WO2019024612A1 - Procédé et appareil d'authentification d'accès - Google Patents

Procédé et appareil d'authentification d'accès Download PDF

Info

Publication number
WO2019024612A1
WO2019024612A1 PCT/CN2018/091048 CN2018091048W WO2019024612A1 WO 2019024612 A1 WO2019024612 A1 WO 2019024612A1 CN 2018091048 W CN2018091048 W CN 2018091048W WO 2019024612 A1 WO2019024612 A1 WO 2019024612A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
terminal device
eap
nas information
authentication
Prior art date
Application number
PCT/CN2018/091048
Other languages
English (en)
Chinese (zh)
Inventor
李欢
李�赫
诸华林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019024612A1 publication Critical patent/WO2019024612A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a method and an apparatus for access authentication.
  • the fifth generation (English name: 5-generation, English abbreviation: 5G) core network allows terminal equipment to access the network or non-3GPP access from the third generation partnership project (English name: 3rd generation Partnership Project, English abbreviation: 3GPP) Network access.
  • the terminal device accesses the core network from the non-3GPP access network, the prior art does not involve how to implement the authentication of the terminal device by the core network device.
  • the embodiment of the present invention provides a method and an apparatus for access authentication, which can solve the problem that the terminal device cannot authenticate the terminal device when the terminal device accesses the core network from the non-3GPP access network in the prior art. .
  • a first aspect of the embodiments of the present application provides a method for access authentication, where the method includes:
  • the gateway device receives the first authentication request sent by the terminal device, where the first authentication request includes the first extended authentication protocol EAP information, and the first EAP information includes the first non-access stratum NAS information.
  • the gateway device sends the first NAS information to the access and mobility management network element, where the first NAS information includes second EAP information, where the first NAS information is used to trigger the core network to the terminal device. EAP authentication.
  • the gateway device obtains an EAP authentication result of the core network from the access network and the mobility management network element, and sends a second NAS information to the terminal device, where the second NAS information includes the EAP authentication result.
  • the gateway device sends a first authentication response of the first authentication request to the terminal device.
  • the gateway device after the gateway device receives the first authentication request sent by the terminal device, in the authentication process, the gateway device will carry the first NAS of the second EAP information.
  • the information is sent to the access and mobility management network element, and the EAP authentication result obtained from the access and mobility management network element is sent to the terminal device in the second NAS information, and finally the first authentication is sent to the terminal device. response.
  • the embodiment of the present application completes the EAP authentication process for the terminal device based on the NAS information and the EAP information, and the gateway device ends the EAP authentication process with the first authentication response.
  • the gateway device obtains the EAP authentication result of the terminal device from the access and mobility management network element, including:
  • the gateway device receives a first message from the access and mobility management network element, where the first message includes the EAP authentication result and a security command mode.
  • the first message can be an N2 message.
  • the gateway device receives a security mode command from the access and mobility management network element, the security mode command including the EAP authentication result.
  • the gateway device receives third NAS information from the access and mobility management network element, where the third NAS information includes the EAP authentication result.
  • the second NAS information can be considered to be the third NAS information.
  • the gateway device sends the second NAS information to the terminal device, including:
  • the gateway device sends second NAS information to the terminal device, where the second NAS information includes a security mode command, and the security mode command includes the EAP authentication result.
  • the first NAS information is registration request information
  • the second NAS information sent by the gateway device to the terminal device includes a registration response of the terminal device
  • the EAP authentication result may be included in the registration response
  • the second NAS information includes indication information, where the indication information is used to indicate that the second NAS information carries the EAP authentication result.
  • the gateway device after the gateway device sends the second NAS information to the terminal device, before the gateway device sends the first authentication response of the first authentication request to the terminal device, the method also includes:
  • the gateway device receives a response to the first NAS information sent by the access and mobility management network element, and sends a response of the first NAS information to the terminal device.
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information carries the registration indication information, where the value of the registration indication information is an initially registered value.
  • the gateway device after the gateway device sends the second NAS information to the terminal device, before the gateway device sends the first authentication response of the first authentication request to the terminal device, the method also includes:
  • the gateway device receives fourth NAS information sent by the terminal device, where the fourth NAS information is a response of the terminal device to the second NAS information.
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • a second aspect of the embodiments of the present application provides a method for access authentication, where the method includes:
  • the gateway device a first authentication request sent by the terminal device to the gateway device, where the first authentication request includes first extended authentication protocol EAP information, the first EAP information includes first non-access stratum NAS information, the first NAS The information is used to trigger a registration process of the terminal device.
  • EAP information includes first extended authentication protocol
  • NAS information includes first non-access stratum NAS information
  • the first NAS The information is used to trigger a registration process of the terminal device.
  • the terminal device receives the second NAS information sent by the gateway device, where the second NAS information includes an EAP authentication result of the core network to the terminal device.
  • the terminal device receives a first authentication response of the first authentication request sent by the gateway device.
  • the terminal device receives the second NAS information that is sent by the gateway device, where the second NAS information includes the EAP authentication result of the core device, including:
  • the terminal device receives the second NAS information sent by the gateway device, where the second NAS information includes a security mode command, and the security mode command includes the EAP authentication result.
  • the first NAS information includes registration request information.
  • the second NAS information includes a registration response.
  • the method further includes:
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the method further includes:
  • the terminal device receives a response of the first NAS information sent by the gateway device.
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information includes registration indication information, where the value of the registration indication information is an initially registered value.
  • a third aspect of the embodiments of the present application provides a method for access authentication, where the method includes:
  • the access and mobility management network element receives the first non-access stratum NAS information sent by the gateway device, where the first NAS information includes second EAP information, where the first NAS information is used to trigger the core network to the terminal device. EAP authentication.
  • the access and mobility management network element sends an authentication request to the authentication server according to the second EAP information.
  • the access and mobility management network element receives an EAP authentication result from the authentication server to the terminal device.
  • the access and mobility management entity sends the EAP authentication result to the gateway device.
  • the core network performs EAP authentication on the terminal device, and the EAP is The authentication result is returned to the gateway device.
  • the gateway device sends the EAP authentication result to the terminal device in the second NAS information, and finally sends the first authentication response to the terminal device.
  • the embodiment of the present application completes the EAP authentication process for the terminal device based on the NAS information and the EAP information, and the gateway device ends the EAP authentication process with the first authentication response. In this way, the complete registration process and the EAP authentication process can be performed without the need to enhance the terminal device and only need to coordinate between the gateway device and the AMF.
  • the access and mobility management entity sends the EAP authentication result to the gateway device, including one of the following implementation manners:
  • the access and mobility management entity sends a first message to the gateway device, where the first message includes the EAP authentication result and a security mode command;
  • the access and mobility management network element sends a security mode command to the gateway device, where the security mode command includes an EAP authentication result of the terminal device;
  • the access and mobility management network element sends third NAS information to the gateway device, where the third NAS information includes an EAP authentication result of the terminal device.
  • the embodiments of the present application provide a variety of information carrying modes, and provide convenient and effective transmission of information interaction in the EAP authentication process. It is also flexible to choose different types of information to be packaged to accommodate diverse information interactions.
  • the first NAS information is a registration request
  • the access and mobility management network element sends the EAP authentication result to the gateway device, including:
  • the access and mobility management network element sends a response to the first NAS information to the gateway device, and the response of the first NAS information includes the EAP authentication result.
  • the gateway device is a gateway device of a non-3GPP access network.
  • the fourth aspect of the embodiments of the present application further provides a method for accessing, where the method includes:
