WO2020029730A1 - 一种身份信息的处理方法、设备及系统 - Google Patents

一种身份信息的处理方法、设备及系统 Download PDF

Info

Publication number
WO2020029730A1
WO2020029730A1 PCT/CN2019/094830 CN2019094830W WO2020029730A1 WO 2020029730 A1 WO2020029730 A1 WO 2020029730A1 CN 2019094830 W CN2019094830 W CN 2019094830W WO 2020029730 A1 WO2020029730 A1 WO 2020029730A1
Authority
WO
WIPO (PCT)
Prior art keywords
identity information
network element
terminal
network
information
Prior art date
Application number
PCT/CN2019/094830
Other languages
English (en)
French (fr)
Inventor
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19847301.9A priority Critical patent/EP3790299B1/en
Publication of WO2020029730A1 publication Critical patent/WO2020029730A1/zh
Priority to US17/115,179 priority patent/US11510052B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
    • H04L12/1403—Architecture for metering, charging or billing
    • H04L12/1407—Policy-and-charging control [PCC] architecture
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0866—Checking the configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method, a device, and a system for processing identity information.
  • 5G network the fifth generation mobile communication network
  • 5G network in order to meet the business needs of different customers (such as service providers or tenants) , Proposed the concept of Network Slice (NS).
  • NS Network Slice
  • NS is a network for supporting logical isolation of specific network capabilities and network characteristics, and can provide end-to-end (E2E) network services.
  • the terminal may send a request message carrying the terminal's identity information (such as: Subscription Permanent Identifier (SUPI)) to the network slice, requesting the network function (Network Function, NF) in the network slice to establish a bearer for the terminal.
  • SUPI Subscription Permanent Identifier
  • NF Network Function
  • a protocol data unit (PDU) session on a network slice enables a terminal to access a data network (DN) through the PDU session.
  • DN data network
  • the domain to which different network slices belong is different.
  • the network slice belongs to a domain other than the operator (such as a vertical industry security domain)
  • the terminal's identity information is sent to the network slice, which easily leads to the identity of the terminal being leaked to Risks in vertical industry security domains.
  • the present application provides a method, a device, and a system for processing identity information, so as to solve a problem that a terminal's identity information is leaked.
  • the present application provides a method for processing identity information.
  • the method includes: a first network element obtaining a first parameter for determining a domain to which a network slice belongs, and determining whether the network slice is managed by an operator according to the first parameter. Based on this method, it can be judged whether the network slice is managed by the operator, so that when the identity information of the terminal is subsequently sent to the network slice, it is determined whether to hide the identity information of the terminal according to the judgment result to protect the identity information of the terminal from being leaked.
  • the identity information indicated is safe, and the identity information of the terminal need not be hidden; on the contrary, when the network slice is not managed by the operator, it means that the terminal's network slice is located in the vertical industry security domain. It is easy to leak, and the identity information of the terminal needs to be hidden.
  • the above network slice may refer to a network slice that supports terminal access.
  • the first network element selects any network element among the network element, the network storage network element, and the access and mobility management network element for the slice. In this way, you can judge whether the network slice is managed by the operator through different network elements, which improves the flexibility of judgment.
  • the method further includes : The first network element sends indication information to the access and mobility management network element, the indication information is used to indicate whether the network slice is managed by the operator; or, it is used to indicate whether the first identity information of the terminal is hidden; or, Indicates whether the domain to which the network slice belongs belongs to the same security domain as the carrier security domain. In this way, the access and mobility management network element can determine whether the network slice is managed by the operator through the instruction information sent by other network elements.
  • the first parameter includes: NSSAI corresponding to the network slice, TAI of the terminal, and service type of the terminal. At least one parameter.
  • the first network element may receive the first parameter sent by the access and mobility management network element, and the first parameter may be included in the slice selection request.
  • the first network element When the first network element is a network storage network element, the first network element may receive a first parameter sent by the access and mobility management network element, and the first parameter may be included in the NF discovery request.
  • the first network element may receive a first parameter sent by the terminal, where the first parameter may be included in a session establishment request, a session update request, or a registration request.
  • the present application provides a communication device.
  • the communication device may be a first network element in a communication network.
  • the first network element may be a slice selection network element or a chip or a system-on-chip in the slice selection network element. It is a network storage network element or a chip or a system on a chip in the network storage network element; it may also be an access and mobility management network element or a chip or a system on a chip in the access and mobility management network element.
  • the communication device may implement the functions performed by the communication device in the above aspects or possible designs, and the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the foregoing functions.
  • the communication device may include: an obtaining unit and a judging unit;
  • An obtaining unit configured to obtain a first parameter used to determine a domain to which a network slice belongs
  • the judging unit is configured to judge whether the network slice is managed by an operator according to the first parameter.
  • the communication device For a specific implementation manner of the communication device, reference may be made to the behavior function of the communication device in the method for processing identity information provided by the first aspect or any possible design of the first aspect, which is not repeatedly described here. Therefore, the provided communication device can achieve the same beneficial effects as the first aspect or any possible design of the first aspect.
  • a communication device including: a processor and a memory; the memory is configured to store a computer execution instruction, and when the communication device is running, the processor executes the computer execution instruction stored in the memory, so that the memory
  • the communication device executes the method for processing identity information according to the first aspect or any possible design of the first aspect.
  • a computer-readable storage medium stores instructions, and when the computer-readable storage medium runs on the computer, the computer can execute the foregoing first aspect or any one of the foregoing aspects. Design the processing method of the identity information.
  • a computer program product containing instructions, which, when run on a computer, enables the computer to execute the method for processing identity information according to the first aspect or any one of the foregoing aspects.
  • a chip system includes a processor and a communication interface, and is configured to support a communication device to implement the functions involved in the foregoing aspect.
  • the processor obtains a first used to determine a domain to which a network slice belongs. Parameter, to determine whether the network slice is managed by the operator according to the first parameter.
  • the chip system further includes a memory, and the memory is configured to store program instructions and data necessary for the communication device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides another method for processing identity information.
  • the method includes: the second network element determines whether to hide the first identity information of the terminal, and when the second network element determines to hide the first identity information of the terminal; The second network element hides the first identity information, obtains the second identity information, and sends the second identity information to the session management network element. Based on this method, the second network element can hide the identity information of the terminal that needs to be hidden and send it to the session management network element to protect the identity information of the terminal from being leaked when it is sent to the vertical industry security domain.
  • the second network element is any one of an access and mobility management network element, a network edge protection agent, and a visited session management network element.
  • the identity information of the terminal can be hidden by different network elements, which improves the flexibility of hiding the identity information of the terminal.
  • the second network element determining whether to hide the first identity information of the terminal includes: the second network element receiving Indication information, which is used to determine whether to hide the first identity information of the terminal according to the indication information; the indication information is used to indicate whether the network slice is managed by the operator; or the indication information is used to indicate whether the first identity information of the terminal is hidden; or It indicates whether the domain to which the network slice belongs belongs to the same security domain as the operator security domain.
  • the second network element when the second network element is an access and mobility management network element, the second network element itself can determine whether the network slice is managed by the operator, and determine whether to hide the first identity of the terminal according to its own judgment result. information.
  • the second network element hides the first identity information and obtains the second identity information, including: the second network The element uses the public key to encrypt the first identity information of the terminal to obtain the second identity information; or the second network element uses the shared key to encrypt the first identity information of the terminal to obtain the second identity information; or the second network element uses the shared key to obtain the second identity information;
  • the key and key derivation function obtain a new key, and use the new key to encrypt the first identity information of the terminal to obtain the second identity information; or, the second network element randomizes the first identity information of the terminal to obtain the first Two identity information; or, the second network element uses the GPSI corresponding to the first identity information of the terminal as the second identity information.
  • the present application provides a communication device.
  • the communication device may be a second network element in a communication network.
  • the second network element may be a network edge protection agent or a chip or a system on a chip in the network edge protection agent. It is the visited session management network element or the chip or system on chip in the visited session management network element; it may also be the access and mobility management network element or the chip or system on chip in the access and mobility management network element.
  • the communication device may implement the functions performed by the communication device in the seventh aspect or each of the possible designs of the seventh aspect, and the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the foregoing functions.
  • the communication device may include: a determining unit, a hiding unit, and a sending unit.
  • a determining unit configured to determine whether to hide the first identity information of the terminal
  • a hiding unit configured to hide the first identity information to obtain the second identity information when the first identity information of the hidden terminal is determined
  • the sending unit is configured to send the second identity information to the session management network element.
  • the provided communication device can achieve the same beneficial effects as the seventh aspect or any possible design of the seventh aspect.
  • a communication device including: a processor and a memory; the memory is configured to store a computer execution instruction, and when the communication device is running, the processor executes the computer execution instruction stored in the memory so that the memory
  • the communication device executes the identity information processing method according to the seventh aspect or any one of the possible designs of the seventh aspect.
  • a computer-readable storage medium stores instructions, and when the computer-readable storage medium runs on the computer, the computer can execute the seventh aspect or any of the foregoing aspects. Design the processing method of the identity information.
  • a computer program product containing instructions which, when run on a computer, enables the computer to execute the seventh aspect or any one of the possible designs of the foregoing aspect, the method for processing identity information .
  • a chip system includes a processor and a communication interface, and is configured to support a communication device to implement the functions involved in the foregoing aspect. For example, the processor determines whether to hide the first identity information of the terminal. When the first identity information of the terminal is determined to be hidden, the first identity information is hidden to obtain the second identity information, and the second identity information is sent to the session management network element through the communication interface.
  • the chip system further includes a memory, and the memory is configured to store program instructions and data necessary for the communication device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the present application provides a method for processing identity information, the method comprising: the third network element receiving the identity information of the terminal sent by the session management network element and indicating that the identity information of the terminal is hidden identity information
  • the third network element sends a decryption request to the decryption function entity according to the instruction, where the decryption request includes the identity information of the terminal, and the decryption request is used to request the identity information of the terminal; the third network element receives the decrypted Identity information, acquiring data corresponding to the decrypted identity information, and sending the data to the session management network element.
  • the requesting decryption function entity decrypts the hidden identity information, obtains the data corresponding to the decrypted identity information, and The obtained data is sent to the session management network element, so that the session management network element implements service transmission on the PDU session according to the received data. In this way, the continuity of service transmission is ensured without the identity information of the terminal being leaked.
  • the third network element is any one of a policy control network element, a charging network element, and a data management network element. In this way, after receiving the hidden identity information, different network elements may request other network elements to decrypt the identity information of the terminal.
  • the decryption function entity is an access and mobility management network element, a data management network element, Any one of a network storage network element, a charging network element, a policy control network element, and an authentication network element.
  • the identity information of the hidden terminal can be decrypted by different network elements, increasing the flexibility of decrypting the identity information of the terminal.
  • the method further includes: sending, by the third network element, the hidden information to the session management network element.
  • Information corresponding to the second identity information so that the session management network element stores the hidden second identity information and information corresponding to the second identity information.
  • the third network element notifies the session management network element to send information
  • the hidden identity information can be directly sent to the session management network element, and there is no need to decrypt the hidden identity information through the decryption function entity, and then to the session.
  • the management network element sends information, which reduces the processing power consumption of the third network element and the signaling overhead with other network elements.
  • the present application provides a communication device.
  • the communication device may be a third network element in a communication network.
  • the third network element may be a policy control network element or a chip or a system on a chip in the policy control network element. It may be a charging network element or a chip or a system on a chip in the charging network element; it may also be a data management network element or a chip or a system on a chip in the data management network element.
  • the communication device may implement the functions performed by the communication device in the thirteenth aspect or each of the possible designs of the thirteenth aspect, and the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the foregoing functions.
  • the communication device may include a receiving unit, a sending unit, and an obtaining unit.
  • a receiving unit configured to receive identity information of the terminal and an indication used to indicate that the identity information of the terminal is hidden identity information sent by the session management network element;
  • a sending unit configured to send a decryption request to the decryption function entity according to the instruction, wherein the decryption request includes identity information of the terminal, and the decryption request is used to request to decrypt the identity information of the terminal;
  • the receiving unit is further configured to receive the decrypted identity information from the decryption function entity;
  • An obtaining unit configured to obtain data corresponding to the decrypted identity information
  • the sending unit is further configured to send data to the session management network element.
  • the provided communication device can achieve the same beneficial effects as the thirteenth aspect or any of the possible designs of the thirteenth aspect.
  • a communication device including: a processor and a memory; the memory is configured to store a computer execution instruction, and when the communication device is running, the processor executes the computer execution instruction stored in the memory so that The communication device executes the identity information processing method according to the thirteenth aspect or any one of the thirteenth possible designs.
  • a computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the thirteenth aspect or any of the foregoing aspects. It is possible to design the processing method of the identity information.
  • a computer program product containing instructions which, when run on a computer, enables the computer to execute the processing of the identity information described in the thirteenth aspect or any one of the above possible designs. method.
  • a chip system includes a processor and a communication interface, and is configured to support a communication device to implement the functions involved in the foregoing aspect, for example, the processor receives identity information of a terminal sent by a session management network element. And an instruction for indicating that the identity information of the terminal is hidden identity information, and sending a decryption request to the decryption function entity according to the instruction, wherein the decryption request includes the identity information of the terminal, and the decryption request is used to request the identity information of the terminal;
  • the functional entity receives the decrypted identity information, obtains data corresponding to the decrypted identity information, and sends the data to the session management network element.
  • the chip system further includes a memory, and the memory is configured to store program instructions and data necessary for the communication device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the technical effects brought by any of the design methods in the fifteenth aspect to the eighteenth aspect can refer to the technical effects brought by the thirteenth aspect or any of the possible designs of the thirteenth aspect. More details.
  • the present application provides an identity information processing system, including: a first network element according to the second to sixth aspects, and a second network element according to the eighth to twelfth aspects The third network element according to the fourteenth aspect to the eighteenth aspect.
  • FIG. 1 is a schematic diagram of a system architecture according to an embodiment of the present application.
  • FIG. 2a is a schematic diagram of a system architecture in a non-roaming scenario according to an embodiment of the present application
  • FIG. 2b is a schematic diagram of a system architecture in a LOB roaming scenario according to an embodiment of the present application
  • 2c is a schematic diagram of a system architecture in a home routed roaming scenario according to an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 4 is a flowchart of a method for processing identity information according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another method for processing identity information according to an embodiment of the present application.
  • FIG. 6 is a flowchart of another method for processing identity information according to an embodiment of the present application.
  • FIG. 7 is a flowchart of still another method for processing identity information according to an embodiment of the present application.
  • FIG. 8 is a flowchart of another method for processing identity information according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of still another communication device according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of still another communication device according to an embodiment of the present application.
  • NS It is a logical network with specific network characteristics. Different network slices are logically isolated. It can flexibly provide one or more network services according to the requirements of the demander.
  • a network slice is identified by a single network slice selection assistance information (Single Network Selection Selection Information, S-NSSAI).
  • NSSAI Network slice selection assistance information
  • S-NSSAI used to indicate one or more network slices.
  • NSSAI includes multiple single NSSAIs (single NSSAIs, S-NSSAIs).
  • S-NSSAI consists of parameters such as slice / service type (SST) and slice differentiator (SD).
  • SST includes standardized and operator-defined types; SD is optional information that supplements SST to distinguish multiple network slices of the same SST.
  • SST slice / service type
  • SD slice differentiator
  • SST includes standardized and operator-defined types
  • SD is optional information that supplements SST to distinguish multiple network slices of the same SST.
  • NSSAI may be referred to as network slice information for short.
  • Operator security domain The network managed by the operator.
  • Vertical industry security domain other networks outside the operator's security domain, that is, networks not managed by the operator.
  • the vertical industry security domain may be referred to as a service management domain or a business security domain.
  • SEPP Network Edge Protection Agent
  • SEEP1 is deployed at the edge of the security domain of the vertical industry
  • SEEP2 is deployed at the edge of the operator's security domain.
  • Network functions (NF) in the vertical industry security domain can send information to SEEP2 in the security domain of the operator through SEEP1. After receiving the information sent by SEEP1, SEEP2 sends the received information to the NF in the operator's security domain.
  • the network may be a 5G network.
  • the network may include: terminals, access network equipment, access and mobility management network elements, multiple network slices (such as NS-1 and NS-2 in Figure 1), and slice selection network elements. , Policy control network element, data management network element, charging network element, data network (DN), etc.
  • Each network slice is composed of different network functions and physical resources, and can be used to carry a PDU session so that the terminal can access the data network through the PDU session.
  • the network slice is composed of a network storage network element, multiple management network elements, and multiple user plane network elements. Network slices are isolated from each other.
  • Multiple network slices can share the same slice to select network elements, access and mobility management network elements, data management network elements, policy control network elements, and billing network elements.
  • different network slices can be located in the operator's security domain and managed by the operator; they can also be deployed in networks other than the operator.
  • NS-1 in Figure 1 is located in the operator security domain
  • NS-2 is located in the vertical service security domain.
  • SEEP can be deployed at the edge of each domain.
  • SEEP is the communication interface of the domain. It has the function of sending and receiving data or information.
  • NFs in different domains can communicate with each other through SEEP.
  • the network architecture shown in FIG. 1 is only an exemplary architecture diagram.
  • the network shown in FIG. 1 may include other functions, such as an authentication network. (Such as: Authentication Server Function (AUSF)), authentication credential storage and processing function (Authentication, Repository, Processing Functon, ARPF), etc.
  • AUSF Authentication Server Function
  • ARPF Processing Functon
  • the terminal in FIG. 1 may be a user equipment (UE), and may also be various handheld devices with wireless or wired communication functions, vehicle-mounted devices, wearable devices, computing devices, or other processing connected to a wireless modem.
  • Equipment can also include subscriber units, cellular phones, smart phones, wireless data cards, personal digital assistant (PDA) computers, tablet computers, wireless modems (modems ), Handheld devices, laptop computers, cordless phones or wireless local loop (WLL) stations, Machine Type Communication (MTC) terminals, mobile Mobile (Station, MS), etc., are not restricted.
  • PDA personal digital assistant
  • modems modems
  • WLL wireless local loop
  • MTC Machine Type Communication
  • MS mobile Mobile
  • the access network equipment in Figure 1 is mainly used to implement functions such as physical layer functions, resource scheduling and wireless resource management, access control, and mobility management; it can be a next-generation base station (generation nodeB, gNB) or some other Access unit; may also be an access network device for other specific wired network functions.
  • generation nodeB generation nodeB
  • gNB next-generation base station
  • the slice selection network element in Figure 1 has the functions of selecting network slices and identifying the attributes of the network slices. It is mainly used to select the appropriate network slice for the terminal according to the information requested by the terminal and / or the NSSAI contracted by the terminal, and determine the selected network slice. Whether network slicing is managed by the operator.
  • the slice selection network element may be a network slice selection function (Network Slice Selection Function, NSSF).
  • the access and mobility management network element in FIG. 1 mainly implements access control and mobility management functions for the terminal, and can also be used to protect the identity information of the terminal (such as the terminal's SUPI, etc.).
  • the access and mobility management network element may be an access and mobility management function (AMF).
  • the network storage network element in Figure 1 stores the profile of each network function (NF) in the network and the services supported by the NF. It is mainly used to discover NFs and determine whether the network where the discovered NFs are located is operated. Business management, etc.
  • the network storage network element may be a network warehouse function (Network Repository Function, NRF).
  • the session management network element in Figure 1 is mainly used to implement session management functions such as the establishment, release, and change of user plane transmission paths. It can also be used to hide the session management network element when the session management network element is the terminal's visited location. (hide) Identity information of the terminal sent to the home session management network element.
  • the session management network element may be a session management function (Session Management) (SMF).
  • the user plane network element in FIG. 1 is mainly responsible for functions such as routing and forwarding of user plane data, such as: responsible for filtering terminal data packets, data transmission / forwarding, rate control, and generating charging information.
  • the user plane network element may be a user plane function (User Plane Function, UPF).
  • the policy control network element in Figure 1 is mainly used to formulate policy and charging control rules (PCC rules) related to the terminal. It can also be used to receive the hidden identity sent by the session management network element. After the information is obtained, the original identity information corresponding to the hidden identity information is obtained, and the data corresponding to the original identity information is delivered to the session management network element.
