WO2019062374A1 - 一种密钥衍生算法的协商方法及装置 - Google Patents

一种密钥衍生算法的协商方法及装置 Download PDF

Info

Publication number
WO2019062374A1
WO2019062374A1 PCT/CN2018/100848 CN2018100848W WO2019062374A1 WO 2019062374 A1 WO2019062374 A1 WO 2019062374A1 CN 2018100848 W CN2018100848 W CN 2018100848W WO 2019062374 A1 WO2019062374 A1 WO 2019062374A1
Authority
WO
WIPO (PCT)
Prior art keywords
derivation algorithm
key derivation
key
terminal
algorithm
Prior art date
Application number
PCT/CN2018/100848
Other languages
English (en)
French (fr)
Inventor
胡力
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18860899.6A priority Critical patent/EP3675544A4/en
Publication of WO2019062374A1 publication Critical patent/WO2019062374A1/zh
Priority to US16/821,103 priority patent/US11627458B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H04L9/16—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms the keys or algorithms being changed during operation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present application relates to the field of mobile communications technologies, and in particular, to a method and apparatus for negotiating a key derivation algorithm.
  • Security-related algorithms include integrity protection algorithms, encryption algorithms, and Key Derivation Function (KDF) algorithms.
  • the key derivation function algorithm is also called a key derivation algorithm.
  • the integrity protection algorithm is used to calculate a message authentication code (MAC).
  • the encryption algorithm is used to encrypt the message.
  • the KDF algorithm is used to derive the key.
  • the negotiation method between the terminal and the network side is: the terminal sends the key derivation algorithm supported by the terminal to the network side, and the network side selects one according to a pre-configured policy, such as a priority policy.
  • the key derivation algorithm is sent to the terminal, and the selected key derivation algorithm is used as a negotiated key derivation algorithm.
  • the main problem of the above method is that the initial message sent by the terminal to the network side is vulnerable to attackers because it is not protected by integrity.
  • the key-derived algorithm supported by the attacker to the terminal on the network side The modification is performed so that the network side only receives a weaker key-derived algorithm, so that the network side selects the weaker key-derived algorithm and sends it to the terminal as a negotiated key-derived algorithm, resulting in the terminal and
  • the network side uses a weaker key-derived algorithm to reduce the security of communication.
  • the present application provides a method and apparatus for negotiating a key derivation algorithm to improve communication security.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a chip in a terminal or a terminal.
  • the method includes: the terminal sends a first key derivation algorithm to the storage function entity, where the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the terminal receives an authentication token from the storage function entity, and the authentication token includes a first message authentication code, a second key derivation algorithm, and a third key derivation algorithm.
  • the second key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the storage function entity, and the second key derivation algorithm includes a third key derivation algorithm.
  • the first message authentication code is generated according to a second key derivation algorithm.
  • the terminal generates a second message authentication code according to the second key derivation algorithm. If the first message authentication code is the same as the second message authentication code, and the first key derivation algorithm is the same as the second key derivation algorithm, the terminal acquires the third The key derivation algorithm acts as a key derivation algorithm for the terminal.
  • the terminal checks the sent first key derivation algorithm and the received second key derivation algorithm.
  • the terminal determines The first key derivation algorithm sent by the terminal is not tampered with by the attacker.
  • the negotiated third key derivation algorithm is used as the key derivation algorithm of the terminal. The confidentiality of the negotiated key-derived algorithm is guaranteed, thereby improving the security of the communication.
  • the second key derivation algorithm is carried in the authentication management domain AMF of the authentication token.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a chip in a storage function entity or a storage function entity.
  • the storage function entity may be a Home Subscriber Server (HSS), a Unified Data Management (UDM) entity, an Authentication Credential Repository and Processing Function (ARPF) entity, or the like.
  • the method includes:
  • the storage function entity receives the second key derivation algorithm, and the second key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the storage function entity.
  • the storage function entity selects a third key derivation algorithm from the second key derivation algorithm according to the preset policy, and generates a first message authentication code according to the second key derivation algorithm.
  • the storage function entity sends an authentication token to the terminal, where the authentication token includes a first message authentication code, a third key derivation algorithm, and a second key derivation algorithm.
  • the second key derivation algorithm is carried in the authentication management domain AMF of the authentication token.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a chip in a terminal or a terminal.
  • the method includes: if the first key derivation algorithm is different from the second key derivation algorithm, the terminal sends a first message to the mobility management function entity, where the first message includes a first key derivation algorithm, and the first key derivation algorithm is a terminal Supporting at least one key derivation algorithm, the second key derivation algorithm is a mobile management function entity or a storage function entity storing at least one key derivation algorithm supported by the terminal received by the function entity.
  • the terminal receives a second message from the mobility management function entity, the second message includes a target key derivation algorithm, wherein the first key derivation algorithm includes a target key derivation algorithm.
  • the terminal updates the key derivation algorithm of the terminal to the target key derivation algorithm, and updates the key of the terminal according to the target key derivation algorithm.
  • the terminal When the first key derivation algorithm is different from the second key derivation algorithm, it is determined that the first key derivation algorithm sent by the terminal is tampered with, so the first key derivation algorithm is retransmitted by the first message. At this point, the first message sent is not the initial message, so it can be integrity protected and will not be attacked by the attacker. Therefore, when the terminal receives the target key derivation algorithm, the terminal does not need to perform verification, and the terminal derivation algorithm of the terminal is directly updated to the target derivation algorithm. Thereby, the negotiation of the key derivation algorithm is completed, and the confidentiality of the negotiated key derivation algorithm is ensured, thereby improving the security of the communication.
  • the target key derivation algorithm includes a first target key derivation algorithm from the storage function entity; the terminal updates the key of the terminal according to the target key derivation algorithm, including: the terminal according to the first target key Derived algorithm to update the access security management entity key of the terminal.
  • the terminal further updates the key of the terminal according to the first target key derivation algorithm selected by the storage function entity, such as accessing the security management entity key, to ensure the security of the communication.
  • the second message further includes a first random number from the storage function entity, and the terminal updates the access security management entity key of the terminal according to the first target key derivation algorithm, including: the terminal according to the first The target key derivation algorithm and the first random number update the access security management entity key.
  • the target key derivation algorithm includes a second target key derivation algorithm from the mobility management function entity; the terminal updates the key of the terminal according to the target key derivation algorithm, including: the terminal according to the second target secret A key derivation algorithm that updates a first key used for communication between the terminal and the mobility management functional entity.
  • the terminal further updates the key of the terminal, such as the first key communicated by the terminal and the mobility management function entity, according to the second target key derivation algorithm selected by the mobility management function entity, to ensure the security of the communication.
  • the second message further includes a second random number from the mobility management function entity
  • the method further includes: receiving, by the terminal, a non-access stratum (NAS) security mode completed (SMP) message from the mobility management function entity, where the NAS SMP message includes the second secret Key derived algorithm.
  • the terminal determines that the first key derivation algorithm is different from the second key derivation algorithm.
  • NAS non-access stratum
  • SMP security mode completed
  • the first message is a NAS SMP message and the second message is a NAS security mode comand (SMC) message.
  • SMC NAS security mode comand
  • the first message may be integrity protected, so that the first key derivation algorithm in the first message is not tampering by the attacker, and the security of the communication is ensured.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a chip in a storage function entity or a storage function entity, or by a chip in a mobility management function entity or a mobility management function entity, where
  • the storage function entity may be an HSS, a UDM, or an ARPF
  • the mobility management function entity may be a Mobility Management Entity (MME), an Access and Mobility Management Function (AMF) entity, or the like.
  • the method includes: the network side node receives a first key derivation algorithm from the terminal, and the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the network side node selects a target key derivation algorithm from the first key derivation algorithm according to a preset policy.
  • the network side node updates the key stored in the network side node according to the target key derivation algorithm.
  • the network side node sends a target key derivation algorithm to the terminal.
  • the storage function entity updates the key stored in the network side node according to the target key derivation algorithm, including: the network side node generates a random number.
  • the network side node updates the key stored in the network side node according to the random number and the target key derivation algorithm. And, the network side node sends a random number to the terminal.
  • the network side node is a mobility management function entity, and the key stored in the network side node is a terminal access security management entity key.
  • the network side node is a storage function entity, and the key stored in the network side node is a first key used for communication between the terminal and the mobility management function entity.
  • the network side node is a mobility management function entity, and before the network side node receives the first key derivation algorithm from the terminal, the mobility management function entity receives the second key derivation algorithm, and the second key derivation
  • the algorithm is at least one key derivation algorithm supported by the terminal received by the mobility management function entity.
  • the mobility management function entity sends a non-access stratum NAS security mode completion SMC message to the terminal, and the NAS SMC message includes a second key derivation algorithm.
  • the present application provides a device, which may be a terminal or a chip in a terminal.
  • the device has the functionality to implement the various embodiments of the first aspect described above. This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the terminal when the device is a terminal, the terminal comprises: a processing unit and a communication unit, the processing unit may be, for example, a processor, the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit, optionally,
  • the terminal also includes a storage unit, which may be, for example, a memory.
  • the storage unit stores a computer execution instruction
  • the processing unit is connected to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit, so that the terminal performs any one of the foregoing first aspects.
  • the negotiation method of the key derivation algorithm when the terminal includes a storage unit, the storage unit stores a computer execution instruction, and the processing unit is connected to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit, so that the terminal performs any one of the foregoing first aspects.
  • the chip comprises: a processing unit and a communication unit
  • the processing unit may be, for example, a processor
  • the communication unit may be, for example, an input/output interface, a pin or a circuit. Wait.
  • the processing unit may execute computer execution instructions stored by the storage unit such that the negotiation method of the key derivation algorithm of any of the above aspects is performed.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the terminal, such as a read-only memory (ROM), and may be stored statically. Other types of static storage devices, random access memory (RAM), etc. for information and instructions.
  • the processor mentioned in any of the above may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more An integrated circuit for controlling a program for performing a negotiation method of a key derivation algorithm of the above first aspect.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the application provides a device, which may be a storage function entity, or a chip in a storage function entity, where the storage function entity may be an HSS, a UDM, an ARPF, or the like.
  • the device has the functionality to implement the various embodiments of the second aspect described above. This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage function entity comprises: a processing unit and a communication unit
  • the processing unit may be, for example, a processor
  • the communication unit may be, for example, a transceiver
  • the transceiver includes a radio frequency circuit
  • the storage function entity further comprises a storage unit, which may be, for example, a memory.
  • the storage function entity includes a storage unit
  • the storage unit stores a computer execution instruction
  • the processing unit is coupled to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit to cause the storage function entity to execute the second A negotiation method for a key-derived algorithm of any of the aspects.
  • the chip when the device is a chip in a storage function entity, the chip comprises: a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin. Or circuit, etc.
  • the processing unit may execute computer execution instructions stored by the storage unit such that the negotiation method of the key derivation algorithm of any of the above second aspects is performed.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit outside the chip in the storage function entity, such as a ROM, other types of statics that can store static information and instructions. Storage device, RAM, etc.
  • the processor mentioned in any of the above may be a general-purpose CPU, a microprocessor, an ASIC, or one or more programs for controlling a negotiation method for executing the key-derived algorithm of the second aspect described above. Circuit.
  • the present application provides a device, which may be a terminal or a chip in a terminal.
  • the device has the functionality to implement the various embodiments of the third aspect described above. This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the terminal when the device is a terminal, the terminal comprises: a processing unit and a communication unit, the processing unit may be, for example, a processor, the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit, optionally,
  • the terminal also includes a storage unit, which may be, for example, a memory.
  • the storage unit stores a computer execution instruction
  • the processing unit is connected to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit, so that the terminal performs any one of the foregoing third aspects.
  • the negotiation method of the key derivation algorithm when the terminal includes a storage unit, the storage unit stores a computer execution instruction, and the processing unit is connected to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit, so that the terminal performs any one of the foregoing third aspects.
  • the chip comprises: a processing unit and a communication unit
  • the processing unit may be, for example, a processor
  • the communication unit may be, for example, an input/output interface, a pin or a circuit. Wait.
  • the processing unit may execute computer execution instructions stored by the storage unit such that the negotiation method of the key derivation algorithm of any of the above third aspects is performed.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the terminal, such as a ROM, other types of static storage devices that can store static information and instructions. , RAM, etc.
  • the processor mentioned in any of the above may be a general-purpose CPU, a microprocessor, an ASIC, or one or more programs for controlling a negotiation method for executing the key-derived algorithm of the above third aspect. Circuit.
  • the application provides a device, which may be a storage function entity or a chip in a storage function entity, where the storage function entity may be an HSS, a UDM, an ARPF, or the like.
  • the device has the functionality to implement the various embodiments of the fourth aspect described above.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage function entity comprises: a processing unit and a communication unit
  • the processing unit may be, for example, a processor
  • the communication unit may be, for example, a transceiver
  • the transceiver includes a radio frequency circuit
  • the storage function entity further comprises a storage unit, which may be, for example, a memory.
  • the storage function entity includes a storage unit
  • the storage unit stores a computer execution instruction
  • the processing unit is coupled to the storage unit, and the processing unit executes a computer execution instruction stored by the storage unit to cause the storage function entity to execute the fourth A negotiation method for a key-derived algorithm of any of the aspects.
  • the chip when the device is a chip in a storage function entity, the chip comprises: a processing unit and a communication unit, the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin. Or circuit, etc.
  • the processing unit may execute computer execution instructions stored by the storage unit such that the negotiation method of the key derivation algorithm of any of the above fourth aspects is performed.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit outside the chip in the storage function entity, such as a ROM, other types of statics that can store static information and instructions. Storage device, RAM, etc.
  • the processor mentioned in any of the above may be a general-purpose CPU, a microprocessor, an ASIC, or one or more programs for controlling a negotiation method for executing the key-derived algorithm of the fourth aspect described above. Circuit.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a chip in a terminal or a terminal.
  • the method includes: the terminal sending the first identifier information of the first key derivation algorithm to the network side network element, where the first key derivation algorithm is at least one key derivation algorithm supported by the terminal, and the terminal receives the second key derivation algorithm
  • the second identifier information is generated by the terminal according to the upper layer key, the first identifier information, and the second key derivation algorithm.
  • the terminal sends the first identifier information of the first key derivation algorithm to the network side network element, where the first key derivation algorithm may be tampered with during the sending process, and the terminal receives the second key derivation.
  • the second identification information of the algorithm may be a key derivation algorithm selected by the network side network element, or may be a falsified key derivation algorithm.
  • the terminal generates a lower layer key according to the upper layer key, the first identification information, and the second key derivation algorithm.
  • the first identification information and the second key derivation algorithm of the first key derivation algorithm are used when generating the lower layer key, if the first key algorithm algorithm or the second key derivation algorithm is tampered, it will result in The lower layer key generated by the terminal is different from the lower layer key generated by the network side network element, resulting in communication failure. Only when the first key derivation algorithm and the second key derivation algorithm are not tampered with, the correct communication can be realized, thereby improving the security of communication.
  • the terminal generates a lower layer key according to the upper layer key, the first identification information, and the second key derivation algorithm, including: the terminal according to the upper layer key, the first identification information, the second identification information, and the A second key derivation algorithm that generates a lower layer key.
  • the second identification information when generating the lower layer key, may also be used as an input parameter.
  • the upper layer key is the encryption key CK and the integrity key IK
  • the lower layer key is the security anchor key Kseaf
  • the terminal is derived according to the upper layer key, the first identification information and the second key.
  • the algorithm generates a lower layer key, including: the terminal generates an authentication service key Kausf according to the CK, IK, the first identification information, and the second key derivation algorithm; and generates Kseaf according to the Kausf and the second key derivation algorithm; or The terminal generates Kausf according to the CK, IK, and the second key derivation algorithm; and generates Kseaf according to the Kausf, the first identification information, and the second key derivation algorithm.
  • Kausf and Kseaf can be simultaneously generated in one negotiation process, thereby improving the negotiation efficiency.
  • the upper layer key is Kseaf
  • the lower layer key is the non-access stratum encryption key KNASenc
  • the non-access stratum integrity protection key KNASint the base station key KgNB
  • the non-3GPP access key Kn3iwf At least one of the terminal generates a lower layer key according to the upper layer key, the first identification information, and the second key derivation algorithm, and the method includes: the terminal generates an access management according to the Kseaf, the first identification information, and the second key derivation algorithm.
  • the network side network element is a mobility management function entity AMF
  • the upper layer key is Kamf
  • the lower layer key is at least one of KNASenc, KNASint, KgNB, Kn3iwf; or
  • the network side network element is the security anchor entity SEAF, the upper layer key is Kseaf, and the lower layer key is Kamf; or
  • the network side network element is the authentication service entity AUSF, the upper layer key is Kausf, and the lower layer key is Kseaf; or
  • the network side network element is a unified data management entity, the upper layer key is CK, IK, and the lower layer key is at least one of CK', IK', and Kausf; or
  • the network side network element is the next generation base station gNB, the upper layer key is KgNB, the lower layer key is the wireless connection control encryption key Krrc-enc, the wireless connection control integrity protection key Krrc-int, the user plane encryption key Kup-enc , the user plane integrity protection key Kup-int, at least one of the next hop NH; or,
  • the network side network element is the mobility management entity MME, the upper layer key is the access management key Kamse, and the lower layer key is at least one of KNASenc and KNASint; or
  • the network side network element is the home subscription user server, the upper layer key is CK, IK, and the lower layer key is Kasme; or
  • the network side network element is an eNB
  • the upper layer key is KeNB
  • the lower layer key is at least one of Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH.
  • the present application provides a method for negotiating a key-derived algorithm, which may be performed by a network element in a network side or a chip in a network side network element.
  • the method includes: the network side network element receives the third identifier information of the third key derivation algorithm, and the third key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the network side network element, and the network side network element is configured according to the network side
  • the preset policy selects a fourth key derivation algorithm from the third key derivation algorithm, and the network side network element generates a lower layer key according to the third identification information, the fourth key derivation algorithm, and the upper layer key, and the network side network element moves to the terminal. Sending fourth identification information of the fourth key derivation algorithm.
  • the network side network receives the third identification information of the third key derivation algorithm
  • the third key derivation algorithm may be a key derivation algorithm that is tampered with during the transmission process of the terminal
  • the network side network element is In the third key derivation algorithm, a fourth key derivation algorithm is selected as the negotiated key derivation algorithm, and then sent to the terminal, and the fourth key derivation algorithm may be changed to other key derivation algorithms during the transmission process.
  • the network side network element generates a lower layer key according to the upper layer key, the third identification information, and the fourth key derivation algorithm.
  • the third identification information and the fourth key derivation algorithm of the third key derivation algorithm are used when generating the lower layer key, if the third key algorithm algorithm or the fourth key derivation algorithm is tampered, the The lower layer key generated by the network side network element is different from the lower layer key generated by the terminal, resulting in communication failure. Only when the third key derivation algorithm and the third key derivation algorithm are not tampered with, the correct communication can be realized, thereby improving the security of communication.
  • the network side network element generates a lower layer key according to the third identifier information, the fourth key derivation algorithm, and the upper layer key, including: the network side network element according to the upper layer key, the third identifier information, The fourth identification information and the fourth key derivation algorithm generate a lower layer key.
  • the network side network element is a unified data management entity, the upper layer key is CK, IK, and the lower layer key is Kausf; the network side network element sends the fourth identification information and Kausf to the authentication service entity.
  • the network side network element is a security anchor entity, the upper layer key is Kseaf, and the lower layer key is Kamf; the network side network element sends fourth identification information and Kamf to the mobility management function entity AMF.
  • the network side network element is a mobility management function entity AMF
  • the upper layer key is Kamf
  • the lower layer key is at least one of KNASenc, KNASint, KgNB, Kn3iwf; or
  • the network side network element is the security anchor entity SEAF, the upper layer key is Kseaf, and the lower layer key is Kamf; or
  • the network side network element is the authentication service entity AUSF, the upper layer key is Kausf, and the lower layer key is Kseaf; or
  • the network side network element is a unified data management entity, the upper layer key is CK, IK, and the lower layer key is at least one of CK', IK', and Kausf; or
  • the network side network element is the next generation base station gNB, the upper layer key is KgNB, the lower layer key is the wireless connection control encryption key Krrc-enc, the wireless connection control integrity protection key Krrc-int, the user plane encryption key Kup-enc , the user plane integrity protection key Kup-int, at least one of the next hop NH; or,
  • the network side network element is the mobility management entity MME, the upper layer key is the access management key Kamse, and the lower layer key is at least one of KNASenc and KNASint; or
  • the network side network element is the home subscription user server, the upper layer key is CK, IK, and the lower layer key is Kasme; or
  • the network side network element is an eNB
  • the upper layer key is KeNB
  • the lower layer key is at least one of Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH.
  • the present application further provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the methods described in the above aspects.
  • the present application also provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the various aspects above.
  • FIG. 1 is a schematic diagram of a possible network architecture applicable to the present application
  • FIG. 2 is a schematic diagram of another possible network architecture applicable to the present application.
  • FIG. 3 is a schematic diagram of a key derivation algorithm provided by the present application.
  • FIG. 4 is a schematic diagram of an application management domain AMF provided by the present application.
  • FIG. 5 is a schematic diagram of parameter generation provided by the present application.
  • FIG. 6 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 7 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 8 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 9 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 10 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 11 is a method for negotiating another key derivation algorithm provided by the present application.
  • Figure 12 is a schematic diagram of a device provided by the present application.
  • Figure 13 is a schematic view of another apparatus provided by the present application.
  • Figure 14 is a schematic view of another apparatus provided by the present application.
  • Figure 15 is a schematic view of another apparatus provided by the present application.
  • 16 is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 17(a) is a method for negotiating another key derivation algorithm provided by the present application.
  • FIG. 17(b) is a method for negotiating another key derivation algorithm provided by the present application.
  • Figure 18 is a schematic view of another apparatus provided by the present application.
  • FIG. 19 is a schematic diagram of another apparatus provided by the present application.
  • the negotiation method of the key derivation algorithm of the present application may be performed by a device.
  • the device On the network side, the device may be a chip in a storage function entity or a storage function entity, or may be a chip in a mobility management function entity or a mobility management function entity.
  • the storage function entity may be used to store a permanent key of the terminal, for example, the storage function entity may be an HSS, a UDM entity, or an ARPF entity or the like.
  • the mobility management function entity can be used to manage the mobility of the terminal, for example, the mobility management function entity can be an MME, or an AMF entity or the like.
  • the device On the terminal side, the device can be a terminal or a chip within the terminal.
  • the present application uses a device as a storage function entity, a mobility management function entity, and a terminal as an example to describe a method for negotiating a key-derived algorithm
  • the device is a chip and a mobility management function entity in a storage function entity.
  • the implementation method of the chip in the chip and the chip in the terminal may refer to the specific description of the negotiation method of the storage function entity, the mobility management function entity, and the key derivation algorithm of the terminal, and the description will not be repeated.
  • the network architecture is a 4G network architecture.
  • the network element in the 4G architecture includes a terminal, and the terminal uses user equipment (UE) as an example.
  • the network architecture also includes a Mobility Management Entity (MME), a Serving GPRS Support Node (SGSN), a Home Subscriber Server (HSS), and a serving gateway (S-GW). ), Packet Data Network Gateway (PDN gateway, P-GW), Policy and Charging Rules Function (PCRF) entity, Evolved Universal Terrestrial (Evolved Universal Terrestrial) Radio Access Network, E-TURAN), etc.
  • MME Mobility Management Entity
  • SGSN Serving GPRS Support Node
  • HSS Home Subscriber Server
  • S-GW serving gateway
  • PCRF Policy and Charging Rules Function
  • the E-UTRAN is composed of a plurality of Evolved NodeBs (eNodeBs), and the eNodeBs are connected to each other through an X2 interface.
  • the eNodeB and the Evolved Packet Core (EPC) pass through the S1 interface, and the eNodeB and the UE pass LTE-Uu interconnection.
  • EPC Evolved Packet Core
  • the main functions of the MME are to support non-access stratum (NAS) signaling and its security, management of the Track Area (TA) list, selection of P-GW and S-GW, MME selection when switching across MMEs, SGSN selection, user authentication, roaming control, and bearer management during the handover to the 2G/3G access system, and the core network nodes of the 3rd Generation Partnership Project (3GPP) different access networks Mobility management between.
  • NAS non-access stratum
  • TA Track Area
  • the S-GW is a gateway terminated on the E-UTRAN interface. Its main functions include: acting as a local anchor point when performing inter-base station handover, and assisting in completing the reordering function of the base station; as a mobile when switching between 3GPP different access systems sexual anchor; perform lawful interception; perform routing and forwarding of data packets; perform packet marking at the upstream and downstream transport layers; and be used for inter-operator billing.
  • the P-GW is a gateway that terminates the PDN to the SGi interface. If the UE accesses multiple PDNs, the UE will correspond to one or more P-GWs.
  • the main functions of the P-GW include a packet filtering function based on the user, a lawful interception function, an Internet Protocol (IP) address allocation function between the UEs, and a packet transmission level flag in the uplink. Perform uplink and downlink service level charging and service level threshold control, and perform service-based uplink and downlink rate control.
  • IP Internet Protocol
  • the HSS is a database for storing user subscription information, and the home network may include one or more HSSs.
  • the HSS is responsible for storing information related to the user, such as user identification, numbering and routing information, security information, location information, profile information, and the like.
  • the SGSN can be used for signaling interaction when the 2G/3G and E-UTRAN 3GPP access networks move, including the selection of the P-GW and the S-GW, and for the user switching to the E-UTRAN 3GPP access network. MME selection.
  • the PCRF entity terminates on the Rx interface and the Gx interface.
  • HPLMN Public Land Mobile Network
  • IP-Connectivity Access Network IP-Connectivity Access Network
  • the network elements related to the present application are mainly: UE, MME, and HSS.
  • the network architecture is a 5G network architecture.
  • the network element in the 5G architecture includes a terminal, and the terminal uses the terminal as the UE as an example.
  • the network architecture also includes a Radio Access Network (RAN), an Access and Mobility Management Function (AMF) entity, a session management function (SMF) entity, and a user plane function (user).
  • Plane function (UPF) entity Unified Data Management (UDM) entity, Authentication Service Function (AUSF) entity, Authentication Credential Repository and Processing Function (ARPF) entity ( Not shown in the figure), Security Anchor Function (SEAF) entity (not shown), Data Network (DN), etc.
  • RAN Radio Access Network
  • AMF Access and Mobility Management Function
  • SMF session management function
  • UPF Unified Data Management
  • AUSF Authentication Service Function
  • ARPF Authentication Credential Repository and Processing Function
  • SEAF Security Anchor Function
  • the main function of the RAN is to control the user's access to the mobile communication network through wireless.
  • the RAN is part of a mobile communication system. It implements a wireless access technology. Conceptually, it resides between devices (such as mobile phones, a computer, or any remote controller) and provides connectivity to its core network.
  • the RAN device includes, but is not limited to, (g nodeB, gNB), evolved node B (eNB), radio network controller (RNC), node B (node B, NB) in 5G, Base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved node B, or home node B, HNB), baseband unit (BBU), transmission point (transmitting and receiving point, TRP), a transmitting point (TP), a mobile switching center, etc., and may also include a wireless fidelity (wifi) access point (AP) or the like.
  • BSC Base station controller
  • BTS base transceiver station
  • TRP transmission point
  • TRP transmitting and receiving point
  • TP transmitting point
  • AP wireless fidelity
  • the AMF entity is responsible for the access management and mobility management of the terminal. In practical applications, it includes the mobility management function in the mobility management entity (MME) in the network framework of LTE, and joins the access management function.
  • MME mobility management entity
  • the SMF entity is responsible for session management, such as user session establishment.
  • the UPF entity is a functional network element of the user plane, and is mainly responsible for connecting to an external network, and includes related functions of an LTE serving gateway (SGW) and a public data network gateWay (PDN-GW).
  • SGW LTE serving gateway
  • PDN-GW public data network gateWay
  • the DN is responsible for providing services to the terminal. For example, some DNs provide Internet access for terminals, and other DNs provide SMS functions for terminals.
  • the SEAF entity is used to complete the authentication process for the UE. In 5G, the functions of the SEAF can be incorporated into the AMF entity.
  • the AUSF entity has an authentication service function for terminating the authentication function of the SEAF request.
  • the AMF entity is responsible for access management and mobility management of the terminal. In practical applications, it includes the mobility management function of the MME in Long Term Evolution (LTE) and adds access management functions.
  • LTE Long Term Evolution
  • the ARPF entity has an authentication credential storage and processing function for storing a user's long-term authentication credential, such as a permanent key K.
  • a user's long-term authentication credential such as a permanent key K.
  • ARPF can be incorporated into UDM entities.
  • the UDM entity can store the subscriber's subscription information, implementing a backend similar to the HSS in 4G.
  • the network elements related to the present application are mainly: a UE, an AMF entity, an HSS entity, a SEAF entity, an AUSF entity, and an ARPF entity.
  • the terminal in the present application is a device with wireless transceiving function, which can be deployed on land, indoors or outdoors, hand-held or on-board; it can also be deployed on the water surface (such as a ship, etc.); it can also be deployed in the air (for example) Aircraft, balloons and satellites, etc.)
  • the terminal may be a mobile phone, a tablet, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, industrial control (industrial control) Wireless terminal, wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transport safety, A wireless terminal in a smart city, a wireless terminal in a smart home, and the like.
  • the UE in FIG. 1 and the UE in FIG. 2 are one specific example of the terminal.
  • the present application refers to the MME in 4G, and the AMF entity in 5G as a mobility management function entity.
  • the HSS in 4G, the APRF entity in 5G, and the UDM entity are collectively referred to as a storage function entity.
  • the mobility management function entity and the storage function entity are collectively referred to as a network side node.
  • a schematic diagram of a key derivation algorithm includes the following steps:
  • Step 301 The terminal sends a first key derivation algorithm to the storage function entity, and the storage function entity receives the second key derivation algorithm.
  • the first key derivation algorithm can be used to represent the key derivation algorithm capability of the terminal, that is, the first key derivation algorithm is a key derivation algorithm supported by the terminal.
  • the first key derivation algorithm is a key derivation algorithm supported by the terminal.
  • the key-derived algorithms supported by the terminal are KDF1, KDF2, and KDF3
  • the first key-derived algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ .
  • the first key derivation algorithm sent by the terminal may be an identifier of a key derivation algorithm supported by the terminal.
  • the terminal sends the first The key derivation algorithm is ⁇ identification of KDF1, identification of KDF2, identification of KDF3 ⁇ .
  • the key-derived algorithm sent by the terminal received by the storage function entity and the mobility management function entity is called a second key derivation algorithm.
  • the second key derivation algorithm may be an identifier of a key-derived algorithm supported by the terminal.
  • the specific method for the terminal to send the first key derivation algorithm to the storage function entity may be, for example:
  • the terminal first sends an attach request message or a track area update (TAU) request (request) message to the MME, where the request message includes the KDF supported by the UE, and the MME sends the authentication data to the HSS.
  • TAU track area update
  • An Authentication Data Request message containing a second key derivation algorithm.
  • the terminal first sends a registration request (Registration Request) message to the AMF entity or the SEAF entity, where the registration request message includes the first key derivation algorithm.
  • the AMF entity or the SEAF entity sends an Authentication Initiation Request message to the AUSF entity, where the authentication initiation request message includes a first key derivation algorithm, and the AUSF entity sends an Authentication Information Request to the ARPF entity or the UDM entity.
  • the message includes a second key derivation algorithm in the authentication information request message.
  • the initial message carrying the first key derivation algorithm sent by the terminal is not protected by integrity, and thus is relatively vulnerable to attack by an attacker.
  • the attacker may tamper with the first key derivation algorithm in the initial message, that is, the second key derivation algorithm is a falsified key derivation algorithm.
  • the second key derivation algorithm may be derived from the first key.
  • the algorithm is different.
  • the first key derivation algorithm sent by the terminal is not attacked by the attacker, and the second key derivation algorithm received by the storage function entity is the same as the first key derivation algorithm sent by the terminal.
  • the second key derivation algorithm received by the storage function entity may be the same as or different from the first key derivation algorithm sent by the terminal.
  • Step 302 The storage function entity selects a third key derivation algorithm from the received second key derivation algorithm according to a preset policy.
  • the second key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the storage function entity.
  • a third key derivation algorithm is selected from the second key derivation algorithm according to a preset policy, and the communication between the negotiated terminal and the storage function entity is performed. Key derivation algorithm.
  • the third key derivation algorithm may be represented by an identifier of the third key derivation algorithm.
  • the preset policy may be a priority policy, that is, selecting a key-derived algorithm with the highest priority; or, a usage-time policy, that is, selecting a key-derived algorithm with the most usage; or other strategies, the application does not limit.
  • the first key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ , wherein the priority of KDF1 ⁇ the priority of KDF2 ⁇ the priority of KDF3.
  • the second key derivation algorithm received by the storage function entity is the same as the first key derivation algorithm, and is also ⁇ KDF1, KDF2, KDF3 ⁇ , and the storage function entity is from the first
  • the third key derivation algorithm selected in the two key derivation algorithm is KDF3.
  • the first key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ , wherein the priority of KDF1 ⁇ the priority of KDF2 ⁇ the priority of KDF3.
  • the second key derivation algorithm received by the storage function entity is ⁇ KDF1 ⁇
  • the third key derivation algorithm selected by the storage function entity from the second key derivation algorithm is KDF1.
  • Step 303 The storage function entity sends an authentication token to the terminal, and the terminal receives an authentication token (AUTN) from the storage function entity.
  • AUTN authentication token
  • the storage function entity After the third key derivation algorithm is selected, the storage function entity needs to send the third key derivation algorithm to the terminal. In the application, the storage function entity also receives the third key derivation algorithm. The second key derivation algorithm is sent to the terminal, so that the terminal verifies whether the first key derivation algorithm sent by the terminal is tampered with.
  • the authentication token includes a first message authentication code (MAC), a second key derivation algorithm, and a selected third key derivation algorithm, and the first message authentication code is based on the second key. Derived algorithm generation.
  • the AUTN includes an Authentication Management Field (AMF) and a MAC.
  • the AMF includes a second key derivation algorithm and a third key derivation algorithm, and the MAC is the first message authentication code.
  • the application management domain AMF is composed of 8 bits, and the terminal supports at most 4 algorithms, for example, KDF1, KDF2, KDF3, and KDF4.
  • KDF1, KDF2, KDF3, and KDF4 are used to represent the received second key derivation algorithm.
  • an exemplary diagram of the AMF an exemplary diagram of the AMF.
  • the 0th bit and the 1st bit are used to represent the selected third key derivation algorithm.
  • the third key derivation algorithm is KDF1, and when "01", the third key derivation algorithm is represented.
  • KDF2 when "10”, it means that the third key derivation algorithm is KDF3, and when "11”, it means that the third key derivation algorithm is KDF4.
  • the second to fifth bits are respectively used to indicate whether KDF1, KDF2, KDF3, and KDF4 are received, wherein “1" indicates reception, and "0" indicates that reception is not received.
  • the second to fifth digits are "0000", it indicates that the received second key derivation algorithm is empty; when the second to fifth digits are "0100", it indicates that the received second key derivation algorithm is KDF2; when the 2nd to 5th bits are "1110", it indicates that the received second key derivation algorithm is KDF1, KDF2, KDF3.
  • FIG. 4 is only described as an example.
  • other bits may be used to represent the second key derivation algorithm and the third key derivation algorithm, which is not limited in this application.
  • the AMF is not 8 bits, its usage is similar.
  • FIG. 5 is a schematic diagram for generating parameters.
  • the storage function entity generates a sequence number (SQN) and a random number (RAND), and then generates a MAC (ie, a first message authentication code), an expected response (XRES), and an encryption key (Cipher).
  • MAC ie, a first message authentication code
  • XRES expected response
  • Cipher an encryption key
  • Key, CK integrity key
  • IK integrity key
  • AK Anonymity Key
  • MAC f1(K, AMF, SQN, RAND), wherein the format of the application management domain AMF is as shown in FIG. 4, and the AMF includes a second key derivation algorithm and a third key derivation algorithm;
  • IK f4(K,RAND);
  • f1, f2, f3, f4, and f5 represent functions, and the terminal also stores the same function.
  • AUTN includes AMF and MAC, where For the AND or symbol, the result of the OR operation of SQN and AK, "
  • the AUTN thus includes a MAC (first message authentication code), a second key derivation algorithm, and a third key derivation algorithm, wherein the second key derivation algorithm and the third key derivation algorithm are carried in the authentication management domain AMF.
  • the AUTN may be carried in the AV and sent to the terminal, where the AV includes RAND, XRES, CK, IK, and AUTN.
  • the second key derivation algorithm, the third key derivation algorithm, the first message authentication code and other parameters that may be needed are sent to the terminal.
  • AUTN includes an authentication management domain AMF, a second key derivation algorithm, and a MAC
  • AMF includes a third key derivation algorithm
  • the MAC is a first message authentication code.
  • MAC f1 (K, AMF, SQN, RAND, second key derivation algorithm).
  • the main difference between the implementation method 2 and the implementation method 1 is as follows: First, in the implementation method 1, the second key derivation algorithm is carried in the AMF, and the implementation method 2 is to carry the second key derivation algorithm. In AUTN, since the bits of the AMF are limited, the second key derivation algorithm is moved outside the AMF, so that the method of the present application still applies when there are many types of key derivation algorithms supported by the terminal. For example, if the AMF is 8 bits, if the method 1 is implemented as described above, when the number of key-derived algorithms supported by the terminal exceeds 5, the implementation method 1 cannot be implemented. According to the implementation method 2, the key-derived algorithm supported by the terminal can reach up to 28 types.
  • the second key derivation algorithm is also required as an input parameter when generating the MAC.
  • the AUTN is generated, the AUTN is sent to the terminal, and the transmission of the AUTN is protected by the integrity protection algorithm and is not falsified by the attacker.
  • the AUTN is carried in the AV and sent to the terminal.
  • the method for the storage function entity to send the AUTN to the terminal is:
  • the HSS entity sends an authentication data response (Authenticaition Data Response) message to the MME, where the message includes the AUTN, and the MME sends a User Authentication Request message to the terminal, where the message includes the AUTN.
  • Authenticaition Data Response Authenticaition Data Response
  • the method for the storage function entity to send the AUTN to the terminal is:
  • the UDM entity or the ARPF entity sends an Authenticaition Information Response message to the AUSF entity, where the message includes the AUTN, and the AUSF entity sends an Authentication Initiation Answer message to the SEAF or AMF entity entity, where the message includes the AUTN and the SEAF entity.
  • the AMF entity sends an Authenticaition Request message to the terminal, where the message includes the AUTN.
  • Step 304 The terminal generates a second message authentication code according to the second key derivation algorithm in the authentication token.
  • the terminal may obtain the first message authentication code, the second key derivation algorithm, and the third key derivation algorithm.
  • the terminal generates a second message authentication code according to the second key derivation algorithm, and the generating method is the same as the method for the storage function entity to generate the first message authentication code.
  • the method for generating the second message authentication code has the following two methods:
  • the method for the terminal to generate the second message authentication code is:
  • the second message authentication code (MAC1) f1 (K, AMF, SQN, RAND), where K is stored in the terminal, AMF is obtained from the AUTN, RAND is obtained from the AV, and then can be pushed according to K Derived AK, according to AK and SQN is available.
  • the method for the terminal to generate the second message authentication code is:
  • the second message authentication code (MAC1) f1 (K, AMF, SQN, RAND, second key derivation algorithm), where K is stored in the terminal, AMF is obtained from the AUTN, and RAND is obtained from the AV. And then according to K can deduct AK, according to AK and The SQN can be obtained, and the second key derivation algorithm is obtained from the AUTN.
  • Step 305 If the terminal determines that the second message authentication code is the same as the first message authentication code in the authentication token, and determines that the first key derivation algorithm is the same as the second key derivation algorithm, acquiring the third in the authentication token. Key derivation algorithm as a terminal key derivation algorithm.
  • the terminal compares the first key derivation algorithm and the second key derivation algorithm. If it is determined that the first key derivation algorithm is the same as the second key derivation algorithm, the terminal uses the generated second message authentication code pair to receive the first message. The authentication code is verified. The following describes how to verify the message authentication code in combination with a specific example.
  • the first key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇
  • the priority of KDF1 ⁇ the priority of KDF2 ⁇ the priority of KDF3.
  • the second method for implementing the AUTN and the second method for generating the second message authentication code are taken as an example.
  • Example 1 the second key derivation algorithm is ⁇ KDF1 ⁇
  • the first message authentication code (MAC) f1 (K, AMF, SQN, RAND, KDF1),
  • the second message authentication code (MAC1) generated by the terminal f1 (K, AMF, SQN, RAND, KDF1).
  • the terminal checks whether the MAC and the MAC1 are the same. If they are the same, the MAC check is correct. If the check is correct, the parameter for generating the first message authentication code is the same as the parameter for generating the second message authentication code, that is, the parameters are not tampered with. If the check is incorrect, the reason may be that the above parameters are tampered with, and the subsequent operations may be continued according to the prior art method. For example, the terminal may send an error indication message to the storage function entity, and the error indication message may be an authentication failure. Message.
  • the check MAC1 MAC
  • the check is correct, and then compare whether the second key derivation algorithm obtained from the AUTN is the same as the terminal's own first key derivation algorithm, since the second key derivation algorithm is ⁇ KDF1 ⁇ , A key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ , and therefore, if the terminal determines that the transmitted first key derivation algorithm has been tampered with, instead of using the third key derivation algorithm, the default key derivation algorithm is used.
  • the key of the terminal is generated, such as Key Access Security Management Entity (Kasme).
  • Kasme Key Access Security Management Entity
  • the process of renegotiation is also required, and the key of the terminal and the storage function entity is updated in the new process, and the details will be described later.
  • Example 2 the second key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇
  • the first message authentication code (MAC) f1 (K, AMF, SQN, RAND, ⁇ KDF1, KDF2, KDF3 ⁇ ),
  • the second message authentication code (MAC1) generated by the terminal f1 (K, AMF, SQN, RAND, ⁇ KDF1,
  • the verification MAC is correct, and the first key is derived.
  • the algorithm is the same as the second key derivation algorithm, and the terminal acquires the third key derivation algorithm as a terminal key derivation algorithm, and generates a key of the terminal according to the third key derivation algorithm, such as Kasme, etc., and the process ends.
  • the terminal checks the sent first key derivation algorithm and the received second key derivation algorithm, when the verification is correct and the first key derivation algorithm and the second key If the derived algorithm is the same, it is determined that the first key derivation algorithm sent by the terminal is not tampered by the attacker, and then the negotiated third key derivation algorithm is used as the key derivation algorithm of the terminal to ensure the negotiated key derivation algorithm. Confidentiality, thereby improving the security of communications.
  • the present application further provides another method for negotiating a key derivation algorithm, where the method is used to negotiate a key derivation algorithm between a terminal and a storage function entity, including the following steps:
  • Step 601 The terminal sends a request message to the mobility management function entity, where the mobility management function entity receives the request message from the terminal.
  • the request message may be an attach request message or a tracking area update request message in 4G, or a registration request message in 5G.
  • the request message includes a first key derivation algorithm, and the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the terminal sends the first key derivation algorithm
  • the mobile management function entity receives the second key derivation algorithm
  • the second key derivation algorithm is the at least one key derivation algorithm supported by the terminal received by the mobility management function entity.
  • the second key derivation algorithm may be the same as or different from the first key derivation algorithm. For example, when the attacker falsifies, the second key derivation algorithm is different from the first key derivation algorithm.
  • Step 602 The mobility management function entity sends a second key derivation algorithm to the storage function entity, where the storage function entity receives the second key derivation algorithm from the mobility management function entity.
  • the second key derivation algorithm may be carried in an Authentication Data Request message.
  • the second key derivation algorithm may be carried in an Authentication Information Request message.
  • Step 603 The storage function entity selects a third key derivation algorithm from the second key derivation algorithm.
  • the storage function entity selects a key-derived algorithm with the highest priority according to the second key derivation algorithm and the pre-configured algorithm priority list, that is, the third key derivation algorithm is negotiated between the terminal and the storage function entity. Key derivation algorithm.
  • the storage function entity may carry the third key derivation algorithm in a part of the bit of the authentication management domain AMF.
  • the storage function entity may carry the third key derivation algorithm in a part of the bit of the authentication management domain AMF.
  • Step 604 The storage function entity sends an AUTN to the mobility management function entity, and the mobility management function entity receives the AUTN from the storage function entity.
  • the AUTN includes an AMF and a MAC, and some bits in the AMF are used to set a third key derivation algorithm.
  • the MAC is generated by the storage function entity according to the AMF, K, RAND, and SQN. Since the second key derivation algorithm is not included in the AMF, in this embodiment, the MAC is not generated according to the second key derivation algorithm, that is, The second key derivation algorithm is not included in the MAC.
  • Step 605 The mobility management function entity sends an AUTN to the terminal, where the terminal receives the AUTN from the mobility management function entity.
  • the storage function entity sends an AUTN to the mobility management function entity
  • the specific implementation manner in which the mobility management function entity sends the AUTN to the terminal may be:
  • the HSS entity sends an Authenticaition Data Response message to the MME, where the message includes the AUTN, and the MME sends a User Authentication Request message to the terminal, where the message includes the AUTN.
  • the UDM entity or the ARPF entity sends an Authenticaition Information Response (AV-Resp) message to the AUSF entity, where the message includes the AUTN, and the AUSF entity sends an initialization authentication response to the SEAF entity or the AMF entity.
  • AV-Resp Authenticaition Information Response
  • the message includes the AUTN
  • SEAF entity or the AMF entity sends an Authenticaition Request (Auth-Req) message to the terminal, and the message includes the AUTN.
  • Auth-Req Authenticaition Request
  • Step 606 The terminal acquires a third key derivation algorithm.
  • the terminal acquires the MAC and the AMF from the received AUTN.
  • the MAC is verified. Specifically, the terminal generates MAC1 according to K, AMF, RAND, and SQN, and then compares with the MAC obtained from the AUTN. If they are the same, the verification is correct.
  • the terminal acquires the third key derivation algorithm in the AMF as a key derivation algorithm negotiated between the terminal and the storage function entity.
  • Step 607 The terminal sends a response message to the storage function entity, where the storage function entity receives the response message from the terminal.
  • the response message may be an authentication response message for notifying the storage function entity whether the negotiation failed or succeeded.
  • the negotiation process of the key derivation algorithm between the terminal and the storage function entity is completed, but the above process does not determine whether the first key derivation algorithm sent by the terminal is tampered with.
  • the following is an example.
  • the first key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ , and the priority of KDF1 ⁇ priority of KDF2 ⁇ KDF3 priority.
  • the second key derivation algorithm is ⁇ KDF1 ⁇
  • the third key derivation algorithm selected in the above step 603 is KDF1
  • the terminal The third key derivation algorithm obtained in step 606 is KDF1. Therefore, the process of the above steps 601 to 607 can only complete the negotiation of the key derivation algorithm, but it is not yet determined whether the first key derivation algorithm is tampered with by the attacker.
  • the method further includes the following steps for determining whether the attack is under attack.
  • Step 608 The mobility management function entity sends a NAS SMC message to the terminal, where the terminal receives the NAS SMC message from the mobility management function entity.
  • the NAS SMC message includes a second key derivation algorithm. Since the NAS SMC message is protected by the integrity protection algorithm, the content in the NAS SMC message is not tampered with.
  • Step 609 The terminal acquires a second key derivation algorithm, and verifies the second key derivation algorithm.
  • the terminal compares the first key derivation algorithm with the second key derivation algorithm. If the same, the verification is correct. If not, the verification is incorrect.
  • Step 610 The terminal sends a NAS SMP message to the mobility management function entity, where the mobility management function entity receives the NAS SMP message from the terminal.
  • the NAS SMP message is used to notify the completion of the verification. The process ends.
  • the request message in step 601 may be re-carryed in the NAS SMP message, and the request message includes a first key derivation algorithm, and the negotiation process is re-initiated.
  • the specific process of renegotiation will be detailed later.
  • the NAS SMP message is integrity protected, it is not tampered with by the attacker, that is, the first key derivation algorithm sent in step 610, the mobility management function entity and the storage function entity receive It is also the first key derivation algorithm, or it can be understood that the second key derivation algorithm received by the mobility management function entity and the storage function entity is the same as the first key derivation algorithm.
  • the negotiation of the key derivation algorithm is completed through steps 601 to 607, and then the second key derivation algorithm is performed through steps 608 to 609. If the verification is correct, it is determined that the attack is not attacked. Therefore, the negotiated third key derivation algorithm can be used as the key derivation algorithm of the terminal; if the verification fails, the negotiation process of the key derivation algorithm is reinitiated through step 610.
  • FIG. 7 is a schematic diagram of a negotiation key derivation algorithm between a terminal and a mobility management function entity provided by an embodiment of the present application.
  • the embodiment is a specific implementation method, and the name of the message may be referred to as another name in actual use, which is not limited in this application.
  • Step 701 The terminal sends a request message to the mobility management function entity, where the mobility management function entity receives the request message from the terminal.
  • the request message may be an attach request message or a tracking area update request message in 4G, or a registration request message in 5G.
  • the request message includes a first key derivation algorithm, and the first key derivation algorithm is at least one key derivation algorithm supported by the terminal, and the first key derivation algorithm is also referred to as a terminal-supported key derivation algorithm capability.
  • the terminal sends the first key derivation algorithm
  • the mobile management function entity receives the second key derivation algorithm
  • the second key derivation algorithm is the at least one key derivation algorithm supported by the terminal received by the mobility management function entity.
  • the second key derivation algorithm may be the same as or different from the first key derivation algorithm.
  • the second key derivation algorithm is different from the first key derivation algorithm.
  • Step 702 The mobility management function entity selects a fourth key derivation algorithm from the second key derivation algorithm.
  • the selected fourth key derivation algorithm is used as a key derivation algorithm negotiated between the terminal and the mobility management function entity.
  • the mobility management function entity selects a key-preferred algorithm with the highest priority according to the second key derivation algorithm and the pre-configured algorithm priority list, as the fourth key derivation algorithm.
  • the fourth key derivation algorithm may be an identifier of the fourth key derivation algorithm.
  • the mobility management function entity further performs integrity protection on the NAS SMC message according to the NAS integrity protection key to generate a NAS-MAC.
  • the NAS SMC message includes a fourth key derivation algorithm, a second key derivation algorithm, and NAS-MAC.
  • Step 703 The mobility management function entity sends a NAS SMC message to the terminal, where the terminal receives the NAS SMC message from the mobility management function entity.
  • Step 704 The terminal checks the received NAS-MAC.
  • the terminal After receiving the NAS SMC message, the terminal checks the NAS-MAC according to the NAS integrity protection key to determine whether the message has been tampered with.
  • step 705 is performed, otherwise, according to the prior art, for example, the verification process is re-initiated.
  • Step 705 The terminal checks the second key derivation algorithm.
  • the terminal verifies that the second key derivation is the same as the first key derivation algorithm. If they are the same, it indicates that the first key derivation algorithm sent by the terminal to the mobility management function entity has not been tampered with, and the fourth key derivation algorithm is used as The result of the negotiation of the key derivation algorithm between the terminal and the mobility management function entity; if not, the first key derivation algorithm sent by the terminal to the mobility management function entity is tampered with.
  • Step 706 The terminal sends a NAS SMP message to the mobility management function entity, where the mobility management function entity receives the NAS SMP message from the terminal.
  • the NAS SMP message is used to inform the algorithm of the negotiation result. If successful, the NAS SMP message informs the terminal that the key-derived algorithm negotiation between the terminal and the mobility management function entity is completed, and the NAS layer security is activated. If the failure occurs, the process of renegotiation can be initiated through the NAS SMP message, which will be described in detail later.
  • the process of negotiating a key derivation algorithm between the terminal and the base station includes the following steps 708 to 711.
  • Step 707 The mobility management function entity sends an Initial UE message to the base station, where the base station receives an initialization terminal message from the mobility management function entity.
  • the initialization terminal message includes a second key derivation algorithm.
  • Step 708 The base station selects a fifth key derivation algorithm.
  • the base station selects a key-derived algorithm with the highest priority from the second key derivation algorithm according to the second key derivation algorithm received in step 707 and the pre-configured algorithm priority list, that is, the fifth key derivation algorithm.
  • a key derivation algorithm negotiated between the terminal and the base station.
  • the base station completes the AS SMC message according to the access layer (AS) integrity protection key, and generates an AS-MAC.
  • AS access layer
  • Step 709 The base station sends an AS SMC message to the terminal, where the terminal receives an AS SMC message from the base station.
  • the AS SMC message includes an AS-MAC and a fifth key derivation algorithm.
  • Step 710 The terminal checks the AS-MAC.
  • the terminal verifies the AS-MAC according to the AS integrity protection key, and determines whether the message has been tampered with. If it is determined that the message has not been tampered with, the fifth key derivation algorithm is used as a key derivation algorithm negotiated between the terminal and the base station.
  • Step 711 The terminal sends an AS SMP message to the base station, where the base station receives the AS SMP message from the terminal.
  • the AS SMP message is used to inform the algorithm of the negotiation result. If successful, the AS SMP message informs the terminal that the key derivation algorithm negotiation between the terminal and the base station is completed, and the AS layer security is activated. If it fails, the key derivation algorithm negotiation between the terminal and the base station is notified to fail.
  • the terminal checks the sent first key derivation algorithm and the received second key derivation algorithm.
  • the verification is correct and the first key derivation algorithm is the same as the second key derivation algorithm.
  • Determining that the first key derivation algorithm sent by the terminal is not tampered by the attacker, and then using the fourth key derivation algorithm negotiated between the terminal and the mobility management function entity as the key derivation algorithm of the terminal, and the terminal and the base station
  • the fifth key derivation algorithm negotiated as the key derivation algorithm of the terminal ensures the confidentiality of the negotiated key derivation algorithm, thereby improving the security of the communication.
  • a method for negotiating a key derivation algorithm between a terminal and a storage function entity and a method for negotiating a key derivation algorithm between the terminal and the mobility management function entity are introduced.
  • a protocol key derivation algorithm is used between the terminal and the storage function entity.
  • the terminal determines that the first message authentication code is the same as the second message authentication code, but the first key derivation algorithm is different from the second key derivation algorithm, and the third key is not used.
  • the derivative algorithm selects the default key derivation algorithm as the key derivation algorithm of the terminal, and derives the key according to the default key derivation algorithm.
  • the third key derivation algorithm may also be used as a key derivation algorithm of the terminal, and the key is derived according to the third key derivation algorithm.
  • the process of re-negotiating the key derivation algorithm is initiated, or the terminal disconnects from the current radio access network and re-accesses.
  • This application uses the renegotiation key derivation algorithm as an example for description.
  • a protocol key derivation algorithm is used between the terminal and the storage function entity.
  • the terminal verifies that the first key derivation algorithm is different from the second key derivation algorithm, and the NAS SMP sent in step 610 may carry the request message sent in step 601, where the request message includes the first key derivation.
  • the algorithm re-initiates the process of renegotiating the key derivation algorithm, or the terminal disconnects from the current radio access network and re-accesses.
  • This application uses the renegotiation key derivation algorithm as an example for description.
  • a protocol key derivation algorithm is used between the terminal and the mobility management function entity.
  • the fourth key derivation algorithm is not used as the secret between the terminal and the mobility management functional entity.
  • the key derivation algorithm selects the default key derivation algorithm as the key derivation algorithm between the terminal and the mobility management function entity.
  • the fourth key derivation algorithm may also be used as the terminal. a key derivation algorithm that derives a key according to the fourth key derivation algorithm.
  • the AS SMP sent in step 711 carries the request message sent in step 701, where the request message includes a first key derivation algorithm, re-initiates the process of renegotiating the key derivation algorithm, or the terminal and the current radio access network are disconnected.
  • the application is described by taking the renegotiation key derivation algorithm as an example.
  • a method for negotiating a key derivation algorithm is used for renegotiating a key derivation algorithm between a terminal and a mobility management function entity.
  • the process shown in FIG. 8 may be as shown in FIG. Step 706 of the process is completed, that is, after step 706 of FIG. 7, the following steps are further included:
  • Step 801 The terminal sends a first message to the mobility management function entity, where the mobility management function entity receives the first message from the terminal.
  • the step 801 may be the foregoing step 706, that is, the first message may be a NAS SMP message, where the first key derivation algorithm is carried.
  • the mobility management function entity receives the first key derivation. algorithm.
  • Step 802 The mobility management function entity selects a second target key derivation algorithm from the first key derivation algorithm.
  • the method for selecting the second target key derivation algorithm refers to the foregoing method for selecting the third key derivation algorithm from the second key derivation algorithm, and details are not described herein again.
  • Step 803 The mobility management entity updates the first key stored in the mobility management function entity according to the second target key derivation algorithm.
  • the mobility management function entity may be configured as a second random number, generate a new first key according to the generated second random number and the second target key derivation algorithm, and then use the generated new one.
  • the first key updates the first key stored in the mobility management function entity.
  • the first key is used for communication between the terminal and the mobility management function entity.
  • the first key may be Knas, and specifically may include an encryption key (Knas-enc/KNASenc), and an integrity protection key (Knas- Int/KNASint).
  • the encryption key is called Knas-enc and the integrity protection key is called Knas-int.
  • the encryption key is called KNASenc and the integrity protection key is called KNASint.
  • a new Kasme is generated according to a second random number, a locally stored Kasme, and a second target key derivation algorithm, and then according to a new Kasme, a second target key derivation algorithm, and an integrity protection algorithm. Generate a new Knas-int. And, according to the new Kasme, the second target key derivation algorithm, and the encryption algorithm, generate a new Knas-enc.
  • a new Kamf is generated according to the second random number, Kamf, and the second target key derivation algorithm, and then a new Kamf is generated according to the new Kamf, the second target key derivation algorithm, and the integrity protection algorithm. KNASint. And, according to the new Kamf, the second target key derivation algorithm, and the encryption algorithm, generate a new KNASenc.
  • the mobility management function entity may generate a new first key according to the NAS count COUNT and the second target key derivation algorithm, and then update the mobility management function by using the generated new first key.
  • the first message may carry a part of the bit of the uplink NAS COUNT, and the AMF entity may obtain the complete NAS COUNT according to the uplink NAS COUNT part bit carried in the first message.
  • the first key is used for communication between the terminal and the mobility management function entity.
  • the first key may be Knas, and specifically may include an encryption key (Knas-enc/KNASenc), and an integrity protection key (Knas-int/ KNASint).
  • the entire NAS COUNT is obtained according to some bits of the NAS COUNT, and then a new Kasme is generated according to the NAS COUNT, the locally stored Kasme, and the second target key derivation algorithm, and then according to the new Kasme, the second.
  • a target key derivation algorithm, an integrity protection algorithm generates a new Knas-int.
  • the second target key derivation algorithm, and the encryption algorithm generate a new Knas-enc.
  • the entire NAS COUNT is obtained according to some bits of the NAS COUNT, and then a new Kamf is generated according to the NAS COUNT, Kamf, and second target key derivation algorithms, and then according to the new Kamf, the second target secret.
  • a key-derived algorithm, an integrity protection algorithm generates a new KNASint.
  • the new Kamf, the second target key derivation algorithm, and the encryption algorithm generate a new KNASenc.
  • the mobility management function entity may generate a new first key according to the NAS count COUNT and the second target key derivation algorithm and a constant string, and then use the generated new first key, Update the first key stored in the mobility management function entity.
  • the first message may carry a part of the bit of the uplink NAS COUNT, and the AMF entity may obtain the complete NAS COUNT according to the uplink NAS COUNT part bit carried in the first message.
  • the first key is used for communication between the terminal and the mobility management function entity.
  • the first key may be Knas, and specifically may include an encryption key (Knas-enc/KNASenc), and an integrity protection key (Knas-int/ KNASint).
  • Constant strings can be preconfigured constant strings such as "KDF”, "KDF-UPDATE", and so on.
  • the entire NAS COUNT is obtained according to some bits of the NAS COUNT, and then a new Kasme is generated according to the NAS COUNT, the locally stored Kasme, the second target key derivation algorithm, the constant string, and then according to the new Kasme, the second target key derivation algorithm, and the integrity protection algorithm generate a new Knas-int. And, according to the new Kasme, the second target key derivation algorithm, and the encryption algorithm, generate a new Knas-enc.
  • the entire NAS COUNT is obtained according to some bits of the NAS COUNT, and then a new Kamf is generated according to the NAS COUNT, Kamf, the second target key derivation algorithm, the constant string, and then according to the new Kamf,
  • the second target key derivation algorithm, the integrity protection algorithm generates a new KNASint.
  • the new Kamf, the second target key derivation algorithm, and the encryption algorithm generate a new KNASenc.
  • Step 804 The mobility management entity sends a second message to the terminal, where the terminal receives the second message from the mobility management entity.
  • the second message may be a NAS SMC message, which is integrity protected to prevent the attacker from tampering with the content of the message.
  • the second message includes a second target key derivation algorithm, and optionally, a second random number.
  • Step 805 The terminal updates the first key.
  • the terminal acquires a second target-derived algorithm from the received second message, uses the second target-derived algorithm to update the terminal's key-derived algorithm, and updates the first key according to the second target-key-derived algorithm.
  • the terminal updates the first key according to the second target key derivation algorithm and the second random number.
  • the terminal may further update the first key according to the second target key derivation algorithm and the NAS COUNT, where the first message in the foregoing step 801 carries a partial bit of the NAS COUNT.
  • the terminal may further update the first key according to the second target key derivation algorithm, the constant string, and the NAS COUNT, where the first message in the foregoing step 801 carries a partial bit of the NAS COUNT.
  • Step 806 The terminal sends a NAS SMP message to the mobility management entity, and the mobility management entity receives the NAS SMP message from the terminal.
  • the NAS SMP message is used to notify the mobility management entity that the first key is successfully negotiated and updated.
  • a method for negotiating a key derivation algorithm is used for renegotiating a key derivation algorithm between a terminal and a storage function entity.
  • the process shown in FIG. 9 may be the process shown in FIG. After step 304 is completed, that is, after step 304 of FIG. 3, if it is determined that the first key derivation algorithm is different from the second key derivation algorithm, the following steps are further included:
  • Step 901 The terminal sends a first message to the mobility management function entity, where the mobility management function entity receives the first message from the terminal.
  • the first message may be a NAS SMP message carrying a first key derivation algorithm.
  • the mobility management function entity receives the first key derivation. algorithm.
  • Step 902 The mobility management entity sends a first key derivation algorithm to the storage function entity, where the storage function entity receives the first key derivation algorithm from the mobility management entity.
  • Step 903 The storage function entity selects a first target key derivation algorithm from the first key derivation algorithm.
  • Step 904 The storage function entity updates the access security management entity key.
  • the access security management entity key may be referred to as Kasme, and in 5G, the name may be different from 4G, for example, referred to as Kasme*.
  • the storage function entity may be a first random number, and generate a new access security management according to the generated first random number, the first target key derivation algorithm, and the stored access security management entity key.
  • the entity key is then updated with the access security management entity key stored in the storage function entity.
  • Step 905 The storage function entity sends a first target key derivation algorithm to the mobility management function entity, where the mobility management function entity receives the first target key derivation algorithm from the storage function entity.
  • the storage function entity further sends a first random number to the mobility management function entity.
  • Step 906 The mobility management entity sends a second message to the terminal, where the terminal receives the second message from the mobility management entity.
  • the second message may be a NAS SMC message, which is integrity protected to prevent the attacker from tampering with the content of the message.
  • the second message includes a first target key derivation algorithm, and optionally, a first random number.
  • Step 907 The terminal updates an access security management entity key stored in the terminal.
  • the terminal obtains the first target-derived algorithm from the received second message, uses the first target-derived algorithm to update the key-derived algorithm of the terminal, and updates the access security management entity key according to the first target key-derived algorithm, optionally And updating the access security management entity key according to the first target key derivation algorithm and the first random number.
  • the specific method refer to the process of updating the first key by the mobility management entity in step 904, and details are not described herein.
  • a method for negotiating a key derivation algorithm is used for renegotiating a key derivation algorithm between a terminal and a storage function entity, and re-negotiating a key derivation algorithm between the terminal and the mobility management function entity.
  • the flow shown in FIG. 10 can be combined with the flow shown in FIG. 8 and the flow shown in FIG. 9, and FIG. 10 is an example of 4G.
  • the MME in FIG. 10 is a mobility management function entity, and the HSS entity is a storage function entity.
  • the process shown in Figure 10 includes the following steps:
  • Step 1001 The terminal sends a NAS SMP message to the MME, and the MME receives the NAS SMP message from the terminal.
  • the NAS SMP message includes a first key derivation algorithm, and the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • Step 1002 The MME sends a first key derivation algorithm to the HSS, and the HSS receives the first key derivation algorithm from the MME.
  • Step 1003 The MME selects a second target key derivation algorithm from the first target key derivation algorithm.
  • Step 1004 The HSS selects a first target key derivation algorithm from the first target key derivation algorithm.
  • Step 1005 the HSS updates Kasme.
  • the HSS generates a first random number, generates a new Kasme according to the first random number, the locally stored Kasme, and the first target key derivation algorithm, and updates the locally stored Kasme using the new Kasme.
  • Step 1006 The HSS sends a first target key derivation algorithm and a new Kasme to the MME.
  • the first random number is also sent.
  • Step 1007 The MME updates the locally stored Kasme according to the received Kasme.
  • the method for updating the locally stored Kasme in step 1007 is:
  • the MME generates a second random number, and generates a new Kasme according to the second random number, the locally stored Kasme, and the second target key derivation algorithm.
  • Step 1008 The MME updates the first key.
  • the MME generates a new Knas-enc according to the updated Kasme, the second target key derivation algorithm, and the encryption algorithm.
  • a new Knas-int is generated according to the new Kasme, the second target key derivation algorithm, and the integrity protection algorithm.
  • the first key is a key for communication between the terminal and the MME, and includes Knas-int and Knas-enc.
  • Step 1009 The MME sends a NAS SMC message to the terminal, where the terminal receives the MAS SMC message from the MME.
  • the NAS SMC message includes a first target key derivation algorithm, a second target key derivation algorithm, and optionally, a first random number and a second random number.
  • Step 1010 The terminal updates the Kasme and the first key.
  • the terminal receives the received first target key derivation algorithm and second target key derivation algorithm as the key of the terminal.
  • the first target key derivation algorithm is used for communication between the terminal and the HSS
  • the second target key derivation algorithm is used for communication between the terminal and the MME.
  • the method for updating the Kasme by the terminal is the same as the method for updating the Kasme by the HSS.
  • the method for the terminal to update the first key is the same as the method for the MME to update the first key, and details are not described herein.
  • Step 1011 The terminal sends a NAS SMP message to the MME, and the mobility management entity receives the NAS SMP message from the terminal.
  • the NAS SMP message is used to notify the MME that the negotiation and update of the key is successful.
  • step 1002 may be performed before step 1003, step 1004 and step 1005 are performed before step 1003, or step 1003 is performed between step 1004 and step 1005. .
  • a method for negotiating a key derivation algorithm is used for renegotiating a key derivation algorithm between a terminal and a storage function entity, and renegotiating a key derivation algorithm between the terminal and the mobility management function entity.
  • the flow shown in FIG. 11 includes a part of the flow of FIG. 8, and a partial flow including FIG. Fig. 11 is an illustration of 5G.
  • the AMF entity in Figure 11 is the mobility management functional entity, and the ARPF entity is the storage functional entity.
  • the flow shown in Figure 11 includes the following steps:
  • Step 1101 The terminal sends a NAS SMP message to the AMF, and the AMF receives the NAS SMP message from the terminal.
  • the NAS SMP message includes a first key derivation algorithm, and the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • Step 1102 The AMF sends a first key derivation algorithm to the AUSF, and the AUSF receives the first key derivation algorithm from the AMF.
  • Step 1103 The AUSF sends a first key derivation algorithm to the ARPF, and the ARPF receives the first key derivation algorithm from the AUSF.
  • Step 1104 The AMF selects a second target key derivation algorithm from the first key derivation algorithm.
  • Step 1105 The ARPF selects a first target key derivation algorithm from the first key derivation algorithm.
  • Step 1106 ARPF updates Kasme*.
  • ARPF generates a new Kasme* based on the locally stored Kasme* and first target key derivation algorithm, and updates the locally stored Kasme* with the new Kasme*.
  • the ARPF generates a first random number, and then generates a new Kasme* according to the first random number, the locally stored Kasme*, and the first target key derivation algorithm, and updates the locally stored Kasme with the new Kasme*. *.
  • Step 1107 The ARPF sends a first target key derivation algorithm and a new Kasme* to the AUSF.
  • the ARPF when the ARPF updates the Kasme* according to the generated first random number, the ARPF further sends the first random number to the AUSF.
  • Step 1108 The AUSF updates the locally stored Kasme* according to the received Kasme*.
  • Step 1109 The AUSF generates Kseaf according to Kasme*.
  • the kseaf is generated by AUSF and sent to SEAF. Kseaf can be used to obtain the key Kamf used by AMF.
  • Step 1110 The AUSF sends the first target key derivation algorithm and Kseaf to the SEAF.
  • the AUSF further sends the first random number to the SEAF.
  • Step 1111 The SEAF update updates the locally stored Kseaf according to the received Kseaf.
  • Step 1112 The SEAF generates Kamf according to the updated Kseaf.
  • Step 1113 The SEAF sends a first target key derivation algorithm and Kamf to the AMF.
  • the SEAF further sends the first random number to the AMF.
  • Step 1114 The AMF is based on the locally stored Kamf according to the received Kamf.
  • step 1115 the AMF updates the first key.
  • the AMF generates a new KNASenc according to the updated Kamf, the second target key derivation algorithm, and the encryption algorithm.
  • a new KNASint is generated based on the updated Kamf, the second target key derivation algorithm, and the integrity protection algorithm.
  • the first key is a key for communication between the terminal and the AMF, including KNASenc and KNASint.
  • Step 1116 The AMF sends a NAS SMC message to the terminal, and the terminal receives the NAS SMC message from the AMF.
  • the NAS SMC message includes a first target key derivation algorithm and a second target key derivation algorithm.
  • the NAS SMC message further includes a first random number.
  • Step 1117 The terminal updates the locally stored Kamf, Kseaf, Kasme*, and the first key.
  • the terminal generates a new Kasme* according to the locally stored Kasme* and the first target key derivation algorithm, and updates the locally stored Kasme* with the new Kasme*.
  • the terminal when the terminal receives the first random number, the terminal generates a new Kasme* according to the first random number, the locally stored Kasme*, and the first target key derivation algorithm, and updates the locality by using the new Kasme*. Stored Kasme*.
  • the terminal generates a new Kseaf based on the updated Kasme* and updates the locally stored Kseaf according to the new Kseaf.
  • the terminal Based on the new Kseaf, the terminal generates a new Kamf and updates the locally stored Kamf according to the new Kamf.
  • the terminal generates a new KNASenc according to the updated Kamf, the second target key derivation algorithm, and the encryption algorithm.
  • the terminal generates a new KNASint according to the updated Kamf, the second target key derivation algorithm, and the integrity protection algorithm.
  • the new KNASenc and the new KNASint are collectively referred to as the updated first key.
  • Step 1118 The terminal sends a NAS SMP message to the AMF, and the AMF receives the NAS SMP message from the terminal.
  • the NAS SMP message is used to notify the AMF that the negotiation and update of the key is successful.
  • step 1102 step 1103 may be performed before step 1004, and execution between step 1104 and step 1105 to step 1113 is not sequentially limited.
  • each of the foregoing network elements includes a hardware structure and/or a software module corresponding to each function.
  • the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • FIG. 12 a schematic diagram of a device provided by the present application, which may be a terminal, may perform the method performed by the terminal in any of the foregoing embodiments.
  • the terminal 1200 includes at least one processor 121, a transceiver 122, and optionally a memory 123.
  • the processor 121, the transceiver 122, and the memory 123 are connected by a communication bus.
  • the processor 121 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication bus can include a path for communicating information between the above units.
  • the transceiver 122 is configured to communicate with other devices or communication networks, and the transceiver includes a radio frequency circuit.
  • the memory 123 can be a read-only memory (ROM) or other type of static storage device random access memory (RAM) that can store static information and instructions or other types of information and instructions that can store information.
  • the dynamic storage device may also be an electrically erasable programmabler-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, or a disc storage (including Compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer Any other medium, but not limited to this.
  • EEPROM electrically erasable programmabler-only memory
  • CD-ROM compact disc read-only memory
  • CD-ROM compact disc read-only memory
  • disc storage including Compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the memory 123 may be independent and connected to the processor 121 via a communication bus.
  • the memory 123 can also be integrated with the processor.
  • the memory 123 is used to store application code for executing the solution of the present invention, and is controlled by the processor 121 for execution.
  • the processor 121 is configured to execute application code stored in the memory 123.
  • the processor 121 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • the terminal 1200 may include multiple processors, such as the processor 121 and the processor 128 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment of the present invention.
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment of the present invention.
  • the application may divide the function module into the terminal according to the above method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the modules in the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 13 shows a schematic diagram of a device, which may be the terminal involved in the above embodiment, and the device includes a processing unit 1301 and a communication unit 1302.
  • the communication unit 1302 is configured to send a first key derivation algorithm to the storage function entity, where the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the communication unit 1302 is further configured to receive an authentication token from the storage function entity, where the authentication token includes a first message authentication code, a second key derivation algorithm, and a third key derivation algorithm, where the second key derivation algorithm is And storing at least one key derivation algorithm supported by the terminal received by the function entity, and the second key derivation algorithm includes a third key derivation algorithm, and the first message authentication code is generated according to the second key derivation algorithm.
  • the processing unit 1301 is configured to generate a second message authentication code according to the second key derivation algorithm.
  • the processing unit 1301 is further configured to acquire the third key derivation algorithm as the key of the terminal. Derived algorithm.
  • the second key derivation algorithm is carried in an authentication management domain of the authentication token.
  • the communication unit 1302 is configured to send a first message to the mobility management function entity, where the first message includes the first key derivation algorithm, the first secret
  • the key derivation algorithm is at least one key derivation algorithm supported by the terminal
  • the second key derivation algorithm is a mobile management function entity or a storage function entity storing at least one key derivation algorithm supported by the terminal received by the function entity.
  • the communication unit 1302 is further configured to receive a second message from the mobility management function entity, where the second message includes a target key derivation algorithm, where the first key derivation algorithm includes a target key derivation algorithm.
  • the processing unit 1301 is configured to update the key derivation algorithm of the terminal to the target key derivation algorithm, and update the key of the terminal according to the target key derivation algorithm.
  • the target key derivation algorithm includes a first target key derivation algorithm from the storage function entity
  • the processing unit 1301 is configured to: update the access security management entity key of the terminal according to the first target key derivation algorithm.
  • the second message further includes a first random number from the storage function entity.
  • the processing unit 1301 is specifically configured to: update the access security management entity key according to the first target key derivation algorithm and the first random number.
  • the target key derivation algorithm includes a second target key derivation algorithm from the mobility management function entity, and the processing unit 1301 is specifically configured to: update the terminal for the terminal and the mobility management function according to the second target key derivation algorithm The first key of communication.
  • the second message further includes a second random number from the mobility management function entity, and the processing unit 1301 is configured to: update the first key according to the second target key derivation algorithm and the second random number.
  • the method further includes: a communication unit 1302, configured to receive a non-access stratum NAS security mode completion SMP message from the mobility management function entity, where the NAS SMP message includes a second key derivation algorithm, and the second key derivation algorithm is And storing, by the function entity, a key-derived algorithm supported by the terminal, the processing unit 1301 is further configured to determine that the first key-derived algorithm is different from the second key-derived algorithm.
  • a communication unit 1302 configured to receive a non-access stratum NAS security mode completion SMP message from the mobility management function entity, where the NAS SMP message includes a second key derivation algorithm, and the second key derivation algorithm is And storing, by the function entity, a key-derived algorithm supported by the terminal, the processing unit 1301 is further configured to determine that the first key-derived algorithm is different from the second key-derived algorithm.
  • the first message is a NAS SMP message
  • the second message is a NAS security mode command SMC message.
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment of the present invention.
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment of the present invention.
  • FIG. 14 a schematic diagram of a device provided by the present application, where the device may be, for example, a mobility management function entity or a storage function entity, may be implemented by a mobility management function entity or Stores the method that the functional entity performs.
  • the device may be, for example, a mobility management function entity or a storage function entity, may be implemented by a mobility management function entity or Stores the method that the functional entity performs.
  • the mobility management function entity or storage function entity 1400 includes at least one processor 141, a transceiver 142, and optionally a memory 143.
  • the processor 141, the transceiver 142, and the memory 143 are connected by a communication bus.
  • the processor 141 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.
  • CPU general purpose central processing unit
  • ASIC application-specific integrated circuit
  • the communication bus can include a path for communicating information between the above units.
  • the transceiver 142 is configured to communicate with other devices or communication networks, and the transceiver includes a radio frequency circuit.
  • the memory 143 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device may also be an electrically erasable programmabler-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, or a disc storage ( Including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be stored by a computer Any other media taken, but not limited to this.
  • EEPROM electrically erasable programmabler-only memory
  • CD-ROM compact disc read-only memory
  • CD-ROM compact disc read-only memory
  • disc storage Including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the memory 143 may be independent and connected to the processor 141 via a communication bus. Memory 143 can also be integrated with the processor. Among them, the memory 143 is used to store application code for executing the scheme of the present invention, and is controlled by the processor 141 for execution. The processor 141 is configured to execute application code stored in the memory 143.
  • processor 141 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • the mobility management function entity or storage function entity 1400 can include multiple processors, such as processor 141 and processor 148 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.
  • the mobility management function entity or the storage function entity may be used to implement the steps performed by the mobility management function entity or the storage function entity in the negotiation method of the key derivation algorithm of the embodiment of the present invention. I won't go into details here.
  • the application may divide the function module of the mobility management function entity or the storage function entity according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic, and is only a logical function division, and may be further divided in actual implementation.
  • FIG. 15 shows a schematic diagram of a device, which may be a mobility management function entity or a storage function entity involved in the above embodiment, and the device includes a processing unit. 1501 and communication unit 1502.
  • the communication unit 1502 is configured to receive a second key derivation algorithm, and the second key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the storage function entity.
  • the processing unit 1501 is configured to select a third key derivation algorithm from the second key derivation algorithm according to the preset policy, and generate a first message authentication code according to the second key derivation algorithm.
  • the communication unit 1502 is further configured to send an authentication token to the terminal, where the authentication token includes a first message authentication code, a third key derivation algorithm, and a second key derivation algorithm.
  • the second key derivation algorithm is carried in an authentication management domain of the authentication token.
  • the communication unit 1502 is configured to receive a first key derivation algorithm from the terminal, where the first key derivation algorithm is derived from at least one key supported by the terminal. algorithm.
  • the processing unit 1501 is configured to select a target key derivation algorithm from the first key derivation algorithm according to a preset policy.
  • the processing unit 1501 is further configured to update the key stored in the network side node according to the target key derivation algorithm.
