WO2020147509A1 - 能力上报、密钥协商方法及装置、终端、通信设备及系统 - Google Patents

能力上报、密钥协商方法及装置、终端、通信设备及系统 Download PDF

Info

Publication number
WO2020147509A1
WO2020147509A1 PCT/CN2019/126746 CN2019126746W WO2020147509A1 WO 2020147509 A1 WO2020147509 A1 WO 2020147509A1 CN 2019126746 W CN2019126746 W CN 2019126746W WO 2020147509 A1 WO2020147509 A1 WO 2020147509A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
terminal
capability
key
counterfeiting
Prior art date
Application number
PCT/CN2019/126746
Other languages
English (en)
French (fr)
Inventor
余万涛
谢振华
彭锦
游世林
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP19909990.4A priority Critical patent/EP3913952A4/en
Priority to US17/423,888 priority patent/US20220124493A1/en
Publication of WO2020147509A1 publication Critical patent/WO2020147509A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the present invention relates to the field of communications, and in particular to a method and device for capability reporting, key agreement, terminal, communication equipment and system.
  • the anti-counterfeiting base station key can be issued on the base station and the terminal, so that the base station can use the anti-counterfeiting base station key to protect the communication message or part of the content of the message.
  • the terminal After receiving the message sent by the base station, the terminal can authenticate the message sent by the base station according to the anti-counterfeiting base station key, thereby realizing the authenticity of the base station.
  • the node equipment on the network side is not aware of the terminal's anti-counterfeiting base station capabilities, so it is impossible to perform authentication and key negotiation and distribution based on the terminal's anti-counterfeiting base station capabilities.
  • the key negotiation method, device, terminal, communication device, and communication system provided by the embodiments of the present invention mainly solve the technical problem that the communication device cannot understand the terminal's anti-counterfeiting base station capabilities, and cannot perform authentication and keys based on the terminal's anti-counterfeiting base station capabilities.
  • Negotiate and distribute The key negotiation method, device, terminal, communication device, and communication system provided by the embodiments of the present invention mainly solve the technical problem that the communication device cannot understand the terminal's anti-counterfeiting base station capabilities, and cannot perform authentication and keys based on the terminal's anti-counterfeiting base station capabilities.
  • an embodiment of the present invention provides a capability reporting method, including:
  • the anti-counterfeiting base station capability indication information is sent to the communication device, and the anti-counterfeiting base station capability indication information is used to indicate to the communication device the anti-counterfeiting base station capability of the terminal.
  • the embodiment of the present invention also provides a key agreement method, including:
  • the anti-counterfeit base station capability indication information is used to indicate the anti-counterfeit base station capability of the terminal;
  • the embodiment of the present invention also provides a capability reporting device, including:
  • the capability reporting module is configured to send the anti-counterfeiting base station capability indication information to the communication device, and the anti-counterfeiting base station capability indication information is used to indicate the anti-counterfeiting base station capability of the terminal to the communication device.
  • the embodiment of the present invention also provides a key agreement device, including:
  • the capability determination module is configured to obtain the anti-counterfeiting base station capability indication information sent by the terminal, and the anti-counterfeiting base station capability indication information is used to indicate the anti-counterfeiting base station capability of the terminal;
  • the authentication negotiation module is configured to perform an authentication and key negotiation process with the terminal that matches the capabilities of the target base station and the terminal's anti-counterfeiting base station, and the target base station is the base station that the terminal is to access.
  • the embodiment of the present invention also provides a terminal, and the cover terminal includes a first processor, a first memory, and a first communication bus;
  • the first communication bus is configured to realize connection and communication between the first processor and the first memory
  • the first processor is configured to execute one or more programs stored in the first memory to implement the steps of the above-mentioned capability reporting method.
  • An embodiment of the present invention also provides a communication device, which includes a second processor, a second memory, and a second communication bus;
  • the second communication bus is configured to realize connection and communication between the second processor and the second memory
  • the second processor is configured to execute one or more programs stored in the second memory to implement the steps of the above-mentioned key agreement method.
  • An embodiment of the present invention also provides a communication system, which includes the above-mentioned communication device and at least one above-mentioned terminal.
  • the embodiment of the present invention also provides a storage medium, the storage medium stores a capability report program and/or a key agreement program, and the capability report program can be executed by one or more processors to implement the steps of the above capability report method;
  • the key agreement procedure can be executed by one or more processors to implement the steps of the above key agreement method.
  • the anti-counterfeiting base station capability indication information is sent to the communication device through the terminal, and the anti-counterfeiting base station capability indication information can indicate the anti-counterfeiting of the terminal like the communication device Base station capabilities.
  • the terminal's anti-counterfeiting base station capability can be determined, and authentication and key negotiation that match the terminal's anti-counterfeiting base station capability and the target base station's anti-counterfeiting base station capability can be performed.
  • the process of negotiating an anti-counterfeiting base station key that matches the anti-counterfeiting base station capabilities of the terminal and the target base station for base station anti-counterfeiting when the two communicate thereby reducing the risk of network attacks from fake base stations, improving the security of communication between the terminal and the base station, and enhancing users Experience.
  • FIG. 1 is a flowchart of a key agreement method provided in Embodiment 1 of the present invention.
  • FIG. 2 is an interaction diagram of the terminal provided in the first embodiment of the present invention for capability reporting
  • FIG. 3 is a schematic structural diagram of a capability reporting device provided in Embodiment 2 of the present invention.
  • FIG. 4 is a schematic structural diagram of a key agreement device provided in Embodiment 2 of the present invention.
  • FIG. 5 is a schematic diagram of another structure of the capability reporting device provided in Embodiment 2 of the present invention.
  • FIG. 6 is a schematic diagram of a hardware structure of a terminal provided in Embodiment 3 of the present invention.
  • FIG. 7 is a schematic diagram of a hardware structure of a communication device provided in Embodiment 3 of the present invention.
  • Embodiment 8 is a schematic structural diagram of a communication system provided in Embodiment 3 of the present invention.
  • Embodiment 9 is a schematic diagram of a mobile terminal key agreement process provided in Embodiment 4 of the present invention.
  • Fig. 10 is another schematic diagram of the mobile terminal key agreement process provided in the fourth embodiment of the present invention.
  • 3GPP (3rd Generation Partnership Project) has formulated various mobile network specifications, and mobile networks deployed in accordance with these specifications are also being attacked by various pseudo base stations, which is one of the main reasons why attacks can be implemented. That is, the terminal cannot authenticate the authenticity of the base station, and thus accepts various instructions sent by the pseudo base station.
  • key information In order to authenticate the base station, key information must be issued on the base station and the terminal, so that the base station can protect the message sent or part of the message according to the key information, so that the terminal can send the message to the base station according to the key information.
  • the message is authenticated, and then the base station can be authenticated (because the pseudo base station cannot access the mobile network to obtain these key information).
  • the anti-counterfeiting base station key may use a symmetric key or an asymmetric key, it is necessary to start a different authentication key negotiation process when the terminal device accesses the network And anti-counterfeiting base station key distribution process.
  • the current terminal capability information reported by the terminal does not indicate whether the terminal has anti-counterfeiting base station capabilities, so that network-side nodes, such as AMF (Access Mobility Function, access and mobility management function), SEAF (Security Anchor Function, security anchor) Point function), AUSF (Authentication Server Function) and UDM (Unified Data Management, unified data management), etc. Do not know whether the terminal has anti-counterfeiting base station capabilities, which may lead to failure to start matching the terminal and base station's anti-counterfeiting base station capabilities The process of authentication and key agreement distribution.
  • AMF Access Mobility Function, access and mobility management function
  • SEAF Security Anchor Function, security anchor
  • Point function Point function
  • AUSF Authentication Server Function
  • UDM Unified Data Management
  • the embodiment provides a key agreement scheme, which includes a terminal capability report process and an authentication negotiation process.
  • the terminal capability report process can be implemented by the terminal execution capability report method, and the authentication negotiation process is implemented by the terminal and the communication device jointly executing the key.
  • the negotiation method please refer to the flowchart shown in Figure 1:
  • S102 The terminal sends the anti-counterfeiting base station capability indication information to the communication device.
  • the anti-counterfeiting base station capability indication may only indicate to the communication device whether the terminal has the anti-counterfeiting base station capability.
  • the terminal and the communication device use a pre-appointed key system when performing authentication and key negotiation. In this way, when the terminal indicates to the communication device that it has the anti-counterfeiting base station capability through the anti-counterfeiting base station capability indication information, the communication device can use the pre-appointed key system for authentication and key negotiation with the terminal.
  • the anti-counterfeiting base station capability indication information can not only indicate to the communication device whether the terminal has the anti-counterfeiting base station capability, but also indicate to the communication device the key system of the anti-counterfeiting base station key supported by the terminal.
  • the anti-counterfeiting base station capability indication information includes key system indication information.
  • the key system indication information is used to indicate the key system to which the anti-counterfeiting base station key supported by the terminal belongs, that is, the key system indication information may It characterizes whether the anti-counterfeiting base station key supported by the terminal is a symmetric key or an asymmetric key.
  • the terminal can support both a symmetric anti-counterfeiting base station key and an asymmetric anti-counterfeiting base station key.
  • the terminal can indicate its anti-counterfeiting base station capability to the communication device through capability indication information: the terminal carries the anti-counterfeiting base station capability indication information that can characterize its anti-counterfeiting base station capability in a capability report message and sends it to the communication device.
  • the capability report message may refer to a registration request message or an attachment request message.