  • the policy control network element may be a Policy Control Function (PCF).
  • the data management network element in FIG. 1 is mainly used to save terminal contract data and related information. It can also be used to obtain the original identity corresponding to the hidden identity information after receiving the hidden identity information sent by the session management network element. Identity information, and delivers data corresponding to the original identity information to the session management network element.
  • the data management network element may be unified data management (UDM).
  • the charging network element in Figure 1 is mainly used to charge the traffic of the terminal. It can also be used to obtain the original identity corresponding to the hidden identity information after receiving the hidden identity information sent by the session management network element. Identity information, and delivers data corresponding to the original identity information to the session management network element.
  • the charging network element may be a charging control function (Charge Function, CHF).
  • the network element names in the above architectures are only examples, and the network element names in the specific implementation may be other names, which are not specifically limited in the embodiment of the present application.
  • the following uses Figure 1 as a 5G network.
  • the access and mobility management network element in Figure 1 is AMF
  • the slice selection network element is NSSF
  • the network storage network element is NRF
  • the session management network element is AMF
  • the policy control network element is PCF.
  • the data management network element is UDM
  • the charging network element is CHF.
  • FIG. 2a it is a system architecture diagram of a terminal in a non-roaming scenario.
  • the terminal is located in a home public land mobile network (HPLMN) (hPLMN), and the terminal can access the DN through the NS in the hPLMN.
  • HPLMN home public land mobile network
  • hPLMN home public land mobile network
  • the terminal can access DN1 through NS-2 in hPLMN.
  • LBO roaming can refer to the roaming terminal accessing the corresponding service through the network slice of the visited place, and the service provider can visit the Public Land Mobile Network (PLMN) (referred to as vPLMN).
  • PLMN Public Land Mobile Network
  • the terminal accesses DN1 to obtain corresponding services through the SMF (that is, vSMF) in vPLMN, and the terminal-side traffic of all access services is reported to the PCF (that is, hPCF) in hPLMN via vSMF in vPLMN. That is: SMF for terminal service under local breakout roaming is located in the visited place.
  • Home-routed roaming refers to routing through home, connecting to the home SMF through the SMF of the visiting place, transmitting control signaling, and connecting the home network slice to the data network.
  • vSMF is the visiting Local SMF
  • hSMF is the visiting SMF.
  • the terminal can send messages to hSMF through vSMF, and hSMF can upload the received messages to PCF, CHF, or UDM.
  • the identity information of the terminal (such as SUPI) from leaking to the vertical industry security domain
  • determine whether the network slice is managed by the operator determine whether the network slice is managed by the operator.
  • the identity information of the terminal is hidden, that is, the identity information of the encrypted terminal is encrypted, and the terminal identity information is subsequently sent to the network slice.
  • Send encrypted identity information to protect the identity information of the terminal from being leaked to the vertical industry security domain.
  • some network elements such as PCF or CHF or UDM
  • receive the encrypted identity information they decrypt the received identity information and obtain data corresponding to the decrypted identity information.
  • the operation of hiding the identity information of the terminal may be processing the identity information of the terminal in a randomized manner. Specifically, this method can be referred to FIG. 4 to FIG. 8.
  • FIG. 3 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the communication device 300 includes at least one processor 301, a communication line 302, and at least one communication interface 304, and may further include a memory 303.
  • the processor 301, the memory 303, and the communication interface 304 may be connected through a communication line 302.
  • the processor 301 may be a central processing unit (CPU), a specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. For example: one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).
  • DSPs digital signal processors
  • FPGAs field programmable gate arrays
  • the communication line 302 may include a path for transmitting information between the aforementioned components.
  • the memory 303 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (Random Access Memory, RAM), or other types that can store information and instructions
  • the dynamic storage device can also be Electrically Erasable Programmable Read-Only Memory (EEPROM), Compact Disc (Read-Only Memory, CD-ROM) or other optical disk storage, optical disk storage (Including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this.
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • CD-ROM Compact Disc
  • optical disk storage including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • magnetic disk storage media or other magnetic storage devices or can be used to carry or
  • the memory 303 may exist independently, and is connected to the processor 301 through a communication line 302.
  • the memory 303 may also be integrated with the processor 301.
  • the memory 303 is configured to store execution instructions or application program code, and is controlled and executed by the processor 301 to implement a method for processing identity information provided in the following embodiments of the present application.
  • the communication interface 304 is used to communicate with other devices or communication networks. Any device such as a transceiver can be used, such as Ethernet, Radio Access Network (RAN), and Wireless Local Area Networks (WLAN). Wait.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the processor 301 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 3.
  • the communication device 300 may include multiple processors, such as the processor 301 and the processor 307 in FIG. 3.
  • the communication apparatus 300 may further include an output device 305 and an input device 306.
  • the above-mentioned communication device 300 may be a general-purpose device or a special-purpose device.
  • the communication device 300 may be a desktop computer, a portable computer, a network server, a PDA, a mobile phone, a tablet computer, a wireless terminal, an embedded device, or a device with a similar structure in FIG. 3.
  • the embodiment of the present application does not limit the type of the communication device 300.
  • FIG. 4 is a flowchart of a method for processing identity information according to an embodiment of the present application.
  • the method may be applied to the scenario shown in FIG. 2a or FIG. 2b or FIG. 2c.
  • the AMF and NSSF in this method may be the home AMF (ie hAMF) and the home NSSF (ie hNSSF).
  • the AMF and NSSF in the method may be the visited AMF (that is, vAMF) and the visited NSSF (that is, vNSSF) in FIG. 2b.
  • the AMF and NSSF in the method may be the visited AMF (that is, vAMF) and the home place NSSF (that is, hNSSF) in FIG. 2c.
  • the method may include:
  • Step 401 The terminal sends a first request message to the AMF.
  • the AMF may be a default AMF.
  • the terminal may send a first request message to the AMF through the access network device.
  • the first request message can be used to request the AMF to establish network access for the terminal; it can also be used to instruct the AMF to hide the identity information of the terminal sent to the network slice if the network slice is located in a vertical industry security domain.
  • the first request message may be a session establishment request, a session update request, or a registration request, without limitation.
  • the first request message may include the first identity information of the terminal and the NSSAI requested by the terminal, and may also include other information, such as: the device type of the terminal, the service identification of the terminal, and the service type parameters of the terminal; it may also include a hidden indication, the The hiding indication can be used to instruct the AMF to hide the identity information of the terminal sent to the network slice if the network slice is located in a vertical industry security domain. It should be noted that the first request message may not include a hidden indication. When the AMF receives the first request message that includes the first identity information of the terminal, it defaults to sending hidden messages when the network slice is located in a vertical industry security domain. The first identity information of the terminal of the network slice.
  • the first identity information of the terminal may be a terminal ’s permanent identity (Subscription, Permanent Identifier, SUPI), or the terminal ’s International Mobile Subscriber Identifier (IMSI), or the terminal ’s global uniqueness.
  • SUPI Permanent Identifier
  • IMSI International Mobile Subscriber Identifier
  • Temporary Identifier Globally Unique Temporary Identifier, GUTI
  • TMSI Temporary Mobile Subscriber Identifier
  • S-TMSI System Architecture Evolution Temporary Mobile Subscriber Identifier
  • M-TMSI mobile management function temporary mobile user Identifier
  • P-TMSI packet domain user temporary identifier
  • IPPI IP Multimedia Private Identity
  • IP Multimedia Identity IP Multimedia Identity
  • IMPU IP Multimedia Common Identity
  • IMEI International Mobile Station Equipment Identity
  • Step 402 The AMF receives the first request message and sends a slice selection request to the NSSF.
  • the slice selection request may be used to request NSSF to select a network slice that supports terminal access.
  • the slice selection request may include the NSSAI requested by the terminal, and may also include the Public Land Mobile Network Identity (PLMN) of the terminal ’s SUPI. ID), one or more pieces of information in the terminal ’s tracking area identification (TAI), the device type of the terminal, the service identification of the terminal, and the service type parameters of the terminal.
  • PLMN Public Land Mobile Network Identity
  • TAI tracking area identification
  • step 402 when the AMF receives the first request message, if the AMF itself cannot select a suitable network slice for the terminal, it sends a slice selection request to the NSSF; if the AMF itself can select a suitable network for the terminal Slice, no slice selection request is sent to NSSF.
  • the AMF can determine whether it can select an appropriate network slice for the terminal by using the existing technology, which is not described in the embodiment of the present application.
  • the AMF may directly send a slice selection request to the NSSF through a communication interface (such as a service interface Nnssf) between the AMF and the NSSF.
  • a communication interface such as a service interface Nnssf
  • the AMF may send a slice selection request to the vNSSF.
  • the vNSSF forwards the slice selection request to the hNSSF.
  • both the slice selection request sent by AMF to vNSSF and the slice selection request sent by vNSSF to hNSSF carry the NSSAI requested by the terminal.
  • the information carried in the slice selection request sent by AMF to vNSSF can be It is the same as or different from the information carried in the slice selection request sent by vNSSF to hNSSF.
  • Step 403 The NSSF receives the slice selection request, and determines whether the network slice is managed by the operator.
  • the network slice described in step 403 may be a network slice selected by the NSSF and supporting terminal access. Specifically, for a process of selecting a network slice by the NSSF, reference may be made to the existing technology, which is not described in the embodiment of the present application.
  • whether the network slice is managed by the operator can refer to whether the network slice is located in the operator's security domain or whether the domain in which the network slice belongs and the operator's security domain belong to the same security domain. For example: if the terminal's network slice is in the operator's security domain, it means that the network slice is managed by the operator; otherwise, the network slice is outside the operator's security domain (that is, in the vertical industry security domain) and the network slice is not used by the operator management.
  • determining whether a network slice is managed by an operator can be described as "determining whether the identity information sent to (in a network slice) NF (such as SMF) needs to be hidden” or it can be described as "determining the domain to which a network slice belongs” Whether it belongs to the same security domain as the operator's security domain “can also be described as” determining whether the network slice is located in the operator's security domain.
  • other description languages can also be used to indirectly express "whether the network slice is managed by the operator", that is, the language description that can be used to express "whether the network slice is managed by the operator” is also within the protection scope of this application.
  • NSSF determines whether the network slice is managed by the operator according to the corresponding relationship between the NSSAI and the domain to which the network slice belongs; wherein the domain to which the network slice belongs includes the operator security domain or the vertical industry security domain.
  • NSSAI1 corresponds to the operator security domain
  • NSSAI2 corresponds to the vertical industry security domain.
  • NSSAI includes an indication of whether the network slice corresponding to NSSAI belongs to the operator's security domain.
  • NSSF can directly determine whether the network slice is managed by the operator. For example, when the instruction is used to indicate that the network slice corresponding to NSSAI is not an operation When it comes to commercial security domains, NSSF determines that network slices are not located in operator security domains, but in vertical industry security domains.
  • the slice selection request includes the TAI of the terminal. If the terminal's TAI indicates that the terminal is in a vertical industry security domain, NSSF determines that the network slice is managed by the operator according to the terminal's TAI, otherwise, it determines the network Slices are not managed by the operator.
  • the slice selection request includes the service type of the terminal. If the service type of the terminal indicates that the service of the terminal belongs to the vertical industry business category, NSSF determines that the network slice belongs to the operator's management according to the service type of the terminal, and vice versa , It is determined that the network slice is not managed by the operator.
  • the above network slice is equivalent to the NF in the network slice (for example, network function entities such as SMF and UPF). That is, whether the network slice described in this application is managed by the operator is equivalent to whether the NF (such as SMF or UPF) in the network slice is managed by the operator.
  • the NF such as SMF or UPF
  • Step 404 The NSSF sends instruction information to the AMF.
  • the indication information may be used to indicate whether the network slice is managed by the operator, or to indicate whether to hide the first identity information of the terminal, or to indicate whether the domain to which the network slice belongs belongs to the same security domain as the operator's security domain.
  • the indication information may be a binary number of “0” or “1”, where “0” indicates that the network slice is not managed by the operator, and “1” indicates Network slicing is managed by the operator.
  • the indication information is a Boolean value "true” or “false”, “false” indicates that the network slice is not managed by the operator, and "true” indicates that the network slice is managed by the operator.
  • the NSSF may directly send instruction information to the AMF through a communication interface (such as a service interface Namf) between the NSSF and the AMF.
  • a communication interface such as a service interface Namf
  • hNSSF sends instruction information to vNSSF
  • vNSSF sends instruction information to AMF.
  • the instruction information sent by hNSSF to vNSSF and the instruction information sent by vNSSF to AMF may be the same or different.
  • the instruction information sent by hNSSF to vNSSF may be used to indicate that the network slice is not managed by the operator.
  • the indication information sent by the AMF may be used to indicate whether the identity information of the terminal is hidden.
  • the NSSF may also send the NSSAI and other information corresponding to the network slice to the AMF, without limitation.
  • Step 405 The AMF receives the instruction information.
  • the AMF may determine whether to hide the first identity information of the terminal according to the indication information. Specifically, for a process of determining whether to hide the first identity information of the terminal according to the indication information, reference may be made to FIG. 7.
  • this method can be referred to FIG. 5.
  • FIG. 5 is another method for processing identity information according to an embodiment of the present application.
  • the method may be applied to the scenario shown in FIG. 2a or FIG. 2b or FIG. 2c.
  • the method may be the home AMF (ie hAMF) and the home NRF (ie hNRF).
  • the AMF and NRF in the method may be the visited AMF (that is, vAMF) and the visited NRF (that is, vNRF) in FIG. 2b.
  • the AMF and NRF in the method may be the visited AMF (that is, vAMF) and the home NRF (that is, hNRF) in FIG. 2c.
  • the method may include:
  • Step 501 The terminal sends a first request message to the AMF.
  • step 501 reference may be made to step 401, and details are not described again.
  • Step 502 The AMF receives the first request message and sends an NF discovery request to the NRF.
  • the NF discovery request may include the NSSAI corresponding to the network slice, and the network slice may be a network slice that supports terminal access.
  • the NF discovery request may be used to request the NRF to discover the SMF serving the terminal in the network slice corresponding to the NSSAI and determine whether the SMF is managed by the operator.
  • the NF discovery request may also include one or more information of the PLMN ID corresponding to the SUPI of the terminal, the TAI of the terminal, the device type of the terminal, the service identification of the terminal, and the service type parameter of the terminal.
  • step 502 when the AMF receives the first request message and selects a network slice, if the AMF itself cannot select an SMF serving the terminal from the network slice, it sends a NF discovery request to the NRF; if The AMF itself can select the SMF serving the terminal from the network slice, and does not send a slice selection request to the NSSF.
  • the AMF may use the existing technology to determine whether it can select an SMF for terminal service, which is not described in the embodiment of this application.
  • the network slice selected by the AMF is the visited network slice.
  • the AMF may directly send a NF discovery request to the NRF through a communication interface (such as a service interface Nnrf) between the AMF and the NRF.
  • a communication interface such as a service interface Nnrf
  • the AMF can send a NF discovery request to the vNRF, and after receiving the NF discovery request, the vNRF forwards the NF discovery request to the hNRF;
  • the NRF in the visited network slice selected for the AMF, and hNRF is the NRF in the home network slice corresponding to the visited network slice.
  • both the NF discovery request sent by AMF to vNRF and the NF discovery request sent by vNRF to hNRF carry the NSSAI requested by the terminal.
  • the information carried in the NF discovery request sent by AMF to vNRF can be It is the same as or different from the information carried in the NF discovery request sent by vNRF to hNRF.
  • Step 503 The NRF receives the NF discovery request, and determines whether the SMF is managed by the operator.
  • the SMF described in step 503 may be an SMF selected by the NRF from a network slice supporting terminal access and serving the terminal, or may be another SMF capable of serving the terminal.
  • the process of selecting the SMF for the terminal service by the NRF may refer to the existing technology, which is not described in the embodiment of the present application. It should be noted that, in the scenario shown in FIG. 2c, the SMF selected by the NRF is the home SMF (hSMF).
  • the process by which the NRF determines whether the SMF is managed by the operator may include: the NRF determines the corresponding NSSAI included in the NF discovery request. Whether the network slice is managed by the operator. If it is managed by the operator, it is determined that the selected SMF is managed by the operator; otherwise, it is determined that the selected SMF is not managed by the operator.
  • the process of the NRF judging whether the network slice corresponding to the NSSAI included in the NF discovery request is managed by the operator may refer to the process of the NSSF judging whether the network slice is managed by the operator in step 403, which is not described again.
  • the NRF can determine whether the SMF is managed by the operator according to the address information of the SMF. For example, the NRF can view all the address information managed by the operator. If the address information of the SMF is included in the range of the address information managed by the operator, it is determined that the SMF is managed by the operator; otherwise, it is determined that the SMF is not operated by the operator. Business management.
  • the address information of the SMF is used to identify the SMF, which can be an Internet Protocol (IP) address of the SMF, or a fully qualified domain name (FQDN) of the SMF, or information of an SMF instance, or an SMF service instance. Address, etc.
  • IP Internet Protocol
  • FQDN fully qualified domain name
  • the SMF is managed by the operator, whether the network slice where the SMF is located is managed by the operator, whether the network slice where the SMF is located is in the operator's security domain, whether the identity information sent to the SMF needs to be hidden (or protected), and sent. Whether the identity information of the network slice where the SMF is located needs to be hidden (or protected), and whether the domain of the network slice where the SMF is located and the operator's security domain belong to the same security domain are the same concept.
  • determining whether SMF is managed by an operator can be described as "determining whether a network slice accessed by a terminal is managed by an operator", and can also be described as " Judging whether the network slice accessed by the terminal and the operator's security domain belong to the same security domain ", etc., are not restricted.
  • other description languages can also be used to indirectly express "whether the SMF is managed by the operator", that is, the language description that can be used to express "whether the SMF is managed by the operator” is also within the protection scope of this application.
  • Step 504 The NRF sends address information and indication information of the SMF to the AMF.
  • the instruction information in step 504 may be used to indicate whether the SMF is managed by the operator, or used to indicate whether to hide the first identity information of the terminal sent to the SMF, or used to indicate whether the domain to which the SMF belongs is secure with the operator.
  • the domains belong to the same security domain.
  • the NRF can directly send the address information and indication information of the SMF to the AMF through the communication interface between the NRF and the AMF (such as the service interface Namf).
  • hNRF sends address information and indication information of SMF to vNRF
  • vNRF sends address information and indication information of SMF to AMF.
  • the instructions sent by hNRF to vNRF and the instructions sent by vNRF to AMF may be the same or different.
  • the instructions sent by hNRF to vNRF can be used to indicate that SMF is not managed by the operator, and vNRF sends to AMF.
  • the sent instruction information may be used to indicate that the first identity information of the terminal sent to the SMF is hidden.
  • Step 505 The AMF receives the address information and indication information of the SMF.
  • the AMF may determine whether to hide the first identity information of the terminal according to the indication information. Specifically, for a process of determining whether to hide the first identity information of the terminal according to the indication information, reference may be made to FIG. 7. It should be noted that in the method shown in FIG. 5, the NRF may also send the address information of the SMF to the AMF only. After receiving the address information of the SMF, the AMF determines whether the SMF is managed by the operator according to the address information of the SMF. For example, if the address information of the SMF is included in the range of the address information managed by the operator, it is determined that the SMF is managed by the operator; otherwise, it is determined that the SMF is not managed by the operator.
  • whether or not the network slice is managed by the operator can be determined by the AMF itself.
  • the implementable method can be referred to FIG. 6.
  • FIG. 6 is another method for processing identity information according to an embodiment of the present application.
  • the method may be applied to the scenario shown in FIG. 2a or FIG. 2b or FIG. 2c.
  • the method may be used in the scenario shown in FIG. 2a.
  • the AMF and UDM in the method may be the home AMF (ie hAMF) and the home UDM.
  • the AMF in the method may be the visited AMF (that is, vAMF) in FIG. 2b
  • the UDM may be the home UDM.
  • the AMF in the method may be the visited AMF (that is, vAMF) in FIG. 2c
  • the UDM may be the home UDM.
  • the method may include:
  • Step 601 The terminal sends a first request message to the AMF.
  • step 601 reference may be made to step 401, and details are not described again.
  • Step 602 The AMF receives the first request message and sends a data request to the UDM.
  • the data request may include the first identity information of the terminal, and the data request may be used to request subscription data of the terminal.
  • the data request can be a Nudm message
  • Step 603 The UDM acquires the subscription data of the terminal, and sends the acquired subscription data of the terminal to the AMF.
  • the contracted data of the terminal may include the NSSAI contracted by the terminal, or the name of the data network (Data Network Name, DNN) contracted by the terminal, or the correspondence between whether the NSSAI contracted by the terminal and the NSSAI contracted by the terminal are managed by the operator. Or the correspondence between the DNN contracted by the terminal and whether the DNN contracted by the terminal is managed by the operation.
  • DNN Data Network Name
  • Step 604 The AMF receives the data signed by the terminal, and determines whether the network slice is managed by the operator according to the data signed by the terminal and the NSSAI requested by the terminal.
  • the network slice may be a network slice that supports terminal access.
  • the AMF may determine the network slice supporting the terminal access according to the data contracted by the terminal and the NSSAI requested by the terminal. For specific implementation methods, refer to the existing technology, and details are not described again.
  • the process of the AMF determining whether the network slice is managed by the operator may refer to the process of the NSSF determining whether the network slice is managed by the operator in step 403, which is not described again.
  • the AMF can also determine whether the network slice is managed by the operator based on whether the DNN is managed by the operator based on the DNN corresponding to the network slice. For example, if the DNN is managed by the operator, determine that the network slice is operated. Provider management, otherwise, it is determined that the network slice is not managed by the operator.
  • the AMF may determine whether to hide the first identity information of the terminal by itself or other network elements. Specifically, for a process of determining whether to hide the first identity information of the terminal, refer to FIG. 7.
  • the AMF can be used to determine whether the network slice is managed by the operator. Subsequently, it is convenient for the AMF or other network elements to determine whether to hide the identity information of the terminal based on the judgment result of the AMF and protect the identity information of the terminal from being leaked .
  • the above Figures 4 to 6 mainly describe whether the network slice or SMF is managed by the operator.
  • the first identity information of the terminal is hidden; otherwise, the first identity information of the terminal is directly sent to the SMF in the network slice.
  • this process can be referred to FIG. 7.
  • FIG. 7 is a schematic flowchart of a method for processing identity information provided by this application.
  • the method can be applied to the scenario shown in FIG. 2a or FIG. 2b or FIG. 2c.
  • the method When the method is used in the scenario shown in FIG. 2a, the method The AMF and SMF in the home may be the home AMF (ie hAMF) and the home SMF.
  • the AMF in the method When the method is used in the scenario shown in FIG. 2b, the AMF in the method may be the visited AMF (that is, vAMF) in FIG. 2b, and the SMF may be the visited SMF (vSMF).
  • the AMF in the method When the method is used in the scenario shown in FIG. 2c, the AMF in the method may be the visited AMF (that is, vAMF) in FIG. 2c, and the SMF may be the home SMF (hSMF).
  • the method includes:
  • Step 701 The AMF determines whether to hide the first identity information of the terminal.
  • the AMF determines whether to hide the first identity information of the terminal according to the indication information received from the NSSF or the NRF; for a description of the indication information, reference may be made to FIG. 4 or FIG. 5, and details are not described again.
  • the indication information is used to indicate that the network slice is managed by the operator, it is determined that the first identity information of the terminal is not hidden; otherwise, it is determined that the first identity information of the terminal is hidden.
