WO2019157935A1

WO2019157935A1 - Authentication method and device, message processing method and device, and storage medium

Info

Publication number: WO2019157935A1
Application number: PCT/CN2019/073379
Authority: WO
Inventors: 谢振华
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-02-13
Filing date: 2019-01-28
Publication date: 2019-08-22
Also published as: CN110167081A; CN110167081B

Abstract

Disclosed are an authentication method and device, a message processing method and device, and a storage medium. The authentication method comprises: after a non-access stratum (NAS) connection has been established between a first network function and a terminal, transmitting an authentication request or a re-authentication request to the terminal; and the first network function receiving, from a second network function, a context transfer request associated with the terminal, and transmitting a first cipher key to the second network function, the first cipher key being derived from a cipher key in an authentication vector of the terminal.

Description

Authentication method and device, message processing method and device, and storage medium

The present disclosure claims priority to Chinese Patent Application No. 201101150834.9, filed on Jan. 13, 2018, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present disclosure relates to the field of communications technologies, and, for example, to an authentication method and apparatus, a message processing method and apparatus, and a storage medium.

Background technique

The 3rd Generation Partnership Project (3GPP) proposes a registration scheme for a multi-NAS (Non Access Stratum) connection. The terminal establishes a first access network and a first access management function. After the NAS is connected, the second access management function is registered, and after the second access management function acquires the context of the terminal from the first access management function, the first access network access management function is notified to change, and the registration with the terminal is completed. During the above registration process, the first access management function or the second access management function may not correctly serve the terminal. In addition, there may be a problem that the NAS message from the terminal cannot be processed.

Summary of the invention

At least one embodiment of the present disclosure provides an authentication method and apparatus, such that when a terminal (User Equipment, UE) performs a multi-NAS connection, the network side can provide services for the terminal.

At least one embodiment of the present disclosure provides an authentication method, including:

After the first network function establishes a connection with the non-access stratum NAS, the terminal sends an authentication request or a re-authentication request to the terminal;

The first network function receives a context transfer request for the terminal from a second network function, and sends a first key to the second network function, the first key being based on an authentication vector of the terminal Key derivation.

An embodiment of the present disclosure provides an authentication method, including:

The second network function receives a registration request from the terminal;

The second network function requests context information of the terminal from the first network function, and receives a first key sent by the first network function, where the first key is based on a key in an authentication vector of the terminal Derived.

An embodiment of the present disclosure provides an authentication apparatus, including a memory and a processor, where the memory stores a program, and when the program is read and executed by the processor, the authentication method described in any of the embodiments is implemented.

An embodiment of the present disclosure provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the foregoing An authentication method as described in an embodiment.

At least one embodiment of the present disclosure provides a message processing method and apparatus, so that a UE can correctly process a NAS message from a terminal when performing a multi-NAS connection.

At least one embodiment of the present disclosure provides a message processing method, including:

After the third network function establishes a NAS connection with the terminal, receiving a context transfer request for the terminal sent by the fourth network function;

The third network function receives a first NAS message from the terminal, and sends the first NAS message to the fourth network function; or the third network function receives the fourth network function and sends the a second NAS message, wherein the second NAS message is sent by the terminal to the fourth network function; or the third network function sends a third NAS message to the terminal, waiting for a third preset time After that, the context information of the terminal is sent to the fourth network function.

An embodiment of the present disclosure provides a message processing method, including:

The fourth network function receives the registration request from the terminal by using the first access network element;

The fourth network function requests context information of the terminal from a third network function;

Receiving, by the fourth network function, the first NAS message sent by the third network function, where the first NAS message is sent by the terminal to the third network function; or, the fourth network function is passed The second access network element receives the second NAS message from the terminal, and sends the second NAS message to the third network function.

An embodiment of the present disclosure provides a message processing apparatus including a memory and a processor, where the memory stores a program, and when the program is read and executed by the processor, the message processing described in any of the above embodiments is implemented. method.

An embodiment of the present disclosure provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the foregoing A message processing method according to an embodiment.

DRAWINGS

FIG. 1 is a registration method in a related art in a multi-NAS connection;

2 is a flowchart of an authentication method provided by an embodiment;

FIG. 3 is a flowchart of another authentication method provided by an embodiment;

FIG. 4 is a flowchart of an authentication provided by an embodiment;

FIG. 5 is another authentication flowchart provided by an embodiment;

6 is another authentication flowchart provided by an embodiment;

FIG. 7 is another authentication flowchart provided by an embodiment;

FIG. 8 is another flow chart of authentication provided by an embodiment;

FIG. 9 is a schematic diagram of another message processing method according to an embodiment; FIG.

FIG. 10 is a schematic diagram of a message processing method according to an embodiment; FIG.

FIG. 11 is a flowchart of another message processing method according to an embodiment; FIG.

FIG. 12 is a schematic diagram of another message processing method provided by an embodiment.

Detailed ways

Embodiments of the present disclosure will be described hereinafter with reference to the accompanying drawings.

The steps illustrated in the flowchart of the figures may be executed in a computer system such as a set of computer executable instructions.

As shown in FIG. 1, the registration scheme in the related art includes the following steps.

