WO2018201946A1 - 锚密钥生成方法、设备以及系统 - Google Patents

锚密钥生成方法、设备以及系统 Download PDF

Info

Publication number
WO2018201946A1
WO2018201946A1 PCT/CN2018/084416 CN2018084416W WO2018201946A1 WO 2018201946 A1 WO2018201946 A1 WO 2018201946A1 CN 2018084416 W CN2018084416 W CN 2018084416W WO 2018201946 A1 WO2018201946 A1 WO 2018201946A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
anchor
access
terminal
identifier
Prior art date
Application number
PCT/CN2018/084416
Other languages
English (en)
French (fr)
Inventor
吴�荣
张博
甘露
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to RU2019139240A priority Critical patent/RU2781250C2/ru
Priority to JP2019560249A priority patent/JP6924848B2/ja
Priority to KR1020197035377A priority patent/KR102245688B1/ko
Priority to CN201880026323.4A priority patent/CN110612729B/zh
Priority to BR112019022792-0A priority patent/BR112019022792B1/pt
Priority to EP22210348.3A priority patent/EP4203533A1/en
Priority to EP18795025.8A priority patent/EP3531732B1/en
Publication of WO2018201946A1 publication Critical patent/WO2018201946A1/zh
Priority to US16/388,606 priority patent/US11012855B2/en
Priority to US16/441,598 priority patent/US10966083B2/en
Priority to US17/245,991 priority patent/US11924629B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/25—Maintenance of established connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/08—Upper layer protocols
    • H04W80/10—Upper layer protocols adapted for application session management, e.g. SIP [Session Initiation Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/022—Selective call receivers
    • H04W88/023—Selective call receivers with message or information receiving capability

