WO2019134704A1 - 一种更新密钥的方法及装置 - Google Patents

一种更新密钥的方法及装置 Download PDF

Info

Publication number
WO2019134704A1
WO2019134704A1 PCT/CN2019/070709 CN2019070709W WO2019134704A1 WO 2019134704 A1 WO2019134704 A1 WO 2019134704A1 CN 2019070709 W CN2019070709 W CN 2019070709W WO 2019134704 A1 WO2019134704 A1 WO 2019134704A1
Authority
WO
WIPO (PCT)
Prior art keywords
connection
terminal
key
core network
network device
Prior art date
Application number
PCT/CN2019/070709
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2019205078A priority Critical patent/AU2019205078B2/en
Priority to JP2020537753A priority patent/JP7095095B2/ja
Priority to EP19735959.9A priority patent/EP3737032B1/en
Priority to BR112020013611-5A priority patent/BR112020013611A2/pt
Priority to MX2020007292A priority patent/MX2020007292A/es
Priority to EP22169110.8A priority patent/EP4131845A1/en
Priority to RU2020126333A priority patent/RU2783597C2/ru
Publication of WO2019134704A1 publication Critical patent/WO2019134704A1/zh
Priority to US16/922,485 priority patent/US11595206B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/15—Setup of multiple wireless link connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a method and an apparatus for updating a key.
  • the terminal can access the access through the 3rd generation partnership project (3GPP) access technology and the non-3GPP (non-3GPP) access technology. And access and mobility management function (AMF) nodes.
  • 3GPP 3rd generation partnership project
  • non-3GPP non-3GPP
  • AMF access and mobility management function
  • the AMF node maintains the registration management (RM) state machine and connection for the 3GPP access technology and the non-3GPP access technology respectively.
  • CM State machine for connection management
  • the state machine of the registration management corresponds to the RM state (RM state), and the RM state is divided into a RM-registration state and a RM-deregistration state.
  • the state machine of the connection management corresponds to the CM state (CM state), and the CM state is divided into a CM-connected state and a CM-idle state.
  • the terminal and the AMF node may share a set of NAS keys when communicating through the two access technologies.
  • the process of re-authentication involves updating the NAS key.
  • the terminal and the AMF node still need to use the shared NAS key when communicating through another access technology, or the terminal and the AMF node are communicating using the shared NAS key.
  • the update of the NAS key involved in the process of re-authenticating the terminal by the AMF node through an access technology may affect the normal communication between the terminal and the AMF node through another access technology.
  • An embodiment of the present application provides a method and an apparatus for updating a key, which are used to solve an update of a NAS key involved in an AMF node re-authenticating a terminal by using an access technology, and affect the relationship between the terminal and the AMF node.
  • the terminal may update the key of the second connection, so that when the terminal accesses the AMF node through multiple access technologies at the same time, the terminal can pass through without affecting the terminal and the AMF node.
  • the terminal On the premise that the second connection performs normal communication, the terminal is re-authenticated through the first connection, and key update of the two connections is implemented.
  • the trigger condition is the state of the second connection
  • the state of the second connection is the connected state or the idle state.
  • the trigger condition is that the second connection is in an idle state; if the core network device determines to re-authenticate the terminal through the first connection, and the second connection is in the connected state, the core network device passes the first connection. Sending a first message to the terminal, the first message is used to instruct the terminal to suspend using the first connection.
  • the NAS COUNT may be reversed, so the terminal is notified to suspend the use of the first connection.
  • the trigger condition is that the second connection is in an idle state; and the core network device acquires the first key identifier, the first key identifier, in the process of re-authenticating the terminal by using the first connection. An updated key used to identify the first connection.
  • the core network device may send the indication information to the terminal by using the first connection, where the indication information is And is used to instruct the terminal to update the key corresponding to the second connection.
  • the terminal is notified to update the key of the second connection in time, so that the subsequent core network device and the terminal use the same key pair when transmitting the message through the second connection. The message is secured.
  • the indication information may be a first key identifier.
  • the terminal may update the second connected key to the key identified by the first key identifier.
  • the triggering condition is that the second connection is in the connected state;
  • the method for the core network device to update the second connected key corresponding to the second access technology is: the core network device suspends using the second connection, and then the core The network device updates the key of the second connection.
  • the core network device suspends the use of the second connection and then updates the key of the second connection, which can prevent the key update process from affecting the normal communication of the core network device using the second connection.
  • the core network device may acquire the first key identifier, and retain the second key identifier and the second connection.
  • the pre-update key, the first key identifier is used to identify the updated key of the first connection, and the second key identifier is used to identify the pre-update key of the second connection.
  • the trigger condition is:
  • the core network device receives the second message sent by the terminal through the second connection before the timer expires, and the core network device successfully performs the security verification on the second message by using the pre-updated key of the second connection;
  • the timer expires, and the core network device does not receive the second message sent by the terminal through the second connection before the timer expires;
  • the core network device After the timer expires, the core network device receives the second message that the terminal sends through the second connection without security protection; or
  • the core network device After the timer expires, the core network device receives the second message sent by the terminal through the second connection, and the core network device performs the security verification on the second message by using the updated key of the second connection.
  • the core network device may send a third message to the terminal by using the first connection, where the third message includes a first key identifier, a second key identifier, or indication information, where the indication information is used to indicate The terminal starts the timer.
  • the core network device can re-authenticate the terminal directly through the first connection, and the re-authentication process can retain the The pre-update key of the second connection, so that even if the core network device re-authenticates the terminal through the first connection and updates the key of the first connection, the core network device and the terminal can still communicate through the second connection.
  • the method implements decoupling of the first connection and the second connection, and the core network device does not need to authenticate the terminal through the first connection.
  • the state of the second connection is detected. After the timer expires, the core network device and the terminal can actively update the key of the second connection, which reduces the signaling interaction overhead between the core network device and the terminal, and is simpler to implement.
  • the core network device may delete the pre-update key and the second key identifier of the second connection.
  • the core network device may set the first mark, A flag is used to mark the core network device that has re-authenticated the terminal through the first connection or to indicate a key to update the second connection.
  • the trigger condition is that the second connection switches to the idle state and the core network device determines that the first flag is present.
  • the triggering condition is that the core network device determines that the first identifier exists; and the method for the core network device to update the second connected key corresponding to the second access technology includes: if the second connection is in the connected state, The core network device suspends the use of the second connection, and then the core network device updates the key of the second connection.
  • the core network device may obtain a third key identifier, where the third key identifier is used to identify A connected updated key and a second connected updated key, and then the core network device sends a third key identifier to the terminal.
  • the core network device after the core network device re-authenticates the terminal by using the first connection corresponding to the first access technology, the core network device sends the indication information to the terminal, where the indication information is used to indicate that the terminal updates the second The key of the connection.
  • the trigger condition is that the core network device determines that the second flag exists, and the second connection is in an idle state; after the core network device re-authenticates the terminal through the first connection, the core network device may be configured.
  • the second tag is used to indicate that the key of the second connection is updated.
  • an embodiment of the present application provides a method for updating a key, which is applied to a communication system, where the communication system includes a terminal and a core network device, and the terminal accesses the core through the first access technology and the second access technology, respectively.
  • the network device includes: the terminal re-authenticating by using the first connection corresponding to the first access technology, and if the trigger condition is met, the terminal updates the key of the second connection corresponding to the second access technology.
  • the terminal updates the key of the second connection corresponding to the second access technology when the trigger condition is met, and can pass the first without affecting the normal communication between the terminal and the AMF node through the second connection.
  • the connection re-authenticates the terminal.
  • the trigger condition is that the state of the second connection is an idle state.
  • the terminal performs re-authentication by using the first connection corresponding to the first access technology, including: retaining the key identifier and the second connection in the process of re-authenticating the terminal through the first connection
  • the pre-update key which is used to identify the pre-update key of the second connection.
  • the trigger condition is that the timer expires; after the terminal performs re-authentication through the first connection corresponding to the first access technology, the terminal may start a timer.
  • the method further includes: the terminal sending a message to the core network device through the second connection before the timer expires, the message passing the pre-update key of the second connection Performing security protection; or, after the timer expires, the terminal sends a message that is not secured to the core network device through the second connection; or; after the timer expires, the terminal sends a message to the core network device by using the second connection, The message is secured by the updated key of the second connection.
  • the method further includes: deleting, by the terminal, the pre-update key and the key identifier of the second connection.
  • an embodiment of the present application provides a device, which has a function of implementing the behavior of a core network device in the design of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a core network device or can be a chip in a core network device.
  • the device is a core network device, and the core network device includes a processor configured to support a core network device to perform a corresponding function in the above method. Further, the core network device may further include a transmitter and a receiver for supporting communication between the core network device and the terminal. Further, the core network device may further include a memory for coupling with the processor, which stores program instructions and data necessary for the terminal.
  • an embodiment of the present application provides a device, which has a function of implementing terminal behavior in the design of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a terminal or can be a chip in the terminal.
  • the device is a terminal, and the terminal includes a processor configured to support the terminal to perform a corresponding function in the above method. Further, the terminal may further include a transmitter and a receiver for supporting communication between the terminal and the core network device. Further, the terminal may further include a memory for coupling with the processor, which stores program instructions and data necessary for the terminal.
  • the embodiment of the present application provides a communication system, where the system includes the terminal and the core network device in the foregoing aspect.
  • the system may further include a base station, an N3 IWF node, and the terminal and the core according to the foregoing aspect.
  • Network equipment
  • the embodiment of the present application provides a computer storage medium for storing the computer software instructions used for the core network device, which includes a program designed to execute the foregoing first aspect.
  • an embodiment of the present application provides a computer storage medium for storing the above computer software instructions for a terminal, which includes a program designed to execute the foregoing second aspect.
  • an embodiment of the present application provides a computer program product comprising instructions that, when run on a computer, cause the computer to perform the method of the first aspect described above.
  • an embodiment of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the second aspect described above.
  • an embodiment of the present application provides a chip system, which is applied to a core network device, where the chip system includes at least one processor, a memory, and a transceiver circuit, the memory, the transceiver circuit, and the at least one
  • the processor is interconnected by a line, the at least one memory storing instructions; the instructions being executed by the processor to perform the operations of the core network device in the method of the first aspect described above.
  • an embodiment of the present application provides a chip system, which is applied to a terminal, where the chip system includes at least one processor, a memory and a transceiver circuit, the memory, the transceiver circuit, and the at least one processing
  • the instructions are interconnected by a line, and the at least one memory stores instructions; the instructions are executed by the processor to perform the operations of the terminal in the method of the second aspect described above.
  • the core network device may re-authenticate the terminal by using the first connection, and the key of the first connection may be updated during the re-authentication process.
  • the core network device may Updating the key of the second connection, when the second trigger condition is met, the terminal may update the key of the second connection, so that when the terminal accesses the AMF node through multiple access technologies at the same time, the terminal may not be affected.
  • the terminal Under the premise that the AMF nodes communicate normally through the second connection, the terminal is re-authenticated through the first connection, and the key update of the two connections is implemented.
  • FIG. 1 is a schematic diagram of a possible network architecture provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of another possible network architecture provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a key structure provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of a method for generating a key according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 6 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 7 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 8 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 9 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 10 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 11 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 12 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 13 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a device according to an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a core network device according to an embodiment of the present application.
  • 16 is a schematic structural diagram of another apparatus according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of an apparatus according to an embodiment of the present application.
  • Embodiments of the present application can be applied to a communication system that supports a terminal to simultaneously access a network through at least two access technologies.
  • the communication system may be a next-generation wireless communication system, such as a 5G communication system.
  • FIG. 1 shows a possible network architecture diagram of the present application, where the network architecture includes:
  • AMF node A network element responsible for mobility management, which can be used to implement functions other than session management in the mobility management entity (MME) function, such as lawful interception and access authorization.
  • MME mobility management entity
  • Session management function (SMF) node used to allocate session resources for user planes.
  • the authentication server function (AUSF) node When the AUSF authenticates the terminal, it is responsible for verifying the authenticity of the parameters to be authenticated and the authentication terminal.
  • the main functions include: receiving an authentication request sent by a security anchor function (SEAF) node; and selecting an authentication method.
  • SEAF security anchor function
  • EAP-AKA' extensible authentication protocol authentication and key agreement
  • the SEAF node may be part of an AMF node or an independent network element, and is mainly responsible for initiating an authentication request to the AUSF, in an evolved packet system authentication and key agreement (EPS-) AKA*)
  • EPS- evolved packet system authentication and key agreement
  • AKA* evolved packet system authentication and key agreement
  • User plane function (UPF) node is the exit of user plane data and is used to connect to the external network.
  • DN Data network
  • Internet Internet
  • radio access network (R) AN node can adopt different access technologies.
  • 3GPP access technologies such as radio access technologies used in 3G, 4G or 5G systems
  • non-3GPP access technologies refers to an access technology conforming to the 3GPP standard specification, and the access network adopting the 3GPP access technology is called a radio access network (RAN), wherein the access network device in the 5G system is called a next-generation base station node. (next generation node basestation, gNB).
  • the non-3GPP access technology refers to an access technology that does not conform to the 3GPP standard specification, for example, an air interface technology represented by a wifi access point (AP).
  • AP wifi access point
  • the terminal referred to in this application is a device with wireless transceiver function, which can be deployed on land, indoors or outdoors, handheld or on-board; it can also be deployed on the water surface (such as ships); it can also be deployed in In the air (such as airplanes, balloons, satellites, etc.).
  • the terminal may include various types of user equipment (UE), mobile phone, tablet, wireless transceiver computer, wireless data card, virtual reality (VR) terminal device.
  • UE user equipment
  • mobile phone tablet
  • wireless transceiver computer wireless data card
  • VR virtual reality
  • AR augmented reality
  • MTC machine type communication
  • industrial control industrial control
  • self-driving terminal equipment remote Terminal equipment in medical (remote medical)
  • remote Terminal equipment in medical remote Terminal equipment in smart grid
  • terminal equipment in transport safety terminal equipment in smart city
  • wearable devices such as smart Watches, smart bracelets, pedometers, etc.
  • the names of terminals having similar wireless communication functions may be different.
  • the devices having the wireless communication function are collectively referred to as terminals. .
  • the terminal in the present application stores a long-term key and a correlation function, and when the terminal performs bidirectional authentication with a core network node (such as an AMF node, an AUSF node, a SEAF node, etc.), a long-term key and a correlation function pair may be used. Verify the authenticity of the network.
  • a core network node such as an AMF node, an AUSF node, a SEAF node, etc.
  • the access network device involved in the embodiment of the present application is a device that provides a wireless communication function for a terminal.
  • the access network device may be a base station (BS), which may include various forms of macro base stations, micro base stations, relay stations, access points, and the like.
  • BS base station
  • the names of devices with base station functions may vary, for example, in 5G systems, called next-generation base station nodes, which can be expressed as gNB, in long term evolution (long term evolution)
  • eNB or eNodeB is called a Node B or the like in a 3rd generation (3G) communication system.
  • 3G 3rd generation
  • Network exposure function (NEF) node It is mainly used to interact with third parties, so that third parties can interact with network elements inside certain 3GPP networks indirectly.
  • Network function repository function (NRF) node used for network element discovery and network function (NF).
  • PCF node The PCF node stores the latest quality of service (QoS) rules.
  • QoS quality of service
  • the base station can allocate appropriate resources for the user plane transmission channel according to the QoS rules provided by the SMF node.
  • the AF node can be located inside the DN and belongs to a functional network element deployed on a third party.
  • the primary function of this network element is to inform the PCF node of the latest third-party enterprise's service requirements for an application.
  • the PCF node can generate corresponding QoS rules according to the service requirements, and ensure that the services provided by the network meet the requirements put forward by the third party.
  • the terminal may access the AMF node by using at least two access technologies, and the at least two access technologies, including the 3GPP access technology and the non-3GPP access technology, are used as an example.
  • a schematic diagram of a possible network architecture as shown in FIG. 2, the network architecture includes an AMF node, an AUSF node, an SMF node, a UPF node, and a UDM node (or authentication credential repository and processing function (APRF) Node), terminal and non-3GPP interworking function (N3IWF) nodes.
  • the AUSF node For the AMF node, the AUSF node, the SMF node, the UPF node, the UDM node, and the terminal, refer to the description in FIG. 1 , and details are not described herein again.
  • the N3IWF node is used to support the terminal to access the AMF node through the non-3GPP access technology.
  • the terminal can access the AMF node through the 3GPP access technology and the non-3GPP access technology at the same time.
  • the access network device in the 3GPP access technology may be a base station of a 5G network, a base station of a 4G network, or a base station used by a future telecommunication network.
  • the non-3GPP access technology may be a network access technology used by a non-telecom network such as a wifi network or a fixed network.
  • the 3GPP access technology can be simply expressed as 3GPP, and the non-3GPP access technology can be simply expressed as non-3GPP or non-3GPP.
  • Path 1 in Figure 2 is the path through which the terminal accesses the AMF node through 3GPP
  • path 2 is the path through which the terminal accesses the AMF node through non-3GPP.
  • the terminal can access the AMF node through a gateway corresponding to the corresponding access technology, and a functional entity deployed together with the gateway or an entity having a gateway function.
  • the gateway corresponding to the non-3GPP technology may be an N3IWF node, and may also be a gateway used by the terminal to access the AMF node through the fixed network access technology, such as a BNG (broadband network gateway).
  • the gateway function entity refers to the peer end connected to the AMF node, such as the other end of the 5G network N2 interface, and the other end of the 4G network S1 interface.
  • the NAS message may be split into at least two message blocks, and part of the message.
  • the block is transmitted through 3GPP, and another part of the message block is transmitted through non-3GPP.
  • the NAS message can be divided into five message blocks of 1, 2, 3, 4, and 5, wherein 2, 4 message blocks are transmitted through 3GPP, 1 The 3, 5 message blocks are transmitted through non-3GPP.
  • the terminal may transmit one entire NAS message through 3GPP and another entire NAS message through non-3GPP.
  • the RM is used to control the terminal and the network, and the RM state includes two states: a registration state and a deregistration state.
  • the terminal may attempt to enter the registration state by sending a registration procedure to the core network device (for example, the AMF node).
  • the core network device for example, the AMF node.
  • the terminal receives the registration accept message replied by the AMF node, the terminal enters the registration state. .
  • the terminal is shut down, or the terminal registration fails, the terminal returns to the registration state.
  • the AMF node In the case that the terminal is in the registration state, the AMF node has location information, routing information, and security context information of the terminal, and the terminal has security context information.
  • the AMF node does not have the location information of the terminal, the routing information, the AMF node and the terminal have security context information.
  • the security context information includes the NAS key and the related algorithm. If the terminal returns to the deregistration state by the registration state, the terminal not only saves the security context information, but also saves the temporary identity information allocated by the AMF node at the time of the last registration, so that the terminal When registering to the network again, you can not initiate the authentication process and reduce the delay of accessing the network.
  • the CM state includes a connected state and an idle state.
  • the terminal If the terminal is not connected to the network, the terminal is in the idle state and the de-registered state. At this time, there is no security context information between the terminal and the AMF node, and the terminal first switches from the idle state to the connected state, and then the terminal can initiate the registration process. Switching from the deregistration state to the registration state, the terminal has a NAS key and a security algorithm. If the terminal does not need to interact with the network in the subsequent data, the terminal can return to the idle state, and after the terminal returns to the idle state, it is still in the registration state.
  • the security context information saved by the terminal is the NAS key and the security algorithm when the terminal returns from the connected state to the idle state.
  • the terminal saves the NAS key, the security algorithm, and the temporary identity information assigned by the AMF at the time of the last registration.
  • the state switching in the present application refers to that the CM state of the terminal in the core network device changes from one state to another state. For example, switching from the connected state to the idle state means that the terminal is in the core network device.
  • the CM state returns from the connected state to the idle state. For example, when the terminal sends a registration request message to the core network device, the terminal is in the connected state. After the core network device sends the registration completion message to the terminal, if the terminal does not immediately send a message to the core network device, or the terminal does not want the core network device to send a message within a certain period of time controlled by the timer, the terminal will return. Idle state.
  • the time in the embodiment of the present application does not limit the time of the "switching" action, that is, the time required for the second connection to be switched from the connected state to the idle state may be controlled by a timer or by a switching process, which is not limited in this application.
  • the terminal supports accessing the network through the first access technology and the second access technology, where the first access technology is a 3GPP access technology, the second access technology is a non-3GPP access technology, or the first access The technology is a non-3GPP access technology, and the second access technology is a 3GPP access technology.
  • the application is not limited thereto, and the first access technology and the second access technology may also be other access technologies supported when the terminal communicates with the core network device.
  • the first connection is a connection that the terminal accesses the first core network device by using the first access technology.
  • the second connection is a connection that the terminal accesses the second core network device by using the second access technology.
  • the terminals using the first connection and the second connection are the same terminal, but the first core network device and the second core network device may be the same or different.
  • the terminal supports the same core network device through the first connection and the second connection as an example.
  • first connection and the second connection in the present application may be a direct connection between the terminal and the core network device, or may be an indirect connection.
  • the second connection is that the terminal accesses the gateway device through the second access technology, and accesses the connection of the core network element through the gateway device.
  • the terminal can access the AMF node through the 3GPP access technology.
  • the first connection can be understood as the communication path between the terminal and the AMF node when the terminal uses the 3GPP access technology, that is, the path 1, or the terminal can also pass The non-3GPP access technology accesses the AMF node.
  • the terminal When the terminal accesses the AMF node through the non-3GPP access technology, the terminal does not directly communicate with the AMF node, but communicates with the AMF node through the N3IWF node, and the second connection is the terminal.
  • the connection between the N3IWF node and the connection between the N3IWF node and the AMF node can also be understood as the second connection being path 2.
  • Re-authentication means that when a core network device finds that a certain parameter is about to be unavailable, for example, the NAS COUNT is about to be flipped, or according to the carrier's configuration requirements, the trigger condition for the core network device to authenticate the terminal again is reached.
  • the core network device interacts with the terminal to enter a message, and the terminal and the core network device respectively compare the parameter to be verified provided by the other party with another parameter generated by the user, if the other party The parameters to be verified are the same as the parameters generated by itself, and the authentication verification between the terminal and the core network device is passed.
  • the authentication verification process can be a 5G AKA process of a 5G network, an EAP-AKA' process, or an EPS AKA process of an LTE network.
  • the re-authentication process in the embodiment of the present application may include an authentication verification process and a key activation process, that is, in the authentication verification process, the core network device and the terminal may mutually verify whether the information to be verified sent by the peer is correct.
  • the core network device sends a NAS security mode command (SMC) message to the terminal, and receives a NAS security mode complete (SMP) message from the terminal.
  • SMC NAS security mode command
  • SMP NAS security mode complete
  • the core network device is a device that is different from the 3GPP network of the access network device.
  • the core network device may be an AMF node, an SMF node, or a network device such as a SEAF node, an AUSF node, or a UDM node.
  • the core network device is not limited to a device that authenticates the terminal, such as an AUSF node in a 5G network.
  • the core network device may also be a device that participates in the authentication process, such as a device (eg, an AMF node) used to forward messages in an authentication process.
  • the core network device may also have separate functions such as SEAF functionality deployed with the core network device.
  • the core network device that initiates the re-authentication process for the terminal may be the same as or different from the core network device that performs authentication verification on the terminal.
  • the authentication verification refers to whether the core network device verifies that the information to be authenticated sent by the terminal is correct.
  • the core network device that initiates the re-authentication process is an AMF node, or a SEAF node that is deployed with the AMF node.
  • the core network device that initiates the re-authentication process may be an AMF node.
  • the core network device that authenticates the terminal is the SEAF node in the AMF node.
  • the core network device that initiates the re-authentication process for the terminal and the core network device that performs the authentication verification for the terminal are the same.
  • the core network device that initiates the re-authentication process for the terminal and the device that performs authentication verification on the terminal are different. of.
  • the core network device that initiates the re-authentication process may be an AMF node, and the device that performs authentication verification on the terminal is an AUSF node.
  • the core network device that initiates the re-authentication process of the terminal and the core network device that performs authentication verification on the terminal are different.
  • the first connected key and the second connected key are both NAS keys, and the NAS key includes an encryption key and an integrity protection key, and the first connected key is used to pass between the terminal and the core network device.
  • the message transmitted between the first connection is secured, and the key of the second connection is used to secure the message transmitted between the terminal and the core network through the second connection.
  • the key of the upper layer can be used as a generation parameter of the key of the next layer, optionally, in the process of re-authentication.
  • a key for the first connection and other keys for deriving the first connection may be generated, for example, in Figure 3, keys other than the K of the first layer are updated during the re-authentication process.