  • the indication information is used to indicate the first identity information of the hidden terminal, the first identity information of the hidden terminal is directly determined; otherwise, the first identity information of the terminal is not determined to be hidden.
  • the AMF determines whether to hide the first identity information of the terminal according to a local preset policy. For example, the AMF may determine whether to hide the first identity information of the terminal by using the method shown in FIG. 6.
  • this application does not limit the implementation manner of the AMF determining whether to hide the first identity information of the terminal.
  • Step 702 In a case where the AMF determines the first identity information of the hidden terminal, the first identity information of the hidden terminal obtains the second identity information.
  • concealment may refer to encryption or encapsulation or protection.
  • the second identity information may be identity information of the hidden terminal, and the second identity information may correspond to the first identity information of the terminal.
  • the AMF can hide the first identity information of the terminal in the following ways to obtain the second identity information:
  • Method 1 Use the public key to encrypt the first identity information of the terminal to obtain the second identity information.
  • Manner 2 The first identity information of the terminal is encrypted by using the shared key to obtain the second identity information.
  • the shared key is configured in advance on a network element (such as AMF) that hides the first identity information of the terminal and on a network element that decrypts the second identity information.
  • Method 3 The AMF derives a new key according to the shared key, and uses the new key to encrypt the first identity information of the terminal to obtain the second identity information.
  • the shared key K is pre-configured on a network element (such as AMF) that hides the first identity information of the terminal and on a network element (such as the decryption function entity shown in FIG. 8) that decrypts the second identity information.
  • the parameters in the above key derivation function may include at least one of a slice ID and a session ID in addition to K and SST; it may also include time, calculator, serial number, and random number ( nonce) and so on.
  • the AMF needs to send parameters that are not shared between the AMF and the network element that decrypts the second identity information (such as slice ID, time, calculator, serial number, nonce, etc.) to the SMF, so that the SMF Send these unshared parameters to the network element that decrypts the second identity information, so that the network element that decrypts the second identity information uses the same deduction function and deduction parameters to obtain K_SST, and then decrypts the second identity information according to K_SST to obtain the terminal First identity information.
  • the second identity information such as slice ID, time, calculator, serial number, nonce, etc.
  • Method 4 The AMF randomizes the first identity information of the terminal to obtain the second identity information.
  • the AMF randomizes the first identity information of the terminal according to a hash type function.
  • the hash type function can be a common hash type function (such as SHA-256, etc.), or a Media Access Control (MAC) Message Authentication Code (Message) function (such as: based on a hash algorithm
  • MAC Media Access Control
  • Message Message Authentication Code
  • the hidden identity information hash (SUPI, SST), or hash (SUPI, SST, (nonce, sequence number (number), time) At least one))).
  • the random number is any value generated by the AMF.
  • the sequence number is the sequence number of the information that the AMF interacts with the SMF at the moment before the current moment.
  • the time is the timer in the AMF at the current time.
  • the second identity information is composed of routing information (information) of the AMF and a random number generated by the AMF.
  • routing information information
  • the terminal's first identity information as SUPI as an example
  • Hide (SUPI) AMF routing information
  • the AMF saves the correspondence between the hidden second identity information and the terminal's first identity information, so that after the AMF receives the decryption request sent by the network element that decrypts the second identity information, it decrypts it according to the correspondence relationship.
  • the first identity information of the terminal is the first identity information of the terminal.
  • Method 5 The AMF uses the GPSI corresponding to the first identity information of the terminal as the hidden second identity information.
  • hiding the first identity information of the terminal in this application may refer to hiding all or partially hiding the first identity information of the terminal, where partially hiding means hiding some information in the first identity information of the terminal.
  • SUPI includes two pieces of information: a network identity and an identity identity.
  • the network identity can be MNC, MCC, and the identity identity can be MSIN.
  • the network identity need not be hidden, and the identity identity is hidden.
  • Step 703 The AMF sends the second identity information to the SMF.
  • the second identity information may be sent to the SMF in a session establishment request or a session update request.
  • the AMF can also send an indication to the SMF that the second identity information is hidden identity information, so that after receiving the indication, the SMF sends the second identity information and the indication to the PCF or CHF together or UDM, etc.
  • the AMF can directly send the second identity information to the SMF through the communication interface between the AMF and the SMF (such as the service-oriented interface Nsmf); or, the AMF Send the second identity information to the first SEEP in its domain.
  • the first SEEP sends the second identity information to the second SEEP in the domain where the SMF is located.
  • the second SEEP receives the second identity information and sends it to the SMF. Send the received second identity information.
  • hAMF sends second identity information to vSMF
  • vSMF sends second identity information to hSMF.
  • the AMF directly sends the first identity information of the terminal to the SMF.
  • the AMF may also send an indication to the SMF that the first identity information is unhidden identity information.
  • the process in which the AMF sends the first identity information to the SMF may refer to the process in which the AMF sends the second identity information to the SMF, and details are not described again.
  • "0" or “1” may be used to indicate whether the identity information sent by the AMF to the SMF is identity information after being hidden. For example, “0” indicates that the identity information sent by the AMF to the SMF is not hidden, and “1" indicates that the identity information sent by the AMF to the SMF is hidden. It should be noted that while sending the first identity information of the terminal to the SMF, the AMF may not send an indication to the SMF to indicate that the first identity information is unhidden identity information. When the SMF receives the first identity information including only the terminal, When a message of identity information is received, the identity information received by default is the identity information that is not hidden.
  • the AMF determines whether to perform step 701 shown in FIG. 7 and hide the first identity information of the terminal according to a local policy.
  • the local policy is configured in advance on the AMF, and the local policy is used for
  • the AMF is required to enable or disable the AMF's function of determining whether to hide the terminal's identity information before sending the terminal's identity information to other network elements.
  • the identity information of the terminal may be hidden by other network elements. details as follows:
  • the AMF after the AMF receives the instruction information sent by the NSSF or NRF, or the AMF itself determines whether the network slice is managed by the operator, it does not perform steps 702 to 703, but instead sends the first to its first location.
  • the SEEP or the second SEEP where the SMF is located sends the indication information of the first identity information of the hidden terminal and the first identity information of the terminal, so that the first SEEP or the second SEEP hides the terminal's first identity information according to the indication information of the hidden terminal's first identity information.
  • An identity information obtain the second identity information, and send the second identity information to the SMF.
  • the process of concealing the first identity information of the terminal by the first SEEP or the second SEEP may refer to the process of concealing the first identity information of the terminal by the AMF, and details are not described again.
  • the AMF does not perform steps 702 to 703, but sends to the vSMF to indicate the hidden terminal.
  • the indication information of the first identity information of the terminal and the first identity information of the terminal so that the vSMF hides the first identity information of the terminal according to the indication information of the hidden first identity information of the terminal, obtains the second identity information, and sends the second identity to the hSMF information.
  • the process of hiding the first identity information of the terminal by the vSMF may refer to the process of hiding the first identity information of the terminal by the AMF, and details are not described again.
  • the indication information received by the AMF and the indication information sent by the AMF to the vSMF may be the same or different.
  • the indication information received by the AMF may be a network slice that is not managed by the operator, and the indication information sent by the AMF to the vSMF may be a hidden terminal.
  • First identity information may be used to identify the indication information received by the AMF and the indication information sent by the AMF to the vSMF.
  • the identity information that needs to be hidden can be hidden and sent to the SMF to protect the identity information of the terminal from being leaked when it is sent to the vertical industry security domain.
  • the SMF may send the received identity information to the PCF or CHF or UDM, so that the PCF or CHF or UDM receives the identity information of the terminal sent by the SMF.
  • the identity information of the terminal is the hidden second identity information
  • the decryption function entity is requested to decrypt the second identity information to obtain the first identity, and obtain the terminal-related data according to the decrypted first identity information and return it to the SMF. .
  • the process is described below with reference to FIG. 8 by using the SMF to send the identity information of the terminal it receives to the PCF as an example.
  • the process of the SMF sending the terminal's identity information to the UDM or CHF refer to the process shown in FIG. 8.
  • FIG. 8 is a flowchart of a method for processing identity information provided by this application.
  • the method can be applied to the scenario shown in FIG. 2a or FIG. 2b or FIG. 2c.
  • the method When the method is used in the scenario shown in FIG. 2a, the method The SMF in can be the home SMF, and the PCF can be the home PCF.
  • the SMF in the method When the method is used in the scenario shown in FIG. 2b, the SMF in the method may be the visited SMF (vSMF), and the PCF may be the home PCF.
  • the SMF in the method may be the home SMF (hSMF), and the PCF may be the home PCF.
  • the method includes:
  • Step 801 The SMF receives the identity information of the terminal.
  • the identity information received by the SMF may be the first identity information of the unhidden terminal or the hidden second identity information.
  • the SMF further receives an indication indicating whether the identity information of the terminal is the hidden identity information, so that the SMF can determine whether the received identity information is the hidden identity information according to the indication.
  • the SMF receives the second identity information and an indication for indicating that the identity information of the terminal is the hidden identity information, so that the SMF can determine the received identity information as the hidden identity information according to the indication.
  • Step 802 In a case where the identity information of the terminal is the hidden second identity information, the SMF sends the second identity information to the PCF and an indication for indicating that the second identity information is the hidden identity information.
  • the SMF sends the second identity information to the PCF through the SEEP and an instruction for indicating that the second identity information is the hidden identity information, or, via its communication interface with the PCF (such as a service-oriented interface Npcf), to the PCF Sending the second identity information and an indication for indicating that the second identity information is hidden identity information.
  • the PCF such as a service-oriented interface Npcf
  • the indication indicating that the second identity information is the hidden identity information may not be issued.
  • the PCF can determine whether it is the hidden identity information based on the received identity information; or the PCF can determine whether the identity information sent by the SMF is the hidden identity information based on the SMF information (such as the address of the source SMF, etc.), that is, the PCF does not An indication is required to determine whether the received identity information is hidden identity information.
  • Step 803 The PCF receives the second identity information and an indication for indicating that the second identity information is hidden identity information, and sends a decryption request to the decryption function entity.
  • the decryption request includes second identity information, and the decryption request may be used to request decryption of the hidden second identity information.
  • the decryption function entity may be any network element among UDM, AMF, CHF, AUSF, ARPF, NRF, and PCF. It should be noted that when the decryption function entity is a function other than itself, one of the alternatives is that the PCF obtains the address information of the decryption function entity and sends a decryption request to the decryption according to the address information of the decryption function entity.
  • the address information of the decryption function entity can be sent to the SMF by the decryption function entity and sent to the PCF by the SMF.
  • the decryption function entity is an AMF
  • the address information of the decryption function entity can be sent in the same message as the second identity information.
  • the PCF can also be sent to the PCF in different messages.
  • the PCF is pre-configured with the address information of the decryption function entity.
  • the PCF uses the pre-configured decryption function entity therein. Sends the decryption request to the decryption function entity.
  • the PCF receives Hide (SUPI)
  • the PCF determines the address information of the AMF according to the AMF routing information, and sends a decryption request to the AMF.
  • Step 804 The decryption function entity receives the decryption request, decrypts the hidden second identity information, obtains the first identity information of the terminal, and sends the first identity information of the terminal to the PCF.
  • the decryption function entity decrypts the hidden second identity information by using the private key to obtain the first identity information of the terminal.
  • the decryption function entity decrypts the hidden second identity information through the shared key to obtain the first identity information of the terminal.
  • the shared key is stored on the decryption function entity in advance.
  • the identity information of the terminal is hidden by using the third method, after the decryption function entity obtains the shared key through the derivation function and the derivation parameter, the hidden first identity information is decrypted based on the shared key to obtain the second identity information of the terminal.
  • the decryption function entity is AMF
  • the AMF stores the correspondence between the hidden second identity information and the first identity information of the terminal, and the first identity information of the terminal is obtained according to this correspondence.
  • the decryption function entity is AMF or UDM, and the decryption function entity decrypts the hidden second identity information through the correspondence between the terminal's identity information and GPSI to obtain the first identity information of the terminal.
  • Step 805 The PCF receives the first identity information of the terminal, obtains data corresponding to the first identity information, and sends the obtained data to the SMF.
  • the SMF sends the first identity information to the PCF.
  • the PCF receives the first identity information sent by the SMF, does not need to decrypt the received first identity information, directly obtains data corresponding to the first identity information, and sends the obtained data to the SMF.
  • the requesting decryption function entity decrypts the hidden identity information, obtains the data corresponding to the decrypted identity information, and The obtained data is sent to the SMF, so that the SMF implements service transmission on the PDU session according to the received data. In this way, the continuity of service transmission is ensured without the identity information of the terminal being leaked.
  • the PCF may send information corresponding to the hidden second identity information to the SMF, so that the SMF saves the hidden second identity information and information corresponding to the second identity information.
  • the PCF needs to send a message (such as a notification message) to the SMF
  • the hidden second identity information is sent to the SMF, so that the SMF directly obtains the information corresponding to the second identity information according to the hidden second identity information, and
  • the obtained information performs corresponding operations. For example: update the policy corresponding to the user, or notify the UPF, or send a Quality of Service (QoS) change to the access network device.
  • QoS Quality of Service
  • the hidden identity information can be directly sent to the SMF, and the hidden identity information does not need to be decrypted by the decryption function entity, and then the information is sent to the SMF, which reduces the third network element. Processing power consumption and signaling overhead with other network elements.
  • the AMF includes a hardware structure and / or a software module corresponding to each function.
  • this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is performed by hardware or computer software-driven hardware depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
  • the functional modules of the communication device performing the foregoing method may be divided according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of the modules in the embodiments of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • FIG. 9 shows a structural diagram of a communication device.
  • the communication device may select a network element (such as NSSF) for a slice or a chip or a system on a chip in a network element for a slice, and may also be a network storage network element (such as NRF) Or a chip or system-on-chip in a network storage network element; or an access and mobility management network element (such as AMF) or a chip or system-on-chip in an access and mobility management network element, the communication device may be used to execute Functions of the terminal involved in the above embodiments.
  • the communication device shown in FIG. 9 includes: an obtaining unit 90 and a determining unit 91;
  • the obtaining unit 90 is configured to obtain a first parameter for determining a domain to which a network slice belongs; for example, the obtaining unit 90 supports the communication device shown in FIG. 9 to perform step 402 or step 502 or step 601.
  • a judging unit 91 is configured to judge whether a network slice is managed by an operator according to a first parameter.
  • the judging unit 91 is configured to support the communication device shown in FIG. 9 to perform step 403, step 503, or step 604.
  • a slice selection network element such as NSSF
  • a chip or a system on a chip in the slice selection network element or a network storage network element (such as NRF) or a network storage network element is selected.
  • the communication device may further include: a sending unit 92;
  • the sending unit 92 is configured to send instruction information to the access and mobility management network element.
  • the related description of the instruction information is as described above, and details are not described herein again.
  • the sending unit 92 is configured to support the communication device shown in FIG. 9 to perform steps 404 and 504.
  • the communication device provided in the embodiment of the present application is configured to perform a function of the communication device in the foregoing processing method of identity information, and thus can achieve the same effect as the foregoing processing method of identity information.
  • the communication device shown in FIG. 9 may include a processing module and a communication module.
  • the obtaining unit 90 and the judging unit 91 are integrated in a processing module, and the sending unit 92 is integrated in a communication module.
  • the processing module is used to control and manage the actions of the communication device.
  • the processing module is used to support the communication device to support step 403 or step 503 or step 604 and other processes that perform the techniques described herein.
  • the communication module is configured to support the communication device to perform steps 404 and 504 and communicate with other network entities, such as communication with the functional module or network entity shown in FIG. 1.
  • the communication device may further include a storage module for storing program code and data of the communication device.
  • the processing module may be a processor or a controller. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • a processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication module may be a transceiver circuit or a communication interface.
  • the memory module may be a memory. When the processing module is a processor, the communication module is a communication interface, and the storage module is a memory, the communication device shown in FIG. 9 may be the communication device shown in FIG. 3.
  • FIG. 10 shows a structure diagram of a communication device.
  • the communication device may be a network edge protection agent (such as SEEP) or a chip or a system on a chip in the network edge protection agent, and may also be a visited session management network element ( For example: vSMF) or the chip or system-on-chip in the visited session management network element; it may also be an access and mobility management network element (such as AMF) or a chip or system-on-chip in the access and mobility management network element.
  • the communication device may be configured to perform functions of the terminal involved in the foregoing embodiments.
  • the communication device shown in FIG. 10 includes: a determining unit 100, a hiding unit 101, and a sending unit 102.
  • the determining unit 100 is configured to determine whether to hide the first identity information of the terminal; for example, the determining unit 100 is configured to support the communication device shown in FIG. 10 to perform step 701.
  • the hiding unit 101 is configured to hide the first identity information to obtain the second identity information when the first identity information of the hidden terminal is determined; for example, the hiding unit 101 is configured to support the communication device shown in FIG. 10 to execute step 702.
  • the sending unit 102 is configured to send the second identity information to the session management network element.
  • the sending unit 102 is configured to support the communication device shown in FIG. 10 to execute step 703.
  • the communication device may further include: a receiving unit 103;
  • the receiving unit 103 is configured to receive instruction information sent by a slice selection network element or a network storage network element.
  • the related description of the instruction information is as described above, and details are not described herein again.
  • the determining unit 100 is specifically configured to determine whether to hide the first identity information of the terminal according to the instruction information.
  • the communication device provided in the embodiment of the present application is configured to perform a function of the communication device in the foregoing processing method of identity information, and thus can achieve the same effect as the foregoing processing method of identity information.
  • the communication device shown in FIG. 10 may include a processing module and a communication module.
  • the processing module is integrated with a determination unit 100 and a hidden unit 101; the communication module is integrated with a receiving unit 103 and a sending unit 102.
  • the processing module is used to control and manage the actions of the communication device.
  • the processing module is used to support the communication device to support steps 701, 702, and other processes that perform the techniques described herein.
  • the communication module is configured to support the communication device to perform step 703 and communicate with other network entities, such as communication with the functional module or network entity shown in FIG. 1.
  • the communication device may further include a storage module for storing program code and data of the communication device.
  • the processing module may be a processor or a controller. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • a processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication module may be a transceiver circuit or a communication interface.
  • the memory module may be a memory. When the processing module is a processor, the communication module is a communication interface, and the storage module is a memory, the communication device shown in FIG. 10 may be the communication device shown in FIG. 3.
  • FIG. 11 shows a structural diagram of a communication device.
  • the communication device may be a policy control network element (such as a PCF) or a chip or a system on a chip in the policy control network element, and may also be a charging network element (such as a CHF). ) Or a chip or system-on-chip in a charging network element; or a data management network element (such as a UDM) or a chip or system-on-chip in a data management network element.
  • the communication device may be configured to perform functions of the terminal involved in the foregoing embodiments.
  • the communication device shown in FIG. 11 includes: a receiving unit 110, a sending unit 111, and an obtaining unit 112.
  • the receiving unit 110 is configured to receive the identity information of the terminal and an indication used to indicate that the identity information of the terminal is hidden identity information sent by the session management network element.
  • the receiving unit 110 is configured to support the execution of the communication device shown in FIG. 11. Step 802.
  • the sending unit 111 is configured to send a decryption request to the decryption function entity according to the instruction, where the decryption request includes the identity information of the terminal, and the decryption request is used to request the identity information of the terminal; for example, the sending unit 111 is configured to support the The communication device executes step 803.
  • the receiving unit 110 is further configured to receive the decrypted identity information from the decryption function entity.
  • the receiving unit 110 is configured to support the communication device shown in FIG. 11 to perform step 804.
  • the obtaining unit 112 is configured to obtain data corresponding to the decrypted identity information.
  • the sending unit 111 is further configured to send data to a session management network element.
  • the sending unit 111 is configured to support the communication device shown in FIG. 11 to execute step 805.
  • the communication device provided in the embodiment of the present application is configured to perform a function of the communication device in the foregoing processing method of identity information, and thus can achieve the same effect as the foregoing processing method of identity information.
  • the communication device shown in FIG. 11 may include a processing module and a communication module.
  • the processing module is integrated with an acquisition unit 112; the communication module is integrated with a receiving unit 110 and a sending unit 111.
  • the processing module is used to control and manage the actions of the communication device.
  • the processing module is used to support the communication device to obtain data corresponding to the decrypted identity information and perform other processes of the technology described herein.
  • the communication module is used to support the communication device to perform steps 802, 803, 804, and 805 and communication with other network entities, such as communication with the functional module or network entity shown in FIG. 1.
  • the communication device may further include a storage module for storing program code and data of the communication device.
  • the processing module may be a processor or a controller. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • a processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication module may be a transceiver circuit or a communication interface.
  • the memory module may be a memory. When the processing module is a processor, the communication module is a communication interface, and the storage module is a memory, the communication device shown in FIG. 11 may be the communication device shown in FIG. 3.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, a computer, a server, or a data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more servers, data centers, and the like that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种身份信息的处理方法、设备及系统，以解决终端的身份信息被泄露的问题。该方法包括：确定是否隐藏终端的第一身份信息，在确定隐藏终端的第一身份信息的情况下，隐藏第一身份信息，得到第二身份信息，向会话管理网元发送第二身份信息。后续，会话管理网元向第三网元发送第二身份信息，第三网元接收会话管理网元发送的终端的第二身份信息后，向解密功能实体发送用于请求解密终端的第二身份信息的解密请求，从解密功能实体接收解密后的身份信息，获取与解密后的身份信息对应的数据，向会话管理网元发送数据。