  • the terminal may carry the anti-counterfeiting base station capability indication information in the registration request message, and at the same time also carry the anti-counterfeiting base station capability indication information in the attachment request message, that is, both the registration request message and the attachment request message belong to the capability report. news.
  • the anti-counterfeiting base station capability of the terminal can be preset by the programmer or controlled by the user. For example, in some examples of this embodiment, the user can control whether the terminal has the anti-counterfeiting base station capability by controlling the "anti-counterfeiting base station switch". Therefore, in this implementation, before the terminal sends the capability report message to the communication device, it also determines the anti-counterfeiting base station capability indication information of the terminal according to the pre-configuration situation or the input instruction.
  • the so-called terminal in this embodiment may refer to user equipment UE, or may refer to other terminal equipment supporting mobile communications.
  • the communication device may refer to at least one network device among AMF network elements, SEAF network elements, AUSF network elements, and UDM network elements. It should be understood that the terminal will send the capability report message to the communication device through the base station, which is the target base station to be accessed by the terminal.
  • the capability report message sent by the terminal to the communication device not only includes the anti-counterfeiting base station capability indication information used to indicate the terminal's anti-counterfeiting base station capability, but also includes indication information indicating other capabilities.
  • the capability indication information may be used by other network elements other than AUSF network elements and UDM network elements, such as AMF network elements and/or SEAF network elements. Therefore, the terminal can first send the capability report message to the AMF network element and SEAF network element. At least one of the AMF network elements and/or SEAF network elements, after receiving the capability report message of the terminal, sends the anti-counterfeiting base station capability indication information to the AUSF network element and/or UDM network element.
  • Figure 2 for a schematic diagram of an interaction in which a terminal performs capability reporting:
  • S202 The terminal sends a capability report message to the AMF network element.
  • the terminal When the terminal sends the capability report message to the AMF network element, the message is forwarded through the base station.
  • the base station mentioned here refers to the target base station. It is understandable that the AMF network element is only taken as an example here. In some other examples of this embodiment, the terminal may also send the capability report message to the SEAF network element, or to both the AMF network element and the SEAF network element.
  • the AMF network element extracts the capability indication information of the anti-counterfeiting base station from the capability report message.
  • the AUSF network element considering that in the process of authentication and key negotiation and distribution, the AUSF network element only needs to know the terminal’s anti-counterfeiting base station capability indication information, and it does not matter to other capability indication information in the capability report message, so the AMF network element receives After the capability report message sent by the terminal, the anti-counterfeiting base station capability indication information in the capability report message can be extracted and sent to the AUSF network element.
  • the AMF network element sends the anti-counterfeiting base station capability indication information to the AUSF network element.
  • the AMF network element After the AMF network element extracts the anti-counterfeiting base station capability indication information of the terminal from the capability report message, it sends the anti-counterfeiting base station capability indication information to the AUSF network element.
  • the AMF network element after the AMF network element receives the capability report message, it can also send the capability report message directly to the AUSF network element, so that the AUSF network element can extract the terminal from the capability report message.
  • the indication information of the anti-counterfeiting base station capability is also sent to the AUSF network element, so that the AUSF network element can extract the terminal from the capability report message.
  • the AMF network element sending the anti-counterfeiting base station capability indication information or capability report message to the AUSF network element is only an example. In some other examples, the AMF network element may also send the anti-counterfeiting base station capability indication information or capability report message. To UDM network elements.
  • S104 The terminal and the communication device perform an authentication and key negotiation process that matches the capabilities of the target base station and the terminal's anti-counterfeiting base station.
  • the communication device After receiving the capability report message sent by the terminal, the communication device can learn the anti-counterfeiting base station capability of the terminal, and then perform corresponding authentication and key agreement processes with the terminal based on the terminal's anti-counterfeiting base station capability and the target base station's anti-counterfeiting base station capability. It can be understood that the authentication and key agreement process between the communication device and the terminal is an authentication and key agreement process that matches the terminal's anti-counterfeiting base station capabilities and the target base station's anti-counterfeiting base station capabilities.
  • the terminal For example, if the terminal’s anti-counterfeiting base station capability indication information indicates that the terminal supports a symmetric anti-counterfeiting base station key, and the target base station also supports a symmetric anti-counterfeiting base station key, then when the terminal accesses and attaches to the network or performs cell reconfiguration When selected, the communication device will start the authentication and key negotiation and distribution process corresponding to the symmetric anti-counterfeiting base station key.
  • the anti-counterfeiting base station key negotiated by the two is the anti-counterfeiting base station key of the symmetric system.
  • the terminal For example, if the terminal’s anti-counterfeiting base station capability indication information indicates that the terminal supports an asymmetric anti-counterfeiting base station key, and the target base station also supports an asymmetric anti-counterfeiting base station key, then when the terminal accesses the network or performs cell reconfiguration When selected, the communication device will start the authentication and key negotiation and distribution process corresponding to the key of the asymmetric anti-counterfeiting base station.
  • the anti-counterfeiting base station key negotiated by the two is the anti-counterfeiting base station key of the asymmetric system.
  • the terminal's anti-counterfeiting base station capability and the target base station's anti-counterfeiting base station capability can be the same or different.
  • the terminal supports only one of the two key systems, while the target base station can support both key systems at the same time .
  • the terminal can support two key systems at the same time, while the target base station only supports one of the two key systems.
  • the communication device starts the authentication and key agreement distribution process, it can choose to perform the authentication and key agreement distribution process corresponding to the key system supported by both the terminal and the target base station.
  • the communication device can start the authentication and key agreement process in the existing way.
  • the anti-counterfeiting base station capability of the terminal needs to be determined according to the terminal's anti-counterfeiting base station capability indication information, but also the anti-counterfeiting base station capability of the target base station. It is understandable that on the communication device side, the anti-counterfeiting base station capability indication information of each base station deployed by the operator to which it belongs can be pre-stored.
  • the communication device may determine based on the capability report message The target base station corresponding to the terminal is obtained, and then the anti-counterfeiting base station capability indication information of the target base station is queried, and then the anti-counterfeiting base station capability of the target base station is determined.
  • the terminal can report its anti-counterfeiting base station capability to the communication device through the anti-counterfeiting base station capability indication information, so that the communication device can learn about the terminal's anti-counterfeiting according to the anti-counterfeiting base station capability indication information Base station capabilities, and when performing authentication and key negotiation with the terminal, perform an authentication and key negotiation process that matches the terminal's anti-counterfeiting base station capabilities and the target base station's anti-counterfeiting base station capabilities, thereby negotiating the same terminal and target base station's anti-counterfeiting base station capabilities
  • the matching anti-counterfeiting base station key is used for base station anti-counterfeiting when the two communicate, reducing the probability of the terminal accessing the pseudo base station, enhancing the security of communication between the terminal and the base station, and improving the user experience on the terminal side.
  • This embodiment will provide a capability reporting device that can be applied to the terminal side.
  • the capability reporting device can be deployed on the terminal to achieve the purpose of reporting the anti-counterfeiting base station capabilities of the terminal to the communication device. Please refer to a schematic structural diagram of the capability reporting device shown in FIG. 3:
  • the capability reporting device 30 includes a capability reporting module 302, and the capability reporting module 302 is configured to send the anti-counterfeiting base station capability indication information to the communication device.
  • This embodiment also provides a key agreement device, please refer to a schematic structural diagram of the key agreement device shown in FIG. 4:
  • the key agreement device 40 includes a capability determination module 402 and an authentication negotiation module 404.
  • the capability determination module 402 is configured to obtain the anti-counterfeiting base station capability indication information sent by the terminal, and the authentication negotiation module 404 is configured to communicate with the target base station and the terminal with the terminal. The authentication and key agreement process that matches the capabilities of the anti-counterfeiting base station.
  • the capability reporting device 30 needs to determine the anti-counterfeiting base station capability of the terminal before sending the anti-counterfeiting base station capability indication information to the communication device. Therefore, in this embodiment, the capability reporting device 30 may also include capability determination. Module. In addition, after the capability reporting device 30 reports the anti-counterfeiting base station capability indication information to the communication device, the terminal also needs to perform authentication and key negotiation with the communication device. Therefore, in some examples of this embodiment, as shown in FIG. 5, the capability The reporting device 30 may also include a key agreement module 304.
  • the function of the capability reporting module 302 can be implemented by the processor and the communication unit of the terminal.
  • the capability reporting device 30 includes the key agreement module 304
  • the encryption may also be implemented by the processor of the terminal and the communication unit.
  • the key agreement apparatus 40 can be deployed on a communication device, and the functions of the capability determination module 402 and the authentication negotiation module 404 can be implemented by the processor and the communication unit of the communication device.
  • the anti-counterfeiting base station capability indication may only indicate to the communication device whether the terminal has the anti-counterfeiting base station capability.