  • the first connected key may be KNASint, KNASenc, KRRCint, KRRCenc, KUPint, KUPenc, and the like.
  • the retained old key may be at least one of KNASint, KNASenc, KgNB, NH, KRRCint, KRRCenc, KUPint, KUPenc, KN3IWF.
  • KNASint KNASenc
  • KgNB NH
  • KRRCint KRRCenc
  • KUPint KUPenc
  • KAUSF KAUSF
  • an embodiment of the present application provides a method for updating a key, which is applied to a communication system, where the communication system includes a core network device and a terminal, where the terminal passes the first access technology and the second connection respectively.
  • the incoming technology simultaneously accesses the core network device.
  • the method includes:
  • Step 401 The core network device re-authenticates the terminal by using the first connection corresponding to the first access technology, and correspondingly, the terminal re-authenticates the core network device by using the first connection corresponding to the first access technology.
  • the core network device and the terminal may update the key of the first connection in the process of re-authenticating the terminal by using the first connection, for example, the core network device and the terminal device generate a new secret for the first connection.
  • Keys such as KAUSF, KSEAF, KAMF, KNASint, KNASenc and other keys.
  • the core network device may further obtain the first key identifier, where the first key identifier is used to identify the update of the first connection. Key.
  • the core network node is an AMF node
  • the method for obtaining the first key identifier by the AMF node includes the following three types:
  • the AMF node generates a first key identifier.
  • the AMF node obtains the first key identifier from other core network devices.
  • the first key identifier is obtained from the SEAF node.
  • the AMF node obtains information for generating the first key identifier from other core network devices, and then generates a first key identifier based on the information used to generate the first key identifier.
  • the core network device may send the first key identifier to the terminal.
  • the terminal may update the key of the first connection to the key identified by the first key identifier.
  • Step 402 If the first trigger condition is met, the core network device updates the key of the second connection corresponding to the second access technology.
  • the first trigger condition may be a second connected state
  • the second connected state may be an idle state or a connected state
  • the first triggering condition is that the second connection is in the de-registered state. If the core network device determines that the second connection is in the de-registered state, the core network device and the terminal are not currently using the second connection, so the terminal is heavily The process of authentication and the process of updating the key of the second connection do not affect the use of the second connection by the core network device and the terminal.
  • Step 403 If the second trigger condition is met, the terminal updates the key of the second connection corresponding to the second access technology.
  • the core network device may re-authenticate the terminal by using the first connection, and the key of the first connection may be updated during the re-authentication process.
  • the core network device may Updating the key of the second connection, when the second trigger condition is met, the terminal may update the key of the second connection, so that when the terminal accesses the AMF node through multiple access technologies at the same time, the terminal may not be affected.
  • the terminal Under the premise that the AMF nodes communicate normally through the second connection, the terminal is re-authenticated through the first connection, and the key update of the two connections is implemented.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the first trigger condition is that the second connection is in an idle state. If the core network device determines that the terminal needs to be re-authenticated through the first connection, but the second connection is in the connected state, as shown in FIG. 5, the method includes: Step 501 to Step 505.
  • the core network device sends a first message to the terminal by using the first connection, where the first message is used to indicate that the terminal suspends using the first connection.
  • the terminal receives the first message from the core network device over the first connection.
  • the terminal when the second connection is in the connected state, in order to prevent the re-authentication process from affecting the communication between the terminal and the core network device through the second connection, the terminal may be re-authenticated through the first connection, and the After the second connection is switched from the connected state to the idle state, the terminal is re-authenticated through the first connection. Because the NAS COUNT used in the terminal is about to be flipped, the core network device needs to re-authenticate the terminal. If the terminal continues to send NAS messages to the core network device through the first connection, the NAS COUNT may be reversed, so the core network The device can instruct the terminal to suspend the use of the first connection. Optionally, if the security context of the first connection is also used once, the core network device may instruct the terminal to send, by using the first connection or the second connection, the first one to the core network device before re-authentication. Connected security context protected NAS messages.
  • Step 502 After the second connection is switched from the connected state to the idle state, the core network device re-authenticates the terminal by using the first connection corresponding to the first access technology. Correspondingly, the terminal performs re-authentication by using the first connection corresponding to the first access technology.
  • the method is performed according to the method in step 502.
  • the core network device may be corresponding to the first connection corresponding to the first access technology or the second access technology.
  • the second connection re-authenticates the terminal. It can be understood that since both connections are in an idle state, the terminal can access the network again through any one of the connections. When this happens, we can think that the second connection becomes the first connection in the embodiment of the present application, and the original first connection is changed to the second connection.
  • the core network device may further update the key of the second connection, and acquire a third key identifier, where the third key identifier is used to identify The updated key of the second connection.
  • the third key identifier is the same as the first key identifier, or it may be understood that the core network device does not need to obtain the third secret.
  • the key identifier, the first key identifier can also be used to identify the updated key of the second connection.
  • the terminal may send a message to the core network device by using the first connection or the second connection, and trigger the core network device to initiate re-authentication for the terminal.
  • the terminal may send a message to the core network device before returning to the idle state.
  • the trigger core network device re-authenticates the terminal device through the second connection.
  • the second connection can be considered to be the first connection in the present application, and the original first connection is changed to the second connection.
  • step 503 may be performed after step 502.
  • Step 503 The core network device updates the key of the second connection corresponding to the second access technology.
  • the second connection is in an idle state, and the core network device may update the key of the second connection corresponding to the second access technology after re-authentication.
  • the core network device may also obtain a third key identifier.
  • Step 504 The core network device sends the first indication information to the terminal by using the first connection.
  • the first connection is used to instruct the terminal to update the key of the second connection.
  • the first indication information may be a first key identifier or a second key identifier.
  • the first indication information may also be a first key identifier and a second key identifier.
  • Step 505 The terminal updates the key of the second connection.
  • the second triggering condition is that the terminal receives the first indication information from the core network device by using the first connection.
  • the terminal may update the second connected key to the key indicated by the first key identifier, if the first indication information is the second key The identifier, the terminal may update the key of the second connection to the key indicated by the second key identifier.
  • the terminal may update the key of the second connection to The key indicated by the key identifier sent by the core network device.
  • the method for updating a key provided by the embodiment of the present application, if the core network device determines that the terminal needs to be re-authenticated through the first connection, the state of the second connection needs to be determined, and the second connection is in an idle state. The terminal is re-authenticated through the first connection, and the keys of the first connection and the second connection are updated. Since the second connection is in an idle state, the process of updating the key does not affect the terminal and the core network device. The normal use of the connection.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the first trigger condition is that the second connection is in a connected state.
  • the core network device may suspend the use of the second connection, and then re-authenticate the terminal through the first connection, and update the A connected key and a second connected key.
  • the AMF node and the terminal may pre-configure a timer, after the core network device re-authenticates the terminal through the first connection and updates the first connected key, When the second connection is in the connected state, the core network device and the terminal start a timer. After the core network and the terminal determine that the timer expires, the old key of the second connection cannot be used. or,
  • the core network device After the core network device re-authenticates the terminal through the first connection and updates the key of the first connection, if the second connection is in the connected state, after the re-authentication is completed, the core network device starts a timer; the terminal automatically starts the timing. Device. After the core network determines that the timer expires, the old key of the second connection cannot be used. Similarly, after the terminal determines that the timer expires, the old key of the second connection cannot be used. or,
  • the core network device After the core network device re-authenticates the terminal through the first connection, or after completing the re-authentication, the core network device sends the first key identifier to the terminal, and then the core network device and the terminal respectively set a tag information for itself. For marking the key of the second connection if the second connection is switched to the idle state.
  • the first triggering condition is a timer or tag information
  • the method includes:
  • Step 601 The core network device re-authenticates the terminal by using the first connection corresponding to the first access technology.
  • the terminal re-authenticates the core network device by using the first connection corresponding to the first access technology.
  • the core network device acquires the first key identifier, and retains the second key identifier and the pre-update key of the second connection.
  • the first key identifier is used to identify the updated key of the first connection
  • the second key identifier is used to identify the pre-update key of the second connection.
  • Step 602 The core network device starts a timer.
  • the value that causes the timer to time out may be the value of an existing timer that is being used, such as the value of a timer associated with the non-3GPP access technology, such as the value of a designation timer. It may also be a value of a timer associated with the 3GPP access technology, such as a value of a periodic registration timer.
  • the core network device starts the timer, you can directly use the value of a timer that is counting down. You can also set a value smaller than the timer value that is counting down. You can also set a timer with an existing one. The value of the value is irrelevant.
  • the operator may pre-configure the value of the timer timeout so that the value of the timer timeout represents the effective duration of the pre-update key of the second connection, that is, the length of time before the pre-update key of the second connection can be used.
  • Step 603 The core network device sends a second message to the terminal by using the first connection. Accordingly, the terminal receives the second message.
  • the second message carries indication information, where the indication information is used to indicate that the terminal starts the timer.
  • the second message may be a NAS SMC message.
  • Step 604 The terminal starts a timer.
  • the timeout value of the timer initiated by the terminal may be the same as or different from the timeout value of the timer started by the core network device. If it is different, the timeout value of the timer started by the terminal is smaller than the timeout value of the timer started by the core network.
  • the timeout value of the terminal start timer may be the value of an existing timer that is being used, such as the value of a timer associated with the non-3GPP access technology, such as the value of a designation timer. It may also be a value of a timer associated with the 3GPP access technology, such as a value of a periodic registration timer. When the core network device starts the timer, you can directly use the value of a timer that is counting down.
  • Step 605 If the second trigger condition is met, the terminal updates the key of the second connection.
  • the second trigger condition may be that the timer of the terminal is timed out.
  • the terminal may discard the key before the second connection update, or the terminal updates the key used by the second connection according to the new key generated in the re-authentication process.
  • the newly generated NAS layer key in the re-authentication process is used as a new key, or a new NAS layer key is derived by using a newly generated key in the re-authentication process.
  • step 605 may be performed before step 606, or may be performed after step 606 and step 607.
  • step 605 is first executed as an example.
  • Step 606 The terminal sends a third message to the core network device by using the second connection. Accordingly, the core network device receives the third message from the terminal over the second connection.
  • the third message is a NAS message, and may be, for example, a registration request message, a session creation request message, or the like.
  • the sending, by the terminal, the third message to the core network device by using the second connection includes the following situations:
  • Case 2 After the timer expires, the terminal sends a third message that is not secured to the core network device through the second connection. It can be understood that, in this case, if the timer expires, the terminal may not actively update the key of the second connection. Optionally, the terminal may send the third message to the second connection, and then perform step 607. After the step 607, the core network device may send, by using the second connection, a message for updating and activating the new key, such as in the message.
  • the indication information or the third key identifier indicating that the terminal updates the key of the second connection is carried, and the terminal further performs step 605.
  • the second triggering condition in step 605 is that the terminal receives the indication information or the third key identifier.
  • the terminal may also update the key of the second connection after sending the third message to the core network device, that is, the second trigger condition is that the timer of the terminal times out, that is, after step 606, step 605 is performed.
  • the terminal may actively update the key of the second connection, that is, after step 606, step 605 is performed.
  • step 606 is the terminal.
  • the second trigger condition in step 605 is the terminal. The timer expired.
  • Step 607 If the first trigger condition is met, the core network device updates the key of the second connection.
  • the first trigger condition may also include three types corresponding to the three cases in step 605:
  • the first triggering condition is: the core network device receives the third message sent by the terminal through the second connection before the timer expires, and the core network device passes the pre-updated key pair of the second connection. Three messages were successfully verified for security.
  • the terminal does not update the key of the second connection before sending the third message to the core network device, so after the core network device updates the key of the second connection, the terminal may be instructed to update the Two connected keys.
  • the key of the second connection is updated by a subsequent key activation process.
  • the NAS SMC process For example, the NAS SMC process.
  • the core network device may send a failure message to the terminal, where the failure message may carry a failure cause value, and the cause value is used to notify the terminal of the second connection update.
  • the previous key is overdue.
  • the second triggering condition is: after the timer expires, the core network device receives the third message that the terminal sends through the second connection without security protection.
  • the core network device enables the updated key of the second connection, such as the NAS SMC process, through the subsequent key activation process.
  • the fourth triggering condition is further included: the timer expires, and the core network device does not receive the third message sent by the terminal through the second connection before the timer expires.
  • the terminal does not send the third message to the core network device, after the timer of the core network device times out, the core The network device discards the key before the second connection update.
  • the core network device also updates the key of the second connection.
  • the core network device instructs the terminal to update the key of the second connection.
  • the second connection does not immediately return to the idle state.
  • the core network device may re-authenticate the terminal.
  • the core network device can turn off the timer, and if the terminal updates the second connected key before the timer expires. The terminal can also turn off the timer.
  • Step 608 The core network device deletes the pre-update key and the second key identifier of the second connection.
  • step 608 after the core network device updates the key of the second connection, step 608 can be performed.
  • Step 609 The terminal deletes the pre-update key and the second key identifier of the second connection.
  • step 605 after the terminal updates the key of the second connection, step 609 can be performed.
  • the method for updating a key provided by the embodiment of the present application, when the core network determines that re-authentication needs to be performed through the first connection, if the second connection is in the connected state, the core network device can re-authenticate the terminal directly through the first connection.
  • the re-authentication process may retain the pre-update key of the second connection, so that even if the core network device re-authenticates the terminal through the first connection, the key of the first connection is updated, and the core network device and the terminal pass through
  • the pre-update key of the second connection can still be used, and the normal communication of the second connection is not affected, and the method implements decoupling of the first connection and the second connection, and the core network device passes
  • the first connection does not need to detect the status of the second connection when the terminal is authenticated. After the timer expires, the core network device and the terminal can actively update the second connection key, thereby reducing signaling between the core network device and the terminal.
  • the interaction overhead is simpler to implement.
  • the terminal or the core network device may perform some or all of the steps in the foregoing embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the method when the core network determines that the terminal needs to be re-authenticated through the first connection, as shown in FIG. 7, the method includes:
  • Step 701 The core network device re-authenticates the terminal by using the first connection corresponding to the first access technology, and correspondingly, the terminal re-authenticates the core network device by using the first connection corresponding to the first access technology.
  • Step 702 The core network device sets a first mark.
  • the second connection is in a connected state.
  • the first flag is used to mark that the core network device has re-authenticated the terminal through the first connection, or is used to indicate that the key of the second connection is updated.
  • the first tag is used to mark the core network device that the device is re-authenticated through the first connection, it also implicitly marks that the core network device needs to update the key of the second connection.
  • Step 703 If the first trigger condition is met, the core network device updates the key of the second connection.
  • the second connection may return to the idle state, and based on the first trigger condition, the second connection is in an idle state, and the core network device Make sure the first token is present.
  • the second connection returns to the idle state, and the core network device can receive the NAS message sent by the terminal through the second connection again, for example, The request message is registered, and the core network device determines that the key of the second connection is updated if the first flag exists. For example, the key of the second connection is updated by interacting with the terminal device to update the key and activate the process.
  • the core network device may determine, by using the key identifier information carried in the message sent by the terminal device, which set of keys is used by the terminal device. At this time, the core network device determines the key according to the key identifier, and verifies the message sent by the terminal using the key corresponding to the key identifier. After the verification is successful, the set of keys is used as the updated key of the second connection.
  • the second connection can be resumed, and when the NAS message is sent by using the second connection, the NAS message can be performed by using the updated second connected key. Integrity protection.
  • Step 704 The core network device acquires a third key identifier.
  • the third key identifier is used to identify the updated key of the second connection.
  • the core network device may not acquire the first key identifier during the re-authentication process, but after updating the second connected key.
  • the third key identifier is obtained, and the third key identifier can be used to identify the updated key of the first connection and the updated key of the second connection.
  • the core network device may directly obtain the first key identifier obtained by using the re-authentication process without acquiring the third key identifier, that is, The first key identifier obtained during the re-authentication process may be used to identify the updated key of the first connection and the updated key of the second connection.
  • Step 705 The core network device sends a third key identifier to the terminal.
  • the terminal receives a third key identifier from the terminal.
  • the core network device may send the third key identifier to the terminal by using the second connection, where the third key identifier The integrity protection is performed by the updated second connected key; if the second connection is in the idle state, the core network device may send the third key identifier to the terminal through the first connection, and the third key identifier passes The updated first connected key is integrity protected.
  • the core network device may send the first key identifier to the terminal.
  • the core network device may further send, to the terminal, at least one parameter for updating a key of the second connection, such as an encryption algorithm and an integrity protection algorithm selected when the core network device updates the key of the second connection.
  • a key of the second connection such as an encryption algorithm and an integrity protection algorithm selected when the core network device updates the key of the second connection.
  • Another example is the type of access technology.
  • Step 706 The terminal updates the key of the second connection.
  • the second trigger condition at this time is that the terminal receives the third key identifier from the core network device.
  • the third key identifier may be carried in the NAS message, and if the terminal receives the third key identifier through the second connection, the terminal may update the second connected key according to the third key identifier. Updating the key of the second connection to the key identified by the third key identifier, and performing integrity protection verification on the NAS message by using the updated second connected key, and verifying the update of the second connection after passing the verification The subsequent key is valid; if the terminal receives the third key identifier through the first connection, the terminal may perform integrity protection verification on the NAS message by using the updated key of the first connection, and update the second after the verification is passed. The key of the connection.
  • the method for generating a key provided by the embodiment of the present application, whether the second connection is in an idle state, the core network device may first update the key of the first connection, and after updating the key of the first connection, if the second After the connection is returned to the idle state, the second connection key may be updated after the terminal sends the registration request message to the terminal through the second connection. If the second connection is still in the connected state, the core network device and the terminal are prevented from passing through the second. When the connection message is transmitted, the security of the second connection key before the update is still used for security protection, which may result in failure of the security verification of the message.
  • the core network device may suspend the use of the second connection, that is, suspend the connection between the core network device and the terminal.
  • the NAS message exchange performed by the second connection, and then the key of the second connection is updated.
  • the NAS message exchange between the core network device and the terminal can be resumed through the second connection, and the NAS message at this time uses the update of the second connection.
  • the latter key is security-protected, and after the core network device re-authenticates the terminal through the first connection, the message transmitted by the second connection is avoided. Verification failure.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the embodiment of the present application provides another possibility.
  • the implementation manner is as shown in FIG. 8, and the method includes:
  • Step 801 The core network device re-authenticates the terminal by using the first connection corresponding to the first access technology, and correspondingly, the terminal re-authenticates the core network device by using the first connection corresponding to the first access technology.
  • Step 802 The core network device sends the second indication information to the terminal by using the first connection.
  • the terminal receives the second indication information from the core network device.
  • the second indication information is used to instruct the terminal to update the key of the second connection.
  • the implementation method does not limit the update timing of the second connection key, that is, does not restrict the terminal device to update the key immediately after receiving the second indication information, or updates the key after a period of time after receiving the second indication information. .
  • the method emphasizes that the terminal has the function of updating the second connected key when receiving the second indication information.
  • Step 803 The core network device sets a second flag.
  • step 802 and step 803. These two steps may be performed simultaneously, or any one of the steps may be performed first.
  • Step 804 The terminal sets a third flag.
  • the third flag is used to indicate that the key of the second connection is updated.
  • Step 805 If the core network device determines that the second flag exists, and the second connection switches to the idle state, the core network device updates the key of the second connection.
  • the first trigger condition at this time is that the core network device determines that the second flag exists, and the second connection switches to the idle state.
  • Step 806 If the terminal determines that the third flag exists, and the second connection switches to the idle state, the terminal updates the key of the second connection.
  • the second trigger condition at this time is that the terminal determines that the third flag exists, and the second connection switches to the idle state.
  • the terminal may not set the third identifier, and after the core network device updates the key of the second connection, the terminal may send the indication information to the terminal to update the key of the second connection.
  • the NAS message sent by the terminal to the core network device through the second connection may be integrity protected by the updated key of the second connection.
  • the method for updating a key provided by the embodiment of the present application, when the core network device determines that the terminal needs to be re-authenticated through the first connection, if the second connection is in the connected state, the core network device may first perform the terminal connection on the terminal. After re-authentication, after re-authentication, the core network device can set a second flag, and the terminal can set a third flag. After the second connection is switched to the idle state, the core network device and the terminal can update the second according to the flag set by itself.
  • the connected key reduces the signaling overhead incurred in updating the key of the second connection.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the method for generating a key provided by the embodiment of the present application is described below with reference to a specific scenario. Referring to FIG. 4 and FIG. 6 , in the implementation scenario corresponding to FIG. 6 , as shown in FIG. 9 , the method specifically includes:
  • Step 901 The terminal sends a NAS message to the AMF node by using the first connection. Accordingly, the AMF node receives the NAS message over the first connection.
  • the NAS message may be a registration request message, a service request message, or a PDU session establishment request message, or may be another NAS message, which is not limited in this application.
  • the NAS message carries a key identifier for identifying a key of the first connection, and the NAS message is protected by the first connected key.
  • Step 902 The AMF node successfully performs integrity verification on the NAS message, and determines that the terminal needs to be re-authenticated through the first branch.
  • the AMF node determines the key of the first connection according to the key identifier carried in the NAS message. After the AMF node successfully authenticates the integrity of the NAS message by using the key of the first connection determined according to the key identifier, it can determine whether Re-authentication of the terminal is required. Illustratively, when the AMF node determines that the NAS COUNT used by the terminal is about to be reversed, it is determined that the terminal needs to be re-authenticated, or the AMF node can further determine whether it is needed according to the configuration information of the operator. The terminal is re-authenticated. Of course, the present application is not limited to the two methods for determining whether the terminal needs to be re-authenticated.
  • Step 903 The AMF node initiates re-authentication to the terminal by using the first connection. Correspondingly, the terminal re-authenticates through the first connection.
  • the re-authentication right includes an authentication verification process and a key activation process.
  • Step 904 The AMF node updates the key corresponding to the first connection, and acquires the first key identifier.
  • the first key identifier may be obtained in an authentication process, and the first key identifier is used to identify the updated key of the first connection.
  • the pre-update key of the first connection may be deleted, and the second connection is retained. a key and a second key identifier, the second key identifier being used to identify the pre-update key of the second connection; or
  • the AMF node still needs to reserve the pre-update key and the first connection of the first connection for the second connection.
  • a second key identifier is used to identify the pre-update key of the second connection, it being understood that the pre-update key of the second connection is the same as the pre-update key of the first connection .
  • the AMF node still needs to reserve the pre-update key and the second key of the first connection for the second connection. Identifier.
  • Step 905 The AMF node sends a NAS SMC message to the terminal by using the first connection. Accordingly, the terminal receives the NAS SMC message from the AMF node through the first connection.
  • the NAS SMC message is equivalent to the second message in step 603.
  • the NAS SMC message carries a first key identifier, a second key identifier, or indication information, where the indication information is used to instruct the terminal to start a timer.
  • the NAS SMC message received by the terminal carries the indication information used to instruct the terminal to start the timer, and the terminal starts the timer.
  • the terminal determines that the received NAS SMC message carries the first key identifier or the second key identifier, and the terminal may also start a timer.
  • the terminal may verify the integrity protection of the NAS SMC even if the first key identifier, the second key identifier, or the indication information is not carried in the NAS SMC.
  • the terminal may verify the integrity protection of the NAS SMC even if the first key identifier, the second key identifier, or the indication information is not carried in the NAS SMC.
  • start the timer After the correct, or after sending a NAS SMP message, start the timer.
  • the start timer is performed by the terminal in a very short period of time after verifying that the integrity protection of the NAS SMC is correct or after sending the NAS SMP message. For example, start immediately after verifying the NAS SMC, or immediately after sending the NAS SMP. Under this method, the first key identifier has been passed to the terminal in the authentication process.
  • the AMF node may also start the timer before executing the above step 905, or start the timer after step 908.
  • the value of the timer expired is the effective duration of the pre-update key of the second connection. For example, if the first connection and the second connection share a set of keys, before the timer expires, the first connection The pre-update key can still be used by the second connection, but after the timer expires, the message transmitted between the AMF node and the terminal over the second connection cannot be secured using the pre-updated key of the first connection.
