WO2018153173A1 - 一种终端标识的处理方法、装置及相关设备 - Google Patents

一种终端标识的处理方法、装置及相关设备 Download PDF

Info

Publication number
WO2018153173A1
WO2018153173A1 PCT/CN2018/072029 CN2018072029W WO2018153173A1 WO 2018153173 A1 WO2018153173 A1 WO 2018153173A1 CN 2018072029 W CN2018072029 W CN 2018072029W WO 2018153173 A1 WO2018153173 A1 WO 2018153173A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
identifier
function entity
network function
type indication
Prior art date
Application number
PCT/CN2018/072029
Other languages
English (en)
French (fr)
Inventor
谢振华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018153173A1 publication Critical patent/WO2018153173A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data

Definitions

  • the present disclosure relates to the field of communications, and in particular, to a method, an apparatus, and a related device for processing a terminal identifier.
  • the terminal identifier is used to identify the corresponding terminal, that is, to authenticate the terminal.
  • the 3rd Generation Partnership Project proposes a transformation scheme for the identification of the mobile terminal.
  • the embodiment of the present disclosure provides a method, an apparatus, and a related device for processing a terminal identifier.
  • the embodiment of the present disclosure provides a method for processing a terminal identifier, which is applied to a first network function entity, and the method includes: correspondingly sending, according to the validity of the authentication vector for the terminal, a corresponding identifier type indication to the terminal;
  • the identifier type indication is used to indicate terminal identifier information carried by the terminal when sending a subsequent message; the authentication vector is received from a second network function entity.
  • the method when the corresponding identifier type indication is sent to the terminal according to the validity of the authentication vector of the terminal, the method includes: when there is no authentication vector that can be used for the terminal, The identifier type sent by the terminal is indicated as a first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the corresponding terminal identifier information.
  • the method when the corresponding identifier type indication is sent to the terminal according to the validity of the authentication vector for the terminal, the method includes: when there is an authentication vector that can be used for the terminal, The identifier type sent by the terminal is indicated as a second type indication; the second type indication indicates that the second network function entity is capable of identifying the terminal according to the corresponding terminal identification information.
  • the indication type indication form is specific identification information or non-specific identification information.
  • the method further includes: receiving, by the second network function entity, identifier information of the terminal, where the received identifier information of the terminal is used by the first network function entity and the second network function entity Interacting related information of the terminal.
  • the embodiment of the present disclosure further provides a method for processing a terminal identifier, which is applied to a terminal, where the method includes: receiving an identifier type indication sent by a first network function entity; and indicating, according to the identifier type, to the first network
  • the message sent by the function entity carries the corresponding terminal identifier information.
  • the method further includes: when the identifier type indicates the first type indication, carrying the first terminal identification information in the sent message; the first type indication characterizing the first network function
  • the entity can identify the terminal according to the first terminal identification information; the first terminal identification information is received from the first network function entity.
  • the method further includes: when the identifier type indicates the second type indication, carrying the second terminal identification information in the sent message; the second type indication indicating that the second network function entity can Identifying the terminal according to the second terminal identification information.
  • the method further includes: generating second terminal identification information according to information shared with the second network function entity; and the second network function entity is capable of identifying the terminal according to the second terminal identification information.
  • the method further includes: receiving a calculation parameter sent by the first network function entity; the calculation parameter is sent by the second network function entity; and according to the information shared with the second network function entity, Calculating parameters to generate second terminal identification information; the second network function entity is capable of identifying the terminal according to the second terminal identification information.
  • the indication type indication form is specific identification information or non-specific identification information.
  • the embodiment of the present disclosure further provides a processing apparatus for a terminal identifier, including: a determining unit, and a sending unit, configured to send a corresponding identifier to the terminal according to the validity of the authentication vector for the terminal determined by the determining unit.
  • the type indication is used to indicate terminal identification information that is carried by the terminal when sending a subsequent message; the authentication vector is received from a second network function entity.
  • the identifier type sent by the sending unit to the terminal is indicated as a first type indication; the first type indication represents the first network function.
  • the entity can identify the terminal according to the corresponding terminal identification information.
  • the identifier type sent by the sending unit to the terminal is a second type indication; the second type indication represents the second network function entity.
  • the terminal can be identified according to the corresponding terminal identification information.
  • the embodiment of the present disclosure further provides a processing apparatus for a terminal identifier, including: a second receiving unit, configured to receive an identifier type indication sent by a first network function entity; and a processing unit configured to indicate according to the identifier type
  • the message sent by the first network function entity carries corresponding terminal identifier information.
  • the processing unit when the identifier type indicates the first type indication, the processing unit carries the first terminal identification information in the sent message; the first type indication indicates that the first network function entity can Identifying the terminal according to the first terminal identification information; the first terminal identification information is received from the first network function entity.
  • the processing unit when the identifier type indicates the second type indication, the processing unit carries the second terminal identification information in the sent message; the second type indication indicates that the second network function entity can be according to the The second terminal identification information identifies the terminal.
  • the embodiment of the present disclosure further provides a network function entity, which is a first network function entity, the first network function entity includes: a first processor; and a first communication interface, configured to be determined according to the first processor Corresponding to the validity of the authentication vector of the terminal, correspondingly sending a corresponding identifier type indication to the terminal; the identifier type indication is used to indicate terminal identifier information carried by the terminal when sending a subsequent message; the authentication vector is received from the Two network functional entities.
  • the first network function entity includes: a first processor; and a first communication interface, configured to be determined according to the first processor Corresponding to the validity of the authentication vector of the terminal, correspondingly sending a corresponding identifier type indication to the terminal; the identifier type indication is used to indicate terminal identifier information carried by the terminal when sending a subsequent message; the authentication vector is received from the Two network functional entities.
  • the identifier type sent by the first communication interface to the terminal is indicated as a first type indication; the first type indication represents the first
  • the network function entity can identify the terminal according to the corresponding terminal identification information.
  • the identifier type sent by the first communication interface to the terminal is a second type indication; and the second type indication represents the second network.
  • the functional entity is capable of identifying the terminal based on the corresponding terminal identification information.
  • the embodiment of the present disclosure further provides a terminal, including: a second communication interface, configured to receive an identifier type indication sent by the first network function entity; and a second processor configured to: according to the identifier type indication, The message sent by the second communication interface to the first network function entity carries the corresponding terminal identifier information.
  • the second processor when the identifier type indicates the first type indication, the second processor carries the first terminal identifier information in the sent message; the first type indication represents the first network function The entity can identify the terminal according to the first terminal identification information; the first terminal identification information is received from the first network function entity.
  • the second processor when the identifier type indicates the second type indication, the second processor carries the second terminal identification information in the sent message; the second type indication indicates that the second network function entity can be based on the The second terminal identification information identifies the terminal.
  • the method, device, and related device for processing a terminal identifier provided by the embodiment of the present disclosure, the first network function entity, according to the validity of the authentication vector for the terminal, correspondingly sending a corresponding identifier type indication to the terminal; the authentication vector is received from a second network function entity; after receiving the identifier type indication sent by the first network function entity, the terminal carries the corresponding terminal identifier information in the message sent to the first network function entity according to the identifier type indication, The terminal can indicate the identifier type to the terminal, so the terminal can carry the corresponding terminal identifier in the message according to the type of the indication, so that the first network function entity can directly perform the authentication operation with the terminal, thereby improving the signaling of the authentication operation. effectiveness.
  • FIG. 1 is a schematic diagram of a transformation process of a mobile terminal identifier in the related art
  • FIG. 2 is a schematic flowchart of a method for processing a terminal identifier according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart of a method for processing a terminal identifier according to Embodiment 1 of the present disclosure
  • FIG. 4 is a schematic flowchart of a method for transforming a terminal identifier according to Embodiment 2 of the present disclosure
  • FIG. 5 is a schematic flowchart of a method for transforming a terminal identifier according to Embodiment 3 of the present disclosure
  • FIG. 6 is a schematic flowchart of a method for transforming a terminal identifier according to Embodiment 4 of the present disclosure
  • FIG. 7 is a schematic structural diagram of a device for processing a terminal identifier according to Embodiment 5 of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another apparatus for processing a terminal identifier according to Embodiment 5 of the present disclosure.
  • the flow of the method includes the following steps.
  • step 101 the terminal (UE, User Equipment) sends an attach request to the core network element, such as an attach request (Attach Request) message, where the message carries the identifier ID1 of the UE.
  • an attach request Attach Request
  • the core network element may be a Mobility Management Entity (MME) or a Mobility Management Function (MMF).
  • MME Mobility Management Entity
  • MMF Mobility Management Function
  • ID1 may be an International Mobile Subscriber Identification (IMSI), or a previously received identifier.
  • IMSI International Mobile Subscriber Identification
  • step 102 the core network element sends an authentication data request to the network element that sends the authentication data, and carries the received ID1.
  • the authentication data delivery network element may be a Home Subscriber Server (HSS) or an Authentication Service Function (AUSF).
  • HSS Home Subscriber Server
  • AUSF Authentication Service Function
  • the authentication data request is sent, and may be an authentication data request (Authentication Data Request) message or the like.
  • step 103 the authentication data sending network element generates a new identifier ID2 for the UE.
  • step 104 the authentication data sending network element sends an authentication data response to the core network element, carries an authentication vector, and carries the encrypted ID2 and the calculation parameter.
  • the authentication data response may be sent, and may be an authentication data response (Authentication Data Response) message or the like.
  • authentication data response Authentication Data Response
  • the calculation parameter is used for the UE to verify the ID2.
  • step 105 the core network element sends a user authentication request to the UE, carries the authentication parameter consisting of part of the received authentication vector, and carries the encrypted ID2 and the calculation parameter.
  • the user authentication request is sent, and the user authentication request message or the like may be sent.
  • the authentication parameters may include a random number (RAND) and a network authentication token (AUTN).
  • RAND random number
  • AUTN network authentication token
  • the AUTN is used for the UE to verify the network
  • the RAND is used by the network to authenticate the UE.
  • the core network element may be an MME or the like.
  • Sending a user authentication response may be sending a User Authentication Response message.
  • Step 107 The core network element sends an identity confirmation message to the network element that sends the authentication data, for example, sends a SYNC message and carries the verification code.
