WO2020020007A1 - 网络接入方法、装置、终端、基站和可读存储介质 - Google Patents

网络接入方法、装置、终端、基站和可读存储介质 Download PDF

Info

Publication number
WO2020020007A1
WO2020020007A1 PCT/CN2019/096023 CN2019096023W WO2020020007A1 WO 2020020007 A1 WO2020020007 A1 WO 2020020007A1 CN 2019096023 W CN2019096023 W CN 2019096023W WO 2020020007 A1 WO2020020007 A1 WO 2020020007A1
Authority
WO
WIPO (PCT)
Prior art keywords
amf
nssai
network
authentication
network access
Prior art date
Application number
PCT/CN2019/096023
Other languages
English (en)
French (fr)
Inventor
毛玉欣
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2020020007A1 publication Critical patent/WO2020020007A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • Embodiments of the present disclosure relate to the field of network communications, and in particular, to a network access method, device, terminal, base station, and computer-readable storage medium.
  • the 5G network realizes the decoupling of software and hardware, and builds a virtual network on general hardware resources to provide network services.
  • 5G networks can flexibly shrink network capacity based on demand.
  • 5G networks also break the closed model of traditional telecommunications networks, opening up network service capabilities to third-party services (such as service providers, enterprises, vertical industries, etc.), allowing third-party services to build network slices as needed to provide network services, Adapt to the rapid development and changing needs of various businesses. ,
  • the 3GPP (The 3rd Generation Partnership Project) defines a 5G network communication architecture, as shown in FIG. 1.
  • 5G networks provide network services to users in the form of network slices.
  • Network slicing is a virtual network with complete functions, logical independence, and resource sharing.
  • NSSAI Network Slice Selection Assistant Information
  • the embodiments of the present disclosure provide a network access method, device, terminal, base station, and computer-readable storage medium, which aim to solve the problems of poor network access security and vulnerability to attacks in the prior art.
  • an embodiment of the present disclosure provides a network access method, including:
  • the serving AMF is the AMF determined according to the network slice selection auxiliary information NSSAI sent to the default AMF;
  • the network access of the user equipment UE is completed based on the serving AMF.
  • An embodiment of the present disclosure further provides a network access method, including:
  • Network access of the UE is completed through the serving AMF.
  • An embodiment of the present disclosure further provides a network access device, including:
  • a request initiation module configured to initiate a network initial registration request to the AMF
  • a first authentication module configured to perform access authentication with the default AMF through the network initial registration request
  • the first AMF confirmation module is configured to determine a corresponding service AMF after successful authentication; the service AMF is an AMF determined according to the network slice selection auxiliary information NSSAI sent to the default AMF;
  • the first network access module is configured to complete network access of the user equipment UE based on the serving AMF.
  • An embodiment of the present disclosure further provides a network access device, including:
  • a request receiving module configured to receive a network initial registration request sent by a UE
  • a second authentication module configured to perform access authentication with the default AMF through the network initial registration request
  • the second AMF confirmation module is configured to determine a corresponding serving AMF according to the received NSSAI sent by the UE after the authentication is successful;
  • the second network access module is configured to complete network access of the UE through the serving AMF.
  • An embodiment of the present disclosure further provides a terminal including a first processor, a first memory, and a first communication bus;
  • the first communication bus is configured to implement connection and communication between the first processor and a first memory
  • the first processor is configured to execute a computer program stored in the first memory to implement the steps of the foregoing network access method.
  • An embodiment of the present disclosure further provides a base station including a second processor, a second memory, and a second communication bus;
  • the second communication bus is configured to implement connection and communication between the second processor and a second memory
  • the second processor is configured to execute a computer program stored in the second memory to implement the steps of the network access method described above.
  • An embodiment of the present disclosure further provides a computer-readable storage medium.
  • the computer-readable storage medium stores one or more computer programs, and the computer programs can be executed by one or more processors to implement the foregoing network access method. A step of.
  • Embodiments of the present disclosure provide a network access method, device, terminal, base station, and computer-readable storage medium.
  • a network initial registration request is initiated to a default AMF, and then access authentication is performed with the default AMF through the network initial registration request.
  • the corresponding serving AMF is determined; the serving AMF is the AMF determined according to the NSSAI sent to the default AMF; and the network access of the user equipment UE is completed based on the serving AMF. Therefore, after the authentication interaction with the default AMF, the NSSAI information processing process is performed to determine the service AMF, which avoids the message leakage that may be caused by directly sending NSSAI and improves the security of network access.
  • Figure 1 is a schematic diagram of a 5G network communication architecture
  • FIG. 2 is a schematic diagram of slicing network access
  • 3 is a signal flow diagram of a network access method defined by 3GPP;
  • FIG. 4 is a flowchart of a network access method according to a first embodiment of the present disclosure
  • FIG. 5 is a flowchart of a network access method according to a second embodiment of the present disclosure.
  • FIG. 6 is a signal flow diagram of a network access method according to a third embodiment of the present disclosure.
  • FIG. 7 is a signal flow diagram of a network access method according to a fourth embodiment of the present disclosure.
  • FIG. 8 is a signal flow diagram of a network access method according to a fifth embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of a network access device according to a sixth embodiment of the present disclosure.
  • FIG. 10 is a schematic diagram of a network access device according to a seventh embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a terminal according to an eighth embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of a base station according to a ninth embodiment of the present disclosure.
  • FIG. 2 illustrates an example of a user accessing a 5G network and using network slices to provide services.
  • the network orchestration management system orchestrates network slice 1 to provide services for the Internet of Vehicles business, orchestrates network slice 2 to provide services for Internet services, and slices 1 and 2 are logically isolated.
  • the public network element domain is a public network element shared by multiple slices, such as AMF (Access and Mobility Management Function, Access and Mobility Management Function), NSSF (Network Slice Selection Function), AUSF (Authentication Server) Function, authentication service function) and so on.
  • AMF Access and Mobility Management Function, Access and Mobility Management Function
  • NSSF Network Slice Selection Function
  • AUSF Authentication Server Function
  • User UE User Equipment
  • Different businesses have different requirements for network indicators such as network service quality and security.
  • the Internet of Vehicles application requires ultra-low latency and high reliability; the Internet of Things application guarantees machine communication and requires a high level of security assurance, while ordinary multimedia entertainment and other data services have high requirements for bandwidth, but only A common security level is required to meet business requirements.
  • 5G technology can customize different network slices for different services to meet the needs of each service.
  • Each network slice is logically a separate network and can provide users with network services. Although multiple network slices share the basic network resources, the network slices are isolated from each other.
  • 3GPP defines the process for users to attach to the network and initiate initial registration, as shown in Figure 3.
  • the UE sends a registration request message.
  • the message includes: registration type, SUPI / 5G-GUTI (Subscription Permanent Identifier, permanent signing identifier / 5G-Globally Unique Temporary UE Identity, 5G global unique temporary UE identifier), security parameters, NSSAI, etc. information.
  • NSSAI is used to indicate the network slice that the user requested to access.
  • the RAN Radio Access Network, Radio Access Network selects AMF (Access and Mobility Management Function) to serve the user's access according to information provided by the UE (User Equipment), such as NSSAI and operator policies And mobility management).
  • AMF Access and Mobility Management Function
  • the RAN routes the registration request message to the AMF.
  • the new AMF interacts with the old AMF, and obtains SUPI and mobility management context information from the old AMF. .
  • step S305 If no SUPI is provided to the new AMF in step S301 or step S303, the new AMF initiates an identity request procedure to the UE, requesting the UE to provide SUPI.
  • the UE provides SUCI (Subscription, Concealed, Identifier, hidden signing identifier, encrypted SUPI) to the new AMF.
  • SUCI Subscribed, Concealed, Identifier, hidden signing identifier, encrypted SUPI
  • the new AMF initiates a UE access authentication process, and selects AUSF (Authentication Server Function) according to SUCI.
  • AUSF Authentication Server Function
  • the UE, the new AMF, AUSF, and UDM exchange authentication procedures to complete the two-way authentication between the UE and the AMF.
  • the AMF initiates a NAS (Non-Access Stratum, non-access stratum) secure channel establishment procedure, establishes a NAS secure channel, and encrypts and integrity protects messages exchanged between the UE and the AMF.
  • NAS Non-Access Stratum, non-access stratum
  • the new AMF notifies the old AMF of the successful registration of the UE.
  • the new AMF initiates an identity request procedure to the UE, and requests the UE to provide the PEI.
  • the AMF interacts with the Equipment Identity Register (EIR) to authenticate the PEI.
  • EIR Equipment Identity Register
  • the new AMF is registered with the UDM, and the UDM stores the AMF identity and the access type.
  • the new AMF obtains access and mobility contract data from UDM, SMF (Session Management Function, Session Management Function) selection contract data, and so on. After obtaining this information, a mobility management context is created.
  • the new AMF subscribes to the user subscription information from the UDM. When the user subscription information changes, the new AMF is notified in time so that the new AMF recreates the mobility management context based on the new user subscription information.
  • the UDM notifies the old AMF to delete the mobility management context related to the UE.
  • the old AMF notifies the relevant SMF that the UE has deregistered from the old AMF and releases the related PDU session.
  • the old AMF registered the relevant subscription events before the UDM.
  • the new AMF notifies the UE reachability status to each SMF. If the PDU session status indicates that it has been released on the UE side, the AMF needs to notify the SMF to release the network resources associated with the PDU session.
  • the new AMF returns a registration acceptance message to the UE, including information such as 5G-GUTI (the latest 5G-GUTI allocated by the new AMF), NSSAI (the NSSAI authorized by the network side to allow the UE to request use), and other information.
  • 5G-GUTI the latest 5G-GUTI allocated by the new AMF
  • NSSAI the NSSAI authorized by the network side to allow the UE to request use
  • the UE sends a registration completion message to the new AMF.
  • a NAS security channel is established between the user and the network to ensure that the information exchanged between the UE and the AMF is encrypted and integrity protected.
  • the messages in steps S301-S306 are transmitted in clear text, including the IMSI (International Mobile Subscriber Identification Number) carried by the user during the registration request message sent to the network during this period. Identification code), and the network slice identification NSSAI information requested by the user to access are all in plain text. Therefore, the middleman can easily obtain key user information such as IMSI and NSSAI on the message passing path.
  • IMSI International Mobile Subscriber Identification Number
  • FIG. 4 is a flowchart of a network access method according to a first embodiment of the present disclosure, including:
  • the service AMF is the AMF determined according to the network slice selection auxiliary information NSSAI sent to the default AMF;
  • this embodiment proposes a network access method for users to access the network. Pass to achieve the purpose of protecting NSSAI.
  • the default AMF described in this embodiment refers to the AMF in the default state of the system; since the network access process in this embodiment, the UE does not directly provide the plain text NSSAI information when requested, so it cannot directly confirm The service AMF that the UE wants to access completes the network access process, so the UE's interaction object is first the default AMF, and the default AMF is used to provide access services for the user.
  • the interaction of the default AMF needs to involve the authentication process with the UE.
  • the authentication process does not involve the selection of the serving AMF by the UE, but for the subsequent UE and the default AMF.
  • Interaction between NSSAI information may be sent to the default AMF by using at least one of asymmetric encryption transmission, symmetric encryption transmission, and NAS secure channel transmission.
  • the means for transmitting NSSAI between the UE and the default AMF may include encrypting the NSSAI itself or transmitting the two means in a secure NAS secure channel.
  • Encryption of NSSAI can be achieved through asymmetric encryption, symmetric encryption, and other means.
  • the above encryption methods can be implemented separately or in combination.
  • NSSAI can be encrypted by asymmetric encryption and then transmitted through the NAS secure channel; or NSSAI can be encrypted by symmetric encryption and then passed through NAS secure channel for transmission and more.
  • the transmission of the NSSAI by asymmetric encryption may include: determining the operator's public and private keys configured on the UE and the network side; encrypting the NSSAI by the public key; and initial registering the encrypted NSSAI through the network
  • the request is sent to the default AMF.
  • to transmit by asymmetric encryption method firstly, it is necessary to configure a matching operator public key and private key on the UE side and the network side. Then, when the UE sends the NSSAI to the network side, the NSSAI is Encrypt and then send the encrypted NSSAI to the network side.
