WO2018137713A1 - 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体 - Google Patents

网络切片内鉴权方法、切片鉴权代理实体及会话管理实体 Download PDF

Info

Publication number
WO2018137713A1
WO2018137713A1 PCT/CN2018/075604 CN2018075604W WO2018137713A1 WO 2018137713 A1 WO2018137713 A1 WO 2018137713A1 CN 2018075604 W CN2018075604 W CN 2018075604W WO 2018137713 A1 WO2018137713 A1 WO 2018137713A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
slice
entity
security policy
network slice
Prior art date
Application number
PCT/CN2018/075604
Other languages
English (en)
French (fr)
Inventor
周巍
Original Assignee
电信科学技术研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 电信科学技术研究院 filed Critical 电信科学技术研究院
Publication of WO2018137713A1 publication Critical patent/WO2018137713A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present disclosure relates to the field of communications technologies, and in particular, to a method for authenticating within a network slice, a network slice authentication proxy entity, and a session management entity.
  • the 3GPP SA3 (3rd Generation Partnership Project Security Group 3) slice security aspect describes various key issues of network slice security, including network slice authentication.
  • Network slice authentication can be divided into network slice external authentication and network slice authentication. So far, there is no specific technical solution on how to implement authentication within the network slice. However, in order to ensure high slice security, network slice authentication is still needed.
  • the purpose of the disclosure is to provide a method for authenticating within a network slice, a network slice authentication proxy entity, and a session management entity, which solves the problem that the slice security authentication scheme in the related art is not perfect.
  • an embodiment of the present disclosure provides a method for authenticating within a network slice, which is applied to a network slice authentication proxy entity, including: receiving a network slice intra-slice authentication request and a slice security policy sent by the session management entity; The intra-network slice authentication request and the slice security policy are performed to perform an intra-slice authentication operation.
  • the slice security policy includes an authentication mode identifier and an authenticator address
  • the step of performing an intra-network slice authentication operation includes: Transmitting an authentication vector request to the corresponding authentication entity according to the authentication party address in the slice security policy; receiving a terminal authentication vector that is requested by the authentication entity according to the authentication vector; using the terminal authentication vector and corresponding The terminal performs network slice authentication.
  • the slice security policy includes an authentication mode identifier and an authenticator address, where the step of performing an intra-network slice authentication operation when the authentication mode identifier indicates a relay mode
  • the method includes: establishing an association with the corresponding authentication entity according to the authentication party address in the slice security policy; and forwarding the authentication information between the corresponding terminal and the authentication entity by using the association, to perform network slice intra-authentication authentication .
  • the authentication entity is an authentication server or a third party authentication entity.
  • the method further comprises: generating a slice master key; and transmitting the slice master key to the session management entity.
  • Some embodiments of the present disclosure further provide a method for authenticating within a network slice, which is applied to a session management entity, including: acquiring a slice security policy when receiving a session establishment instruction sent by a mobility management entity; When the policy indicates that the corresponding terminal performs intra-network intra-slice authentication, the network slice authentication proxy entity sends the intra-network intra-slice authentication request and the slice security policy.
  • the step of acquiring a slice security policy includes: acquiring a slice security policy locally; or
  • the step of obtaining a slice security policy from the policy control entity includes: sending a control policy request to the policy control entity, where the control policy request includes a terminal identifier and a slice identifier; and receiving the policy
  • the control entity includes a slice security policy according to the control identifier of the terminal identifier and the slice identifier feedback.
  • the slice security policy includes a terminal slice intra-authentication identifier
  • the method further before the sending the network slice intra-authentication request and the slice security policy to the network slice authentication proxy entity The method includes: when the authentication identifier in the terminal slice indicates that intra-slice authentication is performed, confirming that the slice security policy indicates that the terminal performs intra-network slice authentication.
  • the method further includes: receiving, by the network slice authentication proxy entity, And a slice master key generated after successful authentication in the network slice; and performing a distributed operation on the original slice master key and the slice master key generated after successful authentication in the network slice according to a preset rule.
  • Some embodiments of the present disclosure further provide a network slice authentication proxy entity, including: a first receiving module, configured to receive a network slice intra-slice authentication request and a slice security policy sent by the session management entity; and a first processing module, configured to The intra-slice authentication request and the slice security policy perform an operation of authenticating within the network slice.
  • a network slice authentication proxy entity including: a first receiving module, configured to receive a network slice intra-slice authentication request and a slice security policy sent by the session management entity; and a first processing module, configured to The intra-slice authentication request and the slice security policy perform an operation of authenticating within the network slice.
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the first processing module includes: a first sending submodule And sending an authentication vector request to the corresponding authentication entity according to the authentication party address in the slice security policy; the first receiving submodule is configured to receive the terminal authentication that is sent by the authentication entity according to the authentication vector request a first processing sub-module, configured to perform intra-network slice authentication by using the terminal authentication vector and the corresponding terminal.
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the first processing module includes: a first finder. a module, configured to establish an association with a corresponding authentication entity according to an authentication party address in the slice security policy; and a second processing submodule, configured to forward, by using the association, a reference between the corresponding terminal and the authentication entity Right information for authentication within the network slice.
  • the authentication entity is an authentication server or a third party authentication entity.
  • the network slice authentication proxy entity further includes: a first generating module, configured to generate a slice master key after successful authentication in the network slice; and a first sending module, configured to: The slice master key is sent to the session management entity.
  • Some embodiments of the present disclosure further provide a session management entity, including: a first obtaining module, configured to acquire a slice security policy when receiving a session establishment instruction sent by the mobility management entity; and a second sending module, configured to The slice security policy indicates that when the corresponding terminal performs network slice intra-authentication, the network slice authentication proxy entity sends the network slice intra-authentication request and the slice security policy.
  • the first obtaining module includes: a first obtaining submodule, configured to acquire a slice security policy locally; or obtain a slice security policy from the policy control entity.
  • the first obtaining submodule includes: a first sending unit, configured to send a control policy request to the policy control entity, where the control policy request includes a terminal identifier and a slice identifier; And a unit, configured to receive a control policy that is sent by the policy control entity according to the terminal identifier and the slice identifier, where the control policy includes a slice security policy.
  • the slice security policy includes a terminal slice intra-authentication identifier
  • the session management entity further includes: a first confirmation module, configured to send the network slice to the network slice authentication proxy entity Before the internal authentication request and the slice security policy, when the authentication identifier in the terminal slice indicates that intra-slice authentication is performed, it is confirmed that the slice security policy indicates that the terminal performs network slice authentication.
  • the session management entity further includes: a second receiving module, configured to: after sending the network slice intra-authentication request and the slice security policy to the network slice authentication proxy entity, a slice master key generated by the network slice authentication proxy entity and generated after the network slice is successfully authenticated; and a second processing module, configured to generate the original slice master key and the network slice successfully after the authentication according to the preset rule
  • the slice master key performs a decentralized operation.
  • Some embodiments of the present disclosure also provide a network slice authentication proxy entity, including: a processor, a memory, and a transceiver, where the memory is used to store programs and data used by the processor when performing operations, when processing When the device calls and executes the program and data stored in the memory, the following process is performed: receiving, by the transceiver, a network intra-slice authentication request and a slice security policy sent by the session management entity; according to the network slice intra-authentication request and the The slice security policy performs an operation of authenticating within the network slice, wherein the transceiver is configured to receive and transmit data.
  • a network slice authentication proxy entity including: a processor, a memory, and a transceiver, where the memory is used to store programs and data used by the processor when performing operations, when processing When the device calls and executes the program and data stored in the memory, the following process is performed: receiving, by the transceiver, a network intra-slice authentication request and a slice security policy sent by the session management entity; according