  • the verification code is used to verify the identification confirmation message.
  • the network element with the authentication data can communicate with each other using the ID2, thereby preventing others from leaking the location information of the UE by tracking the ID1.
  • the authentication data is delivered to the network element and only one authentication vector can be delivered at a time, and the subsequent authentication operation must be performed by the authentication data of the home network, which affects the authentication operation. Signaling efficiency.
  • the first network function entity sends a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal; the identifier type indication is used to indicate that the terminal sends the subsequent message.
  • the terminal identifier information is carried; the authentication vector is received from the second network function entity; after receiving the identifier type indication sent by the first network function entity, the terminal carries the corresponding message in the message sent to the first network function entity according to the identifier type indication Terminal identification information.
  • An embodiment of the present disclosure provides a method for processing a terminal identifier, which is applied to a first network function entity. As shown in FIG. 2, the method includes the following steps.
  • the first network function entity determines an identifier type indication corresponding to the identifier type of the terminal according to the validity of the authentication vector for the terminal.
  • the first network function entity determines the identity type indication corresponding to the identity type of the terminal according to the usage (availability) of the authentication vector for the terminal.
  • the identifier type indication is used to indicate terminal identifier information carried by the terminal when sending the subsequent message.
  • the identifier type of the terminal corresponds to the identifier type indication as the first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the corresponding terminal identification information.
  • the identifier type of the terminal corresponds to the identifier type indication as the second type indication; and the second type indication indicates that the second network function entity can identify the terminal according to the corresponding terminal identification information.
  • the authentication vector is an authentication vector delivered by the second network function entity, that is, the authentication vector is received from the second network function entity.
  • the use of the authentication vector may be an authentication vector that can be used for the terminal, or may be an authentication vector that is not available for the terminal.
  • the use of authentication vectors can be divided into two types: an authentication vector that can be used and an authentication vector that cannot be used.
  • the authentication vector is used for the terminal to perform mutual authentication with the corresponding network.
  • the second network function entity may deliver at least one authentication vector as needed.
  • Each authentication vector contains a plurality of authentication parameters, which form a vector, ie an authentication vector.
  • the first network function entity may be a key control node of the access network, such as a core network element, which may be an MME or an MMF.
  • the second network function entity may be an authentication data sending network element, that is, a node that controls user data, such as an HSS or an AUSF.
  • the representation of the identifier type indication may be specific identification information or non-specific identification information.
  • the first network function entity determines that the identifier type indication is notified in an implicit manner.
  • the specific terminal identification information such as the identifier information that is not all zeros, indicates the terminal identification information corresponding to the terminal, and indicates whether the identifier type is the first type or the second type, which can save signaling. Resources.
  • the first network function entity determines that the identification type indication is notified in an explicit manner. For example, the terminal identifier information corresponding to the terminal may be indicated, and at the same time, a field is used to indicate that the identifier type is the first type or the second type.
  • the method may further include: receiving identification information of the terminal sent by the second network function entity; and the identifier information of the received terminal is used for information related to the interaction between the first network function entity and the second network function entity.
  • the second network function entity does not directly send the second type of terminal identification information to the terminal through the first network function entity, and the terminal is based on sharing with the second network function entity.
  • the information generated by the second network function entity sends the identification information of the terminal to the first network function entity, so that the first network function entity and the second network function entity interact with the terminal.
  • the terminal When generating the identification information of the terminal, when the second network function entity sends the calculation parameter to the terminal by using the first network function entity, the terminal generates the second type based on the information shared with the second network function entity and the calculation parameter. Terminal identification information.
  • step 202 the first network function entity sends a corresponding identifier type indication to the terminal according to the determined identifier type.
  • the type of the identifier sent to the terminal is indicated as the first type indication.
  • the type of the identifier sent to the terminal is indicated as a second type indication.
  • the method may further include: the first network function entity receiving the message sent by the terminal; and when the terminal cannot identify the terminal according to the terminal identifier information carried in the received message, the first network The function entity forwards the terminal identification information carried in the received message to the second network function entity to identify the terminal, so that the second network function entity and the terminal perform mutual authentication based on the corresponding authentication vector.
  • the first network function entity and the terminal perform mutual authentication based on the corresponding authentication vector when the terminal can be identified according to the terminal identification information carried in the received message.
  • the first network function entity sends a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal; the identifier type indication is used to indicate that the terminal is sending the subsequent message. Terminal identification information carried at the time; the authentication vector is received from the second network functional entity.
  • the identification type indication is a first type indication; the first type indication indicates that the first network function entity is capable of identifying the terminal according to the corresponding terminal identification information.
  • the identifier type sent to the terminal is indicated as a second type indication; and the second type indication indicates that the second network function entity can identify the terminal according to the corresponding terminal identification information.
  • the embodiment of the present disclosure further provides a method for processing a terminal identifier, which is applied to a terminal. As shown in FIG. 3, the method includes the following steps.
  • step 301 the terminal receives an identifier type indication sent by the first network function entity.
  • the identifier type indicates terminal identification information that is used when the terminal sends a message.
  • the representation of the identifier type indication may be specific identification information or non-specific identification information.
  • the first network function entity determines that the identifier type indication is notified in an implicit manner.
  • the specific terminal identification information such as the identifier information that is not all zeros, indicates the terminal identification information corresponding to the terminal, and indicates whether the identifier type is the first type or the second type, which can save signaling. Resources.
  • the first network function entity determines that the identification type indication is notified in an explicit manner. For example, the terminal identifier information corresponding to the terminal may be indicated, and at the same time, a field is used to indicate that the identifier type is the first type or the second type.
  • step 302 the terminal carries the corresponding terminal identification information in the message sent to the first network function entity according to the identifier type indication.
  • the first type indication indicates that the first network function entity can identify the terminal according to the first terminal identification information, and then the terminal, when the received identifier type indicates the first type indication.
  • Mutual authentication is performed based on the corresponding authentication vector.
  • the sent message carries the second terminal identifier information; the second type indication indicates that the second network function entity can identify the terminal according to the second terminal identifier information, and further, the second network The functional entity and the terminal perform mutual authentication based on the corresponding authentication vector.
  • the first terminal identifier information is received by the first network function entity, for example, the terminal may obtain the first terminal identifier information from the message indicating the identifier type indication.
  • the second network function entity does not directly send the second type of terminal identification information to the terminal through the first network function entity.
  • the terminal is based on The information shared by the second network function entity generates the second terminal identifier information.
  • the second network function entity sends the identifier information of the terminal to the first network function entity, so that the first network function entity and the second network function entity interact with the terminal.
  • the method may further include: the terminal receiving the calculation parameter sent by the first network function entity; the calculation parameter is sent by the second network function entity; of course, the terminal is shared according to the second network function entity. Information and calculation parameters, generating second terminal identification information.
  • the second network function entity can identify the terminal according to the second terminal identification information, and then the mutual authentication is performed by the second network function entity and the terminal based on the corresponding authentication vector.
  • the embodiment further provides a method for processing a terminal identifier, including the following steps.
  • step A the first network function entity sends a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal.
  • the terminal After receiving the identifier type indication sent by the first network function entity, the terminal carries the corresponding terminal identifier information in the message sent to the first network function entity according to the identifier type indication.
  • the terminal identification information described in the embodiment of the present disclosure may be selected according to requirements, as long as the information of the terminal can be identified, which is not limited by the embodiment of the disclosure.
  • the first network function entity sends a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal; the authentication vector is received from the second network function entity; the terminal receives After the identifier type indication sent by the first network function entity, the message sent to the first network function entity carries the corresponding terminal identifier information according to the identifier type indication, and the terminal may indicate the type according to the indicated type.
  • the message carries the corresponding terminal identifier, so that the authentication operation can be directly performed by the first network function entity and the terminal, so that the signaling efficiency of the authentication operation can be improved.
  • the identifier type indication is sent to the terminal as the first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the corresponding terminal identification information, so as to be used by the first network function.
  • the entity directly performs the authentication operation with the terminal, and does not require the participation of the second network function entity, thereby improving the signaling efficiency of the authentication operation.
  • this embodiment describes in detail the process of terminal identity transformation.
  • the method for transforming the terminal identifier in this embodiment includes the following steps.
  • step 401 the UE sends an attach request to the core network element.
  • the core network element may be an MME or an MMF.
  • the sent attachment request carries the identifier ID1 of the UE.
  • the ID1 may be an IMSI, or an identifier previously received by the UE.
  • step 402 after receiving the attach request, the core network element sends an authentication data request to the network element for sending the authentication data.
  • the authentication data delivery network element may be an HSS, an AUSF, or the like.
  • Sending an authentication data request may be an authentication Data Request message or the like.
  • the sent authentication data request carries ID1.
  • step 403 after the authentication data is sent by the network element, the new identifier ID2 is generated for the UE.
  • step 404 the authentication data sending network element sends an authentication data response to the core network element.
  • the authentication data response is sent, which may be an Authentication Data Response message or the like.
  • the sent authentication data response carries a set of authentication vectors and ID2.
  • step 405 after receiving the response, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the sent user authentication request carries authentication parameters consisting of part of the information of one of the authentication vectors, such as RAND and AUTN, and carries ID2.
  • the AUTN is used for the UE to verify the network
  • the RAND is used by the network to authenticate the UE.
  • step 406 after receiving the request, the UE verifies the network based on the AUTN; calculates the response value RES based on the RAND, and sends a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • the core network element sends an attach accept message to the UE.