Step 1010: The UE registers with the mobile network through the first radio access network (Radom Access Network 1, RAN1), thereby establishing a NAS connection with the first access management function (Access Management Function 1, AMF1).

Step 1020: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE. .

Step 1030: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 1040: The AMF2 determines that it does not have the context of the UE, and then obtains the related information of the AMF1 from the registration request message, and sends a transfer context request to the AMF1, such as a Transfer UE Context Request. Message.

Step 1050: The AMF1 returns the context information of the UE to the AMF2, so that the AMF2 can provide services for the UE regardless of which radio access network the UE sends a message.

In this embodiment, the AMF1 may carry the context information of the UE by using a Transfer UE Context Response message.

Step 1060: The AMF2 informs the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 will receive the UE from the UE. The message is forwarded to the AMF2 instead of AMF1.

Step 1070: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 1080: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sends a Register Accept message.

Step 1090: The RAN2 forwards the registration accept message to the UE.

In the registration process shown in FIG. 1, when the AMF1 initiates an authentication process to the terminal through the RAN1, when the UE does not receive the return message of the UE, the UE initiates registration with the mobile network through the RAN2, and after the UE modifies the security context through the authentication process, the authentication is performed. The return message may be received by RAN1 before RAN1 receives the AMF change request, so RAN1 will still forward the message to AMF1. Since AMF1 has transferred the context of the UE to AMF2, AMF1 has no context of the UE, so The message cannot be processed, and the AMF2 and the UE may also perform a security process through the RAN2, such as a NAS Security Mode Control (SMC) process, to activate a new security context, at which time the security context content of the UE has changed. The security context content in the context information of the UE obtained by the AMF2 is unchanged, that is, the security content of the UE and the AMF2 are different, and the security process performed by the AMF2 and the UE fails, and the network cannot continue to provide services for the UE. Therefore, in the present disclosure, the new key generated by the authentication is transmitted to the AMF 2 such that the security context content of the AMF 2 and the UE are consistent.

In the registration process of FIG. 1, when the terminal UE sends a NAS message through RAN1 and then initiates registration with the mobile network through RAN2, the first NAS message may be received by RAN1 before RAN1 receives the AMF change request, so RAN1 will The NAS message is still forwarded to the AMF1. Since the AMF1 has transferred the context of the terminal UE to the AMF2, the AMF1 does not have the context of the terminal UE, and the NAS message cannot be processed.

FIG. 2 is an authentication method provided by an embodiment. As shown in FIG. 2, the method includes the following steps.

Step 2010: After the first network function establishes a NAS connection with the terminal, the first network function sends an authentication request or a re-authentication request to the terminal.

Step 2020, the first network function receives a context transfer request for the terminal from a second network function, and sends a first key to the second network function, where the first key is based on the terminal Key derivation in the authentication vector.

In this embodiment, the context transfer request is used to request context information of the terminal.

In the solution provided by the embodiment, the first network function sends the first key derived based on the key in the authentication vector of the terminal to the second network function, so that the key of the second network function and the first network function can be consistent. .

In this embodiment, the first network function and the second network function may be an access management function, or may be other core network devices that implement access management.

In this embodiment, in step 2020, the first network function may carry the first key by using a context transfer response.

In an embodiment, the method further includes: the first network function sending a NAS security mode command to the terminal, receiving a NAS security mode completion message returned by the terminal, and sending the NAS security mode completion message to The second network function. In this embodiment, the NAS SMC process is initiated by the first network function to activate a new security context, and after the first network function receives the NAS security mode complete message, since the context of the UE has been transferred to the second network function, The NAS security mode completion message is forwarded to the second network function processing.

In an embodiment, the method further includes that the first network function receives an authentication response or a re-authentication response returned by the terminal, and sends the authentication response or the re-authentication response to the second network function. In this embodiment, when the first network function returns the first key to the second network function, the authentication response or the re-authentication response from the terminal has not been received, and only the second network function is currently in the authentication process, and is received. After the authentication response or the re-authentication response is forwarded to the second network function, the second network function processes the authentication response or the re-authentication response.

In an embodiment, before the sending the authentication response or the re-authentication response to the second network function, the method further includes: the first network function sending an expected response in the authentication vector of the terminal to the second a network function, or the first network function sends a desired response and a random string in the authentication vector of the terminal to the second network function. The second network function determines whether the authentication is valid according to the expected response or based on the expected response and the random string.

In an embodiment, the sending the first key to the second network function comprises: after the first network function receives the authentication response or the NAS security mode completion message returned by the terminal, to the second The network function sends the first key. That is, the first network function needs to wait for receiving the authentication response or the re-authentication response or the NAS security mode completion message before transmitting the first key to the second network function.

In an embodiment, after the first network function receives the context transfer request for the terminal from the second network function, the method further includes: the first network function sending status information to the second network function, The status information indicates the progress status of the authentication process or the NAS security mode process. The second network function can perform subsequent operations according to the status information.

In an embodiment, after the first network function receives the context transfer request for the terminal from the second network function, the method further includes: the first network function waiting to receive the authentication request or the heavy After the response of the authentication request, the context information of the terminal is sent to the second network function; or the first network function waits for the first preset time, and sends the context information of the terminal to the first The second network function; or the first network function caches the context information of the terminal for a second preset time.