  • Some embodiments of the present disclosure also provide a session management entity, including: a processor; a memory, a transceiver, and a transceiver, the memory for storing programs and data used by the processor when performing operations, when processing When the device calls and executes the program and data stored in the memory, the following process is performed: when receiving a session establishment instruction sent by the mobility management entity by the transceiver, acquiring a slice security policy; When the corresponding terminal performs intra-network intra-slice authentication, the network slice intra-agent authentication request and the slice security policy are sent by the transceiver to the network slice authentication proxy entity, where the transceiver is configured to receive and send data.
  • a session management entity including: a processor; a memory, a transceiver, and a transceiver, the memory for storing programs and data used by the processor when performing operations, when processing When the device calls and executes the program and data stored in the memory, the following process is performed: when receiving a session establishment instruction sent by the mobility management
  • the method for authenticating within a network slice receives a network slice intra-slice authentication request and a slice security policy sent by a session management entity, and according to the network slice internal authentication request. And the slice security policy performs the operation of authenticating in the network slice; the authentication in the network slice can be completed, the slice security is further ensured, and the problem that the slice security authentication scheme is not perfect in the related technology is solved.
  • FIG. 1 is a schematic flowchart of a method for authenticating within a network slice in some optional embodiments of the present disclosure
  • FIG. 2 is a schematic flowchart of a method for authenticating within a network slice in some optional embodiments of the present disclosure
  • FIG. 3 is a schematic diagram of an implementation architecture of some optional embodiments of the present disclosure.
  • FIG. 4 is a schematic flowchart of a method for authenticating within a network slice according to some optional embodiments of the present disclosure
  • FIG. 5 is a schematic flowchart of an example of a method for authenticating within a network slice according to some optional embodiments of the present disclosure
  • FIG. 6 is a schematic structural diagram of a network slice authentication proxy entity in some optional embodiments of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a network slice authentication proxy entity in some optional embodiments of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a session management entity in some optional embodiments of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a session management entity in some optional embodiments of the present disclosure.
  • the present disclosure provides various solutions for the problem that the authentication scheme of the slice security is not perfect in the prior art, and is specifically as follows: as shown in FIG. 1 , some optional embodiments of the present disclosure provide a network slice.
  • the method of authentication can be applied to a network slice authentication proxy entity, and the method includes the following steps.
  • Step 11 Receive an intra-slice authentication request and a slice security policy sent by the session management entity.
  • Step 12 Perform an operation of authenticating within the network slice according to the intra-slice authentication request and the slice security policy.
  • the method for intra-network slice authentication receives a network intra-slice authentication request and a slice security policy sent by a session management entity, and according to the network slice intra-authentication request and the slice
  • the security policy performs the operation of authenticating within the network slice; the authentication in the network slice can be completed, the security of the slice is further ensured, and the problem that the slice security authentication scheme in the related technology is not perfect is solved.
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the step of performing an intra-network slice authentication operation includes: Sending an authentication vector request to the corresponding authentication entity in the slice security policy; receiving a terminal authentication vector that is requested by the authentication entity according to the authentication vector; and performing network segmentation by using the terminal authentication vector and the corresponding terminal Internal authentication.
  • the terminal authentication vector includes information required for performing authentication with the terminal, and the corresponding terminal refers to sending an attach request to the network, causing the mobility management entity to send a session establishment instruction to the session management entity, thereby enabling the session management entity to go to the network.
  • the slice authentication proxy entity sends a terminal in the network slice authentication request and the slice security policy (see the process shown in FIG. 4).
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the authentication mode identifier indicates a relay mode
  • the step of performing an intra-network slice authentication operation includes: The authentication party address in the section security policy is associated with the corresponding authentication entity; the authentication information between the corresponding terminal and the authentication entity is forwarded by the association to perform intra-network slice authentication.
  • the association may be a channel capable of transmitting communication information
  • the corresponding terminal refers to sending an attach request to the network, causing the mobility management entity to send a session establishment instruction to the session management entity, thereby enabling the session management entity to authenticate the network slice.
  • the proxy entity sends a terminal in the network slice authentication request and the slice security policy (see the process shown in Figure 4).
  • the authentication entity is an authentication server or a third-party authentication entity.
  • the method further comprises: generating a slice master key; and transmitting the slice master key to the session management entity.
  • a method for authenticating within a network slice is provided, which is applicable to a session management entity, and the method includes the following steps.
  • Step 21 Acquire a slice security policy when receiving a session establishment instruction sent by the mobility management entity.
  • Step 22 Send the intra-network intra-slice authentication request and the slice security policy to the network slice authentication proxy entity when the slice security policy indicates that the corresponding terminal performs network intra-slice authentication.
  • the method for authenticating within the network slice acquires a slice security policy by receiving a session establishment instruction sent by the mobility management entity, and correspondingly indicates the pair in the slice security policy.
  • the terminal sends the intra-network intra-slice authentication request and the slice security policy to the network slice authentication proxy entity when performing network intra-slice authentication, so that the network slice authentication proxy entity can perform the intra-slice authentication request and the slice security
  • the strategy performs the operation of authentication in the network slice; completes the authentication in the network slice, further ensures the security of the slice, and solves the problem that the authentication scheme of the slice security in the related technology is not perfect.
  • the step of acquiring a slice security policy includes: acquiring a slice security policy locally; or acquiring a slice security policy from the policy control entity.
  • the step of acquiring a slice security policy from the policy control entity includes: sending a control policy request to the policy control entity, where the control policy request includes a terminal identifier and a slice identifier; and receiving the policy control entity according to the terminal And a control policy for identifying and feeding the slice identifier, wherein the control policy includes a slice security policy.
  • the slice security policy includes a terminal slice intra-authentication identifier
  • the method further before the sending the network slice intra-authentication request and the slice security policy to the network slice authentication proxy entity The method includes: when the authentication identifier in the terminal slice indicates that intra-slice authentication is performed, confirming that the slice security policy indicates that the terminal performs intra-network slice authentication.
  • the method further includes: receiving, by the network slice authentication proxy entity, And a slice master key generated after successful authentication in the network slice; and performing a distributed operation on the original slice master key and the slice master key generated after successful authentication in the network slice according to a preset rule.
  • the method for authenticating the network slice provided by the embodiment of the present disclosure is further described below in conjunction with the network slice authentication proxy entity and the session management entity.
  • the present embodiment provides a method for authenticating within a network slice.
  • a possible security architecture for implementing this solution is shown in Figure 3.
  • It includes a control plane access network CP-AN, a user plane access network UP-AN, a core network-user plane function CN-UPF, a mobility function management function MMF (corresponding to a mobility management entity), and a session management function SMF (corresponding to a session management entity) , authentication server function AUSF and authentication credential storage and processing function ARPF, security context management function SCMF and security anchor function SEAF, network slice authentication proxy function NSPPF (corresponding network slice authentication proxy entity), policy control function PCF, and third party The authentication function 3 rd AAA; wherein UP-AN, SMF, NSPPF and CN-UPF belong to slice Slice#n, and #n represents the slice identifier.
  • ARPF Authentication Credential Repository and Processing Function
  • AUSF Authentication Server Function
  • SEAF Security Anchor Function
  • SCMF Security Context Management Function
  • PCF Policy Control Function
  • NSAPF Network Slice Authentication Proxy Function
  • the UE is responsible for authentication within a slice belonging to third functional entities described as follows: the third-party authentication function (3 rd party Authentication, Authorization and Account function, AAA): complete interaction with the UE through UE NSAPF inner sections Authentication, and a new slice security master key is generated after successful authentication, and the master key will be provided to the NSAPF.
  • the third-party authentication function (3 rd party Authentication, Authorization and Account function, AAA): complete interaction with the UE through UE NSAPF inner sections Authentication, and a new slice security master key is generated after successful authentication, and the master key will be provided to the NSAPF.
  • the slice security policy includes at least the following information:
  • ⁇ UE intra-slice authentication identifier used to determine whether the specified UE needs to perform intra-slice authentication.
  • ⁇ Authentication mode identification Identifies the way to implement authentication within the slice. Based on the authentication mode identifier, the NSAPF can determine which technical solution should be used to implement intra-slice authentication of the UE and how to interact with the UE and the authentication entity located outside the slice.