  • an attach accept message may be sent, which may be an attach accept message or the like.
  • the attach accept message carries the temporary identifier TID1 allocated by the core network element.
  • the TID1 is not specific identifier information, for example, identifier information that is not all 0s. Therefore, the UE can view the identifier type as the identifier type.
  • the TID1 and the identifier type indication may also be carried in the attach accept message, such as carrying an id-type field to indicate that the UE uses the TID1.
  • the terminal After receiving the attach accept message, the terminal sends a message by using the temporary identifier TID1 in the subsequent process.
  • the UE again sends an attach request to the core network element.
  • the attachment request carries TID1.
  • step 410 after receiving the request, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the user authentication request carries an unused authentication parameter composed of part of the information in the authentication vector of the UE, such as RAND and AUTN.
  • step 411 after receiving the user authentication request, the UE verifies the network based on the AUTN; the UE calculates the response value RES based on the RAND, and sends a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • the core network element sends an attach accept message to the terminal.
  • an attach accept message is sent, which may be an Attach Accept message or the like.
  • the core network element determines whether there is still an available authentication vector for the UE before sending the attach accept message. If yes, the attach accept message carries the temporary identifier TID2 allocated by the core network element. Similar to the TID1, the TID2 is not specific identifier information, for example, the identifier information is not all 0s. Therefore, the UE may refer to the identifier type indication, and may also carry an identifier type indication in the message, such as carrying an id-type field to indicate the terminal usage. TID2.
  • the attach accept message carries the identifier type indication and the temporary identification information TID2 allocated by the core network, or the message carries a specific temporary identifier as the identification information, such as all 0 identification information, to indicate The terminal temporary ID is not available and ID2 is required.
  • the UE may carry the corresponding identifier information in the sent message according to the identifier type indication.
  • the core network element fails to identify the UE, so the core network element forwards the ID2 to the authentication data delivery network element, and the authentication data is sent to the network element to identify the UE, and the new network is sent.
  • the authentication vector group for the UE is given to the core network element, so that the core network element can identify the UE again.
  • the UE may also send a service request, such as a service request (Service Request) message, to the core network element, and the subsequent processing process is completely the same as steps 410-413.
  • a service request such as a service request (Service Request) message
  • this embodiment describes the process of terminal identifier transformation in detail.
  • the method for transforming the terminal identifier in this embodiment includes the following steps.
  • step 501 the UE sends an attach request to the core network element.
  • the core network element may be an MME or an MMF.
  • the sent attachment request carries the identifier ID1 of the UE.
  • the ID1 may be an IMSI, or an identifier previously received by the UE.
  • step 502 after receiving the attach request, the core network element sends an authentication data request to the network element for sending the authentication data.
  • the authentication data delivery network element may be an HSS, an AUSF, or the like.
  • Sending an authentication data request may be an authentication Data Request message or the like.
  • the sent authentication data request carries ID1.
  • the new identifier ID2 is generated according to the key Ki shared with the UE, ID1 or the initial identifier ID0 of the terminal.
  • the new identifier ID2 when generating the new identifier ID2, it may also be based on the key Ki shared with the UE, ID1 or the initial identifier ID0 of the terminal, and calculation parameters (such as random numbers or other values in the authentication parameter group, etc.) ), generate a new ID ID2.
  • step 504 the authentication data sending network element sends an authentication data response to the core network element.
  • the authentication data response is sent, which may be an Authentication Data Response message or the like.
  • the transmitted authentication data response carries a set of authentication vectors.
  • the sent authentication data response may further carry the calculation parameter.
  • step 505 after receiving the response, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the sent user authentication request carries authentication parameters consisting of part of the information of one of the authentication vectors, such as RAND and AUTN.
  • the sent user authentication request may also carry the calculation parameter.
  • step 506 after receiving the request, the UE calculates the new identifier ID2 by using the same information as the authentication data delivery network element.
  • the UE calculates ID2 according to the key Ki, ID1 or the initial identifier ID0 of the terminal; when the request carries the calculation parameter, the UE according to the key Ki, ID1 or the initial identifier ID0 of the terminal, and Calculate the parameter calculation ID2.
  • the information that is the same as the network element that is sent by the authentication data can be regarded as the information that is shared with the authentication data.
  • the UE verifies the network based on the AUTN; the UE calculates a response value RES based on the RAND and transmits a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • step 509 the core network element sends an attach accept message to the UE.
  • an attach accept message may be sent, which may be an attach accept message or the like.
  • the attach accept message carries the temporary identifier TID1 allocated by the core network element.
  • the TID1 is not specific identifier information, for example, identifier information that is not all 0s. Therefore, the UE can view the identifier type as the identifier type.
  • the TID1 and the identifier type indication may be carried in the attach accept message, for example, carrying an id-type field to instruct the terminal to use the TID1.
  • the terminal After receiving the attach accept message, the terminal sends a message by using the temporary identifier TID1 in the subsequent process.
  • the UE again sends an attach request to the core network element.
  • the attachment request carries TID1.
  • step 511 after receiving the request, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the user authentication request carries an unused authentication parameter composed of part of the information in the authentication vector of the UE, such as RAND and AUTN.
  • step 512 after receiving the user authentication request, the UE verifies the network based on the AUTN; the UE calculates the response value RES based on the RAND, and sends a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • the core network element sends an attach accept message to the terminal.
  • an attach accept message is sent, which may be an Attach Accept message or the like.
  • the core network element determines whether there is still an available authentication vector for the UE before sending the attach accept message. If yes, the attach accept message carries the temporary identifier TID2 allocated by the core network element. Similar to the TID1, the TID2 is not specific identifier information, for example, the identifier information is not all 0s. Therefore, the UE may refer to the identifier type indication, and may also carry an identifier type indication in the message, such as carrying an id-type field to indicate the terminal usage. TID2.
  • the attach accept message carries the identifier type indication and the temporary identification information TID2 allocated by the core network, or the message carries a specific temporary identifier as the identification information, such as all 0 identification information, to indicate The terminal temporary ID is not available and ID2 is required.
  • the UE may carry the corresponding identifier information in the sent message according to the identifier type indication.
  • the core network element fails to identify the UE, so the core network element forwards the ID2 to the authentication data delivery network element, and the authentication data is sent to the network element to identify the UE, and the new network is sent.
  • the authentication vector group for the UE is given to the core network element.
  • the UE may also send a service request, such as a Service Request message, to the centroid network element, and the subsequent processing process is completely the same as steps 511-514.
  • a service request such as a Service Request message
  • This embodiment describes in detail the process of terminal identity transformation.
  • the method for transforming the terminal identifier in this embodiment, as shown in FIG. 6, includes the following steps.
  • step 601 the UE sends an attach request to the core network element.
  • the core network element may be an MME or an MMF.
  • the sent attachment request carries the identifier ID1 of the UE.
  • the ID1 may be an IMSI, or an identifier previously received by the UE.
  • step 602 after receiving the attach request, the core network element sends an authentication data request to the network element for sending the authentication data.
  • the authentication data delivery network element may be an HSS, an AUSF, or the like.
  • Sending an authentication data request may be an authentication Data Request message or the like.
  • the sent authentication data request carries ID1.
  • the new identifier ID2 is generated according to the key Ki shared with the UE, ID1 or the initial identifier ID0 of the terminal.
  • the new identifier ID2 when generating the new identifier ID2, it may also be based on the key Ki shared with the UE, ID1 or the initial identifier ID0 of the terminal, and calculation parameters (such as random numbers or other values in the authentication parameter group, etc.) ), generate a new ID ID2.
  • step 604 the authentication data sending network element sends an authentication data response to the core network element.
  • the authentication data response is sent, which may be an Authentication Data Response message or the like.
  • the transmitted authentication data response carries a set of authentication vectors and an anchor identifier AID1.
  • the AID1 is used by the core network element to exchange information about the UE with the authentication data sending network element.
  • the sent authentication data response may further carry the calculation parameter.
  • step 605 after receiving the response, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the sent user authentication request carries authentication parameters consisting of part of the information of one of the authentication vectors, such as RAND and AUTN.
  • the sent user authentication request may also carry the calculation parameter.
  • step 606 after receiving the request, the UE calculates the new identifier ID2 by using the same information as the authentication data delivery network element.
  • the UE calculates ID2 according to the key Ki, ID1 or the initial identifier ID0 of the terminal; when the request carries the calculation parameter, the UE according to the key Ki, ID1 or the initial identifier ID0 of the terminal, and Calculate the parameter calculation ID2.
  • the information that is the same as the network element that is sent by the authentication data can be regarded as the information that is shared with the authentication data.
  • step 607 the UE verifies the network based on the AUTN; the UE calculates the response value RES based on the RAND and transmits a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • the core network element sends an attach accept message to the UE.
  • an attach accept message may be sent, which may be an attach accept message or the like.
  • the attach accept message carries the temporary identifier TID1 allocated by the core network element.
  • the TID1 is not specific identifier information, for example, identifier information that is not all 0s. Therefore, the UE can view the identifier type as the identifier type.
  • the TID1 and the identifier type indication may be carried in the attach accept message, for example, carrying an id-type field to instruct the terminal to use the TID1.
  • the terminal After receiving the attach accept message, the terminal sends a message by using the temporary identifier TID1 in the subsequent process.
  • the UE again sends an attach request to the core network element.
  • the attachment request carries TID1.
  • step 611 after receiving the request, the core network element sends a user authentication request to the UE.
  • a user authentication request is sent, and a User Authentication Request message or the like may be sent.
  • the user authentication request carries an unused authentication parameter composed of part of the information in the authentication vector of the UE, such as RAND and AUTN.
  • step 612 after receiving the user authentication request, the UE verifies the network based on the AUTN; the UE calculates the response value RES based on the RAND, and sends a user authentication response to the core network element.
  • a user authentication response is sent, and a User Authentication Response message or the like may be sent.
  • the user response carries the authentication information, ie RES.
  • the core network element sends an attach accept message to the terminal.
  • an attach accept message is sent, which may be an Attach Accept message or the like.
  • the core network element determines whether there is still an available authentication vector for the UE before sending the attach accept message. If yes, the attach accept message carries the temporary identifier TID2 allocated by the core network element. Similar to the TID1, the TID2 is not specific identifier information, for example, the identifier information is not all 0s. Therefore, the UE may refer to the identifier type indication, and may also carry an identifier type indication in the message, such as carrying an id-type field to indicate the terminal usage. TID2.
  • the attach accept message carries the identifier type indication and the temporary identification information TID2 allocated by the core network, or the message carries a specific temporary identifier as the identification information, such as all 0 identification information, to indicate The terminal temporary ID is not available and ID2 is required.
  • the UE may carry the corresponding identifier information in the sent message according to the identifier type indication.