  • Step 906 The terminal updates the key of the first connection.
  • the terminal receives the NAS SMC message from the AMF node through the first connection in the re-authentication process, and updates the key corresponding to the first connection.
  • the pre-update key of the first connection may be deleted, and the second connection key and the second key identifier are retained.
  • the deletion of the pre-update key of the first connection means that the key can no longer be used by the first connection. This behavior is only related to the first connection, and is independent of the second connection.
  • Step 907 The terminal sends a NAS SMP message to the AMF node by using the first connection. Accordingly, the AMF node receives the NAS SMP message.
  • the NAS SMP node performs integrity protection through the updated key of the first connection.
  • step 904 to step 907 can also be understood as a process in which the core network device re-authenticates the terminal through the first connection.
  • Step 908 The AMF node sends a completion message to the terminal through the first connection, and accordingly, the terminal receives the completion message from the AMF node.
  • the completion message is a response message of the NAS message in step 901.
  • the NAS message in step 901 is a registration request message
  • the NAS message is a registration completion message.
  • Step 909 The terminal sends a NAS message to the AMF node by using the second connection. Accordingly, the AMF node receives the NAS message over the second connection.
  • the NAS message carries a second key identifier, and the NAS message is protected by the pre-updated key of the second connection.
  • the NAS message also carries a first key identifier.
  • the NAS message may also be a registration request message, or a service request message, or a PDU session establishment request message.
  • the application is not limited thereto.
  • the NAS message is equivalent to the third message in the step 606, and the terminal sends the NAS message to the AMF node through the second connection.
  • the terminal sends the NAS message to the AMF node through the second connection.
  • Step 910 The AMF node updates the key of the second connection.
  • the AMF node can update the key of the second connection when the first trigger condition is met.
  • first trigger condition refer to the related description in step 607 above, and details are not described herein again.
  • the AMF node may obtain a third key identifier corresponding to the updated second connected key, where the third key identifier is used to identify the updated key of the second connection, or if the first The connection and the second connection share a set of NAS keys, and the AMF node may not generate the third key identifier, but use the first key identifier to identify the updated key of the first connection and the updated connection of the second connection. Key.
  • the pre-update key of the second connection and the key identifier of the pre-update key for identifying the second connection may be deleted.
  • the AMF node may also select the pre-update key of the second connection and the key identifier of the pre-update key for identifying the second connection before the second connection key is updated because of the trigger condition. symbol.
  • Step 911 The AMF node sends a NAS SMC message to the terminal by using the second connection. Accordingly, the terminal receives the NAS SMC message from the AMF node through the second connection.
  • the NAS SMC message carries the first key identifier.
  • the NAS SMC message carries the third key identifier.
  • Step 912 The terminal updates the key of the second connection.
  • the terminal after receiving the NAS SMC message, the terminal updates the key of the second connection.
  • the second connected key may be updated according to the first key identifier or the third key identifier carried in the NAS SMC message.
  • the terminal stops the timer after updating the key of the second connection.
  • the pre-update key of the second connection and the key identifier of the pre-update key for identifying the second connection may be deleted.
  • Step 913 The terminal sends a NAS SMP message to the AMF node by using the second connection. Accordingly, the AMF node receives the NAS SMP message over the second connection.
  • the calculation of NAS SMP integrity protection is based on the updated key.
  • the core network device stops the timer after updating the second connected key.
  • Step 914 The AMF node sends a completion message to the terminal by using the second connection. Accordingly, the terminal receives the completion message through the second connection.
  • the completion message is a response message of the NAS message in step 901.
  • the completion message is a registration completion message.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the AMF node determines that the terminal needs to re-authenticate the terminal through the first connection, it is required to determine the state of the second connection, where the second connection state is idle.
  • the terminal can be re-authenticated through the first connection.
  • the method includes: Step 1001 to Step 1012.
  • the steps 1001 to 1002 are the same as the above steps 901 to 902, and details are not described herein again.
  • Step 1003 The AMF node determines the status of the second connection.
  • the re-authentication method when the second connection is in the connected state is different from the authentication method when the second connection is in the idle state or the non-registered state, so the AMF node needs to be determined. Whether the second connection is in the connected state.
  • the terminal supports the 3GPP access technology and the non-3GPP access technology to access the AMF node at the same time.
  • the AMF node may determine whether the terminal uses the 3GPP access technology and the non-3GPP access technology to access the AMF node at the same time. If the terminal accesses the AMF node by using the 3GPP access technology and the non-3GPP access technology, the second connection exists between the AMF node and the terminal, and then determines whether the terminal is in the connected state.
  • the AMF node may first determine whether the terminal is in the registration state in the second connection, and if it is determined that the terminal is in the de-registered state, the terminal may determine that the terminal is not in the second connection. If it is determined that the terminal is in the registration state, the terminal further determines whether the terminal is in the connected state.
  • the AMF node determines whether the terminal accesses the AMF node by using two access technologies at the same time, and at least includes the following three methods:
  • the NAS message in the above step 1001 carries the indication information for indicating that the terminal is in the registration state of the second connection, and the AMF node may determine, according to the indication information, that the terminal is in the registration state, that is, the terminal simultaneously adopts two types.
  • the access technology accesses the AMF node.
  • the AMF node can directly determine the state of the terminal in the second connection according to the received indication information, which is convenient and fast, and does not require the AMF node to perform other query work.
  • the AMF node determines that the terminal still has another access technology association other than the access technology corresponding to the first connection by querying the state machine of the terminal maintained by itself.
  • the AMF node can determine the state of the second connection by a simple query operation without additionally adding an indication to the NAS message indicating the status of the second connection.
  • the AMF node stores indication information indicating that the terminal accesses the two access technologies simultaneously.
  • the AMF node determines that the terminal successfully accesses through another access technology (for example, non-3GPP access technology)
  • the AMF The node may be configured with an identifier in the context of the terminal, where the identifier is used to indicate that the current terminal accesses through several access technologies. For example, when the identifier is 0, the terminal is accessed by using an access technology.
  • the representative terminal is accessed through two access technologies at the same time, or the terminal is in a dual registration state.
  • the dual registration status is a state in which the terminal registers with the AMF node through two access technologies at the same time.
  • the AMF node may set an indication information for the files shared by the two access technologies, to indicate that the content in the shared file is shared and used by the two access technologies, and the content in the file is deleted or changed. Before, you need to determine if the content in the file is being used.
  • the content in the file may be a NAS key and a related security algorithm common to the two access technologies.
  • the AMF node may determine, according to the indication information corresponding to the file, that the terminal uses two access technologies to access the AMF node at the same time.
  • the AMF node determines whether the terminal is in the connected state in the second connection, and at least includes the following three possible implementation manners:
  • the AMF node determines that it is communicating with the terminal through the second connection.
  • the AMF node is transmitting a NAS message to the terminal over the second connection, or the AMF node is paging the terminal through the second connection.
  • the AMF node determines that the terminal is in the connected state by checking the state machine of the terminal maintained by itself.
  • the AMF node determines, by the indication information stored by itself, that the terminal is in the connected state in the second connection.
  • the AMF node finds that the terminal stored by itself is in the dual registration state or the dual connectivity state, for example, the discovery identifier is 1, it is determined that the terminal is in the connected state.
  • the AMF node finds that the indication information corresponding to the file stored by the AMF indicates that the content in the file is shared by the two access technologies, and the content in the file cannot be changed, the content in the file is being used by the second connection, and further It can be determined that the terminal is in the connected state at the second connection.
  • the state in which the second connection is connected is taken as an example for description.
  • Step 1004 The AMF node sends a reject message or an accept message to the terminal by using the first connection.
  • the first message in step 501 may be a reject message or an accept message in this step.
  • the reject message indicates that the AMF node rejects the NAS message sent by the terminal in step 1001, for example, rejects the registration request message sent by the terminal.
  • the reject message carries the cause value, and the reason value is used to notify the terminal that the reason for the second connection is in the connected state, so the terminal cannot be re-authenticated at this time.
  • the cause value is further used to indicate that the AMF node successfully performs integrity verification on the NAS message sent by the terminal in step 1101.
  • the AMF node further allows the terminal to continue to send the specified number of NAS messages through the terminal, or the terminal sends a periodic registration message to the AMF node through the first connection,
  • the AMF node can send an accept message to the terminal through the first connection.
  • the re-authentication identifier bit information is carried in the accepting message, and the re-authentication identifier bit information is used to inform the terminal that the terminal needs to re-authenticate, but the re-authentication cannot be initiated temporarily because the second connection is in the connected state. After the terminal receives the re-authentication identification bit, the behavior of the terminal will be restricted.
  • the re-authentication identifier may be used to indicate that the terminal suspends using the first connection, or the terminal may only use the first connection to send user plane data, or the terminal can only A specified number of (eg, one) NAS messages are sent over the first connection (equivalent to the security context of the first connection may also be used once), or the terminal may only send a registration request message that is not integrity protected over the first connection.
  • the re-authentication identifier bit information may also be timer information. If the terminal has not been re-authenticated before the timer expires, the AMF node may cause the terminal to be in the de-registered state. Optionally, the AMF node deletes the terminal. All security contexts are such that the terminal must re-authenticate the next time it enters the network.
  • Step 1005 The terminal determines that the second connection is switched to an idle state.
  • Step 1006 The terminal sends a NAS message to the AMF node by using any one of the connections. Accordingly, the AMF node receives the NAS message.
  • the connection to send the NAS message becomes the first connection of the present invention.
  • the NAS message may be a registration request message.
  • the terminal may send a NAS message to the AMF node through any one of the connections.
  • the terminal may send an integrity protection to the AMF node through the first connection. NAS message. If the re-authentication flag indicates that the terminal can send the registration request message without security protection, the terminal may send the unprotected registration request message to the terminal through the first connection or the second connection.
  • the AMF node receives the integrity-protected NAS message, the NAS message is first verified for integrity protection.
  • Step 1005 and step 1006 are optional steps, that is, after step 1004, step 1007 may also be directly performed.
  • Step 1007 The AMF node determines that the second connection is in an idle state.
  • Step 1008 The AMF node re-authenticates the terminal by using the first connection.
  • the AMF node may re-authenticate the terminal by using the second connection in the step, where the AMF node performs the terminal connection through the first connection.
  • the re-authentication is taken as an example for explanation.
  • the AMF node may update the key of the first connection and the key of the second connection, and the terminal may update the key of the first connection.
  • the AMF node may obtain the first key identifier in the process of re-authenticating the terminal, where the first key identifier is used to identify the first An updated updated key and a second connected updated key.
  • the AMF node may obtain the first key identifier in the process of re-authenticating the terminal, and optionally, the AMF node may also obtain the first Three key identifier.
  • the first key identifier is used to identify the updated key of the first connection
  • the third key identifier is used to represent the updated key of the second connection.
  • Step 1009 The AMF node sends a NAS SMC message to the terminal. Accordingly, the terminal receives the NAS SMC message.
  • the first indication information in step 504 may be carried in the NAS SMC message.
  • the first indication information is used to instruct the terminal to update the key of the second connection.
  • the first indication information may be a first key identifier or a second key identifier.
  • the first indication information may also be a first key identifier and a second key identifier.
  • the NAS SMC message can be integrity-protected by using the updated key of the first connection, and the terminal can perform integrity protection verification on the NAS SMC message by using the updated key of the first connection.
  • Step 1010 The terminal updates the key of the second connection according to the first indication information.
  • Step 1011 The terminal sends a NAS SMP message to the AMF node by using the first connection, and correspondingly, the AMF node receives the NAS SMP message by using the first connection.
  • the NAS SMP message is integrity protected by the updated key of the first connection.
  • the terminal may further send a NAS SMP message to the AMF node by using the second connection, where the NAS SMP message is integrity protected by using the updated key of the second connection.
  • Step 1012 The AMF node sends a completion message to the terminal by using the first connection. Accordingly, the terminal accepts the completion message from the AMF node through the first connection.
  • the completion message is a response message of the NAS message in step 1001.
  • the completion message is a registration completion message.
  • the terminal subsequently sends the NAS message to the terminal through the second connection, the NAS message can be integrity protected by the updated second connected key.
  • the terminal or the core network device may perform some or all of the steps in the foregoing embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the core network device may first pass the first The connection re-authenticates the terminal.
  • the method includes: Step 1101 to Step 1115.
  • Steps 1101 to 1103 are the same as steps 1001 to 1003 described above, and are not described herein again.
  • Step 1104 The AMF node re-authenticates the terminal by using the first connection.
  • the AMF node and the terminal may update the key of the first connection in the process of re-authentication.
  • Step 1105 The AMF node sends a NAS SMC message to the terminal by using the first connection. Accordingly, the terminal receives the NAS SMC message from the AMF node through the first connection.
  • the NAS SMC message is integrity-protected by using the updated key of the first connection, and the terminal can perform integrity protection verification on the NAS SMC message by using the updated key of the first connection.
  • the NAS SMC message carries the second indication information in step 802, where the second indication information is used to indicate that the terminal updates the key of the second connection, or the second indication information is also used to indicate that the terminal does not update the second connection. key.
  • Step 1106 The terminal sends a NAS SMP message to the AMF node by using the first connection.
  • Step 1107 The AMF node sets a first flag.
  • the first flag is used to mark that the core network device has re-authenticated the terminal through the first connection, or is used to indicate that the key of the second connection is updated.
  • Step 1108 The terminal sets a second flag.
  • the third flag is used to indicate that the key of the second connection is updated.
  • step 1108 needs to be performed.
  • Step 1109 The AMF node sends a registration accept message to the terminal by using the first connection. Accordingly, the terminal receives a registration accept message from the AMF node through the first connection.
  • Step 1110 The terminal determines that the second connection is switched to the idle state. If it is determined that the third flag exists, the terminal updates the key of the second connection.
  • step 1111 is performed.
  • Step 1111 The AMF node determines that the second connection is switched to the idle state. If it is determined that the first flag exists, the AMF node updates the key of the second connection.
  • the AMF node may suspend the use of the second connection, or if the AMF node detects the first flag when processing the NAS message sent by the terminal through the second connection, the user may also suspend the use.
  • a second connection then updating a key of the second connection and a key identifier for identifying the updated key of the second connection, and sending a NAS SMC message to the terminal through the second connection, the NAS SMC message carrying the identifier
  • the key identifier of the updated key of the second connection, and the terminal can then update the key of the second connection according to the key identifier. It can be understood that after both the AMF node and the terminal update the key of the second connection, the AMF node can resume using the second connection, and use the updated key of the second connection to complete the NAS message transmitted through the second connection.
  • Sexual protection the AMF node can resume using the second connection, and use the updated key of the second connection to complete the NAS message transmitted through the second connection.
  • Step 1112 The terminal sends a registration request message to the AMF node by using the second connection. Accordingly, the AMF node receives the registration request message from the terminal through the second connection.
  • the registration request message is integrity protected by the updated key of the second connection.
  • Step 1113 The AMF node sends a NAS SMC message to the terminal by using the second connection. Accordingly, the terminal receives the NAS SMC message from the AMF node through the second connection.
  • the NAS SMC message carries a key identifier for identifying the updated key of the second connection.
  • the NAS SMC message may further carry at least one parameter for updating the key of the second connection.
  • Step 1114 The terminal sends a NAS SMP message to the AMF node by using the second connection. Accordingly, the AMF node receives the NAS SMP message from the terminal over the second connection.
  • the NAS SMP message is integrity protected by the updated second connected key.
  • Step 1115 The AMF node replies to the terminal with a registration accept message through the second connection. Accordingly, the terminal receives a registration accept message from the AMF node through the second connection.
  • the registration accept message is integrity protected by the updated second connected key.
  • the terminal or the core network device may perform some or all of the steps in the above embodiments, and the steps or operations are merely examples, and the embodiments of the present invention may also perform other operations or variations of various operations. Further, the various steps may be performed in a different order as presented in the above embodiments, and it is possible that not all of the operations in the above embodiments are performed.
  • the condition for triggering the update of the key of the second connection is related to the timer and the state of the second connection. As shown in FIG. 12, the method includes: Step 1201 to Step 1212.
  • the terminal 1201 to the step 1208 communicate with the core network device through the first connection.
  • Step 1201 The terminal sends a registration request message to the core network device by using the first connection, and correspondingly, the AMF node receives the registration request message.
  • the registration request message may also be the NAS message in the step 901.
  • the registration request message may also be the NAS message in the step 901.
  • Step 1202 The core network device triggers re-authentication.
  • Step 1203 The core network device and the terminal perform a re-authentication process.
  • Step 1204 The core network device sends a NAS SMC message to the terminal. Accordingly, the terminal receives the NAS SMC message.
  • Step 1205 The terminal activates a new key of the first connection, and starts a timer.
  • the new key of the terminal activating the first connection means that the key of the first connection has been updated, and the NAS message sent by the terminal to the core network device through the first connection is secured by using the updated key of the first connection. .
  • Step 1206 The terminal sends a NAS SMP message to the core network device. Accordingly, the terminal receives NAS SMP messages from the core network device.
  • Step 1207 The core network device activates a new key of the first connection, and starts a timer.
  • the new key of the core network device activating the first connection means that the key of the first connection has been updated, and the NAS message sent by the core network device to the core network device through the first connection uses the updated connection of the first connection.
  • the key is secured.
  • Step 1208 The core network device sends a registration completion message to the terminal. Accordingly, the terminal receives the registration completion message.
  • Step 1209 to step 1212 the terminal communicates with the core network device through the second connection.
  • Step 1209 Before the timer expires, if the second connection is in an idle state, the terminal deletes the old key and the old key identifier of the second connection, enables the new key of the second connection, and stops the timer.
  • the terminal may continue to use the old key of the second connection.
  • Step 1210 The terminal sends a registration request message to the core network device. Accordingly, the core network device receives the registration request message.
  • the registration request message is integrity protected by the new key of the second connection, and the registration request message carries the first key identifier.
  • the core network device may determine, according to the first key identifier, that the new key of the second connection is the same as the new key of the first connection, and then use the new key pair registration request of the second connection. The message is integrity verified. After the verification is passed, the core network device deletes the old key of the second connection and stops the timer.
  • Step 1212 The core network device sends a registration completion message to the terminal, and accordingly, the terminal receives a registration completion message from the core network device.
  • the registration completion message is integrity protected by the new key of the second connection.
  • the condition for triggering the update of the key of the second connection is independent of the state of the second connection.
  • the method includes: Step 1301 to Step 1314.
  • Steps 1301 to 1308 are the same as steps 1201 to 1208, and are not described herein again.
  • Step 1309 to step 1314 the terminal communicates with the core network device through the second connection.
  • Step 1310 The terminal sends, to the core network device, a registration request message for integrity protection by using the old key of the second connection, where the registration request message carries the second key identifier. Accordingly, the core network device receives the registration request message.
  • Step 1311 The core network device determines, according to the second key identifier, using the old key of the second connection, and performs integrity verification on the registration request message by using the old key of the second connection.
  • Step 1312 The core network device sends a registration completion message to the terminal.
  • Step 1313 After the timer expires, the terminal deletes the old key and the second key identifier of the second connection.
  • Step 1314 After the timer expires, the core network device deletes the old key and the second key identifier of the second connection.
  • the new key of the first connection may be used as the new key of the second connection.
  • the timers of the terminal and the core network device may continue to be timed. After the timer expires, steps 1313 and 1314 are performed. Alternatively, the terminal and the core network device may restart timing. After the timer expires, step 1313 and step 1314 are performed.
  • the solution provided by the embodiment of the present application is introduced from the perspective of interaction between the core network device and the terminal.
  • the terminal and the core network device include corresponding hardware structures and/or software modules for performing the respective functions in order to implement the above functions.
  • the embodiments of the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements of the examples and algorithm steps described in the embodiments disclosed in the application. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the technical solutions of the embodiments of the present application.
  • the embodiments of the present application may perform functional unit division on a terminal, a core network device, and the like according to the foregoing method.
  • each functional unit may be divided according to each function, or two or more functions may be integrated into one processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • Figure 14 shows a schematic block diagram of an apparatus provided in an embodiment of the present invention.
  • the device may exist in the form of software, may also be a core network device, or may be a chip in a core network device.
  • the apparatus 1400 includes a processing unit 1402 and a communication unit 1403.
  • the processing unit 1402 is configured to perform control management on the action of the device 1400.
  • the processing unit 1402 is configured to support the device 1400 to perform step 401 and step 402 in FIG. 4, step 502 and step 503 in FIG. 5, and steps in FIG. 601, 602, 607, and 608, steps 701, 702, 703, and 704 in FIG. 7, steps 801, 803, and 805 in FIG. 8, steps 902, 903, 904, and 910 in FIG.
  • the communication unit 1403 is configured to support communication between the device 1400 and other network elements (eg, terminals, etc.), for example, the communication unit 1403 can support the device 1400 to perform steps 501 and 504 in FIG. 5, step 603 in FIG. 6, in FIG. Step 705, step 802 in FIG. 8, steps 905, 908, 911, 914 in FIG. 9, steps 1004, 1009, 1014 in FIG. 10, steps 1105, 1109, 1113, 1115 in FIG. 11, FIG. Steps 1204, 1208, 1212, and steps 1304, 1308, 1312 in FIG.
  • the device 1400 can also include a storage unit 1401 for storing program codes and data of the device 1400.
  • the processing unit 1402 may be a processor or a controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1403 may be a communication interface, where the communication interface is a collective name.
  • the communication interface may include multiple interfaces, for example, may include: an interface between the access network device and the access network device, and access An interface and/or other interface between the network device and the core network device.
  • the storage unit 1401 may be a memory.
  • the structure of the apparatus 1400 involved in the embodiment of the present application may be the structure of the core network device as shown in FIG.
  • FIG. 15 is a schematic structural diagram of a core network device provided by an embodiment of the present application.
  • the core network device 1500 includes a processor 1502, a communication interface 1503, and a memory 1501.
  • the core network device 1500 may further include a bus 1504.
  • the communication interface 1503, the processor 1502, and the memory 1501 may be connected to each other through a bus 1504.
  • the bus 1504 may be a PCI bus or an EISA bus.
  • the bus 1504 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • FIG. 16 shows a schematic block diagram of still another apparatus provided in the embodiment of the present application.
  • the device 1600 can exist in the form of software, can also be a terminal, and can also be a chip in the terminal.
  • the device 1600 includes a processing unit 1602 and a communication unit 1603.
  • the processing unit 1602 is configured to control and manage the actions of the device 1600.
  • the processing unit 1602 is configured to support the device 1600 to perform steps 401 and 403 in FIG. 4, step 505 in FIG. 5, steps 604, 605 in FIG. 609, step 706 in FIG. 7, steps 801, 804, 806 in FIG. 8, steps 903, 906, 912 in FIG. 9, steps 1008 and 1010 in FIG. 10, steps 1104, 1108, 1110 in FIG.
  • the communication unit 1603 is configured to support communication between the device 1600 and other network elements (e.g., core network devices, N3 IWF nodes).
  • the communication unit 1603 is configured to support the device 1600 to perform step 606 in FIG. 6, steps 901, 907, 909, 913 in FIG. 9, steps 1001, 1006, and 1011 in FIG. 10, and step 1101 in FIG. 1106, 1111, 1114, steps 1201, 1206, 1210 in FIG. 12, and steps 1301, 1306, and 1310 in FIG.
  • the device 1600 can also include a storage unit 1601 for storing program code and data of the device 1600.
  • the processing unit 1602 may be a processor or a controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1603 may be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage unit 1601 may be a memory.
  • the apparatus 1600 involved in the embodiment of the present application may be the terminal shown in FIG.
  • FIG. 17 is a simplified schematic diagram showing a possible design structure of a terminal involved in the embodiment of the present application.
  • the terminal 1700 includes a transmitter 1701, a receiver 1702, and a processor 1703.
  • the processor 1703 may also be a controller, and is represented as "controller/processor 1703" in FIG.
  • the terminal 1700 may further include a modem processor 1705.
  • the modem processor 1705 may include an encoder 1706, a modulator 1707, a decoder 1708, and a demodulator 1709.
  • the transmitter 1701 conditions (eg, analog transforms, filters, amplifies, upconverts, etc.) the output samples and generates an uplink signal that is transmitted via an antenna to the base station described in the above embodiments. .
  • the antenna receives the downlink signal transmitted by the base station in the above embodiment.
  • Receiver 1702 conditions (eg, filters, amplifies, downconverts, digitizes, etc.) the signals received from the antenna and provides input samples.
  • encoder 1706 receives the traffic data and signaling messages to be transmitted on the uplink and processes (e.g., formats, codes, and interleaves) the traffic data and signaling messages.
  • Modulator 1707 further processes (e.g., symbol maps and modulates) the encoded service data and signaling messages and provides output samples.
  • Demodulator 1709 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • the decoder 1708 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages that are sent to the terminal 1700.
  • Encoder 1706, modulator 1707, demodulator 1709, and decoder 1708 may be implemented by a composite modem processor 1705. These units are processed according to the radio access technology employed by the radio access network (e.g., access technologies of LTE and other evolved systems). It should be noted that when the terminal 1700 does not include the modem processor 1705, the above functions of the modem processor 1705 can also be completed by the processor 1703.
  • the processor 1703 performs control and management on the operation of the terminal 1700, and is used to perform the processing performed by the terminal 1700 in the foregoing embodiment of the present application.
  • the processor 1703 is further configured to perform the processes related to the terminal in the method shown in FIG. 4 to FIG. 13 and/or other processes of the technical solutions described in the present application.
  • the terminal 1700 can also include a memory 1704 for storing program codes and data for the terminal 1700.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a core network device or terminal.
  • the processor and the storage medium may also exist as discrete components in a core network device or terminal.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network devices. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each functional unit may exist independently, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the present application can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. .
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a hard disk or optical disk, etc. includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请的实施例提供一种更新密钥的方法，涉及通信技术领域，可以解决AMF节点通过一种接入技术对终端进行重鉴权的过程涉及的NAS密钥的更新，影响终端与AMF节点之间通过另一种接入技术的正常通信的问题。该方法包括：通信系统包括终端和核心网设备，终端分别通过第一接入技术和第二接入技术同时接入核心网设备，包括：核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权；若满足触发条件，则核心网设备更新第二接入技术对应的第二连接的密钥。