  • the authentication mode in the slice may be the same as the authentication mode adopted outside the slice, or may be different from the authentication mode adopted outside the slice. It may be a symmetric key based authentication method or an asymmetric key based authentication method.
  • the authentication vector may be obtained by the NSAPF from the slice external authentication entity, and the external authentication entity and the UE may be authenticated by the external authentication entity, or may be directly performed by the slice external authentication entity with the UE.
  • NSAPF is capable of supporting two basic intra-slice authentication methods:
  • Proxy mode The NSAPF sends an authentication vector request to the authentication entity located outside the slice according to the "Authentication Party Address" given in the slice security policy, and receives the authentication vector from the external authentication entity. The NSAPF then performs the intra-slice authentication process with the UE using the obtained authentication vector.
  • the NSAPF establishes a security association to the authentication entity located outside the slice according to the "Authentication Party Address" given in the slice security policy, and then the external authentication entity performs the intra-slice authentication process with the UE through the NSAPF.
  • Authentication party address Provides an address outside the slice that can provide an authentication vector or perform an intra-slice authentication function.
  • the method for authenticating the network slice provided by this embodiment is as shown in FIG. 4, and includes:
  • Step 41 The UE sends an attach request Attach request to the network. Based on a specific network function selection rule, an Access Network (AN) routes the attach request to a Mobility Management Function (MMF). The MMF further routes the request to the SEAF as a network security anchor and triggers a two-way authentication process.
  • AN Access Network
  • MMF Mobility Management Function
  • Step 42 Authentication and session master key derivation - Authentication and session master key derivation.
  • the UE performs mutual authentication through the SEAF and the AUSF (SEAF sends an authentication request to the AUSF). Successful authentication will result in the generation of the session master key Kseaf between the UE and the AUSF.
  • SEAF sends an authentication request to the AUSF.
  • the network side slice selection function allocates the UE to a suitable slice instance (ARPF derives the session master key Kseaf).
  • Step 43 Generate a session master key [Kseaf]-Providing session master key [Kseaf].
  • the AUSF provides the generated session master key Kseaf to the SEAF, which passes the session master key Kseaf to the SCMF.
  • Step 44 Control plane master key [Kcn-mm, Kns] - CP master key install [Kcn-mm, Kns].
  • the SCMF derives the control plane master key Kcn-mm for implementing control plane security and the slice master key Kns for implementing slice security and provides them to the MMF.
  • Step 45 The control plane securely establishes a CP security establish.
  • MMF uses Kcn-mm to perform the necessary key distribution and provides the derived key to the corresponding control plane functional entity to achieve control plane security.
  • Step 46 Create a session, including [Kns]-Session creation[Kns].
  • the MMF sends a session establishment command to a Session Management Session (SMF) in the UE slice, and the instruction includes a slice master key Kns.
  • SMF Session Management Session
  • Step 47 Slice security policy check request (with slice identifier, terminal identifier) - Control policy check request [Slice ID, UE ID].
  • the SMF sends a slice security control policy check request to the Policy Control Function (PCF), which includes a UE identifier (UE ID) and a slice identifier (Slice ID) to obtain a slice security policy, and whether the policy includes Information within the slice and how to perform intra-slice authentication.
  • PCF Policy Control Function
  • the SMF can also obtain the slice security policy locally, so that step 48 is not needed, and the other steps are unchanged.
  • Step 48 Slice security policy check response (with slice security policy) - Control policy check response [control policy].
  • the PCF retrieves a control policy applicable to the UE according to the slice identifier and the UE identity, and returns a response to the SMF through the slice security policy check response.
  • the slice security policy checks the response to include the control policy.
  • the slice security policy related to intra-slice authentication in the control policy includes at least the following contents:
  • Step 49 Secondary authentication request-Secondary authentication request, which can carry a slice security policy.
  • the SMF triggers the intra-slice authentication (secondary authentication) process and sends a secondary authentication request to the NSAPF (network) In-slice authentication request) and slice security policy.
  • Step 410 Secondary authentication + key derivation - Secondary authentication and key derivation.
  • the UE In the authentication process the UE slicing the slice authentication (second authentication key derivation +) by the 3 rd AAA NSAPF belonging to third parties by the AUSF NSAPF and ARPF, or.
  • NSAPF performs the following operations according to the settings of the authentication method:
  • the NSAPF sends an authentication vector request to the corresponding authentication entity to the "authenticator address" given in the slice security policy.
  • the request should contain at least the "UE Identity” and optionally the "Slice ID”.
  • the authentication entity generates or retrieves the applicable "UE Authentication Vector” using "UE Identity” and/or "Slice Identification”.
  • the authentication entity returns the "UE Authentication Vector" to the NSAPF.
  • the NSAPF uses the authentication vector to perform intra-slice authentication with the UE.
  • the NSAPF establishes a security association with the authentication entity specified by the "Authentication Party Address" given in the slice security policy.
  • the UE and the authentication entity perform the intra-slice authentication process through the NSAPF, and the NSAPF implements the relay forwarding function.
  • Step 411 New User Face Master Key - New UP master key install [Kns'].
  • Step 412 User face key [Kup]-UP key install[Kup].
  • the SMF sends the user plane key [Kup] to the user plane function UPF.
  • the SMF performs the necessary key distribution process according to the rules, and provides the generated key to the corresponding functional entity in the slice to implement slice security.
  • Step 413 User security establishment - UP security established.
  • the SMF, UE, UPF and AN generate the required security context and key through the corresponding Security Model Command (SMC) process and provide it to the corresponding functional entity to establish user plane security.
  • SMC Security Model Command
  • the method for authenticating within the network slice provided by the embodiment of the present disclosure is exemplified in the following.
  • Steps 51 to 59 are the same as steps 41 to 49 described above (Same as step 41 - step 49). It is assumed that the control policy obtained by the SMF from the PCF requires intra-slice authentication for the UE.
  • the specific content is as follows:
  • Step 510.1 Authentication vector request (porting terminal identifier, slice identifier) -authentication vector request [UE ID, Slice ID].
  • the NSAPF sends an intra-slice authentication vector request to the 3 rd AAA, which includes "UE ID” and "Slice ID”.
  • Step 510.2 Authentication vector response (carrying the authentication vector) -authentication vector response[authentication vector].
  • the 3 rd AAA provides an authentication vector to the NSAPF based on the "UE ID” and "Slice ID” information.
  • Step 510.3 Two-way authentication and key derivation-Mutual authentication and key derivation.
  • the NSAPF and the UE perform an intra-slice authentication process and derive a new user plane master key Kns' after successful authentication.
  • Steps 511 to 513 are the same as steps 411 to 413 described above (Same as step 411 - step 413).
  • the authentication party address in the first example may also be a local AUSF or ARPF.
  • the specific process is the same as that of the first example.
  • NSAPF act as a relay for communication between the UE and the 3 rd AAA.
  • 3 rd AAA needs to provide a new user plane security master key to the NSAPF.
  • step 510.3 may also perform only two-way authentication without exporting a new slice master key.
  • the slice master key provided by the out-of-slice SCMF can be directly used in the slice; it is no longer necessary to perform step 511 - step 513.
  • the network slice authentication proxy function NSAPF in this embodiment is a security anchor point in the network slice, and is responsible for interacting with the UE and an authentication entity outside the slice that can implement the intra-slice authentication function to complete the UE.
  • the authentication process within the slice. Successful intra-slice authentication can result in the generation of a new slice master key.
  • the NSAPF provides the new slice master key to the SMF, and the necessary key distribution is performed by the SMF, and the distributed key is distributed to the corresponding functional entity to achieve the required slice security.
  • Whether intra-slice authentication is performed in the slice in this embodiment is determined by the SMF according to the slice security policy.
  • SMF can obtain a slice security policy in two ways:
  • the SMF is obtained from the Policy Control Function (PCF);
  • Intra-slice authentication in this embodiment is performed by the NSAPF.
  • Intra-slice authentication should support two basic intra-slice authentication methods:
  • Proxy mode The NSAPF sends an authentication vector request to the authentication entity located outside the slice according to the "Authentication Party Address" given in the slice security policy, and receives the authentication vector from the external authentication entity. The NSAPF then performs the intra-slice authentication process with the UE using the obtained authentication vector. After successful authentication, the NSAPF and the UE can respectively obtain a new slice master key.
  • the NSAPF establishes a security association with the authentication entity outside the slice according to the "authenticator address" given in the slice security policy, and then the UE performs the intra-slice authentication process through the NSAPF and the authentication entity located outside the slice. After successful authentication, the external authentication entity needs to provide the generated new slice master key to the NSAPF.
  • the slice security policy in this embodiment describes whether the UE needs to perform an intra-slice authentication process and how to perform intra-slice authentication.
  • the slice security policy includes at least:
  • intra-slice authentication identifier used to determine whether the specified UE needs to perform intra-slice authentication
  • - authentication mode identification used to determine which method should be used to implement intra-slice authentication of the UE
  • - Authentication party address used to describe which slice external authentication entity should send a request related to authentication.
  • the SIM security policy request sent by the SMF to the PCF includes at least a “UE identity” and a “slice identifier”.
