WO2019196668A1 - 一种信息发送方法、密钥生成方法以及装置 - Google Patents

一种信息发送方法、密钥生成方法以及装置 Download PDF

Info

Publication number
WO2019196668A1
WO2019196668A1 PCT/CN2019/080159 CN2019080159W WO2019196668A1 WO 2019196668 A1 WO2019196668 A1 WO 2019196668A1 CN 2019080159 W CN2019080159 W CN 2019080159W WO 2019196668 A1 WO2019196668 A1 WO 2019196668A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
network element
terminal device
key
access network
Prior art date
Application number
PCT/CN2019/080159
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2019250928A priority Critical patent/AU2019250928C1/en
Priority to BR112020019989-3A priority patent/BR112020019989A2/pt
Priority to JP2021501070A priority patent/JP7414796B2/ja
Priority to EP19786094.3A priority patent/EP3758402A4/en
Publication of WO2019196668A1 publication Critical patent/WO2019196668A1/zh
Priority to US17/011,698 priority patent/US20200403788A1/en
Priority to AU2022204263A priority patent/AU2022204263A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/04—Interfaces between hierarchically different network devices
    • H04W92/14—Interfaces between hierarchically different network devices between access point controllers and backbone network device

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an information sending method, a key generating method, and an apparatus.
  • the development of mobile services is increasingly important for security requirements in wireless communications.
  • the terminal device Before the terminal device requests service data from the core network, the terminal device and the core network need to perform an activation process of the security protection function.
  • the terminal device first moves to the mobility management entity (MME).
  • MME mobility management entity
  • the entity sends an initial non-access stratum (NAS) message, triggering the MME entity to authenticate with the terminal device.
  • NAS non-access stratum
  • the MME entity activates the NAS layer security protection function with the terminal device, in the MME.
  • the MME entity re-activates the security protection function of the access stratum (AS) of the base station and the terminal device.
  • AS access stratum
  • the security protection between the core network, the terminal device and the access network device is activated.
  • the fifth generation communication system (5th generation, 5G) will be built in a flexible manner.
  • network capabilities can be flexibly and dynamically customized according to different application scenarios and different requirements, for example,
  • These 5G systems are used to provide ultra-low latency service services.
  • the complex activation process in the 4G system if used, it will bring a large delay and cannot meet the requirements of the 5G system. It can be seen that the activation process for the security protection function in the 4G system cannot meet the flexibility requirements of the 5G system.
  • the embodiment of the present application provides an information sending method, a key generating method, and a device, which are used to solve the technical problem that the activation process for the security protection function in the prior art cannot meet the flexibility requirement of the 5G system.
  • the present application provides an information sending method, in which a core network element first determines whether a terminal device needs to perform a key activation process, and then sends a first message to the access network element, the first message. And indicating, by the network element of the access network, a second message for triggering the terminal device to perform the key activation process, and the access network element receives the first message, according to the first message. Determining whether the second message needs to be sent to the terminal device, and if it is determined to be needed, transmitting the second message to the terminal device.
  • the core network element first determines whether the key activation process needs to be performed, and then carries the result of the judgment in the first message to the access network element, and the access network element is according to the first After the content of the message determines that the key activation process needs to be triggered, the key activation process is triggered by sending the second message to the terminal device, so that the access network element can selectively trigger the key activation process according to actual conditions.
  • the flexibility requirement of the 5G system can be met. Further, when the access network element determines that the key activation process is not required, the terminal device can not perform the key activation process, which can save signaling overhead.
  • the first message includes at least one of the following information:
  • the core network element may indicate the result of the determination to the access network element by using one or more of the foregoing multiple types of information, which may increase the flexibility of the system.
  • the core network element determines whether the terminal device needs to perform the key activation process, and the fourth message is used by the terminal device to access the core network or The terminal device requests the core network element to establish a connection for sending service data.
  • the core network element determines whether the terminal device needs to perform a key activation process, so that the core network
  • the network element can trigger the determination process of determining whether the terminal device needs to perform the key activation process according to the requirements of the terminal device, and can reduce the power consumption of the core network element.
  • the core network element may determine whether the terminal device needs to perform the key activation process according to one of multiple determination manners.
  • the multiple determination manners are as follows:
  • the first mode if the type of the fourth message is a type of user plane data to be established, the core network element determines that the key activation process needs to be performed;
  • the second mode is: if it is determined that the type of the terminal device is an enhanced mobile broadband eMBB type according to the fourth message, the core network element determines that the key activation process needs to be performed;
  • the third mode if the delay required to determine the service that the terminal device needs to perform is higher than the preset delay according to the fourth message, the core network element determines that the key activation process needs to be performed.
  • the network element of the core network may select one of the methods according to the actual situation to determine whether the terminal device needs to perform the key activation process, and the flexibility of the core network element may be improved.
  • the core network element after the core network element receives the third message sent by the access network element for requesting the parameter triggering the key activation process, the core network element sends the network element to the access network element.
  • the first message After the core network element receives the third message sent by the access network element for requesting the parameter triggering the key activation process, the core network element sends the network element to the access network element. The first message.
  • the network element of the access network when the network element of the access network needs to trigger the key activation process of the terminal device, the network element of the access network may actively request the core network element to trigger the parameter of the key activation process, thereby triggering the core network element to The first message is sent, so that the access network element can send the message to be protected to the terminal device at any time through the solution, thereby improving the flexibility of the access network element.
  • the access network element determines whether the second message needs to be sent to the terminal device according to the preset policy and the first message.
  • the access network element may further determine whether the second message needs to be sent to the terminal device by using the content in the first message and the preset policy, so that the second message may be avoided.
  • the access network element directly triggers the key activation process according to the judgment result of the core network element or does not trigger the key activation process, thereby increasing the flexibility of the access network element.
  • the access network element can also directly determine whether it is needed according to the determination result.
  • the second message is sent to the terminal device, so that the operation complexity of the access network element can be reduced, and the decision is simplified.
  • the present application provides a key generation method, in which the access network element can be obtained according to the first input information used by the terminal device to generate a target key and the access network element itself.
  • the second input information for generating the target key is generated, and the target key is a key for performing a key activation process.
  • the access network element may directly generate a key for performing the key activation process according to the first input information and the second input information, so that the activation of the security protection function of the access network element may be It is determined by the access network element itself, without relying on the core network element, which makes the security negotiation between the access network element and the terminal device more flexible.
  • the access network element first obtains the security capability information of the terminal device, and then determines the second input information according to the security capability information.
  • the access network element may determine the information used by the access network element to generate the target key according to the security capability information of the terminal device, and the processing manner is simple, and the operation complexity of the access network element is reduced.
  • the terminal device sends the first radio resource control RRC signaling to the access network element, and the access network element obtains the security capability information of the terminal device from the first RRC signaling.
  • the network element of the access network can directly obtain the security capability information of the terminal device by using the RRC signaling with the terminal device, and provides a new processing mode.
  • the access network element can be selected according to the actual situation.
  • One of the ways to obtain the security capability information can increase the flexibility of the access network element.
  • the terminal device sends the second radio resource control RRC signaling to the access network element, and the access network element obtains the terminal device from the second RRC signaling to generate the target key.
  • the first input information is the second radio resource control RRC signaling.
  • the access network element can directly obtain the first input information by using RRC signaling with the terminal device, and provides a new processing mode, and the access network element can select the network element according to the actual situation.
  • the method of obtaining the first input information may increase the flexibility of the access network element.
  • the access network element may send the first message protected by the target key integrity to the terminal device, and the terminal device receives the first message.
  • the target key is generated according to the content in the first message
  • the second message is processed by the target network by performing integrity protection processing on the access network element, and the access network element receives the second message.
  • the second message is verified by using the target key generated by itself, and when the verification is successful, the key activation process is completed.
  • the target network element after the target network element generates the target key, the key activation process is completed according to the target key, so that the activation of the security protection function of the access network element and the terminal device may be accessed by
  • the network element determines its own, and does not need to rely on the core network element to make the security negotiation between the access network element and the terminal device more flexible.
  • the access network element sends a third message signed by the public key to the terminal device, and after receiving the third message, the terminal device uses the public key to perform the signature on the third message. Verification, if the signature of the third message is correct, the terminal device generates a key for performing the key activation process according to the content of the third message and the first input information used by the user to generate the target key, and then the first input information
  • the fourth message is sent to the network element of the access network, and the fourth message is integrity-protected by using the target key, and the access network element receives the fourth message, and then receives the fourth message.
  • the message acquires the first input information.
  • the network element of the access network first transmits the second input information used by the public key to generate the target key to the terminal device, so that the security of the second input information can be ensured, and the terminal device uses the
  • the public key verifies the information sent by the network element of the access network, so as to ensure the correctness of the second input information, and the terminal device uses the target key to protect the fourth message and integrity, thereby ensuring the core network element.
  • the correctness of the obtained first input information is such that the information transmitted between the access network element and the terminal device is protected by the public key and the target key, and the target device used by the terminal device and the access network element can be ensured. Key consistency.
  • the access network element uses the target key to verify the second message. When the verification succeeds, the key activation process is completed.
  • the target network element after the target network element generates the target key, the key activation process is completed according to the target key, so that the activation of the security protection function of the access network element and the terminal device may be accessed by
  • the network element determines its own, and does not need to rely on the core network element to make the security negotiation between the access network element and the terminal device more flexible.
  • the present application provides a key generation method, in which a terminal device receives a third message that is sent by a network element of an access network and is signed by a public key, and then the terminal device uses the public key to use the public key.
  • the signature of the third message is verified. If the signature is correct, the terminal device generates the target key according to the content in the third message and the first input information used by the user to generate a key for performing the key activation process.
  • the network element of the access network signs the information sent to the terminal device by using the public key, so that the security of the third message can be ensured, and the terminal device uses the public key to verify the third message.
  • the target key is generated by using the content in the third message, so that the correctness of the target key generated by the terminal device can be ensured.
  • the third message includes second input information used by the access network element to generate the target key.
  • the access network element may send the second input information of the target key by itself to the terminal device by using the third message, so that the terminal device directly generates the target key according to the second input information.
  • the processing complexity of the access network element can be reduced.
  • the terminal device may send, to the access network element, a fourth message that performs integrity protection processing by using the target key.
  • the terminal device after generating the target key, the terminal device directly uses the target key to perform integrity protection on the fourth message to ensure the correctness of the fourth message, thereby enabling the access network element to Determining the same target key as the terminal device according to the fourth message ensures consistency between the access network element and the target key used by the terminal device.
  • the fourth message includes the first input information.
  • the terminal device directly sends the first input information used by the terminal device to generate the target key to the core network element by using the fourth message, and the core network element directly determines the The target key can reduce the processing complexity of the access network element.
  • the application provides an apparatus, where the apparatus may be an access network element or a device in an access network element, and the apparatus may include a receiving module and a determining module, where the module may perform the foregoing first
  • the apparatus may be an access network element or a device in an access network element
  • the apparatus may include a receiving module and a determining module, where the module may perform the foregoing first
  • a receiving module configured to receive the first message
  • a determining module configured to determine, according to the first message, whether a second message needs to be sent to the terminal device, where the second message is used to trigger the terminal device to perform a key activation process
  • a sending module configured to send the second message to the terminal device if it is determined to be needed.
  • the specific content included in the first message can be referred to the specific description of the first message in the first aspect, which is not specifically limited herein.
  • the sending module is further configured to send a third message to the core network element, where the third message is used to request a parameter that triggers the key activation process.
  • the determining module is configured to determine, according to the preset policy and the first message, whether the second message needs to be sent to the terminal device.
  • the application provides a device, which may be a core network element or a device in a core network element.
  • the device may include a communication module and a determining module, and the modules may perform the foregoing first aspect.
  • a determining module configured to determine whether the terminal device needs to perform the key activation process
  • a communication module configured to send a first message to the network element of the access network, where the first message is used to indicate whether the network element of the access network sends a second message to the terminal device, where the second message is used to trigger the terminal.
  • the specific content included in the first message can be referred to the specific description of the first message in the first aspect, which is not specifically limited herein.
  • the communication module is further configured to receive a fourth message, where the fourth message is used by the terminal device to access the core network or the terminal device requests the core network element to establish a connection for sending service data.
  • the determining module can determine whether the key activation process needs to be performed in the following three ways:
  • the first mode if the type of the fourth message is a type of user plane data to be established, it is determined that the key activation process needs to be performed.
  • the second mode if it is determined according to the fourth message that the type of the terminal device is an enhanced mobile broadband eMBB type, it is determined that the key activation process needs to be performed.
  • the third mode if it is determined that the delay required by the terminal device to perform the service according to the fourth message is higher than the preset delay, it is determined that the key activation process needs to be performed.
  • the communication module is further configured to receive a third message sent by the access network element, the third message is used to request a parameter that triggers the key activation process.
  • the application provides a device, which may be an access network element or a device in an access network element, where the device may include a communication module and a determining module, and the modules may perform the second
  • the device may include a communication module and a determining module, and the modules may perform the second
  • a communication module configured to acquire first input information and second input information, where the first input information is information obtained by the terminal device for generating a target key, where the target key is a key for performing a key activation process
  • the second input information is information obtained by the access network element for generating the target key
  • a determining module configured to generate the target key according to the first input information and the second input information.
  • the communication module is configured to obtain security capability information of the terminal device, and determine the second input information according to the security capability information.
  • the communication module is configured to receive the first radio resource control RRC signaling sent by the terminal device, and obtain the security capability information from the first RRC signaling.
  • the communication module is configured to receive the second radio resource control RRC signaling sent by the terminal device, and obtain the first input information from the second RRC signaling.
  • the communication module is further configured to send a first message to the terminal device, where the first message is protected by the target key integrity; and receive the second message sent by the terminal device a message, wherein the second message performs integrity protection processing by using the target key; the determining module is further configured to verify the second message by using the target key, and when the verification is successful, completing the key activation process .
  • the communication module is configured to send a third message to the terminal device, where the third message is a message signed by a public key; and receiving a fourth message sent by the terminal device And wherein the fourth message performs integrity protection processing by using the target key, the fourth message includes the first input information; and the first input information is obtained from the fourth message.
  • the determining module is further configured to verify the second message by using the target key, and when the verification succeeds, the key activation process is completed.
  • the present application provides a device, which may be a terminal device or a device in a terminal device, and the device may include a communication module and a determining module, and the modules may perform any of the foregoing design examples of the second aspect.
  • a communication module configured to receive a third message sent by the network element of the access network, where the third message is a message that is signed by the public key;
  • a determining module configured to verify the signature of the third message by using the public key; and, if the signature of the third message is correct, generate a target key according to the third message and the first input information, where the An input message is information used by the device to generate a target key, which is a key for performing a key activation process.
  • the third message includes second input information, where the second input information is information used by the access network element to generate the target key.
  • the communication module is further configured to send a fourth message to the access network element, wherein the fourth message performs integrity protection processing by using the target key.
  • the fourth message includes the first input information.
  • the present application provides an apparatus, the apparatus comprising a processor for implementing the method described in the first aspect above.
  • the apparatus can also include a memory for storing program instructions and data.
  • the memory is coupled to the processor, and the processor can invoke and execute program instructions stored in the memory for implementing the method described in the first aspect above.
  • the apparatus can also include a communication interface for the device to communicate with other devices.
  • the other device is a terminal device.
  • the device comprises:
  • a communication interface configured to receive the first message
  • a memory for storing program instructions
  • a processor configured to determine, according to the first message, whether to send a second message to the terminal device, where the second message is used to trigger the terminal device to perform a key activation process; if it is determined, the device sends the second message to the terminal device Second message.
  • the specific content included in the first message can be referred to the specific description of the first message in the first aspect, which is not specifically limited herein.
  • the communication interface is further configured to send a third message to the core network element, where the third message is used to request a parameter that triggers the key activation process.
  • the processor is further configured to determine, according to the preset policy and the first message, whether the second message needs to be sent to the terminal device.
  • the present application provides an apparatus comprising a processor for implementing the method described above in the first aspect.
  • the apparatus can also include a memory for storing program instructions and data.
  • the memory is coupled to the processor, and the processor can invoke and execute program instructions stored in the memory for implementing the method described in the first aspect above.
  • the apparatus can also include a communication interface for the device to communicate with other devices.
  • the other device is a core network element.
  • the device comprises:
  • a processor configured to determine whether the terminal device needs to perform the key activation process
  • a communication interface configured to send a first message to the network element of the access network, where the first message is used to indicate whether the network element of the access network sends a second message to the terminal device, where the second message is used to trigger the terminal
  • the device performs the key activation process
  • a memory for storing program instructions.
  • the specific content included in the first message can be referred to the specific description of the first message in the first aspect, which is not specifically limited herein.
  • the communication interface is further configured to receive a fourth message, where the fourth message is used by the terminal device to access the core network or the terminal device requests the core network element to establish a connection for sending service data.
  • the processor can determine whether the key activation process needs to be performed in the following three ways:
  • the first mode if the type of the fourth message is a type of user plane data to be established, it is determined that the key activation process needs to be performed.
  • the second mode if it is determined according to the fourth message that the type of the terminal device is an enhanced mobile broadband eMBB type, it is determined that the key activation process needs to be performed.
  • the third mode if it is determined that the delay required by the terminal device to perform the service according to the fourth message is higher than the preset delay, it is determined that the key activation process needs to be performed.
  • the communication interface is further configured to receive a third message sent by the access network element, the third message being used to request a parameter that triggers the key activation process.
  • the application provides an apparatus, the apparatus comprising a processor for implementing the method described in the second aspect above.
  • the apparatus can also include a memory for storing program instructions and data.
  • the memory is coupled to the processor, and the processor can invoke and execute program instructions stored in the memory for implementing the method described in the second aspect above.
  • the apparatus can also include a communication interface for the device to communicate with other devices.
  • the other device is a terminal device.
  • the device comprises:
  • a communication interface configured to acquire first input information and second input information, where the first input information is information obtained by the terminal device for generating a target key, where the target key is a key for performing a key activation process
  • the second input information is information obtained by the access network element for generating the target key
  • a memory for storing program instructions
  • a processor configured to generate the target key according to the first input information and the second input information.
  • the communication interface is configured to obtain security capability information of the terminal device, and determine the second input information according to the security capability information.
  • the communication interface is configured to receive the first radio resource control RRC signaling sent by the terminal device, and obtain the security capability information from the first RRC signaling.
  • the communication interface is configured to receive the second radio resource control RRC signaling sent by the terminal device, and obtain the first input information from the second RRC signaling.
  • the communication interface is further configured to send a first message to the terminal device, where the first message is protected by the target key integrity; and receive the second message sent by the terminal device a message, wherein the second message performs integrity protection processing by using the target key; the determining module is further configured to verify the second message by using the target key, and when the verification is successful, completing the key activation process .
  • the communication interface is configured to send a third message to the terminal device, where the third message is a message signed by a public key; and receiving a fourth message sent by the terminal device And wherein the fourth message performs integrity protection processing by using the target key, the fourth message includes the first input information; and the first input information is obtained from the fourth message.
  • the processor is further configured to verify the second message by using the target key, and complete the key activation process when the verification succeeds.
  • the application provides an apparatus, the apparatus comprising a processor for implementing the method described in the second aspect above.
  • the apparatus can also include a memory for storing program instructions and data.
  • the memory is coupled to the processor, and the processor can invoke and execute program instructions stored in the memory for implementing the method described in the second aspect above.
  • the apparatus can also include a communication interface for the device to communicate with other devices.
  • the other device is an access network element.
  • the device comprises:
  • a communication interface configured to receive a third message sent by the network element of the access network, where the third message is a message that is signed by the public key;
  • a memory for storing program instructions
  • a processor configured to use the public key to verify the signature of the third message; and, if the signature of the third message is correct, generate a target key according to the third message and the first input information, where the An input message is information used by the device to generate a target key, which is a key for performing a key activation process.
  • the third message includes second input information, where the second input information is information used by the access network element to generate the target key.
  • the communication interface is further configured to send a fourth message to the access network element, wherein the fourth message performs integrity protection processing by using the target key.
  • the fourth message includes the first input information.
  • the present application further provides a computer readable storage medium comprising instructions which, when run on a computer, cause the computer to perform the method of the first aspect.
  • the embodiment of the present application further provides a computer readable storage medium, comprising instructions, when executed on a computer, causing the computer to perform the method of the second aspect or the third aspect.
  • the present application provides a chip system including a processor, and a memory, for implementing the method of the first aspect.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides a chip system including a processor, and may further include a memory for implementing the method of the second aspect or the third aspect.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides a system comprising the apparatus of the fourth aspect and the apparatus of the fifth aspect.
  • the present application provides a system comprising the apparatus of the sixth aspect and the apparatus of the seventh aspect.
  • the present application provides a system comprising the apparatus of the eighth aspect and the apparatus of the ninth aspect.
  • the present application provides a system comprising the apparatus of the tenth aspect and the apparatus of the eleventh aspect.
  • FIG. 1 is a flow chart of activation of a terminal device and a core network security protection function in the prior art
  • FIG. 2 is a structural diagram of a communication system according to an embodiment of the present application.
  • 3A-3C are flowcharts of a method for sending information according to an embodiment of the present application.
  • FIG. 5 is a flowchart of a method for generating a key according to an embodiment of the present application
  • FIG. 6 is a flowchart of an implementation manner for an access network element A to obtain the first input information according to an embodiment of the present disclosure
  • FIG. 7 is a flowchart of another method for generating a key according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of another apparatus according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of another apparatus according to an embodiment of the present application.
  • Key activation process It may include an AS SMC process and/or a NAS SMC process. Of course, it may also be another key activation process that has an activation security key and protects subsequent messages, and is not limited herein.
  • Network exposure function (NEF) network element which is mainly used to interact with third parties, so that third parties can indirectly interact with certain 3rd generation partnership project (3GPP) networks.
  • the network element interacts.
  • NF repository function (NRF) network element, which is used to support network function service registration, status monitoring, etc., to realize automatic management, selection and scalability of network function services.
  • a policy control function (PCF) network element for storing or generating session management related rules, for example, a session quality of service (QoS) rule, and providing the rule to session management
  • PCF policy control function
  • a session management function (SMF) entity is also used to generate mobility management related policy information and provide it to an access and mobility management function (AMF) entity.
  • Unified data management (UDM) network element which stores subscription information of the terminal device.
  • An application function (AF) network element is configured to interact with the PCF entity to provide a third-party service requirement to the PCF entity, so that the PCF entity generates a corresponding QoS rule according to the service requirement.
  • AF application function
  • An authentication service function (AUSF) network element configured to obtain a security authentication vector, where the security authentication vector is used to perform security authentication between the terminal device and the network side.
  • AUSF authentication service function
  • AMF network element used for authentication of terminal equipment, mobility management of terminal equipment, network slice selection, SMF entity selection, etc.; as an anchor point for N1 and N2 signaling connections and providing N1 and N2 for SMF entities Routing of session management (SM) messages; maintaining and managing state information of terminal devices.
  • SM session management
  • Security anchor function (SEAF) network element used to initiate an authentication request to the AUSF entity to complete the authentication of the terminal device on the network side.
  • SMF network element used to manage all control plane functions of the terminal equipment, including UPF entity selection, network protocol (IP) address allocation, session QoS attribute management, and policy control function (PCF).
  • IP network protocol
  • PCF policy control function
  • the entity obtains policy control and charging (PCC) rules, and allocates session resources for the user plane.
  • PCC policy control and charging
  • UPF User plane function
  • PDU protocol data unit
  • a data network (DN) entity is configured to generate downlink data that needs to be sent to the terminal device, and receive uplink data sent by the terminal device.
  • (R) AN radio access network
  • R radio access network
  • the (R)AN may be an access network employing different access technologies, for example, a 3GPP access technology, a non-3rd generation partnership project (non-3GPP) access technology.
  • the (R) AN node may also be referred to as an access network element, such as a base station, and may be a gNB (gNode B) in a new radio (NR) system, and an evolved base station (evolutional NodeB in an LTE system).
  • gNB gNode B
  • NR new radio
  • evolutional NodeB evolutional NodeB in an LTE system
  • the eNB or the eNodeB which may be a new radio controller (NR controller), may be a centralized unit, may be a radio remote module, may be a micro base station, or may be a distributed network element ( a distributed unit, which may be a transmission reception point (TRP) or a transmission point (TP), or a wireless controller in a cloud radio access network (CRAN) scenario, or
  • the network device may be a relay station, an access point, an in-vehicle device, a wearable device, and a network device in a public land mobile network (PLMN) or any other wireless access device in a future evolution, but the embodiment of the present application does not. Limited to this.
  • the access network element allocates appropriate resources for the user plane transmission channel according to the QoS rules provided by the SMF entity.
  • the terminal device may be a wireless terminal device or a wired terminal device.
  • the terminal device verifies the authenticity of the network by using the long-term key and related functions stored in the terminal device.
  • the wireless terminal device can be a device that provides voice and/or data connectivity to the user, a handheld device with wireless connectivity, or other processing device that is connected to the wireless modem.
  • the wireless terminal device can communicate with one or more core networks via the RAN, which can be a mobile terminal device, such as a mobile telephone (or "cellular" telephone) and a computer with a mobile terminal device, for example, can be portable , pocket, handheld, computer built-in or in-vehicle mobile devices that exchange language and/or data with the wireless access network.
  • a mobile terminal device such as a mobile telephone (or "cellular" telephone)
  • a computer with a mobile terminal device for example, can be portable , pocket, handheld, computer built-in or in-vehicle mobile devices that exchange language and/or data with the wireless access network.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • a wireless terminal may also be called a system, a subscriber unit (SU), a subscriber station (SS), a mobile station (MB), a mobile station, a remote station (RS), Access point (AP), remote terminal (RT), access terminal (AT), user terminal (UT), user agent (UA), terminal equipment ( User device (UD), or user equipment (UE).
  • SU subscriber unit
  • SS subscriber station
  • MB mobile station
  • RS remote station
  • RT remote terminal
  • AT access terminal
  • U user agent
  • U terminal equipment
  • UD User device
  • UE user equipment
  • the activation process of the terminal device and the core network security protection function in the 4G system is first introduced. As shown in Figure 1, in the 4G system, the activation process of the terminal device and the core network security protection function is described as follows:
  • the terminal device sends an initial NAS message to the MME entity by using the access network element, where the initial NAS message may be an attach request.
  • the MME entity and the terminal device perform authentication
  • the MME entity After the MME entity and the terminal device are successfully authenticated, the MME entity sends a non-access stratum security mode command (NAS SMC) message to the terminal device, and the terminal device receives the NAS SMC message;
  • NAS SMC non-access stratum security mode command
  • the terminal device activates the NAS security protection function according to the NAS SMC message.
  • the terminal device After the NAS security is activated, the terminal device sends a non-access stratum security mode completion (NAS SMP) message to the MME entity, and the MME entity receives the NAS SMP message;
  • NAS SMP non-access stratum security mode completion
  • the MME entity activates the NAS security protection function according to the NAS SMP message
  • the MME entity After the MME entity completes the security verification process with the non-access stratum of the terminal device, the MME entity sends an initial context aetup request message to the access network element, and the access network element receives the initial a context establishment request message, where the initial context establishment request message carries a security context;
  • the access network element sends an access layer security mode command (AS SMC) message to the terminal device according to the security context, and the terminal device receives the AS SMC message;
  • AS SMC access layer security mode command
  • the terminal device activates the AS security protection function according to the AS SMC message.
  • the terminal device After the AS security is activated, the terminal device sends an Access Layer Security Mode Complete (AS SMP) message to the MME entity, and the MME entity receives the AS SMP message;
  • AS SMP Access Layer Security Mode Complete
  • the MME entity activates the AS security protection function according to the AS SMP message, and completes the activation process of the security protection function.
  • the embodiment of the present application provides an information sending method, which is applied in an activation process of a 5G system security protection function, in which the access network element first determines whether to activate the security protection function with the terminal device, if it is determined If necessary, the activation process of the security protection function is triggered, so that the activation process of the security protection function can be selectively performed according to actual conditions, and can meet the flexibility requirement of the 5G system.
  • the technical solution of the embodiment of the present application can be applied to various communication systems, for example, an NR system, an LTE system, an advanced long term evolution (LTE-A) system, and a third generation partnership project (the 3rd generation partnership project).