  • the core network element fails to identify the UE, so the core network element forwards the ID2 to the authentication data delivery network element, and the authentication data is sent to the network element to identify the UE, and the new network is sent.
  • the authentication vector group for the UE is given to the core network element.
  • the UE may also send a service request, such as a Service Request message, to the centroid network element, and the subsequent processing process is completely the same as steps 611-614.
  • a service request such as a Service Request message
  • the solution provided by the embodiment of the present disclosure uses two kinds of terminal identification information: one is allocated by the core network element, and the other is distributed by the authentication data, and is configured by the core network.
  • the network element notifies the terminal of the terminal identification information, and the authentication data sending network element can send multiple authentication vectors at a time, so that the authentication operation can be performed on the core network element of the visited place, thereby improving the signaling efficiency of the authentication operation.
  • the embodiment provides a processing device for the terminal identifier, which is disposed in the first network function entity. As shown in FIG. 7, the device includes: a determining unit 71 and a sending unit 72.
  • the sending unit 72 is configured to send a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal determined by the determining unit 71.
  • the identifier type indication is used to indicate the terminal identifier information carried by the terminal when sending the subsequent message.
  • the determining unit 71 determines the identifier type indication corresponding to the identifier type of the terminal according to the validity of the authentication vector for the terminal (which can also be understood as the usage case); accordingly, the sending unit 72 indicates according to the determined identifier type, The terminal sends a corresponding identifier type indication.
  • the determining unit 71 determines that the identification type of the terminal corresponds to the identification type indication as the first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the corresponding terminal identification information.
  • the first determining unit 71 determines that the identification type of the terminal corresponds to the identification type indication as the second type indication; and the second type indicates that the second network function entity can identify the terminal according to the corresponding terminal identification information.
  • the identifier type sent to the terminal indicates the first type indication; when there is an authentication vector that can be used for the terminal, the identifier sent to the terminal
  • the type is a second type indication; the second type indicates that the second network function entity is capable of identifying the terminal according to the corresponding terminal identification information.
  • the authentication vector is an authentication vector delivered by the second network function entity, that is, the authentication vector is received from the second network function entity.
  • the use of the authentication vector may be an authentication vector that can be used for the terminal, or may be an authentication vector that is not available for the terminal.
  • the use of authentication vectors can be divided into two types: an authentication vector that can be used and an authentication vector that cannot be used.
  • the authentication vector is used for the terminal to perform mutual authentication with the corresponding network.
  • the second network function entity may deliver at least one authentication vector as needed.
  • Each authentication vector contains a plurality of authentication parameters, which form a vector, ie an authentication vector.
  • the first network function entity may be a key control node of the access network, such as a core network element, which may be an MME or an MMF.
  • the second network function entity may be an authentication data sending network element, that is, a node that controls user data, such as an HSS or an AUSF.
  • the representation of the identifier type indication may be specific identification information or non-specific identification information.
  • the first network function entity determines that the identifier type indication is notified in an implicit manner.
  • the specific terminal identification information such as the identifier information that is not all zeros, indicates the terminal identification information corresponding to the terminal, and indicates whether the identifier type is the first type or the second type, which can save signaling. Resources.
  • the first network function entity determines that the identification type indication is notified in an explicit manner. For example, the terminal identifier information corresponding to the terminal may be indicated, and at the same time, a field is used to indicate that the identifier type is the first type or the second type.
  • the apparatus may further include: a first receiving unit, configured to receive identification information of the terminal sent by the second network function entity; and the identifier information of the received terminal is used by the first network function entity and the second network function Information about the entity interaction terminal.
  • the second network function entity does not directly send the second type of terminal identification information to the terminal through the first network function entity, and the terminal is based on sharing with the second network function entity.
  • the information generated by the second network function entity sends the identification information of the terminal to the first network function entity, so that the first network function entity and the second network function entity interact with the terminal.
  • the terminal When generating the identification information of the terminal, when the second network function entity sends the calculation parameter to the terminal by using the first network function entity, the terminal generates the second type based on the information shared with the second network function entity and the calculation parameter. Terminal identification information.
  • the first receiving unit is configured to receive a message sent by the terminal.
  • the sending unit 72 is further configured to: when the terminal identifier information carried in the received message cannot identify the terminal, forward the terminal identifier information carried in the received message to the second network function entity, to identify the terminal, so as to be The network function entity and the terminal perform mutual authentication based on the corresponding authentication vector.
  • the first network function entity and the terminal perform mutual authentication based on the corresponding authentication vector when the terminal can be identified according to the terminal identification information carried in the received message.
  • the determining unit 71 can be implemented by a processor in the processing device identified by the terminal; the transmitting unit 72 and the first receiving unit can be implemented by a communication interface in the processing device identified by the terminal.
  • an embodiment of the present disclosure further provides a network function entity, which is a first network function entity, where the first network function entity includes: a first processor and a first communication interface.
  • the first communication interface is configured to send a corresponding identifier type indication to the terminal according to the validity of the authentication vector determined by the first processor, and the identifier type indication is used to indicate the terminal identifier information that is carried by the terminal when sending the subsequent message;
  • the authentication vector is received from a second network functional entity.
  • the identifier type sent by the first communication interface to the terminal is indicated as a first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the corresponding terminal identification information.
  • the identifier type sent by the first communication interface to the terminal is a second type indication; and the second type indication indicates that the second network function entity can identify the terminal according to the corresponding terminal identification information.
  • the implementation functions of the first processor and the first communication interface can be understood by referring to the related descriptions of the foregoing methods and devices, and are not described herein again.
  • the embodiment of the present disclosure further provides a processing device for the terminal identifier.
  • the device includes: a second receiving unit 81 and processing. Unit 82.
  • the second receiving unit 81 is configured to receive an identifier type indication sent by the first network function entity.
  • the processing unit 82 is configured to carry the corresponding terminal identification information in the message sent to the first network function entity according to the identifier type indication.
  • the identifier type indicates terminal identification information that is used when the terminal sends a message.
  • the representation of the identifier type indication may be specific identification information or non-specific identification information.
  • the first network function entity determines that the identifier type indication is notified in an implicit manner.
  • the specific terminal identification information such as the identifier information that is not all zeros, indicates the terminal identification information corresponding to the terminal, and indicates whether the identifier type is the first type or the second type, which can save signaling. Resources.
  • the first network function entity determines that the identification type indication is notified in an explicit manner. For example, the terminal identifier information corresponding to the terminal may be indicated, and at the same time, a field is used to indicate that the identifier type is the first type or the second type.
  • the processing unit 82 when the received identifier type indicates the first type indication, the first terminal identifier information is carried in the sent message; the first type indication indicates that the first network function entity can be according to the first The terminal identification information identifies the terminal, and then performs mutual authentication with the terminal based on the corresponding authentication vector; or, when the received identification type indicates the second type indication, the second terminal identification information is carried in the sent message; The second network function entity is capable of identifying the terminal according to the second terminal identification information, and then the mutual authentication is performed by the second network function entity and the terminal based on the corresponding authentication vector.
  • the first terminal identifier information is received by the first network function entity, for example, the terminal may obtain the first terminal identifier information from the message indicating the identifier type indication.
  • the second network function entity does not directly send the second type of terminal identification information to the terminal through the first network function entity, and the processing unit 82 is based on the second network function.
  • the information shared by the entity generates the second terminal identifier information.
  • the second network function entity sends the identifier information of the terminal to the first network function entity, so that the first network function entity and the second network function entity interact with the terminal.
  • the second receiving unit 81 is further configured to receive a calculation parameter sent by the first network function entity, where the calculation parameter is sent by the second network function entity, and the processing unit 82 is configured to:
  • the second terminal identification information is generated by the information shared by the network function entity and the calculation parameter.
  • the second network function entity can identify the terminal according to the second terminal identification information, and then the mutual authentication is performed by the second network function entity and the terminal based on the corresponding authentication vector.
  • the second receiving unit 81 can be implemented by a communication interface in the processing device identified by the terminal; the processing unit 82 can be implemented by a processor in the processing device identified by the terminal.
  • an embodiment of the present disclosure further provides a terminal, including: a second communication interface and a second processor.
  • the second communication interface is configured to receive the identifier type indication sent by the first network function entity, and the second processor is configured to carry the corresponding terminal identifier in the message sent by the second network interface to the first network function entity according to the identifier type indication information.
  • the second processor carries the first terminal identification information in the sent message when the identifier type indicates the first type indication; the first type indication indicates that the first network function entity can identify the terminal according to the first terminal identification information; A terminal identification information is received from the first network function entity.
  • the second processor When the identifier type indicates the second type indication, the second processor carries the second terminal identification information in the sent message; the second type indication indicates that the second network function entity can identify the terminal according to the second terminal identification information.
  • the embodiment of the present disclosure further provides a processing system for a terminal identifier, where the system includes: a first network function entity and a terminal.
  • the first network function entity is configured to send a corresponding identifier type indication to the terminal according to the validity of the authentication vector for the terminal; the terminal is configured to receive the identifier type indication sent by the first network function entity, according to the identifier type indication, The message sent to the first network function entity carries the corresponding terminal identifier information.
  • the terminal identification information described in the embodiment of the present disclosure may be selected according to requirements, as long as the information of the terminal can be identified, which is not limited by the embodiment of the disclosure.
  • embodiments of the present disclosure can be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明涉及一种终端标识的处理方法，包括：第一网络功能实体依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。本发明同时还公开了一种终端标识的处理装置、网络功能实体及终端。