FIG. 3 is another authentication method provided by an embodiment. As shown in FIG. 3, the method includes the following steps.

In step 3010, the second network function receives a registration request from the terminal.

Step 3020, the second network function requests context information of the terminal from the first network function, and receives a first key sent by the first network function, where the first key is based on the first network function. Key derivation in the authentication vector of the terminal.

In an embodiment, the method further includes: the second network function receiving status information sent by the first network function, where the status information indicates that the second network function waits for a preset time when the authentication is completed. Perform the NAS security mode control process.

In an embodiment, the method further includes: receiving, by the second network function, status information sent by the first network function, and waiting to receive an authentication response or re-authentication returned by the first network function according to the status information. Response or NAS security mode completion message.

FIG. 4 is a schematic diagram of an authentication process provided by an embodiment. As shown in FIG. 4, the process includes the following steps.

Step 4010: The UE registers with the mobile network through RAN1, thereby establishing a NAS connection with AMF1.

Step 4020: The AMF1 holds the authentication vector of the UE, and then initiates an authentication or re-authentication request to the UE through the RAN1, for example, sends an authentication request (User Authentication Request), and carries the network authentication parameter (AUTN) and the random string (RAND) in the authentication vector. ).

Step 4030: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a registration request (Register Request) message, where the message carries information about the AMF1 previously registered by the UE. .

Step 4040: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 4050: After receiving the authentication request or the re-authentication request, the UE determines that the AUTN is valid, and then calculates the challenge response RES according to the information such as RAND and AUTN in the authentication request or the re-authentication request message, and generates an access management key Kamf2, and then passes The RAN1 sends an authentication response or a re-authentication response to the AMF1, such as sending a User Authentication Response, carrying the RES, and the AMF1 determines that the RES is valid according to the expected response HXRES in the authentication vector, or the RAND in the authentication vector and the expected response HXRES. The access management key Kamf2 is then derived by the key Kseaf in the authentication vector of the UE, which is the same as the Kamf2 generated by the UE.

Step 4060: When the AMF1 has not performed the NAS SMC procedure, it receives a context transfer request for the UE from the AMF2, such as a Transfer UE Context Request message.

In another case of this embodiment, step 4060 occurs before step 4050, and AMF1 may wait for a period of time to receive the authentication response or re-authentication response of step 4050, or may wait for the authentication response or re-authentication response of step 4050 to be received. After step 4070 is performed, the context may be cached for a period of time while the step 4070 is executed, and the cache time may be preset.

Step 4070: The AMF1 sends a context transfer response to the AMF2, such as a Transfer UE Context Response message, carrying the context information of the UE. The context information of the UE includes the activation security context information of the UE, and carries the status information and the derived new key Kamf2. The status information indicates that the authentication process of the UE is completed.

In another embodiment, AMF1 may derive a new key Kamf1 based on the key Kamf in the activation security context, which may also include Kamf1, where Kamf1 and Kamf2 are derived based on different keys, respectively.

Step 4080: In an embodiment, the AMF2 waits for a preset time, so that the message that may be sent to the UE before the AMF1 can reach the UE, and the messages are all protected based on the activation security context, and the AMF2 will perform the NAS SMC process after the end of the waiting. Generate a new activation security context.

In this embodiment, the preset time may be set as needed.

Step 4090: The AMF2 performs a NAS SMC procedure, and sends a NAS Security Mode Command message to the UE through the RAN2, and the NAS security mode command message is secured based on the derived key of Kamf2.

Step 4100: The UE has performed the authentication process, and therefore uses the derived key of Kamf2 to verify the security of the NAS security mode command message. After the verification is passed, the NAS Security Mode Complete message is sent to the AMF2 through the RAN2, the NAS. The secure mode completion message is secured and encrypted using Kamf2's derived key.

Step 4110: The AMF2 informs the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 forwards the received message from the UE to the AMF2. No longer AMF1.

Step 4120: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 4130: The AMF2 sends a registration accept message to the UE by using the RAN2, for example, sending a Register Accept message.

Step 4140: The RAN2 forwards the registration accept message to the UE.

In this embodiment, the AMF1 receives the context transfer request of the AMF2 after receiving the authentication response, and after transmitting the Kamf2 to the AMF2, the AMF2 performs the NAS SMC process to activate the new security context.

FIG. 5 is a schematic diagram of another authentication process provided by an embodiment. As shown in FIG. 5, the process includes the following steps.

Step 5010: The UE registers with the mobile network through RAN1 to establish a NAS connection with AMF1.

Step 5020: The AMF1 holds the authentication vector of the UE, and then initiates an authentication or re-authentication request to the UE through the RAN1, for example, sends a User Authentication Request, and carries the network authentication parameter AUTN and the random string RAND in the authentication vector.

Step 5030: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE. .

Step 5040: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 5050: The UE receives the authentication request or the re-authentication request, determines that the AUTN is valid, and then calculates the challenge response RES according to the information such as RAND and AUTN in the authentication or re-authentication request message, and generates an access management key Kamf2, and then sends the access management key Kamf2 to The AMF1 sends an authentication or re-authentication response, such as sending a User Authentication Response, carrying the RES. The AMF1 determines that the RES is valid according to the expected response HXRES in the authentication vector, or the RAND in the authentication vector and the expected response HXRES, and then passes the key in the authentication vector. Kseaf derives the access management key Kamf2, which is the same as the Kamf2 generated by the UE.