  • 3GPP 3rd generation partnership project
  • 5G systems 5th Generation mobile communication systems.
  • the communication system can also be applied to the communication technology of the future.
  • the system described in the embodiment of the present application is for explaining the technical solution of the embodiment of the present application, and does not constitute the technical solution provided by the embodiment of the present application.
  • the technical solutions provided by the embodiments of the present application are applicable to similar technical problems as the network architecture evolves.
  • FIG. 2 is a structural diagram of a communication system according to an embodiment of the present application.
  • the functions of the network elements in the communication system have been previously described, and details are not described herein again.
  • 3A-3C are flowcharts of a method for sending information according to an embodiment of the present application.
  • the description of the flowchart is as follows:
  • Step 301 The terminal device sends a fourth message to the core network element, and the core network element receives the fourth message.
  • the core network element is, for example, a single network entity shown in FIG. 2, such as an AMF entity or an SMF entity, or the core network element may also be a combination of multiple network entities, for example, It may be a combination of an AMF entity and an SMF entity (representing a combination of two signaling plane functional entities), or a combination of an AUSF entity, an AMF entity, and a SEAF entity (representing a combination of a security functional entity and a signaling plane security entity) Etc., it may also be a combination of an MEC entity and a UPF entity (representing a combination of two user plane security entities), or a combination of an SMF entity and a UPF entity (representing a combination of a signaling plane security entity and a user plane security entity), It may be a combination of a UPF entity and a SEAF entity (representing a combination of a user plane entity and a security function entity), in which case it may not be standardized.
  • the core network element may be a network function corresponding to a certain service.
  • the network function may be understood as a virtualization function under the virtualization implementation, and may also be understood as a network function of providing a service under the service network, for example, a network function dedicated to the registration process of the terminal device, or a network function dedicated to providing video service data to the terminal device.
  • the core network element may be a single network function, or may be A combination of network functions corresponding to multiple services, a specific combination example may be similar to a combination of multiple network entities, that is, a combination of different functions of different services may be provided, and details are not described herein again. Therefore, the core network element of the present invention may be a cooperation between multiple core network elements, that is, after several core network elements communicate, and then one core network element acts as an egress to interact with the access network device.
  • the network entity, the network element, the device, and the like are equivalent, and the specific title is not limited.
  • the core network element will be described. Since there are multiple terminal devices connected to the core network element, for convenience of description, the terminal device 1 will be described as an example.
  • the fourth message is used for the terminal device 1 to access the core network or the terminal device 1 requests the core network element to establish a connection for sending service data.
  • the fourth message may be an initial registration request.
  • NAS messages such as messages or service request messages.
  • the terminal device 1 needs to register with the core network or request service data, the terminal device 1 sends the fourth message to the core network element.
  • Step 302 The core network element determines whether the terminal device 1 needs to perform a key activation process.
  • the key activation process may be an AS SMC process, or may be another key activation process that has an activation security key and protects subsequent messages.
  • AS SMC process is taken as an example for description. .
  • the core network element determines whether the terminal device 1 needs to perform an AS SMC process.
  • the specific manner in which the core network element determines whether the terminal device 1 needs to perform the AS SMC process may be at least one of the following multiple manners.
  • the core network element determines the type of the fourth message, and determines, according to the type of the fourth message, whether the terminal device 1 needs to enter the AS SMC process. If the type of the fourth message is a type of a transmission channel that needs to establish user plane data, The core network element determines that the AS SMC process needs to be performed.
  • the core network element may determine the type of the fourth message according to the information carried in the fourth message. For example, if the fourth message carries the content related to the PDU session, the core network element determines that the fourth message is the type of the user plane data to be established, and determines that the AS SMC process needs to be performed; if the fourth message does not carry the protocol data. If the content of the protocol data unit (PDU) is related to the session, the fourth message is determined to be a type that does not need to establish user plane data. Or, if the fourth message is a service request message, determining that the fourth message is a type of user plane data needs to be established; otherwise, determining that the fourth message is a type that does not need to establish user plane data. Of course, other judgment methods can also be adopted, and no limitation is imposed here.
  • PDU protocol data unit
  • the core network element determines the type of the terminal device 1, and determines whether the ASSMC process needs to be performed by the type of the terminal device 1. If the type of the terminal device 1 is the enhanced mobile broadband eMBB type, the core network element determines that the AS SMC process needs to be performed.
  • the core network element may obtain information related to the terminal device 1 from other network elements, such as an SMF entity or a UDM entity, and obtain the information according to the acquired terminal.
  • the information related to the device 1 and the fourth message determine whether the AS SMC process needs to be performed.
  • the core network element may determine the type of the terminal device 1 according to a certain field in the fourth message, the subscription information of the terminal device 1 in the UDM entity, the location information of the terminal device 1 sent by the PCF entity, and the like.
  • the terminal device 1 is of the eMBB type, it is determined that the AS SMC process needs to be performed; if the terminal device 1 is of the mMTC type or the URLLC type, it is determined that the AS SMC process is not required. For example, if the terminal device 1 is a car or an onboard module, it is determined that the AS SMC process is not required; if the terminal device 1 is a mobile phone, it is determined that the AS SMC process needs to be performed. Certainly, if the type of the terminal device 1 is other types, the foregoing manner may also be used for determining, and details are not described herein again.
  • the core network element obtains the QoS information obtained from the other core network elements according to the quality of service (QoS) information carried in the fourth message or after receiving the fourth message.
  • QoS quality of service
  • the delay required by the service requested by the terminal device 1 can be determined according to the QOS related information, and whether the AS SMC process needs to be performed is determined according to the delay. For example, if the required delay of the service requested by the terminal device 1 is higher than the preset delay, the core network element determines that the AS SMC process needs to be performed; if the time required by the service requested by the terminal device 1 is lower than or equal to the The default network delay determines that the core network element does not need to perform the AS SMC process.
  • the preset delay is 1 s
  • the core network element determines, according to the fourth message, that the required delay of the service requested by the terminal device 1 is 0.5 s, 0.5 s ⁇ 1 s, and the core network element determines that the AS is not required. SMC process.
  • the core network element may obtain state information of the external network that the terminal device 1 requests to access from other network elements, such as a PCF entity or an AF entity or a management network element entity, for example, slice related information of the network requesting access, Which data network name (DNN) is requested to access, determine what kind of network the terminal device 1 requests to access, and determine whether the AS SMC process needs to be performed according to the status information of the network that is requested to access. For example, if the terminal device 1 requests access to a network with a very low latency requirement, the network requires the terminal device 1 to access the network at the fastest speed, and the core network element determines that the AS SMC process is not required. Alternatively, the core network element may obtain the load information of the access network that the terminal device 1 requests to access.
  • other network elements such as a PCF entity or an AF entity or a management network element entity, for example, slice related information of the network requesting access, Which data network name (DNN) is requested to access, determine what kind of network the terminal device 1 requests to
  • the core network element determines that the AS SMC process needs to be performed. Of course, it can also be judged according to other information of the network that the terminal device 1 requests to access, which is not mentioned here.
  • the core network element may obtain state information of the access network element currently accessed by the terminal device 1 from itself or other network elements, such as a PCF entity or an AF entity, according to the status information of the access network element currently accessed. Determine if an AS SMC process is required.
  • the core network element can obtain the location information of the access network element currently accessed by the terminal device 1, for example, the deployment location of the currently accessed access network element is a desert, and there is no other nearby. In the network, the core network element determines that the AS SMC process is not required.
  • the network location of the currently accessed access network element is the business area, and the core network element determines that the AS SMC process needs to be performed. Of course, it can also be judged according to other information of the currently accessed network, which is not mentioned here.
  • the policy configured by the network element of the core network or the policy provided by the network management system determines whether the AS SMC process needs to be performed.
  • the configured policy may be an operator policy.
  • the operator policy may be an AS SMC process for all UEs, and the core network element determines that the terminal device 1 does not need to perform an AS SMC process; if the carrier policy is The AS SMC process is required for all the UEs, and the core network element determines that the terminal device 1 needs to perform the AS SMC process.
  • the core network element may determine whether the AS SMC process needs to be performed according to the indication information carried in the fourth message.
  • the indication information may be from the access network element or from the terminal device 1.
  • the terminal device 1 may add bit indication information in the fourth message, where the bit indication information is used to indicate whether the core network element needs an AS SMC process.
  • the access network device may add bit indication information in the N2 message that sends the fourth message, where the bit indication information is used to indicate whether the core network element needs the AS SMC process.
  • the core network element may use one of the above seven methods to determine, or set the priority for the above seven methods.
  • the priority is used.
  • the determination method the correspondence between the various determination methods and the actual situation may be set, and in which case, the determination manner is used, which is not limited in the embodiment of the present application.
  • step 301 - step 302 is an optional step, that is, it is not necessary to perform.
  • Step 303 The core network element and the terminal device 1 perform authentication.
  • Step 304 The core network element sends a NAS SMC message to the terminal device 1, and the terminal device 1 receives the NAS SMC message.
  • Step 305 The terminal device 1 activates NAS security according to the NAS SMC message.
  • Step 306 The terminal device 1 sends a NAS SMP message to the core network element, and the core network element receives the NAS SMP message and activates the NAS security.
  • Steps 303 to 306 are the same as the corresponding steps in FIG. 1, and details are not described herein again.
  • step 302 and step 303-step 306 may be performed first step 302 and then step 303-step 306, as shown in FIG. 3A; or step 303 may be performed first and step 302 is performed last. Steps 306 to 306 are performed, as shown in FIG. 3B. Steps 303 to 306 are performed first, and then step 302 is performed. As shown in FIG. 3C, in the embodiment of the present application, step 302 and step 303-step 306 are omitted. The order of execution is limited.
  • step 302 may also be performed multiple times, that is, step 302 is performed first, then step 303-step 306 is performed, and then step 302 is performed again; or step 303 is performed first, then step 302 is performed, and step is performed. 304 - Step 306, and finally step 302 is performed again.
  • the determination result of step 302 may be indicated by one or more of the 7 kinds of information in the foregoing first message after the first determination, or may be indicated after the last execution of step 302.
  • the core network element may be pre-configured with the location of the step 302, the number of times the step 302 is performed, and the location of the determination result of the step 302, which is not limited herein.
  • step 303-step 306 is an optional step, which is not necessarily performed, that is, after the core network element receives the fourth message sent by the terminal device 1, it can perform authentication and NAS through steps 303-306.
  • the layer security verification process may not perform the verification process of step 303 to step 306, and is not limited herein.
  • Step 307 The core network element sends a first message to the access network element, where the access network element receives the first message.
  • the access network element can be understood as a traditional access device of the 3GPP network, such as a 4G base station eNB, a 5G base station gNB, and various upgraded or evolved 3GPP access technologies. .
  • the deployment mode of the access network device is not specified in the present invention.
  • the present invention uses the access network device to represent the device having the access network function, that is, the front-end base station and the back-end data center in the cloud state deployment. Meanwhile, the access network device is not excluded as a wireless access point AP under the non-3GPP access technology, or various types of gateway devices, for example, an evolved packet data gateway (ePDG), an N3IWF, and a fixed network access. Gateway used by technology.
  • ePDG evolved packet data gateway
  • N3IWF N3IWF
  • the network entity, the network element, the device, and the like are equivalent, and the specific name is not limited.
  • the access network element A As there are multiple access network elements connected to the core network element, for convenience of description, the following describes the access network element A as an example.
  • the first message will be described below.
  • the first message is a message that the access network element A receives from the core network element.
  • the message may be used to provide the reference information to the access network device A, so that the access network device A can be used to determine whether the message of the AS SMC process needs to be triggered, or can be used to enable the access network device A to trigger the AS SMC process.
  • Required parameters The form of the first message includes but is not limited to the following three types:
  • the first form is a message similar to the initial context setup request message.
  • an initial context setup message is used to transfer a security context from a core network element to an access network element.
  • the first message may be the same as the content included in the initial context setup request message in FIG. 1, and the specific information is not described herein.
  • the second form: the first message may include information in the initial context setup request message, and further includes other information, which may be used by the access network element A to determine whether the AS SMC process with the terminal device needs to be triggered. .
  • the other information includes at least one of the following information:
  • the core network element may store or acquire or temporarily generate a base root key KgNB for performing an AS SMC process corresponding to each terminal device of the access core network, and store the base root key according to the base
  • the KgNB generates a plurality of algorithms for performing the key of the AS SMC process, so that when the core network element needs to trigger the access network element A and the AS SMC process of a certain terminal device, the basis is corresponding to the certain terminal device.
  • the root key KgNB and the selected algorithm generate a key for the access network element A to perform the AS SMC process with the certain terminal device.
  • the basic root key KgNB and the algorithm have a mapping relationship with the multiple sets of keys
  • the key may also be a core network element according to the basic root key KgNB and the selected algorithm, and the pre-stored multiple sets of keys are used.
  • a set of keys selected in the middle does not limit the way the keys are obtained.
  • the terminal device is a terminal device that needs to be interacted with by the access network element A.
  • the certain terminal device is referred to as the terminal device 1.
  • a base root key KgNB for generating a key for performing an AS SMC process (2) A base root key KgNB for generating a key for performing an AS SMC process.
  • the basic root key for example, may be KgNB, and the description thereof is described in (1), and details are not described herein again.
  • the base root key may also be other keys than KgNB, and is not limited herein.
  • the key identifier is a key used to indicate the AS SMC process.
  • the key identifier is used to identify that the core network element determines the use of the AS SMC process when the access network element A and the terminal device 1 perform the AS SMC process.
  • the key of the multiple sets of keys is such that there are multiple sets of keys between the core network element and the terminal device 1, and the key identifier can be accurately determined in the AS SMC process.
  • the key determined by the key identifier may be a set of keys or a specific key, which is not limited herein. If a set of keys is determined, the core network element can directly use one of a set of keys as the base key or as the key of the AS SMC process; or use one of the keys to further obtain the basis. Key, or key used for the AS SMC process. For example, if the value of the key identifier is 001, it means that one of the keys identified by the two parties using the 001 key, or a key of the set of keys is further derived from the key protection AS SMC message. .
  • the indication information may be bit position indication information or a character string.
  • the indication information can become a notification of display, and the method of carrying the basic key or other information can also be called implicit notification.
  • a possible implementation method may be: the indication information is 0, 1 bit indicating information. That is, 0 means that the AS SMC process does not need to be triggered. 1 indicates that the AS SMC process needs to be triggered.
  • the indication information may be used to indicate three different contents, that is, the AS SMC process needs to be triggered, the AS SMC process is triggered, and the AS SMC process does not need to be triggered. If the content indicated by the indication information is that the AS SMC process needs to be triggered, the access network element A must trigger the AS SMC process; if the content indicated by the indication information is a suggestion triggering the AS SMC process, the access network element may select to trigger. The AS SMC process may also choose not to trigger the AS SMC process; if the indication information indicates that the AS SMC process does not need to be triggered, the access network element A selects not to trigger the AS SMC process.
  • the indication information can occupy 2 bits, for example, 00 means no trigger is needed, 01 means trigger is needed, and 10 means suggestion trigger.
  • the indication information may also be composed of a plurality of character strings. For example, “not needed” indicates that no trigger is required, “required” indicates that a trigger is required, and “prefered” indicates a recommended trigger.
  • the specific form of the indication information is not limited herein.
  • mMTC mass machine type of communication m
  • URLLC ultra reliable low latency communication
  • eMBB enhanced mobile broadband
  • the type of the terminal device may also include other types, and may be classified into other types according to other factors, and is not limited herein.
  • the core network element may obtain the type of the terminal device 1 by using various methods.
  • the subscription information may be used to know what kind of device the terminal is, or the terminal device 1 may also report that it is when accessing the network. What kind of equipment is given to the core network element.
  • the present invention does not limit the specific method of knowing the type of the terminal device 1 of the core network element.
  • the delay may be a specific delay of the service requirement that the terminal device 1 needs to perform.
  • the delay may be 0.5 s or 1 s, etc., that is, the network delay may not be 0.5 s or 1 s.
  • the delay may also be an indication information indicating a level of delay required by the terminal device 1, for example, the access network element A and the core network element have a delay of 0-1s (including 0s and 1s) are low-level, delays are in the range of 1-2s (including 1s and 2s), and delays are in the range of 2-3s (including 2s and 3s) for high-level, if terminal equipment
  • the delay of 1 is 0.5 s
  • the level of delay of the terminal device 1 is a low level.
  • the network element of the core network can obtain the acceptable delay value required by the terminal device in multiple ways, for example, through subscription information acquisition, or through other core network element, or through the terminal device 1 itself.
  • Access to information For example, the information is obtained from the AMF subscription information, or the SMF function obtains the delay information of the UE from the PCF or the subscription information, and then the SMF function can inform the core network device whether the AS SMC process is required, or notify the core network device whether the AMG function is needed by the AMF function.
  • the AS SMC process, or the SMF function informs the AMF, and then the AMF itself determines whether the access network device needs the AS SMC process.
  • the access network element currently accessed by the terminal device 1 is the access network element A
  • the deployment environment of the access network element currently accessed by the terminal device 1 is the access network.
  • the deployment environment of the meta-A for example, the deployment environment may be a desert environment or a residential area or a business area.
  • the deployment environment can also be used to describe the probability that the deployment environment where the access network element A is located is attacked by a third party.
  • the third party can serve the user or a request for service.
  • the deployment environment of the access network element A is desert.
  • the environment indicates that the probability of the access network element A being attacked by a third party is low, or the deployment environment of the access network element A is a business area, indicating that the probability of the access network element A being attacked by a third party is high. No restrictions.
  • the other information may be the result of the determination in step 302, that is, after the core network element performs step 302, the core network element may use the determination result of step 302 as one of the seven types of information. Or multiple types are carried in the first message and sent to the access network element A. Specifically, the core network element determines whether the AS SMC process needs to be in a one-to-one correspondence with the other information in the first message, that is, whether the core network element uses the method to determine whether the AS SMC needs to be performed.
  • the flow, the other information in the first message may be one or more of the seven types of information included in the foregoing first message. For example, the core network element determines the need to perform the AS SMC process in the first manner, and the first message is used.
  • the information of the (1) type that is, the key used to perform the AS SMC process
  • the information (4) that is, the indication information
  • the first message may be directly
  • the information of the (6) type is used to notify the access network element A of the determination result, which is not limited in the embodiment of the present application.
  • the third form the first message only contains information for the access network element A to determine whether it is necessary to trigger the AS SMC process with the terminal device 1, in which case the first message is initial with the one shown in FIG.
  • a security context setup request message can be understood as two different messages.
  • the information used by the access network element A to determine whether to trigger the AS SMC process with the terminal device 1 is considered to be the same as the other information in the second form, and reference may be made to the related description in the second form. Let me repeat.
  • Step 308 The access network element A determines, according to the first message, whether the second message needs to be sent to the terminal device 1.
  • the second message is used to trigger the terminal device 1 to perform an access layer security mode command AS SMC process.
  • the second message may be an AS SMC message as shown in FIG. 1 , and may of course be an activated other type of message with security protection function, which is not limited in the embodiment of the present application.
  • the core network element informs the access network element A of its own determination result, and the result of whether the access network element A complies with the core network element is determined according to different conditions.
  • the access network element A may be determined to comply with the decision of the core network element, and the access network element A may be determined according to the content in the first message;
  • the current situation is determined together with the content in the first message, or the access network element A re-determines according to its current situation.
  • the behavior of the access network element is also affected by different regulations.
  • the access network device A is required to comply with the decision of the core network element, but when the access network element A cannot satisfy its decision, the access network The device should reject this access.
  • the access network element A must comply with the decision of the core network element and the access network element A is determined according to its current situation and the content of the first message.
  • the first implementation manner is as follows: the access network element A determines whether the second message needs to be sent to the terminal device 1 according to the content in the first message, that is, if the core network element determines that the AS SMC process needs to be performed, the access is performed. Network element A determines that the AS SMC process needs to be performed.
  • the first message may have the foregoing three forms, in this case, the first message is the second form or the third form of the foregoing three forms, that is, the first message needs to be included.
  • the access network element A determines whether it is necessary to trigger the information of the AS SMC process with the terminal device.
  • the access network element A determines that the first message includes a key or a basic root key KgNB or a key identifier for performing an AS SMC process, indicating that the core
  • the network element determines that the AS SMC process needs to be performed, and the access network element A determines that the AS SMC process needs to be performed.
  • the access network element A determines that the first message includes indication information for indicating whether the AS SMC process needs to be triggered, and the access network element A according to the The content of the indication information determines whether an AS SMC process is required.
  • the indication information is 1 bit, and the access network element A can be agreed with the core network element.
  • the AS SMC process is not required.
  • the indication information is 1, it indicates that the AS needs to be performed.
  • the indication information when the indication information is 1, it indicates that the core network element determines that the AS SMC process needs to be performed, and the access network element A determines that the AS SMC process needs to be performed.
  • the access network element A determines the type of the terminal device 1 included in the first message, and the access network element A determines whether the terminal device 1 is based on the type of the terminal device 1
  • the AS SMC process is required.
  • the network element A of the access network can be agreed with the network element of the core network.
  • the type of the terminal device 1 is eMBB, it indicates that the AS SMC process needs to be performed. Otherwise, if the AS SMC process is not required, the access network element is used.
  • A determines that the type of the terminal device 1 in the first message is the eMBB type, indicating that the core network element determines that the AS SMC process needs to be performed, and the access network element A determines that the AS SMC process needs to be performed.
  • the access network element A determines that the first message includes a delay, and the access network element A determines whether the AS SMC process needs to be performed according to the delay. For example, the access network element A can be agreed with the core network element. If the delay is less than 1 s, the AS SMC process is not required. Otherwise, the AS SMC process is required. In this way, when the access network element A determines that the delay in the first message is 1.5s, indicating that the core network element determines that the AS SMC process needs to be performed, the access network element A determines that the AS SMC process needs to be performed.
  • the access network element A determines that the first message includes a deployment environment of the access network element currently accessed by the terminal device 1, and the access network element A depends on whether the AS SMC process needs to be performed in the deployment environment. For example, the access network element A can be bound to the core network element. When the deployment environment is in a desert environment, the AS SMC process is not required. Otherwise, the AS SMC process is required. In this way, when the access network element A determines that the deployment environment in the first message is a business area, indicating that the core network element determines that the AS SMC process needs to be performed, the access network element A determines that the AS SMC process needs to be performed.
  • the core network element may pre-inform with the access network element A what information is intended to be used, so that when the access network element A receives the first message, The corresponding information may be directly extracted from the first message, so that the access network element A does not need to determine from the first message what kind of information is sent by the core network element.
  • the core network element can often obtain more and more comprehensive information about the terminal device 1, it can judge whether the AS SMC process is needed from a multi-faceted and full-dimensional perspective to ensure the accuracy of the judgment result. Further, the core network element notifies the network element A of the access network by the UE status, the determination result, the indication information, etc., so that the access network element A can directly comply with the judgment of the core network element. The decision of the access network element A can be made simpler, more convenient and more intuitive.
  • the access network element A can determine, according to a preset priority order, which information is used to determine whether the AS SMC process needs to be performed.
  • the preset priority order may be that the type of the terminal device 1 has a higher priority than the terminal device. 1
  • the priority of the delay required by the service to be performed is determined by the access network element A using only the type of the terminal device 1.
  • it can be determined in other manners, and is not limited in the embodiment of the present application.
  • the second implementation manner is: the access network element A determines whether the second message needs to be sent to the terminal device 1 according to the content in the first message and the preset policy.
  • the preset policy may be a policy provided by an operator, or may be a policy obtained by the access network element A from the core network element, or may be an access network element A according to the specific Information is configured locally.
  • the preset policy can be static. That is, after the network element A of the access network configures the preset policy for the first time, the preset policy will not be changed.
  • the policy may also be dynamic, that is, the preset policy may change, for example, the policy used by the access network element A to determine whether the AS SMC process needs to be performed for the first time.
  • the secondary usage policy is different.
  • the preset network policy is that the access network element A obtains from the core network element before each judgment, and the core network element sends the network element to the access network element. A's strategy may change as the state of the network changes.
  • the AS SMC process may be determined according to the content in the first message and the preset policy.
  • the access network element A After receiving the first message, the access network element A obtains the terminal device.
  • the related information of the terminal device 1 is determined by the information of the terminal device 1 and the information of the terminal device 1 carried in the first message, for example, the type of the terminal device 1 is eMBB type, and the type is determined.
  • the judgment result determined according to the preset policy is that the AS SMC process needs to be performed.
  • the preset policy may be other content.
  • details refer to the content in multiple possible implementation manners in the first mode of step 308, and details are not described herein again.
  • the first message is the second form or the third form of the foregoing three forms
  • the access network element A determines whether to perform the AS SMC process according to the preset policy and the first message.
  • the method may be: if the determination result determined according to the preset policy is the same as the determination result indicated in the first message, it is determined that the AS SMC process needs to be performed, otherwise the AS SMC process is determined not to be performed. If the type of the terminal device is eMBB, the AS SMC process is required. Otherwise, the AS SMC process is not required.
  • the core network NE indicates that the AS SMC process is required.
  • the access network element A when the access network element A receives the first message, the information about the terminal device 1 acquired by the PCF entity or the information of the terminal device 1 carried in the first message is obtained by acquiring the related information of the terminal device 1. Determining the type of the terminal device 1, for example, the type of the terminal device 1 is an eMBB type, and determining that the determination result according to the preset policy is that the AS SMC process needs to be performed, because the determination result indicated by the first message is that the AS SMC needs to be performed. In the process, the access network element A finally determines that the AS SMC process needs to be performed.
  • the priority of the determination result determined according to the preset policy and the determination result indicated in the first message may be set, and the access network element A determines whether the AS needs to be performed according to the information with high priority level.
  • the SMC process is such that the access network element A can select the method to determine whether the AS SMC process needs to be performed according to the actual situation.
  • the access network element A can determine whether the AS SMC process needs to be performed according to the preset policy, and improve the flexibility of the access network element A.
  • Step 309 If it is determined, the access network element A sends the second message to the terminal device 1, and the terminal device 1 receives the second message.
  • the second message is received.
  • the key identifier may be carried in the first message received by the network element A of the access network, and the access network element A determines the use of the AS SMC process according to the first message.
  • a key identifier may be generated and carried in the second message.
  • the second message may include other content, which is not limited herein.
  • the access network element A can determine the key or base key used by the terminal device 1 to perform the AS SMC process according to the first message.
  • the access network element A can store the key, and the subsequent use of the AS SMC process with the terminal device 1 is used. For example, when the access network element A needs to send the RRC message to be protected to the terminal device 1 At that time, the stored key can be used for protection or further derived keys for protection.
  • the access network element A does not use the key for a period of time, or determines according to a preset policy that the key is not used, or when the terminal device 1 becomes idle, the access network element A also This key can be deleted.
  • the access network element A can save the content of the UE except the location information, and access the network element A.
  • the key corresponding to the UE can be stored all the time.
  • the access network element A can directly discard the key.
  • the access network element A can be processed according to the actual situation, and is not limited herein.
  • Step 310 The terminal device 1 sends a fifth message to the access network element A, and the access network element A receives the fifth message.
  • Step 310 is the same as the corresponding step in FIG. 1, and details are not described herein again.
  • step 306 the technical solution described in the embodiment of the present application is described by taking the steps 301 to 310 as an example.
  • the technical solution in the embodiment of the present application may also include other steps, for example, Other steps and the like may be added between step 306 and step 302, which are not limited herein.
  • the access network element may trigger an activation process of the security protection function with the terminal device.
  • the access network element has some important content that needs to be sent to the terminal device or needs to be negotiated with the terminal device. Security protection, but the terminal device does not know the requirements of the access network element. In this case, the access network element can actively trigger the activation process of the security protection function with the terminal device.
  • the information transmission method in the case is introduced.
  • FIG. 4 is a flowchart of another information sender according to an embodiment of the present application.
  • the flowchart is as follows:
  • Step 401 The access network element sends a third message to the core network element, and the core network element receives the third message.
  • the description of the access network element and the core network element is the same as that of the embodiment shown in FIG. 3A to FIG. 3C, and details are not described herein again.
  • the core network will be used.
  • the element is described by taking the access network element A as an example.
  • the third message is used to request a parameter for triggering the key activation process
  • the key activation process is the same as the key activation process in the embodiment shown in FIG. 3A to FIG. 4, and details are not described herein again.
  • the key activation process is used as the AS SMC process.
  • the parameters of the key activation process are the parameters of the AS SMC process. That is, the access network element A can trigger the AS SMC process. However, when there is no necessary parameter (for example, a key), the first message is actively requested from the core network element.
  • the access network element A needs to interact with the terminal device 1 for radio resource control (RRC) signaling, and the RRC signaling needs to be sent only when it is protected, but the access network element does not have
  • RRC radio resource control
  • the access network element A After receiving the first message sent by the core network element or the access network element A does not store the basic root key KgNB used when the terminal device 1 performs the AS SMC process, the access network element A actively sends the core network to the core network. The meta sends the third message.
  • the access network element A can send a message requiring security protection to the terminal device 1 at any time, thereby improving the flexibility of security verification.
  • the access network element A can store the basic root key KgNB of the AS SMC process with the terminal device 1, for example, The inactive process is saved, so that when the terminal device 1 changes from the idle state to the connected state of the access network element A, the access network element A can start the AS SMC process again according to the stored basic root key KgNB.
  • the access device network element A can delete the base of the AS SMC process with the terminal device 1 when the terminal device 1 changes from the connected state to the idle state.
  • the root key KgNB such that when the terminal device 1 becomes the connected state again, the access network element A needs to re-acquire the KgNB.
  • the access network element A can actively send to the core network element.
  • This third message requests KgNB.
  • the request may be sent to the core network element along with other messages, such as the fourth message, or other N2 messages, or may be separately sent to the core network element.
