WO2019096279A1 - 一种安全通信方法和装置 - Google Patents

一种安全通信方法和装置 Download PDF

Info

Publication number
WO2019096279A1
WO2019096279A1 PCT/CN2018/116041 CN2018116041W WO2019096279A1 WO 2019096279 A1 WO2019096279 A1 WO 2019096279A1 CN 2018116041 W CN2018116041 W CN 2018116041W WO 2019096279 A1 WO2019096279 A1 WO 2019096279A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
network
security context
identification information
network device
Prior art date
Application number
PCT/CN2018/116041
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
李欢
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18877474.9A priority Critical patent/EP3703311B1/en
Publication of WO2019096279A1 publication Critical patent/WO2019096279A1/zh
Priority to US16/874,064 priority patent/US11622268B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/06—Terminal devices adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/02—Data link layer protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems

Definitions

  • the embodiments of the present application relate to the field of communications technologies, and in particular, to a secure communication method and apparatus.
  • the main wireless access technologies include the 3rd Generation Partnership Project (3GPP) wireless access technology.
  • the access technology has evolved from 2G and has evolved from Long Term Evolution (LTE) (also known as 4G) technology to New Radio (NR) (also known as 5G) technology.
  • LTE Long Term Evolution
  • NR New Radio
  • 3GPP access technology and non-non-3GPP access technology are independent. Therefore, the handling of communication security is also independent and does not affect each other.
  • non-3GPP access technologies may access the core network of 3GPP in NR technology or future technologies. Therefore, further improvement in communication security processing is needed to improve terminal access through different wireless access technologies. Secure communication capability when entering a wireless network.
  • the embodiments of the present application provide a secure communication method and apparatus to improve the secure communication capability of a terminal when accessing a wireless network through different wireless access technologies.
  • the present application provides a secure communication method, which is applied to a terminal, where the terminal has a first security context and a second security context, where the first security context is used for the terminal to communicate with the first network, and the second security context For the terminal to communicate with the second network, and the first security context and the second security context include different first information
  • the method provided by the application includes: determining, by the terminal, the target security context according to the first information when communicating with the target network, Wherein, when the target network is the first network, the target security context is the first security context; or, when the target network is the second network, the target security context is the second security context; the terminal communicates with the target network according to the target security context.
  • the present application provides a secure communication method.
  • a terminal accesses different networks through different access technologies, for example, the first network and the second network
  • the different networks belong to the same carrier.
  • the different networks belong to different operators.
  • the prior art may have the following problem: the terminal device obtains the same key identifier from different networks, and usually the key identifier is used to identify the key.
  • the network can usually establish a security context using a key, combined with a preset algorithm and parameters such as NAS COUNT. Therefore, if the key identifiers obtained by the terminal from different AMFs are the same, the key determined by the terminal according to the key identifier may be The same is true.
  • the terminal When the terminal accesses the network again, the terminal cannot distinguish which security context is selected to communicate with the network that needs to be accessed. Based on this, in the present application, different first information is included in the first security context and the second security context that are provided on the terminal side, so that when the terminal communicates with the target network, the first information can be used to determine the communication with the target network.
  • the security context is required. For example, the terminal may determine to use the first security context when communicating with the first network according to the first information, and use the second security context when communicating with the second network, so that the terminal can correctly access the corresponding network.
  • the first information is at least one of key identification information and identity information of the terminal.
  • the identity information of the terminal is generated by the network that is accessed by the terminal.
  • the identity information of the terminal generated by the terminal is different. Therefore, the identity information of the terminal can be used to distinguish the first.
  • the security context and the second security context On the other hand, when the first network and the second network belong to the same operator, the network between the same operator can interact, and therefore, the key identifier between different networks and the terminal The information is different. Therefore, the first security context and the second security context can be distinguished by using the key identification information.
  • the first network and the second network belong to different operators, the network between different operators may not be available. When interacting, different networks may generate the same key identification information, so the first security context and the second security context may be further distinguished by the identity information of the terminal.
  • the first security context and the second security context further include different second information, and second The information is used to indicate the access technology of the first security context and the network to which the second security context is directed.
  • the second information included in the first security context may be an access technology of the first network
  • the second information included in the second security context may be an access technology of the second network
  • by using the first security context and the second security Having the second information indicating the access technology in the context may enable the terminal to determine which network the security context is for according to the technical access, so as to correctly access the corresponding network.
  • the first information is indication information, where the indication information is used in a security context Corresponding network access technology.
  • the first security context does not include an UP key
  • the second security context The UP key is included; or, the first security context includes an UP key, and the second security context does not include an UP key.
  • the UP key is usually included in the security context of the network, and when the terminal accesses through the Non-3GPP, the UP key may not be included in the security context. Therefore, the terminal may also use the UP.
  • the key distinguishes the network to which the security context is directed.
  • the application before the terminal communicates with the target network, the application further includes When the terminal registers with the first network, the terminal determines the first security context; when the terminal registers with the second network, the terminal determines the second security context.
  • the terminal determines the first security context, including: receiving, by the terminal, the first The first key identification information of the network device; the terminal generates a first security context including the first key identification information, where the first key identification information is used to identify the first security context.
  • the terminal determines the second security context, that: the terminal receives the second The second key identification information of the network device; the terminal generates a second security context including the second key identification information, and the second key identification information is used to identify the second security context.
  • the terminal receives the key identification information from the network device, including: the terminal Receiving, by the network device, a non-access stratum security mode command, a NAS SMC message, where the NAS SMC message includes the first key identifier information; or the terminal receives a message sent by the network device to indicate that the terminal is successfully authenticated, where the terminal uses The message indicating that the terminal is successfully authenticated includes the key identification information; or the terminal receives the NAS SMC message sent by the network device, where the NAS SMC message includes a message indicating that the terminal is successfully authenticated, and the message is used to indicate that the terminal is successfully authenticated. Includes key identification information.
  • the method provided by the application is further before the terminal communicates with the target network
  • the method includes: determining, by the terminal, whether the first identifier of the third network is the same as the first identifier of the target network, where the third network is a network that the terminal currently accesses.
  • the present application provides a secure communication method, including: a first network device acquiring key identification information, where key identification information is used to identify a security context; and when the first network device completes authentication of the terminal on the network side, The terminal sends the key identification information.
  • the acquiring, by the first network device, the key identification information includes: after the first network device receives the message indicating that the terminal is successfully authenticated, generating Key identification information.
  • the acquiring, by the first network device, the key identification information includes: receiving, by the first network device, The message indicating that the terminal is successfully authenticated, and the message indicating that the terminal is successfully authenticated includes the key identification information.
  • the method further includes: the first network device acquiring a plurality of key identifier sub-information, the plurality of key identifier sub-information being all from other network devices, or the plurality of key identifier sub-information portions being generated by the first network device, and partially from other networks
  • the device obtains the key identification information, and the first network device generates the key identification information according to the plurality of key identifier sub-information.
  • the first network device is an AMF or a SEAF.
  • the first network device is an AMF
  • the key identifier information includes: the first network device sends the key identifier information to the terminal by using the non-access stratum security mode to command the NAS SMC message.
  • the NAS SMC message includes a message for indicating that the terminal is successfully authenticated,
  • the message indicating that the terminal is successfully authenticated includes key identification information.
  • the first network device is an AUSF
  • the first network device obtains the key identifier.
  • transmitting the key identification information to the terminal the method includes: the first network device generates a message, including the key identification information, used to indicate that the terminal is successfully authenticated, and sends a message to the terminal to indicate that the terminal is successfully authenticated.
  • the application provides a device for secure communication
  • the device for secure communication can implement the secure communication method described in any one of the first aspect to the first aspect.
  • the device for secure communication may be a terminal or a chip disposed in the terminal.
  • the above method can be implemented by software, hardware, or by executing corresponding software through hardware.
  • the secure communication device has a first security context and a second security context, wherein the first security context means that the secure communication device communicates with the first network and the second security context is used for secure communication
  • the device is in communication with the second network, and the first security context and the second security context comprise different first information
  • the terminal comprising: a determining unit, configured to determine a target security context according to the first information when communicating with the target network, where When the target network is the first network, the target security context is the first security context; or, when the target network is the second network, the second security context is the second security context; and the communication unit is configured to perform the target security according to the determining unit
  • the context communicates with the target network.
  • the first information is at least one of key identification information and identity identification information of the terminal.
  • the first security context and the second security context further comprise different second information, the second information being used to indicate an access technology of the network to which the security context is directed.
  • the first information is indication information indicating that the information is used for an access technology of a network corresponding to the security context.
  • the first security context does not include an UP key
  • the second security context includes an UP key
  • the first security context includes an UP key and the second security context does not include an UP key
  • the determining unit is further configured to determine the first security context when the terminal registers with the first network, and to determine the second security context when the terminal registers with the second network.
  • the terminal further includes: a receiving unit, configured to receive first key identification information from the first network device; and a determining unit, configured to generate a first security context including the first key identification information The first key identification information is used to identify the first security context.
  • the receiving unit is further configured to receive second key identification information from the second network device, and the determining unit is further configured to generate a second security context including the second key identification information, where The key identification information is used to identify the second security context.
  • the receiving unit is configured to receive a non-access stratum security mode command NAS SMC message sent by the network device, where the NAS SMC message includes the first key identification information; or, the receiving unit is further configured to receive The non-access stratum security mode sent by the network device commands the NAS SMC message, and the NAS SMC message includes the first key identification information; or the receiving unit is configured to receive the NAS SMC message sent by the network device, where the NAS SMC message includes The message that the terminal is successfully authenticated, and the message indicating that the terminal is successfully authenticated includes the key identification information.
  • the determining unit is further configured to determine, before the terminal communicates with the target network, whether the first identifier of the third network is the same as the first identifier of the target network, and the third network is the network that the terminal currently accesses. .
  • the apparatus for secure communication can include at least one processor and a communication interface configured to support the apparatus for determining security capabilities to perform the method of any of the first aspect to the first aspect described above
  • Corresponding operation of message processing or control performed on the device side of the secure communication, communication interface, communication between the device supporting the secure communication and other network elements (for example, network devices), and the communication interface may be a transceiver circuit.
  • the transceiver circuit for supporting the secure communication performs the related operations of receiving and transmitting a message on the device side of the secure communication in the method described in any one of the first aspect to the first aspect.
  • the secure communication device may further include a memory, where the memory is configured to be coupled to the at least one processor, where the program (instructions) and data necessary for the secure communication device are saved.
  • the secure communication device may further include a bus, wherein the memory, the transceiver circuit, and the at least one processor are interconnected by a bus.
  • the application provides a network device, including: an obtaining unit, configured to acquire key identification information, where the key identification information is used to identify a security context, and a sending unit, configured to perform authentication on the terminal when the network side completes Send key identification information to the terminal.
  • the acquiring unit is configured to generate the key identification information after receiving the message for indicating that the terminal is successfully authenticated.
  • the device further includes: a receiving unit, configured to receive, to indicate that the terminal is successfully authenticated
  • the message, the message indicating that the terminal is successfully authenticated, includes key identification information.
  • the acquiring unit is configured to acquire multiple key identifier sub-information, multiple The key identifier sub-information is all from other network devices, or the plurality of key identifier sub-information portions are generated by the first network device, partly from other network devices; and used to generate key identification information according to the plurality of key identifier sub-information .
  • the first network device is an AMF or a SEAF.
  • the first network device is an AMF
  • the sending unit is specifically configured to pass The non-access stratum security mode commands the NAS SMC message to send key identification information to the terminal.
  • the NAS SMC message includes a message for indicating that the terminal is successfully authenticated,
  • the message for indicating that the terminal is successfully authenticated includes key identification information.
  • the first network device is an AUSF
  • the first network device acquires a key
  • the identifier information is sent to the terminal
  • the method includes: an obtaining unit, configured to generate a message, including the key identifier information, for indicating that the terminal is successfully authenticated, and a sending unit, configured to send, to the terminal, the terminal for authenticating the terminal The message of success.
  • the apparatus for secure communication can include at least one processor and a communication interface, the processor configured to support the apparatus for determining security capabilities to perform the method of any of the second aspect to the second aspect described above Corresponding operation of message processing or control performed on the device side of the secure communication, a communication interface for communicating between the device supporting the secure communication and other network elements (eg, terminals), the communication interface may be a transceiver, transmitting and receiving The apparatus for supporting the secure communication performs the related operation of receiving and transmitting a message on the apparatus side of the secure communication in the method described in any one of the second aspect to the second aspect.
  • the apparatus for supporting the secure communication performs the related operation of receiving and transmitting a message on the apparatus side of the secure communication in the method described in any one of the second aspect to the second aspect.
  • the secure communication device may further include a memory, where the memory is configured to be coupled to the at least one processor, where the program (instructions) and data necessary for the secure communication device are saved.
  • the memory, the transceiver and the at least one processor are interconnected by a line.
  • the present application provides a computer readable storage medium, wherein when the computer readable storage medium is applied to a terminal, the computer readable storage medium stores instructions, and when the instructions are executed, causes the computer to execute the first aspect to The secure communication method described in any of the first aspects.
  • the present application provides a computer readable storage medium, wherein when the computer readable storage medium is applied to a network device, the computer readable storage medium stores instructions for causing the computer to perform the second aspect when the instructions are executed The secure communication method described in any one of the second aspects.
  • the present application provides a chip system for use in a terminal, the chip system includes at least one processor and an interface circuit, the interface circuit and the at least one processor are interconnected by a line, and the processor is configured to execute an instruction stored in the chip system
  • the secure communication method described in any one of the first aspect to the first aspect is performed.
  • the present application provides a chip system, which is applied to a network device, where the chip system includes at least one processor and an interface circuit, the interface circuit and the at least one processor are interconnected by a line, and the processor is configured to be stored and stored in the chip system.
  • the chip system in this application further includes the at least one memory, where the at least one memory stores an instruction.
  • the present application provides a computer program product comprising instructions, wherein a computer program product stores instructions, when the instructions are executed, causing the terminal to perform any of the above aspects or any one of the possible aspects of the first aspect.
  • the present application provides a computer program product comprising instructions, wherein a computer program product stores instructions for causing a network device to perform any one of the above second aspect or the second aspect when the instruction is executed The secure communication method described in the design.
  • the present application provides a communication system comprising at least one terminal as described in the above third aspect or the fourth aspect, and at least one network device as described in the fifth aspect or the sixth aspect.
  • system may further include other devices that interact with the network device or the terminal in the solution provided by the embodiment of the present application.
  • FIG. 1 is a structural diagram of a communication system according to an embodiment of the present application.
  • FIG. 2 is a structural diagram of a communication system in which a terminal accesses through different networks according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart 1 of a method for providing secure communication according to the present application.
  • FIG. 4 is a schematic flowchart 2 of a method for secure communication provided by the present application.
  • FIG. 5 is a schematic flowchart 3 of a method for secure communication provided by the present application.
  • FIG. 6 is a schematic flowchart 4 of a method for secure communication provided by the present application.
  • FIG. 7 is a schematic flowchart 5 of a method for secure communication provided by the present application.
  • FIG. 8 is a schematic structural diagram 1 of a terminal provided by the present application.
  • FIG. 9 is a schematic structural diagram 2 of a terminal provided by the present application.
  • FIG. 10 is a schematic structural diagram 3 of a terminal provided by the present application.
  • FIG. 11 is a schematic structural diagram 1 of a network device provided by the present application.
  • FIG. 12 is a schematic structural diagram 2 of a network device provided by the present application.
  • FIG. 13 is a schematic structural diagram 3 of a network device according to the present application.
  • FIG. 14 is a schematic structural diagram of a chip system provided by the present application.
  • At least one refers to one or more, and "a plurality” refers to two or more.
  • "and/or" describing the association relationship of the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, A and B exist at the same time, and B exists separately, where A, B can be singular or plural.
  • the character "/” generally indicates that the contextual object is an "or” relationship.
  • “At least one of the following” or a similar expression thereof refers to any combination of these items, including any combination of a single item or a plurality of items.
  • a, b, or c may represent: a, b, c, ab, ac, bc, or abc, where a, b, c may be single or multiple .
  • the words “first”, “second”, and the like are used to distinguish the same items or similar items whose functions and functions are substantially the same. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the number and execution order, and the words “first”, “second” and the like are not necessarily limited.
  • the network architecture and the service scenario described in the embodiments of the present application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation of the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.
  • FIG. 1 is a structural diagram of a communication system provided by an embodiment of the present application.
  • the communication system includes a core network 101 and an access network (AN) 102.
  • the terminal 103 accesses the service network through the access network 102, and obtains services of the external network (for example, the Internet) through the service network, or communicates with other terminals through the service network.
  • the AN 102 can be an access network that uses different access technologies.
  • access technologies include wireless access technologies and fixed network access technologies.
  • wireless access technologies mainly include two types: 3rd Generation Partnership Project (3GPP) access technologies (for example, 2G, The wireless access technology used in 3G, 4G or 5G systems) and the non-3rd Generation Partnership Project (non-3GPP) access technology.
  • 3GPP 3rd Generation Partnership Project
  • 2G The wireless access technology used in 3G, 4G or 5G systems
  • non-3GPP non-3rd Generation Partnership Project
  • the 3GPP access technology refers to an access technology that complies with the 3GPP standard.
  • the access network that uses the 3GPP access technology is called a radio access network (RAN).
  • RAN radio access network
  • the terminal 103 can use the 3GPP access technology.
  • the access network device may be a base station.
  • the access network device in the 5G system is called a next generation node base station (gNB) and an evolved node B ( Evolved Node B, eNB), etc.
  • gNB next generation node base station
  • eNB evolved node B
  • the non-3GPP access technology refers to a radio access technology that does not comply with the 3GPP standard specifications, for example, an air interface technology represented by wireless fidelity (WIFI), where the access network device can be an access point (access point) , AP).
  • WIFI wireless fidelity
  • the terminal 103 When the terminal 103 accesses the wireless network through different access technologies, the terminal 103 can connect different core network devices through different access network devices.
  • a long-term key and a correlation function are stored in the terminal 103.
  • the terminal 103 performs bidirectional authentication with the core network device, the long-term key and the correlation function are used to verify the authenticity of the network.
  • the core network 101 may include multiple entities, such as an access and mobility management function (AMF) entity 1011, a Security Anchor Function (SEAF) entity 1012, and an Authentication Server Function (AUSF). Entity 1013, etc.
  • AMF access and mobility management function
  • SEAF Security Anchor Function
  • AUSF Authentication Server Function
  • the entities in the core network 101 may be physically or partially integrated or may be separately arranged.
  • the SEAF1012 can be integrated with the AMF1011 or it can be arranged separately.
  • the SEAF 1012 is mainly responsible for initiating an authentication request to the AUSF 1013, and can also complete the authentication of the terminal 103 by the network side in the authentication process.
  • the AUSF 1013 is responsible for verifying the authenticity of the parameters to be authenticated and the authentication terminal. For example, the authentication request sent by the SEAF 1012 is received; the authentication method is selected; and the authentication of the terminal 103 by the network side is completed.
  • the core network may also include other entities, such as a unified data management (UDM) entity, a session management function (SMF) entity, a user plane function (UPF) entity, and a policy.
  • UDM unified data management
  • SMF session management function
  • UPF user plane function
  • PCF policy control function
  • AF application function
  • NEF network exposure function
  • DN data network
  • the UDM is used to store the subscription information of the terminal; the SMF is used to allocate the session resources to the user plane; the UPF is the user plane data exit, and is connected to the external network; the PCF internally stores the latest quality of service (QoS). Rules, the access network device can allocate appropriate resources for the user plane transmission channel according to the QoS rules provided by the SMF.
  • QoS quality of service
  • this network element is located inside the DN and belongs to the function network element deployed in the third party.
  • the main purpose of this AF is to inform the PCF of the latest third-party enterprise's business requirements for an application.
  • the PCF can generate corresponding QoS rules according to requirements to ensure that the services provided by the network meet the requirements of the third party.
  • NEF is mainly used to interact with third parties, so that third parties can interact with network elements inside certain 3GPP networks indirectly.
  • the terminal 103 communicates with the AMF 1011 through the N1 interface, the AN communicates with the UPF through the N3 interface, the UPF communicates with the DN through the N6 interface, and the UPF communicates with the SMF through the N4 interface, which needs to be described between the various network elements in FIG.
  • the interface name is only an example.
  • the interface name may be other names in the specific implementation, which is not specifically limited in this embodiment of the present application.
  • a terminal may also be called a terminal device, a user equipment (UE), an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, and a wireless communication device. , user agent or user device.
  • UE user equipment
  • the terminal device may be a station (STA) in a wireless local area network (WLAN), and may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, or a wireless local loop (wireless local Loop, WLL) station, personal digital assistant (PDA) device, handheld device with wireless communication capabilities, computing device or other processing device connected to a wireless modem, in-vehicle device, wearable device, and next-generation communication system, For example, a terminal device in a fifth-generation (5G) communication network or a terminal device in a public land mobile network (PLMN) network that is evolving in the future.
  • 5G fifth-generation
  • PLMN public land mobile network
  • the terminal may also be a wearable device.
