WO2020199700A1

WO2020199700A1 - Authentication method and communication apparatus

Info

Publication number: WO2020199700A1
Application number: PCT/CN2020/070143
Authority: WO
Inventors: 李飞; 李华
Original assignee: 华为技术有限公司
Priority date: 2019-03-29
Filing date: 2020-01-02
Publication date: 2020-10-08
Also published as: CN111757311A; CN111757311B

Abstract

Provided in the embodiments of the present invention are an authentication method and a communication apparatus. The method comprises: a data management network element sending an authentication vector acquisition request to a home subscriber server, the authentication vector acquisition request comprising authentication type information; and the home subscriber server generating an authentication vector according to the authentication type information, and sending the authentication vector to the data management network element. As such, the data management network element may directly or indirectly indicate the type of the currently requested authentication vector by means of the authentication type information in the authentication vector acquisition request; for example, the authentication vector may be a 5G authentication vector so that the home subscriber server provides the 5G authentication vector to the data management network element to support the data management network element to complete 5G authentication, thus solving the problem wherein UDM and a HSS are deployed separately but authentication data is stored in the HSS, and in the process of authenticating a terminal device, calculation parameters of UDM and the HSS are inconsistent. At the same time, the problem wherein service-oriented transformation must be performed on an HSS in order to support UDM for 5G authentication is avoided.

Description

An authentication method and communication device

Cross references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is 201910250742.2, and the application name is "An authentication method and communication device" on March 29, 2019. The entire content of this application is incorporated into this application by reference. in.

Technical field

This application relates to the field of communication technology, and in particular to an authentication method and communication device.

Background technique

In the transition from 4G network to 5G network, unified data management (UDM) and home subscriber server (HSS) may be deployed separately, and the user's key storage and authentication vector will be realized by HSS Calculation. In an application scenario, a mobility management entity (MME) and UDM will request a 4G authentication vector and a 5G authentication vector from the HSS respectively, but the current HSS cannot distinguish which authentication vector is requested. HSS may provide 4G authentication vector by default, which will cause UDM to obtain 4G authentication vector from HSS and fail to complete 5G authentication.

In the prior art, a service-oriented approach is adopted to solve this problem, and HSS is required to be service-oriented so that the HSS can support communication with UDM through a service-oriented interface, but the HSS changes are relatively large and complex.

Summary of the invention

The embodiments of the present application provide an authentication method and a communication device to solve the technical problem that UDM cannot complete 5G authentication in a scenario where UDM and HSS are deployed separately.

In the first aspect, embodiments of the present application provide an authentication method, which can be applied to a data management network element, for example, UDM, and correspondingly, the home user server can be HSS. The method includes: a data management network element sends an authentication vector acquisition request to a home user server, the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the authentication vector requested; the data management network The element receives the authentication vector sent by the home user server, and the authentication vector is generated by the home user server according to the authentication type information.

Using the technical solution in the embodiment of the present application, the data management network element can obtain the authentication type information in the request through the authentication vector to directly or indirectly indicate the type of the authentication vector currently requested, for example, it may be a 5G authentication vector. So that the home user server can provide 5G authentication vector to it, support the data management network element to complete 5G authentication, and solve the separate deployment of UDM and HSS, but the authentication data is stored in HSS. In the process of authenticating terminal equipment, UDM and HSS The problem of inconsistent calculation parameters. At the same time, it can also avoid the need to transform HSS into a service to support UDM for 5G authentication.

With reference to the first aspect, in the first possible design of the first aspect, the authentication vector includes the first expected response XRES*, the first authentication token AUTN, the authentication service key Kausf, and the random number RAND. In this way, the 5G authentication vector generated by the HSS can support UDM to complete 5G authentication in the manner of 5G AKA, thereby improving the applicability of the authentication method.