  • the PCF retrieves the slice security policy applicable to the specified UE according to the "UE Identity” and "Slice Identification” and returns it to the SMF.
  • the successful intra-slice authentication process in this embodiment may result in generating a new slice master key, which replaces the slice master key provided by the SCMF outside the slice, and implements slice security according to the new slice master key generation.
  • New key system may result in generating a new slice master key, which replaces the slice master key provided by the SCMF outside the slice, and implements slice security according to the new slice master key generation.
  • a network slice authentication proxy entity including:
  • the first receiving module 61 is configured to receive a network slice intra-slice authentication request and a slice security policy sent by the session management entity.
  • the first processing module 62 is configured to perform an operation of authenticating within the network slice according to the intra-slice intra-slice authentication request and the slice security policy.
  • the network slice authentication proxy entity receives the intra-network intra-slice authentication request and the slice security policy sent by the session management entity, and according to the intra-network slice authentication request and the slice security
  • the strategy performs the operation of authenticating within the network slice; the authentication in the network slice can be completed, the security of the slice is further ensured, and the problem that the slice security authentication scheme in the related technology is not perfect is solved.
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the first processing module includes: a first sending submodule, configured to The authentication party address in the slice security policy sends an authentication vector request to the corresponding authentication entity; the first receiving submodule is configured to receive the terminal authentication vector that the authentication entity requests to feed back according to the authentication vector; The processing submodule is configured to perform intranet slice authentication by using the terminal authentication vector and the corresponding terminal.
  • the terminal authentication vector includes information required for performing authentication with the terminal, and the corresponding terminal refers to sending an attach request to the network, causing the mobility management entity to send a session establishment instruction to the session management entity, thereby enabling the session management entity to go to the network.
  • the slice authentication proxy entity sends a terminal in the network slice authentication request and the slice security policy (see the process shown in FIG. 4).
  • the slice security policy includes an authentication mode identifier and an authenticator address.
  • the first processing module includes: a first setup submodule, configured to: Establishing an association with the corresponding authentication entity according to the authentication party address in the slice security policy; the second processing sub-module is configured to forward the authentication information between the corresponding terminal and the authentication entity by using the association, Perform network segmentation authentication.
  • the association may be a channel capable of transmitting communication information
  • the corresponding terminal refers to sending an attach request to the network, causing the mobility management entity to send a session establishment instruction to the session management entity, thereby enabling the session management entity to authenticate the network slice.
  • the proxy entity sends a terminal in the network slice authentication request and the slice security policy (see the process shown in Figure 4).
  • the authentication entity is an authentication server or a third-party authentication entity.
  • the network slice authentication proxy entity further includes: a first generating module, configured to generate a slice master key after successful authentication in the network slice; and a first sending module, configured to: The slice master key is sent to the session management entity.
  • the network slice authentication proxy entity provided in this embodiment solves the problem that the slice security authentication scheme is not perfect in the related art.
  • the embodiment provides a network slice authentication proxy entity, including: a processor 71; and a memory 73 connected to the processor 71 through a bus interface 72, where the memory 73 is used for storing The program 71 and the data used by the processor 71 when performing the operation, when the processor 71 calls and executes the program and data stored in the memory 73, the following process is performed: receiving the network sent by the session management entity through the transceiver 74 The intra-slice authentication request and the slice security policy are performed; and the intra-slice authentication operation is performed according to the intra-network intra-slice authentication request and the slice security policy.
  • the transceiver 74 is coupled to the bus interface 72 for receiving and transmitting data under the control of the processor 71.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 71 and various circuits of memory represented by memory 73.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • Transceiver 74 can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium.
  • the processor 71 is responsible for managing the bus architecture and general processing, and the memory 73 can store data used by the processor 71 in performing operations.
  • a session management entity including: a first obtaining module 81, configured to acquire a slice security policy when receiving a session establishment instruction sent by a mobility management entity.
  • the second sending module 82 is configured to send the intra-network intra-slice authentication request and the slice security policy to the network slice authentication proxy entity when the slice security policy indicates that the corresponding terminal performs intra-network slice authentication.
  • the session management entity acquires a slice security policy by receiving a session establishment instruction sent by the mobility management entity, and indicates that the corresponding terminal is networked in the slice security policy.
  • the operation of authenticating in the slice completing the authentication in the network slice, further ensuring the security of the slice, and solving the problem that the authentication scheme of the slice security in the related technology is not perfect.
  • the first obtaining module includes: a first acquiring sub-module, configured to acquire a slice security policy locally; or obtain a slice security policy from the policy control entity.
  • the first acquiring sub-module includes: a first sending unit, configured to send a control policy request to the policy control entity, where the control policy request includes a terminal identifier and a slice identifier; and the first receiving unit is configured to receive the The control policy is based on the control identifier of the terminal identifier and the slice identifier, and the control policy includes a slice security policy.
  • the slice security policy includes a terminal slice intra-authentication identifier
  • the session management entity further includes: a first confirmation module, configured to send the network slice to the network slice authentication proxy entity Before the internal authentication request and the slice security policy, when the authentication identifier in the terminal slice indicates that intra-slice authentication is performed, it is confirmed that the slice security policy indicates that the terminal performs network slice authentication.
  • the session management entity further includes: a second receiving module, configured to: after sending the network slice intra-authentication request and the slice security policy to the network slice authentication proxy entity, a slice master key generated by the network slice authentication proxy entity and generated after the network slice is successfully authenticated; and a second processing module, configured to generate the original slice master key and the network slice successfully after the authentication according to the preset rule
  • the slice master key performs a decentralized operation.
  • the session management entity provided in this embodiment solves the problem that the authentication scheme of the slice security in the related art is not perfect.
  • some optional embodiments of the present disclosure provide a session management entity, including: a processor 91; and a memory 93 connected to the processor 91 via a bus interface 92, the memory 93 being used for
  • the program and data used by the processor 91 in performing the operations are stored, and when the processor 91 calls and executes the programs and data stored in the memory 93, the following process is performed: the mobility is received through the transceiver 94.
  • the transceiver 94 is coupled to the bus interface 92 for receiving and transmitting data under the control of the processor 91.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 91 and various circuits of memory represented by memory 93.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • Transceiver 94 can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium.
  • the processor 91 is responsible for managing the bus architecture and general processing, and the memory 93 can store data used by the processor 91 in performing operations.
  • modules/sub-modules/units are referred to as modules/sub-modules/units to more particularly emphasize the independence of their implementation.
  • modules/sub-modules/units may be implemented in software for execution by various types of processors.
  • an identified executable code module can comprise one or more physical or logical blocks of computer instructions, which can be constructed, for example, as an object, procedure, or function. Nonetheless, the executable code of the identified modules need not be physically located together, but may include different instructions stored in different bits that, when logically combined, constitute a module and implement the provisions of the module. purpose.
  • the executable code module can be a single instruction or a plurality of instructions, and can even be distributed across multiple different code segments, distributed among different programs, and distributed across multiple memory devices.
  • operational data may be identified within the modules and may be implemented in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed at different locations (including on different storage devices), and may at least partially exist as an electronic signal on a system or network.
  • the module can be implemented by software, considering the level of the existing hardware process, the module can be implemented in software, and the technician can construct a corresponding hardware circuit to implement the corresponding function without considering the cost.
  • the hardware circuitry includes conventional Very Large Scale Integration (VLSI) circuits or gate arrays as well as existing semiconductors such as logic chips, transistors, or other discrete components.
  • VLSI Very Large Scale Integration
  • the modules can also be implemented with programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供了一种网络切片内鉴权的方法、网络切片鉴权代理实体及会话管理实体。网络切片内鉴权的方法包括：接收会话管理实体发送的网络切片内认证请求和切片安全策略；根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。

