分布式ca的私钥分配方法和电子装置
CN116074827A (zh) * 2021-10-31 2023-05-05 华为技术有限公司 一种通信方法及通信装置

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106210042A (zh) * 2016-07-11 2016-12-07 清华大学 一种基于端到端网络切片的用户服务请求选择方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9380032B2 (en) * 2012-04-25 2016-06-28 International Business Machines Corporation Encrypting data for storage in a dispersed storage network
CN103516789B (zh) * 2013-09-16 2019-04-26 北京电视台 从办公网到生产网的传输数据的管理方法和系统
CN104735654A (zh) * 2015-03-10 2015-06-24 重庆邮电大学 一种可检测数据完整性的隐私数据融合方法
US10142994B2 (en) * 2016-04-18 2018-11-27 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
US20180084427A1 (en) * 2016-09-16 2018-03-22 Zte Corporation Security features in next generation networks
US10736028B2 (en) * 2017-03-20 2020-08-04 Qualcomm Incorporated Network service configuration and selection using network slices
US11350272B2 (en) * 2018-11-01 2022-05-31 Qualcomm Incorporated Encrypting network slice selection assistance information

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106210042A (zh) * 2016-07-11 2016-12-07 清华大学 一种基于端到端网络切片的用户服务请求选择方法

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
3GPP SA2 TR 23.799 V14.0.0, December 2016 (2016-12-01)
3GPP SA2 TR 23.799, December 2016 (2016-12-01)
NEC: "pCR to TR 33.899: Solution #1.8 UpdatedKey Hierarchy for NextGen", 3GPP TSG SAWG3 (SECURITY) MEETING #85, S3-162141, 7 November 2016 (2016-11-07), Santa Cruz de Tenerife, Spain, XP051187580, Retrieved from the Internet <URL:http://www.3gpp.org/ftp//tsg_sa/WG3_Security/TSGS3_85_Santa_Cruz/Docs/> *
See also references of EP3565210A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111865872A (zh) * 2019-04-26 2020-10-30 大唐移动通信设备有限公司 一种网络切片内终端安全策略实现方法及设备
WO2020254302A1 (en) * 2019-06-17 2020-12-24 Telefonaktiebolaget Lm Ericsson (Publ) Home controlled network slice privacy
US11108636B2 (en) 2019-10-23 2021-08-31 Cisco Technology, Inc. Integrity verification for managing network configurations
US11818007B2 (en) 2019-10-23 2023-11-14 Cisco Technology, Inc. Integrity verification for managing network configurations

Also Published As

Publication number Publication date
EP3565210A1 (en) 2019-11-06
EP3565210A4 (en) 2019-11-13
CN108347420A (zh) 2018-07-31
EP3565210B1 (en) 2020-12-16
CN108347420B (zh) 2021-02-23
US11917054B2 (en) 2024-02-27
US11431479B2 (en) 2022-08-30
US20230033598A1 (en) 2023-02-02
US20190342082A1 (en) 2019-11-07

Similar Documents

Publication Publication Date Title
WO2018137351A1 (zh) 一种网络密钥处理的方法、相关设备及系统
US11272365B2 (en) Network authentication method, and related device and system
CN108781366B (zh) 用于5g技术的认证机制
EP3183857B1 (en) Secure provisioning of an authentication credential
KR102024653B1 (ko) 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
US20240048985A1 (en) Secure password sharing for wireless networks
KR20180004612A (ko) 무선 통신 시스템에서 서비스에 따른 보안 관리 방법 및 장치
US20170359719A1 (en) Key generation method, device, and system
JP2018502471A (ja) ワイヤレス通信のための装置および方法
WO2023280194A1 (zh) 网络连接管理方法、装置、可读介质、程序产品及电子设备
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
US10419922B1 (en) Subscriber identity privacy
WO2017026930A1 (en) Methods and devices for privacy enhancement in networks
WO2020087286A1 (zh) 一种密钥生成方法、设备及系统
WO2022237561A1 (zh) 一种通信方法及装置
CN107925874B (zh) 超密集网络安全架构和方法
WO2020147602A1 (zh) 一种认证方法、装置和系统
CN117501653A (zh) 操作无线网络的装置、系统和方法
CN108990052B (zh) Wpa2协议脆弱性的检测方法
US20230362631A1 (en) Secure storage and processing of sim data

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17893726

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017893726

Country of ref document: EP

Effective date: 20190729