Step 5060: AMF1 performs a NAS SMC process, and sends a NAS Security Mode Command to the terminal through RAN1, and the message is guaranteed based on the derived key of Kamf2.

Step 5070: AMF1 receives a context transfer request for the UE from AMF2, such as a Transfer UE Context Request message.

Step 5080: The AMF1 marks a new location of the UE context, for example, setting related information of the AMF2 in the context information of the cached UE, or recording related information of the AMF2 corresponding to the UE.

In this embodiment, the AMF1 caches the context of the UE for a second preset time.

Step 5090: The AMF1 sends a context transfer response to the AMF2, such as a Transfer UE Context Response message, carrying the UE context information, where the UE context information includes the activated security context information of the UE, and carries the status information and the derived new key Kamf2, and the status information indicates While the NAS SMC process is in progress, AMF1 may derive a new key Kamf1 based on the key Kamf in the activation security context. The activation security context may also include Kamf1, where Kamf1 and Kamf2 are derived based on different keys, respectively.

In another embodiment, after waiting for the first preset time, the AMF1 sends the context of the UE to the AMF2.

Step 5100: AMF2 determines to wait according to the status information to receive the NAS security mode complete message.

Step 5110: The UE receives the NAS security mode command message. Because the UE has performed the authentication process, the UE uses the derived key of Kamf2 to verify the security of the NAS security mode command message. After the verification is passed, the NAS security mode is sent to the AMF1 through the RAN1. NAS Security Mode Complete) message, which is secured and encrypted using Kamf2's derived key.

Step 5120: AMF1 determines that the context of the UE has been transferred to AMF2, and then sends the NAS security mode complete message to AMF2 for processing.

Step 5130: The AMF2 informs the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 will receive the UE from the UE. The message is sent to the AMF2 instead of AMF1.

Step 5140: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 5150: The AMF2 sends a registration accept message to the UE by using the RAN2, for example, sending a Register Accept message.

Step 5160: The RAN2 sends the registration accept message to the UE.

In this embodiment, the AMF1 receives the context transfer request after transmitting the security mode command to the UE. Therefore, after receiving the security mode complete message, the security mode complete message is sent to the AMF2 process.

FIG. 6 is a schematic diagram of another authentication process provided by an embodiment. As shown in FIG. 6, the process includes the following steps.

Step 6010: The UE registers with the mobile network through the RAN1 to establish a NAS connection with the AMF1.

Step 6020: The AMF1 holds the authentication vector of the UE, and then initiates an authentication or re-authentication request to the UE through the RAN1, for example, sends a User Authentication Request, and carries the network authentication parameter AUTN and the random string RAND in the authentication vector.

Step 6030: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE. .

Step 6040: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 6050: AMF1 receives a context transfer request for the UE from AMF2, such as a Transfer UE Context Request message.

Step 6060: The AMF1 marks a new location of the UE context, for example, setting related information of the AMF2 in the context information of the cached UE, or recording related information of the AMF2 corresponding to the UE, and the AMF1 is derived by using the key Kseaf in the authentication vector. The key Kamf2 is managed, and the access management key Kamf2 is the same as the Kamf2 generated by the UE.

Step 6070: The AMF1 sends a context transfer response to the AMF2, such as a Transfer UE Context Response message, carrying the UE context information, where the UE context information includes the activation security context information of the UE, and carries the status information, the derived new key Kamf2, and the authentication vector. The expected response HXRES may also carry RAND in the authentication vector, wherein the status information indicates that the authentication process is in progress.

In another embodiment, AMF1 may derive a new key Kamf1 based on the key Kamf in the activation security context. The activation security context may also include Kamf1, where Kamf1 and Kamf2 are derived based on different keys, respectively.

Step 6080: The AMF2 determines to wait for the preset time according to the status information, so as to receive the forwarded authentication response message.

Step 6090: The UE receives the authentication request or the re-authentication request, determines that the AUTN is valid, and then calculates the challenge response RES according to the information such as RAND and AUTN in the authentication request or the re-authentication request message, and generates an access management key Kamf2, and then passes the RAN1. Send an authentication response or a re-authentication response, such as sending a User Authentication Response, carrying the RES.

Step 6100: AMF1 determines that the context of the UE has been transferred to AMF2, and then forwards the authentication response or re-authentication response message to AMF2, and AMF2 determines that RES is valid by expecting response HXRES, or RAND and expected response HXRES.

In another embodiment, when AMF2 judges that RES is invalid, Kamf2 is not used, and Kamf1 is used as the key.

Step 6110: The AMF2 performs a NAS SMC process, and sends a NAS Security Mode Command to the terminal through the RAN2, and the message is guaranteed based on the derived key of Kamf2.

Step 6120: The UE receives the NAS security mode command message, because the UE has performed the authentication process, and therefore uses the derived key of Kamf2 to verify the security of the NAS security mode command message, and after the verification is passed, the NAS security mode is sent to the AMF2 through the RAN2 ( NAS Security Mode Complete) message, which is secured and encrypted using Kamf2's derived key.

