WO2019196766A1 - 通信方法和装置 - Google Patents

通信方法和装置 Download PDF

Info

Publication number
WO2019196766A1
WO2019196766A1 PCT/CN2019/081678 CN2019081678W WO2019196766A1 WO 2019196766 A1 WO2019196766 A1 WO 2019196766A1 CN 2019081678 W CN2019081678 W CN 2019081678W WO 2019196766 A1 WO2019196766 A1 WO 2019196766A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
message
mobility management
network element
terminal device
Prior art date
Application number
PCT/CN2019/081678
Other languages
English (en)
French (fr)
Inventor
李欢
靳维生
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19784519.1A priority Critical patent/EP3767982A4/en
Publication of WO2019196766A1 publication Critical patent/WO2019196766A1/zh
Priority to US17/065,279 priority patent/US20210045050A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks

Definitions

  • the present application relates to the field of communications and, more particularly, to communication methods and apparatus in the field of communications.
  • the 3rd Generation Partnership Project (3GPP) has released the next-generation Mobile Generation Network Architecture (Next Generation System), also known as the fifth generation (5G) network architecture.
  • Next Generation System also known as the fifth generation (5G) network architecture.
  • 5G Fifth Generation
  • NTN Neutral Host Network
  • the present application provides a communication method and apparatus, which enable a terminal device to access a 5G communication network through an NHN network.
  • a communication method comprising:
  • the first access and mobility management network element in the first communication network receives the first message from the terminal device, where the first message includes a non-access stratum NAS parameter for the terminal device to access the second communication network. ;
  • the first access and mobility management network element sends a second message to the second access and mobility management network element in the second communication network, where the second message includes the NAS parameter.
  • the NAS parameters for the terminal device to access the second communication network are received by the first access and mobility management network element in the first communication network, and the second access and mobility management in the second communication network is performed.
  • the transmitting, by the network element, the NAS parameter enables the terminal device to access the second communication network through the first access and mobility management network element in the first communication network based on the NAS parameter.
  • the first communication network may be an NH network
  • the first mobility management network element may be an NH AMF network element in the NH network
  • the second communication network may be a 5G communication network
  • the second mobility management network element is an AMF network element in the 5G control plane
  • the terminal device may be a UE, which is not specifically limited in this embodiment of the present application.
  • the first message may include first indication information, where the first indication information is used to indicate access to the second communication network.
  • the first indication information may be an identifier (ID) of the terminal device, such as a permanent identity of the user (SUPI), a temporary identity of the user (GUTI), or an independent indication. This is not limited.
  • ID identifier
  • the first access and mobility management network element can determine, according to the indication information, that the terminal device needs to access the second communication network.
  • the first message further includes security capability information of the terminal device.
  • the security capability information includes a security capability applied to the first communication network.
  • the second message further includes a network identifier and/or an access type of the first communications network.
  • the second message may include an Access Network (AN) parameter
  • the AN parameter may include the foregoing network identifier or access type.
  • the second message may include security capability information of the first communications network supported by the terminal device.
  • the method further includes:
  • the first access mode and the mobility management network element perform security protection on the first security mode command according to the key of the first communication network, where the first security mode command is used to start the terminal device and the The message interaction security protection between the first communication networks;
  • the first access and mobility management network element sends the first security mode command after security protection to the terminal device.
  • the method before the security protection of the first security mode command by the first access and mobility management network element according to the key of the first communication network, the method further includes:
  • the first access and mobility management network element receives at least one of the following information from the second access and mobility management network element or security function entity:
  • the base key used to generate the key.
  • the method further includes: the first access and mobility management network element according to the parameter used to generate the key and/or used to generate the key The base key generates the key.
  • the first access and mobility management network element may generate the foregoing key according to a method agreed in advance with the terminal device.
  • the method for generating a key in the prior art can be referred to in the prior art.
  • the second access and mobility management network may be Meta request key.
  • the method further includes: the first access and mobility management network element sending a parameter for generating the key to the terminal device.
  • the method further includes: the first access and mobility management network element receiving a first SMP from the terminal device, where the first SMP is successfully verified by the terminal device a reply message of the first security mode command generated after the first security mode command.
  • the first SMP performs security protection in a manner corresponding to the protection method of the first security mode command.
  • the method further includes:
  • the second security mode command is used to initiate message interaction security protection between the terminal device and the second communication network.
  • the first access and mobility management network element simultaneously sends the first security mode command and the second security mode command to the terminal device;
  • the first access and mobility management network element After transmitting the first security mode command to the terminal device, the first access and mobility management network element sends the second security mode command to the terminal device.
  • the NH AMF may send an N1-N message to the UE, where the N1-N message includes the SMC #1 and SMC #2.
  • the N1-N message includes the SMC #1 and SMC #2.
  • SMC#1 may be nested in SMC#2, or SMC#1 and SMC#2 may be two messages in parallel, which is not specifically limited in this embodiment of the present application.
  • the SMC #1 is encapsulated in the N1-N message #1 and sent to the UE. Then, the SMC encapsulated after the security protection of SMC#2 according to NH-Kamf is encapsulated in the N1-N message #2 and sent to the UE.
  • the SMC #1 is stored first.
  • the SMC encapsulated by the security protection of the SMC#2 according to the NH-Kamf is first sent to the UE in the N1-N message #2, and then the SMC#1 is encapsulated in the N1-N message #1 and sent to the UE.
  • the method further includes: the first access and mobility management network element receiving a second SMP from the terminal device, where the second SMP is successfully verified by the terminal device a reply message of the second security mode command generated after the second security mode command.
  • the NAS encryption may be performed only between the terminal device and the first access and mobility management network element.
  • the second access and mobility management network element sends the SMC#1 to the terminal device by using the first access and mobility management network element, and includes an indication in the SMC#1. Indicates that the NAS key between the terminal device and the second access and mobility management network element is not required to be negotiated, so that subsequent NAS messages between the terminal device and the second access and mobility management network element may not require security. protection.
  • the second access and mobility management network element may send the NAS registration accept message to the first access and mobility management network element without triggering the SMC #1, triggering the first access. And the mobility management network element sends SMC#2 to the terminal device.
  • the second access and mobility management network element sends an N2 message or an N14 message (or invokes the N14 service), triggering the first access and mobility management network element to send the SMC#2 to the terminal. device.
  • the method further includes:
  • the response message of the third message and the response message of the fourth message respectively include parameters for authenticating the terminal device by a network element in the second communication network.
  • a communication method including:
  • the terminal device sends a first message to the first access and mobility management network element in the first communication network, where the first message includes, for the terminal device, accessing the second communication network.
  • Non-access stratum NAS parameters Non-access stratum NAS parameters.
  • the NAS parameters for the terminal device to access the second communication network are received by the first access and mobility management network element in the first communication network, and the second access and mobility management in the second communication network is performed.
  • the transmitting, by the network element, the NAS parameter enables the terminal device to access the second communication network through the first access and mobility management network element in the first communication network based on the NAS parameter.
  • the first communication network may be an NH network
  • the first mobility management network element may be an NH AMF network element in the NH network
  • the second communication network may be a 5G communication network
  • the second mobility management network element is an AMF network element in the 5G control plane
  • the terminal device may be a UE, which is not specifically limited in this embodiment of the present application.
  • the first message may include first indication information, where the first indication information is used to indicate access to the second communication network.
  • the first indication information may be an identifier (ID) of the terminal device, such as a permanent identity of the user (SUPI), a temporary identity of the user (GUTI), or an independent indication. This is not limited.
  • ID identifier
  • the first access and mobility management network element can determine, according to the indication information, that the terminal device needs to access the second communication network.
  • the first message further includes security capability information of the terminal device.
  • the security capability information includes a security capability applied to the first network.
  • the method further includes:
  • the terminal device Receiving, by the terminal device, a first security mode command from the first access and mobility management network element, where the first security mode command is used to start between the terminal device and the first communication network Message interaction security protection, the first security mode command is secured by using a key of the first communication network.
  • the method further includes: the terminal device receiving, from the first access and mobility management network element, a parameter used to generate the key.
  • the method further includes: the terminal device sends a first SMP to the first access and mobility management network element, where the first SMP is successfully verified by the terminal device a reply message of the first security mode command generated after the first security mode command.
  • the first SMP performs security protection in a manner corresponding to the protection method of the first security mode command.
  • the method further includes: the terminal device receiving a second security mode command from the first access and mobility management network element, where the second security mode command is Receiving, by the first access and mobility management network element, the second security mode command, between the terminal device and the second communication network, received by the second access and mobility management network Message interaction security protection.
  • the terminal device simultaneously receives the first security mode command and the second security mode command from the first access and mobility management network element;
  • the terminal device After receiving the first security mode command from the first access and mobility management network element, the terminal device receives the second security mode command from the first access and mobility management network.
  • the NH AMF may send an N1-N message to the UE, where the N1-N message includes the SMC #1 and SMC #2.
  • the N1-N message includes the SMC #1 and SMC #2.
  • SMC#1 may be nested in SMC#2, or SMC#1 and SMC#2 may be two messages in parallel, which is not specifically limited in this embodiment of the present application.
  • the SMC #1 is encapsulated in the N1-N message #1 and sent to the UE. Then, the SMC encapsulated after the security protection of SMC#2 according to NH-Kamf is encapsulated in the N1-N message #2 and sent to the UE.
  • the SMC #1 is stored first.
  • the SMC encapsulated by the security protection of the SMC#2 according to the NH-Kamf is first sent to the UE in the N1-N message #2, and then the SMC#1 is encapsulated in the N1-N message #1 and sent to the UE.
  • the method further includes: the terminal device sends a second SMP to the first access and mobility management network element, where the second SMP is successfully verified by the terminal device a reply message of the second security mode command generated after the second security mode command.
  • the NAS encryption may be performed only between the terminal device and the first access and mobility management network element.
  • the second access and mobility management network element sends the SMC#1 to the terminal device by using the first access and mobility management network element, and includes an indication in the SMC#1. Indicates that the NAS key between the terminal device and the second access and mobility management network element is not required to be negotiated, so that subsequent NAS messages between the terminal device and the second access and mobility management network element may not require security. protection.
  • the second access and mobility management network element may send the NAS registration accept message to the first access and mobility management network element without triggering the SMC #1, triggering the first access. And the mobility management network element sends SMC#2 to the terminal device.
  • the second access and mobility management network element sends an N2 message or an N14 message (or invokes the N14 service), triggering the first access and mobility management network element to send the SMC#2 to the terminal. device.
  • the method further includes:
  • the terminal device Receiving, by the terminal device, the fourth message from the first access and mobility management network element, where the fourth message includes a parameter used by the terminal device to authenticate the second communication network;
  • the terminal device sends a response message of the fourth message to the first access and mobility management network element, where the response message of the fourth message includes a network element pair used in the second communication network.
  • the parameter that the terminal device performs authentication is not limited to:
  • a communication method including:
  • the second access and mobility management network element in the second communication network receives the second message from the first access and mobility management network element in the first communication network, where the second message includes the terminal device Non-access stratum NAS parameters entering the second communication network;
  • the second access and mobility management network element processes the second message.
  • the NAS parameters for the terminal device to access the second communication network are received by the first access and mobility management network element in the first communication network, and the second access and mobility management in the second communication network is performed.
  • the transmitting, by the network element, the NAS parameter enables the terminal device to access the second communication network through the first access and mobility management network element in the first communication network based on the NAS parameter.
  • the first communication network may be an NH network
  • the first mobility management network element may be an NH AMF network element in the NH network
  • the second communication network may be a 5G communication network
  • the second mobility management network element is an AMF network element in the 5G control plane
  • the terminal device may be a UE, which is not specifically limited in this embodiment of the present application.
  • the first message may include first indication information, where the first indication information is used to indicate access to the second communication network.
  • the first indication information may be an identifier (ID) of the terminal device, such as a permanent identity of the user (SUPI), a temporary identity of the user (GUTI), or an independent indication. This is not limited.
  • ID identifier
  • the first access and mobility management network element can determine, according to the indication information, that the terminal device needs to access the second communication network.
  • the second message further includes a network identifier and/or an access type of the first communications network.
  • the second message may include an Access Network (AN) parameter
  • the AN parameter may include the foregoing network identifier or access type.
  • the second message may include security capability information of the first communications network supported by the terminal device.
  • the method further includes: the second access and mobility management network element sending the terminal authentication to the authentication server in the second communication network according to the second message request;
  • the terminal authentication request may include the AN parameter described in the foregoing.
  • the method further includes: the second access and mobility management network element receiving an authentication challenge message from the authentication server, where the authentication challenge message includes a Determining, by the terminal device, a parameter for authenticating the second communication network;
  • the method further includes: the second access and mobility management network element receiving a response message of the third message from the first access and mobility management network element,
  • the response message of the third message includes a parameter used by the network element in the second communication network to authenticate the terminal device.
  • the second access and mobility management network element sends a response message corresponding to the authentication challenge message to the authentication server, where the response message of the authentication challenge message includes the second communication A parameter used by a network element in the network to authenticate the terminal device.
  • the method further includes:
  • the second access and mobility management network element receives at least one of the following information sent by the authentication server:
  • the base key used to generate the key.
  • the method further includes:
  • the second access and mobility management network element sends at least one of the following information to the first access and mobility management network element:
  • the base key used to generate the key.
  • the method further includes:
  • the NH AMF may send an N1-N message to the UE, where the N1-N message includes the SMC #1 and SMC #2.
  • the N1-N message includes the SMC #1 and SMC #2.
  • SMC#1 may be nested in SMC#2, or SMC#1 and SMC#2 may be two messages in parallel, which is not specifically limited in this embodiment of the present application.
  • the SMC #1 is encapsulated in the N1-N message #1 and sent to the UE. Then, the SMC encapsulated after the security protection of SMC#2 according to NH-Kamf is encapsulated in the N1-N message #2 and sent to the UE.
  • the SMC #1 is stored first.
  • the SMC encapsulated by the security protection of the SMC#2 according to the NH-Kamf is first sent to the UE in the N1-N message #2, and then the SMC#1 is encapsulated in the N1-N message #1 and sent to the UE.
  • the method further includes:
  • the second access and mobility management network element receives a second SMP from the first access and mobility management network element, where the second SMP is that the terminal device successfully verifies the second security mode command A reply message of the second security mode command generated thereafter.
  • the NAS encryption may be performed only between the terminal device and the first access and mobility management network element.
  • the second access and mobility management network element sends the SMC#1 to the terminal device by using the first access and mobility management network element, and includes an indication in the SMC#1. Indicates that the NAS key between the terminal device and the second access and mobility management network element is not required to be negotiated, so that subsequent NAS messages between the terminal device and the second access and mobility management network element may not require security. protection.
  • the second access and mobility management network element may send the NAS registration accept message to the first access and mobility management network element without triggering the SMC #1, triggering the first access. And the mobility management network element sends SMC#2 to the terminal device.
  • the second access and mobility management network element sends an N2 message or an N14 message (or invokes the N14 service), triggering the first access and mobility management network element to send the SMC#2 to the terminal. device.
  • a communication apparatus for performing the method of any of the above aspects or any of the possible implementations of any of the aspects.
  • the communication device comprises means for performing the method of any of the above aspects or any of the possible implementations of any of the aspects.
  • a communication device comprising: a transceiver, a memory, a processor, and a bus system.
  • the transceiver, the memory and the processor are connected by the bus system
  • the memory is for storing instructions for executing instructions stored by the memory to control the transceiver to receive and/or transmit signals
  • the processor executes the instructions stored by the memory, the execution causes the processor to perform the method of any of the above aspects or any of the possible implementations of any of the aspects.
  • a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of any of the possible implementations of any of the above aspects.
  • a computer program product comprising: computer program code, a communication unit, a processing unit or a transceiver when the computer program code is communicated by a communication device (eg, a terminal device or a network device) And when the processor is running, causing the communication device to perform the method in any of the possible implementations of any of the above aspects.
  • a communication device eg, a terminal device or a network device
  • a communication chip in which instructions are stored that, when executed on a device for wireless communication, cause the communication chip to perform the method of any of the possible implementations of any of the above aspects.
  • the NAS parameter for the terminal device to access the second communication network is received by the first access and mobility management network element in the first communication network, and the second parameter is obtained in the second communication network.
  • the access and mobility management network element sends the NAS parameter, and based on this, the core network in the second communication network completes the access process of the terminal device to the second communication network according to the NAS parameter. Therefore, the embodiment of the present application enables the terminal device to access the second communication network through the first access and mobility management network element in the first communication network.
  • FIG. 1 shows a schematic diagram of a system architecture 100 to which an embodiment of the present application is applied.
  • FIG. 2 is a schematic diagram of an application scenario 200 of an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another communication network provided by an embodiment of the present application.
  • FIG. 5 is a schematic block diagram of a communication apparatus provided by an embodiment of the present application.
  • FIG. 6 is a schematic block diagram of another communication apparatus provided by an embodiment of the present application.
  • FIG. 7 is a schematic block diagram of another communication apparatus provided by an embodiment of the present application.
  • FIG. 8 is a schematic block diagram of another communication apparatus provided by an embodiment of the present application.
  • FIG. 1 shows a schematic diagram of a system architecture 100 to which an embodiment of the present application is applied.
  • the system architecture 100 includes a terminal device 101, a first access and mobility management network element 102, and a second access and mobility management network element 103.
  • the first access and mobility management network element 102 is a network element in the first communication network
  • the second access and mobility management network element 103 is a network element in the second communication network.
  • the system architecture 100 described above may be used to implement the communication method in the embodiments of the present application.
  • the terminal device 101 is configured to: send, by using the first access and mobility management network element 102 in the first communication network, a first message, where the first message includes the terminal The device accesses the non-access stratum NAS parameters of the second communication network.
  • the first access and mobility management network element 102 is configured to receive a first message from the terminal device 101, where the first message includes a non-access stratum NAS for the terminal device to access the second communication network.
  • the first access and mobility management network element 102 sends a second message to the second access and mobility management network element 103 in the second communication network, where the second message includes the NAS parameter.
  • the first access and mobility management network element 103 is configured to receive a second message from a first access and mobility management network element in the first communication network, where the second message includes a terminal device 101 Accessing non-access stratum NAS parameters of the second communication network.
  • the NAS parameter for the terminal device to access the second communication network is received by the first access and mobility management network element in the first communication network, and is second to the second communication network.
  • the access and mobility management network element sends the NAS parameter, so that the terminal device can access the second communication network by using the first access and mobility management network element in the first communication network based on the NAS parameter. .
  • the access and mobility management network element in the system architecture 100 may be implemented by one device, or may be implemented by multiple devices, or may be a function module in a device.
  • the foregoing functions may be network components in a hardware device, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (for example, a cloud platform). This is not limited.
  • FIG. 2 is a schematic diagram of an application scenario 200 of an embodiment of the present application.
  • the neutral deployment network NHN is interworking with the 3GPP network.
  • the 3GPP network may be a 5G communication network or other possible network in the future (for example, a 6G communication network), which is not specifically limited in this embodiment of the present application.
  • a 5G communication network is taken as an example. Description, but the embodiment of the present application is not limited thereto.
  • the 5G control plane of the 5G communication network includes an access and mobility management function (AMF) network element, which is responsible for access and mobility management, and has authentication, switching, and location update for the user. And other functions.
  • AMF access and mobility management function
  • the NHN core network of the NHN network includes a Neutral Host (NH) AMF network element, where the function of the NH AMF is similar to the function of the AMF in the 5G control plane. Moreover, the NH AMF and the AMF in the 5G communication network can communicate through the N2 interface or the N14 interface.
  • NH Neutral Host
  • the first access and mobility management network element 102 may specifically correspond to the NH AMF network element in FIG. 2, and the second access and mobility management network element 103 may specifically correspond to FIG. AMF network element.
  • the following network elements may also be included in the 5G control plane:
  • An authentication server function (AUSF) network element has an authentication and authorization service function, and is responsible for generating a key and two-way authentication with the UE.
  • a unified data management (UDM) network element stores user subscription data.
  • a session management function (SMF) network element is responsible for session management, including establishment, modification, and release of a packet data unit (PDU) session.
  • SMF session management function