  • the sending process can carry the encrypted NSSAI through the network initial registration request and send it to the network side.
  • determining the corresponding service AMF may include: after the authentication is successful, decrypting the NSSAI by using the private key; and determining the corresponding service AMF according to the decrypted NSSAI. Since NSSAI is encrypted by the operator's public key, in order to ensure its security, the encrypted NSSAI can be decrypted by the operator's private key only after the authentication between the UE and the default AMF is passed, so that the plaintext NSSAI can be obtained. . After obtaining the plaintext NSSAI, the default AMF can determine the service AMF required by the user to access the slice network according to the content of the NSSAI.
  • the transmission of the NSSAI by a symmetric encryption method includes: after the authentication is successful, a key is generated according to the root key and key material, and the NSSAI is encrypted by the key; and the encrypted NSSAI is sent to the default AMF.
  • the symmetric encryption process can be performed after the UE and the default AMF authentication succeed; after the authentication is successful, the root key K generates an authentication vector (including RAND (RANDom, random number), AUTN (AUthentication TokeN, authorization token), K NSSAIenc Etc.).
  • the AUSF sends the authentication vector to the default AMF.
  • the default AMF saves the authentication vector and sends the key material RAND, AUTN and other information to the UE.
  • the UE performs verification and calculates K NSSAIenc based on the saved root key K and key material calculation.
  • determining the corresponding service AMF may include: calculating and generating a key for NSSAI encryption according to the root key and key material calculation; sending the key to the default AMF; and based on the key, the encrypted NSSAI performs decryption; the corresponding service AMF is determined according to the decrypted NSSAI.
  • the serving AMF decrypts the NSSAI accordingly according to the encryption vector K NSSAIenc of the NSSAI to obtain the plaintext NSSAI, and then determines the corresponding serving AMF according to the content of the plaintext NSSAI to implement the slice network of the UE. Access.
  • the NSSAI transmission through the NAS secure channel may further include: after successful authentication, establishing a NAS secure channel between the UE and the default AMF; and sending the NSSAI to the default AMF through the NAS secure channel. At this time, it is not necessary to encrypt the NSSAI itself, but to send the NSSAI through a secure NAS secure channel, thereby ensuring the security of the NSSAI and preventing the NSSAI from being stolen by the outside world.
  • determining the corresponding serving AMF may include: determining the corresponding serving AMF according to the NSSAI; and after determining the corresponding serving AMF, removing the NAS secure channel between the UE and the default AMF. After the serving AMF is determined, there is no need to keep the NAS secure channel between the UE and the default AMF, and it can be removed directly to save network resources.
  • This embodiment provides a network access method.
  • a network initial registration request is initiated to the default AMF, and then access authentication is performed with the default AMF through the network initial registration request. After successful authentication, the corresponding service AMF is determined; the service AMF The AMF is determined according to the NSSAI sent to the default AMF; the network access of the user equipment UE is completed based on the serving AMF. Therefore, after the authentication interaction with the default AMF, the NSSAI information processing process is performed to determine the service AMF, which avoids the message leakage that may be caused by directly sending NSSAI and improves the security of network access.
  • FIG. 5 is a flowchart of a network access method according to a second embodiment of the present disclosure, including:
  • this embodiment proposes a network access method for users to access the network. Pass to achieve the purpose of protecting NSSAI.
  • the default AMF described in this embodiment refers to the AMF in the default state of the system; since the network access process in this embodiment, the UE does not directly provide the plain text NSSAI information when requested, so it cannot directly confirm The service AMF that the UE wants to access completes the network access process, so the UE's interaction object is first the default AMF, and the default AMF is used to provide access services for the user.
  • the interaction of the default AMF needs to involve the authentication process with the UE.
  • the authentication process does not involve the selection of the serving AMF by the UE, but for the subsequent UE and the default AMF.
  • Interaction between NSSAI information can receive NSSAI through at least one of an asymmetric encryption mode transmission, a symmetric encryption mode transmission, and a NAS secure channel transmission.
  • the means for transmitting NSSAI between the UE and the default AMF may include encrypting the NSSAI itself or transmitting the two means in a secure NAS secure channel.
  • Encryption of NSSAI can be achieved through asymmetric encryption, symmetric encryption, and other means.
  • the above encryption methods can be implemented separately or in combination.
  • NSSAI can be encrypted by asymmetric encryption and then transmitted through the NAS secure channel; or NSSAI can be encrypted by symmetric encryption and then passed through NAS secure channel for transmission and more.
  • transmitting the NSSAI in an asymmetric encryption method may include: determining an operator's public and private keys configured on the UE and the network side; encrypting the NSSAI through the public key; and receiving the encrypted NSSAI.
  • asymmetric encryption method to transmit by asymmetric encryption method, firstly, it is necessary to configure a matching operator public key and private key on the UE side and the network side. Then, when the UE sends the NSSAI to the network side, the NSSAI is Encrypt and then send the encrypted NSSAI to the network side.
  • the sending process can carry the encrypted NSSAI through the network initial registration request and send it to the network side.
  • determining the corresponding service AMF according to the received NSSAI sent by the UE may include: after the authentication is successful, decrypting the NSSAI through the private key; and determining the corresponding service AMF according to the decrypted NSSAI. Since NSSAI is encrypted by the operator's public key, in order to ensure its security, the encrypted NSSAI can be decrypted by the operator's private key only after the authentication between the UE and the default AMF is passed, so that the plaintext NSSAI can be obtained. . After obtaining the plaintext NSSAI, the default AMF can determine the service AMF required by the user to access the slice network according to the content of the NSSAI.
  • the transmission of NSSAI by symmetric encryption may include: after authentication is successful, a key for NSSAI encryption is generated according to the root key and key material and key material calculation, and the NSSAI is encrypted by the key; Receive encrypted NSSAI.
  • the symmetric encryption process can be performed after the UE and the default AMF authentication succeed; after the authentication is successful, the root key K generates an authentication vector (including RAND (RANDom, random number), AUTN (AUthentication TokeN, authorization token), K NSSAIenc Etc.).
  • the AUSF sends the authentication vector to the default AMF.
  • the default AMF saves the authentication vector and sends the key material RAND, AUTN and other information to the UE.
  • the UE performs verification and calculates K NSSAIenc based on the saved root key K and key material calculation.
  • determining the corresponding service AMF may include: calculating and generating a key for NSSAI encryption according to the root key and key material calculation; receiving the key; and decrypting the encrypted NSSAI according to the key; According to the decrypted NSSAI, the corresponding service AMF is determined.
  • the serving AMF decrypts the NSSAI accordingly according to the encryption vector K NSSAIenc of the NSSAI to obtain the plaintext NSSAI, and then determines the corresponding serving AMF according to the content of the plaintext NSSAI to implement the slice network of the UE. Access.
  • the NSSAI transmission through the NAS secure channel may include: after successful authentication, establishing a NAS secure channel between the UE and the NSSAI; and receiving the NSSAI through the NAS secure channel. At this time, it is not necessary to encrypt the NSSAI itself, but to send the NSSAI through a secure NAS secure channel, thereby ensuring the security of the NSSAI and preventing the NSSAI from being stolen by the outside world.
  • This embodiment provides a network access method.
  • a network initial registration request is initiated to the default AMF, and then access authentication is performed with the default AMF through the network initial registration request. After successful authentication, the corresponding service AMF is determined; the service AMF The AMF is determined according to the NSSAI sent to the default AMF; the network access of the user equipment UE is completed based on the serving AMF. Therefore, after the authentication interaction with the default AMF, the NSSAI information processing process is performed to determine the service AMF, which avoids the message leakage that may be caused by directly sending NSSAI and improves the security of network access.
  • FIG. 6 is a signal flow diagram of a network access method according to this embodiment, including:
  • This embodiment describes an optimized registration process in the process of a user accessing a network, realizing encrypted transmission of NSSAI, and ensuring security in the process of NSSAI transmission.
  • the AMF initially selected by the user to access the network is the default AMF, that is, the AMF configured when the AMF selection cannot be performed according to the information provided by the UE.
  • the specific implementation process is described as follows:
  • the UE accesses the network to initiate a registration request, and uses the public key to encrypt the network slice identifier NSSAI of the requested access.
  • the UE initiates a network initial registration request, and the request message includes an encrypted NSSAI. Due to the NSSAI encryption, according to the AMF selection method, the AMF corresponding to the NSSAI cannot be selected for the user. Therefore, the default AMF is selected for the user access service.
  • the two-way authentication is completed between the UE and the default AMF.
  • SIDF decrypts the encrypted NSSAI into plain text, and sends the plain text NSSAI to the default AMF.
  • the default AMF sends a slice selection request to the NSSF according to the plaintext NSSAI.
  • the NSSF authorizes the requesting NSSAI (that is, the plaintext NSSAI), and returns the authorized NSSAI and the target AMF (target AMF) set to the default AMF.
  • the default AMF sends a Target AMF (ie, service AMF) query to the NRF to obtain the IP address / FQDN (Fully Qualified Domain Name) information of the service AMF.
  • a Target AMF ie, service AMF
  • FQDN Full Qualified Domain Name
  • the default AMF forwards the user registration request to the Target AMF, and includes the RAN information and the mobility management context generated on the default AMF after successful authentication.
  • the Target AMF sends an N2 session message to the RAN.
  • the above implementation process ensures that the NSSAI is transmitted in an encrypted manner between the UE and the network, and prevents the middleman from stealing the NSSAI to deduce the slicing function through analysis and access to the attributes of the crowd, and then launches a network attack to ensure user and network security.
  • FIG. 7 is a signal flow diagram of a network access method according to a fourth embodiment of the present disclosure, including:
  • This embodiment describes an optimized registration procedure when a user accesses a network. After successful authentication between the UE and the default AMF, a cipher key for NSSAI is derived. This key is used to encrypt NSSAI for secure transmission.
  • the specific implementation process is described as follows:
  • S701 The UE accesses the network and initiates a registration request.
  • the initial registration request message does not contain NSSAI, so it is not possible to select a suitable AMF, and use the default AMF to access the UE for service.
  • the default AMF receives the registration request. If the user identity SUPI is not obtained, it initiates an identity acquisition process to obtain SUCI (encrypted SUPI) from the UE.
  • SUCI Encrypted SUPI
  • the AUSF generates an authentication vector (including RAND (RANDom, random number), AUTN (AUthentication TokeN, authorization token), K NSSAIenc, etc.) according to the root key K in the UE contract information.
  • the AUSF sends the authentication vector to the default AMF.
  • the default AMF saves the authentication vector and sends the key material RAND, AUTN and other information to the UE.
  • the UE performs verification and calculates K NSSAIenc based on the saved root key K and key material calculation.
  • the UE encrypts the NSSAI by using K NSSAIenc .
  • the UE sends the encrypted NSSAI to the default AMF.
  • the AMF After receiving the encrypted NSSAI by default, the AMF uses K NSSAIenc to decrypt it to obtain the plain text NSSAI.
  • the default AMF sends a slice selection request to the NSSF according to the plaintext NSSAI.
  • the NSSF authorizes the requesting NSSAI (that is, the plaintext NSSAI), and returns the authorized NSSAI and the target AMF set to the default AMF.
  • the default AMF sends an N2 session message to the RAN, and carries the target AMF set to the RAN.
  • the RAN initiates a Target AMF (ie, serving AMF) query to the NRF to obtain the IP address / FQDN information of the serving AMF.
  • Target AMF ie, serving AMF
  • the RAN forwards a user registration request to the Target AMF.
  • access authentication is performed between the UE and the default AMF, and the shared key K NSSAIenc is generated according to the UE root key K, and the NSSAI is encrypted and transmitted to ensure the security during the NSSAI transmission process.
  • FIG. 8 is a signal flow diagram of a network access method according to a fifth embodiment of the present disclosure, including:
  • This embodiment describes an optimized registration process when a user accesses the network.
  • the NSSAI is transmitted by establishing a NAS secure channel between the UE and the default AMF, and the NAS channel is removed after selecting to serve the AMF. .
  • the specific implementation process is described as follows:
  • the UE accesses the network and initiates a registration request.
  • the initial registration request message does not contain NSSAI, so it is not possible to select a suitable AMF, and use the default AMF to access the UE for service.
  • the default AMF receives the registration request. If the user identity SUPI is not obtained, it initiates an identity acquisition process to obtain SUCI (encrypted SUPI) from the UE.
  • SUCI Encrypted SUPI
  • NAS secure channel is established between the UE and the default AMF.
  • the UE uses the NAS secure channel to send NSSAI to the default AMF.
  • the NAS secure channel encrypts and protects the entire message sent between the UE and the default AMF.