Description

一种更新密钥的方法及装置
本申请要求于2018年1月8日提交中国专利局、申请号为201810016762.9、发明名称为“一种更新密钥的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种更新密钥的方法及装置。
背景技术
在第五代(5th generation，5G)系统中，终端可以同时通过第三代合作伙伴计划(3rd generation partnership project,3GPP)接入技术和非3GPP(non-3GPP)接入技术接入到接入和移动性管理功能(access and mobility management function,AMF)节点。在终端同时通过3GPP接入技术和非3GPP接入技术接入AMF节点的情况下，AMF节点分别为3GPP接入技术和非3GPP接入技术维护注册管理(registration management，RM)的状态机和连接管理(connection management,CM)的状态机。
其中，注册管理的状态机对应RM态(RM state)，RM态分为RM注册态(RM-registration state)和RM去注册态(RM-deregistration state)。连接管理的状态机对应CM态(CM state),CM态分为CM连接态(CM-connected state)和CM空闲态(CM-idle state)。终端由空闲态进入连接态之后，可以发起注册流程。完成注册流程后，终端即可由去注册态切换至注册态，此时终端具有非接入层(non-access stratum，NAS)密钥和安全算法等安全上下文信息。当终端再次回到空闲态或去注册态时，终端仍然具有NAS密钥和安全算法。
虽然AMF节点可以分别为3GPP接入技术和非3GPP接入技术单独维护状态机，但是终端和AMF节点通过这两种接入技术进行通信时可能共用一套NAS密钥。当AMF节点需要通过其中一种接入技术对终端进行重鉴权时，重鉴权的过程会涉及NAS密钥的更新。然而，终端和AMF节点通过另一种接入技术进行通信时仍然需要使用上述共用的NAS密钥，或者终端和AMF节点正在使用上述共用的NAS密钥进行通信。这种情况下，AMF节点通过一种接入技术对终端进行重鉴权的过程涉及的NAS密钥的更新，可能会影响终端与AMF节点之间通过另一种接入技术的正常通信。
发明内容
本申请的实施例提供一种更新密钥的方法及装置，用以解决AMF节点通过一种接入技术对终端进行重鉴权的过程涉及的NAS密钥的更新，影响终端与AMF节点之间通过另一种接入技术的正常通信的问题。
第一方面，本申请的实施例提供一种更新密钥的方法，应用于通信系统，该通信系统包括终端和核心网设备，终端分别通过第一接入技术和第二接入技术同时接入核心网设备，包括：核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权；若满足触发条件，则核心网设备更新第二接入技术对应的第二连接的密钥。采用该方法，核心网设备可通过第一连接对终端进行重鉴权，重鉴权过程中可更新第一连接的 密钥，当满足第一触发条件时，核心网设备可更新第二连接的密钥，当满足第二触发条件时，终端可更新第二连接的密钥，实现了终端同时通过多种接入技术接入AMF节点的情况下，可以在不影响终端与AMF节点之间通过第二连接进行正常通信的前提下，通过第一连接对终端进行重鉴权，且实现了两条连接的密钥更新。
在一种可能的设计中，触发条件为第二连接的状态，第二连接的状态为连接态或空闲态。
采用该方法，若核心网设备确定需要通过第一连接对终端进行重鉴权时，还需判断第二连接的状态，在第二连接处于空闲态的情况下才会通过第一连接对终端进行重鉴权，并更新第一连接和第二连接的密钥，由于第二连接处于空闲态，所以更新密钥的过程不会影响终端与核心网设备对第二连接的正常使用。
在一种可能的设计中，触发条件为第二连接处于空闲态；若核心网设备确定通过第一连接对终端进行重鉴权，且第二连接处于连接态，则核心网设备通过第一连接向终端发送第一消息，第一消息用于指示终端暂停使用第一连接。采用该方法，若终端继续通过第一连接向核心网设备发送NAS消息，可能会导致NAS COUNT翻转，所以及时通知终端暂停使用第一连接。
在一种可能的设计中，触发条件为第二连接处于空闲态；核心网设备在通过第一连接对终端进行重鉴权的过程中，获取第一密钥标识符，第一密钥标识符用于标识第一连接的更新后的密钥。
在一种可能的设计中，在核心网设备通过第一接入技术对应的第一连接对所述终端进行重鉴权之后，核心网设备可以通过第一连接向终端发送指示信息，该指示信息用于指示终端更新第二连接对应的密钥。采用该方法，在核心网设备更新第二连接对应的密钥后，及时通知终端更新第二连接的密钥，可以保证后续核心网设备与终端通过第二连接传输消息时使用相同的密钥对消息进行安全保护。
可选地，该指示信息可以为第一密钥标识符。终端接收到第一密钥标识符之后，可将第二连接的密钥更新为第一密钥标识符标识的密钥。
在一种可能的设计中，触发条件为第二连接处于连接态；核心网设备更新第二接入技术对应的第二连接的密钥的方法为：核心网设备暂停使用第二连接，然后核心网设备更新第二连接的密钥。采用该方法，核心网设备暂停使用第二连接，然后再更新第二连接的密钥，可以避免密钥更新流程影响核心网设备使用第二连接的正常通信。
在一种可能的设计中，在核心网设备通过第一连接对终端进行重鉴权的过程中，核心网设备可以获取第一密钥标识符，保留第二密钥标识符和第二连接的更新前的密钥，第一密钥标识符用于标识第一连接的更新后的密钥，第二密钥标识符用于标识第二连接的更新前的密钥。
在一种可能的设计中，在核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权之后，核心网设备可以启动计时器。
在一种可能的设计中，触发条件为：
核心网设备在计时器超时前接收到终端通过第二连接发送的第二消息，且核心网设备通过第二连接的更新前的密钥对第二消息进行安全验证成功；或者，
计时器超时，且核心网设备在计时器超时前未接收到终端通过第二连接发送的第 二消息；或者，
计时器超时后，核心网设备接收到终端通过第二连接发送的未进行安全保护的第二消息；或者，
计时器超时后，核心网设备接收到终端通过第二连接发送的第二消息，且核心网设备通过第二连接的更新后的密钥对第二消息进行安全验证成功。
在一种可能的设计中，核心网设备可通过第一连接向终端发送第三消息，第三消息包括第一密钥标识符、第二密钥标识符或者指示信息，该指示信息用于指示终端启动计时器。采用该方法，在核心网确定需要通过第一连接进行重鉴权时，若第二连接处于连接态，核心网设备可以直接通过第一连接对终端进行重鉴权，重鉴权过程中可以保留第二连接的更新前的密钥，这样即使核心网设备通过第一连接对终端进行重鉴权更新了第一连接的密钥，核心网设备和终端之间通过第二连接进行通信时，仍然可以使用第二连接的更新前的密钥，不会影响第二连接的正常通信，且该方法实现了第一连接和第二连接的解耦，核心网设备通过第一连接对终端进行鉴权时无需检测第二连接的状态，在计时器超时后，核心网设备和终端均可主动更新第二连接的密钥，减少了核心网设备和终端之间的信令交互开销，实现更为简单。
在一种可能的设计中，在核心网设备更新第二接入技术对应的第二连接的密钥之后，核心网设备可以删除第二连接的更新前的密钥和第二密钥标识符。
在一种可能的设计中，若第二连接处于连接态，则在核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权之后，核心网设备可以设置第一标记，第一标记用于标记核心网设备已通过第一连接对终端进行重鉴权，或用于指示更新第二连接的密钥。
在一种可能的设计中，触发条件为第二连接切换至空闲态，且核心网设备确定存在第一标记。
在一种可能的设计中，触发条件为核心网设备确定存在第一标记；核心网设备更新第二接入技术对应的第二连接的密钥的方法包括：若第二连接处于连接态，则核心网设备暂停使用第二连接，然后核心网设备更新第二连接的密钥。
在一种可能的设计中，在核心网设备更新第二接入技术对应的第二连接的密钥之后，核心网设备可获取第三密钥标识符，第三密钥标识符用于标识第一连接的更新后的密钥和第二连接的更新后的密钥，然后核心网设备向终端发送第三密钥标识符。
在一种可能的设计中，在核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权之后，核心网设备向终端发送指示信息，该指示信息用于指示终端更新第二连接的密钥。
在一种可能的设计中，触发条件为核心网设备确定存在第二标记，且第二连接处于空闲态；在核心网设备通过第一连接对终端进行重鉴权之后，核心网设备可设置第二标记，第二标记用于指示更新第二连接的密钥。
第二方面，本申请的实施例提供一种更新密钥的方法，应用于通信系统，通信系统包括终端和核心网设备，终端分别通过第一接入技术和第二接入技术同时接入核心网设备，该方法包括：终端通过第一接入技术对应的第一连接进行重鉴权，若满足触发条件，则终端更新第二接入技术对应的第二连接的密钥。采用该方法，终端在满足 触发条件时才会更新第二接入技术对应的第二连接的密钥，可以在不影响终端与AMF节点指甲通过第二连接进行正常通信的前提下，通过第一连接对终端进行重鉴权。
在一种可能的设计中，触发条件为第二连接的状态为空闲态。
在一种可能的设计中，终端通过第一接入技术对应的第一连接进行重鉴权，包括：在终端通过第一连接进行重鉴权的过程中，保留密钥标识符和第二连接的更新前的密钥，密钥标识符用于标识第二连接的更新前的密钥。
在一种可能的设计中，触发条件为计时器超时；在终端通过第一接入技术对应的第一连接进行重鉴权之后，终端可以启动计时器。
在一种可能的设计中，在终端启动计时器之后，该方法还包括：终端在计时器超时前，通过第二连接向核心网设备发送消息，该消息通过第二连接的更新前的密钥进行安全保护；或者，终端在计时器超时后，通过第二连接向核心网设备发送未进行安全保护的消息；或者；终端在计时器超时后，通过第二连接向核心网设备发送消息，该消息通过第二连接的更新后的密钥进行安全保护。
在一种可能的设计中，在终端更新第二接入技术对应的第二连接的密钥之后，该方法还包括：终端删除第二连接的更新前的密钥和密钥标识符。
第三方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中核心网设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为核心网设备，或者可以为核心网设备中的芯片。
在一种可能的设计中，该装置为核心网设备，核心网设备包括处理器，所述处理器被配置为支持核心网设备执行上述方法中相应的功能。进一步地，核心网设备还可以包括发射器和接收器，所述发射器和接收器用于支持核心网设备与终端之间的通信。进一步的，核心网设备还可以包括存储器，所述存储器用于与处理器耦合，其保存终端必要的程序指令和数据。
第四方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中终端行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为终端，或者可以为终端中的芯片。
在一种可能的设计中，该装置为终端，终端包括处理器，所述处理器被配置为支持终端执行上述方法中相应的功能。进一步地，终端还可以包括发射器和接收器，所述发射器和接收器用于支持终端与核心网设备之间的通信。进一步的，终端还可以包括存储器，所述存储器用于与处理器耦合，其保存终端必要的程序指令和数据。
第五方面，本申请实施例提供一种通信系统，该系统包括上述方面所述的终端和核心网设备，可选地，该系统还可以包括基站、N3IWF节点以及上述方面所述的终端和核心网设备。
第六方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于核心网设备所用的计算机软件指令，其包含用于执行上述第一方面所设计的程序。
第七方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于终端所用的计算机软件指令，其包含用于执行上述第二方面所设计的程序。
第八方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第一方面所述的方法。
第九方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第二方面所述的方法。
第十方面，本申请的实施例提供一种芯片系统，应用于核心网设备中，所述芯片系统包括至少一个处理器，存储器和收发电路，所述存储器、所述收发电路和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第一方面所述的方法中所述核心网设备的操作。
第十一方面，本申请的实施例提供一种芯片系统，应用于终端中，所述芯片系统包括至少一个处理器，存储器和收发电路，所述存储器、所述收发电路和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第二方面所述的方法中所述终端的操作。
本申请的实施例提供的方法，核心网设备可通过第一连接对终端进行重鉴权，重鉴权过程中可更新第一连接的密钥，当满足第一触发条件时，核心网设备可更新第二连接的密钥，当满足第二触发条件时，终端可更新第二连接的密钥，实现了终端同时通过多种接入技术接入AMF节点的情况下，可以在不影响终端与AMF节点之间通过第二连接进行正常通信的前提下，通过第一连接对终端进行重鉴权，且实现了两条连接的密钥更新。
附图说明
图1为本申请的实施例提供的一种可能的网络架构示意图；
图2为本申请的实施例提供的另一种可能的网络架构示意图；
图3为本申请的实施例提供的一种密钥架构示意图；
图4为本申请的实施例提供的一种生成密钥的方法的流程图；
图5为本申请的实施例提供的另一种生成密钥的方法的流程图；
图6为本申请的实施例提供的另一种生成密钥的方法的流程图；
图7为本申请的实施例提供的另一种生成密钥的方法的流程图；
图8为本申请的实施例提供的另一种生成密钥的方法的流程图；
图9为本申请的实施例提供的另一种生成密钥的方法的流程图；
图10为本申请的实施例提供的另一种生成密钥的方法的流程图；
图11为本申请的实施例提供的另一种生成密钥的方法的流程图；
图12为本申请的实施例提供的另一种生成密钥的方法的流程图；
图13为本申请的实施例提供的另一种生成密钥的方法的流程图；
图14为本申请的实施例提供的一种装置的结构示意图；
图15为本申请的实施例提供的一种核心网设备的结构示意图；
图16为本申请的实施例提供的另一种装置的结构示意图；
图17为本申请的实施例提供的一种装置的结构示意图。
具体实施方式
下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明， “多个”的含义是两个或两个以上。
本申请描述的系统架构及业务场景是为了更加清楚的说明本申请的技术方案，并不构成对于本申请提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
本申请的实施例可以应用于支持终端同时通过至少两种接入技术接入网络的通信系统。示例性的，该通信系统可以是下一代无线通信系统，例如5G通信系统，如图1所示，图1示出了本申请的一种可能的网络架构示意图，该网络架构中包括：
AMF节点：为负责移动性管理的网元，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如合法监听，接入授权等功能。
会话管理功能(session management function，SMF)节点：用于为用户面分配会话资源。
鉴权服务功能(authentication server function，AUSF)节点：当AUSF对终端进行鉴权的时候，负责验证传递待认证参数和认证终端的真实性。主要功能包括：接收安全锚点功能(security anchor function，SEAF)节点发送的鉴权请求；选择鉴权方法。在使用可扩展鉴权协议鉴权和密钥协商(extensible authentication protocol authentication and key agreement,EAP-AKA’)鉴权方法的时候，AUSF节点可以完成网络侧对终端的鉴权。
SEAF节点：SEAF节点可以是AMF节点的一部分，也可以是独立的网元，主要负责向AUSF发起鉴权请求，在演进分组系统鉴权和密钥协商(evolved packet system authentication and key agreement,EPS-AKA*)鉴权过程中完成网络侧对终端的认证。
用户面功能(user plane function，UPF)节点：为用户面数据的出口，用于连接外部网络。
数据网络(data network，DN)：用于提供外部数据的网络，例如因特网(internet)等。
(无线)接入网((radio)access network，(R)AN)节点：(R)AN可以采用不同的接入技术。目前的无线接入技术有2种类型：3GPP接入技术(例如3G、4G或5G系统中采用的无线接入技术)和non-3GPP接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网称为无线接入网(RAN)，其中，5G系统中的接入网设备称为下一代基站节点(next generation node basestation，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi接入点(access point，AP)为代表的空口技术。
终端：本申请所称的终端，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。该终端可以包括各种类型的用户设备(user equipment， UE)、手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、无线数据卡、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、机器类型通信(machine type communication,MTC)的终端设备，工业控制(industrial control)中的终端设备、无人驾驶(self driving)中的终端设备、远程医疗(remote medical)中的终端设备、智能电网(smart grid)中的终端设备、运输安全(transportation safety)中的终端设备、智慧城市(smart city)中的终端设备，以及可穿戴设备(如智能手表，智能手环，计步器等)等等。在采用不同的无线接入技术的系统中，具备相类似无线通信功能的终端的名称可能会有所不同，仅为描述方便，本申请实施例中，上述具有无线收发通信功能的装置统称为终端。
具体地，本申请中的终端中存储有长期密钥和相关函数，终端在与核心网节点(如AMF节点、AUSF节点、SEAF节点等)进行双向鉴权时，可使用长期密钥和相关函数对验证网络的真实性。
接入网设备：本申请实施例所涉及到的接入网设备是一种为终端提供无线通信功能的装置。例如，接入网设备可以是基站(base station，BS)，所述基站可以包括各种形式的宏基站，微基站，中继站，接入点等等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如在5G系统中，称为下一代基站节点，可表示为gNB，在长期演进(long term evolution，LTE)系统中，称为演进的节点B(evolved NodeB，eNB或eNodeB)，在第三代(3rd generation，3G)通信系统中，称为节点B(Node B)等等。为方便描述，本发明实施例中，上述为终端提供无线通信功能的装置统称为接入网设备。
网络能力开放功能(network exposure function，NEF)节点：主要用于与第三方交互，使第三方可以间接与某些3GPP网络内部的网元进行交互。
网络功能存储(network function repository function，NRF)节点：用于网元间发现，维护网络功能(network function，NF)。
策略控制功能(policy control function，PCF)节点：PCF节点中存储有最新的服务质量(quality of service，QoS)规则，基站可根据SMF节点提供的QoS规则，为用户面传输通道分配合适的资源。
统一的数据管理(unified data management，UDM)节点：用于存储用户的签约信息。
应用功能(application function，AF)节点：AF节点可以位于DN内部，属于部署在第三方的功能网元，此网元主要作用是告知PCF节点最新的第三方企业对于某个应用的业务要求。PCF节点可根据业务要求生成相应的QoS规则，确保网络提供的服务满足第三方所提出的要求。
在本申请的实施例中，终端可以通过至少两种接入技术接入AMF节点，以至少两种接入技术包括3GPP接入技术和非3GPP接入技术为例，本申请实施例还提供了一种可能的网络架构示意图，如图2所示，该网络架构中包括AMF节点、AUSF节点、SMF节点、UPF节点、UDM节点(或认证凭证存储和处理功能(authentication credential repository and processing function，APRF)节点)、终端和非3GPP互通功能(non-3GPP interworking function，N3IWF)节点。
其中，AMF节点、AUSF节点、SMF节点、UPF节点、UDM节点和终端可参考图1中的描述，此处不再赘述。
其中，N3IWF节点用于支持终端通过非3GPP接入技术接入AMF节点。
结合图2所示的网络架构，终端可以同时通过3GPP接入技术和非3GPP接入技术接入AMF节点。其中，3GPP接入技术中的接入网设备可以是5G网络的基站，4G网络的基站，或者未来电信网络所使用的基站。非3GPP接入技术可以是wifi网络，固网网络等非电信网络所使用的网络接入技术。其中，3GPP接入技术可以简单表示为3GPP，非3GPP接入技术可以简单表示为非3GPP或non-3GPP。图2中的路径1为终端通过3GPP接入AMF节点的路径，路径2为终端通过非3GPP接入AMF节点的路径。终端可通过相应接入技术对应的网关，以及与网关共同部署的功能实体或者具有网关功能的实体接入AMF节点。其中，非3GPP技术对应的网关可能是N3IWF节点，还可能是终端通过固网接入技术接入到AMF节点时所使用的网关，比如BNG(broadband network gateway固定网络网关)。具有网关功能实体是指与AMF节点连接的对端，比如5G网络N2接口的另一端，4G网络S1接口的另一端。
在终端同时通过3GPP和非3GPP接入AMF节点的情况下，若终端需要向AMF节点发送NAS消息，在一种可能的实现方式中，NAS消息可以被拆分为至少两个消息块，一部分消息块通过3GPP传输，另一部分消息块通过非3GPP传输，示例性地，可以将NAS消息划分为1、2、3、4、5这五个消息块，其中2、4消息块通过3GPP传输，1、3、5消息块通过非3GPP传输。在另一种可能的实现方式中，终端可以通过3GPP传输一整条NAS消息，通过非3GPP传输另一整条NAS消息。
首先对本申请实施例涉及到的相关术语进行解释说明。
(1)、RM态
RM用于控制终端和网络，RM态包括注册态和去注册态两种状态。
当终端处于去注册态时，终端可以通过向核心网设备(例如AMF节点)发送注册流程尝试进入注册态，当终端接收到AMF节点回复的注册接受(registration accept)消息后，终端即进入注册态。当终端关机，或者终端注册失败的情况下，终端则返回去注册态。
在终端处于注册态的情况下，AMF节点中有终端的位置信息，路由信息以及安全上下文信息，终端中有安全上下文信息。
在终端处于去注册态的情况下，AMF节点没有终端的位置信息，路由信息，AMF节点和终端均有安全上下文信息。其中，安全上下文信息包括NAS密钥和相关算法，若终端是由注册态回到了去注册态，则终端不仅保存安全上下文信息，还保存上次注册时，AMF节点分配的临时身份信息，使得终端再次注册到网络时，可以不发起鉴权流程，降低接入网络的时延。
(2)、CM态
CM态包括连接态和空闲态。
当终端处于连接态的时候，终端和网络之间有通信连接，即终端和AMF节点之间正在交换数据。
当终端处于空闲态的时候，终端和网络之间无通信连接，即终端和AMF节点之 间当前没有交换任何数据。
(3)、状态切换
在终端没有接入过网络的情况下，终端处于空闲态和去注册态，此时终端与AMF节点之间没有安全上下文信息，终端首先由空闲态切换至连接态，然后终端可发起注册流程，由去注册态切换至注册态，此时终端具有NAS密钥和安全算法。如果终端后续不需要与网络进行交互数据，则终端可以回到空闲态，在终端回到空闲态后，仍处于注册态。
其中，在终端由连接态回到空闲态时，终端保存的安全上下文信息为NAS密钥和安全算法。在终端由注册态回到非注册态时，终端保存NAS密钥、安全算法和上次注册时AMF分配的临时身份信息。
需要说明的是，本申请中的状态切换是指终端在核心网设备中的CM态由一种状态回到另一种状态，例如由连接态切换至空闲态是指终端在核心网设备的中的CM态从连接态回到了空闲态。比如，当终端发送注册请求消息给核心网设备的时候，终端处于连接态。在核心网设备向终端发送注册完成消息后，如果终端没有立刻向核心网设备发送消息，或者终端在由定时器控制的某个特定时间段内没有想核心网设备发送消息，则终端会回到空闲态。
另外，本申请实施例不限制“切换”动作的时间，即第二连接由连接态切换至空闲态所需要的时间可以由计时器控制，也可以由切换流程控制，本申请对此不作限定。
(4)、第一接入技术、第二接入技术
终端支持通过第一接入技术和第二接入技术同时接入网络，其中，第一接入技术为3GPP接入技术，第二接入技术为非3GPP接入技术，或者，第一接入技术为非3GPP接入技术，第二接入技术为3GPP接入技术。当然本申请并不限于此，第一接入技术和第二接入技术还可以为终端与核心网设备通信时支持的其他接入技术。
第一连接为终端通过第一接入技术接入第一核心网设备的连接。
第二连接为终端通过第二接入技术接入第二核心网设备的连接。
其中，使用第一连接和第二连接的终端为同一终端，但是第一核心网设备和第二核心网设备可以相同，也可以不同。本申请中以终端支持同时通过第一连接和第二连接接入同一个核心网设备为例。
另外，本申请中的第一连接和第二连接可以是终端与核心网设备之间的直接连接，也可以是间接连接。例如，第二连接为终端通过第二接入技术接入到网关设备，通过网关设备接入到核心网网元的连接。以图2为例，终端可通过3GPP接入技术接入AMF节点，第一连接可以理解为终端使用3GPP接入技术时与AMF节点之间的通信路径，即路径1，或者，终端也可以通过非3GPP接入技术接入AMF节点，在终端通过非3GPP接入技术接入AMF节点时，终端并不是直接与AMF节点进行通信，而是通过N3IWF节点与AMF节点进行通信，第二连接为终端与N3IWF节点之间的连接和N3IWF节点和AMF节点之间的连接，也可以理解为第二连接为路径2。
(5)、重鉴权
重鉴权，是指当核心网设备发现某种参数即将无法使用，比如NAS COUNT即将翻转，或者根据运营商的配置要求，达到了核心网设备对终端再次进行鉴权的触发条 件。核心网设备对终端进行重鉴权的过程中，核心网设备和终端进会行消息交互，终端和核心网设备分别将对方提供的待验证参数，与自己生成的另一个参数进行对比，若对方提供的待验证参数与自身生成的参数相同，则终端和核心网设备之间的鉴权验证通过。
示例性地，鉴权验证流程可以为5G网络的5G AKA流程，EAP-AKA’流程，或者是LTE网络的EPS AKA流程。
可选地，本申请实施例中的重鉴权流程可以包括鉴权验证流程和密钥激活流程，即在鉴权验证流程中，核心网设备和终端可以互相验证对方发送的待验证信息是否正确，在密钥激活流程即核心网设备向终端发送NAS安全模式命令(security mode command，SMC)消息，以及接收来自终端的NAS安全模式完成(security mode complete,SMP)消息的过程。
(6)、核心网设备
其中，核心网设备，是区别于接入网设备的3GPP网络的设备。核心网设备可以是AMF节点,SMF节点,还可以是SEAF节点，AUSF节点，UDM节点等网络设备。
其中，核心网设备不限制于对终端进行验证的设备，比如5G网络中的AUSF节点。核心网设备也可以为参与鉴权流程的设备，比如在鉴权流程中用于转发消息的设备(例如AMF节点)。可选地核心网设备还可以具有与核心网设备部署在一起的独立的功能比如SEAF功能。
另外，对终端发起重鉴权流程的核心网设备可以与对终端进行鉴权验证的核心网设备相同，也可以不同。其中，鉴权验证是指核心网设备验证终端发送的待认证信息是否是正确的。比如在5G AKA场景下，发起重鉴权流程的核心网设备为AMF节点，或者为与AMF节点部署在一起的SEAF节点，在此场景下，发起重鉴权流程的核心网设备可以是AMF节点，对终端进行鉴权验证的核心网设备是AMF节点中的SEAF节点，此时可认为对终端发起重鉴权流程的核心网设备和对终端进行鉴权验证的核心网设备是相同的，均为AMF节点。在此场景下，如果SEAF节点未与AMF节点部署在一起，即SEAF节点也是一个独立的核心网设备，那么对终端发起重鉴权流程的核心网设备和对终端进行鉴权验证的设备就是不同的。