  • the third message sent by the access network element A to the core network element may also carry the identification information of the terminal device 1, for example, the user permanent identifier of the terminal device 1 (subcriber permanent UE) Identity, SUPI), globally unique temporary UE identity (GUTI), or an index number provided by a certain core network element, so that when the core network element receives the third message, it will communicate with the terminal.
  • the key of the AS SMC process corresponding to the device 1 is notified to the access network element A.
  • step 401 is an optional step, that is, it is not necessary to perform. That is, if the access network element A stores the parameters for triggering the AS SMC process with the terminal device 1, for example, the key of the AS SMC process or the base root key KgNB, the steps may not be performed. 401, or the access network element A can also obtain the parameters for triggering the AS SMC process with the terminal device 1 by other means, which is not limited herein.
  • Step 402 The core network element and the terminal device 1 perform authentication.
  • Step 403 The core network element sends a NAS SMC message to the terminal device 1, and the terminal device 1 receives the NAS SMC message.
  • Step 404 The terminal device 1 activates NAS security according to the NAS SMC message.
  • Step 405 The terminal device 1 sends a NAS SMP message to the core network element, and the core network element receives the NAS SMP message and activates the NAS security.
  • Step 402-step 405 is the same as step 303-step 306, and details are not described herein again. Steps 402 to 405 are optional steps, which are not necessarily performed. After the core network element receives the third message sent by the network element A of the access network, the authentication and NAS layer security may be performed through steps 402-405. In the verification process, the verification process of step 402 to step 405 may not be performed, and is not limited herein.
  • Step 406 The core network element determines whether the terminal device 1 needs to perform an access layer security mode command AS SMC process.
  • the core network element may determine whether the terminal device 1 needs to perform an AS SMC process.
  • the core network element can determine the type of the terminal device 1, and determine whether the AS SMC process needs to be performed by using the type of the terminal device 1; or the core network element can be based on receiving the third message.
  • the QoS information obtained from other core network elements determines whether the AS SMC process needs to be performed.
  • the core network element can obtain the status information of the access network element currently accessed by the terminal device 1 from itself or other network elements.
  • Step 406 is the same as step 302, and details are not described herein.
  • step 406 is an optional step, that is, it is not necessary to perform.
  • step 406 and step 402-step 405 the execution sequence between step 406 and step 402-step 405, the number of executions of step 406, and the indication timing of the determination result in step 406 are the same as step 302 and step 303-step 306, and Let me repeat.
  • Step 407 The core network element sends a first message to the access network element A, and the access network element A receives the first message.
  • Step 408 The access network element A determines, according to the first message, whether a second message needs to be sent to the terminal device 1.
  • Step 409 If it is determined, the access network element A sends the second message to the terminal device 1, and the terminal device 1 receives the second message.
  • Step 410 The terminal device 1 sends a fifth message to the access network element A, and the access network element A receives the fifth message.
  • Step 407 - Step 410 is the same as Step 307 - Step 310, and details are not described herein again.
  • the core network element or the access network element may first determine whether the activation process of the security protection function needs to be performed according to the actual situation, and trigger the activation process of the security protection function with the terminal device when the determination is needed. If it is determined that it is not required, the activation process is not directly performed, so that signaling resource waste and delay caused by the single execution of the activation process in the 4G system can be avoided, and further, before performing the activation process.
  • the way of judgment makes the system adopt different processing methods for different system requirements, which can improve the flexibility of the system.
  • the process of generating a key for performing an activation process of the security protection function by the core network element and indicating the key to the access network element is introduced.
  • the process is performed between the access network element and the terminal device. Therefore, in order to simplify the computational complexity of the core network element, in another manner, the key may also be generated by the access network element.
  • FIG. 7 is a flowchart of a method for generating a key according to an embodiment of the present application. The method is applied to the system shown in FIG. 2 as an example. The description of the flowchart is as follows:
  • Step 501 The access network element acquires the first input information and the second input information.
  • the first input information is information used by the terminal device to generate a target key, where the target key is a key for performing a key activation process, and the key activation process is as shown in FIG. 3A to FIG. 4 .
  • the key activation process in the embodiment is the same, and is not described here.
  • the security verification is the AS SMC process.
  • the key of the key activation process is the key of the AS SMC process.
  • the input information is information used by the access network element to generate the target key.
  • the key generation method described in FIG. 5 is the same as the application scenario of the embodiment in FIG. 3A to FIG. 4 .
  • the access network element is continued as the access network element A.
  • the terminal device is an example of the terminal device 1 as an example.
  • the key for performing the AS SMC process is the same as the key for performing the AS SMC process in the embodiment shown in FIG. 3A to FIG. 4 , and details are not described herein again.
  • the first input information may be a generated material used by the terminal device 1 to generate the key, for example, a random number 1.
  • the second input information may be used by the access network element A to generate the key.
  • the random number is 2.
  • the first input information and the second input information may also be other content, which are not limited herein.
  • the manner in which the access network element A obtains the first input information and the second input information may be multiple.
  • the access network element A obtains the first input information and the access network element.
  • A obtains the second input information for explanation.
  • the first mode the access network element A obtains the second input information from the core network element.
  • the access network element A may request the second network input information from the core network element. If the second input information is stored in the core network element, the core network element performs the second The input information is sent to the access network element A.
  • the core network element may send the material and/or algorithm used to generate the second input information.
  • the access network element A may generate second input information according to the material and/or algorithm used to generate the second input information.
  • the material used to generate the second input information is security capability information of the terminal device 1
  • the security capability information may include an encryption rule supported by the terminal device 1, a rule for performing integrity protection, and capability level information of the terminal device 1.
  • the content included in the security capability information is not limited in the embodiment of the present application.
  • the security capability information of the terminal device 1 is carried in the request message, and the core network element obtains the terminal device 1 from the request message.
  • the security capability information when the access network element A requests the core network element to obtain the second input information, the core network element sends the security capability information of the terminal device 1 to the access network element A, the access network.
  • the network element A generates second input information according to the security capability information.
  • the second mode the access network element A obtains the second input information according to the information stored by itself.
  • the access network element A can obtain the second input information according to preset information.
  • the access network element stores a plurality of available keys, and each key has an identification information, such as an index number, and the access network element A generates a random number, or the access network element A utilizes
  • the symmetric key mechanism generates an intermediate parameter, participates in the calculation of the intermediate parameter, and obtains the index number of the target key, thereby obtaining the target key.
  • the third mode the access network element A obtains the second input information according to the information contained in the radio resource control RRC signaling of the terminal device 1.
  • the access network element A first receives the first radio resource control RRC signaling sent by the terminal device 1, and the first RRC signaling may send the registration request message to the core network element by the terminal device 1 or
  • the bearer signaling of the service request message the terminal device 1 carries its security capability information in the RRC signaling.
  • the request message includes two layers, the first layer is the RRC layer, and the second layer is the NAS layer.
  • the NAS layer is higher than the RRC layer, and the security capability information can be carried in both the RRC layer and the NAS layer of the request message.
  • the request message needs to be forwarded by the access network element A to the core network element.
  • the access network element A obtains the request message sent by the terminal device 1 to the core network element, and obtains the RRC from the request message.
  • the layer data that is, the first RRC signaling
  • the access network element A obtains the security capability information of the terminal device 1 from the first RRC signaling, and generates the second according to the security capability information of the terminal device 1 Enter information.
  • the first RRC signaling may also be other RRC signaling independent of the bearer registration request message or the service request message sent to the core network element.
  • the access network element A may send a request to the terminal device 1 to obtain security.
  • the RRC signaling of the capability information, and then the terminal device 1 feeds back the security capability information to the access network element A through the first RRC signaling, where the first RRC signaling is specifically used for carrying the security capability information of the terminal device 1.
  • the first RRC signaling may also be in other forms, which is not limited herein.
  • the access network element A can request the security capability information of the terminal device 1 from the core network element, and the signaling overhead can be reduced.
  • the first mode the access network element A obtains the first input information from the core network element.
  • the access network element A may request the core network element to obtain the first input information. If the first input information of the terminal device 1 is stored in the core network element, the core network element The first input information is sent to the access network element A; if the first input information of the terminal device 1 is not stored in the core network element, the core network element can obtain the first input by interacting with the terminal device 1 The information is then sent to the access network element A.
  • the terminal device 1 may send a registration request message or a service request message to the core network element, and the first input information of the terminal device 1 is carried in the registration request message or the service request message, and the core network element receives the registration request.
  • the first input information is obtained in the message or the service request message, and the first input information is sent to the access network element A.
  • the core network element sends the first input information to the access network element A.
  • the first input information is carried in the NAS signaling such as the registration request and the session request, and the core network element obtains the first input information from the NAS signaling, and the core network element then sends the first input information to the access network. Yuan A.
  • the second mode the access network element A obtains the first input information from its own storage unit.
  • the first input information of the terminal device 1 is pre-stored in the access network element A.
  • the terminal device 1 performs data interaction with the access network element A before the current time.
  • the data is the data to be protected, and then the terminal device 1 changes from the connected state to the third state, such as the inactive state.
  • the access network element A wants to perform data interaction with the terminal device 1 again.
  • the first input information of the terminal device 1 is also stored in the network element A, and the access network element A directly obtains the first input information from its own storage unit.
  • the third mode the access network element A obtains the first input information by using radio resource control RRC signaling.
  • the access network element A first receives the second radio resource control RRC signaling sent by the terminal device 1, and the second RRC signaling may send the registration request message to the core network element of the terminal device 1 or The service request message, the terminal device 1 carries its first input information in the request message.
  • the second RRC signaling and the first RRC signaling are the same RRC signaling, that is, in the first RRC.
  • the signaling capability or the second RRC signaling carries the security capability information of the terminal device 1 and the first input information, and then the access network element A obtains the first input information from the RRC signaling.
  • the second RRC signaling may also be RRC signaling different from the first RRC signaling.
  • the access network element A may obtain the first input information from the AS SMP message, or access the network element. The A sends the RRC signaling requesting the first input information to the terminal device 1, and then the terminal device 1 feeds back the first input information to the access network element A through the second RRC signaling, where the second RRC signaling is Signaling dedicated to carrying the first input information.
  • the second RRC signaling may also be in other forms, which is not limited herein.
  • the fourth mode the access network element A obtains the first input information through a preset process.
  • the method for the access network element A to obtain the first input information includes the following steps:
  • Step 601 The access network element A sends a third message to the terminal device 1, and the terminal device 1 receives the third message.
  • the third message is a message signed by a public key, and the public key is pre-configured in the access network element A.
  • the third message may specifically be a message for performing an AS SMC process, for example, an AS SMC message or the like.
  • public key may also be replaced by a certificate or other information for integrity protection of the message, which is not limited herein.
  • Step 602 The terminal device 1 verifies the signature of the third message by using the public key.
  • the public key may be pre-configured in the terminal device 1 or may be obtained by the terminal device 1 from the access network element A in advance, or may be obtained by other means, and is not limited herein.
  • the terminal device 1 uses the public key to verify the signature of the third message.
  • the specific verification process is the same as the verification process in the prior art, and details are not described herein.
  • Step 603 The signature of the third message is correct, and the terminal device 1 generates a target key according to the parameter in the third message and the first input information.
  • the target key is the key activated by the AS SMC process, that is, after the terminal device 1 completes the AS SMC process, the target message is used to protect the subsequent message.
  • the manner in which the terminal device 1 generates the target key is as follows:
  • the third message includes the second input information used by the access network element A to generate the target key, and the terminal device 1 generates the target key according to the second input information and the first input information.
  • the terminal device 1 stores in advance a plurality of algorithms for generating the target key, and the terminal device 1 selects an algorithm from which the first input information and the second input information are calculated to obtain the target key.
  • the third message includes the second input information and an algorithm for generating the target key
  • the terminal device 1 generates the target key according to the algorithm, the first input information, and the second input information.
  • Step 604 The terminal device 1 sends a fourth message to the access network element A, and the access network element A receives the fourth message.
  • the fourth message performs integrity protection processing by using the target key, and the fourth message includes the first input information.
  • the fourth message may be a message for feeding back the third message, for example, may be an AS SMP message or the like.
  • the third message is a message for performing the AS SMC process
  • the AS security may be activated according to the third message, and the process of specifically activating AS security is in the prior art. The same, no longer repeat here.
  • Step 605 The access network element A obtains the first input information from the fourth message.
  • the access network element A may obtain the second input information by using any one of multiple manners in a), and may obtain the first type by using any one of multiple manners in b).
  • An input information that is, a manner in a) and b) may be arbitrarily combined.
  • the second input information is obtained by using the first method in a), and the first input is obtained by using the second method in b).
  • the information is input, or the second input information is obtained by using the third method in a), and the first input information is obtained by using the first method in b), which is not limited herein.
  • the order in which the access network element A obtains the first input information and obtains the second input information is not restricted, that is, the access network element A may obtain the first input information first. After acquiring the second input information, the second input information may be acquired first to obtain the first input information, and the first input information and the second input information may be acquired at the same time.
  • the access network element A needs to pass the second input information, For example, as described in the first two cases in step 603, the access network element A needs to acquire the second input information to obtain the first input information.
  • Step 502 The access network element A generates the target key according to the first input information and the second input information.
  • Step 502 is the same as step 603, and details are not described herein again.
  • the method in the embodiment of the present application may further include:
  • Step 503 The access network element A sends the first message to the terminal device 1.
  • the first message is integrity protected by the target key and/or encrypted using the target key.
  • the form of the first message and the content of the first message are the same as the third message in step 601.
  • Step 503 is the same as step 601, and details are not described herein again.
  • Step 504 The terminal device 1 generates the target key according to the first message and the first input information.
  • the first message is integrity protected by the public key, and the terminal device 1 uses the public key to verify the signature of the first message.
  • step 504 is the same as step 602. , will not repeat them here.
  • the target key is generated by using the second input information and the first input information in the first message.
  • the first message is encrypted by using the public key
  • the terminal device 1 uses the public key to decrypt the first message, and if the decoding succeeds, the second input information in the first message is used. And the first input information generates the target key.
  • Step 505 The terminal device 1 sends a second message to the access network element A, and the access network element A receives the second message.
  • the second message performs integrity protection processing by using the target key.
  • the second message is the same as the fourth message in step 604, and details are not described herein again.
  • Step 506 The access network element A uses the target key to verify the second message. When the verification succeeds, the AS SMC process is completed.
  • the access network element A can only obtain the information in the second message but cannot change the second message. Therefore, if the access network is accessed When the element A successfully cancels the integrity protection process for the second message by using the target key generated by itself, the verification succeeds, and the AS SMC process is completed.
  • the access network element A will obtain Third input information, in this case, the key generated by the access network element A according to the third input information and the second input information is necessarily the key generated by the terminal device 1 according to the first input information and the second input information.
  • the access network element A receives the second message, the integrity protection processing of the second message cannot be cancelled, that is, the verification fails, and the AS security cannot be activated.
  • the first input information is information actually received by the access network element A, and the first input information may be used by the terminal device 1 to generate input information actually used by the target key. The same can be different from the input information that the terminal device 1 actually uses to generate the target key.
  • the method in the embodiment of the present application may further include:
  • Step 507 The access network element A uses the target key to verify the fourth message. When the verification succeeds, the AS SMC process is completed.
  • the process of verifying the fourth message by using the target key by the access network element A is the same as the process of verifying the second message by using the target key in the access network element A in step 506, and no longer Narration.
  • the access network element may directly generate a key for performing the key activation process according to the first input information and the second input information, so that the activation of the security protection function of the access network element may be It is determined by the access network element itself, without relying on the core network element, which makes the security negotiation between the access network element and the terminal device more flexible.
  • the method provided by the embodiment of the present application is introduced from the perspective of interaction between the network device, the terminal device, and the network device and the terminal device.
  • the network device and the terminal device may include a hardware structure and/or a software module, and implement the foregoing functions in the form of a hardware structure, a software module, or a hardware structure plus a software module.
  • One of the above functions is performed in a hardware structure, a software module, or a hardware structure plus a software module, depending on the specific application and design constraints of the technical solution.
  • FIG. 8 shows a schematic structural view of a device 800.
  • the device 800 can be an access network element, and can implement the function of accessing the network element in the method provided by the embodiment of the present application.
  • the device 800 can also support the access network element to implement the method provided by the embodiment of the present application.
  • Device 800 can be a hardware structure, a software module, or a hardware structure plus a software module.
  • Device 800 can be implemented by a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • Apparatus 800 can include a receiving module 801 and a determining module 802.
  • the receiving module 801 can be used to perform step 307 in the embodiment illustrated in Figures 3A-3C, or step 407 in the embodiment illustrated in Figure 4, and/or other processes for supporting the techniques described herein.
  • the receiving module 801 is for the device 800 to communicate with other modules, which may be circuits, devices, interfaces, buses, software modules, transceivers, or any other device that can implement communications.
  • the determination module 802 can be used to perform step 308 in the embodiment illustrated in Figures 3A-3C, or step 408 in the embodiment illustrated in Figure 4, and/or other processes for supporting the techniques described herein.
  • FIG. 9 shows a schematic structural view of a device 900.
  • the device 900 can be a core network element, which can implement the function of the core network element in the method provided by the embodiment of the present application.
  • the device 900 can also support the core network element to implement the core network in the method provided by the embodiment of the present application.
  • the device 900 can be a hardware structure, a software module, or a hardware structure plus a software module.
  • Device 900 can be implemented by a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • Apparatus 900 can include a communication module 901 and a determination module 902.
  • the communication module 901 can be used to perform any one of steps 301, 303, 304, 306, and 307 in the embodiment shown in FIGS. 3A-3C, or steps 401, 402 in the embodiment shown in FIG. Any of steps 403 and 407, and/or other processes for supporting the techniques described herein.
  • Communication module 901 is for device 900 to communicate with other modules, which may be circuits, devices, interfaces, buses, software modules, transceivers, or any other device that can implement communication.
  • the determination module 902 can be used to perform step 302 in the embodiment illustrated in Figures 3A-3C, or step 406 in the embodiment illustrated in Figure 4, and/or other processes for supporting the techniques described herein.
  • FIG. 10 shows a schematic structural view of a device 1000.
  • the device 1000 can be a terminal device, and can implement the function of the terminal device in the method provided by the embodiment of the present application.
  • the device 1000 can also be a device that can support the terminal device to implement the function of the terminal device in the method provided by the embodiment of the present application.
  • the device 1000 can be a hardware structure, a software module, or a hardware structure plus a software module.
  • Device 1000 can be implemented by a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • Apparatus 1000 can include a communication module 1001 and a determination module 1002.
  • the communication module 1001 can be used to perform step 505 in the embodiment shown in FIG. 5, or step 604 in the embodiment shown in FIG. 6, and/or other processes for supporting the techniques described herein.
  • the communication module 1001 is for the device 1000 to communicate with other modules, which may be circuits, devices, interfaces, buses, software modules, transceivers, or any other device that can implement communication.
  • the determination module 1002 can be used to perform step 504 in the embodiment illustrated in FIG. 5, or step 602 or step 603 in the embodiment illustrated in FIG. 6, and/or other processes for supporting the techniques described herein.
  • FIG. 11 shows a schematic structural view of a device 1100.
  • the device 1100 can be a terminal device, and can implement the function of accessing the network element in the method provided by the embodiment of the present application.
  • the device 1100 can also support the access network element to implement the method in the method provided by the embodiment of the present application.
  • the device 1100 can be a hardware structure, a software module, or a hardware structure plus a software module.
  • Device 1100 can be implemented by a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • the device 1100 can include a communication module 1101 and a determination module 1102.
  • the communication module 1101 can be used to perform step 503 in the embodiment shown in FIG. 5, or step 601 in the embodiment shown in FIG. 6, and/or other processes for supporting the techniques described herein.
  • the communication module 1101 is for the device 1000 to communicate with other modules, which may be circuits, devices, interfaces, buses, software modules, transceivers, or any other device that can implement communication.
  • the determining module 1102 can be used to perform any one of step 501, step 502, and step 506 in the embodiment shown in FIG. 5, or step 605 in the embodiment shown in FIG. 6, and/or to support this document. Other processes of the described techniques.
  • each functional module in each embodiment of the present application may be integrated into one processing. In the device, it can also be physically existed alone, or two or more modules can be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the device 1200 is provided in the embodiment of the present application.
  • the device 1200 may be the access network element in the embodiment shown in FIG. 3A to FIG.
  • the device 1200 can also be a device that can support the access network element to implement the function of accessing the network element in the method provided by the embodiment of the present application.
  • the device 1200 can be a chip system.
  • the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • the device 1200 includes at least one processor 1220 for implementing or for supporting the device 1200 to implement the function of the access network element in the method provided by the embodiment of the present application.
  • the processor 1220 may determine, according to the first message, whether a second message for triggering the terminal device to perform the key activation process needs to be sent to the terminal device.
  • a second message for triggering the terminal device to perform the key activation process needs to be sent to the terminal device.
  • Apparatus 1200 can also include at least one memory 1230 for storing program instructions and/or data.
  • Memory 1230 is coupled to processor 1220.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in an electrical, mechanical or other form for information interaction between devices, units or modules.
  • Processor 1220 may operate in conjunction with memory 1230.
  • Processor 1220 may execute program instructions stored in memory 1230. At least one of the at least one memory may be included in a processor.
  • the device 1200 can also include a communication interface 1210 for communicating with other devices over a transmission medium such that devices for use in the device 1200 can communicate with other devices.
  • the other device may be a terminal device.
  • the processor 1220 can transmit and receive data using the communication interface 1210.
  • connection medium between the communication interface 1210, the processor 1220, and the memory 1230 is not limited in the embodiment of the present application.
  • the memory 1230, the processor 1220, and the communication interface 1210 are connected by a bus 1240 in FIG. 12, and the bus is indicated by a thick line in FIG. 12, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 12, but it does not mean that there is only one bus or one type of bus.
  • the processor 1220 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component. Or the methods, steps, and logic blocks disclosed in the embodiments of the present application are executed.
  • a general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the memory 1230 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • a non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • RAM random access memory
  • a memory is any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function for storing program instructions and/or data.
  • the device 1300 is provided in the embodiment of the present application.
  • the device 1300 can be a core network element, and can implement the function of the core network element in the method provided by the embodiment of the present application.
  • the device 1300 can also support The core network element implements the function of the core network element in the method provided by the embodiment of the present application.
  • the device 1300 can be a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • the device 1300 includes at least one processor 1320 for implementing or for supporting the device 1300 to implement the functions of the core network element in the method provided by the embodiment of the present application.
  • the processor 1320 may determine whether the terminal device needs to perform a key activation process.
  • Apparatus 1300 can also include at least one memory 1330 for storing program instructions and/or data.
  • Memory 1330 is coupled to processor 1320.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in an electrical, mechanical or other form for information interaction between devices, units or modules.
  • Processor 1320 may operate in conjunction with memory 1330.
  • the processor 1320 may execute program instructions stored in the memory 1330. At least one of the at least one memory may be included in a processor.
  • the apparatus 1300 can also include a communication interface 1310 for communicating with other devices via a transmission medium such that devices for use in the device 1300 can communicate with other devices.
  • the other device may be a terminal device.
  • the processor 1320 can transmit and receive data using the communication interface 1310.
  • connection medium between the communication interface 1310, the processor 1320, and the memory 1330 is not limited in the embodiment of the present application.
  • the memory 1330, the processor 1320, and the communication interface 1310 are connected by a bus 1340 in FIG. 13, and the bus is indicated by a thick line in FIG. 13, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the processor 1320 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component. Or the methods, steps, and logic blocks disclosed in the embodiments of the present application are executed.
  • a general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented as hardware processor execution, or performed by a combination of hardware and software modules in the processor.
  • the memory 1330 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or may be a volatile memory.
  • HDD hard disk drive
  • SSD solid-state drive
  • RAM random access memory
  • a memory is any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function for storing program instructions and/or data.
  • the device 1400 is provided in the embodiment of the present application.
  • the device 1400 may be the access network element in the embodiment shown in FIG. 5 to FIG.
  • the device 1400 can also be a device capable of supporting the access network element to implement the function of accessing the network element in the method provided by the embodiment of the present application.
  • the device 1400 can be a chip system.
  • the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • the device 1400 includes at least one processor 1420 for implementing or for supporting the device 1400 to implement the function of accessing the network element in the method provided by the embodiment of the present application.
  • the processor 1420 may generate a target key for performing the key activation process according to the first input information and the second input information.
  • Apparatus 1400 can also include at least one memory 1430 for storing program instructions and/or data.
  • Memory 1430 is coupled to processor 1420.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in an electrical, mechanical or other form for information interaction between devices, units or modules.
  • Processor 1420 may operate in conjunction with memory 1430.
  • Processor 1420 may execute program instructions stored in memory 1430. At least one of the at least one memory may be included in a processor.
  • the device 1400 can also include a communication interface 1410 for communicating with other devices through the transmission medium such that devices for use in the device 1400 can communicate with other devices.
  • the other device may be a terminal device.
  • the processor 1420 can transmit and receive data using the communication interface 1410.
  • connection medium between the communication interface 1410, the processor 1420, and the memory 1430 is not limited in the embodiment of the present application.
  • the memory 1430, the processor 1420, and the communication interface 1410 are connected by a bus 1440 in FIG. 14.
  • the bus is indicated by a thick line in FIG. 14, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus.
  • the processor 1420 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component. Or the methods, steps, and logic blocks disclosed in the embodiments of the present application are executed.
  • a general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the memory 1430 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • a non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • RAM random access memory
  • a memory is any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function for storing program instructions and/or data.
  • the device 1500 is provided in the embodiment of the present application.
  • the device 1500 can be the terminal device in the embodiment shown in FIG. 5 to FIG. 7 , and can implement the function of the terminal device in the method provided by the embodiment of the present application.
  • the device 1500 may also be a device capable of supporting the terminal device to implement the function of the terminal device in the method provided by the embodiment of the present application.
  • the device 1500 can be a chip system. In the embodiment of the present application, the chip system may be composed of a chip, and may also include a chip and other discrete devices.
  • the device 1500 includes at least one processor 1520 for implementing or for supporting the device 1500 to implement the function of the access network element in the method provided by the embodiment of the present application.
  • the processor 1520 can use the public key to verify the signature of the third message. If the signature is correct, the target key for performing the key activation process is generated according to the third message and the first input information. The detailed description is not repeated here.
  • Apparatus 1500 can also include at least one memory 1530 for storing program instructions and/or data.
  • Memory 1530 is coupled to processor 1520.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in an electrical, mechanical or other form for information interaction between devices, units or modules.
  • Processor 1520 may operate in conjunction with memory 1530.
  • Processor 1520 may execute program instructions stored in memory 1530. At least one of the at least one memory may be included in a processor.
  • the device 1500 can also include a communication interface 1510 for communicating with other devices through the transmission medium such that devices for use in the device 1500 can communicate with other devices.
  • the other device may be a terminal device.
  • the processor 1520 can transmit and receive data using the communication interface 1510.
  • connection medium between the communication interface 1510, the processor 1520, and the memory 1530 is not limited in the embodiment of the present application.
  • the memory 1530, the processor 1520, and the communication interface 1510 are connected by a bus 1540 in FIG. 15, and the bus is indicated by a thick line in FIG. 15, and the connection manner between other components is only schematically illustrated. , not limited to.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • the processor 1520 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component. Or the methods, steps, and logic blocks disclosed in the embodiments of the present application are executed.
  • a general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the memory 1530 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • a non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory.
  • RAM random access memory
  • a memory is any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto.
  • the memory in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function for storing program instructions and/or data.
  • the embodiment of the present application further provides a computer readable storage medium, including instructions, when executed on a computer, causing a computer to execute the method for performing the access network element in any one of the embodiments of FIG. 3A to FIG. .
  • the embodiment of the present application further provides a computer readable storage medium, including instructions, when executed on a computer, causing a computer to execute the method for executing the core network element of the network in any one of the embodiments of FIG. 3A to FIG. .
  • a computer readable storage medium is also provided in the embodiment of the present application, including instructions, when executed on a computer, causing the computer to perform the method performed by the terminal device in any one of the embodiments of FIG. 3A to FIG.
  • the embodiment of the present application provides a chip system, which includes a processor, and may further include a memory for implementing the function of accessing the network element in the foregoing method.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the embodiment of the present application provides a chip system, which includes a processor, and may further include a memory for implementing the function of the core network element in the foregoing method.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the embodiment of the present application provides a chip system, which includes a processor, and may further include a memory for implementing the functions of the terminal device in the foregoing method.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the embodiment of the present application provides a system, where the system includes the foregoing access network element and the core network element.
  • the embodiment of the present application provides a system, where the system includes the foregoing access network element and the terminal device.
  • the method provided by the embodiment of the present application may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented in software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, a network device, a user device, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the available media can be magnetic media (eg, floppy disk, hard disk, Magnetic tape), optical medium (for example, digital video disc (DVD)), or semiconductor medium (for example, SSD).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种信息发送方法、密钥生成方法以及装置，在该方法中，核心网网元首先确定终端设备是否需要进行密钥激活流程，然后向接入网网元发送第一消息，该第一消息用于指示该接入网网元是否向该终端设备发送用于触发该终端设备进行该密钥激活流程的第二消息，接入网网元接收该第一消息后，则根据该第一消息确定是否需要向终端设备发送该第二消息，若确定需要，则向终端设备发送所述第二消息。