  • the default AMF obtains the NSSAI, and sends a slice selection request to the NSSF according to the NSSAI.
  • the NSSF authorizes the requesting NSSAI, and returns the authorized NSSAI and the target AMF set to the default AMF.
  • the default AMF sends a Target AMF (ie, service AMF) query to the NRF to obtain the IP address / FQDN information of the service AMF.
  • a Target AMF ie, service AMF
  • the default AMF forwards the user registration request to the Target AMF, and includes the RAN information and the mobility management context generated on the default AMF after successful authentication.
  • the Target AMF sends an N2 session message to the RAN.
  • the default AMF removes the NAS secure channel.
  • Target AMF needs to re-authenticate the UE, initiate an access authentication process.
  • the Target AMF and the UE establish a NAS secure channel.
  • a temporary NAS security channel is established for the secure transmission of NSSAI.
  • the NAS secure channel between the UE and the default AMF is removed to ensure the security during the NSSAI transmission process.
  • FIG. 9 is a schematic diagram of a network access device according to a sixth embodiment of the present disclosure, including:
  • the request initiation module 91 is configured to initiate a network initial registration request to the AMF;
  • a first authentication module 92 configured to perform access authentication with a default AMF through a network initial registration request
  • the first AMF confirmation module 93 is configured to determine the corresponding serving AMF after successful authentication; the serving AMF is the AMF determined according to the network slice selection auxiliary information NSSAI sent to the default AMF;
  • the first network access module 94 is configured to complete network access of the user equipment UE based on the serving AMF.
  • this embodiment proposes a network access method for users to access the network. Pass to achieve the purpose of protecting NSSAI.
  • the default AMF described in this embodiment refers to the AMF in the default state of the system; since the network access process in this embodiment, the UE does not directly provide the plain text NSSAI information when requested, so it cannot directly confirm The service AMF that the UE wants to access completes the network access process, so the UE's interaction object is first the default AMF, and the default AMF is used to provide access services for the user.
  • the interaction of the default AMF needs to involve the authentication process with the UE.
  • the authentication process does not involve the selection of the serving AMF by the UE, but for the subsequent UE and the default AMF.
  • Interaction between NSSAI information may be sent to the default AMF by using at least one of asymmetric encryption transmission, symmetric encryption transmission, and NAS secure channel transmission.
  • the means for transmitting NSSAI between the UE and the default AMF may include encrypting the NSSAI itself or transmitting the two means in a secure NAS secure channel.
  • Encryption of NSSAI can be achieved through asymmetric encryption, symmetric encryption, and other means.
  • the above encryption methods can be implemented separately or in combination.
  • NSSAI can be encrypted by asymmetric encryption and then transmitted through the NAS secure channel; or NSSAI can be encrypted by symmetric encryption and then passed through NAS secure channel for transmission and more.
  • the transmission of the NSSAI by asymmetric encryption may include: determining the operator's public and private keys configured on the UE and the network side; encrypting the NSSAI by the public key; and initial registering the encrypted NSSAI through the network
  • the request is sent to the default AMF.
  • to transmit by asymmetric encryption method firstly, it is necessary to configure a matching operator public key and private key on the UE side and the network side. Then, when the UE sends the NSSAI to the network side, the NSSAI is Encrypt and then send the encrypted NSSAI to the network side.
  • the sending process can carry the encrypted NSSAI through the network initial registration request and send it to the network side.
  • determining the corresponding service AMF may include: after the authentication is successful, decrypting the NSSAI by using the private key; and determining the corresponding service AMF according to the decrypted NSSAI. Since NSSAI is encrypted by the operator's public key, in order to ensure its security, the encrypted NSSAI can be decrypted by the operator's private key only after the authentication between the UE and the default AMF is passed, so that the plaintext NSSAI can be obtained. . After obtaining the plaintext NSSAI, the default AMF can determine the service AMF required by the user to access the slice network according to the content of the NSSAI.
  • the transmission of the NSSAI by a symmetric encryption method includes: after the authentication is successful, a key is generated according to the root key and key material, and the NSSAI is encrypted by the key; and the encrypted NSSAI is sent to the default AMF.
  • the symmetric encryption process can be performed after the UE and the default AMF are successfully authenticated; after the authentication is successful, the authentication vector K NSSAIenc is generated according to the root key K.
  • the default AMF sends the authentication parameters to the UE, and the UE uses the root key K and the authentication The parameters produce K NSSAIenc .
  • the UE uses K NSSAIenc to encrypt NSSAI and sends it to the default AMF.
  • determining the corresponding service AMF may include: sending a key to the default AMF; decrypting the encrypted NSSAI according to the key; and determining the corresponding service AMF according to the decrypted NSSAI.
  • the serving AMF decrypts the NSSAI accordingly according to the encryption vector K NSSAIenc of the NSSAI to obtain the plaintext NSSAI, and then determines the corresponding serving AMF according to the content of the plaintext NSSAI to implement the slice network of the UE Access.
  • the NSSAI transmission through the NAS secure channel may further include: after successful authentication, establishing a NAS secure channel between the UE and the NSSAI; and sending the NSSAI to the default AMF through the NAS secure channel. At this time, it is not necessary to encrypt the NSSAI itself, but to send the NSSAI through a secure NAS secure channel, thereby ensuring the security of the NSSAI and preventing the NSSAI from being stolen by the outside world.
  • This embodiment provides a network access device, which initiates a network initial registration request to the default AMF, and then performs access authentication with the default AMF through the network initial registration request; after the authentication is successful, the corresponding service AMF is determined; the service AMF The AMF is determined according to the NSSAI sent to the default AMF; the network access of the user equipment UE is completed based on the serving AMF. Therefore, after the authentication interaction with the default AMF, the NSSAI information processing process is performed to determine the service AMF, which avoids the message leakage that may be caused by directly sending NSSAI and improves the security of network access.
  • FIG. 10 is a schematic diagram of a network access device according to a seventh embodiment of the present disclosure, including:
  • the request receiving module 101 is configured to receive a network initial registration request sent by a UE;
  • the second authentication module 102 is configured to perform access authentication with the default AMF through the network initial registration request;
  • the second AMF confirmation module 103 is configured to determine the corresponding serving AMF according to the received NSSAI sent by the UE after successful authentication;
  • the second network access module 104 is configured to complete network access of the UE by serving the AMF.
  • this embodiment proposes a network access method for users to access the network. Pass to achieve the purpose of protecting NSSAI.
  • the default AMF described in this embodiment refers to the AMF in the default state of the system; since the network access process in this embodiment, the UE does not directly provide the plain text NSSAI information when requested, so it cannot directly confirm The service AMF that the UE wants to access completes the network access process, so the UE's interaction object is first the default AMF, and the default AMF is used to provide access services for the user.
  • the interaction of the default AMF needs to involve the authentication process with the UE.
  • the authentication process does not involve the selection of the serving AMF by the UE, but for the subsequent UE and the default AMF.
  • Interaction between NSSAI information can receive NSSAI through at least one of an asymmetric encryption mode transmission, a symmetric encryption mode transmission, and a NAS secure channel transmission.
  • the means for transmitting NSSAI between the UE and the default AMF may include encrypting the NSSAI itself or transmitting the two means in a secure NAS secure channel.
  • Encryption of NSSAI can be achieved through asymmetric encryption, symmetric encryption, and other means.
  • the above encryption methods can be implemented separately or in combination.
  • NSSAI can be encrypted by asymmetric encryption and then transmitted through the NAS secure channel; or NSSAI can be encrypted by symmetric encryption and then passed through NAS secure channel for transmission and more.
  • transmitting the NSSAI in an asymmetric encryption method may include: determining an operator's public and private keys configured on the UE and the network side; encrypting the NSSAI through the public key; and receiving the encrypted NSSAI.
  • asymmetric encryption method to transmit by asymmetric encryption method, firstly, it is necessary to configure a matching operator public key and private key on the UE side and the network side. Then, when the UE sends the NSSAI to the network side, the NSSAI is Encrypt and then send the encrypted NSSAI to the network side.
  • the sending process can carry the encrypted NSSAI through the network initial registration request and send it to the network side.
  • determining the corresponding service AMF according to the received NSSAI sent by the UE may include: after the authentication is successful, decrypting the NSSAI through the private key; and determining the corresponding service AMF according to the decrypted NSSAI. Since NSSAI is encrypted by the operator's public key, in order to ensure its security, the encrypted NSSAI can be decrypted by the operator's private key only after the authentication between the UE and the default AMF is passed, so that the plaintext NSSAI can be obtained. . After obtaining the plaintext NSSAI, the default AMF can determine the service AMF required by the user to access the slice network according to the content of the NSSAI.
  • the transmission of NSSAI through symmetric encryption may include: after successful authentication, generating a key according to the root key and key material, encrypting the NSSAI by using the key; and receiving the encrypted NSSAI.
  • the symmetric encryption process can be performed after the UE and the default AMF are successfully authenticated.
  • the authentication vector K NSSAIenc is generated based on the root key and key material K.
  • the default AMF sends the authentication parameters to the UE.
  • the key and key material K and the authentication parameters generate K NSSAIenc .
  • the UE uses K NSSAIenc to encrypt NSSAI and sends it to the default AMF.
  • determining the corresponding service AMF may include: receiving a key; decrypting the encrypted NSSAI according to the key; and determining the corresponding service AMF according to the decrypted NSSAI.
  • the serving AMF decrypts the NSSAI accordingly according to the encryption vector K NSSAIenc of the NSSAI to obtain the plaintext NSSAI, and then determines the corresponding serving AMF according to the content of the plaintext NSSAI to implement the slice network of the UE. Access.
  • the NSSAI transmission through the NAS secure channel may include: after successful authentication, establishing a NAS secure channel between the UE and the NSSAI; and receiving the NSSAI through the NAS secure channel. At this time, it is not necessary to encrypt the NSSAI itself, but to send the NSSAI through a secure NAS secure channel, thereby ensuring the security of the NSSAI and preventing the NSSAI from being stolen by the outside world.
  • This embodiment provides a network access device, which initiates a network initial registration request to the default AMF, and then performs access authentication with the default AMF through the network initial registration request; after the authentication is successful, the corresponding service AMF is determined; the service AMF The AMF is determined according to the NSSAI sent to the default AMF; the network access of the user equipment UE is completed based on the serving AMF. Therefore, after the authentication interaction with the default AMF, the NSSAI information processing process is performed to determine the service AMF, which avoids the message leakage that may be caused by directly sending NSSAI and improves the security of network access.
  • FIG. 11 is a schematic diagram of a terminal composition according to an eighth embodiment of the present disclosure, including a first processor 111, a first memory 112, and a first communication bus 113.
  • the first communication bus 113 is configured to implement connection and communication between the first processor 111 and the first memory 112;
  • the first processor 111 is configured to execute a computer program stored in the first memory 112 to implement a flow of the network access method in the foregoing embodiments of the present disclosure, and details are not described herein again.
  • FIG. 12 is a schematic diagram of a base station composition according to this embodiment, including a second processor 121, a second memory 122, and a second communication bus 123.
  • the second communication bus 123 is configured to implement connection and communication between the second processor 121 and the second memory 122;
  • the second processor 121 is configured to execute a computer program stored in the second memory 122 to implement the flow of the network access method in the foregoing embodiments of the present disclosure, and details are not described herein again.
  • This embodiment provides a computer-readable storage medium.
  • the computer-readable storage medium stores one or more computer programs, and the computer programs can be executed by one or more processors to implement the networks in the foregoing embodiments.
  • the access method is not repeated here.
  • modules or steps of the present disclosure may be implemented by a general-purpose computing device, and they may be concentrated on a single computing device or distributed on a network composed of multiple computing devices.
  • they can be implemented with program code executable by a computing device, so that they can be stored in a storage medium (ROM / RAM, magnetic disk, optical disk) and executed by the computing device, and in some cases
  • ROM / RAM, magnetic disk, optical disk a storage medium
  • the steps shown or described may be performed in a different order than here, or they may be made into individual integrated circuit modules, or multiple modules or steps in them may be made into a single integrated circuit module. Therefore, the present disclosure is not limited to any particular combination of hardware and software.