  • a policy control function (PCF) network element is responsible for user policy management, including mobility related policies and PDU session related policies, such as quality of service (QoS) policies, charging policies, and the like.
  • QoS quality of service
  • a network repository function (NRF) network element is responsible for preserving network functions and service information, and supporting discovery functions for services and network functions (ie, accepting network function query requests and providing information about discovered network functions).
  • the Network Exposure Function (NEF) network element provides operators with open network functions to third parties.
  • the third direction provides a secure platform for carrier network transmission information.
  • an application function (AF) network element may also be included in the 5G communication system.
  • AF application function
  • the 5G communication architecture may further include: a user plane function (UPF) network element of the 5G core network (NG Core), and the UPF is a user plane function, and is responsible for forwarding user data.
  • UPF user plane function
  • NG Core 5G core network
  • the 5G communication architecture may further include: a data network (DN): a destination of the user's PDU session access.
  • DN data network
  • the NH SMF may also include an NH SMF.
  • the function of the NH SMF is similar to the function of the SMF in the 5G control plane.
  • the INHK-NEF may also be included in the NHN core network.
  • the function of the IWK-NEF is similar to the function of the NEF in the 5G control plane.
  • the NH UPF network may also include an NH UPF.
  • the function of the NH UPF is similar to the function of the UPF in the 5G communication architecture.
  • a user equipment is also included.
  • the UE can access the NHN network through the NR MF AP, and the UE communicates with the NH AMF through the N1 interface.
  • the NH AMF in the NHN network can communicate with the AMF in the 5G communication network through the N2 interface or the N14 interface.
  • the UE can communicate with the AMF in the 5G control plane through the N1 interface, and the NH UPF can communicate with the NG Core UPF in the 5G communication network through the N3 interface, and the IWK-NEF can communicate with the NEF in the 5G control plane.
  • the SMF in the 5G communication network can communicate with the NG Core UPF through the N4 interface, and the NG Core UPF can communicate with the DN through the N6 interface, which is not limited in this embodiment of the present application.
  • the terminal device 101 may specifically correspond to the UE in FIG. 2.
  • the interface name between the network elements in FIG. 2 is only an example.
  • the interface name of the system architecture 200 may be another name, which is not specifically limited in this embodiment of the present application.
  • the NR MF AP device may also be referred to as an access device, and the access device refers to a device in which the terminal device accesses the NHN network.
  • the radio access network device is an access device that is connected to the mobile communication system by the terminal device, and may be, for example, a radio base station, a small enterprise station, a home gateway, etc., and the embodiment of the present application is applied to the radio access network device.
  • the specific technology and specific device form adopted are not limited.
  • network slice selection function (NSSF) network element
  • NSF network slice selection function
  • the terminal device involved in the embodiment of the present application may include various handheld devices having wireless communication functions, an in-vehicle device, a wearable device, a computing device, or other processing device connected to the wireless modem; and may further include a subscriber unit. Subscriber unit, cellular phone, smart phone, wireless data card, personal digital assistant (PDA) computer, tablet computer, wireless modem (modem), handheld device (handheld) , laptop computer, cordless phone or wireless local loop (WLL) station, machine type communication (MTC) terminal, user equipment (UE) , mobile station (MS), terminal device or relay user equipment.
  • the relay user equipment may be, for example, a 5G residential gateway (RG).
  • RG 5G residential gateway
  • FIG. 3 is a schematic flowchart of a communication method provided by an embodiment of the present application. The method can be applied to the system architecture 100 shown in FIG. 1 and can also be applied to the application scenario 200 shown in FIG. 2, and the embodiment of the present application is not limited thereto.
  • the first communication network may be an NH network in the application scenario 200
  • the first mobility management network element may be an NH AMF network element in the NH network
  • the second communication network may be the 5G communication network in the application scenario 200
  • the second mobility management network element is the AMF network element in the 5G control plane
  • the terminal device may be the UE in the application scenario 200.
  • the first communication network may be an NH network in the application scenario 200
  • the first mobility management network element may be an NH AMF network element in the NH network.
  • the second communication network may be the 5G communication network in the application scenario 200
  • the second mobility management network element is the AMF network element in the 5G control plane
  • the terminal device may be the UE in the application scenario 200.
  • the terminal device may be the UE in the application scenario 200.
  • the terminal device determines to access the second communication network by using the first communication network.
  • the terminal device may decide to access the second communication network through the first communication network according to the configuration information on the terminal, the policy of the operator, and the service to be used.
  • the specific method is not limited in this patent. As a specific example, when the terminal device is in the coverage of the first communication network, but needs to use the service provided by the operator of the second network, the terminal device needs to access the second communication network through the first communication network.
  • the terminal device sends a first message to the first access and mobility management network element in the first communications network, where the first message includes a non-access stratum for the terminal device to access the second communications network. (Non-access stratum, NAS parameters).
  • the first access and mobility management network element receives the first message from the terminal device.
  • the NAS parameter of the terminal device accessing the second communication network may be a NAS message, or may be one or more parameters used to form a NAS message, such as a terminal identifier, a terminal capability, a registration type, and a PDU session identifier.
  • a terminal identifier such as a terminal identifier, a terminal capability, a registration type, and a PDU session identifier.
  • Data network name DNN such as a terminal identifier, a terminal capability, a registration type, and a PDU session identifier.
  • NSSAI network slice selection auxiliary information
  • the first message may include first indication information, where the first indication information is used to indicate access to the second communication network.
  • the first indication information may be an identifier (ID) of the terminal device, such as a permanent identity of the user (SUPI), a temporary identity of the user (GUTI), or an independent indication. This is not limited.
  • the first message may further include security capability information of the terminal device.
  • the first access and mobility management network element saves the security capability of the terminal device.
  • the security capability information includes a security capability applied to the first communication network.
  • the security capability information of the terminal device is, for example, a security algorithm supported by the terminal device, whether the terminal device holds a public key or a certificate of the first communication network, a security protocol supported by the terminal device, and a version number of the related protocol.
  • the terminal device can support all the security algorithms standardized by the 3GPP organization, or the terminal device can also support a security algorithm that is not standardized by the 3GPP organization, which is not specifically limited in this embodiment of the present application.
  • the terminal device can support a Transport Layer Security (TLS), and specifically supports a TLS1.0 version, a TLS2.0 version, or a TLS3.0 version.
  • TLS Transport Layer Security
  • the first access and mobility management network element sends a second message to a second access and mobility management network element in the second communications network, where the second message includes a NAS parameter.
  • the second access and mobility management network element receives the second message from the first access and mobility management network element.
  • the first access and mobility management network element may acquire the NAS parameter included in the first message, generate a second message including the NAS parameter, and then send the second access And transmitting the second message to the mobility management network element.
  • the NAS parameters can also be presented in the form of a single message.
  • the second message may include a NAS registration request message.
  • the first access and mobility management network element may encapsulate the obtained NAS registration request message in the second message.
  • the first access and mobility management network element when the NAS message is included in the first message, the first access and mobility management network element generates a NAS registration message according to the NAS parameter, and encapsulates the NAS registration request message in the second In the message.
  • the second message may further include a network identifier and/or an access type of the first communication network.
  • the network identifier may include the network identifier of the core network and/or the access network in the first communication network.
  • the network identifier of the core network and the access network may be the same, or may be different. This is not limited.
  • the access type indicates the access technology type of the first communication network, and may include the type of the first communication network access network and/or the core network, and the value may be MultiFire, LTE-U, NHN, etc., which is not limited in this application. .
  • the second message may include an Access Network (AN) parameter
  • the AN parameter may include the foregoing network identifier or access type.
  • the AN parameter of the first access and mobility management network element may be derived from the MF AN parameter sent by the terminal device, or may be from the first message sent by the terminal device to the first access and mobility management network element.
  • the AN parameter may be generated by the first access and mobility management network element, which is not specifically limited in this embodiment of the present application.
  • the second message may include security capability information of the first communications network supported by the terminal device.
  • the information about whether the second message includes the security capability of the first communication network supported by the terminal device may depend on the trust relationship between the first communication network and the second communication network. For example, when the two are trusted, or the protocol requires that the security capability information of the first communication supported by the terminal device be sent to the second access and mobility management network element, the second message must include the terminal device support.
  • Security capability information of the first communication network For details, the security capability information can be referred to the description above. To avoid repetition, details are not described herein.
  • the second access and mobility management network element processes the second message.
  • the second access and mobility management network element may parse the second message, and obtain the NAS parameters carried in the second message, and other parameters described in the foregoing.
  • the NAS parameter for the terminal device to access the second communication network is received by the first access and mobility management network element in the first communication network, and the second parameter is obtained in the second communication network.
  • the access and mobility management network element sends the NAS parameter, and based on this, the core network in the second communication network completes the access process of the terminal device to the second communication network according to the NAS parameter. Therefore, the embodiment of the present application enables the terminal device to access the second communication network through the first access and mobility management network element in the first communication network.
  • the method further includes: the second access and mobility management network element sends a terminal authentication request to the authentication server in the second communication network according to the second message, where The authentication process between the authentication server and the terminal device is started.
  • the authentication process between the authentication server and the terminal device is as follows:
  • the terminal authentication request may include the AN parameter described in the foregoing.
  • the authentication server receives the terminal authentication request from the second access and mobility management network, and after receiving the authentication request, sends an authentication information request message to the data management network element (for example, UDM), and Receiving an authentication information response message sent by the data management network element.
  • the authentication information response message may include user-related data for authenticating the terminal, and the user-related data is, for example, subscription information of the user, which is not limited in this embodiment of the present application.
  • the authentication server After receiving the authentication information response message sent by the data management network element, the authentication server generates an authentication challenge message, where the authentication challenge message includes parameters for the terminal device to authenticate the second communication network. For example, an authentication vector of the terminal device.
  • the authentication server may be configured on the two devices separately from the data management network element, or may be combined on one device, that is, the device has the authentication server and the data management network element at the same time.
  • the function of the present application is not specifically limited thereto.
  • the second access and mobility management network element receives an authentication challenge message from the authentication server, where the authentication challenge message includes, for the terminal device, performing the authentication on the second communication network. Parameter of the right;
  • the second access and mobility management network element sends a third message to the first access and mobility management network element, where the third message includes the terminal device for the The parameters of the communication network for authentication.
  • the foregoing authentication challenge message may be directly nested in the third message.
  • the first access and mobility management network element receives the third message from the second access and mobility management network element, and sends a fourth message to the terminal device.
  • the terminal device receives the fourth message from the first access and mobility management network element.
  • the fourth message includes a parameter for the terminal device to authenticate the second communication network.
  • the foregoing authentication challenge message may be directly nested in the fourth message.
  • the terminal device After receiving the fourth message, the terminal device performs the second communication network according to the parameter included in the third message for authenticating the second communication network by the terminal device. right.
  • the process of authenticating the second communication network by the terminal device can be referred to the description in the prior art, which is not described in detail in this embodiment of the present application.
  • the terminal device After the terminal device is successfully authenticated, the terminal device sends a response message of the fourth message to the first access and mobility management network element, where the response message of the fourth message includes A parameter for the network element in the second communication network to authenticate the terminal device.
  • the response message of the fourth message may include an authentication response message, where the authentication response message is specifically a response message of the authentication challenge message.
  • the first access and mobility management network element receives a response message of the fourth message from the terminal device, and sends the third message to the second access and mobility management network element.
  • Response message receives the response message of the third message from the first access and mobility management network element, and according to the response message of the third message, The rights server sends a response message corresponding to the authentication challenge message.
  • the response message of the third message includes a parameter for the network element in the second communication network to authenticate the terminal device.
  • the response message of the foregoing authentication challenge message may be directly included in the third message.
  • the authentication server receives the response message corresponding to the authentication challenge message sent by the second access and mobility management network element, and performs the terminal device according to the response message corresponding to the authentication challenge message. Authentication. Specifically, the process of authenticating the terminal device by the authentication server can be referred to the description in the prior art, which is not described in detail in this embodiment of the present application.
  • the authentication server may obtain an authentication result between the authentication server and the terminal device. And the authentication server sends a terminal authentication response corresponding to the terminal authentication request to the second access and mobility management network element, where the terminal authentication response includes the authentication server and the terminal device The result of the authentication between the two.
  • the network element in the second communication network may determine a key of the first communication network, or determine to generate the first A parameter of a key of a communication network, or a base key for determining a key for generating a first communication network.
  • the key of the first communication network is a key for protecting the message between the terminal god and the first communication network.
  • the network element in the second communication network may be the second access and mobility management network element, or the authentication server, or the security anchor network element, etc., which is not specifically limited in this embodiment of the present application.
  • the first access and mobility management network element may receive the key from the second access and mobility management network element, or the authentication server, or the security anchor network element, for generating the location. At least one of a parameter of a key, a base key used to generate the key.
  • the authentication server may send at least one of the key, a parameter for generating the key, and a base key for generating the key to the second access and mobility
  • the independent security function entity may send at least one of the key, a parameter used to generate the key, and a base key used to generate the key to the first access and move Sex management network element.
  • the following describes the generation of the key of the first communication network by taking the authentication server as the AUSF, the first access and mobility management network element as the NH AMF, and the second access and mobility management network element as the AFM. Ways.
  • the following examples are intended to be understood by those skilled in the art to understand the embodiments of the present application.
  • the AUSF may generate a base key of the first communication network (ie, the NH network), which may be recorded as NH-Kseaf.
  • the key of the first communication network can be recorded as NH-Kamf.
  • the AUSF can generate the NH-Kseaf in conjunction with the identity and freshness parameters of the NH network.
  • the freshness parameter is, for example, a counter value: COUNT.
  • the AUSF can then pass the NH-Kseaf and freshness parameters to the AMF, or SEAF in the AMF.
  • SEAF in AMF or AMF can generate NH-Kamf according to NH-Kseaf, and then send NH-Kamf to NH-AMF.
  • SEAF in AMF or AMF can send NH-Kseaf to the security function entity in the NH AMF or NH network, and the NH-Kseaf generates NH-based by the security function entity in the NH AMF or NH network.
  • the AUSF can send NH-Kseaf and freshness parameters to separate security functions.
  • the independent security function sends NH-Kseaf to the security function entity in the NH AMF or NH network, and the NH-Kamf is generated by the security function entity in the NH AMF or NH network based on NH-Kseaf.
  • the independent security function generates NH-Kamf based on the NH-Kseaf and then sends the NH-Kamf to the security function entity in the NH AMF or NH network.
  • the AUSF may directly send the NH-Kseaf to the security function entity in the NH-AMF or NH network, and then generate the HN-Kamf based on the NH-Kseaf by the security function entity in the NH AMF or the NH network.
  • the security function entity in the NH network may send the NH-Kamf to the NH AMF.
  • the AMF can generate NH-Kamf according to its own key (denoted as Kamf), the identity of the NH network, and the freshness parameter, and then can pass the NH-Kamf to the NH-AMF.
  • the NH-Kamf may be sent in the N14 message or the N2 message, or may be carried in the N14 message or the N2 message together with the SMC message between the AMF and the UE, which is not limited in this application.
  • the AMF may further generate a parameter for generating a key of the first communication network, where the parameter is, for example, a selected algorithm.
  • the parameter for generating the key of the first communication network may be carried in an N14 message with the SMC message between the AMF and the UE, which is not limited in this embodiment of the present application.
  • the NH AMF may generate an NH-Kamf key according to a method agreed in advance with the UE.
  • the method for generating a key in the prior art can be referred to in the prior art.
  • the NH AMF may request a key from the AMF when the NH AMF does not receive a key from the AUSF, AMF or a separate security function entity, or a parameter for generating a key or a base key for generating a key.
  • the AMF After receiving the request sent by the NH AMF, the AMF transmits a key to the NH AMF, or at least one of a parameter for generating a key and a base key for generating a key.
  • the method further includes: the first access and mobility management network element according to the The key used to generate the key and/or the base key used to generate the key generates the key.
  • the manner in which the NH AMF generates the key according to the parameter and/or the basic key used to generate the key can be referred to the description above. To avoid repetition, details are not described herein again.
  • the method further includes: the first access and mobility management network element performs a first security mode command (SMC) according to a key of the first communication network.
  • SMC security mode command
  • the first SMC is configured to initiate message interaction security protection between the terminal device and the first communication network.
  • the first access and mobility management network element sends the first SMC after the security protection to the terminal device.
  • the terminal device receives the first SMC from the first access and mobility management network element.
  • the method further includes:
  • the terminal device sends a first Security Mode Complete (SMP) message to the first access and mobility management network element, where the first SMP message is that the terminal device successfully verifies the first A reply message of the first SMC generated after the SMC.
  • the first access and mobility management network element receives the first SMP message from the terminal device.
  • SMP Security Mode Complete
  • the name of the reply message of the SMC is the security mode completion message, that is, the SMP is used as an example for description.
  • the method further includes:
  • the access and mobility management network element Transmitting, by the second access and mobility management network element, the second SMC to the first access and mobility management network element, corresponding to the first access and mobility management network element from the second
  • the access and mobility management network element receives the second SMC, and sends the second SMC to the terminal device, where the second SMC is used to start the terminal device and the second communication network. Inter-mail security protection.
  • the terminal device receives the second SMC from the first access and mobility management network element.
  • the terminal device sends a second SMP to the first access and mobility management network element, and correspondingly, the first access and mobility management network element receives a second SMP from the terminal device.
  • the second access and mobility management network element receives a second SMP from the first access and mobility management network element, where the second SMP is after the terminal device successfully verifies the second SMC The generated reply message of the second SMC.
  • the following describes the terminal device and the first communication network, with the first access and mobility management network element as the NH AMF, the second access and mobility management network element as the AFM, and the terminal device as the UE as an example.
  • a message interaction security protection process between the terminal device and the second communication network is denoted as SMC#1
  • the first SMC is denoted as SMC#2
  • the second SMP is denoted as SMP#1
  • the first SMP is denoted as SMP#2.
  • the NH AMF receives the SMC #1 from the AMF, and sends the SMC #1 to the UE.
  • the AMF can obtain the AMF key Kamf according to the prior art, and then further derive Knas-int and Knas-enc according to the key Kamf, and then use the Knas-int key to secure the SMC#1.
  • security protection includes integrity protection.
  • the AMF may send an N14 message to the NH AMF, where the N14 message may include the NH-Kamf and the SMC#1.
  • the N14 message may include the NH-Kamf and the SMC#1.
  • NH-Kamf can be placed outside SMC#1 or placed in SMC#1.
  • the AMF can acquire the NH-Kamf outside the SMC#1, that is, at this time.
  • NH-Kamf can be placed outside SMC#1.
  • the NH AMF obtains the N14 message, it can determine NH-Kamf and SMC#1.
  • the method further includes: the NH AMF performs security protection on the SMC #2 according to the key of the NH network. Then, the NH AMF sends the SMC #2 after performing security protection to the UE.
  • the NH AMF may select a security protection method to be used, and combine the security protection method to generate a key Knas for protecting the NAS message between the UE and the NH AMF. Then, the security protection of the SMC#2 is performed based on the Knas key.
  • the security protection is at least one of encryption protection and integrity protection.
  • the NH AMF sends the SMC #1 and the SMC #2 to the UE at the same time.
  • the NH AMF may send an N1-N message to the UE, where the N1-N message includes the SMC#1 and the SMC#2.
  • the N1-N message includes the SMC#1 and the SMC#2.
  • SMC#1 may be nested in SMC#2, or SMC#1 and SMC#2 may be two messages in parallel, which is not specifically limited in this embodiment of the present application.
  • the NH AMF can perform another security protection on the SMC#1 received from the AMF, so that the SMC#1 can be nested in the SMC#2, that is, the SMC#1 becomes the SMC#2 payload. portion.
  • the NH AMF may not process the SMC #1 received from the MAF, but perform security protection on the SMC #2 according to the NH-Kamf, and finally encapsulate the SMC #1 and the SMC #2 in the N1-N message.
  • the message is sent to the UE, that is, SMC#1 and SMC#2 are two messages juxtaposed in the N1-N message.
  • the SMC #1 is encapsulated in the N1-N message #1 and sent to the UE. Then, the SMC encapsulated after the security protection of SMC#2 according to NH-Kamf is encapsulated in the N1-N message #2 and sent to the UE.
  • the SMC #1 is stored first.
  • the SMC encapsulated by the security protection of the SMC#2 according to the NH-Kamf is first sent to the UE in the N1-N message #2, and then the SMC#1 is encapsulated in the N1-N message #1 and sent to the UE.
  • the interaction between SMC#1 and SMC#2 may be the same as one after all, and then another one is sent, that is, another SMC message is sent after receiving one SMP, and it is not necessary to wait for one all. Finish and start another one.
  • the NH AMF sends a parameter for generating the key to the UE.
  • the parameter for generating a key may also be referred to as a material for generating the key, such as a security protection algorithm or the like.
  • the parameters for generating a key here do not include the key itself, and the base key for generating the key.
  • the parameter of the generated key may be sent together with the security command mode #2.
  • the parameter for generating the key can be placed outside the security command mode #2, and then the NH AMF performs security protection together with the parameter for generating the key and the security command mode #2.
  • the NAS encryption may be performed only between the UE and the NH AMF, that is, the NH AMF and the AMF may be unencrypted.