Step 6130: The AMF2 informs the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 will receive the UE from the UE. The message is forwarded to the AMF2 instead of AMF1.

Step 6140: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 6150: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sending a Register Accept message.

Step 6160: The RAN2 forwards the registration accept message to the UE.

In this embodiment, the AMF1 receives the context transfer request before receiving the authentication response. Therefore, after receiving the authentication response, the authentication response is forwarded to the AMF2, and processed by the AMF2.

FIG. 7 is a schematic diagram of another authentication process provided by an embodiment. As shown in FIG. 7, the process includes the following steps.

Step 7010: The UE registers with the mobile network through the RAN1 to establish a NAS connection with the AMF1.

Step 7020: The AMF1 holds the authentication vector of the UE, and then initiates an authentication or re-authentication request to the UE through the RAN1, for example, sends a User Authentication Request, and carries the network authentication parameter AUTN and the random string RAND in the authentication vector.

Step 7030: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE. .

Step 7040: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 7050: AMF1 receives a context transfer request for the UE from AMF2, such as a Transfer UE Context Request message.

Step 7060: AMF1 has not received the authentication response message, so waits for a preset time to receive the authentication response message, or waits to receive the authentication response message.

Step 7070: The UE receives the authentication request or the re-authentication request, determines that the AUTN is valid, and then calculates the challenge response RES according to the information such as RAND and AUTN in the authentication request or the re-authentication request message, and generates an access management key Kamf2, and then passes the RAN1. Send an authentication response or a re-authentication response to the AMF1, such as sending a User Authentication Response, carrying the RES, and the AMF1 determines that the RES is valid by the expected response HXRES in the authentication vector, or the RAND in the authentication vector and the expected response HXRES, and then passes the authentication vector. The key Kseaf derives the access management key Kamf2, which is the same as the Kamf2 generated by the UE.

Step 7080: AMF1 sends a context transfer response to AMF2, such as a Transfer UE Context Response message, carrying UE context information, the UE context information includes the activation security context information of the UE, and carries a derived new key Kamf2, which may be based on activation security. The key Kamf in the context derives a new key Kamf1, which may also contain Kamf1 in the activation security context, at which time Kamf1 and Kamf2 are derived based on different keys, respectively.

In another embodiment, the context transfer response may also carry status information indicating that the authentication process is complete.

Step 7090: The AMF2 performs a NAS SMC procedure, and sends a NAS Security Mode Command to the UE through the RAN2, and the NAS security mode command message is secured based on the derived key of Kamf2.

Step 7100: The UE has performed the authentication process, and therefore uses the derived key of Kamf2 to verify the security of the NAS security mode command message. After the verification is passed, the NAS Security Mode Complete message is sent to the AMF2 through the RAN2, and the message uses Kamf2. The derived key is secured and encrypted.

Step 7110: The AMF2 informs the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 will receive the UE from the UE. The message is forwarded to the AMF2 instead of AMF1.

Step 7120: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 7130: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sending a Register Accept message.

Step 7140: The RAN2 forwards the registration accept message to the UE.

In this embodiment, when receiving the context transfer request of the AFM2, the AMF1 does not receive the authentication response or the re-authentication response returned by the UE. Therefore, the AMF1 waits to receive the authentication response returned by the UE, and then sends the context transfer response to the AMF2.

FIG. 8 is a schematic diagram of another authentication process provided by an embodiment. As shown in FIG. 8, the process includes the following steps.

Step 8010: The UE registers with the mobile network through the RAN1 to establish a NAS connection with the AMF1.

Step 8020: The AMF1 holds the authentication vector of the UE, and then initiates an authentication request or a re-authentication request to the UE through the RAN1, for example, sends a User Authentication Request, and carries the network authentication parameter AUTN and the random string RAND in the authentication vector of the UE.

Step 8030: The UE registers with the mobile network through the second radio access network (RAN2), and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE. .

Step 8040: The RAN2 selects a second access management function (AMF2), and forwards the registration request message to the AMF2.

Step 8050: The UE receives the authentication request or the re-authentication request, determines that the AUTN is valid, and then calculates the challenge response RES according to the information such as RAND and AUTN in the authentication request or the re-authentication request message, and generates an access management key Kamf2, and then passes the RAN1. Sending an authentication response or a re-authentication response to the AMF1, such as sending a User Authentication Response, carrying the RES, and the AMF1 determines that the RES is valid according to the expected response HXRES in the authentication vector, or the RAND in the authentication vector and the expected response HXRES, and then passes the authentication vector. The key Kseaf derives the access management key Kamf2, which is the same as the Kamf2 generated by the UE.

Step 8060: AMF1 performs a NAS SMC process, and sends a NAS Security Mode Command to the terminal through RAN1, and the message is guaranteed based on the derived key of Kamf2.

Step 8070: AMF1 receives a context transfer request for the UE from AMF2, such as a Transfer UE Context Request message.

Step 8080: AMF1 has not received the NAS security mode completion message, so it waits for a preset time to receive the NAS security mode complete message, or waits to receive the NAS security mode complete message.