  • the gateway device receives the first authentication request sent by the terminal device, where the first authentication request includes first extended authentication protocol EAP information, and the first EAP information includes first non-access stratum NAS information, the first NAS
  • the information includes re-registration indication information, where the re-registration indication information is used to indicate that the gateway device does not initiate an EAP authentication procedure for the terminal device.
  • the gateway device sends a registration request to the access and mobility management network element according to the first NAS information
  • the gateway device sends a first authentication response of the first authentication request to the terminal device.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • the fifth aspect of the embodiments of the present application further provides a method for accessing, where the method includes:
  • the terminal device sends a first authentication request to the gateway device, where the first authentication request includes first extended authentication protocol EAP information, the first EAP information includes first non-access stratum NAS information, and the first NAS information And including the re-registration indication information, where the first NAS information is used to indicate that the gateway device initiates a registration process and does not initiate an EAP authentication process for the terminal device;
  • the first authentication request includes first extended authentication protocol EAP information
  • the first EAP information includes first non-access stratum NAS information
  • the first NAS information And including the re-registration indication information, where the first NAS information is used to indicate that the gateway device initiates a registration process and does not initiate an EAP authentication process for the terminal device;
  • the terminal device After the registration process is completed, the terminal device receives a first authentication response of the first authentication request sent by the gateway device.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • a sixth aspect of the embodiments of the present application provides an apparatus for access authentication, which has a function of implementing a method for providing access authentication performed by a gateway device corresponding to the above first aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above, which may be software and/or hardware.
  • the device for access authentication includes a transceiver module and a processing module, and the processing module is configured to control the transceiver operation of the transceiver module:
  • the transceiver module is configured to receive a first authentication request sent by the terminal device, where the first authentication request includes a first extended authentication protocol EAP information, where the first EAP information includes first non-access stratum NAS information;
  • the transceiver module is further configured to send the first NAS information to the access and mobility management network element, where the first NAS information includes second EAP information, where the first NAS information is used to trigger the core network to EAP authentication of the terminal device;
  • the transceiver module is further configured to obtain, by the access and mobility management network element, an EAP authentication result of the core network to the terminal device;
  • the transceiver module is further configured to send second NAS information to the terminal device, where the second NAS information includes the EAP authentication result;
  • the transceiver module is further configured to send, to the terminal device, a first authentication response of the first authentication request.
  • the transceiver module obtains the EAP authentication result of the terminal device from the access and mobility management network element, and includes one of the following implementation manners:
  • the transceiver module is specifically configured to:
  • the first NAS information includes registration request information.
  • the second NAS information includes a registration response.
  • the second NAS information includes indication information, where the indication information is used to indicate that the second NAS information carries the EAP authentication result.
  • the transceiver module after the sending, by the transceiver module, the second NAS information to the terminal device, before sending the first authentication response of the first authentication request to the terminal device, the transceiver module is further configured to:
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the transceiver module after the sending, by the transceiver module, the second NAS information to the terminal device, before sending the first authentication response of the first authentication request to the terminal device, the transceiver module is further configured to:
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information carries the registration indication information, where the value of the registration indication information is an initially registered value.
  • a seventh aspect of the embodiments of the present application provides a terminal device, which has a function of implementing a method corresponding to the access authentication provided by the foregoing second aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above, which may be software and/or hardware.
  • the terminal device may include:
  • the device includes a transceiver module and a processing module, and the processing module is configured to control the transceiver operation of the transceiver module:
  • the transceiver module is configured to send a first authentication request to the gateway device, where the first authentication request includes first extended authentication protocol EAP information, and the first EAP information includes first non-access stratum NAS information.
  • the first NAS information is used to trigger a registration process of the terminal device;
  • the transceiver module is further configured to receive second NAS information sent by the gateway device, where the second NAS information includes an EAP authentication result of the core device to the terminal device;
  • the transceiver module is further configured to receive a first authentication response of the first authentication request sent by the gateway device.
  • the transceiver module is specifically configured to:
  • the gateway device Receiving, by the gateway device, the second NAS information, where the second NAS information includes a security mode command, where the security mode command includes the EAP authentication result.
  • the first NAS information includes registration request information.
  • the second NAS information includes a registration response.
  • the transceiver module after receiving the second NAS information sent by the gateway device, before receiving the first authentication response sent by the gateway device, is further used to:
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the transceiver module after receiving the second NAS information sent by the gateway device, before receiving the first authentication response sent by the gateway device, is further used to:
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information includes registration indication information, where the value of the registration indication information is an initially registered value.
  • An eighth aspect of the embodiments of the present application provides an apparatus for access authentication, which has a function of implementing a method for access authentication performed by the access and mobility management network element.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above, which may be software and/or hardware.
  • the device for access authentication includes a transceiver module and a processing module, and the processing module is configured to control a transceiver operation of the transceiver module.
  • the transceiver module is configured to receive the first non-access stratum NAS information sent by the gateway device, where the first NAS information includes second EAP information, where the first NAS information is used to trigger the core network to the terminal device. EAP authentication.
  • the transceiver module is further configured to send an authentication request to the authentication server according to the second EAP information.
  • the transceiver module is further configured to receive an EAP authentication result from the authentication server to the terminal device.
  • the transceiver module is further configured to send the EAP authentication result to the gateway device.
  • the transceiver module sends the EAP authentication result to the gateway device, including one of the following implementation manners:
  • the embodiments of the present application provide a variety of information carrying modes, and provide convenient and effective transmission of information interaction in the EAP authentication process. It is also flexible to choose different types of information to be packaged to accommodate diverse information interactions.
  • the first NAS information is a registration request
  • the transceiver module specifically:
  • the gateway device is a gateway device of a non-3GPP access network.
  • a ninth aspect of the embodiments of the present application provides an apparatus for access authentication, having a function of implementing a method corresponding to the access provided by the foregoing fourth aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above, which may be software and/or hardware.
  • the device for access authentication includes a transceiver module and a processing module, and the processing module is configured to control the transceiver operation of the transceiver module:
  • the transceiver module is configured to receive a first authentication request sent by the terminal device, where the first authentication request includes first extended authentication protocol EAP information, and the first EAP information includes first non-access stratum NAS information.
  • the first NAS information includes re-registration indication information, where the re-registration indication information is used to indicate that the gateway device does not initiate an EAP authentication procedure for the terminal device.
  • the transceiver module is further configured to send a registration request to the access and mobility management network element according to the first NAS information;
  • the transceiver module is further configured to receive a registration response sent by the access and mobility management network element;
  • the transceiver module is further configured to send, to the terminal device, a first authentication response of the first authentication request.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • a tenth aspect of the embodiments of the present application provides a terminal device, which has a function of implementing a method corresponding to the access authentication provided by the foregoing fifth aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above, which may be software and/or hardware.
  • the terminal device includes a transceiver module and a processing module, and the processing module is configured to control the transceiver operation of the transceiver module:
  • the transceiver module is configured to send a first authentication request to the gateway device, where the first authentication request includes a first extended authentication protocol (EAP) information, and the first EAP information includes a first non-access stratum NAS information.
  • the first NAS information includes re-registration indication information, where the first NAS information is used to indicate that the gateway device initiates a registration process and does not initiate an EAP authentication process for the terminal device;
  • the transceiver module is further configured to receive a first authentication response of the first authentication request sent by the gateway device.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • Yet another aspect of an embodiment of the present application provides an apparatus for access authentication, including at least one connected processor, a memory, and a transceiver, wherein the memory is used to store program code, and the processor is used to call The program code in the memory is such that the transceiver performs the methods described in the various aspects above.
  • Yet another aspect of an embodiment of the present application provides a computer storage medium comprising instructions that, when executed on a computer, cause the computer to perform the methods described in the various aspects above.
  • Yet another aspect of an embodiment of the present application provides a computer program product comprising instructions that, when run on a computer, cause the computer to perform the methods described in the various aspects above.
  • FIG. 1 is a schematic diagram of a system architecture involved in an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of access authentication in an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of re-registration in the embodiment of the present application.
  • FIG. 5 is another schematic flowchart of access authentication in the embodiment of the present application.
  • FIG. 6 is another schematic flowchart of access authentication in the embodiment of the present application.
  • FIG. 7 is another schematic flowchart of access authentication in the embodiment of the present application.
  • FIG. 8 is another schematic flowchart of re-registration in the embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of an apparatus for access authentication in an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • FIG. 11 is another schematic structural diagram of an apparatus for access authentication in an embodiment of the present application.
  • the terms “comprises” and “comprises” and “the” and “the” are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or modules is not necessarily limited to Those steps or modules, but may include other steps or modules not explicitly listed or inherent to the processes, methods, products or devices, the division of modules occurring in the embodiments of the present application is merely a logical The division may be implemented in an actual application. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.
  • the displayed or discussed mutual The coupling or the direct coupling or the communication connection may be through some interfaces, and the indirect coupling or the communication connection between the modules may be electrical or the like, which is not limited in the embodiment of the present application.
  • the modules or sub-modules described as separate components may or may not be physically separated, may not be physical modules, or may be distributed to multiple circuit modules, and some or all of them may be selected according to actual needs.
  • the module implements the purpose of the solution of the embodiments of the present application.
  • the embodiment of the present application provides a method and an apparatus for access authentication.
  • the embodiment of the present application can be used in a scenario where a terminal device accesses a core network from a non-3GPP access network.
  • the non-3GPP access network may be a trusted non-3GPP access network or a non-trusted non-3GPP access network.
  • the network element involved in the embodiment of the present application mainly includes a terminal device, a gateway device, and an access and mobility management network element.
  • the gateway device in this embodiment is a gateway device that is not a 3GPP access network.
  • FIG. 1 is a schematic diagram of a system architecture involved in an embodiment of the present application.
  • the terminal device can access the core network from the non-3GPP access network and the gateway device, and the terminal device can also access the core network from the 3GPP access network.
  • the gateway device and the access and mobility management network element exchange information through the N2 interface.
  • the session between the gateway device and the user plane network element is transmitted through the N3 interface.
  • the user plane network element transmits service data to the terminal device through the N3 interface.
  • the information exchange between the user plane network element and the session management network element is performed through the N4 interface, and the session management network element and the access and mobility management network element exchange information through the N11 interface.
  • the embodiment of the present application adopts an extended authentication protocol (English full name: extensible authentication protocol, English abbreviation: EAP) in the authentication process of the NAS in EAP information structure.
  • EAP extended authentication protocol
  • the terminal device transmits the non-access stratum (English name: non-access stratum, English abbreviation: NAS) information to the gateway device in the EAP-5G payload (payload), and the 5G core network uses EAP-authentication and confidentiality.
  • the key agreement protocol (English name: authentication and key agreement, English abbreviation: AKA) / EAP-AKA' authenticates the terminal device.
  • a layer of EAP authentication process refers to the authentication process from the terminal device to the core network.
  • the EAP authentication process can be referred to as the A-layer EAP authentication process.
  • the other layer of EAP authentication refers to the terminal device.
  • the gateway device in the EAP authentication process does not perform the authentication operation on the terminal device, and only processes and transmits the information.
  • the EAP authentication process of the layer may be simply referred to as the B layer.
  • EAP authentication process the subsequent EAP information or NAS information appearing in the A-layer EAP authentication process may be referred to as the A-layer EAP information or the A-layer NAS information.
  • the EAP-Request includes a NAS information, such as registration request information.
  • the NAS information included in the EAP-Request includes an EAP message, for example, the EAP message may be an EAP-AKA/Challenge message.
  • the following provides an example for providing a method for access authentication, which includes:
  • the terminal device sends a first authentication request to the gateway device.
  • the first authentication request includes a first EAP message
  • the first EAP information includes first NAS information.
  • the first NAS information may include a registration request.
  • the first EAP information further includes identifier information of the terminal device.
  • the terminal device may further carry the registration indication information in the first NAS information, where the value of the registration indication information is The value of the initial registration indicates that the terminal device is the initial registration this time.
  • the first NAS information does not include any re-registration indication information, it indicates that the terminal device is the initial registration.
  • the gateway device may be a gateway device of a non-3GPP access network.
  • the first NAS information may be located in a payload in the first EAP information.
  • the gateway device receives a first authentication request sent by the terminal device.
  • the gateway device sends the first NAS information to an access and mobility management entity.
  • the gateway device may carry the second EAP information in the sent first NAS information.
  • the first NAS information in this step is used to trigger EAP authentication of the core device to the terminal device.
  • the access and mobility management network element receives first NAS information sent by the gateway device.
  • the access and mobility management network element sends an authentication request to the authentication server according to the first NAS information.
  • the access and mobility management network element may carry the second EAP information in the authentication request.
  • the authentication server receives an authentication request, and performs EAP authentication on the terminal device.
  • the authentication server may authenticate the terminal device according to the second EAP information and the device identifier.
  • the authentication server sends an EAP authentication result to the terminal device to the access and mobility management network element.
  • the EAP authentication result may be EAP authentication success information or EAP authentication failure information.
  • the access and mobility management network element After receiving the EAP authentication result, the access and mobility management network element sends the EAP authentication result to the gateway device.
  • the gateway device acquires an EAP authentication result of the terminal device from the access and mobility management network element, and sends second NAS information to the terminal device.
  • the second NAS information includes the EAP authentication result.
  • the second NAS information may include a registration response, and the registration response may be a registration acceptance or a registration rejection.
  • the obtaining, by the gateway device, the EAP authentication result of the terminal device from the access and mobility management network element may include one of the following implementation manners:
  • the access and mobility management network element sends a first message to the gateway device, where the first message carries a security mode command and the EAP authentication result.
  • the gateway device receives the first message from the access and mobility management network element, thereby acquiring the EAP authentication result.
  • the first message may be an N2 message or a NAS message type.
  • the gateway device further needs to process the EAP authentication result, that is, the second NAS information included in the authentication response sent to the terminal device in step 209 is
  • the EAP authentication result generated by the gateway device is included in the second NAS information.
  • the gateway device receives a security mode command from the access and mobility management network element, the security mode command including the EAP authentication result.
  • the third NAS information includes the EAP authentication result.
  • the gateway device may obtain the EAP authentication result from the third NAS information, and then send the third NAS message to the terminal device. .
  • the second NAS information that the gateway device sends to the terminal device may include security.
  • the gateway device when the gateway device obtains the EAP authentication result by using the foregoing (a) and (b) implementation manners, the gateway device needs to process the EAP authentication result. Send to the terminal device.