Description

一种信息发送方法、密钥生成方法以及装置
本申请要求于2018年04月08日提交中国专利局、申请号为201810308232.1、申请名称为“一种信息发送方法、密钥生成方法以及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种信息发送方法、密钥生成方法以及装置。
背景技术
移动业务的发展对无线通信中的安全性要求越来越重要。在终端设备向核心网请求业务数据之前，终端设备与核心网需要进行安全保护功能的激活流程。
在第四代通信系统(4th generation，4G)中，终端设备与核心网之间采用固定的流程进行安全保护功能的激活，具体的流程为：终端设备首先向移动性管理(mobility management entity，MME)实体发送初始非接入层(non-access stratum，NAS)消息，触发MME实体与终端设备进行鉴权，在鉴权成功后，MME实体激活与终端设备的NAS层的安全保护功能，在MME实体激活与终端设备的非接入层的安全保护功能后，MME实体再激活基站与终端设备的接入层(access stratum，AS)的安全保护功能，当MME实体与终端设备激活AS安全后，便激活了核心网、终端设备和接入网设备之间安全保护功能。
为了满足广泛变化的业务需要，第五代通信系统(5th generation，5G)将以灵活的方式构建，例如，可以根据不同的应用场景和不同的需求，灵活、动态地定制网络能力，例如，某些5G系统用于提供超低时延的业务服务，在这种5G系统中，若再沿用在4G系统中复杂的激活流程将带来较大的时延，无法满足该5G系统的要求。可见，4G系统中用于安全保护功能的激活流程无法满足5G系统的灵活性需求。
发明内容
本申请实施例提供一种信息发送方法、密钥生成方法以及装置，用以解决现有技术中用于安全保护功能的激活流程无法满足5G系统的灵活性需求的技术问题。
第一方面，本申请提供一种信息发送方法，在该方法中，核心网网元首先确定终端设备是否需要进行密钥激活流程，然后向接入网网元发送第一消息，该第一消息用于指示该接入网网元是否向该终端设备发送用于触发该终端设备进行该密钥激活流程的第二消息，接入网网元接收该第一消息后，则根据该第一消息确定是否需要向终端设备发送该第二消息，若确定需要，则向终端设备发送所述第二消息。
在上述技术方案中，核心网网元首先会判断是否需要进行密钥激活流程，然后将其判断结果携带在该第一消息中指示给接入网网元，接入网网元在根据第一消息中的内容确定需要触发该密钥激活流程后，则通过向终端设备发送该第二消息触发该密钥激活流程，这样，接入网网元可以根据实际情况选择性触发该密钥激活流程，可以满足5G系统的灵活性需求，进一步，在接入网网元确定不需要进行该密钥激活流程时， 终端设备便可以不进行该密钥激活流程，可以节省信令开销。
在一种可能的设计中，该第一消息包括如下信息中的至少一种：
用于保护所述第二消息的密钥；
用于生成所述密钥的基础根密钥KgNB；
密钥标识符，用于指示所述密钥；
指示信息，用于指示是否需要触发密钥激活流程；
终端设备的类型；
所述终端设备需要进行的业务所要求的时延。
在上述技术方案中，核心网网元可以通过上述多种信息中的其中一种或多种来向接入网网元指示其判断结果，可以增加系统的灵活性。
在一种可能的设计中，该核心网网元在接收终端设备发送的第四消息后，确定终端设备是否需要进行该密钥激活流程，该第四消息用于该终端设备接入核心网或者该终端设备向该核心网网元请求建立发送业务数据的连接。
在上述技术方案中，当终端设备向核心网网元发送接入请求或者建立发送业务数据的连接请求后，核心网网元才会将确定该终端设备是否需要进行密钥激活流程，这样核心网网元可以根据终端设备的需求来触发确定该终端设备是否需要进行密钥激活流程的判断过程，可以降低核心网网元的功耗。
在一种可能的设计中，核心网网元可以根据如下多种确定方式中的其中一种方式确定终端设备是否需要进行该密钥激活流程，该多种确定方式如下：
第一种方式：若该第四消息的类型为需要建立用户面数据的类型，则核心网网元确定需要进行该密钥激活流程；
第二种方式：若根据该第四消息确定该终端设备的类型为增强移动宽带eMBB类型，则核心网网元确定需要进行该密钥激活流程；
第三种方式：若根据该第四消息确定该终端设备需要进行的业务所要求的时延高于预设时延，则核心网网元确定需要进行该密钥激活流程。
在上述技术方案中，核心网网元可以根据实际情况选择其中一种方式确定终端设备是否需要进行该密钥激活流程，可以提高核心网网元的灵活性。
在一种可能的设计中，核心网网元接收由接入网网元发送的用于请求触发该密钥激活流程的参数的第三消息后，核心网网元才向接入网网元发送该第一消息。
在上述技术方案中，接入网网元在需要触发终端设备的密钥激活流程时，可以主动向核心网网元请求用于触发该密钥激活流程的参数，从而触发核心网网元向其发送该第一消息，这样，接入网网元可以通过该方案随时向终端设备发送需要保护的消息，提高接入网网元的灵活性。
在一种可能的设计中，接入网网元根据预设的策略及该第一消息确定是否需要向终端设备发送该第二消息。
在上述技术方案中，当接入网网元接收该第一消息后，还可以结合第一消息中的内容和预设的策略再次判断是否需要向终端设备发送该第二消息，这样，可以避免接入网网元单一地直接根据核心网网元的判断结果触发该密钥激活流程或者不触发该密钥激活流程，增加接入网网元的灵活性。当然，当核心网网元将其判断是否需要触发该密钥激活流程的判断结果通过该第一消息指示给接入网网元后，接入网网元也可以 直接根据该判断结果确定是否需要向终端设备发送该第二消息，从而可以降低接入网网元运算复杂度，简化决策。
第二方面，本申请提供一种密钥生成方法，在该方法中，接入网网元可以根据终端设备获取的用于生成目标密钥的第一输入信息及接入网网元自身获取的用于生成该目标密钥的第二输入信息，生成该目标密钥，该目标密钥为进行密钥激活流程的密钥。
在上述技术方案中，接入网网元可以直接根据该第一输入信息和该第二输入信息，生成进行该密钥激活流程的密钥，从而接入网网元的安全保护功能的激活可以由接入网网元自身决定，而无需依赖核心网网元，可以使接入网网元和终端设备的安全协商更加灵活。
一种可能的设计中，接入网网元首先获取终端设备的安全能力信息，然后根据该安全能力信息确定该第二输入信息。
在上述技术方案中，接入网网元可以根据终端设备的安全能力信息确定其自身用于生成该目标密钥的信息，处理方式简单，降低接入网网元的运算复杂度。
在一种可能的设计中，终端设备向接入网网元发送第一无线资源控制RRC信令，接入网网元则从该第一RRC信令中获取终端设备的安全能力信息。
在上述技术方案中，接入网网元可以通过与终端设备之间的RRC信令直接获取终端设备的安全能力信息，提供了一种新的处理方式，接入网网元可以根据实际情况选择其中一种方式获取该安全能力信息，可以增加接入网网元的灵活性。
在一种可能的设计中，终端设备向接入网网元发送第二无线资源控制RRC信令，接入网网元则从该第二RRC信令中获取终端设备用于生成该目标密钥的第一输入信息。
在上述技术方案中，接入网网元可以通过与终端设备之间的RRC信令直接获取该第一输入信息，提供了一种新的处理方式，接入网网元可以根据实际情况选择其中一种方式获取该第一输入信息，可以增加接入网网元的灵活性。
在一种可能的设计中，在接入网网元生成该目标密钥后，接入网网元可以向终端设备发送被该目标密钥完整性保护的第一消息，终端设备接收该第一消息后，根据该第一消息中的内容生成该目标密钥，并向接入网网元发送的通过该目标密钥进行完整性保护处理第二消息，接入网网元接收该第二消息后，则使用自身生成的该目标密钥对该第二消息进行验证，在验证成功时，完成该密钥激活流程。
在上述技术方案中，接入网网元在生成该目标密钥后，则根据该目标密钥完成密钥激活流程，从而接入网网元和终端设备的安全保护功能的激活可以由接入网网元自身决定，而无需依赖核心网网元，可以使接入网网元和终端设备的安全协商更加灵活。
在一种可能的设计中，接入网网元向终端设备发送被公钥进行签名过的第三消息，终端设备在接收该第三消息后，使用该公钥对该第三消息的签名进行验证，若该第三消息的签名正确，则终端设备根据该第三消息的内容及自身用于生成目标密钥的第一输入信息生成进行密钥激活流程的密钥，然后将第一输入信息携带在第四消息中发送给接入网网元，并使用该目标密钥对该第四消息进行完整性保护处理，接入网网元则在接收该第四消息后，则从该第四消息获取该第一输入信息。
在上述技术方案中，接入网网元首先通过公钥将自身用于生成目标密钥的第二输入信息传递给终端设备，这样可以保证该第二输入信息的安全，同时，终端设备使用 该公钥对接入网网元发送的信息进行验证，这样可以保证第二输入信息的正确性，且，终端设备使用目标密钥对第四消息及进行完整性保护，从而可以保证核心网网元获取的第一输入信息的正确性，这样，通过公钥和目标密钥对接入网网元与终端设备之间传递的信息进行保护，可以保证终端设备和接入网网元使用的目标密钥的一致性。
在一种可能的设计中，接入网网元生成该目标密钥后，接入网网元使用该目标密钥对该第二消息进行验证，在验证成功时，完成密钥激活流程。
在上述技术方案中，接入网网元在生成该目标密钥后，则根据该目标密钥完成密钥激活流程，从而接入网网元和终端设备的安全保护功能的激活可以由接入网网元自身决定，而无需依赖核心网网元，可以使接入网网元和终端设备的安全协商更加灵活。
第三方面，本申请提供一种密钥生成方法，在该方法中，终端设备接收接入网网元发送的被公钥进行签名过的第三消息，然后，终端设备使用该公钥对该第三消息的签名进行验证，若签名正确，则终端设备根据该第三消息中的内容及自身用于生成进行密钥激活流程的密钥的第一输入信息生成该目标密钥。
在上述技术方案中，接入网网元通过公钥将发送给终端设备的信息进行签名，这样可以保证该第三消息的安全，同时，终端设备使用该公钥对该第三消息进行验证，在验证正确时，则使用该第三消息中的内容生成该目标密钥，从而可以保证终端设备生成的目标密钥的正确性。
在一种可能的设计中，该第三消息中包含接入网网元用于生成该目标密钥的第二输入信息。
在上述技术方案中，接入网网元可以通过第三消息将自身生成该目标密钥的第二输入信息发送给终端设备，这样，终端设备直接根据该该第二输入信息生成该目标密钥，可以降低接入网网元的处理复杂度。
在一种可能的实施方式中，在终端设备生成该目标密钥后，终端设备可以向接入网网元发送通过目标密钥进行完整性保护处理的第四消息。
在上述技术方案中，终端设备在生成该目标密钥后，则直接使用该目标密钥对该第四消息进行完整性保护，保证该第四消息的正确性，从而使接入网网元能够根据该第四消息确定与终端设备相同的目标密钥，可以保证接入网网元与终端设备使用的目标密钥的一致性。
在一种可能的设计中，该第四消息中包含该第一输入信息。
在上述技术方案中，终端设备直接将自身用于生成该目标密钥的第一输入信息通过第四消息发送给核心网网元，则核心网网元则可以直接使用该第一输入信息确定该目标密钥，可以降低接入网网元的处理复杂度。
第四方面，本申请提供一种装置，该装置可以是接入网网元，也可以是接入网网元中的装置，该装置可以包括接收模块和确定模块，这些模块可以执行上述第一方面任一种设计示例中的接入网网元所执行的相应功能，具体的：
接收模块，用于接收第一消息；
确定模块，用于根据该第一消息确定是否需要向终端设备发送第二消息，该第二消息用于触发该终端设备进行密钥激活流程；
发送模块，用于若确定需要，向终端设备发送该第二消息。
在一种可能的设计中，该第一消息包括的具体内容可以参见第一方面中针对第一 消息的具体描述，此处不再具体限定。
在一种可能的设计中，该发送模块还用于元向核心网网元发送第三消息，该第三消息用于请求触发该密钥激活流程的参数。
在一种可能的设计中，该确定模块用于根据预设的策略及该第一消息确定是否需要向终端设备发送该第二消息。
第五方面，本申请提供一种装置，该装置可以是核心网网元，也可以是核心网网元中的装置，该装置可以包括通信模块和确定模块，这些模块可以执行上述第一方面任一种设计示例中的核心网网元所执行的相应功能，具体的：
确定模块，用于确定终端设备是否需要进行该密钥激活流程；
通信模块，用于向接入网网元发送第一消息，其中，该第一消息用于指示该接入网网元是否向该终端设备发送第二消息，该第二消息用于触发该终端设备进行该密钥激活流程。
在一种可能的设计中，该第一消息包括的具体内容可以参见第一方面中针对第一消息的具体描述，此处不再具体限定。
在一种可能的设计中，通信模块还用于接收第四消息，该第四消息用于该终端设备接入核心网或者该终端设备向该核心网网元请求建立发送业务数据的连接。
在一种可能的设计中，确定模块可以通过如下三种方式确定是否需要进行该密钥激活流程，该三种方式如下：
第一种方式：若所述第四消息的类型为需要建立用户面数据的类型，确定需要进行该密钥激活流程。
第二种方式：若根据该第四消息确定该终端设备的类型为增强移动宽带eMBB类型，确定需要进行该密钥激活流程。
第三种方式：若根据该第四消息确定该终端设备需要进行的业务所要求的时延高于预设时延，确定需要进行该密钥激活流程。
在一种可能的设计中，通信模块还用于接收由该接入网网元发送的第三消息，该第三消息用于请求触发该密钥激活流程的参数。
第六方面，本申请提供一种装置，该装置可以是接入网网元，也可以是接入网网元中的装置，该装置可以包括通信模块和确定模块，这些模块可以执行上述第二方面任一种设计示例中的接入网网元所执行的相应功能，具体的：
通信模块，用于获取第一输入信息及第二输入信息，其中，该第一输入信息为终端设备获取的用于生成目标密钥的信息，该目标密钥为进行密钥激活流程的密钥，该第二输入信息为该接入网网元获取的用于生成该目标密钥的信息；
确定模块，用于根据该第一输入信息和该第二输入信息，生成该目标密钥。
在一种可能的设计中，通信模块用于获取该终端设备的安全能力信息，根据该安全能力信息确定该第二输入信息。
在一种可能的设计中，通信模块用于接收该终端设备发送的第一无线资源控制RRC信令，从该第一RRC信令中获取该安全能力信息。
在一种可能的设计中，通信模块用于接收该终端设备发送的第二无线资源控制RRC信令，从该第二RRC信令中获取该第一输入信息。
在一种可能的设计中，该通信模块还用于向该终端设备发送第一消息，其中，该 第一消息被该目标密钥完整性保护的消息；以及，接收该终端设备发送的第二消息，其中，该第二消息通过该目标密钥进行完整性保护处理；该确定模块还用于使用该目标密钥对该第二消息进行验证，在验证成功时，完成所述密钥激活流程。
在一种可能的设计中，该通信模块用于向所述终端设备发送第三消息，其中，该第三消息是被公钥进行签名过的消息；以及，接收该终端设备发送的第四消息，其中，该第四消息通过该目标密钥进行完整性保护处理，该第四消息包含该第一输入信息；以及，从该第四消息获取该第一输入信息。
在一种可能的设计中，确定模块还用于使用该目标密钥对该第二消息进行验证，在验证成功时，完成该密钥激活流程。
第七方面，本申请提供一种装置，该装置可以是终端设备，也可以是终端设备中的装置，该装置可以包括通信模块和确定模块，这些模块可以执行上述第二方面任一种设计示例中的终端设备所执行的相应功能，具体的：
通信模块，用于接收接入网网元发送的第三消息，其中，该第三消息是被公钥进行签名过的消息；
确定模块，用于使用所述公钥对该第三消息的签名进行验证；以及，若该第三消息的签名正确，根据该第三消息及第一输入信息生成目标密钥，其中，该第一输入信息为该装置用于生成目标密钥的信息，该目标密钥为进行密钥激活流程的密钥。
在一种可能的设计中，该第三消息中包含第二输入信息，该第二输入信息为该接入网网元用于生成该目标密钥的信息。
在一种可能的设计中，通信模块还用于向该接入网网元发送第四消息，其中，该第四消息通过该目标密钥进行完整性保护处理。
在一种可能的设计中，该第四消息中包含该第一输入信息。
第八方面，本申请提供了一种装置，所述装置包括处理器，用于实现上述第一方面描述的方法。所述装置还可以包括存储器，用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第一方面描述的方法。所述装置还可以包括通信接口，所述通信接口用于该装置与其它设备进行通信。示例性地，该其它设备为终端设备。
在一种可能的设计中，该装置包括：
通信接口，用于接收第一消息；
存储器，用于存储程序指令；
处理器，用于根据该第一消息确定是否需要向终端设备发送第二消息，该第二消息用于触发该终端设备进行密钥激活流程；若确定需要，通过该通信接口向终端设备发送该第二消息。
在一种可能的设计中，该第一消息包括的具体内容可以参见第一方面中针对第一消息的具体描述，此处不再具体限定。
在一种可能的设计中，该通信接口还用于元向核心网网元发送第三消息，该第三消息用于请求触发该密钥激活流程的参数。
在一种可能的设计中，该处理器还用于根据预设的策略及该第一消息确定是否需要向终端设备发送该第二消息。
第九方面，本申请提供了一种装置，所述装置包括处理器，用于实现上述第一方 面描述的方法。所述装置还可以包括存储器，用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第一方面描述的方法。所述装置还可以包括通信接口，所述通信接口用于该装置与其它设备进行通信。示例性地，该其它设备为核心网网元。
在一种可能的设计中，该装置包括：
处理器，用于确定终端设备是否需要进行该密钥激活流程；
通信接口，用于向接入网网元发送第一消息，其中，该第一消息用于指示该接入网网元是否向该终端设备发送第二消息，该第二消息用于触发该终端设备进行该密钥激活流程；
存储器，用于存储程序指令。
在一种可能的设计中，该第一消息包括的具体内容可以参见第一方面中针对第一消息的具体描述，此处不再具体限定。
在一种可能的设计中，通信接口还用于接收第四消息，该第四消息用于该终端设备接入核心网或者该终端设备向该核心网网元请求建立发送业务数据的连接。
在一种可能的设计中，处理器可以通过如下三种方式确定是否需要进行该密钥激活流程，该三种方式如下：
第一种方式：若所述第四消息的类型为需要建立用户面数据的类型，确定需要进行该密钥激活流程。
第二种方式：若根据该第四消息确定该终端设备的类型为增强移动宽带eMBB类型，确定需要进行该密钥激活流程。
第三种方式：若根据该第四消息确定该终端设备需要进行的业务所要求的时延高于预设时延，确定需要进行该密钥激活流程。
在一种可能的设计中，通信接口还用于接收由该接入网网元发送的第三消息，该第三消息用于请求触发该密钥激活流程的参数。
第十方面，本申请提供了一种装置，所述装置包括处理器，用于实现上述第二方面描述的方法。所述装置还可以包括存储器，用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第二方面描述的方法。所述装置还可以包括通信接口，所述通信接口用于该装置与其它设备进行通信。示例性地，该其它设备为终端设备。
在一种可能的设计中，该装置包括：
通信接口，用于获取第一输入信息及第二输入信息，其中，该第一输入信息为终端设备获取的用于生成目标密钥的信息，该目标密钥为进行密钥激活流程的密钥，该第二输入信息为该接入网网元获取的用于生成该目标密钥的信息；
存储器，用于存储程序指令；
处理器，用于根据该第一输入信息和该第二输入信息，生成该目标密钥。
在一种可能的设计中，通信接口用于获取该终端设备的安全能力信息，根据该安全能力信息确定该第二输入信息。
在一种可能的设计中，通信接口用于接收该终端设备发送的第一无线资源控制RRC信令，从该第一RRC信令中获取该安全能力信息。
在一种可能的设计中，通信接口用于接收该终端设备发送的第二无线资源控制 RRC信令，从该第二RRC信令中获取该第一输入信息。
在一种可能的设计中，该通信接口还用于向该终端设备发送第一消息，其中，该第一消息被该目标密钥完整性保护的消息；以及，接收该终端设备发送的第二消息，其中，该第二消息通过该目标密钥进行完整性保护处理；该确定模块还用于使用该目标密钥对该第二消息进行验证，在验证成功时，完成所述密钥激活流程。
在一种可能的设计中，该通信接口用于向所述终端设备发送第三消息，其中，该第三消息是被公钥进行签名过的消息；以及，接收该终端设备发送的第四消息，其中，该第四消息通过该目标密钥进行完整性保护处理，该第四消息包含该第一输入信息；以及，从该第四消息获取该第一输入信息。
在一种可能的设计中，处理器还用于使用该目标密钥对该第二消息进行验证，在验证成功时，完成该密钥激活流程。
第十一方面，本申请提供了一种装置，所述装置包括处理器，用于实现上述第二方面描述的方法。所述装置还可以包括存储器，用于存储程序指令和数据。所述存储器与所述处理器耦合，所述处理器可以调用并执行所述存储器中存储的程序指令，用于实现上述第二方面描述的方法。所述装置还可以包括通信接口，所述通信接口用于该装置与其它设备进行通信。示例性地，该其它设备为接入网网元。
在一种可能的设计中，该装置包括：
通信接口，用于接收接入网网元发送的第三消息，其中，该第三消息是被公钥进行签名过的消息；
存储器，用于存储程序指令；
处理器，用于使用所述公钥对该第三消息的签名进行验证；以及，若该第三消息的签名正确，根据该第三消息及第一输入信息生成目标密钥，其中，该第一输入信息为该装置用于生成目标密钥的信息，该目标密钥为进行密钥激活流程的密钥。
在一种可能的设计中，该第三消息中包含第二输入信息，该第二输入信息为该接入网网元用于生成该目标密钥的信息。
在一种可能的设计中，通信接口还用于向该接入网网元发送第四消息，其中，该第四消息通过该目标密钥进行完整性保护处理。
在一种可能的设计中，该第四消息中包含该第一输入信息。
第十二方面，本申请还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行第一方面所述的方法。
第十三方面，本申请实施例中还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行第二方面或第三方面所述的方法。
第十四方面，本申请提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现第一方面所述的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
第十五方面，本申请提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现第二方面或第三方面所述的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
第十六方面，本申请提供了一种系统，所述系统包括第四方面所述的装置和第五方面所述的装置。
第十七方面，本申请提供了一种系统，所述系统包括第六方面所述的装置和第七方面所述的装置。
第十八方面，本申请提供了一种系统，所述系统包括第八方面所述的装置和第九方面所述的装置。
第十九方面，本申请提供了一种系统，所述系统包括第十方面所述的装置和第十一方面所述的装置。
上述第四方面至第十九方面及其实现方式的有益效果可以参考对第一方面至第三方面的方法及其实现方式的有益效果的描述。
附图说明
图1为现有技术中终端设备与核心网安全保护功能的激活流程图；
图2为本申请实施例提供的一种通信系统的结构图；
图3A-图3C为本申请实施例提供的一种信息发送方法的流程图；
图4为本申请实施例提供的另一种信息发送方的流程图；
图5为本申请实施例提供的一种密钥生成方法的流程图；
图6为本申请实施例提供的接入网网元A获取该第一输入信息的一种实现方式的流程图；
图7为本申请实施例提供的另一种密钥生成方法的流程图；
图8为本申请实施例提供的一种装置的结构示意图；
图9为本申请实施例提供的另一种装置的结构示意图；
图10为本申请实施例提供的另一种装置的结构示意图；
图11为本申请实施例提供的另一种装置的结构示意图；
图12为本申请实施例提供的另一种装置的结构示意图；
图13为本申请实施例提供的另一种装置的结构示意图；
图14为本申请实施例提供的另一种装置的结构示意图；
图15为本申请实施例提供的另一种装置的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)密钥激活流程：可以包含AS SMC流程和/或NAS SMC流程，当然，也可以是其他具有激活安全密钥，保护后续消息的密钥激活流程，在此不作限制。
(2)网络能力开放功能(network exposure function，NEF)网元，主要用于与第三方交互，使第三方可以间接与某些第三代合作伙伴计划(3rd generation partnership project，3GPP)网络内部的网元进行交互。
(3)NF存储功能(NF repository function，NRF)网元，用于支持网络功能服务注册登记、状态监测等，实现网络功能服务自动化管理、选择和可扩展。
(4)策略控制功能(policy control function，PCF)网元，用于存储或生成会话管 理相关的规则，例如，会话的服务质量(quality of service，QoS)规则，并将该规则提供给会话管理功能(session management function，SMF)实体，还用于生成移动性管理相关的策略信息并提供给接入和移动性管理功能(access and mobility management function，AMF)实体。
(5)统一的数据管理(unified data management，UDM)网元，存储终端设备的签约信息。
(6)应用功能(application function，AF)网元，用于与PCF实体进行交互，将第三方的业务要求提供给PCF实体，使得PCF实体根据该业务要求生成相应的QoS规则。
(7)鉴权服务功能(authentication server function，AUSF)网元，用于获取安全认证向量，所述安全认证向量用于执行终端设备和网络侧之间的安全认证。
(8)AMF网元，用于对终端设备的认证，终端设备的移动性管理，网络切片选择，SMF实体选择等功能；作为N1和N2信令连接的锚点并为SMF实体提供N1和N2会话管理(session management，SM)消息的路由；维护和管理终端设备的状态信息。
(9)安全锚点功能(security anchor function，SEAF)网元：用于向AUSF实体发起鉴权请求，完成网络侧对终端设备的认证。
(10)SMF网元：用于管理终端设备的所有控制面功能，包括UPF实体选择，网络协议(internet protocol，IP)地址分配，会话的QoS属性管理，从策略控制功能(policy control function，PCF)实体获取策略控制和计费(policy control and charging，PCC)规则，以及为用户面分配会话资源等。
(11)用户面功能(user plane function，UPF)实体，UPF实体作为协议数据单元(protocol data unit，PDU)会话连接的锚定点，负责对终端设备的数据报文过滤、数据传输或转发、速率控制、生成计费信息等。
(12)数据网络(data network，DN)实体，用于生成需要发送给终端设备的下行数据，以及接收终端设备发送的上行数据。
(13)(无线)接入网络((radio)access network，(R)AN)，由多个(R)AN节点组成的网络，实现无线物理层功能、资源调度和无线资源管理、无线接入控制以及移动性管理功能，以及与AMF实体建立控制面信令连接，用于实现无线接入承载控制等功能。(R)AN可以为采用不同接入技术的接入网络，例如，3GPP接入技术、非第三代合作伙伴计划(none 3rd generation partnership project，non-3GPP)接入技术。其中，(R)AN节点也可以称为接入网网元，例如基站，可以是新空口(new radio，NR)系统中的gNB(gNode B)，LTE系统中的演进型基站(evolutional NodeB，eNB或eNodeB)，可以是新空口控制器(new radio controller，NR controller)，可以是集中式网元(centralized unit)，可以是射频拉远模块，可以是微基站，可以是分布式网元(distributed unit)，可以是接收点(transmission reception point，TRP)或传输点(transmission point，TP)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来演进的公共陆地移动网络(public land mobile network，PLMN)中的网络设备或者任何其它无线接入设备，但本申请实施例不限于此。接入网网元会 根据SMF实体提供的QoS规则，为用户面传输通道分配合适的资源。
(14)终端设备，可以是无线终端设备也可以是有线终端设备。终端设备在与其他网元，例如AMF实体、AUSF实体等，进行鉴权时，会使用终端设备中存储的长期密钥和相关函数验证网络的真实性。无线终端设备可以是指向用户提供语音和/或数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。无线终端设备可以经RAN与一个或多个核心网进行通信，无线终端设备可以是移动终端设备，如移动电话(或称为“蜂窝”电话)和具有移动终端设备的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。无线终端也可以称为系统、订户单元(subscriber unit，SU)、订户站(subscriber station，SS)，移动站(mobile station，MB)、移动台(mobile)、远程站(remote station，RS)、接入点(access point，AP)、远程终端(remote terminal，RT)、接入终端(access terminal，AT)、用户终端(user terminal，UT)、用户代理(user agent，UA)、终端设备(user device，UD)、或用户装备(user equipment，UE)。
另外，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，如无特殊说明，一般表示前后关联对象是一种“或”的关系。
本文中的一些英文简称为以4G系统以及当前5G系统为例对本申请实施例进行的描述，其可能随着网络的演进发生变化，具体演进可以参考相应标准中的描述。
应理解的是，本文中所示的各个实体，在物理上可以是单个的设备，也可以是两个或两个以上的实体集成在同一个物理设备上，本发明实施例不作具体限定。
为了更好地理解本申请实施例提供的技术方案，下面先介绍4G系统中终端设备与核心网安全保护功能的激活流程。如图1所示，目前在4G系统中，终端设备与核心网安全保护功能的激活的流程描述如下：
1、终端设备通过接入网网元，向MME实体发送初始NAS消息，该初始NAS消息可以为附着请求；
2、MME实体与终端设备进行鉴权；
3、在MME实体与终端设备鉴权成功后，MME实体向终端设备发送非接入层安全模式命令(NAS SMC)消息，终端设备接收该NAS SMC消息；
4、终端设备根据该NAS SMC消息激活NAS安全保护功能；
5、在激活NAS安全后，终端设备向MME实体发送非接入层安全模式完成(NAS SMP)消息，MME实体接收该NAS SMP消息；
6、MME实体根据该NAS SMP消息激活NAS安全保护功能；
7、在MME实体完成与终端设备的非接入层的安全性验证过程后，MME实体向接入网网元发送初始上下文建立请求(initial context aetup request)消息，接入网网元接收该初始上下文建立请求消息，其中，该初始上下文建立请求消息中携带安全上下 文；
8、接入网网元根据该安全上下文向终端设备发送接入层安全模式命令(AS SMC)消息，终端设备接收该AS SMC消息；
9、终端设备根据该AS SMC消息激活AS安全保护功能；
10、终端设备在激活AS安全后，向MME实体发送接入层安全模式完成(AS SMP)消息，MME实体接收该AS SMP消息；
11、MME实体根据该AS SMP消息激活AS安全保护功能，完成安全保护功能的激活流程。
可见，现有技术中的安全保护功能的激活流程比较复杂，需要先激活NAS层安全保护功能，然后再激活AS层安全保护功能，该安全保护功能的激活流程将带来较大的时延，无法满足5G系统的灵活性需求。因此，本申请实施例提供一种信息发送方法，应用在5G系统安全保护功能的激活流程中，在该方法中，接入网网元首先会确定是否激活与终端设备的安全保护功能，若确定需要，则触发安全保护功能的激活流程，从而使得安全保护功能的激活流程可以根据实际情况选择性进行，能够满足5G系统的灵活性需求。
本申请实施例的技术方案可以应用于各种通信系统，例如：NR系统、LTE系统、先进的长期演进(advanced long term evolution，LTE-A)系统、第三代合作伙伴计划(the3rd generation partnership project，3GPP)相关的蜂窝系统、5G系统以及下一代移动通信系统等。