  • the AMF sends the SMC#1 to the UE through the NH AMF, and includes an indication in the SMC#1, indicating that it is not necessary to negotiate the NAS key between the UE and the AMF, so that the UE and the AMF Subsequent NAS messages may not require security protection.
  • the AMF may send the NAS registration accept message to the NH AMF without sending the SMC #1, and trigger the NH AMF to send the SMC #2 to the UE.
  • the AMF sends an N2 message or an N14 message (or invokes the N14 service), and triggers the NH AMF to send the SMC#2 to the UE.
  • the UE when receiving the SMC#1, the UE verifies that the security protection of the AMF is correct.
  • the UE receives the SMC#2 it verifies whether the security protection of the NH AMF is correct.
  • the UE may first verify the security protection of the SMC#2 between the UE and the NH AMF. If the security protection verification of the SMC#2 is correct, the SMC#1 between the UE and the AMF may be further verified. Is the security protection correct? If the security protection verification of SMC#2 is incorrect, the UE may further verify whether the security protection of SMC#1 between the UE and the AMF is correct. At this point, it can be understood that there is a problem with the NH network, but it is possible that the 3GPP network is normal.
  • the UE may also first verify the security protection of the SMC#1 between the UE and the AMF. If the security protection verification of the SMC#1 is correct, the SMC#2 between the UE and the NH AMF may be further verified. Is the security protection correct? If the security protection verification of SMC#1 is incorrect, the UE may not verify SMC#2 between the UE and the NH AMF. At this time, it can be understood that the 5G network element is abnormal, and the UE may not perform access.
  • the SMP message #1 may be generated, and the SMP #1 is sent to the NH AMF.
  • a Security Mode Complete (SMP) message #2 may be generated and sent to the NH AMF.
  • the SMP may be secured in a manner corresponding to the protection method of the corresponding SMC.
  • SMP#1 can be secured in the same way as SMC#1
  • SMP#2 can be secured in the same way as SMC#2.
  • SMC#1 when SMC#1 is nested in SMC#2, SMP#2 can be nested in SMP#2, or when SMC#1 and SMC#2 can be two messages juxtaposed in an N1-N message.
  • SMP#1 and SMP#2 correspond to two messages juxtaposed in one N1-N message, or when SMC#1 is in N1-N message #1 and SMC#2 is in N1-N message #2, SMP#1 is placed in N1-N message #3, and SMP#2 is placed in N1-N message #4, where N1-N message #3 is responsive to N1-N message #1, N1-N message #4 In response to N1-N message #2.
  • the NH AMF may also indicate to the UE that the security protection method adopted by the SMP #2 is required, for example, only encryption protection is performed.
  • the indication information may be sent to the UE together with SMC#2, for example, encapsulated in the same N1-N message. At this time, the UE can perform security protection on SMP#2 according to the indication.
  • the NH AMF does not need to send SMP#1 to the AMF, that is, the UE only needs to generate and transmit SMP#2 in a specified manner or in a manner corresponding to SMC#2.
  • the NH AMF verifies the SMP message.
  • the NH AMF can verify the SMP message according to the method selected by the AMF.
  • SMP#1 and SMP#2 are in the same N1-N message
  • the remaining messages in the N1-N message are sent to the AMF.
  • SMP#1 is placed in N1-N message #3 and SMP#2 is placed in N1-N message #4
  • SMC#1 can be sent to the UE.
  • the UE verifies SMC#1.
  • the NAS parameter for the terminal device to access the second communication network is received by the first access and mobility management network element in the first communication network, and the second parameter is obtained in the second communication network.
  • the access and mobility management network element sends the NAS parameter, so that the terminal device registers with the second communication network through the first communication network, and uses the parameters provided by the second communication network core network to the terminal device and the first communication network network.
  • the NAS message between the two is used for security negotiation to improve the security performance of the network.
  • the first access and mobility management network element is the NH AMF
  • the second access and mobility management network element is the AMF
  • the terminal device is the UE.
  • FIG. 4 is a schematic flowchart of communication provided by an embodiment of the present application. The method can be applied to the system architecture 100 shown in FIG. 1 and can also be applied to the application scenario 200 shown in FIG. 2, and the embodiment of the present application is not limited thereto.
  • the UE sends a first message to the NH AMF in the NH network, where the first message includes a NAS parameter used by the UE to access the 5G communication network.
  • the interface between the UE and the NH AMF may be referred to as an N1-N interface
  • the message that the UE and the NH AMF transmit through the N1-N interface may be referred to as an N1-N message.
  • the first message may be specifically referred to as an N1-N registration request message (N1-N/Registration Request).
  • the NAS parameter may specifically be a NAS registration request message.
  • the NAS registration request message may be nested in the first message, that is, the NAS registration request message is an inner layer message.
  • the first message can be written as N1-N/Registration Request (NAS [Registration Request]).
  • the first message may further include security capability information of the UE.
  • the first message may include first indication information, where the first indication information is used to indicate access to the 5G communication network.
  • the first indication information may be an identifier (ID) of the UE, or may be an independent identifier.
  • the first message and the information included therein may be referred to the description above, and to avoid repetition, details are not described herein again.
  • the NH AMF sends a second message to the AMF in the 5G communication network, where the second message includes a NAS parameter.
  • the interface between the NH AMF and the AMF may be an N14 interface or an N2 interface, and the corresponding message between the NH AMF and the AMF may be referred to as an N14 message or an N2 message.
  • the NAS parameter included in the second message may be a NAS registration request message.
  • the second message may be referred to as N14message(NAS[Registration Request]) or N2message(NAS[Registration Request]).
  • the second message may further include a network identifier and/or an access type of the NH network.
  • the second message may include security capability information of the NH network supported by the UE.
  • the information included in the second message and the second message may be referred to in the foregoing description. To avoid repetition, details are not described herein again.
  • the AMF sends a UE Authentication Request to the AUSF according to the second message.
  • the terminal authentication request may include the AN parameter described in the foregoing.
  • the AUSF sends an Auth Info request to the UDM, and receives an Auth Info response sent by the UDM.
  • the authentication information request and the authentication information response can be referred to the description above. To avoid repetition, details are not described herein again.
  • the AUSF sends an authentication challenge message to the AMF, where the authentication challenge message includes parameters for the UE to authenticate the 5G communication network, for example, including an authentication vector of the UE.
  • the AMF sends a third message to the NH AMF, where the third message includes a parameter for the UE to authenticate the 5G communication network.
  • the third message may include the authentication challenge message, and the third message may be recorded as N14 (NAS [Authentication Challenge]) or N2 (NAS [Authentication Challenge])
  • the NH AMF sends a fourth message to the UE, where the fourth message includes a parameter for the UE to authenticate the 5G communication network.
  • the fourth message may include the authentication challenge message, that is, the fourth message is an Authentication Challenge message that is consistent with the inner NAS message, and is recorded as N1-N (NAS [Authentication Challenge]).
  • the fourth message may be an N1-N message dedicated to transmitting NAS messages between the UE and the AMF, denoted as N1-N Direct NAS Transfer.
  • the UE sends a response message of the fourth message to the NH AMF, where the response message of the fourth message includes a parameter used by the network element of the 5G communication network to authenticate the UE.
  • the response message of the fourth message includes a response message of the authentication challenge message, and the response message of the fourth message may be recorded as N1-N (NAS [Authentication Response]).
  • the NH AMF sends a response message of the third message to the AMF, where the response message of the third message includes a parameter used by the network element of the 5G communication network to authenticate the UE.
  • the response message of the third message includes a response message of the authentication challenge message.
  • the response message of the third message may be recorded as N14 (NAS [Authentication Response]) or N2 (NAS [Authentication Response]).
  • the AMF sends an authentication response (Authentication Response) to the AUSF.
  • the AMF may send a response message of the authentication challenge message in the third message to the AUSF.
  • the AUSF sends a UE Authentication Response to the AMF.
  • the UE authentication response is a response message of the UE authentication request sent by the AMF to the AUSF in 403.
  • the foregoing 403 to 411 correspond to an authentication process between the AUSF and the UE.
  • the authentication process between the AUSF and the UE can be referred to the description above. To avoid repetition, details are not described herein again.
  • the UE authentication response includes an authentication result between the AUSF and the UE.
  • the network element in the 5G communication network may determine a key of the protection message between the UE and the NH network, denoted as NH-Kamf, or determine a parameter for generating the key, or The base key of the key is determined, for example, NH-Kseaf. Then, the network element in the 5G communication network may send the NH-Kamf, or the parameter generating the NH-Kamf, or at least one of the NH-Kseaf to the NH AMF. Alternatively, the NH AMF can generate the NH-Kamf itself.
  • the process in FIG. 4 shows the message interaction security protection process between the UE and the 5G communication network, and the message interaction security protection process between the UE and the NH network.
  • the process includes steps 412 to 420.
  • the AMF sends an SMC Request #1 to the NH AMF, and the message sent in 412 can be recorded as N14 (NAS [SMC Request]) or N2 (NAS [SMC Request]).
  • the AMF may also send security parameters, such as NH-Kamf, or NH-Kseaf, to the NH AMF together with the SMC request #1.
  • the SMC request #1 includes indication information, where the indication information is used to indicate that the NAS key between the UE and the AMF is not required to be negotiated.
  • the AMF may send an N14 message or an N2 message to the NH AMF, and the SMC# request 1 is not included in the message.
  • the NH AMF may not process the SMC request #1, and directly send the SMC request #1 to the UE.
  • the message sent at 413 may be recorded as N1-N (NAS [SMC Request]).
  • the UE can verify whether the security protection of the SMC request #1 between the UE and the AMF is correct. When the verification is correct, the SMP message #1 is sent to the NH AMF, and the SMP message #1 is the response message of the above SMC request #1.
  • the message transmitted at this time 414 can be written as N1-N (NAS [SMC Complete]).
  • the NH AMF sends an SMP message #1 to the AMF, and the message sent at 415 can be recorded as N14 (NAS [SMC Complete]) or N2 (NAS [SMC Complete]).
  • 415 can be replaced by: the NH AMF sends a response message corresponding to the N2 message or the N14 message in 412 to the AMF.
  • the AMF sends a registration accept message #1 to the NH AMF, where the registration accept message #1 indicates that the AMF agrees that the UE accesses the 5G communication network.
  • the message transmitted at 416 at this time can be written as N14 (NAS [Registration Accept]) or N2 (NAS [Registration Accept]).
  • the NH AMF sends an SMC message #2 and a registration accept message #1 to the UE, and is recorded as N1-N [SMC Request (NAS [Registration Accept])].
  • the NH AMF may generate a key NH-Knas for encrypting the NAS message according to the NH-Kamf, and then use the NH-Knas to secure the SMC#2.
  • the registration accept message #1 received from the AMF is sent to the UE together.
  • the UE sends an SMP message #2 and a registration completion message #1 to the NH AMF, denoted as N1-N[SMC complete(NAS[Registration complete])], wherein the registration completion message #1 indicates that the UE successfully accesses the 5G communication network.
  • the UE can verify whether the security protection of the SMC request #2 between the UE and the NH AMF is correct. When the verification is correct, the SMP message #2 is sent to the NH AMF, and the SMP message #2 is the response message of the above SMC request #2.
  • the registration completion message #1 corresponding to the registration accept message #1 is generated, and the registration completion message #1 is transmitted to the NH AMF.
  • SMP message #2 and registration completion message #1 may be sent together.
  • the SMP can be secured in a manner corresponding to the protection method of the SMC.
  • the manner of sending the SMP message #1 and the SMP message #2 can be referred to the description above. To avoid repetition, details are not described herein again.
  • the NH AMF sends a registration accept message #2 to the UE, denoted as N1-N[Registration accept], and the registration accept message #2 indicates that the NH AMF agrees that the UE accesses the NH network.
  • the UE generates a registration completion message #2 corresponding to the sending registration accept message #2 to the NH AMF, and sends the registration completion message #2 to the NH AMF, denoted as N1-N[Registration complete], and the registration completion message #2 indicates The UE successfully accesses the NH network.
  • the SMC request #1, the SMC request #2, the SMP message #1, and the SMP message #2 can be referred to the descriptions of SMC#1, SMC#2, SMP#1, and SMP#2 in FIG. 3, to avoid repetition. I won't go into details here.
  • the process 42 illustrates the message interaction security protection process between the UE and the 5G communication network and the NH network, 42 including steps 412' to 418'.
  • the AMF sends an SMC Request #1 to the NH AMF.
  • the AMF may also send security parameters, such as NH-Kamf, or NH-Kseaf, to the NH AMF along with the SMC request #1.
  • the SMC request #1 includes an indication that the NAS key between the UE and the AMF is not required to be negotiated.
  • the AMF may send an N14 message or an N2 message to the NH AMF, and the SMC# request 1 is not included in the message.
  • the NH AMF sends an SMC Request #1 and an SMC Request #2 to the UE.
  • the NH AMF may generate a key NH-Knas for encrypting the NAS message according to the NH-Kamf, and then use the NH-Knas to perform security protection on the SMC#2, or Security protection is applied to SMC Request #1 and SMC Request #2. Then, SMC Request #1 and SMC Request #2 are sent together to the UE.
  • the manner in which the SMC request #1 and the SMC request #2 are simultaneously transmitted may be referred to in the foregoing description. To avoid repetition, details are not described herein again.
  • the UE sends SMP message #1 and SMP message #2 to the NH AMF, the SMP message #1 is the response message of the SMC request #1, and the SMP message #2 is the response message of the SMC request #2.
  • the UE can verify whether the security protection of the SMC request #1 and the SMC request #2 is correct. When both the SMC request #1 and the SMC request #2 are verified to be correct, the SMP message #1 and the SMP message #2 are transmitted to the NH AMF.
  • the SMP can be secured in a manner corresponding to the protection method of the SMC.
  • the manner of sending the SMP message #1 and the SMP message #2 can be referred to the description above. To avoid repetition, details are not described herein again.
  • the NH AMF sends an SMP message #1 to the AMF.
  • the NH AMF can acquire SMP #2 and forward the remaining message to the AMF, and the remaining message includes the SMP message #1.
  • the SMC# request 1 is not included in the N2 message or the N14 message in 412', the SMC# request 1 is not included in the message sent in 413', and the SMP# message 1 is not included in the message sent in the 414' And the message sent in 415' may be replaced with a response message corresponding to the N2 message or the N14 message in 412'.
  • the AMF sends a registration accept message #1 to the NH AMF, the registration accept message #1 indicating that the AMF agrees to the UE accessing the 5G communication network.
  • 412' is not executed, and 416' is executed before 413', then the message sent in 413' does not include SMC# request 1, and the message sent in 414' does not include SMP# message 1, 415' is not executed. .
  • the NH AMF sends a registration accept message #1 and a registration accept message #2 to the UE, the registration accept message #2 indicating that the NH AMF agrees that the UE accesses the NH network.
  • the UE sends a registration completion message #1 and a registration completion message #2 to the NH AMF.
  • the registration completion message #1 indicates that the UE successfully accesses the 5G communication network, and the registration completion message #2 indicates that the UE successfully accesses the NH network.
  • SMC request #1, SMC request #2, SMP message #1, and SMP message #2 can refer to SMC#1, SMC#2, SMP#1, and SMP#2 in FIG. 3 and FIG. Description, to avoid repetition, we will not repeat them here.
  • the AMF sends a NAS registration rejection message (NAS [Registration Reject]) to the NH AMF after receiving the UE authentication response sent by the AUSF.
  • NAS registration rejection message NAS [Registration Reject]
  • the NH AMF may be configured to be sent to the UE by nesting the NAS registration message in an N1-N registration rejection message (N1-N [Registration Reject (NAS [Registration Reject])], or directly An N1-N Registration Reject message (N1-N[Registration Reject]) is sent to the UE.
  • the embodiment of the present application enables the terminal device to register with the 3GPP 5G core network through the NHN network, and uses the parameters provided by the 3GPP 5G core network to perform security negotiation on the NAS message between the terminal device and the NHN network, thereby improving the security performance of the network.
  • the first access and mobility management network element, the second access and mobility management network element and the terminal device comprise corresponding hardware structures and/or software modules for performing respective functions.
  • the embodiments of the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements of the examples and algorithm steps described in the embodiments disclosed in the application. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the technical solutions of the embodiments of the present application.
  • the embodiments of the present application may perform functional unit division on the first access and mobility management network element, the second access and mobility management network element, and the terminal device according to the foregoing method, for example, each function may be divided according to each function.
  • Units can also integrate two or more functions into one processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • FIG. 5 shows a possible exemplary block diagram of an apparatus involved in the embodiment of the present application, which may exist in the form of software, hardware or a combination of software and hardware.
  • FIG. 5 shows a possible schematic block diagram of the device involved in the embodiment of the present application.
  • the apparatus 500 includes a processing unit 502 and a communication unit 503.
  • the processing unit 502 is configured to control and manage the actions of the device.
  • the communication unit 503 is used to support communication of the device with other devices.
  • the apparatus may also include a storage unit 501 for storing program codes and data of the apparatus.
  • the apparatus 500 shown in FIG. 5 may be the first access and mobility management network element, the second access and mobility management network element involved in the embodiment of the present application.
  • the processing unit 502 can support the apparatus 500 to perform the actions performed by the first access and mobility management network element in the foregoing method examples, for example, The processing unit 502 supports the apparatus 500 to perform the processing on the first message in FIG. 3, and the action of determining the second message, the processing of the first message in the step in FIG. 4, determining the second message, and the third message.
  • the communication unit 503 can support communication between the device 500 and the second access and mobility management network element, the terminal device, the independent security function entity, the SEAF network element in the first communication network, etc., for example, the communication unit 503 supports the device. 500 performs steps 320 and 330 in FIG.
  • the processing unit 502 can support the apparatus 500 to perform the actions performed by the second access and mobility management network element in the foregoing method examples, for example, The processing unit 502 supports the apparatus 500 to perform the action of processing the second message in FIG. 3, processing the second message in FIG. 4, determining the UE authentication request, processing the authentication challenge message, and determining the third message. Processing of a response message to a third message, determining an authentication response, processing the UE authentication response, and/or other processes for the techniques described herein.
  • the communication unit 503 can support communication between the device 500 and the first access and mobility management network element, the authentication processor, etc., for example, the communication unit 503 supports the device 500 to perform step 330 in FIG. 3, in FIG. Steps 402, 403, 405, 406, 409, 410, 411, and/or other related communication processes.
  • the processing unit 502 can be a processor or a controller, such as a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), and an application specific integrated circuit (Application). -Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, units and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 503 can be a communication interface, which is a collective name. In a specific implementation, the communication interface can include one or more interfaces.
  • the storage unit 501 can be a memory.
  • the apparatus 500 involved in the embodiment of the present application may be the apparatus 600 shown in FIG. 6.
  • the apparatus 600 includes a processor 602 and a communication interface 603. Further, the device 600 can also include a memory 601. Alternatively, device 600 may also include a bus 604. The communication interface 603, the processor 602, and the memory 601 may be connected to each other through a bus 604.
  • the bus 604 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA). Bus, etc.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus 604 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 6, but it does not mean that there is only one bus or one type of bus.
  • the processor 602 can perform various functions of the apparatus 600 by running or executing a program stored in the memory 601.
  • the apparatus 600 shown in FIG. 6 may be the first access and mobility management network element, the second access and mobility management network element involved in the embodiment of the present application.
  • the processor 602 can execute the first access and mobility management network element in the foregoing method examples by running or executing a program stored in the memory 601. Actions.
  • the processor 602 can perform the second access and mobility management network element in the foregoing method examples by running or executing a program stored in the memory 601. Actions.
  • FIG. 7 shows a possible exemplary block diagram of another device involved in the embodiment of the present application, which may exist in the form of software, hardware or a combination of software and hardware.
  • FIG. 7 shows a possible schematic block diagram of the apparatus involved in the embodiment of the present application.
  • the apparatus 700 includes a processing unit 702 and a communication unit 703.
  • the processing unit 702 is configured to control and manage the actions of the device.
  • the communication unit 703 is used to support communication of the device with other devices.
  • the apparatus may also include a storage unit 701 for storing program codes and data of the apparatus.
  • the apparatus 700 shown in FIG. 7 may be a terminal device or a chip applied to the terminal device.
  • the processing unit 702 can support the apparatus 700 to perform the actions performed by the terminal device in the above various method examples.
  • the processing unit 702 supports the apparatus 702 to perform step 310 in FIG. 3, and determines the action of the first message, and the steps in FIG. 4 are determined.
  • the first message, the fourth message is processed, the response message of the fourth message is determined, the SMC request #1, the SMC request #2 is processed, the SMP message #1, the SMP message #2, the registration acceptance message #1 and Registration accepts message #2 for processing, determines registration completion message #1 and registration completion message #2, and/or other processes for the techniques described herein.
  • the communication unit 703 can support communication between the device 700 and the first access and mobility management network element, etc., for example, the communication unit 703 supports the device 700 to perform step 320 in FIG. 3, steps 401, 407, 408 in FIG. , 413, 414, 417, 418, 419, 420, or 413', 414', 417', 418', 419', 420', and/or other related communication processes.
  • processing unit 702 can be a processor or controller, such as a CPU, general purpose processor, DSP, ASIC, FPGA or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, units and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 703 can be a communication interface, which is a collective name. In a specific implementation, the communication interface can include one or more interfaces.
  • the storage unit 701 can be a memory.
  • the apparatus 700 involved in the embodiment of the present application may be the terminal device shown in FIG.
  • FIG. 8 is a simplified schematic diagram showing a possible design structure of a terminal device involved in the embodiment of the present application.
  • the terminal device 800 includes a transmitter 801, a receiver 802, and a processor 803.
  • the processor 803 may also be a controller, and is represented as "controller/processor 803" in FIG.
  • the terminal device 800 may further include a modem processor 805.
  • the modem processor 805 may include an encoder 806, a modulator 807, a decoder 808, and a demodulator 809.
  • the transmitter 801 conditions (eg, analog transforms, filters, amplifies, upconverts, etc.) the output samples and generates an uplink signal that is transmitted via an antenna to the base station described in the above embodiments. .
  • the antenna receives the downlink signal transmitted by the base station in the above embodiment.
  • Receiver 802 conditions (eg, filters, amplifies, downconverts, digitizes, etc.) the signals received from the antenna and provides input samples.
  • encoder 806 receives the traffic data and signaling messages to be transmitted on the uplink and processes (e.g., formats, codes, and interleaves) the traffic data and signaling messages.
  • Modulator 807 further processes (e.g., symbol maps and modulates) the encoded traffic data and signaling messages and provides output samples.
  • Demodulator 809 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • the decoder 808 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages for transmission to the terminal device 800.
  • Encoder 806, modulator 807, demodulator 809, and decoder 808 may be implemented by a composite modem processor 805. These units are processed according to the radio access technologies employed by the radio access network (e.g., access technologies for LTE, 5G, and other evolved systems). It should be noted that when the terminal device 800 does not include the modem processor 805, the above functions of the modem processor 805 may also be completed by the processor 803.
  • the processor 803 controls and manages the operations of the terminal device 800, and is used to perform the processing performed by the terminal device 800 in the foregoing embodiment of the present application.
  • the processor 803 is further configured to perform the processes related to the terminal device in the method shown in FIG. 5 and/or other processes described in the present application.
  • the terminal device 800 may further include a memory 804 for storing program codes and data for the terminal device 800.
  • the steps of the method or algorithm described in connection with the disclosure of the embodiments of the present application may be implemented in a hardware manner, or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • the ASIC can be located in a control plane entity of the centralized unit, a user plane entity of the centralized unit, a terminal device, or a unified data storage network element.
  • the processor and the storage medium may also exist as discrete components in the control plane entity of the centralized unit, the user plane entity of the centralized unit, the terminal device or the unified data storage network element.
  • the functions described in the embodiments of the present application may be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法和装置，该通信方法包括：第一通信网络中的第一接入和移动性管理网元从终端设备接收第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层NAS参数；所述第一接入和移动性管理网元向所述第二通信网络中的第二接入和移动性管理网元发送第二消息，所述第二消息中包括所述NAS参数。因此，本申请实施例能够使得该终端设备能够基于该NAS参数，通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。