  • the second NAS information in the embodiment of the present application may be located in a payload of the EAP information.
  • the second NAS information may further include indication information, where the indication information is used to indicate that the second NAS information carries the EAP authentication result.
  • the indication information may specifically meet one of the following items:
  • the content of the indication information is empty, or the indication information is located in a package header of the second NAS information, or the indication information is located in the content of the second NAS information.
  • the designation information is designed to be located in the content of the second NAS information, the following situations may be included:
  • the second NAS information is a new type of NAS information, and the EAP authentication result is included in the new NAS type information.
  • the second NAS information includes a security mode command (English name: SMC), and the EAP authentication result is included in the SMC of the NAS information.
  • SMC security mode command
  • the first NAS information is a registration request, and when the second NAS information includes a registration response of the terminal device, the EAP authentication result may also be included in the registration response of the second NAS information.
  • the embodiment of the present application provides a variety of information carrying manners, which provides convenient and effective transmission of information interaction in the EAP authentication process. It is also flexible to choose different types of information to be packaged to accommodate diverse information interactions.
  • the terminal device receives second NAS information sent by the gateway device.
  • the EAP information may be carried in the authentication response carrying the second NAS information, where the second NAS information is included in the EAP information, and the information structure of the EAP in NAS in EAP is used to implement the information. Effective delivery.
  • the second NAS information may be carried in a payload of the EAP information.
  • the gateway device sends a first authentication response of the first authentication request to the terminal device.
  • the first authentication response is used to notify the terminal device that the EAP authentication process for the terminal device has been completed.
  • the gateway device after the gateway device receives the first authentication request sent by the terminal device, in the authentication process, the gateway device will carry the first NAS of the second EAP information. The information is sent to the access and mobility management network element, and the EAP authentication result obtained from the access and mobility management network element is sent to the terminal device in the second NAS information, and finally the first authentication is sent to the terminal device. response. It can be seen that the embodiment of the present application completes the EAP authentication process for the terminal device based on the information structure of the EAP in NAS in EAP, and the gateway device ends the EAP authentication process with the first authentication response.
  • the terminal device may further send a second authentication request to the gateway device.
  • the sending, by the terminal device, the second authentication request to the gateway device may include the following two modes, and the two methods are applicable to the two situations: EAP authentication success and EAP authentication failure.
  • the second authentication request may carry fourth NAS information, where the fourth NAS information is a response of the terminal device to the second NAS information.
  • the content of the fourth NAS information is empty; or the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the terminal device may not put any substantial data in the NAS message, that is, the second NAS information includes only the encapsulation header and includes a data portion payload without substantial content.
  • the fourth NAS information returned by the terminal device may include a security mode complete (English name: security mode complete, English abbreviation: SMP), and the SMP is SMC's response.
  • SMP security mode complete
  • the fourth NAS information may also be located in a payload in the EAP information.
  • the second authentication request only carries the EAP information, and the EAP information does not include the NAS information and the EAP information related to the A-layer EAP authentication.
  • the gateway device may send the first authentication response to the terminal device.
  • the second NAS information of step 306 does not carry the registration response of the terminal device.
  • the gateway device receives the second authentication request sent by the terminal device, the gateway device Before the first authentication response is sent to the terminal device, the method may further include the following operations:
  • the gateway device sends the fourth NAS information in the second authentication request to the access and mobility management network element.
  • the access and mobility management network element receives the fourth NAS information sent by the gateway device, and sends fifth NAS information to the gateway device.
  • the fifth NAS information carries a registration response of the terminal device, and is used to indicate that the terminal device is registered to accept or refuse to register.
  • the gateway device After receiving the fifth NAS information sent by the access and mobility management network element, the gateway device sends the fifth NAS information to the terminal device.
  • the terminal device After receiving the fifth NAS information sent by the gateway device, the terminal device sends a third authentication request to the gateway device.
  • the third authentication request in the step 4 includes NAS information, where the NAS information is used to instruct the terminal device to complete registration.
  • the authentication request in the step 4 may further include EAP information, where the NAS information may be included in the EAP information, or may be included in the payload of the EAP information.
  • the information sent by the terminal device to the gateway device is also implemented based on the information structure of the EAP in NAS in EAP.
  • the gateway device receives the third authentication request sent by the terminal device, the first authentication response may be sent to the terminal device.
  • the first Child SA is established between the terminal device gateway devices, and the IP SA tunnel of the Child SA is used to transmit subsequent NAS information.
  • the terminal device and the gateway device can transmit subsequent NAS information based on the established Child SA IPsec tunnel.
  • the gateway device may adopt the following two The method determines whether the registration process initiated by the terminal device is re-registration:
  • the registration indication information may further indicate that the terminal device is initially registered, that is, by indicating that the value of the registration indication information is an initial registration value. For example, if the value of the registration indication information is 0, it indicates the initial registration.
  • the specific manner of the present application is not limited in this embodiment.
  • the re-registration indication information may be directly carried in the registration request sent by the terminal device, for example, the registration indication information is indicated as re-registration, that is, an explicit indication.
  • the manner of the indication is not limited in the embodiment of the present application.
  • the embodiment of the present application may include the following steps:
  • the terminal device sends a first authentication request to the gateway device.
  • the first authentication request includes first EAP information, the first EAP information includes first NAS information, and the first NAS information includes re-registration indication information.
  • the first NAS information may also be registration request information.
  • the device identification of the terminal device may also be included in the first authentication request.
  • the first NAS information is used to instruct the gateway device to initiate a registration process, and does not initiate an EAP authentication process for the terminal device.
  • the re-registration indication information may be an implicit indication, for example, the re-registration indication information is a NAS message type, or the re-registration indication information is displayed indication information, for example, indicated by a bit. .
  • the first authentication request may include a device identifier of the terminal device, and the first NAS information may be included in the first EAP information.
  • the gateway device receives a first authentication request sent by the terminal device.
  • the gateway device sends a registration request to the access and mobility management network element according to the first NAS information.
  • the registration request may carry the first NAS information, where the registration request triggers the access and mobility management network element to perform integrity verification on the registration request.
  • the access and mobility management network element receives the registration request sent by the gateway device, performs integrity verification on the registration request according to the first NAS information in the registration request, that is, performs integrity on the first NAS information. verification.
  • the purpose of the integrity authentication performed by the access and mobility management network element on the registration request for the entire message is to verify whether the terminal device uses the correct NAS encryption method and key previously negotiated.
  • the access and mobility management network element sends second NAS information to the gateway device.
  • the second NAS information includes a registration response of the terminal device.
  • the registration response can be either a registration acceptance or a registration rejection.
  • the gateway device receives second NAS information that is sent by the access and mobility management network element.
  • the gateway device sends a first authentication response of the first authentication request to the terminal device.
  • the first authentication response may carry EAP information, and the EAP authentication process may be ended by using the EAP information.
  • the gateway device uses non-3GPP interworking function (English name: non-3GPP interworking function, English abbreviation: N3IWF), with access and mobility management functions (English name: core access and mobility management function, English abbreviation: AMF) Give an example.
  • non-3GPP interworking function English name: non-3GPP interworking function, English abbreviation: N3IWF
  • access and mobility management functions English name: core access and mobility management function, English abbreviation: AMF
  • the successful embodiment of the EAP authentication may include the embodiments shown in FIG. 4 and FIG. 5, which are respectively described below.
  • the solution of the embodiment may be used in an access scenario of a non-3GPP access network, and the message interaction between the terminal device and the N3IWF is performed based on the EAP in NAS in EAP information structure.