Definitions

  • the present invention relates to the field of communications, and in particular, to an anchor key generation method, device, and system.
  • the key is the key to the encryption operation and the decryption operation, and is also the key to the cryptosystem. Therefore, in the information security system, key negotiation is an important part of the authentication process.
  • the key negotiation process is as shown in FIG. 1.
  • the network elements required for the execution of the process include user equipment (UE), base station (eNodeB), and mobility management entity (Mobility Management Entity, MME). ), the Home Subscriber Server (HSS), and the Authentication Center (AuC), etc.
  • the execution flow is as follows:
  • Step 1 The AuC generates an integrity key IK and a secret key CK according to the root key K, and transmits the integrity key IK and the secret key CK to the HSS. Accordingly, the HSS receives the integrity key IK and the secret key CK transmitted by the AuC.
  • Step 2 The HSS generates an intermediate key K ASME according to the integrity key IK and the secret key CK, and sends the intermediate key K ASME to the MME. Accordingly, the MME receives the intermediate key K ASME sent by the HSS.
  • Step 3 The MME generates a NAS integrity key K NASenc for confidentiality protection of Non Access Stratum (NAS) messages according to the intermediate key K ASME , and NAS integrity protection for integrity protection.
  • K NASint Key K NASint .
  • Step 4 The MME generates a base station key K eNB according to the intermediate key K ASME and transmits the base station key K eNB to the eNodeB. Accordingly, the eNodeB receives the base station key K eNB transmitted by the MME.
  • Step 5 The eNodeB separately generates a user plane confidentiality key K UPenc for protecting the confidentiality of the user plane data according to the base station key K eNB , and the user plane integrity key for protecting the integrity of the user plane data
  • K UPint The key K UPint , a control plane secret key K RRCenc for protecting the confidentiality of the control plane data, and a control plane integrity key K RRCint for protecting the integrity of the control plane data.
  • Step 6 The UE generates an integrity key IK, a secret key CK, an intermediate key K ASME , a user plane secret key K UPenc , a user plane integrity key K UPint , and a control plane secret according to the root key K. Sex key K RRCenc , control plane integrity key K RRCint .
  • a key architecture as shown in FIG. 2 will be generated in the 4G system.
  • FIG. 1 is a key agreement process in a process in which a terminal accesses a core network through an access mode of a 3rd Generation Partnership Project (3GPP) in a 4G application scenario.
  • 3GPP 3rd Generation Partnership Project
  • the terminal can access the core network through various access modes, for example, a 3GPP access mode, a reliable non-3GPP access mode, an unreliable 3GPP access mode, and the like.
  • the key negotiation process is also different.
  • it is explicitly required to generate a unified anchor key in the key negotiation process of different access modes.
  • how to generate a unified anchor key is a problem that those skilled in the art need to solve.
  • the embodiment of the present application provides an anchor key generation method, device, and system, which can generate a unified anchor key for different access modes, and implement an anchor key for different access modes, and an anchor key.
  • the generated lower layer key is isolated.
  • the first aspect provides a method for generating an anchor key, including: receiving, by a first communications device, a second communications device to send an indication identifier, wherein the indication identifier is used to indicate an access mode of the terminal; Sending the indication identifier to the third communication device; the first communication device receives an intermediate key returned by the third communication device, where the intermediate key is generated according to the indication identifier; the first The communication device generates an anchor key according to the intermediate key, where the anchor key corresponds to an access mode of the terminal; the first communication device sends the anchor key to the second communication device, The second communication device is configured to derive a lower layer key according to the anchor key for the access mode.
  • the access mode is distinguished according to at least one of an access type and an operator type.
  • the generating, by the first communications device, the anchor key according to the intermediate key is specifically:
  • the first communication device generates an anchor key according to the following formula.
  • Anchor key KDF(IK 1 '
  • the anchor key is the anchor key
  • (IK 1 ', CK 1 ') is the intermediate key
  • IK 1 ' is an intermediate integrity key
  • CK 1 ' is an intermediate secret key
  • the first communication device can generate an intermediate key according to at least two ways:
  • the intermediate key is generated according to the following formula:
  • the access type identifier is used to indicate the access type, and the carrier type identifier is used to indicate the type of the operator;
  • (CK 1 ', IK 1 ') is the intermediate key
  • IK 1 ' is the intermediate integrity key
  • KDF is the key generation algorithm
  • SQN is the latest serial number
  • ANT is the access type identifier
  • SNT is the operator Type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is the random number
  • f3, f4 and f5 are generation algorithms
  • the meaning is an exclusive OR operation.
  • the intermediate key is generated according to the following formula:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • NAI is the indication identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK F5 (RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the first communications device generates the intermediate key according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the first communication device generates EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • the first communication device generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,SNT);
  • the anchor key is the anchor key
  • the SNT is the carrier type identifier
  • the first communications device generates the intermediate key according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the first communication device generates EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK2' is the intermediate integrity key
  • CK2' is the intermediate secret key
  • means the level Union, indicating that the strings on both sides of the symbol are connected;
  • the first communication device generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,ANT);
  • the anchor key is the anchor key
  • the ANT is the access type identifier
  • a communication device including: a receiving module, a sending module, and a generating module, where the receiving module is configured to receive a second communications device to send an indication identifier, where the indication identifier is used to indicate terminal access
  • the sending module is configured to send the indication identifier to a third communications device, where the receiving module is configured to receive an intermediate key returned by the third communications device, where the intermediate key is according to the indication
  • the generating module is configured to generate an anchor key according to the intermediate key, where the anchor key corresponds to an access mode of the terminal, and the sending module is configured to send the anchor key Giving the second communication device, for the second communication device to derive a lower layer key for the access mode according to the anchor key.
  • the access mode is distinguished according to at least one of an access type and an operator type.
  • the generating module is configured to generate an anchor key according to the following formula,
  • Anchor key KDF(IK 1 '
  • the anchor key is the anchor key
  • (IK 1 ', CK 1 ') is the intermediate key
  • IK 1 ' is an intermediate integrity key
  • CK 1 ' is an intermediate secret key
  • the first communication device can generate an intermediate key according to at least two ways:
  • the generating module is configured to generate according to the following formula:
  • the access type identifier is used to indicate the access type
  • the operator type identifier is used to indicate the type of the operator
  • (CK 1 ', IK 1 ') is the intermediate key
  • IK 1 ' is the intermediate integrity key
  • KDF is the key generation algorithm
  • SQN is the latest serial number
  • ANT is the access type identifier
  • SNT is the operator Type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is the random number
  • f3, f4 and f5 are generation algorithms
  • the meaning is an exclusive OR operation.
  • the generation module is configured to generate according to the following formula:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • NAI is the indication identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK F5 (RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the generation module is generated for use according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the generating module is configured to generate EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • the generating module is configured to generate an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,SNT);
  • the anchor key is the anchor key
  • the SNT is the carrier type identifier
  • the generating module is configured to generate according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the generating module is configured to generate EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK2' is the intermediate integrity key
  • CK2' is the intermediate secret key
  • means the level Union, indicating that the strings on both sides of the symbol are connected;
  • the generating module is configured to generate an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,ANT);
  • the anchor key is the anchor key
  • the ANT is the access type identifier
  • a third aspect provides a communication device, including: a memory and a processor and a communication module coupled to the memory, wherein: the communication module is configured to send or receive externally transmitted data, and the memory is used to store An implementation code of a method described on the one hand, the processor for executing program code stored in the memory, ie performing the method described in the first aspect.
  • a computer readable storage medium is provided, the instructions being stored in the computer readable storage medium, when executed on a computer, causing the computer to perform the method of the first aspect described above.
  • a computer program product comprising instructions for causing a computer to perform the method of the first aspect described above when executed on a computer is provided.
  • a communication system including an interconnected access and mobility control function network element, a session management network element, an authentication server, and a unified data management network element, wherein the authentication server is as claimed
  • the authentication server according to any of the two aspects or the third aspect.
  • FIG. 1 is a schematic flowchart of key negotiation in a 3GPP access mode in a 4G application scenario provided by the prior art
  • FIG. 2 is a key architecture diagram of the process of key agreement shown in FIG. 1;
  • FIG. 3 is a network architecture diagram of accessing a 5G core network through a 3GPP access method according to an embodiment of the present application
  • FIG. 4 is a network architecture diagram of accessing a 5G core network by using a non-3GPP access method according to an embodiment of the present application;
  • FIG. 5 is an interaction diagram of a first anchor key generation method according to an embodiment of the present application.
  • 6A to 6B are specific interaction diagrams when the 3GPP mode access and the non-3GPP mode access are used in the anchor key generation method shown in FIG. 5;
  • FIG. 7 is a key architecture diagram obtained by using the anchor key generation method shown in FIG. 5;
  • FIG. 8 is an interaction diagram of a second anchor key generation method according to an embodiment of the present application.
  • FIG. 9 is an interaction diagram of a third anchor key generation method provided by an embodiment of the present application.
  • FIG. 10 is a diagram showing a key structure obtained by using the anchor key generation method shown in FIG. 9; FIG.
  • FIG. 11 is an interaction diagram of a fourth anchor key generation method provided by an embodiment of the present application.
  • Figure 12 is a diagram showing a key structure obtained by using the anchor key generation method shown in Figure 11;
  • FIG. 13 is an interaction diagram of a fifth anchor key generation method according to an embodiment of the present application.
  • 14A to 14B are specific interaction diagrams when the 3GPP mode access and the non-3GPP mode access are used in the anchor key generation method shown in FIG. 13;
  • Figure 15 is a diagram showing a key structure obtained by using the anchor key generation method shown in Figure 13;
  • 16 is an interaction diagram of a sixth anchor key generation method according to an embodiment of the present application.
  • 17A to 17B are specific interaction diagrams when the 3GPP mode access and the non-3GPP mode access are used in the anchor key generation method shown in FIG. 16;
  • FIG. 18 is a key architecture diagram obtained by using the anchor key generation method shown in FIG. 16;
  • FIG. 19 is an interaction diagram of a seventh anchor key generation method according to an embodiment of the present application.
  • FIG. 20 is a key architecture diagram obtained by using the anchor key generation method shown in FIG. 19;
  • FIG. 21 is a schematic structural diagram of a communication device according to an embodiment of the present disclosure.
  • FIG. 22 is a schematic structural diagram of another communication device according to an embodiment of the present application.
  • FIG. 3 is a network architecture diagram of an embodiment of the present application, where the network architecture is mainly applicable to a scenario of accessing a 5G core network through a 3GPP manner.
  • FIG. 4 is a diagram of another network architecture involved in the embodiment of the present application, where the network architecture is mainly applicable to a scenario in which a 5G core network is accessed through a non-3GPP manner.
  • the network architectures shown in FIG. 3 and FIG. 4 each include network elements related to key negotiation: a terminal, an access node (AN) (ie, N3 IWF in FIG. 2), access and mobility control.
  • Access and Mobility Function AMF
  • Session Management Function SMF
  • AUSF Authentication Server Function
  • UDM Unified Data Management
  • SEAF Security Anchor Function
  • ARPF Authentication Credential Repository and Processing Function
  • SEAF can also not be deployed in AMF, but SEAF and AMF are deployed separately.
  • ARPF may not be deployed in UDM, but ARPF and UDM are deployed separately.
  • the NEs related to key agreement (terminal, AN, AMF, SMF, AUSF, and UDM) are briefly introduced below.
  • the terminal may be any one of a User Equipment (Communication Device) Internet of Things (IoT) device.
  • the user equipment may be a smart phone, a smart watch, a smart tablet, and the like.
  • the communication device can be a server, a gateway (GW), a base station, a controller, and the like.
  • IoT devices can be sensors, electricity meters, water meters, and the like.
  • the AN can be a wireless access point, such as a base station, a Wi-Fi access point (Wireless Fidelity), a Bluetooth access point, etc., or a wired access point, such as a gateway, a modem, or an optical fiber. Access, IP access, and more.
  • a wireless access point such as a base station, a Wi-Fi access point (Wireless Fidelity), a Bluetooth access point, etc.
  • a wired access point such as a gateway, a modem, or an optical fiber. Access, IP access, and more.
  • AMF which is responsible for access control and mobility management, is also a forwarding and processing node for Non-access stratum (NAS) signaling.
  • NAS Non-access stratum
  • the SMF is used to perform the establishment and management of a session, a slice, a flow, or a bearer.
  • the physical entity that can be said to perform the function of the session management network element is a session management device or an SM.
  • the establishment and management of the slice, flow flow or bearer are handled by the mobility management network element.
  • AUSF responsible for key generation, management, and negotiation.
  • AUSF can be deployed as a separate logical function entity or in a Mobility Management network element, that is, AMF, session management network element SMF, etc. It may be EPS AKA or EAP AKA'.
  • UDM unified data management
  • unified data management mainly consists of two parts, one is the front end of the business or application, and the other is the user database. Specifically, it includes the processing of credentials, location management, contract data management, policy control, etc., and also includes information storage of these related processes.
  • SEAF as a node of the security authentication function, may be an EPS AKA or an authentication node of EAP AKA', or a node of another authentication protocol; for example, in the case where the authentication process is EPS AKA, the SEAF will receive the intermediate key Kasme.
  • ARPF stores security credentials and uses security credentials to perform security-related operations, such as generating keys and storing secure files. ARPF should be deployed in a physically secure location while interacting with AUSF. In actual deployment, ARPF may be a module of the UDM or as a separate network entity and deployed with the UDM.
  • FIG. 3 and FIG. 4 the logical relationship between the network elements is implemented. In practice, some network elements may be deployed separately, or two or two or more network elements may be integrated and deployed in one entity.
  • the embodiment of the present application provides an anchor key generation method.
  • the above method can also isolate the anchor key of different access modes and the lower layer key generated based on the anchor key.
  • the embodiment of the present application provides a first anchor key generation method.
  • the AUSF is the first communication device in the claims
  • the AMF or the SEAF is the second communication device in the claims
  • the ARPF is the third communication device in the claims.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the terminal identifier may be a fixed identifier, such as a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, and an international mobile device identifier (International).
  • MAC Media Access Control
  • IP Internet Protocol
  • International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • TMSI Temporary Mobile Subscriber Identity
  • GUI Globally Unique Temporary UE Identity
  • the UE may send at least one of an access network parameter, a registration type, a security parameter, a 5G network capability of the UE, a state of the PDU session, and the like to the AN.
  • the access network parameter is a parameter related to the service network, such as a frequency point of the access network, a temporary user identifier, and an NSSAI.
  • the registration type is a behavior that can indicate that the user is the first registration, the registration due to the movement, the periodic registration update, and the like to distinguish the user registration.
  • the security parameters are parameters related to authentication and integrity protection.
  • NSSAI selects auxiliary information for the network slice.
  • the UE's 5G network capabilities may include configuration capabilities to support access to the network.
  • the PDU session is a service connection of the PDU between the UE and the data network, and the type may be an IP or Ethernet service connection.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier is used to indicate an access mode of the terminal.
  • the access mode of the terminal can be divided according to different divisions.
  • the division method of the access method may include an access type and an operator type.
  • the access type may be specifically classified into a 3GPP access type, a trusted non-3GPP access type, and an untrusted non-3GPP access type.
  • the carrier type can be specifically classified into an A carrier type or a B carrier type. It can be understood that there are more types of carrier types, which are only examples and are not specifically limited.
  • the division of the access mode and the type of the carrier are as follows:
  • the basis for the division of the access method may be other types of division basis, for example, the type of the medium (wired access or wireless access), and the like, which is not specifically limited herein.
  • the access type and the operator type it is not limited to the access type and the operator type.
  • the basis of the access method may be one, three, four or more, that is, the interface may be connected from more dimensions or less.
  • the entry method is divided. For example, only the dimension of 3GPP access type and non-3GPP access type is distinguished.
  • the indication identifier may be carried in the access network parameter.
  • the indication identifier may be any one of the following manners: the indication identifier may be a network access identifier (NAI), and is used to simultaneously indicate an access type and an operator type.
  • NAI network access identifier
  • the indication identifier may include an access type identifier and an operator type identifier, where the access type identifier is used to indicate the access type, and the operator type identifier is used to indicate the operator type. It is to be understood that the above examples are by way of example only and are not specifically limited.
  • the network access identifier may be SN Identity
  • the Access Network Identity is defined in the non-3GPP network when it is 4G. It is also possible to upgrade the SN Identity or Access Network Identity mode to indicate an access type of an operator.
  • the access type identifier specifically indicates that the access type is a 3GPP access type, a trusted non-3GPP access type, and a non-trusted non-3GPP access type.
  • the access type identifier Access Network Type can be directly "3GPP network", “Trusted Non-3GPP network”, “Untrusted Non-3GPP network” string, or only "3GPP network” and “Non-3GPP” Network” string and so on.
  • the carrier type identifier may include two parts, one part is used to indicate an operator, and another part is used to indicate a specific access type.
  • the operator type identifier may indicate LTE access for China Mobile or WLAN access for China Unicom.
  • a combination of SN Identity and Access Network Identity can be used as an operator type identifier. It is also possible to include only the distinctions of operators, such as China Mobile, China Unicom, China Telecom, and so on.
  • the identity is only an operator type identity.
  • the identity is only an access type identity.
  • the AMF (or SEAF) sends a terminal identifier and an indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an intermediate key according to the secret key CK and the integrity key IK and the indication identifier.
  • the manner in which the ARPF generates the intermediate key according to the key generation algorithm may include the following:
  • the ARPF when the indication identifier is NAI, the ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • NAI is the indication identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK F5 (RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the ARPF when the indication identifier includes an access type identifier and an operator type identifier, the ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3 (RAND) )
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the SQN may be the latest sequence number generated by the AuC, and the AuC sends the SQN to the ARPF after generating the SQN.
  • RAND may be a random number generated by AuC, and after generating RAND, AuC sends RAND to the ARPF.
  • the SQN and the RAND may also be generated by the other communication devices in the network architecture and sent to the ARPF.
  • the SQN and the RAND may be generated by the ARPF itself, which is not specifically limited herein.
  • CK, IK, and AK may also be generated by other communication devices in the network architecture and sent to the ARPF. Even CK, IK, and AK may be generated by the ARPF itself, which is not specifically limited herein. .
  • the ARPF sends an intermediate key to the AUSF. Accordingly, the AUSF receives the intermediate key transmitted by the ARPF.
  • the AUSF generates an anchor key according to the intermediate key.
  • the AUSF generates an anchor key according to the following formula.
  • Anchor key KDF(IK 1 '
  • anchor key is the anchor key
  • (IK 1 ', CK 1 ') is the intermediate key
  • the meaning is cascading, which means that the strings on both sides of the symbol are connected.
  • the AUSF sends the anchor key to the AMF (or SEAF). Accordingly, the AMF (or SEAF) receives the anchor key transmitted by the AUSF.
  • AMF (or SEAF) generates a lower layer key based on the anchor key.
  • the lower layer key is a key obtained by performing one or more derivation based on the anchor key.
  • f is a mapping function between the indication identifier and the anchor key
  • NAI is the network access identifier
  • the ANT is the access type identifier
  • the SNT is the operator type identifier.
  • the access modes when the access modes are different, the values of the anchor keys are also different, that is, the anchor keys of different access modes are isolated.
  • the AMF (or SEAF) delays the lower layer keys of different access modes based on the anchor keys of different access modes, thereby realizing the isolation of the lower layer keys. That is, if the access mode is the A access mode, the calculated anchor key is the a-anchor key, and when the access mode is the B access mode, the calculated anchor key is the b-anchor key, which can be based on a.
  • the anchor key deducts the lower layer key of the A access mode, and derives the lower layer key of the B access mode according to the b anchor key.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE generates an anchor key according to the root key, and then derives the lower layer key according to the anchor key. It can be understood that the process of the UE deriving the lower layer key is substantially similar to the above process, and the description will not be repeated here.
  • the AUSF can also generate a K AMF key or a K SEAF key according to the anchor key, and then send it to the AMF or SEAF instead of sending the anchor key to the AMF or SEAF, so in step 109
  • the AMF or SEAF generates a lower layer key based on the K AMF key or the K SEAF key.
  • the steps 109 to 111 are different.
  • the following describes the 3GPP access mode and the non-3GPP access mode in the access mode as an example.
  • the steps 109 to 111 can be replaced by the following steps 1111 and 1117.
  • AMF (or SEAF) generates a lower layer key Kamf1 key and/or K seaf1 key according to the following formula:
  • K amf1 KDF (anchor key1, AMF ID);
  • K seaf1 KDF (anchor key1, SEAF ID);
  • the anchor key 1 is the anchor key in the 3GPP access mode
  • the KDF is the key generation algorithm
  • the AMF ID is the identifier of the AMF
  • the SEAF ID is the identifier of the SEAF.
  • the identifier of the AMF may be the MAC address or IP address of the AMF, etc.
  • the identifier of the SEAF may be the MAC address or IP address of the SEAF, and the like.
  • the AMF (or SEAF) generates a base station key K gNB in the 3GPP access mode, a 3GPP-NAS secret key K-3GPP NASenc , and a 3GPP-NAS integrity protection key K-3GPP NASint according to the following formula: :
  • K gNB KDF (K amf1 and / or Kseaf1, NAS Count1);
  • K-3GPP NASint KDF (K amf1 and / or Kseaf1, NAS-int-alg, alg-ID);
  • K-3GPP NASenc KDF (K amf1 and / or Kseaf1, NAS-enc-alg, alg-ID);
  • the NAS Count1 is the count value of the NAS message of the access point gNB via the 3GPP, and may be an uplink count value or a downlink count value
  • NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES'. , 'SNOW 3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to NAS messages, such as 'AES', 'SNOW 3G', 'ZUC' and so on.
  • AMF (or SEAF) sends the base station key K gNB to the AN.
  • the AN receives the base station key K gNB transmitted by the AMF (or SEAF).
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the base station key K gNB .
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the following formula:
  • K UPenc KDF (K gNB , UP-enc-alg, alg-ID);
  • K UPin KDF(K gNB , UP-int-alg, alg-ID);
  • K RRCenc KDFK gNB , RRC-enc-alg, alg-ID);
  • K RRCint KDF(K gNB , RRC-int-alg, alg-ID);
  • KDF is a key generation algorithm
  • K gNB is a base station key
  • alg-ID is an algorithm identifier
  • NAS-int-alg NAS-enc-alg
  • UP-enc-alg UP-int-alg
  • RRC-enc The definition of -alg and RRC-int-alg can refer to the algorithm identification definition table in 4G shown in Table 2, as follows:
  • Algorithm identification (Algorithm distinction er) Value NAS-enc-alg 0x01 NAS-int-alg 0x02 RRC-enc-alg 0x03 RRC-int-alg 0x04 UP-enc-alg 0x05 UP-int-alg 0x06
  • the UE generates an anchor key according to the root key, and then derives the user plane secret key K UPenc , the user plane integrity key K UPint , the control plane secret key K RRCenc , and the control plane complete according to the anchor key. Sex key K RRCint .
  • the AMF may not derive the Kamf1 key and/or the K seaf1 key according to the anchor key, and then according to the Kamf1 key and/or the K seaf1 key.
  • Deriving the base station key K gNB , the 3GPP-NAS secret key K-3GPPNAS enc , and the 3GPP-NAS integrity protection key K-3GPPNAS int but directly deriving the base station key K gNB according to the anchor key 3GPP-NAS privacy key K-3GPPNAS enc , and 3GPP-NAS integrity protection key K-3GPPNAS int .
  • steps 110 to 112 may be replaced by the following steps 1112 and 1116.
  • AMF (or SEAF) generates a K amf2 key and/or a K seaf2 key according to the following formula:
  • K amf2 KDF (anchor key2, AMF ID);
  • K seaf2 KDF (anchor key2, SEAF ID);
  • the anchor key 2 is an anchor key in the non-3GPP access mode
  • the KDF is a key generation algorithm
  • the AMF ID is an AMF identifier
  • the SEAF ID is an identifier of the SEAF.
  • AMF (or SEAF) then generates an access point key K N3IWF in a non-3GPP access mode, a non-3GPP-NAS secret key K-N3GPP NASenc , and a non-3GPP-NAS integrity protection secret according to the following formula: Key K-N3GPP NASint :
  • K N3IWF KDF (K amf2 and / or K seaf2 , NAS Count2);
  • K-N3GPP NASint KDF (K amf2 and / or K seaf2 , NAS-int-alg, alg-ID);
  • K-N3GPP NASenc KDF (K amf2 and / or K seaf2 , NAS-enc-alg, alg-ID);
  • the NAS Count2 is the count value of the NAS message of the non-3GPP access point N3IWF, which may be an uplink count value, or may be a downlink count value, and an integrity algorithm corresponding to the NAS message, such as 'AES', 'SNOW 3G' , 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to the NAS message, such as 'AES', 'SNOW 3G', 'ZUC' and so on.
  • the AMF (or SEAF) sends the access point key K N3IWF to the AN.
  • the AN correspondingly receives the access point key K N3IWF transmitted by the AMF (or SEAF).
  • the UE generates an anchor key according to the root key, and then derives the access point key K N3IWF according to the anchor key.
  • the AMF (or SEAF) is not the anchor key transmitted by the AUSF, but the K AMF key or K SEAF key generated by the AUSF according to the anchor key.
  • the key generation algorithm in the embodiment shown in FIG. 5 is not limited to the KDF algorithm.
  • the key generation algorithm may also be other algorithms, such as the Trunc algorithm: taking a low-level screenshot algorithm; other HASH algorithms. Etc., the application is not specifically limited.
  • the argument of the key generation algorithm may also include other parameters, for example, including NSSAI (Network Slice Selection Association Information), random number (Random number), random number (Number used once, Nonce), and sequence code (Sequence Number).
  • the length of the AK and the length corresponding to the parameter used to generate the key, etc., may be used as an argument of the key generation algorithm in an actual application.
  • the AMF may not derive the Kamf1 key and/or the K seaf1 key according to the anchor key, and then according to the Kamf1 key and/or the K seaf1 key.
  • Deriving the access point key K N3IWF , the non-3GPP-NAS secret key K-N3GPP NASenc , and the non-3GPP-NAS integrity protection key K-N3GPP NASint instead, directly based on the anchor key Entry key K N3IWF , non-3GPP-NAS privacy key K-N3GPP NASenc , and non-3GPP-NAS integrity protection key K-N3GPP NASint .
  • FIG. 7 After the anchor key generation method shown in FIG. 5 is executed, a key schema as shown in FIG. 7 will be generated.
  • the left side of the isolation line in FIG. 7 is a key structure generated by specifically executing the process shown in FIG. 6A.
  • the right side of the isolation line in FIG. 7 is a key structure generated by specifically executing the process shown in FIG. 6B. It is well isolated between the two.
  • the embodiment of the present application provides a second anchor key generation method.
  • the AUSF is the first communication device in the claims
  • the AMF or the SEAF is the second communication device in the claims
  • the ARPF is the third communication device in the claims.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier includes ANT and SNT.
  • the AMF (or SEAF) sends the terminal identifier and the indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an intermediate key according to the secret key CK and the integrity keys IK and ANT.
  • the manner in which the ARPF generates the intermediate key according to the key generation algorithm may include the following:
  • ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the ARPF sends an intermediate key to the AUSF. Accordingly, the AUSF receives the intermediate key transmitted by the ARPF.
  • the AUSF generates an anchor key according to the intermediate key.
  • the manner in which the AUSF generates the anchor key according to the intermediate key is:
  • AUSF generates EMSK' based on intermediate key generation.
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • AUSF generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,SNT);
  • the anchor key is the anchor key
  • the SNT is the carrier type identifier
  • the manner in which the AUSF generates the anchor key according to the intermediate key is:
  • AUSF generates EMSK' based on intermediate key generation.
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • AUSF generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,ANT);
  • the anchor key is the anchor key
  • the ANT is the access type identifier
  • the anchor key can also be generated by EMSK' and other parameters, and is not limited to the indicator.
  • anchor key can also be generated by MSK'.
  • EMSK' generates an anchor key as an example.
  • the AUSF sends the anchor key to the AMF (or SEAF). Accordingly, the AMF (or SEAF) receives the anchor key transmitted by the AUSF.
  • AMF (or SEAF) generates a lower layer key based on the anchor key.
  • the lower layer key is a key obtained by performing one or more derivation based on the anchor key.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE generates an anchor key according to the root key, and then derives the lower layer key according to the anchor key.
  • the embodiment of the present application provides a third anchor key generation method.
  • the AUSF is the first communication device in the claims
  • the AMF or the SEAF is the second communication device in the claims
  • the ARPF is the third communication device in the claims.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier includes ANT and SNT.
  • the AMF (or SEAF) sends the terminal identifier and the indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an intermediate key according to the secret key CK and the integrity keys IK and ANT.
  • the manner in which the ARPF generates the intermediate key according to the key generation algorithm may include the following:
  • ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • ARPF generates an intermediate key according to the following key generation algorithm:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the ARPF sends an intermediate key to the AUSF. Accordingly, the AUSF receives the intermediate key transmitted by the ARPF.
  • the AUSF generates an anchor key according to the intermediate key.
  • the manner in which the AUSF generates the anchor key according to the intermediate key is:
  • AUSF generates EMSK' based on intermediate key generation.
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • AUSF generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,SNT);
  • the anchor key is the anchor key
  • the SNT is the carrier type identifier
  • the manner in which the AUSF generates the anchor key according to the intermediate key is:
  • AUSF generates EMSK' based on intermediate key generation.
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • AUSF generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,ANT);
  • the anchor key is the anchor key
  • the ANT is the access type identifier
  • anchor key can also be generated by EMSK' and other parameters, and is not limited to the indication identifier.
  • anchor key can also be generated by MSK'.
  • EMSK' generates an anchor key as an example.
  • the AUSF generates a K AMF key and/or a K SEAF key according to the anchor key.
  • the AUSF generates a K AMF key or a K SEAF key according to the following key generation algorithm.
  • K AMF KDF (anchor key, AMF ID);
  • K SEAF KDF (anchor key, SEAF ID);
  • the anchor key is the anchor key
  • the KDF is the key generation algorithm
  • the AMF ID is the identifier of the AMF
  • the SEAF ID is the identifier of the SEAF.
  • the AUSF sends the K AMF key and/or the K SEAF key to the AMF (or SEAF). Accordingly, the AMF (or SEAF) receives the K AMF key and/or the K SEAF key transmitted by the AUSF .
  • the AMF (or SEAF) generates a lower layer key based on the K AMF key or the K SEAF key.
  • the lower layer key is a key obtained by one or more derivation based on the K AMF key or the K SEAF key.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE generates an anchor key according to the root key, and then derives the lower layer key according to the anchor key.
  • the AUSF can also directly send the anchor key to the AMF, and then the AMF generates the lower layer key according to the anchor key and sends it to the AN.
  • the left side of the isolation line in FIG. 9 is a key structure corresponding to the UE and the 3GPP network
  • the right side of the isolation line in FIG. 9 is a key structure corresponding to the UE and the non-3GPP network, and the two can be well between the two. Isolation.
  • the AUSF can also generate two keys according to the intermediate key, which are MSK' and EMSK', respectively.
  • MSK' and EMSK' respectively take different parts of the generated key of PRF' (IK 2 '
  • anchor key KDF (MSK', ANT), which is the same as described above.
  • EMSK' is retained or deduced by AUSF and retained for subsequent expansion.
  • the embodiment of the present application provides a fourth anchor key generation method.
  • the AUSF is the first communication device in the claim
  • the SEAF is the second communication device in claim 2
  • the ARPF is the third communication device in the claims.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, and in the embodiment, the number of AMFs is m, respectively named AMF_1 ⁇ AMF_m.
  • the method includes, but is not limited to, the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the AN sends a terminal identifier and an indication identifier to the AMF_1 to the AMF_m.
  • AMF_1 to AMF_m receive the terminal identifier and the indication identifier sent by the AN.
  • AMF_1 to AMF_m send the terminal identifier and the indication identifier to the SEAF.
  • the SEAF receives the terminal identifier sent by the AMF_m and the indication identifier.
  • the SEAF sends the terminal identifier and the indication identifier to the AUSF.
  • the AUSF receives the terminal identifier sent by the SEAF and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an intermediate key according to the secret key CK and the integrity keys IK and ANT.
  • the ARPF sends an intermediate key to the AUSF. Accordingly, the AUSF receives the intermediate key transmitted by the ARPF.
  • the AUSF generates an anchor key according to the intermediate key.
  • the AUSF sends the anchor key to the SEAF. Accordingly, the SEAF receives the anchor key sent by the AUSF.
  • the SEAF generates K AMF_1 to K AMF_m according to the anchor key and the identifiers of AMF_1 to AMF_2, respectively.
  • the SEAF generates K AMF_1 to K AMF_m according to the following formulas, respectively.
  • K AMF_1 KDF (anchor key, AMF_1 ID);
  • K AMF_2 KDF (anchor key, AMF_2 ID);
  • K AMF_m KDF (anchor key, AMF_m ID);
  • the anchor key is the anchor key, and the AMF_1 ID to AMF_m ID are identifiers of AMF_1 to AMF_m, respectively.
  • the SEAF issues K AMF_1 to K AMF_m to AMF_1 to AMF_m respectively. Accordingly, AMF_1 to AMF_2 respectively receive K AMF_1 to K AMF_m transmitted by the SEAF .
  • AMF_1 to AMF_m generate a lower layer key based on K AMF_1 to K AMF_m , respectively.
  • the following describes an example in which the AMF_1 generates the lower layer key 1 based on K AMF_1 as an example.
  • AMF_1 generates a base station key K gNB1 in the 3GPP access mode, a 3GPP-NAS secret key K-3GPP NASenc1 , and a 3GPP-NAS integrity protection key K-3GPP NASint1 according to the following formula:
  • K gNB1 KDF (K AMF_1 , NAS Count1);
  • K-3GPP NASint KDF (K AMF_1 , NAS-int-alg, alg-ID);
  • K-3GPP NASenc KDF (K AMF_1 , NAS-enc-alg, alg-ID);
  • the NAS Count1 is the count value of the NAS message of the access point gNB via the 3GPP, and may be an uplink count value or a downlink count value
  • NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES'. , 'SNOW 3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to NAS messages, such as 'AES', 'SNOW 3G', 'ZUC' and so on.
  • the AMF sends the lower layer key to the AN.
  • the UE generates an anchor key according to the root key, and then derives the lower layer key according to the anchor key.
  • the left side of the isolation line in FIG. 12 is a key structure corresponding to the UE and the 3GPP network
  • the right side of the isolation line in FIG. 12 is a key structure corresponding to the UE and the non-3GPP network, and the two can be well isolated. .
  • FIG. 8, FIG. 9, and FIG. 11 are evolved based on the embodiment shown in FIG. 5.
  • FIG. 8 and FIG. 9 The parts which are different from the embodiment shown in FIG. 5, and the parts of the embodiment shown in FIG. 8, FIG. 9 and FIG. 11 which are the same as the embodiment shown in FIG. 5 can be seen in FIG. 5 and related contents, here. The details are not repeated.
  • the embodiment of the present application provides a fifth anchor key generation method.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the terminal identifier may be a fixed identifier, such as a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, and an international mobile device identifier (International).
  • MAC Media Access Control
  • IP Internet Protocol
  • International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • TMSI Temporary Mobile Subscriber Identity
  • GUI Globally Unique Temporary UE Identity