Description

通信方法和装置
本申请要求于2018年04月08日提交中国专利局、申请号为201810308401.1、申请名称为“通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体的，涉及通信领域中的通信方法和装置。
背景技术
第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)已经发布了下一代移动通信网络架构(Next Generation System)，也称第五代(fifth generation，5G)网络架构。另外，中立部署网络(Neutral Host Network，NHN)也在不断地演进中。
随着网络架构的不断发展，未来这两种网络架构之间会出现越来越多的交互需求。因此，如何使得终端设备通过中立部署网络(Neutral Host Network，NHN)接入5G通信网络是一项亟待解决的问题。
发明内容
本申请提供一种通信方法和装置，能够使得终端设备通过NHN网络接入5G通信网络。
第一方面，提供了一种通信方法，包括：
第一通信网络中的第一接入和移动性管理网元从终端设备接收第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层NAS参数；
所述第一接入和移动性管理网元向所述第二通信网络中的第二接入和移动性管理网元发送第二消息，所述第二消息中包括所述NAS参数。
因此，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，能够使得该终端设备能够基于该NAS参数，通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
可选的，第一通信网络可以为NH网络，第一移动性管理网元可以为NH网络中的NH AMF网元。第二通信网络可以为5G通信网络，第二移动性管理网元为5G控制面中的AMF网元，终端设备可以为UE，本申请实施例对此不作具体限定。
可选的，该第一消息中可以包括第一指示信息，该第一指示信息用于指示接入到第二通信网络。具体的，该第一指示信息可以为该终端设备的标识(ID)，比如用户的永久身份标识(SUPI)，用户的临时身份(GUTI)，也可以是一个独立的指示，本申请实施例对此不作限定。这样，第一接入和移动性管理网元可以根据该指示信息，确定终端设备需要接入第二通信网络。
在第一方面的一些可能的实现方式中，所述第一消息中还包括所述终端设备的安全能力信息。
在第一方面的一些可能的实现方式中，所述安全能力信息包括应用于所述第一通信网络的安全能力。
在第一方面的一些可能的实现方式中，所述第二消息中还包括所述第一通信网络的网络标识和/或接入类型。
在一种可能的实现方式中，第二消息中可以包括接入网(Access Network，AN)参数，AN参数可以包括上述网络标识或者接入类型。
可选的，本申请实施例中，第二消息中可以包括终端设备支持的第一通信网络的安全能力信息。
在第一方面的一些可能的实现方式中，如果所述第二网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
所述第一接入和移动性管理网元根据所述第一通信网络的密钥，对第一安全模式命令进行安全性保护，所述第一安全模式命令用于启动所述终端设备与所述第一通信网络之间的消息交互安全保护；
所述第一接入和移动性管理网元将进行安全性保护之后的所述第一安全模式命令发送给所述终端设备。
在第一方面的一些可能的实现方式中，所述第一接入和移动性管理网元根据所述第一通信网络的密钥，对第一安全模式命令进行安全性保护之前，还包括：
所述第一接入和移动性管理网元从所述第二接入和移动性管理网元或安全功能实体接收以下信息中的至少一项：
所述密钥；
用于生成所述密钥的参数；
用于生成所述密钥的基础密钥。
在第一方面的一些可能的实现方式中，还包括：所述第一接入和移动性管理网元根据所述用于生成所述密钥的参数和/或用于生成所述密钥的基础密钥生成所述密钥。
可选的，第一接入和移动性管理网元可以根据提前与终端设备约定好的方法生成上述密钥。具体的，该约定好的方法可以参见现有技术中的生成密钥的方法，本申请实施例不再详细描述。
或者，当第一接入和移动性管理网元没有接收到密钥，或用于生成密钥的参数或用于生成密钥的基础密钥时，可以向第二接入和移动性管理网元请求密钥。
在第一方面的一些可能的实现方式中，还包括：所述第一接入和移动性管理网元向所述终端设备发送用于生成所述密钥的参数。
在第一方面的一些可能的实现方式中，还包括：所述第一接入和移动性管理网元从所述终端设备接收第一SMP，所述第一SMP为所述终端设备在成功验证所述第一安全模式命令之后生成的所述第一安全模式命令的答复消息。
在第一方面的一些可能的实现方式中，所述第一SMP采用与所述第一安全模式命令的保护方法相对应的方式进行安全保护。
在第一方面的一些可能的实现方式中，还包括：
所述第一接入和移动性管理网元从所述第二接入和移动性管理网元接收第二安全模式命令，并向所述终端设备发送所述第二安全模式命令，其中，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
在第一方面的一些可能的实现方式中，所述第一接入和移动性管理网元同时向所述终端设备发送所述第一安全模式命令和所述第二安全模式命令；或者
所述第一接入和移动性管理网元在向所述终端设备发送所述第二安全模式命令之后，向所述终端设备发送所述第一安全模式命令；或者
所述第一接入和移动性管理网元在向所述终端设备发送所述第一安全模式命令之后，向所述终端设备发送所述第二安全模式命令。
作为一例，所述NH AMF可以向UE发送N1-N消息，该N1-N消息中包括所述SMC#1和SMC#2。此时，在N1-N消息中，SMC#2中可以嵌套SMC#1，或者SMC#1与SMC#2可以是并列的两个消息，本申请实施例对此不做具体限定。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，将该SMC#1封装在N1-N消息#1中发送给UE。然后，将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，先存储SMC#1。先将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE，再将该SMC#1封装在N1-N消息#1中发送给UE。
在第一方面的一些可能的实现方式中，还包括：所述第一接入和移动性管理网元从所述终端设备接收第二SMP，所述第二SMP为所述终端设备在成功验证所述第二安全模式命令之后生成的所述第二安全模式命令的答复消息。
可选的，本申请实施例中，NAS加密可以只在终端设备和第一接入和移动性管理网元之间进行。此时，一种可能的实现方式，第二接入和移动性管理网元通过第一接入和移动性管理网元发送SMC#1给终端设备，并在该SMC#1中包括一个指示，表示不需要协商终端设备和第二接入和移动性管理网元之间的NAS密钥，这样终端设备与第二接入和移动性管理网元之间后续的NAS消息可以不需要进行安全性保护。
或者，另一种可能的实现方式，第二接入和移动性管理网元可以不发送SMC#1，而发送NAS注册接受消息到第一接入和移动性管理网元，触发第一接入和移动性管理网元发送SMC#2给终端设备。
或者，另一种可能的实现方式，第二接入和移动性管理网元发送N2消息或者N14消息(或者调用N14服务)，触发第一接入和移动性管理网元发送SMC#2给终端设备。
在第一方面的一些可能的实现方式中，还包括：
所述第一接入和移动性管理网元从所述第二接入和移动性管理网元接收第三消息，并向所述终端设备发送第四消息，其中，所述第三消息和所述第四消息分别包括用于所述终端设备对所述第二通信网络进行鉴权的参数；
所述第一接入和移动性管理网元从所述终端设备接收所述第四消息的响应消息，并向所述第二接入和移动性管理网元发送所述第三消息的响应消息，其中，所述第三消息的响应消息和所述第四消息的响应消息分别包括用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数。
第二方面，提供了一种通信方法，包括：
所述终端设备向所述第一通信网络中的第一接入和移动性管理网元发送第一消息，所述第一消息中包括用于所述终端设备接入所述第二通信网络的非接入层NAS参数。
因此，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，能够使得该终端设备能够基于该NAS参数，通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
可选的，第一通信网络可以为NH网络，第一移动性管理网元可以为NH网络中的NH AMF网元。第二通信网络可以为5G通信网络，第二移动性管理网元为5G控制面中的AMF网元，终端设备可以为UE，本申请实施例对此不作具体限定。
可选的，该第一消息中可以包括第一指示信息，该第一指示信息用于指示接入到第二通信网络。具体的，该第一指示信息可以为该终端设备的标识(ID)，比如用户的永久身份标识(SUPI)，用户的临时身份(GUTI)，也可以是一个独立的指示，本申请实施例对此不作限定。这样，第一接入和移动性管理网元可以根据该指示信息，确定终端设备需要接入第二通信网络。
在第二方面的一些可能的实现方式中，所述第一消息中还包括所述终端设备的安全能力信息。
在第二方面的一些可能的实现方式中，所述安全能力信息包括应用于所述第一网络的安全能力。
在第二方面的一些可能的实现方式中，如果所述第二网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
所述终端设备从所述第一接入和移动性管理网元接收第一安全模式命令，其中，所述第一安全模式命令用于启动所述终端设备与所述第一通信网络之间的消息交互安全保护，所述第一安全模式命令是使用所述第一通信网络的密钥进行安全性保护的。
在第二方面的一些可能的实现方式中，还包括：所述终端设备从所述第一接入和移动性管理网元接收用于生成所述密钥的参数。
在第二方面的一些可能的实现方式中，还包括：所述终端设备向所述第一接入和移动性管理网元发送第一SMP，所述第一SMP为所述终端设备在成功验证所述第一安全模式命令之后生成的所述第一安全模式命令的答复消息。
在第二方面的一些可能的实现方式中，所述第一SMP采用与所述第一安全模式命令的保护方法相对应的方式进行安全保护。
在第二方面的一些可能的实现方式中，还包括：所述终端设备从所述第一接入和移动性管理网元接收第二安全模式命令，其中，所述第二安全模式命令是所述第一接入和移动性管理网元从所述第二接入和移动性管理网络接收的，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
在第二方面的一些可能的实现方式中，所述终端设备同时从所述第一接入和移动性管理网元接收所述第一安全模式命令和所述第二安全模式命令；或者
所述终端设备从所述第一接入和移动性管理网元接收所述第二安全模式命令之后，从所述第一接入和移动性管理网络接收所述第一安全模式命令；或者
所述终端设备从所述第一接入和移动性管理网元接收所述第一安全模式命令之后，从所述第一接入和移动性管理网络接收所述第二安全模式命令。
作为一例，所述NH AMF可以向UE发送N1-N消息，该N1-N消息中包括所述SMC#1和SMC#2。此时，在N1-N消息中，SMC#2中可以嵌套SMC#1，或者SMC#1与SMC#2可以是并列的两个消息，本申请实施例对此不做具体限定。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，将该SMC#1封装在N1-N消息#1中发送给UE。然后，将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，先存储SMC#1。先将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE，再将该SMC#1封装在N1-N消息#1中发送给UE。
在第二方面的一些可能的实现方式中，还包括：所述终端设备向所述第一接入和移动性管理网元发送第二SMP，所述第二SMP为所述终端设备在成功验证所述第二安全模式命令之后生成的所述第二安全模式命令的答复消息。
可选的，本申请实施例中，NAS加密可以只在终端设备和第一接入和移动性管理网元之间进行。此时，一种可能的实现方式，第二接入和移动性管理网元通过第一接入和移动性管理网元发送SMC#1给终端设备，并在该SMC#1中包括一个指示，表示不需要协商终端设备和第二接入和移动性管理网元之间的NAS密钥，这样终端设备与第二接入和移动性管理网元之间后续的NAS消息可以不需要进行安全性保护。
或者，另一种可能的实现方式，第二接入和移动性管理网元可以不发送SMC#1，而发送NAS注册接受消息到第一接入和移动性管理网元，触发第一接入和移动性管理网元发送SMC#2给终端设备。
或者，另一种可能的实现方式，第二接入和移动性管理网元发送N2消息或者N14消息(或者调用N14服务)，触发第一接入和移动性管理网元发送SMC#2给终端设备。
在第二方面的一些可能的实现方式中，还包括：
所述终端设备从所述第一接入和移动性管理网元接收第四消息，所述第四消息中包括用于所述终端设备对所述第二通信网络进行鉴权的参数；
所述终端设备向所述第一接入和移动性管理网元发送所述第四消息的响应消息，所述第四消息的响应消息中包括用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数。
第三方面，提供了一种通信方法，包括：
第二通信网络中的第二接入和移动性管理网元从第一通信网络中的第一接入和移动性管理网元接收第二消息，所述第二消息中包括用于终端设备接入所述第二通信网络的非接入层NAS参数；
所述第二接入和移动性管理网元对所述第二消息进行处理。
因此，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，能够使得该终端设备能够基于该NAS参数，通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
可选的，第一通信网络可以为NH网络，第一移动性管理网元可以为NH网络中的NH AMF网元。第二通信网络可以为5G通信网络，第二移动性管理网元为5G控制面中的AMF网元，终端设备可以为UE，本申请实施例对此不作具体限定。
可选的，该第一消息中可以包括第一指示信息，该第一指示信息用于指示接入到第二通信网络。具体的，该第一指示信息可以为该终端设备的标识(ID)，比如用户的永久身份标识(SUPI)，用户的临时身份(GUTI)，也可以是一个独立的指示，本申请实施例对此不作限定。这样，第一接入和移动性管理网元可以根据该指示信息，确定终端设备需要接入第二通信网络。
在第三方面的一些可能的实现方式中，所述第二消息中还包括所述第一通信网络的网络标识和/或接入类型。
在一种可能的实现方式中，第二消息中可以包括接入网(Access Network，AN)参数，AN参数可以包括上述网络标识或者接入类型。
可选的，本申请实施例中，第二消息中可以包括终端设备支持的第一通信网络的安全能力信息。
在第三方面的一些可能的实现方式中，还包括：所述第二接入和移动性管理网元根据所述第二消息，向所述第二通信网络中的鉴权服务器发送终端鉴权请求；
所述第二接入和移动性管理网元接收所述鉴权服务器发送的对应于所述终端鉴权请求的终端鉴权响应，所述终端鉴权响应中包括所述鉴权服务器与所述终端设备之间的鉴权结果。
可选的，该终端鉴权请求中可以包括上文中所述的AN参数。
在第三方面的一些可能的实现方式中，还包括：所述第二接入和移动性管理网元从所述鉴权服务器接收鉴权挑战消息，所述鉴权挑战消息中包括用于所述终端设备对所述第二通信网络进行鉴权的参数；
所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送第三消息，其中，所述第三消息包括所述用于所述终端设备对所述第二通信网络进行鉴权的参数。
在第三方面的一些可能的实现方式中，还包括：所述第二接入和移动性管理网元从所述第一接入和移动性管理网元接收所述第三消息的响应消息，其中，所述第三消息的响应消息包括用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数；
所述第二接入和移动性管理网元向所述鉴权服务器发送对应于所述鉴权挑战消息的响应消息，所述鉴权挑战消息的响应消息包括所述用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数。
在第三方面的一些可能的实现方式中，如果所述第二通信网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
所述第二接入和移动性管理网元接收所述鉴权服务器发送的以下信息中的至少一项：
所述第一通信网络的密钥；
用于生成所述密钥的参数；
用于生成密钥的基础密钥。
在第三方面的一些可能的实现方式中，如果所述鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送以下信息中的至少一项：
所述第一通信网络的密钥；
用于生成所述密钥的参数；
用于生成密钥的基础密钥。
在第三方面的一些可能的实现方式中，还包括：
所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送第二安全模式命令，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
作为一例，所述NH AMF可以向UE发送N1-N消息，该N1-N消息中包括所述SMC#1和SMC#2。此时，在N1-N消息中，SMC#2中可以嵌套SMC#1，或者SMC#1与SMC#2可以是并列的两个消息，本申请实施例对此不做具体限定。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，将该SMC#1封装在N1-N消息#1中发送给UE。然后，将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE。
作为另一例，NH AMF从AMF那里接收到SMC#1之后，先存储SMC#1。先将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE，再将该SMC#1封装在N1-N消息#1中发送给UE。
在第三方面的一些可能的实现方式中，还包括：
所述第二接入和移动性管理网元从所述第一接入和移动性管理网元接收第二SMP，所述第二SMP为所述终端设备在成功验证所述第二安全模式命令之后生成的所述第二安全模式命令的答复消息。
可选的，本申请实施例中，NAS加密可以只在终端设备和第一接入和移动性管理网元之间进行。此时，一种可能的实现方式，第二接入和移动性管理网元通过第一接入和移动性管理网元发送SMC#1给终端设备，并在该SMC#1中包括一个指示，表示不需要协商终端设备和第二接入和移动性管理网元之间的NAS密钥，这样终端设备与第二接入和移动性管理网元之间后续的NAS消息可以不需要进行安全性保护。
或者，另一种可能的实现方式，第二接入和移动性管理网元可以不发送SMC#1，而发送NAS注册接受消息到第一接入和移动性管理网元，触发第一接入和移动性管理网元发送SMC#2给终端设备。
或者，另一种可能的实现方式，第二接入和移动性管理网元发送N2消息或者N14消息(或者调用N14服务)，触发第一接入和移动性管理网元发送SMC#2给终端设备。
第四方面，提供了一种通信装置，用于执行上述任一方面或任一方面的任意可能的实现方式中的方法。具体地，该通信装置包括用于执行上述任一方面或任一方面的任意可能的实现方式中的方法的单元。
第五方面，提供了一种通信装置，该装置包括：收发器、存储器、处理器和总线系统。其中，该收发器、该存储器和该处理器通过该总线系统相连，该存储器用于存储指令，该处理器用于执行该存储器存储的指令，以控制收发器接收和/或发送信号，并且当该处理器执行该存储器存储的指令时，该执行使得该处理器执行上述任一方面或任一方面的任意 可能的实现方式中的方法。
第六方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行上述任一方面的任意可能的实现方式中的方法的指令。
第七方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被通信设备(例如，终端设备或网络设备)的通信单元、处理单元或收发器、处理器运行时，使得通信设备执行上述任一方面的任意可能的实现方式中的方法。
第八方面，提供了一种通信芯片，其中存储有指令，当其在无线通信的装置上运行时，使得所述通信芯片执行上述任一方面的任意可能的实现方式中的方法。
因此，本申请实施例中，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，基于此使得第二通信网络中的核心网根据该NAS参数来完成终端设备对第二通信网络的接入过程。因此，本申请实施例能够使得该终端设备通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
附图说明
图1示出了应用本申请实施例的系统架构100的示意图。
图2示出了本申请实施例的应用场景200的示意图。
图3示出了本申请实施例提供的一种通信方法的示意性流程图。
图4示出了本申请实施例提供的另一种通信网络的示意性流程图。
图5示出了本申请实施例提供的一种通信装置的示意性框图。
图6示出了本申请实施例提供的另一种通信装置的示意性框图。
图7示出了本申请实施例提供的另一种通信装置的示意性框图。
图8示出了本申请实施例提供的另一种通信装置的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
图1示出了应用本申请实施例的系统架构100的示意图。如图1所示，该系统架构100包括：终端设备101、第一接入和移动性管理网元102和第二接入和移动性管理网元103。具体的，第一接入和移动性管理网元102为第一通信网络中的网元，第二接入和移动性管理网元103为第二通信网络中的网元。
上述系统架构100可以用于执行本申请实施例中的通信方法。
在一种可能的实现方式中，终端设备101用于：从第一通信网络中的第一接入和移动性管理网元102发送第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层NAS参数。
所述第一接入和移动性管理网元102用于：从终端设备101接收第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层NAS参数；所述第一接入和移动性管理网元102向所述第二通信网络中的第二接入和移动性管理网元103发送第二消息，所述第二消息中包括所述NAS参数。
所述第一接入和移动性管理网元103用于：从第一通信网络中的第一接入和移动性管理网元接收第二消息，所述第二消息中包括用于终端设备101接入所述第二通信网络的非接入层NAS参数。
因此，在系统架构100中，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，能够使得该终端设备能够基于该NAS参数，通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
可选的，上述系统架构100中的接入和移动性管理网元可以由一个设备实现，也可以由多个设备共同实现，还可以是一个设备内的一个功能模块，本申请实施例对此不作具体限定。可以理解的是，上述功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能，本申请实施例对此不作限定。
图2示出了本申请实施例的应用场景200的示意图。在应用场景200中，中立部署网络NHN与3GPP网络互通。本申请实施例中，3GPP网络可以为5G通信网络或者未来其他可能的网络(例如6G通信网络)，本申请实施例对此不作具体限定，这里，为了方便描述，将以5G通信网络为例进行描述，但本申请实施例并不限于此。
具体的，该5G通信网络的5G控制面中包括接入和移动性管理功能(access and mobility management function，AMF)网元，负责接入和移动性管理，具有对用户进行认证、切换、位置更新等功能。
NHN网络的NHN核心网中包括中立部署(Neutral Host，NH)AMF网元，这里NH AMF的功能类似于5G控制面中的AMF的功能。并且，NH AMF与5G通信网络中的AMF之间可以通过N2接口或者N14接口进行通信。
应理解，在上述系统架构100中，第一接入和移动性管理网元102具体可以对应图2中的NH AMF网元，第二接入和移动性管理网元103具体可以对应图2中的AMF网元。
可选的，5G控制面中还可以包括以下网元：
鉴权服务功能(authentication server function，AUSF)网元，具有认证授权业务功能，用于负责密钥的生成以及与UE之间的双向鉴权。
统一数据管理(unified data management，UDM)网元，保存有用户的签约数据。
会话管理功能(session management function，SMF)网元，负责会话管理，包括分组数据单元(packet data unit，PDU)会话的建立、修改、释放等。
策略控制功能(policy control function，PCF)网元，负责用户策略管理，既包括移动性相关策略，也包括PDU会话相关策略，例如，服务质量(quality of service，QoS)策略、计费策略等。