  • Pass the information structure of the EAP in NAS in EAP is encapsulated in the second version of the network key exchange (English name: Internet Key Exchange v2, English abbreviation: IKEv2) protocol.
  • IKEv2 protocol refers to a security protocol that uses the security protocol to perform encrypted communication, so that the terminal device can maintain the encrypted connection even when the network status changes frequently, without frequent flashing, disconnecting, reconnection, and the like. happening.
  • the N3IWF sends the authentication result to the terminal device when receiving the message indicating the terminal device authentication result, and stops the B layer EAP authentication process according to the terminal device authentication result.
  • the interaction between the protocol layers on the terminal device is not required, and the N3IWF separately sends an independent termination message to the two-layer EAP process. Specifically, the following processes are included:
  • the terminal device obtains the address information of the N3IWF.
  • the network key exchange security access between the terminal device and the N3IWF (English full name: Internet Key Exchange security access, English abbreviation: IKE SA) IKE SA channel.
  • the terminal device sends an IKE authentication request (IKE_AUTH Req) to the N3IWF, where the AUTH payload is not carried, indicating that the EAP authentication process is to be used.
  • the authentication request is an authentication request for the B layer.
  • the N3IWF sends an IKE authentication response (IKE_AUTH Res) to the terminal device, and the EAP request (EAP-Req) is included in the authentication response, indicating that the B-layer EAP authentication process is started.
  • IKE_AUTH Res IKE authentication response
  • EAP-Req EAP request
  • the terminal device sends a first authentication request to the N3IWF, where IKE_AUTH Req includes an EAP response (EAP-Res), EAP-Res is a response of the terminal device to EAP-Req in step 4, and EAP-Res is the first EAP information.
  • the EAP response includes NAS information (ie, the first NAS information described above).
  • the NAS information may be a registration request (Registration Req).
  • the first authentication request is an authentication request for the A layer.
  • the N3IWF sends a registration request to the AMF, and initiates an EAP authentication process of the terminal device.
  • the N3IWF may carry an EAP response (EAP-Res) in the registration request, and the EAP response is the foregoing second EAP information.
  • EAP-Res EAP response
  • the AMF After receiving the registration request, the AMF initiates an authentication request (Auth_Req) to the authentication server, and carries the EAP response in step 6 in the authentication request.
  • Auth_Req an authentication request
  • the authentication server replies to the AMF with an authentication response (Auth_Res), and the Auth_Res includes an EAP request (EAP-Req).
  • the AMF sends an authentication request to the N3IWF.
  • the authentication request includes an EAP request (EAP-Req), and the authentication request may be an N2 encapsulated NAS message, that is, an Authentication Request.
  • the N3IWF sends an authentication response to the terminal device, where the authentication response includes an EAP request (EAP-Req), and the N3IWF may send the received authentication request in the EAP-Req.
  • the EAP response is included in the authentication response, and the EAP response may be EAP-Res/AKA-challenge.
  • the terminal device sends an IKE authentication request to the N3IWF, where the second authentication request includes an EAP response (EAP-Res), and the terminal device can include the authentication response in step 11 in the EAP of the IKE authentication request in this step. Send in Res.
  • EAP-Res EAP response
  • the N3IWF carries the authentication response received in step 11 in the authentication request and sends it to the AMF.
  • the AMF sends the EAP response in the authentication response (ie, EAP-Res/AKA-challenge in step 10) to the authentication server.
  • the A-layer EAP authentication success information (EAP-Success) is sent to the AMF.
  • the A-layer EAP-Success is carried in the NAS information and sent to the N3IWF.
  • the NAS information may be the NAS SMC Req.
  • the NAS information may be placed in the N2. Sent in the message.
  • the N3IWF After receiving the NAS SMC Req in step 15, the N3IWF sends an authentication response to the terminal device, and the NAS SMC Req can also be sent to the terminal device in the EAP-5G payload.
  • the NAS SMC Req includes an A-layer EAP-Success, and the NAS SMC Req is the second NAS information.
  • the terminal device After receiving the NAS SMC Req, the terminal device sends a second authentication request to the N3IWF. In some embodiments, the terminal device may also send the NAS SMP message to the N3IWF in the EAP-5G payload. The NAS SMP message is the response of the terminal device to the NAS SMC req.
  • the N3IWF sends the NAS SMP message to the AMF.
  • the AMF sends a Registration Accept message to the N3 IWF, where the registration accept message refers to the third NAS information.
  • the N3IWF receives the Registration Accept message, and sends the authentication response of the second authentication request in step 17 to the terminal device, and optionally records the EAP authentication result of the terminal device.
  • the IKE authentication response includes an EAP-5G payload, and the Registration Accept can be placed in the NAS information payload of the EAP-5G payload.
  • the terminal device sends an IKE authentication request (IKE_AUTH Req) to the N3IWF, where the IKE_AUTH Req includes the EAP-5G payload, and the Registration Complete information can be placed on the EAP-5G payload NAS. Information.
  • the N3 IWF may perform the authentication result according to the record. Sending a first authentication response to the terminal device, where the first authentication response carries the B layer EAP-Success to the terminal device.
  • the first Child SA is established between the terminal device and the N3IWF, and the IPsec tunnel of the Child SA is used to transmit subsequent NAS information.
  • the NAS information between the terminal device and the N3IWF may be transmitted based on the IPsec tunnel of the Child SA.
  • the access scenario of the non-trusted/trusted non-3GPP access network can be used.
  • the message exchange between the terminal device and the N3IWF adopts the EAP in NAS in EAP message.
  • the structure carries the information.
  • the information structure of the EAP in NAS in EAP is encapsulated and transmitted in the IKEv2 protocol.
  • the information structure of the EAP in NAS in EAP is not encapsulated by the IKEv2 protocol.
  • the N3IWF when receiving the message indicating the authentication result of the terminal device, the N3IWF encapsulates the authentication result in a special NAS information and sends the result to the terminal device, and sends the B layer according to the terminal device authentication result.
  • the EAP-success is sent to the terminal device to stop the B-layer EAP authentication process, and the N3IWF sends an independent termination message to the two-layer EAP process.
  • the main process includes the following steps:
  • the AMF After the AMF receives the A-layer EAP-Success returned by the authentication server, the A-layer EAP-Success and the NAS SMC message are placed in the N2 message and transmitted to the N3IWF.
  • the N2 message refers to the first message.
  • the N3IWF After receiving the A-layer EAP-Success, the N3IWF sends the A-layer EAP-Success to the terminal device in the second NAS information. At the same time, the N3IWF can also record the EAP authentication result of the terminal device. For example, the N3IWF can record the terminal device authentication success according to the A-layer EAP-Success, or determine that the terminal device has successfully authenticated according to the NAS SMC message in the N2 message. The N3IWF may send a Layer B EAP-Success to the terminal device according to the EAP authentication result of the terminal device.
  • the terminal device sends a second authentication request to the N3IWF.
  • the second authentication request may carry an EAP response and NAS information (ie, the fourth NAS information described above).
  • the terminal device may also send the fourth NAS information to the N3IWF in the payload of the EAP-5G. In some embodiments, the terminal device may not perform step 17.
  • the N3 IWF may send a first authentication response to the terminal device according to the recorded EAP authentication result, and carry the B layer EAP-Success in the first authentication response.
  • the IPsec tunnel of the first child SA is established between the terminal device and the N3IWF, and the IPsec tunnel of the Child SA is used to transmit subsequent NAS information.
  • the subsequent NAS information is transmitted between the terminal device and the N3IWF based on the Child SA IPsec tunnel. For example, after receiving the NAS SMC information sent by the N3IWF, the terminal device sends the NAS SMP information to the N3IWF, where the NAS SMP information is a response of the terminal device to the NAS SMC information.
  • the N3IWF sends the received NAS SMP message to the AMF.
  • the AMF sends a Registration Accept message to the N3IWF.
  • the N3IWF sends a Registration Accept message to the terminal device.
  • the EAP authentication failure embodiment includes the embodiments shown in FIG. 6 and FIG. 7, which are respectively described below.
  • the solution of this embodiment can be used in a trusted non-3GPP access scenario.
  • the message interaction between the terminal device and the N3IWF uses the EAP in NAS in EAP information structure for information transmission.
  • the information structure of the EAP in NAS in EAP is encapsulated and transmitted in the IKEv2 protocol.
  • IKEv2 encapsulation In the embodiment of the present application, when receiving the message indicating the EAP authentication result of the terminal device, the N3IWF sends the EAP authentication result to the terminal device, and sends the B layer EAP-failure to the terminal device according to the EAP authentication result. Therefore, the B-layer EAP authentication process is stopped, and the N3IWF separately sends an independent termination message to the two-layer EAP process. Specifically, the following processes are included:
  • Step 1-13 is the same as the embodiment corresponding to FIG. 4 and will not be described again.
  • the AMF After the authentication server fails to authenticate the terminal device, the AMF sends an A-layer EAP authentication failure information (EAP-Failure) to the AMF.
  • EAP-Failure A-layer EAP authentication failure information
  • the AMF After receiving the A-layer EAP-Failure returned by the authentication server, the AMF sends the A-layer EAP-Failure to the third NAS information and sends it to the N3WIF.
  • the third NAS information may include a Registration-Failure message, and the AMF may place the A-layer EAP-Failure in the Registration-Failure message.
  • the N3IWF sends the second NAS information to the terminal device.
  • the second NAS information when it is sent, it may be sent in the form of a NAS.
  • the N3IWF can also record the EAP authentication result of the terminal device according to the Registration-Failure or the A-layer EAP-Failure.
  • the terminal device sends a second authentication request to the N3IWF.