  • a wearable device which can also be called a wearable smart device, is a general term for applying wearable technology to intelligently design and wear wearable devices such as glasses, gloves, watches, clothing, and shoes.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are more than just a hardware device, but they also implement powerful functions through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-size, non-reliable smartphones for full or partial functions, such as smart watches or smart glasses, and focus on only one type of application, and need to work with other devices such as smartphones. Use, such as various smart bracelets for smart signs monitoring, smart jewelry, etc.
  • FIG. 2 is a schematic diagram showing an architecture of a terminal accessing a network by using different radio access technologies in an embodiment of the present application, for example, an architecture in which a terminal simultaneously uses a 3GPP access technology and a non-3GPP access technology.
  • the terminal can connect to different AMFs or SEAFs through the 3GPP access technology and the non-3GPP access technology at the same time.
  • the terminal accesses the AMF/SEAF 201 and the terminal through the 3GPP access technology.
  • the AMF/SEAF 202 is accessed through a non-3GPP access technology.
  • different AMFs or SEAFs can usually correspond to different SMFs or corresponding SMFs. Specifically, when different AMFs belong to the same network, different AMF or SEAF can usually correspond to the same SMF. When different AMFs belong to different networks, different AMFs or SEAFs can usually correspond to different SMFs. Different SMFs can correspond to different UPFs, and can also correspond to the same UPF. The UPF can correspond to different DNs, and can also correspond to the same DN. Specifically, as shown in FIG.
  • the terminal when the terminal accesses the AMF 202 by using the non-3GPP access technology, the terminal can access the AMF 202 through a non-3GPP interworking function (N3IWF) entity.
  • N3IWF non-3GPP interworking function
  • the AUSF and the authttication repository function (ARPF)/UDM constitute a Home Public Land Mobile Network (HPLMN).
  • HPLMN Home Public Land Mobile Network
  • the terminal may have different The visited public land mobile network (VPLMN) may also have the same public land mobile network of the visited area.
  • the public land mobile network of different visited places is taken as an example, for example,
  • the functions of the respective network elements shown in FIG. 2 can be referred to the foregoing embodiments, and the details are not described herein again.
  • FIG. 3 shows a secure communication method provided by the present application, which is applied to a terminal having a first security context and a second security context, wherein the first security context is used for the terminal to communicate with the first network, and the second The security context is used by the terminal to communicate with the second network, and the first security context and the second security context include different first information, as shown in FIG. 3, including:
  • the terminal determines a target security context according to the first information when the terminal communicates with the target network, where the target network is the first network, the target security context is the first security context, or the target network is the second network, and the target security context is Second security context.
  • the terminal communicates with the target network according to the target security context.
  • the present application provides a secure communication method.
  • a terminal accesses different networks through different access technologies, for example, the first network and the second network
  • the different networks belong to the same carrier.
  • the different networks belong to different operators.
  • the prior art may have the following problem: the terminal device obtains the same key identifier from different networks, and usually the key identifier is used to identify the key.
  • the network can usually establish a security context using a key, combined with a preset algorithm and parameters such as NAS COUNT. Therefore, if the key identifiers obtained by the terminal from different AMFs are the same, the key determined by the terminal according to the key identifier may be The same is true.
  • the terminal When the terminal accesses the network again, the terminal cannot distinguish which security context is selected to communicate with the network that needs to be accessed. Based on this, in the present application, different first information is included in the first security context and the second security context that are provided on the terminal side, so that when the terminal communicates with the target network, the first information can be used to determine the communication with the target network.
  • the security context is required. For example, the terminal may determine to use the first security context when communicating with the first network according to the first information, and use the second security context when communicating with the second network, so that the terminal can correctly access the corresponding network.
  • the access technologies used by the first network and the second network may be any two of a fixed network access technology, a 3GPP access technology, and a non-3GPP access technology.
  • the access technology of the first network may be a 3GPP access technology
  • the access technology of the second network may be a non-3GPP access technology
  • the access technology of the first network may be a non-3GPP access technology
  • the access technology of the second network may be a 3GPP access technology.
  • the access technology of the first network is a 3GPP access technology
  • the access technology of the second network is a fixed network access technology.
  • the access technology of the first network is a non-3GPP access technology
  • the access technology of the second network is a fixed network access technology.
  • the first security context is a security context determined when the terminal communicates with the first network
  • the second security context is a security context determined when the terminal communicates with the second network.
  • the security context refers to parameters used by the terminal and the network side to protect messages transmitted between the terminal and the network.
  • NAS non-access stratum
  • the first information may be at least one of key identification information and identity information of the terminal.
  • the key identification information is information obtained by the terminal and used to identify the key.
  • the terminal may obtain the key identification information from the network side.
  • the key identification information may be an echo key set identifier (eKSI) in a 4G network.
  • eKSI echo key set identifier
  • the identity information of the terminal may be temporary identity information of the UE, where the temporary identity information includes at least identity information of the core network element, and may also include carrier network information.
  • it can be a globally unique temporary identity (GUTI).
  • the GUTI may be sent to the terminal by the AMF in the network along with the registration completion message when the terminal requests registration to the network.
  • the identity information of the terminal may also be a 4G network temporary identity information (S-TMSI).
  • S-TMSI 4G network temporary identity information
  • the first information may be key identification information.
  • Table 1 shows that the security context can include not only the key identification information but also the identity information of the terminal, the NAS key, the algorithm, the freshness parameter used by the NAS layer, and the radio resource control.
  • Control At least one of a parameter such as an RRC key, an algorithm, and an access parameter used by an Access stratum (AS) layer.
  • the NAS key is used to protect the NAS message, and the NAS freshness parameter is used to prevent the NAS message from being replayed.
  • the RRC key and RRC algorithm are used to protect the RRC message of the air interface.
  • the key identification information in the terminal can be obtained from the network device in the network when the terminal registers with a network, so the terminal can save an association relationship between the key identification information and the network, so that the terminal can be based on the security context.
  • the key identification information in the determination determines which network to communicate with using the security context.
  • the security context 1 includes the first key identification information
  • the second security context includes the second key identification information, which is exemplary, so that the terminal accesses a network A next time, if the terminal
  • the security context between the networks A is the security context 1, and the terminal can select the security context 1 to communicate with the network A according to the first key identification information.
  • the identity identification information of the terminal carried in different security contexts may be the same or different.
  • the key identification information is different in Table 1, the terminals carried in different security contexts are different.
  • the identity information is different for example.
  • the first information may be the identity information of the terminal, as shown in Table 2:
  • the terminal can use GUTI1 and GUTI2 to distinguish between security context 1 and security context 2.
  • the security context 1 is the security context between the terminal and the network 1
  • the security context 2 is the terminal and the network 2.
  • the key identification information in different security contexts may be the same or different, and the present application does not limit this, and the identification information of the terminal in Table 2 is not At the same time, the key identification information in different security contexts is the same, and does not constitute a limitation on the present application.
  • the identity information of the terminal can be allocated to the terminal through the network device in the network accessed by the terminal.
  • the network device accessed by the terminal belongs to the same operator, the network device accessed by the terminal is allocated to the terminal.
  • the identity information of the terminal is often different. In this case, the identity information of the terminal can also be used to distinguish the security context.
  • the network devices that the terminal accesses belong to different operators
  • the network devices of different operators may not be able to exchange the identity information of the terminals that match each other.
  • the identity information of the terminal allocated by the terminal is the same. Therefore, in this case, the security context can be distinguished by combining different key identification information and identity identification information of the terminal.
  • the network devices of different operators can interact with each other, and the identity information of the terminals allocated by the different network devices for the terminal is different, the identity information of the terminal may be separately used to distinguish the security context.
  • the key identification information at this time can distinguish which network the security context belongs to.
  • the terminal may further distinguish different security contexts by combining the key identification information and the identity identification information of the terminal. For example, when the identity information of the terminal is the same, the key identification information is used to distinguish different security contexts. When the key identification information is the same, the identity information of the terminal can be used to distinguish different security contexts.
  • the terminal can further distinguish the security context with different networks by:
  • the first security context and the second security context further include different second information, where the second information is used to indicate an access technology of the network corresponding to the security context.
  • the content of the second information may be multiple.
  • the second information may be a first indicator or a second indicator.
  • the first indicator is used to indicate that the terminal accesses the network by using the first access technology
  • the second indicator is used to indicate that the terminal accesses the network by using the second access technology, where the first access technology and the second access
  • the first access technology and the second access technology are any two of the non-3GPP access technologies, the 3GPP access technologies, and the fixed network access technologies.
  • the indicator can be bit indication information.
  • the first indicator may be 00, indicating that the terminal uses the 3GPP access technology
  • the second indicator is 01 indicating that the terminal uses the non-3GPP access technology
  • 10 indicates that the terminal uses the fixed network access end, or the first indicator. 01 indicates that the terminal uses the non-3GPP access technology
  • the second indicator is 00 using the 3GPP access technology
  • 10 indicates that the terminal uses the fixed network access.
  • the terminal and the network may The contents of the first indicator and the second indicator are negotiated.
  • the indicator can be string information.
  • 3GPP indicates a 3GPP access technology
  • non-3GPP indicates a non-3GPP access technology
  • suffi indicates a fixed network access technology.
  • each security context may further include second information for identifying an access technology when the terminal accesses the network in the previous time, that is, an access technology when the terminal requests to access the network when generating the security context.
  • second information for example, as shown in Table 3:
  • Table 3 uses access technology to distinguish security contexts
  • the terminal when the terminal accesses the network 1 by using the 3GPP access technology, the terminal may use the string "3GPP" identifier in the security context shared with the network 1, that is, the security context 1, and the terminal uses non.
  • the security context 3 including the string "non-3GPP" identifier in the security context shared with the network 2 will be used, that is, the security context includes the string "non-3GPP”.
  • the terminal when the terminal accesses a network by using the fixed network access technology, the terminal may use the "fix" identifier in the security context before the network. Or the terminal uses the bit identifier 01 to indicate 3GPP, and 10 to indicate non-3GPP, and 11 identifies the fixed network access technology, which is not limited in this application.
  • the first information in the first security context and the second security context may be the same.
  • the security context 2 and the security context 3 differ in that the key identification information is different, and the freshness parameters are different, and the others may be the same.
  • the network device can send the same key for the terminal, for example, NAS key-1, and N3IWF key-1, but NAS COUNT different.
  • NAS COUNT is a kind of freshness parameter.
  • the security context when the terminal stores a user plane (UP) key, when the terminal accesses the network through the 3GPP access technology, the security context exists between the terminal and the network. key.
  • the security context between the terminal and the network may not include the UP key. Therefore, the security context used by the 3GPP access technology and the non-3GPP access technology can also be distinguished in the present application by the UP key included in the security context.
  • the first security context does not include an UP key, it may be a security context saved when the terminal accesses the network through the non-3GPP access technology.
  • the second security context includes an UP key, which may be a security context saved when the terminal accesses the network through the 3GPP access technology.
  • the first security context includes an UP key
  • the second security context does not include an UP key.
  • the terminal may determine that the first security context is used by the terminal to access the network through the non-3GPP access technology, so that the terminal uses the non-3GPP access technology again.
  • the first security context can be used when accessing the network.
  • the terminal determines that the second security context includes the UP key, the terminal can determine that the second security context can be used for 3GPP access, so that the second security context can be used when the terminal accesses the network again using the 3GPP access technology.
  • the UP key refers to a key for protecting the security of the user plane when the terminal communicates with the network device, including one or all of the user plane encryption key and the user plane integrity protection key.
  • the security context does not include the UP key. It means that the UP key does not need to be generated during the access to the target network. However, the following situation is not excluded: the terminal has accessed the target network through the 3GPP access technology, and the saved security context has an UP key.
  • the identifiers of the UP key, the identity information of the terminal, the key identifier information, and the access technology may be used in combination to distinguish the security context.
  • the specific combination manner is not limited in this application. As long as the security context between the final terminal and the different networks can be distinguished by using the identification parameters.
  • the key identification information in the application may further include identifier information of the operator.
  • the terminal receives the information of the operator through the broadcast message or knows which carrier information the target network belongs to by other methods, for example, after the information of the operator to which the N3IWF is to be used, the terminal can obtain the information according to the carrier.
  • the key identification information corresponding to the operator is determined, and the used key is determined according to the key identification information corresponding to the operator, and then the message to be sent is integrity-protected by using the determined key.
  • the terminal after the terminal accesses the network simultaneously with two different access technologies to complete the data transmission, the terminal usually returns to the idle state. However, when the terminal returns from the Idle state to the connected state, the terminal first determines which GUTI satisfies the network according to the information in the GUTI according to the information of the network where the terminal is located, and after determining the GUTI, determines the key according to the GUTI, as shown in Table 2 or As shown in Table 3, the terminal can then use the key pair to perform integrity protection on the message to be sent. Alternatively, the terminal first determines the security context information according to the key identification information with the operator information, and then determines the GUTI belonging to the operator. At this point, optionally, the GUTI can be part of a security context.
  • the terminal may also determine which type of access technology to access, and then determine the key. Further, optionally, the terminal may further determine which set of security contexts to use based on other information. For example, if there is a user plane key, there is no clear indication of which security technology the access technology is. After the key is determined, the message to be sent can be integrity protected.
  • the terminal needs to be registered in a network to establish a security context with the network, so as to save the security context with the network in the terminal. Therefore, as another embodiment provided by the present application, as shown in the figure As shown in FIG. 4, before the step S101, the method provided by the present application further includes:
  • the terminal determines the first security context.
  • Step S103 can be specifically implemented by:
  • S1031 The terminal receives first key identification information from the first network device.
  • the terminal may receive a message that is sent by the first network device to indicate that the terminal is successfully authenticated, and the message that is used to indicate that the terminal is successfully authenticated includes the first key identifier information.
  • the first network device may send the key identification information after determining that the terminal successfully authenticates, thereby avoiding The signaling is wasted because the key identification information is sent when the terminal is not successfully authenticated.
  • the terminal may receive a non-access stratum (NAS) security mode command (SMC) message sent by the first network device, where the NAS SMC message includes the first key identification information.
  • NAS non-access stratum
  • SMC security mode command
  • the NAS SMC message may further include a message for indicating that the terminal is successfully authenticated, that is, the message for indicating the terminal authentication success and the first key identifier may be used.
  • the information is carried in the NAS SMC message, which saves signaling overhead.
  • the terminal may receive the NAS SMC message sent by the first network device, where the NAS SMC message includes a message indicating that the terminal is successfully authenticated, and the message indicating that the terminal is successfully authenticated includes the first key identifier. information.
  • the first network device sends the first key identification information to the terminal through the NAS SMC message, and the first key identification information is located in the message for indicating that the terminal is successfully authenticated, the signaling overhead can be saved, which can be understood.
  • the manner in which the first network device sends the first key identification information through the NAS SMC message is applicable to 5G-AKA authentication, EAP-AKA' authentication, and other future authentication methods for the 3GPP system.
  • the authentication method may include an Evolved Packet System (EPS)-Authentication and Key Agreement (AKA) authentication, a 5G-AKA authentication, or an Extensible Authentication Protocol (Extensible Authentication). Protocol, EAP)-AKA' authentication, etc., taking EAP-AKA authentication as an example, the message indicating that the terminal is successfully authenticated may be referred to as an EAP-Success message, for example. This name is for example only and is not limiting.
  • EPS Evolved Packet System
  • AKA Extensible Authentication Protocol
  • the first network device may send the first key identification information to the terminal by using a message for transmitting an authentication vector or a message or an authentication vector for indicating that the terminal is successfully authenticated.
  • the message indicating that the terminal is successfully authenticated may be multiple, for example, implicitly, that is, after verifying the success of the terminal, the SEAF sends certain parameters to the AMF, such as sending a permanent identifier (SUPI). , or send the key Kamf.
  • the displayed notification that is, the SEAF directly sends an authentication success message to the AMF, such as a message sent by the SEAF to the AMF in the 5G AKA authentication method, or an EAP-Success message in the EAP-AKA 'authentication method.
  • an authentication success message such as a message sent by the SEAF to the AMF in the 5G AKA authentication method, or an EAP-Success message in the EAP-AKA 'authentication method.
  • it can also be used to indicate the success of the terminal authentication in the 5G-AKA authentication.
  • S1032 The terminal generates a first security context that includes first key identification information, where the first key identification information is used to identify the first security context.
  • step S104 in the present application may be specifically implemented in the following manner:
  • S1041 The terminal receives second key identification information from the second network device.
  • the second network device may send the second key identification information to the terminal by using an authentication vector or a message indicating that the terminal is successfully authenticated.
  • the message for indicating the success of the terminal authentication is the same as the above description, and details are not described herein again.
  • S1042 The terminal generates a second security context that includes second key identification information, where the second key identification information is used to identify the second security context.
  • the process of the terminal generating the first security context may be as follows:
  • the terminal may generate the first security context by combining the parameters in Table 1, Table 2, and Table 3. Specifically, the process of the second security context is generated by the terminal, and the process of generating the first security context is not described herein.
  • the first security context may further include other parameters, and specific parameters may refer to some parameters shown in Table 1, Table 2, and Table 3.
  • the first security context may also include the identity information of the terminal, the access technology used by the terminal, and the like, which is not limited in this application.
  • the first network device when the terminal accesses the first network by using the 3GPP access technology, the first network device may be the AMF 201 as shown in FIG. 2, and the terminal accesses the non-3GPP access technology.
  • the second network device may be the AMF 202 as shown in FIG. 2.
  • the terminal when the terminal registers with a network, the terminal usually has an authentication process with the network. Specifically, the terminal may complete the authentication process of the terminal on the network side or after the network side completes the authentication of the terminal, Key identification information is obtained in the network device of the network.
  • the first network device and the second network device belong to the same operator, the first network device can interact with the second network device, and therefore the first key that the first network device sends to the terminal.
  • the identification information and the second key identification information sent by the second network device to the terminal are generally different.
  • the first network device and the second network device belong to different operators, the first network device and the second network device cannot interact with each other.
  • the first key identification information and the second key identification information may be the same or different.
  • the terminal receives the first key identification information from the first network device, and receives the second key identification information from the second network device, and receives the first identity identification information from the first network device, and receives the first identity information from the second network device.
  • Two identity information The first key identification information is used to identify the first security context, and the second key identification information is used to identify the second security context.
  • the first identity information is used to identify the terminal in the first network, and the second identity is used to identify the terminal in the second network.
  • the first key identification information and the second key identification information are different when the network used by the first security context and the second security context is distinguished by the key identification information. When the first security context and the second security context are distinguished by the identity information, the first identity information and the second identity information are different.
  • the method before step S101, the method further includes:
  • the terminal determines whether the network that the terminal has accessed is the same as the first identifier of the target network that the terminal currently requests to register.
  • the access access network of the terminal is different from the access technology of the target network that the terminal currently requests to register.
  • the first identifier is used to determine whether the network that the terminal has accessed and the target network that the terminal currently requests to register belong to the same carrier.
  • the first identifier may be a public land mobile network (PLMN) ID, a cell ID, location area information, and the like.
  • PLMN ID may be an IP address, may be an address information similar to email, or may be a mobile country codes (MNN) + mobile network codes (MNC) information. Not limited.
  • the terminal determines, according to the first identifier, whether the accessed network and the target network to which the terminal is currently requested to belong to the same operator are as follows: the terminal acquires the PLMN ID-1 of the accessed network, and currently requests registration. The PLMN ID-2 of the target network. The terminal determines that the PLMN ID-1 of the accessed network is the same as the PLMN ID-2 of the target network to which the current request is registered. The terminal determines that the accessed network and the target network to which the terminal is currently requesting registration belong to the same operator.
  • the terminal can send a request for the target network to which the current request is registered to the network device 1 corresponding to the accessed network, and the network device 1 sends a request for the target network to which the current request is registered to the network device 2 of the target network.
  • the target network is the network that has been accessed.
  • FIG. 5 is a schematic flowchart of a secure communication method according to an embodiment of the present application. As shown in FIG. 5, the method includes:
  • the first network device acquires key identification information.
  • the first network device may be the AMF, AUSF or SEAF shown in FIG. 1 or FIG. 2.
  • the first network device may generate the key identification information when the network side completes the authentication of the terminal, and may also generate the key identification information in the process of authenticating the terminal on the network side.
  • the first network device After completing the authentication of the terminal on the network side, the first network device sends the key identification information to the terminal.
  • the first network device may determine that the network side completes the authentication of the terminal, for example, on the one hand, when the first network device is an AUSF, the first network device completes authentication of the terminal, and based on this, The first network device can determine that the network side completes the authentication of the terminal.
  • the first network device is the AMF, and the first network device receives the message sent by the AUSF or the SEAF to indicate that the terminal is successfully authenticated
  • the first network device determines that the network side completes the authentication of the terminal.
  • the first network device is the SEAF, and the first network device receives the message sent by the AUSF to indicate that the terminal is successfully authenticated
  • the first network device determines that the network side completes the authentication of the terminal.
  • step S202 in this application may be implemented in the following manner:
  • the first network device may send the key identification information to the terminal by using a message for indicating that the terminal is successfully authenticated.
  • the key identifier information is sent to the terminal by using the message for indicating the success of the terminal authentication, and the key identifier information may be sent after the terminal is successfully authenticated, thereby avoiding sending the key due to the terminal not successfully authenticating the terminal.
  • the signaling is wasted.
  • the first network device may send the key identification information to the terminal by using a signaling message newly defined in the process of indicating that the terminal is successfully authenticated.