Step 8090: The UE receives the NAS security mode command message. Because the UE has performed the authentication process, the UE uses the derived key of Kamf2 to verify the security of the NAS security mode command message. After the verification is passed, the NAS security mode is sent to the AMF1 through the RAN1. NAS Security Mode Complete) message that the NAS security mode completion message is secured and encrypted using Kamf2's derived key.

Step 8100: AMF1 completes the NAS SMC process, generates a new activation security context, and the new activation security context includes a derived new key Kamf2, and then sends a context transfer response to the AMF2, such as a Transfer UE Context Response message, carrying the UE context. Information, the UE context information includes the activated security context information of the UE.

Step 8110: AMF2 informs RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, RAN1 will receive the UE from the UE. The message is forwarded to the AMF2 instead of AMF1.

Step 8120: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response message.

Step 8130: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sending a Register Accept message.

Step 8140: The RAN2 forwards the registration accept message to the UE.

In this embodiment, after the AMF1 sends the security mode command to the UE, it receives the context transfer request sent by the AMF2, and the AMF1 waits to receive the security mode complete message before transmitting the context transfer response to the AMF2.

FIG. 9 is a message processing method according to an embodiment. As shown in FIG. 9, the method includes the following steps.

Step 9010: After the third network function establishes a NAS connection with the terminal, receiving a context transfer request for the terminal sent by the fourth network function.

Step 9020, the third network function receives a first NAS message from the terminal, and sends the first NAS message to the fourth network function; or the third network function receives the fourth network function. a second NAS message sent by the function, wherein the second NAS message is sent by the terminal to the fourth network function; or the third network function sends a third NAS message to the terminal, waiting for a third After the preset time, the context information of the terminal is sent to the fourth network function.

In this embodiment, the third network function and the fourth network function may be an access management function, or another core network device that implements access management. The first NAS message, the second NAS message, the third NAS message, and the following fourth NAS message and fifth NAS message may be any type of NAS message.

In an embodiment, after the third network function receives the second NAS message sent by the fourth network function, the method further includes: sending, by the third network function, the fourth network function to the terminal by using the fourth network function. NAS message.

In an embodiment, after the third network function receives the context transfer request for the terminal from the fourth network function, the method further includes: the third network function records the location of the context information of the terminal For the fourth network function. Since the third network function sends the context information of the terminal to the fourth network function, the storage location of the context information of the recording terminal is stored in the fourth network function.

In an embodiment, the third network function receives a first NAS message from the terminal, and sending the first NAS message to the fourth network function comprises: when the third network function is according to the The third network function sends the first NAS message to the fourth network function when the category, or the name of the first NAS message, or the content judgment needs to be forwarded, or when the first NAS message cannot be decrypted . In this embodiment, the class refers to whether the message is a request message, a response message, an indication message, or the like. For example, the type of the message to be forwarded is preset, or the name of the message to be forwarded is preset, and the content to be forwarded is preset. When the first NAS message is a preset category, or is a preset message name, or contains a preset. The third network function sends the first NAS message to the fourth network function.

FIG. 10 is another message processing method according to an embodiment, where the method includes the following steps.

Step 10010: The fourth network function receives a registration request from the terminal by using the first access network element.

Step 10020: The fourth network function requests context information of the terminal from a third network function.

Step 10030, the fourth network function receives a first NAS message sent by the third network function, where the first NAS message is sent by the terminal to the third network function; or, the fourth The network function receives the second NAS message from the terminal by the second access network element, and sends the second NAS message to the third network function.

In an embodiment, after receiving the first NAS message sent by the third network function, the fourth network function further includes: when the first NAS message is encrypted, the fourth network function decrypts the The first NAS message sends the decrypted first NAS message to the third network function.

The transmitting the decrypted first NAS message to the third network function comprises: when the fourth network function successfully verifies the integrity protection of the first NAS message (referred to as a complete guarantee), the decrypted The first NAS message is sent to the third network function.

In an embodiment, the sending, by the third network function, the second NAS message includes: when the registration process of the terminal is not completed, the fourth network function sends the third network function to the third network function The second NAS message is described. In another embodiment, if the registration process of the terminal has been completed, the fourth network function may not forward the second NAS message to the third network function.

FIG. 11 is a flowchart of another message processing method according to an embodiment. As shown in FIG. 11, the process includes the following steps.

Step 11010: The UE registers with the mobile network through RAN1 to establish a NAS connection with AMF1.

Step 11020: The UE registers with the mobile network through the RAN2, and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE.

Step 11030: RAN2 selects AMF2, and forwards the registration request message to the AMF2.

Step 11040: AMF2 determines that it does not have the context of the UE, and then acquires related information of the AMF1 from the registration request message, and sends a transfer context request to the AMF1, for example, sends a Transfer UE Context Request. Message.

Step 11050: The AMF1 marks a new location of the UE context, for example, setting related information of the AMF2 in the context information of the cached UE, or recording related information of the AMF2 corresponding to the UE.