此外，所述通信系统还可以适用于面向未来的通信技术，本申请实施例描述的系统是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
下面对本申请实施例的应用场景作简要介绍。请参考图2，为本申请实施例提供的一种通信系统的结构图，该通信系统中的各个网元的功能在前面已经进行了介绍，在此不再赘述。
下面结合附图介绍本申请实施例提供的技术方案，在下面的介绍过程中，以本申请提供的技术方案应用在图2所示的应用场景中为例。
请参考图3A-3C为本申请实施例提供的一种信息发送方法的流程图，该流程图的描述如下：
步骤301、终端设备向核心网网元发送第四消息，核心网网元接收该第四消息。
在本申请实施例中，核心网网元例如为图2中所示的单个网络实体，例如是AMF实体或者SMF实体等，或者，核心网网元也可以是多个网络实体的组合，例如，可以是AMF实体和SMF实体的组合(代表两个个信令面功能实体的组合)，也可以是AUSF实体、AMF实体和SEAF实体的组合(代表安全功能实体和信令面安全实体的组合)等，还可以是MEC实体和UPF实体的组合(代表两个用户面安全实体的组合)，也可以是SMF实体和UPF实体组合(代表信令面安全实体和用户面安全实体的组合)，也可以是UPF实体和SEAF实体的组合(代表用户面实体和安全功能实体的组合)，在这种情况下，可以不被标准化。另外，核心网网元可以是某一种服务对应的网络功能，比如，网络功能可以理解为虚拟化实现下的一个虚拟化功能，还可以理解为服务 化网络下提供服务的网络功能，例如，专门用于终端设备的注册流程的网络功能，或者专门用于向终端设备提供视频业务数据的网络功能等，当然在这种情况下，该核心网网元可以是单个的网络功能，也可以是多个服务对应的网络功能的组合，具体的组合示例可以与多个网络实体的组合类似，即可以提供不同服务的不同功能的组合，在此不再赘述。因此，本发明的核心网网元可以是多个核心网网元间的合作，即在几个核心网网元进行交流后，然后有一个核心网网元作为出口与接入网设备进行交互。
需要说明的是，在本申请实施例中，网络实体、网元、设备等称呼是等价的，不对具体称呼进行限制，在下面的描述中，将以核心网网元进行描述。由于与核心网网元连接的终端设备有多个，为方便描述，后文将以终端设备1为例进行说明。
在本申请实施例中，该第四消息用于终端设备1接入核心网或者终端设备1向所述核心网网元请求建立发送业务数据的连接，例如，该第四消息可以为初始注册请求消息或者服务请求消息等NAS消息。当终端设备1需要向核心网注册或者请求业务数据时，则终端设备1向核心网网元发送该第四消息。
步骤302、核心网网元确定终端设备1是否需要进行密钥激活流程。
在本申请实施例中，密钥激活流程可以为AS SMC流程，也可以是其他具有激活安全密钥，保护后续消息的密钥激活流程，在下面的介绍中，以AS SMC流程为例进行说明。
当核心网网元接收该第四消息后，则确定终端设备1是否需要进行AS SMC流程。在本申请实施例中，核心网网元确定终端设备1是否需要进行AS SMC流程的具体方式可以为如下多种方式中的其中至少一种方式。
第一种确定方式：
核心网网元判断该第四消息的类型，根据该第四消息的类型确定终端设备1是否需要进AS SMC流程，若该第四消息的类型为需要建立用户面数据的传输通道的类型，则核心网网元确定需要进行AS SMC流程。
一种可能的实施方式，核心网网元可以根据该第四消息中携带的信息判断该第四消息的类型。例如，若第四消息中携带有PDU会话相关的内容，则核心网网元判断该第四消息为需要建立用户面数据的类型，确定需要进行AS SMC流程；若第四消息中没有携带协议数据单元(protocol data unit，PDU)会话相关的内容，则判断该第四消息为不需要建立用户面数据的类型。或者，若第四消息为服务请求消息，则判断该第四消息为需要建立用户面数据的类型，否则则判断该第四消息为不需要建立用户面数据的类型。当然，也可以采用其他判断方式，在此不作限制。
第二种确定方式：
核心网网元确定终端设备1的类型，通过终端设备1的类型确定是否需要进行ASSMC流程，若终端设备1的类型为增强移动宽带eMBB类型，则核心网网元确定需要进行AS SMC流程。
一种可能的实施方式，核心网网元在接收到该第四消息后，可以从其他网元中，例如SMF实体或者UDM实体等，获取与终端设备1相关的信息，并根据获取的与终端设备1相关的信息以及该第四消息，判断是否需要进行AS SMC流程。例如，核心网网元可以根据该第四消息中的某个字段、UDM实体中终端设备1的签约信息，PCF实体发送的终端设备1的位置信息等判断终端设备1是的类型，例如，若终端设备1 是eMBB类型，则确定需要进行AS SMC流程；若终端设备1为mMTC类型或URLLC类型，则确定不需要进行AS SMC流程。再例如，若终端设备1为车或者车载模块，则确定不需要进行AS SMC流程；若终端设备1为手机，则确定需要进行AS SMC流程。当然，若终端设备1的类型为其他类型时，也可以采用前述方式进行判断，在此不再赘述。
第三种确定方式：
核心网网元根据该第四消息中携带的服务质量(quality of service，QoS)相关信息或者在收到第四消息后才从其他核心网网元处获得的QoS信息。比如，根据QOS相关信息可以确定终端设备1请求的业务所要求的时延，在根据该时延确定是否需要进行AS SMC流程。例如，若终端设备1请求的业务所要求的时延高于预设时延，则核心网网元确定需要进行AS SMC流程；若终端设备1请求的业务所要求的时延低于或等于该预设时延，则核心网网元确定不需要进行AS SMC流程。例如，该预设时延为1s，核心网网元根据该第四消息确定终端设备1请求的业务所要求的时延为0.5s，0.5s<1s，则核心网网元确定不需要进行AS SMC流程。
第四种确定方式：
核心网网元可以从其他网元中，例如PCF实体或者AF实体中或者管理网元实体中获取终端设备1请求接入的外部网络的状态信息，例如，请求接入的网络的切片相关信息，请求接入的数据网络名称(data network name，DNN)是哪个等，确定终端设备1请求接入的是什么样的网络，根据请求接入的网络的状态信息确定是否需要进行AS SMC流程。例如，终端设备1请求接入的是一个时延要求极低的网络，则该网络要求终端设备1以最快速的速度接入网络，则核心网网元确定不需要进行AS SMC流程。或者，核心网网元可以获取终端设备1请求接入的接入网络的负载信息，若终端设备1请求接入的网络的负载量没有超过阈值，则核心网网元确定需要进行AS SMC流程。当然，还可以根据终端设备1请求接入的网络的其他信息进行判断，在此不一一例举。
第五种确定方式：
核心网网元可以从自身或者其他网元中，例如PCF实体或者AF实体，获取终端设备1当前接入的接入网网元的状态信息，根据当前接入的接入网网元的状态信息确定是否需要进行AS SMC流程。一种可能的实施方式，核心网网元可以获取终端设备1当前接入的接入网网元的位置信息，例如，当前接入的接入网网元的部署位置是一片沙漠，附近没有其他网络，则核心网网元确定不需要进行AS SMC流程；当前接入的接入网网元的部署位置为商务区，则核心网网元确定需要进行AS SMC流程。当然，也可以根据当前接入的网络的其他信息进行判断，在此不一一例举。
第六种确定方式：
核心网网元配置的策略或者网管系统提供的策略来确定是否需要进行AS SMC流程。该配置的策略可以是运营商策略，例如，运营商策略可以为对所有的UE都不进行AS SMC流程，则核心网网元确定终端设备1不需要进行AS SMC流程；若该运营商策略为对所有的UE都需要进行AS SMC流程，则核心网网元确定终端设备1需要进行AS SMC流程。
第七种方式：
核心网网元接收该第四消息后，可以根据第四消息携带的指示信息进行判断是否需要进行AS SMC流程。指示信息可以来自接入网网元，也可以来自终端设备1。例如，终端设备1可以在第四消息中加入比特位指示信息，该比特位指示信息用于指示核心网网元是否需要AS SMC流程。再比如，接入网设备可以在发送第四消息的N2消息内加入比特位指示信息，该比特位指示信息用于指示核心网网元是否需要AS SMC流程。
需要说明的是，核心网网元可以采用上述七种方式中的其中一种方式进行判断，也可以对上述七种方式设置优先级，当可以使用多种判断方式进行判断时，优先使用某种判断方式，也可以设置各种判断方式与实际情况的对应关系，在何种情况中使用何种判断方式，在本申请实施例中不作限制。
需要说明的是，步骤301-步骤302为可选的步骤，即不是必须执行的。
步骤303、核心网网元与终端设备1进行鉴权。
步骤304、核心网网元向终端设备1发送NAS SMC消息，终端设备1接收NAS SMC消息。
步骤305、终端设备1根据NAS SMC消息激活NAS安全。
步骤306、终端设备1向核心网网元发送NAS SMP消息，核心网网元接收该NAS SMP消息，并激活NAS安全。
步骤303-步骤306与图1中相应的步骤相同，在此不再赘述。
需要说明的是，步骤302与步骤303-步骤306之间的执行顺序可以是先执行步骤302再执行步骤303-步骤306，如图3A所示；也可以是先执行步骤303再执行步骤302最后执行步骤304-步骤306，如图3B所示；也可以是先执行步骤303-步骤306再执行步骤302，如图3C所示，在本申请实施例中，不对步骤302与步骤303-步骤306之间的执行顺序进行限制。
一种可能的实施方式中，步骤302也可以执行多次，即先执行步骤302再执行步骤303-步骤306，然后再次执行步骤302；或者，先执行步骤303，然后执行步骤302，在执行步骤304-步骤306，最后再次执行步骤302。在这种情况下，步骤302的确定结果可以是首次确定后则通过前述第一消息中的7种信息中的一种或多种进行指示，也可以是在最后一次执行步骤302之后才进行指示，核心网网元可以预先配置好执行步骤302的位置、执行步骤302的次数以及指示步骤302的确定结果的位置，在此不作限制。
需要说明的是，步骤303-步骤306为可选步骤，不是必须要执行的，即当核心网网元接收终端设备1发送的第四消息后，可以通过步骤303-步骤306进行鉴权及NAS层安全验证过程，也可以不执行步骤303-步骤306的验证过程，在此不作限制。
步骤307、核心网网元向接入网网元发送第一消息，该接入网网元接收该第一消息。
在本申请实施例中，接入网网元，可以理解为3GPP网络的传统接入设备，比如4G的基站eNB，5G的基站gNB，以及各类升过级的，或演进的3GPP接入技术。接入网设备的部署形态本发明不做规定，本发明用接入网设备代表具有接入网功能的设备，即可以包括云状态部署下的前端基站和后端数据中心。同时，这里不排除接入网设备为非3GPP接入技术下的无线接入点AP，或者各类网关设备，例如，演进分组数 据网关(evolved packet data gateway，ePDG)，N3IWF以及固网接入技术使用的网关。
需要说明的是，在本申请实施例中，网络实体、网元、设备等称呼是等价的，不对具体称呼进行限制。由于与核心网网元连接的接入网网元有多个，为方便描述，后文将以接入网网元A为例进行说明。
下面，对该第一消息进行说明。
在本申请实施例中，第一消息为接入网网元A从核心网网元处收到的消息。该消息可以用于提供参考信息给接入网设备A，使接入网设备A可以用于确定是否需要触发AS SMC流程的消息，或者可以用于传递使接入网设备A触发AS SMC流程的必要参数。第一消息的形式包括但不限于如下三种：
第一种形式：第一消息为类似于初始上下文建立请求消息的消息。在5G接入技术中，初始上下文建立消息用于将安全上下文从核心网网元传递给接入网网元。
在这种情况下，第一消息可以与图1中的初始上下文建立请求消息包含的内容相同，具体包括的信息不再赘述。
第二种形式：第一消息中可以包含初始上下文建立请求消息中的信息，此外，还包含其他信息，该其他信息可用于供接入网网元A确定是否需要触发与终端设备的AS SMC流程。
在一种示例中，该其他信息包括如下信息中的至少一种：
(1)用于进行AS SMC流程的密钥。
例如，核心网网元中可以存储或者获取或者临时生成与每个接入核心网的终端设备对应的用于进行AS SMC流程的基础根密钥KgNB，以及存储了用于根据该基础根密钥KgNB生成进行AS SMC流程的密钥的多个算法，从而当核心网网元需要触发接入网网元A与某个终端设备的AS SMC流程时，则根据与该某个终端设备对应的基础根密钥KgNB及选择的算法，生成接入网网元A与该某个终端设备进行AS SMC流程的密钥。当然，基础根密钥KgNB及算法与多套密钥之间有映射关系，则该密钥也可以是核心网网元根据基础根密钥KgNB及选择的算法，从预先存储的多套密钥中选择的某一套密钥，在此不对密钥的获取方式进行限制。
需要说明的是，所述的某个终端设备即为接入网网元A需要进行交互的终端设备，为方便描述，在下面的介绍中将该某个终端设备称为终端设备1。
(2)用于生成进行AS SMC流程的密钥的基础根密钥KgNB。
基础根密钥，例如，可以是KgNB，则其介绍参见(1)中的描述，在此不再赘述。基础根密钥也可以是除KgNB外的其他密钥，在此不作限制。接入网设备A收到基础根密钥后，可以进一步生成接入网设备A与终端设备1进行AS SMC流程的密钥，或者直接利用基础跟密钥对AS SMC消息进行保护。
(3)密钥标识符，是用于指示进行AS SMC流程的密钥。
若核心网网元中存储有与终端设备1对应的多套密钥，则密钥标识符用于标识核心网网元确定的在接入网网元A与终端设备1进行AS SMC流程时使用的密钥是该多套密钥中的哪套密钥，这样，在核心网网元和终端设备1之间有多套密钥，可以通过密钥标识符准确地确定在此次AS SMC流程中使用的密钥。
需要说明的是，通过密钥标识符确定的密钥，可以是一组密钥，也可以是一个具体的密钥，在此不做限定。如果确定的是一组密钥，则核心网网元可以直接使用一组 密钥中的一个作为基础密钥，或作为AS SMC流程的密钥；也可以使用其中的某一个密钥进一步获取基础密钥，或用于AS SMC流程的密钥。比如，密钥标识符的值为001，则代表双方使用001标识的那套密钥中的某个密钥，或者那套密钥中的某个密钥进一步衍生获得的密钥保护AS SMC消息。
(4)指示信息，用于指示是否需要触发AS SMC流程。
该指示信息可以是比特位指示信息，或者为字符串。为了与其他几种信息区别，该指示信息又可以成为显示的告知，而携带基础密钥或其他信息的方法又可以称为隐式的告知。
一种可能的实施方法可以为：该指示信息为0,1比特位指示信息。即0表示不需要触发AS SMC流程。1表示需要触发AS SMC流程。
另一种可能的实施方式，该指示信息可以用于指示三种不同的内容，分别为需要触发AS SMC流程、建议触发AS SMC流程以及不需要触发AS SMC流程。若该指示信息指示的内容为需要触发AS SMC流程，则接入网网元A必须触发AS SMC流程；若该指示信息指示的内容为建议触发AS SMC流程，则接入网网元可以选择触发AS SMC流程，也可以选择不触发AS SMC流程；若该指示信息指示的内容为不需要触发AS SMC流程，则接入网网元A选择不触发AS SMC流程定。该指示信息可以占用2个比特，例如，00表示不需要触发，01表示需要触发，10表示建议触发。或者，该指示信息也可以由若干个字符串构成，例如，“not needed”表示不需要触发，“required”表示需要触发，“prefered”表示建议触发，对于指示信息的具体形式在此不作限制。
(5)终端设备1的类型。
终端设备的类型可能有多种，例如海量机器类通信(massive machine type of communicationm，mMTC)类型、超高可靠及低延时通信(ultra reliable low latency communication，URLLC)类型以及增强移动宽带(enhanced mobile broadband，eMBB)。当然，随着应用场景的增加，终端设备的类型也可以包含其他类型，也可以根据其他因素分为其他类型，在此不作限制。
需要说明的是，核心网网元可以有多种方法获取终端设备1的类型，例如，通过签约信息知道终端是什么样的设备，或者终端设备1也可以在接入网络的时候，上报自己是什么样的设备给核心网网元。本发明不限定核心网网元的知道终端设备1类型的具体方法。
(6)终端设备1需要进行的业务所要求的时延。
该时延可以是终端设备1需要进行的业务要求的具体时延，例如，该时延可以为0.5s或者1s等，即网络延迟不可以大0.5s或1s。，或者该时延也可以是一个指示信息，该指示信息指示终端设备1要求的时延的等级，例如，接入网网元A和核心网网元约定时延在0-1s范围内(包含0s和1s)的为低级别，时延在1-2s范围内(包含1s和2s)的为中级别，时延在2-3s范围内(包含2s和3s)的为高级别，如果终端设备1的时延为0.5s，则终端设备1的时延的等级为低级别。
需要说明的是，核心网网元可以有多种方法获取终端设备要求的可以接受的时延值，例如，通过签约信息获取，或者通过其他核心网网元获取，或者通过终端设备1自己上报的信息获取。例如：从AMF签约信息中获取，或者SMF功能从PCF或签约信息中获取UE的延迟信息，然后SMF功能可以自己告知核心网设备是否需要AS SMC 流程，也可以通过AMF功能告知核心网设备是否需要AS SMC流程，或者SMF功能告知AMF，再由AMF自己判断后告知接入网设备是否需要AS SMC流程。
(7)终端设备1当前接入的接入网网元的部署环境。
在本申请实施例中，终端设备1当前接入的接入网网元即为接入网网元A，则终端设备1当前接入的接入网网元的部署环境即为接入网网元A的部署环境，例如，该部署环境可以是沙漠环境或者住宅区或者商务区等等。该部署环境也可以用来表征接入网网元A所在的部署环境受到第三方攻击的概率，第三方可以为人或者某个请求服务的应用，例如，接入网网元A的部署环境为沙漠环境，则表示接入网网元A受到第三方攻击的概率低，或者接入网网元A的部署环境为商务区，则表示接入网网元A受到第三方攻击的概率高等，在此不作限制。
需要说明的是，该其他信息可以是步骤302中的确定结果，即在核心网网元执行步骤302之后，核心网网元则可以将步骤302的确定结果以上述七种信息中的其中一种或多种携带在第一消息中，发送给接入网网元A。具体来讲，核心网网元确定是否需要进行AS SMC流程的方式与第一消息中的其他信息的形式没有一一对应的关系，即无论核心网网元采用何种方式确定是否需要进行AS SMC流程，第一消息中的其他信息可以是前述第一消息包含的7种信息中的一种或多种，例如，核心网网元采用第一种方式确定需要进行AS SMC流程，则第一消息中可以通过第(1)种信息，即用于进行AS SMC流程的密钥，来通知接入网网元A其确定结果；核心网网元采用第二种方式确定需要进行AS SMC流程，则第一消息中也可以通过第(4)种信息，即指示信息，来通知接入网网元A其确定结果。当然，为了简化核心网设备的计算复杂度，当核心网网元采用第三种方式，即终端设备1请求的业务所要求的时延确定需要进行AS SMC流程，则第一消息中则可以直接使用第(6)种信息来通知接入网网元A其确定结果，在本申请实施例中不作限制。
第三种形式：第一消息仅包含用于接入网网元A确定是否需要触发与终端设备1的AS SMC流程的信息，在这种情况下，第一消息与图1中所示的初始安全上下文建立请求消息可以理解为两个不同的消息。用于接入网网元A确定是否需要触发与终端设备1的AS SMC流程的信息，可以认为与第二种形式中的其他信息相同，可参考第二种形式中的相关介绍，在此不再赘述。
步骤308、接入网网元A根据该第一消息确定是否需要向终端设备1发送第二消息。
在本申请实施例中，该第二消息用于触发终端设备1进行接入层安全模式命令AS SMC流程。例如，该第二消息可以是如图1中所示的AS SMC消息，当然也可以是具有安全保护功能的激活的其他类型消息，在本申请实施例中不作限制。
核心网网元将自身的确定结果告知给接入网网元A，接入网网元A是否遵从核心网网元的结果要根据不同情况进行确定。例如，可以规定接入网网元A必须遵从核心网网元的决定，则接入网网元A则根据第一消息中的内容进行确定即可；也可以规定接入网网元A根据自己当前的情况及第一消息中的内容一起决定，或者接入网网元A根据自己当前的情况重新做决定。接入网网元的行为也会受到不同规定的影响，例如，规定接入网设备A要遵从核心网网元的决定，但是接入网网元A无法满足其决定的时候，则接入网设备要拒绝此次接入。在下面的描述中，以接入网网元A必须遵从核心 网网元的决定以及接入网网元A根据自己当前的情况及第一消息中的内容一起决定为例进行介绍。
第一种实现方式：接入网网元A只根据第一消息中的内容，确定是否需要向终端设备1发送第二消息，即，若核心网网元确定需要进行AS SMC流程，则接入网网元A则确定需要进行AS SMC流程。
需要说明的是，由于第一消息可以有前述三种形式，在这种情况下，第一消息为前述三种形式中的第二种形式或者第三种形式，即第一消息中需要包含用于接入网网元A确定是否需要触发与终端设备的AS SMC流程的信息。
一种可能的实施方式，接入网网元A接收该第一消息后，确定该第一消息中包含用于进行AS SMC流程的密钥或者基础根密钥KgNB或者密钥标识符，表示核心网网元确定需要进行AS SMC流程，则接入网网元A确定需要进行AS SMC流程。
另一种可能的实施方式，接入网网元A接收该第一消息后，确定该第一消息中包含用于指示是否需要触发AS SMC流程的指示信息，则接入网网元A根据该指示信息的内容确定是否需要进行AS SMC流程。例如，该指示信息为1个比特，接入网网元A可以与核心网网元约定，当指示信息为0时，表示不需要进行AS SMC流程，当指示信息为1时，表示需要进行AS SMC流程，则当该指示信息为1时，表示核心网网元确定需要进行AS SMC流程，则接入网网元A确定需要进行AS SMC流程。
另一种可能的实施方式，接入网网元A接收该第一消息后，确定该第一消息中包含的终端设备1的类型，则接入网网元A根据终端设备1的类型确定是否需要进行AS SMC流程。例如，接入网网元A可以与核心网网元约定，当终端设备1的类型为eMBB类型时，表示需要进行AS SMC流程，否则表示不需要进行AS SMC流程，则当接入网网元A确定第一消息中终端设备1的类型为eMBB类型时，表示核心网网元确定需要进行AS SMC流程，则接入网网元A确定需要进行AS SMC流程。
另一种可能的实施方式，接入网网元A接收该第一消息后，确定该第一消息中包含时延，则接入网网元A根据该时延确定是否需要进行AS SMC流程。例如，接入网网元A可以与核心网网元约定，当时延小于1s时，表示不需要进行AS SMC流程，否则表示需要进行AS SMC流程。这样，当接入网网元A确定第一消息中的时延为1.5s，表示核心网网元确定需要进行AS SMC流程，则接入网网元A确定需要进行AS SMC流程。
另一种可能的实施方式，接入网网元A接收该第一消息后，确定该第一消息中包含终端设备1当前接入的接入网网元的部署环境，则接入网网元A根据该部署环境是否需要进行AS SMC流程。例如，接入网网元A可以与核心网网元约定，当部署环境为沙漠环境时，表示不需要进行AS SMC流程，否则表示需要进行AS SMC流程。这样，当接入网网元A确定第一消息中的部署环境为商务区，表示核心网网元确定需要进行AS SMC流程，则接入网网元A确定需要进行AS SMC流程。
为了简化接入网网元A的计算复杂度，核心网网元可以预先与接入网网元A预定使用何种信息进行指示，这样，当接入网网元A接收到第一消息后，直接从该第一消息中提取对应的信息即可，从而接入网网元A无须从第一消息中确定核心网网元发送的是何种信息。
由于核心网网元往往能够获得更多的、更全面的关于终端设备1的信息，从而可 以从多方面、全维度的角度去判断是否需要AS SMC流程，保证判断结果的准确性。进一步，核心网网元通过UE状态、判断结果、指示信息等方式，将自身的判断结果通知给接入网网元A，从而接入网网元A可以直接遵从核心网网元的判断即可，可以使接入网网元A的决策更加简单、方便及直观。
需要说明的是，若第一消息中包含有前述7中信息中的多种信息，例如，该第一消息中包含终端设备1的类型以及终端设备1需要进行的业务所要求的时延，接入网网元A可以根据预设的优先级顺序来确定使用何种信息确定是否需要进行AS SMC流程，例如，该预设的优先级顺序可以为终端设备1的类型的优先级高于终端设备1需要进行的业务所要求的时延的优先级，则接入网网元A则只使用终端设备1的类型进行判断。当然，也可以采用其他方式确定，在本申请实施例中不作限制。
第二种实现方式：接入网网元A根据第一消息中的内容以及预设的策略，确定是否需要向终端设备1发送该第二消息。
在本申请实施例中，该预设的策略可以是由运营商提供的策略，也可以是接入网网元A从核心网网元获得的策略，也可以是接入网网元A根据具体信息本地配置的。该预设的策略可以是静态的，即，接入网网元A首次配置该预设的策略后，该预设的策略就不会发生更改，以后每次判断都是用这一套预设的策略；该预设的策略也可以是动态的，即该预设的策略可能会发生变化，例如，接入网网元A在第一次判断是否需要进行AS SMC流程时使用的策略与第二次使用的策略不相同，一种可能的示例，该预设的策略是接入网网元A在每次判断之前从核心网网元获取，而核心网网元发送给接入网网元A的策略可能会随着网络状态的不同而发生改变。
一种可能的实施方式，当第一消息为前述三种形式中的第一种形式时，即第一消息为如图1所示的初始安全上下文建立请求消息，则当接入网网元A获取该第一消息后，则可以根据该第一消息中的内容以及预设的策略确定是否需要进行AS SMC流程。
例如，该预设的策略为终端设备的类型为eMBB类型时，则需要进行AS SMC流程，否则不需要进行AS SMC流程，当接入网网元A接收到第一消息后，通过获取终端设备1的相关信息，例如从PCF实体获取的终端设备1的信息或者该第一消息中携带的终端设备1的信息，确定出终端设备1的类型，例如终端设备1的类型为eMBB类型，确定出根据预设的策略确定的判断结果为需要进行AS SMC流程。
该预设的策略可以为其他内容，具体可以参照步骤308的第一种方式中的多种可能的实施方式中的内容，在此不再赘述。
另一种可能的实施方式，第一消息为前述三种形式中的第二种形式或者第三种形式，则接入网网元A根据预设的策略及第一消息确定是否进行AS SMC流程的方式可以为：若根据预设的策略确定的判断结果与第一消息中指示的确定结果相同，则确定需要进行AS SMC流程，否则确定不进行AS SMC流程。以该预设的策略为终端设备的类型为eMBB类型时，则需要进行AS SMC流程，否则不需要进行AS SMC流程为例，核心网网元通过指示信息指示其确定结果为需要进行AS SMC流程，这样，当接入网网元A接收到第一消息后，通过获取终端设备1的相关信息，例如从PCF实体获取的终端设备1的信息或者该第一消息中携带的终端设备1的信息，确定出终端设备1的类型，例如终端设备1的类型为eMBB类型，确定出根据预设的策略确定的判断结果为需要进行AS SMC流程，由于第一消息指示的确定结果为需要进行AS SMC流 程，则接入网网元A最终确定需要进行AS SMC流程。
在这种情况下，也可以对根据预设的策略确定的判断结果和第一消息中指示的确定结果设置优先级，则接入网网元A根据优先级级别高的信息确定是否需要进行AS SMC流程，这样，接入网网元A可以根据实际情况选择使用何种方式确定是否需要进行AS SMC流程。
通过上述方式，接入网网元A可以根据预设的策略自行确定是否需要进行AS SMC流程，提高接入网网元A的灵活性。
步骤309、若确定需要，接入网网元A向终端设备1发送该第二消息，终端设备1接收该第二消息。
在本申请实施例中，若核心网网元中预先存储与终端设备1对应的多套密钥，且接入网网元A接收的第一消息中携带有密钥标识符，则第二消息中可以携带该密钥标识符；或者，接入网网元A接收的第一消息中不携带密钥标识符，接入网网元A再根据该第一消息确定出进行AS SMC流程使用的密钥后，也可以自己生成一个密钥标识符，并将该密钥标识符携带在第二消息中，当然，第二消息中还可以包含其他内容，在此不作限制。
需要说明的是，若接入网网元A确定不需要进行AS SMC流程，但是接入网网元A能够根据第一消息确定出与终端设备1进行AS SMC流程使用的密钥或基础密钥，则接入网网元A可以存储该密钥，等后续需要与终端设备1进行AS SMC流程时再使用，例如，当接入网网元A需要向终端设备1发送需要被保护的RRC消息时，则可以直接使用存储的密钥进行保护或进一步衍生的密钥进行保护。当接入网网元A在一段时间内没有使用该密钥，或者根据预设的策略确定不会在使用该密钥，或者当终端设备1变为空闲态，该接入网网元A也可以删除该密钥。另外，对于接入网网元A仅保留了部分信息的UE，例如不会发生位置移动的UE，接入网网元A可以保存该UE的除位置信息外的内容，接入网网元A可以一直存储与该UE对应的密钥。当然，若接入网网元A确定不需要进行AS SMC流程时，接入网网元A也可以直接丢弃该密钥，接入网网元A可以根据实际情况进行处理，在此不作限制。
步骤310、终端设备1向接入网网元A发送第五消息，接入网网元A接收该第五消息。
在接入网网元A接收该第五消息后，则根据该第五消息激活AS安全，完成AS SMC流程。步骤310与图1中相应的步骤相同，在此不再赘述。
需要说明的是，本申请实施例中描述的技术方案以步骤301-步骤310为例进行了说明，在可能的实施方式中，本申请实施例中的技术方案也可以包含其他步骤，例如，在步骤306与步骤302之间还可以增加其他步骤等，在此不作限制。
在上述实施例中，当终端设备向核心网网元发送第四消息后，接入网网元则可能会触发与终端设备之间的安全保护功能的激活流程。一种可能存在的情况，在终端设备向核心网网元发送第四消息之前，接入网网元有一些重要的内容需要发送给终端设备或者需要与终端设备进行协商，这些重要的内容需要有安全保护，但是终端设备并不知道接入网网元的需求，在这种情况下，接入网网元可以主动触发与终端设备之间的安全保护功能的激活流程，下面，则对这种情况下的信息发送方法进行介绍。
请参考图4，为本申请实施例提供的另一种信息发送方的流程图，该流程图的描 述如下：
步骤401、接入网网元向核心网网元发送第三消息，核心网网元接收该第三消息。
在本申请实施例中，对接入网网元与核心网网元的说明与图3A-图3C所示的实施例相同，在此不再赘述，在下面的描述中，将以核心网网元且以接入网网元A为例进行说明。
在本申请实施例中，该第三消息用于请求触发密钥激活流程的参数，密钥激活流程与图3A-图4所示的实施例中的密钥激活流程相同，在此不再赘述，在下面的介绍中，以密钥激活流程为AS SMC流程为例，则密钥激活流程的参数即进行AS SMC流程的参数，即，接入网网元A可以在需要触发AS SMC流程，但却没有必要参数(例如，密钥)时，主动向核心网网元请求该第一消息。例如，接入网网元A需要与终端设备1交互无线资源控制(radio resource control，RRC)信令，该RRC信令是需要在被保护的情况下才可以发送，但是接入网网元没有接收到核心网网元发送的第一消息或接入网网元A中没有存储与终端设备1进行AS SMC流程时使用的基础根密钥KgNB，则接入网网元A主动向核心网网元发送该第三消息。
通过上述方式，接入网网元A可以随时向终端设备1发送需要安全保护的消息，提高安全验证的灵活性。
需要说明的是，当接入网网元A与终端设备1进行一次AS SMC流程后，接入网网元A中可以存储与终端设备1进行AS SMC流程的基础根密钥KgNB，例如，通过inactive流程进行保存，这样，当终端设备1由空闲态变为与接入网网元A连接的连接态时，接入网网元A可以根据存储的基础根密钥KgNB再次出发AS SMC流程。或者，当接入网网元A与终端设备1进行一次AS SMC流程后，终端设备1由连接态变为空闲态时，接入网网元A可以删除与终端设备1进行AS SMC流程的基础根密钥KgNB，这样，当终端设备1再次变为连接态时，接入网网元A则需要重新获取KgNB，在这种情况，接入网网元A则可以主动向核心网网元发送该第三消息请求KgNB。可选地，该请求可以随着其他消息，比如第四消息，或其他N2消息，发送给核心网网元，也可以单独发给核心网网元。
另外，需要说明的是，与接入网网元A连接的终端设备可以有多个，例如，包括终端设备1、终端设备2以及终端设备3，若核心网网元中不同的UE对应的进行AS SMC流程的密钥不同，则接入网网元A向核心网网元发送的第三消息中，还可以携带终端设备1的标识信息，例如，终端设备1的用户永久标识(subcriber permanent UE identity，SUPI)，全球唯一临时UE标识(globally unique temporary UE identity，GUTI)，或某种核心网网元提供的索引号等，从而当核心网网元接收到该第三消息后，将与终端设备1对应的进行AS SMC流程的密钥通知给接入网网元A。
需要说明的是，步骤401为可选的步骤，即不是必须执行的。即，若接入网网元A中存储了用于触发与终端设备1之间的AS SMC流程的参数，例如，进行AS SMC流程的密钥或者基础根密钥KgNB时，则可以不执行步骤401，或者接入网网元A也可以通过其他方式获取该用于触发与终端设备1之间的AS SMC流程的参数，在此不作限制。
步骤402、核心网网元与终端设备1进行鉴权。