  • the key agreement module 304 of the capability reporting device 30 and the authentication negotiation module 404 of the key agreement device 40 are performing authentication and key During the negotiation, the key system used is pre-agreed. In this way, when the capability reporting module 202 indicates to the communication device that the terminal has the capability of an anti-counterfeiting base station through the anti-counterfeiting base station capability indication information, the key agreement module 304 and the authentication negotiation module 404 can use a pre-agreed key system for authentication and key agreement.
  • the anti-counterfeit base station capability indication information can not only indicate whether the terminal has anti-counterfeit base station capability, but also indicate the key system of the anti-counterfeit base station key supported by the terminal.
  • the anti-counterfeiting base station capability indication information includes key system indication information.
  • the key system indication information can represent the key system to which the anti-counterfeiting base station key supported by the terminal belongs.
  • the terminal supports or adopts symmetric
  • the key is also an asymmetric key.
  • the terminal can support both the anti-counterfeiting base station key of the symmetric system and the anti-counterfeiting base station key of the asymmetric mechanism.
  • the capability reporting module 302 can indicate the terminal's anti-counterfeiting base station capabilities to the communication device through the capability indication information: the capability reporting module 302 carries the anti-counterfeiting base station capability indication information that can characterize the terminal's anti-counterfeiting base station capabilities in the capability report message and sends it to communication device.
  • the capability report message may refer to a registration request message or an attachment request message.
  • the capability reporting module 302 may carry the anti-counterfeiting base station capability indication information in the registration request message, and at the same time carry the anti-counterfeiting base station capability indication information in the attach request message, that is, both the registration request message and the attach request message It is a capability report message.
  • the capability report module 302 needs to determine its own anti-counterfeiting base station capability before sending the capability report message to the key agreement device 40.
  • the anti-counterfeiting base station capability of the terminal can be preset by the programmer or controlled by the user. For example, in some examples of this embodiment, the user can control whether the terminal has the anti-counterfeiting base station capability by controlling the "anti-counterfeiting base station switch". Therefore, in this implementation, before the terminal sends the capability report message to the key agreement device 40, it also determines the anti-counterfeiting base station capability indication information of the terminal according to the pre-configuration situation or the input instruction.
  • the so-called terminal in this embodiment may refer to user equipment UE, or may refer to other terminal equipment supporting mobile communications.
  • the communication device where the key agreement apparatus 40 is located may refer to a network device where at least one of the AUSF network element and the UDM network element is deployed. It should be understood that the terminal will send the capability report message to the communication device through the base station, which is the target base station to be accessed by the terminal.
  • the capability report message sent by the capability reporting module 302 to the key agreement device 40 includes anti-counterfeiting base station capability indication information used to indicate the terminal's anti-counterfeiting base station capability, and also includes information indicating other capabilities. Indication information, and the capability indication information may need to be used by other network elements other than AUSF network elements and UDM network elements, such as AMF network elements and/or SEAF network elements.
  • the capability reporting module 302 may send the capability report message first To at least one of the AMF network element and the SEAF network element, the AMF network element and/or the SEAF network element, after receiving the capability report message from the capability reporting module 302, sends the anti-counterfeiting base station capability indication information to the AUSF network element and/or Or UDM network element.
  • the capability report module 302 when the capability report module 302 sends the capability report message to the AMF network element, the message is forwarded through the base station, and the base station mentioned here refers to the target base station. It is understandable that here is only an AMF network element as an example. In some other examples of this embodiment, the capability reporting module 302 may also send the capability report message to the SEAF network element, or to both the AMF network element and the SEAF network element. .
  • the AUSF network element considering that in the process of authentication and key negotiation and distribution, the AUSF network element only needs to know the terminal’s anti-counterfeiting base station capability indication information, and it does not matter to other capability indication information in the capability report message, so the AMF network element receives After the capability report message sent by the terminal, the anti-counterfeiting base station capability indication information in the capability report message can be extracted and sent to the AUSF network element.
  • the AMF network element After the AMF network element extracts the anti-counterfeiting base station capability indication information of the terminal from the capability report message, it sends the anti-counterfeiting base station capability indication information to the AUSF network element.
  • the AMF network element after the AMF network element receives the capability report message, it can also send the capability report message directly to the AUSF network element, so that the AUSF network element can extract the terminal from the capability report message.
  • the indication information of the anti-counterfeiting base station capability is also sent to the AUSF network element, so that the AUSF network element can extract the terminal from the capability report message.
  • the AMF network element sending the anti-counterfeiting base station capability indication information or capability report message to the AUSF network element is only an example. In some other examples, the AMF network element may also send the anti-counterfeiting base station capability indication information or capability report message. To UDM network elements.
  • the capability determining module 402 of the key agreement device 40 can determine the terminal's anti-counterfeiting base station capability according to the anti-counterfeiting base station capability indication information sent by the capability reporting module 302: after receiving the capability report message sent by the capability reporting module 302, the capability determining module 402 can understand
  • the authentication negotiation module 404 then performs corresponding authentication and key negotiation processes with the terminal based on the terminal's anti-counterfeiting base station capabilities and the target base station's anti-counterfeiting base station capabilities. It can be understood that the authentication and key agreement process between the authentication negotiation module 404 and the terminal is an authentication and key agreement process that matches the anti-counterfeiting base station capabilities of the terminal and the target base station.
  • the authentication negotiation module 404 will start the authentication and key negotiation and distribution process corresponding to the symmetric anti-counterfeiting base station key.
  • the anti-counterfeiting base station key negotiated by the two is the anti-counterfeiting base station key of the symmetric system.
  • the authentication negotiation module 404 will start the authentication and key negotiation distribution process corresponding to the key of the asymmetric anti-counterfeiting base station.
  • the anti-counterfeiting base station key negotiated by the two is the anti-counterfeiting base station key of the asymmetric system.
  • the terminal's anti-counterfeiting base station capability and the target base station's anti-counterfeiting base station capability can be the same or different.
  • the terminal supports only one of the two key systems, while the target base station can support both key systems at the same time .
  • the terminal can support two key systems at the same time, while the target base station only supports one of the two key systems.
  • the authentication negotiation module 404 starts the authentication and key agreement distribution process, it can choose to perform the authentication and key agreement distribution process corresponding to the key system supported by both the terminal and the target base station.
  • the authentication negotiation module 404 can start the authentication and key agreement distribution process in the existing manner.
  • the authentication negotiation module 404 performs the authentication and key agreement process with the terminal, it not only needs to determine the anti-counterfeiting base station capability of the terminal according to the terminal's anti-counterfeiting base station capability indication information, but also determine the anti-counterfeiting base station capability of the target base station. . It is understandable that the key agreement device 40 may pre-store the anti-counterfeiting base station capability indication information of each base station deployed by its operator.
  • the key agreement device 40 may The target base station corresponding to the terminal is determined based on the capability report message, and then the anti-counterfeiting base station capability indication information of the target base station is queried, and then the anti-counterfeiting base station capability of the target base station is determined.
  • the capability reporting device can report the anti-counterfeit base station capability of the terminal to the key agreement device through the anti-counterfeit base station capability indication information, so that the key agreement device can learn the anti-counterfeit base station capability of the terminal according to the anti-counterfeit base station capability indication information, and then When performing authentication and key negotiation with the terminal, perform the authentication and key negotiation process that matches the terminal's anti-counterfeiting base station capabilities and the target base station's anti-counterfeiting base station capabilities, so as to negotiate an anti-counterfeiting that matches the terminal and target base station's anti-counterfeiting base station capabilities
  • the base station key is used for base station anti-counterfeiting when the two communicate, which reduces the probability of the terminal accessing the pseudo base station, enhances the security of communication between the terminal and the base station, and improves the user experience on the terminal side.
  • This embodiment provides a storage medium that can store one or more computer programs that can be read, compiled, and executed by one or more processors.
  • the storage medium can store One of the capability reporting procedure and the key agreement procedure, wherein the capability reporting procedure can be executed by one or more processors to implement any one of the capability reporting methods introduced in the foregoing embodiments.
  • the key agreement program can be executed by one or more processors to implement any one of the key agreement methods introduced in the foregoing embodiments.
  • the terminal 60 includes a first processor 61, a first memory 62, and a first communication bus 63 for connecting the first processor 61 and the first memory 62, where
  • the first storage 62 may be the aforementioned storage medium capable of storing the report program:
  • the first processor 61 may send anti-counterfeiting base station capability indication information to the communication device, where the anti-counterfeiting base station capability indication information is used to indicate the anti-counterfeiting base station capability of the terminal 60 to the communication device.
  • the communication device 70 includes a second processor 71, a second memory 72, and a second communication bus for connecting the second processor 71 and the second memory 72 73.
  • the second memory 72 may be the aforementioned storage medium storing the key agreement program:
  • the second processor 71 obtains the anti-counterfeiting base station capability indication information sent by the terminal, and then performs an authentication and key negotiation process matching the target base station and the terminal's anti-counterfeiting base station capabilities with the terminal.