Description

网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
相关申请的交叉引用
本申请主张在2017年1月24日在中国提交的中国专利申请号No.201710055047.1的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，特别是指一种网络切片内鉴权的方法、网络切片鉴权代理实体及会话管理实体。
背景技术
3GPP SA3(第三代合作伙伴项目安全组3)切片安全方面描述了网络切片安全的各种关键问题，包括网络切片鉴权。网络切片鉴权可分为网络切片外鉴权和网络切片内鉴权。至目前为止还没有关于如何实现网络切片内鉴权的具体技术方案，但是，为了保证高度的切片安全，网络切片内鉴权还是需要的。
发明内容
本公开的目的在于提供一种网络切片内鉴权的方法、网络切片鉴权代理实体及会话管理实体，解决相关技术中切片安全的鉴权方案不够完善的问题。
为了解决上述技术问题，本公开实施例提供一种网络切片内鉴权的方法，应用于网络切片鉴权代理实体，包括：接收会话管理实体发送的网络切片内认证请求和切片安全策略；根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
在一些可选的实施例中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述进行网络切片内鉴权的操作的步骤包括：根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；利用所述终端认证向量与对应终端进行网络切片内鉴权。
在一些可选的实施例中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述进行网络切片内鉴权的操作的步骤包括：根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
在一些可选的实施例中，所述鉴权实体为认证服务器或第三方鉴权实体。
在一些可选的实施例中，在网络切片内鉴权成功之后，所述方法还包括：产生切片主密钥；将所述切片主密钥发送给所述会话管理实体。
本公开一些实施例还提供了一种网络切片内鉴权的方法，应用于会话管理实体，包括：在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
在一些可选的实施例中，所述获取切片安全策略的步骤包括：在本地获取切片安全策略；或者
从策略控制实体处获取切片安全策略。
在一些可选的实施例中，所述从策略控制实体处获取切片安全策略的步骤包括：向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
在一些可选的实施例中，所述切片安全策略包括终端切片内鉴权标识，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，所述方法还包括：在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
在一些可选的实施例中，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，所述方法还包括：接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
本公开一些实施例还提供了一种网络切片鉴权代理实体，包括：第一接 收模块，用于接收会话管理实体发送的网络切片内认证请求和切片安全策略；第一处理模块，用于根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
在一些可选的实施例中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述第一处理模块包括：第一发送子模块，用于根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；第一接收子模块，用于接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；第一处理子模块，用于利用所述终端认证向量与对应终端进行网络切片内鉴权。
在一些可选的实施例中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述第一处理模块包括：第一建立子模块，用于根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；第二处理子模块，用于通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
在一些可选的实施例中，所述鉴权实体为认证服务器或第三方鉴权实体。
在一些可选的实施例中，所述网络切片鉴权代理实体还包括：第一产生模块，用于在网络切片内鉴权成功之后，产生切片主密钥；第一发送模块，用于将所述切片主密钥发送给所述会话管理实体。
本公开一些实施例还提供了一种会话管理实体，包括：第一获取模块，用于在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；第二发送模块，用于在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
在一些可选的实施例中，所述第一获取模块包括：第一获取子模块，用于在本地获取切片安全策略；或者从策略控制实体处获取切片安全策略。
在一些可选的实施例中，所述第一获取子模块包括：第一发送单元，用于向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；第一接收单元，用于接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
在一些可选的实施例中，所述切片安全策略包括终端切片内鉴权标识，所述会话管理实体还包括：第一确认模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
在一些可选的实施例中，所述会话管理实体还包括：第二接收模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；第二处理模块，用于根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
本公开一些实施例还提供了一种网络切片鉴权代理实体，包括：处理器、存储器以及收发机，所述存储器用于存储所述处理器在执行操作时所使用的程序和数据，当处理器调用并执行所述存储器中所存储的程序和数据时，执行下列过程：通过收发机接收会话管理实体发送的网络切片内认证请求和切片安全策略；根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作，其中，收发机用于接收和发送数据。
本公开一些实施例还提供了一种会话管理实体，包括：处理器；存储器、收发机以及收发机，所述存储器用于存储所述处理器在执行操作时所使用的程序和数据，当处理器调用并执行所述存储器中所存储的程序和数据时，执行下列过程：在通过收发机接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，通过收发机向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略，其中，收发机用于接收和发送数据。
本公开的上述技术方案的有益效果如下：上述方案中，所述网络切片内鉴权的方法通过接收会话管理实体发送的网络切片内认证请求和切片安全策略，并根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作；能够完成网络切片内的鉴权，进一步保障切片安全，解决了相关技术中切片安全的鉴权方案不够完善的问题。
附图说明
图1为本公开一些可选的实施例中的网络切片内鉴权的方法流程示意图；
图2为本公开一些可选的实施例中的网络切片内鉴权的方法流程示意图；
图3为本公开一些可选的实施例的实现架构示意图；
图4为本公开一些可选的实施例的网络切片内鉴权的方法具体流程示意图；
图5为本公开一些可选的实施例的网络切片内鉴权的方法举例流程示意图；
图6为本公开一些可选的实施例中的网络切片鉴权代理实体结构示意图；
图7为本公开一些可选的实施例中的网络切片鉴权代理实体结构示意图；
图8为本公开一些可选的实施例中的会话管理实体结构示意图；
图9为本公开一些可选的实施例中的会话管理实体结构示意图。
具体实施方式
为使本公开要解决的技术问题、技术方案和优点更加清楚，下面将结合附图及具体实施例进行详细描述。
本公开针对现有的技术中切片安全的鉴权方案不够完善的问题，提供了多种解决方案，具体如下：如图1所示，本公开一些可选的实施例中提供一种网络切片内鉴权的方法，可应用于网络切片鉴权代理实体，所述方法包括以下步骤。
步骤11：接收会话管理实体发送的网络切片内认证请求和切片安全策略；
步骤12：根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
本公开一些可选的实施例中提供的所述网络切片内鉴权的方法通过接收会话管理实体发送的网络切片内认证请求和切片安全策略，并根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作；能够完成网络切片内的鉴权，进一步保障切片安全，解决了相关技术中切片安全的鉴权方案不够完善的问题。
考虑到实际使用时，进行网络切片内鉴权的操作的具体实现方案可有多 种，本实施例中，提供以下两种示例：
第一种示例，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述进行网络切片内鉴权的操作的步骤包括：根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；利用所述终端认证向量与对应终端进行网络切片内鉴权。
其中，终端认证向量包含有用于与终端进行认证所需要的信息，对应终端指的是向网络发送附着请求，促使移动性管理实体向会话管理实体发送会话建立指令，进而使得会话管理实体能够向网络切片鉴权代理实体发送网络切片内认证请求和切片安全策略(具体见图4所示的流程)的终端。
第二种示例，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述进行网络切片内鉴权的操作的步骤包括：根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
其中，所述关联可以为能够传递通讯信息的通道，对应终端指的是向网络发送附着请求，促使移动性管理实体向会话管理实体发送会话建立指令，进而使得会话管理实体能够向网络切片鉴权代理实体发送网络切片内认证请求和切片安全策略(具体见图4所示的流程)的终端。
具体的，所述鉴权实体为认证服务器或第三方鉴权实体。
在一些可选的实施例中，在网络切片内鉴权成功之后，所述方法还包括：产生切片主密钥；将所述切片主密钥发送给所述会话管理实体。
由上可知，本实施例提供的所述网络切片内鉴权的方法很好的解决了相关技术中切片安全的鉴权方案不够完善的问题。
如图2所示，本公开一些可选的实施例中提供一种网络切片内鉴权的方法，可应用于会话管理实体，所述方法包括以下步骤。
步骤21：在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；
步骤22：在所述切片安全策略指示对对应的终端进行网络切片内鉴权时， 向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
本公开一些可选的实施例中提供的所述网络切片内鉴权的方法通过在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略，并在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略；使得网络切片鉴权代理实体能够根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作；完成网络切片内的鉴权，进一步保障切片安全，解决了相关技术中切片安全的鉴权方案不够完善的问题。