  • the communication unit 1502 is further configured to send a target key derivation algorithm to the terminal.
  • the processing unit 1501 is specifically configured to: generate a random number; update the key stored in the network side node according to the random number and the target key derivation algorithm.
  • the communication unit 1502 is further configured to: send a random number to the terminal.
  • the key stored in the mobility management function entity is an access security management entity key of the terminal; or, if the device is a storage function entity, the key stored in the storage function entity is A first key for communication between the terminal and the mobility management function entity.
  • the communication unit 1502 is further configured to: receive a second key derivation algorithm, where the second key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the mobility management function entity; and send the non-access layer NAS security mode to the terminal
  • the SMP message is completed, and the NAS SMP message includes a second key derivation algorithm.
  • the mobility management function entity or the storage function entity is presented in a form corresponding to each function to divide each function module, or the mobility management function entity or the storage function entity divides the form of each function module in an integrated manner.
  • a “module” herein may refer to an application-specific integrated circuit (ASIC), circuitry, a processor and memory that executes one or more software or firmware programs, integrated logic circuitry, and/or other functions that provide the functionality described above. Device.
  • ASIC application-specific integrated circuit
  • the mobility management function entity or the storage function entity may be used to implement the steps performed by the mobility management function entity or the storage function entity in the negotiation method of the key derivation algorithm of the embodiment of the present invention. I won't go into details here.
  • another method for negotiating a key-derived algorithm includes the following steps:
  • step 1601 the terminal sends the first identifier information of the first key derivation algorithm to the network side network element, and the network side network element receives the third identifier information of the third key derivation algorithm.
  • the network side network element may be UDM, HSS, AUSF, SEAF, AMF, MME, gNB or eNB.
  • the first key derivation algorithm can be used to represent the key derivation algorithm capability of the terminal, that is, the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the key-derived algorithms supported by the terminal are KDF1, KDF2, and KDF3
  • the first key-derived algorithm may be ⁇ KDF1, KDF2, KDF3 ⁇ .
  • the first key derivation algorithm sent by the terminal may be the first identifier information of the key derivation algorithm supported by the terminal.
  • the terminal sends the identifier.
  • the first identification information of the first key derivation algorithm is ⁇ identification of KDF1, identification of KDF2, identification of KDF3 ⁇ .
  • a key derivation algorithm sent by a terminal received by a network side network element is called a third key derivation algorithm.
  • the network side network element receives the identifier information of the third key derivation algorithm, for example, the third identifier information.
  • the specific method for the terminal to send the first identifier information of the first key derivation algorithm to the network side network element may be:
  • the first identification information may be encapsulated in a registration request message (the registration request message is used for initial registration of the terminal, or changing a tracking area identity (TAI), or Transmitted to AMF in periodic TAI update).
  • the registration request message is used for initial registration of the terminal, or changing a tracking area identity (TAI), or Transmitted to AMF in periodic TAI update.
  • TAI tracking area identity
  • the first identification information may be sent by the terminal to the AMF first, and then sent by the AMF to the SEAF.
  • the first identification information may be that the terminal first sends the information to the SEAF through the AMF, and then the SEAF passes the authentication initiation request message (the authentication initiation request message is used for the terminal). Initiating authentication of the terminal) is sent to the AUSF.
  • the first identification information may be that the terminal first sends the AUSF through the AMF and the SEAF, and then the AUSF passes the authentication information request message (the authentication information request message). Used to request an authentication vector) to be sent to the UDM.
  • the first identification information may be that the terminal sends the AMF first, and then the AMF uses an initial context setup request message (the initial context setup request message is used for The initial terminal context is established and sent to the gNB.
  • the first identifier information may be encapsulated in an attach request message (the attach request message is used for the terminal to register to the network) and sent to the MME.
  • the first identifier information may be sent by the terminal to the MME, and then the MME passes an authentication data request message (the authentication data request message is used to request the authentication vector). ) sent to HSS.
  • the first identifier information may be sent by the terminal to the MME, and then the MME uses an initial context setup request message (the initial context setup request message is used for The initial terminal context is established and sent to the eNB.
  • the initial message carrying the first identifier information sent by the terminal is not protected by the integrity. Therefore, the attacker may be attacked by the attacker. The attacker may tamper with the first identifier information in the initial message.
  • the third identification information of the third key derivation algorithm may be different from the first identification information of the first key derivation algorithm.
  • the first identifier information sent by the terminal is not tampered with by the attacker, and the third identifier information of the third key derivation algorithm received by the network side network element and the first identifier of the first key derivation algorithm sent by the terminal The information is the same.
  • the third identifier information of the third key derivation algorithm received by the network side network element may be the same as the first identifier information of the first key derivation algorithm sent by the terminal, or may be different.
  • Step 1602 The network side network element selects a fourth key derivation algorithm from the received third key derivation algorithm according to a preset policy.
  • the third key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the network side network element.
  • the third key derivation algorithm may be determined according to the third identifier information. Then, the network side network element selects a fourth key derivation algorithm from the third key derivation algorithm according to a preset policy, as a key derivation algorithm negotiated between the terminal and the network side network element.
  • the preset policy may be a priority policy, that is, selecting a key-derived algorithm with the highest priority; or, a usage-time policy, that is, selecting a key-derived algorithm with the most usage; or other strategies, the application does not limit.
  • the first key derivation algorithm is ⁇ KDF1, KDF2, KDF3 ⁇ , wherein the priority of KDF1 is lower than the priority of KDF2, and the priority of KDF2 is lower than the priority of KDF3.
  • the third key derivation algorithm received by the network side network element is the same as the first key derivation algorithm, and is also ⁇ KDF1, KDF2, KDF3 ⁇ , and the network side network element
  • the fourth key derivation algorithm selected from the third key derivation algorithm is KDF3.
  • the third key derivation algorithm received by the network side network element is ⁇ KDF1 ⁇
  • the fourth key derivation algorithm selected by the network side network element from the third key derivation algorithm is KDF1.
  • step 1603 the network side network element sends the fourth identifier information of the fourth key derivation algorithm to the terminal, and the terminal receives the second identifier information of the second key derivation algorithm.
  • the network side network element selects a fourth key derivation algorithm from the third key derivation algorithm, and then carries the fourth identification information of the fourth key derivation algorithm in a message and sends the message to the terminal, and the message is not completed.
  • Sexual protection so it may be attacked by an attacker.
  • the attacker may tamper with the fourth identification information in the message.
  • the second identification information of the second key derivation algorithm received by the terminal may be the fourth key.
  • the fourth identification information of the derived algorithm is different.
  • the fourth identifier information sent by the network side network element is not tampered with by the attacker, and the second identifier information of the second key derivation algorithm received by the terminal is compared with the fourth key derivation algorithm sent by the network side network element.
  • the fourth identification information is the same.
  • the second identification information of the second key derivation algorithm received by the terminal may be the same as the fourth identification information of the fourth key derivation algorithm sent by the network side network element, or may be different.
  • the terminal After receiving the second identifier information of the second key derivation algorithm, the terminal determines that the key derivation algorithm selected by the network side network element is the second key derivation algorithm. Or it is understood that the terminal determines that the key derivation algorithm negotiated with the network side is the second key derivation algorithm.
  • Step 1604 The terminal generates a lower layer key according to the upper layer key, the first identification information of the first key derivation algorithm, and the second key derivation algorithm.
  • the terminal generates the lower layer key according to the upper layer key, the first identification information of the first key derivation algorithm, and the second key derivation algorithm. Specifically, the terminal uses the upper layer key and the first identification information as input parameters, and the second The key derivation algorithm is used as a function to input the input parameters into the function to obtain the lower layer key.
  • the terminal generates the lower layer key according to the upper layer key, the first identifier information, and the second key derivation algorithm, where the terminal may be: the terminal according to the upper layer key, the first identifier information, the second identifier information, and the second
  • the key derivation algorithm generates the lower layer key, specifically: the terminal takes the upper layer key, the first identification information, and the second identification information as input parameters, and uses the second key derivation algorithm as a function to input the input parameter into the function.
  • Lower layer key the terminal takes the upper layer key, the first identification information, and the second identification information as input parameters
  • the upper layer key may be the access management key Kamf
  • the lower layer key may be the non-access layer encryption key KNASenc, and the non-access layer integrity protection key.
  • At least one of the KNASint, the base station key KgNB, and the non-3GPP access key Kn3iwf that is, the terminal generates the lower layer key KNASenc, KNASint, KgNB, Kn3iwf according to the upper layer key Kamf, the first identification information, and the second key derivation algorithm.
  • At least one of the lower layer keys KNASenc, KNASint, KgNB, Kn3iwf is generated by the terminal according to the upper layer key Kamf, the first identification information, the second identification information, and the second key derivation algorithm.
  • the upper layer key may be the security anchor key Kseaf
  • the lower layer key is Kamf, that is, the terminal according to the upper layer key Kseaf, the first identification information, and the second key.
  • the derivative algorithm generates the lower layer key Kamf, or the terminal generates the lower layer key Kamf according to the upper layer key Kseaf, the first identification information, the second identification information, and the second key derivation algorithm.
  • the upper layer key may be the authentication service key Kausf
  • the lower layer key may be Kseaf, that is, the terminal is derived according to the upper layer key Kausf, the first identification information, and the second key.
  • the algorithm generates the lower layer key Kseaf, or the terminal generates the lower layer key Kseaf according to the upper layer key Kausf, the first identification information, the second identification information, and the second key derivation algorithm.
  • the upper layer key may be the encryption key CK and the integrity IK
  • the lower layer key may be at least one of CK', IK', and Kausf, that is, the terminal is according to the upper layer.
  • the key CK, IK, the first identification information, and the second key derivation algorithm generate at least one of the lower layer keys CK', IK', Kausf, or the terminal according to the upper layer key CK, IK, the first identification information
  • the second identification information and the second key derivation algorithm generate at least one of the lower layer keys CK', IK', Kausf.
  • the network side network element is the next generation base station gNB
  • the upper layer key may be KgNB
  • the lower layer key may be the wireless connection control encryption key Krrc-enc
  • the wireless connection control integrity protection key Krrc-int user plane At least one of the encryption key Kup-enc, the user plane integrity protection key Kup-int, and the next hop NH, that is, the terminal generates the lower layer key according to the upper layer key KgNB, the first identification information, and the second key derivation algorithm.
  • At least one of Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH, or the terminal generates a lower layer according to the upper layer key KgNB, the first identification information, the second identification information, and the second key derivation algorithm At least one of the keys Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH.
  • the upper layer key may be the access management key Kamse
  • the lower layer key may be at least one of KNASenc and KNASint, that is, the terminal according to the upper layer key Kamse, the first
  • the identification information and the second key derivation algorithm generate at least one of the lower layer keys KNASenc, KNASint, or the terminal generates the lower layer according to the upper layer key Kamse, the first identification information, the second identification information, and the second key derivation algorithm.
  • the upper layer key may be CK or IK
  • the lower layer key may be Kasme, that is, the terminal generates the lower layer according to the upper layer key CK, IK, the first identification information, and the second key derivation algorithm.
  • the key Kasme, or the terminal generates the lower layer key Kasme according to the upper layer key CK, IK, the first identification information, the second identification information, and the second key derivation algorithm.
  • the upper layer key may be a KeNB
  • the lower layer key may be at least one of a Krrc-enc, a Krrc-int, a Kup-enc, a Kup-int, and the NH, that is, the terminal is configured according to the upper layer.
  • the key KeNB, the first identification information, and the second key derivation algorithm generate at least one of the lower layer key Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH, or the terminal according to the upper layer key KeNB,
  • the first identification information, the second identification information, and the second key derivation algorithm generate at least one of the lower layer keys Krrc-enc, Krrc-int, Kup-enc, Kup-int, NH.
  • the network side network element is UDM
  • the upper layer key is CK, IK
  • the lower layer key is Kseaf
  • the terminal generates Kausf according to CK, IK, first identification information, and second key derivation algorithm, and then according to Kausf and The second key derivation algorithm generates Kseaf.
  • the terminal generates Kausf according to the CK, IK, and the second key derivation algorithm, and then generates Kseaf according to the Kausf, the first identification information, and the second key derivation algorithm.
  • the KDF algorithm used with the AUSF is obtained. Therefore, the terminal obtains two sets of keys in one negotiation with the UDM: Kausf and Kseaf, so the terminal does not need to separately negotiate the key derivation algorithm with the AUSF, which can save the overhead of the terminal.
  • the network side network element is AUSF
  • the upper layer key is CK, IK
  • the lower layer key is Kseaf
  • the terminal generates Kausf according to CK, IK, first identification information, and second key derivation algorithm, and then according to Kausf and The second key derivation algorithm generates Kseaf.
  • the terminal generates Kausf according to the CK, IK, and the second key derivation algorithm, and then generates Kseaf according to the Kausf, the first identification information, and the second key derivation algorithm.
  • the KDF algorithm used with the UDM is obtained. Therefore, the terminal obtains two sets of keys in a negotiation with the AUSF: Kausf and Kseaf, so the terminal does not need to separately negotiate the key derivation algorithm with the UDM, which can save the overhead of the terminal.
  • the network side network element is SEAF
  • the upper layer key is Kseaf
  • the lower layer key is at least one of KNASenc, KNASint, KgNB, and Kn3iwf, that is, the terminal generates according to Kseaf, the first identification information, and the second key derivation algorithm.
  • Kamf then generates at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf and the second key derivation algorithm.
  • the terminal generates Kamf according to Kseaf and the second key derivation algorithm, and then generates at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf, the first identification information, and the second key derivation algorithm.
  • the KDF algorithm used with the AMF is obtained. Therefore, the terminal obtains two sets of keys in one negotiation with the SEAF: the first group is Kamf, and the second group is at least one of KNASenc, KNASint, KgNB, and Kn3iwf, so the terminal does not need to separately negotiate the key derivation algorithm with the AMF. It can save the overhead of the terminal.
  • the network side network element is AMF
  • the upper layer key is Kseaf
  • the lower layer key is at least one of KNASenc, KNASint, KgNB, and Kn3iwf, that is, the terminal generates according to Kseaf, the first identification information, and the second key derivation algorithm.
  • Kamf then generates at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf and the second key derivation algorithm.
  • the terminal generates Kamf according to Kseaf and the second key derivation algorithm, and then generates at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf, the first identification information, and the second key derivation algorithm.
  • the KDF algorithm used with the SEAF is obtained. Therefore, the terminal obtains two sets of keys in a negotiation with the AMF: the first group is Kamf, and the second group is at least one of KNASenc, KNASint, KgNB, and Kn3iwf, so the terminal does not need to separately negotiate the key derivation algorithm with the SEAF. It can save the overhead of the terminal.
  • Step 1605 The network side network element generates a lower layer key according to the upper layer key, the third identification information of the third key derivation algorithm, and the fourth key derivation algorithm.
  • the network side network element generates a lower layer key
  • the step 1605 may be performed before or after the step 1604, or may be performed simultaneously with the step 1604.
  • the manner in which the network side network element generates the lower layer key corresponds to the manner in which the terminal generates the lower layer key.
  • the terminal adopts the upper layer key and the first identification information as input parameters
  • the second key derivation algorithm is used as a function, and the input parameter is input into the function to obtain the lower layer key
  • the network side network element will The upper key and the third identification information are used as input parameters
  • the fourth key derivation algorithm is used as a function, and the input parameters are input into the function to obtain the lower layer key.
  • the terminal takes the upper layer key, the first identification information, and the second identification information as input parameters
  • the second key derivation algorithm is used as a function, and the input parameter is input into the function to obtain the lower layer key.
  • the network side network element takes the upper layer key, the third identification information, and the fourth identification information as input parameters, and uses the fourth key derivation algorithm as a function, and inputs the input parameter into the function to obtain the lower layer key.
  • the network side network element is AMF
  • the upper layer key is Kamf
  • the lower layer key is at least one of KNASenc, KNASint, KgNB, and Kn3iwf.
  • the terminal generates at least one of the lower layer keys KNASenc, KNASint, KgNB, Kn3iwf according to the upper layer key Kamf, the first identification information, and the second key derivation algorithm, and accordingly, the AMF is according to the upper layer key.
  • the Kamf, the third identification information, and the fourth key derivation algorithm generate at least one of the lower layer keys KNASenc, KNASint, KgNB, Kn3iwf.
  • the terminal generates at least one of the lower layer keys KNASenc, KNASint, KgNB, Kn3iwf according to the upper layer key Kamf, the first identification information, the second identification information, and the second key derivation algorithm, and accordingly
  • the AMF generates at least one of the lower layer keys KNASenc, KNASint, KgNB, Kn3iwf according to the upper layer key Kamf, the third identification information, the fourth identification information, and the fourth key derivation algorithm.
  • the case where the network side network element is SEAF, AUSF, UDM, gNB, MME, HSS, and eNB is similar, and will not be described again.
  • the terminal when the network side network element is a UDM, the terminal can negotiate with the UDM through a KDF and complete the KDF negotiation with the AUSF, that is, the terminal can negotiate with the UDM to obtain Kausf and Kseaf, and accordingly, the UDM
  • the lower layer key Kausf is obtained according to the upper layer key CK, IK in the same manner as the terminal, and further, the UDM further transmits the fourth identification information and Kausf to the AUSF such that the AUSF is based on the Kausf, the fourth identification information, and the fourth key.
  • the derived algorithm generates Kseaf.
  • the terminal may negotiate with the AUSF through a KDF and complete the KDF negotiation with the UDM, that is, the terminal may negotiate with the AUSF to obtain Kausf and Kseaf, and correspondingly, the AUSF
  • the fourth identifier information is sent to the UDM.
  • the UDM obtains the lower layer key Kausf according to the upper layer key CK, IK in the same manner as the terminal, and further, the UDM sends the Kausf to the AUSF, so that the AUSF according to the Kausf, the fourth identification information, and
  • the fourth key derivation algorithm generates Kseaf.
  • the terminal can negotiate with the SEAF through a KDF and complete the KDF negotiation with the AMF, that is, the terminal can negotiate with the SEAF to obtain Kamf, and obtain KNASenc, KNASint, KgNB.
  • the SEAF obtains the lower layer key Kamf according to the upper layer key Kseaf in the same manner as the terminal, and further, the SEAF also sends the fourth identification information and Kamf to the AMF, so that the AMF is based on Kamf
  • the fourth identification information and the fourth key derivation algorithm generate at least one of KNASenc, KNASint, KgNB, Kn3iwf.
  • the terminal when the network side network element is AMF, the terminal can negotiate with the AMF through a KDF, and simultaneously complete the KDF negotiation with the SEAF, that is, the terminal can negotiate with the AMF to obtain Kamf, and obtain KNASenc, KNASint, KgNB. At least one of Kn3iwf, correspondingly, the AMF first sends the fourth identification information to the SEAF, and the SEAF obtains the lower layer key Kamf according to the upper layer key Kseaf in the same manner as the terminal, and further, the SEAF also sends Kamf to the AMF. And causing the AMF to generate at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf, fourth identification information, and fourth key derivation algorithm.
  • the first key derivation algorithm is the same as the third key derivation algorithm
  • the second key algorithm is the same as the fourth key derivation algorithm
  • the first key derivation algorithm sent by the terminal to the network side network element is the same as the third key derivation algorithm received by the network side network element, and the second key derivation algorithm received by the terminal is sent by the network side network element.
  • the fourth key derivation algorithm is the same. That is, the first key derivation algorithm sent by the terminal has not been tampered with, and the fourth key derivation algorithm sent by the network side network element has not been tampered with.
  • the lower layer key generated by the terminal and the network side network element is the same, so that normal communication can be implemented.
  • the first key derivation algorithm is the same as the third key derivation algorithm, but the second key algorithm is different from the fourth key derivation algorithm.
  • the first key derivation algorithm sent by the terminal to the network side network element is the same as the third key derivation algorithm received by the network side network element, and the second key derivation algorithm received by the terminal is sent by the network side network element.
  • the fourth key derivation algorithm is different. That is, the first key derivation algorithm sent by the terminal has not been tampered with, but the fourth key derivation algorithm sent by the network side network element has been tampered with.
  • the lower layer key generated by the terminal and the network side network element negotiation is different, so that the terminal cannot communicate with the network side network element subsequently, that is, the terminal and the network side network element can find the negotiation failure, and the negotiation process can be re-initiated. That is, in this case, when the key derivation algorithm is tampered with, the terminal and the network side network element will not communicate using the key generated according to the falsified key derivation algorithm, thereby ensuring the security of the communication.
  • the first key derivation algorithm is different from the third key derivation algorithm, but the second key algorithm is the same as the fourth key derivation algorithm.
  • the first key derivation algorithm sent by the terminal to the network side network element is different from the third key derivation algorithm received by the network side network element, and the second key derivation algorithm received by the terminal is sent by the network side network element.
  • the fourth key derivation algorithm is the same. That is, the first key derivation algorithm sent by the terminal is tampered with, but the fourth key derivation algorithm sent by the network side network element has not been tampered with.
  • the lower layer key generated by the terminal and the network side network element negotiation is different, so that the terminal cannot communicate with the network side network element subsequently, that is, the terminal and the network side network element can find the negotiation failure, and the negotiation process can be re-initiated. That is, in this case, when the key derivation algorithm is tampered with, the terminal and the network side network element will not communicate using the key generated according to the falsified key derivation algorithm, thereby ensuring the security of the communication.
  • the first key derivation algorithm sent by the terminal to the network side network element is different from the third key derivation algorithm received by the network side network element, and the second key derivation algorithm received by the terminal is sent by the network side network element.
  • the fourth key derivation algorithm is different. That is, the first key derivation algorithm sent by the terminal is tampered with, and the fourth key derivation algorithm sent by the network side network element is tampered with.
  • the lower layer key generated by the terminal and the network side network element negotiation is different, so that the terminal cannot communicate with the network side network element subsequently, that is, the terminal and the network side network element can find the negotiation failure, and the negotiation process can be re-initiated. That is, in this case, when the key derivation algorithm is tampered with, the terminal and the network side network element will not communicate using the key generated according to the falsified key derivation algorithm, thereby ensuring the security of the communication.
  • the terminal and the network side network element will generate different lower layer keys, thereby causing communication failure. Therefore, when the key derivation algorithm is tampered with, the terminal and the network side network element will not communicate using the key generated according to the falsified key derivation algorithm, thereby ensuring the security of the communication.
  • the key negotiation method shown in FIG. 16 is exemplified below with reference to specific embodiments.
  • another method for key negotiation provided by the present application includes the following steps:
  • Step 1701 The terminal sends the first identifier information of the first key derivation algorithm to the AUSF, and the AUSF receives the third identifier information of the third key derivation algorithm.
  • the first key derivation algorithm can be used to represent the key derivation algorithm capability of the terminal, that is, the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the third key derivation algorithm represents the key derivation algorithm capability of the terminal received by the AUSF.
  • the first identifier information may be sent by the terminal to the AUSF through the AMF and the SEAF.
  • Step 1702 The AUSF sends the third identifier information of the third key derivation algorithm to the UDM, and the UDM receives the third identifier information of the third key derivation algorithm.
  • the AUSF sends the third identification information to the UDM through an authentication information request message.
  • the step is protected, the third identifier information sent by the AUSF to the UDM is not tampered with.
  • Step 1703 The UDM selects a fourth key derivation algorithm from the received third key derivation algorithm according to a preset policy.
  • this step is the same as the method for selecting the fourth key algorithm by the network side network element in step 1602 of the embodiment shown in FIG. 16, and reference may be made to the foregoing description.
  • Step 1704 the UDM generates Kausf according to CK, IK, the fourth key derivation algorithm, and generates XRES* according to XRES, the fourth key derivation algorithm.
  • UDM takes CK, IK as an input parameter, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to obtain the key Kausf.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • UDM also uses XRES as an input parameter, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to get XRES*.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • Step 1705 The UDM sends the fourth identifier information of the fourth key derivation algorithm, Kausf and XRES*, to the AUSF. Accordingly, the AUSF receives the fourth identifier information of the fourth key derivation algorithm, Kausf and XRES*.
  • the UDM sends the fourth identification information of the fourth key derivation algorithm to the AUSF, and Kausf and XRES* are not tampered with.
  • Step 1706 the AUSF generates Kseaf according to Kausf, the third identification information of the third key derivation algorithm and the fourth key derivation algorithm.
  • the AUSF takes the Kausf and the third identification information as input parameters, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to generate Kseaf.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • Step 1707 The AUSF sends the fourth identifier information of the fourth key derivation algorithm to the terminal, and the terminal receives the second identifier information of the second key derivation algorithm.
  • the fourth key derivation algorithm is an algorithm selected by the UDM from the third key derivation algorithm, and the second key derivation algorithm is a key derivation algorithm received by the terminal when the AUSF sends the fourth key derivation algorithm to the terminal. .
  • the second identification information received by the terminal is the same as the fourth identification information sent by the AUSF.
  • the second identifier information received by the terminal may be different from the fourth identifier information sent by the AUSF.
  • Step 1708 the terminal generates Kausf according to CK, IK, the second key derivation algorithm, and generates XRES* according to XRES, the second key derivation algorithm.
  • the terminal takes CK, IK as an input parameter, and uses the second key derivation algorithm as a function to input the input parameters into the function to obtain the key Kausf.
  • the input parameter may further include second identifier information of the second key derivation algorithm.
  • the terminal also uses XRES as an input parameter, and uses the second key derivation algorithm as a function to input the input parameters into the function to obtain XRES*.
  • the input parameter may further include second identifier information of the second key derivation algorithm.
  • the terminal generating Kausf is different from the UDM generating Kausf in that the function on the UDM side is a fourth key derivation algorithm, and the input parameter on the terminal side is a second key derivation algorithm.
  • the second key derivation algorithm is the same as the fourth key derivation algorithm, the Kausf generated by the terminal and the UDM respectively is the same.
  • the terminal generation XRES* differs from the UDM generation XRES* in that the function on the UDM side is a fourth key derivation algorithm, and the input parameter on the terminal side is a second key derivation algorithm.
  • the second key derivation algorithm is the same as the fourth key derivation algorithm, the XRES* generated by the terminal and the UDM respectively is the same.
  • Step 1709 The terminal generates Kseaf according to Kausf, the first identification information of the first key derivation algorithm and the second key derivation algorithm.
  • the terminal takes the Kausf and the first identification information as input parameters, and uses the second key derivation algorithm as a function to input the input parameters into the function to generate Kseaf.
  • the input parameter may further include second identifier information of the second key derivation algorithm.
  • the terminal generation Kseaf is different from the AUSF generation Kseaf in that the function on the AUSF side is the fourth key derivation algorithm and the input parameter includes the third identification information, and the function on the terminal side is the second key derivation algorithm and input.
  • the parameter includes first identification information. Therefore, if the second key derivation algorithm is the same as the fourth key derivation algorithm, and the first key derivation algorithm is the same as the third key derivation algorithm, the Kseaf generated by the terminal and the AUSF respectively is the same.
  • the process of negotiating a key from the terminal and the UDM can be seen as follows: First, only when the first key derivation algorithm is the same as the third key derivation algorithm, and the second key derivation algorithm is the same as the fourth key derivation algorithm.
  • the Kseaf negotiated by the terminal and the AUSF is the same. If it is different, the normal communication cannot be completed, so that the key is secured while the key is negotiated.
  • the terminal can pass the UDM.
  • a KDF negotiation and completion of the KDF negotiation with the AUSF that is, the terminal can negotiate with the UDM to obtain Kausf and Kseaf.
  • the terminal negotiates a key with the AUSF: first, only when the first key derivation algorithm is the same as the third key derivation algorithm, and the second key derivation algorithm is the same as the fourth key derivation algorithm
  • the Kseaf negotiated by the terminal and the AUSF is the same. If it is different, the normal communication cannot be completed, thereby ensuring the security of the key while completing the key negotiation.
  • the terminal can pass the AUSF.
  • a KDF negotiation and completion of the KDF negotiation with the UDM that is, the terminal can negotiate with the AUSF to obtain Kausf and Kseaf.
  • another method for key negotiation provided by the present application includes the following steps:
  • Step 1711 The terminal sends the first identifier information of the first key derivation algorithm to the AUSF, and the AUSF receives the third identifier information of the third key derivation algorithm.
  • the first key derivation algorithm can be used to represent the key derivation algorithm capability of the terminal, that is, the first key derivation algorithm is at least one key derivation algorithm supported by the terminal.
  • the third key derivation algorithm represents the key derivation algorithm capability of the terminal received by the AUSF.
  • the first identifier information may be sent by the terminal to the AUSF through the AMF and the SEAF.
  • Step 1712 The AUSF sends the third identifier information of the third key derivation algorithm to the UDM, and the UDM receives the third identifier information of the third key derivation algorithm.
  • the AUSF sends the third identification information to the UDM through an authentication information request message.
  • the step is protected, the third identifier information sent by the AUSF to the UDM is not tampered with.
  • Step 1713 The UDM selects a fourth key derivation algorithm from the received third key derivation algorithm according to a preset policy.
  • this step is the same as the method for selecting the fourth key algorithm by the network side network element in step 1602 of the embodiment shown in FIG. 16, and reference may be made to the foregoing description.
  • step 1714 the UDM generates CK', IK' according to the CK, IK, fourth key derivation algorithm.
  • the UDM takes CK, IK as an input parameter, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to obtain CK', IK'.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • step 1715 the UDM sends the fourth identification information of the fourth key derivation algorithm, CK', IK', to the AUSF. Accordingly, the AUSF receives the fourth identification information of the fourth key derivation algorithm, CK', IK'.
  • the UDM sends the fourth identification information of the fourth key derivation algorithm to the AUSF, and CK', IK' will not be tampered with.
  • step 1716 the AUSF generates Kausf based on CK', IK' and the fourth key derivation algorithm.
  • AUSF takes CK', IK' as an input parameter, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to generate Kausf.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • Step 1717 The AUSF generates Kseaf according to Kausf, the third identification information of the third key derivation algorithm and the fourth key derivation algorithm.
  • the AUSF takes the Kausf and the third identification information as input parameters, and uses the fourth key derivation algorithm as a function to input the input parameters into the function to generate Kseaf.
  • the input parameter may further include fourth identification information of the fourth key derivation algorithm.
  • Step 1718 The AUSF sends the fourth identifier information of the fourth key derivation algorithm to the terminal, and the terminal receives the second identifier information of the second key derivation algorithm.
  • the fourth key derivation algorithm is an algorithm selected by the UDM from the third key derivation algorithm, and the second key derivation algorithm is a key derivation algorithm received by the terminal when the AUSF sends the fourth key derivation algorithm to the terminal. .
  • the second identifier information received by the terminal is the same as the fourth identifier information sent by the AUSF.
  • the second identifier information received by the terminal may be different from the fourth identifier information sent by the AUSF.
  • step 1719 the terminal generates CK', IK' according to the CK, IK, and second key derivation algorithm.
  • the terminal takes CK', IK' as an input parameter, and uses the second key derivation algorithm as a function to input the input parameters into the function to obtain CK', IK'.
  • the input parameter in the step 1714 includes the fourth identifier information of the fourth key derivation algorithm
  • the input parameter in the step 1719 further includes the second identifier information of the second key derivation algorithm.
  • step 1720 the terminal generates Kausf according to CK', IK' and the second key derivation algorithm.
  • the terminal takes CK', IK' as an input parameter, and uses the second key derivation algorithm as a function to input the input parameters into the function to obtain the key Kausf.
  • the input parameter in the step 1716 includes the fourth identifier information of the fourth key derivation algorithm
  • the input parameter in the step 1720 further includes the second identifier information of the second key derivation algorithm.
  • the terminal generating Kausf is different from the AUSF generating Kausf in that the function on the AUSF side is the fourth key derivation algorithm, and the function on the terminal side is the second key derivation algorithm.
  • the second key derivation algorithm is the same as the fourth key derivation algorithm, the Kausf generated by the terminal and the AUSF respectively is the same.
  • Step 1721 The terminal generates Kseaf according to Kausf, the first identification information of the first key derivation algorithm and the second key derivation algorithm.
  • the terminal takes the Kausf and the first identification information as input parameters, and uses the second key derivation algorithm as a function to input the input parameters into the function to generate Kseaf.
  • the input parameter in the step 1717 includes the fourth identifier information of the fourth key derivation algorithm
  • the input parameter in the step 1721 further includes the second identifier information of the second key derivation algorithm.
  • the terminal generation Kseaf is different from the AUSF generation Kseaf in that the function on the AUSF side is the fourth key derivation algorithm and the input parameter includes the third identification information, and the function on the terminal side is the second key derivation algorithm and input.
  • the parameter includes first identification information. Therefore, if the second key derivation algorithm is the same as the fourth key derivation algorithm, and the first key derivation algorithm is the same as the third key derivation algorithm, the Kseaf generated by the terminal and the AUSF respectively is the same.
  • the process of negotiating a key from the terminal and the UDM can be seen as follows: First, only when the first key derivation algorithm is the same as the third key derivation algorithm, and the second key derivation algorithm is the same as the fourth key derivation algorithm.
  • the Kseaf negotiated by the terminal and the AUSF is the same. If it is different, the normal communication cannot be completed, so that the key is secured while the key is negotiated.
  • the terminal can pass the UDM.
  • a KDF negotiation and completion of the KDF negotiation with the AUSF that is, the terminal can negotiate with the UDM to obtain Kausf and Kseaf.
  • the terminal negotiates a key with the AUSF: first, only when the first key derivation algorithm is the same as the third key derivation algorithm, and the second key derivation algorithm is the same as the fourth key derivation algorithm
  • the Kseaf negotiated by the terminal and the AUSF is the same. If it is different, the normal communication cannot be completed, thereby ensuring the security of the key while completing the key negotiation.
  • the terminal can pass the AUSF.
  • a KDF negotiation and completion of the KDF negotiation with the UDM that is, the terminal can negotiate with the AUSF to obtain Kausf and Kseaf.
  • FIG. 18 a schematic diagram of a device provided by the present application, which may be a terminal, may perform the method performed by the terminal in the embodiment shown in FIG. 16, or may be a network side network.
  • the method performed by the network side network element in the embodiment shown in FIG. 16 can be performed.
  • the apparatus 1800 includes at least one processor 181, a transceiver 182, and optionally a memory 183.
  • the processor 181, the transceiver 182, and the memory 183 are connected by a communication bus.
  • Processor 181 can be a general purpose central processing unit (CPU), microprocessor, ASIC, or one or more integrated circuits for controlling the execution of the program of the present invention.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • the communication bus can include a path for communicating information between the above units.
  • the transceiver 182 is configured to communicate with other devices or communication networks, and the transceiver includes a radio frequency circuit.
  • the memory 183 may be a ROM or other type of static storage device RAM that may store static information and instructions) or other types of dynamic storage devices that may store information and instructions, or may be EEPROM, CD-ROM or other optical disk storage, optical disk storage. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory 183 can exist independently and be coupled to the processor 181 via a communication bus. Memory 183 can also be integrated with the processor.
  • the memory 183 is used to store application code for executing the solution of the present invention, and is controlled by the processor 181 for execution.
  • the processor 181 is configured to execute application code stored in the memory 183.
  • processor 181 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • apparatus 1800 can include multiple processors, such as processor 181 and processor 188 in FIG. Each of these processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.
  • processors such as processor 181 and processor 188 in FIG.
  • processors may be a single-CPU processor or a multi-core processor, where the processor may refer to one or more devices, circuits, and/or A processing core for processing data, such as computer program instructions.
  • the terminal when the device is a terminal, the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment shown in FIG. 16 , and related features may refer to the above, and details are not described herein again.
  • the network side network element When the device is a network side network element, the network side network element may be used to implement the step performed by the network side network element in the negotiation method of the key derivation algorithm of the embodiment shown in FIG. , will not repeat them here.
  • each functional module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic, and is only a logical function division, and may be further divided in actual implementation. For example, in the case where each functional module is divided by corresponding functions, FIG. 19 shows a schematic diagram of a device including a processing unit 1901 and a communication unit 1902.
  • the device may be the terminal involved in the embodiment shown in FIG.
  • the processing unit 1901 and the communication unit 1902 of the device can be used to perform the following operations:
  • the communication unit 1902 is configured to send the first identifier information of the first key derivation algorithm to the network side network element, where the first key derivation algorithm is at least one key derivation algorithm supported by the terminal;
  • the communication unit 1902 is further configured to receive second identification information of the second key derivation algorithm
  • the processing unit 1901 is configured to generate a lower layer key according to the upper layer key, the first identification information, and the second key derivation algorithm.
  • the processing unit 1901 is configured to generate a lower layer key according to the upper layer key, the first identifier information, the second identifier information, and the second key derivation algorithm.
  • the upper layer key is an encryption key CK, an integrity key IK
  • the lower layer key is a security anchor key Kseaf
  • the processing unit 1901 is specifically configured to: according to CK, IK, first identification information, and second a key derivation algorithm, generating an authentication service key Kausf; and generating Kseaf according to Kausf and a second key derivation algorithm; or generating Kausf according to CK, IK and a second key derivation algorithm; and, according to Kausf, An identification information and a second key derivation algorithm generate Kseaf.
  • the upper layer key is Kseaf
  • the lower layer key is a non-access stratum encryption key KNASenc, a non-access stratum integrity protection key KNASint, a base station key KgNB, and at least one of the non-3GPP access keys Kn3iwf
  • the processing unit 1901 is specifically configured to: generate an access management key Kamf according to the Kseaf, the first identification information, and the second key derivation algorithm; and generate KNASenc, KNASint, KgNB according to the Kamf and the second key derivation algorithm At least one of Kn3iwf; or, according to Kseaf and the second key derivation algorithm, generating Kamf; and generating at least one of KNASenc, KNASint, KgNB, Kn3iwf according to Kamf, first identification information, second key derivation algorithm .
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment shown in FIG. 16.
  • the terminal may be used to implement the steps performed by the terminal in the negotiation method of the key derivation algorithm of the embodiment shown in FIG. 16.
  • the apparatus may be the network side network element involved in the embodiment shown in FIG.
  • the processing unit 1901 and the communication unit 1902 of the device can be used to perform the following operations:
  • the communication unit 1902 is configured to receive third identifier information of the third key derivation algorithm, where the third key derivation algorithm is at least one key derivation algorithm supported by the terminal received by the network side network element;
  • the processing unit 1901 is configured to select a fourth key derivation algorithm from the third key derivation algorithm according to the preset policy; and generate a lower layer key according to the third identification information, the fourth key derivation algorithm, and the upper layer key. ;
  • the communication unit 1902 is further configured to send fourth identification information of the fourth key derivation algorithm to the terminal.
  • the processing unit 1901 is configured to generate a lower layer key according to the upper layer key, the third identifier information, the fourth identifier information, and the fourth key derivation algorithm.
  • the device 1900 is a unified data management entity, the upper layer key is CK, IK, and the lower layer key is Kausf.
  • the communication unit 1902 is further configured to send fourth identification information and Kausf to the authentication service entity.
  • the device 1900 is a security anchor entity, the upper layer key is Kseaf, and the lower layer key is Kamf.
  • the communication unit 1902 is further configured to send fourth identification information and Kamf to the mobility management function entity.
  • the network side network element may be used to implement the steps performed by the network side network element in the negotiation method of the key derivation algorithm of the embodiment shown in FIG. 16 of the present invention. Narration.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a DVD
  • a semiconductor medium such as a Solid State Disk (SSD)
  • embodiments of the present application can be provided as a method, apparatus (device), computer readable storage medium, or computer program product.
  • the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware aspects, which are collectively referred to herein as "module” or "system.”
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种密钥衍生算法的协商方法及装置。该方法包括：终端对发送出去的第一密钥衍生算法与接收到的第二密钥衍生算法进行校验，当校验正确且第一密钥衍生算法与第二密钥衍生算法相同，则确定终端发送的的第一密钥衍生算法没有被攻击者篡改，然后才将协商的第三密钥衍生算法，作为终端的密钥衍生算法，保证了协商的密钥衍生算法的保密性，从而提高通信的安全性。