  • the newly defined one signaling message may be regarded as a message used in the authentication process, and the message belongs to a message in the 5G AKA or EAP-AKA 'authentication; or may be understood as the first after the authentication succeeds.
  • the network device sends a message before the NAS SMC, the message is not in the message of the 5G AKA or EAP-AKA'; or may be a bearer message carrying a message indicating that the terminal is successfully authenticated.
  • the bearer message is a NAS message delivered through the N2 interface.
  • the key identifier information may be carried in the message indicating that the authentication succeeds, or is sent to the terminal in addition to the message indicating that the authentication succeeds, along with the newly defined signaling.
  • the message indicating that the terminal is successfully authenticated may be sent by the NAS SMC message, so that the key identification information is carried in the message indicating that the terminal is successfully authenticated, and the message indicating that the terminal is successfully authenticated is carried in the NAS SMC. In the message, it can also be carried in the NAS SMC message in addition to the message indicating successful authentication.
  • the AMF sends key identification information through the NAS SMC message for 5G AKA authentication or EAP-AKA' authentication or other future authentication procedures for the 3GPP system.
  • step S202 in this application may also be implemented in the following manner:
  • the first network device sends the key identification information to the terminal by using the NAS SMC message.
  • the NAS SMC message may further include a message for indicating that the terminal is successfully authenticated.
  • signaling can be saved by placing a message for indicating terminal authentication success in the NAS SMC, because the NAS SMC message and the message indicating that the terminal is successfully authenticated are sent in the form of two messages.
  • the terminal receives the NAS SMC message and the message indicating that the terminal is successfully authenticated, the terminal responds to each message, which inevitably increases the signaling overhead, and also increases the interaction process between the AMF and the terminal. .
  • the first network device in the application may also send the key to the terminal in the process of sending the authentication vector to the terminal.
  • Identification information For example, the key identification information is transmitted to the terminal using an EAP-request (REQ)/AKA'-Challenge message.
  • EAP-AKA' in the present application can also be applied to 5G AKA. If there is no flow in EAP-AKA' in the 5G AKA, similar or related messages can be replaced in the 5G AKA. Of course, the corresponding process can also be added to the 5G AKA to complete the related operations.
  • the terminal receives the key identification information sent by the first network device.
  • the terminal may receive the key identification information sent by the first network device in the NAS SMC message, or may receive the key identification information in the message indicating that the terminal is successfully authenticated, and in which message the terminal receives the secret.
  • the key identification information may be based on which message the first network device sent to the terminal.
  • the method for determining the key identification information by the first network device is different when the first network device is AMF, AUSF or SEAF, the following will be respectively introduced:
  • the step S201 in the application may be implemented as follows:
  • the first network device receives a message for indicating that the terminal is successfully authenticated, and the first network device generates key identification information.
  • the first network device in the application receives the message indicating that the terminal is successfully authenticated, it can determine that the network side successfully authenticates the terminal. In this case, the first network device generates the key identification information. Avoid the problem that the generated key identification information is wasted due to unsuccessful terminal authentication.
  • the AMF obtains the key identification information.
  • the AMF may directly obtain the key identification information from the message indicating that the terminal is successfully authenticated.
  • the AMF when the message for indicating that the terminal is successfully authenticated does not include the key identification information, the AMF generates the key identification information by itself.
  • the SEAF receives the message sent by the AUSF to indicate that the terminal is successfully authenticated, or the SEAF itself verifies that the UE is authentic, then the SEAF obtains the key identification information, in which case
  • the SEAF may directly obtain the key identification information from the message indicating that the terminal is successfully authenticated.
  • the key identification information is all generated by the SEAF or the AMF separately, that is, there is no key identification information in the message indicating that the terminal is successfully authenticated.
  • the key identification information can be generated by at least one network device, if at least two network devices generate the key identifier, the key identifier needs to be delivered to the network device of the next level (for example, the AUSF generates the secret).
  • the key identification information is transmitted to the SEAF or the AMF, or the SEAF generates the key identification information and is transmitted to the AMF. Therefore, each of the network devices of the next level may generate the key identification information, or may obtain the confidentiality from the network device of the upper level.
  • the key identifies the information to determine the key identification information, which will be described separately below:
  • the step S2011 in the present application may be specifically implemented by: after the first network device receives the message indicating that the terminal is successfully authenticated, or after the first device determines that the UE is authentic, the second network device is used.
  • the transmitted first key identification information is determined as key identification information.
  • the second network device may be a SEAF or an AUSF
  • the first network device is a SEAF
  • the second network device may be an AUSF.
  • the manner in which the second network device sends the key identification information to the first network device can be referred to the foregoing description, which is not limited in this application.
  • step S2011 in this application may be specifically implemented by: determining, by the first network device, that a message indicating that the terminal is successfully authenticated is received, or after the first device determines that the UE is authentic, generating a key. Identification information.
  • the first network device may generate the key identification information by itself, when used to indicate the terminal.
  • the first network device may generate the key identifier information based on the first key identifier information, or may not generate the key identifier information based on the first key identifier information.
  • Key identification information which is not limited in this application.
  • the method provided by the present application, before step 201 further includes:
  • the first network device acquires multiple key identifier sub-information, where all of the multiple key identifier sub-information are from other network devices, or the plurality of key identifier sub-information portions are generated by the first network device. Some of them come from other network devices.
  • Other network devices here may be SEAF or AUSF.
  • the other network devices may be at least one of a SEAF and an AUSF.
  • the other network devices may be AUSF.
  • the key identification information in this application may be a key identifier.
  • key identification information is generated by SEAF, AUSF, and AMF.
  • AUSF generates key identification information -a
  • SEAF generates key identification information -b
  • AMF generates key identification information -c
  • AMF sets key identification information -a, key identification information -b, and key identification information - c is combined to determine key identification information, in which case the key identification information is key identification information -c and key identification information -b and key identification information -a.
  • the AUSF can fill the highest 3 bits, ie, the 9th bit, the 8th bit, and the 7th bit, and after filling, pass 001000000 to the SEAF, and the SEAF refills the sixth.
  • the bit, the 5th bit, and the 4th bit, the key identification information sent by the final SEAF to the AMF may be 001010000.
  • the AMF fills the last 3 bits, that is, the 3rd bit, the 2nd bit, and the 1st bit, and finally obtains the key.
  • the identification information is 001010001.
  • the present application does not limit this.
  • the multiple key identifiers generated by the AUSF and the SEAF may be the same. It may also be different, and this application does not limit this.
  • Step S202 in the present application may be specifically implemented in the following manner based on step S204:
  • the first network device receives a message for indicating that the terminal is successfully authenticated, and generates second key identification information.
  • the first network device in the present application may generate the second key identification information based on the multiple key identifier sub-information, or may generate the second key identifier information based on the remaining parameters other than the multiple key identifier sub-information.
  • the first network device determines the key identification information according to the multiple key identifier sub-information and the second key identifier information.
  • the AUSF after receiving the message indicating the authentication of the terminal (for example, EAP-RSP/AKA'-Challenge message), the AUSF generates the key identification information 1, and then the AUSF can be used to indicate completion of the terminal.
  • the message of the authentication (for example, the following is an EAP-Success message, the application does not limit the specific name of the message for completing the authentication of the terminal), and the key identification information 1 is sent to the SEAF.
  • the SEAF may determine that the network side completes the authentication of the terminal, and then the SEAF generates the key identification information 2. Then, the SEAF sends the key through the EAP-Success message.
  • the identification information 1 and the key identification information 2 are sent to the AMF. After receiving the EAP-Success carrying the key identification information 1 and the key identification information 2, the AMF generates the key identification information 3, and finally, the AMF identifies the key according to the key.
  • the information 1, the key identification information 2, and the key identification information 3 determine the key identification information.
  • the method for determining the key identification information by the AMF according to the key identification information 1, the key identification information 2, and the key identification information 3 is not limited.
  • the AMF may use the key identification information 1 and the key identification information 2 and the key.
  • the location of the identification information 3 determines the key identification information, but the present application does not limit the location of each key identification information.
  • the key identification information can be used to identify which set of keys the terminal is using. Therefore, generating a part of the key identification information by each network element can make the key identification information more flexible, especially when the network element other than the AMF also has multiple sets of terminal security contexts.
  • step S201 in this application may also be implemented in the following manner:
  • S2012 The first network device determines that an authentication request for the terminal is received, and the first network device determines the key identification information.
  • the first network device determines that the authentication request for the terminal sent by the SEAF is received, and the first network device generates the key identification information to determine the key identification information.
  • the terminal first accesses from the 3GPP side, but the terminal starts to access from the non-3GPP side as an example, and the security communication method provided by the present application is described in detail:
  • the terminal accesses the network by using a non-3GPP access technology.
  • step S301 can be referred to the prior art, which is not limited in this application.
  • the terminal and the N3IWF exchange an IKE_SA_INIT message.
  • the IKE_SA_INIT message carries the key material.
  • the terminal and the N3IWF can generate the same key for protecting all subsequent messages.
  • the terminal sends a network key exchange protocol authentication request (IKE_AUTH_Request) to the N3IWF.
  • IKE_AUTH_Request a network key exchange protocol authentication request
  • the IKE_AUTH_Request message carries the identification information of the terminal, and the IKE_AUTH_Request message may not carry the authentication parameter.
  • the N3IWF sends a reply message to the terminal for the IKE_AUTH_Request message, where the reply message for the IKE_AUTH_Request message is used to instruct the terminal to start the 5G authentication process.
  • the reply message for the IKE_AUTH_Request message carries the EAP-5G-Request message/5G-Start message.
  • the terminal determines whether the accessed N3IWF and the network accessed through the 3GPP access technology are the same operator.
  • the terminal searches for the relevant N3IWF by using the PLMN ID of the network accessed through the 3GPP access technology. For example, the terminal obtains a feedback, and the content of the feedback is related information of the N3IWF, and the terminal can determine from the information whether the PLMN ID where the N3IWF is located is the same as the PLMN ID accessed by the 3GPP.
  • the terminal sends an IKE_AUTH Request message to the N3IWF, where the IKE_AUTH Request message is used for the terminal to register to the AMF.
  • the IKE_AUTH Request message includes an EAP-5G-ReS/5G-NAS message.
  • the EAP-5G-ReS/5G-NAS message includes a NAS-Protocol Data Unit (PDU), and the NAS PDU includes a registration request message, and the registration request message is used by the terminal to register with the AMF.
  • PDU NAS-Protocol Data Unit
  • the registration request here can be used for the terminal to register to the AMF through the non-3GPP access technology.
  • the registration request message carries temporary identity information of the terminal, for example, GUTI, key identification information ngKSI.
  • the registration request message is integrity protected by the NAS integrity key identified by ngKSI.
  • N3IWF first selects an AMF according to the information in the GUTI.
  • the N3IWF when the N3IWF finds the AMF-2/SEAF-2 of the GUTI identifier according to the GUTI, the N3IWF sends a registration request message to the AMF-2/SEAF-2.
  • the N3IWF cannot find AMF-2/SEAF-2 according to GUTI, the N3IWF forwards the registration request message to AMF-1/SEAF-1.
  • the embodiment of the present application takes N3IWF as an example, and cannot find AMF-2/SEAF-2 according to GUTI.
  • the N3IWF forwards the registration request message to the AMF-1.
  • AMF-1 determines AMF-2 according to the information in the GUTI.
  • the AMF-1 forwards the registration request message to the AMF-2.
  • the AMF-2 determines the key according to the GUTI and the ngKSI in the registration request message, and verifies that the integrity protection is correct. If the integrity protection is correct, the following step S212 is performed:
  • the AMF-2 generates a new key nKamf according to the existing key oKamf in the AMF-2.
  • AMF-2 sends the new nKamf to AMF-1.
  • the AMF-2 may further send the first indication information to the AMF-1, where the first indication information is used to indicate that the state between the terminal and the AMF-2 is a connected state.
  • the first indication information may be a key identifier currently used by the AMF-2, and may also be one bit indication information.
  • nKamf KDF (oKamf, other parameters), and other parameters may be one or more.
  • other parameters are NAS COUNT, or NAS COUNT and ngKSI, or ngKSI alone, or Kamf maintains a COUNT value.
  • This COUNT value is passed to AMF-1, which is passed to the terminal by AMF-1 through the NAS SMC message.
  • nKamf key derivation function (KDF) (Kseaf, other parameters), where Kseaf represents the key in SEAF.
  • S314 and AMF-1 select a security algorithm.
  • AMF-1 uses nKamf to generate a new NAS key, as well as a new key identifier.
  • the new key identifier generated by the AMF may be different from the received key identifier, so that the terminal can distinguish different security contexts according to the key identifier.
  • the AMF generates the same key identifier as the received key identifier, in which case the terminal can use the terminal's identity information to distinguish between different security contexts.
  • the AMF-1 sends a NAS SMC message to the terminal.
  • the NAS SMC message carries the selected security capability and key identification information.
  • the key identification information may be a key identifier.
  • the AMF-1 may further send the second indication information to the terminal, where the second indication information is used to notify the terminal whether Keep the original key.
  • the terminal may retain the previous key identifier by default.
  • the terminal can determine whether to update the key by using the following manner.
  • Manner 1 The terminal determines that the 3GPP side is accessing. If a NAS SMC message is received from the non-3GPP side, the terminal determines that the non-3GPP side needs to generate a new key.
  • Manner 2 The terminal determines to receive the new key identifier ngKSI sent by the AMF-1, and generates a new key according to the new key identifier ngKSI.
  • Manner 3 The terminal determines whether to update the key according to the second indication information, or the terminal determines whether to update the key according to the COUNT value carried in the NAS SMC message.
  • the second indication information indicates an update key, and the terminal updates the key.
  • the terminal replies to the NAS SMP message to the AMF-1.
  • NAS SMP messages use the new key for integrity protection.
  • S320 and AMF-1 receive the NAS SMP message, and deliver the key Kn3iwf used by the N3IWF to the N3IWF.
  • AMF-1 generates a GUTI-1, which is issued to the terminal along with the registration completion message.
  • the terminal When the terminal receives the GUTI-1, if the eKSI sent by the AMF-1 to the terminal is the same as the eKSI used by the terminal in the registration request message, the terminal can distinguish the different security contexts by the GUTI-1.
  • the scheme shown in FIG. 7 is applied when the terminal accesses the AMF of the operator A through the 3GPP, and then accesses the AMF of the operator B through the non-3GPP while maintaining the access of the 3GPP side. Based on this scenario, when the terminal re-accesses the AMF of the operator B, the operator B needs to trigger the authentication process on the non-3GPP side.
  • the first mode is: the terminal determines that the operator of the N3IWF to access is different from the operator that accesses through the 3GPP. In this case, when the terminal accesses through the non-3GPP, the terminal is re-authenticated on the non-3GPP side. In this case, the identity identification information carried by the terminal to the AMF is a SUCI.
  • each network element such as a terminal and a network device
  • each network element includes hardware structures and/or software modules corresponding to each function in order to implement the above functions.
  • the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner. The following is an example of dividing each functional module by using corresponding functions:
  • FIG. 8 shows a possible structural diagram of the terminal involved in the above embodiment.
  • the terminal includes a determining unit 101 and a communication unit 102.
  • the determining unit 101 is configured to support the terminal to perform steps S101, S103 and S104 and S105 and S305 in the foregoing embodiment;
  • the communication unit is configured to support the terminal to perform steps S102 and S301 in the foregoing embodiment.
  • the terminal further includes a receiving unit 103 and a generating unit 104, where the receiving unit 103 is configured to support the terminal to perform steps S1031, S1041, and S203 and S302 in the foregoing embodiment, where the generating unit 104 is configured to support the terminal to execute the foregoing embodiment. Steps S1032 and S1042.
  • the terminal further includes a transmitting unit for performing S303, S306. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional description of the corresponding functional modules, and details are not described herein again.
  • FIG. 9 shows a possible logical structure diagram of the terminal involved in the above embodiment.
  • the terminal includes a processing module 112 and a communication module 113.
  • the processing module 112 is configured to control and control the action of the terminal.
  • the processing module 112 is configured to support the terminal to perform steps S101, S103 and S104 and S105 and S305 and S1032, S1042 in the above embodiment; and the communication module 113 is used to support the terminal. Steps S1031, S1041 and S203 and S302 and S303, S306 in the above embodiment are executed. And/or other processes performed by the terminal for the techniques described herein.
  • the terminal may further include a storage module 111 for storing program codes and data of the terminal.
  • the processing module 112 may be a processor or a controller, such as a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, Hardware components or any combination thereof. It is possible to implement or perform various exemplary logical blocks, modules and circuits described in connection with the disclosure of the embodiments of the present application.
  • the processor may also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
  • the communication module 113 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 111 can be a memory.
  • the terminal involved in the present application may be the device shown in FIG.
  • the communication interface 130, the at least one processor 120, and the memory 140 are mutually connected by a bus 110; the bus 110 may be a PCI bus or an EISA bus or the like.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10, but it does not mean that there is only one bus or one type of bus.
  • the memory 140 is used to store program codes and data of the terminal.
  • the communication interface 130 is configured to support the terminal to communicate with other devices (eg, network devices), and the processor 120 is configured to support the terminal to execute program codes and data stored in the memory 140 to implement a secure communication method provided by the present application.
  • FIG. 11 shows a possible structural diagram of the network device involved in the above embodiment.
  • the network device includes an obtaining unit 201 and a transmitting unit 202.
  • the obtaining unit 201 is configured to support the network device to perform step S201 (specifically, may be S2011, S2012), S204 in the foregoing embodiment;
  • the sending unit 202 is configured to support the network device to perform step S202 in the foregoing embodiment (specific It can be S2021, S2022, S2023, and S2024).
  • step S201 specifically, may be S2011, S2012
  • S204 in the foregoing embodiment
  • the sending unit 202 is configured to support the network device to perform step S202 in the foregoing embodiment (specific It can be S2021, S2022, S2023, and S2024).
  • All the related content of the steps involved in the foregoing method embodiments may be referred to the functional description of the corresponding functional modules, and details are not described herein again.
  • FIG. 12 shows a possible logical structure diagram of the network device involved in the above embodiment.
  • the network device includes: a processing module 212 and a communication module 213.
  • the processing module 212 is configured to perform control and management on the action of the network device.
  • the processing module 212 is configured to support the network device to perform step S201 (specifically, may be S2011, S2012), S204 in the foregoing embodiment;
  • the supporting network device performs S202 in the above embodiment (specifically, it may be S2021, S2022, S2023, and S2024). And/or other processes performed by the network device for the techniques described herein.
  • the network device may further include a storage module 211 for storing program codes and data of the network device.
  • the processing module 212 can be a processor or a controller, for example, a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, Hardware components or any combination thereof. It is possible to implement or perform various exemplary logical blocks, modules and circuits described in connection with the disclosure of the embodiments of the present application.
  • the processor may also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
  • the communication module 213 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 211 can be a memory.
  • the network device involved in the present application may be the device shown in FIG.
  • the communication interface 230, the at least one processor 220, and the memory 210 are connected to each other through a bus 200.
  • the bus 200 may be a PCI bus or an EISA bus or the like.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the memory 210 is used to store program codes and data of the network device.
  • the communication interface 230 is configured to support communication of network devices with other devices (eg, terminals), and the processor 220 is configured to support the network devices to execute program codes and data stored in the memory 210 to implement a secure communication method provided by the present application.
  • the receiving unit (or the unit for receiving) involved in the present application may be an interface circuit of the secure communication device for receiving signals from other devices.
  • the receiving unit is an interface circuit for the chip to receive signals from other chips or devices.
  • the above transmitting unit is an interface circuit of the secure communication device for transmitting signals to other devices.
  • the transmitting unit is an interface circuit for transmitting signals to other chips or devices.
  • FIG. 14 is a schematic structural diagram of a chip system 150 according to an embodiment of the present application.
  • the chip system 150 includes at least one processor 1510 and interface circuitry 1530.
  • the chip system 150 further includes a memory 1550, which may include a read only memory and a random access memory, and provides operating instructions and data to the processor 1510.
  • a portion of memory 1550 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1550 stores elements, executable modules or data structures, or a subset thereof, or their extended set:
  • the corresponding operation is performed by calling an operation instruction stored in the memory 1550 (which can be stored in the operating system).
  • One possible implementation manner is that the structure of the chip system used by the terminal and the network device is similar, and different devices can use different chip systems to implement their respective functions.
  • the processor 1510 controls the operations of the terminal and the network device, and the processor 1510 may also be referred to as a CPU (Central Processing Unit).
  • Memory 1550 can include read only memory and random access memory and provides instructions and data to processor 1510.
  • a portion of memory 1550 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1550, the interface circuit 1530, and the memory 1550 are coupled together by a bus system 1520.
  • the bus system 1520 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 1520 in FIG.
  • the method disclosed in the foregoing embodiment of the present application may be applied to the processor 1510 or implemented by the processor 1510.
  • the processor 1510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1510 or an instruction in a form of software.
  • the processor 1510 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1550, and the processor 1510 reads the information in the memory 1550 and performs the steps of the above method in combination with its hardware.
  • the interface circuit 1530 is configured to perform the steps of receiving and transmitting the terminal and the network device in the embodiment shown in FIG. 3, FIG. 4, and FIG.
  • the processor 1510 is configured to perform the steps of the processing of the terminal and the network device in the embodiments shown in FIG. 3, FIG. 4, and FIG.
  • the instructions stored by the memory for execution by the processor may be implemented in the form of a computer program product.
  • the computer program product may be written in the memory in advance, or may be downloaded in software and installed in the memory.
  • a computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, computer instructions can be wired from a website site, computer, server or data center (eg, Coax, fiber, digital subscriber line (DSL) or wireless (eg, infrared, wireless, microwave, etc.) is transmitted to another website, computer, server, or data center.
  • a website site eg, computer, server or data center
  • DSL digital subscriber line
  • wireless eg, infrared, wireless, microwave, etc.
  • the computer readable storage medium can be any available media that can be stored by the computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • Useful media can be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk, SSD).
  • a computer storage medium stores instructions for causing the terminal to execute S101, S103 and S104 and S105 and S305 and S1032, S1042, S1031 in the embodiment when the instruction is run on the terminal. , S1041 and S203 and S302, and S303 and S306. And/or other processes performed by the terminal for the techniques described herein.
  • a computer storage medium stores instructions.
  • the network device When the instruction is run on the network device, the network device performs step S201 in the embodiment (specifically, may be S2011, S2012) S204, S202 (specifically, it may be S2021, S2022, S2023, and S2024). And/or other processes performed by the network device for the techniques described herein.
  • a computer program product storing instructions, when the instruction is run on the terminal, causing the terminal to execute S101, S103, and S104 and S105 and S305 and S1032, S1042 in the embodiment, S1031, S1041 and S203 and S302, and S303 and S306. And/or other processes performed by the terminal for the techniques described herein.
  • a computer program product storing instructions, when the instruction is run on the network device, causing the network device to execute S201 in the embodiment (specifically, may be S2011, S2012) S204, S202 (specifically, it may be S2021, S2022, S2023, and S2024). And/or other processes performed by the network device for the techniques described herein.
  • the present application further provides a communication system including the terminal shown in FIG. 8-10, and the network device shown in FIG. 11 to FIG. 13, in addition to the communication system, the communication system may further include Other devices that network devices communicate with.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of cells is only a logical function division.
  • multiple units or components may be combined or integrated. Go to another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种安全通信方法和装置，涉及通信技术领域，以提高终端通过不同无线接入技术接入无线网络时的安全通信能力。该方案应用于终端中，终端具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于终端与第一网络通信，第二安全上下文用于终端与第二网络通信，且第一安全上下文和第二安全上下文包括不同的第一信息，该方法包括：终端在与目标网络通信时，根据第一信息确定目标安全上下文，其中，目标网络为第一网络，当目标安全上下文为第一安全上下文；当目标网络为第二网络，目标安全上下文为第二安全上下文；终端根据目标安全上下文与目标网络通信，本申请适用于终端通过不同网络接入的场景中。