其中，所述获取切片安全策略的步骤包括：在本地获取切片安全策略；或者从策略控制实体处获取切片安全策略。
具体的，所述从策略控制实体处获取切片安全策略的步骤包括：向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
在一些可选的实施例中，所述切片安全策略包括终端切片内鉴权标识，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，所述方法还包括：在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
在一些可选的实施例中，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，所述方法还包括：接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
由上可知，本实施例提供的所述网络切片内鉴权的方法很好的解决了相关技术中切片安全的鉴权方案不够完善的问题。
下面结合网络切片鉴权代理实体和会话管理实体两侧对本公开实施例提供的网络切片内鉴权的方法进行进一步说明。
针对3GPP SA3(第三代合作伙伴项目安全组3)5G安全研究报告TR中尚无实现切片内鉴权的情况，本实施例提供了一种网络切片内鉴权的方法。 实现本方案的一种可能的安全架构如图3所示。
其包括控制面接入网CP-AN，用户面接入网UP-AN，核心网-用户面功能CN-UPF，移动性功能管理功能MMF(对应移动性管理实体)，会话管理功能SMF(对应会话管理实体)，认证服务器功能AUSF和认证凭证存储和处理功能ARPF，安全上下文管理功能SCMF和安全锚功能SEAF，网络切片鉴权代理功能NSSPF(对应网络切片鉴权代理实体)，策略控制功能PCF，和第三方鉴权功能3 rd AAA；其中的UP-AN、SMF、NSSPF和CN-UPF属于切片Slice#n，#n代表的是切片标识。
具体的，部分安全功能实体介绍如下：认证凭证存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)：此功能存储，在身份认证过程中使用的长期安全凭证，并执行任何使用长期安全凭证作为输入的加密算法。它还存储与安全相关的签约用户配置文件。ARPF通过与认证服务器功能AUSF交互完成相应的安全服务功能，例如密钥导出。
认证服务器功能(Authentication Server Function，AUSF)：此功能接收来自安全锚功能SEAF的认证请求，并执行认证功能。AUSF与ARPF可通过接口进行交互，并由后者提供认证过程所需的密钥。
安全锚功能(Security Anchor Function，SEAF)：核心网络中的认证功能，其与AUSF和终端UE交互，并从AUSF接收作为终端UE认证过程的结果而建立的中间密钥。在初始附着期间，SEAF还将与移动性管理(Mobility Management，MM)功能和安全上下文管理功能SCMF交互。SEAF应驻留在运营商网络中的安全环境中，并提供物理上的访问控制。在漫游情况下，SEAF驻留在访问网络中。
安全上下文管理功能(Security Context Management Function，SCMF)：SCMF从SEAF接收中间密钥，然后利用中间密钥进一步导出用于控制面和用户面安全的密钥。SCMF应驻留在运营商网络中的安全环境中，并提供物理上的访问控制。在漫游情况下，SCMF驻留在访问网络中。
策略控制功能(Policy Control Function，PCF)：为UE会话的建立提供控制策略。本实施例中假设描述实现切片安全的策略也存储在PCF中。切片安全策略描述指定的UE是否需要执行切片内鉴权过程以及执行切片内鉴权 的方式和相关信息。
网络切片鉴权代理功能(Network Slice Authentication Proxy Function，NSAPF)：为网络切片内的安全锚点，负责与UE和可实现切片内鉴权功能的实体交互，完成UE在切片内的鉴权过程，并负责根据鉴权成功后获得的新的切片主密钥分散出用于实现切片安全的新的密钥体系，并将这些密钥分发给相应功能实体，从而实现所需的切片安全。
本实施例中，属于第三方的负责UE切片内鉴权的功能实体介绍如下：第三方鉴权功能(3 rd party Authentication,Authorization and Account function，AAA)：通过NSAPF与UE交互完成UE的切片内鉴权，并可在鉴权成功后生成新的切片安全主密钥，该主密钥将提供给NSAPF。
另外，为了达到鉴权的目的，本实施例中，切片安全策略中至少包含如下信息：
·UE切片内认证标识：用于判断指定UE是否需要进行切片内认证。
·鉴权方式标识：标识实现切片内鉴权的方式。基于认证方式标识，NSAPF可确定应使用何种技术方案实现UE的切片内鉴权，以及如何与UE和位于切片外部的鉴权实体进行交互。切片内的鉴权方式可以与切片外部采用的鉴权方式相同，也可以与切片外部采用的鉴权方式不同。可以是基于对称密钥的认证方法，也可以是基于非对称密钥的鉴权方法。可以是由NSAPF从切片外部鉴权实体获得认证向量，并代理该外部鉴权实体与UE完成鉴权过程，也可以是由切片外部鉴权实体直接与UE执行鉴权过程。
NSAPF能够支持2种基本的切片内鉴权方式：
-代理方式：NSAPF按切片安全策略中给出的“鉴权方地址”向位于切片外部的鉴权实体发送认证向量请求，并接收来自于该外部鉴权实体的认证向量。然后NSAPF使用获得的认证向量与UE执行切片内鉴权过程。
-中继方式：NSAPF按切片安全策略中给出的“鉴权方地址”向位于切片外部的鉴权实体建立安全关联，然后该外部鉴权实体通过NSAPF与UE执行切片内鉴权过程。
·鉴权方地址：提供位于切片外的能够提供认证向量或执行切片内鉴权功能的实体的地址。
基于上述实现架构，本实施例提供的网络切片内鉴权的方法如图4所示，包括：
步骤41：UE向网络发送附着请求Attach request。基于特定的网络功能选择规则，接入网(Access Network，AN)将附着请求路由至移动性管理功能(Mobility Management Function，MMF)。MMF进一步路由该请求至作为网络安全锚点的SEAF，并触发双向鉴权过程。
步骤42：认证和会话主钥导出-Authentication and session master key derivation。
在双向鉴权过程中UE通过SEAF与AUSF进行双向认证(SEAF向AUSF发送认证请求)。成功的认证将导致在UE和AUSF之间产生会话主密钥Kseaf。同时网络侧切片选择功能将该UE分配给合适的切片实例(ARPF将会话主密钥Kseaf导出)。
步骤43：产生会话主密钥[Kseaf]-Providing session master key[Kseaf]。
AUSF将生成的会话主密钥Kseaf提供给SEAF，SEAF将会话主密钥Kseaf传递给SCMF。
步骤44：控制面主密钥[Kcn-mm,Kns]-CP master key install[Kcn-mm,Kns]。
SCMF导出用于实现控制面安全的控制面主密钥Kcn-mm和用于实现切片安全的切片主密钥Kns，并将它们提供给MMF。
步骤45：控制面安全建立CP security establish。
MMF利用Kcn-mm进行必要的密钥分散，并将导出的密钥提供给相应的控制面功能实体，以实现控制面安全。
步骤46：创建会话，包括[Kns]-Session creation[Kns]。
MMF将会话建立指令发送给UE切片内的会话管理功能(Session Management Session，SMF)，指令中包含有切片主密钥Kns。
步骤47：切片安全策略检查请求(携带切片标识，终端标识)-Control policy check request[Slice ID,UE ID]。
SMF向策略控制功能(Policy Control Function，PCF)发送切片安全控制策略检查请求，其中包含有UE标识(UE ID)和切片标识(Slice ID)，以获 得切片安全策略，该策略中包含有是否进行切片内鉴权及如何进行切片内鉴权的信息。
当然，SMF也可以从本地获得切片安全策略，这样就不需要步骤48了，其他步骤无变动。
步骤48：切片安全策略检查响应(携带切片安全策略)-Control policy check response[control policy]。
PCF依据切片标识和UE标识检索到适用于该UE的控制策略，并通过切片安全策略检查响应返回给SMF。
切片安全策略检查响应中包含控制策略。控制策略中与切片内认证相关的切片安全策略至少包含如下内容：
-UE切片内鉴权标识；
-鉴权方式标识；
-鉴权方地址。
步骤49：二次认证请求-Secondary authentication request，可携带切片安全策略。
若PCF提供的控制策略中的切片安全策略要求对该UE进行二次鉴权(网络切片内鉴权)，则SMF触发切片内认证(二次认证)过程，向NSAPF发送二次认证请求(网络切片内鉴权请求)和切片安全策略。
步骤410：二次认证+密钥导出-Secondary authentication and key derivation。
在切片内鉴权过程中UE通过NSAPF与AUSF和ARPF，或者通过NSAPF与属于第三方的3 rd AAA进行切片内认证(二次认证+密钥导出)。
NSAPF依据认证方式的设置进行如下操作：
·若认证方式为“代理方式”，则进行如下处理：
(1)NSAPF向切片安全策略中给出的“鉴权方地址”向对应的鉴权实体发送认证向量请求。请求中应至少包含“UE标识”，并可选地包含“切片标识”。
(2)鉴权实体利用“UE标识”和/或“切片标识”生成或检索适用的“UE认证向量”。
(3)鉴权实体将“UE认证向量”返回给NSAPF。
(4)NSAPF使用该认证向量与UE进行切片内鉴权。
·若认证方式为“中继方式”，则进行如下处理：
(1)NSAPF与切片安全策略中给出的“鉴权方地址”指定的鉴权实体建立安全关联。
(2)UE与鉴权实体通过NSAPF执行切片内鉴权过程，NSAPF实现中继转发功能。
步骤411：新的用户面主密钥-New UP master key install[Kns']。
认证成功后可导致产生新的切片主密钥(用户面主密钥)Kns'。若有新的切片主密钥Kns'产生，NSAPF将获得该密钥，并该密钥提供给SMF。
步骤412：用户面密钥[Kup]-UP key install[Kup]。
SMF向用户面功能UPF发送用户面密钥[Kup]。
也可以理解为，SMF依据规则进行必要的密钥分散过程，并将生成的密钥提供给切片内相应的功能实体，以实现切片安全。
步骤413：用户面安全建立-UP security established。
SMF，UE，UPF和AN通过相应的安全模式命令(Security Model Command，SMC)过程生成所需的安全上下文和密钥，并提供给相应的功能实体，从而建立起用户面安全。
下面结合上述内容对本公开实施例提供的网络切片内鉴权的方法进行举例说明。
举例一：
上述内容提供了一个包含切片外鉴权和由第三方参与的切片内鉴权的方案。此处假设第三方鉴权实体可提供认证向量。具体流程如图5所示，并描述如下：
步骤51至步骤59与上述步骤41至步骤49相同(Same as step 41–step49)。假设SMF从PCF获得的控制策略中要求对UE进行切片内认证，具体内容如下：
-UE切片内鉴权标识：“需要切片内鉴权”；
-鉴权方式标识：“代理方式”；
-鉴权方地址：“3 rd AAA地址”。
步骤510.1：认证向量请求(携带终端标识，切片标识)-authentication vector request[UE ID,Slice ID]。
NSAPF向3 rd AAA发送切片内认证向量请求，请求中包含“UE ID”和“切片ID”。
步骤510.2：认证向量响应(携带认证向量)-authentication vector response[authentication vector]。
3 rd AAA根据“UE ID”和“切片ID”信息向NSAPF提供认证向量。
步骤510.3：双向认证和密钥导出-Mutual authentication and key derivation。
NSAPF和UE执行切片内鉴权过程，并在认证成功后推导出新的用户面主密钥Kns'。
步骤511至步骤513与上述步骤411至步骤413相同(Same as step 411–step 413)。