  • the UE may send at least one of an access network parameter, a registration type, a security parameter, a 5G network capability of the UE, a state of the PDU session, and the like to the AN.
  • the access network parameter is a parameter related to the service network, such as a frequency point of the access network, a temporary user identifier, and an NSSAI.
  • the registration type is a behavior that can indicate that the user is the first registration, the registration due to the movement, the periodic registration update, and the like to distinguish the user registration.
  • the security parameters are parameters related to authentication and integrity protection. .
  • NSSAI selects auxiliary information for the network slice.
  • the UE's 5G network capabilities may include configuration capabilities to support access to the network.
  • the PDU session is a service connection of the PDU between the UE and the data network, and the type may be an IP or Ethernet service connection.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier is used to indicate an access mode of the terminal.
  • the access mode of the terminal can be divided according to different divisions.
  • the division method of the access method may include an access type and an operator type.
  • the access type may be specifically classified into a 3GPP access type, a trusted non-3GPP access type, and an untrusted non-3GPP access type.
  • the carrier type can be specifically classified into an A carrier type or a B carrier type. It can be understood that there are more types of carrier types, which are only examples and are not specifically limited.
  • the division of the access mode and the type of the carrier may be as shown in Table 1. It is not limited to the above two types of division, and the basis for the division of the access method may be other types of division basis, for example, the type of the medium (wired access or wireless access), and the like, which is not specifically limited herein. Moreover, it is not limited to the access type and the operator type.
  • the basis of the access method may be one, three, four or more, that is, the interface may be connected from more dimensions or less.
  • the entry method is divided.
  • the indication identifier may be carried in the access network parameter.
  • the indication identifier may be any one of the following manners: the indication identifier may be a network access identifier (NAI), and is used to simultaneously indicate an access type and an operator type.
  • NAI network access identifier
  • the indication identifier may include an access type identifier and an operator type identifier, where the access type identifier is used to indicate the access type, and the operator type identifier is used to indicate the operator type. It is to be understood that the above examples are by way of example only and are not specifically limited.
  • the network access identifier may be SN Identity
  • the Access Network Identity is defined in the non-3GPP network when it is 4G. It is also possible to upgrade the SN Identity or Access Network Identity mode to indicate an access type of an operator.
  • the access type identifier specifically indicates that the access type is a 3GPP access type, a trusted non-3GPP access type, and a non-trusted non-3GPP access type.
  • the access type identifier Access Network Type can be directly "3GPP network", “Trusted Non-3GPP network”, “Untrusted Non-3GPP network” string, or only "3GPP network” and “Non-3GPP” Network” string and so on.
  • the carrier type identifier may include two parts, one part is used to indicate an operator, and another part is used to indicate a specific access type.
  • the operator type identifier may indicate LTE access for China Mobile or WLAN access for China Unicom.
  • the combination of SN Identity and Access Network Identity can be used as the carrier type identifier; it is also possible to include only the operator's distinction, such as China Mobile, China Unicom, China Telecom, and so on.
  • the identity is only an operator type identity.
  • the identity is only an access type identity.
  • the AMF (or SEAF) sends the terminal identifier and the indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an anchor key according to the secret key CK, the integrity key IK, and the indication identifier.
  • the manner in which the ARPF generates the anchor key may include the following:
  • ARPF generates an anchor key according to the following formula:
  • the anchor key is the anchor key
  • the KDF is the key generation algorithm
  • the SQN is the latest serial number
  • the NAI is the indication identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous.
  • f3, f4 and f5 are generation algorithms. The meaning is an exclusive OR operation.
  • ARPF generates an anchor key according to the following formula:
  • the anchor key is the anchor key
  • the KDF is a key generation algorithm
  • the SQN is the latest serial number
  • the ANT is the access type identifier
  • the SNT is the carrier type identifier
  • CK is the initial secret key.
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is the random number
  • f3, f4 and f5 are the generation algorithms.
  • the meaning is an exclusive OR operation.
  • the SQN may be the latest sequence number generated by the AuC, and the AuC sends the SQN to the ARPF after generating the SQN.
  • RAND may be a random number generated by AuC, and after generating RAND, AuC sends RAND to the ARPF.
  • the SQN and the RAND may also be generated by the other communication devices in the network architecture and sent to the ARPF.
  • the SQN and the RAND may be generated by the ARPF itself, which is not specifically limited herein.
  • CK, IK, and AK may also be generated by other communication devices in the network architecture and sent to the ARPF. Even CK, IK, and AK may be generated by the ARPF itself, which is not specifically limited herein. .
  • the ARPF sends an anchor key to the AUSF. Accordingly, the AUSF receives the anchor key transmitted by the ARPF.
  • AUSF generates K amf /K seaf according to the anchor key.
  • the AUSF generates K amf /K seaf according to the following formula:
  • K amf KDF (anchor key, AMF ID);
  • K seaf KDF(anchor key, SEAF ID);
  • the anchor key is the anchor key
  • the KDF is the key generation algorithm
  • the AMF ID is the identifier of the AMF
  • the SEAF ID is the identifier of the SEAF.
  • the identifier of the AMF may be the MAC address or IP address of the AMF, etc.
  • the identifier of the SEAF may be the MAC address or IP address of the SEAF, and the like.
  • AUSF sends K amf /K seaf to AMF (or SEAF). Accordingly, the AMF (or SEAF) receives the K amf /K seaf sent by the AUSF .
  • AMF (or SEAF) generates a lower layer key based on K amf /K seaf .
  • the lower layer key is a key obtained by performing one or more derivation based on the anchor key.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE derives the lower layer key by itself according to the CK, IK, and the indication identifier. It can be understood that the process of the UE deriving the lower layer key is substantially similar to the above process, and the description will not be repeated here.
  • the AUSF can also directly send the anchor key to the AMF, and then the AMF will generate the lower layer key according to the anchor key and send it to the AN.
  • the steps 409 to 411 are different.
  • the following describes the 3GPP access mode and the non-3GPP access mode in the access mode as an example.
  • the steps 409 to 411 can be replaced by the following steps 4111 and 4117.
  • AMF (or SEAF) generates a base station key K gNB according to K amf1 /K seaf1 , a 3GPP-NAS secret key K-3GPP NASenc , and a 3GPP-NAS integrity protection key K-3GPP NASint .
  • the AMF (or SEAF) generates a base station key K gNB in the 3GPP access mode, a 3GPP-NAS secret key K-3GPP NASenc , and a 3GPP-NAS integrity protection key K-3GPP NASint according to the following formula: :
  • K gNB KDF (K amf1 and / or K seaf1 , NAS Count1);
  • K-3GPP NASint KDF (K amf1 and / or K seaf1 , NAS-int-alg, alg-ID);
  • K-3GPP NASenc KDF (K amf1 and / or K seaf1 , NAS-enc-alg, alg-ID);
  • the NAS Count1 is the count value of the NAS message of the access point gNB via the 3GPP, and may be an uplink count value or a downlink count value
  • NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES'. , 'SNOW3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to the NAS message, such as
  • the AMF (or SEAF) transmits the base station key K gNB to the AN.
  • the AN receives the base station key K gNB transmitted by the AMF (or SEAF).
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the base station key K gNB .
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the following formula:
  • K UPenc KDF (K gNB , UP-enc-alg, alg-ID);
  • K UPin KDF(K gNB , UP-int-alg, alg-ID);
  • K RRCenc KDFK gNB , RRC-enc-alg, alg-ID);
  • K RRCint KDF(K gNB , RRC-int-alg, alg-ID);
  • KDF is a key generation algorithm
  • K gNB is a base station key
  • alg-ID is an algorithm identifier
  • UP-enc-alg UP-int-alg
  • RRC-enc-alg RRC-int-alg
  • RRC-int-alg The algorithm identification definition table in 4G shown in Table 2.
  • the UE derives the anchor key according to the CK, IK, and the indication identifier, and then derives the user plane confidentiality key K UPenc , the user plane integrity key K UPint , and the control plane confidentiality key according to the anchor key.
  • K RRCenc control plane integrity key K RRCint .
  • steps 409 to 411 can be replaced by the following steps 4112 to 4116.
  • AMF (or SEAF) generates an access point key K N3IWF according to the anchor key anchor key 2, a non-3GPP-NAS secret key K-N3GPP NASenc , and a non-3GPP-NAS integrity protection key K-N3GPP NASint .
  • the AMF (or SEAF) generates the access point key K N3IWF in the non-3GPP access mode, the non-3GPP-NAS secret key K-N3GPP NASenc , and the non-3GPP-NAS integrity protection according to the following formula.
  • Key K-N3GPP NASint is the access point key K N3IWF in the non-3GPP access mode, the non-3GPP-NAS secret key K-N3GPP NASenc , and the non-3GPP-NAS integrity protection according to the following formula.
  • Key K-N3GPP NASint Key K-N3GPP NASint :
  • K N3IWF KDF (K amf2 and / or K seaf2 , NAS Count2);
  • K-N3GPP NASint KDF (K amf2 and / or K seaf2 , NAS-int-alg, alg-ID);
  • K-N3GPP NASenc KDF (K amf2 and / or K seaf2 , NAS-enc-alg, alg-ID);
  • the NAS Count2 is the count value of the NAS message of the non-3GPP access point N3IWF, which may be an uplink count value or a downlink count value
  • the NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES. ', 'SNOW 3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to NAS messages, such as 'AES', 'SNOW 3G', 'ZUC' and so on.
  • the AMF (or SEAF) sends the access point key K N3IWF to the AN.
  • the AN correspondingly receives the access point key K N3IWF transmitted by the AMF (or SEAF).
  • the UE derives the anchor key by itself according to the CK, IK, and the indication identifier, and then derives the access point key K N3IWF according to the anchor key.
  • the key generation algorithm in the embodiment shown in FIG. 13 is not limited to the KDF algorithm.
  • the key generation algorithm may also be other algorithms, such as the Trunc algorithm: taking a low-level screenshot algorithm; other HASH algorithms. Etc., the application is not specifically limited.
  • the arguments of the key generation algorithm may also include other parameters, including, for example, NSSAI, random numbers, random values, sequence codes, registration types, number of access layer messages, security algorithm identification, security identification, and SQN.
  • the length of the AK and the length corresponding to the parameter used to generate the key, etc. may be used as an argument of the key generation algorithm in an actual application.
  • a key schema as shown in FIG. 15 is generated.
  • the left side of the isolation line in FIG. 15 is a key structure generated by specifically executing the flow shown in FIG. 14A.
  • the right side of the isolation line in FIG. 15 is a key structure generated by specifically executing the flow shown in FIG. 14B. It is well isolated between the two.
  • the embodiment of the present application provides a sixth anchor key generation method.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the terminal identifier may be a fixed identifier, such as a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, and an international mobile device identifier (International).
  • MAC Media Access Control
  • IP Internet Protocol
  • International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • TMSI Temporary Mobile Subscriber Identity
  • GUI Globally Unique Temporary UE Identity
  • the UE may send at least one of an access network parameter, a registration type, a security parameter, a 5G network capability of the UE, a state of the PDU session, and the like to the AN.
  • the access network parameter is a parameter related to the service network, such as a frequency point of the access network, a temporary user identifier, and an NSSAI.
  • the registration type is a behavior that can indicate that the user is the first registration, the registration due to the movement, the periodic registration update, and the like to distinguish the user registration.
  • the security parameters are parameters related to authentication and integrity protection.
  • NSSAI selects auxiliary information for the network slice.
  • the UE's 5G network capabilities may include configuration capabilities to support access to the network.
  • the PDU session is a service connection of the PDU between the UE and the data network, and the type may be an IP or Ethernet service connection.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier is used to indicate an access mode of the terminal.
  • the access mode of the terminal can be divided according to different divisions.
  • the division method of the access method may include an access type and an operator type.
  • the access type may be specifically classified into a 3GPP access type, a trusted non-3GPP access type, and an untrusted non-3GPP access type.
  • the carrier type can be specifically classified into an A carrier type or a B carrier type. It can be understood that there are more types of carrier types, which are only examples and are not specifically limited.
  • the division of the access mode and the type of the carrier may be as shown in Table 1. It is not limited to the above two types of division, and the basis for the division of the access method may be other types of division basis, for example, the type of the medium (wired access or wireless access), and the like, which is not specifically limited herein. Moreover, it is not limited to the access type and the operator type.
  • the basis of the access method may be one, three, four or more, that is, the interface may be connected from more dimensions or less.
  • the entry method is divided.
  • the indication identifier may be carried in the access network parameter.
  • the indication identifier may include an access type identifier and an operator type identifier, where the access type identifier is used to indicate the access type, and the operator type identifier is used to indicate the operator type. It is to be understood that the above examples are by way of example only and are not specifically limited.
  • the access type identifier specifically indicates that the access type is a 3GPP access type, a trusted non-3GPP access type, and a non-trusted non-3GPP access type.
  • the access type identifier Access Network Type can be directly "3GPP network", “Trusted Non-3GPP network”, “Untrusted Non-3GPP network” string, or only "3GPP network” and “Non-3GPP” Network” string and so on.
  • the carrier type identifier may include two parts, one part is used to indicate an operator, and another part is used to indicate a specific access type.
  • the operator type identifier may indicate LTE access for China Mobile or WLAN access for China Unicom.
  • the combination of SN Identity and Access Network Identity can be used as the carrier type identifier; it is also possible to include only the operator's distinction, such as China Mobile, China Unicom, China Telecom, and so on.
  • the identity is only an operator type identity.
  • the identity is only an access type identity.
  • the AMF (or SEAF) sends the terminal identifier and the indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates a shared key according to the secret key CK and the integrity key IK and the indication identifier.
  • the manner in which the ARPF generates the shared key may include the following:
  • ARPF generates a shared key shared key according to the following formula:
  • KDF is the key generation algorithm
  • SQN is the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3( RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • ARPF generates a shared key shared key according to the following formula:
  • KDF is the key generation algorithm
  • SQN is the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3 ( RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the SQN may be the latest sequence number generated by the AuC, and the AuC sends the SQN to the ARPF after generating the SQN.
  • RAND may be a random number generated by AuC, and after generating RAND, AuC sends RAND to the ARPF.
  • the SQN and the RAND may also be generated by the other communication devices in the network architecture and sent to the ARPF.
  • the SQN and the RAND may be generated by the ARPF itself, which is not specifically limited herein.
  • CK, IK, and AK may also be generated by other communication devices in the network architecture and sent to the ARPF. Even CK, IK, and AK may be generated by the ARPF itself, which is not specifically limited herein. .
  • the ARPF sends a shared key to the AUSF. Accordingly, the AUSF receives the shared key transmitted by the ARPF.
  • the AUSF sends a shared key. Accordingly, the AMF (or SEAF) receives the shared key transmitted by the AUSF.
  • AMF (or SEAF) generates an anchor key based on the shared key.
  • the manner in which the AMF generates the anchor key according to the shared key is:
  • Anchor key KDF(shared key,SNT);
  • the anchor key is the anchor key
  • the KDF is a key generation algorithm
  • the SNT is the carrier type identifier
  • the manner in which the AMF generates the anchor key according to the shared key is:
  • Anchor key KDF(shared key,ANT);
  • the anchor key is the anchor key
  • the KDF is a key generation algorithm
  • the ANT is the access type identifier
  • AMF (or SEAF) generates a lower layer key based on the anchor key.
  • the lower layer key is a key obtained by performing one or more derivation based on the anchor key.
  • the AMF (or SEAF)
  • the key K amf / K seaf key generation process with the lower key process shown in FIG 6A and 6B is substantially the same, specifically see Figure 6A and 6B and related content, this The details are not repeated here.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE generates a lower layer key according to AK, IK, SNT, and ANT. It can be understood that the process of the UE deriving the lower layer key is substantially similar to the above process, and the description will not be repeated here.
  • the steps 509 to 511 are different.
  • the following describes the 3GPP access mode and the non-3GPP access mode in the access mode as an example.
  • the steps 509 to 511 can be replaced by the following steps 5111 and 5117.
  • the AMF (or SEAF) generates a base station key K gNB according to the anchor key 1 , a 3GPP-NAS secret key K-3GPP NASenc , and a 3GPP-NAS integrity protection key K-3GPP NASint .
  • the AMF (or SEAF) generates a base station key K gNB in the 3GPP access mode, a 3GPP-NAS secret key K-3GPP NASenc , and a 3GPP-NAS integrity protection key K-3GPP NASint according to the following formula: :
  • K gNB KDF (anchor key 1, NAS Count1)
  • K-3GPP NASint KDF (anchor key 1, NAS-int-alg, alg-ID);
  • K-3GPP NASenc KDF (anchor key 1, NAS-enc-alg, alg-ID);
  • the NAS Count1 is the count value of the NAS message of the access point gNB via the 3GPP, and may be an uplink count value or a downlink count value
  • NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES'. , 'SNOW3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to the NAS message, such as
  • the AMF (or SEAF) transmits the base station key K gNB to the AN.
  • the AN receives the base station key K gNB transmitted by the AMF (or SEAF).
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the base station key K gNB .
  • the AN generates a user plane secret key K UPenc , a user plane integrity key K UPint , a control plane secret key K RRCenc , and a control plane integrity key K RRCint according to the following formula:
  • K UPenc KDF (K gNB , UP-enc-alg, alg-ID);
  • K UPin KDF(K gNB , UP-int-alg, alg-ID);
  • K RRCenc KDFK gNB , RRC-enc-alg, alg-ID);
  • K RRCint KDF(K gNB , RRC-int-alg, alg-ID);
  • KDF is a key generation algorithm
  • K gNB is a base station key
  • alg-ID is an algorithm identifier
  • UP-enc-alg UP-int-alg
  • RRC-enc-alg RRC-int-alg
  • RRC-int-alg The algorithm identification definition table in 4G shown in Table 2.
  • the UE generates an anchor key according to the AK, IK, SNT and ANT, and then derives the user plane secret key K UPenc , the user plane integrity key K UPint , and the control plane confidentiality according to the anchor key.
  • K RRCenc control plane integrity key K RRCint .
  • steps 509 to 511 can be replaced by the following steps 5112 and 5116.
  • AMF (or SEAF) generates an access point key K N3IWF according to an anchor key anchor 2, a non-3GPP-NAS secret key K-N3GPP NASenc , and a non-3GPP-NAS integrity protection key K-N3GPP NASint .
  • the AMF (or SEAF) generates the access point key K N3IWF in the non-3GPP access mode, the non-3GPP-NAS secret key K-N3GPP NASenc , and the non-3GPP-NAS integrity protection according to the following formula.
  • Key K-N3GPP NASint is the access point key K N3IWF in the non-3GPP access mode, the non-3GPP-NAS secret key K-N3GPP NASenc , and the non-3GPP-NAS integrity protection according to the following formula.
  • Key K-N3GPP NASint Key K-N3GPP NASint :
  • K N3IWF KDF (anchor key 2, NAS Count2)
  • K-N3GPP NASint KDF (anchor key 2, NAS-int-alg, alg-ID);
  • K-N3GPP NASenc KDF (anchor key 2, NAS-enc-alg, alg-ID);
  • the NAS Count2 is the count value of the NAS message of the non-3GPP access point N3IWF, which may be an uplink count value or a downlink count value
  • the NAS-int-alg is an integrity algorithm corresponding to the NAS message, such as 'AES. ', 'SNOW 3G', 'ZUC', etc.
  • alg-ID is the identifier of the algorithm
  • NAS-enc-alg is the confidentiality algorithm corresponding to NAS messages, such as 'AES', 'SNOW 3G', 'ZUC' and so on.
  • the AMF (or SEAF) sends the access point key K N3IWF to the AN.
  • the AN correspondingly receives the access point key K N3IWF transmitted by the AMF (or SEAF).
  • the UE generates an anchor key according to the AK, IK, SNT, and ANT, and then derives the access point key K N3IWF according to the anchor key.
  • the key generation algorithm in the embodiment shown in FIG. 16 is not limited to the KDF algorithm.
  • the key generation algorithm may also be other algorithms, such as the Trunc algorithm: taking a low-level screenshot algorithm; other HASH algorithms. Etc., the application is not specifically limited.
  • the argument of the key generation algorithm may also include other parameters, for example, including NSSAI, random number, random number, sequence code, registration type, access layer message number, security algorithm identifier, security identifier, SQN.
  • the length of the AK and the length corresponding to the parameter used to generate the key, etc. may be used as an argument of the key generation algorithm in an actual application.
  • a key schema as shown in Fig. 18 is generated.
  • the left side of the isolation line in FIG. 18 is a key structure generated by specifically executing the flow shown in FIG. 17A.
  • the right side of the isolation line in FIG. 18 is a key structure generated by specifically executing the process shown in FIG. 17B. It is well isolated between the two.
  • the embodiment of the present application provides a seventh anchor key generation method.
  • the method can be implemented based on the network architecture shown in FIG. 3 and FIG. 4, including but not limited to the following steps.
  • the UE sends a terminal identifier to the AN.
  • the AN receives the terminal identifier sent by the UE.
  • the terminal identifier may be a fixed identifier, such as a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, and an international mobile device identifier (International).
  • MAC Media Access Control
  • IP Internet Protocol
  • International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • TMSI Temporary Mobile Subscriber Identity
  • GUI Globally Unique Temporary UE Identity
  • the UE may send at least one of an access network parameter, a registration type, a security parameter, a 5G network capability of the UE, a state of the PDU session, and the like to the AN.
  • the access network parameter is a parameter related to the service network, such as a frequency point of the access network, a temporary user identifier, and an NSSAI.
  • the registration type is a behavior that can indicate that the user is the first registration, the registration due to the movement, the periodic registration update, and the like to distinguish the user registration.
  • the security parameters are parameters related to authentication and integrity protection.
  • NSSAI selects auxiliary information for the network slice.
  • the UE's 5G network capabilities may include configuration capabilities to support access to the network.
  • the PDU session is a service connection of the PDU between the UE and the data network, and the type may be an IP or Ethernet service connection.
  • the AN sends a terminal identifier and an indication identifier to the AMF (or SEAF).
  • the AMF or SEAF
  • the indication identifier is used to indicate an access mode of the terminal.
  • the access mode of the terminal can be divided according to different divisions.
  • the division of the access method may include an access type and an operator type.
  • the access type may be specifically classified into a 3GPP access type, a trusted non-3GPP access type, and an untrusted non-3GPP access type.
  • the carrier type can be specifically classified into an A carrier type or a B carrier type. It can be understood that there are more types of carrier types, which are only examples and are not specifically limited.
  • the division of the access mode and the type of the carrier may be as shown in Table 1. It is not limited to the above two types of division, and the basis for the division of the access method may be other types of division basis, for example, the type of the medium (wired access or wireless access), and the like, which is not specifically limited herein. Moreover, it is not limited to the access type and the operator type.
  • the basis of the access method may be one, three, four or more, that is, the interface may be connected from more dimensions or less.
  • the entry method is divided.
  • the indication identifier may be carried in the access network parameter.
  • the indication identifier may include an access type identifier and an operator type identifier, where the access type identifier is used to indicate the access type, and the operator type identifier is used to indicate the operator type. It is to be understood that the above examples are by way of example only and are not specifically limited.
  • the access type identifier specifically indicates that the access type is a 3GPP access type, a trusted non-3GPP access type, and a non-trusted non-3GPP access type.
  • the access type identifier Access Network Type can be directly "3GPP network", “Trusted Non-3GPP network”, “Untrusted Non-3GPP network” string, or only "3GPP network” and “Non-3GPP” Network” string and so on.
  • the carrier type identifier may include two parts, one part is used to indicate an operator, and another part is used to indicate a specific access type.
  • the operator type identifier may indicate LTE access for China Mobile or WLAN access for China Unicom.
  • the combination of SN Identity and Access Network Identity can be used as the carrier type identifier; it is also possible to include only the operator's distinction, such as China Mobile, China Unicom, China Telecom, and so on.
  • the identity is only an operator type identity.
  • the identity is only an access type identity.
  • the AMF (or SEAF) sends the terminal identifier and the indication identifier to the AUSF. Accordingly, the AUSF receives the terminal identifier transmitted by the AMF (or SEAF) and the indication identifier.
  • the AUSF sends the terminal identifier and the indication identifier to the ARPF.
  • the ARPF receives the terminal identifier sent by the AUSF and the indication identifier.
  • the ARPF generates an anchor key according to the root key K and the indication identifier.
  • the manner in which the ARPF generates the anchor key according to the key generation algorithm may include the following:
  • the ARPF when the indication identifier is NAI, the ARPF generates an anchor key anchor key according to the following key generation algorithm:
  • the KDF is a key generation algorithm
  • the SQN is the latest serial number
  • the NAI is the indication identifier
  • K is the root key
  • AK is the anonymous key
  • AK f5(RAND)
  • RAND is a random number
  • f3 is a generation algorithm.
  • the meaning is an exclusive OR operation.
  • the ARPF when the indication identifier includes the access type identifier and the operator type identifier, the ARPF generates an anchor key anchor key according to the following key generation algorithm:
  • the KDF is a key generation algorithm
  • the SQN is the latest serial number
  • the ANT is the access type identifier
  • the SNT is the carrier type identifier
  • AK is an anonymous key
  • AK f5(RAND)
  • RAND is a random number.
  • f5 is the generation algorithm
  • the meaning is an exclusive OR operation.
  • the SQN may be the latest sequence number generated by the AuC, and the AuC sends the SQN to the ARPF after generating the SQN.
  • RAND may be a random number generated by AuC, and after generating RAND, AuC sends RAND to the ARPF.
  • the SQN and the RAND may also be generated by the other communication devices in the network architecture and sent to the ARPF.
  • the SQN and the RAND may be generated by the ARPF itself, which is not specifically limited herein.
  • the AK may also be an ARPF that is generated and sent by other communication devices in the network architecture. Even the AK may be generated by the ARPF itself, which is not specifically limited herein.
  • the ARPF sends an anchor key to the AUSF. Accordingly, the AUSF receives the anchor key transmitted by the ARPF.
  • the AUSF generates a K amf key and/or a K seaf key according to the anchor key.
  • the AUSF generates a K amf key and/or a K seaf key according to the following formula:
  • K amf KDF (anchor key, AMF ID);
  • K seaf KDF(anchor key, SEAF ID);
  • the anchor key is the anchor key
  • the KDF is the key generation algorithm
  • the AMF ID is the identifier of the AMF
  • the SEAF ID is the identifier of the SEAF.
  • AUSF sent to AMF / SEAF K amf key / K seaf key. Accordingly, the AMF/SEAF receives the K amf key/K seaf key transmitted by the AUSF .
  • the lower layer key is a key obtained by performing one or more derivation based on the anchor key.
  • the AMF (or SEAF) sends the lower layer key to the AN.
  • the UE generates a lower layer key according to K, SNT, and ANT. It can be understood that the process of the UE deriving the lower layer key is substantially similar to the above process, and the description will not be repeated here.
  • the AUSF can also directly send the anchor key to the AMF, and then the AMF generates the lower layer key according to the anchor key and sends it to the AN.
  • the key generation algorithm in the embodiment shown in FIG. 19 is not limited to the KDF algorithm.
  • the key generation algorithm may also be other algorithms, such as the Trunc algorithm: taking a low-level screenshot algorithm; other HASH algorithms. Etc., the application is not specifically limited.
  • the argument of the key generation algorithm may also include other parameters, for example, including NSSAI, random number, random number, sequence code, registration type, access layer message number, security algorithm identifier, security identifier, SQN.
  • the length of the AK and the length corresponding to the parameter used to generate the key, etc. may be used as an argument of the key generation algorithm in an actual application.
  • the left side of the isolation line in FIG. 20 is a key structure generated by the process of performing the 3GPP access mode
  • the right side of the isolation line in FIG. 20 is a key structure generated by the process of performing the non-3GPP access mode. The two can be well isolated.
  • an implementation of retaining a key in an AUSF is disclosed.
  • the reserved key can be abbreviated as K left .
  • the SEAF belongs to the security network element of the service network
  • the AUSF belongs to the security network element of the home network, especially in the In the scenario of roaming, if the authentication occurs between the UE and the security network element of the home network, the UE and the AUSF may generate a final protection key based on the reserved key after the authentication, thereby implementing end-to-end between the UE and the home network. End security or higher security.
  • the reserved key may be generated by the ARPF and then sent to the AUSF, or the reserved key may be directly generated by the AUSF.
  • the ARPF may generate the reserved key K left according to parameters such as IK, CK, SQN, AK, service network identifier, key feature identifier, RAND or nonce.
  • SQN is the latest serial number
  • CK is the initial confidentiality key
  • IK is the initial integrity key
  • AK is the anonymous key
  • RAND and Nonce can be regarded as random numbers
  • the key feature identifier can be: KEYLEFT, AUSFKEY, KEYAUSF, KEYSEAF, SEAFKEY and other similar strings.
  • the generation function KDF involved in the following may also be a pesudo random function (PRF) or the like. See the definition in section 3.4.1 of RFC5448 for details.
  • PRF pesudo random function
  • K left KDF (IK, CK, SQN ⁇ AK, optional parameters); KDF is a key generation algorithm.
  • the optional parameters are one or more of an authentication method name, a service network identifier, a key feature identifier, RAND, and a nonce.
  • the authentication method name may be an identifier of an identification authentication method such as 'EAP-AKA'', '5G-EAP', 'EPS-AKA*';
  • ARPF can generate K left according to parameters such as K asme* , authentication method name, service network identifier, network type identifier, key signature, RAND, nonce.
  • K asme* is a key similar to K asme in 4G LTE.
  • K left KDF (K asme* , the first parameter group);
  • the first parameter group is one or more of an authentication method name, a service network identifier, a network type identifier, a key feature identifier, a RAND, and a nonce.
  • ARPF may generate K left according to one or more parameters of IK', CK', authentication method name, service network identifier, key feature identifier, AUSF ID, RAND, nonce, and the like.
  • K left KDF (IK', CK', service network identification, key feature identification, second parameter group).
  • the second parameter group is one or more of an authentication method name, an AUSF ID, a RAND, a nonce, and the like.
  • AUSF can generate K left according to parameters such as EMSK and MSK.
  • EMSK is an extended primary session key. See RFC5448.
  • MSK Primary session key. See RFC5448.
  • K left trunc (EMSK or MSK), the meaning of the formula is to intercept some bits directly by intercepting EMSK or MSK as K left , where trunc is used to truncate the value.
  • trunc(number) represents a truncated number
  • trunc(date) represents a truncated date.
  • N2 can be a negative number, indicating truncation before the decimal point. Note that TRUNC truncation is not rounded.
  • K left KDF (EMSK or MSK, key feature identifier, third parameter group)
  • the third parameter group is one or more of a service network identifier, an authentication method name, a random number, and the like.
  • K left can also be understood as EMSK.
  • the anchor key can be a key generated based on K left .
  • the anchor key may be generated according to parameters such as K left , service network identifier, key feature identifier, RAND or nonce.
  • step 1114 of FIG. 6B, step 4112 of FIG. 14B, and step 5112 of FIG. 17B may be replaced by:
  • the AMF (or SEAF) generates an access point key K N3IWF in a non-3GPP access mode according to parameters such as K amf2 , K seaf2 , NAS Count2, NAS connection distinguishing identifier, and N3IWF identifier.
  • K N3IWF KDF (K amf2 and / or K seaf2 , NAS Count2);
  • the NAS Count2 is a count value of the NAS message via the non-3GPP access point N3IWF, and may be an uplink count value or a downlink count value.
  • a and / or B represent three possibilities: A, B or (A and B).
  • K N3IWF KDF (K amf2 and / or K seaf2 , NAS Count2) contains three possibilities:
  • K N3IWF KDF (K amf2 , NAS Count2)
  • K N3IWF KDF (K seaf2 , NAS Count2)
  • K N3IWF KDF (K amf2 , K seaf2 , NAS Count2).
  • FIG. 21 is a schematic structural diagram of a communication device.
  • the communication device includes: a receiving module 710, a sending module 720, and a generating module 730. The description is expanded below.
  • the receiving module 710 is configured to receive a second communication device to send an indication identifier, where the indication identifier is used to indicate an access mode of the terminal.
  • the sending module 720 is configured to send the indication identifier to a third communications device.
  • the receiving module 710 is configured to receive an intermediate key returned by the third communications device, where the intermediate key is generated according to the indication identifier;
  • the generating module 730 is configured to generate an anchor key according to the intermediate key, where the anchor key corresponds to an access mode of the terminal;
  • the sending module 720 is configured to send the anchor key to the second communications device, so that the second communications device derives a lower layer key for the access mode according to the anchor key.
  • an embodiment of the present invention further provides a device (shown in FIG. 22) for implementing the method described in the foregoing embodiments of FIG. 5 to FIG.
  • the apparatus 800 includes a transmitter 803, a receiver 804, a memory 802, and a processor 801 coupled to the memory 802 (the number of the processors 801 may be one or more, and one processor in FIG. example).
  • the transmitter 803, the receiver 804, the memory 802, and the processor 801 may be connected by a bus or other means (in FIG. 20, for example, by connection via the bus 805).
  • the transmitter 803 is for transmitting data to the outside
  • the receiver 804 is for receiving data from the outside.
  • the memory 802 is used to store program code
  • the processor 801 is used to call and run program code stored in the memory 802.
  • the second communication device Receiving, by the receiver 804, the second communication device to send the indication identifier, where the indication identifier is used to indicate an access mode of the terminal;
  • the transmitter 803 Sending, by the transmitter 803, the indication identifier to the third communication device; the first communication device receives an intermediate key returned by the third communication device, where the intermediate key is generated according to the indication identifier;
  • the processor 801 generates an anchor key according to the intermediate key, where the anchor key corresponds to an access mode of the terminal;
  • the anchor key is sent by the transmitter 803 to the second communication device, so that the second communication device derives the lower layer key for the access mode according to the anchor key.
  • the access mode is distinguished according to at least one of an access type and an operator type.
  • the processor 801 generates an anchor key according to the following formula.
  • Anchor key KDF(IK 1 '
  • the anchor key is the anchor key
  • (IK 1 ', CK 1 ') is the intermediate key
  • IK 1 ' is an intermediate integrity key
  • CK 1 ' is an intermediate secret key
  • the processor 801 can generate the intermediate key according to at least two ways:
  • the intermediate key is generated by the processor 801 according to the following formula:
  • the access type identifier is used to indicate the access type, and the carrier type identifier is used to indicate the type of the operator;
  • (CK 1 ', IK 1 ') is the intermediate key
  • IK 1 ' is the intermediate integrity key
  • KDF is the key generation algorithm
  • SQN is the latest serial number
  • ANT is the access type identifier
  • SNT is the operator Type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is the random number
  • f3, f4 and f5 are generation algorithms
  • the meaning is an exclusive OR operation.
  • the intermediate key is generated by the processor 801 according to the following formula:
  • (CK 1 ', IK 1 ') is the intermediate key
  • CK 1 ' is the intermediate secret key
  • IK 1 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • NAI is the indication identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK F5 (RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the processor 801 generates the intermediate key according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • ANT is the access type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the processor 801 generates EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK 2 ' is the intermediate integrity key
  • CK 2 ' is the intermediate secret key
  • the processor 801 generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,SNT);
  • the anchor key is the anchor key
  • the SNT is the carrier type identifier
  • the processor 801 generates the intermediate key according to the following formula:
  • CK 2 ', IK 2 ' is the intermediate key
  • CK 2 ' is the intermediate secret key
  • IK 2 ' is the intermediate integrity key
  • KDF is a key generation algorithm
  • SQN For the latest serial number
  • SNT is the carrier type identifier
  • CK is the initial secret key
  • IK is the initial integrity key
  • AK is the anonymous key
  • CK f3(RAND)
  • IK f4(RAND)
  • AK f5(RAND)
  • RAND is a random number
  • f3, f4 and f5 are generation algorithms.
  • the meaning is an exclusive OR operation.
  • the processor 801 generates EMSK' according to the following formula,
  • EMSK' PRF'(IK 2 '
  • EMSK' is the extended primary session key
  • (IK 2 ', CK 2 ') is the intermediate key
  • IK2' is the intermediate integrity key
  • CK2' is the intermediate secret key
  • means the level Union, indicating that the strings on both sides of the symbol are connected;
  • the processor 801 generates an anchor key according to the following formula.
  • Anchor key KDF(EMSK’,ANT);
  • the anchor key is the anchor key
  • the ANT is the access type identifier
  • embodiments of the present invention can be provided as a method, system, or computer program product.
  • the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware.
  • the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种锚密钥生成方法，设备以及系统。其中，所述方法包括：第一通讯设备接收第二通讯设备发送指示标识，其中，指示标识用于指示终端的接入方式；第一通讯设备向第三通讯设备发送指示标识；第一通讯设备接收第三通讯设备返回的中间密钥，其中，中间密钥是根据指示标识生成的；第一通讯设备根据中间密钥生成锚密钥，其中，锚密钥对应终端的接入方式；第一通讯设备将锚密钥发送给第二通讯设备，以供第二通讯设备根据锚密钥为接入方式推衍下层密钥。上述方法能够为不同的接入方式生成统一的锚密钥，并且实现了将不同接入方式的锚密钥，以及基于锚密钥生成的下层密钥进行隔离。