  • the authentication request may include only an EAP request (EAP-Req), and the NAS information and the A-layer EAP information do not exist in the EAP-Req.
  • the N3IWF sends the first authentication response to the terminal device, and the Layer B EAP-Failure is carried in the first authentication response to the terminal device according to the recorded EAP authentication result of the terminal device, so as to stop the EAP authentication process of the terminal device.
  • the solution of this embodiment can be used in an access scenario of a non-trusted/trusted non-3GPP access network, and the message interaction between the terminal device and the N3IWF is based on EAP in NAS.
  • EAP information structure for information transfer.
  • the information structure of the EAP in NAS in EAP is encapsulated and transmitted in the IKEv2 protocol.
  • the information structure of the EAP in NAS in EAP is not encapsulated by the IKEv2 protocol.
  • the N3IWF when receiving the message indicating the EAP authentication result of the terminal device, the N3IWF encapsulates the EAP authentication result in a special NAS information and sends the result to the terminal device, and sends the B according to the EAP authentication result.
  • the layer EAP-Failure is sent to the terminal device to stop the B-layer EAP authentication process.
  • the interaction between the protocol layers on the terminal device is not required, and the N3IWF sends an independent termination message to the two-layer EAP process. Specifically, the following processes are included:
  • Step 1-13 is the same as the embodiment corresponding to FIG. 4 and will not be described again.
  • the authentication server After the authentication server fails to authenticate the terminal device, it sends an EAP authentication failure information (EAP-Failure) to the AMF to the AMF.
  • EAP-Failure EAP authentication failure information
  • the A-layer EAP-Failure After the AMF receives the A-layer EAP-Failure returned by the authentication server, the A-layer EAP-Failure sends the A-layer EAP-Failure to the N3WIF in the second NAS information. Alternatively, the EAP-Failure is sent to the N3WIF by placing the A-layer EAP-Failure in the N2 information.
  • the second NAS information may be a new type of NAS information, such as marking a new message type on the NAS encapsulation header, or a special indication, such as on a NAS encapsulation header or in NAS information (in a NAS-PDU). Add a new indication.
  • the special NAS information indicates that the terminal device needs to send the EAP-Failure of the A layer to the upper EAP layer of the terminal device for processing.
  • the N3IWF needs to send the EAP-Failure in the N2 information to a terminal device in a special NAS information (for example, the foregoing second NAS information).
  • the structure of the second NAS information generated by the N3WIF is the same as the second NAS information generated by the AMF.
  • the N3IWF sends the second NAS information carrying the A-layer EAP-Failure to the terminal device.
  • the terminal device After receiving the EAP-Failure, the terminal device sends a second authentication request to the N3IWF, where the authentication request may include only an EAP request (EAP-Req), where the EAP-Req carries the NAS information (ie, the fourth NAS information) ).
  • EAP-Req EAP request
  • the EAP-Req carries the NAS information (ie, the fourth NAS information)
  • the N3IWF sends a first authentication response to the terminal device, and sends a first authentication response carrying the B layer EAP-Failure to the terminal device according to the recorded authentication result of the terminal device, so as to stop the B layer EAP authentication process.
  • the solution of the embodiment may be used in an access scenario of a non-trusted/trusted non-3GPP access network.
  • the N3IWF is configured according to a re-registration sent by the terminal device.
  • the information determines whether an EAP message is included in the NAS information sent to the AMF.
  • unnecessary EAP authentication procedures are omitted. Specifically, the following processes are included:
  • the terminal device obtains the address of the N3IWF.
  • An IKE SA is established between the terminal device and the N3IWF.
  • the terminal device needs to carry the re-registration indication (re-reg indication) in the IKE authentication request (IKE_AUTH Req), and the indication is used to indicate that the N3IWF core network does not need to initiate the EAP authentication process.
  • the NAS information in this step can be either Registration req or Service req.
  • the re-registration indication information may be an indication of display, or may be a NAS information type, such as a service request (Service Req).
  • This step corresponds to the step 1-4 in the first embodiment. If the terminal device does not include the re-registration indication information in step 3, or the registration indication information carried in the IKE authentication request in step 3 takes the initial registration. In this case, the N3IWF needs to include an EAP message in the NAS information in step 5 to initiate EAP authentication.
  • the N3IWF sends an IKE authentication response (IKE_AUTH Res) to the terminal device, and the EAP message (EAP-Req) indicates that the B layer EAP authentication process is started.
  • IKE_AUTH Res IKE authentication response
  • EAP-Req EAP message
  • the terminal device sends a first authentication request to the N3IWF, where the EAP message included in the first authentication request includes a NAS information, that is, a registration req.
  • the N3IWF sends the NAS information received in step 3 to the AMF according to the received re-registration indication information, where the transmitted NAS information does not include the EAP message.
  • the AMF performs integrity verification on the received NAS information.
  • the AMF sends a registration response to the N3IWF. If the registration request is received, the registration response may carry a registration accept message or a Service Accept message; if the registration request is rejected, the registration response may be Carry a registration reject message or a service reject message to the N3IWF.
  • the N3IWF sends a first authentication response to the terminal device according to the received registration response, where the first authentication response includes a B layer EAP-Success or a B layer EAP-Failure.
  • the first Child SA is established between the terminal device and the N3IWF.
  • the IPsec tunnel of the Child SA is used to transmit subsequent NAS information.
  • the information exchange between the terminal device and the N3IWF based on the IPsec tunnel of the Child SA is registered or accepted.
  • the foregoing describes an access authentication method in the embodiment of the present application.
  • the following describes the apparatus and the terminal device for performing the foregoing method for access authentication, and the device and the terminal device for performing the foregoing access method.
  • the apparatus for access authentication has a function of implementing a method performed by a gateway device corresponding to an embodiment corresponding to any of the above-described FIGS. 2-8.
  • the device includes a transceiver module and a processing module, and the processing module is configured to control the transceiver operation of the transceiver module:
  • the transceiver module is configured to receive a first authentication request sent by the terminal device, where the first authentication request includes a first extended authentication protocol EAP information, where the first EAP information includes first non-access stratum NAS information;
  • the transceiver module is further configured to send the first NAS information to the access and mobility management network element, where the first NAS information includes second EAP information, where the first NAS information is used to trigger the core network to EAP authentication of the terminal device;
  • the transceiver module is further configured to obtain, by the access and mobility management network element, an EAP authentication result of the core network to the terminal device;
  • the transceiver module is further configured to send second NAS information to the terminal device, where the second NAS information includes the EAP authentication result;
  • the transceiver module is further configured to send, to the terminal device, a first authentication response of the first authentication request.
  • the transceiver module after the transceiver module receives the first authentication request sent by the terminal device, in the authentication process, the transceiver module will carry the first NAS of the second EAP information.
  • the information is sent to the access and mobility management network element, and the EAP authentication result obtained from the access and mobility management network element is sent to the terminal device in the second NAS information, and finally the first authentication is sent to the terminal device. response.
  • the embodiment of the present application completes the EAP authentication process for the terminal device based on the information structure of the EAP in NAS in EAP, and the gateway device ends the EAP authentication process with the first authentication response.
  • the transceiver module obtains the EAP authentication result of the terminal device from the access and mobility management network element, and includes one of the following implementation manners:
  • the transceiver module is specifically configured to:
  • the first NAS information includes registration request information.
  • the second NAS information includes a registration response.
  • the second NAS information includes indication information, where the indication information is used to indicate that the second NAS information carries the EAP authentication result.
  • the transceiver module after the sending, by the transceiver module, the second NAS information to the terminal device, before sending the first authentication response of the first authentication request to the terminal device, Used for:
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the transceiver module after the sending, by the transceiver module, the second NAS information to the terminal device, before sending the first authentication response of the first authentication request to the terminal device, Used for:
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information carries the registration indication information, where the value of the registration indication information is an initially registered value.
  • the terminal device includes a transceiver module and a processing module, and the processing module is configured to control a transceiver operation of the transceiver module.
  • the transceiver module is configured to send a first authentication request to the gateway device, where the first authentication request includes first extended authentication protocol EAP information, and the first EAP information includes first non-access stratum NAS information.
  • the first NAS information is used to trigger a registration process of the terminal device;
  • the transceiver module is further configured to receive second NAS information sent by the gateway device, where the second NAS information includes an EAP authentication result of the core device to the terminal device;
  • the transceiver module is further configured to receive a first authentication response of the first authentication request sent by the gateway device.