With reference to the first aspect, in the second possible design of the first aspect, the authentication vector includes the second expected response XRES, the second authentication token AUTN, the first encryption key CK, the first integrity key IK, and The random number RAND, the AMF indicator of the authentication management field of the second AUTN is a set value, for example, it can be set to 1. In addition, the data management network element can also determine the second encryption key CK' and The second integrity key IK'. Optionally, the data management network element may determine CK' and IK' after receiving the authentication vector. In this way, the 5G authentication vector generated by HSS can support UDM to complete 5G authentication in the way of EAP-AKA', avoiding the problem of excessive calculation of 5G authentication vector generated by HSS and large changes to HSS, and improving the authentication method Applicability.

Combining the first aspect and the first or second possible design of the first aspect, in the third possible design of the first aspect, the authentication vector acquisition request includes the international mobile subscriber identity IMSI of the terminal device, and the IMSI is used To instruct the home user server to provide the authentication vector corresponding to the terminal device, the IMSI is obtained by the data management network element according to the user permanent identity SUPI of the terminal device. In this way, UDM can carry the IMSI information of the terminal equipment to request an authentication vector from the HSS, thereby avoiding that the user ID at UDM is SUPI and the user ID at HSS is IMSI, and the user IDs used in the two locations are inconsistent, causing HSS to not know the request. Which terminal device’s authentication vector is the problem.

Combining the first aspect and any one of the first to third possible designs of the first aspect, in the fourth possible design of the first aspect, the authentication type information may include the access mode type Information, service network type information, authentication vector type information, and authentication network element type information. In this way, the authentication type information indicates that the type of authentication vector required can have multiple possible implementations. You can use the authentication vector to obtain the existing cell indication in the request, or use the new The cell indication can effectively improve the applicability of the authentication method.

In the second aspect, the embodiments of the present application provide another authentication method, which can be applied to a home user server, such as an HSS, and correspondingly, the data management network element can be UDM. The method includes: a home user server receives an authentication vector acquisition request sent by a data management network element, the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the requested authentication vector; the home user The server generates an authentication vector according to the authentication type information, and sends the authentication vector to the data management network element.

Using the technical solution in the embodiment of this application, the authentication vector acquisition request sent by the data management network element includes authentication type information, and the home user server can identify the authentication vector requested by the data management network element according to the authentication type information. Type, for example, 5G authentication vector, which supports UDM to complete 5G authentication and solves the separate deployment of UDM and HSS, but the authentication data is stored in HSS. During the authentication of terminal equipment, the calculation parameters of UDM and HSS are inconsistent problem. At the same time, it can also avoid the need to transform HSS into a service to support UDM for 5G authentication.

With reference to the second aspect, in the first possible design of the second aspect, the authentication vector includes the first expected response XRES*, the first authentication token AUTN, the authentication service key Kausf, and the random number RAND. In this way, the 5G authentication vector generated by the HSS can support UDM to complete 5G authentication in the manner of 5G AKA, thereby improving the applicability of the authentication method.

With reference to the second aspect, in the second possible design of the second aspect, the authentication vector includes a second expected response XRES, a second authentication token AUTN, a first encryption key CK, a first integrity key IK, and Random number RAND, the AMF indicator of the authentication management domain of the second AUTN is a set value, for example, it can be set to 1, CK and IK are used by the data management network element to determine the second encryption key CK' and the second integrity The secret key IK'. Optionally, the data management network element may determine CK' and IK' according to CK and IK after receiving the authentication vector sent by the home user server. In this way, the 5G authentication vector generated by HSS can support UDM to complete 5G authentication in the way of EAP-AKA', thereby avoiding the problem of excessive calculation of the 5G authentication vector generated by HSS and large changes to HSS, and improving authentication Applicability of the method.