再比如，在5G EAP-AKA’的场景下，发起重鉴权流程的核心网设备可以是AMF节点，而对终端进行鉴权验证的设备是AUSF节点。此时，对终端发起重鉴权流程的核心网设备和对终端进行鉴权验证的核心网设备就是不同的。
(7)、密钥
第一连接的密钥和第二连接的密钥均为NAS密钥，NAS密钥包括加密密钥和完整性保护密钥，第一连接的密钥用于对终端与核心网设备之间通过第一连接之间传输的消息进行安全保护，第二连接的密钥用于对终端与核心网之间通过第二连接之间传输的消息进行安全保护。
本申请的实施例涉及到的密钥架构如图3所示，在图3中，上一层的密钥可以作为下一层的密钥的生成参数，可选地，在重鉴权过程中可以生成用于第一连接的密钥和其他用于衍生第一连接的密钥，例如在图3中，除了第一层的K之外的密钥在重鉴权过程中都会被更新。示例性地，第一连接的密钥可以为KNASint,KNASenc, KRRCint,KRRCenc,KUPint,KUPenc等。
可选地，在若更新密钥的过程中需要保留旧的密钥，被保留的旧密钥可以为KNASint,KNASenc,KgNB,NH,KRRCint,KRRCenc,KUPint,KUPenc,KN3IWF中的至少1个。可选的，KAMF，KSEAF，KAUSF也被保留下来。
结合图1至图3，本申请的实施例提供一种更新密钥的方法，应用于通信系统，通信系统包括核心网设备和终端，其中，该终端分别通过第一接入技术和第二接入技术同时接入到核心网设备。如图4所示，该方法包括：
步骤401、核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权，相应地，终端通过第一接入技术对应的第一连接对核心网设备进行重鉴权。
其中，核心网设备通过第一连接对终端进行重鉴权的过程中，核心网设备和终端均可以更新第一连接的密钥，例如核心网设备和终端设备会为第一连接生成新的密钥，比如KAUSF，KSEAF，KAMF，KNASint,KNASenc等密钥。
可选地，在核心网设备通过第一连接对终端进行重鉴权的过程中，核心网设备还可以获取第一密钥标识符，第一密钥标识符用于标识第一连接的更新后的密钥。在核心网节点为AMF节点时，AMF节点获取第一密钥标识符的方法包括以下三种：
第一种：AMF节点生成第一密钥标识符。
第二种：AMF节点从其他核心网设备处获取第一密钥标识符。比如，从SEAF节点获取第一密钥标识符。
第三种：AMF节点从其他核心网设备处获取用于生成第一密钥标识符的信息，然后根据用于生成第一密钥标识符的信息生成第一密钥标识符。
可选地，在重鉴权过程中，核心网设备可将第一密钥标识符发送给终端。
可以理解的是，终端接收到第一密钥标识符后，可将第一连接的密钥更新为第一密钥标识符标识的密钥。
步骤402、若满足第一触发条件，则核心网设备更新第二接入技术对应的第二连接的密钥。
可选地，第一触发条件可以为第二连接的状态，第二连接的状态可以为空闲态或连接态。
可选地，第一触发条件还可以为第二连接处于去注册态，若核心网设备确定第二连接处于去注册态，说明核心网设备和终端当前未使用第二连接，所以对终端进行重鉴权的过程以及更新第二连接的密钥的过程均不会影响核心网设备和终端对第二连接的使用。
步骤403、若满足第二触发条件，则终端更新第二接入技术对应的第二连接的密钥。
本申请的实施例提供的方法，核心网设备可通过第一连接对终端进行重鉴权，重鉴权过程中可更新第一连接的密钥，当满足第一触发条件时，核心网设备可更新第二连接的密钥，当满足第二触发条件时，终端可更新第二连接的密钥，实现了终端同时通过多种接入技术接入AMF节点的情况下，可以在不影响终端与AMF节点之间通过第二连接进行正常通信的前提下，通过第一连接对终端进行重鉴权，且实现了两条连接的密钥更新。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
结合图4所示的实施例，在一种可能的实施场景下，第一触发条件为第二连接处于空闲态。若核心网设备确定需要通过第一连接对终端进行重鉴权，但此时第二连接处于连接态，如图5所示，该方法包括：步骤501至步骤505。
501、核心网设备通过第一连接向终端发送第一消息，第一消息用于指示终端暂停使用第一连接。相应地，终端通过第一连接接收来自核心网设备的第一消息。
可以理解的是，在第二连接处于连接态时，为了避免重鉴权过程对终端与核心网设备通过第二连接进行的通信产生影响，可以暂缓通过第一连接对终端进行重鉴权，待第二连接由连接态切换至空闲态后，再通过第一连接对终端进行重鉴权。由于在终端使用的NAS COUNT即将翻转等原因，所以核心网设备才需要对终端进行重鉴权，若终端继续通过第一连接向核心网设备发送NAS消息，可能会导致NAS COUNT翻转，所以核心网设备可指示终端暂停使用第一连接。可选地，若第一连接的安全上下文还可以使用一次，则核心网设备可指示终端在重鉴权之前只能通过第一连接或第二连接向核心网设备发送一条使用现有的第一连接的安全上下文保护的NAS消息。
步骤502、在第二连接由连接态切换至空闲态后，核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权。相应地，终端通过第一接入技术对应的第一连接进行重鉴权。
可选地，在第二连接由连接态切换至空闲态后，若第一连接仍处于连接态，则按步骤502的方法执行。
可选地，在第二连接由连接态切换至空闲态后，若第一连接处于空闲态，则核心网设备可通过第一接入技术对应的第一连接或通过第二接入技术对应的第二连接对终端进行重鉴权。可以理解的是，由于两个连接都处于空闲态，所以终端可以通过任意一个连接再次接入网络。当这种情况发生时，我们可以认为第二连接变为本申请实施例中的第一连接，原来的第一连接则变换为第二连接。
可选地，在通过第一连接对终端进行重鉴权的过程中，核心网设备还可以更新第二连接的密钥，并获取第三密钥标识符，第三密钥标识符用于标识第二连接的更新后的密钥。需要说明的是，若第一连接和第二连接共用一套NAS密钥，则第三密钥标识符和第一密钥标识符相同，或者也可以理解为，核心网设备无需获取第三密钥标识符，第一密钥标识符还可以用于标识第二连接的更新后的密钥。
在另一种可能的实现方式中，终端检测到第二连接回到了空闲态后，可通过第一连接或第二连接向核心网设备发送一条消息，触发核心网设备对终端发起重鉴权。在又一种可能的实现方式中，终端在第一连接处于空闲态，在第二连接收到了某一流程的结束消息后，在没有回到空闲态前，终端可向核心网设备发送消息，触发核心网设备通过第二连接对终端设备进行重鉴权。在这种情况下，可以认为第二连接变为本申请中的第一连接，原来的第一连接则变换为第二连接。
或者，还可以在核心网设备通过第一连接对终端进行重鉴权之后，更新第二连接 的密钥，即在步骤502之后还可以执行步骤503。
步骤503、核心网设备更新第二接入技术对应的第二连接的密钥。
具体地，第二连接处于空闲态，则核心网设备在重鉴权之后，可能更新第二接入技术对应的第二连接的密钥。
可选地，核心网设备还可以获取第三密钥标识符。
步骤504、核心网设备通过第一连接向终端发送第一指示信息。
其中，第一连接用于指示终端更新第二连接的密钥。
可选地，第一指示信息可以为第一密钥标识符或第二密钥标识符。或者第一指示信息还可以为第一密钥标识符和第二密钥标识符。
步骤505、终端更新第二连接的密钥。
可以理解的是，第二触发条件为终端通过第一连接接收到了来自核心网设备的第一指示信息。
可选地，若第一指示信息为第一密钥标识符，则终端可将第二连接的密钥更新为第一密钥标识符指示的密钥，若第一指示信息为第二密钥标识符，则终端可将第二连接的密钥更新为第二密钥标识符指示的密钥。
需要说明的是，在本申请的任一实施例中，若核心网设备通过向终端发送密钥标识符来指示终端更新第二连接的密钥，终端均可将第二连接的密钥更新为核心网设备发送的密钥标识符指示的密钥。
本申请的实施例提供的更新密钥的方法，若核心网设备确定需要通过第一连接对终端进行重鉴权时，还需判断第二连接的状态，在第二连接处于空闲态的情况下才会通过第一连接对终端进行重鉴权，并更新第一连接和第二连接的密钥，由于第二连接处于空闲态，所以更新密钥的过程不会影响终端与核心网设备对第二连接的正常使用。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
结合图4所示的方法，可选地，在另一种可能的实施场景下，第一触发条件为第二连接处于连接态。在核心网设备确定需要通过第一连接对终端进行重鉴权时，若第二连接处于连接态，则核心网设备可以暂停使用第二连接，然后通过第一连接对终端进行重鉴权，更新第一连接的密钥和第二连接的密钥。
可选地，在另一种可能的实施场景下，AMF节点和终端可预先配置计时器，在核心网设备通过第一连接对终端进行重鉴权并更新第一连接的密钥后，若第二连接处于连接态，则核心网设备和终端会启动计时器，核心网和终端确定计时器超时后，第二连接的旧密钥无法使用。或者，
在核心网设备通过第一连接对终端进行重鉴权并更新第一连接的密钥后，若第二连接处于连接态，在重鉴权完成后，核心网设备启动计时器；终端自动启动定时器。核心网确定计时器超时后，第二连接的旧密钥无法继续使用，同样，终端确定计时器超时后，也无法继续使用第二连接的旧密钥。或者，
在核心网设备通过第一连接对终端进行重鉴权过程中，或者完成重鉴权之后，核 心网设备向终端发送第一密钥标识符，然后核心网设备和终端各自为自身设置一个标记信息，用于标记若第二连接切换至空闲态，则更新第二连接的密钥。
结合图4，可选地，在另一种可能的实施场景下，第一触发条件为计时器或者标记信息，如图6所示，该方法包括：
步骤601、核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权。相应地，终端通过第一接入技术对应的第一连接对核心网设备进行重鉴权。
可选地，在核心网设备通过第一连接对终端进行重鉴权的过程中，核心网设备获取第一密钥标识符，保留第二密钥标识符和第二连接的更新前的密钥，第一密钥标识符用于标识第一连接的更新后的密钥，第二密钥标识符用于标识第二连接的更新前的密钥。
相应地，在终端通过第一连接进行重鉴权的过程中，保留第二密钥标识符和第二连接的更新前的密钥，第二密钥标识符用于标识第二连接的更新前的密钥。
需要说明的是，本申请的实施例中涉及到的第二连接的更新前的密钥为第二连接的旧密钥，第二连接的更新后的密钥为第二连接的新密钥。第二连接的新密钥与终端设备通过第一连接重鉴权过程中生成的密钥相关。
步骤602、核心网设备启动计时器。
其中，使得计时器超时的值可以是现有的某个正在使用的计时器的值，比如与non-3GPP接入技术相关的计时器的值，如去注册计时器(degistration timer)的值，还可以是3GPP接入技术相关的计时器的值，比如周期更新定时器(periodic registration timer)的值。当核心网设备启动计时器的时候，可以直接使用某个正在倒计时的计时器的值，也可以设置一个比某个正在倒计时的计时器值小的值，也可以设置一个与已经存在的计时器的值无关的值。或者可以运营商可以预配置计时器超时的值，使得计时器超时的值代表第二连接的更新前的密钥的有效时长，即第二连接的更新前的密钥可以被继续使用的时长。
步骤603、核心网设备通过第一连接向终端发送第二消息。相应地，终端接收第二消息。
可选地，第二消息携带指示信息，指示信息用于指示终端启动计时器。可选地，第二消息可以为NAS SMC消息。
可选地，第二消息还携带有第一密钥标识符或第二密钥标识符。
步骤604、终端启动计时器。
可选地，若终端接收的第二消息携带第一密钥标识符或第二密钥标识符，则终端可确定需要更新第二连接的密钥，进而启动计时器，或者，若终端接收的第二消息携带指示信息，则终端可根据指示信息启动计时器。
可选地，终端启动的计时器的超时值与核心网设备启动的计时器的超时值可以相同，也可以不同。若不同，则终端启动的计时器的超时值要小于核心网启动的计时器的超时值。终端启动计时器的超时值，可以是现有的某个正在使用的计时器的值，比如与non-3GPP接入技术相关的计时器的值，比如去注册计时器(degistration timer)的值，还可以是3GPP接入技术相关的计时器的值，比如周期更新定时器(periodic registration timer)的值。当核心网设备启动计时器的时候，可以直接使用某个正在倒计时的计时器 的值，也可以设置一个比某个正在倒计时的计时器小的值，也可以设置一个与已经存在的计时器无关的值。或者运营商可以预配置计时器超时的值，使得计时器超时的值代表第二连接的更新前的密钥的有效时长，即第二连接的更新前的密钥可以被继续使用的时长。
步骤605、若满足第二触发条件，则终端更新第二连接的密钥。
可选的，第二触发条件可以为终端的计时器超时。在计时器超时后，终端可以丢弃第二连接更新前的密钥，或者终端根据重鉴权过程中产生的新密钥，更新第二连接使用的密钥。比如将重鉴权过程中新生产的NAS层密钥作为新密钥，或者利用重鉴权过程中新生成的某个密钥衍生新的NAS层密钥。如Kamf。
需要说明的是，本申请不限制步骤605至步骤606的执行顺序，步骤605可能在步骤606之前执行，也可能在步骤606和步骤607之后执行，图6中以先执行步骤605为例。
步骤606、终端通过第二连接向核心网设备发送第三消息。相应地，核心网设备通过第二连接接收来自终端的第三消息。
其中，第三消息为NAS消息，例如可以为注册请求消息，会话创建请求消息等。终端通过第二连接向核心网设备发送第三消息至少包括以下几种情况：
情况一：终端在计时器超时前，通过第二连接向核心网设备发送第三消息，第三消息通过第二连接的更新前的密钥进行安全保护。
情况二：终端在计时器超时后，通过第二连接向核心网设备发送未进行安全保护的第三消息。可以理解的是，在这种情况下，若计时器超时后，终端可以不主动更新第二连接的密钥。可选的，终端可以向第二连接发送第三消息，进而执行步骤607，在步骤607之后，核心网设备可通过第二连接向终端发送用于更新、激活新密钥的消息，比如消息中携带指示终端更新第二连接的密钥的指示信息或第三密钥标识符，进而终端执行步骤605。对应于此情况，步骤605中的第二触发条件为终端接收到该指示信息或第三密钥标识符。或者，在这种情况下，终端也可以在向核心网设备发送第三消息后更新第二连接的密钥，即第二触发条件为终端的计时器超时，即在步骤606后执行步骤605。
情况三：终端在计时器超时后，通过第二连接向核心网设备发送第三消息，第三消息通过第二连接的更新后的密钥进行安全保护。
可选地，在情况三中，在计时器超时后，终端可主动更新第二连接的密钥，即在步骤606之后执行步骤605，对应于此情况，步骤605中的第二触发条件为终端的计时器超时。
步骤607、若满足第一触发条件，则核心网设备更新第二连接的密钥。
其中，对应于步骤605中的三种情况，第一触发条件也可以包括三种：
对应于上述情况一，第一种触发条件为：核心网设备在计时器超时前接收到终端通过第二连接发送的第三消息，且核心网设备通过第二连接的更新前的密钥对第三消息进行安全验证成功。
可选的，在这种情况下，终端在向核心网设备发送第三消息前，未更新第二连接的密钥，所以在核心网设备更新第二连接的密钥后，可以指示终端更新第二连接的密 钥。比如，通过随后的密钥激活流程更新第二连接的密钥。比如NAS SMC流程。
可选地，核心网设备在处理第三消息的过程中，计时器超时，核心网设备可向终端发送失败消息，失败消息可以携带失败原因值，原因值用于告知终端的第二连接的更新前的密钥超期。
可选地，核心网设备在处理第三消息的过程中，若计时器超时，核心网设备后续向终端发送的消息可通过更新后的第二连接的密钥进行安全保护，由于终端的计时器超时后，终端会更新第二连接的密钥，所以终端可以对计时器超期后，通过第二连接接收到的消息使用更新后的第二连接的密钥进行安全验证。
对应于上述情况二，第二种触发条件为：计时器超时后，核心网设备接收到终端通过第二连接发送的未进行安全保护的第三消息。在这种情况下，核心网设备会通过随后的密钥激活流程启用第二连接的更新后的密钥，比如NAS SMC流程。
对应于上述情况三，第三种触发条件为：计时器超时后，核心网设备接收到终端通过第二连接发送的第三消息，第三消息通过第二连接的更新后的密钥进行安全保护。对应的，核心网设备使用更新后第二连接的密钥对第三消息进行安全验证。
可选的，还包括第四种触发条件：计时器超时，且核心网设备在计时器超时前未接收到终端通过第二连接发送的第三消息。
对于第四种触发条件，即从核心网设备的计时器开始计时一直到核心网的计时器超时，终端均未向核心网设备发送第三消息，则在核心网设备的计时器超时后，核心网设备丢弃第二连接更新前的密钥。可选地，核心网设备还更新第二连接的密钥。可选地，核心网设备指示终端更新第二连接的密钥。
可选地，若计时器超时后，第二连接没有马上回到空闲态。在计时器超时到第二连接回到空闲态的时间段内，若终端向核心网设备发送了注册请求消息，则核心网设备可以对终端进行重鉴权。
需要说明的是，在计时器超时前，若核心网设备已经更新了第二连接的密钥，则核心网设备可关闭计时器，同样若终端在计时器超时前更新了第二连接的密钥，终端也可以关闭计时器。
步骤608、核心网设备删除第二连接的更新前的密钥和第二密钥标识符。
可以理解的，在步骤607，核心网设备更新第二连接的密钥之后即可执行步骤608。
步骤609、终端删除第二连接的更新前的密钥和第二密钥标识符。
可以理解的，在步骤605，终端更新第二连接的密钥之后即可执行步骤609。
本申请的实施例提供的更新密钥的方法，在核心网确定需要通过第一连接进行重鉴权时，若第二连接处于连接态，核心网设备可以直接通过第一连接对终端进行重鉴权，重鉴权过程中可以保留第二连接的更新前的密钥，这样即使核心网设备通过第一连接对终端进行重鉴权更新了第一连接的密钥，核心网设备和终端之间通过第二连接进行通信时，仍然可以使用第二连接的更新前的密钥，不会影响第二连接的正常通信，且该方法实现了第一连接和第二连接的解耦，核心网设备通过第一连接对终端进行鉴权时无需检测第二连接的状态，在计时器超时后，核心网设备和终端均可主动更新第二连接的密钥，减少了核心网设备和终端之间的信令交互开销，实现更为简单。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些 步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
可选地，结合图4，在另一种可能的实施场景下，在核心网确定需要通过第一连接对终端进行重鉴权时，如图7所示，该方法包括：
步骤701、核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权，相应地，终端通过第一接入技术对应的第一连接对核心网设备进行重鉴权。
步骤702、核心网设备设置第一标记。可选地，第二连接处于连接态。
其中，第一标记用于标记核心网设备已通过第一连接对终端进行重鉴权，或用于指示更新第二连接的密钥。
需要说明的是，若第一标记用于标记核心网设备已通过第一连接对终端进行重鉴权，也隐含标记了核心网设备需要更新第二连接的密钥。
步骤703、若满足第一触发条件，则核心网设备更新第二连接的密钥。
可选的，在核心网设备通过第一连接对终端进行重鉴权的过程中，第二连接可能回到空闲态，基于此，第一触发条件为第二连接处于空闲态，且核心网设备确定存在第一标记。
或者，若终端通过第一连接对终端进行重鉴权后，第二连接仍处于连接态，此时第一触发条件为核心网设备确定存在第一标记，对应的核心网设备更新第二连接的密钥的方法为：若第二连接处于连接态，则核心网设备先暂停使用第二连接，然后更新第二连接的密钥。或者，核心网设备在通过第二连接回复终端消息前，先通过与终端设备交互密钥更新、激活流程，更新第二连接的密钥，再发送回复消息给终端。比如，通过NAS SMC流程更新第二连接的密钥。
需要说明的是，若核心网设备通过第一连接对终端进行重鉴权的过程中，第二连接回到空闲态，核心网设备可以在再次接收到终端通过第二连接发送的NAS消息，比如注册请求消息，且核心网设备确定存在第一标记的情况下更新第二连接的密钥。比如，通过与终端设备交互密钥更新、激活流程，更新第二连接的密钥。
可选地，核心网设备可以通过终端设备发送的消息中携带的密钥标识符信息确定终端设备使用的是哪套密钥。此时，核心网设备根据密钥标识符确定密钥，并使用密钥标识符对应的密钥验证终端发送的消息。验证成功后，将这套密钥作为第二连接的更新的密钥。
可以理解的是，在核心网设备更新第二连接的密钥后，可以恢复使用第二连接，后续使用第二连接发送NAS消息时，可通过更新后的第二连接的密钥对NAS消息进行完整性保护。
步骤704、核心网设备获取第三密钥标识符。
其中，第三密钥标识符用于标识第二连接更新后的密钥。
可选的，若第一连接和第二连接共用一套NAS密钥，则核心网设备在重鉴权过程中可以不获取第一密钥标识符，而是在更新第二连接的密钥后获取第三密钥标识符，则第三密钥标识符可以用于标识第一连接的更新后的密钥和第二连接的更新后的密钥。
可选的，若第一连接和第二连接共用一套NAS密钥，则核心网设备可以不获取第 三密钥标识符，直接使用重鉴权过程中获取的第一密钥标识符，即重鉴权过程中获取的第一密钥标识符可以用于标识第一连接的更新后的密钥和第二连接的更新后的密钥。
步骤705、核心网设备向终端发送第三密钥标识符。相应的，终端接收来自终端的第三密钥标识符。
需要说明的是，在核心网设备更新第二连接的密钥后，若第二连接处于连接态，则核心网设备可通过第二连接向终端发送第三密钥标识符，第三密钥标识符通过更新后的第二连接的密钥进行完整性保护；若第二连接处于空闲态，则核心网设备可通过第一连接向终端发送第三密钥标识符，第三密钥标识符通过更新后的第一连接的密钥进行完整性保护。
可选的，若第一连接和第二连接共用一套NAS密钥，且核心网设备未获取第三密钥标识符，则核心网设备可向终端发送第一密钥标识符。
可选的，核心网设备还可以向终端发送至少一个用于更新第二连接的密钥的参数，比如核心网设备更新第二连接的密钥时选择的加密算法和完整性保护算法。再比如，接入技术类型。
步骤706、终端更新第二连接的密钥。
可以理解的是，此时第二触发条件为终端接收到来自核心网设备的第三密钥标识符。
可选的，第三密钥标识符可以被携带在NAS消息中，若终端通过第二连接接收到第三密钥标识符，则终端可以根据第三密钥标识符更新第二连接的密钥，即将第二连接的密钥更新为第三密钥标识符标识的密钥，并通过更新后的第二连接的密钥对该NAS消息进行完整性保护验证，验证通过后第二连接的更新后的密钥生效；若终端通过第一连接接收到第三密钥标识符，则终端可通过第一连接的更新后的密钥对该NAS消息进行完整性保护验证，验证通过后更新第二连接的密钥。
本申请的实施例提供的生成密钥的方法，无论第二连接是否处于空闲态，核心网设备均可先更新第一连接的密钥，在更新完第一连接的密钥后，若第二连接回到空闲态，则可在终端下次通过第二连接向终端发送注册请求消息后更新第二连接的密钥，若第二连接仍处于连接态，为了避免核心网设备与终端通过第二连接传输消息时仍使用更新前的第二连接的密钥进行安全保护，会导致对消息的安全验证失败，核心网设备可以暂停使用第二连接，即先暂停核心网设备与终端之间通过第二连接进行的NAS消息交互，之后更新第二连接的密钥，更新之后核心网设备和终端之间即可恢复通过第二连接进行NAS消息交互，此时的NAS消息均使用第二连接的更新后的密钥进行安全保护，在核心网设备通过第一连接对终端进行重鉴权之后，避免了第二连接传输的消息出现安全验证失败的情况。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
结合图4，在上一种可能的实施场景下，在核心网确定需要通过第一连接对终端进行重鉴权时，若第二连接处于连接态，本申请的实施例还提供了另一种可能的实现 方式，如图8所示，该方法包括：
步骤801、核心网设备通过第一接入技术对应的第一连接对终端进行重鉴权，相应地，终端通过第一接入技术对应的第一连接对核心网设备进行重鉴权。
步骤802、核心网设备通过第一连接向终端发送第二指示信息。相应的，终端接收来自核心网设备的第二指示信息。
其中，第二指示信息用于指示终端更新第二连接的密钥。
其中，本实现方法不限制第二连接密钥的更新时机，即不限制终端设备在收到第二指示信息后立刻更新密钥，还是在收到第二指示信息后的一段时间后更新密钥。本方法强调的是终端在收到第二指示信息用，终端有更新第二连接的密钥的动作。
步骤803、核心网设备设置第二标记。
其中，第二标记用于指示更新第二连接的密钥。
需要说明的是，本申请不限制步骤802和步骤803之间的执行顺序，这两个步骤可以同时执行，或者其中任意一个步骤先执行。
步骤804、终端设置第三标记。
其中，第三标记用于指示更新第二连接的密钥。
步骤805、若核心网设备确定存在第二标记，且第二连接切换至空闲态，则核心网设备更新第二连接的密钥。
可以理解的是，此时第一触发条件为核心网设备确定存在第二标记，且第二连接切换至空闲态。
步骤806、若终端确定存在第三标记，且第二连接切换至空闲态，则终端更新第二连接的密钥。
可以理解的是，此时第二触发条件为终端确定存在第三标记，且第二连接切换至空闲态。
可选的，终端也可以不设置第三标记，在核心网设备更新第二连接的密钥后，可向终端发送指示信息，指示终端更新第二连接的密钥。
或者，在第二连接切换至空闲态后，终端可以暂时不更新第二连接的密钥，待终端需要通过第二连接向核心网设备发送消息时，若确定存在第三标记，则更新第二连接的密钥。
可以理解的，在终端更新第二连接的密钥后，终端通过第二连接向核心网设备发送的NAS消息可以通过第二连接的更新后的密钥进行完整性保护。
本申请的实施例提供的更新密钥的方法，核心网设备确定需要通过第一连接对终端进行重鉴权时，若第二连接处于连接态，则核心网设备可先通过第一连接对终端进行重鉴权，重鉴权之后，核心网设备可设置第二标记，终端可设置第三标记，在第二连接切换至空闲态后，核心网设备和终端均可根据自身设置的标记更新第二连接的密钥，减少了更新第二连接的密钥过程中产生的信令开销。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
以下结合具体场景对本申请实施例提供的生成密钥的方法进行描述，结合图4和图6，在图6对应的实施场景下，如图9所示，该方法具体包括：
步骤901、终端通过第一连接向AMF节点发送NAS消息。相应地，AMF节点通过第一连接接收NAS消息。
示例性地，NAS消息可以为注册请求消息、服务请求消息或者PDU会话建立请求消息，或者还可以为其他NAS消息，本申请对此不作限定。
其中，NAS消息携带有用于标识第一连接的密钥的密钥标识符，该NAS消息用第一连接的密钥进行保护。
步骤902、AMF节点对NAS消息进行完整性验证成功，且确定需要通过第一支路对终端进行重鉴权。
其中，AMF节点根据NAS消息中携带的密钥标识符确定第一连接的密钥，AMF节点使用根据密钥标识符确定的第一连接的密钥对NAS消息完整性验证成功后，可以判断是否需要对终端进行重鉴权，示例性地，当AMF节点确定终端使用的NAS COUNT即将发生翻转时，则确定需要对终端进行重鉴权，或者AMF节点还可以根据运营商的配置信息确定是否需要对终端进行重鉴权，当然本申请并不限制于例举的这两种确定是否需要对终端进行重鉴权的方法。
步骤903、AMF节点通过第一连接向终端发起重鉴权。相应地，终端通过第一连接进行重鉴权。
其中，重鉴权包括鉴权验证流程和密钥激活流程。
步骤904、AMF节点更新第一连接对应的密钥，并获取第一密钥标识符。
其中，第一密钥标识符可以是在鉴权过程中获得的，第一密钥标识符用于标识第一连接的更新后的密钥。
需要说明的是，若第一连接和第二连接使用的是不同的密钥，则AMF节点更新第一连接的密钥后，可删除第一连接的更新前的密钥，保留第二连接的密钥和第二密钥标识符，第二密钥标识符用于标识第二连接的更新前的密钥；或者，
若第一连接和第二连接共用一套密钥，则AMF节点更新第一连接的密钥时，可选地，AMF节点仍需为第二连接保留第一连接的更新前的密钥和第二密钥标识符，第二密钥标识符用于标识第二连接的更新前的密钥，可以理解的是，第二连接的更新前的密钥和第一连接的更新前的密钥相同。具体地，若第二连接处于连接态，或者在AMF节点设置了标识信息或计时器值的方法下，AMF节点仍需为第二连接保留第一连接的更新前的密钥和第二密钥标识符。
步骤905、AMF节点通过第一连接向终端发送NAS SMC消息。相应地，终端通过第一连接接收来自AMF节点的NAS SMC消息。
其中，该NAS SMC消息相当于步骤603中的第二消息。可选地，NAS SMC消息携带第一密钥标识符、第二密钥标识符或者指示信息，该指示信息用于指示终端启动计时器。
可选地，终端接收到的NAS SMC消息携带用于指示终端启动计时器的指示信息，则终端启动计时器。或者，终端确定接收到的NAS SMC消息携带第一密钥标识符或第二密钥标识符，终端也可以启动计时器。
或者，当确定选择使用计时器方法的时候，即使在NAS SMC中没有携带第一密钥标识符、第二密钥标识符或者指示信息的情况下，终端可以在验证完NAS SMC的完整性保护正确后，或者发送NAS SMP消息后，启动计时器。其中，启动计时器是终端可以在验证完NAS SMC的完整性保护正确后，或者发送NAS SMP消息后的极短的时间内进行的。比如，验证完NAS SMC后立刻启动，或者在发送完NAS SMP后立即启动。在此方法下，第一密钥标识符已经在鉴权流程中传递给了终端。
需要说明的是，AMF节点在也可以在执行上述步骤905之前启动计时器，或者在步骤908之后启动计时器。