Description

一种安全通信方法和装置
本申请要求于2017年11月17日提交中国专利局、申请号为201711147451.8、申请名称为“一种安全通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种安全通信方法和装置。
背景技术
目前，主要的无线接入技术包括第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)无线接入技术。该接入技术从2G逐渐演进，目前已经从长期演进(Long Term Evolution，LTE)(又称为4G)技术向新无线(New Radio，NR)(又称为5G)技术演进。
在4G及以前的接入技术中，3GPP接入技术和非(non)-3GPP接入技术是独立的。因此对通信安全的处理也是独立的，不会彼此影响。随着技术的演进，在NR技术或未来的技术中，非3GPP接入技术可能会接入3GPP的核心网，因此在通信安全的处理上需要进一步改进，以提高终端通过不同无线接入技术接入无线网络时的安全通信能力。
发明内容
本申请实施例提供一种安全通信方法和装置，以提高终端通过不同无线接入技术接入无线网络时的安全通信能力。
为了解决上述技术问题，本申请实施例提供的如下技术方案：
第一方面，本申请提供一种安全通信方法，应用于终端中，该终端具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于终端与第一网络通信，第二安全上下文用于终端与第二网络通信，且第一安全上下文和第二安全上下文包括不同的第一信息，本申请提供的方法包括：终端在与目标网络通信时，根据第一信息确定目标安全上下文，其中，当目标网络为第一网络时，目标安全上下文为第一安全上下文；或者，当目标网络为第二网络，目标安全上下文为第二安全上下文；终端根据目标安全上下文与目标网络通信。
本申请提供一种安全通信方法，当终端通过不同的接入技术接入到不同的网络时，例如，第一网络和第二网络，可能会存在如下情况：该不同的网络属于同一个运营商，或者该不同的网络属于不同的运营商。无论，不同的网络是否属于同一个运营商，现有技术中均可能存在如下问题：终端设备从不同网络处获得相同的密钥标识符，而通常密钥标识符的作用是对密钥进行标识，而网络通常可以使用密钥，结合预设算法以及NAS COUNT等参数建立安全上下文，因此，若终端从不同AMF处获得的密钥标识符相同，终端根据该密钥标识符确定的密钥可能也是相同的，当终端再次入网的时候，终端无法区分选择哪个安全上下文与需要接入的网络进行通信。基于此，本申请 中通过在终端侧具有的第一安全上下文和第二安全上下文中包括不同的第一信息，这样终端在与目标网络通信时，可以通过第一信息确定与目标网络通信时所需要的安全上下文，例如，终端可以根据第一信息确定与第一网络通信时使用第一安全上下文，与第二网络通信时使用第二安全上下文，从而可以使得终端正确的接入相应的网络。
结合第一方面，在第一方面的第一种可能的实现方式中，第一信息为密钥标识信息和终端的身份标识信息中的至少一项。具体的，终端的身份标识信息由终端所接入的网络生成，当终端接入不同网络时，不同网络为终端生成的终端的身份标识信息不同，因此，可以使用终端的身份标识信息区分第一安全上下文和第二安全上下文，另一方面，在第一网络和第二网络属于同一个运营商时，同一个运营商之间的网络可以交互，因此，不同网络与终端之间的密钥标识信息不同，因此，可以使用密钥标识信息区分第一安全上下文和第二安全上下文，又一方面，在第一网络和第二网络属于不同运营商时，在不同运营商之间的网络可能无法交互时，便可能存在不同网络生成相同的密钥标识信息，因此可以进一步结合终端的身份标识信息区分第一安全上下文和第二安全上下文。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，第一安全上下文和第二安全上下文还包括不同的第二信息，第二信息用于指示第一安全上下文和第二安全上下文针对的网络的接入技术。例如，第一安全上下文包括的第二信息可以为第一网络的接入技术，第二安全上下文包括的第二信息可以为第二网络的接入技术，通过在第一安全上下文和第二安全上下文中携带用于指示接入技术的第二信息，可以使得终端根据技术接入确定安全上下文是针对哪个网络的，从而正确的接入相应的网络中。
结合第一方面至第一方面的第二种可能的实现方式中的任一项，在第一方面的第三种可能的实现方式中，第一信息为指示信息，该指示信息用于安全上下文对应的网络的接入技术。
结合第一方面至第一方面的第三种可能的实现方式中的任一项，在第一方面的第四种可能的实现方式中，第一安全上下文不包括UP密钥，第二安全上下文包括UP密钥；或者，第一安全上下文包括UP密钥，第二安全上下文不包括UP密钥。由于终端通过3GPP接入网络时，与网络的安全上下文中通常会包括UP密钥，而终端通过Non-3GPP接入时，通常安全上下文中可能不包括UP密钥，因此，终端也可以使用UP密钥区分安全上下文针对的网络。
结合第一方面至第一方面的第四种可能的实现方式中的任一项，在第一方面的第五种可能的实现方式中，终端在与目标网络通信之前，本申请提供的还包括：终端在注册到第一网络时，终端确定第一安全上下文；终端在注册到第二网络时，终端确定第二安全上下文。
结合第一方面至第一方面的第五种可能的实现方式中的任一项，在第一方面的第六种可能的实现方式中，终端确定第一安全上下文，包括：终端接收来自第一网络设备的第一密钥标识信息；终端生成包括第一密钥标识信息的第一安全上下文，第一密钥标识信息用于标识第一安全上下文。
结合第一方面至第一方面的第六种可能的实现方式中的任一项，在第一方面的第 七种可能的实现方式中，终端确定第二安全上下文，包括：终端接收来自第二网络设备的第二密钥标识信息；终端生成包括第二密钥标识信息的第二安全上下文，第二密钥标识信息用于标识第二安全上下文。
结合第一方面至第一方面的第七种可能的实现方式中的任一项，在第一方面的第八种可能的实现方式中，终端接收来自网络设备的密钥标识信息，包括：终端接收网络设备发送的非接入层安全模式命令NAS SMC消息，该NAS SMC消息中包括第一密钥标识信息；或，终端接收网络设备发送的用于指示终端鉴权成功的消息，该用于指示终端鉴权成功的消息包括密钥标识信息；或，终端接收网络设备发送的NAS SMC消息，该NAS SMC消息包括用于指示终端鉴权成功的消息，该用于指示终端鉴权成功的消息包括密钥标识信息。
结合第一方面至第一方面的第八种可能的实现方式中的任一项，在第一方面的第九种可能的实现方式中，终端在与目标网络通信之前，本申请提供的方法还包括：终端确定第三网络的第一标识与目标网络的第一标识是否相同，第三网络为终端当前接入的网络。
第二方面，本申请提供一种安全通信方法，包括：第一网络设备获取密钥标识信息，密钥标识信息用于标识安全上下文；第一网络设备在网络侧完成对终端的鉴权时，向终端发送密钥标识信息。
结合第二方面，在第二方面的第一种可能的实现方式中，第一网络设备获取密钥标识信息，包括：第一网络设备接收到用于指示对终端鉴权成功的消息之后，生成密钥标识信息。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，第一网络设备获取密钥标识信息，包括：第一网络设备接收用于指示终端鉴权成功的消息，用于指示对终端鉴权成功的消息包括密钥标识信息。
结合第二方面至第二方面的第二种可能的实现方式中任一项，在第二方面的第三种可能的实现方式中，第一网络设备获取密钥标识信息之前，本申请提供的方法还包括：第一网络设备获取多个密钥标识子信息，多个密钥标识子信息全部来自其它网络设备，或者多个密钥标识子信息部分由第一网络设备生成，部分来自其它网络设备；第一网络设备获取密钥标识信息，包括：第一网络设备根据多个密钥标识子信息，生成密钥标识信息。
结合第二方面至第二方面的第三种可能的实现方式中任一项，在第二方面的第四种可能的实现方式中，第一网络设备为AMF或SEAF。
结合第二方面至第二方面的第四种可能的实现方式中任一项，在第二方面的第五种可能的实现方式中，第一网络设备为AMF，第一网络设备向终端发送密钥标识信息，包括：第一网络设备通过非接入层安全模式命令NAS SMC消息向终端发送密钥标识信息。
结合第二方面至第二方面的第五种可能的实现方式中任一项，在第二方面的第六种可能的实现方式中，NAS SMC消息包括用于指示终端鉴权成功的消息，用于指示终端鉴权成功的消息包括密钥标识信息。
结合第二方面至第二方面的第六种可能的实现方式中任一项，在第二方面的第七 种可能的实现方式中，第一网络设备为AUSF，第一网络设备获取密钥标识信息，并向终端发送密钥标识信息，包括：第一网络设备生成包括密钥标识信息的用于指示终端鉴权成功的消息，并向终端发送用于指示终端鉴权成功的消息。
相应的，第三方面，本申请提供一种安全通信的装置，该安全通信的装置可以实现第一方面至第一方面的任一项所描述的安全通信方法。例如，该安全通信的装置可以为终端，或者为设置在终端中的芯片。其可以通过软件、硬件、或者通过硬件执行相应的软件实现上述方法。
在一种可能的设计中，安全通信的装置具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于安全通信的装置与第一网络通信，第二安全上下文用于安全通信的装置与第二网络通信，且第一安全上下文和第二安全上下文包括不同的第一信息，该终端包括：确定单元，用于在与目标网络通信时，根据第一信息确定目标安全上下文，其中，当目标网络为第一网络，目标安全上下文为第一安全上下文；或者，当目标网络为第二网络，第二安全上下文为第二安全上下文；通信单元，用于根据确定单元确定的目标安全上下文与目标网络通信。
在一种可能的设计中，第一信息为密钥标识信息和终端的身份标识信息中的至少一项。
在一种可能的设计中，第一安全上下文和第二安全上下文还包括不同的第二信息，第二信息用于指示安全上下文针对的网络的接入技术。
在一种可能的设计中，第一信息为指示信息，指示信息用于安全上下文对应的网络的接入技术。
在一种可能的设计中，第一安全上下文不包括UP密钥，第二安全上下文包括UP密钥；或者，第一安全上下文包括UP密钥，第二安全上下文不包括UP密钥。
在一种可能的设计中，确定单元，还用于在终端注册到第一网络时，确定第一安全上下文；以及用于在终端注册到第二网络时，确定第二安全上下文。
在一种可能的设计中，终端，还包括：接收单元，用于接收来自第一网络设备的第一密钥标识信息；确定单元，用于生成包括第一密钥标识信息的第一安全上下文，第一密钥标识信息用于标识第一安全上下文。
在一种可能的设计中，接收单元，还用于接收来自第二网络设备的第二密钥标识信息；确定单元，还用于生成包括第二密钥标识信息的第二安全上下文，第二密钥标识信息用于标识第二安全上下文。
在一种可能的设计中，接收单元，用于接收网络设备发送的非接入层安全模式命令NAS SMC消息，NAS SMC消息中包括第一密钥标识信息；或，接收单元，还用于接收网络设备发送的非接入层安全模式命令NAS SMC消息，NAS SMC消息中包括第一密钥标识信息；或，接收单元，用于接收网络设备发送的NAS SMC消息，NAS SMC消息包括用于指示终端鉴权成功的消息，用于指示终端鉴权成功的消息包括密钥标识信息。
在一种可能的设计中，确定单元，还用于在终端与目标网络通信之前，确定第三网络的第一标识与目标网络的第一标识是否相同，第三网络为终端当前接入的网络。
第四方面，该安全通信的装置可以包括至少一个处理器和通信接口，该处理器被 配置为支持该确定安全能力的装置执行上述第一方面至第一方面的任一项所描述的方法中在该安全通信的装置侧进行的消息处理或控制的相关操作，通信接口，用于支持该安全通信的装置与其他网元(例如，网络设备)之间的通信，通信接口可以是收发电路，收发电路用于支持该安全通信的装置执行上述第一方面至第一方面的任一项所描述的方法中在该安全通信的装置侧进行消息接收和发送的相关操作。
可选的，该安全通信的装置还可以包括存储器，存储器用于与至少一个处理器耦合，存储器中保存该安全通信的装置必要的程序(指令)和数据。其中，可选的，该安全通信的装置还可以包括总线，其中，存储器、收发电路和至少一个处理器通过总线互联。
第五方面，本申请提供一种网络设备，包括：获取单元，用于获取密钥标识信息，该密钥标识信息用于标识安全上下文；发送单元，用于在网络侧完成对终端的鉴权时，向终端发送密钥标识信息。
结合第五方面，在第五方面的第一种可能的实现方式中，获取单元，用于接收到用于指示对终端鉴权成功的消息之后，生成密钥标识信息。
结合第五方面或第五方面的第一种可能的实现方式，在第五方面的第二种可能的实现方式中，装置还包括：接收单元，用于接收用于指示对终端鉴权成功的消息，用于指示对终端鉴权成功的消息包括密钥标识信息。
结合第五方面至第五方面的第二种可能的实现方式任一项，在第五方面的第三种可能的实现方式中，获取单元，用于获取多个密钥标识子信息，多个密钥标识子信息全部来自其它网络设备，或者多个密钥标识子信息部分由第一网络设备生成，部分来自其它网络设备；以及用于根据多个密钥标识子信息，生成密钥标识信息。
结合第五方面至第五方面的第三种可能的实现方式中的任一项，在第五方面的第四种可能的实现方式中，第一网络设备为AMF或SEAF。
结合第五方面至第五方面的第四种可能的实现方式中的任一项，在第五方面的第五种可能的实现方式中，第一网络设备为AMF，发送单元，具体用于通过非接入层安全模式命令NAS SMC消息向终端发送密钥标识信息。
结合第五方面至第五方面的第五种可能的实现方式中的任一项，在第五方面的第六种可能的实现方式中，NAS SMC消息包括用于指示终端鉴权成功的消息，用于指示终端鉴权成功的消息包括密钥标识信息。
结合第五方面至第五方面的第六种可能的实现方式中的任一项，在第五方面的第七种可能的实现方式中，第一网络设备为AUSF，第一网络设备获取密钥标识信息，并向终端发送密钥标识信息，包括：获取单元，用于生成包括密钥标识信息的用于指示终端鉴权成功的消息，发送单元，用于向终端发送用于指示终端鉴权成功的消息。
第六方面，该安全通信的装置可以包括至少一个处理器和通信接口，该处理器被配置为支持该确定安全能力的装置执行上述第二方面至第二方面的任一项所描述的方法中在该安全通信的装置侧进行的消息处理或控制的相关操作，通信接口，用于支持该安全通信的装置与其他网元(例如，终端)之间的通信，通信接口可以是收发器，收发器用于支持该安全通信的装置执行上述第二方面至第二方面的任一项所描述的方法中在该安全通信的装置侧进行消息接收和发送的相关操作。
可选的，该安全通信的装置还可以包括存储器，存储器用于与至少一个处理器耦合，存储器中保存该安全通信的装置必要的程序(指令)和数据。其中，其中，存储器、收发器和至少一个处理器通过线路互联。
第七方面，本申请提供一种计算机可读存储介质，当计算机可读存储介质应用于终端中，计算机可读存储介质中存储有指令，当指令被运行时，使得计算机执行上述第一方面至第一方面的任一项所描述的安全通信方法。
第八方面，本申请提供一种计算机可读存储介质，当计算机可读存储介质应用于网络设备中，计算机可读存储介质中存储有指令，当指令被运行时，使得计算机执行上述第二方面至第二方面的任一项所描述的安全通信方法。
第九方面，本申请提供一种芯片系统，应用于终端中，芯片系统包括至少一个处理器和接口电路，接口电路和至少一个处理器通过线路互联，处理器用于运行存储在芯片系统中的指令，以执行第一方面至第一方面的任一项所描述的安全通信方法。
第十方面，本申请提供一种芯片系统，应用于网络设备中，芯片系统包括至少一个处理器和接口电路，接口电路和至少一个处理器通过线路互联，处理器用于运行存储在芯片系统中的指令，以执行第二方面至第二方面的任一项的安全通信方法。
可选的，本申请中的芯片系统还包括该至少一个存储器，该至少一个存储器中存储有指令。
第十一方面，本申请提供一种包含指令的计算机程序产品，计算机程序产品中存储有指令，当该指令被运行时，使得终端执行上述第一方面或第一方面的任意一种可能的设计中所描述的安全通信方法。
第十二方面，本申请提供一种包含指令的计算机程序产品，计算机程序产品中存储有指令，当该指令被运行时，使得网络设备执行上述第二方面或第二方面的任意一种可能的设计中所描述的安全通信方法。
第十三方面，本申请提供一种通信系统，该通信系统包括至少一个如上述第三方面或第四方面所描述的终端，和至少一个如第五方面或第六方面所描述的网络设备。
在一个可能的设计中，该系统还可以包括本申请实施例提供的方案中与网络设备，或者终端进行交互的其他设备。
附图说明
图1为本申请实施例提供的一种通信系统的结构图；
图2为本申请实施例提供的终端通过不同网络接入的通信系统结构图；
图3为本申请提供一种安全通信的方法流程示意图一；
图4为本申请提供的一种安全通信的方法流程示意图二；
图5为本申请提供的一种安全通信的方法流程示意图三；
图6为本申请提供的一种安全通信的方法流程示意图四；
图7为本申请提供的一种安全通信的方法流程示意图五；
图8为本申请提供的一种终端的结构示意图一；
图9为本申请提供的一种终端的结构示意图二；
图10为本申请提供的一种终端的结构示意图三；
图11为本申请提供的一种网络设备的结构示意图一；
图12为本申请提供的一种网络设备的结构示意图二；
图13为本申请提供的一种网络设备的结构示意图三；
图14为本申请提供的一种芯片系统的结构示意图。
具体实施方式
本申请中“的(英文：of)”，相应的“(英文corresponding，relevant)”和“对应的(英文：corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
需要说明的是，本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
本申请实施例中，至少一个指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
图1示出了本申请实施例提供的一种通信系统架构图。如图1所示，该通信系统包括：核心网101和接入网(Access network，AN)102。终端103通过接入网102接入服务网络，并通过该服务网络获取外网(例如因特网)的服务，或者通过服务网络与其它终端通信。其中，AN102可以为采用不同接入技术的接入网络。例如，接入技术包括无线接入技术以及固网接入技术，其中，无线接入技术主要包括2种类型：第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如2G、3G、4G或5G系统中采用的无线接入技术)和非第三代合作伙伴计划(none 3rd Generation Partnership Project，non-3GPP)接入技术。
其中，3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网络称为无线接入网络(Radio Access Network，RAN)，例如，终端103可以使用3GPP接入技术通过接入网设备接入无线网络中，该接入网设备可以为基站，例如，5G系统中的接入网设备称为下一代基站节点(next generation Node Basestation，gNB)、演进型节点B(evolved Node B，eNB)等。
非3GPP接入技术是指不符合3GPP标准规范的无线接入技术，例如，以无线保 真(wireless fidelity，WIFI)为代表的空口技术，其中，接入网设备可以为接入点(access point，AP)。
当终端103通过不同的接入技术接入无线网络时，终端103可以通过不同的接入网设备连接不同的核心网设备。
终端103中存储有长期密钥和相关函数。终端103在与核心网设备进行双向鉴权的时候，会使用该长期密钥和相关函数验证网络的真实性。
核心网101可以包括多个实体，例如接入和移动性管理功能(access and mobility management function，AMF)实体1011、安全锚点功能(Security Anchor Function，SEAF)实体1012以及(Authentication Server Function，AUSF)实体1013等。
其中，核心网101中的实体在物理上可以部分或全部集成在一起，也可以分开布置。例如，SEAF1012可以和AMF1011集成在一起，也可以单独布置。SEAF1012主要负责向AUSF1013发起鉴权请求，还可以在鉴权过程完成网络侧对终端103的认证。
AUSF1013在对终端103进行鉴权的时候，负责验证传递待认证参数和认证终端的真实性。例如：接收SEAF 1012发送的鉴权请求；选择鉴权方法；完成网络侧对终端103的鉴权。
此外，核心网还可以包括其它实体，例如：统一的数据管理(unified data management，UDM)实体，会话管理功能(session management function，SMF)实体，用户面功能(user plane function，UPF)实体，策略控制功能(policy control function，PCF)实体、应用功能(application function，AF)实体，以及网络能力开放功能(network exposure function，NEF)实体1019以及数据网络(data network，DN)，本申请实施例对此不作具体限定。这些实体可以部分或全部集成在一个物理设备中，也可以分开设置。
其中，UDM用于存储终端的签约信息；SMF，用于为用户面分配会话资源等；UPF为用户面数据出口，连接外部网络；PCF其内部存储有最新的服务质量(Quality of service，QoS)规则，接入网设备可以根据SMF提供的QoS规则，为用户面传输通道分配合适的资源。
AF，这个网元位于DN内部，属于部署在第三方的功能网元，此AF主要作用是通知PCF最新的第三方企业对于某个应用的业务要求。PCF可以根据要求生成相应的QoS规则，确保网络提供的服务满足第三方所提出的要求。
NEF主要用于与第三方交互，使第三方可以间接与某些3GPP网络内部的网元进行交互。
其中，终端103通过N1接口与AMF1011通信，AN通过N3接口与UPF通信，UPF通过N6接口与DN通信，UPF与SMF通过N4接口通信，需要说明的是，图1中的各个网元之间的接口名字只是一个示例，具体实现中接口名字可能为其他名字，本申请实施例对此不作具体限定。
终端也可以称为终端设备，用户设备(user equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备可以是无线局域网(wireless local area networks，WLAN)中的站点(station，STA)，可以是蜂窝电话、无绳电话、会话启 动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)设备、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备以及下一代通信系统，例如，第五代(fifth-generation，5G)通信网络中的终端设备或者未来演进的公共陆地移动网络(public land mobile network，PLMN)网络中的终端设备等。
作为示例，在本申请实施例中，该终端还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
图2示出了本申请一实施例中终端使用不同的无线接入技术接入网络的架构示意图，例如，终端同时使用3GPP接入技术和non-3GPP接入技术的架构。如图2所示，终端可以同时通过3GPP接入技术和non-3GPP接入技术连接到不同的AMF或SEAF，例如，如图2所示，终端通过3GPP接入技术接入AMF/SEAF201和终端通过non-3GPP接入技术接入AMF/SEAF 202。当终端通过不同的接入技术接入不同的AMF或SEAF时，不同的AMF或SEAF通常可以对应不同的SMF，也可以对应相同的SMF，具体的，当不同的AMF属于同一个网络时，不同的AMF或SEAF通常可以对应同一个SMF，当不同的AMF属于别不同网络时，不同的AMF或SEAF通常可以对应不同的SMF，不同的SMF可以对应不同的UPF，也可以对应相同的UPF，不同的UPF可以对应不同的DN，也可以对应同一个DN。具体的，如图2所示，终端在使用non-3GPP接入技术接入AMF202时，可以通过非3GPP互通功能(non-3GPP interworking function，N3IWF)实体接入AMF202。其中，AUSF和鉴权存储功能(authetnication repository function，ARPF)/UDM构成归属公共陆地移动网(Home Public Land Mobile Network，HPLMN)，终端通过不同的接入技术接入网络时，可以具有不同的受访地公用陆地移动网(visited public land mobile network，VPLMN)，也可以具有相同的受访地公用陆地移动网，例如，如图2中以不同的受访地公用陆地移动网为例，例如，图2所示的VPLMN1和VPLMN2，具体的，图2中所示的各个网元的功能可以参见上述实施例，本申请在此不再赘述。