Description

一种终端标识的处理方法、装置及相关设备 技术领域
本公开涉及通信领域，尤其涉及一种终端标识的处理方法、装置及相关设备。
背景技术
在通信领域，终端标识用于识别对应的终端，即用于对终端进行认证。
为了保证终端的安全性，避免使用一个终端标识标识对应终端，第三代合作伙伴计划(3GPP，3rd Generation Partnership Project)提出了一种移动终端标识的变换方案。
在这种方案中，终端标识的认证操作流程比较麻烦，这影响了认证操作的信令效率。
发明内容
为解决相关技术中存在的技术问题，本公开实施例提供一种终端标识的处理方法、装置及相关设备。
本公开实施例提供了一种终端标识的处理方法，应用于第一网络功能实体，所述方法包括：依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。
上述方案中，所述依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示时，所述方法包括：当没有针对所述终端的能够使用的认证向量时，向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述第一网络功能实体能够根据对应的终端标识信息识别所述终端。
上述方案中，所述依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示时，所述方法包括：当有针对所述终端的能够使用的认证向量时，向所述终端发送的标识类型指示为第二类型指示；所述第二类型指示表征所述第二网络功能实体能够根据对应的终端标识信息识别所述终端。
上述方案中，所述标识类型指示的表现形式为特定标识信息、或为非特定标识信息。
上述方案中，所述方法还包括：接收第二网络功能实体发送的所述终端的标识信息；接收的所述终端的标识信息用于所述第一网络功能实体与所述第二网络功能实体交互所述终端的相关信息。
本公开实施例还提供了一种终端标识的处理方法，应用于终端，所述方法包括：接收第一网络功能实体发送的标识类型指示；依据所述标识类型指示，在向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
上述方案中，所述方法还包括：当所述标识类型指示为第一类型指示时，在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
上述方案中，所述方法还包括：当所述标识类型指示为第二类型指示时，在所述发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
上述方案中，所述方法还包括：依据与第二网络功能实体共享的信息，生成第二终端标识信息；所述第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
上述方案中，所述方法还包括：接收所述第一网络功能实体发送的计算参数；所述计算参数是第二网络功能实体下发的；依据与所述第二网络功能实体共享的信息及计算参数，生成第二终端标识信息；所述第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
上述方案中，所述标识类型指示的表现形式为特定标识信息、或为非特定标识信息。
本公开实施例又提供了一种终端标识的处理装置，包括：确定单元；发送单元，设置为依据所述确定单元确定的针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。
上述方案中，当没有针对所述终端的能够使用的认证向量时，所述发送单元向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述第一网络功能实体能够根据对应的终端标识信息识别所述终端。
上述方案中，当有针对所述终端的能够使用的认证向量时，所述发送单元向所述终端发送的标识类型为第二类型指示；所述第二类型指示表征所述第二网络功能实体能够根据对应的终端标识信息识别所述终端。
本公开实施例还提供了一种终端标识的处理装置，包括：第二接收单元，设置为接收第一网络功能实体发送的标识类型指示；处理单元，设置为依据所述标识类型指示，在向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
上述方案中，当所述标识类型指示为第一类型指示时，所述处理单元在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
上述方案中，当所述标识类型指示为第二类型指示时，所述处理单元在发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
本公开实施例又提供了一种网络功能实体，为第一网络功能实体，所述第一网络功能实体包括：第一处理器；第一通信接口，设置为依据所述第一处理器确定的针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。
上述方案中，当没有针对所述终端的能够使用的认证向量时，所述第一通信接口向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述第一网络功能实体能够根据对应的终端标识信息识别所述终端。
上述方案中，当有针对所述终端的能够使用的认证向量时，所述第一通信接口向所述终端发送的标识类型为第二类型指示；所述第二类型指示表征所述第二网络功能实体能够根据对应的终端标识信息识别所述终端。
本公开实施例还提供了一种终端，包括：第二通信接口，设置为接收第一网络功能实体发送的标识类型指示；第二处理器，设置为依据所述标识类型指示，在通过所述第二通信接口向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
上述方案中，当所述标识类型指示为第一类型指示时，所述第二处理器在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
上述方案中，当所述标识类型指示为第二类型指示时，所述第二处理器在发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
本公开实施例提供的终端标识的处理方法、装置及相关设备，第一网络功能实体依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述认证向量接收自第二网络功能实体；所述终端收到第一网络功能实体发送的标识类型指示后，依据所述标识类型指示，在向所述第一网络功能实体发送的消息中携带对应的终端标识信息，由于向终端指示了标识类型，所以终端可以根据指示的类型在消息中携带对应的终端标识，以便后续可以由第一网络功能实体与所述终端直接进行认证操作，从而能够提高认证操作的信令效率。
附图说明
附图不一定是按比例绘制的，在附图中，相似的附图标记可在不同的视图中描述相似的部件。具有不同字母后缀的相似附图标记可表示相似部件的不同示例。附图以示例而非限制的方式大体示出了本文中所讨论的各个实施例。
图1为相关技术中一种移动终端标识的变换流程示意图；
图2为本公开实施例一一种终端标识的处理的方法流程示意图；
图3为本公开实施例一另一种终端标识的处理的方法流程示意图；
图4为本公开实施例二终端标识变换的方法流程示意图；
图5为本公开实施例三终端标识变换的方法流程示意图；
图6为本公开实施例四终端标识变换的方法流程示意图；
图7为本公开实施例五一种终端标识的处理装置结构示意图；
图8为本公开实施例五另一种终端标识的处理装置结构示意图。
具体实施方式
下面结合附图及实施例对本公开再作进一步详细的描述。
如前所述，3GPP里提出了一种移动终端标识的变换方案，如图1所示，该方法的流程 包括如下步骤。
在步骤101，终端(UE，User Equipment)向核心网网元发送附着请求，比如发送附着请求(Attach Request)消息，消息携带UE的标识ID1。
这里，核心网网元可以是移动网络功能实体(MME，Mobility Management Entity)或移动管理功能(MMF，Mobility Management Function)等。
ID1可以是国际移动台标识(IMSI，International Mobile Subscriber Identification Number)，或之前收到的标识等。
在步骤102，核心网网元向认证数据下发网元发送认证数据请求，携带收到的ID1。
这里，认证数据下发网元可以是归属签约用户服务器(HSS，Home Subscriber Server)或认证服务功能(AUSF，Authentication Server Function)等。
发送认证数据请求，可以是发送认证数据请求(Authentication Data Request)消息等。
在步骤103，认证数据下发网元为该UE生成新的标识ID2。
在步骤104，认证数据下发网元向核心网网元发送认证数据响应，携带一个认证向量，还携带加密的ID2和计算参数。
这里，发送认证数据响应，可以是发送认证数据响应(Authentication Data Response)消息等。
其中，计算参数用于UE验证ID2。
在步骤105，核心网网元向UE发送用户认证请求，携带收到的认证向量中的部分信息组成的认证参数，并携带加密的ID2和计算参数。
这里，发送用户认证请求，可以是发送User Authentication Request消息等。
认证参数可以包含随机数(RAND)和网络认证令牌(AUTN)等。
其中，AUTN用于UE验证网络，RAND用于网络验证UE的用户。
在步骤106，UE基于AUTN验证网络；并基于RAND计算出响应值RES，并向核心网网元发送用户认证响应，消息携带认证信息，即RES；核心网网元比对RES和该认证向量中的XRES；如果RES＝XRES则网络验证用户通过，执行步骤107。
这里，核心网网元可以是MME等。
发送用户认证响应，可以是发送User Authentication Response消息。
步骤107：核心网网元向认证数据下发网元发送标识确认消息，比如发送SYNC消息，携带验证码。
这里，验证码用于验证标识确认消息。
至此，UE解密ID2后，和认证数据下发网元可以使用ID2相互通讯，从而防止其他人通过跟踪ID1而导致UE位置信息的泄漏。
从上面的描述中可以看出，相关技术中，认证数据下发网元一次只能下发一个认证向量，后续认证操作必须通过归属网的认证数据下发网元执行，这影响了认证操作的信令效率。
基于此，在本公开的各种实施例中：第一网络功能实体依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；标识类型指示用于指示终端在发送后续消息时携 带的终端标识信息；认证向量接收自第二网络功能实体；终端收到第一网络功能实体发送的标识类型指示后，依据标识类型指示，在向第一网络功能实体发送的消息中携带对应的终端标识信息。
实施例一
本公开实施例提供了一种终端标识的处理方法，应用于第一网络功能实体，如图2所示，该方法包括如下所述的步骤。
在步骤201，第一网络功能实体依据针对终端的认证向量的有效性，确定终端的标识类型对应的标识类型指示。
换句话说，第一网络功能实体依据针对终端的认证向量的使用情况(可用性)，确定终端的标识类型对应的标识类型指示。
这里，标识类型指示用于指示终端在发送后续消息时携带的终端标识信息。
当没有针对终端的能够使用的认证向量时，确定终端的标识类型对应标识类型指示为第一类型指示；第一类型指示表征第一网络功能实体能够根据对应的终端标识信息识别终端。
当有针对终端的能够使用的认证向量时，确定终端的标识类型对应标识类型指示为第二类型指示；第二类型指示表征第二网络功能实体能够根据对应终端标识信息识别终端。
其中，认证向量为第二网络功能实体下发的认证向量，即认证向量接收自第二网络功能实体。
从上面的描述中可以看出，认证向量的使用情况可以是有针对终端的能够使用的认证向量，或者可以是没有针对终端的能够使用的认证向量。简单地说，认证向量的使用情况可以分为有能使用的认证向量和没有能够使用的认证向量两种情况。
这里，认证向量用于终端与对应的网络进行相互认证。
实际应用时，第二网络功能实体可以根据需要下发至少一个认证向量。每个认证向量包含多个认证参数，这多个认证参数形成一个向量，即认证向量。
实际应用时，第一网络功能实体可以是接入网络的关键控制节点，比如核心网网元，可以是MME或MMF等。
实际应用时，第二网络功能实体可以是认证数据下发网元，即控制用户数据的节点，比如HSS或AUSF等。
在一实施例中，标识类型指示的表现形式可以为特定标识信息，也可以为非特定标识信息。
其中，当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过隐式的方式通知标识类型指示。比如，可以通过一种特定的终端标识信息，比如不是全零的标识信息，即指示了终端对应的终端标识信息，同时也指示了标识类型为第一类型还是第二类型，这样可以节约信令资源。
当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过显式的方式通知标识类型指示。比如，可以指示终端对应的终端标识信息，同时，再利用一个字段 来指示标识类型为第一类型或是第二类型。
在一实施例中，该方法还可以包括：接收第二网络功能实体发送的终端的标识信息；接收的终端的标识信息用于第一网络功能实体与第二网络功能实体交互终端的相关信息。
这里，实际应用时，有一种情况是，第二网络功能实体并不会通过第一网络功能实体直接向终端下发第二类型的终端标识信息，此时终端会基于与第二网络功能实体共享的信息生成第二类型的终端标识信息，此时，第二网络功能实体会向第一网络功能实体发送终端的标识信息，以便第一网络功能实体与第二网络功能实体交互终端的相关信息。
其中，在生成终端的标识信息时，当第二网络功能实体通过第一网络功能实体向终端发送了计算参数时，终端会基于与第二网络功能实体共享的信息以及计算参数生成第二类型的终端标识信息。
在步骤202：第一网络功能实体依据确定的标识类型，向终端发送对应的标识类型指示。
当没有针对终端的能够使用的认证向量时，向终端发送的标识类型指示为第一类型指示。
当有针对终端的能够使用的认证向量时，向终端发送的标识类型指示为第二类型指示。
在一实施例中，向终端发送标识类型指示后，该方法还可以包括：第一网络功能实体接收终端发送的消息；当根据接收的消息中携带的终端标识信息不能识别终端时，第一网络功能实体向第二网络功能实体转发接收的消息中携带的终端标识信息，以对终端进行识别，以便由第二网络功能实体与终端基于对应的认证向量进行相互认证。
其中，当根据接收的消息中携带的终端标识信息能识别终端时，第一网络功能实体与终端基于对应的认证向量进行相互认证。
从上面的描述可以看出，本公开实施例中，第一网络功能实体依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；标识类型指示用于指示终端在发送后续消息时携带的终端标识信息；认证向量接收自第二网络功能实体。