其中，使得计时器超时的值为第二连接的更新前的密钥的有效时长，示例性地，若第一连接和第二连接共用一套密钥，在计时器超时之前，第一连接的更新前的密钥仍可被第二连接使用，但是在计时器超时之后，AMF节点与终端之间通过第二连接传输的消息将无法使用第一连接的更新前的密钥进行安全保护。
步骤906、终端更新第一连接的密钥。
可以理解的是，终端在重鉴权过程中通过第一连接接收到来自AMF节点的NAS SMC消息，会更新第一连接对应的密钥。
则终端更新第一连接的密钥后，可删除第一连接的更新前的密钥，保留第二连接的密钥和第二密钥标识符。其中，删除第一连接的更新前的密钥，意味着这个密钥不可以再被第一连接使用，这个行为只跟第一连接相关，与第二连接无关。
步骤907、终端通过第一连接向AMF节点发送NAS SMP消息。相应地，AMF节点接收NAS SMP消息。
其中，NAS SMP节点通过第一连接的更新后的密钥进行完整性保护。
需要说明的是，步骤904至步骤907也可以理解为核心网设备通过第一连接对终端进行重鉴权的流程。
步骤908、AMF节点通过第一连接向终端发送完成消息，相应地，终端接收来自AMF节点的完成消息。
其中，该完成消息为步骤901中的NAS消息的响应消息，示例性地，若步骤901中的NAS消息为注册请求消息，则该NAS消息为注册完成消息。
步骤909、终端通过第二连接向AMF节点发送NAS消息。相应地，AMF节点通过第二连接接收NAS消息。
其中，NAS消息携带有第二密钥标识符，该NAS消息用第二连接的更新前的密钥进行保护。
可选地，NAS消息还携带第一密钥标识符。
同样，该NAS消息也可以为注册请求消息，或服务请求消息，或PDU会话建立请求消息，当然本申请不限于此。
其中，该NAS消息相当于步骤606中的第三消息，终端通过第二连接向AMF节点发送NAS消息的情况可参考步骤606中的描述，此处不再赘述。
步骤910、AMF节点更新第二连接的密钥。
其中，AMF节点在满足第一触发条件时才可以更新第二连接的密钥，关于第一触发条件的描述可参考上述步骤607中的相关描述，此处不再赘述。
可选地，AMF节点可以获取与更新的第二连接的密钥对应的第三密钥标识符，第三密钥标识符用于标识第二连接的更新后的密钥，或者，若第一连接和第二连接共用一套NAS密钥，AMF节点可以不生成第三密钥标识符，而是使用第一密钥标识符标识第一连接的更新后的密钥和第二连接的更新后的密钥。
需要说明的是，AMF节点更新第二连接的密钥后，可删除第二连接的更新前的密钥和用于标识第二连接的更新前的密钥的密钥标识符。或者，AMF节点也可以因为触发条件的不同，选择在第二连接的密钥更新前，删除第二连接的更新前的密钥和用于标识第二连接的更新前的密钥的密钥标识符。
步骤911、AMF节点通过第二连接向终端发送NAS SMC消息。相应地，终端通过第二连接接收来自AMF节点的NAS SMC消息。
其中，若第一连接和第二连接共用一套密钥，则NAS SMC消息携带第一密钥标识符。
可选地，若第一连接和第二连接使用不同的密钥，则NAS SMC消息携带第三密钥标识符。
步骤912、终端更新第二连接的密钥。
可选地，终端在接收到NAS SMC消息后，更新第二连接的密钥。可选地，可根据NAS SMC消息中携带的第一密钥标识符或第三密钥标识符更新第二连接的密钥。
可选地，在终端启动计时器后，若终端的计时器未超时，则终端更新第二连接的密钥后，停止计时器。
终端更新第二连接的密钥后，可删除第二连接的更新前的密钥和用于标识第二连接的更新前的密钥的密钥标识符。
步骤913、终端通过第二连接向AMF节点发送NAS SMP消息。相应地，AMF节点通过第二连接接收NAS SMP消息。
其中，计算NAS SMP的完整性保护是根据更新后的密钥得出的。
可选地，在核心网设备启动计时器后，若核心网设备计时器未超时，则核心网设备更新第二连接的密钥后，停止计时器。
步骤914、AMF节点通过第二连接向终端发送完成消息。相应地，终端通过第二连接接收完成消息。
其中，该完成消息为步骤901中的NAS消息的响应消息，示例性地，若步骤901中的NAS消息为注册请求消息，则该完成消息为注册完成消息。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
可选地，在上述图5对应的实施场景下，在AMF节点确定需要通过第一连接对终端进行重鉴权时，需要判断第二连接的状态，在第二连接的状态为空闲态的情况下才可以通过第一连接对终端进行重鉴权，如图10所示，该方法包括：步骤1001至步骤1012。
其中，步骤1001至步骤1002与上述步骤901至步骤902相同，此处不再赘述。
步骤1003、AMF节点确定第二连接的状态。
其中，当AMF节点确定需要对终端进行重鉴权时，在第二连接处于连接状态下的重鉴权方法和第二连接处于空闲态或非注册态时的鉴权方法不同，所以AMF节点需确定第二连接是否处于连接态。
可选地，以终端支持通过3GPP接入技术和非3GPP接入技术同时接入AMF节点为例，AMF节点可先确定终端是否同时使用3GPP接入技术和非3GPP接入技术接入AMF节点，若终端同时使用3GPP接入技术和非3GPP接入技术接入AMF节点，则说明AMF节点与终端之间存在第二连接，进而确定终端在第二连接是否处于连接态。
为了快速确定第二连接是否处于连接态，AMF节点可先确定终端在第二连接是否处于注册态，若确定终端在第二连接处于去注册态，则可确定终端在第二连接不可能处于连接态，若确定终端在第二连接处于注册态，则进一步确定终端在第二连接是否处于连接态。
其中，AMF节点确定终端是否同时使用两种接入技术接入AMF节点至少包括以下三种方法：
(1)、上述步骤1001的NAS消息中携带用于指示终端在第二连接处于注册态的指示信息，AMF节点可根据该指示信息确定终端在第二连接处于注册态，即终端同时通过两种接入技术接入AMF节点。
采用这种方法，AMF节点可直接根据接收到的指示信息确定终端在第二连接的状态，方便快捷，无需AMF节点进行其他查询工作。
(2)、AMF节点通过查询自身维护的终端的状态机确定终端还存在一个注册态与除第一连接对应的接入技术之外的另一种接入技术关联。
采用这种方法，AMF节点可通过简单的查询操作确定第二连接的状态，无需终端额外在NAS消息中添加用于指示第二连接的状态的指示信息。
(3)、AMF节点中存储用于指示终端同时使用两种接入技术接入的指示信息。
例如，在终端已经通过一种接入技术(例如3GPP接入技术)接入的情况下，若AMF节点确定终端通过另外一种接入技术(例如非3GPP接入技术)接入成功，则AMF节点可在终端的上下文中设置一个标识，该标识用于表示当前终端通过几种接入技术接入，例如该标识为0时，代表终端通过一种接入技术接入，该标识为1时，代表终端同时通过两种接入技术接入，或者代表终端处于双注册状态。其中，双注册状态为终端同时通过两种接入技术注册到AMF节点的状态。
再例如，AMF节点可为两种接入技术共享的文件设置一个指示信息，用于指示该共享文件中的内容是被两种接入技术共享使用的，在该文件中的内容被删除或更改前，需要确定该文件中的内容是否正在被使用。其中，该文件中的内容可以是两种接入技术公用的NAS密钥和相关安全算法，AMF节点可根据该文件对应的指示信息确定终端同时使用两种接入技术接入AMF节点。
此外，AMF节点确定终端在第二连接是否处于连接态至少包括以下三种可能的实现方式：
(1)、AMF节点确定自身正在通过第二连接与终端通信。
示例性地，AMF节点正在通过第二连接向终端发送NAS消息，或者AMF节点正 在通过第二连接寻呼终端。
(2)、AMF节点通过查询自身维护的终端的状态机确定终端在第二连接处于连接态。
(3)、AMF节点通过自身存储的指示信息确定终端在第二连接处于连接态。
例如，若AMF节点发现自身存储的终端处于双注册态或双连接态的标识，例如发现标识为1，则确定终端在第二连接处于连接态。
再例如，若AMF节点发现自身存储的文件对应的指示信息指示文件中的内容被两种接入技术共用，且文件中的内容无法被更改，说明文件中的内容正在被第二连接使用，进而可确定终端在第二连接处于连接态。
在本实施例中，以第二连接的状态为连接态为例进行说明。
步骤1004、AMF节点通过第一连接向终端发送拒绝消息或接受消息。
其中，步骤501中的第一消息可以为本步骤中的拒绝消息或接受消息。拒绝消息表示AMF节点拒绝步骤1001中终端发送的NAS消息，例如拒绝终端发送的注册请求消息。可选地，拒绝消息携带原因值，原因值用于告知终端拒绝原因为第二连接处于连接态，所以此时无法对终端进行重鉴权。可选地，原因值还用于表示AMF节点对步骤1101中终端发送的NAS消息进行完整性验证成功。
可选地，若第一连接对应的NAS COUNT暂时不会发生翻转，AMF节点还允许终端继续通过终端发送指定数量的NAS消息，或者终端通过第一连接向AMF节点发送的是周期注册消息，则AMF节点可通过第一连接向终端发送接受消息。
接受消息中携带重鉴权标识位信息，重鉴权标识位信息用于告知终端需要第终端进行重鉴权，但是由于第二连接处于连接态而暂时无法发起重鉴权。终端接收到重鉴权标识位后，终端的行为将受到限制，例如重鉴权标识符可用于指示终端暂停使用第一连接，或者终端只可使用第一连接发送用户面数据，或者终端只可以通过第一连接发送指定数量的(例如一条)NAS消息(相当于第一连接的安全上下文还可以使用一次)，或者终端只可以通过第一连接发送未进行完整性保护的注册请求消息。
重鉴权标识位信息还可以是计时器信息，如果终端在计时器到期前还没有被重新鉴权，则AMF节点会使终端处于去注册状态，可选地，AMF节点会删掉这个终端的所有安全上下文以使得终端在下次入网时，必须进行重鉴权。
步骤1005、终端确定第二连接切换至空闲态。
步骤1006、终端通过任意一条连接向AMF节点发送NAS消息。相应地，AMF节点接收NAS消息。发送NAS消息的连接成为本发明的第一连接。
可选地，该NAS消息可以为注册请求消息。
若终端在步骤1004中接收到的是拒绝消息，则终端可通过任何一个连接向AMF节点发送NAS消息。
若终端在步骤1004中接收到的是接受消息，且重鉴权标识位指示终端可通过第一连接发送指定数量的NAS消息，则终端可通过第一连接向AMF节点发送一条具有完整性保护的NAS消息。若重鉴权标识位指示终端可以发送未进行安全保护的注册请求消息，则终端可通过第一连接或第二连接向终端发送未进行安全保护的注册请求消息。
可以理解的是，若AMF节点接收到的为经过完整性保护的NAS消息，则先对NAS 消息进行完整性保护验证。
步骤1005和步骤1006为可选步骤，即在步骤1004之后，也可以直接执行步骤1007。
步骤1007、AMF节点确定第二连接处于空闲态。
其中，AMF节点确定第二连接的状态的方法可参考步骤1003中的相关描述，此处不再赘述。
步骤1008、AMF节点通过第一连接对终端进行重鉴权。
可选地，若步骤1006中，终端通过第二连接向AMF节点发送NAS消息，则本步骤中AMF节点可通过第二连接对终端进行重鉴权，以下均AMF节点通过第一连接对终端进行重鉴权为例进行说明。
可选地，在本步骤中，AMF节点可更新第一连接的密钥和第二连接的密钥，终端可更新第一连接的密钥。可选地，若第一连接和第二连接共用一套NAS密钥，则AMF节点在对终端进行重鉴权过程中可获取第一密钥标识符，第一密钥标识符用于标识第一连接的更新后的密钥和第二连接的更新后的密钥。
或者，若第一连接和第二连接分别使用不同的NAS密钥，则AMF节点在对终端进行重鉴权的过程中可获取第一密钥标识符，可选地，AMF节点还可以获取第三密钥标识符。此时第一密钥标识符用于标识第一连接的更新后的密钥，第三密钥标识符用于表示第二连接的更新后的密钥。
步骤1009、AMF节点向终端发送NAS SMC消息。相应地，终端接收NAS SMC消息。
可选地，NAS SMC消息中可携带步骤504中的第一指示信息。
其中，第一指示信息用于指示终端更新第二连接的密钥。
可选地，第一指示信息可以为第一密钥标识符或第二密钥标识符。或者第一指示信息还可以为第一密钥标识符和第二密钥标识符。
其中，NAS SMC消息可通过第一连接更新后的密钥进行完整性保护，终端可通过第一连接更新后的密钥对NAS SMC消息进行完整性保护验证。
步骤1010、终端根据第一指示信息更新第二连接的密钥。
步骤1011、终端通过第一连接向AMF节点发送NAS SMP消息，相应地，AMF节点通过第一连接接收NAS SMP消息。
其中，NAS SMP消息通过第一连接更新后的密钥进行完整性保护。
可选地，终端还可以通过第二连接向AMF节点发送NAS SMP消息，此时NAS SMP消息通过第二连接更新后的密钥进行完整性保护。
步骤1012、AMF节点通过第一连接向终端发送完成消息。相应地，终端通过第一连接接受来自AMF节点的完成消息。
该完成消息为步骤1001中的NAS消息的响应消息，示例性地，若步骤1001中的NAS消息为注册请求消息，则该完成消息为注册完成消息。
可以理解的是，若终端后续通过第二连接向终端发送NAS消息，则可通过更新后的第二连接的密钥对该NAS消息进行完整性保护。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些 步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
可选地，在上述图7和图8对应的实施场景下，在AMF节点确定需要通过第一连接对终端进行重鉴权时，若第二支路处于连接态，核心网设备可先通过第一连接对终端进行重鉴权，如图11所示，该方法包括：步骤1101至步骤1115。
其中，步骤1101至步骤1103与上述步骤1001至步骤1003相同，此处不再赘述。
步骤1104、AMF节点通过第一连接对终端进行重鉴权。
其中，重鉴权过程中AMF节点和终端均可更新第一连接的密钥。
步骤1105、AMF节点通过第一连接向终端发送NAS SMC消息。相应地，终端通过第一连接接收来自AMF节点的NAS SMC消息。
其中，NAS SMC消息通过第一连接的更新后的密钥进行完整性保护，终端可通过第一连接的更新后的密钥对NAS SMC消息进行完整性保护验证。
可选地，NAS SMC消息携带步骤802中的第二指示信息，第二指示信息用于指示终端更新第二连接的密钥，或者第二指示信息也可用于指示终端不更新第二连接的密钥。
步骤1106、终端通过第一连接向AMF节点发送NAS SMP消息。
步骤1107、AMF节点设置第一标记。
其中，第一标记用于标记核心网设备已通过第一连接对终端进行重鉴权，或用于指示更新第二连接的密钥。
步骤1108、终端设置第二标记。
其中，第三标记用于指示更新第二连接的密钥。
可选地，若终端接收到的第二指示信息用于指示终端更新第二连接的密钥的情况下，才需要执行步骤1108。
步骤1109、AMF节点通过第一连接向终端发送注册接受消息。相应地，终端通过第一连接接收来自AMF节点的注册接受消息。
步骤1110、终端确定第二连接切换至空闲态，若确定存在第三标记，则终端更新第二连接的密钥。
可选地，若终端未设置第三标记，则第二连接切换至空闲态时，需执行步骤1111。
步骤1111、AMF节点确定第二连接切换至空闲态，若确定存在第一标记，则AMF节点更新第二连接的密钥。
可选地，若第二连接仍处于连接态，则AMF节点可暂停使用第二连接，或者若AMF节点在处理终端通过第二连接发送的NAS消息时，若发现第一标记，也可以暂停使用第二连接，然后更新第二连接的密钥以及用于标识第二连接的更新后的密钥的密钥标识符，并通过第二连接向终端发送NAS SMC消息，NAS SMC消息携带用于标识第二连接的更新后的密钥的密钥标识符，进而终端可根据该密钥标识符更新第二连接的密钥。可以理解的是，AMF节点和终端均更新第二连接的密钥后，AMF节点可恢复使用第二连接，且使用更新后的第二连接的密钥对通过第二连接传输的NAS消息进行完整性保护。
步骤1112、终端通过第二连接向AMF节点发送注册请求消息。相应地，AMF节点通过第二连接接收来自终端的注册请求消息。
其中，注册请求消息通过第二连接的更新后的密钥进行完整性保护。
步骤1113、AMF节点通过第二连接向终端发送NAS SMC消息。相应地，终端通过第二连接接收来自AMF节点的NAS SMC消息。
其中，NAS SMC消息携带用于标识第二连接的更新后的密钥的密钥标识符，可选地，NAS SMC消息还可携带至少一个用于更新第二连接的密钥的参数。
步骤1114、终端通过第二连接向AMF节点发送NAS SMP消息。相应地，AMF节点通过第二连接接收来自终端的NAS SMP消息。
其中，NAS SMP消息通过更新后的第二连接的密钥进行完整性保护。
步骤1115、AMF节点通过第二连接向终端回复注册接受消息。相应地，终端通过第二连接接收来自AMF节点的注册接受消息。
其中，注册接受消息通过更新后的第二连接的密钥进行完整性保护。
可以理解的，终端或核心网设备可以执行上述实施例中的部分或全部步骤，这些步骤或操作仅是示例，本发明实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
在另一种可能的实施场景下，触发更新第二连接的密钥的条件与计时器和第二连接的状态有关，如图12所示，该方法包括：步骤1201至步骤1212。
其中，步骤1201至步骤1208终端与核心网设备通过第一连接进行通信。
步骤1201、终端通过第一连接向核心网设备发送注册请求消息，相应地，AMF节点接收注册请求消息。
可选地，该注册请求消息还可以为步骤901中的NAS消息，具体可参考步骤901中的相关描述，此处不再赘述。
步骤1202、核心网设备触发重鉴权。
步骤1203、核心网设备和终端进行重鉴权流程。
步骤1204、核心网设备向终端发送NAS SMC消息。相应地，终端接收NAS SMC消息。
步骤1205、终端激活第一连接的新密钥，并启动计时器。
其中，终端激活第一连接的新密钥是指第一连接的密钥已经被更新，终端之后通过第一连接向核心网设备发送的NAS消息使用第一连接的更新后的密钥进行安全保护。
步骤1206、终端向核心网设备发送NAS SMP消息。相应地，终端接收来自核心网设备的NAS SMP消息。
步骤1207、核心网设备激活第一连接的新密钥，并启动计时器。
其中，核心网设备激活第一连接的新密钥是指第一连接的密钥已经被更新，核心网设备之后通过第一连接向核心网设备发送的NAS消息使用第一连接的更新后的密钥进行安全保护。
步骤1208、核心网设备向终端发送注册完成消息。相应地，终端接收注册完成消 息。
步骤1209至步骤1212终端与核心网设备通过第二连接进行通信。
步骤1209、在计时器超时前，若第二连接处于空闲态，终端删除第二连接的旧密钥和旧密钥标识符，启用第二连接的新密钥，并停止计时器。
其中，第一连接和第二连接共用一套密钥，则第二连接的新密钥与第一连接的新密钥相同。第一密钥标识符用于表示第一连接的新密钥和第二连接的新密钥。
可选地，在计时器超时前，若第二连接处于连接态，则终端可以继续使用第二连接的旧密钥。
步骤1210、终端向核心网设备发送注册请求消息。相应地，核心网设备接收注册请求消息。
其中，该注册请求消息通过第二连接的新密钥进行完整性保护，且注册请求消息中携带第一密钥标识符。
步骤1211、核心网设备根据第一密钥标识符确定启用第二连接的新密钥，删除第二连接的旧密钥，并停止计时器。
其中，核心网设备接收到注册请求消息后，可根据第一密钥标识符确定第二连接的新密钥与第一连接的新密钥相同，进而使用第二连接的新密钥对注册请求消息进行完整性验证，验证通过后，核心网设备删除第二连接的旧密钥，并停止计时器。
步骤1212、核心网设备向终端发送注册完成消息，相应地，终端接收来自核心网设备的注册完成消息。
其中，注册完成消息通过第二连接的新密钥进行完整性保护。
在另一种可能的实现方式中，如图13所示，触发更新第二连接的密钥的条件与第二连接的状态无关，如图13所示，该方法包括：步骤1301至步骤1314。
其中，步骤1301至步骤1308与步骤1201至步骤1208相同，此处不再赘述。
步骤1309至步骤1314终端与核心网设备通过第二连接进行通信。
步骤1309、在计时器超时前，终端确定使用第二连接的旧密钥。
其中，第二密钥标识符用于标识第二连接的旧密钥。可以理解的是，本申请实施例中的新密钥为更新后的密钥，旧密钥为更新前的密钥。在第一连接与第二连接共用一套密钥的情况下，第二连接的旧密钥与通过第一连接重鉴权之前的密钥相同。
步骤1310、终端向核心网设备发送通过第二连接的旧密钥进行完整性保护的注册请求消息，该注册请求消息携带第二密钥标识符。相应地，核心网设备接收注册请求消息。
步骤1311、核心网设备根据第二密钥标识符确定使用第二连接的旧密钥，通过第二连接的旧密钥对注册请求消息进行完整性验证。
步骤1312、核心网设备向终端发送注册完成消息。
步骤1313、终端在计时器超时后，删除第二连接的旧密钥和第二密钥标识符。
步骤1314、核心网设备在计时器超时后，删除第二连接的旧密钥和第二密钥标识符。
其中，终端和核心网设备删除第二连接的旧密钥和第二密钥标识符之后，可以将第一连接的新密钥作为第二连接的新密钥。
可选地，图13的方法流程中，在终端和核心网设备的计时器超时之前，若核心网设备又触发了重鉴权的流程，则终端和核心网设备的计时器可以继续计时，在计时器超时后，执行步骤1313和步骤1314。或者，终端和核心网设备可以重新开始计时，在计时器超时后，执行步骤1313和步骤1314。
上述主要从核心网设备与终端之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，终端和核心网设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。结合本申请中所公开的实施例描述的各示例的单元及算法步骤，本申请实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以对每个特定的应用来使用不同的方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的技术方案的范围。
本申请实施例可以根据上述方法示例对终端和核心网设备等进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图14示出了本发明实施例中提供的一种装置的示意性框图。该装置可以以软件的形式存在，也可以为核心网设备，还可以为核心网设备中的芯片。该装置1400包括：处理单元1402和通信单元1403。处理单元1402用于对装置1400的动作进行控制管理，例如，处理单元1402用于支持装置1400执行图4中的步骤401和步骤402，图5中的步骤502和步骤503，图6中的步骤601、602、607和608，图7中的步骤701、702、703、704，图8中的步骤801、803、805，图9中的步骤902、903、904、910，图10中的步骤1002、1003、1005、1007、1008，图11中的步骤1102、1103、1104、1107、1112，图12中的步骤1202、1203、1207、1211，以及图13中的步骤1302、1303、1307、1311、1314，和/或用于本文所描述的技术的其它过程。通信单元1403用于支持装置1400和其他网元(例如终端等)之间的通信，例如通信单元1403可以支持装置1400执行图5中的步骤501和504，图6中的步骤603，图7中的步骤705，图8中的步骤802，图9中的步骤905、908、911、914，图10中的步骤1004、1009、1014，图11中的步骤1105、1109、1113、1115，图12中的步骤1204、1208、1212，以及图13中的步骤1304、1308、1312。装置1400还可以包括存储单元1401，用于存储装置1400的程序代码和数据。
其中，处理单元1402可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1403可以是通信接口，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，例如可以包 括：接入网设备与接入网设备之间的接口、接入网设备与核心网设备之间的接口和/或其他接口。存储单元1401可以是存储器。
当处理单元1402为处理器，通信单元1403为通信接口，存储单元1401为存储器时，本申请实施例所涉及的装置1400的结构可以是如图15所示的核心网设备的结构。
图15示出了本申请实施例提供的核心网设备的一种可能的结构示意图。
如图15所示，该核心网设备1500包括：处理器1502、通信接口1503、存储器1501。可选的，核心网设备1500还可以包括总线1504。其中，通信接口1503、处理器1502以及存储器1501可以通过总线1504相互连接；总线1504可以是PCI总线或EISA总线等。所述总线1504可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在采用集成的单元的情况下，图16示出了本申请实施例中提供的又一种装置的示意性框图。该装置1600可以以软件的形式存在，也可以为终端，还可以为终端中的芯片。装置1600包括：处理单元1602和通信单元1603。处理单元1602用于对装置1600的动作进行控制管理，例如，处理单元1602用于支持装置1600执行图4中的步骤401和403，图5中的步骤505，图6中的步骤604、605和609，图7中的步骤706，图8中的步骤801、804、806，图9中的步骤903、906、912，图10中的步骤1008和1010，图11中的步骤1104、1108、1110，图12中的步骤1205和1209，以及图13中的步骤1305、1309和1313，和/或用于本文所描述的技术的其它过程。通信单元1603用于支持装置1600和其他网元(例如核心网设备，N3IWF节点)之间的通信。例如，通信单元1603用于支持装置1600执行图6中的步骤606，图9中的步骤901、907、909、913，图10中的步骤1001、1006、1011，以及图11中的步骤1101、1106、1111、1114，图12中的步骤1201、1206、1210，以及图13中的步骤1301、1306和1310。装置1600还可以包括存储单元1601，用于存储装置1600的程序代码和数据。
其中，处理单元1602可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1603可以是收发器、收发电路或通信接口等。存储单元1601可以是存储器。
当处理单元1602为处理器，通信单元1603为收发器，存储单元1601为存储器时，本申请实施例所涉及的装置1600可以为图17所示的终端。
图17示出了本申请实施例中所涉及的终端的一种可能的设计结构的简化示意图。所述终端1700包括发射器1701，接收器1702和处理器1703。其中，处理器1703也可以为控制器，图17中表示为“控制器/处理器1703”。可选的，所述终端1700还可以包括调制解调处理器1705，其中，调制解调处理器1705可以包括编码器1706、调制器1707、解码器1708和解调器1709。
在一个示例中，发射器1701调节(例如，模拟转换、滤波、放大和上变频等)该输 出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的基站。在下行链路上，天线接收上述实施例中基站发射的下行链路信号。接收器1702调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在调制解调处理器1705中，编码器1706接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器1707进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器1709处理(例如，解调)该输入采样并提供符号估计。解码器1708处理(例如，解交织和解码)该符号估计并提供发送给终端1700的已解码的数据和信令消息。编码器1706、调制器1707、解调器1709和解码器1708可以由合成的调制解调处理器1705来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE及其他演进系统的接入技术)来进行处理。需要说明的是，当终端1700不包括调制解调处理器1705时，调制解调处理器1705的上述功能也可以由处理器1703完成。
处理器1703对终端1700的动作进行控制管理，用于执行上述本申请实施例中由终端1700进行的处理过程。例如，处理器1703还用于执行图4至图13所示方法中涉及终端的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，终端1700还可以包括存储器1704，存储器1704用于存储用于终端1700的程序代码和数据。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于核心网设备或终端中。当然，处理器和存储介质也可以作为分立组件存在于核心网设备或终端中。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络设备上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个功能单元独立存在，也可以两个或两个以上单元集成在一个单元中。上述集成 的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (34)