  • the target base station here refers to the terminal to be accessed Base station.
  • the communication system 8 includes a communication device 70 and at least one terminal 60. It can be understood that in some other examples of this embodiment, the communication system 8 may also It includes multiple communication devices 70 and multiple terminals 60 at the same time. Each terminal 60 can implement the capability reporting method described in the foregoing embodiment, and the communication device 70 can implement the key agreement method described in the foregoing embodiment. Through the cooperation of the terminal 60 and the communication device 70, the communication device 70 in the communication system 8 can understand the anti-counterfeiting base station capabilities of the terminal 60, and then when performing authentication and key agreement with the terminal 60, the authentication and key agreement process can be adapted to the terminal. 60 and the anti-counterfeiting base station capability of the corresponding target base station.
  • the anti-counterfeiting base station capability indication information is sent to the communication device through the terminal, and the anti-counterfeiting base station capability indication information can indicate the anti-counterfeiting base station capability of the terminal like the communication device.
  • the terminal's anti-counterfeiting base station capability can be determined, and authentication and key negotiation that match the terminal's anti-counterfeiting base station capability and the target base station's anti-counterfeiting base station capability can be performed.
  • the process of negotiating an anti-counterfeiting base station key that matches the capabilities of the terminal and the target base station's anti-counterfeiting base station for base station anti-counterfeiting when the two communicate thereby reducing the risk of network attacks from fake base stations, improving the security of communication between the terminal and the base station, and enhancing users Experience.
  • the terminal is a mobile terminal
  • the communication equipment is a node equipment deployed with AUSF network elements and/or UDM network elements (hereinafter referred to as "AUSF/UDM”).
  • AUSF/UDM UDM network elements
  • the mobile terminal capability reporting and authentication also involves AMF network elements and/or SEAF network elements (hereinafter referred to as "AMF/SEAF”):
  • the mobile terminal can be configured to support the function of an anti-counterfeiting base station.
  • the mobile terminal device can be pre-configured to support an anti-counterfeiting base station, or the user can set the mobile terminal device to support an anti-counterfeiting base station through the mobile terminal device user interface.
  • the mobile terminal supporting the anti-counterfeiting base station can realize the anti-counterfeiting base station function based on the obtained anti-counterfeiting base station key together with the base station supporting the anti-counterfeiting base station in this embodiment.
  • a mobile terminal that supports an anti-counterfeiting base station can support an anti-counterfeiting base station key with a symmetric key system, an anti-counterfeiting base station key with an asymmetric key system, or an anti-counterfeiting base station key with a symmetric key system at the same time. Key and asymmetric key system anti-counterfeiting base station key.
  • the anti-counterfeiting base station capability of the mobile terminal can be used as a terminal capability, which is identified by the anti-counterfeiting base station capability information.
  • the anti-counterfeiting base station capability information of the mobile terminal and the base station's anti-counterfeiting base station capability information may be the same or different.
  • the anti-counterfeiting base station capability information of the mobile terminal equipment is used to identify the anti-counterfeiting base station capability of the mobile terminal.
  • the anti-counterfeiting base station capability information of the mobile terminal can be used to identify whether the anti-counterfeiting base station key supported or adopted by the mobile terminal is a symmetric key, an asymmetric key, or supports or adopts both a symmetric key and an asymmetric key.
  • the anti-counterfeiting base station key of the mobile terminal with the anti-counterfeiting base station function adopts a symmetric key
  • the mobile terminal accesses and attaches to the network or performs cell reselection
  • the corresponding key of the symmetric anti-counterfeit base station will be activated. Authentication and key agreement distribution process.
  • the anti-counterfeiting base station key of the mobile terminal with anti-counterfeiting base station function adopts an asymmetric key
  • the mobile terminal accesses the network or performs cell reselection, the authentication corresponding to the asymmetric anti-counterfeiting base station key will be initiated And the key agreement distribution process.
  • the mobile terminal may be a user equipment UE, or other terminal equipment supporting mobile communications.
  • the base station (that is, the target base station to be accessed by the terminal) can be configured to support the function of the anti-counterfeiting base station. After the base station supporting the anti-counterfeiting base station obtains the anti-counterfeiting base station key, it can be based on the obtained anti-counterfeiting base station key and the support of this embodiment.
  • the mobile terminals of the anti-counterfeiting base station realize the function of the anti-counterfeiting base station together.
  • the anti-counterfeiting base station capability of the base station can be used as a base station capability, which is identified by the anti-counterfeiting base station capability information.
  • the base station supporting the anti-counterfeiting base station can support the anti-counterfeiting base station key of the symmetric key system, the anti-counterfeiting base station key of the asymmetric key system, or the anti-counterfeiting base station key of the symmetric key system at the same time. And asymmetric key system anti-counterfeiting base station key.
  • the anti-counterfeiting base station capability information of the base station is used to identify the anti-counterfeiting base station capability of the base station.
  • the anti-counterfeiting base station capability information of the base station can be used to identify whether the anti-counterfeiting base station key supported or adopted by the base station is a symmetric key, an asymmetric key, or supports or adopts both a symmetric key and an asymmetric key.
  • the anti-counterfeiting base station key of the base station with the anti-counterfeiting base station function adopts a symmetric key
  • a mobile terminal that supports the same anti-counterfeiting base station capability as the base station accesses and attaches to the network or performs cell reselection, Start the authentication and key negotiation and distribution process corresponding to the symmetric anti-counterfeiting base station key.
  • the anti-counterfeiting base station key of the base station with the anti-counterfeiting base station function adopts an asymmetric key
  • a mobile terminal that supports the same anti-counterfeiting base station capability as the base station accesses the network or performs cell reselection, NAND will be activated.
  • the corresponding authentication and key agreement distribution process of the symmetric anti-counterfeiting base station key when the anti-counterfeiting base station key of the base station with the anti-counterfeiting base station function adopts an asymmetric key, when a mobile terminal that supports the same anti-counterfeiting base station capability as the base station accesses the network or performs cell reselection, NAND will be activated.
  • the corresponding authentication and key agreement distribution process of the symmetric anti-counterfeiting base station key when the anti-counterfeiting base station key of the base station with the anti-counterfeiting base station function adopts an asymmetric key, when a mobile terminal that supports
  • the base station can detect and identify the anti-counterfeiting base station capability information of the mobile terminal.
  • FIG. 9 is a schematic diagram of the mobile terminal key negotiation process provided in this embodiment.
  • the specific process includes:
  • S902 The mobile terminal sends a registration request message to AMF/SEAF.
  • the registration request message here carries the anti-counterfeiting base station capability information of the mobile terminal. It can be understood that the registration request message can also be replaced by an attachment request message.
  • AMF/SEAF sends an authentication request message to AUSF/UDM.
  • the AMF/SEAF After the AMF/SEAF receives the registration request message, it extracts the anti-counterfeiting base station capability information in the registration request message, and generates an authentication request message for the mobile terminal based on the anti-counterfeiting base station capability information and sends it to AUSF/UDM.
  • AUSF/UDM determines the anti-counterfeiting base station capabilities of the mobile terminal and the base station.
  • AUSF/UDM determines the anti-counterfeiting base station capability of the mobile terminal based on the authentication request message, and determines the anti-counterfeiting base station capability of the base station.
  • AUSF/UDM starts an authentication and key agreement process matching the mobile terminal and base station anti-counterfeiting base station capability information.
  • FIG. 10 is another schematic diagram of the mobile terminal key negotiation process provided in this embodiment.
  • the specific process includes:
  • S1002 The mobile terminal sends a registration request message to the AMF/SEAF.
  • the registration request message here carries the anti-counterfeiting base station capability information of the mobile terminal. It can be understood that the registration request message can also be replaced by an attachment request message.
  • AMF/SEAF sends an authentication request message to AUSF/UDM.
  • the AMF/SEAF After the AMF/SEAF receives the registration request message, it extracts the anti-counterfeiting base station capability information in the registration request message, and generates an authentication request message for the mobile terminal based on the anti-counterfeiting base station capability information and sends it to AUSF/UDM.
  • AUSF/UDM determines the anti-counterfeiting base station capabilities of mobile terminals and base stations.
  • AUSF/UDM determines the anti-counterfeiting base station capability of the mobile terminal based on the authentication request message, and determines the anti-counterfeiting base station capability of the base station.
  • AUSF/UDM initiates an authentication and key negotiation process that matches the capability information of the anti-counterfeiting base station.
  • AUSF/UDM directly initiates the authentication and key negotiation and distribution process of the non-counterfeiting base station function.
  • AMF/SEAF sends registration rejection information to the terminal.
  • the network side node such as AMF/SEAF can directly reject, discard or not respond to the registration request of the mobile terminal.
  • the AMF/SEAF can feed back registration rejection information to the terminal, and the registration rejection information contains the reason for the registration rejection, for example, the base station does not support the anti-counterfeiting base station function.
  • Such software may be distributed on a computer-readable medium, executed by a computing device, and in some cases, the steps shown or described may be performed in a different order than the computer-readable medium may include computer storage Media (or non-transitory media) and communication media (or transitory media).
  • computer storage media includes both volatile and nonvolatile implemented in any method or technology for storing information such as computer readable instructions, data structures, program modules, or other data Sex, removable and non-removable media.
  • Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or Any other medium used to store desired information and that can be accessed by a computer.
  • communication media usually contain computer readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media . Therefore, the present invention is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供一种能力上报、密钥协商方法及装置、终端、通信设备及系统，通过终端向通信设备发送防伪基站能力指示信息，该防伪基站能力指示信息能够像通信设备指示终端的防伪基站能力。对于通信设备而言，在获取到终端发送的防伪基站能力指示信息之后，就可以确定出终端的防伪基站能力，进行与该终端防伪基站能力以及目标基站防伪基站能力相匹配的认证与密钥协商过程，从而协商出同终端及目标基站防伪基站能力相匹配的防伪基站密钥供二者通信时进行基站防伪，进而降低伪基站网络攻击的风险，提升终端与基站间通信的安全性，增强用户体验。