Description

锚密钥生成方法、设备以及系统 技术领域
本发明涉及通信领域，尤其涉及一种锚密钥生成方法、设备以及系统。
背景技术
密钥是加密运算和解密运算的关键，也是密码系统的关键，所以，在信息安全系统中，密钥协商是认证流程中的重要一环。在现有的4G系统中，密钥协商过程如图1所示，该流程的执行需要的网元包括用户设备(User Equipment，UE)、基站(eNodeB)、移动性管理实体(MobilityManagement Entity，MME)、归属签约用户服务器(Home Subscriber Server，HSS)以及鉴权中心(AUthentication Center，AuC)等，执行流程大致如下：
步骤1：AuC根据根密钥K生成完整性密钥IK以及保密性密钥CK，并将完整性密钥IK以及保密性密钥CK发送给HSS。相应地，HSS接收AuC发送的完整性密钥IK以及保密性密钥CK。
步骤2：HSS根据完整性密钥IK以及保密性密钥CK生成中间密钥K ASME，并将中间密钥K ASME发送给MME。相应地，MME接收HSS发送的中间密钥K ASME。
步骤3：MME根据中间密钥K ASME生成用于对非接入层(Non Access Stratum，NAS)消息进行保密性保护的NAS完整性密钥K NASenc，以及，进行完整性保护的NAS完整性保护密钥K NASint。
步骤4：MME根据中间密钥K ASME生成基站密钥K eNB，并将基站密钥K eNB发送给eNodeB。相应地，eNodeB接收MME发送的基站密钥K eNB。
步骤5：eNodeB根据基站密钥K eNB分别生成用于对用户面数据的保密性进行保护的用户面保密性密钥K UPenc，用于对用户面数据的完整性进行保护的用户面完整性密钥K UPint，用于对控制面数据的保密性进行保护的控制面保密性密钥K RRCenc，用于对控制面数据的完整性进行保护的控制面完整性密钥K RRCint。
步骤6：UE根据根密钥K自行生成完整性密钥IK、保密性密钥CK、中间密钥K ASME、用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
经过图1所述的密钥协商流程之后，4G系统中将生成如图2所示的密钥架构。
可以理解，图1是4G应用场景中，终端通过第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)的接入方式接入到核心网的流程中的密钥协商流程。为了适应各种应用场景的要求，终端可以通过各种不同的接入方式接入到核心网，例如，3GPP接入方式、可靠的非3GPP接入方式，非可靠的3GPP接入方式等等，在不同的接入方式中，密钥协商流程也各不相同。为了能够兼容各种接入方式，在5G标准中，明确规定了需要在不同的接入方式的密钥协商流程中生成一个统一的锚密钥(anchor key)。但是，如何生成一个统一的锚密钥是本领域的技术人员需要解决的问题。
发明内容
本申请实施例提供了一种锚密钥生成方法、设备以及系统，能够为不同的接入方式生成统一的锚密钥，并且实现了将不同接入方式的锚密钥，以及基于锚密钥生成的下层密钥进行隔离。
第一方面，提供了一种锚密钥生成方法，包括：第一通讯设备接收第二通讯设备发送指示标识，其中，所述指示标识用于指示终端的接入方式；所述第一通讯设备向第三通讯设备发送所述指示标识；所述第一通讯设备接收所述第三通讯设备返回的中间密钥，其中，所述中间密钥是根据所述指示标识生成的；所述第一通讯设备根据所述中间密钥生成锚密钥，其中，所述锚密钥对应所述终端的接入方式；所述第一通讯设备将所述锚密钥发送给所述第二通讯设备，以供所述第二通讯设备根据所述锚密钥为所述接入方式推衍下层密钥。
在一些可能的实施方式中，所述接入方式是根据接入类型以及运营商类型中的至少一个进行区分的。
在一些可能的实施方式中，所述第一通讯设备根据所述中间密钥生成锚密钥具体为：
所述第一通讯设备根据以下公式生成锚密钥，
anchor key＝KDF(IK 1’||CK 1’)
其中，anchor key为所述锚密钥，(IK 1’，CK 1’)为所述中间钥匙，IK 1’为中间完整性密钥，CK 1’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来。
所述第一通讯设备至少可以根据以下两种方式生成中间密钥：
当所述指示标识包括接入类型标识以及运营商类型标识时，所述中间密钥是根据以下公式生成的：
Figure PCTCN2018084416-appb-000001
其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型；(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000002
的含义为异或运算。
当所述指示标识是NAI时，所述中间密钥是根据以下公式生成的：
Figure PCTCN2018084416-appb-000003
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000004
的含义为异或运算。
在一些可能的实施方式中，所述第一通讯设备根据以下公式生成所述中间密钥：
Figure PCTCN2018084416-appb-000005
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000006
的含义为异或运算。
所述第一通讯设备根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性 密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
所述第一通讯设备根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，SNT)；
其中，anchor key为所述锚密钥，SNT为所述运营商类型标识。
在一些可能的实施方式中，所述第一通讯设备根据以下公式生成所述中间密钥：
Figure PCTCN2018084416-appb-000007
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000008
的含义为异或运算。
所述第一通讯设备根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK2’为中间完整性密钥，CK2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
所述第一通讯设备根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，ANT)；
其中，anchor key为所述锚密钥，ANT为所述接入类型标识。
第二方面，提供了一种通讯设备，包括：接收模块、发送模块以及生成模块，所述接收模块用于接收第二通讯设备发送指示标识，其中，所述指示标识用于指示终端的接入方式；所述发送模块用于向第三通讯设备发送所述指示标识；所述接收模块用于接收所述第三通讯设备返回的中间密钥，其中，所述中间密钥是根据所述指示标识生成的；所述生成模块用于根据所述中间密钥生成锚密钥，其中，所述锚密钥对应所述终端的接入方式；所述发送模块用于将所述锚密钥发送给所述第二通讯设备，以供所述第二通讯设备根据所述锚密钥为所述接入方式推衍下层密钥。
在一些可能的实施方式中，所述接入方式是根据接入类型以及运营商类型中的至少一个进行区分的。
在一些可能的实施方式中，所述生成模块用于根据以下公式生成锚密钥，
anchor key＝KDF(IK 1’||CK 1’)
其中，anchor key为所述锚密钥，(IK 1’，CK 1’)为所述中间钥匙，IK 1’为中间完整性密钥，CK 1’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来。
所述第一通讯设备至少可以根据以下两种方式生成中间密钥：
当所述指示标识包括接入类型标识以及运营商类型标识时，所述生成模块用于根据以下公式生成的：
Figure PCTCN2018084416-appb-000009
其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥， CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000010
的含义为异或运算。
当所述指示标识是NAI时，所述生成模块用于根据以下公式生成的：
Figure PCTCN2018084416-appb-000011
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000012
的含义为异或运算。
在一些可能的实施方式中，生成模块用于根据以下公式生成的：
Figure PCTCN2018084416-appb-000013
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000014
的含义为异或运算。
所述生成模块用于根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
所述生成模块用于根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，SNT)；
其中，anchor key为所述锚密钥，SNT为所述运营商类型标识。
在一些可能的实施方式中，所述生成模块用于根据以下公式生成的：
Figure PCTCN2018084416-appb-000015
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000016
的含义为异或运算。
所述生成模块用于根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK2’为中间完整性密钥，CK2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
所述生成模块用于根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，ANT)；
其中，anchor key为所述锚密钥，ANT为所述接入类型标识。
第三方面，提供了一种通讯设备，包括：存储器以及与所述存储器耦合的处理器、通信模块，其中：所述通信模块用于发送或者接收外部发送的数据，所述存储器用于存储第一方面描述的方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行第一 方面描述的方法。
第四方面，提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第五方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第六方面，提供了一种通信系统，包括相互连接的接入和移动性控制功能网元、会话管理网元、认证服务器以及统一数据管理网元，其中，所述认证服务器为如权利要求第二方面或者第三方面任一项所述的认证服务器。
附图说明
为了更清楚地说明本发明实施例或背景技术中的技术方案，下面将对本发明实施例或背景技术中所需要使用的附图进行说明。
图1是现有技术提供的一种4G应用场景中通过3GPP接入方式中密钥协商的流程示意图；
图2是图1所示的密钥协商的流程的密钥架构图；
图3是本申请实施例涉及的通过3GPP接入方式接入5G核心网的网络架构图；
图4是本申请实施例涉及的通过非3GPP接入方式接入5G核心网的网络架构图；
图5是本申请实施例提供的第一种锚密钥生成方法的交互图；
图6A至6B分别是图5所示的锚密钥生成方法中采用3GPP方式接入以及非3GPP方式接入时的具体交互图；
图7是使用图5所示的锚密钥生成方法得到的密钥架构图；
图8是本申请实施例提供的第二种锚密钥生成方法的交互图；
图9是本申请实施例提供的第三种锚密钥生成方法的交互图；
图10是使用图9所示的锚密钥生成方法得到的密钥架构图；
图11是本申请实施例提供的第四种锚密钥生成方法的交互图；
图12是使用图11所示的锚密钥生成方法得到的密钥架构图；
图13是是本申请实施例提供的第五种锚密钥生成方法的交互图；
图14A至14B分别是图13所示的锚密钥生成方法中采用3GPP方式接入以及非3GPP方式接入时的具体交互图；
图15是使用图13所示的锚密钥生成方法得到的密钥架构图；
图16是本申请实施例提供的第六种锚密钥生成方法的交互图；
图17A至17B分别是图16所示的锚密钥生成方法中采用3GPP方式接入以及非3GPP方式接入时的具体交互图；
图18是使用图16所示的锚密钥生成方法得到的密钥架构图；
图19是本申请实施例提供的第七种锚密钥生成方法的交互图；
图20是使用图19所示的锚密钥生成方法得到的密钥架构图；
图21是本申请实施例提供的一种通讯设备的结构示意图；
图22是本申请实施例提供的另一种通讯设备的结构示意图。
具体实施方式
下面结合附图以及具体的实施例对本申请的多个实施例分别进行介绍。
图3是本申请实施例涉及的一种网络架构图，其中，这种网络架构主要适用于通过3GPP方式接入5G核心网的场景。图4是本申请实施例涉及的另一种网络架构图，其中，这种网络架构主要适用于通过非3GPP方式接入5G核心网的场景。图3和图4所示的网络架构均包括与密钥协商相关的网元：终端(Terminal)、接入节点(Access node，AN)(即图2中的N3IWF)、接入和移动性控制功能网元(Access and Mobility Function，AMF)、会话管理网元(Session Management Function，SMF)、认证服务器(Authentication Server Function，AUSF)以及统一数据管理网元(Unified Data Management，UDM)。
需要说明的是，AMF中可以部署安全锚点(Security Anchor Function，SEAF)，UDM中可以部署认证信任状存储和操作功能网元(Authentication Credential Repository and Processing Function，ARPF)。当然，SEAF也可以不部署在AMF中，而是SEAF与AMF两者单独部署。类似地，ARPF也可以不部署在UDM中，而是ARPF与UDM两者单独部署。
下面分别对密钥协商相关的网元(终端、AN、AMF、SMF、AUSF以及UDM)分别进行简单的介绍。
终端，具体可以是UE(User Equipment)，通信设备(Communication Device)物联网(Internet of Things，IoT)设备中的任意一种。其中，用户设备可以是智能手机(smart phone)、智能手表(smart watch)，智能平板等等。通信设备可以是服务器、网关(Gateway，GW)、基站以及控制器等等。物联网设备可以是传感器，电表以及水表等等。
AN，可以是无线接入点，例如：基站、Wi-Fi接入点(Wireless Fidelity，无线保真)以及蓝牙接入点等等，也可以是有线接入点，例如：网关，调制解调器，光纤接入，IP接入等等。
AMF，负责接入控制和移动性管理，也是非接入层(Non-access stratum，NAS)信令的转发和处理节点。
SMF，用于执行会话、切片、流flow或者承载bearer的建立和管理，后续可以称执行该会话管理网元的功能的物理实体为会话管理设备或者SM。其中切片、流flow或者承载bearer的建立和管理由移动性管理网元负责。
AUSF，负责密钥的生成、管理和协商。AUSF可以作为一个独立的逻辑功能实体单独部署，也可以集合在移动性管理(Mobility Management)网元，也就是AMF、会话管理网元SMF等设备中,可能是EPS AKA也可能是EAP AKA’的认证节点，或者其他认证协议的节点。
UDM，统一的数据管理，主要包括两部分，一部分为业务或者应用的前端，一部分为用户数据库。具体来说，包括信任状的处理、位置管理、签约数据管理、策略控制等，同时也包括这些相关处理的信息存储。
SEAF，作为安全认证功能的节点，可能是EPS AKA也可能是EAP AKA’的认证节点，或者其他认证协议的节点；例如认证过程是EPS AKA的情况下，SEAF将接收中间密钥Kasme。
ARPF，存储安全信任状并使用安全信任状执行安全相关的操作，比如生成密钥，存储安全的文件。ARPF应该部署在一个物理安全的位置，同时可以与AUSF交互。在实际部署 中，ARPF可能是UDM的一个模块或者作为一个单独的网络实体并与UDM部署在一起。
需要说明的是，图3以及图4中体现的是各个网元之间的逻辑关系，在实际中，有些网元可以单独部署，也可以两两或多个网元集成部署在一个实体中。
为了能够为不同的接入方式生成统一的锚密钥，本申请实施例提供了一种锚密钥生成方法。上述方法除了能够生成统一的锚密钥之外，还能够将不同接入方式的锚密钥以及基于锚密钥生成的下层密钥进行隔离。
如图5所示，本申请实施例提供了第一种锚密钥生成方法。在本实施例中，AUSF即为权利要求中的第一通讯设备，AMF或者SEAF即为权利要求中的第二通讯设备，ARPF即为权利要求中的第三通讯设备。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
101：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
在本申请实施例中，终端标识可以是固定不变的标识，例如，媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)等等，也可以是临时分配的标识，例如，临时移动用户标识符(TemporaryMobileSubscriberIdentity，TMSI)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等。
可以理解，除了终端标识之外，UE还可以将接入网参数、注册类型、安全参数、UE的5G网络能力，PDU session的状态等至少一种发送给AN。其中，接入网参数为可能为接入网的频点，临时用户标识，NSSAI等与服务网络相关的参数。注册类型为可以表明用户是初次注册、由于移动引起的注册、周期性注册更新等区分用户注册的行为。安全参数为认证和完整性保护相关的参数。NSSAI为网络切片选择辅助信息。UE的5G网络能力可能包括支持接入该网络的配置能力。PDU session为UE和数据网络之间的PDU的业务连接，类型可能为IP、以太网的业务连接。
102：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF)接收AN发送的终端标识以及指示标识。
在本申请实施例中，指示标识用于指示终端的接入方式。在5G标准中，可以按照不同的划分依据对终端的接入方式进行划分。例如，接入方式的划分依据可以包括接入类型以及运营商类型。其中，接入类型具体可以分为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。运营商类型具体可以分为A运营商类型或者B运营商类型。可以理解，运营商类型还可以有更多的类型，此处仅作为示例，不作具体限定。
以划分依据包括接入类型以及运营商类型为例，所述接入方式的划分可以如表1所示：
表1 接入方式表
Figure PCTCN2018084416-appb-000017
需要说明的，不限于上述两种划分依据，接入方式的划分依据还可以是其他种类的划分依据，例如，介质类型(有线接入或者无线接入)等等，此处不作具体限定。并且，不限于接入类型以及运营商类型两种划分依据，接入方式的划分依据还可以是一种、三种、四种或者更多，即，可以从更多维度或者更少维度对接入方式进行划分。例如,只从3GPP接入类型和非3GPP接入类型这个维度进行区分。
所述指示标识可以是携带在上述接入网参数中。所述指示标识可以是下述的任意一种方式：所述指示标识可以是网络接入标识(Network Access Identifier，NAI)，用于同时指示接入类型以及运营商类型。或者，所述指示标识可以包括接入类型标识以及运营商类型标识，其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型。可以理解，上述例子仅作为举例，不构成具体限定。
在一些可能的实现方式中，网络接入标识可以为SN Identity|Access Network Identity，即可以特定表示某运营商下的某种接入，如中国联通的WLAN接入等等，此处的SN Identity为4G网络中的定义，Access Network Identity为4G时非3GPP网络中的定义。也可能将SN Identity或者Access Network Identity的方式进行升级，使其能够表示某运营商的某种接入类型。
在一些可能的实现方式中，接入类型标识具体指示所述接入类型为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。例如，接入类型标识Access Network Type(ANT)可以直接为“3GPP network”，“Trusted Non-3GPP network”，“Untrusted Non-3GPP network”字符串，或者仅为“3GPP network”和“Non-3GPP network”字符串等等。
在一些可能的实现方式中，所述运营商类型标识可以包括两部分，一部分用于指示运营商，另一部分用于指示具体接入类型。例如，运营商类型标识可以指示为中国移动的LTE接入或者中国联通的WLAN接入。在具体应用中，可以将SN Identity和Access Network Identity的结合以作为运营商类型标识。也有可能只包括运营商的区分，比如中国移动、中国联通、中国电信等等。
在一些可能的实现方式中，有可能指示标识只是运营商类型标识。
在一些可能的实现方式中，有可能指示标识只是接入类型标识。
103：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
104：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
105：ARPF根据保密性密钥CK以及完整性密钥IK以及指示标识生成中间密钥。
在本申请实施例中，ARPF根据密钥生成算法生成中间密钥的方式可以包括以下几种：
在第一种方式中，当指示标识为NAI时，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000018
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000019
的含义为异或运算。
在第二种方式中，当指示标识包括接入类型标识以及运营商类型标识时，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000020
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000021
的含义为异或运算。
在一些可能的实施方式中，SQN可以是AuC生成的最新序列号，AuC在生成SQN之后，将SQN发送给所述ARPF。类似地，RAND可以是AuC生成的随机数，AuC在生成RAND之后，将RAND发送给所述ARPF。除了上述的方式之外，SQN以及RAND也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，SQN以及RAND可以是所述ARPF自己生成的，此处不作具体限定。
在一些可能的实施方式中，CK可以是AuC根据公式CK＝f3(RAND)生成的，IK可以是AuC根据公式IK＝f4(RAND)生成的，AK可以是AuC根据公式AK＝f5(RAND)生成的。除了上述的方式之外，CK、IK以及AK也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，CK、IK以及AK可以是所述ARPF自己生成的，此处不作具体限定。
106：ARPF向AUSF发送中间密钥。相应地，AUSF接收ARPF发送的中间密钥。
107：AUSF根据中间密钥生成锚密钥。
在本申请实施例中，AUSF根据以下公式生成锚密钥，
anchor key＝KDF(IK 1’||CK 1’)
其中，anchor key为所述锚密钥，(IK 1’，CK 1’)为所述中间密钥，IK 1’为中间完整性密钥，CK 1’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来。AUSF还可能根据以下公式生成锚密钥：anchor key＝KDF(IK 1’，CK 1’)
108：AUSF将锚密钥发送给AMF(或者SEAF)。相应地，AMF(或者SEAF)接收AUSF发送的锚密钥。
109：AMF(或者SEAF)基于锚密钥生成下层密钥。其中，下层密钥为基于锚密钥进行一次或者多次推衍得到的密钥。
在本申请实施例中，锚密钥是根据中间密钥生成的，而中间密钥是根据指示标识生成的，所以，锚密钥与指示标识的关系可以表示为anchor key＝f(ANT，SNT)或者anchor key＝f(NAI)。其中，f表示为指示标识与锚密钥之间的映射函数，NAI为所述网络接入标识，ANT为所述接入类型标识，SNT为所述运营商类型标识。根据锚密钥与指示标识的映射关系可知，当指示标识不同时，锚密钥的值也自然不同。也就是说，当接入方式不同时，锚密钥的值也不同，即对不同接入方式的锚密钥进行了隔离。此外，AMF(或者SEAF)基于不同 接入方式的锚密钥分别推延不同接入方式的下层密钥，从而实现了对下层密钥的隔离。即，假设接入方式为A接入方式，计算得到的锚密钥为a锚密钥，接入方式为B接入方式时，计算得到的锚密钥为b锚密钥，则可以根据a锚密钥推衍A接入方式的下层密钥，根据b锚密钥推衍B接入方式的下层密钥。
110：AMF(或者SEAF)向AN发送下层密钥。
111：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍得到下层密钥。可以理解，UE推衍下层密钥的过程与上述过程大体类似，此处将不再展开描述。
可以理解，在步骤108中，AUSF还可以根据锚密钥生成K AMF密钥或者K SEAF密钥，然后发送给AMF或者SEAF，而不是将锚密钥发送给AMF或者SEAF，因此在步骤109中，AMF或者SEAF基于K AMF密钥或者K SEAF密钥生成下层密钥。
需要说明的是，当接入方式不同时，步骤109至步骤111是不相同的，下面分别以接入方式为3GPP接入方式以及非3GPP接入方式为例进行详细介绍。
如图6A所示，假设接入方式为3GPP接入方式，锚密钥为anchor key 1，则步骤109至步骤111可以用下述的步骤1111ˉ1117步骤代替。
1111：AMF(或者SEAF)根据以下公式生成下层密钥K amf1密钥和/或K seaf1密钥：
K amf1＝KDF(anchor key1，AMF ID)；
K seaf1＝KDF(anchor key1，SEAF ID)；
其中，anchor key1为所述3GPP接入方式下的锚密钥，KDF为密钥生成算法，AMF ID为AMF的标识，SEAF ID为SEAF的标识。AMF的标识可以是AMF的MAC地址或者IP地址等等，SEAF的标识可以是SEAF的MAC地址或者IP地址等等。
1113：AMF(或者SEAF)再根据以下公式生成3GPP接入方式下的基站密钥K gNB、3GPP-NAS保密性密钥K-3GPP NASenc，以及，3GPP-NAS完整性保护密钥K-3GPP NASint：
K gNB＝KDF(K amf1和/或Kseaf1，NAS Count1)；
K-3GPP NASint＝KDF(K amf1和/或Kseaf1，NAS-int-alg，alg-ID)；
K-3GPP NASenc＝KDF(K amf1和/或Kseaf1，NAS-enc-alg，alg-ID)；
其中，NAS Count1为经由3GPP的接入点gNB的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’,’SNOW 3G’,’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如‘AES’,’SNOW 3G’,’ZUC’等。
1115：AMF(或者SEAF)将基站密钥K gNB发送给AN。此时，AN相应接收AMF(或者SEAF)发送的基站密钥K gNB。
1117：AN根据基站密钥K gNB生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
在本申请实施例中，AN根据如下公式分别生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint：
K UPenc＝KDF(K gNB，UP-enc-alg,alg-ID)；
K UPin＝KDF(K gNB，UP-int-alg,alg-ID)；
K RRCenc＝KDFK gNB，RRC-enc-alg,alg-ID)；
K RRCint＝KDF(K gNB，RRC-int-alg,alg-ID)；
其中，KDF为密钥生成算法，K gNB为基站密钥，alg-ID为算法标识，NAS-int-alg、NAS-enc-alg、UP-enc-alg、UP-int-alg、RRC-enc-alg以及RRC-int-alg的定义可以参考表2所示的4G中的算法标识定义表格，具体如下：
表2 算法标识定义表格
算法标识(Algorithm distinguisher) 值(Value)
NAS-enc-alg 0x01
NAS-int-alg 0x02
RRC-enc-alg 0x03
RRC-int-alg 0x04
UP-enc-alg 0x05
UP-int-alg 0x06
1119：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
可以理解，AMF(或者SEAF)在接收到锚密钥之后，也可以不根据锚密钥推衍K amf1密钥和/或K seaf1密钥，再根据K amf1密钥和/或K seaf1密钥推衍基站密钥K gNB、3GPP-NAS保密性密钥K-3GPPNAS enc，以及，3GPP-NAS完整性保护密钥K-3GPPNAS int，而是，直接根据锚密钥推衍基站密钥K gNB、3GPP-NAS保密性密钥K-3GPPNAS enc，以及，3GPP-NAS完整性保护密钥K-3GPPNAS int。
如图6B所示，假设接入方式为非3GPP接入方式，锚密钥为anchor key 2，则步骤110至步骤112可以用下述的步骤1112ˉ1116步骤代替。
1112：AMF(或者SEAF)根据以下公式生成K amf2密钥和/或K seaf2密钥：
K amf2＝KDF(anchor key2，AMF ID)；
K seaf2＝KDF(anchor key2，SEAF ID)；
其中，anchor key2为所述非3GPP接入方式下的锚密钥，KDF为密钥生成算法，AMF ID为AMF的标识，SEAF ID为SEAF的标识。