图3示出了本申请提供的一种安全通信方法，应用于终端中，该终端具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于终端与第一网络通信，第二安全上下文用于终端与第二网络通信，且第一安全上下文和第二安全上下文包括不同的第一信息，如图3所示，包括：
S101、终端在与目标网络通信时，根据第一信息确定目标安全上下文，其中，目标网络为第一网络，目标安全上下文为第一安全上下文；或者目标网络为第二网络，目标安全上下文为第二安全上下文。
S102、终端根据目标安全上下文与目标网络通信。
本申请提供一种安全通信方法，当终端通过不同的接入技术接入到不同的网络时，例如，第一网络和第二网络，可能会存在如下情况：该不同的网络属于同一个运营商，或者该不同的网络属于不同的运营商。无论，不同的网络是否属于同一个运营商，现有技术中均可能存在如下问题：终端设备从不同网络处获得相同的密钥标识符，而通常密钥标识符的作用是对密钥进行标识，而网络通常可以使用密钥，结合预设算法以及NAS COUNT等参数建立安全上下文，因此，若终端从不同AMF处获得的密钥标识符相同，终端根据该密钥标识符确定的密钥可能也是相同的，当终端再次入网的时候，终端无法区分选择哪个安全上下文与需要接入的网络进行通信。基于此，本申请中通过在终端侧具有的第一安全上下文和第二安全上下文中包括不同的第一信息，这样终端在与目标网络通信时，可以通过第一信息确定与目标网络通信时所需要的安全上下文，例如，终端可以根据第一信息确定与第一网络通信时使用第一安全上下文，与第二网络通信时使用第二安全上下文，从而可以使得终端正确的接入相应的网络。
其中，第一网络和第二网络使用的接入技术可以为：固网接入技术、3GPP接入技术以及非3GPP接入技术中的任意两种。
示例性的，第一网络的接入技术可以为3GPP接入技术，第二网络的接入技术可以为非3GPP接入技术。或者，第一网络的接入技术可以为非3GPP接入技术，第二网络的接入技术可以为3GPP接入技术。或者第一网络的接入技术为3GPP接入技术，第二网络的接入技术为固网接入技术。或者第一网络的接入技术为非3GPP接入技术，第二网络的接入技术为固网接入技术等。
其中，第一安全上下文为终端与第一网络通信时确定的安全上下文，第二安全上下文为终端与第二网络通信时确定的安全上下文。
其中，安全上下文是指终端和网络侧使用的，用于保护终端和网络之间传输的消息的参数。比如，安全上下文可以包括非接入层(non-access stratum，NAS)加密密钥，非接入层完整性保护密钥，加密算法，完整性保护算法，新鲜性参数、密钥标识符等参数。
可选的，第一信息可以为密钥标识信息和终端的身份标识信息中的至少一项。
示例性的，密钥标识信息为终端获得的，用于标识密钥的信息，例如，终端可以从网络侧获取密钥标识信息。比如，密钥标识信息可以为4G网络中的密钥标识符(evloved key set identifier，eKSI)。
示例性的，终端的身份标识信息可以为UE的临时身份信息，该临时身份信息至少包括核心网网元的身份信息，还可以包括运营商网络信息。比如，可以为全局唯一的临时标识(globally unique temporary identity，GUTI)。该GUTI可以为终端请求注册到网络时，由该网络中的AMF随着注册完成消息发送给终端。再比如，终端的身份标识信息还可以为4G网络临时身份信息(SAE-Temporary Mobile Subscriber Identity，S-TMSI)。例如，如图2所示，当终端请求注册到3GPP网络时，终端的GUTI可以由AMF201为终端分配。
例如，一方面，当终端与不同网络之间具有的密钥标识信息不同时，该第一信息可以为密钥标识信息。如表1所示，表1示出了安全上下文中不仅可以包括密钥标识 信息还可以包括终端的身份标识信息、NAS密钥、算法、NAS层使用的新鲜性参数、无线资源控制(radio resource control，RRC)RRC密钥、算法、接入层(Access stratum，AS)层使用的新鲜性参数等参数中的至少一个。
其中，NAS密钥用于保护NAS消息，NAS新鲜性参数用于防止NAS消息被重放攻击。RRC密钥和RRC算法用于保护空口的RRC消息。
表1 使用不同的密钥标识信息区分安全上下文
Figure PCTCN2018116041-appb-000001
终端中的密钥标识信息通常可以从终端注册到一个网络时，该网络中的网络设备处获取，因此终端可以保存密钥标识信息和网络之间的一个关联关系，这样终端便可以根据安全上下文中的密钥标识信息确定，使用该安全上下文与哪个网络通信。如表1所示，安全上下文1包括第一密钥标识信息，第二安全上下文包括第二密钥标识信息，示例性的，这样终端再下次接入一个网络A时，若终端之前与该网络A之间的安全上下文为安全上下文1，那么终端可以便可以根据第一密钥标识信息选择安全上下文1与网络A通信。
需要说明的是，当密钥标识信息不同的时候，不同安全上下文中携带的终端的身份标识信息可以相同，也可以不同，表1以密钥标识信息不同时，不同的安全上下文中携带的终端的身份标识信息不同为例。
另一方面，例如，当终端与不同网络之间具有的身份标识信息不同时，该第一信息可以为终端的身份标识信息，如表2所示：
表2 使用不同的身份标识信息区分安全上下文
Figure PCTCN2018116041-appb-000002
Figure PCTCN2018116041-appb-000003
如表2所示，终端可以使用GUTI1和GUTI2来区分安全上下文1和安全上下文2，此时，该安全上下文1为终端和网络1之间具有的安全上下文，安全上下文2为终端和网络2之间具有的安全上下文，此外，终端和同一个网络之间也可以具有多套安全上下文，例如，终端和网络2之间具有安全上下文2和安全上下文3，在这种情况下，终端可以使用第一密钥标识信息和第二密钥标识信息来区分安全上下文2和安全上下文3。
此外，当使用终端的身份标识信息来区分不同的安全上下文时，不同安全上下文中的密钥标识信息可以相同，也可以不同，本申请对此不进行限定，表2以终端的身份标识信息不同时，不同安全上下文中的密钥标识信息相同为例，并不构成对本申请的限定。
需要说明的是，终端的身份标识信息可以通过终端所接入的网络中的网络设备为终端分配，当终端接入的网络设备属于同一个运营商时，该终端接入的网络设备为终端分配的终端的身份标识信息往往不同，在这种情况下，也可以使用终端的身份标识信息来区分安全上下文。
当终端接入的网络设备属于不同运营商时，在不同运营商的网络设备之间不可以交互彼此为终端分匹配的终端的身份标识信息时，可能存在不同运营商中不同网络的网络设备为终端分配的终端的身份标识信息相同，因此，在这种情况下，可以结合不同的密钥标识信息和终端的身份标识信息来区分安全上下文。当不同运营商中的网络设备之间可以交互时，且不同网络设备为终端分配的终端的身份标识信息不同时，也可以单独使用终端的身份标识信息来区分安全上下文。但是，此时的密钥标识信息，可以区分安全上下文属于哪个网络。
更进一步的，终端还可以结合密钥标识信息和终端的身份标识信息来区分不同的安全上下文，例如，当终端的身份标识信息相同时，使用密钥标识信息来区分不同的安全上下文，当密钥标识信息相同时，可以使用终端的身份标识信息来区分不同的安全上下文。
此外，更进一步的，终端还可以通过如下方式区分与不同网络之间的安全上下文：
可选的，第一安全上下文和第二安全上下文还包括不同的第二信息，该第二信息用于指示安全上下文对应的网络的接入技术。
具体的，该第二信息的内容可以有多种，例如，一方面，该第二信息可以为第一指示符或第二指示符。其中，第一指示符用于指示终端使用第一接入技术接入网络， 第二指示符用于指示终端使用第二接入技术接入网络，其中，第一接入技术和第二接入技术不同，该第一接入技术和第二接入技术为非3GPP接入技术、3GPP接入技术以及固网接入技术中的任意两个。
示例性的，指示符可以为比特位指示信息。比如，该第一指示符可以为00，表示终端使用3GPP接入技术，该第二指示符为01表示终端使用非3GPP接入技术，10表示终端使用固网接入结束，或第一指示符为01表示终端使用非3GPP接入技术，第二指示符为00使用3GPP接入技术，10表示终端使用固网接入结束，本申请对此不进行限定，具体的，终端和网络之间可以协商第一指示符和第二指示符的内容。
另一种示例，指示符可以为字符串信息。比如，“3GPP”表示3GPP接入技术，“non-3GPP”表示非3GPP接入技术，“fix”表示固网接入技术。
另一方面，每个安全上下文中还可以包括第二信息用于标识终端前次接入网络时的接入技术，也即终端在生成安全上下文时，将终端请求接入网络时的接入技术作为第二信息，例如，如表3所示：
表3 使用接入技术区分安全上下文
Figure PCTCN2018116041-appb-000004
结合表3所示，终端可以在使用3GPP接入技术接入网络1时，将使用与网络1之间共同保存的安全上下文中包括字符串“3GPP”标识，即安全上下文1，终端在使用non-3GP接入技术接入网络2时，将使用与网络2之间共同保存的安全上下文中包括字符串“non-3GPP”标识的安全上下文3，即安全上下文中包括字符串“non-3GPP”标识，此外，终端在使用固网接入技术接入一个网络时，可以在于该网络之前的安全上下文 中使用“fix”标识。或者终端使用比特位标识01表示3GPP，10表示non-3GPP，11标识固网接入技术，本申请对此不进行限定。
需要说明的是，本申请中使用第二信息区分第一安全上下文和第二安全上下文时，第一安全上下文和第二安全上下文中的第一信息也可以相同。
此外，在表3中，当终端的身份标识信息为GUTI-1时，安全上下文2和安全上下文3的区别在于，密钥标识信息不同，以及新鲜性参数不同，其他可以是相同的。这是由于，当终端使用不同的接入技术接入同一个网络设备时，该网络设备可以为终端发送相同的密钥，例如，NAS密钥-1、以及N3IWF密钥-1，但是NAS COUNT不同。其中，NAS COUNT是新鲜性参数的一种。
可选的，由表3可以看出：当终端保存有用户面(user plane，UP)密钥时，终端通过3GPP接入技术接入网络时，终端与网络之间的安全上下文中存在UP密钥。当终端通过非3GPP接入技术接入网络时，终端与网络之间的安全上下文可以不包括UP密钥。因此本申请中还可以通过安全上下文中包括的UP密钥来区分3GPP接入技术和non-3GPP接入技术使用的安全上下文。例如，第一安全上下文不包括UP密钥，则可能为终端通过non-3GPP接入技术接入网络时保存的安全上下文。第二安全上下文包括UP密钥，则可能为终端通过3GPP接入技术接入网络时保存的安全上下文。或者，所述第一安全上下文包括UP密钥，所述第二安全上下文不包括UP密钥。
具体的，当终端确定第一安全上下文中不包括UP密钥时，终端便可以确定该第一安全上下文用于终端通过非3GPP接入技术接入网络，从而当终端再次使用非3GPP接入技术接入网络时便可以使用第一安全上下文。当终端确定第二安全上下文包括UP密钥，终端便可以确定该第二安全上下文可以用于3GPP接入时使用，从而当终端再次使用3GPP接入技术接入网络时可以使用第二安全上下文。
其中，UP密钥是指终端和网络设备通信时，保护用户面安全的密钥，包括用户面加密密钥和用户面完整性保护密钥的之一或全部。
安全上下文不包括UP密钥，是指在接入目标网络过程中，不需要生成UP密钥。但是并不排除下面这种情况：终端曾经通过3GPP接入技术接入过目标网络，并且保存的安全上下文有UP密钥。
需要说明的是，上述描述的UP密钥、终端的身份标识信息、密钥标识信息以及接入技术等标识参数可以结合起来使用以区分安全上下文，具体的组合方式，本申请对此不进行限定，只要最终终端与不同网络之间的安全上下文可以使用标识参数来区分即可。
可选的，本申请中的密钥标识信息还可以包括运营商的标识信息。具体的，终端通过广播消息收到运营商的信息或者通过其他方法得知目标网络属于哪个运营商的信息后，比如通过要使用的N3IWF属于哪个运营商的信息后，终端就可以根据运营商信息确定出与运营商相应的密钥标识信息，进而根据与运营商相应的密钥标识信息确定出使用的密钥，然后利用确定出的密钥对将要发送的消息进行完整性保护。
此外，当终端以两个不同的接入技术同时接入网络完成数据传输之后，终端通常会回到空闲(Idle)态。但是，当终端从Idle态回到连接态时，终端首先根据终端所在网络的信息，根据GUTI中的信息，确定哪个GUTI满足这个网络，确定出GUTI 之后，根据GUTI确定密钥，如表2或表3所示，于是终端可以使用密钥对将要发送的消息进行完整性保护。另一种方法是，终端首先根据带有运营商信息的密钥标识信息确定出安全上下文信息，再确定出属于这个运营商的GUTI。此时，可选地，GUTI可以是安全上下文的一部分。
如果终端确定出属于待接入网络的安全上下文后，若终端有属于不同接入技术的安全上下文，则终端还可以判断要接入的接入技术是哪类，再确定密钥。进一步地，可选地，终端可以再根据其他信息确定最终使用哪套安全上下文。比如有没有用户面密钥，有没有明确的标识说明是哪个接入技术的安全上下文，确定密钥后，就可以对将要发送的消息进行完整性保护了。
通常情况下，终端需要注册到一个网络中，才可以建立与该网络之间的安全上下文，以便将与网络的安全上下文保存在终端中，因此，作为本申请提供的另一个实施例，如图4所示，本申请提供的方法在步骤S101之前，还包括：
S103、终端在注册到第一网络时，终端确定第一安全上下文。
由于密钥标识信息通常可以作为安全上下文中的内容，而终端中的密钥标识信息通常可以在终端注册网络时，由该网络中的网络设备为终端分配，因此，具体的，本申请中的步骤S103具体可以通过以下方式实现：
S1031、终端接收来自第一网络设备的第一密钥标识信息。
可选的，终端可以接收第一网络设备发送的用于指示终端鉴权成功的消息，该用于指示终端鉴权成功的消息中包括第一密钥标识信息。当第一网络设备通过用于指示终端鉴权成功的消息向终端发送第一密钥标识信息时，这样可以由第一网络设备在确定对终端成功鉴权之后再发送密钥标识信息，避免了由于对终端未成功鉴权而发送密钥标识信息时，造成的信令浪费。
可选的，终端可以接收第一网络设备发送的非接入层(Non-access stratum，NAS)安全模式命令(Security Mode Command，SMC)消息，该NAS SMC消息中包括第一密钥标识信息。
当NAS SMC消息中包括第一密钥标识信息时，NAS SMC消息中还可以包括用于指示终端鉴权成功的消息，也即可以将用于指示终端鉴权成功的消息和第一密钥标识信息携带在NAS SMC消息中，这样可以节约信令开销。
可选的，终端可以接收第一网络设备发送的NAS SMC消息，该NAS SMC消息中包括用于指示终端鉴权成功的消息，该用于指示终端鉴权成功的消息中包括第一密钥标识信息。当第一网络设备通过NAS SMC消息向终端发送第一密钥标识信息时，且该第一密钥标识信息位于用于指示终端鉴权成功的消息中时，可以节省信令开销，可以理解的是，第一网络设备通过NAS SMC消息发送第一密钥标识信息的方式适用于5G-AKA鉴权、EAP-AKA’鉴权以及其他未来用于3GPP系统的其他鉴权方法。
其中，鉴权方式可以包括演进分组系统(Evolved Packet System，EPS)-鉴权和密钥协商(Authentication and Key Agreement，AKA)鉴权、5G-AKA鉴权、或可扩展鉴权协议(Extensible Authentication Protocol，EAP)-AKA’鉴权等，以EAP-AKA鉴权为例，该用于指示终端鉴权成功的消息例如可以称为EAP-Success消息。该名称仅为举例，并没有限制作用。
具体的，终端在向第一网络设备注册时，该第一网络设备可以通过传递鉴权向量的消息或者用于指示终端鉴权成功的消息或者鉴权向量向终端发送第一密钥标识信息。
其中，用于指示终端鉴权成功的消息可以有多种，例如，隐式的告知，即SEAF在验证终端成功后，发送某些参数给AMF，比如发送永久身份标识(subscriber permanent identifier，SUPI)，或者发送密钥Kamf。再例如，显示的告知，即SEAF直接发送鉴权成功消息给AMF，比如在5G AKA鉴权方法中，SEAF发给AMF的一条消息，或者为EAP-AKA’鉴权方法中的EAP-Success消息，当然也可以为5G-AKA鉴权中用于指示终端鉴权成功的消息。
S1032、终端生成包括第一密钥标识信息的第一安全上下文，该第一密钥标识信息用于标识第一安全上下文。
S104、终端在注册到第二网络时，终端确定第二安全上下文。
具体的，本申请中的步骤S104具体可以通过以下方式实现：
S1041、终端接收来自第二网络设备的第二密钥标识信息。
具体的，终端在向第二网络设备注册时，该第二网络设备可以通过鉴权向量或者用于指示终端鉴权成功的消息向终端发送第二密钥标识信息。
其中，用于指示终端鉴权成功的消息同以上描述，在此不再赘述。
S1042、终端生成包括第二密钥标识信息的第二安全上下文，所述第二密钥标识信息用于标识所述第二安全上下文。
具体的，终端生成第一安全上下文的过程可以如下：
当终端从所接入网络的第一网络设备出接收到第一密钥标识信息，则终端便可以结合表1、表2以及表3中的参数生成第一安全上下文。具体的，终端生成第二安全上下文的过程可以参见终端生成第一安全上下文的过程，本申请在此不再赘述。
可以理解的是，终端基于第一密钥标识信息生成第一安全上下文时，该第一安全上下文中还可以包括其他参数，具体的参数可以参考表1、表2和表3所示的部分参数，例如，第一安全上下文中还可以包括终端的身份标识信息，终端使用的接入技术等，本申请对此不进行限定。
示例性的，如图2所示，当终端使用3GPP接入技术接入第一网络时，该第一网络设备可以为如图2所示的AMF201，当终端使用非3GPP接入技术接入第二网络时，该第二网络设备可以为如图2所示的AMF202。
具体的，终端在注册到一个网络时，通常会与该网络存在鉴权的过程，具体的，终端可以在网络侧完成对终端的鉴权过程中或者网络侧完成对终端的鉴权之后，从该网络的网络设备中获取到密钥标识信息。
可以理解的是，当第一网络设备和第二网络设备属于同一个运营商时，该第一网络设备可以和第二网络设备之间交互，因此第一网络设备向终端发送的第一密钥标识信息和第二网络设备向终端发送的第二密钥标识信息通常不同，当第一网络设备和第二网络设备属于不同运营商时，在第一网络设备和第二网络设备之间无法交互彼此为终端分配的密钥标识信息的情况下，该第一密钥标识信息和第二密钥标识信息可以相同，也可以不同。
终端除了从第一网络设备接收第一密钥标识信息，从第二网络设备接收第二密钥标识信息以外，还可以从第一网络设备接收第一身份标识信息，从第二网络设备接收第二身份标识信息。其中，第一密钥标识信息用于标识第一安全上下文，第二密钥标识信息用于标识第二安全上下文。第一身份标识信息用于在第一网络中标识终端，第二身份标识用于在第二网络中标识终端。当用密钥标识信息区分第一安全上下文和第二安全上下文所用的网络时，第一密钥标识信息和第二密钥标识信息不同。当用身份标识信息区分第一安全上下文和第二安全上下文所用的网络时，第一身份标识信息和第二身份标识信息不同。
可选的，作为本申请另一种可能的实现方式，在步骤S101之前，还包括：
S105、终端确定终端已接入的网络与所述终端当前请求注册到的目标网络的第一标识是否相同。
可选的，终端接入已接入的网络与所述终端当前请求注册到的目标网络的接入技术不同。
具体的，该第一标识用于确定终端已接入的网络和终端当前请求注册到的目标网络是否属于同一个运营商。
具体的，该第一标识可以为公用陆地移动网(public land mobile network，PLMN)ID，小区ID，位置区信息等。该PLMN ID，可以是一个IP地址，可以是一个类似于email的地址信息，还可以是移动国家码(mobile country codes，MNN)+移动网络码(mobile network codes，MNC)信息，本申请对此不进行限定。
具体的，终端根据第一标识确定已接入的网络和终端当前请求注册到的目标网络是否属于同一个运营商的例子如下：终端获取已接入的网络的PLMN ID-1，以及当前请求注册到的目标网络的PLMN ID-2。终端确定已接入的网络的PLMN ID-1与当前请求注册到的目标网络的PLMN ID-2相同，终端确定已接入的网络和终端当前请求注册到的目标网络属于同一个运营商。这样，终端便可以将当前请求注册到的目标网络的请求发送给已接入的网络对应的网络设备1，由网络设备1将当前请求注册到的目标网络的请求发送给目标网络的网络设备2，此时目标网络就是已接入的网络。
如图5所示，图5示出了本申请实施例提供的一种安全通信方法的流程示意图，如图5所示，该方法包括：
S201、第一网络设备获取密钥标识信息。
具体的，该第一网络设备可以为图1或图2所示的AMF，AUSF或者SEAF。
本申请中第一网络设备可以在网络侧完成对终端的鉴权时，生成密钥标识信息，也可以在网络侧对终端鉴权的过程中，生成密钥标识信息。
S202、第一网络设备在网络侧完成对终端的鉴权后，向终端发送密钥标识信息。
具体的，第一网络设备可以通过如下方式确定网络侧完成对终端的鉴权，例如，一方面，当第一网络设备为AUSF时，该第一网络设备完成对终端的鉴权，基于此，该第一网络设备便可以确定网络侧完成对终端的鉴权。当第一网络设备为AMF，第一网络设备接收到AUSF或者SEAF发送的用于指示终端鉴权成功的消息，则第一网络设备确定网络侧完成对终端的鉴权。当第一网络设备为SEAF，第一网络设备接收到AUSF发送的用于指示终端鉴权成功的消息，则第一网络设备确定网络侧完成对终端 的鉴权。
该用于指示终端鉴权成功的消息可以参见上述实施例，本申请在此不再赘述。
可选的，本申请中的步骤S202可以通过以下方式实现：
S2021、第一网络设备可以通过用于指示终端鉴权成功的消息向终端发送密钥标识信息。
本申请中利用用于指示终端鉴权成功的消息向终端发送密钥标识信息，可以在确定对终端成功鉴权之后再发送密钥标识信息，避免了由于对终端未成功鉴权而发送密钥标识信息时，造成的信令浪费。
当然，第一网络设备可以利用向终端指示鉴权成功的过程中新定义的一个信令消息来向终端发送密钥标识信息。
其中，新定义的一个信令消息可以认为是鉴权过程中使用的一条消息，此消息属于5G AKA或EAP-AKA’鉴权中一条消息；或者也可以理解为是鉴权成功后，第一网络设备发送NAS SMC之前的消息，此消息不在5G AKA或EAP-AKA’的消息内；或者还可以是承载用于指示终端鉴权成功的消息的承载消息。比如，承载消息是通过N2接口的传递的NAS消息。
具体的，密钥标识信息可以携带在指示鉴权成功的消息内传递给终端，或者放在指示鉴权成功的消息外随着新定义的信令传递给终端。比如用于指示终端鉴权成功的消息可以通过NAS SMC消息发送，这样也即密钥标识信息携带在用于指示终端鉴权成功的消息中，用于指示终端鉴权成功的消息携带在NAS SMC消息中；也可以携带在指示鉴权成功的消息外，同时放在NAS SMC消息中。
需要说明的是，AMF通过NAS SMC消息发送密钥标识信息适用于5G AKA鉴权或EAP-AKA’鉴权或其他未来用于3GPP系统的其他鉴权过程。
可选的，本申请中的步骤S202还可以通过以下方式实现：
S2022、第一网络设备通过NAS SMC消息向终端发送密钥标识信息。
可以理解的是，第一网络设备通过NAS SMC消息向终端发送密钥标识信息时，该NAS SMC消息中还可以包括用于指示终端鉴权成功的消息。这样通过将用于指示终端鉴权成功的消息放到NAS SMC中传输一方面可以节省信令，这是由于当NAS SMC消息和用于指示终端鉴权成功的消息以两条消息的形式发送给终端时，那么终端在收到NAS SMC消息和用于指示终端鉴权成功的消息时对每个消息均要做出响应，这样势必会增加信令开销，且还增加了AMF与终端的交互过程。
当然，在网络侧对终端鉴权的过程中，第一网络设备生成密钥标识信息的时候，本申请中第一网络设备还可以在向终端发送鉴权向量的过程中，向终端发送密钥标识信息。例如，使用EAP-请求(request，REQ)/AKA’-Challenge消息向终端发送密钥标识信息。