另外，依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示时，当没有针对终端的能够使用的认证向量时，当没有针对终端的能够使用的认证向量时，向终端发送的标识类型指示为第一类型指示；第一类型指示表征第一网络功能实体能够根据对应的终端标识信息识别终端。当有针对终端的能够使用的认证向量时，向终端发送的标识类型指示为第二类型指示；第二类型指示表征第二网络功能实体能够根据对应终端标识信息识别终端。
对应地，本公开实施例还提供了一种终端标识的处理方法，应用于终端，如图3所示，该方法包括如下所述的步骤。
在步骤301，终端接收第一网络功能实体发送的标识类型指示。
这里，标识类型指示用于指示终端发送消息时携带的终端标识信息。
在一实施例中，标识类型指示的表现形式可以为特定标识信息，也可以为非特定标识信息。
其中，当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过 隐式的方式通知标识类型指示。比如，可以通过一种特定的终端标识信息，比如不是全零的标识信息，即指示了终端对应的终端标识信息，同时也指示了标识类型为第一类型还是第二类型，这样可以节约信令资源。
当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过显式的方式通知标识类型指示。比如，可以指示终端对应的终端标识信息，同时，再利用一个字段来指示标识类型为第一类型或是第二类型。
在步骤302，依据标识类型指示，终端在向第一网络功能实体发送的消息中携带对应的终端标识信息。
其中，当接收的标识类型指示为第一类型指示时，在发送的消息中携带第一终端标识信息；第一类型指示表征第一网络功能实体能够根据第一终端标识信息识别终端，进而与终端基于对应的认证向量进行相互认证。
当接收的标识类型指示为第二类型指示时，在发送的消息中携带第二终端标识信息；第二类型指示表征第二网络功能实体能够根据第二终端标识信息识别终端，进而由第二网络功能实体与终端基于对应的认证向量进行相互认证。
其中，第一终端标识信息从第一网络功能实体接收，比如可以是终端从接收标识类型指示的消息中获取第一终端标识信息。
这里，实际应用时，有一种情况是，第二网络功能实体并不会通过第一网络功能实体直接向终端下发第二类型的终端标识信息，此时在执行步骤302之前，终端会基于与第二网络功能实体共享的信息生成第二终端标识信息，此时，第二网络功能实体会向第一网络功能实体发送终端的标识信息，以便第一网络功能实体与第二网络功能实体交互终端的相关信息。
另外，在一实施例中，该方法还可以包括：终端接收第一网络功能实体发送的计算参数；计算参数是第二网络功能实体下发的；当然，终端依据与第二网络功能实体共享的信息及计算参数，生成第二终端标识信息。
其中，从上面的描述可以看出，第二网络功能实体能够根据第二终端标识信息识别终端，进而由第二网络功能实体与终端基于对应的认证向量进行相互认证。
基于上述方法，本实施例还提供了一种终端标识的处理方法，包括以下步骤。
在步骤A，第一网络功能实体依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示。
在步骤B，终端接收到第一网络功能实体发送的标识类型指示后，依据标识类型指示，在向第一网络功能实体发发送的消息中携带对应的终端标识信息。
需要说明的是，实际应用时，本公开实施例所描述的终端标识信息可以根据需要来选择，只要可以标识终端的信息即可，本公开实施例对此不做限定。
另外，第一网络功能实体和终端的处理过程已在上文详述，这里不再赘述。
本公开实施例提供的终端标识的处理方法，第一网络功能实体依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；认证向量接收自第二网络功能实体；终端收到第一网络功能实体发送的标识类型指示后，依据标识类型指示，在向第一网络功能实体 发送的消息中携带对应的终端标识信息，由于向终端指示了标识类型，所以终端可以根据指示的类型在消息中携带对应的终端标识，以便后续可以由第一网络功能实体与终端直接进行认证操作，从而能够提高认证操作的信令效率。
当没有针对终端的能够使用的认证向量时，向终端发送标识类型指示为第一类型指示；第一类型指示表征第一网络功能实体能够根据对应的终端标识信息识别终端，以便由第一网络功能实体与终端直接进行认证操作，不需要第二网络功能实体的参与，从而提高了认证操作的信令效率。
实施例二
在实施例一的基础上，本实施例详细描述终端标识变换的过程。
本实施例终端标识变换的方法，如图4所示，包括以下步骤。
在步骤401，UE向核心网网元发送附着请求。
这里，实际应用时，核心网网元可以是MME或MMF等。
发送附着请求，可以是发送Attach Request消息。
发送的附着请求中携带UE的标识ID1。
其中，ID1可以是IMSI，或UE之前收到的标识等。
在步骤402，核心网网元收到附着请求后，向认证数据下发网元发送认证数据请求。
这里，实际应用时，认证数据下发网元可以是HSS或AUSF等。
发送认证数据请求，可以是发Authentication Data Request消息等。
发送的认证数据请求中携带ID1。
在步骤403，认证数据下发网元收到请求后，为UE生成新的标识ID2。
在步骤404，认证数据下发网元向核心网网元发送认证数据响应。
这里，实际应用时，发送认证数据响应，可以是发送Authentication Data Response消息等。
发送的认证数据响应中携带一组认证向量以及ID2。
在步骤405，核心网网元收到响应后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
发送的用户认证请求中携带一组认证向量中的一个认证向量的部分信息组成的认证参数，比如RAND和AUTN，并携带ID2。
其中，AUTN用于UE验证网络，RAND用于网络验证UE的用户。
在步骤406，UE收到请求后，基于AUTN验证网络；基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤407，核心网网元收到响应后，将RES和对应认证向量中的XRES进行比对，如 果RES＝XRES则网络验证用户通过，执行步骤408。
在步骤408：核心网网元向UE发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送附着接受(Attach Accept)消息等。
附着接受消息中携带核心网网元分配的临时标识TID1。
其中，TID1不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示。
或者，也可以在附着接受消息中携带TID1及标识类型指示，比如携带id-type字段以指示UE使用TID1。
终端接收到附着接受消息后，后续过程中，终端使用临时标识TID1发送消息。
在步骤409，UE再次向核心网网元发送附着请求。
这里，附着请求中携带TID1。
在步骤410，核心网网元收到请求后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
用户认证请求中携带一个未被使用的针对该UE的认证向量中的部分信息组成的认证参数，比如RAND和AUTN。
在步骤411，UE收到用户认证请求后，基于AUTN验证网络；UE基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤412，核心网网元收到响应后，将RES和对应认证向量中的XRES进行比对，如果RES＝XRES则网络验证用户通过，则执行步骤413。
在步骤413：核心网网元向终端发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送Attach Accept消息等。
其中，在发送附着接受消息之前，核心网网元会判断是否还有可以使用的针对该UE的认证向量，如果还有，则附着接受消息携带核心网网元分配的临时标识TID2。与TID1类似的，TID2不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示，也可以在该消息中携带标识类型指示，比如携带id-type字段以指示终端使用TID2。如果没有可以使用的针对该UE的认证向量，则附着接受消息携带标识类型指示以及核心网分配的临时标识信息TID2，或消息要携带特定的临时标识作为标识信息，比如全0标识信息，以指示终端临时标识不可用，需使用ID2。
收到附着接受消息后，UE可以依据标识类型指示在发送的消息中携带相应的标识信息。当UE发送的消息中携带ID2时，由于核心网网元无法识别UE，所以核心网网元会将ID2转发给认证数据下发网元，由认证数据下发网元识别UE，并下发新的针对UE的认证向量组给核心网网元，以便核心网网元能够再次对UE进行识别。
需要说明的是：实际应用时，在步骤409中，UE还可以是向核心网网元发送业务请求， 比如业务请求(Service Request)消息，后续处理过程与步骤410～413完全相同。
实施例三
在实施例一、二的基础上，本实施例详细描述终端标识变换的过程。
本实施例终端标识变换的方法，如图5所示，包括以下步骤。
在步骤501，UE向核心网网元发送附着请求。
这里，实际应用时，核心网网元可以是MME或MMF等。
发送附着请求，可以是发送Attach Request消息。
发送的附着请求中携带UE的标识ID1。
其中，ID1可以是IMSI，或UE之前收到的标识等。
在步骤502，核心网网元收到附着请求后，向认证数据下发网元发送认证数据请求。
这里，实际应用时，认证数据下发网元可以是HSS或AUSF等。
发送认证数据请求，可以是发Authentication Data Request消息等。
发送的认证数据请求中携带ID1。
在步骤503，认证数据下发网元收到请求后，根据与该UE共享的密钥Ki，ID1或该终端的初始标识ID0，生成新的标识ID2。
这里，实际应用时，生成新的标识ID2时，还可以根据与该UE共享的密钥Ki，ID1或该终端的初始标识ID0，以及计算参数(比如随机数或认证参数组中的其它数值等)，生成新的标识ID2。
其中，实际应用时，其它数值可以是认证参数组中变化的其它数值。
在步骤504，认证数据下发网元向核心网网元发送认证数据响应。
这里，实际应用时，发送认证数据响应，可以是发送Authentication Data Response消息等。
发送的认证数据响应中携带一组认证向量。当认证数据下发网元生成ID2时使用了计算参数时，发送的认证数据响应还可以进一步携带计算参数。
在步骤505，核心网网元收到响应后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
发送的用户认证请求中携带一组认证向量中的一个认证向量的部分信息组成的认证参数，比如RAND和AUTN。
相应地，当核心网网元收到的响应中携带了计算参数时，发送的用户认证请求还可以携带计算参数。
在步骤506，UE收到请求后，利用与认证数据下发网元相同的信息计算新的标识ID2。
当请求中未携带计算参数时，UE根据密钥Ki，ID1或该终端的初始标识ID0计算ID2；当请求中携带计算参数时，UE根据密钥Ki，ID1或该终端的初始标识ID0，以及计算参数计算ID2。
与认证数据下发网元相同的信息，可以认为是与认证数据下发网元共享的信息。
在步骤507，UE基于AUTN验证网络；UE基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤508，核心网网元收到响应后，将RES和该认证向量中的XRES进行比对，如果RES＝XRES则网络验证用户通过，执行步骤509。
在步骤509，核心网网元向UE发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送附着接受(Attach Accept)消息等。
附着接受消息中携带核心网网元分配的临时标识TID1。
其中，TID1不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示。
或者，也可以在附着接受消息中携带TID1及标识类型指示，比如携带id-type字段以指示终端使用TID1。
终端接收到附着接受消息后，后续过程中，终端使用临时标识TID1发送消息。
在步骤510，UE再次向核心网网元发送附着请求。
这里，附着请求中携带TID1。
在步骤511：核心网网元收到请求后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
用户认证请求中携带一个未被使用的针对该UE的认证向量中的部分信息组成的认证参数，比如RAND和AUTN。
在步骤512，UE收到用户认证请求后，基于AUTN验证网络；UE基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤513，核心网网元收到响应后，将RES和对应认证向量中的XRES进行比对，如果RES＝XRES则网络验证用户通过，则执行步骤514；
在步骤514，核心网网元向终端发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送Attach Accept消息等。
其中，在发送附着接受消息之前，核心网网元会判断是否还有可以使用的针对该UE的认证向量，如果还有，则附着接受消息携带核心网网元分配的临时标识TID2。与TID1类似的，TID2不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示，也可以在该消息中携带标识类型指示，比如携带id-type字段以指示终端使用TID2。如果没有可以使用的针对该UE的认证向量，则附着接受消息携带标识类型指示以及核心网分配的临时标识信息TID2，或消息要携带特定的临时标识作为标识信息，比如全0标识信息，以 指示终端临时标识不可用，需使用ID2。
收到附着接受消息后，UE可以依据标识类型指示在发送的消息中携带相应的标识信息。当UE发送的消息中携带ID2时，由于核心网网元无法识别UE，所以核心网网元会将ID2转发给认证数据下发网元，由认证数据下发网元识别UE，并下发新的针对UE的认证向量组给核心网网元。
需要说明的是：实际应用时，在步骤510中，UE还可以是向心网网元发送业务请求，比如Service Request消息，后续处理过程与步骤511～514完全相同。
实施例四
本实施例详细描述终端标识变换的过程。
本实施例终端标识变换的方法，如图6所示，包括以下步骤。
在步骤601，UE向核心网网元发送附着请求。
这里，实际应用时，核心网网元可以是MME或MMF等。
发送附着请求，可以是发送Attach Request消息。
发送的附着请求中携带UE的标识ID1。
其中，ID1可以是IMSI，或UE之前收到的标识等。