1114：AMF(或者SEAF)再根据以下公式生成非3GPP接入方式下的接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint：
K N3IWF＝KDF(K amf2和/或K seaf2，NAS Count2)；
K-N3GPP NASint＝KDF(K amf2和/或K seaf2，NAS-int-alg，alg-ID)；
K-N3GPP NASenc＝KDF(K amf2和/或K seaf2，NAS-enc-alg，alg-ID)；
其中，NAS Count2为经由非3GPP的接入点N3IWF的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS消息对应的完整性算法，比如‘AES’,’SNOW 3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如‘AES’，’SNOW 3G’，’ZUC’等。
1116：AMF(或者SEAF)将接入点密钥K N3IWF发送给AN。此时，AN相应接收AMF(或者 SEAF)发送的接入点密钥K N3IWF。
1118：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍接入点密钥K N3IWF。
同样的，可以理解，在步骤1114中，AMF(或者SEAF)不是接收AUSF发送的锚密钥，而是AUSF根据锚密钥生成的K AMF密钥或者K SEAF密钥。
可以理解，图5所示实施例中的密钥生成算法不限于KDF算法，在实际应用中，密钥生成算法还可以是其它的算法，比如Trunc算法：取低位的截图算法；其他的HASH算法等，本申请不作具体限定。而且，密钥生成算法的自变量也可以包括其他的参数，例如，包括NSSAI(Network Slice Selection Association Information)、随机数(Random number)、随机数值(Number used once，Nonce)、序列码(Sequence Number)、注册类型(registration type)、接入层消息数量(NAS Count)、安全算法标识、安全标识、SQN
Figure PCTCN2018084416-appb-000022
AK的长度以及生成密钥所用的参数对应的长度等等，在实际应用中，可以根据需要从中选择中的一个或者多个参数作为所述密钥生成算法的自变量。
可以理解，AMF(或者SEAF)在接收到锚密钥之后，也可以不根据锚密钥推衍K amf1密钥和/或K seaf1密钥，再根据K amf1密钥和/或K seaf1密钥推衍接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint，而是，直接根据锚密钥推衍接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint。
执行图5所示的锚密钥生成方法之后，将生成如图7所示的密钥架构。其中，图7中隔离线左边的为具体执行图6A所示的流程所生成的密钥架构，图7图中隔离线右边的为具体执行图6B所示的流程所生成的密钥架构，两者之间能够很好地进行隔离。
如图8所示，本申请实施例提供了第二种锚密钥生成方法。在本实施例中，AUSF即为权利要求中的第一通讯设备为，AMF或者SEAF即为权利要求中的第二通讯设备，ARPF即为权利要求中的第三通讯设备。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
201：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
202：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF)接收AN发送的终端标识以及指示标识。其中，指示标识包括ANT以及SNT。
203：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
204：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
205：ARPF根据保密性密钥CK以及完整性密钥IK以及ANT生成中间密钥。
在本申请实施例中，ARPF根据密钥生成算法生成中间密钥的方式可以包括以下几种：
在第一种方式中，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000023
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间 完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000024
的含义为异或运算。
在第二种方式中，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000025
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000026
的含义为异或运算。
206：ARPF向AUSF发送中间密钥。相应地，AUSF接收ARPF发送的中间密钥。
207：AUSF根据中间密钥生成锚密钥。
针对步骤205中的第一种生成中间密钥的方式，AUSF根据中间密钥生成锚密钥的方式为：
首先，AUSF根据中间密钥生成生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
然后，AUSF根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，SNT)；
其中，anchor key为所述锚密钥，SNT为所述运营商类型标识。
针对步骤205中的第二种生成中间密钥的方式，AUSF根据中间密钥生成锚密钥的方式为：
首先，AUSF根据中间密钥生成生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
然后，AUSF根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，ANT)；
其中，anchor key为所述锚密钥，ANT为所述接入类型标识。
也可以EMSK’和其他的参数生成anchor key，不限定于指示标识。
可以理解，该anchor key也可以由MSK’生成，此处仅以EMSK’生成anchor key为例。
208：AUSF将锚密钥发送给AMF(或者SEAF)。相应地，AMF(或者SEAF)接收AUSF发送的锚密钥。
209：AMF(或者SEAF)基于锚密钥生成下层密钥。其中，下层密钥为基于锚密钥进行一次或者多次推衍得到的密钥。
210：AMF(或者SEAF)向AN发送下层密钥。
211：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍得到下层密钥。
如图9所示，本申请实施例提供了第三种锚密钥生成方法。在本实施例中，AUSF即为权利要求中的第一通讯设备为，AMF或者SEAF即为权利要求中的第二通讯设备，ARPF即为权利要求中的第三通讯设备。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
221：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
222：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF)接收AN发送的终端标识以及指示标识。其中，指示标识包括ANT以及SNT。
223：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
224：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
225：ARPF根据保密性密钥CK以及完整性密钥IK以及ANT生成中间密钥。
在本申请实施例中，ARPF根据密钥生成算法生成中间密钥的方式可以包括以下几种：
在第一种方式中，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000027
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000028
的含义为异或运算。
在第二种方式中，ARPF根据下述密钥生成算法生成中间密钥：
Figure PCTCN2018084416-appb-000029
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000030
的含义为异或运算。
226：ARPF向AUSF发送中间密钥。相应地，AUSF接收ARPF发送的中间密钥。
227：AUSF根据中间密钥生成锚密钥。
针对步骤225中的第一种生成中间密钥的方式，AUSF根据中间密钥生成锚密钥的方式为：
首先，AUSF根据中间密钥生成生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
然后，AUSF根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，SNT)；
其中，anchor key为所述锚密钥，SNT为所述运营商类型标识。
针对步骤225中的第二种生成中间密钥的方式，AUSF根据中间密钥生成锚密钥的方式 为：
首先，AUSF根据中间密钥生成生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
然后，AUSF根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，ANT)；
其中，anchor key为所述锚密钥，ANT为所述接入类型标识。
可以理解，也可以EMSK’和其他的参数生成anchor key，不限定于指示标识。
可以理解，该anchor key也可以由MSK’生成，此处仅以EMSK’生成anchor key为例。
228：AUSF根据锚密钥生成K AMF密钥和/或K SEAF密钥。
在本申请实施例中，AUSF根据下述密钥生成算法生成K AMF密钥或者K SEAF密钥，
K AMF＝KDF(anchor key，AMF ID)；
K SEAF＝KDF(anchor key，SEAF ID)；
其中，anchor key为所述锚密钥，KDF为密钥生成算法，AMF ID为AMF的标识，SEAF ID为SEAF的标识。
229：AUSF将K AMF密钥和/或K SEAF密钥发送给AMF(或者SEAF)。相应地，AMF(或者SEAF)接收AUSF发送的K AMF密钥和/或K SEAF密钥。
230：AMF(或者SEAF)基于K AMF密钥或者K SEAF密钥生成下层密钥。其中，下层密钥为基于K AMF密钥或者K SEAF密钥进行一次或者多次推衍得到的密钥。
231：AMF(或者SEAF)向AN发送下层密钥。
232：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍得到下层密钥。
可以理解，AUSF在生成锚密钥之后，也可以直接将锚密钥发送给AMF，然后，AMF再根据锚密钥生成下层密钥，并发送给AN。
执行图9所示的锚密钥生成方法之后，将生成如图10所示的密钥架构。其中，图9中隔离线左边的为UE和3GPP网络所对应的密钥架构，图9图中隔离线右边的为UE和非3GPP网络所对应的密钥架构，两者之间能够很好地进行隔离。
可以理解，对步骤227，AUSF还可以根据中间密钥生成了2个密钥，分别是MSK’和EMSK’。其中MSK’和EMSK’分别取PRF’(IK 2’||CK 2’)的生成的密钥的不同部分，如MSK’取前512bits，EMSK’取后512bits。
然后，基于MSK’生成anchor key，即anchor key＝KDF(MSK’，ANT)，此处同上面的描述。
而EMSK’则被AUSF保留或推衍后被保留，用于后续扩展。
如图11所示，本申请实施例提供了第四种锚密钥生成方法。在本实施例中，AUSF即 为权利要求中的第一通讯设备为，SEAF即为权利要求2中的第二通讯设备，ARPF即为权利要求中的第三通讯设备。该方法可以基于图3以及图4所示的网络架构来实现，并且，在本实施例中，AMF的数量为m个，分别命名为AMF_1ˉAMF_m。该方法包括但不限于如下步骤。
301：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
302：AN向AMF_1至AMF_m发送终端标识以及指示标识。相应地，AMF_1至AMF_m接收AN发送的终端标识以及指示标识。
303：AMF_1至AMF_m向SEAF发送终端标识以及指示标识。相应地，SEAF接收AMF_m发送的终端标识以及指示标识。
304：SEAF向AUSF发送终端标识以及指示标识。相应地，AUSF接收SEAF发送的终端标识以及指示标识。
305：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
306：ARPF根据保密性密钥CK以及完整性密钥IK以及ANT生成中间密钥。
307：ARPF向AUSF发送中间密钥。相应地，AUSF接收ARPF发送的中间密钥。
308：AUSF根据中间密钥生成锚密钥。
309：AUSF将锚密钥发送给SEAF。相应地，SEAF接收AUSF发送的锚密钥。
310：SEAF根据锚密钥以及AMF_1至AMF_2的标识分别生成K AMF_1至K AMF_m。
在本申请实施例中，SEAF根据以下公式分别生成K AMF_1至K AMF_m，
K AMF_1＝KDF(anchor key，AMF_1 ID)；
K AMF_2＝KDF(anchor key，AMF_2 ID)；
……
K AMF_m＝KDF(anchor key，AMF_m ID)；
其中，anchor key为所述锚密钥，AMF_1 ID至AMF_m ID分别为AMF_1至AMF_m的标识。
311：SEAF分别向AMF_1至AMF_m下发K AMF_1至K AMF_m。相应地，AMF_1至AMF_2分别接收SEAF发送的K AMF_1至K AMF_m。
312：AMF_1至AMF_m分别基于K AMF_1至K AMF_m生成下层密钥。
在本申请实施例中，AMF_1基于K AMF_1生成下层密钥1；AMF_2基于K AMF_2生成下层密钥2；……；AMF_m基于K AMF_m生成下层密钥m。
下面将以AMF_1基于K AMF_1生成下层密钥1为例进行说明。
AMF_1根据以下公式生成3GPP接入方式下的基站密钥K gNB1、3GPP-NAS保密性密钥K-3GPP NASenc1，以及，3GPP-NAS完整性保护密钥K-3GPP NASint1：
K gNB1＝KDF(K AMF_1，NAS Count1)；
K-3GPP NASint＝KDF(K AMF_1，NAS-int-alg，alg-ID)；
K-3GPP NASenc＝KDF(K AMF_1，NAS-enc-alg，alg-ID)；
其中，NAS Count1为经由3GPP的接入点gNB的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’，’SNOW 3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如‘AES’，’SNOW 3G’，’ZUC’等。
313：AMF向AN发送下层密钥。
314：UE根据根密钥生成锚密钥，然后再根据锚密钥推衍得到下层密钥。
执行图11所示的锚密钥生成方法之后，将生成如图12所示的密钥架构。其中，图12中隔离线左边的为UE和3GPP网络对应的密钥架构，图12图中隔离线右边的为UE和非3GPP网络对应的密钥架构，两者之间能够很好地进行隔离。
可以理解，图8、图9以及图11所示的实施例是基于图5所示的实施例演变过来的，为了简便起见，图8、图9以及图11所示的实施例中只描述了与图5所示的实施例不相同的部分，而图8、图9以及图11所示的实施例中与图5所示的实施例相同的部分，可以参见图5以及相关内容，此处不再重复赘述。
如图13所示，本申请实施例提供了第五种锚密钥生成方法。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
401：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
在本申请实施例中，终端标识可以是固定不变的标识，例如，媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)等等，也可以是临时分配的标识，例如，临时移动用户标识符(TemporaryMobileSubscriberIdentity，TMSI)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等。
可以理解，除了终端标识之外，UE还可以将接入网参数、注册类型、安全参数、UE的5G网络能力，PDU session的状态等至少一种发送给AN。其中，接入网参数为可能为接入网的频点，临时用户标识，NSSAI等与服务网络相关的参数。注册类型为可以表明用户是初次注册、由于移动引起的注册、周期性注册更新等区分用户注册的行为。安全参数为认证和完整性保护相关的参数。。NSSAI为网络切片选择辅助信息。UE的5G网络能力可能包括支持接入该网络的配置能力。PDU session为UE和数据网络之间的PDU的业务连接，类型可能为IP、以太网的业务连接。
402：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF)接收AN发送的终端标识以及指示标识。
在本申请实施例中，指示标识用于指示终端的接入方式。在5G标准中，可以按照不同的划分依据对终端的接入方式进行划分。例如，接入方式的划分依据可以包括接入类型以及运营商类型。其中，接入类型具体可以分为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。运营商类型具体可以分为A运营商类型或者B运营商类型。 可以理解，运营商类型还可以有更多的类型，此处仅作为示例，不作具体限定。
以划分依据包括接入类型以及运营商类型为例，所述接入方式的划分可以如表1所示。需要说明的，不限于上述两种划分依据，接入方式的划分依据还可以是其他种类的划分依据，例如，介质类型(有线接入或者无线接入)等等，此处不作具体限定。并且，不限于接入类型以及运营商类型两种划分依据，接入方式的划分依据还可以是一种、三种、四种或者更多，即，可以从更多维度或者更少维度对接入方式进行划分。
所述指示标识可以是携带在上述接入网参数中。所述指示标识可以是下述的任意一种方式：所述指示标识可以是网络接入标识(Network Access Identifier，NAI)，用于同时指示接入类型以及运营商类型。或者，所述指示标识可以包括接入类型标识以及运营商类型标识，其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型。可以理解，上述例子仅作为举例，不构成具体限定。
在一些可能的实现方式中，网络接入标识可以为SN Identity|Access Network Identity，即可以特定表示某运营商下的某种接入，如中国联通的WLAN接入等等，此处的SN Identity为4G网络中的定义，Access Network Identity为4G时非3GPP网络中的定义。也可能将SN Identity或者Access Network Identity的方式进行升级，使其能够表示某运营商的某种接入类型。
在一些可能的实现方式中，接入类型标识具体指示所述接入类型为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。例如，接入类型标识Access Network Type(ANT)可以直接为“3GPP network”，“Trusted Non-3GPP network”，“Untrusted Non-3GPP network”字符串，或者仅为“3GPP network”和“Non-3GPP network”字符串等等。
在一些可能的实现方式中，所述运营商类型标识可以包括两部分，一部分用于指示运营商，另一部分用于指示具体接入类型。例如，运营商类型标识可以指示为中国移动的LTE接入或者中国联通的WLAN接入。在具体应用中，可以将SN Identity和Access Network Identity的结合以作为运营商类型标识；也有可能只包括运营商的区分，比如中国移动、中国联通、中国电信等等。
在一些可能的实现方式中，有可能指示标识只是运营商类型标识。
在一些可能的实现方式中，有可能指示标识只是接入类型标识。
403：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
404：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
405：ARPF根据保密性密钥CK、完整性密钥IK以及指示标识生成锚密钥。
在本申请实施例中，ARPF根据生成锚密钥的方式可以包括以下几种：
在第一种方式中，ARPF根据下述公式生成锚密钥：
Figure PCTCN2018084416-appb-000031
其中，anchor key为所述锚密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000032
的含义 为异或运算。
在第二种方式中，ARPF根据下述公式生成锚密钥：
Figure PCTCN2018084416-appb-000033
其中，anchor key为所述锚密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000034
的含义为异或运算。
在一些可能的实施方式中，SQN可以是AuC生成的最新序列号，AuC在生成SQN之后，将SQN发送给所述ARPF。类似地，RAND可以是AuC生成的随机数，AuC在生成RAND之后，将RAND发送给所述ARPF。除了上述的方式之外，SQN以及RAND也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，SQN以及RAND可以是所述ARPF自己生成的，此处不作具体限定。
在一些可能的实施方式中，CK可以是AuC根据公式CK＝f3(RAND)生成的，IK可以是AuC根据公式IK＝f4(RAND)生成的，AK可以是AuC根据公式AK＝f5(RAND)生成的。除了上述的方式之外，CK、IK以及AK也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，CK、IK以及AK可以是所述ARPF自己生成的，此处不作具体限定。
406：ARPF向AUSF发送锚密钥。相应地，AUSF接收ARPF发送的锚密钥。
407：AUSF根据锚密钥生成K amf/K seaf。
在本申请实施例中，AUSF根据以下公式生成K amf/K seaf：
K amf＝KDF(anchor key，AMF ID)；
K seaf＝KDF(anchor key，SEAF ID)；
其中，anchor key为所述锚密钥，KDF为密钥生成算法，AMF ID为AMF的标识，SEAF ID为SEAF的标识。AMF的标识可以是AMF的MAC地址或者IP地址等等，SEAF的标识可以是SEAF的MAC地址或者IP地址等等。
408：AUSF将K amf/K seaf发送给AMF(或者SEAF)。相应地，AMF(或者SEAF)接收AUSF发送的K amf/K seaf。
409：AMF(或者SEAF)基于K amf/K seaf生成下层密钥。其中，下层密钥为基于锚密钥进行一次或者多次推衍得到的密钥。
410：AMF(或者SEAF)向AN发送下层密钥。
411：UE根据CK、IK以及指示标识自行推衍生成下层密钥。可以理解，UE推衍下层密钥的过程与上述过程大体类似，此处将不再展开描述。
可以理解，AUSF在生成锚密钥之后，也可以直接将锚密钥发送给AMF，然后，AMF再将根据锚密钥生成下层密钥，并发送给AN。
需要说明的是，当接入方式不同时，步骤409至步骤411是不相同的，下面分别以接入方式为3GPP接入方式以及非3GPP接入方式为例进行详细介绍。
如图14A所示，假设接入方式为3GPP接入方式，锚密钥为anchor key 1，则步骤409至步骤411可以用下述的步骤4111ˉ4117步骤代替。
4111：AMF(或者SEAF)根据K amf1/K seaf1生成基站密钥K gNB，3GPP-NAS保密性密钥K-3GPP NASenc，3GPP-NAS完整性保护密钥K-3GPP NASint。
具体地，AMF(或者SEAF)根据以下公式生成3GPP接入方式下的基站密钥K gNB、3GPP-NAS保密性密钥K-3GPP NASenc，以及，3GPP-NAS完整性保护密钥K-3GPP NASint：
K gNB＝KDF(K amf1和/或K seaf1，NAS Count1)；
K-3GPP NASint＝KDF(K amf1和/或K seaf1，NAS-int-alg，alg-ID)；
K-3GPP NASenc＝KDF(K amf1和/或K seaf1，NAS-enc-alg，alg-ID)；
其中，NAS Count1为经由3GPP的接入点gNB的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’，’SNOW3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如
‘AES’，’SNOW 3G’，’ZUC’等。
4113：AMF(或者SEAF)将基站密钥K gNB发送给AN。此时，AN相应接收AMF(或者SEAF)发送的基站密钥K gNB。
4115：AN根据基站密钥K gNB生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
在本申请实施例中，AN根据如下公式分别生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint：
K UPenc＝KDF(K gNB，UP-enc-alg,alg-ID)；
K UPin＝KDF(K gNB，UP-int-alg,alg-ID)；
K RRCenc＝KDFK gNB，RRC-enc-alg,alg-ID)；
K RRCint＝KDF(K gNB，RRC-int-alg,alg-ID)；
其中，KDF为密钥生成算法，K gNB为基站密钥，alg-ID为算法标识，UP-enc-alg、UP-int-alg、RRC-enc-alg以及RRC-int-alg的定义可以参考表2所示的4G中的算法标识定义表格。
4117：UE根据CK、IK以及指示标识自行推衍锚密钥，然后，根据锚密钥自行推衍用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
如图14B所示，假设接入方式为非3GPP接入方式，锚密钥为anchor key 2，则步骤409至步骤411可以用下述的步骤4112ˉ4116步骤代替。
4112：AMF(或者SEAF)根据锚密钥anchor key 2生成接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint。
具体地，AMF(或者SEAF)再根据以下公式生成非3GPP接入方式下的接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint：
K N3IWF＝KDF(K amf2和/或K seaf2，NAS Count2)；
K-N3GPP NASint＝KDF(K amf2和/或K seaf2，NAS-int-alg，alg-ID)；
K-N3GPP NASenc＝KDF(K amf2和/或K seaf2，NAS-enc-alg，alg-ID)；
其中，NAS Count2为经由非3GPP的接入点N3IWF的NAS消息的计数值，可能为上行 计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’，’SNOW 3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如‘AES’，’SNOW 3G’，’ZUC’等。
4114：AMF(或者SEAF)将接入点密钥K N3IWF发送给AN。此时，AN相应接收AMF(或者SEAF)发送的接入点密钥K N3IWF。
4116、UE根据CK、IK以及指示标识自行推衍锚密钥，然后，根据锚密钥自行推衍接入点密钥K N3IWF。
可以理解，图13所示实施例中的密钥生成算法不限于KDF算法，在实际应用中，密钥生成算法还可以是其它的算法，比如Trunc算法：取低位的截图算法；其他的HASH算法等，本申请不作具体限定。而且，密钥生成算法的自变量也可以包括其他的参数，例如，包括NSSAI、随机数、随机数值、序列码、注册类型、接入层消息数量、安全算法标识、安全标识以及SQN
Figure PCTCN2018084416-appb-000035
AK的长度以及生成密钥所用的参数对应的长度等等，在实际应用中，可以根据需要从中选择中的一个或者多个参数作为所述密钥生成算法的自变量。
执行图13所示的锚密钥生成方法之后，将生成如图15所示的密钥架构。其中，图15中隔离线左边的为具体执行图14A所示的流程所生成的密钥架构，图15图中隔离线右边的为具体执行图14B所示的流程所生成的密钥架构，两者之间能够很好地进行隔离。
如图16所示，本申请实施例提供了第六种锚密钥生成方法。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
501：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
在本申请实施例中，终端标识可以是固定不变的标识，例如，媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)等等，也可以是临时分配的标识，例如，临时移动用户标识符(TemporaryMobileSubscriberIdentity，TMSI)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等。
可以理解，除了终端标识之外，UE还可以将接入网参数、注册类型、安全参数、UE的5G网络能力，PDU session的状态等至少一种发送给AN。其中，接入网参数为可能为接入网的频点，临时用户标识，NSSAI等与服务网络相关的参数。注册类型为可以表明用户是初次注册、由于移动引起的注册、周期性注册更新等区分用户注册的行为。安全参数为认证和完整性保护相关的参数。NSSAI为网络切片选择辅助信息。UE的5G网络能力可能包括支持接入该网络的配置能力。PDU session为UE和数据网络之间的PDU的业务连接，类型可能为IP、以太网的业务连接。
502：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF) 接收AN发送的终端标识以及指示标识。