Description

一种身份信息的处理方法、设备及系统
本申请要求于2018年8月9日提交中国国家知识产权局、申请号为201810904615.5、发明名称为“一种身份信息的处理方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种身份信息的处理方法、设备及系统。
背景技术
随着无线通信技术的快速发展，第五代(Fifth Generation，5G)移动通信网络(简称5G网络)应运而生，在5G网络中，为了满足不同客户(如业务提供商或者租户)的业务需求，提出了网络切片(Network Slice，NS)的概念。
其中，NS是一个用于支持特定网络能力与网络特性的逻辑隔离的网络，可以提供端到端(end to end，E2E)的网络服务。例如，终端可以向网络切片发送携带有终端的身份信息(如：用户永久标识(Subscription Permanent Identifier，SUPI))的请求消息，请求网络切片中的网络功能(Network Function，NF)为终端建立承载在网络切片上的协议数据单元(protocol data unit，PDU)会话(Session)，使终端通过PDU session接入数据网络(data network，DN)。
但是，不同网络切片所属域是不同的，当网络切片属于除运营商之外的域(如垂直行业安全域)时，将终端的身份信息发送至该网络切片，容易导致终端的身份信息泄露到垂直行业安全域的风险。
发明内容
本申请提供一种身份信息的处理方法、设备及系统，以解决终端的身份信息被泄露的问题。
为达到上述目的，本申请提供如下技术方案：
第一方面，本申请提供一种身份信息的处理方法，该方法包括：第一网元获取用于确定网络切片的所属域的第一参数，根据第一参数判断网络切片是否被运营商管理。基于该方法，可以判断网络切片是否被运营商管理，以便后续向该网络切片发送终端的身份信息时，根据该判断结果确定是否隐藏终端的身份信息，保护终端的身份信息不被泄露。如：在网络切片被运营商管理时，表示的身份信息是安全的，不用隐藏终端的身份信息；反之，在网络切片未被运营商管理时，则表示终端的网络切片位于垂直行业安全域，易泄露，需要隐藏终端的身份信息。需要说明的是，上述网络切片可以指支持终端接入的网络切片。
在第一方面的第一种可能的设计中，结合第一方面，第一网元为切片选择网元、网络贮存网元、接入和移动性管理网元中任一网元。如此，可以通过不同的网元来判断网络切片是 否被运营商管理，提高了判断的灵活性。
在第一方面的第二种可能的设计中，结合第一方面或第一方面的第一种可能的设计，当第一网元为切片选择网元或者网络贮存网元时，该方法还包括：第一网元向接入和移动性管理网元发送指示信息，该指示信息用于指示网络切片是否被运营商管理；或者，用于指示是否隐藏终端的第一身份信息；或者，用于指示网络切片的所属域是否与运营商安全域属于同一安全域。如此，接入和移动性管理网元可以通过其他网元发送的指示信息判断网络切片是否被运营商管理。
在第一方面的第三种可能的设计中，结合第一方面或第一方面的任一种可能的设计，第一参数包括：网络切片对应的NSSAI、终端的TAI、终端的业务类型中的至少一种参数。
其中，在第一网元为切片选择网元时，第一网元可以接收接入和移动性管理网元发送的第一参数，第一参数可以包括在切片选择请求中。
在第一网元为网络贮存网元时，第一网元可以接收接入和移动性管理网元发送的第一参数，第一参数可以包括在NF发现请求中。
在第一网元为接入和移动性管理网元时，第一网元可以接收终端发送的第一参数，其中，第一参数可以包括在会话建立请求或者会话更新请求或者注册请求中。
第二方面，本申请提供一种通信装置，该通信装置可以为通信网络中的第一网元，第一网元可以为切片选择网元或者切片选择网元中的芯片或者片上系统，还可以为网络贮存网元或者网络贮存网元中的芯片或者片上系统；也可以为接入和移动性管理网元或者接入和移动性管理网元中的芯片或者片上系统。该通信装置可以实现上述各方面或者各可能的设计中通信装置所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的模块。如：该通信装置可以包括：获取单元，判断单元；
获取单元，用于获取用于确定网络切片的所属域的第一参数；
判断单元，用于根据第一参数判断网络切片是否被运营商管理。
其中，通信装置的具体实现方式可以参考第一方面或第一方面的任一种可能的设计提供的身份信息的处理方法中通信装置的行为功能，在此不再重复赘述。因此，该提供的通信装置可以达到与第一方面或者第一方面的任一种可能的设计相同的有益效果。
第三方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该通信装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该通信装置执行如上述第一方面或者第一方面的任一种可能的设计所述的身份信息的处理方法。
第四方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第五方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第六方面，提供了一种芯片系统，该芯片系统包括处理器、通信接口，用于支持通信装置实现上述方面中所涉及的功能，例如处理器获取用于确定网络切片的所属域的第一参数，根据第一参数判断网络切片是否被运营商管理。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第三方面至第六方面中任一种设计方式所带来的技术效果可参见上述第一方面或者第一方面的任一种可能的设计所带来的技术效果，不再赘述。
第七方面，本申请提供又一种身份信息的处理方法，该方法包括：第二网元确定是否隐藏终端的第一身份信息，在第二网元确定隐藏终端的第一身份信息的情况下，第二网元隐藏第一身份信息，得到第二身份信息，并向会话管理网元发送第二身份信息。基于该方法，第二网元可以将需要隐藏的终端的身份信息进行隐藏后发送至会话管理网元，保护终端的身份信息在发往垂直行业安全域时不被泄露。
在第七方面的第一种可能的设计中，结合第七方面，第二网元为接入和移动性管理网元、网络边缘保护代理、拜访地会话管理网元中任一网元。如此，可以通过不同网元隐藏终端的身份信息，提高了终端的身份信息隐藏的灵活性。
在第七方面的第二种可能的设计中，结合第七方面或第七方面的第一种可能的设计，第二网元确定是否隐藏终端的第一身份信息，包括：第二网元接收指示信息，根据指示信息确定是否隐藏终端的第一身份信息；指示信息用于指示网络切片是否被运营商管理；或者，指示信息用于指示是否隐藏终端的第一身份信息；或者，指示信息用于指示网络切片的所属域是否与运营商安全域属于同一安全域。
需要说明的是，当第二网元为接入和移动性管理网元时，第二网元自己可以判断网络切片是否被运营商管理，并根据自身的判断结果确定是否隐藏终端的第一身份信息。
在第七方面的第三种可能的设计中，根据第七方面或第七方面的任一种可能的设计，第二网元隐藏第一身份信息，得到第二身份信息，包括：第二网元利用公钥加密终端的第一身份信息，得到第二身份信息；或者，第二网元利用共享密钥加密终端的第一身份信息，得到第二身份信息；或者，第二网元根据共享密钥以及密钥推衍函数得到新的密钥，利用新的密钥加密终端的第一身份信息，得到第二身份信息；或者，第二网元随机化终端的第一身份信息，得到第二身份信息；或者，第二网元将终端的第一身份信息对应的GPSI作为第二身份信息。如此，可以通过多种方式隐藏终端的身份信息，提高了隐藏的灵活性。
第八方面，本申请提供一种通信装置，该通信装置可以为通信网络中的第二网元，第二网元可以为网络边缘保护代理或者网络边缘保护代理中的芯片或者片上系统，还可以为拜访地会话管理网元或者拜访地会话管理网元中的芯片或者片上系统；也可以为接入和移动性管理网元或者接入和移动性管理网元中的芯片或者片上系统。该通信装置可以实现上述第七方面或者第七方面的各可能的设计中通信装置所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的模块。如：该通信装置可以包括：确定单元、隐藏单元、发送单元。
确定单元，用于确定是否隐藏终端的第一身份信息；
隐藏单元，用于确定隐藏终端的第一身份信息的情况下，隐藏第一身份信息，得到第二身份信息；
发送单元，用于向会话管理网元发送第二身份信息。
其中，通信装置的具体实现方式可以参考第七方面或第七方面的任一种可能的设计提供的身份信息的处理方法中通信装置的行为功能，在此不再重复赘述。因此，该提供的通信装置可以达到与第七方面或者第七方面的任一种可能的设计相同的有益效果。
第九方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该通信装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该通信装置执行如上述第七方面或者第七方面的任一种可能的设计所述的身份信息的处理方法。
第十方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第七方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第十一方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第七方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第十二方面，提供了一种芯片系统，该芯片系统包括处理器、通信接口，用于支持通信装置实现上述方面中所涉及的功能，例如处理器确定是否隐藏终端的第一身份信息，在确定隐藏终端的第一身份信息的情况下，隐藏第一身份信息，得到第二身份信息，并通过通信接口向会话管理网元发送第二身份信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第九方面至第十二方面中任一种设计方式所带来的技术效果可参见上述第七方面或者第七方面的任一种可能的设计所带来的技术效果，不再赘述。
第十三方面，本申请提供一种身份信息的处理方法，所述方法包括：第三网元接收会话管理网元发送的终端的身份信息以及用于指示终端的身份信息为隐藏后的身份信息的指示；第三网元根据指示向解密功能实体发送解密请求，其中，解密请求包括终端的身份信息，解密请求用于请求解密终端的身份信息；第三网元从解密功能实体接收解密后的身份信息，获取与解密后的身份信息对应的数据，向会话管理网元发送数据。基于该方法，在第三网元接收到的身份信息为隐藏后的身份信息的情况下，请求解密功能实体对隐藏后的身份信息进行解密，获取与解密后的身份信息对应的数据，并将获取到的数据发送给会话管理网元，以便会话管理网元根据接收的数据实现PDU session上的业务传输。如此，在终端的身份信息不被泄露的情况下，保证了业务传输的连续性。
在第十三方面的第一种可能的设计中，结合第十三方面，第三网元为策略控制网元、计费网元、数据管理网元中任一网元。如此，不同网元接收到隐藏后的身份信息后，可以请求其他网元解密终端的身份信息。
在第十三方面的第二种可能的设计中，结合第十三方面或者第十三方面的第一种可能的设计，解密功能实体为接入和移动性管理网元、数据管理网元、网络贮存网元、计费网元、 策略控制网元、认证鉴权网元中任一网元。如此，可以通过不同网元解密隐藏后的终端的身份信息，增加解密终端的身份信息的灵活性。
在第十三方面的第二种可能的设计中，结合第十三方面或者第十三方面的任一种可能的设计，所述方法还包括：第三网元向会话管理网元发送隐藏后的第二身份信息对应的信息，以便会话管理网元保存隐藏后的第二身份信息以及第二身份信息对应的信息。如此，可以在第三网元通知会话管理网元发送信息的情况下，直接向会话管理网元发送隐藏后的身份信息即可，无需通过解密功能实体解密隐藏后的身份信息后，再向会话管理网元发送信息，降低了第三网元的处理功耗以及与其他网元之间的信令开销。
第十四方面，本申请提供一种通信装置，该通信装置可以为通信网络中的第三网元，第三网元可以为策略控制网元或者策略控制网元中的芯片或者片上系统，还可以为计费网元或者计费网元中的芯片或者片上系统；也可以为数据管理网元或者数据管理网元中的芯片或者片上系统。该通信装置可以实现上述第十三方面或者第十三方面的各可能的设计中通信装置所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的模块。如：该通信装置可以包括：接收单元、发送单元、获取单元。
接收单元，用于接收会话管理网元发送的终端的身份信息以及用于指示终端的身份信息为隐藏后的身份信息的指示；
发送单元，用于根据指示向解密功能实体发送解密请求，其中，解密请求包括终端的身份信息，解密请求用于请求解密终端的身份信息；
接收单元，还用于从解密功能实体接收解密后的身份信息；
获取单元，用于获取与解密后的身份信息对应的数据；
发送单元，还用于向会话管理网元发送数据。
其中，通信装置的具体实现方式可以参考第十三方面或第十三方面的任一种可能的设计提供的身份信息的处理方法中通信装置的行为功能，在此不再重复赘述。因此，该提供的通信装置可以达到与第十三方面或者第十三方面的任一种可能的设计相同的有益效果。
第十五方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该通信装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该通信装置执行如上述第十三方面或者第十三方面的任一种可能的设计所述的身份信息的处理方法。
第十六方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第十三方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第十七方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第十三方面或者上述方面的任一种可能的设计所述的身份信息的处理方法。
第十八方面，提供了一种芯片系统，该芯片系统包括处理器、通信接口，用于支持通信装置实现上述方面中所涉及的功能，例如处理器接收会话管理网元发送的终端的身份信息以 及用于指示终端的身份信息为隐藏后的身份信息的指示，根据指示向解密功能实体发送解密请求，其中，解密请求包括终端的身份信息，解密请求用于请求解密终端的身份信息；从解密功能实体接收解密后的身份信息，获取与解密后的身份信息对应的数据，向会话管理网元发送数据。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第十五方面至第十八方面中任一种设计方式所带来的技术效果可参见上述第十三方面或者第十三方面的任一种可能的设计所带来的技术效果，不再赘述。
第十九方面，本申请提供一种身份信息的处理系统，包括：如第二方面至第六方面所述的第一网元、如第八方面至第十二方面所述的第二网元、如第十四方面至第十八方面所述的第三网元。
附图说明
图1为本申请实施例提供的系统架构示意图；
图2a为本申请实施例提供的非漫游场景下的系统架构示意图；
图2b为本申请实施例提供的LOB漫游场景下的系统架构示意图；
图2c为本申请实施例提供的home routed漫游场景下的系统架构示意图；
图3为本申请实施例提供的一种通信装置的组成示意图；
图4为本申请实施例提供的一种身份信息的处理方法流程图；
图5为本申请实施例提供的又一种身份信息的处理方法流程图；
图6为本申请实施例提供的再一种身份信息的处理方法流程图；
图7为本申请实施例提供的再一种身份信息的处理方法流程图；
图8为本申请实施例提供的再一种身份信息的处理方法流程图；
图9为本申请实施例提供的一种通信装置的组成示意图；
图10为本申请实施例提供的又一种通信装置的组成示意图；
图11为本申请实施例提供的再一种通信装置的组成示意图。
具体实施方式
首先，为了便于理解本申请实施例，对本申请实施例涉及的一些技术术语进行描述：
NS：是一个具备特定网络特性的逻辑网络，不同网络切片之间逻辑上是隔离的，它可以按照需求方的要求灵活地提供一种或者多种网络服务。一个网络切片由单网络切片选择辅助信息(Single Network Slice Selection Assistance Information，S-NSSAI)来标识。
网络切片选择辅助信息(network slice selection assistance information，NSSAI)：用于指示一个或者多个网络切片，NSSAI中包括多个单NSSAI(single NSSAI，S-NSSAI)。S-NSSAI由服务类型(slice/service type，SST)和切片区分器(slice differentiator，SD)等参数组成。其中，SST包括标准化和运营商自定义的类型；SD是补充SST的可选信息，以区分相同SST的多个网络切片。需要说明的是，在本申请实施例中，可以将NSSAI简称为网络切片信息。
运营商安全域：运营商所管理的网络。
垂直行业安全域：运营商安全域之外的其他网络，即非运营商管理的网络。在本申请各实施例中，垂直行业安全域可称为业务管理域或者业务安全域等。其中一种可能的部署方式为，垂直行业安全域中与运营商安全域之间通过网络边缘保护代理(Security Edge Protection Proxy，SEPP)相互通信。如：垂直行业安全域的边缘部署有SEEP1，运营商安全域的边缘部署有SEEP2，垂直行业安全域中的网络功能(Network Function，NF)可以通过SEEP1向运营商安全域中的SEEP2发送信息，SEEP2接收到SEEP1发送的信息后，将接收到的信息发送给运营商安全域中的NF。
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请提供的技术方案可以应用于图1所示网络，该网络可以为5G网络。如图1所示，该网络可以包括：终端、接入网设备、接入和移动性管理网元、多个网络切片(如图1中的NS-1和NS-2)、切片选择网元、策略控制网元、数据管理网元、计费网元、数据网络(Data Network，DN)等。其中，每个网络切片由不同网络功能和物理资源集合而成，可以用于承载PDU session，以便终端通过该PDU session接入数据网络。一种可能的结构中，网络切片由网络贮存网元、多个管理网元、多个用户面网元组成。网络切片间相互隔离，多个网络切片可以共享同一切片选择网元、接入和移动性管理网元、数据管理网元、策略控制网元、计费网元。在图1中，不同网络切片可以均位于运营商安全域中，被运营商所管理；也可以部署在除运营商之外的网络中。例如，图1中的NS-1位于运营商安全域，NS-2位于垂直业务安全域。在图1中，每个域的边缘可以部署有SEEP，SEEP为域的通信接口，具有收发数据或信息的功能，不同域中的NF可以通过SEEP相互通信。需要说明的是，图1所示网络架构仅为示例性架构图，虽然未示出，但除图1所示网络功能外，图1所示网络还可以包括其他功能，如：认证鉴权网元(如：认证服务器功能(Authentication Server Function，AUSF))、认证信任状存储和处理功能(Authentication credential Repository and Processing Functon，ARPF)等。
其中，图1中的终端可以为用户设备(User Equipment，UE)，还可以为各种具有无线或者有线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(Personal Digital Assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(Wireless Local Loop，WLL)台、机器类型通信(Machine Type Communication，MTC)终端、移动台(Mobile Station，MS)等，不予限制。
图1中的接入网设备主要用于实现物理层功能、资源调度和无线资源管理、接入控制以及移动性管理等功能；可以为下一代基站(generation nodeB，gNB)或某种其它任一接入单元；也可能为其他具体有线网络功能的接入网设备。
图1中的切片选择网元具备选择网络切片以及识别网络切片的属性的功能，主要用于根据终端请求的NSSAI和/或终端签约的NSSAI等信息为终端选择合适的网络切片、判断选择出的网络切片是否被运营商管理等。具体的，该切片选择网元可以为网络切片选择功能(Network Slice Selection Function，NSSF)。
图1中的接入和移动性管理网元主要实现对终端的接入控制和移动性管理功能，还可以用于保护终端的身份信息(如终端的SUPI等)。具体的，该接入和移动性管理网元可以为接入和移动管理功能(Access and Mobility Management Function，AMF)。
图1中的网络贮存网元保存有网络中各个网络功能(Network Function，NF)的概况(profile)、NF支持的业务，主要用于发现NF以及判断其发现的NF所处的网络是否被运营商管理等。具体的，该网络贮存网元可以为网络仓库功能(Network Repository Function，NRF)。
图1中的会话管理网元主要用于实现用户面传输路径的建立、释放和更改等会话管理功能，还可以用于在会话管理网元为终端的拜访地会话管理网元的情况下，隐藏(hide)发往归属地会话管理网元的终端的身份信息。具体的，该会话管理网元可以为会话管理功能(Session Management，SMF)。
图1中的用户面网元主要负责用户面数据的路由转发等功能，如：负责对终端的数据报文过滤、数据传输/转发、速率控制、生成计费信息等。具体的，该用户面网元可以为用户面功能(User Plane Function，UPF)。
图1中的策略控制网元主要用于制定与终端相关的策略与计费控制规则(Policy and Charging Control Rule，PCC rule)，还可以用于在接收到会话管理网元发送的隐藏后的身份信息后，获取与隐藏后的身份信息对应的原身份信息，并向会话管理网元下发原身份信息对应的数据。具体的，该策略控制网元可以为策略控制功能(Policy Control Function，PCF)。
图1中的数据管理网元主要用于保存终端签约的数据和相关信息，还可以用于在接收到会话管理网元发送的隐藏后的身份信息后，获取与隐藏后的身份信息对应的原身份信息，并向会话管理网元下发原身份信息对应的数据。具体的，该数据管理网元可以为统一数据管理(unified data management，UDM)。
图1中的计费网元主要用于对终端的流量进行计费等，还可以用于在接收到会话管理网元发送的隐藏后的身份信息后，获取与隐藏后的身份信息对应的原身份信息，并向会话管理网元下发原身份信息对应的数据。具体的，该计费网元可以为计费控制功能(Charge Function，CHF)。
需要说明的是，上述各架构中的网元名字只是一个示例，具体实现中网元名字可能为其他名字，本申请实施例对此不作具体限定。下面以图1为5G网络，图1中的接入和移动性管理网元为AMF，切片选择网元为NSSF，网络贮存网元为NRF，会话管理网 元为AMF，策略控制网元为PCF，数据管理网元为UDM，计费网元为CHF为例，对本申请提供的身份信息的处理方法进行介绍。