In combination with the second aspect and the first or second possible design of the second aspect, in the third possible design of the second aspect, the authentication vector acquisition request may include the international mobile subscriber identity IMSI of the terminal device, The IMSI is used to instruct the home user server to provide the authentication vector corresponding to the terminal device. The IMSI is obtained by the data management network element according to the user permanent identification SUPI of the terminal device. In this way, the UDM can carry the IMSI information of the terminal equipment to request the authentication vector from the HSS, which can effectively avoid the fact that the user ID at UDM is SUPI and the user ID at HSS is IMSI, and the user IDs used in the two locations are inconsistent, causing HSS to not know It is a question of which terminal device's authentication vector is requested.

Combining the second aspect and any one of the first to third possible designs of the second aspect, in the fourth possible design of the second aspect, the authentication type information may include the access mode Any one of type information, service network type information, authentication vector type information, and authentication network element type information. In this way, the authentication type information indicates that the type of authentication vector required can have multiple possible implementations. You can use the authentication vector to obtain the existing cell indication in the request, or use the new The cell indication can effectively improve the applicability of the authentication method.

In the third aspect, an embodiment of the present application provides a communication device. The communication device may have the function of realizing the data management network element in the first aspect or any of the possible designs of the first aspect. The communication device may be a data management network element, such as UDM, or a data management network element. The included chips may also be other communication devices used to implement the functions of data management network elements. Alternatively, the communication device may also have the function of implementing the home user server in the second aspect or any of the possible designs of the second aspect. The communication device may be the home user server or a chip included in the home user server. , Or other communication devices used to implement the home user server function. The above-mentioned functions may be realized by hardware, or may be realized by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In a possible design, the structure of the communication device includes a processing module and a transceiver module, wherein the processing module is configured to support the communication device to perform the corresponding function in the first aspect or any one of the first aspects. , Or perform the corresponding function in the second aspect or any one of the second aspects mentioned above. The transceiver module is used to support the communication between the communication device and other communication equipment. For example, when the communication device is a data management network element, the transceiver module sends an authentication vector acquisition request to the home user server, and when the communication device is a home user server, The module sends the authentication vector to the data management network element. The communication device may also include a storage module, which is coupled with the processing module, which stores program instructions and data necessary for the communication device. As an example, the processing module may be a processor, the communication module may be a transceiver, and the storage module may be a memory. The memory may be integrated with the processor or may be provided separately from the processor, which is not limited in this application.

In another possible design, the structure of the communication device includes a processor and a memory, and the processor is coupled to the memory and can be used to execute computer program instructions stored in the memory, so that the communication device executes the first aspect or the first aspect. The method in any possible design of the aspect, or the communication device executes the second aspect or the method in any possible design of the second aspect. Optionally, the communication device further includes a communication interface, and the processor is coupled with the communication interface. When the communication device is a first network device, the communication interface may be a transceiver or an input/output interface; when the communication device is a chip included in the first network device, the communication interface may be an input/output interface of the chip. Optionally, the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.

In a fourth aspect, an embodiment of the present application provides a chip system, including: a processor, the processor is coupled to a memory, the memory is used to store a program or an instruction, when the program or instruction is executed by the processor , So that the chip system implements any possible design method of the foregoing first aspect, or implements any possible design method of the foregoing second aspect.

Optionally, there may be one or more processors in the chip system. The processor can be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented by software, the processor can be a general-purpose processor, implemented by reading software codes stored in the memory.

Optionally, there may be one or more memories in the chip system. The memory may be integrated with the processor, or may be provided separately from the processor, which is not limited in this application. Exemplarily, the memory may be a non-transitory processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip, or may be set on different chips. The setting method of the processor is not specifically limited.

In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer-readable instructions. When the computer reads and executes the computer-readable instructions, the computer is caused to execute the first The method in any possible design of the aspect, or the method in any possible design of the above-mentioned second aspect.

In a sixth aspect, the embodiments of the present application provide a computer program product. When the computer reads and executes the computer program product, the computer executes any of the possible design methods in the first aspect, or executes the first Any of the two possible design methods.