Description

能力上报、密钥协商方法及装置、终端、通信设备及系统 技术领域
本发明涉及通信领域，尤其涉及一种能力上报、密钥协商方法及装置、终端、通信设备及系统。
背景技术
为了防止网络攻击，实现对基站的鉴别(authentic)，可以在基站及终端上发放防伪基站密钥，从而使基站利用防伪基站密钥对通信消息或消息中的部分内容进行保护。终端接收到基站发送的消息后，可以依据防伪基站密钥对基站所发送的消息进行鉴别，进而实现对基站进行真伪鉴别。不过，目前网络侧的节点设备并不清楚终端的防伪基站能力，因此，无法基于终端的防伪基站能力进行认证和密钥协商分发。
发明内容
本发明实施例提供的密钥协商方法、装置、终端、通信设备、通信系统，主要解决的技术问题是：通信设备无法了解终端的防伪基站能力，无法基于终端的防伪基站能力进行认证和密钥协商分发。
为解决上述技术问题，本发明实施例提供一种能力上报方法，包括：
向通信设备发送防伪基站能力指示信息，防伪基站能力指示信息用于向通信设备指示本终端的防伪基站能力。
本发明实施例还提供一种密钥协商方法，包括：
获取终端发送的防伪基站能力指示信息，防伪基站能力指示信息用于指示终端的防伪基站能力；
同终端进行与目标基站以及终端二者防伪基站能力相匹配的认证与密钥协商过程，目标基站为终端待接入的基站。
本发明实施例还提供一种能力上报装置，包括：
能力上报模块，设置为向通信设备发送防伪基站能力指示信息，防伪基站能力指示信息用于向通信设备指示本终端的防伪基站能力。
本发明实施例还提供一种密钥协商装置，包括：
能力确定模块，设置为获取终端发送的防伪基站能力指示信息，防伪基站能力指示信息用于指示终端的防伪基站能力；
认证协商模块，设置为同终端进行与目标基站以及终端二者防伪基站能力相匹配的认证与密钥协商过程，目标基站为终端待接入的基站。
本发明实施例还提供一种终端，盖终端包括第一处理器、第一存储器及第一通信总线；
第一通信总线设置为实现第一处理器和第一存储器之间的连接通信；
第一处理器设置为执行第一存储器中存储的一个或者多个程序，以实现上述的能力上报方法的步骤。
本发明实施例还提供一种通信设备，该通信设备包括第二处理器、第二存储器及第二通信总线；
第二通信总线设置为实现第二处理器和第二存储器之间的连接通信；
第二处理器设置为执行第二存储器中存储的一个或者多个程序，以实现上述的密钥协商方法的步骤。
本发明实施例还提供一种通信系统，所述通信系统包括上述的通信设备，以及至少一个上述的终端。
本发明实施例还提供一种存储介质，存储介质存储有能力上报程序和/或密钥协商程序，能力上报程序可被一个或者多个处理器执行，以实现如上的能力上报方法的步骤；密钥协商程序可被一个或者多个处理器执行，以实现如上的密钥协商方法的步骤。
本发明实施例的有益效果是：
根据本发明实施例提供的能力上报、密钥协商方法及装置、终端、通信设备及系统，通过终端向通信设备发送防伪基站能力指示信息，该防伪基站能力指示信息能够像通信设备指示终端的防伪基站能力。对于通信设备而言，在获取到终端发送的防伪基站能力指示信息之后，就可以确定出终端的防伪基站能力，进行与该终端防伪基站能力以及目标基站防伪基站能力相匹配的认证与密钥协商过程，从而协商出同终端及目标基站防伪基站能力相匹配的防伪基站密钥供二者通信时进行基站防伪，进而降低伪基站网络攻击的风险，提升终端与基站间通信的安全性，增强用户体验。
本发明其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本发明说明书中的记载变的显而易见。
附图说明
图1为本发明实施例一中提供的密钥协商方法的一种流程图；
图2为本发明实施例一中提供的终端进行能力上报的一种交互图；
图3为本发明实施例二中提供的能力上报装置的一种结构示意图；
图4为本发明实施例二中提供的密钥协商装置的一种结构示意图；
图5为本发明实施例二中提供的能力上报装置的另一种结构示意图；
图6为本发明实施例三中提供的终端的一种硬件结构示意图；
图7为本发明实施例三中提供的通信设备的一种硬件结构示意图；
图8为本发明实施例三中提供的通信系统的一种结构示意图；
图9为本发明实施例四中提供的移动终端密钥协商流程的一种示意图；
图10为本发明实施例四中提供的移动终端密钥协商流程的另一种示 意图。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本发明实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
实施例一：
3GPP(3rd Generation Partnership Project，第三代合作伙伴计划)制定了各种移动网络的规范，而依据这些规范部署的移动网络也正遭受各种伪基站的攻击，导致攻击能够实施的一大主要原因就是终端无法对基站进行真伪鉴别，从而接受了伪基站发送的各种指示。
为了对基站进行鉴别，必须在基站及终端上发放密钥信息，从而使基站依据这些密钥信息对发送的消息或消息中的部分内容进行保护，从而使得终端可以依据密钥信息对基站发送的消息进行鉴别，进而能够对基站进行真伪鉴别(因为伪基站无法接入移动网络获得这些密钥信息)。
在基站和终端配置防伪基站密钥信息后，由于防伪基站密钥可能采用对称密钥，也可能采用非对称密钥，这使得当终端设备接入网络时，需要启动不同的认证密钥协商过程和防伪基站密钥分发过程。但是，目前终端上报的终端能力信息中没有关于终端是否具有防伪基站能力的指示信息，使得网络侧节点，如AMF(Access Mobility Function，接入和移动管理功能)、SEAF(Security Anchor Function，安全锚点功能)、AUSF(Authentication Server Function，认证服务器功能)和UDM(Unified Data Management，统一数据管理)等不了解终端是否具有防伪基站能力，进而可能导致无法启动与终端和基站的防伪基站能力相匹配的认证和密钥协商分发过程。
为了解决现有技术中通信设备因不了解终端防伪基站能力，从而无法 与终端进行与之防伪基站能力相匹配的认证及密钥协商，导致终端容易接入伪基站，受到网络攻击的问题，本实施例提供一种密钥协商方案，该方案包括终端能力上报流程与认证协商流程，其中终端能力上报流程可以通过终端执行能力上报方法实现，而认证协商流程则通过终端和通信设备共同执行密钥协商方法实现，请参见图1示出的流程图：
S102：终端向通信设备发送防伪基站能力指示信息。
防伪基站能力指示可以仅向通信设备指示终端是否具有防伪基站能力，在这种示例当中，终端和通信设备在进行认证和密钥协商时，所采用的密钥体制是预先约定好的。这样，当终端通过防伪基站能力指示信息向通信设备指示自己具有防伪基站能力时，通信设备就可以和该终端采用预先约定的密钥体制进行认证与密钥协商。
在本实施例的另外一些示例当中，防伪基站能力指示信息不仅能向通信设备指示终端是否具有防伪基站能力，而且还能向通信设备指示终端所支持的防伪基站密钥的密钥体制。例如，在一些示例当中，防伪基站能力指示信息中包括密钥体制指示信息，密钥体制指示信息用于指示终端所支持的防伪基站密钥所属的密钥体制，也即密钥体制指示信息可以表征终端所支持的防伪基站密钥是对称密钥还是非对称密钥，当然，在一些情况中，终端可以同时支持对称体制的防伪基站密钥和非对称机制的防伪基站密钥。
在本实施例中，终端可以通过能力指示信息向通信设备指示自身的防伪基站能力：终端将可以表征自己防伪基站能力的防伪基站能力指示信息携带在能力报告消息中发送给通信设备。在本实施例的一种示例当中，能力报告消息可以是指注册请求消息，也可以是指附着请求消息。在本实施例的一些示例当中，终端可以在注册请求消息中携带防伪基站能力指示信息，同时在附着请求消息中也携带防伪基站能力指示信息，也即注册请求 消息和附着请求消息均属于能力报告消息。
终端在向通信设备发送能力报告消息之前，需要先确定出自己的防伪基站能力。终端的防伪基站能力可以由程序人员预先设置，也可以由用户控制。例如，在本实施例的一些示例当中，用户可以通过控制“防伪基站开关”来控制终端是否具有防伪基站能力。所以，在本实施中，终端在向通信设备发送能力报告消息之前，还会先根据预配置情况或输入指令确定本终端的防伪基站能力指示信息。
本实施例中所谓的终端可以是指用户设备UE，也可以是指其他支持移动通信的终端设备。而通信设备则可以是指AMF网元、SEAF网元、AUSF网元和UDM网元中的至少一个网络设备。应当理解的是，终端将会通过基站将能力报告消息发送给通信设备，该基站即为终端待接入的目标基站。
在本实施例的一些示例当中，终端向通信设备发送的能力报告消息中不仅包括用于指示终端防伪基站能力的防伪基站能力指示信息，也还包括用于指示其他方面能力的指示信息，而需要使用这些能力指示信息的可能是AUSF网元和UDM网元以外的其他网元，例如AMF网元和/或SEAF网元，所以，终端可以将能力报告消息先发送给AMF网元和SEAF网元中的至少一个，由AMF网元和/或SEAF网元在接收到终端的能力报告消息之后，将防伪基站能力指示信息并发送给AUSF网元和/或UDM网元。请参见图2示出的终端进行能力上报的一种交互示意图：
S202：终端将能力报告消息发送给AMF网元。
终端将能力报告消息发送给AMF网元时，是通过基站进行消息转发的，这里所说的基站即指目标基站。可以理解的是，这里只是以AMF网元为例，在本实施例其他一些示例当中，终端也可以将能力报告消息发送给SEAF网元，或者同时发送给AMF网元和SEAF网元。
S204：AMF网元从能力报告消息提取防伪基站能力指示信息。
在本实施例中，考虑到认证与密钥协商分发过程中，AUSF网元仅需要了解终端的防伪基站能力指示信息，对于能力报告消息中的其他能力指示信息并不关系，因此AMF网元接收到终端发送的能力报告消息之后，可以将能力报告消息中的防伪基站能力指示信息提取出来，并发送给AUSF网元。
S206：AMF网元将防伪基站能力指示信息发送给AUSF网元。
AMF网元从能力报告消息提取出终端的防伪基站能力指示信息后，将该防伪基站能力指示信息发送给AUSF网元。
可以理解的是，在本实施例的其他一些示例当中，AMF网元接收到能力报告消息之后，也可以将能力报告消息直接发送给AUSF网元，让AUSF网元自己从能力报告消息中提取终端的防伪基站能力指示信息。