  1. 一种更新密钥的方法，应用于通信系统，所述通信系统包括终端和核心网设备，所述终端分别通过第一接入技术和第二接入技术同时接入所述核心网设备，其特征在于，包括：
    所述核心网设备通过所述第一接入技术对应的第一连接对所述终端进行重鉴权；
    若满足触发条件，则所述核心网设备更新所述第二接入技术对应的第二连接的密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述触发条件为所述第二连接的状态，所述第二连接的状态为连接态或空闲态。
  3. 根据权利要求2所述的方法，其特征在于，所述触发条件为所述第二连接处于空闲态；所述方法还包括：
    若所述核心网设备确定通过所述第一连接对所述终端进行重鉴权，且所述第二连接处于连接态，则所述核心网设备通过所述第一连接向所述终端发送第一消息，所述第一消息用于指示所述终端暂停使用所述第一连接。
  4. 根据权利要求2或3所述的方法，其特征在于，所述触发条件为所述第二连接处于空闲态；所述核心网设备通过所述第一接入技术对应的第一连接对所述终端进行重鉴权，包括：
    所述核心网设备在通过所述第一连接对所述终端进行重鉴权的过程中，获取第一密钥标识符，所述第一密钥标识符用于标识所述第一连接的更新后的密钥。
  5. 根据权利要求2所述的方法，其特征在于，所述触发条件为所述第二连接处于连接态；所述核心网设备更新所述第二接入技术对应的第二连接的密钥，包括：
    所述核心网设备暂停使用所述第二连接；
    所述核心网设备更新所述第二连接的密钥。
  6. 根据权利要求1所述的方法，其特征在于，所述核心网设备通过所述第一接入技术对应的第一连接对所述终端进行重鉴权，包括：
    在所述核心网设备通过所述第一连接对所述终端进行重鉴权的过程中，所述核心网设备获取第一密钥标识符，保留第二密钥标识符和所述第二连接的更新前的密钥，所述第一密钥标识符用于标识所述第一连接的更新后的密钥，所述第二密钥标识符用于标识所述第二连接的更新前的密钥。
  7. 根据权利要求6所述的方法，其特征在于，在所述核心网设备通过所述第一接入技术对应的第一连接对所述终端进行重鉴权之后，所述方法还包括：
    所述核心网设备启动计时器。
  8. 根据权利要求7所述的方法，其特征在于，所述触发条件为：
    所述核心网设备在所述计时器超时前接收到所述终端通过所述第二连接发送的第二消息，且所述核心网设备通过所述第二连接的更新前的密钥对所述第二消息进行安全验证成功；或者，
    所述计时器超时，且所述核心网设备在所述计时器超时前未接收到所述终端通过所述第二连接发送的第二消息；或者，
    所述计时器超时后，所述核心网设备接收到所述终端通过所述第二连接发送的未 进行安全保护的第二消息；或者，
    所述计时器超时后，所述核心网设备接收到所述终端通过所述第二连接发送的第二消息，且所述核心网设备通过所述第二连接的更新后的密钥对所述第二消息进行安全验证成功。
  9. 根据权利要求6至8中任一项所述的方法，其特征在于，在所述核心网设备更新所述第二接入技术对应的第二连接的密钥之后，所述方法还包括：
    所述核心网设备删除所述第二连接的更新前的密钥和所述第二密钥标识符。
  10. 一种更新密钥的方法，应用于通信系统，所述通信系统包括终端和核心网设备，所述终端分别通过第一接入技术和第二接入技术同时接入所述核心网设备，其特征在于，包括：
    所述终端通过所述第一接入技术对应的第一连接进行重鉴权；
    若满足触发条件，则所述终端更新所述第二接入技术对应的第二连接的密钥。
  11. 根据权利要求10所述的方法，其特征在于，所述触发条件为所述第二连接的状态为空闲态。
  12. 根据权利要求10所述的方法，其特征在于，所述终端通过所述第一接入技术对应的第一连接进行重鉴权，包括：
    在所述终端通过所述第一连接进行重鉴权的过程中，保留密钥标识符和所述第二连接的更新前的密钥，所述密钥标识符用于标识所述第二连接的更新前的密钥。
  13. 根据权利要求12所述的方法，其特征在于，所述触发条件为计时器超时；在所述终端通过所述第一接入技术对应的第一连接进行重鉴权之后，所述方法还包括：
    所述终端启动所述计时器。
  14. 根据权利要求13所述的方法，其特征在于，在所述终端启动所述计时器之后，所述方法还包括：
    所述终端在所述计时器超时前，通过所述第二连接向所述核心网设备发送消息，所述消息通过所述第二连接的更新前的密钥进行安全保护；或者，
    所述终端在所述计时器超时后，通过所述第二连接向所述核心网设备发送未进行安全保护的消息；或者；
    所述终端在所述计时器超时后，通过所述第二连接向所述核心网设备发送消息，所述消息通过所述第二连接的更新后的密钥进行安全保护。
  15. 根据权利要求12至14中任一项所述的方法，其特征在于，在所述终端更新所述第二接入技术对应的第二连接的密钥之后，所述方法还包括：
    所述终端删除所述第二连接的更新前的密钥和所述密钥标识符。
  16. 一种装置，应用于通信系统，所述通信系统包括终端和所述装置，所述终端分别通过第一接入技术和第二接入技术同时接入所述装置，其特征在于，所述装置包括：
    处理单元，用于通过所述第一接入技术对应的第一连接对所述终端进行重鉴权；还用于若满足触发条件，则更新所述第二接入技术对应的第二连接的密钥。
  17. 根据权利要求16所述的装置，其特征在于，所述触发条件为所述第二连接的状态，所述第二连接的状态为连接态或空闲态。
  18. 根据权利要求17所述的装置，其特征在于，所述触发条件为所述第二连接处于空闲态；所述装置还包括：通信单元；
    所述通信单元，用于若所述处理单元确定通过所述第一连接对所述终端进行重鉴权，且所述第二连接处于连接态，则通过所述第一连接向所述终端发送第一消息，所述第一消息用于指示所述终端暂停使用所述第一连接。
  19. 根据权利要求17或18所述的装置，其特征在于，所述触发条件为所述第二连接处于空闲态；
    所述处理单元，还用于在通过所述第一连接对所述终端进行重鉴权的过程中，获取第一密钥标识符，所述第一密钥标识符用于标识所述第一连接的更新后的密钥。
  20. 根据权利要求19所述的装置，其特征在于，所述触发条件为所述第二连接处于连接态；
    所述处理单元，还用于暂停使用所述第二连接；更新所述第二连接的密钥。
  21. 根据权利要求16所述的装置，其特征在于，
    所述处理单元，还用于在通过所述第一连接对所述终端进行重鉴权的过程中，获取第一密钥标识符，保留第二密钥标识符和所述第二连接的更新前的密钥，所述第一密钥标识符用于标识所述第一连接的更新后的密钥，所述第二密钥标识符用于标识所述第二连接的更新前的密钥。
  22. 根据权利要求21所述的装置，其特征在于，
    所述处理单元，还用于启动计时器。
  23. 根据权利要求22所述的装置，其特征在于，所述装置还包括：通信单元；所述触发条件为：
    所述通信单元在所述计时器超时前接收到所述终端通过所述第二连接发送的第二消息，且所述处理单元通过所述第二连接的更新前的密钥对所述通信单元接收到的第二消息进行安全验证成功；或者，
    所述计时器超时，且所述通信单元在所述计时器超时前未接收到所述终端通过所述第二连接发送的第二消息；或者，
    所述计时器超时后，所述通信单元接收到所述终端通过所述第二连接发送的未进行安全保护的第二消息；或者，
    所述计时器超时后，所述通信单元接收到所述终端通过所述第二连接发送的第二消息，且所述处理单元通过所述第二连接的更新后的密钥对所述通信单元接收到的第二消息进行安全验证成功。
  24. 根据权利要求21至23中任一项所述的装置，其特征在于，
    所述处理单元，还用于删除所述第二连接的更新前的密钥和所述第二密钥标识符。
  25. 一种装置，应用于通信系统，所述通信系统包括所述装置和核心网设备，所述装置分别通过第一接入技术和第二接入技术同时接入所述核心网设备，其特征在于，包括：
    处理单元，用于通过所述第一接入技术对应的第一连接进行重鉴权；还用于若满足触发条件，则更新所述第二接入技术对应的第二连接的密钥。
  26. 根据权利要求25所述的装置，其特征在于，所述触发条件为所述第二连接的 状态为空闲态。
  27. 根据权利要求25所述的装置，其特征在于，
    所述处理单元，还用于在通过所述第一连接进行重鉴权的过程中，保留密钥标识符和所述第二连接的更新前的密钥，所述密钥标识符用于标识所述第二连接的更新前的密钥。
  28. 根据权利要求27所述的装置，其特征在于，所述触发条件为计时器超时；
    所述处理单元，还用于启动所述计时器。
  29. 根据权利要求28所述的装置，其特征在于，所述装置还包括：通信单元；
    所述通信单元，用于在所述计时器超时前，通过所述第二连接向所述核心网设备发送消息，所述消息通过所述第二连接的更新前的密钥进行安全保护；
    所述通信单元，还用于在所述计时器超时后，通过所述第二连接向所述核心网设备发送未进行安全保护的消息；
    所述通信单元，还用于在所述计时器超时后，通过所述第二连接向所述核心网设备发送消息，所述消息通过所述第二连接的更新后的密钥进行安全保护。
  30. 根据权利要求25至29中任一项所述的装置，其特征在于，
    所述处理单元，还用于删除所述第二连接的更新前的密钥和所述密钥标识符。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机执行所述权利要求1-9中任意一项所述的方法。
  32. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机执行所述权利要求10-15中任意一项所述的方法。
  33. 一种装置，其特征在于，包括：包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述装置执行上述权利要求1-9中任一项所述的方法。
  34. 一种装置，其特征在于，包括：包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述装置执行上述权利要求10-15中任一项所述的方法。
PCT/CN2019/070709 2018-01-08 2019-01-07 一种更新密钥的方法及装置 WO2019134704A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
AU2019205078A AU2019205078B2 (en) 2018-01-08 2019-01-07 Key update method and apparatus
JP2020537753A JP7095095B2 (ja) 2018-01-08 2019-01-07 鍵更新方法および装置
EP19735959.9A EP3737032B1 (en) 2018-01-08 2019-01-07 Key updating method and apparatus
BR112020013611-5A BR112020013611A2 (pt) 2018-01-08 2019-01-07 método de atualização de chave, aparelho e mídia de armazenamento legível por computador
MX2020007292A MX2020007292A (es) 2018-01-08 2019-01-07 Metodo y aparato de actualizacion de claves.
EP22169110.8A EP4131845A1 (en) 2018-01-08 2019-01-07 Key updating method and apparatus
RU2020126333A RU2783597C2 (ru) 2018-01-08 2019-01-07 Способ обновления ключа и устройство
US16/922,485 US11595206B2 (en) 2018-01-08 2020-07-07 Key update method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810016762.9A CN110022206B (zh) 2018-01-08 2018-01-08 一种更新密钥的方法及装置
CN201810016762.9 2018-01-08