网络存储功能(network repository function，NRF)网元，负责保存网络功能和业务信息，支持业务和网络功能的发现功能(即，接受网络功能查询请求，提供所发现的网络功能的信息)。
网络开放功能(Network Exposure Function，NEF)网元，为运营商提供开放网络功能给第三方，第三方向运营商网络传输信息提供一个安全的平台。
可选的，5G通信系统中还可以包括应用功能(AF)网元。
可选地，该5G通信架构中还可以包括：5G核心网(Next Generation Core，NG Core)的用户面功能(user plane function，UPF)网元，UPF是用户面功能，负责用户数据的转发。
可选地，该5G通信架构中还可以包括：数据网络(data network，DN)：用户的PDU会话访问的目的地。
可选的，NHN核心网中还可以包括NH SMF，具体的，NH SMF的功能类似于5G控制面中的SMF的功能。
可选的，NHN核心网中还可以包括IWK-NEF，具体的，IWK-NEF的功能类似于5G控制面中的NEF的功能。
可选的，NHN核心网中还可以包括NH UPF，具体的，NH UPF的功能类似于5G通信架构中的UPF的功能。
应理解，上述应用场景200中，还包括用户设备(user equipment，UE)。其中，UE可以通过NR MF AP接入NHN网络，UE通过N1接口与NH AMF通信。NHN网络中的NH AMF可以通过N2接口或N14接口与5G通信网络中的AMF通信。
可选的，UE可以通过N1接口与5G控制面中的AMF通信，NH UPF可以通过N3接口与5G通信网络中的NG Core UPF通信，IWK-NEF可以与5G控制面中的NEF通信。另外，5G通信网络中SMF可以通过N4接口与NG Core UPF通信，NG Core UPF可以通过N6接口与DN通信，本申请实施例对此不作限定。
应理解，在上述系统架构100中，终端设备101具体可以对应图2中UE。
需要说明的是，图2中仅以终端设备为UE作出了示例性说明。另外，图2中的各个网元之间的接口名称仅仅是一个示例，在具体实现中，该系统架构200的接口名称还可能为其他名称，本申请实施例对此不作具体限定。
此外，NR MF AP设备也可以称之为接入设备，该接入设备指的是终端设备接入NHN网络的设备。无线接入网设备是终端设备通过无线方式接入到该移动通信系统中的接入设备，例如可以是无线基站，企业小站，家庭网关等，本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
当然，上述应用场景200中还可以部署其它的网元，例如，网络切片选择功能(network slice selection function，NSSF)网元等，本申请实施例对此不作具体限定。
本申请实施例中所涉及到的终端设备(terminal)可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端、用户设备(user equipment，UE)，移动台(mobile station，MS)，终端设备(terminal device)或者中继用户设备等。其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。为方便描述，本申请中，上面提到的设备统称为终端设备。
图3示出了本申请实施例提供的一种通信方法的示意性流程图。该方法可以应用于图 1所示的系统架构100，也可以应用于图2所示的应用场景200，本申请实施例不限于此。
具体的，第一通信网络可以为应用场景200中的NH网络，第一移动性管理网元可以为NH网络中的NH AMF网元。第二通信网络可以为应用场景200中的5G通信网络，第二移动性管理网元为5G控制面中的AMF网元，终端设备可以为应用场景200中的UE，本申请实施例对此不作具体限定。
可选的，310，终端设备决定通过第一通信网络接入第二通信网络。
终端设备可以根据终端上的配置信息，运营商的策略，所需要使用的业务等决定通过第一通信网络接入第二通信网络，具体的方式本专利不做限定。一个具体的例子，当终端设备在第一通信网络的覆盖中，但是需要使用第二网络的运营商提供的服务，则终端设备需要通过第一通信网络接入第二通信网络。
320，终端设备向第一通信网络中的第一接入和移动性管理网元发送第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层(Non-access stratum，NAS参数)。对应的，所述第一接入和移动性管理网元从所述终端设备接收所述第一消息。
这里，所述终端设备接入第二通信网络的NAS参数可以是一条NAS消息，也可以是用于组成NAS消息的一个或多个参数，如终端标识，终端能力，注册类型，PDU会话标识，数据网络名称DNN，网络切片选择辅助信息NSSAI等。
可选的，该第一消息中可以包括第一指示信息，该第一指示信息用于指示接入到第二通信网络。具体的，该第一指示信息可以为该终端设备的标识(ID)，比如用户的永久身份标识(SUPI)，用户的临时身份(GUTI)，也可以是一个独立的指示，本申请实施例对此不作限定。
可选的，该第一消息中还可以包括终端设备的安全能力信息。相应的，第一接入与移动性管理网元接收到第一消息后，保存该终端设备的安全能力。
在一种可能的实现方式中，该安全能力信息包括应用于所述第一通信网络的安全能力。这里，终端设备的安全能力信息例如为该终端设备支持的安全算法，该终端设备是否持有第一通信网络的公钥或证书，该终端设备支持的安全协议以及相关协议的版本号等。
作为一个具体的例子，该终端设备可以支持被3GPP组织标准化的所有的安全算法，或者，该终端设备还可以支没有被3GPP组织标准化的的安全算法，本申请实施例对此不作具体限定。
作为另一个具体的例子，该终端设备可以支持安全传输层协议(Transport Layer Security，TLS)，具体可以支持TLS1.0版本、TLS2.0版本或TLS3.0版本。
330，所述第一接入和移动性管理网元向所述第二通信网络中的第二接入和移动性管理网元发送第二消息，所述第二消息中包括NAS参数。对应的，所述第二接入和移动性管理网元从所述第一接入和移动性管理网元接收所述第二消息。
具体的，本申请实施例中，所述第一接入和移动性管理网元可以获取该第一消息中包括的NAS参数，并生成包含NAS参数的第二消息中，然后向第二接入和移动性管理网元发送该第二消息。示例性地，该NAS参数也可以以一整条消息的形式呈现。
作为一例，第二消息中可以包括NAS注册请求消息。一种可能的实现方式中，当第一消息中包括NAS注册请求消息时，第一接入和移动性管理网元可以将获取到的该NAS 注册请求消息封装在第二消息中。另一种可能的实现方式中，当第一消息中包NAS参数时，第一接入和移动性管理网元根据该NAS参数，生成NAS注册消息，并将该NAS注册请求消息封装在第二消息中。
作为一个可选的实施例，所述第二消息中还可以包括所述第一通信网络的网络标识和/或接入类型。
具体的，网络标识可以包括第一通信网络中的核心网和/或接入网的网络标识，另外，这里核心网与接入网的网络标识可以相同，或者也可以不同，本申请实施例对此不做限定。
接入类型表示第一通信网络的接入技术类型，可以包括第一通信网络接入网和/或核心网的类型，取值可以为MultiFire，LTE-U，NHN等，本申请对此不作限定。
在一种可能的实现方式中，第二消息中可以包括接入网(Access Network，AN)参数，AN参数可以包括上述网络标识或者接入类型。具体的，这里第一接入和移动性管理网元的AN参数可以来自于终端设备发送的MF AN参数，也可以来自于终端设备向第一接入与移动性管理网元发送的第一消息，或者该AN参数可以由第一接入与移动性管理网元生成，本申请实施例对此不作具体限定。
可选的，本申请实施例中，第二消息中可以包括终端设备支持的第一通信网络的安全能力信息。具体的，第二消息中是否包括该终端设备支持的第一通信网络的安全能力的信息可以取决于第一通信网络和第二通信网络的信任关系。例如，当两者是可信的，或者协议要求必须将终端设备支持的第一通信的安全能力信息发送给第二接入与移动性管理网元时，则第二消息中必须包括终端设备支持的第一通信网络的安全能力信息。具体的，安全能力信息可以参见上文中的描述，为避免重复，这里不再赘述。
340，所述第二接入和移动性管理网元对所述第二消息进行处理。
具体的，第二接入和移动性管理网元可以对该第二消息进行解析处理，并获取该第二消息中携带的NAS参数，以及上文中所述的其他参数。
因此，本申请实施例中，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，基于此使得第二通信网络中的核心网根据该NAS参数来完成终端设备对第二通信网络的接入过程。因此，本申请实施例能够使得该终端设备通过第一通信网络中的第一接入和移动性管理网元，接入所述第二通信网络。
可选的，本申请实施例中，还包括：所述第二接入和移动性管理网元根据所述第二消息，向所述第二通信网络中的鉴权服务器发送终端鉴权请求，以启动鉴权服务器与终端设备之间的鉴权流程。具体的，鉴权服务器与终端设备之间的鉴权流程如下：
可选的，该终端鉴权请求中可以包括上文中所述的AN参数。
对应的，鉴权服务器从第二接入和移动性管理网络接收该终端鉴权请求，并在接收到该鉴权请求之后，向数据管理网元(例如UDM)发送鉴权信息请求消息，并接收数据管理网元发送的鉴权信息响应消息。这里，鉴权信息响应消息中可以包括用于对该终端鉴权的用户相关数据，该用户相关数据例如为用户的签约信息，本申请实施例对此不作限定。
鉴权服务器在接收到数据管理网元发送的鉴权信息响应消息之后，生成鉴权挑战(Authentication Challenge)消息，该鉴权挑战消息中包括用于终端设备对第二通信网络进行鉴权的参数，例如为终端设备的鉴权向量。
可选的，本申请实施例中，鉴权服务器可以与数据管理网元分设在两个设备上，或者可以合设在一个设备上，即此时该设备同时具备鉴权服务器和数据管理网元的功能，本申请实施例对此不作具体限定。
对应的，所述第二接入和移动性管理网元从所述鉴权服务器接收鉴权挑战消息，所述鉴权挑战消息中包括用于所述终端设备对所述第二通信网络进行鉴权的参数；
然后，所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送第三消息，其中，所述第三消息包括用于所述终端设备对所述第二通信网络进行鉴权的参数。在一种可能实施方式中，该第三消息中可以直接嵌套上述鉴权挑战消息。
对应的，第一接入和移动性管理网元从所述第二接入和移动性管理网元接收所述第三消息，并向所述终端设备发送第四消息。对应的，所述终端设备从所述第一接入和移动性管理网元接收所述第四消息。这里，所述第四消息包括用于所述终端设备对所述第二通信网络进行鉴权的参数。在一种可能实施方式中，该第四消息中可以直接嵌套上述鉴权挑战消息。
所述终端设备接收到所述第四消息之后，根据所述第三消息中包括的用于所述终端设备对所述第二通信网络进行鉴权的参数，对所述第二通信网络进行鉴权。具体的，所述终端设备对所述第二通信网络进行鉴权的过程可以参见现有技术中的描述，本申请实施例对此不作详细描述。
当所述终端设备鉴权成功之后，所述终端设备向所述第一接入和移动性管理网元发送所述第四消息的响应消息，所述第四消息的响应消息中包括用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数。在一种可能的实现方式中，该第四消息的响应消息中可以包括鉴权响应消息，该鉴权响应消息具体为上文中的鉴权挑战消息的响应消息。
对应的，所述第一接入和移动性管理网元从所述终端设备接收所述第四消息的响应消息，并向所述第二接入和移动性管理网元发送所述第三消息的响应消息。对应的，所述第二接入和移动性管理网元从所述第一接入和移动性管理网元接收所述第三消息的响应消息，并根据该第三消息的响应消息，向鉴权服务器发送对应于所述鉴权挑战消息的响应消息。这里，第三消息的响应消息中包括用于所述第二通信网络中的网元对所述终端设备进行鉴权的参数。在一种可能的实现方式中，第三消息中可以直接包括上述鉴权挑战消息的响应消息。
对应的，鉴权服务器接收第二接入和移动性管理网元发送的对应于所述鉴权挑战消息的响应消息，并根据该对应于所述鉴权挑战消息的响应消息，对终端设备进行鉴权。具体的，鉴权服务器对所述终端设备进行鉴权的过程可以参见现有技术中的描述，本申请实施例对此不作详细描述。
在经过上述鉴权服务器与终端设备之间的鉴权流程，鉴权服务器可以获得所述鉴权服务器与所述终端设备之间的鉴权结果。然后，鉴权服务器向第二接入和移动性管理网元发送对应于所述终端鉴权请求的终端鉴权响应，所述终端鉴权响应中包括所述鉴权服务器与所述终端设备之间的鉴权结果。
可选的，本申请实施例中，当鉴权服务器与所述终端设备之间鉴权成功时，第二通信网络中的网元可以确定第一通信网络的密钥，或确定用于生成第一通信网络的密钥的参数，或确定用于生成第一通信网络的密钥的基础密钥。具体的，第一通信网络的密钥即为终端 神和第一通信网络之间保护消息的密钥。这里，第二通信网络中的网元可以为该第二接入和移动性管理网元，或者为该鉴权服务器，或者为安全锚点网元等，本申请实施例对此不作具体限定。
这时，第一接入和移动性管理网元可以从所述第二接入和移动性管理网元，或该鉴权服务器，或者安全锚点网元接收所述密钥、用于生成所述密钥的参数、用于生成所述密钥的基础密钥中的至少一项。例如，该鉴权服务器可以将所述密钥、用于生成所述密钥的参数、用于生成所述密钥的基础密钥中的至少一项发送给所述第二接入和移动性管理实体和独立的安全功能实体中的至少一项。可选的，独立的安全功能实体可以将所述密钥、用于生成所述密钥的参数、用于生成所述密钥的基础密钥中的至少一项发送给第一接入和移动性管理网元。
下面将以鉴权服务器为AUSF、第一接入和移动性管理网元为NH AMF、第二接入和移动性管理网元为AFM为例，详细描述生成第一通信网络的密钥的几种方式。应理解，下面的举例是为了本领域的技术人员理解本申请实施例的技术方案，不构成对本申请实施例的限定。
在一种可能的实现方式中，AUSF可以生成第一通信网络(即NH网络)的基础密钥，可以记为NH-Kseaf。另外，第一通信网络的密钥可以记为NH-Kamf。具体的，AUSF可以结合NH网络的标识和新鲜性参数来生成NH-Kseaf。这里，新鲜性参数例如为计数器值：COUNT。
然后，AUSF可以将NH-Kseaf和新鲜性参数传递给AMF，或者该AMF中的SEAF。这时，一种可能的方式，AMF或AMF中的SEAF可以根据NH-Kseaf生成NH-Kamf，之后向NH-AMF发送NH-Kamf。另一种可能的方式，AMF或AMF中的SEAF可以将NH-Kseaf发送给NH AMF或NH网络中的安全功能实体，由NH AMF或NH网络中的安全功能实体基于NH-Kseaf来生成NH-Kamf。
或者，AUSF可以将NH-Kseaf和新鲜性参数发送给独立的安全功能。这时，一种可能的方式，该独立的安全功能将NH-Kseaf发送给NH AMF或NH网络中的安全功能实体，由NH AMF或NH网络中的安全功能实体基于NH-Kseaf生成NH-Kamf。另一种可能的方式，该独立的安全功能基于该NH-Kseaf生成NH-Kamf，然后将NH-Kamf发送给NH AMF或NH网络中的安全功能实体。
或者，AUSF可以直接将NH-Kseaf发送给NH-AMF或NH网络中的安全功能实体，再由NH AMF或NH网络中的安全功能实体基于该NH-Kseaf生成HN-Kamf。
可选的，当NH网络中的安全功能实体获取NH-Kamf时，NH网络中的安全功能实体可以将该NH-Kamf发送给NH AMF。
另一种可能的实现方式，AMF可以根据自己的密钥(记为Kamf)、NH网络的标识和新鲜性参数生成NH-Kamf，然后可以将NH-Kamf传递给NH-AMF。可选的，NH-Kamf可以携带在N14消息或N2消息中发送，或者可以与AMF与UE之间的SMC消息一起携带在N14消息或N2消息中发送，本申请实施了对此不做限定。
可选的，AMF还可以生成用于生成上述第一通信网络的密钥的参数，该参数例如为选择的算法。可选的，该用于生成第一通信网络的密钥的参数可以与AMF与UE之间的SMC消息携带在一条N14消息中，本申请实施例对此不做限定。
另一种可能的实现方式中，NH AMF可以根据提前与UE约定好的方法生成NH-Kamf密钥。具体的，该约定好的方法可以参见现有技术中的生成密钥的方法，本申请实施例不再详细描述。
或者，当NH AMF没有从AUSF、AMF或独立的安全功能实体接收到密钥，或用于生成密钥的参数或用于生成密钥的基础密钥时，NH AMF可以向AMF请求密钥。AMF接收到NH AMF发送的请求之后，向NH AMF发送密钥，或用于生成密钥的参数和用于生成密钥的基础密钥中的至少一种。
当NH AMF接收到用于生成密钥的参数或用于生成密钥的基础密钥(并未接收到密钥)时，还包括：所述第一接入和移动性管理网元根据所述用于生成所述密钥的参数和/或用于生成所述密钥的基础密钥生成所述密钥。这里，NH AMF根据用于生成所述密钥的参数和/或基础密钥生成所述密钥的方式可以参见上文中的描述，为避免重复，这里不再赘述。
可选的，本申请实施例中，还包括：所述第一接入和移动性管理网元根据所述第一通信网络的密钥，对第一安全模式命令(Security Mode Command，SMC)进行安全性保护。所述第一SMC用于启动所述终端设备与所述第一通信网络之间的消息交互安全保护。
应理解，本申请实施例中，仅以用于启动终端设备与通信网络之间的消息交互安全保护的消息或命令的名称为安全模式命令，即SMC为例进行描述，本申请实施例对此不作限定。
所述第一接入和移动性管理网元将进行安全性保护之后的所述第一SMC发送给所述终端设备。对应的，所述终端设备从所述第一接入和移动性管理网元接收第一SMC。
可选的，当所述终端设备对所述第一SMC验证成功之后，还包括：
所述终端设备向所述第一接入和移动性管理网元发送第一安全模式完成(Security Mode Complete，SMP)消息，所述第一SMP消息为所述终端设备在成功验证所述第一SMC之后生成的所述第一SMC的答复消息。对应的，所述第一接入和移动性管理网元从所述终端设备接收第一SMP消息。
应理解，本申请实施例中，以SMC的答复消息的名称为安全模式完成消息，即SMP为例进行描述，本申请实施例对此不作限定。
可选的，本申请实施例中，还包括：
所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送第二SMC，对应的，所述第一接入和移动性管理网元从所述第二接入和移动性管理网元接收所述第二SMC，并向所述终端设备发送所述第二SMC，其中，所述第二SMC用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。对应的，所述终端设备从所述第一接入和移动性管理网元接收第二SMC。
可选的，所述终端设备向所述第一接入和移动性管理网元发送第二SMP，对应的，所述第一接入和移动性管理网元从所述终端设备接收第二SMP，所述第二接入和移动性管理网元从所述第一接入和移动性管理网元接收第二SMP，所述第二SMP为所述终端设备在成功验证所述第二SMC之后生成的所述第二SMC的答复消息。
为了描述方便，下文将以第一接入和移动性管理网元为NH AMF、第二接入和移动性管理网元为AFM、终端设备为UE为例，描述终端设备与第一通信网络以及终端设备与 第二通信网络之间的消息交互安全保护过程。下面，将第二SMC记为SMC#1、第一SMC记为为SMC#2、第二SMP记为SMP#1、第一SMP记为SMP#2。
可选的，本申请实施例中，所述NH AMF从所述AMF接收SMC#1，并向UE发送所述SMC#1。
具体的，AMF可以按照现有技术的方式的获取AMF的密钥Kamf，然后根据密钥Kamf进一步衍生Knas-int和Knas-enc，然后使用Knas-int密钥对SMC#1进行安全性保护。这里，安全性保护包括完整性保护。
具体而言，本申请实施例中，AMF可以向NH AMF发送N14消息，该N14消息中可以包括上文中的NH-Kamf和SMC#1。具体的，NH-Kamf可以放到SMC#1外，也可以放到SMC#1内。一个具体的例子，如果NH-AMF需要使用AMF选择的生成密钥的算法作为生成NH-Kamf的一个输入参数，则AMF可以在该SMC#1外获取该NH-Kamf，也就是说，此时NH-Kamf可以放到SMC#1外。相应的，NH AMF获取到该N14消息之后，可以确定NH-Kamf和SMC#1。
可选的，本申请实施例中，还包括：所述NH AMF根据所述NH网络的密钥，对SMC#2进行安全性保护。然后，所述NH AMF将进行安全性保护之后的所述SMC#2发送给UE。
具体的，NH AMF获取密钥NH-Kamf之后，可以选择要使用的安全保护方法，并结合该安全保护方法，生成UE和NH AMF之间保护NAS消息的密钥Knas。然后，基于Knas密钥对安SMC#2进行安全性保护。这里，安全性保护为加密保护和完整性保护中的至少一种。
可选的，本申请实施例中，一种可能的实现方式，所述NH AMF同时向UE发送所述SMC#1和所述SMC#2。
具体的，所述NH AMF可以向UE发送N1-N消息，该N1-N消息中包括所述SMC#1和SMC#2。此时，在N1-N消息中，SMC#2中可以嵌套SMC#1，或者SMC#1与SMC#2可以是并列的两个消息，本申请实施例对此不做具体限定。
具体而言，NH AMF可以对从AMF那里接收到的SMC#1再做一次安全保护，使得SMC#2中可以嵌套SMC#1，即使得SMC#1成为SMC#2负荷(payload)中的一部分。或者，NH AMF可以对从MAF那里接收到的SMC#1不做处理，而是根据NH-Kamf对SMC#2进行安全性保护，最后将SMC#1与SMC#2一起封装在N1-N消息中发送给UE，即此时SMC#1与SMC#2为N1-N消息中的并列的两个消息。
或者另一种可能的实现方式，所述NH AMF在向所述UE发送所述SMC#1之后，向所述UE发送所述SMC#2。
具体的，NH AMF从AMF那里接收到SMC#1之后，将该SMC#1封装在N1-N消息#1中发送给UE。然后，将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE。
或者另一种可能的实现方式，所述NH AMF在向所述UE发送所述SMC#2之后，向所述UE发送所述SMC#1。
具体的，NH AMF从AMF那里接收到SMC#1之后，先存储SMC#1。先将根据NH-Kamf对SMC#2进行安全性保护之后的SMC封装在N1-N消息#2中发送给UE，再将该SMC#1封装在N1-N消息#1中发送给UE。
应注意，本申请实施例中，SMC#1和SMC#2的交互可以是等一个全部做完再启动另一个，即收到一个SMP后再发另一个SMC消息，也可以不需要等一个全部做完再启动另一个。
可选的，本申请实施例中，所述NH AMF向所述UE发送用于生成所述密钥的参数。这里，用于生成密钥的参数还可以称为该密钥的生成材料，例如安全保护算法等。并且，为了安全起见，这里的生成密钥的参数不包括密钥本身，以及生成密钥的基础密钥。
具体的，该生成密钥的参数可以与安全命令模式#2一起发送。例如该生成密钥的参数可以放到安全命令模式#2外，然后NH AMF对生成密钥的参数和安全命令模式#2一起做安全性保护。
可选的，本申请实施例中，NAS加密可以只在UE和NH AMF之间进行，即NH AMF和AMF之间可以是不加密的。此时，一种可能的实现方式，AMF通过NH AMF发送SMC#1给UE，并在SMC#1中包括一个指示，表示不需要协商UE和AMF之间的NAS密钥，这样UE与AMF之间后续的NAS消息可以不需要进行安全性保护。或者，另一种可能的实现方式，AMF可以不发送SMC#1，而发送NAS注册接受消息到NH AMF，触发NH AMF发送SMC#2给UE。或者，另一种可能的实现方式，AMF发送N2消息或者N14消息(或者调用N14服务)，触发NH AMF发送SMC#2给UE。
对应的，UE在收到SMC#1时，验证AMF的安全保护是否正确，UE在收到SMC#2时，验证NH AMF的安全保护是否正确。
一种具体的实施方式中，UE可以先验证UE与NH AMF之间的SMC#2的安全保护，如果SMC#2的安全保护验证正确，则可以进一步验证UE与AMF之间的SMC#1的安全保护是否正确。如果SMC#2的安全保护验证不正确，则UE也可以进一步验证UE与AMF之间的SMC#1的安全保护是否正确。此时，可以理解为NH网络出现了问题，但是有可能3GPP网络是正常的。
另一种可能的实现方式，UE也可以先验证UE与AMF之间的SMC#1的安全保护，如果SMC#1的安全保护验证正确，则可以进一步验证UE与NH AMF之间的SMC#2的安全保护是否正确。如果SMC#1的安全保护验证不正确，则UE可以不验证UE与NH AMF之间的SMC#2。这时，可以理解为5G网元是不正常的，UE可以不进行接入。
并且，本申请实施例中，当UE确定验证SMC#1的安全保护正确之后，可以生成SMP消息#1，并向NH AMF发送该SMP#1。当终端设备确定验证SMC#2的安全保护正确之后，可以生成安全模式完成(Security Mode Complete，SMP)消息#2，并向NH AMF发送该SMP#2。
可选的，SMP可以采用与其对应的SMC的保护方法相对应的方式进行安全保护。
一方面，SMP#1可以采用与SMC#1相同的方式进行安全性保护，SMP#2可以采用与SMC#2相同的方式进行安全性保护。