Description

一种密钥衍生算法的协商方法及装置
本申请要求在2017年9月27日提交中华人民共和国知识产权局、申请号为201710890306.2、发明名称为“一种密钥衍生算法的协商方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中，以及，要求在2018年3月28日提交中华人民共和国知识产权局、申请号为201810265796.1、发明名称为“一种密钥衍生算法的协商方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及移动通信技术领域，尤其涉及一种密钥衍生算法的协商方法及装置。
背景技术
与安全相关的算法包括完整性保护算法、加密算法以及密钥衍生功能(Key Derivation Function,KDF)算法。密钥衍生功能算法也称为密钥衍生算法。其中，完整性保护算法用于计算消息鉴别码(Message Authentication Code,MAC)。加密算法用于对消息进行加密。KDF算法用于推衍密钥。
目前，针对密钥衍生算法，终端与网络侧之间的协商方法为：终端将终端支持的密钥衍生算法发送至网络侧，由网络侧根据预先配置的策略，如优先级策略，从中选择一个密钥衍生算法发送至终端，该选择的密钥衍生算法即作为协商的密钥衍生算法。
上述方法存在的主要问题是：由终端向网络侧发送的初始消息由于没有得到完整性保护，因此容易受到攻击者的攻击，比如，攻击者对终端发送给网络侧的终端支持的密钥衍生算法进行修改，使得网络侧只接收到一种安全性较弱的密钥衍生算法，从而网络侧选择该安全性较弱的密钥衍生算法发送给终端，作为协商的密钥衍生算法，导致终端和网络侧使用了安全性较弱的密钥衍生算法，降低了通信的安全性。
发明内容
本申请提供一种密钥衍生算法的协商方法及装置，用以提高通信的安全性。
第一方面，本申请提供一种密钥衍生算法的协商方法，该方法可由终端或终端内的芯片执行。该方法包括：终端向存储功能实体发送第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。终端接收来自存储功能实体的认证令牌，认证令牌包括第一消息鉴别码、第二密钥衍生算法以及第三密钥衍生算法。其中，第二密钥衍生算法为存储功能实体接收到的终端支持的至少一个密钥衍生算法，且第二密钥衍生算法包括第三密钥衍生算法。第一消息鉴别码是根据第二密钥衍生算法生成的。终端根据第二密钥衍生算法生成第二消息鉴别码，若第一消息鉴别码与第二消息鉴别码相同，且第一密钥衍生算法与第二密钥衍生算法相同，则终端获取第三密钥衍生算法作为终端的密钥衍生算法。
本申请，终端对发送出去的第一密钥衍生算法与接收到的第二密钥衍生算法进行校验，当校验正确且第一密钥衍生算法与第二密钥衍生算法相同，则确定终端发送的 的第一密钥衍生算法没有被攻击者篡改。然后才将协商的第三密钥衍生算法，作为终端的密钥衍生算法。保证了协商的密钥衍生算法的保密性，从而提高通信的安全性。
在一种可能的设计中，第二密钥衍生算法携带于认证令牌的认证管理域AMF。
第二方面，本申请提供一种密钥衍生算法的协商方法，该方法可由存储功能实体或存储功能实体内的芯片执行。存储功能实体可以是归属签约用户服务器(Home Subscriber Server，HSS)、统一数据管理(Unified Data Management，UDM)实体、认证凭证存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)实体等。该方法包括：
存储功能实体接收第二密钥衍生算法，第二密钥衍生算法为存储功能实体接收到的终端支持的至少一个密钥衍生算法。存储功能实体根据预设策略，从第二密钥衍生算法中选择第三密钥衍生算法，以及，根据第二密钥衍生算法生成第一消息鉴别码。存储功能实体向终端发送认证令牌，认证令牌包括第一消息鉴别码、第三密钥衍生算法以及第二密钥衍生算法。
在一种可能的设计中，第二密钥衍生算法携带于认证令牌的认证管理域AMF。
第三方面，本申请提供一种密钥衍生算法的协商方法，该方法可由终端或终端内的芯片执行。该方法包括：若第一密钥衍生算法与第二密钥衍生算法不同，终端向移动管理功能实体发送第一消息，第一消息包含第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法，第二密钥衍生算法为移动管理功能实体或存储功能实体存储功能实体接收到的终端支持的至少一个密钥衍生算法。终端接收来自移动管理功能实体的第二消息，第二消息包括目标密钥衍生算法，其中，第一密钥衍生算法包括目标密钥衍生算法。终端将终端的密钥衍生算法更新为目标密钥衍生算法，并根据目标密钥衍生算法更新终端的密钥。
当第一密钥衍生算法与第二密钥衍生算法不同，则确定终端发送的第一密钥衍生算法被篡改，因此通过第一消息重新发送第一密钥衍生算法。此时，发送的第一消息由于不是初始消息，因此可以得到完整性保护，不会被攻击者攻击。因此，当终端接收到目标密钥衍生算法时，则不需要做校验，直接将终端的密钥衍生算法更新为该目标衍生算法。从而完成密钥衍生算法的协商，保证了协商的密钥衍生算法的保密性，从而提高通信的安全性。
在一种可能的设计中，目标密钥衍生算法包括来自存储功能实体的第一目标密钥衍生算法；终端根据目标密钥衍生算法，更新终端的密钥，包括：终端根据第一目标密钥衍生算法，更新终端的接入安全管理实体密钥。
该方法，终端还根据存储功能实体选择的第一目标密钥衍生算法，更新终端的密钥，如接入安全管理实体密钥，保证通信的安全性。
在一种可能的设计中，第二消息还包括来自存储功能实体的第一随机数；终端根据第一目标密钥衍生算法，更新终端的接入安全管理实体密钥，包括：终端根据第一目标密钥衍生算法和第一随机数，更新接入安全管理实体密钥。
在一种可能的设计中，目标密钥衍生算法包括来自移动管理功能实体的第二目标密钥衍生算法；终端根据目标密钥衍生算法，更新终端的密钥，包括：终端根据第二目标密钥衍生算法，更新用于终端和移动管理功能实体通信的第一密钥。
该方法，终端还根据移动管理功能实体选择的第二目标密钥衍生算法，更新终端 的密钥，如终端和移动管理功能实体通信的第一密钥，保证通信的安全性。
在一种可能的设计中，第二消息还包括来自移动管理功能实体的第二随机数；
终端根据第二目标密钥衍生算法，更新用于终端和移动管理功能实体通信的第一密钥，包括：终端根据第二目标密钥衍生算法和第二随机数，更新第一密钥。
在一种可能的设计中，还包括：终端接收来自移动管理功能实体的非接入层(Non-Access Stratum，NAS)安全模式完成(security mode completed，SMP)消息，NAS SMP消息包括第二密钥衍生算法。终端确定第一密钥衍生算法与第二密钥衍生算法不同。
在一种可能的设计中，第一消息为NAS SMP消息，第二消息为NAS安全模式命令(security mode comand，SMC)消息。当第一消息为NAS SMP消息时，该第一消息可受到完整性保护，因而可保证第一消息中的第一密钥衍生算法不被攻击者篡改，保证了通信的安全性。
第四方面，本申请提供一种密钥衍生算法的协商方法，该方法可由存储功能实体或存储功能实体内的芯片执行，或者由移动管理功能实体或移动管理功能实体内的芯片执行，其中，存储功能实体可以是HSS、UDM、ARPF，移动管理功能实体可以是移动管理实体(Mobility Management Entity，MME)、接入与移动管理功能(Access and Mobility Management Function，AMF)实体等。该方法包括：网络侧节点接收来自终端的第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。网络侧节点根据预设策略，从第一密钥衍生算法中选择目标密钥衍生算法。网络侧节点根据目标密钥衍生算法，更新网络侧节点中存储的密钥。网络侧节点向终端发送目标密钥衍生算法。
在一种可能的设计中，存储功能实体根据目标密钥衍生算法，更新网络侧节点中存储的密钥，包括：网络侧节点生成随机数。网络侧节点根据随机数和目标密钥衍生算法，更新网络侧节点中存储的密钥。以及，网络侧节点向终端发送随机数。
在一种可能的设计中，网络侧节点为移动管理功能实体，网络侧节点中存储的密钥为终端的接入安全管理实体密钥。或者，网络侧节点为存储功能实体，网络侧节点中存储的密钥为用于终端和移动管理功能实体通信的第一密钥。
在一种可能的设计中，网络侧节点为移动管理功能实体，在网络侧节点接收来自终端的第一密钥衍生算法之前，移动管理功能实体接收第二密钥衍生算法，第二密钥衍生算法为移动管理功能实体接收到的终端支持的至少一个密钥衍生算法。移动管理功能实体向终端发送非接入层NAS安全模式完成SMC消息，NAS SMC消息包括第二密钥衍生算法。
第五方面，本申请提供一种装置，该装置可以是终端，也可以是终端内的芯片。该装置具有实现上述第一方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，当该装置为终端时，终端包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是收发器，收发器包括射频电路，可选地，终端还包括存储单元，该存储单元例如可以是存储器。当终端包括存储单元时，该存储单元存储有计算机执行指令，该处理单元与该存储单元连接，该处理单元执行 该存储单元存储的计算机执行指令，以使该终端执行上述第一方面任意一项的密钥衍生算法的协商方法。
在另一种可能的设计中，当该装置为终端内的芯片时，芯片包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使上述第一方面任意一项的密钥衍生算法的协商方法被执行。可选地，存储单元为芯片内的存储单元，如寄存器、缓存等，存储单元还可以是终端内的位于芯片外部的存储单元，如只读存储器(read-only memory，ROM)、可存储静态信息和指令的其他类型的静态存储设备、随机存取存储器(random access memory，RAM)等。
其中，上述任一处提到的处理器，可以是一个通用的中央处理器(Central Processing Unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制执行上述第一方面的密钥衍生算法的协商方法的程序的集成电路。
第六方面，本申请提供一种装置，该装置可以是存储功能实体，也可以是存储功能实体内的芯片，其中，存储功能实体可以是HSS、UDM、ARPF等。该装置具有实现上述第二方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，当该装置为存储功能实体时，存储功能实体包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是收发器，收发器包括射频电路，可选地，存储功能实体还包括存储单元，该存储单元例如可以是存储器。当存储功能实体包括存储单元时，该存储单元存储有计算机执行指令，该处理单元与该存储单元连接，该处理单元执行该存储单元存储的计算机执行指令，以使该存储功能实体执行上述第二方面任意一项的密钥衍生算法的协商方法。
在另一种可能的设计中，当该装置为存储功能实体内的芯片时，芯片包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使上述第二方面任意一项的密钥衍生算法的协商方法被执行。可选地，存储单元为芯片内的存储单元，如寄存器、缓存等，存储单元还可以是存储功能实体内的位于芯片外部的存储单元，如ROM、可存储静态信息和指令的其他类型的静态存储设备、RAM等。
其中，上述任一处提到的处理器，可以是一个通用的CPU，微处理器，ASIC，或一个或多个用于控制执行上述第二方面的密钥衍生算法的协商方法的程序的集成电路。
第七方面，本申请提供一种装置，该装置可以是终端，也可以是终端内的芯片。该装置具有实现上述第三方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，当该装置为终端时，终端包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是收发器，收发器包括射频电路，可选地，终端还包括存储单元，该存储单元例如可以是存储器。当终端包括存储单元时，该存储单元存储有计算机执行指令，该处理单元与该存储单元连接，该处理单元执行该存储单元存储的计算机执行指令，以使该终端执行上述第三方面任意一项的密钥衍 生算法的协商方法。
在另一种可能的设计中，当该装置为终端内的芯片时，芯片包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使上述第三方面任意一项的密钥衍生算法的协商方法被执行。可选地，存储单元为芯片内的存储单元，如寄存器、缓存等，存储单元还可以是终端内的位于芯片外部的存储单元，如ROM、可存储静态信息和指令的其他类型的静态存储设备、RAM等。
其中，上述任一处提到的处理器，可以是一个通用的CPU，微处理器，ASIC，或一个或多个用于控制执行上述第三方面的密钥衍生算法的协商方法的程序的集成电路。
第八方面，本申请提供一种装置，该装置可以是存储功能实体，也可以是存储功能实体内的芯片，其中，存储功能实体可以是HSS、UDM、ARPF等。该装置具有实现上述第四方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的设计中，当该装置为存储功能实体时，存储功能实体包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是收发器，收发器包括射频电路，可选地，存储功能实体还包括存储单元，该存储单元例如可以是存储器。当存储功能实体包括存储单元时，该存储单元存储有计算机执行指令，该处理单元与该存储单元连接，该处理单元执行该存储单元存储的计算机执行指令，以使该存储功能实体执行上述第四方面任意一项的密钥衍生算法的协商方法。
在另一种可能的设计中，当该装置为存储功能实体内的芯片时，芯片包括：处理单元和通信单元，处理单元例如可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使上述第四方面任意一项的密钥衍生算法的协商方法被执行。可选地，存储单元为芯片内的存储单元，如寄存器、缓存等，存储单元还可以是存储功能实体内的位于芯片外部的存储单元，如ROM、可存储静态信息和指令的其他类型的静态存储设备、RAM等。
其中，上述任一处提到的处理器，可以是一个通用的CPU，微处理器，ASIC，或一个或多个用于控制执行上述第四方面的密钥衍生算法的协商方法的程序的集成电路。
第九方面，本申请提供一种密钥衍生算法的协商方法，该方法可由终端或终端内的芯片执行。该方法包括：终端向网络侧网元发送第一密钥衍生算法的第一标识信息，该第一密钥衍生算法为终端支持的至少一个密钥衍生算法，终端接收第二密钥衍生算法的第二标识信息，终端根据上层密钥、第一标识信息及第二密钥衍生算法，生成下层密钥。
本申请，终端向网络侧网元发送的是第一密钥衍生算法的第一标识信息，该第一密钥衍生算法有可能在发送过程中被篡改，终端接收到的是第二密钥衍生算法的第二标识信息，该第二密钥衍生算法可能是网络侧网元选择的密钥衍生算法，也可能是被篡改后的密钥衍生算法。进一步地，终端根据上层密钥、第一标识信息和第二密钥衍生算法生成下层密钥。由于在生成下层密钥时，使用到了第一密钥衍生算法的第一标识信息和第二密钥衍生算法，因此，如果第一密钥算法算法或第二密钥衍生算法被篡改，将导致终端生成的下层密钥，与网络侧网元生成的下层密钥不相同，导致通信失败。只有当第一密钥衍生算法和第二密钥衍生算法均没有被篡改时，才能实现正确通 信，从而提高了通信的安全性。
在一种可能的设计中，终端根据上层密钥、第一标识信息及第二密钥衍生算法，生成下层密钥，包括：终端根据上层密钥、第一标识信息、第二标识信息及第二密钥衍生算法，生成下层密钥。
上述方法，在生成下层密钥时，还可以将第二标识信息作为输入参数。
在一种可能的设计中，上层密钥为加密密钥CK、完整性密钥IK，下层密钥为安全锚点密钥Kseaf；终端根据上层密钥、第一标识信息及第二密钥衍生算法，生成下层密钥，包括：终端根据CK、IK、第一标识信息及第二密钥衍生算法，生成认证服务密钥Kausf；以及，根据Kausf及第二密钥衍生算法，生成Kseaf；或者，终端根据CK、IK及第二密钥衍生算法，生成Kausf；以及，根据Kausf、第一标识信息及第二密钥衍生算法，生成Kseaf。
上述方法，终端在生成下层密钥时，可在一次协商过程中同时生成Kausf和Kseaf，因而可提高协商的效率。
在一种可能的设计中，上层密钥为Kseaf，下层密钥为非接入层加密密钥KNASenc，非接入层完整性保护密钥KNASint，基站密钥KgNB，非3GPP接入密钥Kn3iwf中的至少一个；终端根据上层密钥、第一标识信息及第二密钥衍生算法，生成下层密钥，包括：终端根据Kseaf、第一标识信息及第二密钥衍生算法，生成接入管理密钥Kamf；以及，根据Kamf及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，终端根据Kseaf及第二密钥衍生算法，生成Kamf；以及，根据Kamf、第一标识信息及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
上述方法，终端在生成下层密钥时，可在一次协商过程中同时生成Kamf和KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，因而可提高协商的效率。
在一种可能的设计中，网络侧网元为移动性管理功能实体AMF，上层密钥为Kamf，下层密钥为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，
网络侧网元为安全锚点实体SEAF，上层密钥为Kseaf，下层密钥为Kamf；或者，
网络侧网元为认证服务实体AUSF，上层密钥为Kausf，下层密钥为Kseaf；或者，
网络侧网元为统一数据管理实体，上层密钥为CK、IK，下层密钥为CK’,IK’，Kausf中的至少一个；或者，
网络侧网元为下一代基站gNB，上层密钥为KgNB，下层密钥为无线连接控制加密密钥Krrc-enc，无线连接控制完整性保护密钥Krrc-int，用户面加密密钥Kup-enc，用户面完整性保护密钥Kup-int，下一跳NH中的至少一个；或者，
网络侧网元为移动性管理实体MME，上层密钥为接入管理密钥Kamse，下层密钥为KNASenc，KNASint中的至少一个；或者，
网络侧网元为归属签约用户服务器，上层密钥为CK、IK，下层密钥为Kasme；或者，
网络侧网元为eNB，上层密钥为KeNB，下层密钥为Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个。
第十方面，本申请提供一种密钥衍生算法的协商方法，该方法可由网络侧网元或网络侧网元内的芯片执行。该方法包括：网络侧网元接收第三密钥衍生算法的第三标 识信息，第三密钥衍生算法为网络侧网元接收到的终端支持的至少一个密钥衍生算法，网络侧网元根据预设策略从第三密钥衍生算法中选择第四密钥衍生算法，网络侧网元根据第三标识信息、第四密钥衍生算法和上层密钥生成下层密钥，网络侧网元向终端发送第四密钥衍生算法的第四标识信息。
本申请，网络侧网络接收到的是第三密钥衍生算法的第三标识信息，该第三密钥衍生算法有可能在终端发送过程中被篡改后的密钥衍生算法，网络侧网元从第三密钥衍生算法中选择一个第四密钥衍生算法作为协商的密钥衍生算法，然后发送给终端，该第四密钥衍生算法可能在发送过程中被篡改为其它密钥衍生算法。进一步地，网络侧网元根据上层密钥、第三标识信息和第四密钥衍生算法生成下层密钥。由于在生成下层密钥时，使用到了第三密钥衍生算法的第三标识信息和第四密钥衍生算法，因此，如果第三密钥算法算法或第四密钥衍生算法被篡改，将导致网络侧网元生成的下层密钥，与终端生成的下层密钥不相同，导致通信失败。只有当第三密钥衍生算法和第三密钥衍生算法均没有被篡改时，才能实现正确通信，从而提高了通信的安全性。
在一种可能的设计中，网络侧网元根据第三标识信息、第四密钥衍生算法和上层密钥，生成下层密钥，包括：网络侧网元根据上层密钥、第三标识信息、第四标识信息及第四密钥衍生算法，生成下层密钥。
在一种可能的设计中，网络侧网元为统一数据管理实体，上层密钥为CK、IK，下层密钥为Kausf；网络侧网元向认证服务实体发送第四标识信息和Kausf。
在一种可能的设计中，网络侧网元为安全锚点实体，上层密钥为Kseaf，下层密钥为Kamf；网络侧网元向移动性管理功能实体AMF发送第四标识信息和Kamf。
在一种可能的设计中，网络侧网元为移动性管理功能实体AMF，上层密钥为Kamf，下层密钥为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，
网络侧网元为安全锚点实体SEAF，上层密钥为Kseaf，下层密钥为Kamf；或者，
网络侧网元为认证服务实体AUSF，上层密钥为Kausf，下层密钥为Kseaf；或者，
网络侧网元为统一数据管理实体，上层密钥为CK、IK，下层密钥为CK’,IK’，Kausf中的至少一个；或者，
网络侧网元为下一代基站gNB，上层密钥为KgNB，下层密钥为无线连接控制加密密钥Krrc-enc，无线连接控制完整性保护密钥Krrc-int，用户面加密密钥Kup-enc，用户面完整性保护密钥Kup-int，下一跳NH中的至少一个；或者，
网络侧网元为移动性管理实体MME，上层密钥为接入管理密钥Kamse，下层密钥为KNASenc，KNASint中的至少一个；或者，
网络侧网元为归属签约用户服务器，上层密钥为CK、IK，下层密钥为Kasme；或者，
网络侧网元为eNB，上层密钥为KeNB，下层密钥为Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个。
第十一方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十二方面，本申请还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请适用的一种可能的网络架构示意图；
图2为本申请适用的另一种可能的网络架构示意图；
图3为本申请提供的一种密钥衍生算法示意图；
图4为本申请提供的应用管理域AMF的一种示意图；
图5为本申请提供的参数生成示意图；
图6为本申请提供的另一种密钥衍生算法的协商方法；
图7为本申请提供的另一种密钥衍生算法的协商方法；
图8为本申请提供的另一种密钥衍生算法的协商方法；
图9为本申请提供的另一种密钥衍生算法的协商方法；
图10为本申请提供的另一种密钥衍生算法的协商方法；
图11为本申请提供的另一种密钥衍生算法的协商方法；
图12为本申请提供的一种装置示意图；
图13为本申请提供的另一种装置示意图；
图14为本申请提供的另一种装置示意图；
图15为本申请提供的另一种装置示意图；
图16为本申请提供的另一种密钥衍生算法的协商方法；
图17(a)为本申请提供的另一种密钥衍生算法的协商方法；
图17(b)为本申请提供的另一种密钥衍生算法的协商方法；
图18为本申请提供的另一种装置示意图；
图19为本申请提供的另一种装置示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
需要说明的的是，本申请的密钥衍生算法的协商方法可由装置执行。在网络侧，该装置可以是存储功能实体或存储功能实体内的芯片，还可以是移动管理功能实体或移动管理功能实体内的芯片。存储功能实体可以用于存储终端的永久密钥，例如，存储功能实体可以是HSS、UDM实体、或ARPF实体等。移动管理功能实体可以用于管理终端的移动性，例如，移动管理功能实体可以是MME、或AMF实体等。在终端侧，该装置可以是终端或终端内的芯片。
为方便说明，本申请，以装置为存储功能实体、移动管理功能实体、终端为例，对申请的密钥衍生算法的协商方法进行说明，对于装置为存储功能实体内的芯片、移动管理功能实体内的芯片、终端内的芯片的实现方法，可参考存储功能实体、移动管理功能实体、终端的密钥衍生算法的协商方法的具体说明，不再重复介绍。
如图1所示，为本申请适用的一种可能的网络架构示意图。该网络架构为4G网络架构。该4G架构中的网元包括终端，图中以终端为用户设备(user equipment，UE)为例。网络架构还包括移动性管理实体(Mobility Management Entity，MME)、服务GPRS支持节点(Serving GPRS Support Node，SGSN)、归属签约用户服务器(Home  Subscriber Server，HSS)、服务网关(serving gateway，S-GW)、分组数据网络网关(Packet Data Network gateway，PDN gateway，P-GW)、策略与计费规则功能(Policy and Charging Rules Function，PCRF)实体、演进的通用陆基无线接入网(Evolved Universal Terrestrial Radio Access Network，E-TURAN)等。
E-UTRAN由多个演进的基站(Evolved NodeB，eNodeB)组成，eNodeB之间通过X2接口彼此互联，eNodeB与演进分组核心网(Evolved Packet Core，EPC)之间通过S1接口，而eNodeB与UE通过LTE-Uu互联。
MME的主要功能是支持非接入层(NAS)信令及其安全、跟踪区域(Track Area，TA)列表的管理、P-GW和S-GW的选择、跨MME切换时进行MME的选择、在向2G/3G接入系统切换过程中进行SGSN的选择、用户的鉴权、漫游控制以及承载管理、第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)不同接入网络的核心网络节点之间的移动性管理。
S-GW是终止于E-UTRAN接口的网关，其主要功能包括：进行基站间切换时，作为本地锚定点，并协助完成基站的重排序功能；在3GPP不同接入系统间切换时，作为移动性锚点；执行合法侦听功能；进行数据包的路由和前转；在上行和下行传输层进行分组标记；用于运营商间的计费等。
P-GW是面向PDN终结于SGi接口的网关，如果UE访问多个PDN，UE将对应一个或多个P-GW。P-GW的主要功能包括基于用户的包过滤功能、合法侦听功能、UE的网络之间互连的协议(Internet Protocol，IP)地址分配功能、在上行链路中进行数据包传送级标记、进行上下行服务等级计费以及服务水平门限的控制、进行基于业务的上下行速率的控制等。
HSS是用于存储用户签约信息的数据库，归属网络中可以包含一个或多个HSS。HSS负责保存跟用户相关的信息，例如用户标识、编号和路由信息、安全信息、位置信息、概要(Profile)信息等。
SGSN可以用于2G/3G和E-UTRAN 3GPP接入网间移动时，进行信令交互，包括对P-GW和S-GW的选择，同时为切换到E-UTRAN 3GPP接入网的用户进行MME的选择。
PCRF实体终结于Rx接口和Gx接口，非漫游场景时，在本地公用陆地移动网络(Home Public Land Mobile Network，HPLMN)中只有一个PCRF跟UE的一个IP连通性接入网络(IP-Connectivity Access Network)，IP-CAN会话相关；在漫游场景并且业务流是本地疏导时，可能会有两个PCRF跟一个UE的IP-CAN会话相关。
其中，图1所示的架构中，与本申请有关的网元主要是：UE、MME、HSS。
如图2所示，为本申请适用的另一种可能的网络架构示意图。该网络架构为5G网络架构。该5G架构中的网元包括终端，图中以终端为UE为例。网络架构还包括无线接入网(Radio Access Network，RAN)、接入与移动管理功能(Access and Mobility Management Function，AMF)实体、会话管理功能(session management function，SMF)实体、用户面功能(user plane function，UPF)实体、统一数据管理(Unified Data Management，UDM)实体、鉴权服务功能(Authentication Server Function，AUSF)实体、认证凭证存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)实体(图中未示出)、安全锚点功能(Security Anchor Function，SEAF) 实体(图中未示出)、数据网络(Data Network，DN)等。
RAN的主要功能是控制用户通过无线接入到移动通信网络。RAN是移动通信系统的一部分。它实现了一种无线接入技术。从概念上讲，它驻留某个设备之间(如移动电话、一台计算机，或任何远程控制机)，并提供与其核心网的连接。RAN设备包括但不限于：5G中的(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(BaseBand Unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等，此外，还可以包括无线保真(wireless fidelity，wifi)接入点(access point，AP)等。
AMF实体负责终端的接入管理和移动性管理，在实际应用中，其包括了LTE中网络框架中移动管理实体(mobility management entity，MME)里的移动性管理功能，并加入了接入管理功能。
SMF实体负责会话管理，如用户的会话建立等。
UPF实体是用户面的功能网元，主要负责连接外部网络，其包括了LTE的服务网关(serving gateway，SGW)和公用数据网网关(public data network GateWay，PDN-GW)的相关功能。
DN负责为终端提供服务的网络，如一些DN为终端提供上网功能，另一些DN为终端提供短信功能等等。SEAF实体用于完成对UE的认证过程，在5G中，SEAF的功能可以合并到AMF实体中。
AUSF实体具有鉴权服务功能，用于终结SEAF请求的认证功能。
AMF实体负责终端的接入管理和移动性管理，在实际应用中，其包括了长期演进(Long term evolution，LTE)中MME的移动性管理功能，并加入了接入管理功能。
ARPF实体具有认证凭证存储和处理功能，用于存储用户的长期认证凭证，如永久密钥K等。在5G中，ARPF的功能可以合并到UDM实体中。
UDM实体可存储用户的签约信息，实现类似于4G中的HSS的后端。
其中，图2所示的架构中，与本申请有关的网元主要是：UE、AMF实体、HSS实体、SEAF实体、AUSF实体及ARPF实体。
本申请中的终端，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。例如图1中的UE和图2中的UE，为终端的一个具体示例。
本申请既适用于图1所示的4G网络架构，也适用于图2所示的5G网络架构。
为方便说明，本申请将4G中的MME，5G中的AMF实体，统称为移动管理功能 实体。将4G中的HSS，5G中的APRF实体，UDM实体统称为存储功能实体。以及，将移动管理功能实体和存储功能实体，统称为网络侧节点。
下面结合附图对本申请的密钥衍生算法的协商方法进行说明。
如图3所示，为本申请提供的一种密钥衍生算法示意图，包括以下步骤：
步骤301、终端向存储功能实体发送第一密钥衍生算法，存储功能实体接收到第二密钥衍生算法。
其中，第一密钥衍生算法可用于表示终端的密钥衍生算法能力，即第一密钥衍生算法为终端支持的密钥衍生算法。例如，终端支持的密钥衍生算法为KDF1、KDF2、KDF3，则第一密钥衍生算法为{KDF1、KDF2、KDF3}。
在具体实现中，终端发送的第一密钥衍生算法可以是终端支持的密钥衍生算法的标识，例如，当终端支持的密钥衍生算法为KDF1、KDF2、KDF3时，则终端发送的第一密钥衍生算法为{KDF1的标识、KDF2的标识、KDF3的标识}。
本申请，存储功能实体和移动性管理功能实体接收到的终端发送的密钥衍生算法，称为第二密钥衍生算法。
在具体实现中，第二密钥衍生算法可以是终端支持的密钥衍生算法的标识。
终端向存储功能实体发送第一密钥衍生算法的具体方法，例如可以为：
在4G中，终端先向MME发送附着(Attach)请求(request)消息或跟踪区域更新(track area update，TAU)请求(request)消息，请求消息中包含UE支持的KDF，MME向HSS发送认证数据请求(Authentication Data Request)消息，消息中包含第二密钥衍生算法。
在5G中，终端先向AMF实体或SEAF实体发送注册请求(Registration Request)消息，注册请求消息中包含第一密钥衍生算法。AMF实体或SEAF实体向AUSF实体发送认证启动请求(Authentication Initiation Request)消息，该认证启动请求消息中包含第一密钥衍生算法，AUSF实体向ARPF实体或UDM实体发送认证信息请求(Authentication Information request)消息，该认证信息请求消息中包含第二密钥衍生算法。
由于终端发送的携带第一密钥衍生算法的初始消息，如4G的附着请求消息、跟踪区域更新请求消息，或5G的注册请求消息，没有得到完整性保护，因此比较容易受到攻击者的攻击，攻击者有可能将该初始消息中的第一密钥衍生算法篡改，即第二密钥衍生算法为篡改后的密钥衍生算法，此时，第二密钥衍生算法可能与第一密钥衍生算法不同。
或者是，终端发送的第一密钥衍生算法没有被攻击者攻击，则存储功能实体接收到的第二密钥衍生算法，与终端发送的第一密钥衍生算法相同。
因此，存储功能实体接收到的第二密钥衍生算法可能与终端发送的第一密钥衍生算法相同，也有可能不同。
步骤302、存储功能实体根据预设策略，从接收到的第二密钥衍生算法中，选择第三密钥衍生算法。
第二密钥衍生算法为存储功能实体接收到的终端支持的至少一个密钥衍生算法。
当存储功能实体接收到第二密钥衍生算法之后，则根据预先设定的策略，从第二密钥衍生算法中选择一个第三密钥衍生算法，作为协商的终端与存储功能实体之间通 信的密钥衍生算法。
在具体实现中，第三密钥衍生算法可以用第三密钥衍生算法的标识来表示。
其中，预设策略可以是优先级策略，即选择优先级最高的密钥衍生算法；或者是，使用次数策略，即选择使用次数最多的密钥衍生算法；还可以是其它策略，本申请不做限制。
为方便说明，后续以优先级策略为例进行说明。
例如，第一密钥衍生算法为{KDF1、KDF2、KDF3}，其中，KDF1的优先级<KDF2的优先级<KDF3的优先级。若第一密钥衍生算法没有被攻击篡改，则存储功能实体收到的第二密钥衍生算法与第一密钥衍生算法相同，也为{KDF1、KDF2、KDF3}，则存储功能实体从第二密钥衍生算法中选择的第三密钥衍生算法为KDF3。
再比如，第一密钥衍生算法为{KDF1、KDF2、KDF3}，其中，KDF1的优先级<KDF2的优先级<KDF3的优先级。若第一密钥衍生算法被攻击篡改，(一般会修改为只包含优先级最低的密钥衍生算法，从而方便破解密钥)，例如，存储功能实体收到的第二密钥衍生算法为{KDF1}，则存储功能实体从第二密钥衍生算法中选择的第三密钥衍生算法为KDF1。
步骤303、存储功能实体向终端发送认证令牌，终端接收来自存储功能实体的认证令牌(Authentication Token，AUTN)。
存储功能实体在选择了第三密钥衍生算法之后，需要将第三密钥衍生算法发送给终端，本申请，在存储功能实体发送第三密钥衍生算法的过程中，还将存储功能实体接收到的第二密钥衍生算法发送至终端，以便终端校验终端发送的第一密钥衍生算法是否被篡改。
本申请，认证令牌中包括第一消息鉴别码(Message Authentication Code,MAC)、第二密钥衍生算法以及选择的第三密钥衍生算法，并且，第一消息鉴别码是根据第二密钥衍生算法生成。
下面结合附图，给出几种AUTN的实现方法。
实现方法一、AUTN包括认证管理域(Authentication Management Field,AMF)和MAC，AMF中包括第二密钥衍生算法和第三密钥衍生算法，MAC为第一消息鉴别码。
作为一种实现方式，例如应用管理域AMF由8个比特位构成，终端最多支持4个算法，例如分别为KDF1，KDF2，KDF3，KDF4。使用AMF中的两位表示选择的第三密钥衍生算法，AMF中的四位用于表示接收到的第二密钥衍生算法。
例如，参考图4，为AMF的一种示例图。其中，第0位和第1位用于表示选择的第三密钥衍生算法，例如为“00”时，表示第三密钥衍生算法为KDF1，“01”时，表示第三密钥衍生算法为KDF2，“10”时，表示第三密钥衍生算法为KDF3，“11”时，表示第三密钥衍生算法为KDF4。第2位至第5位分别用于表示是否接收到KDF1、KDF2、KDF3、KDF4，，其中，“1”表示接收到，“0”表示未接收到。例如，第2至第5位为“0000”时，表示接收到的第二密钥衍生算法为空；第2至第5位为“0100”时，表示接收到的第二密钥衍生算法为KDF2；第2至第5位为“1110”时，表示接收到的第二密钥衍生算法为KDF1、KDF2、KDF3。
当然，图4只是作为一种示例进行说明，例如，还可以使用其他位表示第二密钥衍生算法和第三密钥衍生算法，本申请不做限制。或者，当AMF不是8位时，其使 用方法也类似。
下面结合附图，给出一种生成AUTN的具体实现方式，如图5所示，为参数生成示意图。
参见图5，存储功能实体生成序列号(Sequence Number,SQN)和随机数(RAND)，然后分别生成MAC(即第一消息鉴别码)、期望响应(Expected Response，XRES)、加密密钥(Cipher Key，CK)、完整性密钥(integrity key，IK)、匿名密钥(Anonymity Key，AK)。
MAC＝f1(K，AMF，SQN，RAND)，其中，应用管理域AMF的格式如图4所示，AMF包括第二密钥衍生算法和第三密钥衍生算法；
XRES＝f2(K，RAND)；
CK＝f3(K，RAND)；
IK＝f4(K，RAND)；
AK＝f5(K，RAND)。
其中，f1、f2、f3、f4、f5表示函数，终端也存储有相同的函数。
然后根据以上参数生成AUTN和认证向量(Authentication Vector,AV)，具体地：
Figure PCTCN2018100848-appb-000001
AV:＝RAND||XRES||CK||IK||AUTN。
AUTN包括
Figure PCTCN2018100848-appb-000002
AMF和MAC，其中
Figure PCTCN2018100848-appb-000003
为与或符号，表示SQN和AK进行与或运算的结果，“||”为连接符号，例如00||11，即为0011。因而AUTN中包括MAC(第一消息鉴别码)、第二密钥衍生算法和第三密钥衍生算法，其中，第二密钥衍生算法和第三密钥衍生算法携带于认证管理域AMF中。
可选的，作为一种实现方式，还可以将AUTN携带于AV中发送至终端，其中，AV包括RAND、XRES、CK、IK、AUTN。
从而，实现了将第二密钥衍生算法、第三密钥衍生算法、第一消息鉴别码以及其他可能需要用到的参数发送至终端。
实现方法二、AUTN包括认证管理域AMF、第二密钥衍生算法和MAC，AMF中包括第三密钥衍生算法，MAC为第一消息鉴别码
具体地，作为一种实现方式，例如：
AUTN:＝第二密钥衍生算法
Figure PCTCN2018100848-appb-000004
MAC＝f1(K，AMF，SQN，RAND,第二密钥衍生算法)。
其中，针对ATUN，该实现方法二与上述实现方法一的主要区别在于：第一，实现方法一中是将第二密钥衍生算法携带于AMF，实现方法二是将第二密钥衍生算法携带于AUTN，由于AMF的比特位是有限制的，因此将第二密钥衍生算法移至AMF之外，使得当终端支持的密钥衍生算法的种类比较多时，本申请方法仍然适用。例如，假设AMF为8位，若按照上述实现方法一，则当终端支持的密钥衍生算法超过5种时，则上述实现方法一无法实施。而按照实现方法二，终端支持的密钥衍生算法最多可达到2 8种。
针对MAC，生成MAC时还需要将第二密钥衍生算法作为输入参数。
使用上述实现方法一或实现方法二，生成AUTN之后，则将AUTN发送至终端，该AUTN的发送是受到完整性保护算法的保护的，不会被攻击者篡改。
可选的，AUTN是携带于AV中发送至终端的。
作为一种实现方式，在4G中，存储功能实体向终端发送AUTN的方法为：
HSS实体向MME发送认证数据响应(Authenticaition Data Response)消息，消息中包含AUTN，MME向终端发送用户认证请求(User Authentication Request)消息，消息中包含AUTN。
作为一种实现方式，在5G中，存储功能实体向终端发送AUTN的方法为：
UDM实体或ARPF实体向AUSF实体发送认证信息应答(Authenticaition Information Response)消息，消息中包含AUTN，AUSF实体向SEAF或AMF实体实体发送初始化认证响应(Authentication Initiation Answer)消息，消息中包含AUTN，SEAF实体或AMF实体向终端发送认证请求(Authenticaition Request)消息，消息中包含AUTN。
步骤304、终端根据认证令牌中的第二密钥衍生算法，生成第二消息鉴别码。
当终端接收到认证令牌后，可从中获取第一消息鉴别码、第二密钥衍生算法和第三密钥衍生算法。
然后，终端根据第二密钥衍生算法，生成第二消息鉴别码，生成方法与存储功能实体生成第一消息鉴别码的方法相同。例如，与上述存储功能实体发送AUTN的两种具体实现方法相对应地，则生成第二消息鉴别码的方法有以下两种：
方法一、对应于上述实现方法一
当第一消息鉴别码(MAC)＝f1(K，AMF，SQN，RAND)，其中，AMF中包括第二密钥衍生算法和第三密钥衍生算法，
Figure PCTCN2018100848-appb-000005