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/922,485 Continuation US11595206B2 (en) 2018-01-08 2020-07-07 Key update method and apparatus

Publications (1)

Publication Number Publication Date
WO2019134704A1 true WO2019134704A1 (zh) 2019-07-11

Family

ID=67144350

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/070709 WO2019134704A1 (zh) 2018-01-08 2019-01-07 一种更新密钥的方法及装置

Country Status (8)

Country Link
US (1) US11595206B2 (zh)
EP (2) EP3737032B1 (zh)
JP (1) JP7095095B2 (zh)
CN (2) CN110022206B (zh)
AU (1) AU2019205078B2 (zh)
BR (1) BR112020013611A2 (zh)
MX (1) MX2020007292A (zh)
WO (1) WO2019134704A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110896387B (zh) * 2018-09-12 2021-01-01 宁德时代新能源科技股份有限公司 数据传输方法、电池管理系统和存储介质
US11477701B2 (en) * 2019-07-22 2022-10-18 Mediatek Inc. Apparatuses and methods for voice call service provision
CN114270900B (zh) * 2019-08-19 2023-03-10 中兴通讯股份有限公司 通过接入和移动性管理功能重新分配进行注册的方法及计算机可读介质
CN115915132A (zh) * 2020-04-30 2023-04-04 华为技术有限公司 密钥管理方法、设备及系统
US20230292112A1 (en) * 2020-07-21 2023-09-14 Samsung Electronics Co., Ltd. A method for managing an authentication and key management for applications service for a user equipment
KR102279293B1 (ko) * 2020-08-07 2021-07-20 한국인터넷진흥원 비암호화 채널 탐지 방법 및 장치
CN112512043A (zh) * 2020-10-22 2021-03-16 中兴通讯股份有限公司 一种会话请求方法、装置、终端及存储介质

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102158862A (zh) * 2010-02-12 2011-08-17 中兴通讯股份有限公司 一种触发空闲状态的终端进行重鉴权的方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101079705B (zh) * 2006-05-24 2010-09-29 华为技术有限公司 移动ip密钥在重新鉴权认证后的产生及分发方法与系统
JP5175615B2 (ja) * 2007-06-04 2013-04-03 パナソニック株式会社 利用装置、サーバ装置、サービス利用システム、サービス利用方法、サービス利用プログラム及び集積回路
US8965338B2 (en) * 2008-06-09 2015-02-24 Apple Inc Network access control methods and apparatus
CN101577912B (zh) * 2009-06-10 2011-05-11 中兴通讯股份有限公司 保持asn的各网元中用户状态一致的方法及装置
JP5458796B2 (ja) 2009-10-19 2014-04-02 株式会社リコー 通信装置及び通信制御方法
CN102932531B (zh) 2012-09-27 2015-05-27 华为技术有限公司 保持客户识别模块卡待机的方法和终端设备
CN104137468A (zh) * 2012-11-07 2014-11-05 华为技术有限公司 一种ca公钥的更新方法、装置、ue及ca
WO2015062097A1 (zh) * 2013-11-01 2015-05-07 华为技术有限公司 一种双连接模式下的密钥处理方法和设备
CN105592455B (zh) * 2014-11-13 2020-09-29 南京中兴软件有限责任公司 一种密钥更新方法、装置和主传输节点tp
WO2017159970A1 (ko) * 2016-03-17 2017-09-21 엘지전자(주) 무선통신 시스템에서 단말의 보안설정을 수행하기 위한 방법 및 이를 위한 장치

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102158862A (zh) * 2010-02-12 2011-08-17 中兴通讯股份有限公司 一种触发空闲状态的终端进行重鉴权的方法

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
HUAWEI ET AL.: "Add Context for Multiple Registrations in the Same PLMN", 3GPP TSG SA WG3 (SECURITY) MEETING #90 S3-180202, 26 January 2018 (2018-01-26), XP051390656 *
HUAWEI ET AL.: "Add New Requirements for Multiple Registrations in the Same PLMN", 3GPP TSG SA WG3 (SECURITY) MEETING #89 S3-173193, 1 December 2017 (2017-12-01), XP051380450 *
NOKIA: "Clause 6.3.4.2 Multiple Registrations in the Same PLMN", 3GPP TSG SA WG3 (SECURITY) MEETING #89 S3-173109, 1 December 2017 (2017-12-01), XP051380370 *
See also references of EP3737032A4

Also Published As

Publication number Publication date
CN113660660A (zh) 2021-11-16
BR112020013611A2 (pt) 2020-12-01
AU2019205078B2 (en) 2022-01-13
EP3737032A4 (en) 2021-03-03
JP7095095B2 (ja) 2022-07-04
RU2020126333A3 (zh) 2022-04-28
MX2020007292A (es) 2020-09-10
US11595206B2 (en) 2023-02-28
RU2020126333A (ru) 2022-02-10
EP3737032A1 (en) 2020-11-11
CN110022206B (zh) 2021-04-09
JP2021510262A (ja) 2021-04-15
EP3737032B1 (en) 2022-04-27
EP4131845A1 (en) 2023-02-08
CN110022206A (zh) 2019-07-16
US20200336305A1 (en) 2020-10-22
AU2019205078A1 (en) 2020-08-27

Similar Documents

Publication Publication Date Title
WO2019134704A1 (zh) 一种更新密钥的方法及装置
KR102264718B1 (ko) 보안 구현 방법, 및 관련된 장치 및 시스템
CN110999356B (zh) 网络安全管理的方法及装置
US11564100B2 (en) Security protection method and apparatus
WO2019062996A1 (zh) 一种安全保护的方法、装置和系统
JP2022536924A (ja) クローズドアクセスグループ関連の手順をハンドリングするための方法及びシステム
US10798082B2 (en) Network authentication triggering method and related device
US20210045050A1 (en) Communications method and apparatus
CN113676901A (zh) 密钥管理方法、设备及系统
WO2022063181A1 (zh) 一种非接入层上下文的处理方法及装置
WO2018170703A1 (zh) 一种连接建立方法及装置
WO2022228455A1 (zh) 一种通信方法以及相关装置
CN110830996B (zh) 一种密钥更新方法、网络设备及终端
CN115396126A (zh) Nswo业务的认证方法、设备和存储介质
RU2783597C2 (ru) Способ обновления ключа и устройство
WO2022217571A1 (zh) 网络切片的鉴权方法及装置、设备和存储介质
KR20240064005A (ko) 주 인증 방법 및 장치
CN117793710A (zh) 鉴权方法、通信装置及通信系统
CN116634426A (zh) 一种通信的方法及装置
CN114223232A (zh) 通信方法和相关设备
CN115884187A (zh) 消息传输方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19735959

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020537753

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019735959

Country of ref document: EP

Effective date: 20200807

ENP Entry into the national phase

Ref document number: 2019205078

Country of ref document: AU

Date of ref document: 20190107

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112020013611

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112020013611

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20200702