In a seventh aspect, an embodiment of the present application provides a communication system, which includes one or more network elements of the data management network element and the home user server described in the foregoing aspect.

Description of the drawings

FIG. 1 is a schematic diagram of a network architecture of a communication system to which an embodiment of this application is applicable;

2 is a schematic flowchart of an authentication method provided by an embodiment of this application;

3a and 3b are schematic diagrams of another flow of an authentication method provided by an embodiment of this application;

4 is a schematic structural diagram of a communication device provided by an embodiment of this application;

FIG. 5 is a schematic diagram of another structure of a communication device provided by an embodiment of this application.

detailed description

In order to make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

The technical solutions provided by the embodiments of this application can be applied to long term evolution (LTE) systems, advanced long term evolution (LTE-A) systems, and universal mobile telecommunication systems (UMTS) , Evolved long-term evolution (evolved long term evolution, eLTE) system, 5G system, or other mobile communication systems that will evolve in the future.

Please refer to Figure 1, which is a network architecture diagram of a communication system to which this embodiment of the application applies. The communication system takes a 5G communication system as an example, including: authentication server function (authentication server function, AUSF) network elements, unified data management ( unified data management (UDM) network element, access and mobility management function (AMF) network element, session management function (session management function, SMF) network element, policy control function (PCF) ) Network element, application function (AF) network element, user plane function (UPF) network element, data network (DN), (radio) access network, (R) AN) and terminal equipment (user equipment, UE).

These network elements are logically interconnected through service-oriented interfaces. As shown in Figure 1, the terminal equipment and the AMF are interconnected through the N1 interface, (R)AN and AMF are interconnected through the N2 interface, (R)AN and UPF are interconnected through the N3 interface, and between UPF and SMF They are interconnected through N4 interface, PCF and AF are interconnected through N5 interface, UPF and DN are interconnected through N6 interface, SMF and PCF are interconnected through N7 interface, and AMF and UDM are interconnected through N8 interface. , UPF and UPF are interconnected through N9 interface, UDM and SMF are interconnected through N10 interface, SMF and AMF are interconnected through N11 interface, AMF and AUSF are interconnected through N12 interface, and between AUSF and UDM The interconnection is achieved through the N13 interface, the AMF and the AMF are interconnected through the N14 interface, and the AMF and the PCF are interconnected through the N15 interface.

The communication system provided by the embodiments of this application may also include a home subscriber server (HSS) reserved during the evolution of the 4G network to the 5G network, and the HSS is used to store user subscription data of the 4G network and location information of the mobile terminal , And used to generate the authentication vector. The HSS can communicate with the UDM in the 5G network and the mobility management entity (MME) in the 4G network through different protocol interfaces.

The authentication method provided in the embodiment of the present application mainly involves AMF, AUSF, UDM, and HSS in the above-mentioned network architecture. Among them, AMF is used to be responsible for the access management and mobility management of terminal equipment, for example, the management of terminal equipment in terms of access authorization/authentication. When the terminal device is registered to the serving network, the AMF of the serving network will call the UE authentication request service provided by the home network AUSF, and receive the authentication vector returned by the home network AUSF as a response to the UE authentication request service, for example, 5G authentication Vector, complete the authentication of terminal equipment in the service network. After the terminal device is authenticated in the service network, the AMF can initiate a registration process to obtain user subscription data in UDM.

AUSF, used for authentication. After the UE authentication request service provided by the home network AUSF is invoked, the AUSF may further invoke the UE authentication acquisition request service provided by UDM to apply for obtaining an authentication vector, for example, a 5G authentication vector.

UDM is used for unified data management, such as managing user subscription data for 5G networks. After the AUSF invokes the UE authentication acquisition request service provided by UDM, UDM can further send an authentication vector acquisition request message to the HSS, and receive the authentication vector returned by the HSS.