AV:＝RAND||XRES||CK||IK||AUTN，则终端生成第二消息鉴别码的方法为：
第二消息鉴别码(MAC1)＝f1(K，AMF，SQN，RAND)，其中的K是存储在终端的，AMF是从AUTN中获取的，RAND是从AV中获取的，然后根据K可以推衍出AK，根据AK和
Figure PCTCN2018100848-appb-000006
可获取SQN。
方法二、对应于上述实现方法二
当第一消息鉴别码(MAC)＝f1(K，AMF，SQN，RAND，第二密钥衍生算法)，其中，AMF中包括第三密钥衍生算法，AUTN:＝第二密钥衍生算法
Figure PCTCN2018100848-appb-000007
AK||AMF||MAC，AV:＝RAND||XRES||CK||IK||AUTN，则终端生成第二消息鉴别码的方法为：
第二消息鉴别码(MAC1)＝f1(K，AMF，SQN，RAND，第二密钥衍生算法)，其中的K是存储在终端的，AMF是从AUTN中获取的，RAND是从AV中获取的，然后根据K可以推衍出AK，根据AK和
Figure PCTCN2018100848-appb-000008
可获取SQN，第二密钥衍生算法是从AUTN中获取的。
步骤305、终端若确定第二消息鉴别码与认证令牌中的第一消息鉴别码相同，且确定第一密钥衍生算法与第二密钥衍生算法相同，则获取认证令牌中的第三密钥衍生算法，作为终端密钥衍生算法。
终端对比第一密钥衍生算法和第二密钥衍生算法，如果确定第一密钥衍生算法与第二密钥衍生算法相同，则终端使用生成的第二消息鉴别码对接收到的第一消息鉴别码进行校验，下面结合具体的例子，说明如何校验消息鉴别码。
假设第一密钥衍生算法为{KDF1、KDF2、KDF3}，且KDF1的优先级<KDF2的 优先级<KDF3的优先级。并且，以上述发送AUTN的实现方法二和生成第二消息鉴别码的方法二为例。
例1，第二密钥衍生算法为{KDF1}
第一消息鉴别码(MAC)＝f1(K，AMF，SQN，RAND，KDF1)，
Figure PCTCN2018100848-appb-000009
终端生成的第二消息鉴别码(MAC1)＝f1(K，AMF，SQN，RAND，KDF1)。
终端校验MAC与MAC1是否相同，如果相同，则MAC校验正确，校验正确则表明生成第一消息鉴别码的参数与生成第二消息鉴别码的参数相同，即这些参数没有被篡改。如果校验不正确，原因可能是上述参数被篡改，则可以按照现有技术方法继续后续操作，例如可以是：终端发送错误指示消息给存储功能实体，错误指示消息可以是认证失败(Authentication Failure)消息。
假设校验MAC1＝MAC，则校验正确，接着比较从AUTN获取的第二密钥衍生算法与终端自己的第一密钥衍生算法是否相同，由于第二密钥衍生算法为{KDF1}，第一密钥衍生算法为{KDF1、KDF2、KDF3}，因此不同，则终端确定发送的第一密钥衍生算法被篡改，则不使用第三密钥衍生算法，而是使用默认的密钥衍生算法，生成终端的密钥，如接入安全管理实体密钥(Key Access Security Management Entity，Kasme)等。以及，还需要发起重新协商的流程，并在新的流程中更新终端、存储功能实体的密钥，后续会详细说明如何更新。
例2，第二密钥衍生算法为{KDF1、KDF2、KDF3}
第一消息鉴别码(MAC)＝f1(K，AMF，SQN，RAND，{KDF1、KDF2、KDF3})，
Figure PCTCN2018100848-appb-000010
终端生成的第二消息鉴别码(MAC1)＝f1(K，AMF，SQN，RAND，{KDF1、
KDF2、KDF3})。
假设MAC1＝MAC，且由于第一密钥衍生算法为{KDF1、KDF2、KDF3},第二密钥衍生算法为{KDF1、KDF2、KDF3}，因此，校验MAC正确，且第一密钥衍生算法与第二密钥衍生算法相同，则终端获取第三密钥衍生算法作为终端密钥衍生算法，并根据该第三密钥衍生算法，生成终端的密钥，如Kasme等，流程结束。
上述密钥衍生算法的协商方法，终端对发送出去的第一密钥衍生算法与接收到的第二密钥衍生算法进行校验，当校验正确且第一密钥衍生算法与第二密钥衍生算法相同，则确定终端发送的的第一密钥衍生算法没有被攻击者篡改，然后才将协商的第三密钥衍生算法，作为终端的密钥衍生算法，保证了协商的密钥衍生算法的保密性，从而提高通信的安全性。
如图6所示，本申请还提供另外一种密钥衍生算法的协商方法，该方法用于终端与存储功能实体之间协商密钥衍生算法，包括以下步骤：
步骤601、终端向移动管理功能实体发送请求消息，移动管理功能实体接收来自终端的请求消息。
该请求消息可以是4G中的附着请求消息或跟踪区域更新请求消息，或为5G中的注册请求消息。
其中，该请求消息包括第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。
终端发送的是第一密钥衍生算法，移动管理功能实体接收的是第二密钥衍生算法，第二密钥衍生算法为移动管理功能实体接收到的终端支持的至少一个密钥衍生算法。
第二密钥衍生算法可能与第一密钥衍生算法相同，也有可能不同，例如当被攻击者篡改时，第二密钥衍生算法则与第一密钥衍生算法不同。
步骤602、移动管理功能实体向存储功能实体发送第二密钥衍生算法，存储功能实体接收来自移动管理功能实体的第二密钥衍生算法。
例如，在4G中，第二密钥衍生算法可以携带于认证数据请求(Authentication Data Request)消息，在5G中，第二密钥衍生算法可以携带于认证信息请求(Authentication Information request)消息。
步骤603、存储功能实体从第二密钥衍生算法中选择第三密钥衍生算法。
存储功能实体根据第二密钥衍生算法，以及自身预配置的算法优先级列表，选择一个优先级最高的密钥衍生算法，即第三密钥衍生算法，作为终端与存储功能实体之间协商的密钥衍生算法。
可选地，存储功能实体可以将第三密钥衍生算法携带于认证管理域AMF的部分bit位，具体可参考前述描述。
步骤604、存储功能实体向移动管理功能实体发送AUTN，移动管理功能实体接收来自存储功能实体的AUTN。
其中，AUTN包括AMF和MAC，AMF中的部分bit位用于设置表示第三密钥衍生算法。该MAC是由存储功能实体根据AMF、K、RAND、SQN生成，由于该AMF中不包括第二密钥衍生算法，因此该实施例中，MAC不是根据第二密钥衍生算法生成的，即，MAC中不包括第二密钥衍生算法。
步骤605、移动管理功能实体向终端发送AUTN，终端接收来自移动管理功能实体的AUTN。
上述步骤604和步骤605中，存储功能实体向移动管理功能实体发送AUTN，移动管理功能实体向终端发送AUTN的具体实现方式，例如可以是：
作为一种实现方式，在4G中，HSS实体向MME发送认证数据响应(Authenticaition Data Response)消息，消息中包含AUTN，MME向终端发送用户认证请求(User Authentication Request)消息，该消息中包含AUTN。
作为一种实现方式，在5G中，UDM实体或ARPF实体向AUSF实体发送认证信息应答(Authenticaition Information Response，AV-Resp)消息，消息中包含AUTN，AUSF实体向SEAF实体或AMF实体发送初始化认证响应(Authentication Initiation Answer)消息，消息中包含AUTN，SEAF实体或AMF实体向终端发送认证请求(Authenticaition Request，Auth-Req)消息，消息中包含AUTN。
步骤606、终端获取第三密钥衍生算法。
具体地，终端从接收到的AUTN中获取MAC、AMF。
首先对MAC进行校验，具体地，终端根据K、AMF、RAND、SQN生成MAC1，然后与从AUTN中获取的MAC比较，若相同，则校验正确。
如果校验正确，则终端获取AMF中的第三密钥衍生算法，作为终端与存储功能实体之间协商的密钥衍生算法。
步骤607、终端向存储功能实体发送响应消息，存储功能实体接收来自终端的响 应消息。例如，该响应消息可以是认证响应消息，用于通知存储功能实体协商失败还是成功。
通过上述步骤601～步骤607，完成了终端与存储功能实体之间的密钥衍生算法的协商过程，但上述过程没有判断终端发送的第一密钥衍生算法是否被篡改。下面举例说明。
例如，第一密钥衍生算法为{KDF1、KDF2、KDF3}，且KDF1的优先级<KDF2的优先级<KDF3的优先级。若上述步骤601中携带的第一密钥衍生算法被攻击者篡改为KDF1，即第二密钥衍生算法为{KDF1}，则上述步骤603中选择的第三密钥衍生算法为KDF1，然后终端在步骤606中获取的第三密钥衍生算法为KDF1。因而，上述步骤601～步骤607的过程，只能完成密钥衍生算法的协商，但还不能判断第一密钥衍生算法是否被攻击者篡改。
因此，在步骤607之后，进一步还包括以下步骤，用于判断是否受到攻击。
步骤608、移动管理功能实体向终端发送NAS SMC消息，终端接收来自移动管理功能实体的NAS SMC消息。
该NAS SMC消息中包括第二密钥衍生算法，由于该NAS SMC消息是受到完整性保护算法的保护的，因此，该NAS SMC消息中的内容不会被篡改。
步骤609、终端获取第二密钥衍生算法，并校验该第二密钥衍生算法。
具体地，终端将第一密钥衍生算法与第二密钥衍生算法进行比较，如果一样，则校验正确，如果不一样，则校验不正确。
步骤610、终端向移动管理功能实体发送NAS SMP消息，移动管理功能实体接收来自终端的NAS SMP消息。
其中，如果步骤609中，第二密钥衍生算法校验正确，则该NAS SMP消息用于通知校验完成。流程结束。
如果步骤609中，第二密钥衍生算法校验不正确，则该NAS SMP消息中可以重新携带步骤601中的请求消息，请求消息包括第一密钥衍生算法，重新发起协商过程。重新协商的具体过程，后续会详细说明。
需要说明的是，由于该NAS SMP消息是受到完整性保护的，因此不会被攻击者篡改，即在步骤610中发送的第一密钥衍生算法，移动管理功能实体和存储功能实体接收到的也是第一密钥衍生算法，或者，也可以理解为，移动管理功能实体和存储功能实体接收到的第二密钥衍生算法，与第一密钥衍生算法相同。
上述实施例，终端和存储功能实体之间协商密钥衍生算法时，首先通过步骤601～步骤607，完成密钥衍生算法的协商，然后通过步骤608～步骤609对第二密钥衍生算法进行校验，若校验正确，则确定未受到攻击，因此协商的第三密钥衍生算法可以作为终端的密钥衍生算法；若校验失败，则通过步骤610重新发起密钥衍生算法的协商过程。
上述实施例介绍了终端和存储功能实体之间协商密钥衍生算法的过程，如图7所示，为本申请实施例提供的终端和移动管理功能实体之间协商密钥衍生算法的示意图，该实施例为一种具体实现方法，其中的消息的名称，在实际使用中，也可以称为其它名称，本申请不做限定。
步骤701、终端向移动管理功能实体发送请求消息，移动管理功能实体接收来自 终端的请求消息。
该请求消息可以是4G中的附着请求消息或跟踪区域更新请求消息，或为5G中的注册请求消息。
该请求消息中包括第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法，第一密钥衍生算法也称为终端支持的密钥衍生算法能力。
终端发送的是第一密钥衍生算法，移动管理功能实体接收的是第二密钥衍生算法，第二密钥衍生算法为移动管理功能实体接收到的终端支持的至少一个密钥衍生算法。
第二密钥衍生算法可能与第一密钥衍生算法相同，也有可能不同，例如当被攻击者篡改时，第二密钥衍生算法则与第一密钥衍生算法不同。具体说明可参考上述实施例的步骤301中的相关描述，不再赘述。
步骤702、移动管理功能实体从第二密钥衍生算法中选择第四密钥衍生算法。
选择的第四密钥衍生算法作为终端与移动管理功能实体之间协商的密钥衍生算法。例如，移动管理功能实体根据第二密钥衍生算法以及自身预配置的算法优先级列表，选择一个优先级最高的密钥衍生算法，作为第四密钥衍生算法。
该第四密钥衍生算法在具体实现中，可以是第四密钥衍生算法的标识。
进一步地，移动管理功能实体还根据NAS完整性保护密钥，对NAS SMC消息进行完整性保护，生成NAS-MAC。NAS SMC消息中包含第四密钥衍生算法、第二密钥衍生算法，和NAS-MAC等。
步骤703、移动管理功能实体向终端发送NAS SMC消息，终端接收来自移动管理功能实体的NAS SMC消息。
步骤704、终端校验接收到的NAS-MAC。
终端接收到NAS SMC消息后，根据NAS完整性保护密钥，校验NAS-MAC，确定消息是否被篡改。
如果确定消息没有被篡改，则执行步骤705，否则，按照现有技术执行，例如重新发起校验过程。
步骤705、终端校验第二密钥衍生算法。
终端校验第二密钥衍生与第一密钥衍生算法是否相同，若相同，表明终端向移动管理功能实体发送的第一密钥衍生算法没有被篡改，并将第四密钥衍生算法，作为终端与移动管理功能实体之间的密钥衍生算法的协商结果；若不相同，表明终端向移动管理功能实体发送的第一密钥衍生算法被篡改。
步骤706、终端向移动管理功能实体发送NAS SMP消息，移动管理功能实体接收来自终端的NAS SMP消息。
NAS SMP消息用于告知算法协商结果，若成功，则在该NAS SMP消息告知终端与移动管理功能实体之间的密钥衍生算法协商完成,并激活了NAS层的安全。若失败，则可以通过该NAS SMP消息发起重新协商的过程，后续会详细说明。
可选地，还包括终端与基站之间协商密钥衍生算法的过程，包括以下步骤708～步骤711。
步骤707、移动管理功能实体向基站发送初始化终端消息(Initial UE message)，基站接收来自移动管理功能实体的初始化终端消息。
该初始化终端消息中包括第二密钥衍生算法。
步骤708、基站选择第五密钥衍生算法。
基站根据步骤707接收到的第二密钥衍生算法，以及自身预配置的算法优先级列表，从第二密钥衍生算法中选择一个优先级最高的密钥衍生算法，即第五密钥衍生算法，作为终端与基站之间协商的密钥衍生算法。
接着，基站根据接入层(AS)完整性保护密钥，对AS SMC消息进行完保，生成AS-MAC。
步骤709、基站向终端发送AS SMC消息，终端接收来自基站的AS SMC消息。
AS SMC消息包括AS-MAC和第五密钥衍生算法。
步骤710、终端校验AS-MAC。
终端根据AS完整性保护密钥，校验AS-MAC，确定消息是否被篡改。若确定消息未被篡改，则将第五密钥衍生算法作为终端与基站之间协商的密钥衍生算法。
步骤711、终端向基站发送AS SMP消息，基站接收来自终端的AS SMP消息。
AS SMP消息用于告知算法协商结果，若成功，则在该AS SMP消息告知终端与基站之间的密钥衍生算法协商完成,并激活了AS层的安全。若失败，告知终端与基站之间的密钥衍生算法协商失败。
上述实施例，终端对发送出去的第一密钥衍生算法与接收到的第二密钥衍生算法进行校验，当校验正确且第一密钥衍生算法与第二密钥衍生算法相同，则确定终端发送的的第一密钥衍生算法没有被攻击者篡改，然后才将终端与移动管理功能实体之间协商的第四密钥衍生算法作为终端的密钥衍生算法，以及，将终端与基站之间协商的第五密钥衍生算法作为终端的密钥衍生算法，保证了协商的密钥衍生算法的保密性，从而提高通信的安全性。
上述实施例，介绍了终端与存储功能实体之间协商密钥衍生算法的方法，及终端与移动管理功能实体之间协商密钥衍生算法的方法。
下面介绍另外几种密钥衍生算法的协商方法，用于上述实施例中密钥衍生算法协商失败后的处理。
例如，图3所示的实施例中，终端与存储功能实体之间协议密钥衍生算法。在步骤304中生成第二消息鉴别码之后，终端确定第一消息鉴别码与第二消息鉴别码相同，但第一密钥衍生算法与第二密钥衍生算法不同，则不将第三密钥衍生算法作为终端的密钥衍生算法，而是选择默认的密钥衍生算法作为终端的密钥衍生算法，并根据默认的密钥衍生算法，推衍密钥，当然，作为另一种实现方式，也可以先将第三密钥衍生算法作为终端的密钥衍生算法，根据该第三密钥衍生算法推衍密钥。进一步地，再发起重新协商密钥衍生算法的流程，或者终端与当前无线接入网络断开重新接入，本申请以发起重新协商密钥衍生算法为例进行说明。
再比如，图6所示的实施例中，终端与存储功能实体之间协议密钥衍生算法。在步骤609中，终端校验第一密钥衍生算法与第二密钥衍生算法不同，则可以在步骤610发送的NAS SMP中携带步骤601中发送的请求消息，请求消息包括第一密钥衍生算法，重新发起重新协商密钥衍生算法的流程，或者终端与当前无线接入网络断开重新接入，本申请以发起重新协商密钥衍生算法为例进行说明。
再比如，图7所示的实施例中，终端与移动管理功能实体之间协议密钥衍生算法。在步骤705中，校验NAS-MAC正确，但校验第二密钥衍生算法与第一密钥衍生算法 不同，则不将第四密钥衍生算法作为终端与移动管理功能实体之间的密钥衍生算法，而是选择默认的密钥衍生算法作为终端与移动管理功能实体之间的密钥衍生算法，当然，作为另一种实现方式，也可以先将第四密钥衍生算法作为终端的密钥衍生算法，根据该第四密钥衍生算法推衍密钥。进一步地，在步骤711发送的AS SMP中携带步骤701中发送的请求消息，请求消息包括第一密钥衍生算法，重新发起重新协商密钥衍生算法的流程，或者终端与当前无线接入网络断开重新接入，本申请以发起重新协商密钥衍生算法为例进行说明。
下面分三种情形，对密钥衍生算法的重新协商过程进行具体说明。
情形一、终端与移动管理功能实体之间的密钥衍生算法的重新协商
参考图8，为本申请实施例提供的密钥衍生算法的协商方法，用于终端与移动管理功能实体之间重新协商密钥衍生算法，图8所示的流程可以是在图7所示的流程的步骤706之后完成，即在图7的步骤706之后，还包括以下步骤：
步骤801、终端向移动管理功能实体发送第一消息，移动管理功能实体接收来自终端的第一消息。
该步骤801可以是上述步骤706，即该第一消息可以是NAS SMP消息，其中携带第一密钥衍生算法。
需要说明的是，该第一消息是受到完整性保护算法保护的，因此其中携带的第一密钥衍生算法不会被攻击者篡改，因此，移动管理功能实体接收到的也是第一密钥衍生算法。
步骤802、移动管理功能实体从第一密钥衍生算法中选择第二目标密钥衍生算法。
选择第二目标密钥衍生算法的方法参考前述从第二密钥衍生算法中选择第三密钥衍生算法的方法，不再赘述。
步骤803、移动管理实体根据第二目标密钥衍生算法，更新移动管理功能实体中存储的第一密钥。
作为一种实现方式，移动管理功能实体可先生成第二随机数，根据生成的第二随机数和所述第二目标密钥衍生算法，生成新的第一密钥，然后用生成的新的第一密钥，更新移动管理功能实体中存储的第一密钥。
其中，该第一密钥用于终端与移动管理功能实体之间通信，例如第一密钥可以是Knas，具体可以包括加密密钥(Knas-enc/KNASenc)，完整性保护密钥(Knas-int/KNASint)。
例如，在4G中，加密密钥称为Knas-enc，完整性保护密钥称为Knas-int。
在5G中，加密密钥称为KNASenc，完整性保护密钥称为KNASint。
例如，在4G中，先根据第二随机数、本地存储的Kasme、第二目标密钥衍生算法，生成新的Kasme，然后根据新的Kasme、第二目标密钥衍生算法、完整性保护算法，生成新的Knas-int。以及，根据新的Kasme、第二目标密钥衍生算法、加密算法，生成新的Knas-enc。
再比如，在5G中，先根据第二随机数、Kamf、第二目标密钥衍生算法，生成新的Kamf，然后根据新的Kamf、第二目标密钥衍生算法、完整性保护算法，生成新的KNASint。以及，根据新的Kamf、第二目标密钥衍生算法、加密算法，生成新的KNASenc。
作为另一种实现方式，移动管理功能实体可根据NAS计数COUNT和所述第二目 标密钥衍生算法，生成新的第一密钥，然后用生成的新的第一密钥，更新移动管理功能实体中存储的第一密钥。
其中，第一消息可以携带上行NAS COUNT的部分比特位，AMF实体可根据第一消息中携带的上行NAS COUNT部分比特位，获取完整的NAS COUNT。该第一密钥用于终端与移动管理功能实体之间通信，例如第一密钥可以是Knas，具体可以包括加密密钥(Knas-enc/KNASenc)，完整性保护密钥(Knas-int/KNASint)。
例如，在4G中，先根据NAS COUNT的部分比特位获得整个NAS COUNT，再根据NAS COUNT、本地存储的Kasme、第二目标密钥衍生算法，生成新的Kasme，然后根据新的Kasme、第二目标密钥衍生算法、完整性保护算法，生成新的Knas-int。以及，根据新的Kasme、第二目标密钥衍生算法、加密算法，生成新的Knas-enc。
再比如，在5G中，先根据NAS COUNT的部分比特位获得整个NAS COUNT，再根据NAS COUNT、Kamf、第二目标密钥衍生算法，生成新的Kamf，然后根据新的Kamf、第二目标密钥衍生算法、完整性保护算法，生成新的KNASint。以及，根据新的Kamf、第二目标密钥衍生算法、加密算法，生成新的KNASenc。
作为另一种实现方式，移动管理功能实体可根据NAS计数COUNT和所述第二目标密钥衍生算法以及常量字符串，生成新的第一密钥，然后用生成的新的第一密钥，更新移动管理功能实体中存储的第一密钥。
其中，第一消息可以携带上行NAS COUNT的部分比特位，AMF实体可根据第一消息中携带的上行NAS COUNT部分比特位，获取完整的NAS COUNT。该第一密钥用于终端与移动管理功能实体之间通信，例如第一密钥可以是Knas，具体可以包括加密密钥(Knas-enc/KNASenc)，完整性保护密钥(Knas-int/KNASint)。常量字符串可以是预配置的常量字符串，例如“KDF”，“KDF-UPDATE”等。
例如，在4G中，先根据NAS COUNT的部分比特位获得整个NAS COUNT，再根据NAS COUNT、本地存储的Kasme、第二目标密钥衍生算法，常量字符串，生成新的Kasme，然后根据新的Kasme、第二目标密钥衍生算法、完整性保护算法，生成新的Knas-int。以及，根据新的Kasme、第二目标密钥衍生算法、加密算法，生成新的Knas-enc。
再比如，在5G中，先根据NAS COUNT的部分比特位获得整个NAS COUNT，再根据NAS COUNT、Kamf、第二目标密钥衍生算法，常量字符串，生成新的Kamf，然后根据新的Kamf、第二目标密钥衍生算法、完整性保护算法，生成新的KNASint。以及，根据新的Kamf、第二目标密钥衍生算法、加密算法，生成新的KNASenc。
步骤804、移动管理实体向终端发送第二消息，终端接收来自移动管理实体的第二消息。
该第二消息可以是NAS SMC消息，受到完整性保护，可防止被攻击者篡改消息的内容。
该第二消息中包括第二目标密钥衍生算法，可选地，还包括第二随机数。
步骤805、终端更新第一密钥。
终端从接收的第二消息中获取第二目标衍生算法，使用该第二目标衍生算法更新终端的密钥衍生算法，根据第二目标密钥衍生算法，更新第一密钥。
可选地，若第二消息包括第二随机数，则终端根据第二目标密钥衍生算法和第二 随机数，更新第一密钥。
可选地，终端还可以根据第二目标密钥衍生算法和NAS COUNT，更新第一密钥，其中，上述步骤801中的第一消息携带该NAS COUNT的部分比特位。
可选地，终端还可以根据第二目标密钥衍生算法、常量字符串和NAS COUNT，更新第一密钥，其中，上述步骤801中的第一消息携带该NAS COUNT的部分比特位。
上述三种终端更新第一密钥的具体方法，可参考步骤803中的移动管理实体更新第一密钥的过程，不再赘述。
步骤806、终端向移动管理实体发送NAS SMP消息，移动管理实体接收来自终端的NAS SMP消息。
该NAS SMP消息用于通知移动管理实体，协商和更新第一密钥成功。
情形二、终端与存储功能实体之间的密钥衍生算法的重新协商
参考图9，为本申请实施例提供的密钥衍生算法的协商方法，用于终端与存储功能实体之间重新协商密钥衍生算法，图9所示的流程可以是在图3所示的流程的步骤304之后完成，即在图3的步骤304之后，若确定第一密钥衍生算法与第二密钥衍生算法不同，则还包括以下步骤：
步骤901、终端向移动管理功能实体发送第一消息，移动管理功能实体接收来自终端的第一消息。
该第一消息可以是NAS SMP消息，其中携带第一密钥衍生算法。
需要说明的是，该第一消息是受到完整性保护算法保护的，因此其中携带的第一密钥衍生算法不会被攻击者篡改，因此，移动管理功能实体接收到的也是第一密钥衍生算法。
步骤902、移动管理实体向存储功能实体发送第一密钥衍生算法，存储功能实体接收来自移动管理实体的第一密钥衍生算法。
步骤903、存储功能实体从第一密钥衍生算法中选择第一目标密钥衍生算法。
选择第一目标密钥衍生算法的方法，可参考前述从第二密钥衍生算法中选择第三密钥衍生算法的方法，不再赘述。
步骤904、存储功能实体更新接入安全管理实体密钥。
在4G中，该接入安全管理实体密钥可以称为Kasme，在5G中，名称可能与4G中不同，例如称为Kasme*。
作为一种实现方式，存储功能实体可先生成第一随机数，根据生成的第一随机数、第一目标密钥衍生算法及存储的接入安全管理实体密钥，生成新的接入安全管理实体密钥，然后更新存储功能实体中存储的接入安全管理实体密钥。
步骤905、存储功能实体向移动管理功能实体发送第一目标密钥衍生算法，移动管理功能实体接收来自存储功能实体的第一目标密钥衍生算法。
可选地，该步骤905中，存储功能实体还向移动管理功能实体发送第一随机数。
步骤906、移动管理实体向终端发送第二消息，终端接收来自移动管理实体的第二消息。
该第二消息可以是NAS SMC消息，受到完整性保护，可防止被攻击者篡改消息的内容。
该第二消息中包括第一目标密钥衍生算法，可选地，还包括第一随机数。
步骤907、终端更新终端中存储的接入安全管理实体密钥。
终端从接收的第二消息中获取第一目标衍生算法，使用该第一目标衍生算法更新终端的密钥衍生算法，根据第一目标密钥衍生算法，更新接入安全管理实体密钥，可选地，根据第一目标密钥衍生算法和第一随机数，更新接入安全管理实体密钥，具体方法可参考步骤904中的移动管理实体更新第一密钥的过程，不再赘述。
情形三、终端与移动管理功能实体之间的密钥衍生算法的重新协商+终端与存储功能实体之间的密钥衍生算法的重新协商
参考图10，为本申请实施例提供的密钥衍生算法的协商方法，用于终端与存储功能实体之间重新协商密钥衍生算法，以及终端与移动管理功能实体之间重新协商密钥衍生算法图10所示的流程可以图8所示的流程与图9所示的流程的结合，且图10是以4G为例进行说明。图10中的MME即为移动管理功能实体，HSS实体即为存储功能实体。图10所示的流程包括以下步骤：
步骤1001、终端向MME发送NAS SMP消息，MME接收来自终端的NAS SMP消息。
NAS SMP消息中包括第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。
步骤1002、MME向HSS发送第一密钥衍生算法，HSS接收来自MME的第一密钥衍生算法。
步骤1003、MME从第一目标密钥衍生算法中选择第二目标密钥衍生算法。
步骤1004、HSS从第一目标密钥衍生算法中选择第一目标密钥衍生算法。
步骤1005、HSS更新Kasme。
例如，HSS生成第一随机数，根据第一随机数、本地存储的Kasme及第一目标密钥衍生算法，生成新的Kasme，并使用新的Kasme，更新本地存储的Kasme。
步骤1006、HSS向MME发送第一目标密钥衍生算法和新的Kasme。
可选地，还发送第一随机数。
步骤1007、MME根据接收到的Kasme，更新本地存储的Kasme。
即，使用接收到的Kasme，替换本地存储的Kasme。
可选地，若上述步骤1006中不包括新的Kasme，则步骤1007中更新本地存储的Kasme的方法为：
MME生成第二随机数，根据第二随机数、本地存储的Kasme、第二目标密钥衍生算法，生成新的Kasme。
步骤1008、MME更新第一密钥。
具体地，MME根据更新的Kasme、第二目标密钥衍生算法、加密算法，生成新的Knas-enc。
根据新的Kasme、第二目标密钥衍生算法、完整性保护算法，生成新的Knas-int。
其中，第一密钥为终端与MME之间通信的密钥，包括Knas-int和Knas-enc。
步骤1009、MME向终端发送NAS SMC消息，终端接收来自MME的MAS SMC消息。
该NAS SMC消息包括第一目标密钥衍生算法、第二目标密钥衍生算法，可选地，还包括第一随机数、第二随机数。
步骤1010、终端更新Kasme和第一密钥。
终端一方面将接收到的第一目标密钥衍生算法和第二目标密钥衍生算法，作为终端的密钥。其中，第一目标密钥衍生算法用于终端和HSS之间的通信，第二目标密钥衍生算法用于终端和MME之间的通信。
终端更新Kasme的方法与HSS更新Kasme的方法相同，终端更新第一密钥的方法与MME更新第一密钥的方法相同，不再赘述。
步骤1011、终端向MME发送NAS SMP消息，移动管理实体接收来自终端的NAS SMP消息。
该NAS SMP消息用于通知MME，协商和更新密钥成功。
上述各步骤的详细执行方法，可参考前述实施例中相关部分的详细描述，这里不再赘述。
需要说明的是，上述各步骤之间没有严格的执行顺序，例如，步骤1002可以在步骤1003之前执行，步骤1004和步骤1005在步骤1003之前执行，或者步骤1003在步骤1004和步骤1005之间执行。
参考图11，为本申请实施例提供的密钥衍生算法的协商方法，用于终端与存储功能实体之间重新协商密钥衍生算法，以及终端与移动管理功能实体之间重新协商密钥衍生算法。图11所示的流程包括图8的部分流程，以及包括图9的部分流程。图11是以5G为例进行说明。图11中的AMF实体即为移动管理功能实体，ARPF实体即为存储功能实体。图11所示的流程包括以下步骤：
步骤1101、终端向AMF发送NAS SMP消息，AMF接收来自终端的NAS SMP消息。
NAS SMP消息中包括第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。
步骤1102、AMF向AUSF发送第一密钥衍生算法，AUSF接收来自AMF的第一密钥衍生算法。
步骤1103、AUSF向ARPF发送第一密钥衍生算法，ARPF接收来自AUSF的第一密钥衍生算法。
步骤1104、AMF从第一密钥衍生算法中选择第二目标密钥衍生算法。
步骤1105、ARPF从第一密钥衍生算法中选择第一目标密钥衍生算法。
步骤1106、ARPF更新Kasme*。
ARPF根据本地存储的Kasme*及第一目标密钥衍生算法，生成新的Kasme*，并使用新的Kasme*，更新本地存储的Kasme*。
可选地，ARPF生成第一随机数，然后根据第一随机数、本地存储的Kasme*及第一目标密钥衍生算法，生成新的Kasme*，并使用新的Kasme*，更新本地存储的Kasme*。
步骤1107、ARPF向AUSF发送第一目标密钥衍生算法、新的Kasme*。
可选地，当ARPF根据生成的第一随机数更新Kasme*时，则ARPF还向AUSF发送第一随机数。
步骤1108、AUSF根据接收到的Kasme*，更新本地存储的Kasme*。
即，使用接收到的Kasme*，替换本地存储的Kasme*。
步骤1109、AUSF根据Kasme*，生成Kseaf。
例如，该kseaf是AUSF生成，并发送给SEAF的。Kseaf可以用于获得AMF所使用的密钥Kamf。
步骤1110、AUSF向SEAF发送第一目标密钥衍生算法及Kseaf。
可选地，当上述步骤1107中包括第一随机数时，AUSF还向SEAF发送第一随机数。
步骤1111、SEAF更新根据接收到的Kseaf，更新本地存储的Kseaf。
步骤1112、SEAF根据更新的Kseaf，生成Kamf。
步骤1113、SEAF向AMF发送第一目标密钥衍生算法及Kamf。
可选地，当上述步骤1110中包括第一随机数时，SEAF还向AMF发送第一随机数。
步骤1114、AMF根据接收到的Kamf，根据本地存储的Kamf。
步骤1115、AMF更新第一密钥。
具体地，AMF根据更新的Kamf、第二目标密钥衍生算法、加密算法，生成新的KNASenc。
根据更新的Kamf、第二目标密钥衍生算法、完整性保护算法，生成新的KNASint。
其中，第一密钥为终端与AMF之间通信的密钥，包括KNASenc和KNASint。
步骤1116、AMF向终端发送NAS SMC消息，终端接收来自AMF的NAS SMC消息。
该NAS SMC消息中包括第一目标密钥衍生算法、第二目标密钥衍生算法。
可选地，当上述步骤1113中包括第一随机数时，NAS SMC消息中还包括第一随机数。
步骤1117、终端更新本地存储的Kamf、Kseaf、Kasme*及第一密钥。
终端根据本地存储的Kasme*及第一目标密钥衍生算法，生成新的Kasme*，并使用新的Kasme*，更新本地存储的Kasme*。
可选地，当终端接收到第一随机数，则终端根据第一随机数、本地存储的Kasme*及第一目标密钥衍生算法，生成新的Kasme*，并使用新的Kasme*，更新本地存储的Kasme*。
终端根据更新的Kasme*，生成新的Kseaf，并根据新的Kseaf，更新本地存储的Kseaf。
终端根据新的Kseaf，生成新的Kamf，并根据新的Kamf，更新本地存储的Kamf。
终端根据更新的Kamf、第二目标密钥衍生算法、加密算法，生成新的KNASenc。
终端根据更新的Kamf、第二目标密钥衍生算法、完整性保护算法，生成新的KNASint。
其中，新的KNASenc和新的KNASint统称为更新的第一密钥。
步骤1118、终端向AMF发送NAS SMP消息，AMF接收来自终端的NAS SMP消息。
该NAS SMP消息用于通知AMF，协商和更新密钥成功。
上述各步骤的详细执行方法，可参考前述实施例中相关部分的详细描述，这里不再赘述。
需要说明的是，上述各步骤之间没有严格的执行顺序，例如，步骤1102、步骤1103 可以在步骤1004之前执行，步骤1104和步骤1105～步骤1113之间的执行没有顺序限制。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
基于相同的发明构思，如图12所示，为本申请提供的一种装置示意图，该装置可以是终端，可执行上述任一实施例中由终端执行的方法。
该终端1200包括至少一个处理器121，收发器122，可选地，还包括存储器123。所述处理器121、收发器122、存储器123通过通信总线连接。
处理器121可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
通信总线可包括一通路，在上述单元之间传送信息。
所述收发器122，用于与其他设备或通信网络通信，收发器包括射频电路。
存储器123可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically erasable programmabler-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器123可以是独立存在，通过通信总线与处理器121相连接。存储器123也可以和处理器集成在一起。其中，所述存储器123用于存储执行本发明方案的应用程序代码，并由处理器121来控制执行。所述处理器121用于执行所述存储器123中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器121可以包括一个或多个CPU，例如图12中的CPU0和CPU1。
在具体实现中，作为一种实施例，终端1200可以包括多个处理器，例如图12中的处理器121和处理器128。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器，这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
应理解，该终端可以用于实现本发明实施例的密钥衍生算法的协商方法中由终端执行的步骤，相关特征可以参照上文，此处不再赘述。
本申请可以根据上述方法示例对终端进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需 要说明的是，本申请中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。比如，在采用对应各个功能划分各个功能模块的情况下，图13示出了一种装置示意图，该装置可以是上述实施例中所涉及的终端，该装置包括处理单元1301和通信单元1302。
一方面，所述通信单元1302，用于向存储功能实体发送第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。通信单元1302，还用于接收来自存储功能实体的认证令牌，认证令牌包括第一消息鉴别码、第二密钥衍生算法以及第三密钥衍生算法，其中，第二密钥衍生算法为存储功能实体接收到的终端支持的至少一个密钥衍生算法，且第二密钥衍生算法包括第三密钥衍生算法，第一消息鉴别码是根据第二密钥衍生算法生成的。处理单元1301，用于根据第二密钥衍生算法生成第二消息鉴别码。若第一消息鉴别码与第二消息鉴别码相同，且第一密钥衍生算法与第二密钥衍生算法相同，则处理单元1301，还用于获取第三密钥衍生算法作为终端的密钥衍生算法。
可选地，第二密钥衍生算法携带于认证令牌的认证管理域。
另一方面，若第一密钥衍生算法与第二密钥衍生算法不同，通信单元1302，用于向移动管理功能实体发送第一消息，第一消息包含第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法，第二密钥衍生算法为移动管理功能实体或存储功能实体存储功能实体接收到的终端支持的至少一个密钥衍生算法。通信单元1302，还用于接收来自移动管理功能实体的第二消息，第二消息包括目标密钥衍生算法，其中，第一密钥衍生算法包括目标密钥衍生算法。处理单元1301，用于将终端的密钥衍生算法更新为目标密钥衍生算法，并根据目标密钥衍生算法更新终端的密钥。
可选地，目标密钥衍生算法包括来自存储功能实体的第一目标密钥衍生算法，处理单元1301，具体用于：根据第一目标密钥衍生算法，更新终端的接入安全管理实体密钥。
可选地，第二消息还包括来自存储功能实体的第一随机数。处理单元1301，具体用于：根据第一目标密钥衍生算法和第一随机数，更新接入安全管理实体密钥。
可选地，目标密钥衍生算法包括来自移动管理功能实体的第二目标密钥衍生算法，处理单元1301，具体用于：根据第二目标密钥衍生算法，更新用于终端和移动管理功能实体通信的第一密钥。
可选地，第二消息还包括来自移动管理功能实体的第二随机数，处理单元1301，具体用于：根据第二目标密钥衍生算法和第二随机数，更新第一密钥。
可选地，还包括：通信单元1302，还用于接收来自移动管理功能实体的非接入层NAS安全模式完成SMP消息，NAS SMP消息包括第二密钥衍生算法，第二密钥衍生算法为存储功能实体接收到的终端支持的密钥衍生算法，处理单元1301，还用于确定第一密钥衍生算法与第二密钥衍生算法不同。
可选地,第一消息为NAS SMP消息，第二消息为NAS安全模式命令SMC消息。
应理解，该终端可以用于实现本发明实施例的密钥衍生算法的协商方法中由终端执行的步骤，相关特征可以参照上文，此处不再赘述。
基于相同的发明构思，如图14所示，为本申请提供的一种装置示意图，该装置例如可以是移动管理功能实体或存储功能实体，可执行上述任一实施例中由移动管理功 能实体或存储功能实体执行的方法。
该移动管理功能实体或存储功能实体1400包括至少一个处理器141，收发器142，可选地，还包括存储器143。处理器141、收发器142、存储器143通过通信总线连接。
处理器141可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
通信总线可包括一通路，在上述单元之间传送信息。
收发器142，用于与其他设备或通信网络通信，收发器包括射频电路。
存储器143可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically erasable programmabler-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器143可以是独立存在，通过通信总线与处理器141相连接。存储器143也可以和处理器集成在一起。其中，存储器143用于存储执行本发明方案的应用程序代码，并由处理器141来控制执行。处理器141用于执行存储器143中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器141可以包括一个或多个CPU，例如图14中的CPU0和CPU1。
在具体实现中，作为一种实施例，移动管理功能实体或存储功能实体1400可以包括多个处理器，例如图14中的处理器141和处理器148。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器，这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
应理解，该移动管理功能实体或存储功能实体可以用于实现本发明实施例的密钥衍生算法的协商方法中由移动管理功能实体或存储功能实体执行的步骤，相关特征可以参照上文，此处不再赘述。
本申请可以根据上述方法示例对移动管理功能实体或存储功能实体进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。比如，在采用对应各个功能划分各个功能模块的情况下，图15示出了一种装置示意图，该装置可以是上述实施例中所涉及的移动管理功能实体或存储功能实体，该装置包括处理单元1501和通信单元1502。
一方面，若装置为存储功能实体，则通信单元1502，用于接收第二密钥衍生算法，第二密钥衍生算法为存储功能实体接收到的终端支持的至少一个密钥衍生算法。处理单元1501，用于根据预设策略，从第二密钥衍生算法中选择第三密钥衍生算法，以及， 根据所述第二密钥衍生算法生成第一消息鉴别码。通信单元1502，还用于向终端发送认证令牌，认证令牌包括第一消息鉴别码、第三密钥衍生算法以及第二密钥衍生算法。