  • the transceiver module sends a first authentication request to the gateway device, so that the gateway device sends the first NAS information carrying the second EAP information to the gateway during the authentication process.
  • the ingress and mobility management network element, and the EAP authentication result obtained from the access and mobility management network element is sent to the terminal device in the second NAS information, and finally the first authentication response is sent to the terminal device.
  • the embodiment of the present application completes the EAP authentication process for the terminal device based on the information structure of the EAP in NAS in EAP, and the gateway device ends the EAP authentication process with the first authentication response.
  • the transceiver module is specifically configured to:
  • the gateway device Receiving, by the gateway device, the second NAS information, where the second NAS information includes a security mode command, where the security mode command includes the EAP authentication result.
  • the first NAS information includes registration request information.
  • the second NAS information includes a registration response.
  • the transceiver module after receiving the second NAS information sent by the gateway device, before receiving the first authentication response sent by the gateway device, is further used to:
  • the content of the fourth NAS information is empty;
  • the fourth NAS information includes indication information, where the indication information is used to indicate that the fourth NAS information is a response of the second NAS information.
  • the transceiver module after receiving the second NAS information sent by the gateway device, before receiving the first authentication response sent by the gateway device, is further used to:
  • the first NAS information is located in a payload of the first EAP information.
  • the first NAS information does not include re-registration indication information
  • the first NAS information includes registration indication information, and the value of the registration indication information is an initially registered value.
  • the apparatus for access authentication has implementation of access and mobility management in an embodiment corresponding to any of the foregoing FIG. 2-8.
  • the transceiver module and the processing module in FIG. 9 respectively perform operations performed by the access and mobility management network element.
  • the transceiver module is configured to receive the first non-access stratum NAS information sent by the gateway device, where the first NAS information includes second EAP information, where the first NAS information is used. Triggering the EAP authentication of the terminal device by the core network.
  • the transceiver module is further configured to send an authentication request to the authentication server according to the second EAP information.
  • the transceiver module is further configured to receive an EAP authentication result from the authentication server to the terminal device.
  • the transceiver module is further configured to send the EAP authentication result to the gateway device.
  • the transceiver module after receiving the first NAS information, the transceiver module sends an authentication request to the authentication server according to the second EAP information, and the The EAP authentication result obtained by the authentication server is sent to the gateway device, so that the gateway device sends the EAP authentication result to the terminal device in the second NAS information, and finally sends the first authentication response to the terminal device.
  • the embodiment of the present application completes the EAP authentication process for the terminal device based on the information structure of the EAP in NAS in EAP, and the gateway device ends the EAP authentication process with the first authentication response.
  • the transceiver module sends the EAP authentication result to the gateway device, including one of the following implementation manners:
  • the embodiments of the present application provide a variety of information carrying modes, and provide convenient and effective transmission of information interaction in the EAP authentication process. It is also flexible to choose different types of information to be packaged to accommodate diverse information interactions.
  • the first NAS information is a registration request
  • the transceiver module is specifically configured to:
  • the device for access authentication corresponding to FIG. 9 can also be used for accessing a network.
  • the device shown in FIG. 9 has an implementation corresponding to the above.
  • the apparatus shown in FIG. 9 implements the functions of the gateway device, the transceiver module and the processing module in FIG. 9 respectively perform operations performed by the gateway device.
  • the transceiver module is configured to receive a first authentication request sent by the terminal device, where the first authentication request includes a first extended authentication protocol EAP information, and the first EAP information
  • the first non-access stratum NAS information is included, and the first NAS information includes re-registration indication information, where the re-registration indication information is used to indicate that the gateway device does not initiate an EAP authentication procedure for the terminal device.
  • the transceiver module is further configured to send a registration request to the access and mobility management network element according to the first NAS information;
  • the transceiver module is further configured to receive a registration response sent by the access and mobility management network element;
  • the transceiver module is further configured to send, to the terminal device, a first authentication response of the first authentication request.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • the terminal device shown in FIG. 10 can also be used to access the network.
  • the terminal device shown in FIG. 10 has an implementation corresponding to FIG. 2 above.
  • the function of the method of accessing the network by the terminal device in any of the corresponding embodiments.
  • the transceiver module is configured to send a first authentication request to the gateway device, where the first authentication request includes first extended authentication protocol EAP information, and the first EAP information includes first non-access stratum NAS information,
  • the first NAS information includes re-registration indication information, where the first NAS information is used to instruct the gateway device to initiate a registration process and does not initiate an EAP authentication process for the terminal device;
  • the transceiver module is further configured to receive a first authentication response of the first authentication request sent by the gateway device 902.
  • the first NAS information is registration request information.
  • the re-registration indication information is displayed indication information, or the re-registration indication information is a NAS message type.
  • FIG. 11 is another schematic structural diagram of an apparatus for accessing authentication or an accessed apparatus or terminal device according to an embodiment of the present disclosure, where at least one processor, at least one network interface or other communication interface, memory, at least A communication bus, at least one receiver, and at least one transmitter are used to effect connection communication between the devices.
  • the above processor is configured to execute an executable module, such as a computer program, stored in the above memory.
  • the above memory may include a high speed random access memory (English name: Random Access Memory, English abbreviation: RAM), and may also include a non-volatile memory, such as at least one disk memory.
  • the communication connection between the system gateway and at least one other network element is implemented by at least one network interface (which may be wired or wireless), and an Internet, a wide area network, a local network, a metropolitan area network, etc. may be used.
  • a program instruction is stored in the memory, and the program instruction may be executed by the processor, and the processor executes the program instruction stored in the memory, and the processor specifically performs the connection in the embodiment of the present application.
  • the physical devices corresponding to all the transceiver modules may be transceivers, and the physical devices corresponding to all the processing modules may be processed.
  • Device Each of the devices shown in FIGS. 9 and 10 may have a structure as shown in FIG. 11, and when one of the devices has the structure as shown in FIG. 11, the processor and the transceiver in FIG. 11 implement the aforementioned corresponding device.
  • the device module provides the same or similar functions as the processing module and the transceiver module, and the memory storage processor in FIG. 11 needs to call the program code when performing the above method of access authentication or the method of accessing.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules is only a logical function division.
  • there may be another division manner for example, multiple modules or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or otherwise.
  • the modules described as separate components may or may not be physically separated.
  • the components displayed as modules may or may not be physical modules, that is, may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the integrated modules, if implemented in the form of software functional modules and sold or used as separate products, may be stored in a computer readable storage medium.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • wire eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé et un appareil d'authentification d'accès, ledit procédé comprenant les étapes suivantes : un dispositif de passerelle de réseau reçoit une première demande d'authentification envoyée par un équipement terminal, des premières informations EAP comprises par ladite première demande d'authentification reprenant des premières informations NAS ; le dispositif de passerelle de réseau envoie des premières informations NAS à une entité de gestion d'accès et de mobilité ; les premières informations NAS reprenant les secondes informations NAS, et les premières informations NAS sont utilisées pour déclencher une authentification EAP dudit équipement terminal ; le dispositif de passerelle de réseau obtient à partir de l'entité de gestion d'accès et de mobilité un résultat d'authentification EAP de l'équipement terminal ; le dispositif de passerelle de réseau envoie des secondes informations NAS à l'équipement terminal, les secondes informations NAS reprennent le résultat d'authentification EAP ; le dispositif de passerelle de réseau envoie à l'équipement terminal une première réponse d'authentification à la première demande d'authentification. Dans les modes de réalisation de la présente invention, seule la coordination entre le dispositif de passerelle de réseau et l'entité de gestion d'accès et de mobilité est nécessaire pour effectuer un processus d'authentification EAP complet.
PCT/CN2018/091048 2017-08-03 2018-06-13 Procédé et appareil d'authentification d'accès WO2019024612A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710657053.4 2017-08-03
CN201710657053.4A CN109391941B (zh) 2017-08-03 2017-08-03 一种接入鉴权的方法及装置