需要说明的是，本申请中以EAP-AKA’为例的描述，也可以适用于5G AKA中。如果5G AKA中不存在EAP-AKA’中的一个流程，则在5G AKA中可以用相似的，或者相关的消息替代，当然，也可以在5G AKA中增加相应的流程用于完成相关操作。
S203、终端接收第一网络设备发送的密钥标识信息。
具体的，终端可以在NAS SMC消息中接收第一网络设备发送的密钥标识信息， 也可以在用于指示终端鉴权成功的消息中接收密钥标识信息，至于终端在哪个消息中接收到密钥标识信息可以基于第一网络设备通过哪个消息向终端发送。
由于当第一网络设备为AMF、AUSF或SEAF时，第一网络设备确定密钥标识信息的方法不同，因此下述将分别介绍：
可选的，一种可能的实现方式，当第一网络设备为AMF或SEAF时，本申请中的步骤S201可以通过如下方式实现：
S2011、第一网络设备接收到用于指示终端鉴权成功的消息，第一网络设备生成密钥标识信息。本申请中第一网络设备在接收到用于指示终端鉴权成功的消息时，便可以确定网络侧对终端鉴权成功，在这种情况下，第一网络设备才生成密钥标识信息，可以避免由于终端鉴权不成功时导致生成的密钥标识信息浪费的问题。
具体的，当第一网络设备为AMF，该AMF接收到SEAF或AUSF发送的用于指示终端鉴权成功的消息，则AMF获取密钥标识信息，在这种情况下，可选的，当用于指示终端鉴权成功的消息中包括密钥标识信息时，AMF可以直接从用于指示终端鉴权成功的消息中获取密钥标识信息。
可选地，当用于指示终端鉴权成功的消息中不包括密钥标识信息时，AMF自己生成密钥标识信息。当第一网络设备为SEAF，该SEAF接收到AUSF发送的用于指示终端鉴权成功的消息，或者SEAF自己验证UE是真实的之后，则SEAF获取密钥标识信息，在这种情况下，可选的当用于指示终端鉴权成功的消息中包括密钥标识信息时，SEAF可以直接从用于指示终端鉴权成功的消息中获取密钥标识信息。当然，也存在密钥标识信息全部由SEAF、或AMF单独生成的情况，即指示终端鉴权成功的消息中没有密钥标识信息。
由于，密钥标识信息可以由至少一个网络设备生成，若有至少两个网络设备生成了密钥标识符，则密钥标识符需要被传递给其下一级的网络设备(例如，AUSF生成密钥标识信息传递给SEAF或者AMF，或者SEAF生成密钥标识信息传递给AMF)，因此，每个下一级的网络设备可以生成密钥标识信息，也可以从其上一级网络设备出获取密钥标识信息，以确定密钥标识信息，下述将分别介绍：
可选的，本申请中的步骤S2011具体可以通过以下方式实现：第一网络设备接收到用于指示终端鉴权成功的消息，或者第一设备自己确定UE是真实的之后，将第二网络设备发送的第一密钥标识信息确定为密钥标识信息。例如，当第一网络设备为AMF时，第二网络设备可以为SEAF或者AUSF，当第一网络设备为SEAF时，第二网络设备可以为AUSF。具体的，第二网络设备向第一网络设备发送密钥标识信息的方式可以参见上述描述，本申请对此不进行限定。
可选的，本申请中的步骤S2011具体还可以通过以下方式实现：第一网络设备确定接收到用于指示终端鉴权成功的消息，或者第一设备自己确定UE是真实的之后，生成密钥标识信息。在这种情况下，当用于指示终端鉴权成功的消息中不携带第二网络设备发送的第一密钥标识信息时，第一网络设备可以自己生成密钥标识信息，当用于指示终端鉴权成功的消息中携带第二网络设备发送的第一密钥标识信息时，第一网络设备可以基于第一密钥标识信息生成密钥标识信息，也可以不基于第一密钥标识信息生成密钥标识信息，本申请对此不进行限定。
可选的，作为本申请的又一个实施例，基于图5，如图6所示，本申请提供的方法在步骤201之前，还包括：
S204、第一网络设备获取多个密钥标识子信息，所述多个密钥标识子信息中全部来自其它网络设备，或者所述多个密钥标识子信息部分由所述第一网络设备生成，部分来自其它网络设备。
此处的其他网络设备可以为SEAF或者AUSF。具体的，当第一网络设备为AMF时，其他网络设备可以为SEAF和AUSF中的至少一项。当第一网络设备为SEAF时，其他网络设备可以为AUSF。
可选的，本申请中的密钥标识信息可以为密钥标识符。
下述将以SEAF、AUSF以及AMF均生成密钥标识信息为例进行说明。AUSF生成密钥标识信息-a，SEAF生成密钥标识信息-b，AMF生成密钥标识信息-c，则AMF将密钥标识信息-a，密钥标识信息-b，以及密钥标识信息-c进行组合，以确定密钥标识信息，此时密钥标识信息为密钥标识信息-c和密钥标识信息-b和密钥标识信息-a。再比如，在网络规定密钥标识信息为9比特的情况下，AUSF可以填充最高3比特，即第9比特、第8比特和第7比特，填充之后将001000000传递给SEAF，SEAF再填充第6比特，第5比特，以及第4比特，最终SEAF发送给AMF的密钥标识信息可以为001010000，最终，AMF填充最后3比特，即第3比特，第2比特以及第1比特，最终得到密钥标识信息即001010001。
此处，AUSF或SEAF向第一网络设备发送的多个密钥标识子信息的方法可以参见上述步骤，本申请对此不进行限定，AUSF和SEAF各自生成的多个密钥标识子信息可以相同也可以不同，本申请对此不进行限定。
基于步骤S204，本申请中的步骤S202具体可以通过以下方式实现：
S2023、第一网络设备接收到用于指示终端鉴权成功的消息，生成第二密钥标识信息。
具体的，本申请中第一网络设备可以基于多个密钥标识子信息生成第二密钥标识信息，也可以基于多个密钥标识子信息之外的其余参数生成第二密钥标识信息。
S2024、第一网络设备根据多个密钥标识子信息以及第二密钥标识信息，确定所述密钥标识信息。
示例性的，AUSF在接收到用于指示对终端鉴权的消息(例如，EAP-RSP/AKA’-Challenge消息)之后，AUSF生成密钥标识信息1，然后AUSF可以通过用于指示完成对终端鉴权的消息(例如，下述将以EAP-Success消息为例，本申请对该用于指示完成对终端鉴权的消息的具体名称不进行限定)，将密钥标识信息1发送给SEAF，SEAF在接收到携带密钥标识信息1的EAP-Success消息之后，一方面可以确定网络侧完成对终端的鉴权，于是SEAF生成密钥标识信息2，然后，SEAF通过EAP-Success消息将密钥标识信息1和密钥标识信息2发送给AMF，AMF在收到携带密钥标识信息1和密钥标识信息2的EAP-Success之后，AMF生成密钥标识信息3，最终，AMF根据密钥标识信息1、密钥标识信息2以及密钥标识信息3确定密钥标识信息。
本申请对AMF根据密钥标识信息1、密钥标识信息2以及密钥标识信息3确定密 钥标识信息的方式不进行限定，AMF可以根据密钥标识信息1和密钥标识信息2以及密钥标识信息3的位置确定密钥标识信息，但是本申请对各个密钥标识信息的位置不进行限定，示例性的，该密钥标识信息＝密钥标识信息1+密钥标识信息2+密钥标识信息3，或者密钥标识信息＝密钥标识信息2+密钥标识信息3+密钥标识信息1，这样做的好处是，当AUSF或者SEAF也有保存不止1个终端的密钥时，也可以通过密钥标识信息，识别终端正在使用哪套密钥。因此，由每个网元生成一部分密钥标识信息，可以使密钥标识信息更加灵活，尤其是当除了AMF以外的网元也会有多套终端的安全上下文的时候。
可选的，一种可能的实现方式，当第一网络设备为AUSF时，本申请中的步骤S201还可以通过以下方式实现：
S2012、第一网络设备确定接收到对终端的鉴权请求，第一网络设备确定密钥标识信息。
具体的，第一网络设备确定接收到SEAF发送的对终端的鉴权请求，则第一网络设备生成密钥标识信息，以确定密钥标识信息。
下述结合图7以终端先从3GPP侧接入，但由于某种条件触发，终端开始从non-3GPP侧接入为例，详细介绍本申请提供的一种安全通信方法：
S301、终端使用non-3GPP接入技术接入网络。
具体的，步骤S301的实现可以参见现有技术，本申请对此不进行限定。
S302、在终端具有与网络之间的安全上下文的情况下，终端和N3IWF交互IKE_SA_INIT消息。
可选的，该IKE_SA_INIT消息携带密钥材料，当终端完成与N3IWF之间的交互后，终端和N3IWF之间可以生成相同的密钥，用于保护后面所有消息。
S303、终端向N3IWF发送网络密钥交换协议鉴权请求消息(Internet Key Exchange protocol authentication Request，IKE_AUTH_Request)。
该IKE_AUTH_Request消息中携带给终端的标识信息，IKE_AUTH_Request消息中可以不携带鉴权参数。
S304、N3IWF向终端发送针对IKE_AUTH_Request消息的回复消息，该针对IKE_AUTH_Request消息的回复消息用于指示终端开始5G鉴权流程。
可选的，针对IKE_AUTH_Request消息的回复消息中携带EAP-5G-Request消息/5G-Start消息。
S305、终端确定接入的N3IWF与通过3GPP接入技术接入的网络是否是同一个运营商。
具体的，终端使用通过3GPP接入技术接入的网络的PLMN ID寻找相关的N3IWF。再比如，终端得到一种反馈，反馈的内容是N3IWF的相关信息，终端可以从信息中判断N3IWF所在的PLMN ID是否与3GPP接入的PLMN ID相同。
此处，PLMN ID的具体内容可以参见上述实施例，本申请对此不进行限定。
S306、终端向N3IWF发送IKE_AUTH Request消息，该IKE_AUTH Request消息用于终端注册到AMF。
可选的，该IKE_AUTH Request消息中包括EAP-5G-ReS/5G-NAS消息。
其中，EAP-5G-ReS/5G-NAS消息中含有NAS-协议数据单元(protocol data unit，PDU)，NAS PDU中含有注册请求消息，该注册请求消息用于终端向AMF注册。
可以理解的是，当终端已通过3GPP接入技术注册到该AMF的情况下，此处的注册请求可以用于终端通过非3GPP接入技术注册到AMF。
可选的，注册请求消息携带有终端的临时身份信息，例如，GUTI，密钥标识信息ngKSI。该注册请求消息被ngKSI标识的NAS完整性密钥做完整性保护。
S307、N3IWF首先根据GUTI中信息，选择一个AMF。
具体的，当N3IWF根据GUTI找到GUTI标识的AMF-2/SEAF-2时，N3IWF将注册请求消息发送给AMF-2/SEAF-2。当N3IWF根据GUTI无法找到AMF-2/SEAF-2时，N3IWF将注册请求消息转发给AMF-1/SEAF-1。本申请实施例以N3IWF根据GUTI无法找到AMF-2/SEAF-2为例。
S308、N3IWF将注册请求消息转发给AMF-1。
S309、AMF-1根据GUTI中的信息确定AMF-2。
S310、AMF-1将注册请求消息转发给AMF-2。
S311、AMF-2根据注册请求消息中的GUTI以及ngKSI确定出密钥，验证完整性保护是否正确，在完整性保护正确的情况下，执行下述步骤S212：
S312、AMF-2根据AMF-2中现有的密钥oKamf生成一个新的密钥nKamf。
S313、AMF-2将新的nKamf发送给AMF-1。
可选的，AMF-2还可以向AMF-1发送第一指示信息，该第一指示信息用于指示终端和AMF-2之间的状态是连接态。
具体的，该第一指示信息可以是AMF-2当前使用的密钥标识符，还可以是一个比特位指示信息。
其中，AMF-2根据现有的密钥oKamf生成一个新的密钥nKamf的一种可能的实现方式为：nKamf＝KDF(oKamf，其他参数)，其他参数可以是一个或多个。比如其他参数为NAS COUNT，或者为NAS COUNT和ngKSI，或者单独为ngKSI，或者Kamf维护一个COUNT值，此COUNT值会传递给AMF-1，由AMF-1通过NAS SMC消息传递给终端。
另一种实现方式是由nKamf＝密钥衍生函数(key derivation function，KDF)(Kseaf，其他参数)，其中，Kseaf表示SEAF中的密钥。
S314、AMF-1选择安全算法。
具体的，AMF-1使用nKamf生成新的NAS密钥，以及新的密钥标识符。
具体的，一方面，AMF生成的新的密钥标识符可以与收到的密钥标识符不同，以便于终端根据密钥标识符区分出不同的安全上下文。
另一方面，AMF生成与接收到的密钥标识符相同的密钥标识符，在这种情况下终端可以使用终端的身份标识信息来区分不同的安全上下文。
S315、AMF-1发送NAS SMC消息给终端。
可选的，NAS SMC消息中携带选择的安全能力和密钥标识信息，例如，密钥标识信息可以为密钥标识符。
可选地，当NAS SMC消息中携带的密钥标识符与终端存储的密钥标识符不同时， AMF-1还可以向终端发送第二指示信息，该第二指示信息用于告知终端是否需要保留原来的密钥。可选的，当密钥标识符与之前的不同的时候，终端可以默认保留之前的密钥标识符。
S316、N3IWF转发NAS SMC消息给终端。
S317、终端收到NAS SMC消息之后，确定是否更新密钥。
具体的，终端可以通过如下方式确定是否更新密钥。
方式一、终端确定3GPP侧正在接入，如果从non-3GPP侧收到一个NAS SMC消息，则终端确定non-3GPP侧需要生成新的密钥。
方式二、终端确定接收到AMF-1发送的新的密钥标识符ngKSI，则根据新的密钥标识符ngKSI生成新的密钥。
方式三、终端根据第二指示信息确定是否更新密钥，或者终端根据NAS SMC消息中携带的COUNT值来确定是否更新密钥。
具体的，第二指示信息指示更新密钥，则终端更新密钥。
S318、终端向AMF-1回复NAS SMP消息。
可选的，NAS SMP消息使用新密钥做完整性保护。
S319、N3IWF转发NAS SMP消息至AMF-1。
S320、AMF-1在收到NAS SMP消息，向N3IWF传递N3IWF使用的密钥Kn3iwf。此外，AMF-1生成一个GUTI-1，该GUTI-1随着注册完成消息发放给终端。
终端在接收到GUTI-1，若AMF-1向终端发送的eKSI和终端在在注册请求消息中使用的eKSI相同的情况下，那么终端便可以通过GUTI-1来区分不同的安全上下文。
需要说明的是，当图7所示的方案应用于当终端通过3GPP接入运营商A的AMF，再通过non-3GPP接入运营商B的AMF，同时保持3GPP侧的接入时。基于此场景下，当终端再接入运营商B的AMF时，运营商B要触发non-3GPP侧的鉴权流程，触发方法有2种：
第一种方式：终端确定要接入的N3IWF的运营商与通过3GPP接入的运营商不同，在这种情况下，终端通过non-3GPP接入时，要在non-3GPP侧重新鉴权，在这种情况下，终端向AMF发送的注册请求消息携带的身份标识信息为SUCI。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，各个网元，例如终端和网络设备，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对终端和网络设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分 各个功能模块为例进行说明：
在采用集成的单元的情况下，图8示出了上述实施例中所涉及的终端的一种可能的结构示意图。终端包括：确定单元101以及通信单元102。其中，确定单元101用于支持终端执行上述实施例中的步骤S101、S103以及S104以及S105以及S305；通信单元用于支持终端执行上述实施例中的步骤S102以及S301。可选的，终端还包括接收单元103以及生成单元104，其中，接收单元103用于支持终端执行上述实施例中的步骤S1031、S1041以及S203以及S302，生成单元104用于支持终端执行上述实施例中的步骤S1032、S1042。此外，终端还包括发送单元用于执行S303、S306。上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图9示出了上述实施例中所涉及的终端的一种可能的逻辑结构示意图。终端包括：处理模块112和通信模块113。处理模块112用于对终端的动作进行控制管理，例如，处理模块112用于支持终端执行上述实施例中的步骤S101、S103以及S104以及S105以及S305以及S1032、S1042；通信模块113用于支持终端执行上述实施例中的步骤S1031、S1041以及S203以及S302以及S303、S306。和/或用于本文所描述的技术的其他由终端执行的过程。终端还可以包括存储模块111，用于存储终端的程序代码和数据。
其中，处理模块112可以是处理器或控制器，例如可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。通信模块113可以是收发器、收发电路或通信接口等。存储模块111可以是存储器。
当处理模块112为处理器120，通信模块113为通信接口130或收发器时，存储模块111为存储器140时，本申请所涉及的终端可以为图10所示的设备。
其中，通信接口130、至少一个处理器120以及存储器140通过总线110相互连接；总线110可以是PCI总线或EISA总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。其中，存储器140用于存储终端的程序代码和数据。通信接口130用于支持终端与其他设备(例如，网络设备)通信，处理器120用于支持终端执行存储器140中存储的程序代码和数据以实现本申请提供的一种安全通信方法。
在采用集成的单元的情况下，图11示出了上述实施例中所涉及的网络设备的一种可能的结构示意图。网络设备包括：获取单元201和发送单元202。其中，获取单元201用于支持网络设备执行上述实施例中的步骤S201(具体的，可以为S2011、S2012)、S204；发送单元202用于支持网络设备执行上述实施例中的步骤S202(具体的可以为S2021、S2022、S2023以及S2024)。和/或用于本文所描述的技术的其它过程。上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图12示出了上述实施例中所涉及的网络设备的一种可能的逻辑结构示意图。网络设备，包括：处理模块212和通信模块213。处理模块212用于对网络设备的动作进行控制管理，例如，处理模块212用于支持网络设备执行上述实施例中的步骤S201(具体的，可以为S2011、S2012)、S204；通信模块213用于支持网络设备执行上述实施例中的S202(具体的可以为S2021、S2022、S2023以及S2024)。和/或用于本文所描述的技术的其他由网络设备执行的过程。网络设备还可以包括存储模块211，用于存储网络设备的程序代码和数据。
其中，处理模块212可以是处理器或控制器，例如可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。通信模块213可以是收发器、收发电路或通信接口等。存储模块211可以是存储器。
当处理模块212为处理器220，通信模块213为通信接口230或收发器时，存储模块211为存储器210时，本申请所涉及的网络设备可以为图13所示的设备。
其中，通信接口230、至少一个处理器220以及存储器210通过总线200相互连接；总线200可以是PCI总线或EISA总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。其中，存储器210用于存储网络设备的程序代码和数据。通信接口230用于支持网络设备与其他设备(例如，终端)通信，处理器220用于支持网络设备执行存储器210中存储的程序代码和数据以实现本申请提供的一种安全通信方法。
需要说明的是，本申请中涉及的接收单元(或用于接收的单元)可以是一种该安全通信装置的接口电路，用于从其它装置接收信号。例如，当该安全通信装置以芯片的方式实现时，该接收单元是该芯片用于从其它芯片或装置接收信号的接口电路。以上发送单元(或用于发送的单元)是一种该安全通信装置的接口电路，用于向其它装置发送信号。例如，当该安全通信装置以芯片的方式实现时，该发送单元是该芯片用于向其它芯片或装置发送信号的接口电路。
图14是本申请实施例提供的芯片系统150的结构示意图。芯片系统150包括至少一个处理器1510和接口电路1530。
可选的，该芯片系统150还包括存储器1550，存储器1550可以包括只读存储器和随机存取存储器，并向处理器1510提供操作指令和数据。存储器1550的一部分还可以包括非易失性随机存取存储器(NVRAM)。
在一些实施方式中，存储器1550存储了如下的元素，可执行模块或者数据结构，或者他们的子集，或者他们的扩展集：
在本申请实施例中，通过调用存储器1550存储的操作指令(该操作指令可存储在操作系统中)，执行相应的操作。
一种可能的实现方式为：终端和网络设备所用的芯片系统的结构类似，不同的装置可以使用不同的芯片系统以实现各自的功能。
处理器1510控制终端和网络设备的操作，处理器1510还可以称为CPU(Central Processing Unit，中央处理单元)。存储器1550可以包括只读存储器和随机存取存储器，并向处理器1510提供指令和数据。存储器1550的一部分还可以包括非易失性随机存取存储器(NVRAM)。具体的应用中存储器1550、接口电路1530以及存储器1550通过总线系统1520耦合在一起，其中总线系统1520除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图14中将各种总线都标为总线系统1520。
上述本申请实施例揭示的方法可以应用于处理器1510中，或者由处理器1510实现。处理器1510可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1510中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1510可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1550，处理器1510读取存储器1550中的信息，结合其硬件完成上述方法的步骤。
可选地，接口电路1530用于执行图3、图4、图5所示的实施例中的终端和网络设备的接收和发送的步骤。
处理器1510用于执行图3、图4、图5所示的实施例中的终端和网络设备的处理的步骤。
在上述实施例中，存储器存储的供处理器执行的指令可以以计算机程序产品的形式实现。计算机程序产品可以是事先写入在存储器中，也可以是以软件形式下载并安装在存储器中。
计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk，SSD)等。
一方面，提供一种计算机存储介质，计算机可读存储介质中存储有指令，当指令在终端上运行时，使得终端执行实施例中的S101、S103以及S104以及S105以及S305以及S1032、S1042，S1031、S1041以及S203以及S302以及S303、S306。和/或用于 本文所描述的技术的其他由终端执行的过程。
又一方面，提供一种计算机存储介质，计算机可读存储介质中存储有指令，当指令在网络设备上运行时，使得网络设备执行实施例中的步骤S201(具体的，可以为S2011、S2012)、S204，S202(具体的可以为S2021、S2022、S2023以及S2024)。和/或用于本文所描述的技术的其他由网络设备执行的过程。
一方面，提供一种包含指令的计算机程序产品，计算机程序产品中存储有指令，当指令在终端上运行时，使得终端执行实施例中的S101、S103以及S104以及S105以及S305以及S1032、S1042，S1031、S1041以及S203以及S302以及S303、S306。和/或用于本文所描述的技术的其他由终端执行的过程。
又一方面，提供一种包含指令的计算机程序产品，计算机程序产品中存储有指令，当指令在网络设备上运行时，使得网络设备执行实施例中的S201(具体的，可以为S2011、S2012)、S204，S202(具体的可以为S2021、S2022、S2023以及S2024)。和/或用于本文所描述的技术的其他由网络设备执行的过程。
此外，本申请还提供一种通信系统，该通信系统包括如图8-10所示的终端，以及图11-图13所示的网络设备，除此之外，通信系统还可以包括与终端和网络设备通信的其他设备。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可 以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (40)