另一方面，当SMC#2中嵌套SMC#1时，SMP#2中可以嵌套SMP#2，或者当SMC#1与SMC#2可以是一条N1-N消息中的并列的两个消息时，SMP#1和SMP#2对应为一条N1-N消息中并列的两个消息，或者当SMC#1在N1-N消息#1中，SMC#2在N1-N消息#2中时，SMP#1放在N1-N消息#3中，SMP#2放在N1-N消息#4中，其中，N1-N消息#3中响应于N1-N消息#1，N1-N消息#4中响应于N1-N消息#2。
或者，可选的，NH AMF还可以向UE指示期望SMP#2采用的安全保护方法，例如只进行加密保护。作为一例，该指示信息可以与SMC#2一起发送给UE，例如封装在同一条N1-N消息中。这时，UE可以根据该指示对SMP#2进行安全保护。
或者，当不发送SMC#1时，NH AMF不需要向AMF发送SMP#1，即UE仅需要采用指定的方式，或与SMC#2对应的方式生成以及发送SMP#2。
对应的，NH AMF收到SMP消息后，对该SMP消息进行验证。可选的，NH AMF可以根据AMF选择的方法对SMP消息进行验证。
具体的，在SMP#1和SMP#2在同一条N1-N消息中的情况下，当NH AMF对SMP#2验证成功时，将该N1-N消息中的剩余消息发送给AMF。在SMP#1放在N1-N消息#3中，SMP#2放在N1-N消息#4中的情况下，NH AMF对SMP#2验证成功后，可以将SMC#1发送给UE，由UE对SMC#1进行验证。
因此，本申请实施例中，通过第一通信网络中的第一接入和移动性管理网元接收用于终端设备接入第二通信网络的NAS参数，并向第二通信网络中的第二接入和移动性管理网元发送该NAS参数，进而使得终端设备通过第一通信网络注册到第二通信网络，并且使用第二通信网络核心网提供的参数对终端设备和第一通信网络网络之间的NAS消息进行安全协商，提高网络的安全性能。
为便于理解，下面以第一接入和移动性管理网元为NH AMF、第二接入和移动性管理网元为AMF、终端设备为UE为例，结合图4对本申请实施例进行详细说明。图4示出了本申请实施例提供的通信示意性流程图。该方法可以应用于图1所示的系统架构100，也可以应用于图2所示的应用场景200，本申请实施例不限于此。
401，UE向NH网络中的NH AMF发第一消息，该第一消息中包括用于该UE接入5G通信网络的NAS参数。
可选的，本申请实施例中，UE与NH AMF之间的接口可以称为N1-N接口，UE与NH AMF通过该N1-N接口传递的消息可以称为N1-N消息。此时，该第一消息具体可以称为N1-N注册请求消息(N1-N/Registration Request)。
作为一例，该NAS参数具体可以为NAS注册请求(NAS registration request)消息。此时，该第一消息中可以嵌套该NAS注册请求消息，即NAS注册请求消息为内层消息。这时，该第一消息可以记为N1-N/Registration Request(NAS[Registration Request])。
可选的，该第一消息中还可以包括该UE的安全能力信息。
可选的，该第一消息中可以包括第一指示信息，该第一指示信息用于指示接入到5G通信网络。具体的，该第一指示信息可以为该UE的标识(ID)，也可以是一个独立的标识。
具体的，第一消息以及其中包括的信息可以参见上文中的描述，为避免重复，这里不再赘述。
402，NH AMF向5G通信网络中的AMF发送第二消息，该第二消息中包括NAS参数。
本申请实施例中，NH AMF与AMF之间的接口可以为N14接口或N2接口，对应的可以将NH AMF与AMF之间的消息称为N14消息或N2消息。
作为一例，第二消息中包括的NAS参数可以为NAS注册请求消息。作为一例，此时， 该第二消息可以记为N14message(NAS[Registration Request])或N2message(NAS[Registration Request])。
可选的，所述第二消息中还可以包括所述NH网络的网络标识和/或接入类型。
可选的，本申请实施例中，第二消息中可以包括UE支持的NH网络的安全能力信息。
具体的，第二消息以及第二消息中包括的信息可以参见上文中的描述，为避免重复，这里不再赘述。
403，AMF根据该第二消息，向AUSF发送UE鉴权请求(UE Authentication Request)。
可选的，该终端鉴权请求中可以包括上文中所述的AN参数。
404，AUSF向UDM发送鉴权信息请求(Auth Info request)，并接收UDM发送的鉴权信息响应(Auth Info response)。
具体的，鉴权信息请求以及鉴权信息响应可以参见上文中的描述，为避免重复，这里不再赘述。
405，AUSF向AMF发送鉴权挑战消息(Authentication Challenge)，该鉴权挑战消息中包括用于UE对5G通信网络进行鉴权的参数，例如包括UE的鉴权向量。
406，AMF向NH AMF发送第三消息，该第三消息中包括用于UE对5G通信网络进行鉴权的参数。作为一例，该第三消息可以包括所述鉴权挑战消息，该第三消息可以记为N14(NAS[Authentication Challenge])或N2(NAS[Authentication Challenge])
407，NH AMF向UE发送第四消息，该第四消息中包括用于UE对5G通信网络进行鉴权的参数。作为一例，该第四消息可以包括所述鉴权挑战消息，即第四消息是根据内层NAS消息一致的Authentication Challenge消息，记为N1-N(NAS[Authentication Challenge])。作为另一例，该第四消息可以是专门用于传输UE与AMF之间NAS消息的N1-N消息，记为N1-N Direct NAS Transfer。
408，UE向NH AMF发送第四消息的响应消息，所述第四消息的响应消息中包括用于所述5G通信网络的网元对所述UE进行鉴权的参数。作为一例，该第四消息的响应消息中包括鉴权挑战消息的响应消息，第四消息的响应消息可以记为N1-N(NAS[Authentication response])。
409，NH AMF向AMF发送第三消息的响应消息，所述第三消息的响应消息中包括用于所述5G通信网络的网元对所述UE进行鉴权的参数。作为一例，该第三消息的响应消息中包括鉴权挑战消息的响应消息。第三消息的响应消息可以记为N14(NAS[Authentication response])或N2(NAS[Authentication response])。
410，AMF向AUSF发送鉴权挑战消息的响应消息(Authentication response)。
具体的，AMF可以将第三消息中的鉴权挑战消息的响应消息发送给AUSF。
411，AUSF向AMF发送UE鉴权响应(UE Authentication Response)。具体的，该UE鉴权响应为403中的AMF向AUSF发送的UE鉴权请求的响应消息。
具体的，上述403至411对应于AUSF与UE之间的鉴权过程。具体的，AUSF与UE之间的鉴权过程可以参见上文中的描述，为避免重复，这里不再赘述。
并且，UE鉴权响应中包括所述AUSF与所述UE之间的鉴权结果。可选的，当AUSF与UE鉴权成功时，5G通信网络中的网元可以确定UE与NH网络之间保护消息的密钥，记为NH-Kamf，或者确定生成该密钥的参数，或者确定该密钥的基础密钥，该基础密钥 例如为NH-Kseaf。然后，5G通信网络中的网元可以将NH-Kamf、或者生成NH-Kamf的参数，或者NH-Kseaf中的至少一种发送给NH AMF。或者，NH AMF可以自己生成该NH-Kamf。
具体的，生成以及传递NH-Kamf的过程可以参见上文中的描述，为避免重复，这里不再赘述。
图4中的41过程示出了UE先与5G通信网络之间的消息交互安全保护流程，后与NH网络之间的消息交互安全保护流程，41过程包括步骤412至420。
412，AMF向NH AMF发送SMC请求#1，此时412中发送的消息可以记为N14(NAS[SMC Request])或N2(NAS[SMC Request])。可选的，412中，AMF还可以与该SMC请求#1一起，向NH AMF发送安全参数，例如为NH-Kamf，或者NH-Kseaf等。
可选的，该SMC请求#1中包括指示信息，该指示信息用于指示不需要协商UE和AMF之间的NAS密钥。
可替换的，412中，AMF可以向NH AMF发送N14消息或N2消息，并且该消息中不包括SMC#请求1。
413，NH AMF可以不对该SMC请求#1进行处理，直接向UE发送该SMC请求#1，此时413中发送的消息可以记为N1-N(NAS[SMC Request])。
414，UE可以验证UE与AMF之间的SMC请求#1的安全保护是否正确。当验证正确时，向NH AMF发送SMP消息#1，SMP消息#1为上述SMC请求#1的响应消息。此时414中发送的消息可以记为N1-N(NAS[SMC Complete])。
415，NH AMF向AMF发送SMP消息#1，此时415中发送的消息可以记为N14(NAS[SMC Complete])或N2(NAS[SMC Complete])。
可替换的，如果412中的N2消息或N14消息中不包括SMC#请求1，则不执行413和414。并且，415可以替换为：NH AMF向AMF发送对应于412中的N2消息或N14消息的响应消息。
416，AMF向NH AMF发送注册接受消息#1，该注册接受消息#1表示AMF同意UE接入该5G通信网络。此时416中发送的消息可以记为N14(NAS[Registration Accept])或N2(NAS[Registration Accept])。
417，NH AMF向UE发送SMC消息#2和注册接受消息#1，记为N1-N[SMC Request(NAS[Registration Accept])]。
具体的，NH AMF可以根据NH-Kamf，生成用于对NAS消息进行加密的密钥NH-Knas，然后使用该NH-Knas对SMC#2进行安全性保护。同时，将从AMF那里接收来的注册接受消息#1一起发送给UE。
418，UE向NH AMF发送SMP消息#2和注册完成消息#1，记为N1-N[SMC complete(NAS[Registration complete])]其中，注册完成消息#1表示UE成功接入5G通信网络。
具体的，UE可以验证UE与NH AMF之间的SMC请求#2的安全保护是否正确。当验证正确时，向NH AMF发送SMP消息#2，SMP消息#2为上述SMC请求#2的响应消息。
并且，当UE收到注册接受消息#1时，生成对应于该注册接受消息#1的注册完成消息#1，并且，将该注册完成消息#1发送给NH AMF。可选的，SMP消息#2和注册完成消息#1可以一起发送。
可选的，SMP可以采用与SMC的保护方法相对应的方式进行安全保护。具体的，SMP消息#1和SMP消息#2的发送方式可以参见上文中的描述，为避免重复，这里不再赘述。
419，NH AMF向UE发送注册接受消息#2，记为N1-N[Registration accept]，该注册接受消息#2表示NH AMF同意UE接入该NH网络。
420，UE向NH AMF生成对应于发送注册接受消息#2的注册完成消息#2，并向NH AMF发送该注册完成消息#2，记为N1-N[Registration complete]，注册完成消息#2表示UE成功接入NH网络。
具体的，这里SMC请求#1、SMC请求#2、SMP消息#1、SMP消息#2可以参见图3中SMC#1、SMC#2、SMP#1、SMP#2的描述，为避免重复，这里不再赘述。
42过程示出了UE同时与5G通信网络以及NH网络之间的消息交互安全保护流程，42过程包括步骤412’至418’。
412’，AMF向NH AMF发送SMC请求#1。可选的，412’中，AMF还可以与该SMC请求#1一起，向NH AMF发送安全参数，例如为NH-Kamf，或者NH-Kseaf等。
可选的，该SMC请求#1中包括一个指示，表示不需要协商UE和AMF之间的NAS密钥。
可替换的，412’中，AMF可以向NH AMF发送N14消息或N2消息，并且该消息中不包括SMC#请求1。
413’，NH AMF向UE发送SMC请求#1和SMC请求#2。
具体的，NH AMF收到SMC请求#1之后，可以根据NH-Kamf，生成用于对NAS消息进行加密的密钥NH-Knas，然后使用该NH-Knas对SMC#2进行安全性保护，或者对SMC请求#1和SMC请求#2进行安全性保护。然后，将SMC请求#1和SMC请求#2一起发送给UE。
具体的，SMC请求#1和SMC请求#2同时发送的方式可以参见上文中的描述，为避免重复，这里不再赘述。
414’，UE向NH AMF发送SMP消息#1和SMP消息#2，SMP消息#1为上述SMC请求#1的响应消息，SMP消息#2为上述SMC请求#2的响应消息。
具体的，UE可以分别验证SMC请求#1和SMC请求#2的安全保护是否正确。当SMC请求#1和SMC请求#2都验证正确时，向NH AMF发送SMP消息#1以及SMP消息#2。
可选的，SMP可以采用与SMC的保护方法相对应的方式进行安全保护。具体的，SMP消息#1和SMP消息#2的发送方式可以参见上文中的描述，为避免重复，这里不再赘述。
415’，NH AMF向AMF发送SMP消息#1。
具体的，NH AMF可以获取SMP#2，并将剩余消息转发给AMF，剩余消息中包括SMP消息#1。
可替换的，如果412’中的N2消息或N14消息中不包括SMC#请求1，则413’中发送的消息中不包括SMC#请求1，414’中发送的消息中不包括SMP#消息1，并且415’中发送的消息可替换为412’中的对应于N2消息或N14消息的响应消息。
416’，AMF向NH AMF发送注册接受消息#1，该注册接受消息#1表示AMF同意UE接入该5G通信网络。
可替换的，412’不执行，在413’前执行416’，则413’中发送的消息中不包括SMC#请 求1，414’中发送的消息中不包括SMP#消息1，415’不执行。
417’，NH AMF向UE发送注册接受消息#1和注册接受消息#2，该注册接受消息#2表示NH AMF同意UE接入该NH网络。
418’，UE向NH AMF发送注册完成消息#1和注册完成消息#2。
注册完成消息#1表示UE成功接入5G通信网络，注册完成消息#2表示UE成功接入NH网络。
具体的，这里SMC请求#1、SMC请求#2、SMP消息#1、SMP消息#2可以参见图3以及图4中41部分中SMC#1、SMC#2、SMP#1、SMP#2的描述，为避免重复，这里不再赘述。
可选的，本申请实施例中，如果AUSF对所述UE鉴权失败，则AMF在收到AUSF发送的UE鉴权响应之后，向NH AMF发送NAS注册拒绝消息(NAS[Registration Reject])。NH AMF在收到该NAS注册拒绝消息之后，可以将该NAS注册消息嵌套在N1-N注册拒绝消息中(N1-N[Registration Reject(NAS[Registration Reject])])发送给UE，或者直接向UE发送N1-N注册拒绝消息(N1-N[Registration Reject])。
因此，本申请实施例使得终端设备通过NHN网络注册到3GPP 5G核心网，并且使用3GPP 5G核心网提供的参数对终端设备和NHN网络之间的NAS消息进行安全协商，提高网络的安全性能。
上述主要从不同网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，第一接入和移动性管理网元、第二接入和移动性管理网元和终端设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。结合本申请中所公开的实施例描述的各示例的单元及算法步骤，本申请实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以对每个特定的应用来使用不同的方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的技术方案的范围。
本申请实施例可以根据上述方法示例对第一接入和移动性管理网元、第二接入和移动性管理网元和终端设备等进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图5示出了本申请实施例中所涉及的一种装置的一种可能的示例性框图，该装置500可以以软件、硬件或软硬结合的形式存在。图5示出了本申请实施例中所涉及的装置的一种可能的示意性框图。装置500包括：处理单元502和通信单元503。处理单元502用于对装置的动作进行控制管理。通信单元503用于支持装置与其他设备的通信。装置还可以包括存储单元501，用于存储装置的程序代码和数据。
图5所示的装置500可以是本申请实施例所涉及的第一接入和移动性管理网元、第二接入和移动性管理网元。
当图5所示的装置500为第一接入和移动性管理网元时，处理单元502能够支持装置500执行上述各方法示例中由第一接入和移动性管理网元完成的动作，例如，处理单元502支持装置500执行图3中的对第一消息的处理，以及确定第二消息的动作，图4中的步骤 中对第一消息的处理，确定第二消息、对第三消息的处理、确定第四消息、对第四消息的响应消息的处理、确定第三消息的响应消息、对SMC请求#1进行处理、对SMP消息#1进行处理、对注册接受消息#1进行处理、确定SMC请求#2、对SMP消息#2进行处理、确定注册接受消息#2、对注册完成消息#2进行处理的动作，和/或用于本文所描述的技术的其它过程。通信单元503能够支持装置500与第二接入和移动性管理网元、终端设备、独立的安全功能实体、第一通信网络中的SEAF网元等之间的通信，例如，通信单元503支持装置500执行图3中的步骤320和330，图4中的步骤401、402、406、407、408、409、412、413、414、415、416、417、418、419、420，或412’、413’、414’、415’、416’、417’、418’，和/或其他相关的通信过程。
当图5所示的装置500为第二接入和移动性管理网元时，处理单元502能够支持装置500执行上述各方法示例中由第二接入和移动性管理网元完成的动作，例如，处理单元502支持装置500执行图3中的对第二消息进行处理的动作，图4中的对第二消息进行处理、确定UE鉴权请求、对鉴权挑战消息进行处理、确定第三消息、对第三消息的响应消息进行处理、确定鉴权响应、对UE鉴权响应进行处理的动作，和/或用于本文所描述的技术的其它过程。通信单元503能够支持装置500与第第一接入和移动性管理网元、鉴权处理器等之间的通信，例如，通信单元503支持装置500执行图3中的步骤330，图4中的步骤402、403、405、406、409、410、411，和/或其他相关的通信过程。
示例性地，处理单元502可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，单元和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元503可以是通信接口，该通信接口是统称，在具体实现中，该通信接口可以包括一个或多个接口。存储单元501可以是存储器。
当处理单元502为处理器，通信单元503为通信接口，存储单元501为存储器时，本申请实施例所涉及的装置500可以为图6所示的装置600。
参阅图6所示，该装置600包括：处理器602和通信接口603。进一步地，该装置600还可以包括存储器601。可选的，装置600还可以包括总线604。其中，通信接口603、处理器602以及存储器601可以通过总线604相互连接；总线604可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。所述总线604可以分为地址总线、数据总线、控制总线等。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
其中，处理器602可以通过运行或执行存储在存储器601内的程序，执行所述装置600的各种功能。
示例性地，图6所示的装置600可以是本申请实施例所涉及的第一接入和移动性管理网元、第二接入和移动性管理网元。
当装置600为第一接入和移动性管理网元时，处理器602可以通过运行或执行存储在 存储器601内的程序，执行上述各方法示例中由第一接入和移动性管理网元完成的动作。当装置600为第二接入和移动性管理网元时，处理器602可以通过运行或执行存储在存储器601内的程序，执行上述各方法示例中由第二接入和移动性管理网元完成的动作。
在采用集成的单元的情况下，图7示出了本申请实施例中所涉及的另一种装置的一种可能的示例性框图，该装置700可以以软件、硬件或软硬结合的形式存在。图7示出了本申请实施例中所涉及的装置的一种可能的示意性框图。装置700包括：处理单元702和通信单元703。处理单元702用于对装置的动作进行控制管理。通信单元703用于支持装置与其他设备的通信。装置还可以包括存储单元701，用于存储装置的程序代码和数据。
图7所示的装置700可以是终端设备，也可以为应用于终端设备的芯片。处理单元702能够支持装置700执行上述各方法示例中由终端设备完成的动作，例如，处理单元702支持装置702执行图3中的步骤310，以及确定第一消息的动作，图4中的步骤确定第一消息、对第四消息进行处理、确定第四消息的响应消息、对SMC请求#1、SMC请求#2进行处理、确定SMP消息#1、SMP消息#2、对注册接受消息#1和注册接受消息#2进行处理、确定注册完成消息#1和注册完成消息#2，和/或用于本文所描述的技术的其它过程。通信单元703能够支持装置700与第一接入和移动性管理网元等之间的通信，例如，通信单元703支持装置700执行图3中的步骤320，图4中的步骤401、407、408、413、414、417、418、419、420，或413’、414’、417’、418’、419’、420’，和/或其他相关的通信过程。
示例性地，处理单元702可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，单元和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元703可以是通信接口，该通信接口是统称，在具体实现中，该通信接口可以包括一个或多个接口。存储单元701可以是存储器。
当处理单元702为处理器，通信单元703为收发器，存储单元701为存储器时，本申请实施例所涉及的装置700可以为图8所示的终端设备。
图8示出了本申请实施例中所涉及的终端设备的一种可能的设计结构的简化示意图。所述终端设备800包括发射器801，接收器802和处理器803。其中，处理器803也可以为控制器，图8中表示为“控制器/处理器803”。可选的，所述终端设备800还可以包括调制解调处理器805，其中，调制解调处理器805可以包括编码器806、调制器807、解码器808和解调器809。
在一个示例中，发射器801调节(例如，模拟转换、滤波、放大和上变频等)该输出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的基站。在下行链路上，天线接收上述实施例中基站发射的下行链路信号。接收器802调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在调制解调处理器805中，编码器806接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器807进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器809处理(例如，解调)该输入采样并提供符号估计。解码器808处理(例如，解交织和解码)该符号估计并提供发送给终 端设备800的已解码的数据和信令消息。编码器806、调制器807、解调器809和解码器808可以由合成的调制解调处理器805来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE、5G及其他演进系统的接入技术)来进行处理。需要说明的是，当终端设备800不包括调制解调处理器805时，调制解调处理器805的上述功能也可以由处理器803完成。
处理器803对终端设备800的动作进行控制管理，用于执行上述本申请实施例中由终端设备800进行的处理过程。例如，处理器803还用于执行3和图5所示方法中涉及终端设备的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，终端设备800还可以包括存储器804，存储器804用于存储用于终端设备800的程序代码和数据。
结合本申请实施例公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于集中式单元的控制面实体、集中式单元的用户面实体、终端设备或统一数据存储网元中。当然，处理器和存储介质也可以作为分立组件存在于集中式单元的控制面实体、集中式单元的用户面实体、终端设备或统一数据存储网元中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请实施例的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请实施例的具体实施方式而已，并不用于限定本申请实施例的保护范围，凡在本申请实施例的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请实施例的保护范围之内。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (29)