如图2a所示，为终端处于非漫游场景下的系统架构图。在图2a中，终端位于归属公共陆地移动网络(Home Public Land Mobile Network，HPLMN)(简称hPLMN)中，终端可以通过hPLMN中的NS接入DN。例如：终端可以通过hPLMN中的NS-2接入DN1。
由于终端设备的的移动性，终端设备在5G网络中移动时，可能会处于图2b所示的本地分汇(Local breakout，LBO)漫游的场景或者图2c所示的归属地路由(home routed)漫游的场景，其中，LBO漫游可以指漫游终端通过拜访地的网络切片接入网络获取相应的业务，业务的提供者可以是拜访公共陆地移动网络(Public Land Mobile Network，PLMN)(简称vPLMN)。例如，如图2b所示，终端通过vPLMN中的SMF(即vSMF)接入DN1获取相应的业务，所有访问业务的终端面流量都经vPLMN中的vSMF上报给hPLMN中的PCF(即hPCF)，即：local breakout漫游下为终端服务的SMF位于拜访地。
home routed漫游是指经由归属地路由，通过拜访地的SMF与归属地SMF相连接，进行控制信令传输，并由归属地网络切片与数据网络相连接，如：图2c所示，vSMF为拜访地SMF，hSMF为拜访地SMF，终端可以通过vSMF向hSMF发送消息，hSMF可以将接收到的消息上传给PCF或者CHF或者UDM等。
在图1～图2c所示系统中，为了避免终端的身份信息(如SUPI)泄露到垂直行业安全域，在终端接入某个网络切片之前，判断该网络切片是否被运营商管理，在该网络切片被运营商管理的情况下(如：网络切片位于垂直行业安全域的情况下)，隐藏终端的身份信息，即：加密终端的身份信息，后续向该网络切片发送终端的身份信息时，发送加密后的身份信息，保护终端的身份信息不被泄露到垂直行业安全域。当网络中的某些网元(如PCF或CHF或UDM)接收到加密后的身份信息后，解密收到的身份信息，获取与解密后的身份信息对应的数据。上述隐藏终端的身份信息的操作可以为通过随机化的方式处理终端的身份信息。具体的，该方法可参照图4～图8所示。
为了实现本申请实施例提供的身份信息的处理方法，上述网络中的各个网元可以包括图3所示部件。图3为本申请实施例提供的一种通信装置的组成示意图，如图3所示，该通信装置300包括至少一个处理器301，通信线路302，以及至少一个通信接口304，还可以包括存储器303。其中，处理器301，存储器303以及通信接口304三者之间可以通过通信线路302连接。
处理器301可以是一个中央处理器(Central Processing Unit，CPU)，也可以是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个数字信号处理器(Digital Signal Processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)。
通信线路302可包括一通路，用于在上述组件之间传送信息。
存储器303可以是只读存储器(Read-Only Memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(Random Access Memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器303可以是独立存在，通过通信线路302与处理器301相连接。存储器303也可以和处理器301集成在一起。其中，存储器303用于存储执行指令或者应用程序代码，并由处理器301来控制执行，实现本申请下述实施例提供的身份信息的处理方法。
通信接口304，用于与其他设备或通信网络通信，可以使用任何收发器一类的装置，如以太网，无线接入网(Radio Access Network，RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
作为一种可实现方式，处理器301可以包括一个或多个CPU，例如图3中的CPU0和CPU1。作为另一种可实现方式，通信装置300可以包括多个处理器，例如图3中的处理器301和处理器307。作为再一种可实现方式，通信装置300还可以包括输出设备305和输入设备306。
需要说明的是，上述的通信装置300可以是一个通用设备或者是一个专用设备。例如，通信装置300可以是台式机、便携式电脑、网络服务器、PDA、移动手机、平板电脑、无线终端、嵌入式设备或有图3中类似结构的设备。本申请实施例不限定通信装置300的类型。
下面结合图2a～图2c，对本申请实施例提供的身份信息的处理方法进行具体阐述。需要说明的是，本申请下述实施例中各个网元之间的消息名字或消息中各参数的名字等只是一个示例，具体实现中也可以是其他的名字，本申请实施例对此不作具体限定。
图4为本申请实施例提供的一种身份信息的处理方法流程图，该方法可以应用于图2a或图2b或图2c所示场景中，在该方法用于图2a所示场景中时，该方法中的AMF、NSSF可以为归属地AMF(即hAMF)、归属地NSSF(即hNSSF)。在该方法用于图2b所示场景中时，该方法中的AMF、NSSF可以为图2b中的拜访地AMF(即vAMF)、拜访地NSSF(即vNSSF)。在该方法用于图2c所示场景中时，该方法中的AMF、NSSF可以为图2c中的拜访地AMF(即vAMF)、归属地NSSF(即hNSSF)。如图4所示，该方法可以包括：
步骤401：终端向AMF发送第一请求消息。
其中，该AMF可以为默认AMF。终端可以通过接入网设备向AMF发送第一请求消息。
其中，第一请求消息可以用于请求AMF为终端建立网络接入；还可以用于指示AMF在网络切片位于垂直行业安全域的情况下，隐藏发往网络切片的终端的身份信息。
第一请求消息可以为会话建立请求或者会话更新请求或者注册请求，不予限制。第一请求消息可以包括终端的第一身份信息以及终端请求的NSSAI，还可以包括其他信息，如：终端的设备类型、终端的业务标识、终端的业务类型参数等；又可以包括隐藏指示，该隐藏指示可以用于指示AMF在网络切片位于垂直行业安全域的情况下，隐藏发往该网络切片的终端的身份信息。需要说明的是，第一请求消息也可以不包括隐藏指示，当AMF接收到包括终端的第一身份信息的第一请求消息时，默认在网络切片位于垂直行业安全域的情况下，隐藏发往该网络切片的终端的第一身份信息。
本申请各实施例中，终端的第一身份信息可以为终端的用户永久标识(Subscription Permanent Identifier，SUPI)，或者终端的国际移动用户识别码(International Mobile Subscriber Identity，IMSI)，或者终端的全球唯一临时标识(Globally Unique Temporary Identifier，GUTI)，或者终端的临时移动用户标识符(Temporary Mobile Subscriber Identity，TMSI)(如：系统架构演进临时移动用户标识符(S-TMSI)或者移动管理功能临时移动用户标识符(M-TMSI)或者分组域用户临时标识符(P-TMSI))，或者终端的IP多媒体私有标识(IP Multimedia Private Identity，IMPI)，或者终端的IP多媒体共有标识(IP Multimedia Public Identity，IMPU)，或者终端的国际移动台设备标识(International Mobile Station Equipment Identity，IMEI)等，不予限制。
步骤402：AMF接收第一请求消息，向NSSF发送切片选择请求。
其中，切片选择请求可以用于请求NSSF选择支持终端接入的网络切片，切片选择请求可以包括终端请求的NSSAI，还可以包括终端的SUPI对应的公共陆地移动网标识(Public Land Mobile Network Identity，PLMN ID)、终端的路由区域标识(Tracking Area Identity，TAI)、终端的设备类型、终端的业务标识、终端的业务类型参数中的一种或多种信息。
可选的，步骤402中，当AMF接收到第一请求消息后，若AMF自身不能为终端选择出合适的网络切片，则向NSSF发送切片选择请求；若AMF自身可以为终端选择出合适的网络切片，则不向NSSF发送切片选择请求。具体的，AMF可以通过现有技术判断自身是否可以为终端选择出合适的网络切片，本申请实施例对此不予赘述。
在图4所示方法应用于图2a或图2b所示场景下时，AMF可以通过AMF与NSSF之间的通信接口(如：服务化接口Nnssf)直接向NSSF发送切片选择请求。在图4所示方法应用于图2c所示场景下时，如图2c所示，AMF可以向vNSSF发送切片选择请求，vNSSF接收到切片选择请求后，向hNSSF转发该切片选择请求。需要说明的是，AMF向vNSSF发送的切片选择请求与vNSSF向hNSSF发送的切片选择请求中均携带有终端请求的NSSAI，除携带NSSAI之外，AMF向vNSSF发送的切片选择请求中携带的信息可以与vNSSF向hNSSF发送的切片选择请求中携带的信息相同或不同。
步骤403：NSSF接收切片选择请求，判断网络切片是否被运营商管理。
其中，步骤403中所述的网络切片可以为NSSF选择的、支持终端接入的网络切片。具体的，NSSF选择网络切片的过程可参照现有技术，本申请实施例对此不予赘述。
其中，网络切片是否被运营商管理可以指：网络切片是否位于运营商安全域或者网 络切片的所属域与运营商安全域是否属于同一安全域。如：若终端的网络切片位于运营商安全域中，则表示网络切片被运营商管理；反之，网络切片位于运营商安全域之外(即位于垂直行业安全域中)，网络切片不被运营商管理。
需要说明的是，本申请中的下述几四种描述：网络切片是否被运营商管理、网络切片是否位于运营商安全域、发往网络切片的身份信息是否需要隐藏(或者保护)、发往(网络切片中的)NF(如：SMF)的身份信息是否需要隐藏(或者保护)、网络切片的所属域与运营商安全域是否属于同一安全域为同一概念，这四种描述形式之间可以相互替换。例如，“判断网络切片是否被运营商管理”可以描述为“判断发往(网络切片中的)NF(如：SMF)的身份信息是否需要隐藏”，还可以描述为“判断网络切片的所属域与运营商安全域是否属于同一安全域”，也可以描述为“判断网络切片是否位于运营商安全域”。此外，还可以用其他描述语言来间接表达“网络切片是否被运营商管理”，即用其可用于表达“网络切片是否被运营商管理”的语言描述也在本申请的保护范围之内。
一种可能的设计中，NSSF根据NSSAI与网络切片所属域的对应关系，确定网络切片是否被运营商管理；其中，网络切片所属域包括运营商安全域或者垂直行业安全域。例如，NSSAI1对应运营商安全域，NSSAI2对应垂直行业安全域，当NSSF选择出的网络切片对应的NSSAI为NSSAI2时，则确定网络切片位于垂直行业安全域，不被运营商管理。或者，NSSAI中包括NSSAI对应的网络切片是否属于运营商安全域的指示，NSSF根据此指示可以直接确定网络切片是否被运营商管理，如：当该指示用于指示NSSAI对应的网络切片不属于运营商安全域时，NSSF确定网络切片不位于运营商安全域，而是位于垂直行业安全域。
又一种可能的设计中，切片选择请求中包括终端的TAI，若终端的TAI指示终端位于垂直行业安全域中，则NSSF根据终端的TAI确定网络切片属于被运营商管理，反之，则确定网络切片不被运营商管理。
再一种可能的设计中，切片选择请求中包括终端的业务类型，若终端的业务类型指示终端的业务属于垂直行业业务范畴，则NSSF根据终端的业务类型确定网络切片属于被运营商管理，反之，则确定网络切片不被运营商管理。
可选的，上述网络切片等价为网络切片内的NF(如：SMF、UPF等网络功能实体)。即本申请中所述的网络切片是否被运营商管理等同于网络切片中的NF(如：SMF或者UPF)是否被运营商管理。
步骤404：NSSF向AMF发送指示信息。
其中，指示信息可以用于指示网络切片是否被运营商管理，或者用于指示是否隐藏终端的第一身份信息，或者用于指示网络切片的所属域是否与运营商安全域属于同一安全域。
以指示信息用于指示网络切片是否被运营商管理为例，该指示信息可以为二进制比特数“0”或“1”，其中，“0”表示网络切片未被运营商管理，“1”表示网络切片被运营商管理。或者，该指示信息为布尔值“true”或者“false”，“false”表示网络切片未被运营商管理，“true”表示网络切片被运营商管理。
在图4所示方法应用于图2a或图2b所示场景下时，NSSF可以通过NSSF与AMF之间的通信接口(如：服务化接口Namf)直接向AMF发送指示信息。
在图4所示方法应用于图2c所示场景下时，hNSSF向vNSSF发送指示信息，由vNSSF向AMF发送指示信息。需要说明的是，hNSSF向vNSSF发送的指示信息与vNSSF向AMF发送的指示信息可以相同，也可以不同，如：hNSSF向vNSSF发送的指示信息可以用于指示网络切片不被运营商管理，vNSSF向AMF发送的指示信息可以用于指示是否隐藏终端的身份信息。
需要说明的是，在步骤404中，NSSF还可以向AMF发送网络切片对应的NSSAI以及其他信息，不予限制。
步骤405：AMF接收指示信息。
进一步可选的，AMF接收到指示信息后，可以由自身或者其他网元根据指示信息确定是否隐藏终端的第一身份信息。具体的，根据指示信息确定是否隐藏终端的第一身份信息的过程可参照7中所示。
在图4所示的方法中，可以通过NSSF判断网络切片是否被运营商管理，并根据判断结果向AMF发送指示信息，后续，以便AMF或者其他网元根据该指示信息确定是否隐藏终端的身份信息，保护终端的身份信息不被泄露。
与图4不同的是，在又一种可实现方法中，可以通过NRF判断为终端服务的会话管理网元是否被运营商管理，具体的，该方法可参照图5所示。
图5为本申请实施例提供的又一种身份信息的处理方法，该方法可以应用于图2a或图2b或图2c所示场景中，在该方法用于图2a所示场景中时，该方法中的AMF、NRF可以为归属地AMF(即hAMF)、归属地NRF(即hNRF)。在该方法用于图2b所示场景中时，该方法中的AMF、NRF可以为图2b中的拜访地AMF(即vAMF)、拜访地NRF(即vNRF)。在该方法用于图2c所示场景中时，该方法中的AMF、NRF可以为图2c中的拜访地AMF(即vAMF)、归属地NRF(即hNRF)。如图5所示，该方法可以包括：
步骤501：终端向AMF发送第一请求消息。
其中，步骤501可参照步骤401所述，不再赘述。
步骤502：AMF接收第一请求消息，向NRF发送NF发现请求。
其中，NF发现请求中可以包括网络切片对应的NSSAI，该网络切片可以为支持终端接入的网络切片。NF发现请求可以用于请求NRF发现该NSSAI对应的网络切片中为终端服务的SMF以及判断该SMF是否被运营商管理。除包括NSSAI之外，NF发现请求还可以包括终端的SUPI对应的PLMN ID、终端的TAI、终端的设备类型、终端的业务标识、终端的业务类型参数中的一种或多种信息。
可选的，步骤502中，当AMF接收到第一请求消息，且选择出网络切片后，若AMF自身不能从该网络切片中选择出为终端服务的SMF，则向NRF发送NF发现请求；若AMF自身可以从该网络切片中选择出为终端服务的SMF，则不向NSSF发送切片选择请求。具体的，AMF可以采用现有技术判断自身是否可以选择出为终端服务的SMF，本 申请实施例对此不予赘述。其中，在图2c所示场景下，AMF选择出的网络切片为拜访地网络切片。
在图5所示方法应用于图2a或图2c所示场景下时，AMF可以通过AMF与NRF之间的通信接口(如：服务化接口Nnrf)直接向NRF发送NF发现请求。在图4所示方法应用于图2c所示场景下时，如图2c所示，AMF可以向vNRF发送NF发现请求，vNRF接收到NF发现请求后，向hNRF转发该NF发现请求；其中，vNRF为AMF选择出的拜访地网络切片中的NRF，hNRF为与该拜访地网络切片相对应的归属地网络切片中的NRF。需要说明的是，AMF向vNRF发送的NF发现请求与vNRF向hNRF发送的NF发现请求中均携带有终端请求的NSSAI，除携带NSSAI之外，AMF向vNRF发送的NF发现请求中携带的信息可以与vNRF向hNRF发送的NF发现请求中携带的信息相同或者不同。
步骤503：NRF接收NF发现请求，判断SMF是否被运营商管理。
其中，步骤503中所述的SMF可以是NRF从支持终端接入的网络切片中选择出的、为终端服务的SMF，也可以为其他能够为终端服务的SMF。其中，NRF选择为终端服务的SMF的过程可参照现有技术，本申请实施例对此不予赘述。需要说明的是，在图2c所示场景下，NRF选择出的SMF为归属地SMF(hSMF)。
在SMF是NRF从支持终端接入的网络切片中选择出的、为终端服务的SMF的情况下，NRF判断SMF是否被运营商管理的过程可以包括：NRF判断NF发现请求中包括的NSSAI对应的网络切片是否被运营商管理，若被运营商管理，则确定选择出的SMF被运营商管理，反之，则确定选择出的SMF不被运营商管理。NRF判断NF发现请求中包括的NSSAI对应的网络切片是否被运营商管理的过程可参照步骤403中NSSF判断网络切片是否被运营商管理的过程，不再赘述。
在步骤503中的SMF为其他SMF的情况下，NRF可以根据SMF的地址信息判断该SMF是否被运营商管理。如：NRF可以查看运营商管理的所有地址信息，若该SMF的地址信息包括在运营商管理的地址信息的范围之内，则确定该SMF被运营商管理，反之，则确定该SMF不被运营商管理。其中，SMF的地址信息用于标识该SMF，可以为SMF的因特网协议(Internet Protocol，IP)地址，或者SMF全量域名(fully qualified domain name，FQDN)，或者SMF实例的信息，或者SMF业务实例的地址等。
需要说明的是，SMF是否被运营商管理、SMF所在的网络切片是否被运营商管理、SMF所在的网络切片是否位于运营商安全域、发往SMF的身份信息是否需要隐藏(或者保护)、发往SMF所在的网络切片的身份信息是否需要隐藏(或者保护)、SMF所在的网络切片的所属域与运营商安全域是否属于同一安全域为同一概念，这几种描述形式之间可以相互替换。例如，以SMF为支持终端接入的网络切片中的SMF为例，“判断SMF是否被运营商管理”可以描述为“判断终端接入的网络切片是否被运营商管理”，还可以描述为“判断终端接入的网络切片与运营商安全域是否属于同一安全域”等，不予限制。此外，还可以用其他描述语言来间接表达“SMF是否被运营商管理”，即用其可用于表达“SMF是否被运营商管理”的语言描述也在本申请的保护范围之内。
步骤504：NRF向AMF发送SMF的地址信息以及指示信息。
其中，步骤504中的指示信息可以用于指示SMF是否被运营商管理，或者用于指示是否隐藏发往该SMF的终端的第一身份信息，或者用于指示SMF的所属域是否与运营商安全域属于同一安全域。该指示信息的具体表示形式可参照步骤404中所述，不再赘述。
在图5所示方法应用于图2a或图2b所示场景下时，NRF可以通过NRF与AMF之间的通信接口(如：服务化接口Namf)直接向AMF发送SMF的地址信息以及指示信息。
在图5所示方法应用于图2c所示场景下时，hNRF向vNRF发送SMF的地址信息以及指示信息，由vNRF向AMF发送SMF的地址信息以及指示信息。需要说明的是，hNRF向vNRF发送的指示信息与vNRF向AMF发送的指示信息可以相同，也可以不同，如：hNRF向vNRF发送的指示信息可以用于指示SMF不被运营商管理，vNRF向AMF发送的指示信息可以用于指示隐藏发往SMF的终端的第一身份信息。
步骤505：AMF接收SMF的地址信息以及指示信息。
进一步可选的，AMF接收到指示信息后，可以由自身或者其他网元根据指示信息确定是否隐藏终端的第一身份信息。具体的，根据指示信息确定是否隐藏终端的第一身份信息的过程可参照7中所示。需要说明的是，在图5所示方法中，NRF也可以仅向AMF发送SMF的地址信息，后续，AMF接收到SMF的地址信息后，根据SMF的地址信息确定SMF是否被运营商管理。如：若SMF的地址信息包括在运营商所管理的地址信息的范围内，则确定SMF被运营商管理，反之，则确定SMF不被运营商管理。
在图5所示的方法中，可以通过NRF判断网络切片中的SMF是否被运营商管理，并根据判断结果向AMF发送指示信息，后续，便于AMF或者其他网元根据该指示信息确定是否隐藏终端的身份信息，保护终端的身份信息不被泄露。
与图4或图5所示方法不同的是，再一种可实现方法中，可以通过AMF自身判断网络切片是否被运营商管理。具体的，该可实现方法可参照图6中所示。
图6为本申请实施例提供的再一种身份信息的处理方法，该方法可以应用于图2a或图2b或图2c所示场景中，在该方法用于图2a所示场景中时，该方法中的AMF、UDM可以为归属地AMF(即hAMF)、归属地UDM。在该方法用于图2b所示场景中时，该方法中的AMF可以为图2b中的拜访地AMF(即vAMF)，UDM可以为归属地UDM。在该方法用于图2c所示场景中时，该方法中的AMF可以为图2c中的拜访地AMF(即vAMF)，UDM可以为归属地UDM。如图6所示，该方法可以包括：
步骤601：终端向AMF发送第一请求消息。
其中，步骤601可参照步骤401所述，不再赘述。
步骤602：AMF接收第一请求消息，向UDM发送数据请求。
其中，数据请求中可以包括终端的第一身份信息，数据请求可以用于请求终端的签约数据。该数据请求可以为Nudm消息，
步骤603：UDM获取终端的签约数据，向AMF发送获取到的终端的签约数据。
其中，终端的签约数据可以包括终端签约的NSSAI，或者终端签约的数据网络的名称(Data Network Name，DNN)，或者，终端签约的NSSAI以及终端签约的NSSAI是否被运营商管理间的对应关系，或者终端签约的DNN以及终端签约的DNN是否被运营管理间的对应关系。
步骤604：AMF接收终端签约的数据，根据终端签约的数据以及终端请求的NSSAI，判断网络切片是否被运营商管理。
其中，该网络切片可以为支持终端接入的网络切片。AMF可以根据终端签约的数据以及终端请求的NSSAI确定支持终端接入的网络切片，其具体实现方式可参照现有技术，不再赘述。
具体的，AMF判断网络切片是否被运营商管理的过程可参照步骤403中NSSF判断网络切片是否被运营商管理的过程，不再赘述。除参照步骤403之外，AMF还可以根据网络切片对应的DNN，根据该DNN是否被运营商管理，判断网络切片是否被运营商管理，如：若DNN被运营商管理，则确定网络切片被运营商管理，反之，则确定网络切片不被运营商管理。
进一步可选的，AMF判断网络切片是否被运营商管理后，可以由自身或者其他网元确定是否隐藏终端的第一身份信息。具体的，确定是否隐藏终端的第一身份信息的过程可参照7中所示。
在图6所示的方法中，可以通过AMF判断网络切片是否被运营商管理，后续，便于AMF或者其他网元根据AMF的判断结果确定是否隐藏终端的身份信息，保护终端的身份信息不被泄露。
以上图4～图6主要对网络切片或者SMF是否被运营商管理进行了描述。接下来，在网络切片或者SMF被运营商管理的情况下，隐藏终端的第一身份信息，反之，则直接向网络切片中的SMF发送终端的第一身份信息。具体的，该过程可参照图7所示。