  1. 一种安全通信方法，其特征在于，应用于终端中，所述终端具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于所述终端与第一网络通信，所述第二安全上下文用于所述终端与第二网络通信，且所述第一安全上下文和所述第二安全上下文包括不同的第一信息，所述方法包括：
    所述终端在与目标网络通信时，根据所述第一信息确定目标安全上下文，其中，当所述目标网络为所述第一网络时，所述目标安全上下文为所述第一安全上下文；或者，当所述目标网络为所述第二网络时，所述目标安全上下文为所述第二安全上下文；
    所述终端根据所述目标安全上下文与所述目标网络通信。
  2. 根据权利要求1所述的方法，其特征在于，所述第一信息为密钥标识信息和所述终端的身份标识信息中的至少一项。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一安全上下文和所述第二安全上下文还包括不同的第二信息，所述第二信息用于指示安全上下文对应的网络的接入技术。
  4. 根据权利要求1或2所述的方法，其特征在于，所述第一信息为指示信息，所述指示信息用于安全上下文对应的网络的接入技术。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一安全上下文不包括UP密钥，所述第二安全上下文包括UP密钥；
    或者，所述第一安全上下文包括UP密钥，所述第二安全上下文不包括UP密钥。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述终端在与所述目标网络通信之前，还包括：
    所述终端在注册到第一网络时，所述终端确定所述第一安全上下文；
    所述终端在注册到第二网络时，所述终端确定所述第二安全上下文。
  7. 根据权利要求6所述的方法，其特征在于，所述终端确定所述第一安全上下文，包括：
    所述终端接收来自第一网络设备的第一密钥标识信息；
    所述终端生成包括所述第一密钥标识信息的所述第一安全上下文，所述第一密钥标识信息用于标识所述第一安全上下文；
    所述终端确定所述第二安全上下文，包括：
    所述终端接收来自第二网络设备的第二密钥标识信息；
    所述终端生成包括所述第二密钥标识信息的所述第二安全上下文，所述第二密钥标识信息用于标识所述第二安全上下文。
  8. 根据权利要求7所述的方法，其特征在于，终端接收来自网络设备的密钥标识信息，包括：
    所述终端接收网络设备发送的非接入层安全模式命令NAS SMC消息，所述NAS SMC消息中包括所述第一密钥标识信息；或，
    所述终端接收网络设备发送的用于指示终端鉴权成功的消息，所述用于指示终端鉴权成功的消息包括所述密钥标识信息；或，
    所述终端接收网络设备发送的NAS SMC消息，所述NAS SMC消息包括用于指 示终端鉴权成功的消息，所述用于指示终端鉴权成功的消息包括所述密钥标识信息。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述终端在与目标网络通信之前，所述方法还包括:
    所述终端确定所述终端已接入的网络与所述终端当前请求注册到的目标网络的第一标识是否相同。
  10. 一种安全通信装置，其特征在于，所述安全通信装置具有第一安全上下文和第二安全上下文，其中，第一安全上下文用于所述安全通信的装置与第一网络通信，所述第二安全上下文用于所述安全通信的装置与第二网络通信，且所述第一安全上下文和所述第二安全上下文包括不同的第一信息，所述安全通信装置包括：
    确定单元，用于在与目标网络通信时，根据所述第一信息确定目标安全上下文，其中，当所述目标网络为所述第一网络时，所述目标安全上下文为所述第一安全上下文；或者，当所述目标网络为所述第二网络时，所述目标安全上下文为所述第二安全上下文；
    通信单元，用于根据所述目标安全上下文与所述目标网络通信。
  11. 根据权利要求10所述的装置，其特征在于，所述第一信息为密钥标识信息和所述终端的身份标识信息中的至少一项。
  12. 根据权利要求10或11所述的装置，其特征在于，所述第一安全上下文和所述第二安全上下文还包括不同的第二信息，所述第二信息用于指示安全上下文对应的网络的接入技术。
  13. 根据权利要求10或11所述的装置，其特征在于，所述第一信息为指示信息，所述指示信息用于安全上下文对应的网络的接入技术。
  14. 根据权利要求10-13任一项所述的装置，其特征在于，所述第一安全上下文不包括UP密钥，所述第二安全上下文包括UP密钥；
    或者，所述第一安全上下文包括UP密钥，所述第二安全上下文不包括UP密钥。
  15. 根据权利要求10-14任一项所述的装置，其特征在于，所述确定单元，还用于在所述安全通信装置注册到第一网络时，确定所述第一安全上下文；
    以及，用于在所述在安全通信装置注册到第二网络时，确定所述第二安全上下文。
  16. 根据权利要求15所述的装置，其特征在于，所述安全通信装置，还包括：
    接收单元，用于接收来自第一网络设备的第一密钥标识信息；
    生成单元，用于生成包括所述第一密钥标识信息的所述第一安全上下文，所述第一密钥标识信息用于标识所述第一安全上下文。
  17. 根据权利要求15或16所述的装置，其特征在于，接收单元，还用于接收来自第二网络设备的第二密钥标识信息；
    生成单元，还用于生成包括所述第二密钥标识信息的所述第二安全上下文，所述第二密钥标识信息用于标识所述第二安全上下文。
  18. 根据权利要求16或17所述的装置，其特征在于，
    所述接收单元，还用于接收网络设备发送的非接入层安全模式命令NAS SMC消息，所述NAS SMC消息中包括所述第一密钥标识信息；
    或，所述接收单元用于接收网络设备发送的用于指示终端鉴权成功的消息，所述 用于指示终端鉴权成功的消息包括所述密钥标识信息；
    或，所述接收单元，用于接收网络设备发送的NAS SMC消息，所述NAS SMC消息包括用于指示终端鉴权成功的消息，所述用于指示终端鉴权成功的消息包括所述密钥标识信息。
  19. 根据权利要求10-18任一项所述的装置，其特征在于，所述确定单元，还用于确定所述装置已接入的网络与所述装置当前请求注册到的目标网络的第一标识是否相同。
  20. 一种安全通信方法，其特征在于，包括：
    第一网络设备获取密钥标识信息，所述密钥标识信息用于标识安全上下文；
    所述第一网络设备在网络侧完成对终端的鉴权时，向所述终端发送所述密钥标识信息。
  21. 根据权利要求20所述的方法，其特征在于，所述第一网络设备获取密钥标识信息，包括：
    第一网络设备接收到用于指示对所述终端鉴权成功的消息之后，生成所述密钥标识信息。
  22. 根据权利要求20或21所述的方法，其特征在于，所述第一网络设备获取密钥标识信息，包括：所述第一网络设备接收用于指示终端鉴权成功的消息，所述用于指示终端鉴权成功的消息包括所述密钥标识信息。
  23. 根据权利要求20-22任一项所述的方法，其特征在于，所述第一网络设备为AMF或SEAF，所述第一网络设备获取密钥标识信息之前，所述方法还包括：
    所述第一网络设备获取多个密钥标识子信息，所述多个密钥标识子信息全部来自其它网络设备，或者所述多个密钥标识子信息部分由所述第一网络设备生成，部分来自其它网络设备；
    所述第一网络设备获取密钥标识信息，包括：
    所述第一网络设备根据所述多个密钥标识子信息，生成所述密钥标识信息。
  24. 根据权利要求20-22任一项所述的方法，其特征在于，所述第一网络设备为AMF，所述第一网络设备向所述终端发送所述密钥标识信息，包括：所述第一网络设备通过非接入层安全模式命令NAS SMC消息向所述终端发送所述密钥标识信息。
  25. 一种安全通信装置，其特征在于，包括：
    获取单元，用于获取密钥标识信息，所述密钥标识信息用于标识安全上下文；
    发送单元，用于在网络侧完成对终端的鉴权时，向所述终端发送所述密钥标识信息。
  26. 根据权利要求25所述的装置，其特征在于，所述第一网络设备获取密钥标识信息，包括：
    第一网络设备接收到用于指示对所述终端鉴权成功的消息之后，生成所述密钥标识信息。
  27. 根据权利要求25或26所述的装置，其特征在于，所述第一网络设备获取密钥标识信息，包括：所述第一网络设备接收用于指示终端鉴权成功的消息，所述用于指示终端鉴权成功的消息包括所述密钥标识信息。
  28. 根据权利要求25-27任一项所述的装置，其特征在于，所述第一网络设备为AMF或SEAF，所述第一网络设备获取密钥标识信息之前，所述方法还包括：
    所述第一网络设备获取多个密钥标识子信息，所述多个密钥标识子信息全部来自其它网络设备，或者所述多个密钥标识子信息部分由所述第一网络设备生成，部分来自其它网络设备；
    所述第一网络设备获取密钥标识信息，包括：
    所述第一网络设备根据所述多个密钥标识子信息，生成所述密钥标识信息。
  29. 根据权利要求25-27任一项所述的装置，其特征在于，所述第一网络设备为AMF，所述第一网络设备向所述终端发送所述密钥标识信息，包括：所述第一网络设备通过非接入层安全模式命令NAS SMC消息向所述终端发送所述密钥标识信息。
  30. 一种安全通信方法，其特征在于，所述方法包括：
    终端接收来自第一网络设备的非接入层安全模式命令NAS SMC消息，所述NAS SMC消息中包括用于指示终端鉴权成功的消息和第一密钥标识信息；
    所述终端生成包括所述第一密钥标识信息的第一安全上下文，其中，所述第一安全上下文包括用于保护终端和所述第一网络之间传输的消息的参数。
  31. 根据权利要求30所述的方法，所述用于指示终端鉴权成功的消息为可扩展鉴权协议成功消息EAP-Success。
  32. 根据权利要求30或31所述的方法，所述第一密钥标识信息为密钥标识符。
  33. 一种安全通信方法，其特征在于，包括：
    第一网络设备确定网络侧完成对终端的鉴权；
    所述第一网络设备向所述终端发送非接入层安全模式命令NAS SMC消息，所述NAS SMC消息中包括用于指示终端鉴权成功的消息和第一密钥标识信息。
  34. 根据权利要求33所述的方法，其特征在于，所述第一网络设备确定网络侧完成对终端的鉴权，包括：
    第一网络设备接收鉴权服务器功能AUSF发送的用于指示终端鉴权成功的消息；
    第一网络设备在收到AUSF发送的用于指示终端鉴权成功的消息后，向所述终端发送用于指示终端鉴权成功的消息和第一密钥标识信息。
  35. 根据权利要求33或34所述的方法，其特征在于，在所述第一网络设备向所述终端发送非接入层安全模式命令NAS SMC消息之前，所述方法还包括：
    所述第一网络设备获取所述第一密钥标识信息。
  36. 根据权利要求35所述的方法，其特征在于，所述第一网络设备获取所述第一密钥标识信息，包括：
    所述第一网络设备接收到所述用于指示终端鉴权成功的消息之后，生成所述第一密钥标识信息。
  37. 根据权利要求33-36任一项所述的方法，其特征在于，所述第一网络设备为安全锚点功能。
  38. 根据权利要求33-37任一项所述的方法，其特征在于，所述第一密钥标识信息为密钥标识符。
  39. 一种芯片系统，其特征在于，包括：应用于安全通信装置中，所述芯片系统 包括至少一个处理器和接口电路，所述接口电路和所述至少一个处理器通过线路互联，所述至少一个处理器用于运行所述终端中的指令，以执行权利要求1-9、权利要求20-24、权利要求30-33或者权利要求34-38任一项所述的方法。
  40. 一种计算机可读存储介质，其特征在于，应用于安全通信装置中，所述计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机执行上述权利要求1-9、权利要求20-24、权利要求30-33或者权利要求34-38任一项所述的方法。
PCT/CN2018/116041 2017-11-17 2018-11-16 一种安全通信方法和装置 WO2019096279A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18877474.9A EP3703311B1 (en) 2017-11-17 2018-11-16 Secure communication method and device
US16/874,064 US11622268B2 (en) 2017-11-17 2020-05-14 Secure communication method and secure communications apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711147451.8A CN109803350B (zh) 2017-11-17 2017-11-17 一种安全通信方法和装置
CN201711147451.8 2017-11-17