可选地，第二密钥衍生算法携带于认证令牌的认证管理域。
另一方面，若装置为移动管理功能实体或存储功能实体，则：通信单元1502，用于接收来自终端的第一密钥衍生算法，第一密钥衍生算法为终端支持的至少一个密钥衍生算法。处理单元1501，用于根据预设策略，从第一密钥衍生算法中选择目标密钥衍生算法。处理单元1501，还用于根据目标密钥衍生算法，更新网络侧节点中存储的密钥。通信单元1502，还用于向终端发送目标密钥衍生算法。
可选地，处理单元1501，具体用于：生成随机数；根据随机数和目标密钥衍生算法，更新网络侧节点中存储的密钥。通信单元1502，还用于：向终端发送随机数。
可选地，若装置为移动管理功能实体，移动管理功能实体中存储的密钥为终端的接入安全管理实体密钥；或者，若装置为存储功能实体，存储功能实体中存储的密钥为用于终端和移动管理功能实体通信的第一密钥。
可选地，若装置为移动管理功能实体。通信单元1502，还用于：接收第二密钥衍生算法，第二密钥衍生算法为移动管理功能实体接收到的终端支持的至少一个密钥衍生算法；向终端发送非接入层NAS安全模式完成SMP消息，NAS SMP消息包括第二密钥衍生算法。
在本实施例中，该移动管理功能实体或存储功能实体以对应各个功能划分各个功能模块的形式来呈现，或者，该移动管理功能实体或存储功能实体以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路(application-specific integrated circuit，ASIC)，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
应理解，该移动管理功能实体或存储功能实体可以用于实现本发明实施例的密钥衍生算法的协商方法中由移动管理功能实体或存储功能实体执行的步骤，相关特征可以参照上文，此处不再赘述。
如图16所示，为本申请提供的又一种密钥衍生算法的协商方法，该方法包括以下步骤：
步骤1601，终端向网络侧网元发送第一密钥衍生算法的第一标识信息，网络侧网元接收到第三密钥衍生算法的第三标识信息。
网络侧网元可以是UDM、HSS、AUSF,SEAF、AMF、MME、gNB或eNB等。
第一密钥衍生算法可用于表示终端的密钥衍生算法能力，即第一密钥衍生算法为终端支持的至少一个密钥衍生算法。例如，终端支持的密钥衍生算法为KDF1、KDF2、KDF3，则第一密钥衍生算法可以为{KDF1、KDF2、KDF3}。
在具体实现中，终端发送的第一密钥衍生算法可以是终端支持的密钥衍生算法的第一标识信息，例如，当终端支持的密钥衍生算法为KDF1、KDF2、KDF3时，则终端发送的第一密钥衍生算法的第一标识信息为{KDF1的标识、KDF2的标识、KDF3的标识}。
本申请，网络侧网元接收到的终端发送的密钥衍生算法，称为第三密钥衍生算法。在具体实现中，网络侧网元接收到的是第三密钥衍生算法的标识信息，比如称为第三标识信息。
终端向网络侧网元发送第一密钥衍生算法的第一标识信息的具体方法，例如可以为：
当网络侧网元为AMF，即终端与AMF协商时，第一标识信息可以封装在注册请求消息(该注册请求消息用于终端初始注册、或改变跟踪区标识(tracking area identity，TAI)、或周期性TAI更新)中发送到AMF。
当网络侧网元为SEAF，即终端与SEAF协商时，第一标识信息可以是终端先发给AMF，然后由AMF发给SEAF。
当网络侧网元为AUSF，即终端与AUSF协商时，第一标识信息可以是终端先通过AMF发给SEAF，然后由SEAF通过认证启动请求(authentication initiation request)消息(该认证启动请求消息用于发起对终端的认证)发给AUSF。
当网络侧网元为UDM，即终端与UDM协商时，第一标识信息可以是终端先通过AMF、SEAF发给AUSF，然后由AUSF通过认证信息请求(authentication information request)消息(该认证信息请求消息用于请求认证向量)发给UDM。
当网络侧网元为gNB，即终端与gNB协商时，第一标识信息可以是终端先发给AMF，然后AMF通过初始上下文建立请求(initial context setup request)消息(该初始上下文建立请求消息用于建立初始终端上下文)发给gNB。
当网络侧网元为MME，即终端与MME协商时，第一标识信息可以封装在附着请求消息(该附着请求消息用于终端注册到网络)中发送到MME。
当网络侧网元为HSS，即终端与HSS协商时，第一标识信息可以是终端先发给MME，然后MME通过认证数据请求(authentication data request)消息(该认证数据请求消息用于请求认证向量)发给HSS。
当网络侧网元为eNB，即终端与eNB协商时，第一标识信息可以是终端先发给MME，然后MME通过初始上下文建立请求(initial context setup request)消息(该初始上下文建立请求消息用于建立初始终端上下文)发给eNB。
由于终端发送的携带第一标识信息的初始消息没有得到完整性保护，因此可能会受到攻击者的攻击，攻击者有可能将该初始消息中的第一标识信息篡改，此时网络侧网元接收到的第三密钥衍生算法的第三标识信息可能与第一密钥衍生算法的第一标识信息不同。
或者是，终端发送的第一标识信息没有被攻击者篡改，则网络侧网元接收到的第三密钥衍生算法的第三标识信息，与终端发送的第一密钥衍生算法的第一标识信息相同。
因此，网络侧网元接收到的第三密钥衍生算法的第三标识信息可能与终端发送的第一密钥衍生算法的第一标识信息相同，也有可能不同。
步骤1602，网络侧网元根据预设策略，从接收到的第三密钥衍生算法中选择第四密钥衍生算法。
第三密钥衍生算法为网络侧网元接收到的终端支持的至少一个密钥衍生算法。
当网络侧网元接收到第三密钥衍生算法的第三标识信息之后，可以根据第三标识信息确定第三密钥衍生算法。接着，网络侧网元根据预先设定的策略，从第三密钥衍生算法中选择一个第四密钥衍生算法，作为终端与网络侧网元之间协商的密钥衍生算法。
其中，预设策略可以是优先级策略，即选择优先级最高的密钥衍生算法；或者是，使用次数策略，即选择使用次数最多的密钥衍生算法；还可以是其它策略，本申请不做限制。
为方便说明，后续以优先级策略为例进行说明。
例如，第一密钥衍生算法为{KDF1、KDF2、KDF3}，其中，KDF1的优先级低于KDF2的优先级，KDF2的优先级低于KDF3的优先级。若第一密钥衍生算法没有被攻击篡改，则网络侧网元接收到的第三密钥衍生算法与第一密钥衍生算法相同，也为{KDF1、KDF2、KDF3}，则网络侧网元从第三密钥衍生算法中选择的第四密钥衍生算法为KDF3。
若第一密钥衍生算法被攻击篡改，(一般会修改为只包含优先级最低的密钥衍生算法，从而方便破解密钥)，例如，网络侧网元接收到的第三密钥衍生算法为{KDF1}，则网络侧网元从第三密钥衍生算法中选择的第四密钥衍生算法为KDF1。
步骤1603，网络侧网元向终端发送第四密钥衍生算法的第四标识信息，终端接收到第二密钥衍生算法的第二标识信息。
网络侧网元从第三密钥衍生算法中选择一个第四密钥衍生算法，然后将第四密钥衍生算法的第四标识信息携带于某个消息中发送至终端，且该消息没有得到完整性保护，因此可能会受到攻击者的攻击，攻击者有可能将该消息中的第四标识信息篡改，此时终端接收到的第二密钥衍生算法的第二标识信息可能与第四密钥衍生算法的第四标识信息不同。
或者是，网络侧网元发送的第四标识信息没有被攻击者篡改，则终端接收到的第二密钥衍生算法的第二标识信息，与网络侧网元发送的第四密钥衍生算法的第四标识信息相同。
因此，终端接收到的第二密钥衍生算法的第二标识信息可能与网络侧网元发送的第四密钥衍生算法的第四标识信息相同，也有可能不同。
终端在接收到第二密钥衍生算法的第二标识信息，则确定网络侧网元选择的密钥衍生算法为第二密钥衍生算法。或者理解为，终端确定与网络侧协商的密钥衍生算法为第二密钥衍生算法。
步骤1604，终端根据上层密钥、第一密钥衍生算法的第一标识信息和第二密钥衍生算法，生成下层密钥。
终端根据上层密钥、第一密钥衍生算法的第一标识信息及第二密钥衍生算法生成下层密钥，具体是指：终端将上层密钥、第一标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到下层密钥。
作为又一种实现方式，终端根据上层密钥、第一标识信息及第二密钥衍生算法生成下层密钥，可以是：终端根据上层密钥、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥，具体是指：终端将上层密钥、第一标识信息、第二标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到下层密钥。
下面结合具体示例进行说明。
比如，网络侧网元为移动性管理功能实体AMF，则上层密钥可以为接入管理密钥Kamf，下层密钥可以为非接入层加密密钥KNASenc，非接入层完整性保护密钥 KNASint，基站密钥KgNB，非3GPP接入密钥Kn3iwf中的至少一个，即终端根据上层密钥Kamf、第一标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，或者是，终端根据上层密钥Kamf、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
再比如，网络侧网元为安全锚点实体SEAF，则上层密钥可以为安全锚点密钥Kseaf，下层密钥为Kamf，即终端根据上层密钥Kseaf、第一标识信息及第二密钥衍生算法生成下层密钥Kamf，或者是，终端根据上层密钥Kseaf、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥Kamf。
再比如，网络侧网元为认证服务实体AUSF，则上层密钥可以为认证服务密钥Kausf，下层密钥可以为Kseaf，即终端根据上层密钥Kausf、第一标识信息及第二密钥衍生算法生成下层密钥Kseaf，或者是，终端根据上层密钥Kausf、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥Kseaf。
再比如，网络侧网元为统一数据管理实体UDM，则上层密钥可以为加密密钥CK、完整性IK，下层密钥可以为CK’,IK’，Kausf中的至少一个，即终端根据上层密钥CK、IK、第一标识信息及第二密钥衍生算法生成下层密钥CK’,IK’，Kausf中的至少一个，或者是，终端根据上层密钥CK、IK、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥CK’,IK’，Kausf中的至少一个。
再比如，网络侧网元为下一代基站gNB，则上层密钥可以为KgNB，下层密钥可以为无线连接控制加密密钥Krrc-enc，无线连接控制完整性保护密钥Krrc-int，用户面加密密钥Kup-enc，用户面完整性保护密钥Kup-int，下一跳NH中的至少一个，即终端根据上层密钥KgNB、第一标识信息及第二密钥衍生算法生成下层密钥Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个，或者是，终端根据上层密钥KgNB、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个。
再比如，网络侧网元为移动性管理实体MME，则上层密钥可以为接入管理密钥Kamse，下层密钥可以为KNASenc，KNASint中的至少一个，即终端根据上层密钥Kamse、第一标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint中的至少一个，或者是，终端根据上层密钥Kamse、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint中的至少一个。
再比如，网络侧网元为HSS，则上层密钥可以为CK、IK，下层密钥可以为Kasme，即终端根据上层密钥CK、IK、第一标识信息及第二密钥衍生算法生成下层密钥Kasme，或者是，终端根据上层密钥CK、IK、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥Kasme。
再比如，网络侧网元为eNB，则上层密钥可以为KeNB，下层密钥可以为Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个，即终端根据上层密钥KeNB、第一标识信息及第二密钥衍生算法生成下层密钥Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个，或者是，终端根据上层密钥KeNB、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥Krrc-enc，Krrc-int，Kup-enc，Kup-int，NH中的至少一个。
再比如，网络侧网元为UDM，上层密钥为CK、IK，下层密钥为Kseaf，即：终端根据CK、IK、第一标识信息及第二密钥衍生算法生成Kausf，然后根据Kausf及第二密钥衍生算法，生成Kseaf。或者，终端根据CK、IK及第二密钥衍生算法生成Kausf，然后根据Kausf、第一标识信息及第二密钥衍生算法，生成Kseaf。在该实现方式中，UE与UDM协商KDF算法的同时，获得了与AUSF使用的KDF算法。从而终端在与UDM的一次协商中得到两组密钥：Kausf和Kseaf，因此终端无需再与AUSF单独协商密钥衍生算法，可节约终端的开销。
再比如，网络侧网元为AUSF，上层密钥为CK、IK，下层密钥为Kseaf，即：终端根据CK、IK、第一标识信息及第二密钥衍生算法生成Kausf，然后根据Kausf及第二密钥衍生算法，生成Kseaf。或者，终端根据CK、IK及第二密钥衍生算法生成Kausf，然后根据Kausf、第一标识信息及第二密钥衍生算法，生成Kseaf。在该实现方式中，UE与AUSF协商KDF算法的同时，获得了与UDM使用的KDF算法。从而终端在与AUSF的一次协商中得到两组密钥：Kausf和Kseaf，因此终端无需再与UDM单独协商密钥衍生算法，可节约终端的开销。
再比如，网络侧网元为SEAF，上层密钥为Kseaf，下层密钥为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，即：终端根据Kseaf、第一标识信息及第二密钥衍生算法生成Kamf，然后根据Kamf及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。或者，终端根据Kseaf及第二密钥衍生算法生成Kamf，然后根据Kamf、第一标识信息及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。在该实现方式中，UE与SEAF协商KDF算法的同时，获得了与AMF使用的KDF算法。从而终端在与SEAF的一次协商中得到两组密钥：第一组为Kamf，第二组为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，因此终端无需再与AMF单独协商密钥衍生算法，可节约终端的开销。
再比如，网络侧网元为AMF，上层密钥为Kseaf，下层密钥为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，即：终端根据Kseaf、第一标识信息及第二密钥衍生算法生成Kamf，然后根据Kamf及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。或者，终端根据Kseaf及第二密钥衍生算法生成Kamf，然后根据Kamf、第一标识信息及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。在该实现方式中，UE与AMF协商KDF算法的同时，获得了与SEAF使用的KDF算法。从而终端在与AMF的一次协商中得到两组密钥：第一组为Kamf，第二组为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，因此终端无需再与SEAF单独协商密钥衍生算法，可节约终端的开销。
步骤1605，网络侧网元根据上层密钥、第三密钥衍生算法的第三标识信息和第四密钥衍生算法，生成下层密钥。
该步骤中网络侧网元生成下层密钥，该步骤1605可以是在步骤1604之前或之后执行，也可以是与步骤1604同时执行。
该步骤中，网络侧网元生成下层密钥的方式与终端生成下层密钥的方式相对应。具体地，若终端采用将上层密钥、第一标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到下层密钥，则相应地，网络侧网元将上层密钥、第三标识信息作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到 函数中得到下层密钥。
若终端将上层密钥、第一标识信息、第二标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到下层密钥。则相应地，网络侧网元将上层密钥、第三标识信息、第四标识信息作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到下层密钥。
例如，网络侧网元为AMF，上层密钥为Kamf，下层密钥为KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。在一种实现方式中，终端根据上层密钥Kamf、第一标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，则相应地，AMF根据上层密钥Kamf、第三标识信息及第四密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。在又一种实现方式中，终端根据上层密钥Kamf、第一标识信息、第二标识信息及第二密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，则相应地，AMF根据上层密钥Kamf、第三标识信息、第四标识信息及第四密钥衍生算法生成下层密钥KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
对于网络侧网元为SEAF、AUSF、UDM、gNB、MME、HSS、eNB的情形，也是类似，不再赘述。
在又一种实现方式中，当网络侧网元为UDM时，终端可以跟UDM通过一次KDF协商，同时完成与AUSF的KDF协商，即终端可以跟UDM协商得到Kausf和Kseaf，则相应地，UDM以与终端相同的方式，根据上层密钥CK、IK得到下层密钥Kausf，且进一步地，UDM还向AUSF发送第四标识信息和Kausf，使得AUSF根据Kausf、第四标识信息以及第四密钥衍生算法生成Kseaf。
在又一种实现方式中，当网络侧网元为AUSF时，终端可以跟AUSF通过一次KDF协商，同时完成与UDM的KDF协商，即终端可以跟AUSF协商得到Kausf和Kseaf，则相应地，AUSF先向UDM发送第四标识信息，UDM以与终端相同的方式，根据上层密钥CK、IK得到下层密钥Kausf，且进一步地，UDM向AUSF发送Kausf，使得AUSF根据Kausf、第四标识信息以及第四密钥衍生算法生成Kseaf。
在又一种实现方式中，当网络侧网元为SEAF时，终端可以跟SEAF通过一次KDF协商，同时完成与AMF的KDF协商，即终端可以跟SEAF协商得到Kamf，以及得到KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，则相应地，SEAF以与终端相同的方式，根据上层密钥Kseaf得到下层密钥Kamf，且进一步地，SEAF还向AMF发送第四标识信息和Kamf，使得AMF根据Kamf、第四标识信息以及第四密钥衍生算法生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
在又一种实现方式中，当网络侧网元为AMF时，终端可以跟AMF通过一次KDF协商，同时完成与SEAF的KDF协商，即终端可以跟AMF协商得到Kamf，以及得到KNASenc，KNASint，KgNB，Kn3iwf中的至少一个，则相应地，AMF先向SEAF发送第四标识信息，SEAF以与终端相同的方式，根据上层密钥Kseaf得到下层密钥Kamf，且进一步地，SEAF还向AMF发送Kamf，使得AMF根据Kamf、第四标识信息以及第四密钥衍生算法生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
通过上述步骤1601-步骤1605的实现方式，存在以下几种情形：
情形一，第一密钥衍生算法与第三密钥衍生算法相同，且第二密钥算法与第四密 钥衍生算法相同
该情形中，终端向网络侧网元发送的第一密钥衍生算法与网络侧网元接收到的第三密钥衍生算法相同，终端接收到的第二密钥衍生算法与网络侧网元发送的第四密钥衍生算法相同。即终端发送的第一密钥衍生算法未被篡改，且网络侧网元发送的第四密钥衍生算法也未被篡改。该情形下，终端与网络侧网元协商生成的下层密钥是相同的，因而可以实现正常通信。
情形二，第一密钥衍生算法与第三密钥衍生算法相同，但第二密钥算法与第四密钥衍生算法不同
该情形中，终端向网络侧网元发送的第一密钥衍生算法与网络侧网元接收到的第三密钥衍生算法相同，终端接收到的第二密钥衍生算法与网络侧网元发送的第四密钥衍生算法不同。即终端发送的第一密钥衍生算法未被篡改，但网络侧网元发送的第四密钥衍生算法被篡改了。该情形下，终端与网络侧网元协商生成的下层密钥不相同，从而终端后续不能与网络侧网元正常通信，即终端和网络侧网元可以发现协商失败，进而可以重新发起协商流程。即该情形下，当密钥衍生算法被篡改时，终端和网络侧网元将不会使用根据被篡改的密钥衍生算法生成的密钥来通信，从而可以保证通信的安全性。
情形三，第一密钥衍生算法与第三密钥衍生算法不同，但第二密钥算法与第四密钥衍生算法相同
该情形中，终端向网络侧网元发送的第一密钥衍生算法与网络侧网元接收到的第三密钥衍生算法不同，终端接收到的第二密钥衍生算法与网络侧网元发送的第四密钥衍生算法相同。即终端发送的第一密钥衍生算法被篡改，但网络侧网元发送的第四密钥衍生算法未被篡改。该情形下，终端与网络侧网元协商生成的下层密钥不相同，从而终端后续不能与网络侧网元正常通信，即终端和网络侧网元可以发现协商失败，进而可以重新发起协商流程。即该情形下，当密钥衍生算法被篡改时，终端和网络侧网元将不会使用根据被篡改的密钥衍生算法生成的密钥来通信，从而可以保证通信的安全性。
情形四，第一密钥衍生算法与第三密钥衍生算法不同，且第二密钥算法与第四密钥衍生算法不同
该情形中，终端向网络侧网元发送的第一密钥衍生算法与网络侧网元接收到的第三密钥衍生算法不同，终端接收到的第二密钥衍生算法与网络侧网元发送的第四密钥衍生算法不同。即终端发送的第一密钥衍生算法被篡改，且网络侧网元发送的第四密钥衍生算法被篡改。该情形下，终端与网络侧网元协商生成的下层密钥不相同，从而终端后续不能与网络侧网元正常通信，即终端和网络侧网元可以发现协商失败，进而可以重新发起协商流程。即该情形下，当密钥衍生算法被篡改时，终端和网络侧网元将不会使用根据被篡改的密钥衍生算法生成的密钥来通信，从而可以保证通信的安全性。
因此，本申请提供的上述方法，如果密钥衍生算法被篡改，终端和网络侧网元将会生成不同的下层密钥，从而导致通信失败。因此，当密钥衍生算法被篡改时，终端和网络侧网元将不会使用根据被篡改的密钥衍生算法生成的密钥来通信，从而可以保证通信的安全性。
下面结合具体实施例，对图16所示的密钥协商方法进行举例说明。
如图17(a)所示，为本申请提供的又一种密钥协商方法，包括以下步骤：
步骤1701，终端向AUSF发送第一密钥衍生算法的第一标识信息，AUSF接收到第三密钥衍生算法的第三标识信息。
第一密钥衍生算法可用于表示终端的密钥衍生算法能力，即第一密钥衍生算法为终端支持的至少一个密钥衍生算法。第三密钥衍生算法表示AUSF接收到的终端的密钥衍生算法能力。
作为一种实现方式，第一标识信息可以是终端通过AMF、SEAF发给AUSF的。
步骤1702,AUSF向UDM发送第三密钥衍生算法的第三标识信息，UDM接收到第三密钥衍生算法的第三标识信息。
例如，AUSF通过认证信息请求(authentication information request)消息将第三标识信息发给UDM。
需要说明的是，该步骤由于受到保护，因而AUSF向UDM发送的第三标识信息不会被篡改。
步骤1703,UDM根据预设策略，从接收到的第三密钥衍生算法中选择第四密钥衍生算法。
该步骤的实现方式，与图16所示的实施例的步骤1602中网络侧网元选择第四密钥算法的方法相同，可参考前述描述。
步骤1704,UDM根据CK,IK,第四密钥衍生算法生成Kausf，以及根据XRES，第四密钥衍生算法生成XRES*。
一方面，UDM将CK，IK作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到密钥Kausf。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
另一方面，UDM还将XRES作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到XRES*。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
步骤1705,UDM向AUSF发送第四密钥衍生算法的第四标识信息，Kausf和XRES*，相应地，AUSF接收第四密钥衍生算法的第四标识信息，Kausf和XRES*。
需要说明的是，该步骤由于受到保护，因而UDM向AUSF发送第四密钥衍生算法的第四标识信息，Kausf和XRES*不会被篡改。
步骤1706,AUSF根据Kausf,第三密钥衍生算法的第三标识信息和第四密钥衍生算法生成Kseaf。
AUSF将Kausf、第三标识信息作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到生成Kseaf。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
步骤1707，AUSF向终端发送第四密钥衍生算法的第四标识信息，终端接收到第二密钥衍生算法的第二标识信息。
第四密钥衍生算法为UDM从第三密钥衍生算法中选择的一个算法，而第二密钥衍生算法为AUSF向终端发送第四密钥衍生算法时，终端所接收到的密钥衍生算法。
在第四密钥衍生算法的第四标识信息没有被攻击者篡改时，终端接收到的第二标 识信息与AUSF发送的第四标识信息相同。在第四密钥衍生算法的第四标识信息被攻击者篡改时，终端接收到的第二标识信息可能与AUSF发送的第四标识信息不同。
步骤1708,终端根据CK,IK,第二密钥衍生算法生成Kausf，以及根据XRES，第二密钥衍生算法生成XRES*。
一方面，终端将CK，IK作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到密钥Kausf。可选的，输入参数还可以包含第二密钥衍生算法的第二标识信息。
另一方面，终端还将XRES作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到XRES*。可选的，输入参数还可以包含第二密钥衍生算法的第二标识信息。
可以看出，终端生成Kausf与UDM生成Kausf的不同之处在于：UDM侧的函数为第四密钥衍生算法，终端侧的输入参数为第二密钥衍生算法。因而，如果第二密钥衍生算法与第四密钥衍生算法相同，则终端与UDM分别生成的Kausf是相同的。
同样地，终端生成XRES*与UDM生成XRES*的不同之处在于：UDM侧的函数为第四密钥衍生算法，终端侧的输入参数为第二密钥衍生算法。因而，如果第二密钥衍生算法与第四密钥衍生算法相同，则终端与UDM分别生成的XRES*是相同的。
步骤1709，终端根据Kausf,第一密钥衍生算法的第一标识信息和第二密钥衍生算法生成Kseaf。
终端将Kausf、第一标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到生成Kseaf。可选的，输入参数还可以包含第二密钥衍生算法的第二标识信息。
可以看出，终端生成Kseaf与AUSF生成Kseaf的不同之处在于：AUSF侧的函数为第四密钥衍生算法且输入参数包括第三标识信息，终端侧的函数为第二密钥衍生算法且输入参数包括第一标识信息。因而，如果第二密钥衍生算法与第四密钥衍生算法相同，且第一密钥衍生算法与第三密钥衍生算法相同，则终端与AUSF分别生成的Kseaf是相同的。
从以上终端与UDM协商密钥的过程可以看出：第一，只有当第一密钥衍生算法与第三密钥衍生算法相同，且第二密钥衍生算法与第四密钥衍生算法相同时，终端与AUSF协商的Kseaf才是相同的，如果不同则不能完成正常通信，从而在完成密钥协商的同时保证了密钥的安全性；第二，从终端角度来看，终端可以跟UDM通过一次KDF协商，同时完成与AUSF的KDF协商，即终端可以跟UDM协商得到Kausf和Kseaf。
从以上终端与AUSF协商密钥的过程可以看出：第一，只有当第一密钥衍生算法与第三密钥衍生算法相同，且第二密钥衍生算法与第四密钥衍生算法相同时，终端与AUSF协商的Kseaf才是相同的，如果不同则不能完成正常通信，从而在完成密钥协商的同时保证了密钥的安全性；第二，从终端角度来看，终端可以跟AUSF通过一次KDF协商，同时完成与UDM的KDF协商，即终端可以跟AUSF协商得到Kausf和Kseaf。
如图17(b)所示，为本申请提供的又一种密钥协商方法，包括以下步骤：
步骤1711，终端向AUSF发送第一密钥衍生算法的第一标识信息，AUSF接收到第三密钥衍生算法的第三标识信息。
第一密钥衍生算法可用于表示终端的密钥衍生算法能力，即第一密钥衍生算法为终端支持的至少一个密钥衍生算法。第三密钥衍生算法表示AUSF接收到的终端的密钥衍生算法能力。
作为一种实现方式，第一标识信息可以是终端通过AMF、SEAF发给AUSF的。
步骤1712,AUSF向UDM发送第三密钥衍生算法的第三标识信息，UDM接收到第三密钥衍生算法的第三标识信息。
例如，AUSF通过认证信息请求(authentication information request)消息将第三标识信息发给UDM。
需要说明的是，该步骤由于受到保护，因而AUSF向UDM发送的第三标识信息不会被篡改。
步骤1713,UDM根据预设策略，从接收到的第三密钥衍生算法中选择第四密钥衍生算法。
该步骤的实现方式，与图16所示的实施例的步骤1602中网络侧网元选择第四密钥算法的方法相同，可参考前述描述。
步骤1714,UDM根据CK,IK,第四密钥衍生算法生成CK’，IK’。
UDM将CK，IK作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到CK’，IK’。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
步骤1715,UDM向AUSF发送第四密钥衍生算法的第四标识信息，CK’，IK’，相应地，AUSF接收第四密钥衍生算法的第四标识信息，CK’，IK’。
需要说明的是，该步骤由于受到保护，因而UDM向AUSF发送第四密钥衍生算法的第四标识信息，CK’，IK’不会被篡改。
步骤1716，AUSF根据CK’，IK’和第四密钥衍生算法生成Kausf。
AUSF将CK’，IK’作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到生成Kausf。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
步骤1717,AUSF根据Kausf,第三密钥衍生算法的第三标识信息和第四密钥衍生算法生成Kseaf。
AUSF将Kausf、第三标识信息作为输入参数，将第四密钥衍生算法作为函数，将输入参数输入到函数中得到生成Kseaf。可选的，输入参数还可以包含第四密钥衍生算法的第四标识信息。
步骤1718，AUSF向终端发送第四密钥衍生算法的第四标识信息，终端接收到第二密钥衍生算法的第二标识信息。
第四密钥衍生算法为UDM从第三密钥衍生算法中选择的一个算法，而第二密钥衍生算法为AUSF向终端发送第四密钥衍生算法时，终端所接收到的密钥衍生算法。
在第四密钥衍生算法的第四标识信息没有被攻击者篡改时，终端接收到的第二标识信息与AUSF发送的第四标识信息相同。在第四密钥衍生算法的第四标识信息被攻击者篡改时，终端接收到的第二标识信息可能与AUSF发送的第四标识信息不同。
步骤1719，终端根据CK,IK,第二密钥衍生算法生成CK’，IK’。
终端将CK’，IK’作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入 到函数中得到生成CK’，IK’。可选的，若步骤1714中的输入参数包括第四密钥衍生算法的第四标识信息，则该步骤1719中的输入参数还包括第二密钥衍生算法的第二标识信息。
步骤1720,终端根据CK’，IK’和第二密钥衍生算法生成Kausf。
终端将CK’，IK’作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到密钥Kausf。可选的，若步骤1716中的输入参数包括第四密钥衍生算法的第四标识信息，则该步骤1720中的输入参数还包括第二密钥衍生算法的第二标识信息。
可以看出，终端生成Kausf与AUSF生成Kausf的不同之处在于：AUSF侧的函数为第四密钥衍生算法，终端侧的函数为第二密钥衍生算法。因而，如果第二密钥衍生算法与第四密钥衍生算法相同，则终端与AUSF分别生成的Kausf是相同的。
步骤1721，终端根据Kausf,第一密钥衍生算法的第一标识信息和第二密钥衍生算法生成Kseaf。
终端将Kausf、第一标识信息作为输入参数，将第二密钥衍生算法作为函数，将输入参数输入到函数中得到生成Kseaf。可选的，若步骤1717中的输入参数包括第四密钥衍生算法的第四标识信息，则该步骤1721中的输入参数还包括第二密钥衍生算法的第二标识信息。
可以看出，终端生成Kseaf与AUSF生成Kseaf的不同之处在于：AUSF侧的函数为第四密钥衍生算法且输入参数包括第三标识信息，终端侧的函数为第二密钥衍生算法且输入参数包括第一标识信息。因而，如果第二密钥衍生算法与第四密钥衍生算法相同，且第一密钥衍生算法与第三密钥衍生算法相同，则终端与AUSF分别生成的Kseaf是相同的。
从以上终端与UDM协商密钥的过程可以看出：第一，只有当第一密钥衍生算法与第三密钥衍生算法相同，且第二密钥衍生算法与第四密钥衍生算法相同时，终端与AUSF协商的Kseaf才是相同的，如果不同则不能完成正常通信，从而在完成密钥协商的同时保证了密钥的安全性；第二，从终端角度来看，终端可以跟UDM通过一次KDF协商，同时完成与AUSF的KDF协商，即终端可以跟UDM协商得到Kausf和Kseaf。
从以上终端与AUSF协商密钥的过程可以看出：第一，只有当第一密钥衍生算法与第三密钥衍生算法相同，且第二密钥衍生算法与第四密钥衍生算法相同时，终端与AUSF协商的Kseaf才是相同的，如果不同则不能完成正常通信，从而在完成密钥协商的同时保证了密钥的安全性；第二，从终端角度来看，终端可以跟AUSF通过一次KDF协商，同时完成与UDM的KDF协商，即终端可以跟AUSF协商得到Kausf和Kseaf。
基于相同的发明构思，如图18所示，为本申请提供的一种装置示意图，该装置可以是终端，可执行图16所示的实施例中由终端执行的方法，或者可以是网络侧网元，可执行图16所示的实施例中由网络侧网元执行的方法。
该装置1800包括至少一个处理器181，收发器182，可选地，还包括存储器183。所述处理器181、收发器182、存储器183通过通信总线连接。
处理器181可以是一个通用中央处理器(CPU)，微处理器，ASIC，或一个或多个用于控制本发明方案程序执行的集成电路。
通信总线可包括一通路，在上述单元之间传送信息。
所述收发器182，用于与其他设备或通信网络通信，收发器包括射频电路。
存储器183可以是ROM或可存储静态信息和指令的其他类型的静态存储设备RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器183可以是独立存在，通过通信总线与处理器181相连接。存储器183也可以和处理器集成在一起。其中，所述存储器183用于存储执行本发明方案的应用程序代码，并由处理器181来控制执行。所述处理器181用于执行所述存储器183中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器181可以包括一个或多个CPU，例如图18中的CPU0和CPU1。
在具体实现中，作为一种实施例，装置1800可以包括多个处理器，例如图18中的处理器181和处理器188。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器，这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
应理解，当该装置为终端时，该终端可以用于实现图16所示的实施例的密钥衍生算法的协商方法中由终端执行的步骤，相关特征可以参照上文，此处不再赘述。当该装置为网络侧网元时，该网络侧网元可以用于实现图16所示的实施例的密钥衍生算法的协商方法中由网络侧网元执行的步骤，相关特征可以参照上文，此处不再赘述。
本申请可以根据上述方法示例对上述装置进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。比如，在采用对应各个功能划分各个功能模块的情况下，图19示出了一种装置示意图，该装置包括处理单元1901和通信单元1902。
在一个实施例中，该装置可以是图16所示的实施例中所涉及的终端。当该装置为终端时，则该装置的处理单元1901和通信单元1902可用于执行以下操作：
通信单元1902，用于向网络侧网元发送第一密钥衍生算法的第一标识信息，第一密钥衍生算法为终端支持的至少一个密钥衍生算法；
通信单元1902，还用于接收第二密钥衍生算法的第二标识信息；
处理单元1901，用于根据上层密钥、第一标识信息及第二密钥衍生算法，生成下层密钥。
可选地，处理单元1901，具体用于根据上层密钥、第一标识信息、第二标识信息及第二密钥衍生算法，生成下层密钥。
可选地，上层密钥为加密密钥CK、完整性密钥IK，下层密钥为安全锚点密钥Kseaf；处理单元1901，具体用于：根据CK、IK、第一标识信息及第二密钥衍生算法，生成认证服务密钥Kausf；以及，根据Kausf及第二密钥衍生算法，生成Kseaf；或者，根据CK、IK及第二密钥衍生算法，生成Kausf；以及，根据Kausf、第一标识信息及第二密钥衍生算法，生成Kseaf。
可选地，上层密钥为Kseaf，下层密钥为非接入层加密密钥KNASenc，非接入层完整性保护密钥KNASint，基站密钥KgNB，非3GPP接入密钥Kn3iwf中的至少一个；处理单元1901，具体用于：根据Kseaf、第一标识信息及第二密钥衍生算法，生成接入管理密钥Kamf；以及，根据Kamf及第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，根据Kseaf及第二密钥衍生算法，生成Kamf；以及，根据Kamf、第一标识信息第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
应理解，该终端可以用于实现图16所示的实施例的密钥衍生算法的协商方法中由终端执行的步骤，相关特征可以参照上文，此处不再赘述。
在另一个实施例中，该装置可以是图16所示的实施例中所涉及的网络侧网元。当该装置为网络侧网元时，则该装置的处理单元1901和通信单元1902可用于执行以下操作：
通信单元1902，用于接收第三密钥衍生算法的第三标识信息，第三密钥衍生算法为网络侧网元接收到的终端支持的至少一个密钥衍生算法；
处理单元1901，用于根据预设策略，从第三密钥衍生算法中选择第四密钥衍生算法；以及，根据第三标识信息、第四密钥衍生算法和上层密钥，生成下层密钥；
通信单元1902，还用于向终端发送第四密钥衍生算法的第四标识信息。
可选地，处理单元1901，具体用于根据上层密钥、第三标识信息、第四标识信息及第四密钥衍生算法，生成下层密钥。
可选地，装置1900为统一数据管理实体，上层密钥为CK、IK，下层密钥为Kausf；通信单元1902，还用于向认证服务实体发送第四标识信息和Kausf。
可选地，装置1900为安全锚点实体，上层密钥为Kseaf，下层密钥为Kamf；通信单元1902，还用于向移动性管理功能实体发送第四标识信息和Kamf。
应理解，该网络侧网元可以用于实现本发明图16所示的实施例的密钥衍生算法的协商方法中由网络侧网元执行的步骤，相关特征可以参照上文，此处不再赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的本发明过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理 解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
本领域技术人员应明白，本申请的实施例可提供为方法、装置(设备)、计算机可读存储介质或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式，这里将它们都统称为“模块”或“系统”。
本申请是参照本申请的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本发明进行了描述，显而易见的，在不脱离本发明的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本发明的示例性说明，且视为已覆盖本发明范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (46)