步骤403、核心网网元向终端设备1发送NAS SMC消息，终端设备1接收NAS SMC 消息。
步骤404、终端设备1根据NAS SMC消息激活NAS安全。
步骤405、终端设备1向核心网网元发送NAS SMP消息，核心网网元接收该NAS SMP消息，并激活NAS安全。
步骤402-步骤405与步骤303-步骤306相同，在此不再赘述。步骤402-步骤405为可选步骤，不是必须要执行的，即当核心网网元接收接入网网元A发送的第三消息后，可以通过步骤402-步骤405进行鉴权及NAS层安全验证过程，也可以不执行步骤402-步骤405的验证过程，在此不作限制。
步骤406、核心网网元确定终端设备1是否需要进行接入层安全模式命令AS SMC流程。
当核心网网元接收该第三消息后，则可以确定终端设备1是否需要进行AS SMC流程。在本申请实施例中，核心网网元可以确定终端设备1的类型，通过终端设备1的类型确定是否需要进行AS SMC流程；或者，核心网网元可以根据在接收到该第三消息后才从其他核心网网元处获得的QoS信息，确定是否需要进行AS SMC流程；或者，核心网网元可以从自身或者其他网元中获取终端设备1当前接入的接入网网元的状态信息，确定是否需要进行AS SMC流程；或者，核心网网元可以通过配置的策略或者网管系统提供的策略来确定是否需要进行AS SMC流程；或者，核心网网元接收该第三消息后，可以根据第三消息携带的指示信息进行判断是否需要进行AS SMC流程，指示信息可以来自接入网网元A，步骤406与步骤302相同，在此不再赘述。
需要说明的是，步骤406为可选的步骤，即不是必须执行的。
另外，需要说明的是，步骤406与步骤402-步骤405之间的执行顺序、步骤406的执行次数以及步骤406中的确定结果的指示时机与步骤302与步骤303-步骤306相同，在此不再赘述。
步骤407、核心网网元向接入网网元A发送第一消息，该接入网网元A接收该第一消息。
步骤408、接入网网元A根据该第一消息确定是否需要向终端设备1发送第二消息。
步骤409、若确定需要，接入网网元A向终端设备1发送该第二消息，终端设备1接收该第二消息。
步骤410、终端设备1向接入网网元A发送第五消息，接入网网元A接收该第五消息。
步骤407-步骤410与步骤307-步骤310相同，在此不再赘述。
需要说明的是，本申请实施例中描述的技术方案以步骤401-步骤410为例进行了说明，在可能的实施方式中，本申请实施例中的技术方案也可以包含其他步骤，在此不作限制。
在上述技术方案中，核心网网元或者接入网网元可以首先根据实际情况先判断是否需要进行安全保护功能的激活流程，在确定需要时，才触发与终端设备的安全保护功能的激活流程，若确定不需要，则直接不进行该激活流程，从而可以避免像4G系统中单一地执行该激活流程时造成的信令资源浪费以及时延问题，进一步，通过在执行该激活流程之前先进行判断的方式，使得系统可以针对不同的系统要求采用不同的 处理方式，可以提高系统的灵活性。
在图3A至图4所示的实施例中，介绍了通过核心网网元生成进行安全保护功能的激活流程的密钥，并将该密钥指示给接入网网元的过程，由于该激活流程是接入网网元与终端设备之间进行的，因此，为简化核心网网元的计算复杂度，在另一种方式中，也可以由接入网网元来生成该密钥。
请参考图5-图7，为本申请实施例提供的一种密钥生成方法的流程图，以该方法应用在图2所示的系统中为例，该流程图的描述如下：
步骤501、接入网网元获取第一输入信息及第二输入信息。
在本申请实施例中，该第一输入信息为终端设备用于生成目标密钥的信息，该目标密钥为进行密钥激活流程的密钥，密钥激活流程与图3A-图4所示的实施例中的密钥激活流程相同，在此不再赘述，后文以该安全验证为AS SMC流程为例，则该密钥激活流程的密钥即AS SMC流程的密钥，该第二输入信息为该接入网网元用于生成该目标密钥的信息。
由于图5所述的密钥生成方法与图3A至图4中的实施例的应用场景相同，为方便说明，因此，在下面的描述中继续以接入网网元为接入网网元A，终端设备为终端设备1为例进行介绍。
在本申请实施例中，进行AS SMC流程的密钥与图3A至图4所示的实施例中进行AS SMC流程的密钥相同，在此不再赘述。
在一种可能的实施方式中，第一输入信息可以是终端设备1用于生成该密钥的生成材料，例如，随机数1。第二输入信息可以是接入网网元A用于生成该密钥的生成材料。例如，随机数2。当然，该第一输入信息和该第二输入信息也可以是其他内容，在此不作限制。
在本申请实施例中，接入网网元A获取第一输入信息及第二输入信息的方式可以有多种，下面则对接入网网元A获取第一输入信息和接入网网元A获取第二输入信息分别进行说明。
a)接入网网元A获取第二输入信息的方式。
第一种方式：接入网网元A从核心网网元获取该第二输入信息。
一种可能的实施方式，接入网网元A可以向核心网网元请求获取该第二输入信息，若核心网网元中存储有该第二输入信息，则核心网网元将该第二输入信息发送给接入网网元A。
另一种可能的实施方式，接入网网元A在向核心网网元请求获取该第二输入信息后，核心网网元可以将用于生成该第二输入信息的材料和/或算法发送给接入网网元A，然后有接入网网元A根据该用于生成该第二输入信息的材料和/或算法生成第二输入信息。例如，用于生成该第二输入信息的材料为终端设备1的安全能力信息，该安全能力信息可以包含终端设备1支持的加密规则、进行完整性保护的规则以及终端设备1的能力等级信息等，在本申请实施例中不对该安全能力信息包含的内容进行限制。当终端设备1向核心网网元发送注册请求消息或者服务请求消息时，会将终端设备1的安全能力信息携带在该请求消息中，则核心网网元从该请求消息中获取终端设备1的安全能力信息，当接入网网元A向核心网网元请求获取该第二输入信息时，核心网网元则将终端设备1的安全能力信息发送给接入网网元A，接入网网元A则根据该安 全能力信息生成第二输入信息。
第二种方式：接入网网元A根据自身存储的信息获取该第二输入信息。
一种可能的实施方式，接入网网元A可以根据预设的信息获取该第二输入信息。比如，接入网网元中存储有多个可用的密钥，每个密钥对应有一个标识信息，例如索引号，接入网网元A生成一个随机数，或者接入网网元A利用对称密钥机制生成一个中间参数，将中间参数参与计算，获得目标密钥的索引号，从而获得目标密钥。
第三种方式：接入网网元A根据与终端设备1的无线资源控制RRC信令中包含的信息获取该第二输入信息。
一种可能的实施方式，接入网网元A首先接收终端设备1发送的第一无线资源控制RRC信令，该第一RRC信令可以为终端设备1向核心网网元发送注册请求消息或者服务请求消息的承载信令，终端设备1会将其安全能力信息携带在该RRC信令中，具体来讲，该请求消息包含两层，第一层是RRC层，第二层是NAS层，NAS层高于RRC层，该请求消息的RRC层和NAS层中均可携带有该安全能力信息。由于该请求消息需要由接入网网元A转发给核心网网元，因此，接入网网元A便获取终端设备1发送给核心网网元的请求消息，并从该请求消息中获取RRC层数据，即该第一RRC信令，然后，接入网网元A则从该第一RRC信令中获取终端设备1的安全能力信息，并根据终端设备1的安全能力信息生成该第二输入信息。当然，第一RRC信令也可以是与向核心网网元发送的承载注册请求消息或服务请求消息独立的其他RRC信令，例如，接入网网元A可以向终端设备1发送请求获取安全能力信息的RRC信令，然后终端设备1则通过该第一RRC信令向接入网网元A反馈安全能力信息，该第一RRC信令为专门用于承载终端设备1的安全能力信息的信令。当然，第一RRC信令也可以是其他形式，在此不作限制。
通过该上述方式，接入网网元A可以无须再向核心网网元请求终端设备1的安全能力信息，可以减少信令开销。
b)接入网网元A获取第一输入信息的方式。
第一种方式：接入网网元A从核心网网元获取该第一输入信息。
一种可能的实施方式，接入网网元A可以向核心网网元请求获取该第一输入信息，若核心网网元中存储有终端设备1的第一输入信息，则核心网网元将该第一输入信息发送给接入网网元A；若核心网网元中未存储有终端设备1的第一输入信息，则核心网网元可以通过与终端设备1的交互获取该第一输入信息，然后将该第一输入信息发送给接入网网元A。例如，终端设备1可以向核心网网元发送注册请求消息或者服务请求消息，在该注册请求消息或者服务请求消息中携带终端设备1的第一输入信息，则核心网网元则从该注册请求消息或者服务请求消息中获取该第一输入信息，进而将该第一输入信息发送给接入网网元A。
另一种可能的实施方式，核心网网元将第一输入信息发送给接入网网元A。比如，第一输入信息携带在注册请求、会话请求等NAS信令中，核心网网元从NAS信令中获取第一输入信息，核心网网元随后将第一输入信息发送给接入网网元A。
第二种方式：接入网网元A从自身的存储单元中获取该第一输入信息。
一种可能的实施方式，接入网网元A中预先存储有终端设备1的第一输入信息，例如，终端设备1在当前时刻之前与接入网网元A进行了数据交互，该交互的数据为 需要保护的数据，然后，终端设备1由连接态变为第三态了，比如inactive态，在这种情况下，接入网网元A想要再次与终端设备1进行数据交互，接入网网元A中还存储有终端设备1的第一输入信息，则接入网网元A直接从自身的存储单元中获取该第一输入信息。
第三种方式：接入网网元A通过无线资源控制RRC信令获取该第一输入信息。
一种可能的实施方式，接入网网元A首先接收终端设备1发送的二无线资源控制RRC信令，该第二RRC信令可以为终端设备1承载向核心网网元发送注册请求消息或者服务请求消息，终端设备1会将其第一输入信息携带在该请求消息中，在这种情况下，第二RRC信令与第一RRC信令为同一个RRC信令，即在第一RRC信令或第二RRC信令中同时携带有终端设备1的安全能力信息以及第一输入信息，然后，接入网网元A则从该RRC信令中获取该第一输入信息。
当然，该第二RRC信令也可以是与该第一RRC信令不同的RRC信令，例如，接入网网元A可以从AS SMP消息中获取第一输入信息，或者接入网网元A向终端设备1发送请求获取第一输入信息的RRC信令，然后终端设备1则通过该第二RRC信令向接入网网元A反馈该第一输入信息，该第二RRC信令为专门用于承载该第一输入信息的信令。当然，第二RRC信令也可以是其他形式，在此不作限制。
第四种方式：接入网网元A通过预设流程获取该第一输入信息。
一种可能的实施方式中，请参考图6，接入网网元A获取该第一输入信息的方法包括如下步骤：
步骤601、接入网网元A向终端设备1发送第三消息，终端设备1接收该第三消息。
在本申请实施例中，该第三消息是被公钥进行签名过的消息，接入网网元A中预先配置有该公钥。该第三消息具体可以是用于进行AS SMC流程的消息，例如，AS SMC消息等。
需要说明的是，该公钥也可以替换为证书或者其他用于对消息进行完整性保护的信息，在此不作限制。
步骤602、终端设备1使用该公钥对该第三消息的签名进行验证。
该公钥可以是预先配置在终端设备1中的，也可以是终端设备1预先从接入网网元A中获取的，也可以是通过其他方式获取的，在此不作限制。终端设备1接收该第三消息后，则使用该公钥对该第三消息的签名进行验证，具体验证过程与现有技术中的验证过程相同，在此不再赘述。
步骤603、该第三消息的签名正确，终端设备1根据该第三消息中的参数及第一输入信息生成目标密钥。
在这种情况下，该目标密钥为AS SMC流程所激活的密钥，即在终端设备1完成AS SMC流程后，开始使用该目标密钥对后续消息进行保护。终端设备1生成目标密钥的方式如下：
第一种情况：第三消息中包含接入网网元A用于生成该目标密钥的第二输入信息，则终端设备1根据该第二输入信息及该第一输入信息生成该目标密钥。例如，终端设备1中预先存储有多种生成该目标密钥的算法，终端设备1从中选择一种算法，对该第一输入信息和第二输入信息进行运算，获得该目标密钥。
第二种情况：该第三消息中包含有该第二输入信息及用于生成该目标密钥的算法，终端设备1则根据该算法、第一输入信息及第二输入信息生成该目标密钥。
步骤604、终端设备1向接入网网元A发送第四消息，接入网网元A接收该第四消息。
在本申请实施例中，该第四消息通过该目标密钥进行完整性保护处理，该第四消息包含该第一输入信息。
一种可能的实施方式，若第三消息为用于进行AS SMC流程的消息，则第四消息可以为用于对第三消息进行反馈的消息，例如，可以为AS SMP消息等。
需要说明的是，当该第三消息为用于进行AS SMC流程的消息时，终端设备1执行步骤604之前，可以根据该第三消息激活AS安全，具体激活AS安全的过程与现有技术中相同，在此不再赘述。
步骤605、接入网网元A从该第四消息获取该第一输入信息。
需要说明的是，接入网网元A可以采用a)中的多种方式中的任意一种获取该第二输入信息，以及可以采用b)中的多种方式中的任意一种获取该第一输入信息，即a)和b)中的方式可以进行任意组合，例如，采用a)中的第一种方式获取该第二输入信息，并采用b)中的第二种方式获取该第一输入信息，或者，采用a)中的第三种方式获取该第二输入信息，并采用b)中的第一种方式获取该第一输入信息，在此不作限制。
另外，需要说明的是，在本申请实施例中不对接入网网元A获取第一输入信息以及获取第二输入信息的顺序进行限制，即接入网网元A可以先获取第一输入信息在获取第二输入信息，也可以先获取第二输入信息在获取第一输入信息，也可以同时获取第一输入信息及第二输入信息，当然，若第一输入信息需要通过第二输入信息才能获取，例如步骤603中的前两种情况所述，则接入网网元A需要先获取该第二输入信息在获取该第一输入信息。
步骤502、接入网网元A根据该第一输入信息和第二输入信息，生成该目标密钥。
步骤502与步骤603相同，在此不再赘述。
当接入网网元A采用b)中的前三种方式中的其中一种方式获取该第一输入信息时，请参考图5，本申请实施例中的方法还可以包括：
步骤503、接入网网元A向终端设备1发送第一消息。
在本申请实施例中，该第一消息被该目标密钥进行完整性保护和/或使用该目标密钥进行加密。该第一消息的形式及包含的内容与步骤601中的第三消息相同，步骤503与步骤601相同，在此不再赘述。
步骤504、终端设备1根据该第一消息及该第一输入信息生成该目标密钥。
一种可能的实施方式中，第一消息被该公钥进行完整性保护，则终端设备1使用该公钥对该第一消息的签名进行验证，在这种情况下，步骤504与步骤602相同，在此不再赘述。当验证正确后，则使用该第一消息中的第二输入信息及第一输入信息生成该目标密钥。
一种可能的实施方式中，第一消息使用该公钥进行加密，则终端设备1使用该公钥对该第一消息进行解密，若解码成功，则使用该第一消息中的第二输入信息及第一输入信息生成该目标密钥。
步骤505、终端设备1向接入网网元A发送第二消息，接入网网元A接收该第二 消息。
在本申请实施例中，该第二消息通过该目标密钥进行完整性保护处理。该第二消息与步骤604中的第四消息相同，在此不再赘述。
步骤506、接入网网元A使用该目标密钥对该第二消息进行验证，在验证成功时，完成AS SMC流程。
由于该第二消息使用该目标密钥进行完整性保护处理，在接入网网元A只能获取该第二消息中的信息但是无法对该第二消息进行更改，因此，若接入网网元A使用自身生成的目标密钥成功解除对该第二消息的完整性保护处理时，则表示验证成功，进而完成AS SMC流程。
当然，若存在第三方应用对终端设备1发送的第一输入信息进行篡改，例如，将第一RRC信令中的第一输入信息篡改为第三输入信息，则接入网网元A将获得第三输入信息，在这种情况下，接入网网元A根据第三输入信息和第二输入信息生成的密钥必然与终端设备1根据第一输入信息和第二输入信息生成的密钥不同，从而当接入网网元A接收该第二消息后，将无法解除对该第二消息的完整性保护处理，即表示验证失败，无法激活AS安全。
需要说明的是，在本申请实施例中，该第一输入信息为接入网网元A实际接收到的信息，该第一输入信息可以与终端设备1生成该目标密钥实际使用的输入信息相同，也可以与终端设备1生成该目标密钥实际使用的输入信息不同。
当接入网网元A采用b)中的第四种方式获取该第一输入信息时，请参考图7，本申请实施例中的方法还可以包括：
步骤507、接入网网元A使用该目标密钥对该第四消息进行验证，在验证成功时，完成AS SMC流程。
接入网网元A使用该目标密钥对该第四消息进行验证的过程与步骤506中接入网网元A使用该目标密钥对该第二消息进行验证的过程相同，在此不再赘述。
需要说明的是，本申请实施例中描述的技术方案以步骤501-步骤507为例进行了说明，在可能的实施方式中，本申请实施例中的技术方案也可以包含其他步骤，在此不作限制。
在上述技术方案中，接入网网元可以直接根据该第一输入信息和该第二输入信息，生成进行该密钥激活流程的密钥，从而接入网网元的安全保护功能的激活可以由接入网网元自身决定，而无需依赖核心网网元，可以使接入网网元和终端设备的安全协商更加灵活。
上述本申请提供的实施例中，分别从网络设备、终端设备、以及网络设备和终端设备之间交互的角度对本申请实施例提供的方法进行了介绍。为了实现上述本申请实施例提供的方法中的各功能，网络设备和终端设备可以包括硬件结构和/或软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行，取决于技术方案的特定应用和设计约束条件。
图8示出了一种装置800的结构示意图。其中，装置800可以是接入网网元，能够实现本申请实施例提供的方法中接入网网元的功能；装置800也可以是能够支持接入网网元实现本申请实施例提供的方法中接入网网元的功能的装置。装置800可以是 硬件结构、软件模块、或硬件结构加软件模块。装置800可以由芯片系统实现。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置800可以包括接收模块801和确定模块802。
接收模块801可以用于执行图3A-图3C所示的实施例中的步骤307，或者图4所示的实施例中的步骤407，和/或用于支持本文所描述的技术的其它过程。接收模块801用于装置800和其它模块进行通信，其可以是电路、器件、接口、总线、软件模块、收发器或者其它任意可以实现通信的装置。
确定模块802可以用于执行图3A-图3C所示的实施例中的步骤308，或者图4所示的实施例中的步骤408，和/或用于支持本文所描述的技术的其它过程。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图9示出了一种装置900的结构示意图。其中，装置900可以是核心网网元，能够实现本申请实施例提供的方法中核心网网元的功能；装置900也可以是能够支持核心网网元实现本申请实施例提供的方法中核心网网元的功能的装置。装置900可以是硬件结构、软件模块、或硬件结构加软件模块。装置900可以由芯片系统实现。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置900可以包括通信模块901和确定模块902。
通信模块901可以用于执行图3A-图3C所示的实施例中的步骤301、303、304、306以及307中的任意一个步骤，或者图4所示的实施例中的步骤401、402、403以及407中的任意一个步骤，和/或用于支持本文所描述的技术的其它过程。通信模块901用于装置900和其它模块进行通信，其可以是电路、器件、接口、总线、软件模块、收发器或者其它任意可以实现通信的装置。
确定模块902可以用于执行图3A-图3C所示的实施例中的步骤302，或者图4所示的实施例中的步骤406，和/或用于支持本文所描述的技术的其它过程。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图10示出了一种装置1000的结构示意图。其中，装置1000可以是终端设备，能够实现本申请实施例提供的方法中终端设备的功能；装置1000也可以是能够支持终端设备实现本申请实施例提供的方法中终端设备的功能的装置。装置1000可以是硬件结构、软件模块、或硬件结构加软件模块。装置1000可以由芯片系统实现。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1000可以包括通信模块1001和确定模块1002。
通信模块1001可以用于执行图5所示的实施例中的步骤505，或者图6所示的实施例中的步骤604，和/或用于支持本文所描述的技术的其它过程。通信模块1001用于装置1000和其它模块进行通信，其可以是电路、器件、接口、总线、软件模块、收发器或者其它任意可以实现通信的装置。
确定模块1002可以用于执行图5所示的实施例中的步骤504，或者图6所示的实施例中的步骤602或者步骤603，和/或用于支持本文所描述的技术的其它过程。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
图11示出了一种装置1100的结构示意图。其中，装置1100可以是终端设备，能够实现本申请实施例提供的方法中接入网网元的功能；装置1100也可以是能够支持接入网网元实现本申请实施例提供的方法中接入网网元的功能的装置。装置1100可以是硬件结构、软件模块、或硬件结构加软件模块。装置1100可以由芯片系统实现。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1100可以包括通信模块1101和确定模块1102。
通信模块1101可以用于执行图5所示的实施例中的步骤503，或者图6所示的实施例中的步骤601，和/或用于支持本文所描述的技术的其它过程。通信模块1101用于装置1000和其它模块进行通信，其可以是电路、器件、接口、总线、软件模块、收发器或者其它任意可以实现通信的装置。
确定模块1102可以用于执行图5所示的实施例中的步骤501、步骤502以及步骤506中的任意一个步骤，或者图6所示的实施例中的步骤605，和/或用于支持本文所描述的技术的其它过程。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能模块可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
如图12所示为本申请实施例提供的装置1200，其中，装置1200可以是图3A-图4所示的实施例中的接入网网元，能够实现本申请实施例提供的方法中接入网网元的功能；装置1200也可以是能够支持接入网网元实现本申请实施例提供的方法中接入网网元的功能的装置。其中，该装置1200可以为芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1200包括至少一个处理器1220，用于实现或用于支持装置1200实现本申请实施例提供的方法中接入网网元的功能。示例性地，处理器1220可以根据第一消息确定是否需要向终端设备发送用于触发终端设备进行密钥激活流程的第二消息，具体参见方法示例中的详细描述，此处不做赘述。
装置1200还可以包括至少一个存储器1230，用于存储程序指令和/或数据。存储器1230和处理器1220耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器1220可能和存储器1230协同操作。处理器1220可能执行存储器1230中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
装置1200还可以包括通信接口1210，用于通过传输介质和其它设备进行通信，从而用于装置1200中的装置可以和其它设备进行通信。示例性地，该其它设备可以是终端设备。处理器1220可以利用通信接口1210收发数据。
本申请实施例中不限定上述通信接口1210、处理器1220以及存储器1230之间的具体连接介质。本申请实施例在图12中以存储器1230、处理器1220以及通信接口1210之间通过总线1240连接，总线在图12中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总 线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器1220可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器1230可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
如图13所示为本申请实施例提供的装置1300，其中，装置1300可以是核心网网元，能够实现本申请实施例提供的方法中核心网网元的功能；装置1300也可以是能够支持核心网网元实现本申请实施例提供的方法中核心网网元的功能的装置。其中，该装置1300可以为芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1300包括至少一个处理器1320，用于实现或用于支持装置1300实现本申请实施例提供的方法中核心网网元的功能。示例性地，处理器1320可以确定终端设备是否需要进行密钥激活流程，具体参见方法示例中的详细描述，此处不做赘述。
装置1300还可以包括至少一个存储器1330，用于存储程序指令和/或数据。存储器1330和处理器1320耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器1320可能和存储器1330协同操作。处理器1320可能执行存储器1330中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
装置1300还可以包括通信接口1310，用于通过传输介质和其它设备进行通信，从而用于装置1300中的装置可以和其它设备进行通信。示例性地，该其它设备可以是终端设备。处理器1320可以利用通信接口1310收发数据。
本申请实施例中不限定上述通信接口1310、处理器1320以及存储器1330之间的具体连接介质。本申请实施例在图13中以存储器1330、处理器1320以及通信接口1310之间通过总线1340连接，总线在图13中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器1320可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方 法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器1330可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
如图14所示为本申请实施例提供的装置1400，其中，装置1400可以是图5-图7所示的实施例中的接入网网元，能够实现本申请实施例提供的方法中接入网网元的功能；装置1400也可以是能够支持接入网网元实现本申请实施例提供的方法中接入网网元的功能的装置。其中，该装置1400可以为芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1400包括至少一个处理器1420，用于实现或用于支持装置1400实现本申请实施例提供的方法中接入网网元的功能。示例性地，处理器1420可以根据第一输入信息和第二输入信息，生成进行密钥激活流程的目标密钥，具体参见方法示例中的详细描述，此处不做赘述。
装置1400还可以包括至少一个存储器1430，用于存储程序指令和/或数据。存储器1430和处理器1420耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器1420可能和存储器1430协同操作。处理器1420可能执行存储器1430中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
装置1400还可以包括通信接口1410，用于通过传输介质和其它设备进行通信，从而用于装置1400中的装置可以和其它设备进行通信。示例性地，该其它设备可以是终端设备。处理器1420可以利用通信接口1410收发数据。
本申请实施例中不限定上述通信接口1410、处理器1420以及存储器1430之间的具体连接介质。本申请实施例在图14中以存储器1430、处理器1420以及通信接口1410之间通过总线1440连接，总线在图14中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图14中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器1420可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器1430可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存 储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
如图15所示为本申请实施例提供的装置1500，其中，装置1500可以是图5-图7所示的实施例中的终端设备，能够实现本申请实施例提供的方法中终端设备的功能；装置1500也可以是能够支持终端设备实现本申请实施例提供的方法中终端设备的功能的装置。其中，该装置1500可以为芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
装置1500包括至少一个处理器1520，用于实现或用于支持装置1500实现本申请实施例提供的方法中接入网网元的功能。示例性地，处理器1520可以使用公钥对第三消息的签名进行验证，若签名正确，则根据该第三消息及第一输入信息生成进行密钥激活流程的目标密钥，具体参见方法示例中的详细描述，此处不做赘述。
装置1500还可以包括至少一个存储器1530，用于存储程序指令和/或数据。存储器1530和处理器1520耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器1520可能和存储器1530协同操作。处理器1520可能执行存储器1530中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
装置1500还可以包括通信接口1510，用于通过传输介质和其它设备进行通信，从而用于装置1500中的装置可以和其它设备进行通信。示例性地，该其它设备可以是终端设备。处理器1520可以利用通信接口1510收发数据。
本申请实施例中不限定上述通信接口1510、处理器1520以及存储器1530之间的具体连接介质。本申请实施例在图15中以存储器1530、处理器1520以及通信接口1510之间通过总线1540连接，总线在图15中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器1520可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
在本申请实施例中，存储器1530可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。本申请实施例中的存储器还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。
本申请实施例中还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行图3A至图7中任意一个实施例中所述接入网网元执行的方法。
本申请实施例中还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行图3A至图4中任意一个实施例中所述核心网网网元执行的方法。
本申请实施例中还提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行图3A至图7中任意一个实施例中所述终端设备执行的方法。
本申请实施例提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现前述方法中接入网网元的功能。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现前述方法中核心网网元的功能。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现前述方法中终端设备的功能。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例提供了一种系统，所述系统包括前述所述的接入网网元和所述核心网网元。
本申请实施例提供了一种系统，所述系统包括前述所述的接入网网元和所述终端设备。
本申请实施例提供的方法中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，简称DSL)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机可以存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，简称DVD))、或者半导体介质(例如，SSD)等。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (47)