图7为本申请提供的一种身份信息的处理方法流程示意图，该方法可以应用于图2a或图2b或图2c所示场景中，在该方法用于图2a所示场景中时，该方法中的AMF、SMF可以为归属地AMF(即hAMF)、归属地SMF。在该方法用于图2b所示场景中时，该方法中的AMF可以为图2b中的拜访地AMF(即vAMF)，SMF可以为拜访地SMF(vSMF)。在该方法用于图2c所示场景中时，该方法中的AMF可以为图2c中的拜访地AMF(即vAMF)，SMF可以为归属地SMF(hSMF)。如图7所示，所述方法包括：
步骤701：AMF确定是否隐藏终端的第一身份信息。
一种可能的设计中，AMF根据从NSSF或者NRF接收到的指示信息确定是否隐藏终端的第一身份信息；其中，指示信息的相关描述可参照图4或图5中所述，不再赘述。
例如，若指示信息用于指示网络切片被运营商管理，则确定不隐藏终端的第一身份信息，反之，则确定隐藏终端的第一身份信息。或者，若指示信息用于指示隐藏终端的第一身份信息，则直接确定隐藏终端的第一身份信息，反之，则确定不隐藏终端的第一 身份信息。
又一种可能的设计中，AMF根据本地预设策略确定是否隐藏终端的第一身份信息，如：AMF可以采用图6所示方法确定是否隐藏终端的第一身份信息。
需要说明的是，本申请不限制AMF确定是否隐藏终端的第一身份信息的实现方式。
步骤702：在AMF确定隐藏终端的第一身份信息的情况下，隐藏终端的第一身份信息得到第二身份信息。
在本申请各实施例中，隐藏可以指加密或者封装或者保护。第二身份信息可以为隐藏后的终端的身份信息，第二身份信息可以与终端的第一身份信息对应。
具体的，AMF可以通过下述几种方式隐藏终端的第一身份信息，得到第二身份信息：
方式一：利用公钥加密终端的第一身份信息，得到第二身份信息。
方式二：利用共享密钥加密终端的第一身份信息，得到第二身份信息。其中，共享密钥预先配置在隐藏终端的第一身份信息的网元(如AMF)上和解密第二身份信息的网元上。
方式三：AMF根据共享密钥衍生出新的密钥，利用新的密钥加密终端的第一身份信息，得到第二身份信息。
例如：新的密钥K_SST＝KDF(K)，或者K_SST＝KDF(K，SST)，其中，K为共享密钥，SST为NSSAI包括的切片信息，KDF为密钥推衍函数。共享密钥K预先配置在隐藏终端的第一身份信息的网元(如AMF)上和解密第二身份信息的网元(如图8中所示的解密功能实体)上。
需要说明的是，上述密钥推衍函数内的参数，除了K，SST之外，还可能包括切片ID，会话ID中的至少一项；也可以包括时间，计算器，序列号，随机数(nonce)等。在方式三中，AMF需要将AMF与解密第二身份信息的网元间没有共享的参数(如：切片ID，时间，计算器，序列号，随机数(nonce)等)发送至SMF，以便SMF将这些没有共享的参数发送至解密第二身份信息的网元，以使得解密第二身份信息的网元使用相同推衍函数和推衍参数得到K_SST，进而根据K_SST解密第二身份信息，得到终端的第一身份信息。
方式四：AMF随机化终端的第一身份信息，得到第二身份信息。
一种可能的设计中，AMF根据hash类型函数随机化终端的第一身份信息。这里hash类型的函数可以为普通的hash类型函数(如SHA-256等)，或者媒体接入控制(Media Access Control，MAC)消息验证码(Message Authentication Code)类型的函数(如：基于哈希算法的消息验证码(Hashed Base Message Authentication，HMAC)，或者基于加密的验证码(Cipher-based MAC，CMAC)等)，不做限制。例如，以终端的第一身份信息为SUPI为例，隐藏后的身份信息＝hash(SUPI，SST)，或者hash(SUPI，SST，(nonce，序列号(sequence number)，时间(time)中的至少一项))。其中，随机数为AMF生成的任一数值。序列号为当前时刻的前一时刻AMF与SMF交互的信息的序号。时间为当前时刻AMF内定时器的时间。
又一种可能的设计中，第二身份信息由AMF的路由信息(routing information)以及AMF生成的随机数组成。例如，以终端的第一身份信息为SUPI为例，Hide(SUPI)＝AMF routing information||random number。
在方式四中，AMF保存隐藏后的第二身份信息与终端的第一身份信息的对应关系，以便后续AMF接收到解密第二身份信息的网元发送的解密请求后，根据该对应关系解密得到终端的第一身份信息。
方式五：AMF将终端的第一身份信息对应的GPSI作为隐藏后的第二身份信息。
需要说明的是，本申请中所述隐藏终端的第一身份信息可以指：将终端的第一身份信息全部隐藏或者部分隐藏，其中，部分隐藏指隐藏终端的第一身份信息中的部分信息。以终端的第一身份信息为SUPI为例，SUPI包括网络标识和身份标识两部分信息，网络标识可以为MNC，MCC，身份标识可以为MSIN，其中，网络标识可以不用隐藏，身份标识隐藏。
步骤703：AMF向SMF发送第二身份信息。
其中，第二身份信息可以包括在会话建立请求或者会话更新请求中向SMF发送。除第二身份信息之外，AMF还可以向SMF发送第二身份信息为隐藏后的身份信息的指示，以便SMF接收到该指示后，将第二身份信息以及该指示一起发送给PCF或CHF或者UDM等。
在图7所示方法应用于图2a或图2b所示场景下时，AMF可以通过AMF与SMF之间的通信接口(如：服务化接口Nsmf)直接向SMF发送第二身份信息；或者，AMF向其所在域的第一SEEP发送第二身份信息，第一SEEP接收到第二身份信息后，向SMF所在域的第二SEEP发送第二身份信息，第二SEEP接收第二身份信息，向SMF发送接收到的第二身份信息。
在图7所示方法应用于图2c所示场景下时，hAMF向vSMF发送第二身份信息，由vSMF向hSMF发送第二身份信息。
可选的，在AMF确定不隐藏终端的第一身份信息的情况下，AMF直接向SMF发送终端的第一身份信息。其中，除发送终端的第一身份信息外，AMF还可以向SMF发送第一身份信息为未隐藏的身份信息的指示。其中，AMF向SMF发送第一身份信息的过程可参照AMF向SMF发送第二身份信息的过程，不再赘述。
在本申请中，可以用“0”或“1”来指示AMF向SMF发送的身份信息是否为隐藏后的身份信息。如：“0”指示AMF向SMF发送的身份信息未隐藏，“1”指示AMF向SMF发送的身份信息被隐藏。需要说明的是，向SMF发送终端的第一身份信息的同时，AMF也可以不向SMF发送用于指示第一身份信息为未隐藏后的身份信息的指示，当SMF接收到仅包括终端的第一身份信息的消息时，默认接收到的身份信息为未隐藏后的身份信息。
可选的，在图7所示方法中，AMF根据本地策略确定是否执行图7所示步骤701以及隐藏终端的第一身份信息的过程，其中，本地策略预先配置在AMF上，本地策略用于 规定AMF在向其他网元发送终端的身份信息之前，开启或者关闭AMF的确定是否隐藏终端的身份信息的功能。在AMF确定不执行步骤701的情况下，可以通过其他网元来隐藏终端的身份信息。具体如下：
在图2a或图2b的情况下，AMF接收到NSSF或者NRF发送的指示信息，或者AMF自身判断网络切片是否被运营商管理之后，不执行步骤702～步骤703，而是向其所在的第一SEEP或者SMF所在的第二SEEP发送隐藏终端的第一身份信息的指示信息以及终端的第一身份信息，以便第一SEEP或者第二SEEP根据隐藏终端的第一身份信息的指示信息隐藏终端的第一身份信息，得到第二身份信息，并向SMF发送第二身份信息。其中，第一SEEP或第二SEEP隐藏终端的第一身份信息的过程可参照AMF隐藏终端的第一身份信息的过程，不再赘述。
在图2c的情况下，AMF接收到NSSF或者NRF发送的指示信息，或者AMF自身判断网络切片是否被运营商管理之后，AMF不执行步骤702～步骤703，而是向vSMF发送用于指示隐藏终端的第一身份信息的指示信息以及终端的第一身份信息，以便vSMF根据隐藏终端的第一身份信息的指示信息隐藏终端的第一身份信息，得到第二身份信息，并向hSMF发送第二身份信息。其中，vSMF隐藏终端的第一身份信息的过程可参照AMF隐藏终端的第一身份信息的过程，不再赘述。AMF接收到的指示信息与AMF向vSMF发送的指示信息可以相同，也可以不同，如：AMF接收到的指示信息可以为网络切片不被运营商管理，AMF向vSMF发送的指示信息可以为隐藏终端的第一身份信息。
在图7所示的方法中，可以将需要隐藏的身份信息进行隐藏后发送至SMF，保护终端的身份信息在发往垂直行业安全域时不被泄露。
SMF接收到终端的身份信息(第一身份信息或者第二身份信息)后，可以将接收到的身份信息发送至PCF或CHF或UDM，以便PCF或CHF或UDM接收SMF发送的终端的身份信息，并在终端的身份信息为隐藏后的第二身份信息的情况下，请求解密功能实体解密第二身份信息得到第一身份，并根据解密后的第一身份信息获取与终端相关的数据返回给SMF。下面结合图8，以SMF向PCF发送其接收到的终端的身份信息为例，对该过程进行介绍。其中，SMF向UDM或者CHF发送终端的身份信息的过程可参照图8所示过程。
图8为本申请提供的一种身份信息的处理方法流程图，该方法可以应用于图2a或图2b或图2c所示场景中，在该方法用于图2a所示场景中时，该方法中的SMF可以为归属地SMF，PCF可以为归属地PCF。在该方法用于图2b所示场景中时，该方法中的SMF可以为拜访地SMF(vSMF)，PCF可以为归属地PCF。在该方法用于图2c所示场景中时，该方法中的SMF可以为归属地SMF(hSMF)，PCF可以为归属地PCF。如图8所示，所述方法包括：
步骤801：SMF接收终端的身份信息。
其中，SMF接收到的身份信息可以为未隐藏的终端的第一身份信息或者隐藏后的第二身份信息。
可选的，步骤801中，SMF还接收到用于指示终端的身份信息是否为隐藏后的身份 信息的指示，以便SMF根据此指示可以判定接收到的身份信息是否为隐藏后的身份信息。或者，步骤801中，SMF接收到第二身份信息以及用于指示终端的身份信息为隐藏后的身份信息的指示，以便SMF根据此指示可以判定接收到的身份信息为隐藏后的身份信息。
步骤802：在终端的身份信息为隐藏后的第二身份信息的情况下，SMF向PCF发送第二身份信息以及用于指示第二身份信息为隐藏后的身份信息的指示。
可选的，SMF通过SEEP向PCF发送第二身份信息以及用于指示第二身份信息为隐藏后的身份信息的指示，或者，通过其与PCF的通信接口(如：服务化接口Npcf)向PCF发送第二身份信息以及用于指示第二身份信息为隐藏后的身份信息的指示。
可选的，指示第二身份信息为隐藏后的身份信息的指示也可不发。PCF可以根据接收到的身份信息判定其是否为隐藏后的身份信息；或者PCF可以根据SMF的信息(例如源SMF的地址等)判定SMF发送的身份信息是否为隐藏后的身份信息，即PCF不需要指示就可以判定其接收到的身份信息是否为隐藏后的身份信息。
步骤803：PCF接收第二身份信息以及用于指示第二身份信息为隐藏后的身份信息的指示，向解密功能实体发送解密请求。
其中，解密请求中包括第二身份信息，解密请求可以用于请求解密隐藏后的第二身份信息。
其中，解密功能实体可以为UDM、AMF、CHF、AUSF、ARPF、NRF、PCF中任一网元。需要说明的是，当解密功能实体为除自身之外的其他功能时，其中一种可选方式为，PCF获取解密功能实体的地址信息，根据解密功能实体的地址信息向解密发送解密请求。
解密功能实体的地址信息可以由解密功能实体发送给SMF，由SMF发送给PCF，如：以解密功能实体为AMF为例，解密功能实体的地址信息可以与第二身份信息包括在同一消息中发送给PCF，也可以包括在不同消息中发送给PCF。或者，PCF中预先配置有解密功能实体的地址信息，当PCF接收到第二身份信息以及用于指示第二身份信息为隐藏后的身份信息的指示时，PCF根据其内预先配置的解密功能实体的地址信息向解密功能实体发送解密请求。或者，在解密功能实体为AMF，且AMF采用方式四隐藏终端的身份信息的情况下，PCF可以根据隐藏的身份信息中AMF的路由信息来确定AMF，并请求AMF解密隐藏后的身份信息。如：Hide(SUPI)＝AMF routing information||random number，当PCF接收到Hide(SUPI)后，PCF根据AMF routing information确定AMF的地址信息，向AMF发送解密请求。
步骤804：解密功能实体接收解密请求，解密隐藏后的第二身份信息，得到终端的第一身份信息，向PCF发送终端的第一身份信息。
其中，在采用方式一隐藏终端的身份信息情况下，解密功能实体通过私钥解密隐藏后的第二身份信息，得到终端的第一身份信息。
在采用方式二隐藏终端的身份信息情况下，解密功能实体通过共享密钥解密隐藏后的第二身份信息，得到终端的第一身份信息。其中，共享密钥预先存储在解密功能实体 上。
在采用方式三隐藏终端的身份信息情况下，解密功能实体通过推衍函数和推衍参数得到共享密钥后，基于共享密钥解密隐藏后的第一身份信息，得到终端的第二身份信息。
在采用方式四隐藏终端的身份信息情况下，解密功能实体为AMF，AMF保存有隐藏后的第二身份信息与终端的第一身份信息的对应关系，根据此对应关系得到终端的第一身份信息。
在采用方式五隐藏终端的身份信息情况下，解密功能实体为AMF或UDM，解密功能实体通过终端的身份信息与GPSI的对应关系解密隐藏后的第二身份信息，得到终端的第一身份信息。
步骤805：PCF接收终端的第一身份信息，获取与第一身份份信息对应的数据，并向SMF发送获取到的数据。
需要说明的是，在终端的身份信息为第一身份信息的情况下，SMF向PCF发送第第一身份信息。PCF接收SMF发送的第一身份信息，不需要解密接收到的第一身份信息，直接获取与第一身份份信息对应的数据，并向SMF发送获取到的数据。
在图8所示方法中，在PCF接收到的身份信息为隐藏后的身份信息的情况下，请求解密功能实体对隐藏后的身份信息进行解密，获取与解密后的身份信息对应的数据，并将获取到的数据发送给SMF，以便SMF根据接收的数据实现PDU session上的业务传输。如此，在终端的身份信息不被泄露的情况下，保证了业务传输的连续性。
进一步的，在图8所示方法中，PCF可以向SMF发送隐藏后的第二身份信息对应的信息，以便SMF保存隐藏后的第二身份信息以及第二身份信息对应的信息。后续，当PCF需要向SMF发送消息(例如通知消息)时，向SMF发送隐藏后的第二身份信息，以使得SMF根据隐藏后的第二身份信息直接获取第二身份信息对应的信息，并根据获取到的信息执行相应操作。例如：更新用户对应的策略等，或者通知UPF，或者向接入网设备发送服务质量(Quanlity of Server，QoS)变更等等。如此，可以在PCF通知SMF发送信息的情况下，直接向SMF发送隐藏后的身份信息即可，无需通过解密功能实体解密隐藏后的身份信息后，再向SMF发送信息，降低了第三网元的处理功耗以及与其他网元之间的信令开销。
上述主要从AMF、SMF、NSSF、NRF各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述AMF为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对执行上述方法的通信装置进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能 模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
图9示出了的一种通信装置的结构图，该通信装置可以为切片选择网元(如NSSF)或者切片选择网元中的芯片或者片上系统，还可以为网络贮存网元(如NRF)或者网络贮存网元中的芯片或者片上系统；也可以为接入和移动性管理网元(如AMF)或者接入和移动性管理网元中的芯片或者片上系统，该通信装置可以用于执行上述实施例中涉及的终端的功能。作为一种可实现方式，图9所示通信装置包括：获取单元90，判断单元91；
获取单元90，用于获取用于确定网络切片的所属域的第一参数；如：获取单元90支持图9所示通信装置执行步骤402或者步骤502或者步骤601。
判断单元91，用于根据第一参数判断网络切片是否被运营商管理。如：判断单元91用于支持图9所示通信装置执行步骤403或者步骤503或者步骤604。
进一步的，如图9所示，在通信装置为切片选择网元(如NSSF)或者切片选择网元中的芯片或者片上系统，或者，为网络贮存网元(如NRF)或者网络贮存网元中的芯片或者片上系统时，该通信装置还可以包括：发送单元92；
发送单元92，用于向接入和移动性管理网元发送指示信息，该指示信息的相关描述如前所述，不再赘述。如：发送单元92用于支持图9所示的通信装置执行步骤404和步骤504。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。本申请实施例提供的通信装置，用于执行上述身份信息的处理方法中通信装置的功能，因此可以达到与上述身份信息的处理方法相同的效果。
作为又一种可实现方式，图9所示通信装置可以包括：处理模块和通信模块。获取单元90和判断单元91集成在处理模块中，发送单元92集成的通信模块中。处理模块用于对通信装置的动作进行控制管理，例如，处理模块用于支持该通信装置支持步骤403或者步骤503或者步骤604以及执行本文所描述的技术的其它过程。通信模块用于支持通信装置执行步骤404和步骤504以及与其他网络实体的通信，例如与图1示出的功能模块或网络实体之间的通信。进一步的，该通信装置还可以包括存储模块，用于存储通信装置的程序代码和数据。
其中，处理模块可以是处理器或控制器。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块可以是收发电路或通信接口等。存储模块可以是存储器。当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，图9所示通信装置可以为图3所示通信装置。
图10示出了的一种通信装置的结构图，该通信装置可以为网络边缘保护代理(如：SEEP)或者网络边缘保护代理中的芯片或者片上系统，还可以为拜访地会话管理网元(如：vSMF)或者拜访地会话管理网元中的芯片或者片上系统；也可以为接入和移动性管理网元(如：AMF)或者接入和移动性管理网元中的芯片或者片上系统。该通信装置可以用于执行上述实施例中涉及的终端的功能。作为一种可实现方式，图10所示通信装置包括：确定单元100、隐藏单元101、发送单元102。
确定单元100，用于确定是否隐藏终端的第一身份信息；如：确定单元100用于支持图10所示的通信装置执行步骤701。
隐藏单元101，用于在确定隐藏终端的第一身份信息的情况下，隐藏第一身份信息，得到第二身份信息；如：隐藏单元101用于支持图10所示的通信装置执行步骤702。
发送单元102，用于向会话管理网元发送第二身份信息。如：发送单元102用于支持图10所示的通信装置执行步骤703。
进一步的，如图10所示，该通信装置还可以包括：接收单元103；
所述接收单元103，用于接收切片选择网元或者网络贮存网元发送的指示信息，该指示信息的相关描述如前所述，不再赘述。
确定单元100，具体用于根据该指示信息确定是否隐藏终端的第一身份信息。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。本申请实施例提供的通信装置，用于执行上述身份信息的处理方法中通信装置的功能，因此可以达到与上述身份信息的处理方法相同的效果。
作为又一种可实现方式，图10所示通信装置可以包括：处理模块和通信模块。处理模块集成有确定单元100、隐藏单元101；通信模块集成有接收单元103、发送单元102。处理模块用于对通信装置的动作进行控制管理，例如，处理模块用于支持该通信装置支持步骤701、步骤702以及执行本文所描述的技术的其它过程。通信模块用于支持通信装置执行步骤703以及与其他网络实体的通信，例如与图1示出的功能模块或网络实体之间的通信。进一步的，该通信装置还可以包括存储模块，用于存储通信装置的程序代码和数据。
其中，处理模块可以是处理器或控制器。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块可以是收发电路或通信接口等。存储模块可以是存储器。当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，图10所示通信装置可以为图3所示通信装置。
图11示出了的一种通信装置的结构图，该通信装置可以为策略控制网元(如：PCF)或者策略控制网元中的芯片或者片上系统，还可以为计费网元(如CHF)或者计费网元中的芯片或者片上系统；也可以为数据管理网元(如UDM)或者数据管理网元中的芯片或者片上系统。该通信装置可以用于执行上述实施例中涉及的终端的功能。作为一种可实现方式，图11所示通信装置包括：接收单元110、发送单元111、获取单元112。
接收单元110，用于接收会话管理网元发送的终端的身份信息以及用于指示终端的身份信息为隐藏后的身份信息的指示；如：接收单元110用于支持图11所示的通信装置执行步骤802。
发送单元111，用于根据指示向解密功能实体发送解密请求，其中，解密请求包括终端的身份信息，解密请求用于请求解密终端的身份信息；如：发送单元111用于支持 图11所示的通信装置执行步骤803。
接收单元110，还用于从解密功能实体接收解密后的身份信息；如：接收单元110用于支持图11所示的通信装置执行步骤804。
获取单元112，用于获取与解密后的身份信息对应的数据。
发送单元111，还用于向会话管理网元发送数据。如：发送单元111用于支持图11所示的通信装置执行步骤805。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。本申请实施例提供的通信装置，用于执行上述身份信息的处理方法中通信装置的功能，因此可以达到与上述身份信息的处理方法相同的效果。
作为又一种可实现方式，图11所示通信装置可以包括：处理模块和通信模块。处理模块集成有获取单元112；通信模块集成有接收单元110、发送单元111。处理模块用于对通信装置的动作进行控制管理，例如，处理模块用于支持该通信装置获取与解密后的身份信息对应的数据以及执行本文所描述的技术的其它过程。通信模块用于支持通信装置执行步骤802、步骤803、步骤804、步骤805以及与其他网络实体的通信，例如与图1示出的功能模块或网络实体之间的通信。进一步的，该通信装置还可以包括存储模块，用于存储通信装置的程序代码和数据。
其中，处理模块可以是处理器或控制器。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块可以是收发电路或通信接口等。存储模块可以是存储器。当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，图11所示通信装置可以为图3所示通信装置。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并 实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (24)