Please refer to FIG. 2, which is a schematic flowchart of an authentication method provided by an embodiment of this application. The method includes the following steps S201 to S202:

Step S201: The data management network element sends an authentication vector acquisition request to the home user server, where the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the requested authentication vector.

In the embodiment of the present application, the data management network element may be UDM, and the home user server may be HSS. The authentication vector acquisition request sent by UDM to HSS may include authentication type information, which is used to indicate the type of authentication vector requested by UDM, that is, the request is a 5G authentication vector, or the authentication vector The acquisition request is related to 5G authentication. The authentication vector refers to a set of parameters used for authentication.

The authentication type information can be an existing field or cell in the authentication vector obtaining request, or a newly added field or cell in the authentication vector obtaining request, which is not limited in this application. The authentication type information can have multiple possible implementation modes. For example, the authentication type information can be access mode type information, service network type information, authentication vector type information, authentication network element type information, etc., so that it can This effectively improves the applicability of the authentication method provided in the embodiments of the present application.

Exemplarily, if the authentication type information is access mode type information, UDM can indicate that the current access mode is 5G access through the access mode type information, so that the HSS knows that it is requesting a 5G authentication vector. If the authentication type information is service network type information, UDM can indicate that the current service network is a 5G network through the service network type information, so that the HSS knows that it is requesting a 5G authentication vector. If the authentication type information is authentication vector type information, the UDM can indicate that a 5G authentication vector needs to be obtained through the authentication vector type information, so that the HSS can subsequently provide a 5G authentication vector. If the authentication type information is authentication network element type information, UDM can indicate that it is UDM through the authentication network element type information, or indicate that the authentication vector acquisition request is sent by UDM, because UDM belongs to the 5G network Network element, therefore, after HSS receives this authentication vector acquisition request, it will provide UDM with 5G authentication vector.

In this way, UDM can obtain the authentication type information in the request through the authentication vector to directly or indirectly indicate that the current request is a 5G authentication vector, so that HSS can provide the corresponding 5G authentication vector and support UDM to complete 5G authentication, effectively avoiding The service-oriented transformation of HSS is needed to support UDM for 5G authentication.

In a possible design, the authentication vector acquisition request may also include the international mobile subscriber identity (IMSI) of the terminal device. The IMSI is UDM based on the user's permanent identity of the terminal device , SUPI) is used to instruct the HSS to provide the authentication vector of the terminal device. Exemplarily, UDM can remove the type in SUPI to extract the IMSI. In this way, the UDM can carry the IMSI information of the terminal equipment to request the 5G authentication vector from the HSS, which can effectively avoid the user ID of the UDM being SUPI and the user ID of the HSS being the IMSI. The problem of knowing which terminal device's authentication vector is requested.

As shown in Figure 3a and Figure 3b, before the UDM sends the authentication vector acquisition request, the AMF can call the UE authentication request service provided by the AUSF. Then, AUSF can invoke the UE authentication acquisition request service provided by UDM, and then trigger UDM to send an authentication vector acquisition request to HSS. The authentication vector acquisition request may also be called an authentication vector acquisition request message, or it may have other names. This application is not limited.

Step S202: The home user server generates an authentication vector according to the authentication type information, and sends the authentication vector to the data management network element.

In this embodiment of the application, the HSS receives the authentication vector acquisition request, and according to the authentication type information in the authentication vector acquisition request, it can be determined that the current request is the 5G authentication vector. After that, the HSS can generate a 5G authentication vector based on the authentication type information, and send it to UDM. Optionally, the HSS may obtain the IMSI of the terminal device in the request and the authentication type information according to the authentication vector, and generate the 5G authentication vector of the terminal device.

In a possible implementation manner, 5G authentication and key agreement (5G-authentication and key agreement, 5G AKA) can be used for authentication. In this manner, the 5G authentication vector issued by the HSS may include a first expected response (XRES*), a first authentication token (authentication vector, AUTN), an authentication service key Kausf, and a random number RAND.