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/874,064 Continuation US11622268B2 (en) 2017-11-17 2020-05-14 Secure communication method and secure communications apparatus

Publications (1)

Publication Number Publication Date
WO2019096279A1 true WO2019096279A1 (zh) 2019-05-23

Family

ID=66540053

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/116041 WO2019096279A1 (zh) 2017-11-17 2018-11-16 一种安全通信方法和装置

Country Status (4)

Country Link
US (1) US11622268B2 (zh)
EP (1) EP3703311B1 (zh)
CN (2) CN111954208B (zh)
WO (1) WO2019096279A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113676903B (zh) * 2020-04-30 2023-03-10 华为技术有限公司 切片认证授权管理方法、装置和系统
CN114040387B (zh) * 2020-07-21 2024-06-04 中国移动通信有限公司研究院 一种攻击消息的确定方法、装置及设备
CN117082582A (zh) * 2020-09-23 2023-11-17 华为技术有限公司 一种非接入层上下文的处理方法及装置
WO2022170503A1 (en) * 2021-02-09 2022-08-18 Telefonaktiebolaget Lm Ericsson (Publ) Network nodes and methods therein for facilitating registration of terminal device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101610147A (zh) * 2008-06-16 2009-12-23 华为技术有限公司 密钥处理方法、系统、设备及终端
CN105451284A (zh) * 2014-07-10 2016-03-30 华为技术有限公司 用于网络切换的方法及装置
CN105704716A (zh) * 2016-02-29 2016-06-22 宇龙计算机通信科技(深圳)有限公司 VoWi-Fi网络的接入方法及接入装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1956858A1 (en) * 2007-02-06 2008-08-13 Nokia Siemens Networks Gmbh & Co. Kg Method for updating a key in a telecommunication system
EP2258126B9 (en) 2008-04-02 2013-06-19 Nokia Siemens Networks OY Security for a non-3gpp access to an evolved packet system
CN102014381B (zh) 2009-09-08 2012-12-12 华为技术有限公司 加密算法协商方法、网元及移动台
CN102378168B (zh) * 2010-08-17 2016-02-10 中兴通讯股份有限公司 多系统核心网通知密钥的方法和多系统网络
CN104137468A (zh) * 2012-11-07 2014-11-05 华为技术有限公司 一种ca公钥的更新方法、装置、ue及ca
CN103476028B (zh) * 2013-08-30 2017-04-05 大唐移动通信设备有限公司 Nas count翻转时nas消息的处理方法及装置
US9986432B2 (en) * 2013-12-23 2018-05-29 Koninklijke Kpn N.V. Method and system for providing security from a radio access network
CN104935426B (zh) * 2014-03-21 2018-11-30 华为技术有限公司 密钥协商方法、用户设备和近距离通信控制网元
US9918225B2 (en) * 2014-11-03 2018-03-13 Qualcomm Incorporated Apparatuses and methods for wireless communication
US20170171752A1 (en) * 2015-12-14 2017-06-15 Qualcomm Incorporated Securing signaling interface between radio access network and a service management entity to support service slicing
JP2020509640A (ja) * 2017-01-30 2020-03-26 テレフオンアクチーボラゲット エルエム エリクソン（パブル） ５ｇシステムにおけるセキュリティアンカー機能
KR102026950B1 (ko) * 2017-04-19 2019-09-30 엘지전자 주식회사 Pdu 세션 수립 절차를 처리하는 방법 및 amf 노드

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101610147A (zh) * 2008-06-16 2009-12-23 华为技术有限公司 密钥处理方法、系统、设备及终端
CN105451284A (zh) * 2014-07-10 2016-03-30 华为技术有限公司 用于网络切换的方法及装置
CN105704716A (zh) * 2016-02-29 2016-06-22 宇龙计算机通信科技(深圳)有限公司 VoWi-Fi网络的接入方法及接入装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"pCR to provide a normative text for the AMF key derivation/refresh", S3-172010, 3GPP TSG SA WG3 (SECURITY) MEETING #88, 11 August 2017 (2017-08-11), XP051311115 *
"pCR: Security for Non-3GPP access to 5GC", S3-172390, 3GPP TSG SA WG3 (SECURITY) MEETING #88BIS ADHOC, 13 October 2017 (2017-10-13), XP051348263 *
See also references of EP3703311A4

Also Published As

Publication number Publication date
EP3703311A1 (en) 2020-09-02
CN111954208A (zh) 2020-11-17
EP3703311A4 (en) 2020-11-25
US20200275269A1 (en) 2020-08-27
CN109803350A (zh) 2019-05-24
EP3703311B1 (en) 2023-01-18
US11622268B2 (en) 2023-04-04
CN111954208B (zh) 2024-04-12
CN109803350B (zh) 2021-06-08

Similar Documents

Publication Publication Date Title
US10798082B2 (en) Network authentication triggering method and related device
WO2019096279A1 (zh) 一种安全通信方法和装置
EP3817422A1 (en) Communication method and device
CN108605225B (zh) 一种安全处理方法及相关设备
EP3737032B1 (en) Key updating method and apparatus
CN111328112B (zh) 一种安全上下文隔离的方法、装置及系统
US20150319652A1 (en) Methods and Apparatus for Differencitating Security Configurations in a Radio Local Area Network
CN110121196B (zh) 一种安全标识管理方法及装置
US20210045050A1 (en) Communications method and apparatus
EP3648488B1 (en) Methods, devices, system and computer-readable storage medium for acquiring identifier of terminal device
CN113055879B (zh) 一种用户标识接入方法及通信装置
CN114145032B (zh) 获取安全上下文的方法、装置和通信系统
WO2013004905A1 (en) Trusted wireless local area network access
WO2018170703A1 (zh) 一种连接建立方法及装置
US20190149326A1 (en) Key obtaining method and apparatus
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
CN113727342B (zh) 网络注册的方法和装置
WO2022237561A1 (zh) 一种通信方法及装置
WO2021254172A1 (zh) 一种通信方法以及相关装置
JP7414796B2 (ja) 情報送信方法、鍵生成方法、及び機器
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2023147767A1 (zh) 网络校验的方法和装置
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
CN111866870A (zh) 密钥的管理方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18877474

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018877474

Country of ref document: EP

Effective date: 20200525