另外，AMF网元将防伪基站能力指示信息或能力报告消息发送给AUSF网元仅仅是一种示例的情况，在其他一些示例当中，AMF网元也可以将防伪基站能力指示信息或能力报告消息发送给UDM网元。
S104：终端同通信设备进行与目标基站及本终端防伪基站能力相匹配的认证与密钥协商过程。
通信设备接收到终端所发送的能力报告消息之后，可以了解终端的防伪基站能力，然后基于终端的防伪基站能力以及目标基站的防伪基站能力同该终端进行对应的认证及密钥协商过程。可以理解的是，通信设备与终端之间进行认证及密钥协商过程是与该终端防伪基站能力及目标基站防伪基站能力相匹配的认证及密钥协商过程。
例如，如果终端的防伪基站能力指示信息表征该终端支持对称体制的防伪基站密钥，同时，目标基站也支持对称体制的防伪基站密钥，则当该终端接入并附着网络时或进行小区重选时，通信设备将启动与对称防伪基 站密钥相应的认证和密钥协商分发过程。在这种情况下，二者所协商出的防伪基站密钥就是对称体制的防伪基站密钥。
例如，如果终端的防伪基站能力指示信息表征该终端支持非对称体制的防伪基站密钥，同时，目标基站也支持非对称体制的防伪基站密钥，则当该终端接入网络时或进行小区重选时，通信设备将启动与非对称防伪基站密钥相应的认证和密钥协商分发过程。在这种情况下，二者所协商出的防伪基站密钥就是非对称体制的防伪基站密钥。
终端的防伪基站能力与目标基站的防伪基站能力可以相同，也可以不同，例如，在一些示例当中，终端仅支持两种密钥体制中的一种，而目标基站可以同时支持两种密钥体制。在另外一些示例当中，终端可以同时支持两种密钥体制，而目标基站仅支持两种密钥体制中的一种。在这种情况下，通信设备开启认证和密钥协商分发过程时，可以选择进行终端和目标基站均支持的密钥体制对应的认证和密钥协商分发过程。但如果终端和目标基站仅支持某一种体制的防伪基站密钥，且二者所支持的密钥体制不同，则通信设备可以按照现有的方式启动认证和密钥协商过程。
毫无疑义的是，在通信设备在与终端进行认证与密钥协商过程之前，不仅需要根据终端的防伪基站能力指示信息确定终端的防伪基站能力，也要确定出目标基站的防伪基站能力。可以理解的是，在通信设备侧，可以预先存储由其所属运营商所部署的各基站的防伪基站能力指示信息，当获取到终端的防伪基站能力指示信息之后，通信设备可以基于能力报告消息确定出终端对应的目标基站，然后查询出目标基站的防伪基站能力指示信息，进而确定目标基站的防伪基站能力。
本发明实施例提供的能力上报方法及密钥协商方法中，终端可以通过防伪基站能力指示信息将自己的防伪基站能力上报给通信设备，让通信设备可以根据防伪基站能力指示信息了解到终端的防伪基站能力，进而在与 终端进行认证与密钥协商的时候，进行与该终端防伪基站能力以及目标基站防伪基站能力相匹配的认证与密钥协商过程，从而协商出同终端及目标基站防伪基站能力相匹配的防伪基站密钥供二者通信时进行基站防伪，降低了终端接入伪基站的概率，增强了终端与基站间通信的安全性，提升了终端侧的用户体验。
实施例二：
本实施例将提供一种能力上报装置，该能力上报装置可以应用于终端侧，例如，该能力上报装置可以部署在终端上，以实现终端向通信设备上报防伪基站能力的目的。请参见图3示出的该能力上报装置的一种结构示意图：
能力上报装置30包括能力上报模块302，能力上报模块302设置为向通信设备发送防伪基站能力指示信息。
本实施例还提供一种密钥协商装置，请参见图4示出的密钥协商装置的一种结构示意图：
密钥协商装置40包括能力确定模块402以及认证协商模块404，其中，能力确定模块402设置为获取终端发送的防伪基站能力指示信息，而认证协商模块404设置为同终端进行与目标基站以及终端二者防伪基站能力相匹配的认证与密钥协商过程。
可以理解的是，能力上报装置30在向通信设备发送防伪基站能力指示信息之前，需要先确定出终端的防伪基站能力，所以，在本实施例中，能力上报装置30中也还可以包括能力确定模块。另外，终端在能力上报装置30向通信设备上报防伪基站能力指示信息后，还需要与该通信设备进行认证与密钥协商，因此，在本实施例的一些示例当中，如图5所示，能力上报装置30中还可以包括密钥协商模块304。
在本实施例中，部署在终端侧的能力上报装置30中，能力上报模块302的功能可以由终端的处理器与通信单元共同实现，当能力上报装置30中包括密钥协商模块304时，密钥协商模块304的功能也可以由终端的处理器与通信单元共同实现。
而密钥协商装置40则可以部署在通信设备上，能力确定模块402以及认证协商模块404的功能均可以通过通信设备的处理器与通信单元共同实现。
防伪基站能力指示可以仅向通信设备指示终端是否具有防伪基站能力，在这种示例当中，能力上报装置30的密钥协商模块304和密钥协商装置40的认证协商模块404在进行认证和密钥协商时，所采用的密钥体制是预先约定好的。这样，当能力上报模块202通过防伪基站能力指示信息向通信设备指示终端具有防伪基站能力时，密钥协商模块304就可以和认证协商模块404采用预先约定的密钥体制进行认证与密钥协商。
在本实施例的另外一些示例当中，防伪基站能力指示信息不仅能指示终端是否具有防伪基站能力，而且还能指示终端所支持的防伪基站密钥的密钥体制。例如，在一些示例当中，防伪基站能力指示信息中包括密钥体制指示信息，密钥体制指示信息可以表征终端所支持的防伪基站密钥所属的密钥体制，例如，终端支持或采用的是对称密钥还是非对称密钥，当然，在一些情况中，终端可以同时支持对称体制的防伪基站密钥和非对称机制的防伪基站密钥。
在本实施例中，能力上报模块302可以通过能力指示信息向通信设备指示终端的防伪基站能力：能力上报模块302将可以表征终端防伪基站能力的防伪基站能力指示信息携带在能力报告消息中发送给通信设备。在本实施例的一种示例当中，能力报告消息可以是指注册请求消息，也可以是指附着请求消息。在本实施例的一些示例当中，能力上报模块302可以在 注册请求消息中携带防伪基站能力指示信息，同时在附着请求消息中也携带防伪基站能力指示信息，也即注册请求消息和附着请求消息均属于能力报告消息。
能力上报模块302在向密钥协商装置40发送能力报告消息之前，需要先确定出自己的防伪基站能力。终端的防伪基站能力可以由程序人员预先设置，也可以由用户控制。例如，在本实施例的一些示例当中，用户可以通过控制“防伪基站开关”来控制终端是否具有防伪基站能力。所以，在本实施中，终端在向密钥协商装置40发送能力报告消息之前，还会先根据预配置情况或输入指令确定终端的防伪基站能力指示信息。
本实施例中所谓的终端可以是指用户设备UE，也可以是指其他支持移动通信的终端设备。而密钥协商装置40所在的通信设备则可以是指部署有AUSF网元和UDM网元中的至少一个的网络设备。应当理解的是，终端将会通过基站将能力报告消息发送给通信设备，该基站即为终端待接入的目标基站。
在本实施例的一些示例当中，能力上报模块302向密钥协商装置40发送的能力报告消息中包括用于指示终端防伪基站能力的防伪基站能力指示信息，也还包括用于指示其他方面能力的指示信息，而需要使用这些能力指示信息的可能是AUSF网元和UDM网元以外的其他网元，例如AMF网元和/或SEAF网元，所以，能力上报模块302可以将能力报告消息先发送给AMF网元和SEAF网元中的至少一个，由AMF网元和/或SEAF网元在接收到能力上报模块302的能力报告消息之后，将防伪基站能力指示信息并发送给AUSF网元和/或UDM网元。
可选地，能力上报模块302将能力报告消息发送给AMF网元时，是通过基站进行消息转发的，这里所说的基站即指目标基站。可以理解的是，这里只是以AMF网元为例，在本实施例其他一些示例当中，能力上报模 块302也可以将能力报告消息发送给SEAF网元，或者同时发送给AMF网元和SEAF网元。
在本实施例中，考虑到认证与密钥协商分发过程中，AUSF网元仅需要了解终端的防伪基站能力指示信息，对于能力报告消息中的其他能力指示信息并不关系，因此AMF网元接收到终端发送的能力报告消息之后，可以将能力报告消息中的防伪基站能力指示信息提取出来，并发送给AUSF网元。
AMF网元从能力报告消息提取出终端的防伪基站能力指示信息后，将该防伪基站能力指示信息发送给AUSF网元。
可以理解的是，在本实施例的其他一些示例当中，AMF网元接收到能力报告消息之后，也可以将能力报告消息直接发送给AUSF网元，让AUSF网元自己从能力报告消息中提取终端的防伪基站能力指示信息。
另外，AMF网元将防伪基站能力指示信息或能力报告消息发送给AUSF网元仅仅是一种示例的情况，在其他一些示例当中，AMF网元也可以将防伪基站能力指示信息或能力报告消息发送给UDM网元。
密钥协商装置40的能力确定模块402可以根据能力上报模块302发送的防伪基站能力指示信息确定终端的防伪基站能力：接收到能力上报模块302所发送的能力报告消息之后，能力确定模块402可以了解终端的防伪基站能力，然后由认证协商模块404基于终端的防伪基站能力以及目标基站的防伪基站能力同该终端进行对应的认证及密钥协商过程。可以理解的是，认证协商模块404与终端之间进行认证及密钥协商过程是与该终端防伪基站能力及目标基站防伪基站能力相匹配的认证及密钥协商过程。
例如，如果终端的防伪基站能力指示信息表征该终端支持对称体制的防伪基站密钥，同时，目标基站也支持对称体制的防伪基站密钥，则当该终端接入并附着网络时或进行小区重选时，认证协商模块404将启动与对 称防伪基站密钥相应的认证和密钥协商分发过程。在这种情况下，二者所协商出的防伪基站密钥就是对称体制的防伪基站密钥。
例如，如果终端的防伪基站能力指示信息表征该终端支持非对称体制的防伪基站密钥，同时，目标基站也支持非对称体制的防伪基站密钥，则当该终端接入网络时或进行小区重选时，认证协商模块404将启动与非对称防伪基站密钥相应的认证和密钥协商分发过程。在这种情况下，二者所协商出的防伪基站密钥就是非对称体制的防伪基站密钥。
终端的防伪基站能力与目标基站的防伪基站能力可以相同，也可以不同，例如，在一些示例当中，终端仅支持两种密钥体制中的一种，而目标基站可以同时支持两种密钥体制。在另外一些示例当中，终端可以同时支持两种密钥体制，而目标基站仅支持两种密钥体制中的一种。在这种情况下，认证协商模块404开启认证和密钥协商分发过程时，可以选择进行终端和目标基站均支持的密钥体制对应的认证和密钥协商分发过程。但如果终端和目标基站仅支持某一种体制的防伪基站密钥，且二者所支持的密钥体制不同，则认证协商模块404可以按照现有的方式启动认证和密钥协商分发过程。