  1. 一种信息发送方法，其特征在于，包括：
    接入网网元接收第一消息；
    所述接入网网元根据所述第一消息确定是否需要向终端设备发送第二消息，所述第二消息用于触发所述终端设备进行密钥激活流程；
    若确定需要，所述接入网网元向终端设备发送所述第二消息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息包括如下信息中的至少一种：
    用于保护所述第二消息的密钥；
    用于生成所述密钥的基础根密钥KgNB；
    密钥标识符，用于指示所述密钥；
    指示信息，用于指示是否需要触发密钥激活流程；
    终端设备的类型；
    所述终端设备需要进行的业务所要求的时延。
  3. 根据权利要求1或2所述的方法，其特征在于，在接入网网元接收所述第一消息之前，所述方法还包括：
    所述接入网网元向核心网网元发送第三消息，所述第三消息用于请求触发所述密钥激活流程的参数。
  4. 根据权利要求2或3所述的方法，其特征在于，所述接入网网元根据所述第一消息确定是否需要向终端设备发送第二消息，包括：
    所述接入网网元根据预设的策略及所述第一消息确定是否需要向终端设备发送所述第二消息。
  5. 一种信息发送方法，其特征在于，包括：
    核心网网元确定终端设备是否需要进行所述密钥激活流程；
    所述核心网网元向接入网网元发送第一消息，其中，所述第一消息用于指示所述接入网网元是否向所述终端设备发送第二消息，所述第二消息用于触发所述终端设备进行所述密钥激活流程。
  6. 根据权利要求5所述的方法，其特征在于，所述第一消息包括如下信息中的至少一种：
    用于保护所述第二消息的密钥；
    用于生成所述密钥的基础根密钥KgNB；
    密钥标识符，用于指示所述密钥；
    指示信息，用于指示所述确定的结果；
    终端设备的类型；
    所述终端设备需要进行的业务所要求的时延。
  7. 根据权利要求5或6所述的方法，其特征在于，所述核心网网元确定终端设备是否需要进行所述密钥激活流程之前，所述方法还包括：
    接收第四消息，所述第四消息用于所述终端设备接入核心网或者所述终端设备向所述核心网网元请求建立发送业务数据的连接。
  8. 根据权利要求7所述的方法，其特征在于，所述核心网网元确定终端设备是否 需要进行所述密钥激活流程，包括：
    若所述第四消息的类型为需要建立用户面数据的类型，所述核心网网元确定需要进行所述密钥激活流程。
  9. 一种密钥生成方法，其特征在于，包括：
    接入网网元获取第一输入信息及第二输入信息，其中，所述第一输入信息为终端设备获取的用于生成目标密钥的信息，所述目标密钥为进行密钥激活流程的密钥，所述第二输入信息为所述接入网网元获取的用于生成所述目标密钥的信息；
    所述接入网网元根据所述第一输入信息和所述第二输入信息，生成所述目标密钥。
  10. 根据权利要求9所述的方法，其特征在于，接入网网元获取第二输入信息，包括：
    所述接入网网元获取所述终端设备的安全能力信息；
    所述接入网网元根据所述安全能力信息确定所述第二输入信息。
  11. 根据权利要求9或10所述的方法，其特征在于，所述接入网网元获取所述终端设备的安全能力信息，包括：
    所述接入网网元接收所述终端设备发送的第一无线资源控制RRC信令；
    所述接入网网元从所述第一RRC信令中获取所述安全能力信息。
  12. 根据权利要求9-11中任一项所述的方法，其特征在于，获取第一输入信息，包括：
    所述接入网网元向所述终端设备发送第三消息，其中，所述第三消息是被公钥进行签名过的消息；
    所述接入网网元接收所述终端设备发送的第四消息，其中，所述第四消息通过所述目标密钥进行完整性保护处理，所述第四消息包含所述第一输入信息；
    所述接入网网元从所述第四消息获取所述第一输入信息。
  13. 一种密钥生成方法，其特征在于，包括：
    终端设备接收接入网网元发送的第三消息，其中，所述第三消息是被公钥进行签名过的消息；
    所述终端设备使用所述公钥对所述第三消息的签名进行验证；
    若所述第三消息的签名正确，所述终端设备根据所述第三消息及第一输入信息生成目标密钥，其中，所述第一输入信息为所述终端设备用于生成目标密钥的信息，所述目标密钥为进行密钥激活流程的密钥。
  14. 根据权利要求13所述的方法，其特征在于，所述第三消息中包含第二输入信息，所述第二输入信息为所述接入网网元用于生成所述目标密钥的信息。
  15. 根据权利要求13或14所述的方法，其特征在于，在所述终端设备根据所述第三消息及第一输入信息生成目标密钥之后，所述方法还包括：
    所述终端设备向所述接入网网元发送第四消息，其中，所述第四消息通过所述目标密钥进行完整性保护处理。
  16. 一种装置，其特征在于，包括：
    通信接口，用于接收第一消息；
    处理器，用于根据所述第一消息确定是否需要向终端设备发送第二消息，所述第二消息用于触发所述终端设备进行密钥激活流程；以及，若确定需要，所述接入网网 元向终端设备发送所述第二消息。
  17. 根据权利要求16所述的装置，其特征在于，所述第一消息包括如下信息中的至少一种：
    用于保护所述第二消息的密钥；
    用于生成所述密钥的基础根密钥KgNB；
    密钥标识符，用于指示所述密钥；
    指示信息，用于指示是否需要触发密钥激活流程；
    终端设备的类型；
    所述终端设备需要进行的业务所要求的时延。
  18. 根据权利要求16或17所述的装置，其特征在于，所述通信接口还用于：
    向核心网网元发送第三消息，所述第三消息用于请求触发所述密钥激活流程的参数。
  19. 根据权利要求17或18所述的方法，其特征在于，所述处理器具体用于：
    根据预设的策略及所述第一消息确定是否需要向终端设备发送所述第二消息。
  20. 一种装置，其特征在于，包括：
    处理器，用于确定终端设备是否需要进行所述密钥激活流程；
    通信接口，用于向接入网网元发送第一消息，其中，所述第一消息用于指示所述接入网网元是否向所述终端设备发送第二消息，所述第二消息用于触发所述终端设备进行所述密钥激活流程。
  21. 根据权利要求20所述的装置，其特征在于，所述第一消息包括如下信息中的至少一种：
    用于保护所述第二消息的密钥；
    用于生成所述密钥的基础根密钥KgNB；
    密钥标识符，用于指示所述密钥；
    指示信息，用于指示所述确定的结果；
    终端设备的类型；
    所述终端设备需要进行的业务所要求的时延。
  22. 根据权利要求20或21所述的装置，其特征在于，所述通信接口还用于：
    接收第四消息，所述第四消息用于所述终端设备接入核心网或者所述终端设备向所述核心网网元请求建立发送业务数据的连接。
  23. 根据权利要求22所述的装置，其特征在于，所述处理器具体用于：
    若所述第四消息的类型为需要建立用户面数据的类型，确定需要进行所述密钥激活流程。
  24. 一种装置，其特征在于，包括：
    通信接口，用于获取第一输入信息及第二输入信息，其中，所述第一输入信息为终端设备获取的用于生成目标密钥的信息，所述目标密钥为进行密钥激活流程的密钥，所述第二输入信息为所述接入网网元获取的用于生成所述目标密钥的信息；
    处理器，用于根据所述第一输入信息和所述第二输入信息，生成所述目标密钥。
  25. 根据权利要求24所述的装置，其特征在于，所述通信接口具体用于：
    获取所述终端设备的安全能力信息；
    根据所述安全能力信息确定所述第二输入信息。
  26. 根据权利要求24或25所述的装置，其特征在于，所述处理器具体用于：
    接收所述终端设备发送的第一无线资源控制RRC信令；
    从所述第一RRC信令中获取所述安全能力信息。
  27. 根据权利要求24-26中任一项所述的装置，其特征在于，所述通信接口具体用于：
    向所述终端设备发送第三消息，其中，所述第三消息是被公钥进行签名过的消息；
    接收所述终端设备发送的第四消息，其中，所述第四消息通过所述目标密钥进行完整性保护处理，所述第四消息包含所述第一输入信息；
    从所述第四消息获取所述第一输入信息。
  28. 一种装置，其特征在于，包括：
    通信接口，用于接收接入网网元发送的第三消息，其中，所述第三消息是被公钥进行签名过的消息；
    处理器，用于使用所述公钥对所述第三消息的签名进行验证；以及，若所述第三消息的签名正确，所述终端设备根据所述第三消息及第一输入信息生成目标密钥，其中，所述第一输入信息为所述终端设备用于生成目标密钥的信息，所述目标密钥为进行密钥激活流程的密钥。
  29. 根据权利要求28所述的装置，其特征在于，所述第三消息中包含第二输入信息，所述第二输入信息为所述接入网网元用于生成所述目标密钥的信息。
  30. 根据权利要求28或29所述的装置，其特征在于，所述通信接口还用于：
    向所述接入网网元发送第四消息，其中，所述第四消息通过所述目标密钥进行完整性保护处理。
  31. 一种计算机可读存储介质，其特征在于，所述介质上存储有指令，当其在计算机上运行时，使得计算机实现如权利要求1-4或5-8或9-12或13-15任一项所述的方法。
  32. 一种计算机程序产品，其特征在于，所述计算机程序产品包含有指令，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1-4或5-8或9-12或13-15任一项所述的方法。
  33. 一种信息发送的方法，其特征在于，所述方法包括：
    接入与管理功能网元AMF接收接入网网元发送的消息；
    若所述消息携带用于请求触发AS SMC的参数的指示信息，则向所述接入网网元发送所述安全上下文。
  34. 根据权利要求33所述的方法，其特征在于，所述向所述接入网网元发送所述安全上下文，包括：
    所述AMF向所述接入网网元发送携带所述安全上下文的初始上下文建立请求消息。
  35. 根据权利要求33或34所述的方法，其特征在于，所述安全上下文包括基础跟密钥KgNB。
  36. 根据权利要求33至35任一所述的方法，其特征在于，所述安全上下文用于触发接入层安全模式命令AS SMC流程。
  37. 一种信息发送方法，其特征在于，包括：
    接入与管理功能网元AMF接收接入网网元发送的请求消息；
    所述AMF根据所述请求消息确定是否需要向所述接入网设备发送必要参数；
    若确定需要发送所述必要参数，则所述AMF向所述接入网网元发送所述必要参数。
  38. 根据权利要求37所述的方法，其特征在于，所述请求消息中包括指示信息，其中，所述指示信息用于指示所述AMF是否需要向所述接入网设备发送必要参数。
  39. 根据权利要求38所述的方法，其特征在于，所述AMF向所述接入网网元发送所述必要参数，包括：
    所述AMF向所述接入网网元发送初始上下文建立请求消息，其中，所述初始上下文建立请求消息携带所述必要参数。
  40. 根据权利要求37至39任一所述的方法，其特征在于，所述必要参数为安全上下文。
  41. 根据权利要求37至39任一所述的方法，其特征在于，所述必要参数为基础根密钥KgNB。
  42. 根据权利要求37至39任一所述的方法，其特征在于，所述必要参数用于触发AS SMC流程。
  43. 一种信息发送方法，其特征在于，包括：
    接入网网元向接入与管理功能网元AMF消息；所述消息携带用于请求触发ASSMC的参数的指示信息；
    所述接入网网元接收来自所述AMF的安全上下文；以及
    所述接入网网元向终端发送接入层安全模式命令AS SMC消息，其中，所述ASSMC消息包括所述安全上下文。
  44. 根据权利要求43所述的方法，其特征在于，所述必要参数为基础根密钥KgNB。
  45. 一种核心网网元，其特征在于，包括处理器和存储器，所述存储器中存储有程序代码，当所述程序代码被运行时，所处处理器执行权利要求33至36任一所述的方法。
  46. 一种核心网网元，其特征在于，包括处理器和存储器，所述存储器中存储有程序代码，当所述程序代码被运行时，所处处理器执行权利要求37至42任一所述的方法。
  47. 一种接入网网元，其特征在于，包括处理器和存储器，所述存储器中存储有程序代码，当所述程序代码被运行时，所处处理器执行权利要求43或44所述的方法。
PCT/CN2019/080159 2018-04-08 2019-03-28 一种信息发送方法、密钥生成方法以及装置 WO2019196668A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
AU2019250928A AU2019250928C1 (en) 2018-04-08 2019-03-28 Information sending method, key generation method, and apparatus
BR112020019989-3A BR112020019989A2 (pt) 2018-04-08 2019-03-28 método de envio de informações, método de geração de chave, e aparelho
JP2021501070A JP7414796B2 (ja) 2018-04-08 2019-03-28 情報送信方法、鍵生成方法、及び機器
EP19786094.3A EP3758402A4 (en) 2018-04-08 2019-03-28 SENDING INFORMATION PROCEDURES, KEY GENERATION PROCESS AND DEVICE
US17/011,698 US20200403788A1 (en) 2018-04-08 2020-09-03 Information Sending Method, Key Generation Method, and Apparatus
AU2022204263A AU2022204263A1 (en) 2018-04-08 2022-06-17 Information sending method, key generation method, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810308232.1 2018-04-08
CN201810308232.1A CN110351722B (zh) 2018-04-08 2018-04-08 一种信息发送方法、密钥生成方法以及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/011,698 Continuation US20200403788A1 (en) 2018-04-08 2020-09-03 Information Sending Method, Key Generation Method, and Apparatus