在本申请实施例中，指示标识用于指示终端的接入方式。在5G标准中，可以按照不同的划分依据对终端的接入方式进行划分。例如，接入方式的划分依据可以包括接入类型以及运营商类型。其中，接入类型具体可以分为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。运营商类型具体可以分为A运营商类型或者B运营商类型。可以理解，运营商类型还可以有更多的类型，此处仅作为示例，不作具体限定。
以划分依据包括接入类型以及运营商类型为例，所述接入方式的划分可以如表1所示。需要说明的，不限于上述两种划分依据，接入方式的划分依据还可以是其他种类的划分依据，例如，介质类型(有线接入或者无线接入)等等，此处不作具体限定。并且，不限于接入类型以及运营商类型两种划分依据，接入方式的划分依据还可以是一种、三种、四种或者更多，即，可以从更多维度或者更少维度对接入方式进行划分。
所述指示标识可以是携带在上述接入网参数中。所述指示标识可以包括接入类型标识以及运营商类型标识，其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型。可以理解，上述例子仅作为举例，不构成具体限定。
在一些可能的实现方式中，接入类型标识具体指示所述接入类型为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。例如，接入类型标识Access Network Type(ANT)可以直接为“3GPP network”，“Trusted Non-3GPP network”，“Untrusted Non-3GPP network”字符串，或者仅为“3GPP network”和“Non-3GPP network”字符串等等。
在一些可能的实现方式中，所述运营商类型标识可以包括两部分，一部分用于指示运营商，另一部分用于指示具体接入类型。例如，运营商类型标识可以指示为中国移动的LTE接入或者中国联通的WLAN接入。在具体应用中，可以将SN Identity和Access Network Identity的结合以作为运营商类型标识；也有可能只包括运营商的区分，比如中国移动、中国联通、中国电信等等。
在一些可能的实现方式中，有可能指示标识只是运营商类型标识。
在一些可能的实现方式中，有可能指示标识只是接入类型标识。
503：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
504：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
505：ARPF根据保密性密钥CK以及完整性密钥IK以及指示标识生成共享密钥。
在本申请实施例中，ARPF生成共享密钥的方式可以包括以下几种：
在第一种方式中，ARPF根据以下公式生成共享密钥shared key：
Figure PCTCN2018084416-appb-000036
其中，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000037
的含义为异或运算。
在第二种方式中，ARPF根据以下公式生成共享密钥shared key：
Figure PCTCN2018084416-appb-000038
其中，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000039
的含义为异或运算。
在一些可能的实施方式中，SQN可以是AuC生成的最新序列号，AuC在生成SQN之后，将SQN发送给所述ARPF。类似地，RAND可以是AuC生成的随机数，AuC在生成RAND之后，将RAND发送给所述ARPF。除了上述的方式之外，SQN以及RAND也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，SQN以及RAND可以是所述ARPF自己生成的，此处不作具体限定。
在一些可能的实施方式中，CK可以是AuC根据公式CK＝f3(RAND)生成的，IK可以是AuC根据公式IK＝f4(RAND)生成的，AK可以是AuC根据公式AK＝f5(RAND)生成的。除了上述的方式之外，CK、IK以及AK也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，CK、IK以及AK可以是所述ARPF自己生成的，此处不作具体限定。
506：ARPF向AUSF发送共享密钥。相应地，AUSF接收ARPF发送的共享密钥。
507：AUSF向发送共享密钥。相应地，AMF(或者SEAF)接收AUSF发送的共享密钥。
508：AMF(或者SEAF)根据共享密钥生成锚密钥。
针对步骤505中的第一种生成共享密钥的方式，AMF根据共享密钥生成锚密钥的方式为：
anchor key＝KDF(shared key，SNT)；
其中，anchor key为所述锚密钥，KDF为密钥生成算法，SNT为所述运营商类型标识。
针对步骤505中的第二种生成共享密钥的方式，AMF根据共享密钥生成锚密钥的方式为：
anchor key＝KDF(shared key，ANT)；
其中，anchor key为所述锚密钥，KDF为密钥生成算法，ANT为所述接入类型标识。
509：AMF(或者SEAF)根据锚密钥生成下层密钥。其中，下层密钥为基于锚密钥进行一次或者多次推衍得到的密钥。
可以理解，AMF(或者SEAF)根据K amf密钥/K seaf密钥生成下层密钥的过程与图6A以及图6B所示的过程基本相同，具体请参见图6A以及图6B以及相关内容，此处不再重复赘述。510：AMF(或者SEAF)向AN发送下层密钥。
511：UE根据AK，IK，SNT以及ANT生成下层密钥。可以理解，UE推衍下层密钥的过程与上述过程大体类似，此处将不再展开描述。
需要说明的是，当接入方式不同时，步骤509至步骤511是不相同的，下面分别以接入方式为3GPP接入方式以及非3GPP接入方式为例进行详细介绍。
如图17A所示，假设接入方式为3GPP接入方式，锚密钥为anchor key 1，则步骤509至步骤511可以用下述的步骤5111ˉ5117步骤代替。
5111：AMF(或者SEAF)根据anchor key1生成基站密钥K gNB，3GPP-NAS保密性密钥K-3GPP NASenc，3GPP-NAS完整性保护密钥K-3GPP NASint。
具体地，AMF(或者SEAF)根据以下公式生成3GPP接入方式下的基站密钥K gNB、3GPP-NAS 保密性密钥K-3GPP NASenc，以及，3GPP-NAS完整性保护密钥K-3GPP NASint：
K gNB＝KDF(anchor key 1，NAS Count1)；
K-3GPP NASint＝KDF(anchor key 1，NAS-int-alg，alg-ID)；
K-3GPP NASenc＝KDF(anchor key 1，NAS-enc-alg，alg-ID)；
其中，NAS Count1为经由3GPP的接入点gNB的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’，’SNOW3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如
‘AES’，’SNOW 3G’，’ZUC’等。
5113：AMF(或者SEAF)将基站密钥K gNB发送给AN。此时，AN相应接收AMF(或者SEAF)发送的基站密钥K gNB。
5115：AN根据基站密钥K gNB生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
在本申请实施例中，AN根据如下公式分别生成用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint：
K UPenc＝KDF(K gNB，UP-enc-alg,alg-ID)；
K UPin＝KDF(K gNB，UP-int-alg,alg-ID)；
K RRCenc＝KDFK gNB，RRC-enc-alg,alg-ID)；
K RRCint＝KDF(K gNB，RRC-int-alg,alg-ID)；
其中，KDF为密钥生成算法，K gNB为基站密钥，alg-ID为算法标识，UP-enc-alg、UP-int-alg、RRC-enc-alg以及RRC-int-alg的定义可以参考表2所示的4G中的算法标识定义表格。
5117：UE根据自行根据AK，IK，SNT以及ANT生成锚密钥，然后，根据锚密钥自行推衍用户面保密性密钥K UPenc、用户面完整性密钥K UPint、控制面保密性密钥K RRCenc、控制面完整性密钥K RRCint。
如图17B所示，假设接入方式为非3GPP接入方式，锚密钥为anchor key 2，则步骤509至步骤511可以用下述的步骤5112ˉ5116步骤代替。
5112：AMF(或者SEAF)根据锚密钥anchor key 2生成接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint。
具体地，AMF(或者SEAF)再根据以下公式生成非3GPP接入方式下的接入点密钥K N3IWF、非3GPP-NAS保密性密钥K-N3GPP NASenc，以及，非3GPP-NAS完整性保护密钥K-N3GPP NASint：
K N3IWF＝KDF(anchor key 2，NAS Count2)；
K-N3GPP NASint＝KDF(anchor key 2，NAS-int-alg，alg-ID)；
K-N3GPP NASenc＝KDF(anchor key 2，NAS-enc-alg，alg-ID)；
其中，NAS Count2为经由非3GPP的接入点N3IWF的NAS消息的计数值，可能为上行计数值，也可以为下行计数值，NAS-int-alg为NAS消息对应的完整性算法，比如‘AES’，’SNOW 3G’，’ZUC’等，alg-ID为算法的标识，NAS-enc-alg为NAS消息对应的机密性算法，比如‘AES’，’SNOW 3G’，’ZUC’等。
5114：AMF(或者SEAF)将接入点密钥K N3IWF发送给AN。此时，AN相应接收AMF(或者SEAF)发送的接入点密钥K N3IWF。
5116：UE根据自行根据AK，IK，SNT以及ANT生成锚密钥，然后，根据锚密钥自行推衍接入点密钥K N3IWF。
可以理解，图16所示实施例中的密钥生成算法不限于KDF算法，在实际应用中，密钥生成算法还可以是其它的算法，比如Trunc算法：取低位的截图算法；其他的HASH算法等，本申请不作具体限定。而且，密钥生成算法的自变量也可以包括其他的参数，例如，包括NSSAI、随机数、随机数值、序列码、注册类型、接入层消息数量、安全算法标识、安全标识、SQN
Figure PCTCN2018084416-appb-000040
AK的长度以及生成密钥所用的参数对应的长度等等，在实际应用中，可以根据需要从中选择中的一个或者多个参数作为所述密钥生成算法的自变量。
执行图16所示的锚密钥生成方法之后，将生成如图18所示的密钥架构。其中，图18中隔离线左边的为具体执行图17A所示的流程所生成的密钥架构，图18图中隔离线右边的为具体执行图17B所示的流程所生成的密钥架构，两者之间能够很好地进行隔离。
如图19所示，本申请实施例提供了第七种锚密钥生成方法。该方法可以基于图3以及图4所示的网络架构来实现，该方法包括但不限于如下步骤。
601：UE向AN发送终端标识。相应地，AN接收UE发送的终端标识。
在本申请实施例中，终端标识可以是固定不变的标识，例如，媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)等等，也可以是临时分配的标识，例如，临时移动用户标识符(TemporaryMobileSubscriberIdentity，TMSI)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等。
可以理解，除了终端标识之外，UE还可以将接入网参数、注册类型、安全参数、UE的5G网络能力，PDU session的状态等至少一种发送给AN。其中，接入网参数为可能为接入网的频点，临时用户标识，NSSAI等与服务网络相关的参数。注册类型为可以表明用户是初次注册、由于移动引起的注册、周期性注册更新等区分用户注册的行为。安全参数为认证和完整性保护相关的参数。NSSAI为网络切片选择辅助信息。UE的5G网络能力可能包括支持接入该网络的配置能力。PDU session为UE和数据网络之间的PDU的业务连接，类型可能为IP、以太网的业务连接。
602：AN向AMF(或者SEAF)发送终端标识以及指示标识。相应地，AMF(或者SEAF)接收AN发送的终端标识以及指示标识。
在本申请实施例中，指示标识用于指示终端的接入方式。在5G标准中，可以按照不同的划分依据对终端的接入方式进行划分。例如，接入方式的划分依据可以包括接入类型以 及运营商类型。其中，接入类型具体可以分为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。运营商类型具体可以分为A运营商类型或者B运营商类型。可以理解，运营商类型还可以有更多的类型，此处仅作为示例，不作具体限定。
以划分依据包括接入类型以及运营商类型为例，所述接入方式的划分可以如表1所示。需要说明的，不限于上述两种划分依据，接入方式的划分依据还可以是其他种类的划分依据，例如，介质类型(有线接入或者无线接入)等等，此处不作具体限定。并且，不限于接入类型以及运营商类型两种划分依据，接入方式的划分依据还可以是一种、三种、四种或者更多，即，可以从更多维度或者更少维度对接入方式进行划分。
所述指示标识可以是携带在上述接入网参数中。所述指示标识可以包括接入类型标识以及运营商类型标识，其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型。可以理解，上述例子仅作为举例，不构成具体限定。
在一些可能的实现方式中，接入类型标识具体指示所述接入类型为3GPP接入类型、可信的非3GPP接入类型以及非可信的非3GPP接入类型。例如，接入类型标识Access Network Type(ANT)可以直接为“3GPP network”，“Trusted Non-3GPP network”，“Untrusted Non-3GPP network”字符串，或者仅为“3GPP network”和“Non-3GPP network”字符串等等。
在一些可能的实现方式中，所述运营商类型标识可以包括两部分，一部分用于指示运营商，另一部分用于指示具体接入类型。例如，运营商类型标识可以指示为中国移动的LTE接入或者中国联通的WLAN接入。在具体应用中，可以将SN Identity和Access Network Identity的结合以作为运营商类型标识；也有可能只包括运营商的区分，比如中国移动、中国联通、中国电信等等。
在一些可能的实现方式中，有可能指示标识只是运营商类型标识。
在一些可能的实现方式中，有可能指示标识只是接入类型标识。
603：AMF(或者SEAF)向AUSF发送终端标识以及指示标识。相应地，AUSF接收AMF(或者SEAF)发送的终端标识以及指示标识。
604：AUSF向ARPF发送终端标识以及指示标识。相应地，ARPF接收AUSF发送的终端标识以及指示标识。
605：ARPF根据根密钥K以及指示标识生成锚密钥。
在本申请实施例中，ARPF根据密钥生成算法生成锚密钥的方式可以包括以下几种：
在第一种方式中，当指示标识为NAI时，ARPF根据下述密钥生成算法生成锚密钥anchor key：
Figure PCTCN2018084416-appb-000041
其中，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，K为根密钥，AK为匿名密钥AK＝f5(RAND)，RAND为随机数，f3为生成算法，
Figure PCTCN2018084416-appb-000042
的含义为异或运算。
在第二种方式中，当指示标识包括接入类型标识以及运营商类型标识时，ARPF根据下述密钥生成算法生成锚密钥anchor key：
Figure PCTCN2018084416-appb-000043
其中，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT为所述运营商类型标识，AK为匿名密钥，AK＝f5(RAND)，RAND为随机数，f5为生成算法，
Figure PCTCN2018084416-appb-000044
的 含义为异或运算。
在一些可能的实施方式中，SQN可以是AuC生成的最新序列号，AuC在生成SQN之后，将SQN发送给所述ARPF。类似地，RAND可以是AuC生成的随机数，AuC在生成RAND之后，将RAND发送给所述ARPF。除了上述的方式之外，SQN以及RAND也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，SQN以及RAND可以是所述ARPF自己生成的，此处不作具体限定。
在一些可能的实施方式中，AK可以是AuC根据公式AK＝f5(RAND)生成的。除了上述的方式之外，AK也可以是网络架构中的其它通讯设备生成并发送给的ARPF，甚至，AK可以是所述ARPF自己生成的，此处不作具体限定。
606：ARPF向AUSF发送锚密钥。相应地，AUSF接收ARPF发送的锚密钥。
607：AUSF根据锚密钥生成K amf密钥和/或K seaf密钥。
在本申请实施例中，AUSF根据以下公式生成K amf密钥和/或K seaf密钥：
K amf＝KDF(anchor key，AMF ID)；
K seaf＝KDF(anchor key，SEAF ID)；
其中，anchor key为所述锚密钥，KDF为密钥生成算法，AMF ID为AMF的标识，SEAF ID为SEAF的标识。
608：AUSF将K amf密钥/K seaf密钥发送给AMF/SEAF。相应地，AMF/SEAF接收AUSF发送的K amf密钥/K seaf密钥。
609：AMF(或者SEAF)根据K amf密钥/K seaf密钥生成下层密钥。其中，下层密钥为基于锚密钥进行一次或者多次推衍得到的密钥。
可以理解，AMF(或者SEAF)根据K amf密钥/K seaf密钥生成下层密钥的过程与图12A以及图12B所示的过程基本相同，具体请参见图12A以及图12B以及相关内容，此处不再重复赘述。
610：AMF(或者SEAF)向AN发送下层密钥。
611：UE根据K，SNT以及ANT生成下层密钥。可以理解，UE推衍下层密钥的过程与上述过程大体类似，此处将不再展开描述。
可以理解，AUSF在生成锚密钥之后，也可以直接将锚密钥发送给AMF，然后，AMF再根据锚密钥生成下层密钥，并发送给AN。
可以理解，图19所示实施例中的密钥生成算法不限于KDF算法，在实际应用中，密钥生成算法还可以是其它的算法，比如Trunc算法：取低位的截图算法；其他的HASH算法等，本申请不作具体限定。而且，密钥生成算法的自变量也可以包括其他的参数，例如，包括NSSAI、随机数、随机数值、序列码、注册类型、接入层消息数量、安全算法标识、安全标识、SQN
Figure PCTCN2018084416-appb-000045
AK的长度以及生成密钥所用的参数对应的长度等等，在实际应用中，可以根据需要从中选择中的一个或者多个参数作为所述密钥生成算法的自变量。
执行图19所示的锚密钥生成方法之后，将生成如图20所示的密钥架构。其中，图20中隔离线左边的为具体执行3GPP接入方式的流程所生成的密钥架构，图20图中隔离线右 边的为具体执行非3GPP接入方式的流程所生成的密钥架构，两者之间能够很好地进行隔离。
在本发明的另一个实施例中，公开了一种在AUSF中保留一个密钥的实现方式。该保留的密钥可简写为K left。
具体的，需要指出的是，由于AUSF会向第二通讯设备SEAF发送锚密钥，而在可能的场景部署中，SEAF属于服务网络的安全网元，AUSF属于归属网络的安全网元，特别在漫游的场景下，如果认证发生在UE和归属网络的安全网元之间，则UE和AUSF可以基于该认证过后的保留密钥生成最终的保护密钥，从而实现UE和归属网络之间端到端的安全保护或者更高的安全保护。
需要指出的是，该保留的密钥可由ARPF生成，然后发送给AUSF，或者该保留的密钥可直接由AUSF生成。
方法一，ARPF可根据IK,CK,SQN,AK,服务网络标识,密钥特征标识,RAND或nonce等参数生成保留密钥K left。
其中，SQN为最新序列号，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，RAND和Nonce均可以认为是随机数；其中密钥特征标识可以为：KEYLEFT，AUSFKEY，KEYAUSF，KEYSEAF，SEAFKEY等类似字符串。
后续所涉及的生成函数KDF也可以为伪随机函数(pesudo random function，PRF)等。具体可参见为RFC5448 3.4.1章节中的定义。
举例来说，K left＝KDF(IK,CK,SQN⊕AK，可选参数)；KDF为密钥生成算法。
其中，可选参数为authentication method name、服务网络标识,密钥特征标识,RAND,nonce中的一个或多个。
其中，authentication method name：可以为’EAP-AKA’‘，’5G-EAP‘，’EPS-AKA*‘等标识认证方法的标识；
对于EPS-AKA*，ARPF可根据K asme*、authentication method name、服务网络标识,网络类型标识,密钥特征标识,RAND,nonce等参数生成K left。
其中，K asme*为类似于4G LTE中K asme的密钥。
比如，K left＝KDF(K asme*,第一参数组)；
其中，所述第一参数组为authentication method name、服务网络标识,网络类型标识,密钥特征标识,RAND,nonce中的一个或多个。
需要指出的是，方法一描述的生成保留密钥的过程可分别与图5、图8、图9、图11、图13以及图16描述的方法相结合。
方法二，对于EAP-AKA’，ARPF可根据IK’,CK’,authentication method name,服务网络标识,密钥特征标识,AUSF ID,RAND,nonce等中的一个或多个参数生成K left。
比如，K left＝KDF(IK’，CK’，服务网络标识,密钥特征标识,第二参数组)。
其中，第二参数组为authentication method name,AUSF ID,RAND,nonce等中的一个或多个。
需要说明的是，此处也可由ARPF将IK’CK’发送给AUSF后，由AUSF执行K left的生成。
需要指出的是，方法二描述的生成保留密钥的过程可分别与图5、图8、图9以及图11描述的方法相结合。
方法三，AUSF可根据EMSK、MSK等参数生成K left。EMSK:为扩展性主会话密钥。参见RFC5448。MSK:主会话密钥。参见RFC5448。
举例来说，K left＝trunc(EMSK or MSK),该公式的含义为直接通过截取EMSK或MSK的某些bit位作为K left，其中trunc为用于对值进行截断。比如，trunc(number)表示截断数字；trunc(date)表示截断日期。格式：TRUNC(n1,n2)，n1表示被截断的数字，n2表示要截断到那一位。n2可以是负数，表示截断小数点前。注意，TRUNC截断不是四舍五入。
举例来说，K left＝KDF(EMSK or MSK,密钥特征标识,第三参数组)
其中，第三参数组为服务网络标识,authentication method name,随机数等中的一个或多个。
举例来说，K left也可以理解为就是EMSK。
需要指出的是，方法三描述的生成保留密钥的过程可分别与图8、图9以及图11描述的方法相结合。
可以理解的是，当存在K left时，anchor key则可以为基于K left生成的密钥。
具体来说，anchor key可为根据K left,服务网络标识,密钥特征标识,RAND或nonce等参数生成。
另外，在本发明的另一实施例中，图6B的步骤1114、图14B的步骤4112、图17B步骤5112的细化可替换为：
AMF(或者SEAF)根据K amf2，K seaf2，NAS Count2，NAS连接区分标识，N3IWF标识等参数生成非3GPP接入方式下的接入点密钥K N3IWF。
举例来说，
K N3IWF＝KDF(K amf2和/或K seaf2，NAS Count2)；
其中，NAS Count2为经由非3GPP的接入点N3IWF的NAS消息的计数值，可能为上行计数值，也可以为下行计数值。其中，A和/或B表示三种可能：A、B或(A和B)。
该公式：K N3IWF＝KDF(K amf2和/或K seaf2，NAS Count2)包含三种可能：
第一种：K N3IWF＝KDF(K amf2，NAS Count2)；
第二种：K N3IWF＝KDF(K seaf2，NAS Count2)；
第三种：K N3IWF＝KDF(K amf2，K seaf2，NAS Count2)。
图21示出了一种通讯设备的结构示意图，在本实施方式中，通讯设备包括：接收模块710、发送模块720以及生成模块730。下面展开描述。
所述接收模块710用于接收第二通讯设备发送指示标识，其中，所述指示标识用于指示终端的接入方式。
所述发送模块720用于向第三通讯设备发送所述指示标识；
所述接收模块710用于接收所述第三通讯设备返回的中间密钥，其中，所述中间密钥是根据所述指示标识生成的；
所述生成模块730用于根据所述中间密钥生成锚密钥，其中，所述锚密钥对应所述终端的接入方式；
所述发送模块720用于将所述锚密钥发送给所述第二通讯设备，以供所述第二通讯设备根据所述锚密钥为所述接入方式推衍下层密钥。
需要说明，图21实施例中未提及的内容以及各个功能单元的具体实现，请参考图5至图10以及相关内容，这里不再赘述。
基于同一发明构思，本发明实施例还提供一种装置(如图22所示)，该装置用于实现前述图5至图12实施例所描述的方法。如图22所示，装置800包括：发射器803、接收器804、存储器802和与存储器802耦合的处理器801(处理器801的数量可以是一个或多个，图20中以一个处理器为例)。发射器803、接收器804、存储器802和处理器801可通过总线或者其它方式连接(图20中以通过总线805连接为例)。其中，发射器803用于向外部发送数据，接收器804用于从外部接收数据。存储器802用于存储程序代码，处理器801用于调用并运行存储于存储器802中的程序代码。
通过接收器804接收第二通讯设备发送指示标识，其中，所述指示标识用于指示终端的接入方式；
通过发射器803向第三通讯设备发送所述指示标识；所述第一通讯设备接收所述第三通讯设备返回的中间密钥，其中，所述中间密钥是根据所述指示标识生成的；
处理器801根据所述中间密钥生成锚密钥，其中，所述锚密钥对应所述终端的接入方式；
通过发射器803将所述锚密钥发送给所述第二通讯设备，以供所述第二通讯设备根据所述锚密钥为所述接入方式推衍下层密钥。
在一些可能的实施方式中，所述接入方式是根据接入类型以及运营商类型中的至少一个进行区分的。
在一些可能的实施方式中，处理器801根据以下公式生成锚密钥，
anchor key＝KDF(IK 1’||CK 1’)
其中，anchor key为所述锚密钥，(IK 1’，CK 1’)为所述中间钥匙，IK 1’为中间完整性密钥，CK 1’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来。
处理器801至少可以根据以下两种方式生成中间密钥：
当所述指示标识包括接入类型标识以及运营商类型标识时，所述中间密钥是处理器801根据以下公式生成的：
Figure PCTCN2018084416-appb-000046
其中，所述接入类型标识用于指示所述接入类型，所述运营商类型标识用于指示所述运营商类型；(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，SNT 为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000047
的含义为异或运算。
当所述指示标识是NAI时，所述中间密钥是处理器801根据以下公式生成的：
Figure PCTCN2018084416-appb-000048
其中，(CK 1’，IK 1’)为所述中间密钥，CK 1’为所述中间保密性密钥，IK 1’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为所述指示标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000049
的含义为异或运算。
在一些可能的实施方式中，处理器801根据以下公式生成所述中间密钥：
Figure PCTCN2018084416-appb-000050
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，ANT为所述接入类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000051
的含义为异或运算。
处理器801根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK 2’为中间完整性密钥，CK 2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
处理器801根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，SNT)；
其中，anchor key为所述锚密钥，SNT为所述运营商类型标识。
在一些可能的实施方式中，处理器801根据以下公式生成所述中间密钥：
Figure PCTCN2018084416-appb-000052
其中，(CK 2’，IK 2’)为所述中间密钥，CK 2’为所述中间保密性密钥，IK 2’为所述中间完整性密钥，KDF为密钥生成算法，SQN为最新序列号，SNT为所述运营商类型标识，CK为初始保密性密钥，IK为初始完整性密钥，AK为匿名密钥，CK＝f3(RAND)，IK＝f4(RAND)，AK＝f5(RAND)，RAND为随机数，f3，f4以及f5均为生成算法，
Figure PCTCN2018084416-appb-000053
的含义为异或运算。
处理器801根据以下公式生成EMSK’，
EMSK’＝PRF’(IK 2’||CK 2’)；
其中，EMSK’为扩展主会话密钥，(IK 2’，CK 2’)为所述中间钥匙，IK2’为中间完整性密钥，CK2’为中间保密性密钥，||的含义为级联，表示将符号两边的字符串连起来；
处理器801根据以下公式生成锚密钥，
anchor key＝KDF(EMSK’，ANT)；
其中，anchor key为所述锚密钥，ANT为所述接入类型标识。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实 施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (19)