Abstract

本公开实施例提供了一种网络接入方法、装置、终端、基站和计算机可读存储介质，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。

Description

网络接入方法、装置、终端、基站和可读存储介质 技术领域
本公开实施例涉及网络通信领域，尤其涉及一种网络接入方法、装置、终端、基站和计算机可读存储介质。
背景技术
5G网络实现了软件和硬件解耦，在通用硬件资源上构建虚拟化网络提供网络服务。5G网络可以根据需求对网络容量进行灵活弹缩。同时5G网络还打破了传统电信网络的封闭模式，将网络服务能力开放给第三方业务(如业务提供商、企业、垂直行业等)，让第三方业务可以按需构建网络切片提供网络服务，以适应各种业务快速发展和不断变化的需求。、
3GPP(The 3rd Generation Partnership Project，第三代伙伴计划)定义了5G网络通信架构，如图1所示。5G网络以网络切片形式为用户提供网络服务。网络切片是功能完整、逻辑独立、资源共享的虚拟网络。
不同业务对网络服务质量、安全等网络指标存在不同的需求。例如，车联网应用，要求超低时延，超高可靠性；物联网应用保证机器通信，要求高等级的安全保证，而普通的多媒体娱乐等数据业务，虽然对带宽有较高要求，但仅需要普通安全等级就能满足业务要求。5G技术可通过为不同的业务定制不同的网络切片，以满足每种业务的需求。每个网络切片逻辑上是独立的一张网络，可为用户提供网络服务。虽然多个网络切片共用网络基础资源，但网络切片之间彼此是隔离的。网络切片以NSSAI(Network Slice Selection Assistance Information，网络切片选择辅助信息)标识。但是，在网络接入的过程中，NSSAI信息传递过程未加以保护，容易被在消息传递路径上获取其信息，进而易受到其他人群针对此发起的攻击，瘫痪网络，影响用户和网络安全。
发明内容
本公开实施例提供了一种网络接入方法、装置、终端、基站和计算机可读存储介质，旨在解决先有技术中网络接入安全性差，易受到攻击的问题。
为了解决上述技术问题，本公开实施例提供了一种网络接入方法，包括：
向缺省接入和移动性管理功能AMF发起网络初始注册请求；
通过所述网络初始注册请求与所述缺省AMF进行接入认证；
认证成功后，确定对应的服务AMF；所述服务AMF为根据发送给所述缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
基于所述服务AMF完成用户设备UE的网络接入。
本公开实施例还提供一种网络接入方法，包括：
接收UE发送的网络初始注册请求；
通过所述网络初始注册请求与所述UE进行接入认证；
认证成功后，根据接收到的由所述UE发送的NSSAI确定对应的服务AMF；
通过所述服务AMF完成UE的网络接入。
本公开实施例还提供了一种网络接入装置，包括：
请求发起模块，设置为向AMF发起网络初始注册请求；
第一认证模块，设置为通过所述网络初始注册请求与所述缺省AMF进行接入认证；
第一AMF确认模块，设置为认证成功后，确定对应的服务AMF；所述服务AMF为根据发送给所述缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
第一网络接入模块，设置为基于所述服务AMF完成用户设备UE的网络接入。
本公开实施例还提供一种网络接入装置，包括：
请求接收模块，设置为接收UE发送的网络初始注册请求；
第二认证模块，设置为通过所述网络初始注册请求与所述缺省AMF进行接入认证；
第二AMF确认模块，设置为认证成功后，根据接收到的由所述UE发送的NSSAI确定对应的服务AMF；
第二网络接入模块，设置为通过所述服务AMF完成UE的网络接入。
本公开实施例还提供了一种终端，包括第一处理器、第一存储器和第一通信总线；
所述第一通信总线设置为实现所述第一处理器和第一存储器之间的连接通信；
所述第一处理器设置为执行所述第一存储器中存储的计算机程序，以实现上述的网络接入方法的步骤。
本公开实施例还提供了一种基站，包括第二处理器、第二存储器和第二通信总线；
所述第二通信总线设置为实现所述第二处理器和第二存储器之间的连接通信；
所述第二处理器设置为执行所述第二存储器中存储的计算机程序，以实现上述的网络接入方法的步骤。
本公开实施例还提供了一种计算机可读存储介质，计算机可读存储介质中存储有一个或者多个计算机程序，计算机程序可被一个或者多个处理器执行，以实现上述的网络接入方法的步骤。
本公开实施例的有益效果是：
本公开实施例提供了一种网络接入方法、装置、终端、基站和计算机可读存储介质，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。
本公开实施例其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当 理解，至少部分有益效果从本公开说明书中的记载变的显而易见。
附图说明
图1为5G网络通信架构示意图；
图2为切片网络接入示意图；
图3为3GPP定义的网络接入方法信号流图；
图4为本公开第一实施例提供的一种网络接入方法流程图；
图5为本公开第二实施例提供的一种网络接入方法流程图；
图6为本公开第三实施例提供的一种网络接入方法信号流图；
图7为本公开第四实施例提供的一种网络接入方法信号流图；
图8为本公开第五实施例提供的一种网络接入方法信号流图；
图9为本公开第六实施例提供的一种网络接入装置组成示意图；
图10为本公开第七实施例提供的一种网络接入装置组成示意图；
图11为本公开第八实施例提供的一种终端组成示意图；
图12为本公开第九实施例提供的一种基站组成示意图。
具体实施方式
图2描述了用户接入5G网络，使用网络切片提供服务的示例。通过网络编排管理系统编排网络切片1为车联网业务提供服务，编排网络切片2为互联网业务提供服务，切片1与切片2之间逻辑隔离。公共网元域是被多个切片共享的公共网元，例如AMF(Access and Mobility Management Function，接入和移动性管理功能)，NSSF(Network Slice Selection Function，网络切片选择功能)，AUSF(Authentication Server Function，认证服务功能)等。用户UE(User Equipment，用户设备)如果使用车联网业务，就需要接入切片1；如果使用互联网业务，就需要接入切片2。不同业务对网络服务质量、安全等网络指标存在不同的需求。例如，车联网应用，要求超低时延，超高可靠性；物联网应用保证机器通信，要求高等级的安全保证，而普通的多媒体娱乐等数据业务，虽然对带宽有较高要求，但仅需要普通安全等级就能满足业务要求。5G技术可通过为不同的业务定制不同的网络切片，以满足每种业务的需求。每个网络切片逻辑上是独立的一张网络，可为用户提供网络服务。虽然多个网络切片共用网络基础资源，但网络切片之间彼此是隔离的。
3GPP定义了用户附着到网络，发起初次注册的流程，如图3所示。
S301、UE发送注册请求消息，消息中包含：注册类型、SUPI/5G-GUTI(Subscription Permanent Identifier，永久签约标识/5G-Globally Unique Temporary UE Identity，5G全球唯一临时UE标识)、安全参数、NSSAI等信息。NSSAI用于指示用户请求接入的网络切片。
S302、RAN(Radio Access Network，无线接入网络)根据UE(User Equipment，用 户设备)提供的信息，例如NSSAI以及运营商策略，选择为用户接入服务的AMF(Access and Mobility Management Function，接入和移动性管理功能)。
S303、RAN将所述注册请求消息路由至所述AMF。
S304、如果UE注册请求消息中包含了5G-GUTI，并且选择当前服务AMF与用户上一次注册所使用的AMF不同时，新的AMF和旧AMF交互，从旧AMF获取SUPI和移动性管理上下文信息。
S305、如果步骤S301或者步骤S303中没有向新AMF提供SUPI，则新AMF向UE发起标识请求程序，请求UE提供SUPI。
S306、UE向新AMF提供SUCI(Subscription Concealed Identifier，隐藏签约标识，经过加密的SUPI)。
S307、新AMF发起UE接入认证过程，根据SUCI选择AUSF(Authentication Server Function，认证服务功能)。
S308、UE、新AMF、AUSF、UDM(Unified Data Management，统一数据管理)之间交互认证流程，完成UE和AMF之间的双向认证。
S309、认证成功之后，AMF发起NAS(Non-Access Stratum，非接入层)安全通道建立程序，建立NAS安全通道，对UE和AMF交互的消息进行加密和完整性保护。
S310、认证完成之后，新AMF向旧AMF通知UE注册成功。
S311、如果步骤S301或者步骤S303中没有向新AMF提供PEI(Permanent Equipment Identifier，设备永久标识)，则新AMF向UE发起标识请求程序，请求UE提供PEI。AMF和EIR(Equipment Identity Register，设备标识寄存器)交互，对PEI进行认证。
S312、新AMF注册到UDM，UDM存储AMF标识，以及接入类型。新AMF从UDM获取接入和移动性签约数据、SMF(Session Management Function，会话管理功能)选择签约数据等。获取这些信息之后，创建移动性管理上下文。新AMF向UDM订阅用户签约信息，当用户签约信息发生更改时，及时通知新AMF，以便新AMF根据新的用户签约信息重新创建移动性管理上下文。