  1. 一种身份信息的处理方法，其特征在于，所述方法包括：
    第一网元获取第一参数；所述第一参数用于确定网络切片的所属域；
    所述第一网元根据所述第一参数判断所述网络切片是否被运营商管理。
  2. 根据权利要求1所述的身份信息的处理方法，其特征在于，
    所述第一网元为切片选择网元、网络贮存网元、接入和移动性管理网元中任一网元。
  3. 根据权利要求2所述的身份信息的处理方法，其特征在于，当所述第一网元为切片选择网元或者网络贮存网元时，所述方法还包括：
    所述第一网元向所述接入和移动性管理网元发送指示信息；
    其中，所述指示信息用于指示所述网络切片是否被运营商管理；或者，
    所述指示信息用于指示是否隐藏所述终端的第一身份信息；或者，
    所述指示信息用于指示所述网络切片的所属域是否与运营商安全域属于同一安全域。
  4. 根据权利要求1-3任一项所述的身份信息的处理方法，其特征在于，
    所述第一参数包括：所述网络切片对应的网络切片选择辅助信息NSSAI、所述终端的路由区域标识TAI、所述终端的业务类型中的至少一种参数。
  5. 一种身份信息的处理方法，其特征在于，所述方法包括：
    第二网元确定是否隐藏终端的第一身份信息；
    在所述第二网元确定隐藏所述终端的第一身份信息的情况下，所述第二网元隐藏所述第一身份信息，得到第二身份信息，并向会话管理网元发送所述第二身份信息。
  6. 根据权利要求5所述的身份信息的处理方法，其特征在于，
    所述第二网元为接入和移动性管理网元、网络边缘保护代理、拜访地会话管理网元中任一网元。
  7. 根据权利要求5或6所述的身份信息的处理方法，其特征在于，在所述第二网元确定是否隐藏终端的第一身份信息之前，所述方法还包括：
    所述第二网元接收指示信息，其中，所述指示信息用于指示所述网络切片是否被运营商管理；或者，所述指示信息用于指示是否隐藏所述终端的第一身份信息；或者，所述指示信息用于指示所述网络切片的所属域是否与运营商安全域属于同一安全域；
    所述第二网元确定是否隐藏终端的第一身份信息，包括：根据所述指示信息确定是否隐藏终端的第一身份信息。
  8. 根据权利要求5-7任一项所述的身份信息的处理方法，其特征在于，所述第二网元 隐藏所述第一身份信息，得到第二身份信息，包括：
    所述第二网元利用公钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    所述第二网元利用共享密钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    所述第二网元根据共享密钥以及密钥推衍函数得到新的密钥，利用所述新的密钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    所述第二网元随机化所述终端的第一身份信息，得到第二身份信息；或者，
    所述第二网元将所述终端的第一身份信息对应的广义公共用户标识GPSI作为所述第二身份信息。
  9. 一种身份信息的处理方法，其特征在于，所述方法包括：
    第三网元接收会话管理网元发送的终端的身份信息以及用于指示所述终端的身份信息为隐藏后的身份信息的指示；
    所述第三网元根据所述指示向解密功能实体发送解密请求，其中，所述解密请求包括所述终端的身份信息，所述解密请求用于请求解密所述终端的身份信息；
    所述第三网元从所述解密功能实体接收解密后的身份信息，获取与所述解密后的身份信息对应的数据，向所述会话管理网元发送所述数据。
  10. 根据权利要求9所述的身份信息的处理方法，其特征在于，
    所述第三网元为策略控制网元、计费网元、数据管理网元中任一网元。
  11. 根据权利要求9或10所述的身份信息的处理方法，其特征在于，
    所述解密功能实体为接入和移动性管理网元、所述数据管理网元、网络贮存网元、所述计费网元、所述策略控制网元、认证鉴权网元中任一网元。
  12. 一种通信装置，其特征在于，所述通信装置包括：
    获取单元，用于获取第一参数；所述第一参数用于确定网络切片的所属域；
    判断单元，用于根据所述第一参数判断所述网络切片是否被运营商管理。
  13. 根据权利要求12所述的通信装置，其特征在于，
    所述通信装置为切片选择网元、网络贮存网元、接入和移动性管理网元中任一网元。
  14. 根据权利要求13所述的通信装置，其特征在于，当所述通信装置为切片选择网元或者网络贮存网元时，所述通信装置还包括：
    发送单元，用于向所述接入和移动性管理网元发送指示信息；
    其中，所述指示信息用于指示所述网络切片是否被运营商管理；或者，
    所述指示信息用于指示是否隐藏所述终端的第一身份信息；或者，
    所述指示信息用于指示所述网络切片的所属域是否与运营商安全域属于同一安全域。
  15. 根据权利要求12-14任一项所述的通信装置，其特征在于，
    所述第一参数包括：所述网络切片对应的网络切片选择辅助信息NSSAI、所述终端的路由区域标识TAI、所述终端的业务类型中的至少一种参数。
  16. 一种通信装置，其特征在于，所述通信装置包括：
    确定单元，用于确定是否隐藏终端的第一身份信息；
    隐藏单元，用于在所述确定单元确定隐藏所述终端的第一身份信息的情况下，隐藏所述第一身份信息，得到第二身份信息；
    发送单元，用于向会话管理网元发送所述第二身份信息。
  17. 根据权利要求16所述的通信装置，其特征在于，
    所述通信装置为接入和移动性管理网元、网络边缘保护代理、拜访地会话管理网元中任一网元。
  18. 根据权利要求16或17所述的通信装置，其特征在于，所述通信装置，还包括：
    接收单元，用于接收指示信息；所述指示信息用于指示所述网络切片是否被运营商管理；或者，所述指示信息用于指示是否隐藏所述终端的第一身份信息；或者，所述指示信息用于指示所述网络切片的所属域是否与运营商安全域属于同一安全域；
    所述确定单元，具体用于根据所述指示信息确定是否隐藏终端的第一身份信息。
  19. 根据权利要求16-18任一项所述的通信装置，其特征在于，所述隐藏单元，具体用于：
    利用公钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    利用共享密钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    根据共享密钥以及密钥推衍函数得到新的密钥，利用所述新的密钥加密所述终端的第一身份信息，得到第二身份信息；或者，
    随机化所述终端的第一身份信息，得到第二身份信息；或者，
    将所述终端的第一身份信息对应的广义公共用户标识GPSI作为所述第二身份信息。
  20. 一种通信装置，其特征在于，所述通信装置包括：
    接收单元，用于接收会话管理网元发送的终端的身份信息以及用于指示所述终端的身份信息为隐藏后的身份信息的指示；
    发送单元，用于根据所述指示向解密功能实体发送解密请求，其中，所述解密请求包括所述终端的身份信息，所述解密请求用于请求解密所述终端的身份信息；
    所述接收单元，还用于从所述解密功能实体接收解密后的身份信息；
    获取单元，用于获取与所述解密后的身份信息对应的数据；
    所述发送单元，还用于向所述会话管理网元发送所述数据。
  21. 根据权利要求20所述的通信装置，其特征在于，
    所述通信装置为策略控制网元、计费网元、数据管理网元中任一网元。
  22. 根据权利要求20或21所述的通信装置，其特征在于，
    所述解密功能实体为接入和移动性管理网元、所述数据管理网元、网络贮存网元、所述计费网元、所述策略控制网元、认证鉴权网元中任一网元。
  23. 一种包含指令的计算机程序产品，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1-4任一项所述的身份信息的处理方法，或者如权利要求5-8任一项所述的身份信息的处理方法，或者如权利要求9-11任一项所述的身份信息的处理方法。
  24. 一种计算机存储介质，其特征在于，所述计算机存储介质包括计算机指令，当所述计算机指令在计算机上运行时，使得所述计算机执行如权利要求1-4任一项所述的身份信息的处理方法，或者如权利要求5-8任一项所述的身份信息的处理方法，或者如权利要求9-11任一项所述的身份信息的处理方法。
PCT/CN2019/094830 2018-08-09 2019-07-05 一种身份信息的处理方法、设备及系统 WO2020029730A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19847301.9A EP3790299B1 (en) 2018-08-09 2019-07-05 Identity information processing method, device and system
US17/115,179 US11510052B2 (en) 2018-08-09 2020-12-08 Identity information processing method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810904615.5A CN110830990B (zh) 2018-08-09 2018-08-09 一种身份信息的处理方法、装置及存储介质
CN201810904615.5 2018-08-09