  1. 一种密钥衍生算法的协商方法，其特征在于，包括：
    终端向存储功能实体发送第一密钥衍生算法，所述第一密钥衍生算法为所述终端支持的至少一个密钥衍生算法；
    所述终端接收来自所述存储功能实体的认证令牌，所述认证令牌包括第一消息鉴别码、第二密钥衍生算法以及第三密钥衍生算法，其中，所述第二密钥衍生算法为所述存储功能实体接收到的所述终端支持的至少一个密钥衍生算法，且所述第二密钥衍生算法包括所述第三密钥衍生算法，所述第一消息鉴别码是根据所述第二密钥衍生算法生成的；
    所述终端根据所述第二密钥衍生算法生成第二消息鉴别码；
    若所述第一消息鉴别码与所述第二消息鉴别码相同，且所述第一密钥衍生算法与所述第二密钥衍生算法相同，则所述终端获取所述第三密钥衍生算法作为所述终端的密钥衍生算法。
  2. 根据权利要求1所述的方法，其特征在于，所述第二密钥衍生算法携带于所述认证令牌的认证管理域。
  3. 一种密钥衍生算法的协商方法，其特征在于，包括：
    存储功能实体接收第二密钥衍生算法，所述第二密钥衍生算法为所述存储功能实体接收到的终端支持的至少一个密钥衍生算法；
    所述存储功能实体根据预设策略，从所述第二密钥衍生算法中选择第三密钥衍生算法，以及，根据所述第二密钥衍生算法生成第一消息鉴别码；
    所述存储功能实体向所述终端发送认证令牌，所述认证令牌包括所述第一消息鉴别码、所述第三密钥衍生算法以及所述第二密钥衍生算法。
  4. 根据权利要求3所述的方法，其特征在于，所述第二密钥衍生算法携带于所述认证令牌的认证管理域。
  5. 一种密钥衍生算法的协商方法，其特征在于，包括：
    若第一密钥衍生算法与第二密钥衍生算法不同，终端向移动管理功能实体发送第一消息，所述第一消息包含所述第一密钥衍生算法，所述第一密钥衍生算法为所述终端支持的至少一个密钥衍生算法，所述第二密钥衍生算法为所述移动管理功能实体或存储功能实体接收到的所述终端支持的至少一个密钥衍生算法；
    所述终端接收来自所述移动管理功能实体的第二消息，所述第二消息包括目标密钥衍生算法，其中，所述第一密钥衍生算法包括所述目标密钥衍生算法；
    所述终端将所述终端的密钥衍生算法更新为所述目标密钥衍生算法，并根据所述目标密钥衍生算法更新所述终端的密钥。
  6. 根据权利要求5所述的方法，其特征在于，所述目标密钥衍生算法包括来自存储功能实体的第一目标密钥衍生算法；
    所述终端根据所述目标密钥衍生算法，更新所述终端的密钥，包括：
    所述终端根据所述第一目标密钥衍生算法，更新所述终端的接入安全管理实体密钥。
  7. 根据权利要求6所述的方法，其特征在于，所述第二消息还包括来自所述存储 功能实体的第一随机数；
    所述终端根据所述第一目标密钥衍生算法，更新所述终端的接入安全管理实体密钥，包括：
    所述终端根据所述第一目标密钥衍生算法和所述第一随机数，更新所述接入安全管理实体密钥。
  8. 根据权利要求5至7中任一项所述的方法，其特征在于，所述目标密钥衍生算法包括来自所述移动管理功能实体的第二目标密钥衍生算法；
    所述终端根据所述目标密钥衍生算法，更新所述终端的密钥，包括：
    所述终端根据所述第二目标密钥衍生算法，更新用于所述终端和所述移动管理功能实体通信的第一密钥。
  9. 根据权利要求8所述的方法，其特征在于，所述第二消息还包括来自所述移动管理功能实体的第二随机数；
    所述终端根据所述第二目标密钥衍生算法，更新用于所述终端和所述移动管理功能实体通信的第一密钥，包括：
    所述终端根据所述第二目标密钥衍生算法和所述第二随机数，更新所述第一密钥。
  10. 根据权利要求5至9中任一项所述的方法，其特征在于，还包括：
    所述终端接收来自所述移动管理功能实体的非接入层NAS安全模式完成SMP消息，所述NAS SMP消息包括所述第二密钥衍生算法；
    所述终端确定所述第一密钥衍生算法与所述第二密钥衍生算法不同。
  11. 根据权利要求5至10中任一项所述的方法，其特征在于，
    所述第一消息为NAS SMP消息，所述第二消息为NAS安全模式命令SMC消息。
  12. 一种密钥衍生算法的协商方法，其特征在于，包括：
    网络侧节点接收来自终端的第一密钥衍生算法，所述第一密钥衍生算法为所述终端支持的至少一个密钥衍生算法；
    所述网络侧节点根据预设策略，从所述第一密钥衍生算法中选择目标密钥衍生算法；
    所述网络侧节点根据所述目标密钥衍生算法，更新所述网络侧节点中存储的密钥；
    所述网络侧节点向所述终端发送所述目标密钥衍生算法。
  13. 根据权利要求12所述的方法，其特征在于，所述网络侧节点根据所述目标密钥衍生算法，更新所述网络侧节点中存储的密钥，包括：
    所述网络侧节点生成随机数；
    所述网络侧节点根据所述随机数和所述目标密钥衍生算法，更新所述网络侧节点中存储的密钥；
    所述方法还包括：
    所述网络侧节点向所述终端发送所述随机数。
  14. 根据权利要求12或13所述的方法，其特征在于，
    所述网络侧节点为移动管理功能实体，所述网络侧节点中存储的密钥为所述终端的接入安全管理实体密钥；或者，
    所述网络侧节点为存储功能实体，所述网络侧节点中存储的密钥为用于所述终端和所述移动管理功能实体通信的第一密钥。
  15. 根据权利要求12或13所述的方法，其特征在于，所述网络侧节点为移动管理功能实体，在网络侧节点接收来自终端的第一密钥衍生算法之前，所述方法还包括：
    所述移动管理功能实体接收第二密钥衍生算法，所述第二密钥衍生算法为所述移动管理功能实体接收到的终端支持的至少一个密钥衍生算法；
    所述移动管理功能实体向所述终端发送非接入层NAS安全模式完成SMC消息，所述NAS SMC消息包括所述第二密钥衍生算法。
  16. 一种密钥衍生算法的协商方法，其特征在于，包括：
    终端向网络侧网元发送第一密钥衍生算法的第一标识信息，所述第一密钥衍生算法为所述终端支持的至少一个密钥衍生算法；
    所述终端接收第二密钥衍生算法的第二标识信息；
    所述终端根据上层密钥、所述第一标识信息及所述第二密钥衍生算法，生成下层密钥。
  17. 根据权利要求16所述的方法，其特征在于，所述终端根据上层密钥、所述第一标识信息及所述第二密钥衍生算法，生成下层密钥，包括：
    所述终端根据所述上层密钥、所述第一标识信息、所述第二标识信息及所述第二密钥衍生算法，生成所述下层密钥。
  18. 根据权利要求16所述的方法，其特征在于，所述上层密钥为加密密钥CK、完整性密钥IK，所述下层密钥为安全锚点密钥Kseaf；
    所述终端根据上层密钥、所述第一标识信息及所述第二密钥衍生算法，生成下层密钥，包括：
    所述终端根据CK、IK、所述第一标识信息及所述第二密钥衍生算法，生成认证服务密钥Kausf；以及，根据所述Kausf及所述第二密钥衍生算法，生成Kseaf；或者，
    所述终端根据CK、IK及所述第二密钥衍生算法，生成Kausf；以及，根据所述Kausf、所述第一标识信息及所述第二密钥衍生算法，生成Kseaf。
  19. 根据权利要求16所述的方法，其特征在于，所述上层密钥为Kseaf，所述下层密钥为非接入层加密密钥KNASenc，非接入层完整性保护密钥KNASint，基站密钥KgNB，非3GPP接入密钥Kn3iwf中的至少一个；
    所述终端根据上层密钥、所述第一标识信息及所述第二密钥衍生算法，生成下层密钥，包括：
    所述终端根据Kseaf、所述第一标识信息及所述第二密钥衍生算法，生成接入管理密钥Kamf；以及，根据所述Kamf及所述第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，
    所述终端根据Kseaf及所述第二密钥衍生算法，生成Kamf；以及，根据所述Kamf、所述第一标识信息及所述第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
  20. 一种密钥衍生算法的协商方法，其特征在于，包括：
    网络侧网元接收第三密钥衍生算法的第三标识信息，所述第三密钥衍生算法为所述网络侧网元接收到的终端支持的至少一个密钥衍生算法；
    所述网络侧网元根据预设策略，从所述第三密钥衍生算法中选择第四密钥衍生算法；
    所述网络侧网元根据所述第三标识信息、所述第四密钥衍生算法和上层密钥，生成下层密钥；
    所述网络侧网元向所述终端发送所述第四密钥衍生算法的第四标识信息。
  21. 根据权利要求20所述的方法，其特征在于，所述网络侧网元根据所述第三标识信息、所述第四密钥衍生算法和上层密钥，生成下层密钥，包括：
    所述网络侧网元根据所述上层密钥、所述第三标识信息、所述第四标识信息及所述第四密钥衍生算法，生成所述下层密钥。
  22. 根据权利要求20所述的方法，其特征在于，所述网络侧网元为统一数据管理实体，所述上层密钥为CK、IK，所述下层密钥为Kausf；所述方法还包括：
    所述网络侧网元向认证服务实体发送所述第四标识信息和所述Kausf。
  23. 根据权利要求20所述的方法，其特征在于，所述网络侧网元为安全锚点实体，所述上层密钥为Kseaf，所述下层密钥为Kamf；所述方法还包括：
    所述网络侧网元向移动性管理功能实体发送所述第四标识信息和所述Kamf。
  24. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于向存储功能实体发送第一密钥衍生算法，所述第一密钥衍生算法为终端支持的至少一个密钥衍生算法；
    所述通信单元，还用于接收来自所述存储功能实体的认证令牌，所述认证令牌包括第一消息鉴别码、第二密钥衍生算法以及第三密钥衍生算法，其中，所述第二密钥衍生算法为所述存储功能实体接收到的所述终端支持的至少一个密钥衍生算法，且所述第二密钥衍生算法包括所述第三密钥衍生算法，所述第一消息鉴别码是根据所述第二密钥衍生算法生成的；
    所述处理单元，用于根据所述第二密钥衍生算法生成第二消息鉴别码；
    若所述第一消息鉴别码与所述第二消息鉴别码相同，且所述第一密钥衍生算法与所述第二密钥衍生算法相同，则所述处理单元，还用于获取所述第三密钥衍生算法作为所述终端的密钥衍生算法。
  25. 根据权利要求24所述的装置，其特征在于，所述第二密钥衍生算法携带于所述认证令牌的认证管理域。
  26. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收第二密钥衍生算法，所述第二密钥衍生算法为所述存储功能实体接收到的终端支持的至少一个密钥衍生算法；
    所述处理单元，用于根据预设策略，从所述第二密钥衍生算法中选择第三密钥衍生算法，以及，根据所述第二密钥衍生算法生成第一消息鉴别码；
    所述通信单元，还用于向所述终端发送认证令牌，所述认证令牌包括所述第一消息鉴别码、所述第三密钥衍生算法以及所述第二密钥衍生算法。
  27. 根据权利要求26所述的装置，其特征在于，所述第二密钥衍生算法携带于所述认证令牌的认证管理域。
  28. 一种装置，其特征在于，包括：处理单元和通信单元；
    若第一密钥衍生算法与第二密钥衍生算法不同，所述通信单元，用于向移动管理功能实体发送第一消息，所述第一消息包含所述第一密钥衍生算法，所述第一密钥衍生算法为终端支持的至少一个密钥衍生算法，所述第二密钥衍生算法为所述移动管理 功能实体或存储功能实体存储功能实体接收到的所述终端支持的至少一个密钥衍生算法；
    所述通信单元，还用于接收来自所述移动管理功能实体的第二消息，所述第二消息包括目标密钥衍生算法，其中，所述第一密钥衍生算法包括所述目标密钥衍生算法；
    所述处理单元，用于将所述终端的密钥衍生算法更新为所述目标密钥衍生算法，并根据所述目标密钥衍生算法更新所述终端的密钥。
  29. 根据权利要求28所述的装置，其特征在于，所述目标密钥衍生算法包括来自存储功能实体的第一目标密钥衍生算法；
    所述处理单元，具体用于：
    根据所述第一目标密钥衍生算法，更新所述终端的接入安全管理实体密钥。
  30. 根据权利要求29所述的装置，其特征在于，所述第二消息还包括来自所述存储功能实体的第一随机数；
    所述处理单元，具体用于：
    根据所述第一目标密钥衍生算法和所述第一随机数，更新所述接入安全管理实体密钥。
  31. 根据权利要求28至30中任一项所述的装置，其特征在于，所述目标密钥衍生算法包括来自所述移动管理功能实体的第二目标密钥衍生算法；
    所述处理单元，具体用于：
    根据所述第二目标密钥衍生算法，更新用于所述终端和所述移动管理功能实体通信的第一密钥。
  32. 根据权利要求31所述的装置，其特征在于，所述第二消息还包括来自所述移动管理功能实体的第二随机数；
    所述处理单元，具体用于：
    根据所述第二目标密钥衍生算法和所述第二随机数，更新所述第一密钥。
  33. 根据权利要求28至32中任一项所述的装置，其特征在于，还包括：
    所述通信单元，还用于接收来自所述移动管理功能实体的非接入层NAS安全模式完成SMP消息，所述NAS SMP消息包括第二密钥衍生算法，所述第二密钥衍生算法为所述存储功能实体接收到的所述终端支持的密钥衍生算法；
    所述处理单元，还用于确定所述第一密钥衍生算法与所述第二密钥衍生算法不同。
  34. 根据权利要求28至33中任一项所述的装置，其特征在于，
    所述第一消息为NAS SMP消息，所述第二消息为NAS安全模式命令SMC消息。
  35. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收来自终端的第一密钥衍生算法，所述第一密钥衍生算法为所述终端支持的至少一个密钥衍生算法；
    所述处理单元，用于根据预设策略，从所述第一密钥衍生算法中选择目标密钥衍生算法；
    所述处理单元，还用于根据所述目标密钥衍生算法，更新网络侧节点中存储的密钥；
    所述通信单元，还用于向所述终端发送所述目标密钥衍生算法。
  36. 根据权利要求35所述的装置，其特征在于，所述处理单元，具体用于：
    生成随机数；
    根据所述随机数和所述目标密钥衍生算法，更新所述网络侧节点中存储的密钥；
    所述通信单元，还用于：
    向所述终端发送所述随机数。
  37. 根据权利要求35或36所述的装置，其特征在于，
    所述网络侧节点为移动管理功能实体，所述网络侧节点中存储的密钥为所述终端的接入安全管理实体密钥；或者，
    所述网络侧节点为存储功能实体，所述网络侧节点中存储的密钥为用于所述终端和所述移动管理功能实体通信的第一密钥。
  38. 根据权利要求35或36所述的装置，其特征在于，所述网络侧节点为移动管理功能实体；所述通信单元，还用于：
    接收第二密钥衍生算法，所述第二密钥衍生算法为所述移动管理功能实体接收到的终端支持的至少一个密钥衍生算法；
    向所述终端发送非接入层NAS安全模式完成SMP消息，所述NAS SMP消息包括所述第二密钥衍生算法。
  39. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于向网络侧网元发送第一密钥衍生算法的第一标识信息，所述第一密钥衍生算法为终端支持的至少一个密钥衍生算法；
    所述通信单元，还用于接收第二密钥衍生算法的第二标识信息；
    所述处理单元，用于根据上层密钥、所述第一标识信息及所述第二密钥衍生算法，生成下层密钥。
  40. 根据权利要求39所述的装置，其特征在于，所述处理单元，具体用于：
    根据所述上层密钥、所述第一标识信息、所述第二标识信息及所述第二密钥衍生算法，生成所述下层密钥。
  41. 根据权利要求39所述的装置，其特征在于，所述上层密钥为加密密钥CK、完整性密钥IK，所述下层密钥为安全锚点密钥Kseaf；
    所述处理单元，具体用于：根据CK、IK、所述第一标识信息及所述第二密钥衍生算法，生成认证服务密钥Kausf；以及，根据所述Kausf及所述第二密钥衍生算法，生成Kseaf；或者，根据CK、IK及所述第二密钥衍生算法，生成Kausf；以及，根据所述Kausf、所述第一标识信息及所述第二密钥衍生算法，生成Kseaf。
  42. 根据权利要求39所述的装置，其特征在于，所述上层密钥为Kseaf，所述下层密钥为非接入层加密密钥KNASenc，非接入层完整性保护密钥KNASint，基站密钥KgNB，非3GPP接入密钥Kn3iwf中的至少一个；
    所述处理单元，具体用于：根据Kseaf、所述第一标识信息及所述第二密钥衍生算法，生成接入管理密钥Kamf；以及，根据所述Kamf及所述第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个；或者，根据Kseaf及所述第二密钥衍生算法，生成Kamf；以及，根据所述Kamf、所述第一标识信息及所述第二密钥衍生算法，生成KNASenc，KNASint，KgNB，Kn3iwf中的至少一个。
  43. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收第三密钥衍生算法的第三标识信息，所述第三密钥衍生 算法为所述装置接收到的终端支持的至少一个密钥衍生算法；
    所述处理单元，用于根据预设策略，从所述第三密钥衍生算法中选择第四密钥衍生算法；以及，根据所述第三标识信息、所述第四密钥衍生算法和上层密钥，生成下层密钥；
    所述通信单元，还用于向所述终端发送所述第四密钥衍生算法的第四标识信息。
  44. 根据权利要求43所述的装置，其特征在于，所述处理单元，具体用于根据所述上层密钥、所述第三标识信息、所述第四标识信息及所述第四密钥衍生算法，生成所述下层密钥。
  45. 根据权利要求43所述的装置，其特征在于，所述装置为统一数据管理实体，所述上层密钥为CK、IK，所述下层密钥为Kausf；所述通信单元，还用于向认证服务实体发送所述第四标识信息和所述Kausf。
  46. 根据权利要求43所述的装置，其特征在于，所述装置为安全锚点实体，所述上层密钥为Kseaf，所述下层密钥为Kamf；所述通信单元，还用于向移动性管理功能实体发送所述第四标识信息和所述Kamf。
PCT/CN2018/100848 2017-09-27 2018-08-16 一种密钥衍生算法的协商方法及装置 WO2019062374A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18860899.6A EP3675544A4 (en) 2017-09-27 2018-08-16 PROCESS AND APPARATUS FOR NEGOTIATING A KEY DEVELOPMENT ALGORITHM
US16/821,103 US11627458B2 (en) 2017-09-27 2020-03-17 Key derivation algorithm negotiation method and apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201710890306.2 2017-09-27
CN201710890306 2017-09-27
CN201810265796.1A CN109560919B (zh) 2017-09-27 2018-03-28 一种密钥衍生算法的协商方法及装置
CN201810265796.1 2018-03-28