S303、UDM通知旧AMF删除与所述UE相关的移动性管理上下文。旧AMF通知相关SMF所述UE已经从旧AMF去注册，释放相关的PDU会话。旧AMF从UDM上去注册之前的相关订阅事件。
S314、如果AMF发生改变，新AMF向每个SMF通知UE可达状态。如果PDU会话状态指示已经在UE侧释放，则AMF需要通知SMF释放和该PDU会话关联的网络资源。
S315、新AMF向UE返回注册接受消息，包含：5G-GUTI(新AMF为其分配的最新5G-GUTI)、NSSAI(经过网络侧授权的允许UE请求使用的NSSAI)等信息。
S316、UE向新AMF发送注册完成消息。
上述图3中，在用户成功完成接入认证之后，用户和网络之间建立NAS安全通道， 保证UE和AMF之间交互的信息经过加密和完整性保护。而在所述NAS安全通道建立(步骤S309)之前，即步骤S301-S306消息均为明文传递，包括在此期间用户向网络发送注册请求消息时携带的IMSI(International Mobile Subscriber Identification Number，国际移动用户识别码)，以及用户请求接入的网络切片标识NSSAI信息都为明文。因此中间人在消息传递路径上很容易获取IMSI、NSSAI等关键用户信息。通过分析就可以推断出NSSAI对应的网络切片的作用，即提供何种服务，或者推断出使用网络切片的人群等，以便有针对性的向所述切片发起诸如DoS(Denial of Service，拒绝服务)等攻击，瘫痪网络，影响用户和网络安全。
为了使本公开的目的、技术方案及优点更加清楚明白，下面通过各实施方式结合附图对本公开实施例作进一步详细说明。应当理解，此处所描述的实施例仅仅用以解释本公开，并不用于限定本公开。
第一实施例
请参考图4，图4是本公开第一实施例提供的网络接入方法流程图，包括：
S401、向缺省接入和移动性管理功能AMF发起网络初始注册请求；
S402、通过网络初始注册请求与缺省AMF进行接入认证；
S403、认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
S404、基于服务AMF完成用户设备UE的网络接入。
为了避免因NSSAI暴露而引发的网络攻击，需要在用户接入网络过程中，保证NSSAI传递的安全性，因此本实施例提出了一种用户接入网络的网络接入方法，通过对NSSAI的加密传递，达到保护NSSAI的目的。
本实施例中所述的缺省AMF，所指的是系统默认状态下的AMF；由于本实施例中的网络接入过程中，UE没有直接在请求时提供明文的NSSAI信息，因此无法直接确认UE所要接入的服务AMF来完成网络的接入过程，所以UE的交互对象首先是缺省AMF，通过缺省AMF来为用户进行接入服务。
在UE与缺省AMF交互的过程中，缺省AMF的交互需要涉及到与UE之间的认证过程，认证过程中并不涉及到UE对服务AMF的选择，而是为了后续UE与缺省AMF之间交互NSSAI信息。本实施例为了提升NSSAI信息在传输过程中的安全性，示例性而言，NSSAI可以为通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种发送给缺省AMF。也就是说，NSSAI在UE和缺省AMF之间进行传输的手段，可以包括对NSSAI本身进行加密，或者是在安全的NAS安全通道内传输两种手段。而对NSSAI进行加密，则可以通过非对称加密、对称加密等手段来实现。上述各加密手段之间可以单独实施，也可以组合进行，比如可通过非对称加密手段对NSSAI进行加密，然后再通过NAS安全通道进行传输；或者是通过对称加密手段对NSSAI进行加密，然后在 通过NAS安全通道进行传输等等。
在一些实施例中，NSSAI为通过非对称加密方式传送可以包括：确定在UE和网络侧配置的运营商公钥和私钥；通过公钥对NSSAI进行加密；将加密后的NSSAI通过网络初始注册请求发送给缺省AMF。其中，通过非对称加密方式传送，首先需要在UE侧以及网络侧配置匹配的运营商公钥和私钥；然后，UE在发送NSSAI至网络侧时，则通过配置的运营商公钥，对NSSAI进行加密，然后发送加密的NSSAI至网络侧。而发送的过程可以通过网络初始注册请求，来携带加密的NSSAI并发送至网络侧。
相应的，认证成功后，确定对应的服务AMF可以包括：认证成功后，对NSSAI通过私钥进行解密；根据解密后的NSSAI，确定对应的服务AMF。由于NSSAI通过运营商公钥进行了加密，为了保证其安全性，需要在UE和缺省AMF之间的认证通过后，方才通过运营商私钥对该加密的NSSAI进行解密，从而可得到明文NSSAI。得到明文NSSAI之后，缺省AMF就可以根据该NSSAI的内容，来确定用户接入切片网络所需的服务AMF。
在一些实施例中，NSSAI为通过对称加密方式传送包括：认证成功后，根据根密钥和密钥材料产生密钥，通过密钥对NSSAI进行加密；将加密后的NSSAI发送给缺省AMF。对称加密的过程可以在UE与缺省AMF认证成功之后进行；在认证成功后，根密钥K产生认证向量(包括RAND(RANDom，随机数)，AUTN(AUthentication TokeN，授权令牌)，K NSSAIenc等信息)。AUSF将该认证向量发送给缺省AMF。该缺省AMF保存认证向量，并将密钥材料RAND，AUTN等信息发送给UE。UE进行验证，并根据保存的根密钥K和密钥材料计算产生K NSSAIenc。
相应的，认证成功后，确定对应的服务AMF可以包括：根据根密钥和密钥材料计算产生用于NSSAI加密的密钥；将密钥发送给缺省AMF；根据密钥，对加密后的NSSAI进行解密；根据解密后的NSSAI，确定对应的服务AMF。在认证成功后，服务AMF根据加密该NSSAI的认证向量K NSSAIenc来相应的对NSSAI进行解密，从而得到明文NSSAI，然后根据该明文NSSAI的内容，确定对应的服务AMF，来实现UE的切片网络的接入。
在一些实施例中，NSSAI为通过NAS安全通道传送还可以包括：认证成功后，在UE和缺省AMF之间建立NAS安全通道；通过NAS安全通道发送NSSAI给缺省AMF。此时，不需要对NSSAI本身进行加密，而通过安全的NAS安全通道来发送NSSAI，从而保证NSSAI的安全性，避免NSSAI被外界所窃取。
在一些实施例中，认证成功后，确定对应的服务AMF可以包括：根据NSSAI，确定对应的服务AMF；确定对应的服务AMF之后，拆除UE和缺省AMF之间的NAS安全通道。在确定了服务AMF之后，在UE和缺省AMF之间的NAS安全通道就没有必要继续保留了，可以直接拆除以节约网络资源。
本实施例提供了一种网络接入方法，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设 备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。
第二实施例
请参考图5，图5为本公开第二实施例提供的一种网络接入方法流程图，包括：
S501、接收UE发送的网络初始注册请求；
S502、通过网络初始注册请求与UE进行接入认证；
S503、认证成功后，根据接收到的由UE发送的NSSAI确定对应的服务AMF；
S504、通过服务AMF完成UE的网络接入。
为了避免因NSSAI暴露而引发的网络攻击，需要在用户接入网络过程中，保证NSSAI传递的安全性，因此本实施例提出了一种用户接入网络的网络接入方法，通过对NSSAI的加密传递，达到保护NSSAI的目的。
本实施例中所述的缺省AMF，所指的是系统默认状态下的AMF；由于本实施例中的网络接入过程中，UE没有直接在请求时提供明文的NSSAI信息，因此无法直接确认UE所要接入的服务AMF来完成网络的接入过程，所以UE的交互对象首先是缺省AMF，通过缺省AMF来为用户进行接入服务。
在UE与缺省AMF交互的过程中，缺省AMF的交互需要涉及到与UE之间的认证过程，认证过程中并不涉及到UE对服务AMF的选择，而是为了后续UE与缺省AMF之间交互NSSAI信息。本实施例为了提升NSSAI信息在传输过程中的安全性，示例性而言，缺省AMF可以通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种方式接收NSSAI。也就是说，NSSAI在UE和缺省AMF之间进行传输的手段，可以包括对NSSAI本身进行加密，或者是在安全的NAS安全通道内传输两种手段。而对NSSAI进行加密，则可以通过非对称加密、对称加密等手段来实现。上述各加密手段之间可以单独实施，也可以组合进行，比如可通过非对称加密手段对NSSAI进行加密，然后再通过NAS安全通道进行传输；或者是通过对称加密手段对NSSAI进行加密，然后在通过NAS安全通道进行传输等等。
在一些实施例中，NSSAI为通过非对称加密方式传送可以包括：确定在UE和网络侧配置的运营商公钥和私钥；通过公钥对NSSAI进行加密；接收加密后的NSSAI。其中，通过非对称加密方式传送，首先需要在UE侧以及网络侧配置匹配的运营商公钥和私钥；然后，UE在发送NSSAI至网络侧时，则通过配置的运营商公钥，对NSSAI进行加密，然后发送加密的NSSAI至网络侧。而发送的过程可以通过网络初始注册请求，来携带加密的NSSAI并发送至网络侧。
相应的，认证成功后，根据接收到的由UE发送的NSSAI确定对应的服务AMF可以包括：认证成功后，对NSSAI通过私钥进行解密；根据解密后的NSSAI，确定对应的服 务AMF。由于NSSAI通过运营商公钥进行了加密，为了保证其安全性，需要在UE和缺省AMF之间的认证通过后，方才通过运营商私钥对该加密的NSSAI进行解密，从而可得到明文NSSAI。得到明文NSSAI之后，缺省AMF就可以根据该NSSAI的内容，来确定用户接入切片网络所需的服务AMF。