在步骤602，核心网网元收到附着请求后，向认证数据下发网元发送认证数据请求。
这里，实际应用时，认证数据下发网元可以是HSS或AUSF等。
发送认证数据请求，可以是发Authentication Data Request消息等。
发送的认证数据请求中携带ID1。
在步骤603，认证数据下发网元收到请求后，根据与该UE共享的密钥Ki，ID1或该终端的初始标识ID0，生成新的标识ID2。
这里，实际应用时，生成新的标识ID2时，还可以根据与该UE共享的密钥Ki，ID1或该终端的初始标识ID0，以及计算参数(比如随机数或认证参数组中的其它数值等)，生成新的标识ID2。
其中，实际应用时，其它数值可以是认证参数组中变化的其它数值。
在步骤604，认证数据下发网元向核心网网元发送认证数据响应。
这里，实际应用时，发送认证数据响应，可以是发送Authentication Data Response消息等。
发送的认证数据响应中携带一组认证向量和锚定标识AID1。
其中，AID1用于核心网网元与认证数据下发网元交互该UE的相关信息。
当认证数据下发网元生成ID2时使用了计算参数时，发送的认证数据响应还可以进一步携带计算参数。
在步骤605，核心网网元收到响应后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
发送的用户认证请求中携带一组认证向量中的一个认证向量的部分信息组成的认证参 数，比如RAND和AUTN。
相应地，当核心网网元收到的响应中携带了计算参数时，发送的用户认证请求还可以携带计算参数。
在步骤606，UE收到请求后，利用与认证数据下发网元相同的信息计算新的标识ID2。
当请求中未携带计算参数时，UE根据密钥Ki，ID1或该终端的初始标识ID0计算ID2；当请求中携带计算参数时，UE根据密钥Ki，ID1或该终端的初始标识ID0，以及计算参数计算ID2。
与认证数据下发网元相同的信息，可以认为是与认证数据下发网元共享的信息。
在步骤607，UE基于AUTN验证网络；UE基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤608，核心网网元收到响应后，将RES和该认证向量中的XRES进行比对，如果RES＝XRES则网络验证用户通过，执行步骤609。
在步骤609：核心网网元向UE发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送附着接受(Attach Accept)消息等。
附着接受消息中携带核心网网元分配的临时标识TID1。
其中，TID1不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示。
或者，也可以在附着接受消息中携带TID1及标识类型指示，比如携带id-type字段以指示终端使用TID1。
终端接收到附着接受消息后，后续过程中，终端使用临时标识TID1发送消息。
在步骤610，UE再次向核心网网元发送附着请求。
这里，附着请求中携带TID1。
在步骤611，核心网网元收到请求后，向UE发送用户认证请求。
这里，实际应用时，发送用户认证请求，可以是发送User Authentication Request消息等。
用户认证请求中携带一个未被使用的针对该UE的认证向量中的部分信息组成的认证参数，比如RAND和AUTN。
在步骤612，UE收到用户认证请求后，基于AUTN验证网络；UE基于RAND计算出响应值RES，并向核心网网元发送用户认证响应。
这里，实际应用时，发送用户认证响应，可以是发送User Authentication Response消息等。
用户响应中携带认证信息，即RES。
在步骤613，核心网网元收到响应后，将RES和对应认证向量中的XRES进行比对，如果RES＝XRES则网络验证用户通过，则执行步骤614。
在步骤614，核心网网元向终端发送附着接受消息。
这里，实际应用时，发送附着接受消息，可以是发送Attach Accept消息等。
其中，在发送附着接受消息之前，核心网网元会判断是否还有可以使用的针对该UE的认证向量，如果还有，则附着接受消息携带核心网网元分配的临时标识TID2。与TID1类似的，TID2不是特定标识信息，比如不是全0的标识信息，因此UE可以视其为标识类型指示，也可以在该消息中携带标识类型指示，比如携带id-type字段以指示终端使用TID2。如果没有可以使用的针对该UE的认证向量，则附着接受消息携带标识类型指示以及核心网分配的临时标识信息TID2，或消息要携带特定的临时标识作为标识信息，比如全0标识信息，以指示终端临时标识不可用，需使用ID2。
收到附着接受消息后，UE可以依据标识类型指示在发送的消息中携带相应的标识信息。当UE发送的消息中携带ID2时，由于核心网网元无法识别UE，所以核心网网元会将ID2转发给认证数据下发网元，由认证数据下发网元识别UE，并下发新的针对UE的认证向量组给核心网网元。
需要说明的是：实际应用时，在步骤610中，UE还可以是向心网网元发送业务请求，比如Service Request消息，后续处理过程与步骤611～614完全相同。
从实施例二至四可以看出，本公开实施例提供的方案，使用两种终端标识信息：一种由核心网网元分配，另一种由认证数据下发网元分配，并由核心网网元通知终端使用哪种终端标识信息，认证数据下发网元可以一次下发多个认证向量，使得认证操作可以在拜访地的核心网网元执行，从而提高了认证操作的信令效率。
实施例五
为实现本公开实施例的方法，本实施例提供一种终端标识的处理装置，设置在第一网络功能实体，如图7所示，该装置包括：确定单元71和发送单元72。
发送单元72设置为依据确定单元71确定的针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；标识类型指示用于指示终端在发送后续消息时携带的终端标识信息。
也就是说，确定单元71依据针对终端的认证向量的有效性(也可以理解为使用情况)，确定终端的标识类型对应的标识类型指示；相应地，发送单元72依据确定的标识类型指示，向终端发送对应的标识类型指示。
当没有针对终端的能够使用的认证向量时，确定单元71确定终端的标识类型对应标识类型指示为第一类型指示；第一类型指示表征第一网络功能实体能够根据对应的终端标识信息识别终端。
当有针对终端的能够使用的认证向量时，第一确定单元71确定终端的标识类型对应标识类型指示为第二类型指示；第二类型指示表征第二网络功能实体能够根据对应终端标识信息识别终端。
相应地，对于发送单元72，当没有针对终端的能够使用的认证向量时，向终端发送的标 识类型指示为第一类型指示；当有针对终端的能够使用的认证向量时，向终端发送的标识类型为第二类型指示；第二类型指示表征第二网络功能实体能够根据对应的终端标识信息识别终端。
其中，认证向量为第二网络功能实体下发的认证向量，即认证向量接收自第二网络功能实体。
从上面的描述中可以看出，认证向量的使用情况可以是有针对终端的能够使用的认证向量，或者可以是没有针对终端的能够使用的认证向量。简单地说，认证向量的使用情况可以分为有能使用的认证向量和没有能够使用的认证向量两种情况。
这里，认证向量用于终端与对应的网络进行相互认证。
实际应用时，第二网络功能实体可以根据需要下发至少一个认证向量。每个认证向量包含多个认证参数，这多个认证参数形成一个向量，即认证向量。
实际应用时，第一网络功能实体可以是接入网络的关键控制节点，比如核心网网元，可以是MME或MMF等。
实际应用时，第二网络功能实体可以是认证数据下发网元，即控制用户数据的节点，比如HSS或AUSF等。
在一实施例中，标识类型指示的表现形式可以为特定标识信息，也可以为非特定标识信息。
其中，当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过隐式的方式通知标识类型指示。比如，可以通过一种特定的终端标识信息，比如不是全零的标识信息，即指示了终端对应的终端标识信息，同时也指示了标识类型为第一类型还是第二类型，这样可以节约信令资源。
当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过显式的方式通知标识类型指示。比如，可以指示终端对应的终端标识信息，同时，再利用一个字段来指示标识类型为第一类型或是第二类型。
在一实施例中，该装置还可以包括：第一接收单元，设置为接收第二网络功能实体发送的终端的标识信息；接收的终端的标识信息用于第一网络功能实体与第二网络功能实体交互终端的相关信息。
这里，实际应用时，有一种情况是，第二网络功能实体并不会通过第一网络功能实体直接向终端下发第二类型的终端标识信息，此时终端会基于与第二网络功能实体共享的信息生成第二类型的终端标识信息，此时，第二网络功能实体会向第一网络功能实体发送终端的标识信息，以便第一网络功能实体与第二网络功能实体交互终端的相关信息。
其中，在生成终端的标识信息时，当第二网络功能实体通过第一网络功能实体向终端发送了计算参数时，终端会基于与第二网络功能实体共享的信息以及计算参数生成第二类型的终端标识信息。
在一实施例中，第一接收单元，设置为接收终端发送的消息。发送单元72，还设置为当根据接收的消息中携带的终端标识信息不能识别终端时，向第二网络功能实体转发接收的消 息中携带的终端标识信息，以对终端进行识别，以便由第二网络功能实体与终端基于对应的认证向量进行相互认证。
其中，当根据接收的消息中携带的终端标识信息能识别终端时，第一网络功能实体与终端基于对应的认证向量进行相互认证。
实际应用时，确定单元71可由终端标识的处理装置中的处理器实现；发送单元72及第一接收单元可由终端标识的处理装置中的通信接口实现。
基于此，本公开实施例还提供了一种网络功能实体，为第一网络功能实体，第一网络功能实体包括：第一处理器和第一通信接口。
第一通信接口设置为依据第一处理器确定的针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；标识类型指示用于指示终端在发送后续消息时携带的终端标识信息；认证向量接收自第二网络功能实体。
其中，当没有针对终端的能够使用的认证向量时，第一通信接口向终端发送的标识类型指示为第一类型指示；第一类型指示表征第一网络功能实体能够根据对应的终端标识信息识别终端。
当有针对终端的能够使用的认证向量时，第一通信接口向终端发送的标识类型为第二类型指示；第二类型指示表征第二网络功能实体能够根据对应的终端标识信息识别终端。
第一处理器及第一通信接口的实现功能可参照前述方法和装置的相关描述而理解，这里不再赘述。
对应地，为实现本公开实施例终端侧的终端标识的处理方法，本公开实施例还提供了一种终端标识的处理装置，如图8所示，该装置包括：第二接收单元81和处理单元82。
第二接收单元81设置为接收第一网络功能实体发送的标识类型指示。
处理单元82设置为依据标识类型指示，在向第一网络功能实体发送的消息中携带对应的终端标识信息。
这里，标识类型指示用于指示终端发送消息时携带的终端标识信息。
在一实施例中，标识类型指示的表现形式可以为特定标识信息，也可以为非特定标识信息。
其中，当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过隐式的方式通知标识类型指示。比如，可以通过一种特定的终端标识信息，比如不是全零的标识信息，即指示了终端对应的终端标识信息，同时也指示了标识类型为第一类型还是第二类型，这样可以节约信令资源。
当标识类型指示的表现形式为特定标识信息时，说明第一网络功能实体确定通过显式的方式通知标识类型指示。比如，可以指示终端对应的终端标识信息，同时，再利用一个字段来指示标识类型为第一类型或是第二类型。
在一实施例中，对于处理单元82：当接收的标识类型指示为第一类型指示时，在发送的消息中携带第一终端标识信息；第一类型指示表征第一网络功能实体能够根据第一终端标识信息识别终端，进而与终端基于对应的认证向量进行相互认证；或者，当接收的标识类型指 示为第二类型指示时，在发送的消息中携带第二终端标识信息；第二类型指示表征第二网络功能实体能够根据第二终端标识信息识别终端，进而由第二网络功能实体与终端基于对应的认证向量进行相互认证。
其中，第一终端标识信息从第一网络功能实体接收，比如可以是终端从接收标识类型指示的消息中获取第一终端标识信息。
这里，实际应用时，有一种情况是，第二网络功能实体并不会通过第一网络功能实体直接向终端下发第二类型的终端标识信息，此时处理单元82会基于与第二网络功能实体共享的信息生成第二终端标识信息，此时，第二网络功能实体会向第一网络功能实体发送终端的标识信息，以便第一网络功能实体与第二网络功能实体交互终端的相关信息。
另外，在一实施例中，第二接收单元81，还用于接收第一网络功能实体发送的计算参数；计算参数是第二网络功能实体下发的；处理单元82，设置为：依据与第二网络功能实体共享的信息及计算参数，生成第二终端标识信息。
其中，从上面的描述可以看出，第二网络功能实体能够根据第二终端标识信息识别终端，进而由第二网络功能实体与终端基于对应的认证向量进行相互认证。
实际应用时，第二接收单元81可由终端标识的处理装置中的通信接口实现；处理单元82可由终端标识的处理装置中的处理器实现。
基于此，本公开实施例还提供了一种终端，包括：第二通信接口和第二处理器。
第二通信接口设置为接收第一网络功能实体发送的标识类型指示；第二处理器设置为依据标识类型指示，在通过第二通信接口向第一网络功能实体发送的消息中携带对应的终端标识信息。
其中，当标识类型指示为第一类型指示时，第二处理器在发送的消息中携带第一终端标识信息；第一类型指示表征第一网络功能实体能够根据第一终端标识信息识别终端；第一终端标识信息从第一网络功能实体接收。
当标识类型指示为第二类型指示时，第二处理器在发送的消息中携带第二终端标识信息；第二类型指示表征第二网络功能实体能够根据第二终端标识信息识别终端。
第二通信接口及第二处理器的实现功能可参照前述方法和装置的相关描述而理解，这里不再赘述。
基于上述装置，本公开实施例还提供了一种终端标识的处理系统，该系统包括：第一网络功能实体和终端。
第一网络功能实体设置为依据针对终端的认证向量的有效性，相应向终端发送对应的标识类型指示；终端设置为接收到第一网络功能实体发送的标识类型指示后，依据标识类型指示，在向第一网络功能实体发送的消息中携带对应的终端标识信息。
需要说明的是：实际应用时，本公开实施例所描述的终端标识信息可以根据需要来选择，只要可以标识终端的信息即可，本公开实施例不对此做限定。
另外，第一网络功能实体和终端的处理过程已在上文详述，这里不再赘述。
本领域内的技术人员应明白，本公开的实施例可提供为方法、系统、或计算机程序产品。 因此，本公开可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本公开是参照根据本公开实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本公开的较佳实施例而已，并非用于限定本公开的保护范围。