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/115,179 Continuation US11510052B2 (en) 2018-08-09 2020-12-08 Identity information processing method, device, and system

Publications (1)

Publication Number Publication Date
WO2020029730A1 true WO2020029730A1 (zh) 2020-02-13

Family

ID=69415370

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/094830 WO2020029730A1 (zh) 2018-08-09 2019-07-05 一种身份信息的处理方法、设备及系统

Country Status (4)

Country Link
US (1) US11510052B2 (zh)
EP (1) EP3790299B1 (zh)
CN (1) CN110830990B (zh)
WO (1) WO2020029730A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834202A (zh) * 2020-05-27 2023-03-21 Oppo广东移动通信有限公司 信息处理方法及装置、设备、计算机存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102428262B1 (ko) * 2018-08-09 2022-08-02 노키아 테크놀로지스 오와이 이종 액세스 네트워크를 통한 연결의 보안 실현을 위한 방법 및 장치
US12075251B2 (en) * 2019-04-11 2024-08-27 Ntt Docomo, Inc. Network node
US11632694B2 (en) 2019-07-31 2023-04-18 Qualcomm Incorporated Network slice availability check and indication
CN111343273B (zh) * 2020-02-27 2021-03-30 电子科技大学 一种车联网环境下基于属性的策略隐藏外包签密方法
CN111726799B (zh) * 2020-06-19 2023-04-07 中国联合网络通信集团有限公司 一种隐私保护方法及装置
US11432158B2 (en) * 2020-08-10 2022-08-30 Verizon Patent And Licensing Inc. Systems and methods for using a unique routing indicator to connect to a network
EP3979103A3 (en) * 2020-10-01 2022-07-06 Nokia Technologies Oy Apparatus, methods, and computer programs
EP4037361A1 (en) * 2021-01-29 2022-08-03 Adaptive Mobile Security Limited System and method for securing a communication network
US11683309B2 (en) * 2021-02-05 2023-06-20 Cisco Technology, Inc. Nonce-based enterprise security policy enforcement

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017113109A1 (en) * 2015-12-29 2017-07-06 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for virtualized network service provision
CN107819595A (zh) * 2016-09-12 2018-03-20 清华大学 一种网络切片管理装置
CN108012267A (zh) * 2016-10-31 2018-05-08 华为技术有限公司 一种网络认证方法、相关设备及系统
CN108141756A (zh) * 2015-09-29 2018-06-08 瑞典爱立信有限公司 促成网络切片管理

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI20021629A (fi) * 2002-09-11 2004-03-12 Nokia Corp Sijaintitiedon määrittäminen solukkoverkossa
US20090205046A1 (en) * 2008-02-13 2009-08-13 Docomo Communications Laboratories Usa, Inc. Method and apparatus for compensating for and reducing security attacks on network entities
CN101969638B (zh) * 2010-09-30 2013-08-14 中国科学院软件研究所 一种移动通信中对imsi进行保护的方法
CN102572815B (zh) * 2010-12-29 2014-11-05 中国移动通信集团公司 一种对终端应用请求的处理方法、系统及装置
CN107295609B (zh) * 2016-03-30 2021-06-15 中兴通讯股份有限公司 网络切片处理方法及装置、终端、基站
US10142994B2 (en) * 2016-04-18 2018-11-27 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
CN107580360A (zh) * 2016-07-04 2018-01-12 中国移动通信有限公司研究院 一种网络切片选择的方法、设备及网络架构
GB2558585A (en) * 2017-01-06 2018-07-18 Nec Corp Communication system
CN110786034B (zh) * 2017-06-23 2024-01-30 日本电气株式会社 用于网络切片隐私考虑的方法、用户设备和功能节点
EP4297340A3 (en) * 2017-07-25 2024-04-17 Telefonaktiebolaget LM Ericsson (publ) Subscription concealed identifier
CN107580324B (zh) * 2017-09-22 2020-05-08 中国电子科技集团公司第三十研究所 一种用于移动通信系统imsi隐私保护的方法
US10548004B2 (en) * 2018-02-15 2020-01-28 Nokia Technologies Oy Security management in communication systems between security edge protection proxy elements
JP7406512B2 (ja) * 2018-06-07 2023-12-27 コンヴィーダ ワイヤレス， エルエルシー サービス加入者のプライバシのためのデータ匿名化
US10949557B2 (en) * 2018-08-20 2021-03-16 Cisco Technology, Inc. Blockchain-based auditing, instantiation and maintenance of 5G network slices

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108141756A (zh) * 2015-09-29 2018-06-08 瑞典爱立信有限公司 促成网络切片管理
WO2017113109A1 (en) * 2015-12-29 2017-07-06 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for virtualized network service provision
CN107819595A (zh) * 2016-09-12 2018-03-20 清华大学 一种网络切片管理装置
CN108012267A (zh) * 2016-10-31 2018-05-08 华为技术有限公司 一种网络认证方法、相关设备及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3790299A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834202A (zh) * 2020-05-27 2023-03-21 Oppo广东移动通信有限公司 信息处理方法及装置、设备、计算机存储介质

Also Published As

Publication number Publication date
CN110830990B (zh) 2021-04-20
US20210195409A1 (en) 2021-06-24
EP3790299C0 (en) 2024-09-11
US11510052B2 (en) 2022-11-22
CN110830990A (zh) 2020-02-21
EP3790299A4 (en) 2022-01-05
EP3790299A1 (en) 2021-03-10
EP3790299B1 (en) 2024-09-11

Similar Documents

Publication Publication Date Title
WO2020029730A1 (zh) 一种身份信息的处理方法、设备及系统
US20220330361A1 (en) Method for establishing connection and obtaining relay service code and communications apparatus
US11924642B2 (en) Privacy considerations for network slice selection
JP6936393B2 (ja) パラメータ保護方法及びデバイス、並びに、システム
US20220418038A1 (en) Selection of ip version
JP2021532627A (ja) 通信方法および通信装置
TWI812678B (zh) 終端訊息的傳遞方法及相關產品
WO2019214351A1 (zh) 消息处理方法及装置
WO2022027505A1 (en) User equipment authentication and authorization procedure for edge data network
US20220312188A1 (en) Network operations to receive user consent for edge computing
WO2022174399A1 (en) User equipment authentication and authorization procedure for edge data network
US10841792B2 (en) Network connection method, method for determining security node, and apparatus
WO2023141945A1 (en) Authentication mechanism for access to an edge data network based on tls-psk
US20240380730A1 (en) Enabling distributed non-access stratum terminations
WO2024065503A1 (en) Negotiation of authentication procedures in edge computing
US11968530B2 (en) Network authentication for user equipment access to an edge data network
US11956627B2 (en) Securing user equipment identifier for use external to communication network
WO2024092624A1 (en) Encryption key transfer method and device for roaming users in communication networks
US20240056815A1 (en) Secure identification of applications in communication network
US20220304079A1 (en) Security protection on user consent for edge computing
WO2023055342A1 (en) Enabling distributed non-access stratum terminations
CN117336714A (zh) 通信方法、通信装置及通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19847301

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019847301

Country of ref document: EP

Effective date: 20201203

NENP Non-entry into the national phase

Ref country code: DE