在一些实施例中，NSSAI为通过对称加密方式传送可以包括：认证成功后，根据根密钥和密钥材料和密钥材料计算产生用于NSSAI加密的密钥，通过密钥对NSSAI进行加密；接收加密后的NSSAI。对称加密的过程可以在UE与缺省AMF认证成功之后进行；在认证成功后，根密钥K产生认证向量(包括RAND(RANDom，随机数)，AUTN(AUthentication TokeN，授权令牌)，K NSSAIenc等信息)。AUSF将该认证向量发送给缺省AMF。该缺省AMF保存认证向量，并将密钥材料RAND，AUTN等信息发送给UE。UE进行验证，并根据保存的根密钥K和密钥材料计算产生K NSSAIenc。
相应的，认证成功后，确定对应的服务AMF可以包括：根据根密钥和密钥材料计算产生用于NSSAI加密的密钥；接收密钥；根据该密钥，对加密后的NSSAI进行解密；根据解密后的NSSAI，确定对应的服务AMF。在认证成功后，服务AMF根据加密该NSSAI的认证向量K NSSAIenc来相应的对NSSAI进行解密，从而得到明文NSSAI，然后根据该明文NSSAI的内容，确定对应的服务AMF，来实现UE的切片网络的接入。
在一些实施例中，NSSAI为通过NAS安全通道传送可以包括：认证成功后，在UE和NSSAI之间建立NAS安全通道；通过NAS安全通道接收NSSAI。此时，不需要对NSSAI本身进行加密，而通过安全的NAS安全通道来发送NSSAI，从而保证NSSAI的安全性，避免NSSAI被外界所窃取。
本实施例提供了一种网络接入方法，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。
第三实施例
请参考图6，图6为本实施例提供的一种网络接入方法信号流图，包括：
本实施例描述了一种用户接入网络过程中的优化注册流程，实现NSSAI的加密传递，保证NSSAI传递过程中的安全性。本实施例中用户接入网络初始选择的AMF为缺省AMF，即根据UE提供的信息无法进行AMF选择时配置的AMF。具体实施过程如下描述：
S601、在UE配置运营商公钥，用于UE向网络发送消息时，对需要保护的信息进行加密；网络侧SIDF(Subscription Identifier De-concealing Function，签约标识解密功能) 保存相应的运营商私钥，用于对从UE接收的信息的解密。
S602、UE接入网络发起注册请求，将请求接入的网络切片标识NSSAI使用该公钥进行加密。
S603、UE发起网络初始注册请求，请求消息中包含加密NSSAI。由于NSSAI加密，根据AMF选择方法，无法为用户选择到NSSAI对应的AMF。因此选择缺省AMF为用户接入服务。
S604、UE和缺省AMF之间完成双向认证。
S605、认证过程中，加密NSSAI被传递至SIDF。认证成功之后，SIDF对加密NSSAI解密成明文，并将该明文NSSAI发送给缺省AMF。
S606、该缺省AMF根据该明文NSSAI向NSSF发送切片选择请求。NSSF对请求NSSAI(即该明文NSSAI)进行授权，向该缺省AMF返回该授权NSSAI，以及target AMF(目的AMF)集。
S607、该缺省AMF向NRF发起Target AMF(即服务AMF)查询，获取服务AMF的IP地址/FQDN(Fully Qualified Domain Name，全限定域名)信息。
S608、该缺省AMF向该Target AMF转发用户注册请求，并包含该RAN信息，以及认证成功之后缺省AMF上产生的移动性管理上下文等信息。
S609、该Target AMF向RAN发送N2会话消息。
S610、如果该Target AMF需要对UE进行再次认证，则发起接入认证过程。
S611、剩余接入注册过程，参考图3中的步骤S304-306以及S309-316。
上述实现过程，保证了NSSAI在UE和网络之间以加密方式传递，避免中间人窃取NSSAI之后通过解析推断出切片作用，接入人群属性，进而发起网络攻击，保证了用户和网络安全。
第四实施例
请参考图7，图7为本公开第四实施例提供的一种网络接入方法信号流图，包括：
本实施例描述了一种用户接入网络时的优化注册流程，通过UE和缺省AMF之间认证成功之后派生用于NSSAI加密密钥。通过该密钥加密NSSAI实现安全传递。具体实施过程如下描述：
S701、UE接入网络，发起注册请求。初始注册请求消息不包含NSSAI，因此无法选择合适的AMF，使用缺省AMF为UE接入服务。
S702、缺省AMF接收该注册请求，如果没有获取到用户标识SUPI，则发起标识获取流程，从UE获取SUCI(经过加密的SUPI)。
S703、UE和缺省AMF之间完成接入认证。AUSF根据UE签约信息中的根密钥K产生认证向量(包括RAND(RANDom，随机数)，AUTN(AUthentication TokeN，授权令牌)，K NSSAIenc等信息)。AUSF将该认证向量发送给缺省AMF。该缺省AMF保存认 证向量，并将密钥材料RAND，AUTN等信息发送给UE。UE进行验证，并根据保存的根密钥K和密钥材料计算产生K NSSAIenc。
S704、UE使用对K NSSAIenc对NSSAI进行加密。
S705、UE将加密NSSAI发送给缺省AMF。
S706、缺省AMF接收该加密NSSAI之后使用K NSSAIenc解密，得到明文NSSAI。
S707、该缺省AMF根据该明文NSSAI向NSSF发送切片选择请求。NSSF对请求NSSAI(即该明文NSSAI)进行授权，向该缺省AMF返回该授权NSSAI，以及target AMF集。
S708、该缺省AMF向RAN发送N2会话消息，将target AMF集携带给RAN
S709、该RAN向NRF发起Target AMF(即服务AMF)查询，获取服务AMF的IP地址/FQDN信息。
S710、该RAN向该Target AMF转发用户注册请求。
S711、如果该Target AMF需要对UE进行再次认证，则发起接入认证过程。
S712、剩余接入注册过程，参考图3中的步骤S304-306以及S309-316。
上述实现过程，首先通过UE和缺省AMF之间执行接入认证，并根据UE根密钥K产生共享密钥K NSSAIenc后对NSSAI进行加密传送，保证NSSAI传输过程中的安全性。
第五实施例
请参考图8，图8为本公开第五实施例提供的一种网络接入方法信号流图，包括：
本实施例描述了一种用户接入网络时的优化注册流程，通过UE和缺省AMF之间建立NAS安全通道传递NSSAI，并在选择到服务AMF之后，拆除该NAS通道的方式实现NSSAI安全传递。具体实施过程如下描述：
S801、UE接入网络，发起注册请求。初始注册请求消息不包含NSSAI，因此无法选择合适的AMF，使用缺省AMF为UE接入服务。
S802、缺省AMF接收该注册请求，如果没有获取到用户标识SUPI，则发起标识获取流程，从UE获取SUCI(经过加密的SUPI)。
S803、UE和缺省AMF之间完成接入认证。
S804、UE和缺省AMF之间建立NAS安全通道。
S805、UE使用该NAS安全通道将NSSAI发送给该缺省AMF。该NAS安全通道是对UE和缺省AMF之间发送的整条消息进行加密和完整性保护。
S806、缺省AMF获取该NSSAI，根据该NSSAI向NSSF发送切片选择请求。NSSF对请求NSSAI进行授权，向该缺省AMF返回该授权NSSAI，以及target AMF集。
S807、该缺省AMF向NRF发起Target AMF(即服务AMF)查询，获取服务AMF的IP地址/FQDN信息。
S808、该缺省AMF向该Target AMF转发用户注册请求，并包含该RAN信息，以及 认证成功之后缺省AMF上产生的移动性管理上下文等信息。
S809、该Target AMF向RAN发送N2会话消息。
S810、缺省AMF拆除NAS安全通道。
S811、如果该Target AMF需要对UE进行再次认证，则发起接入认证过程。
S812、Target AMF和UE建立NAS安全通道。
S813、剩余接入注册过程，参考图3中的步骤S304-306以及S310-316。
上述实现过程，首先通过UE和缺省AMF之间完成接入认证之后，建立临时NAS安全通道用于NSSAI的安全传递。在缺省AMF根据该NSSAI发现服务AMF之后，拆除UE和缺省AMF之间的NAS安全通道，以此保证NSSAI传输过程中的安全性。
第六实施例
请参考图9，图9为本公开第六实施例提供的一种网络接入装置组成示意图，包括：
请求发起模块91，设置为向AMF发起网络初始注册请求；
第一认证模块92，设置为通过网络初始注册请求与缺省AMF进行接入认证；
第一AMF确认模块93，设置为认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
第一网络接入模块94，设置为基于服务AMF完成用户设备UE的网络接入。
为了避免因NSSAI暴露而引发的网络攻击，需要在用户接入网络过程中，保证NSSAI传递的安全性，因此本实施例提出了一种用户接入网络的网络接入方法，通过对NSSAI的加密传递，达到保护NSSAI的目的。
本实施例中所述的缺省AMF，所指的是系统默认状态下的AMF；由于本实施例中的网络接入过程中，UE没有直接在请求时提供明文的NSSAI信息，因此无法直接确认UE所要接入的服务AMF来完成网络的接入过程，所以UE的交互对象首先是缺省AMF，通过缺省AMF来为用户进行接入服务。