Step 11060: The AMF1 returns the context information of the UE to the AMF2, for example, sends a Transfer UE Context Response message, and carries the context information of the UE, where the context information does not need to include AMF2 related information, so that no matter which wireless the UE passes. The access network sends a message, and the AMF2 can provide services for the UE. The AMF1 may send a NAS message to the UE through the RAN1 and wait for another NAS message to be received before the step 11050. The AMF1 may wait for a preset time to receive another NAS message. Returns the context information of the UE.

Step 11070: The UE sends a NAS message to the core network through the RAN1, and the RAN1 has not received the message that the access management function is changed, and then forwards the NAS message to the original core network function, that is, AMF1.

Step 11080: AMF1 determines that the context of the UE has been transferred to AMF2, and then forwards the NAS message to AMF2 for processing.

In an embodiment, before the AMF1 forwards the message, according to the category (Class, Request, Response, or Indication) or Type (Message Type) or content of the message. Determine if you need to forward.

In this embodiment, the AMF1 may forward the received NAS message after being decrypted, or may forward the undecrypted NAS message because the UE cannot decrypt (the UE uses the new key when transmitting the 11070 step message);

Step 11090: The AMF2 determines that the received forwarded NAS message is guaranteed or encrypted, and then decrypts the forwarded NAS message, and the verification is completed. After the verification is successful, the NAS message is forwarded to the AMF1.

In this embodiment, step 11090 is optional, that is, in another embodiment, step 11090 may not be performed.

Step 11100: AMF2 may cache the NAS message for a period of time, and then process the NAS message after completing the registration process.

Step 11110: The AMF2 notifies the RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message, and after receiving the access management function change request message, the RAN1 will receive the UE from the UE. The message is forwarded to the AMF2 instead of AMF1.

Step 11120: The RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, such as sending an AMF Mobility Response (Access Management Function Change Response) message.

Step 11130: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sending a Register Accept message.

Step 11140: The RAN2 forwards the registration accept message to the UE.

FIG. 12 is a flowchart of another message processing method according to an embodiment. As shown in FIG. 12, the process includes the following steps.

Step 12010: The UE registers with the mobile network through RAN1 to establish a NAS connection with AMF1.

Step 12020: The UE registers with the mobile network through the RAN2, and sends a registration request to the RAN2, for example, sends a Register Request message, which carries information about the AMF1 previously registered by the UE.

Step 12030: RAN2 selects AMF2, and forwards the registration request message to the AMF2.

Step 12040: The AMF2 determines that it does not have the context of the UE, and then acquires the related information of the AMF1 from the registration request message, and sends a transfer context request to the AMF1, for example, sends a Transfer UE Context Request. Message.

Step 12050: The AMF1 buffers the context information of the UE, and then returns the context information of the terminal UE to the AMF2, for example, sends a Transfer UE Context Response message, and carries the context information of the terminal UE.

Step 12060: AMF2 informs RAN1 that the access management function has changed, for example, sends an AMF Mobility Request message. Upon receiving the message, RAN1 forwards the received message from the UE to AMF2 instead of AMF1.

Step 12070: The UE sends the first NAS message to the core network through the RAN1.

Step 12080: The RAN1 has received the message that the access management function is changed, and then forwards the first NAS message to the new core network function, that is, AMF2.

Step 12090: The AMF2 forwards the received first NAS message from the RAN1 to the AMF1. In an embodiment, before the AMF2 forwards, it is determined that the registration process through the RAN2 has not been completed and the forwarding is decided.

Step 12100: After receiving the access management function change message, the RAN1 returns a message to the AMF2, informing the access management function to change the acceptance, for example, sending an AMF Mobility Response message.

Step 12110: In an embodiment, the AMF1 receives the forwarded NAS message and decides to return the second NAS message, and then forwards the second NAS message through the AMF2.

Step 12120: The AMF2 receives the forwarded second NAS message, and after corresponding processing, such as encryption and security, sends a second NAS message to the UE through RAN1 or RAN2.

Step 12130: The AMF2 sends a registration accept message to the UE through the RAN2, for example, sending a Register Accept message.

Step 12140: The RAN2 forwards the registration accept message to the UE.

An embodiment provides an authentication apparatus, including a memory and a processor, the memory storing a program, when the program is read and executed by the processor, the following operations are performed: establishing a non-access stratum NAS connection with the terminal Sending an authentication request or a re-authentication request to the terminal; receiving a context transfer request for the terminal from the second network function, and transmitting a first key to the second network function, the first key being based on Key derivation in the authentication vector of the terminal.

In another embodiment, the program, when executed by the processor, implements the authentication method described in any of the above embodiments.

An embodiment provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement any of the above implementations The authentication method described in the example.

An embodiment provides a message processing apparatus including a memory and a processor, the memory storing a program, when the program is read and executed by the processor, the following operations are performed: after establishing a NAS connection with the terminal, receiving a context transfer request for the terminal from a fourth network function; receiving a first NAS message from the terminal, transmitting the first NAS message to the fourth network function; or receiving the fourth network a second NAS message sent by the function, where the second NAS message is sent by the terminal to the fourth network function; or, after sending a third NAS message to the terminal, waiting for a third preset time, The context information of the terminal is sent to the fourth network function.

In another embodiment, the program further implements the message processing method described in any of the above embodiments when read by the processor.