Claims (23)

  1. 一种应用于第一网络功能实体的终端标识的处理方法，，所述方法包括：
    依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。
  2. 根据权利要求1所述的方法，其中，所述依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示时，所述方法包括：
    当没有针对所述终端的能够使用的认证向量时，向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述第一网络功能实体能够根据对应的终端标识信息识别所述终端。
  3. 根据权利要求1所述的方法，其中，所述依据针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示时，所述方法包括：
    当有针对所述终端的能够使用的认证向量时，向所述终端发送的标识类型指示为第二类型指示；所述第二类型指示表征所述第二网络功能实体能够根据对应的终端标识信息识别所述终端。
  4. 根据权利要求1-3中任一项所述的方法，其中，所述标识类型指示的表现形式为特定标识信息、或为非特定标识信息。
  5. 根据权利要求1-4中任一项所述的方法，还包括：
    接收第二网络功能实体发送的所述终端的标识信息；接收的所述终端的标识信息用于所述第一网络功能实体与所述第二网络功能实体交互所述终端的相关信息。
  6. 一种应用于终端的终端标识的处理方法，，所述方法包括：
    接收第一网络功能实体发送的标识类型指示；
    依据所述标识类型指示，在向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
  7. 根据权利要求6所述的方法，其中，所述方法还包括：
    当所述标识类型指示为第一类型指示时，在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
  8. 根据权利要求6所述的方法，其中，所述方法还包括：
    当所述标识类型指示为第二类型指示时，在所述发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
  9. 根据权利要求6-8中任一项所述的方法，还包括：
    依据与第二网络功能实体共享的信息，生成第二终端标识信息；所述第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
  10. 根据权利要求6-9中任一项所述的方法，还包括：
    接收所述第一网络功能实体发送的计算参数；所述计算参数是第二网络功能实体下发的；
    依据与所述第二网络功能实体共享的信息及计算参数，生成第二终端标识信息；所述第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
  11. 根据权利要求6-10中任一项所述的方法，其中，所述标识类型指示的表现形式为特定标识信息、或为非特定标识信息。
  12. 一种终端标识的处理装置，所述装置包括：
    确定单元；
    发送单元，设置为依据所述确定单元确定的针对终端的认证向量的有效性，相应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自第二网络功能实体。
  13. 根据权利要求12所述的装置，其中，
    当没有针对所述终端的能够使用的认证向量时，所述发送单元向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述第一网络功能实体能够根据对应的终端标识信息识别所述终端。
  14. 根据权利要求12所述的装置，其中，
    当有针对所述终端的能够使用的认证向量时，所述发送单元向所述终端发送的标识类型为第二类型指示；所述第二类型指示表征所述第二网络功能实体能够根据对应的终端标识信息识别所述终端。
  15. 一种终端标识的处理装置，所述装置包括：
    第二接收单元，设置为接收第一网络功能实体发送的标识类型指示；
    处理单元，设置为依据所述标识类型指示，在向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
  16. 根据权利要求15所述的装置，其中，
    当所述标识类型指示为第一类型指示时，所述处理单元在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
  17. 根据权利要求15所述的装置，其中，
    当所述标识类型指示为第二类型指示时，所述处理单元在发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
  18. 一种网络功能实体，包括：
    第一处理器；
    第一通信接口，设置为依据所述第一处理器确定的针对终端的认证向量的有效性，相 应向所述终端发送对应的标识类型指示；所述标识类型指示用于指示所述终端在发送后续消息时携带的终端标识信息；所述认证向量接收自另一网络功能实体。
  19. 根据权利要求18所述的网络功能实体，其中，
    当没有针对所述终端的能够使用的认证向量时，所述第一通信接口向所述终端发送的标识类型指示为第一类型指示；所述第一类型指示表征所述网络功能实体能够根据对应的终端标识信息识别所述终端。
  20. 根据权利要求18所述的网络功能实体，其中，
    当有针对所述终端的能够使用的认证向量时，所述第一通信接口向所述终端发送的标识类型为第二类型指示；所述第二类型指示表征所述另一网络功能实体能够根据对应的终端标识信息识别所述终端。
  21. 一种终端，包括：
    第二通信接口，设置为接收第一网络功能实体发送的标识类型指示；
    第二处理器，设置为依据所述标识类型指示，在通过所述第二通信接口向所述第一网络功能实体发送的消息中携带对应的终端标识信息。
  22. 根据权利要求21所述的终端，其中，
    当所述标识类型指示为第一类型指示时，所述第二处理器在所述发送的消息中携带第一终端标识信息；所述第一类型指示表征所述第一网络功能实体能够根据所述第一终端标识信息识别所述终端；所述第一终端标识信息从所述第一网络功能实体接收。
  23. 根据权利要求21所述的终端，其中，
    当所述标识类型指示为第二类型指示时，所述第二处理器在发送的消息中携带第二终端标识信息；所述第二类型指示表征第二网络功能实体能够根据所述第二终端标识信息识别所述终端。
PCT/CN2018/072029 2017-02-27 2018-01-10 一种终端标识的处理方法、装置及相关设备 WO2018153173A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710108849.4 2017-02-27
CN201710108849.4A CN108513289A (zh) 2017-02-27 2017-02-27 一种终端标识的处理方法、装置及相关设备

Publications (1)

Publication Number Publication Date
WO2018153173A1 true WO2018153173A1 (zh) 2018-08-30

Family

ID=63253117

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/072029 WO2018153173A1 (zh) 2017-02-27 2018-01-10 一种终端标识的处理方法、装置及相关设备

Country Status (2)

Country Link
CN (1) CN108513289A (zh)
WO (1) WO2018153173A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111641498B (zh) * 2019-03-01 2022-12-20 中兴通讯股份有限公司 密钥的确定方法及装置
CN111818516B (zh) 2019-04-12 2022-10-18 华为技术有限公司 认证方法、装置及设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102625306A (zh) * 2011-01-31 2012-08-01 电信科学技术研究院 认证方法、系统和设备
CN102905266A (zh) * 2012-10-11 2013-01-30 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN102917332A (zh) * 2012-10-11 2013-02-06 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102625306A (zh) * 2011-01-31 2012-08-01 电信科学技术研究院 认证方法、系统和设备
CN102905266A (zh) * 2012-10-11 2013-01-30 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN102917332A (zh) * 2012-10-11 2013-02-06 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置

Also Published As

Publication number Publication date
CN108513289A (zh) 2018-09-07

Similar Documents

Publication Publication Date Title
US11784788B2 (en) Identity management method, device, communications network, and storage medium
JP6320501B2 (ja) デバイス・ツー・デバイス通信セッションの確立
CN111669276B (zh) 一种网络验证方法、装置及系统
EP3627794B1 (en) Discovery method and apparatus based on service-oriented architecture
EP2549785B1 (en) Method and network side entity for authenticating communication devices
EP3249849B1 (en) Key agreement for wireless communication
EP3668042A1 (en) Registration method and apparatus based on service-oriented architecture
CN108012266B (zh) 一种数据传输方法及相关设备
US20220408243A1 (en) Subscription concealed identifier privacy
US20240031800A1 (en) Network access authentication method and device
CN103621126A (zh) 提供机器到机器服务的方法和装置
JP2018532325A (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
CN104756458A (zh) 用于保护通信网络中的连接的方法和设备
CN102685730B (zh) 一种ue上下文信息发送方法及mme
WO2016101579A1 (zh) 密钥协商方法、系统、网络实体及计算机存储介质
CN105100268A (zh) 一种物联网设备的安全控制方法、系统及应用服务器
CN111526013B (zh) 密钥分发方法及系统
KR101718775B1 (ko) 통신 보안 처리 방법 및 장치
WO2018153173A1 (zh) 一种终端标识的处理方法、装置及相关设备
CN106487761B (zh) 一种消息传输方法和网络设备
CN110830240B (zh) 一种终端与服务器的通信方法和装置
CN113163399A (zh) 一种终端与服务器的通信方法和装置
CN108271154B (zh) 一种认证方法及装置
US20180131676A1 (en) Code encryption
CN112242976A (zh) 一种身份认证方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18756535

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18756535

Country of ref document: EP

Kind code of ref document: A1