在UE与缺省AMF交互的过程中，缺省AMF的交互需要涉及到与UE之间的认证过程，认证过程中并不涉及到UE对服务AMF的选择，而是为了后续UE与缺省AMF之间交互NSSAI信息。本实施例为了提升NSSAI信息在传输过程中的安全性，示例性而言，NSSAI可以为通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种发送给缺省AMF。也就是说，NSSAI在UE和缺省AMF之间进行传输的手段，可以包括对NSSAI本身进行加密，或者是在安全的NAS安全通道内传输两种手段。而对NSSAI进行加密，则可以通过非对称加密、对称加密等手段来实现。上述各加密手段之间可以单独实施，也可以组合进行，比如可通过非对称加密手段对NSSAI进行加密，然后再通过NAS安全通道进行传输；或者是通过对称加密手段对NSSAI进行加密，然后在通过NAS安全通道进行传输等等。
在一些实施例中，NSSAI为通过非对称加密方式传送可以包括：确定在UE和网络侧 配置的运营商公钥和私钥；通过公钥对NSSAI进行加密；将加密后的NSSAI通过网络初始注册请求发送给缺省AMF。其中，通过非对称加密方式传送，首先需要在UE侧以及网络侧配置匹配的运营商公钥和私钥；然后，UE在发送NSSAI至网络侧时，则通过配置的运营商公钥，对NSSAI进行加密，然后发送加密的NSSAI至网络侧。而发送的过程可以通过网络初始注册请求，来携带加密的NSSAI并发送至网络侧。
相应的，认证成功后，确定对应的服务AMF可以包括：认证成功后，对NSSAI通过私钥进行解密；根据解密后的NSSAI，确定对应的服务AMF。由于NSSAI通过运营商公钥进行了加密，为了保证其安全性，需要在UE和缺省AMF之间的认证通过后，方才通过运营商私钥对该加密的NSSAI进行解密，从而可得到明文NSSAI。得到明文NSSAI之后，缺省AMF就可以根据该NSSAI的内容，来确定用户接入切片网络所需的服务AMF。
在一些实施例中，NSSAI为通过对称加密方式传送包括：认证成功后，根据根密钥和密钥材料产生密钥，通过密钥对NSSAI进行加密；将加密后的NSSAI发送给缺省AMF。对称加密的过程可以在UE与缺省AMF认证成功之后进行；在认证成功后，根据根密钥K产生认证向量K NSSAIenc，缺省AMF将认证参数发送给UE，UE根据根密钥K以及认证参数产生K NSSAIenc。UE使用K NSSAIenc加密NSSAI并发送给缺省AMF。
相应的，认证成功后，确定对应的服务AMF可以包括：将密钥发送给缺省AMF；根据密钥，对加密后的NSSAI进行解密；根据解密后的NSSAI，确定对应的服务AMF。在认证成功后，服务AMF根据加密该NSSAI的认证向量K NSSAIenc来相应的对NSSAI进行解密，从而得到明文NSSAI，然后根据该明文NSSAI的内容，确定对应的服务AMF，来实现UE的切片网络的接入。
在一些实施例中，NSSAI为通过NAS安全通道传送还可以包括：认证成功后，在UE和NSSAI之间建立NAS安全通道；通过NAS安全通道发送NSSAI给缺省AMF。此时，不需要对NSSAI本身进行加密，而通过安全的NAS安全通道来发送NSSAI，从而保证NSSAI的安全性，避免NSSAI被外界所窃取。
本实施例提供了一种网络接入装置，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。
第七实施例
请参考图10，图10为本公开第七实施例提供的一种网络接入装置组成示意图，包括：
请求接收模块101，设置为接收UE发送的网络初始注册请求；
第二认证模块102，设置为通过网络初始注册请求与缺省AMF进行接入认证；
第二AMF确认模块103，设置为认证成功后，根据接收到的由UE发送的NSSAI确定对应的服务AMF；
第二网络接入模块104，设置为通过服务AMF完成UE的网络接入。
为了避免因NSSAI暴露而引发的网络攻击，需要在用户接入网络过程中，保证NSSAI传递的安全性，因此本实施例提出了一种用户接入网络的网络接入方法，通过对NSSAI的加密传递，达到保护NSSAI的目的。
本实施例中所述的缺省AMF，所指的是系统默认状态下的AMF；由于本实施例中的网络接入过程中，UE没有直接在请求时提供明文的NSSAI信息，因此无法直接确认UE所要接入的服务AMF来完成网络的接入过程，所以UE的交互对象首先是缺省AMF，通过缺省AMF来为用户进行接入服务。
在UE与缺省AMF交互的过程中，缺省AMF的交互需要涉及到与UE之间的认证过程，认证过程中并不涉及到UE对服务AMF的选择，而是为了后续UE与缺省AMF之间交互NSSAI信息。本实施例为了提升NSSAI信息在传输过程中的安全性，示例性而言，缺省AMF可以通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种方式接收NSSAI。也就是说，NSSAI在UE和缺省AMF之间进行传输的手段，可以包括对NSSAI本身进行加密，或者是在安全的NAS安全通道内传输两种手段。而对NSSAI进行加密，则可以通过非对称加密、对称加密等手段来实现。上述各加密手段之间可以单独实施，也可以组合进行，比如可通过非对称加密手段对NSSAI进行加密，然后再通过NAS安全通道进行传输；或者是通过对称加密手段对NSSAI进行加密，然后在通过NAS安全通道进行传输等等。
在一些实施例中，NSSAI为通过非对称加密方式传送可以包括：确定在UE和网络侧配置的运营商公钥和私钥；通过公钥对NSSAI进行加密；接收加密后的NSSAI。其中，通过非对称加密方式传送，首先需要在UE侧以及网络侧配置匹配的运营商公钥和私钥；然后，UE在发送NSSAI至网络侧时，则通过配置的运营商公钥，对NSSAI进行加密，然后发送加密的NSSAI至网络侧。而发送的过程可以通过网络初始注册请求，来携带加密的NSSAI并发送至网络侧。
相应的，认证成功后，根据接收到的由UE发送的NSSAI确定对应的服务AMF可以包括：认证成功后，对NSSAI通过私钥进行解密；根据解密后的NSSAI，确定对应的服务AMF。由于NSSAI通过运营商公钥进行了加密，为了保证其安全性，需要在UE和缺省AMF之间的认证通过后，方才通过运营商私钥对该加密的NSSAI进行解密，从而可得到明文NSSAI。得到明文NSSAI之后，缺省AMF就可以根据该NSSAI的内容，来确定用户接入切片网络所需的服务AMF。
在一些实施例中，NSSAI为通过对称加密方式传送可以包括：认证成功后，根据根密钥和密钥材料产生密钥，通过密钥对NSSAI进行加密；接收加密后的NSSAI。对称加密的过程可以在UE与缺省AMF认证成功之后进行；在认证成功后，根据根密钥和密钥 材料K产生认证向量K NSSAIenc，缺省AMF将认证参数发送给UE，UE根据根密钥和密钥材料K以及认证参数产生K NSSAIenc。UE使用K NSSAIenc加密NSSAI并发送给缺省AMF。
相应的，认证成功后，确定对应的服务AMF可以包括：接收密钥；根据密钥，对加密后的NSSAI进行解密；根据解密后的NSSAI，确定对应的服务AMF。在认证成功后，服务AMF根据加密该NSSAI的认证向量K NSSAIenc来相应的对NSSAI进行解密，从而得到明文NSSAI，然后根据该明文NSSAI的内容，确定对应的服务AMF，来实现UE的切片网络的接入。
在一些实施例中，NSSAI为通过NAS安全通道传送可以包括：认证成功后，在UE和NSSAI之间建立NAS安全通道；通过NAS安全通道接收NSSAI。此时，不需要对NSSAI本身进行加密，而通过安全的NAS安全通道来发送NSSAI，从而保证NSSAI的安全性，避免NSSAI被外界所窃取。
本实施例提供了一种网络接入装置，通过向缺省AMF发起网络初始注册请求，然后通过网络初始注册请求与缺省AMF进行接入认证；认证成功后，确定对应的服务AMF；服务AMF为根据发送给缺省AMF的NSSAI所确定的AMF；基于服务AMF完成用户设备UE的网络接入。从而通过与缺省AMF之间的认证交互之后，再进行NSSAI信息的处理过程确定服务AMF，避免了直接发送NSSAI可能造成的消息泄露，提升了网络接入的安全性。
第八实施例
请参考图11，图11为本公开第八实施例提供的一种终端组成示意图，包括第一处理器111、第一存储器112和第一通信总线113；
第一通信总线113设置为实现第一处理器111和第一存储器112之间的连接通信；
第一处理器111设置为执行第一存储器112中存储的计算机程序，以实现本公开上述各实施例中的网络接入方法的流程，这里不再赘述。
第九实施例
请参考图12，图12为本实施例提供的一种基站组成示意图，包括第二处理器121、第二存储器122和第二通信总线123；
第二通信总线123设置为实现第二处理器121和第二存储器122之间的连接通信；
第二处理器121设置为执行第二存储器122中存储的计算机程序，以实现本公开上述各实施例中的网络接入方法的流程，这里不再赘述。
第十实施例
本实施例提供了一种计算机可读存储介质，该计算机可读存储介质中存储有一个或者多个计算机程序，计算机程序可被一个或者多个处理器执行，以实现前述各实施例中的网 络接入方法，这里不再赘述。
显然，本领域的技术人员应该明白，上述本公开的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储介质(ROM/RAM、磁碟、光盘)中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。所以，本公开不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本公开所作的进一步详细说明，不能认定本公开的具体实施只局限于这些说明。对于本公开所属技术领域的普通技术人员来说，在不脱离本公开构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本公开的保护范围。