Publications (1)

Publication Number Publication Date
WO2019196668A1 true WO2019196668A1 (zh) 2019-10-17

Family

ID=67819808

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/080159 WO2019196668A1 (zh) 2018-04-08 2019-03-28 一种信息发送方法、密钥生成方法以及装置

Country Status (7)

Country Link
US (1) US20200403788A1 (zh)
EP (1) EP3758402A4 (zh)
JP (1) JP7414796B2 (zh)
CN (2) CN110351722B (zh)
AU (2) AU2019250928C1 (zh)
BR (1) BR112020019989A2 (zh)
WO (1) WO2019196668A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572801B (zh) * 2020-09-30 2022-08-12 中兴通讯股份有限公司 会话建立方法、装置、接入网设备及存储介质
JP2022164457A (ja) * 2021-04-16 2022-10-27 ブラザー工業株式会社 通信装置及び通信装置のためのコンピュータプログラム
CN117692902B (zh) * 2024-02-02 2024-06-25 深圳市迈腾电子有限公司 一种基于嵌入式家庭网关的智能家居的交互方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2000042491A1 (en) * 1999-01-15 2000-07-20 Rainbow Technologies, Inc. Usb-compliant personal key with integral input and output devices
CN101505479A (zh) * 2009-03-16 2009-08-12 中兴通讯股份有限公司 一种认证过程中安全上下文协商方法和系统
WO2010052920A1 (ja) * 2008-11-07 2010-05-14 パナソニック株式会社 ハンドオーバ方法、その方法で用いられる移動端末及びホームエージェント
US20110161661A1 (en) * 2009-12-31 2011-06-30 General Instrument Corporation Enhanced authorization process using digital signatures
CN102843651A (zh) * 2011-06-22 2012-12-26 中兴通讯股份有限公司 公共警报系统及密钥发送、获取方法、安全连接建立方法
US20130007434A1 (en) * 2011-06-30 2013-01-03 Verizon Patent And Licensing Inc. Local security key generation

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2462615A (en) 2008-08-12 2010-02-17 Nec Corp Optional Access Stratum security activation depending on purpose of request or message parameter in an evolved UTRAN communication network.
KR101475349B1 (ko) * 2008-11-03 2014-12-23 삼성전자주식회사 이동 통신 시스템에서 단말 보안 능력 관련 보안 관리 방안및 장치
CN101835156B (zh) * 2010-05-21 2014-08-13 中兴通讯股份有限公司南京分公司 一种用户接入安全保护的方法及系统
CN102932784B (zh) * 2011-08-12 2015-12-02 华为技术有限公司 终端的通信方法和设备
CN103167492B (zh) * 2011-12-15 2016-03-30 华为技术有限公司 在通信系统中生成接入层密钥的方法及其设备
USRE49491E1 (en) * 2012-06-08 2023-04-11 Samsung Electronics Co., Ltd. Method and system for selective protection of data exchanged between user equipment and network
CN103813308B (zh) * 2012-11-13 2017-11-10 电信科学技术研究院 一种上行数据传输方法、装置及系统
WO2015061951A1 (zh) * 2013-10-28 2015-05-07 华为技术有限公司 一种安全上下文的提供、获取方法及设备
EP3257283A1 (en) * 2015-02-13 2017-12-20 Nec Corporation Apparatus, system and method for security management
WO2017049461A1 (zh) * 2015-09-22 2017-03-30 华为技术有限公司 用户设备ue的接入方法、设备及系统
US10506438B2 (en) * 2015-12-03 2019-12-10 Telefonaktiebolaget Lm Ericsson (Publ) Multi-RAT access stratum security
CN107276971A (zh) * 2016-04-08 2017-10-20 电信科学技术研究院 一种连接管理方法及相关设备
US20180083972A1 (en) * 2016-09-20 2018-03-22 Lg Electronics Inc. Method and apparatus for security configuration in wireless communication system
US11889304B2 (en) * 2016-09-20 2024-01-30 Nokia Solutions And Networks Oy Next generation key set identifier
EP3582531B1 (en) * 2017-03-18 2021-02-17 Huawei Technologies Co., Ltd. Network access authentication method based on non-3gpp network, and related device and system
CN109309920B (zh) * 2017-07-28 2021-09-21 华为技术有限公司 安全实现方法、相关装置以及系统
US11297502B2 (en) * 2017-09-08 2022-04-05 Futurewei Technologies, Inc. Method and device for negotiating security and integrity algorithms
US10542428B2 (en) * 2017-11-20 2020-01-21 Telefonaktiebolaget Lm Ericsson (Publ) Security context handling in 5G during handover
KR102412441B1 (ko) * 2018-04-04 2022-06-22 지티이 코포레이션 무결성 보호를 관리하기 위한 기술

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2000042491A1 (en) * 1999-01-15 2000-07-20 Rainbow Technologies, Inc. Usb-compliant personal key with integral input and output devices
WO2010052920A1 (ja) * 2008-11-07 2010-05-14 パナソニック株式会社 ハンドオーバ方法、その方法で用いられる移動端末及びホームエージェント
CN101505479A (zh) * 2009-03-16 2009-08-12 中兴通讯股份有限公司 一种认证过程中安全上下文协商方法和系统
US20110161661A1 (en) * 2009-12-31 2011-06-30 General Instrument Corporation Enhanced authorization process using digital signatures
CN102843651A (zh) * 2011-06-22 2012-12-26 中兴通讯股份有限公司 公共警报系统及密钥发送、获取方法、安全连接建立方法
US20130007434A1 (en) * 2011-06-30 2013-01-03 Verizon Patent And Licensing Inc. Local security key generation

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3758402A4

Also Published As

Publication number Publication date
EP3758402A1 (en) 2020-12-30
JP7414796B2 (ja) 2024-01-16
US20200403788A1 (en) 2020-12-24
AU2022204263A1 (en) 2022-07-07
AU2019250928B2 (en) 2022-03-17
AU2019250928A1 (en) 2020-09-24
BR112020019989A2 (pt) 2021-01-26
EP3758402A4 (en) 2021-04-14
CN110351722A (zh) 2019-10-18
AU2019250928C1 (en) 2022-09-29
CN110351722B (zh) 2024-04-16
CN110225517B (zh) 2020-07-14
CN110225517A (zh) 2019-09-10
JP2021516935A (ja) 2021-07-08

Similar Documents

Publication Publication Date Title
US11778459B2 (en) Secure session method and apparatus
WO2021037175A1 (zh) 一种网络切片的管理方法及相关装置
JP2020504559A (ja) Ｐｄｕセッション管理
JP2020527914A (ja) ネットワークセキュリティ管理方法および装置
WO2017166221A1 (zh) 无线接入控制方法、装置及系统
EP3771242A1 (en) Key generation method and relevant apparatus
US20200403788A1 (en) Information Sending Method, Key Generation Method, and Apparatus
WO2020253701A1 (zh) 管理背景数据传输策略的方法、装置和系统
WO2018214597A1 (zh) 接入网类型选择方法、设备及系统
CN113873478B (zh) 通信方法及装置
WO2021136211A1 (zh) 授权结果的确定方法及装置
CN110535808B (zh) 一种设备监控、去注册方法及装置
WO2020177632A1 (zh) 一种安全保护方法及装置
WO2019024585A1 (zh) 数据重复传输方法和设备
WO2021233362A1 (zh) 认证授权的方法和装置
WO2021227600A1 (zh) 一种网络切片控制方法及通信装置
WO2020233496A1 (zh) 安全会话方法和装置
US20230018378A1 (en) Parameter configuration method, apparatus and system, device and storage medium
WO2020142884A1 (zh) 切换传输路径的方法及装置
CN112654046A (zh) 用于注册的方法和装置
WO2021147672A1 (zh) 会话处理方法及通信装置
WO2022067538A1 (zh) 网元发现方法、装置、设备及存储介质
CN110913507B (zh) 通信方法和装置
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
WO2024032244A1 (zh) 通信方法和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19786094

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019250928

Country of ref document: AU

Date of ref document: 20190328

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021501070

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2019786094

Country of ref document: EP

Effective date: 20200924

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112020019989

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112020019989

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20200929