Publications (1)

Publication Number Publication Date
WO2019024612A1 true WO2019024612A1 (fr) 2019-02-07

Family

ID=65232734

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/091048 WO2019024612A1 (fr) 2017-08-03 2018-06-13 Procédé et appareil d'authentification d'accès

Country Status (2)

Country Link
CN (1) CN109391941B (fr)
WO (1) WO2019024612A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116567626A (zh) * 2022-01-27 2023-08-08 维沃移动通信有限公司 设备鉴权方法、装置及通信设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101340708A (zh) * 2007-07-02 2009-01-07 华为技术有限公司 一种网络切换的方法、系统及装置
CN103067342A (zh) * 2011-10-20 2013-04-24 中兴通讯股份有限公司 一种使用eap进行外部认证的设备、系统及方法
WO2014047923A1 (fr) * 2012-09-29 2014-04-03 华为技术有限公司 Procédé et dispositif permettant d'accéder à un réseau
US20160309523A1 (en) * 2015-04-16 2016-10-20 Qualcomm Incorporated Reducing delay in attachment procedure with a network
WO2017099864A1 (fr) * 2015-12-09 2017-06-15 Intel IP Corporation Accès normalisé à des réseaux centraux

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104955021B (zh) * 2010-10-21 2018-10-16 中兴通讯股份有限公司 一种用户签约信息处理方法和系统
US9942762B2 (en) * 2014-03-28 2018-04-10 Qualcomm Incorporated Provisioning credentials in wireless communications
CN106454833A (zh) * 2016-12-21 2017-02-22 锐捷网络股份有限公司 一种实现无线802.1x认证的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101340708A (zh) * 2007-07-02 2009-01-07 华为技术有限公司 一种网络切换的方法、系统及装置
CN103067342A (zh) * 2011-10-20 2013-04-24 中兴通讯股份有限公司 一种使用eap进行外部认证的设备、系统及方法
WO2014047923A1 (fr) * 2012-09-29 2014-04-03 华为技术有限公司 Procédé et dispositif permettant d'accéder à un réseau
US20160309523A1 (en) * 2015-04-16 2016-10-20 Qualcomm Incorporated Reducing delay in attachment procedure with a network
WO2017099864A1 (fr) * 2015-12-09 2017-06-15 Intel IP Corporation Accès normalisé à des réseaux centraux

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"S3 171943, Observations on the solution for untrusted non-3GPP access in S 2-174885", 3GPP TSG SA WG3 (SECURITY) MEETING #88, 31 July 2017 (2017-07-31), XP051312409, Retrieved from the Internet <URL:http://www.3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_88_Dali/Docs> *
S3-171943, OBSERVATIONS ON THE SOLUTION FOR UNTRUSTED NON-3GPP ACCESS IN S 2-174885 , 3GPP TSG SA WG3 (SECURITY) MEETING #88, 31 July 2017 (2017-07-31), XP051312409, Retrieved from the Internet <URL:http://www.3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_88_Dali/Docs> *

Also Published As

Publication number Publication date
CN109391941B (zh) 2020-12-25
CN109391941A (zh) 2019-02-26

Similar Documents

Publication Publication Date Title
US10785653B2 (en) Secure short message service over non-access stratum
US9232398B2 (en) Method and apparatus for link setup
TWI420921B (zh) 異質無線網路之間的快速鑑別
US8176327B2 (en) Authentication protocol
KR102024653B1 (ko) 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
US20090028101A1 (en) Authentication method in a radio communication system, a radio terminal device and radio base station using the method, a radio communication system using them, and a program thereof
JP2014507855A (ja) 信頼できないネットワークを介した外部認証サポート
US20210143988A1 (en) Secure authentication in a communication network
CN112514436B (zh) 发起器和响应器之间的安全的、被认证的通信
AU2020200523B2 (en) Methods and arrangements for authenticating a communication device
WO2019029531A1 (fr) Procédé de déclenchement d&#39;authentification de réseau et dispositif associé
EP4057658A1 (fr) Procédé de vérification de carte de machine appliqué à un réseau minimaliste, et dispositif associé
WO2021244509A1 (fr) Procédé et système de transmission de données, dispositif électronique et support d&#39;enregistrement lisible par ordinateur
WO2019196766A1 (fr) Procédé et appareil de communication
TW201731316A (zh) Ｅ－ｕｔｒａｎ及ｗｌａｎ間之交遞
WO2021244569A1 (fr) Procédé et système de transmission de données, dispositif électronique et support de stockage
KR20230124621A (ko) 비-3gpp 서비스 액세스를 위한 ue 인증 방법 및 시스템
WO2019219209A1 (fr) Établissement de nouvelles sa ipsec
WO2019096287A1 (fr) Procédé d&#39;authentification et dispositif
WO2021083012A1 (fr) Procédé et dispositif de protection de paramètres dans un processus d&#39;authentification
US9532218B2 (en) Implementing a security association during the attachment of a terminal to an access network
WO2019024612A1 (fr) Procédé et appareil d&#39;authentification d&#39;accès
TW201301928A (zh) 無線區域網路中的網路連線方法、程式產品、及系統
CN110226319A (zh) 用于紧急接入期间的参数交换的方法和设备
WO2014117524A1 (fr) Procédé permettant la transmission d&#39;une clé maîtresse par paire dans un réseau local sans fil

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18842041

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18842041

Country of ref document: EP

Kind code of ref document: A1