毫无疑义的是，在认证协商模块404在与终端进行认证与密钥协商过程之前，不仅需要根据终端的防伪基站能力指示信息确定终端的防伪基站能力，也要确定出目标基站的防伪基站能力。可以理解的是，在密钥协商装置40，可以预先存储由其所属运营商所部署的各基站的防伪基站能力指示信息，当获取到终端的防伪基站能力指示信息之后，密钥协商装置40可以基于能力报告消息确定出终端对应的目标基站，然后查询出目标基站的防伪基站能力指示信息，进而确定目标基站的防伪基站能力。
本发明实施例提供的能力上报装置可以通过防伪基站能力指示信息将终端的防伪基站能力上报给密钥协商装置，让密钥协商装置可以根据防 伪基站能力指示信息了解到终端的防伪基站能力，进而在与终端进行认证与密钥协商的时候，进行与该终端防伪基站能力以及目标基站防伪基站能力相匹配的认证与密钥协商过程，从而协商出同终端及目标基站防伪基站能力相匹配的防伪基站密钥供二者通信时进行基站防伪，降低了终端接入伪基站的概率，增强了终端与基站间通信的安全性，提升了终端侧的用户体验。
实施例三：
本实施例提供一种存储介质，该存储介质中可以存储有一个或多个可供一个或多个处理器读取、编译并执行的计算机程序，在本实施例中，该存储介质可以存储有能力上报程序和密钥协商程序中的一个，其中，能力上报程序可供一个或多个处理器执行实现前述实施例中介绍的任意一种能力上报方法。密钥协商程序可供一个或多个处理器执行实现前述实施例中介绍的任意一种密钥协商方法。
本实施例中还提供一种终端，请参见图6：终端60包括第一处理器61、第一存储器62以及用于连接第一处理器61与第一存储器62的第一通信总线63，其中第一存储器62可以为前述存储有能力上报程序的存储介质：
第一处理器61可以向通信设备发送防伪基站能力指示信息，该防伪基站能力指示信息用于向通信设备指示本终端60的防伪基站能力。
本实施例中还提供一种通信设备，如图7所示：通信设备70包括第二处理器71、第二存储器72以及用于连接第二处理器71与第二存储器72的第二通信总线73，其中第二存储器72可以为前述存储有密钥协商程序的存储介质：
第二处理器71获取终端发送的防伪基站能力指示信息，然后同终端 进行与目标基站以及终端二者防伪基站能力相匹配的认证与密钥协商过程，这里所谓的目标基站是指终端待接入的基站。
终端60实现能力上报方法的细节，以及通信设备70实现密钥协商方法的细节可以参见前述实施例的介绍，这里不再赘述。
本实施例还提供一种通信系统，请参见图8，该通信系统8包括通信设备70以及至少一个终端60，可以理解的是，在本实施例的其他一些示例当中，通信系统8当中也可以同时包括多个通信设备70以及多个终端60，各终端60可以实现前述实施例中介绍的能力上报方法，而通信设备70则可以实现前述实施例中介绍的密钥协商方法。通过终端60和通信设备70的相互配合，使得通信系统8中通信设备70可以了解终端60的防伪基站能力，进而在同终端60进行认证及密钥协商时，使得认证及密钥协商过程契合终端60及对应目标基站的防伪基站能力。
本发明实施例提供的通信系统，通过终端向通信设备发送防伪基站能力指示信息，该防伪基站能力指示信息能够像通信设备指示终端的防伪基站能力。对于通信设备而言，在获取到终端发送的防伪基站能力指示信息之后，就可以确定出终端的防伪基站能力，进行与该终端防伪基站能力以及目标基站防伪基站能力相匹配的认证与密钥协商过程，从而协商出同终端及目标基站防伪基站能力相匹配的防伪基站密钥供二者通信时进行基站防伪，进而降低伪基站网络攻击的风险，提升终端与基站间通信的安全性，增强用户体验。
实施例四：
为了使本领域技术人员更清楚密钥协商方案的优点与细节，本实施例将结合示例继续对前述实施例中提供的能力上报、密钥协商方法及终端、通信设备及通信系统作进一步说明：
这里假定终端为移动终端，而通信设备则是部署有AUSF网元和/或UDM网元(以下简称“AUSF/UDM”)的节点设备，另外，在本实施例中，移动终端能力上报、认证与密钥协商过程还涉及到AMF网元和/或SEAF网元(以下简称“AMF/SEAF”)：
移动终端可以配置支持防伪基站的功能。在本实施例中，移动终端设备可以预配置为支持防伪基站，也可以由用户通过移动终端设备用户界面将移动终端设备设置为支持防伪基站。
在本实施例中，支持防伪基站的移动终端获得防伪基站密钥后即可以基于获得的防伪基站密钥与本实施例支持防伪基站的基站一起实现防伪基站功能。
在本实施例中，支持防伪基站的移动终端，可以支持对称密钥体制的防伪基站密钥，也可以支持非对称密钥体制的防伪基站密钥，或者同时支持对称密钥体制的防伪基站密钥和非对称密钥体制的防伪基站密钥。移动终端的防伪基站能力可以作为一种终端能力，用防伪基站能力信息来标识。移动终端的防伪基站能力信息和基站的防伪基站能力信息可以相同，也可以不同。
在本实施例中，移动终端设备的防伪基站能力信息信息用以标识移动终端的防伪基站能力。可选地，移动终端的防伪基站能力信息可以用以识别移动终端支持或采用的防伪基站密钥是对称密钥、非对称密钥，还是同时支持或采用对称密钥和非对称密钥。
在本实施例中，具有防伪基站功能的移动终端的防伪基站密钥采用对称密钥时，当移动终端接入并附着网络时或进行小区重选时，将启动与对称防伪基站密钥相应的认证和密钥协商分发过程。
在本实施例中，具有防伪基站功能的移动终端的防伪基站密钥采用非对称密钥时，当移动终端接入网络或进行小区重选时，将启动与非对称防 伪基站密钥相应的认证和密钥协商分发过程。
在本实施例中移动终端可以是用户设备UE，也可以是其他支持移动通信的终端设备。
在本实施例中，基站(即终端待接入的目标基站)可以配置支持防伪基站的功能，支持防伪基站的基站获得防伪基站密钥后即可以基于获得的防伪基站密钥与本实施例支持防伪基站的移动终端一起实现防伪基站功能。基站的防伪基站能力可以作为一种基站能力，用防伪基站能力信息来标识。
在本实施例中，支持防伪基站的基站，可以支持对称密钥体制的防伪基站密钥，也可以支持非对称密钥体制的防伪基站密钥，或者同时支持对称密钥体制的防伪基站密钥和非对称密钥体制的防伪基站密钥。
在本实施例中，基站的防伪基站能力信息用以标识基站的防伪基站能力。可选地，基站的防伪基站能力信息可以用以识别基站支持或采用的防伪基站密钥是对称密钥、非对称密钥，还是同时支持或采用对称密钥和非对称密钥。
在本实施例中，具有防伪基站功能的基站的防伪基站密钥采用对称密钥时，当支持具有与基站相同防伪基站能力的的移动终端接入并附着网络时或进行小区重选时，将启动与对称防伪基站密钥相应的认证和密钥协商分发过程。
在本实施例中，具有防伪基站功能的基站的防伪基站密钥采用非对称密钥时，当支持具有与基站相同防伪基站能力的移动终端接入网络或进行小区重选时，将启动与非对称防伪基站密钥相应的认证和密钥协商分发过程。
在本实施例中，基站可以检测并识别移动终端的防伪基站能力信息。
在本实施例的第一方面，在移动终端配置为支持防伪基站，或者用户 通过用户界面将移动终端设置为支持防伪基站，并且在基站配置为支持防伪基站的情况下，当移动终端设备接入并附着网络时或进行小区重选时，图9为本实施例提供的移动终端密钥协商流程的一种示意图，具体流程包括：
S902：移动终端向AMF/SEAF发送注册请求消息。
这里的注册请求消息中携带移动终端的防伪基站能力信息，可以理解的是，注册请求消息也可以采用附着请求消息替代。
S904：AMF/SEAF向AUSF/UDM发送认证请求消息。
AMF/SEAF接收到注册请求消息后，将注册请求消息中的防伪基站能力信息提取出来，依据该防伪基站能力信息生成针对移动终端的认证请求消息发送给AUSF/UDM。
S906：AUSF/UDM确定移动终端和基站的防伪基站能力。
AUSF/UDM基于认证请求消息确定移动终端的防伪基站能力，并确定基站的防伪基站能力。
S908：AUSF/UDM启动与移动终端、基站防伪基站能力信息相匹配的认证和密钥协商过程。
在本实施例的第二方面，在移动终端设备预设值为支持防伪基站，或者用户通过用户界面将移动终端设置为支持防伪基站，并且在基站不支持防伪基站的情况下，当移动终端设备接入并附着网络时或进行小区重选时，图10为本实施例提供的移动终端密钥协商流程的另一种示意图，具体流程包括：
S1002：移动终端向AMF/SEAF发送注册请求消息。
这里的注册请求消息中携带移动终端的防伪基站能力信息，可以理解的是，注册请求消息也可以采用附着请求消息替代。
S1004：AMF/SEAF向AUSF/UDM发送认证请求消息。
AMF/SEAF接收到注册请求消息后，将注册请求消息中的防伪基站能力信息提取出来，依据该防伪基站能力信息生成针对移动终端的认证请求消息发送给AUSF/UDM。
S1006：AUSF/UDM确定移动终端和基站的防伪基站能力。
AUSF/UDM基于认证请求消息确定移动终端的防伪基站能力，并确定基站的防伪基站能力。
S1008：AUSF/UDM启动无防伪基站能力信息相匹配的认证和密钥协商过程。
由于基站不支持防伪基站，AUSF/UDM直接启动无防伪基站功能的认证和密钥协商分发过程。
S1010：AMF/SEAF向终端发送拒绝注册信息。
可选的，在基站不支持防伪基站的情况下，网络侧节点如AMF/SEAF可以直接拒绝、丢弃或不响应移动终端的注册请求。在本实施例的另外一些示例中，AMF/SEAF可以向终端反馈拒绝注册信息，拒绝注册信息中包含拒绝注册的原因，如基站不支持防伪基站功能。
显然，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件， 或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM,ROM,EEPROM、闪存或其他存储器技术、CD-ROM，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本发明不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本发明实施例所作的进一步详细说明，不能认定本发明的具体实施只局限于这些说明。对于本发明所属技术领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本发明的保护范围。