举例二：
举例一中的鉴权方地址也可以是指向本地的AUSF或ARPF。具体流程与举例一相同。
举例三：
当举例一中的鉴权方式标识指示“中继方式”时，NSAPF充当UE与3 rd AAA之间通信的中继的角色。当鉴权成功时，3 rd AAA需要将新的用户面安全主密钥提供给NSAPF。
举例四：
当举例一中的鉴权方式标识指示“中继方式”时，步骤510.3也可以只进行双向认证，而不导出新的切片主密钥。在这种情况下切片内直接使用切片外SCMF提供的切片主密钥即可；也不再需要执行步骤511-步骤513。
此处说明，本实施例中的网络切片鉴权代理功能NSAPF：为网络切片内的安全锚点，负责与UE和可实现切片内鉴权功能的位于切片外部的鉴权实体交互，以完成UE在切片内的鉴权过程。成功的切片内鉴权可导致生成新的切片主密钥。NSAPF将新的切片主密钥提供给SMF，并由SMF进行必要的密钥分散，并将分散的密钥分发给相应的功能实体以实现所需的切片安全。
本实施例中切片内是否进行切片内认证由SMF根据切片安全策略确定。 SMF可以通过2种方式获得切片安全策略：
(1)SMF从策略控制功能(PCF)中获得；
(2)SMF从本地获得。
本实施例中切片内鉴权由NSAPF执行。切片内鉴权应支持2种基本的切片内鉴权方式：
-代理方式：NSAPF按切片安全策略中给出的“鉴权方地址”向位于切片外部的鉴权实体发送认证向量请求，并接收来自于外部认证实体的认证向量。然后NSAPF使用获得的认证向量与UE进行切片内鉴权过程。成功鉴权后，NSAPF和UE可分别获得新的切片主密钥。
-中继方式：NSAPF按切片安全策略中给出的“鉴权方地址”与切片外部的鉴权实体建立安全关联，然后UE通过NSAPF与位于切片外部的鉴权实体执行切片内鉴权过程。成功鉴权后外部的鉴权实体需要将生成的新切片主密钥提供给NSAPF。
本实施例中切片安全策略描述UE是否需要执行切片内鉴权过程和如何执行切片内鉴权。切片安全策略至少包含有：
-UE切片内认证标识：用于确定指定UE是否需要进行切片内鉴权；
-鉴权方式标识:用于确定应使用何种方法实现UE的切片内鉴权；
-鉴权方地址:用于描述应向哪个切片外部鉴权实体发送与鉴权相关的请求。
本实施例中SMF向PCF发送的切片安全策略请求中至少包含“UE标识”和“切片标识”。PCF依据“UE标识”和“切片标识”检索到适用于指定UE的切片安全策略，并返回给SMF。
本实施例中成功的切片内鉴权过程可导致生成新的切片主密钥，该密钥可替换由切片外部的SCMF提供的切片主密钥，并依据新的切片主密钥生成实现切片安全的新密钥体系。
如图6所示，本公开一些可选的实施例中提供一种网络切片鉴权代理实体，包括：
第一接收模块61，用于接收会话管理实体发送的网络切片内认证请求和切片安全策略；
第一处理模块62，用于根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
本公开一些可选的实施例中提供的所述网络切片鉴权代理实体通过接收会话管理实体发送的网络切片内认证请求和切片安全策略，并根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作；能够完成网络切片内的鉴权，进一步保障切片安全，解决了相关技术中切片安全的鉴权方案不够完善的问题。
考虑到实际使用时，第一处理模块的具体实现方案可有多种，本实施例中，提供以下两种示例：
第一种示例，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述第一处理模块包括：第一发送子模块，用于根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；第一接收子模块，用于接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；第一处理子模块，用于利用所述终端认证向量与对应终端进行网络切片内鉴权。
其中，终端认证向量包含有用于与终端进行认证所需要的信息，对应终端指的是向网络发送附着请求，促使移动性管理实体向会话管理实体发送会话建立指令，进而使得会话管理实体能够向网络切片鉴权代理实体发送网络切片内认证请求和切片安全策略(具体见图4所示的流程)的终端。
第二种示例，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述第一处理模块包括：第一建立子模块，用于根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；第二处理子模块，用于通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
其中，所述关联可以为能够传递通讯信息的通道，对应终端指的是向网络发送附着请求，促使移动性管理实体向会话管理实体发送会话建立指令，进而使得会话管理实体能够向网络切片鉴权代理实体发送网络切片内认证请求和切片安全策略(具体见图4所示的流程)的终端。
具体的，所述鉴权实体为认证服务器或第三方鉴权实体。
在一些可选的实施例中，所述网络切片鉴权代理实体还包括：第一产生模块，用于在网络切片内鉴权成功之后，产生切片主密钥；第一发送模块，用于将所述切片主密钥发送给所述会话管理实体。
由上可知，本实施例提供的所述网络切片鉴权代理实体很好的解决了相关技术中切片安全的鉴权方案不够完善的问题。
其中，上述涉及网络切片鉴权代理实体侧的网络切片内鉴权的方法的所述实现实施例均适用于该网络切片鉴权代理实体的实施例中，也能达到相同的技术效果。
如图7所示，本实施例提供一种网络切片鉴权代理实体，包括：处理器71；以及通过总线接口72与所述处理器71相连接的存储器73，所述存储器73用于存储所述处理器71在执行操作时所使用的程序和数据，当处理器71调用并执行所述存储器73中所存储的程序和数据时，执行下列过程：通过收发机74接收会话管理实体发送的网络切片内认证请求和切片安全策略；根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
其中，收发机74与总线接口72连接，用于在处理器71的控制下接收和发送数据。
需要说明的是，在图7中，总线架构可以包括任意数量的互联的总线和桥，具体由处理器71代表的一个或多个处理器和存储器73代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机74可以是多个元件，即包括发送机和收发机，提供用于在传输介质上与各种其他装置通信的单元。处理器71负责管理总线架构和通常的处理，存储器73可以存储处理器71在执行操作时所使用的数据。
本领域技术人员可以理解，实现上述实施例的全部或者部分步骤可以通过硬件来完成，也可以通过计算机程序来指示相关的硬件来完成，所述计算机程序包括执行上述方法的部分或者全部步骤的指令；且该计算机程序可以存储于一可读存储介质中，存储介质可以是任何形式的存储介质。
如图8所示，本公开一些可选的实施例中提供一种会话管理实体，包括： 第一获取模块81，用于在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；第二发送模块82，用于在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
本公开一些可选的实施例中提供的所述会话管理实体通过在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略，并在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略；使得网络切片鉴权代理实体能够根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作；完成网络切片内的鉴权，进一步保障切片安全，解决了相关技术中切片安全的鉴权方案不够完善的问题。
其中，所述第一获取模块包括：第一获取子模块，用于在本地获取切片安全策略；或者从策略控制实体处获取切片安全策略。
具体的，所述第一获取子模块包括：第一发送单元，用于向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；第一接收单元，用于接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
在一些可选的实施例中，所述切片安全策略包括终端切片内鉴权标识，所述会话管理实体还包括：第一确认模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
在一些可选的实施例中，所述会话管理实体还包括：第二接收模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；第二处理模块，用于根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
由上可知，本实施例提供的所述会话管理实体很好的解决了相关技术中切片安全的鉴权方案不够完善的问题。
其中，上述涉及会话管理实体侧的网络切片内鉴权的方法的所述实现实施例均适用于该会话管理实体的实施例中，也能达到相同的技术效果。
如图9所示，本公开一些可选的实施例提供一种会话管理实体，包括：处理器91；以及通过总线接口92与所述处理器91相连接的存储器93，所述存储器93用于存储所述处理器91在执行操作时所使用的程序和数据，当处理器91调用并执行所述存储器93中所存储的程序和数据时，执行下列过程：在通过收发机94接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，通过收发机94向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
其中，收发机94与总线接口92连接，用于在处理器91的控制下接收和发送数据。
需要说明的是，在图9中，总线架构可以包括任意数量的互联的总线和桥，具体由处理器91代表的一个或多个处理器和存储器93代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机94可以是多个元件，即包括发送机和收发机，提供用于在传输介质上与各种其他装置通信的单元。处理器91负责管理总线架构和通常的处理，存储器93可以存储处理器91在执行操作时所使用的数据。
本领域技术人员可以理解，实现上述实施例的全部或者部分步骤可以通过硬件来完成，也可以通过计算机程序来指示相关的硬件来完成，所述计算机程序包括执行上述方法的部分或者全部步骤的指令；且该计算机程序可以存储于一可读存储介质中，存储介质可以是任何形式的存储介质。
其中，此说明书中所描述的许多功能部件都被称为模块/子模块/单元，以便更加特别地强调其实现方式的独立性。
本公开实施例中，模块/子模块/单元可以用软件实现，以便由各种类型的处理器执行。举例来说，一个标识的可执行代码模块可以包括计算机指令的一个或多个物理或者逻辑块，举例来说，其可以被构建为对象、过程或函数。 尽管如此，所标识模块的可执行代码无需物理地位于一起，而是可以包括存储在不同位里上的不同的指令，当这些指令逻辑上结合在一起时，其构成模块并且实现该模块的规定目的。
实际上，可执行代码模块可以是单条指令或者是许多条指令，并且甚至可以分布在多个不同的代码段上，分布在不同程序当中，以及跨越多个存储器设备分布。同样地，操作数据可以在模块内被识别，并且可以依照任何适当的形式实现并且被组织在任何适当类型的数据结构内。所述操作数据可以作为单个数据集被收集，或者可以分布在不同位置上(包括在不同存储设备上)，并且至少部分地可以仅作为电子信号存在于系统或网络上。
在模块可以利用软件实现时，考虑到现有硬件工艺的水平，所以可以以软件实现的模块，在不考虑成本的情况下，本领域技术人员都可以搭建对应的硬件电路来实现对应的功能，所述硬件电路包括常规的超大规模集成(VLSI)电路或者门阵列以及诸如逻辑芯片、晶体管之类的现有半导体或者是其它分立的元件。模块还可以用可编程硬件设备，诸如现场可编程门阵列、可编程阵列逻辑、可编程逻辑设备等实现。
以上所述的是本公开的优选实施方式，应当指出对于本技术领域的普通人员来说，在不脱离本公开所述原理前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本公开的保护范围。