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/821,103 Continuation US11627458B2 (en) 2017-09-27 2020-03-17 Key derivation algorithm negotiation method and apparatus

Publications (1)

Publication Number Publication Date
WO2019062374A1 true WO2019062374A1 (zh) 2019-04-04

Family

ID=65864536

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/100848 WO2019062374A1 (zh) 2017-09-27 2018-08-16 一种密钥衍生算法的协商方法及装置

Country Status (4)

Country Link
US (1) US11627458B2 (zh)
EP (1) EP3675544A4 (zh)
CN (1) CN109560919B (zh)
WO (1) WO2019062374A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3077175A1 (fr) * 2018-01-19 2019-07-26 Orange Technique de determination d'une cle destinee a securiser une communication entre un equipement utilisateur et un serveur applicatif
CN111866884B (zh) * 2019-04-26 2022-05-24 华为技术有限公司 一种安全保护方法及装置
CN111866871B (zh) * 2019-04-29 2021-11-26 华为技术有限公司 通信方法和装置
CN112073177B (zh) * 2019-06-11 2022-02-08 大唐移动通信设备有限公司 密钥更新方法及装置
CN112825498B (zh) * 2019-11-01 2022-08-12 中国移动通信有限公司研究院 一种认证向量的生成方法、获取方法及设备
CN112585549B (zh) * 2020-02-29 2022-05-31 华为技术有限公司 一种故障诊断方法、装置及车辆
CA3185313A1 (en) * 2020-05-29 2021-12-02 Huawei Technologies Co., Ltd. Communications method and apparatus
CN113810903B (zh) * 2020-05-29 2023-07-11 华为技术有限公司 一种通信方法及装置
CN111726362A (zh) * 2020-06-23 2020-09-29 广东博智林机器人有限公司 信息的传输方法、信息的传输系统、第一设备和第二设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060085348A1 (en) * 2004-07-16 2006-04-20 Ns8 Corporation Method and system for managing the use of electronic works
CN104935426A (zh) * 2014-03-21 2015-09-23 华为技术有限公司 密钥协商方法、用户设备和近距离通信控制网元
CN105306406A (zh) * 2014-05-26 2016-02-03 中国移动通信集团公司 认证和密钥协商算法的协商方法、网络侧设备和用户设备
CN106899562A (zh) * 2016-04-21 2017-06-27 中国移动通信有限公司研究院 物联网的安全算法协商方法、网元及物联网终端

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AP2013006967A0 (en) * 2011-01-13 2013-07-31 Infosys Ltd System and method for accessing integrated applications in a single sign-on enabled enterprise solution
CN103313239B (zh) * 2012-03-06 2018-05-11 中兴通讯股份有限公司 一种用户设备接入融合核心网的方法及系统
EP3852413A1 (en) * 2013-11-01 2021-07-21 Huawei Technologies Co., Ltd. Key processing method in dual connectivity mode and device
US9608945B2 (en) * 2014-05-30 2017-03-28 Apple Inc. Sending messages to multiple receiving electronic devices using a message server
US9918225B2 (en) * 2014-11-03 2018-03-13 Qualcomm Incorporated Apparatuses and methods for wireless communication
US10277578B2 (en) * 2015-01-05 2019-04-30 Citrix Systems, Inc. Securing network activity managed by operating systems
CN104661217A (zh) * 2015-02-09 2015-05-27 哈尔滨工业大学深圳研究生院 基于td-lte网络的鉴权和密钥衍生方法及系统
CN105139204B (zh) * 2015-07-27 2019-07-12 飞天诚信科技股份有限公司 一种进行安全认证的方法和系统
CN106936570B (zh) * 2015-12-31 2021-08-20 华为技术有限公司 一种密钥配置方法及密钥管理中心、网元

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060085348A1 (en) * 2004-07-16 2006-04-20 Ns8 Corporation Method and system for managing the use of electronic works
CN104935426A (zh) * 2014-03-21 2015-09-23 华为技术有限公司 密钥协商方法、用户设备和近距离通信控制网元
CN105306406A (zh) * 2014-05-26 2016-02-03 中国移动通信集团公司 认证和密钥协商算法的协商方法、网络侧设备和用户设备
CN106899562A (zh) * 2016-04-21 2017-06-27 中国移动通信有限公司研究院 物联网的安全算法协商方法、网元及物联网终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3675544A4

Also Published As

Publication number Publication date
CN109560919B (zh) 2021-02-09
EP3675544A4 (en) 2021-03-03
US20200221297A1 (en) 2020-07-09
CN109560919A (zh) 2019-04-02
EP3675544A1 (en) 2020-07-01
US11627458B2 (en) 2023-04-11

Similar Documents

Publication Publication Date Title
CN109560919B (zh) 一种密钥衍生算法的协商方法及装置
CN109891920B (zh) 支持无线网络中的覆盖和资源受限设备的层2中继
WO2019096075A1 (zh) 一种消息保护的方法及装置
KR102304147B1 (ko) 통합된 스몰 셀 및 wi-fi 네트워크를 위한 통합 인증
JP6708626B2 (ja) 無線アクセス・ネットワークからセキュリティを提供する方法およびシステム。
US10911948B2 (en) Method and system for performing network access authentication based on non-3GPP network, and related device
CN108141754B (zh) 用于涉及移动性管理实体重定位的移动性过程的装置和方法
JP6639493B2 (ja) ワイヤレス通信のための装置および方法
EP3713271B1 (en) Method and device for requesting connection recovery
US8605904B2 (en) Security method in wireless communication system having relay node
JP6924848B2 (ja) 鍵生成方法、ユーザ機器、装置、コンピュータ可読記憶媒体、および通信システム
TWI717383B (zh) 用於網路切分的金鑰層級
US20170359719A1 (en) Key generation method, device, and system
US20200228977A1 (en) Parameter Protection Method And Device, And System
CN103428690B (zh) 无线局域网络的安全建立方法及系统、设备
CN110121196B (zh) 一种安全标识管理方法及装置
WO2013185735A2 (zh) 一种加密实现方法及系统
CN109803262B (zh) 一种网络参数的传输方法及装置
CN111464572B (zh) 一种会话配置方法及装置
EP2648437A1 (en) Method, apparatus and system for key generation
US20160219437A1 (en) Method and system for supporting security and information for proximity based service in mobile communication system environment
WO2021073382A1 (zh) 注册方法及装置
WO2023185960A1 (zh) 通信方法及装置
RU2781250C2 (ru) Способ формирования ключа, пользовательское оборудование, устройство, считываемый компьютером носитель данных и система связи
WO2019096265A1 (zh) 一种请求恢复连接的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18860899

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018860899

Country of ref document: EP

Effective date: 20200325

NENP Non-entry into the national phase

Ref country code: DE