Claims (17)

  1. 一种能力上报方法，包括：
    向通信设备发送防伪基站能力指示信息，所述防伪基站能力指示信息用于向所述通信设备指示本终端的防伪基站能力。
  2. 如权利要求1所述的能力上报方法，其中，所述向通信设备发送防伪基站能力指示信息包括：
    向所述通信设备发送携带防伪基站能力指示信息的能力报告消息，所述能力报告消息包括注册请求消息、附着请求消息中的至少一种。
  3. 如权利要求2所述的能力上报方法，其中，所述向所述通信设备发送携带防伪基站能力指示信息的能力报告消息包括：
    将所述能力报告消息发送给接入和移动管理功能AMF网元和安全锚点功能SEAF网元中的至少一个。
  4. 如权利要求1-3任一项所述的能力上报方法，其中，所述防伪基站能力指示信息包括密钥体制指示信息，所述密钥体制指示信息用于向所述通信设备指示本终端所支持的防伪基站密钥所属的密钥体制。
  5. 根据权利要求4所述的能力上报方法，其中，本终端支持或采用的防伪基站密钥的密钥体制包括：对称密钥，或者，非对称密钥，或者，对称密钥和非对称密钥。
  6. 一种密钥协商方法，包括：
    获取终端发送的防伪基站能力指示信息，所述防伪基站能力指示信息用于指示所述终端的防伪基站能力；
    同所述终端进行与目标基站以及所述终端二者防伪基站能力相匹配的认证与密钥协商过程，所述目标基站为所述终端待接入的基站。
  7. 如权利要求6所述的密钥协商方法，其中，所述获取终端发送的防伪基站能力指示信息包括：
    从所述终端发送的能力报告消息中获取所述终端的防伪基站能力指示信息，所述能力报告消息包括注册请求消息、附着请求消息中的至少一种。
  8. 如权利要求7所述的密钥协商方法，其中，所述从所述终端发送的能力报告消息中获取所述终端的防伪基站能力指示信息包括：
    接收AMF网元和SEAF网元中的至少一个发送所述终端的防伪基站能力指示信息，所述AMF网元和SEAF网元中的至少一个根据所述终端所发送的能力报告消息确定所述终端的防伪基站能力指示信息。
  9. 如权利要求6-8任一项所述的密钥协商方法，其中，所述防伪基站能力指示信息包括密钥体制指示信息，所述密钥体制指示信息用于指示所述终端所支持的防伪基站密钥所属的密钥体制。
  10. 根据权利要求9所述的密钥协商方法，其中，所述终端支持或采用的防伪基站密钥的密钥体制包括：对称密钥，或者，非对称密钥，或者，对称密钥和非对称密钥。
  11. 如权利要求10所述的密钥协商方法，其中，所述同所述终端进行与目标基站以及所述终端二者防伪基站能力相匹配的认证与密钥协商过程包括：
    若所述终端与所述目标基站均支持对称防伪基站密钥，则与所述终端进行与对称防伪基站密钥相应的认证和密钥协商过程；
    若所述终端与所述目标基站均支持非对称防伪基站密钥，则与所述终端进行与非对称防伪基站密钥相应的认证和密钥协商过程。
  12. 一种能力上报装置，包括：
    能力上报模块，设置为向通信设备发送防伪基站能力指示信息，所述防伪基站能力指示信息用于向所述通信设备指示本终端的防伪基站能力。
  13. 一种密钥协商装置，包括：
    能力确定模块，设置为获取终端发送的防伪基站能力指示信息，所述防伪基站能力指示信息用于指示所述终端的防伪基站能力；
    认证协商模块，设置为同所述终端进行与目标基站以及所述终端二者防伪基站能力相匹配的认证与密钥协商，所述目标基站为所述终端待接入的基站。
  14. 一种终端，所述终端包括第一处理器、第一存储器及第一通信总线；
    所述第一通信总线设置为实现第一处理器和第一存储器之间的连接通信；
    所述第一处理器设置为执行第一存储器中存储的一个或者多个程序，以实现如权利要求1至5中任一项所述的能力上报方法的步骤。
  15. 一种通信设备，所述通信设备包括第二处理器、第二存储器及第二通信总线；
    所述第二通信总线设置为实现第二处理器和第二存储器之间的连接通信；
    所述第二处理器设置为执行第二存储器中存储的一个或者多个程序，以实现如权利要求6至11中任一项所述的密钥协商方法的步骤。
  16. 如权利要求15所述的通信设备，所述通信设备上部署有AUSF网元和UDM网元中的至少一个。
  17. 一种通信系统，其中，所述通信系统包括如权利要求15或16所述的通信设备，以及至少一个如权利要求14所述的终端
PCT/CN2019/126746 2019-01-18 2019-12-19 能力上报、密钥协商方法及装置、终端、通信设备及系统 WO2020147509A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19909990.4A EP3913952A4 (en) 2019-01-18 2019-12-19 METHOD AND DEVICE FOR REPORTING KEY CAPACITY AND NEGOTIATION, TERMINAL, COMMUNICATION DEVICE AND SYSTEM
US17/423,888 US20220124493A1 (en) 2019-01-18 2019-12-19 Method and Device for Reporting Capacity, Method and Device for Key Agreement, Terminal and Communication Device and System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910048552.2 2019-01-18
CN201910048552.2A CN111465019B (zh) 2019-01-18 2019-01-18 能力上报、密钥协商方法及装置、终端、通信设备及系统

Publications (1)

Publication Number Publication Date
WO2020147509A1 true WO2020147509A1 (zh) 2020-07-23

Family

ID=71613545

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/126746 WO2020147509A1 (zh) 2019-01-18 2019-12-19 能力上报、密钥协商方法及装置、终端、通信设备及系统

Country Status (4)

Country Link
US (1) US20220124493A1 (zh)
EP (1) EP3913952A4 (zh)
CN (1) CN111465019B (zh)
WO (1) WO2020147509A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014056538A1 (en) * 2012-10-11 2014-04-17 Nokia Solutions And Networks Oy Fake base station detection with core network support
CN107222860A (zh) * 2016-03-22 2017-09-29 中兴通讯股份有限公司 一种识别伪基站的方法和装置
CN108966236A (zh) * 2018-07-02 2018-12-07 奇酷互联网络科技（深圳）有限公司 伪基站识别开关控制方法、装置、移动终端及存储介质
CN109151829A (zh) * 2018-10-25 2019-01-04 北京小米智能科技有限公司 伪基站识别方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5303611B2 (ja) * 2011-06-29 2013-10-02 アンリツ株式会社 移動通信端末試験装置及び移動通信端末試験方法
CN104581710B (zh) * 2014-12-18 2018-11-23 中国科学院信息工程研究所 一种在空口上安全传输lte用户imsi的方法和系统
CN110521228B (zh) * 2017-06-16 2024-04-02 摩托罗拉移动有限责任公司 恶意单元检测信息
US10869195B2 (en) * 2018-04-23 2020-12-15 T-Mobile Usa, Inc. Network assisted validation of secure connection to cellular infrastructure

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014056538A1 (en) * 2012-10-11 2014-04-17 Nokia Solutions And Networks Oy Fake base station detection with core network support
CN107222860A (zh) * 2016-03-22 2017-09-29 中兴通讯股份有限公司 一种识别伪基站的方法和装置
CN108966236A (zh) * 2018-07-02 2018-12-07 奇酷互联网络科技（深圳）有限公司 伪基站识别开关控制方法、装置、移动终端及存储介质
CN109151829A (zh) * 2018-10-25 2019-01-04 北京小米智能科技有限公司 伪基站识别方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NEC: "pCR to TR 33.899: Update of solution #1.30", 3GPP TSG SA WG3 (SECURITY) MEETING #86BIS, S3-170821, 31 March 2017 (2017-03-31), XP051258509 *

Also Published As

Publication number Publication date
CN111465019A (zh) 2020-07-28
EP3913952A1 (en) 2021-11-24
EP3913952A4 (en) 2022-02-23
CN111465019B (zh) 2023-09-19
US20220124493A1 (en) 2022-04-21

Similar Documents

Publication Publication Date Title
CN110800331B (zh) 网络验证方法、相关设备及系统
EP3570515A1 (en) Method, device, and system for invoking network function service
EP4117343A1 (en) Service authentication method, apparatus and system
US9380038B2 (en) Bootstrap authentication framework
KR20160114620A (ko) 동적 네트워크 액세스 관리를 위한 방법들, 디바이스들 및 시스템들
US10542433B2 (en) Connection establishment method, device, and system
US10681546B2 (en) Processing method for sim card equipped terminal access to 3GPP network and apparatus
CN112512045B (zh) 一种通信系统、方法及装置
US10158993B2 (en) Wireless communications
WO2016131289A1 (zh) 无线热点安全性检测方法、装置及用户设备
WO2019056971A1 (zh) 一种鉴权方法及设备
CN111132305A (zh) 5g用户终端接入5g网络的方法、用户终端设备及介质
CN110891270B (zh) 一种鉴权算法的选择方法和装置
WO2020147509A1 (zh) 能力上报、密钥协商方法及装置、终端、通信设备及系统
US20220360586A1 (en) Apparatus, methods, and computer programs
CN109246847B (zh) 网络接入方法及系统
US20220174490A1 (en) System, method, storage medium and equipment for mobile network access
US11943618B2 (en) Forcing re-authentication of users for accessing online services
WO2016177223A1 (zh) 核心网的接入控制方法及装置
CN107846410B (zh) 一种入网验证的方法和装置
CN108076009B (zh) 一种资源共享方法、装置及系统
CN110536295B (zh) 初始接入控制方法、装置、终端、智能卡及存储介质
WO2020147354A1 (zh) 防伪基站方法及装置、计算机可读存储介质
US20240098477A1 (en) Roaming validation method for access network providers
RU2792657C2 (ru) Способ вызова сервисного api и соответствующее устройство

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19909990

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019909990

Country of ref document: EP

Effective date: 20210818