  1. 一种通信方法，其特征在于，包括：
    第一通信网络中的第一接入和移动性管理网元从终端设备接收第一消息，所述第一消息中包括用于所述终端设备接入第二通信网络的非接入层NAS参数；
    所述第一接入和移动性管理网元向所述第二通信网络中的第二接入和移动性管理网元发送第二消息，所述第二消息中包括所述NAS参数。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息中还包括所述终端设备的安全能力信息。
  3. 根据权利要求2所述的方法，其特征在于，所述安全能力信息包括应用于所述第一通信网络的安全能力。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第二消息中还包括所述第一通信网络的网络标识和/或接入类型。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，如果所述第二网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
    所述第一接入和移动性管理网元根据所述第一通信网络的密钥，对第一安全模式命令进行安全性保护，所述第一安全模式命令用于启动所述终端设备与所述第一通信网络之间的消息交互安全保护；
    所述第一接入和移动性管理网元将进行安全性保护之后的所述第一安全模式命令发送给所述终端设备。
  6. 根据权利要求5所述的方法，其特征在于，所述第一接入和移动性管理网元根据所述第一通信网络的密钥，对第一安全模式命令进行安全性保护之前，还包括：
    所述第一接入和移动性管理网元从所述第二接入和移动性管理网元或安全功能实体接收以下信息中的至少一项：
    所述密钥；用于生成所述密钥的参数；用于生成所述密钥的基础密钥。
  7. 根据权利要求5或6所述的方法，其特征在于，还包括：
    所述第一接入和移动性管理网元向所述终端设备发送用于生成所述密钥的参数。
  8. 根据权利要求5-7任一项所述的方法，其特征在于，还包括：
    所述第一接入和移动性管理网元从所述第二接入和移动性管理网元接收第二安全模式命令，并向所述终端设备发送所述第二安全模式命令，其中，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
  9. 一种通信方法，其特征在于，包括：
    终端设备决定通过第一通信网络接入第二通信网络；
    所述终端设备向所述第一通信网络中的第一接入和移动性管理网元发送第一消息，所述第一消息中包括用于所述终端设备接入所述第二通信网络的非接入层NAS参数。
  10. 根据权利要求9所述的方法，其特征在于，所述第一消息中还包括所述终端设备的安全能力信息。
  11. 根据权利要求10所述的方法，其特征在于，所述安全能力信息包括应用于所述 第一网络的安全能力。
  12. 根据权利要求9-11任一项所述的方法，其特征在于，如果所述第二网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
    所述终端设备从所述第一接入和移动性管理网元接收第一安全模式命令，其中，所述第一安全模式命令用于启动所述终端设备与所述第一通信网络之间的消息交互安全保护，所述第一安全模式命令是使用所述第一通信网络的密钥进行安全性保护的。
  13. 根据权利要求12所述的方法，其特征在于，还包括：
    所述终端设备从所述第一接入和移动性管理网元接收用于生成所述密钥的参数。
  14. 根据权利要求12或13所述的方法，其特征在于，还包括：
    所述终端设备从所述第一接入和移动性管理网元接收第二安全模式命令，其中，所述第二安全模式命令是所述第一接入和移动性管理网元从所述第二接入和移动性管理网络接收的，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
  15. 一种通信方法，其特征在于，包括：
    第二通信网络中的第二接入和移动性管理网元从第一通信网络中的第一接入和移动性管理网元接收第二消息，所述第二消息中包括用于终端设备接入所述第二通信网络的非接入层NAS参数；
    所述第二接入和移动性管理网元对所述第二消息进行处理。
  16. 根据权利要求15所述的方法，其特征在于，所述第二消息中还包括所述第一通信网络的网络标识和/或接入类型。
  17. 根据权利要求15或16所述的方法，其特征在于，还包括：
    所述第二接入和移动性管理网元根据所述第二消息，向所述第二通信网络中的鉴权服务器发送终端鉴权请求；
    所述第二接入和移动性管理网元接收所述鉴权服务器发送的对应于所述终端鉴权请求的终端鉴权响应，所述终端鉴权响应中包括所述鉴权服务器与所述终端设备之间的鉴权结果。
  18. 根据权利要求17所述的方法，其特征在于，如果所述第二通信网络中的鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
    所述第二接入和移动性管理网元接收所述鉴权服务器发送的以下信息中的至少一项：
    所述第一通信网络的密钥；
    用于生成所述密钥的参数；
    用于生成密钥的基础密钥。
  19. 根据权利要求17或18所述的方法，其特征在于，如果所述鉴权服务器与所述终端设备之间鉴权成功，所述方法还包括：
    所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送以下信息中的至少一项：
    所述第一通信网络的密钥；
    用于生成所述密钥的参数；
    用于生成密钥的基础密钥。
  20. 根据权利要求18或19所述的方法，其特征在于，还包括：
    所述第二接入和移动性管理网元向所述第一接入和移动性管理网元发送第二安全模式命令，所述第二安全模式命令用于启动所述终端设备与所述第二通信网络之间的消息交互安全保护。
  21. 一种接入和移动性管理网元，其特征在于，包括：用于执行如权利要求1至8任一项所述方法中各个步骤的单元。
  22. 一种装置，应用于终端设备，其特征在于，包括：用于执行如权利要求9至14任一项所述方法中各个步骤的单元。
  23. 一种终端设备，其特征在于，包括如权利要求22所述的装置。
  24. 一种接入和移动性管理网元，其特征在于，包括：用于执行如权利要求15至20任一项所述方法中各个步骤的单元。
  25. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行如权利要求1至20任一项所述的方法。
  26. 一种装置，其特征在于，所述装置包括处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述装置执行如权利要求1-8任一所述的方法。
  27. 一种装置，其特征在于，所述装置包括处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述装置执行如权利要求9-14任一所述的方法。
  28. 根据权利要求27所述的装置，其特征在于，所述装置包括终端或所述终端内的芯片。
  29. 一种装置，其特征在于，所述装置包括处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述装置运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述装置执行如权利要求15-20任一所述的方法。
PCT/CN2019/081678 2018-04-08 2019-04-08 通信方法和装置 WO2019196766A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19784519.1A EP3767982A4 (en) 2018-04-08 2019-04-08 COMMUNICATION METHOD AND DEVICE
US17/065,279 US20210045050A1 (en) 2018-04-08 2020-10-07 Communications method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810308401.1 2018-04-08
CN201810308401.1A CN110351725B (zh) 2018-04-08 2018-04-08 通信方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/065,279 Continuation US20210045050A1 (en) 2018-04-08 2020-10-07 Communications method and apparatus