  1. 一种锚密钥生成的系统，其特征在于，所述系统包括认证服务器、安全锚点和统一数据管理网元；
    所述统一数据管理网元，用于根据终端接入的运营商网络的指示标识、保密性密钥和完整性密钥生成中间密钥，并向所述认证服务器发送所述中间密钥；
    所述认证服务器，用于接收所述统一数据管理网元返回的中间密钥；
    所述认证服务器，还用于根据所述中间密钥获取锚密钥；
    所述认证服务器，用于将所述锚密钥发送给所述安全锚点；
    所述安全锚点，用于根据所述锚密钥获取推衍密钥；
    所述安全锚点，还用于当所述终端的接入方式为非3GPP接入方式时，根据所述推衍密钥获取所述非3GPP接入方式的接入点密钥。
  2. 根据权利要求1所述的系统，其特征在于，
    所述认证服务器，具体用于根据所述中间密钥生成扩展主会话密钥EMSK’；
    所述认证服务器，还用于根据所述EMSK’获取锚密钥。
  3. 根据权利要求2所述的系统，其特征在于，
    所述认证服务器，具体用于根据EMSK’和所述终端接入的运营商网络的指示标识生成所述锚密钥。
  4. 根据权利1至3任一所述的系统，其特征在于，所述根据推衍密钥获取所述非3GPP接入方式的接入点密钥，包括：
    根据非接入层消息的上行计数值以及所述推演密钥确定所述非3GPP接入方式的接入点密钥。
  5. 根据权利要求1至4任一所述的系统，其特征在于，
    所述安全锚点，还用于当所述终端的接入方式为3GPP接入方式时，根据所述推衍密钥获取3GPP接入方式的基站密钥。
  6. 根据权利要求1至5任一所述的系统，其特征在于，所述根据所述锚密钥获取推衍密钥，包括：
    根据所述锚密钥以及所述安全锚点的标识生成所述推演密钥。
  7. 根据权利要求1至6任一所述的系统，其特征在于，所述根据终端接入的运营商网络的指示标识、保密性密钥和完整性密钥生成中间密钥，包括：
    Figure PCTCN2018084416-appb-100001
    其中，(CK1’，IK1’)为所述中间密钥，KDF为密钥生成算法，SQN为最新序列号，NAI为终端接入的运营商网络的指示标识，CK为保密性密钥，IK为完整性密钥，AK为匿名密钥，
    Figure PCTCN2018084416-appb-100002
    的含义为异或运算。
  8. 一种推衍密钥的生成方法，其特征在于，所述方法包括：
    终端根据所述终端接入的运营商的指示标识、保密性密钥和完整性密钥生成中间密钥；
    所述终端根据所述中间密钥获取锚密钥K seaf；
    所述终端根据所述锚密钥获取推衍密钥K amf；
    当所述终端接入网络的类型为非3GPP接入类型时，所述终端根据所述K amf获取所述非3GPP接入方式的接入点密钥。
  9. 根据权利要求8所述的方法，其特征在于，所述终端根据所述K amf获取所述非3GPP接入方式的接入点密钥，包括：
    所述终端根据非接入层消息的上行计数值和所述K amf获取所述非3GPP接入方式的接入点密钥。
  10. 根据权利要求8或9所述方法，其特征在于，所述终端根据所述中间密钥获取锚密钥，包括：
    所述终端根据所述中间密钥生成扩展主会话密钥EMSK’，并根据所述EMSK’获取锚密钥。
  11. 根据权利要求10所述的方法，其特征在于，所述根据所述EMSK’获取锚密钥，包括：
    所述终端根据所述EMSK’和所述终端接入的运营商的指示标识生成所述锚密钥。
  12. 根据权利8至11任一所述的方法，其特征在于，所述方法还包括：
    当所述终端接入网络的类型为3GPP接入类型时，所述终端根据所述K amf获取基站密钥K gNB。
  13. 根据权利要求8至12任一所述的方法，其特征在于，所述根据所述锚密钥获取推衍密钥，包括：
    根据接入和移动管理网元的标识和所述锚密钥获取所述推演密钥。
  14. 一种终端，其特征在于，包括处理器和存储器，所述存储器中存储有程序代码，当所述程序代码被执行时，所述处理器执行以下操作：
    根据所述终端接入的运营商的指示标识、保密性密钥和完整性密钥生成中间密钥；
    根据所述中间密钥获取锚密钥K seaf；
    根据所述锚密钥获取推衍密钥K amf；
    当所述终端接入网络的类型为非3GPP接入类型时，根据所述K amf获取所述非3GPP接入方式的接入点密钥。
  15. 根据权利要求14所述的终端，其特征在于，所述根据所述K amf获取所述非3GPP接入方式的接入点密钥，包括：
    根据非接入层消息的上行计数值和所述K amf获取所述非3GPP接入方式的接入点密钥。
  16. 根据权利要求14或15所述的终端，其特征在于，所述根据所述中间密钥获取锚密钥，包括：
    根据所述中间密钥生成扩展主会话密钥EMSK’，并根据所述EMSK’获取锚密钥。
  17. 根据权利要求16所述的终端，其特征在于，所述根据所述EMSK’获取锚密钥，包括：
    根据所述EMSK’和所述终端接入的运营商的指示标识生成所述锚密钥。
  18. 根据权利要求14至17任一所述的终端，其特征在于，所述处理器还用于执行以下操作：
    当所述终端接入网络的类型为3GPP接入类型时，所述终端根据所述K amf获取基站密钥K gNB。
  19. 根据权利要求14至18任一所述的终端，其特征在于，所述根据所述锚密钥获取推衍密钥，包括：
    根据接入和移动管理网元的标识和所述锚密钥获取所述推演密钥。
PCT/CN2018/084416 2017-05-05 2018-04-25 锚密钥生成方法、设备以及系统 WO2018201946A1 (zh)