Claims (22)

  1. 一种网络切片内鉴权的方法，应用于网络切片鉴权代理实体，包括：
    接收会话管理实体发送的网络切片内认证请求和切片安全策略；
    根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
  2. 根据权利要求1所述的方法，其中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述进行网络切片内鉴权的操作的步骤包括：
    根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；
    接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；
    利用所述终端认证向量与对应终端进行网络切片内鉴权。
  3. 根据权利要求1所述的方法，其中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述进行网络切片内鉴权的操作的步骤包括：
    根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；
    通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
  4. 根据权利要求2或3所述的方法，其中，所述鉴权实体为认证服务器或第三方鉴权实体。
  5. 根据权利要求1所述的方法，其中，在网络切片内鉴权成功之后，所述方法还包括：
    产生切片主密钥；
    将所述切片主密钥发送给所述会话管理实体。
  6. 一种网络切片内鉴权的方法，应用于会话管理实体，包括：
    在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；
    在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
  7. 根据权利要求6所述的方法，其中，所述获取切片安全策略的步骤包括：
    在本地获取切片安全策略；或者
    从策略控制实体处获取切片安全策略。
  8. 根据权利要求7所述的方法，其中，所述从策略控制实体处获取切片安全策略的步骤包括：
    向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；
    接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
  9. 根据权利要求6所述的方法，其中，所述切片安全策略包括终端切片内鉴权标识，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，所述方法还包括：
    在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
  10. 根据权利要求6所述的方法，其中，在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，所述方法还包括：
    接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；
    根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
  11. 一种网络切片鉴权代理实体，包括：
    第一接收模块，用于接收会话管理实体发送的网络切片内认证请求和切片安全策略；
    第一处理模块，用于根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作。
  12. 根据权利要求11所述的网络切片鉴权代理实体，其中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示代理方式时，所述第一处理模块包括：
    第一发送子模块，用于根据所述切片安全策略中的鉴权方地址向对应的鉴权实体发送认证向量请求；
    第一接收子模块，用于接收所述鉴权实体根据所述认证向量请求反馈的终端认证向量；
    第一处理子模块，用于利用所述终端认证向量与对应终端进行网络切片内鉴权。
  13. 根据权利要求11所述的网络切片鉴权代理实体，其中，所述切片安全策略包括鉴权方式标识和鉴权方地址，在所述鉴权方式标识指示中继方式时，所述第一处理模块包括：
    第一建立子模块，用于根据所述切片安全策略中的鉴权方地址与对应的鉴权实体建立关联；
    第二处理子模块，用于通过所述关联转发对应终端与所述鉴权实体之间的鉴权信息，以进行网络切片内鉴权。
  14. 根据权利要求12或13所述的网络切片鉴权代理实体，其中，所述鉴权实体为认证服务器或第三方鉴权实体。
  15. 根据权利要求11所述的网络切片鉴权代理实体，其中，所述网络切片鉴权代理实体还包括：
    第一产生模块，用于在网络切片内鉴权成功之后，产生切片主密钥；
    第一发送模块，用于将所述切片主密钥发送给所述会话管理实体。
  16. 一种会话管理实体，包括：
    第一获取模块，用于在接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；
    第二发送模块，用于在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略。
  17. 根据权利要求16所述的会话管理实体，其中，所述第一获取模块包括：
    第一获取子模块，用于在本地获取切片安全策略；或者
    从策略控制实体处获取切片安全策略。
  18. 根据权利要求17所述的会话管理实体，其中，所述第一获取子模块包括：
    第一发送单元，用于向策略控制实体发送控制策略请求，所述控制策略请求中包括终端标识和切片标识；
    第一接收单元，用于接收所述策略控制实体根据所述终端标识和所述切片标识反馈的控制策略，所述控制策略中包括切片安全策略。
  19. 根据权利要求16所述的会话管理实体，其中，所述切片安全策略包括终端切片内鉴权标识，所述会话管理实体还包括：
    第一确认模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之前，在所述终端切片内鉴权标识指示进行切片内鉴权时，确认所述切片安全策略指示对所述终端进行网络切片内鉴权。
  20. 根据权利要求16所述的会话管理实体，其中，所述会话管理实体还包括：
    第二接收模块，用于在所述向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略之后，接收所述网络切片鉴权代理实体发送的、网络切片内鉴权成功后产生的切片主密钥；
    第二处理模块，用于根据预设规则对原始切片主密钥和网络切片内鉴权成功后产生的切片主密钥进行分散操作。
  21. 一种网络切片鉴权代理实体，包括：处理器、存储器以及收发机，所述存储器用于存储所述处理器在执行操作时所使用的程序和数据，当处理器调用并执行所述存储器中所存储的程序和数据时，执行下列过程：
    通过收发机接收会话管理实体发送的网络切片内认证请求和切片安全策略；
    根据所述网络切片内认证请求和所述切片安全策略，进行网络切片内鉴权的操作，
    其中，收发机用于接收和发送数据。
  22. 一种会话管理实体，包括：处理器；存储器、收发机以及收发机，所述存储器用于存储所述处理器在执行操作时所使用的程序和数据，当处理器调用并执行所述存储器中所存储的程序和数据时，执行下列过程：
    在通过收发机接收到移动性管理实体发送的会话建立指令时，获取切片安全策略；
    在所述切片安全策略指示对对应的终端进行网络切片内鉴权时，通过收发机向网络切片鉴权代理实体发送网络切片内认证请求和所述切片安全策略，
    其中，收发机用于接收和发送数据。
PCT/CN2018/075604 2017-01-24 2018-02-07 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体 WO2018137713A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710055047.1 2017-01-24
CN201710055047.1A CN108347729B (zh) 2017-01-24 2017-01-24 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体

Publications (1)

Publication Number Publication Date
WO2018137713A1 true WO2018137713A1 (zh) 2018-08-02

Family

ID=62962949

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/075604 WO2018137713A1 (zh) 2017-01-24 2018-02-07 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体

Country Status (2)

Country Link
CN (1) CN108347729B (zh)
WO (1) WO2018137713A1 (zh)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110831249B (zh) * 2018-08-13 2021-10-01 华为技术有限公司 通信方法和装置
CN112740732A (zh) * 2018-09-18 2021-04-30 Oppo广东移动通信有限公司 用于网络切片鉴权的方法和设备
CN111031538B (zh) * 2018-10-09 2021-12-03 华为技术有限公司 一种鉴权的方法及装置
CN114615703A (zh) * 2018-10-09 2022-06-10 华为技术有限公司 一种网络切片接入控制的方法及装置
ES2900513T3 (es) * 2019-04-01 2022-03-17 Ntt Docomo Inc Métodos y componentes de red de comunicación para iniciar una autenticación y una autorización específicas de segmento
CN115835218A (zh) * 2019-06-17 2023-03-21 华为技术有限公司 二级认证的方法和装置
CN112291784B (zh) * 2019-07-09 2022-04-05 华为技术有限公司 一种通信方法以及网元
WO2021026927A1 (zh) * 2019-08-15 2021-02-18 华为技术有限公司 通信方法和相关设备
CN114208111B (zh) * 2019-08-18 2023-08-04 华为技术有限公司 一种通信方法、装置及系统
CN113746649B (zh) * 2020-05-14 2022-12-06 华为技术有限公司 一种网络切片控制方法及通信装置
CN113904781B (zh) * 2020-06-20 2023-04-07 华为技术有限公司 切片认证方法及系统
CN117118841A (zh) * 2020-06-28 2023-11-24 中兴通讯股份有限公司 网络切片连接管理方法、终端及计算机可读存储介质
CN112073969B (zh) * 2020-09-07 2022-09-13 中国联合网络通信集团有限公司 5g网络安全防护方法及系统

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104092668A (zh) * 2014-06-23 2014-10-08 北京航空航天大学 一种可重构网络安全服务构造方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BR112017023037A2 (pt) * 2015-06-01 2018-07-03 Huawei Tech Co Ltd aparelho e método para funções virtualizadas em planos de controle e de dados.

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104092668A (zh) * 2014-06-23 2014-10-08 北京航空航天大学 一种可重构网络安全服务构造方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI ET AL.: "Network Authentication Supporting Network Slices", 3GPP TSG SA WG3 (SECURITY) MEETING #85 S 3-161741, 11 November 2016 (2016-11-11), XP051170603 *
HUAWEI ET AL.: "Security for UE Connecting to Multiple Slice", 3GPP TSG SA WG2 MEETING #116 S 2-163599, 15 July 2016 (2016-07-15), XP051118185 *

Also Published As

Publication number Publication date
CN108347729B (zh) 2019-08-02
CN108347729A (zh) 2018-07-31

Similar Documents

Publication Publication Date Title
WO2018137713A1 (zh) 网络切片内鉴权方法、切片鉴权代理实体及会话管理实体
US11296877B2 (en) Discovery method and apparatus based on service-based architecture
US20200396060A1 (en) Identity Management Method, Device, Communications Network, And Storage Medium
US11496320B2 (en) Registration method and apparatus based on service-based architecture
KR102345932B1 (ko) 네트워크 보안 관리 방법 및 장치
EP2790370B1 (en) Authentication method and system oriented to heterogeneous network
KR101438243B1 (ko) Ｓｉｍ 기반 인증방법
KR102632519B1 (ko) 사용자 장치와 애플리케이션 서버 간의 통신을 보안하기 위한 키를 결정하기 위한 방법
WO2015029945A1 (ja) 加入者プロファイル転送方法、加入者プロファイル転送システム及びユーザ装置
US9608971B2 (en) Method and apparatus for using a bootstrapping protocol to secure communication between a terminal and cooperating servers
CA2552917C (en) A method of obtaining the user identification for the network application entity
CN109314693B (zh) 验证密钥请求方的方法和设备
CN109891921A (zh) 下一代系统的认证
US20240086562A1 (en) User data management method and related device
CN107135228B (zh) 一种基于中心节点的认证系统与认证方法
JP2023529951A (ja) 安全な通信方法、関連する装置、およびシステム
WO2018076298A1 (zh) 一种安全能力协商方法及相关设备
WO2022078058A1 (zh) 解密方法、服务器及存储介质
CN112906032B (zh) 基于cp-abe与区块链的文件安全传输方法、系统及介质
CN114024693A (zh) 一种认证方法、装置、会话管理功能实体、服务器及终端
WO2021146913A1 (zh) 一种备份信息方法、装置、存储介质和计算机设备
CN113890778B (zh) 一种基于局域网的智能家居认证及加密方法及系统
US20230319563A1 (en) Renewing vendor certificates in a network
WO2024065483A1 (en) Authentication procedures for edge computing in roaming deployment scenarios
EP4369761A1 (en) Secure channel establishing method and apparatus, and related device and storage medium

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18744768

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18744768

Country of ref document: EP

Kind code of ref document: A1