Publications (1)

Publication Number Publication Date
WO2019196766A1 true WO2019196766A1 (zh) 2019-10-17

Family

ID=68163064

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/081678 WO2019196766A1 (zh) 2018-04-08 2019-04-08 通信方法和装置

Country Status (4)

Country Link
US (1) US20210045050A1 (zh)
EP (1) EP3767982A4 (zh)
CN (1) CN110351725B (zh)
WO (1) WO2019196766A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114640992A (zh) * 2020-11-30 2022-06-17 华为技术有限公司 更新用户身份标识的方法和装置
CN114640992B (zh) * 2020-11-30 2024-06-11 华为技术有限公司 更新用户身份标识的方法和装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111263424B (zh) * 2018-12-04 2022-03-08 维沃移动通信有限公司 一种接入网络的控制方法及通信设备
CN113498057A (zh) * 2020-04-03 2021-10-12 华为技术有限公司 通信系统、方法及装置
JP2022020143A (ja) * 2020-07-20 2022-02-01 富士通株式会社 通信プログラム、通信装置、及び通信方法
WO2023206035A1 (zh) * 2022-04-25 2023-11-02 北京小米移动软件有限公司 跨网络的切换认证方法和装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107205264A (zh) * 2016-03-18 2017-09-26 北京佰才邦技术有限公司 Ue上下文的共享方法和装置
CN107580324A (zh) * 2017-09-22 2018-01-12 中国电子科技集团公司第三十研究所 一种用于移动通信系统imsi隐私保护的方法
WO2018016927A1 (ko) * 2016-07-22 2018-01-25 엘지전자 주식회사 Nas 메시지를 송수신하는 방법 및 장치

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102905267B (zh) * 2012-10-11 2015-09-23 大唐移动通信设备有限公司 Me标识鉴权、安全模式控制方法及装置
EP3146741B1 (en) * 2014-05-20 2021-10-06 Nokia Technologies Oy Cellular network authentication control
US9655005B2 (en) * 2014-10-07 2017-05-16 Qualcomm Incorporated Offload services via a neutral host network
US20160309523A1 (en) * 2015-04-16 2016-10-20 Qualcomm Incorporated Reducing delay in attachment procedure with a network
US10285114B2 (en) * 2015-07-29 2019-05-07 Qualcomm Incorporated Techniques for broadcasting service discovery information
CN106535182A (zh) * 2015-09-10 2017-03-22 中兴通讯股份有限公司 一种无线网络鉴权方法及核心网网元、接入网网元、终端
CN107205251B (zh) * 2016-03-18 2020-03-06 北京佰才邦技术有限公司 一种终端接入网络的方法、装置及终端
US20170374704A1 (en) * 2016-06-27 2017-12-28 Qualcomm Incorporated Identification of a shared evolved packet core in a neutral host network
CN107592649B (zh) * 2016-07-08 2020-06-19 北京佰才邦技术有限公司 一种邻区关系建立方法、装置、基站及终端
CN109906641B (zh) * 2016-09-01 2021-06-01 华为技术有限公司 为基站配置参数的方法
CN106714214B (zh) * 2017-01-13 2019-08-30 北京小米移动软件有限公司 用户设备的状态控制方法、装置、用户设备和基站
CN108513295A (zh) * 2018-04-12 2018-09-07 北京佰才邦技术有限公司 快速认证方法、服务器和用户设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107205264A (zh) * 2016-03-18 2017-09-26 北京佰才邦技术有限公司 Ue上下文的共享方法和装置
WO2018016927A1 (ko) * 2016-07-22 2018-01-25 엘지전자 주식회사 Nas 메시지를 송수신하는 방법 및 장치
CN107580324A (zh) * 2017-09-22 2018-01-12 中国电子科技集团公司第三十研究所 一种用于移动通信系统imsi隐私保护的方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI: "TS 23.501: Selection of a Target AMF Supporting the Ne- twork Slices Due to UE Mobility", SA WG2 MEETING #124 , S2-178399, 21 November 2017 (2017-11-21), XP051379428 *
See also references of EP3767982A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114640992A (zh) * 2020-11-30 2022-06-17 华为技术有限公司 更新用户身份标识的方法和装置
CN114640992B (zh) * 2020-11-30 2024-06-11 华为技术有限公司 更新用户身份标识的方法和装置

Also Published As

Publication number Publication date
EP3767982A1 (en) 2021-01-20
EP3767982A4 (en) 2021-04-28
CN110351725A (zh) 2019-10-18
CN110351725B (zh) 2022-08-09
US20210045050A1 (en) 2021-02-11

Similar Documents

Publication Publication Date Title
TWI724132B (zh) 無線通訊的方法、用於無線通訊的裝置以及用於執行該方法的電腦程式軟體
JP6185017B2 (ja) セキュアユーザプレーンロケーション（ｓｕｐｌ）システムにおける認証
US10856135B2 (en) Method and apparatus for network access
CN110798833B (zh) 一种鉴权过程中验证用户设备标识的方法及装置
CN110999359B (zh) 通过非接入层的安全短消息服务
WO2019196766A1 (zh) 通信方法和装置
US9668139B2 (en) Secure negotiation of authentication capabilities
CN109922474B (zh) 触发网络鉴权的方法及相关设备
TW201644236A (zh) 使用用於服務ｃ平面方法的網路符記的高效策略實施
CN112514436B (zh) 发起器和响应器之间的安全的、被认证的通信
WO2019134704A1 (zh) 一种更新密钥的方法及装置
US10904756B2 (en) Authentication for next generation systems
JP2023080266A (ja) モビリティ管理ノード、ユーザ機器、及びこれらの方法
US9060028B1 (en) Method and apparatus for rejecting untrusted network
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
WO2021099675A1 (en) Mobile network service security management
CN110226319A (zh) 用于紧急接入期间的参数交换的方法和设备
CN115942305A (zh) 一种会话建立方法和相关装置
CN115396126A (zh) Nswo业务的认证方法、设备和存储介质
US9043873B1 (en) Method and apparatus for rejecting untrusted network
WO2022228455A1 (zh) 一种通信方法以及相关装置
WO2022237741A1 (zh) 一种通信方法及装置
CN117997541A (zh) 通信方法和通信装置
CN116528234A (zh) 一种虚拟机的安全可信验证方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19784519

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019784519

Country of ref document: EP

Effective date: 20201012