Priority Applications (10)

Application Number Priority Date Filing Date Title
RU2019139240A RU2781250C2 (ru) 2017-05-05 2018-04-25 Способ формирования ключа, пользовательское оборудование, устройство, считываемый компьютером носитель данных и система связи
JP2019560249A JP6924848B2 (ja) 2017-05-05 2018-04-25 鍵生成方法、ユーザ機器、装置、コンピュータ可読記憶媒体、および通信システム
KR1020197035377A KR102245688B1 (ko) 2017-05-05 2018-04-25 키 생성 방법, 사용자 장비, 장치, 컴퓨터 판독가능 저장 매체, 및 통신 시스템
CN201880026323.4A CN110612729B (zh) 2017-05-05 2018-04-25 锚密钥生成方法、设备以及系统
BR112019022792-0A BR112019022792B1 (pt) 2017-05-05 2018-04-25 Método de geração de chave, equipamento de usuário, aparelho, mídia de armazenamento legível por computador e sistema de comunicação
EP22210348.3A EP4203533A1 (en) 2017-05-05 2018-04-25 Anchor key generation method, device, and system
EP18795025.8A EP3531732B1 (en) 2017-05-05 2018-04-25 Anchor key generation method, device and system
US16/388,606 US11012855B2 (en) 2017-05-05 2019-04-18 Anchor key generation method, device, and system
US16/441,598 US10966083B2 (en) 2017-05-05 2019-06-14 Anchor key generation method, device, and system
US17/245,991 US11924629B2 (en) 2017-05-05 2021-04-30 Anchor key generation method, device, and system

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201710313519 2017-05-05
CN201710313519.9 2017-05-05
CN201710908017.0 2017-09-29
CN201710908017.0A CN108809635A (zh) 2017-05-05 2017-09-29 锚密钥生成方法、设备以及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/388,606 Continuation US11012855B2 (en) 2017-05-05 2019-04-18 Anchor key generation method, device, and system

Publications (1)

Publication Number Publication Date
WO2018201946A1 true WO2018201946A1 (zh) 2018-11-08

Family

ID=64094528

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/084416 WO2018201946A1 (zh) 2017-05-05 2018-04-25 锚密钥生成方法、设备以及系统

Country Status (7)

Country Link
US (3) US11012855B2 (zh)
EP (2) EP3531732B1 (zh)
JP (1) JP6924848B2 (zh)
KR (1) KR102245688B1 (zh)
CN (4) CN109874139B (zh)
BR (1) BR112019022792B1 (zh)
WO (1) WO2018201946A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20210103521A (ko) * 2019-01-18 2021-08-23 탈레스 Dis 프랑스 Sa 원격 통신 네트워크의 단말 내에서 모바일 장비와 협력하는 보안 엘리먼트를 인증하기 위한 방법
JP2022516165A (ja) * 2019-01-02 2022-02-24 中国移動通信有限公司研究院 鍵生成方法、端末機器及びネットワーク機器

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019020193A1 (en) * 2017-07-28 2019-01-31 Telefonaktiebolaget Lm Ericsson (Publ) METHODS OF PROVIDING NON-3GPP ACCESS USING ACCESS NETWORK KEYS AND RELATED WIRELESS TERMINALS AND NETWORK NODES
US11962999B2 (en) * 2018-11-02 2024-04-16 Nec Corporation Method, UE, and network for providing KDF negotiation
WO2020208294A1 (en) * 2019-04-11 2020-10-15 Nokia Technologies Oy Establishing secure communication paths to multipath connection server with initial connection over public network
WO2020254204A1 (en) * 2019-06-17 2020-12-24 Telefonaktiebolaget Lm Ericsson (Publ) Handling of nas container in registration request at amf re-allocation
CN110830985B (zh) * 2019-11-11 2022-04-29 重庆邮电大学 一种基于信任机制的5g轻量级终端接入认证方法
CN113162758B (zh) * 2020-01-23 2023-09-19 中国移动通信有限公司研究院 一种密钥生成方法及设备
US11399281B2 (en) * 2020-02-21 2022-07-26 Telefonaktiebolaget Lm Ericsson (Publ) Authentication server function selection in authentication and key management
CN113873492B (zh) * 2020-06-15 2022-12-30 华为技术有限公司 一种通信方法以及相关装置
CN116325840A (zh) * 2020-09-30 2023-06-23 华为技术有限公司 一种密钥推衍方法及其装置、系统
CN112738799A (zh) * 2020-12-29 2021-04-30 中盈优创资讯科技有限公司 一种基于策略的数据安全传输的实现方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103607713A (zh) * 2013-10-29 2014-02-26 小米科技有限责任公司 网络接入方法、装置、设备和系统
CN103781069A (zh) * 2012-10-19 2014-05-07 华为技术有限公司 一种双向认证的方法、设备及系统
CN105554747A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线网络连接方法、装置及系统
WO2016195907A1 (en) * 2015-06-05 2016-12-08 Qualcomm Incorporated Flexible configuration and authentication of wireless devices

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7908484B2 (en) * 2003-08-22 2011-03-15 Nokia Corporation Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack
CN101523765B (zh) * 2006-09-28 2013-06-12 三星电子株式会社 异构无线网络中提供用户设备发起和协助反向切换的系统及方法
JP4390842B1 (ja) * 2008-08-15 2009-12-24 株式会社エヌ・ティ・ティ・ドコモ 移動通信方法、無線基地局及び移動局
CN101771990B (zh) * 2008-12-31 2013-03-20 华为技术有限公司 一种密钥获取方法、设备和系统
CN101540981B (zh) * 2009-04-30 2014-03-12 中兴通讯股份有限公司 一种在紧急呼叫中进行安全能力协商的方法及系统
CN101742498A (zh) * 2009-12-18 2010-06-16 中兴通讯股份有限公司 空口密钥的管理方法和系统
US20110312299A1 (en) * 2010-06-18 2011-12-22 Qualcomm Incorporated Methods and apparatuses facilitating synchronization of security configurations
US20120108206A1 (en) 2010-10-28 2012-05-03 Haggerty David T Methods and apparatus for access control client assisted roaming
CN102572819B (zh) 2010-12-22 2015-05-13 华为技术有限公司 一种密钥生成方法、装置及系统
CN102625300B (zh) 2011-01-28 2015-07-08 华为技术有限公司 密钥生成方法和设备
CN103856288B (zh) 2012-12-04 2017-06-06 北汽福田汽车股份有限公司 用于汽车的can通讯信号校验与传输方法和系统
CN106465116B (zh) * 2014-01-14 2020-07-07 瑞典爱立信有限公司 无线网络的接入控制
WO2015169552A1 (en) * 2014-05-05 2015-11-12 Telefonaktiebolaget L M Ericsson (Publ) Protecting wlcp message exchange between twag and ue
EP3304856A1 (en) * 2015-06-05 2018-04-11 Convida Wireless, LLC Unified authentication for integrated small cell and wi-fi networks
US9674704B1 (en) * 2015-11-23 2017-06-06 Motorola Mobility Llc Network connectivity switching utilizing an authentication device
US10433163B2 (en) * 2016-09-19 2019-10-01 Qualcomm Incorporated Techniques for deriving security keys for a cellular network based on performance of an extensible authentication protocol (EAP) procedure
CN106790053B (zh) 2016-12-20 2019-08-27 江苏大学 一种can总线中ecu安全通信的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103781069A (zh) * 2012-10-19 2014-05-07 华为技术有限公司 一种双向认证的方法、设备及系统
CN103607713A (zh) * 2013-10-29 2014-02-26 小米科技有限责任公司 网络接入方法、装置、设备和系统
WO2016195907A1 (en) * 2015-06-05 2016-12-08 Qualcomm Incorporated Flexible configuration and authentication of wireless devices
CN105554747A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线网络连接方法、装置及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3531732A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2022516165A (ja) * 2019-01-02 2022-02-24 中国移動通信有限公司研究院 鍵生成方法、端末機器及びネットワーク機器
JP7329604B2 (ja) 2019-01-02 2023-08-18 中国移動通信有限公司研究院 鍵生成方法、端末機器及びネットワーク機器
KR20210103521A (ko) * 2019-01-18 2021-08-23 탈레스 Dis 프랑스 Sa 원격 통신 네트워크의 단말 내에서 모바일 장비와 협력하는 보안 엘리먼트를 인증하기 위한 방법
KR102456280B1 (ko) 2019-01-18 2022-10-20 탈레스 Dis 프랑스 Sa 원격 통신 네트워크의 단말 내에서 모바일 장비와 협력하는 보안 엘리먼트를 인증하기 위한 방법

Also Published As

Publication number Publication date
CN108809635A (zh) 2018-11-13
EP3531732A4 (en) 2019-10-30
KR20200003108A (ko) 2020-01-08
CN110612729B (zh) 2021-12-17
US20220295271A9 (en) 2022-09-15
CN109874139A (zh) 2019-06-11
US10966083B2 (en) 2021-03-30
BR112019022792A2 (pt) 2020-05-19
EP3531732B1 (en) 2023-01-11
CN108810890B (zh) 2019-06-11
KR102245688B1 (ko) 2021-04-27
CN109874139B (zh) 2020-02-07
US11924629B2 (en) 2024-03-05
RU2019139240A (ru) 2021-06-07
EP4203533A1 (en) 2023-06-28
CN108810890A (zh) 2018-11-13
CN110612729A (zh) 2019-12-24
US20210258780A1 (en) 2021-08-19
EP3531732A1 (en) 2019-08-28
BR112019022792B1 (pt) 2021-08-17
US11012855B2 (en) 2021-05-18
JP2020519157A (ja) 2020-06-25
US20190297494A1 (en) 2019-09-26
US20190253889A1 (en) 2019-08-15
RU2019139240A3 (zh) 2021-09-07
JP6924848B2 (ja) 2021-08-25

Similar Documents

Publication Publication Date Title
WO2018201946A1 (zh) 锚密钥生成方法、设备以及系统
US10455414B2 (en) User-plane security for next generation cellular networks
JP6639493B2 (ja) ワイヤレス通信のための装置および方法
US10129031B2 (en) End-to-end service layer authentication
US11974132B2 (en) Routing method, apparatus, and system
US11909869B2 (en) Communication method and related product based on key agreement and authentication
US11082843B2 (en) Communication method and communications apparatus
WO2018076740A1 (zh) 数据传输方法及相关设备
US20230354013A1 (en) Secure communication method and device
WO2020087286A1 (zh) 一种密钥生成方法、设备及系统
US20190149326A1 (en) Key obtaining method and apparatus
WO2020147602A1 (zh) 一种认证方法、装置和系统
RU2781250C2 (ru) Способ формирования ключа, пользовательское оборудование, устройство, считываемый компьютером носитель данных и система связи

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18795025

Country of ref document: EP

Kind code of ref document: A1

DPE1 Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101)
ENP Entry into the national phase

Ref document number: 2018795025

Country of ref document: EP

Effective date: 20190524

ENP Entry into the national phase

Ref document number: 2019560249

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112019022792

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 20197035377

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112019022792

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20191030