Claims (20)

  1. 一种网络接入方法，包括：
    向缺省接入和移动性管理功能AMF发起网络初始注册请求；
    通过所述网络初始注册请求与所述缺省AMF进行接入认证；
    认证成功后，确定对应的服务AMF；所述服务AMF为根据发送给所述缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
    基于所述服务AMF完成用户设备UE的网络接入。
  2. 如权利要求1所述的网络接入方法，其中，所述NSSAI为通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种发送给所述缺省AMF。
  3. 如权利要求2所述的网络接入方法，其中，所述NSSAI为通过非对称加密方式传送包括：
    确定在UE和网络侧配置的运营商公钥和私钥；
    通过所述公钥对所述NSSAI进行加密；
    将加密后的NSSAI通过所述网络初始注册请求发送给缺省AMF。
  4. 如权利要求3所述的网络接入方法，其中，所述认证成功后，确定对应的服务AMF包括：
    认证成功后，对所述NSSAI通过所述私钥进行解密；
    根据解密后的所述NSSAI，确定对应的所述服务AMF。
  5. 如权利要求2所述的网络接入方法，其中，所述NSSAI为通过对称加密方式传送包括：
    认证成功后，根据根密钥和密钥材料计算产生用于NSSAI加密的密钥，通过所述密钥对NSSAI进行加密；
    将加密后的所述NSSAI发送给缺省AMF。
  6. 如权利要求5所述的网络接入方法，其中，所述认证成功后，确定对应的服务AMF包括：
    所述缺省AMF根据根密钥和密钥材料计算产生用于NSSAI加密的密钥；
    根据所述密钥，对加密后的所述NSSAI进行解密；
    根据解密后的所述NSSAI，确定对应的所述服务AMF。
  7. 如权利要求2所述的网络接入方法，其中，所述NSSAI为通过NAS安全通道传送包括：
    认证成功后，在UE和所述缺省AMF之间建立NAS安全通道；
    通过所述NAS安全通道发送所述NSSAI给所述缺省AMF。
  8. 如权利要求7所述的网络接入方法，其中，所述认证成功后，确定对应的服务AMF包括：
    根据所述NSSAI，确定对应的所述服务AMF；
    确定对应的所述服务AMF之后，拆除UE和所述缺省AMF之间的NAS安全通道。
  9. 一种网络接入方法，包括：
    接收UE发送的网络初始注册请求；
    通过所述网络初始注册请求与所述UE进行接入认证；
    认证成功后，根据接收到的由所述UE发送的NSSAI确定对应的服务AMF；
    通过所述服务AMF完成UE的网络接入。
  10. 如权利要求9所述的网络接入方法，其中，所述NSSAI为通过非对称加密方式传送、对称加密方式传送以及NAS安全通道传送中的至少一种接收。
  11. 如权利要求10所述的网络接入方法，其中，所述NSSAI为通过非对称加密方式传送包括：
    确定在UE和网络侧配置的运营商公钥和私钥；
    通过所述公钥对所述NSSAI进行加密；
    接收加密后的所述NSSAI。
  12. 如权利要求11所述的网络接入方法，其中，所述认证成功后，根据接收到的由所述UE发送的NSSAI确定对应的服务AMF包括：
    认证成功后，对所述NSSAI通过所述私钥进行解密；
    根据解密后的所述NSSAI，确定对应的所述服务AMF。
  13. 如权利要求10所述的网络接入方法，其中，所述NSSAI为通过对称加密方式传送包括：
    认证成功后，根据根密钥和密钥材料计算产生用于NSSAI加密的密钥，通过所述密钥对NSSAI进行加密；
    接收加密后的所述NSSAI。
  14. 如权利要求13所述的网络接入方法，其中，所述认证成功后，确定对应的服务AMF包括：
    根据根密钥和密钥材料计算产生用于NSSAI加密的密钥；
    根据所述密钥，对加密后的所述NSSAI进行解密；
    根据解密后的所述NSSAI，确定对应的所述服务AMF。
  15. 如权利要求10所述的网络接入方法，其中，所述NSSAI为通过NAS安全通道传送包括：
    认证成功后，在UE和所述缺省AMF之间建立NAS安全通道；
    通过所述NAS安全通道接收所述NSSAI。
  16. 一种网络接入装置，包括：
    请求发起模块，设置为向AMF发起网络初始注册请求；
    第一认证模块，设置为通过所述网络初始注册请求与所述缺省AMF进行接入认证；
    第一AMF确认模块，设置为认证成功后，确定对应的服务AMF；所述服务AMF为根据发送给所述缺省AMF的网络切片选择辅助信息NSSAI所确定的AMF；
    第一网络接入模块，设置为基于所述服务AMF完成用户设备UE的网络接入。
  17. 一种网络接入装置，其中，包括：
    请求接收模块，设置为接收UE发送的网络初始注册请求；
    第二认证模块，设置为通过所述网络初始注册请求与所述缺省AMF进行接入认证；
    第二AMF确认模块，设置为认证成功后，根据接收到的由所述UE发送的NSSAI确定对应的服务AMF；
    第二网络接入模块，设置为通过所述服务AMF完成UE的网络接入。
  18. 一种终端，其中，包括第一处理器、第一存储器和第一通信总线；
    所述第一通信总线设置为实现所述第一处理器和第一存储器之间的连接通信；
    所述第一处理器设置为执行所述第一存储器中存储的计算机程序，以实现如权利要求1-7任一项所述网络接入方法的步骤。
  19. 一种基站，其中，包括第二处理器、第二存储器和第二通信总线；
    所述第二通信总线设置为实现所述第二处理器和第二存储器之间的连接通信；
    所述第二处理器设置为执行所述第二存储器中存储的计算机程序，以实现如权利要求8-14任一项所述网络接入方法的步骤。
  20. 一种计算机可读存储介质，其中，所述计算机可读存储介质中存储有一个或者多个计算机程序，所述计算机程序可被一个或者多个处理器执行，以实现如权利要求1-8任一项所述网络接入方法的步骤，或如权利要求9-15任一项所述的网络接入方法的步骤。
PCT/CN2019/096023 2018-07-25 2019-07-15 网络接入方法、装置、终端、基站和可读存储介质 WO2020020007A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810824956.1A CN110769420B (zh) 2018-07-25 2018-07-25 网络接入方法、装置、终端、基站和可读存储介质
CN201810824956.1 2018-07-25

Publications (1)

Publication Number Publication Date
WO2020020007A1 true WO2020020007A1 (zh) 2020-01-30

Family

ID=69181303

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/096023 WO2020020007A1 (zh) 2018-07-25 2019-07-15 网络接入方法、装置、终端、基站和可读存储介质

Country Status (2)

Country Link
CN (1) CN110769420B (zh)
WO (1) WO2020020007A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111918292A (zh) * 2020-09-02 2020-11-10 中国联合网络通信集团有限公司 一种接入方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20220133963A (ko) * 2020-02-26 2022-10-05 지티이 코포레이션 접근성 및 이동성 관리 기능 재할당을 이용한 등록
CN114079924A (zh) * 2020-08-10 2022-02-22 中国移动通信有限公司研究院 消息的处理方法、装置、相关设备及存储介质
CN113449286B (zh) * 2021-07-08 2024-03-26 深圳职业技术学院 安全校验ue发送的s-nssai的方法及系统、设备
CN115915386A (zh) * 2021-09-30 2023-04-04 中兴通讯股份有限公司 一种注册方法、终端设备、核心网设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106982458A (zh) * 2017-03-09 2017-07-25 华为技术有限公司 一种网络切片的选择方法及装置
US20170303259A1 (en) * 2016-04-18 2017-10-19 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
CN107580324A (zh) * 2017-09-22 2018-01-12 中国电子科技集团公司第三十研究所 一种用于移动通信系统imsi隐私保护的方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108112012A (zh) * 2016-11-24 2018-06-01 中国移动通信有限公司研究院 一种群组终端的网络认证方法及装置
US10531420B2 (en) * 2017-01-05 2020-01-07 Huawei Technologies Co., Ltd. Systems and methods for application-friendly protocol data unit (PDU) session management
CN107770815B (zh) * 2017-10-18 2020-09-11 中国联合网络通信集团有限公司 一种基于位置的mec方法及设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170303259A1 (en) * 2016-04-18 2017-10-19 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
CN106982458A (zh) * 2017-03-09 2017-07-25 华为技术有限公司 一种网络切片的选择方法及装置
CN107580324A (zh) * 2017-09-22 2018-01-12 中国电子科技集团公司第三十研究所 一种用于移动通信系统imsi隐私保护的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"TS23.502: Clarifications on Registration, PDU Session Establishment Procedures and Network Slicing", 3GPP TSG SA WG2 MEETING #119 S2-1701038, 17 February 2017 (2017-02-17) *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111918292A (zh) * 2020-09-02 2020-11-10 中国联合网络通信集团有限公司 一种接入方法及装置

Also Published As

Publication number Publication date
CN110769420B (zh) 2022-05-13
CN110769420A (zh) 2020-02-07

Similar Documents

Publication Publication Date Title
US11588626B2 (en) Key distribution method and system, and apparatus
WO2020133655A1 (zh) 边缘计算场景下支持异构终端匿名接入的轻量级认证方法
WO2020020007A1 (zh) 网络接入方法、装置、终端、基站和可读存储介质
US7702901B2 (en) Secure communications between internet and remote client
KR100886592B1 (ko) 데이터 프로세싱 시스템의 보안 방법 및 장치
US20220353247A1 (en) Secure publish-subscribe communication methods and apparatus
US11736304B2 (en) Secure authentication of remote equipment
EP2767029B1 (en) Secure communication
CN110493367B (zh) 无地址的IPv6非公开服务器、客户机与通信方法
CN110493272B (zh) 使用多重密钥的通信方法和通信系统
CN112769568B (zh) 雾计算环境中的安全认证通信系统、方法、物联网设备
WO2021244569A1 (zh) 数据传输方法、系统、电子设备、存储介质
US20230232219A1 (en) Data transmission method and system, electronic device and computer-readable storage medium
WO2023174143A1 (zh) 数据传输方法、设备、介质及产品
Yang et al. A trust and privacy preserving handover authentication protocol for wireless networks
Køien et al. Location privacy for cellular systems; analysis and solution
Mustafa et al. An enhancement of authentication protocol and key agreement (AKA) for 3G mobile networks
Wan et al. DoS-resistant access control protocol with identity confidentiality for wireless networks
Faisal et al. Graphene: a secure cloud communication architecture
US11838428B2 (en) Certificate-based local UE authentication
US20240097903A1 (en) Ipcon mcdata session establishment method
GB2551358A (en) Low latency security
Wan et al. Access control protocols with two-layer architecture for wireless networks
Prakash et al. EPMOS based secure mobile communication in LTE/SAE networks
Karabulut-Kurt et al. Privacy-Preserving Authentication Scheme for Connected Autonomous Vehicles

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19842145

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 09.06.2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19842145

Country of ref document: EP

Kind code of ref document: A1