An embodiment provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement any of the above implementations The message processing method described in the example.

The computer readable storage medium includes: at least one of a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk. The medium of the code.

Embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer usable program code.

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Claims

An authentication method that includes:

After the first network function establishes a connection with the non-access stratum NAS, the terminal sends an authentication request or a re-authentication request to the terminal;

The first network function receives a context transfer request for the terminal from a second network function, and sends a first key to the second network function, wherein the first key is based on the authentication of the terminal Key derivation in vector.
The authentication method according to claim 1, further comprising: said first network function transmitting a NAS security mode command to said terminal, and receiving a NAS security mode completion message returned by said terminal, said NAS security mode completion message Sended to the second network function.
The authentication method according to claim 1, further comprising: said first network function receiving an authentication response or a re-authentication response returned by said terminal, and transmitting said authentication response or re-authentication response to said second network function.
The authentication method of claim 3, wherein before the sending the authentication response or the re-authentication response to the second network function, the method further comprises:

Transmitting, by the first network function, an expected response in an authentication vector of the terminal to the second network function, or sending, by the first network function, an expected response and a random string in an authentication vector of the terminal to the The second network function is described.
The authentication method according to claim 1, wherein said transmitting said first key to said second network function comprises: said first network function receiving an authentication response or re-authentication response or NAS security returned by said terminal After the mode complete message, the first key is sent to the second network function.
The authentication method according to any one of claims 1 to 5, after the first network function receives the context transfer request for the terminal from the second network function, the method further includes: the first network function The second network function sends status information, wherein the status information indicates an ongoing status of the authentication process or the NAS security mode process.
The authentication method according to any one of claims 1 to 5, wherein, after the first network function receives the context transfer request for the terminal from the second network function, the method further includes: the first network function waiting After receiving the response to the authentication request or the re-authentication request, sending the context information of the terminal to the second network function; or, after the first network function waits for the first preset time, The context information of the terminal is sent to the second network function; or the first network function caches the context information of the terminal for a second preset time.
An authentication method that includes:

The first network function receives a registration request from the terminal;

The first network function requests context information of the terminal from the second network function, and receives a first key sent by the second network function, where the first key is based on an authentication vector of the terminal Key derivation.
The authentication method of claim 8, further comprising: the first network function receiving status information sent by the second network function, wherein the status information indicates that the first network function waits for pre-authentication when the authentication is completed After the time is set, the non-access stratum NAS security mode control process is performed.
The authentication method according to claim 8, further comprising: said first network function receiving status information transmitted by said second network function, waiting to receive an authentication response returned by said second network function or according to said status information Authentication response or NAS security mode completion message.
An authentication apparatus comprising a memory and a processor, the memory storing a program, the program implementing the authentication method according to any one of claims 1 to 10 when read by the processor.
A computer readable storage medium storing at least one program executable by at least one processor to implement the authentication method of any one of claims 1 to 10.
A message processing method includes:

After the first network function establishes a non-access stratum NAS connection with the terminal, receiving a context transfer request for the terminal sent by the second network function;

The first network function receives a first NAS message from the terminal, and sends the first NAS message to the second network function; or the first network function receives the second network function sent a second NAS message, wherein the second NAS message is sent by the terminal to the second network function; or the first network function sends a third NAS message to the terminal, waiting for a preset time, Sending context information of the terminal to the second network function.
The message processing method according to claim 13, after the first network function receives the second NAS message sent by the second network function, the method further includes: the first network function is used by the second network function The terminal sends a fourth NAS message.
The message processing method according to claim 13, after the first network function receives the context transfer request for the terminal from the second network function, the method further includes: the first network function recording The location of the context information of the terminal is the second network function.
The message processing method according to claim 13, wherein the first network function receives the first NAS message from the terminal, and the sending the first NAS message to the second network function comprises:

When the first network function determines that forwarding is required according to the category, or name, or content of the first NAS message, or when the first NAS message cannot be decrypted, the first network function will be the first The NAS message is sent to the second network function.
A message processing method includes:

The first network function receives the registration request from the terminal by using the first access network element;

The first network function requests context information of the terminal to a second network function;

Receiving, by the first network function, the first NAS message sent by the second network function, where the first NAS message is sent by the terminal to the second network function; or the first network function is passed The second access network element receives the second NAS message from the terminal, and sends the second NAS message to the second network function.
The message processing method according to claim 17, after the first network function receives the first NAS message sent by the second network function, the method further includes: when the first NAS message is encrypted, the A network function decrypts the first NAS message, and sends the decrypted first NAS message to the second network function.
The message processing method according to claim 18, wherein said transmitting said decrypted first NAS message to said second network function comprises:

When the first network function successfully checks the integrity protection of the first NAS message, the decrypted first NAS message is sent to the second network function.
The message processing method according to claim 17, wherein said transmitting said second NAS message to said second network function comprises:

The first network function sends the second NAS message to the second network function when the registration process of the terminal is not completed.
A message processing apparatus comprising a memory and a processor, the memory storing a program, the program implementing the message processing method according to any one of claims 13 to 20 when read by the processor.
A computer readable storage medium storing at least one program executable by at least one processor to implement the message processing method according to any one of claims 13 to 20. .