Among them, XRES* is calculated by HSS with CK||IK as Key and SN||RAND||XRES as S, calculated according to key derivation functions (KDF), and is the expected UE authentication response parameter. It is used to compare with the response RES* returned by the UE to determine whether the authentication is successful. AUTN is a parameter that the network provides to the UE and uses it to authenticate the network. Kausf is UDM with CK||IK as the key,

S is calculated according to the key generation function KDF. RAND is an unpredictable random number provided by the network to the UE. CK is the encryption key, IK is the integrity key, SN is the serving network name (SN), SQN is the sequence number (SQN), AK is the anonymous key (AK), symbol || means concatenation,

Represents exclusive OR operation. The specific expression of KDF is: KDF = HMAC-SHA-256 (Key, S), HMAC is a hash-based message authentication code (HMAC), and SHA is a secure hash algorithm (secure hash). algorithms, SHA).

In another possible implementation manner, an extended authentication protocol authentication and key agreement (extensible authentication protocol-authentication and key agreement, EAP-AKA') method can be used for authentication. In this manner, the 5G authentication vector issued by the HSS may include the second expected response XRES (expected response, XRES), the second authentication token AUTN, the first encryption key CK (cipher key, CK), and the first The quintuple of the integrity key IK (integrity key, IK) and the random number RAND. The authentication management field (AMF) indicator bit of the second AUTN in the quintuple is the set value, if possible Set to 1. After the UDM receives the 5-tuple, it calculates other authentication parameters, such as the second encryption key CK' and the second integrity key IK'.

In this way, the HSS provided in the embodiments of the present application can provide different 5G authentication vectors for different authentication methods. In actual application scenarios, the HSS can select which 5G authentication vector to generate according to the configuration, thereby making the authentication method provided in this application more flexible.

Step S203: The data management network element receives the authentication vector sent by the home user server.

In the embodiment of this application, in the 5G AKA authentication mode, after UDM receives the 5G authentication vector (including XRES*, AUTN, Kausf, and RAND), as shown in Figure 3a, UDM can send UE to AUSF The response of the authentication acquisition request service, the response including the above 5G authentication vector, triggers the subsequent authentication process.

Exemplarily, the subsequent authentication process may include: after AUSF receives the above 5G authentication vector, temporarily saves XRES* and Kausf, and calculates HXRES* according to XRES*. AUSF sends a UE authentication request service response to AMF, which carries AUTN, HXRES*, and RAND. Subsequently, the AMF sends an authentication request message to the UE. The authentication request message includes AUTN and RAND. The UE confirms the freshness of the authentication vector by verifying whether the AUTN can be accepted. If the AUTN can be accepted, the UE calculates the authentication response RES* and sends an authentication request response to the AMF. The authentication request response includes the RES* . The AMF can calculate the corresponding HRES* according to the received RES*, and compare the HRES* with the stored HXRES*. If the HRES* is consistent with the HXRES*, it is considered that the UE has successfully authenticated in the access network. After that, the AMF can send an authentication request message to the AUSF, and the authentication request message includes the RES* received by the AMF from the UE. After receiving the authentication request message, the AUSF judges whether the authentication vector has expired. If it expires, the UE is considered to have failed authentication from the perspective of the home network. Otherwise, the RES* is compared with the saved XRES*. If RES* is with the saved XRES* If XRES* is consistent, it is considered that the UE has successfully authenticated in the home network. The AUSF may send an authentication request response to the AMF, and the response includes the authentication result of the UE in the home network.

In the EAP-AKA authentication mode, after UDM receives the 5G authentication vector (that is, the five-tuple including XRES, AUTN, CK, IK, and RAND), it can also use CK and IK in the five-tuple. , Determine the second encryption key CK' and the second integrity key IK', and replace the original CK and IK in the authentication vector with CK' and IK' to obtain the converted 5G authentication vector. After that, as shown in Figure 3b, UDM can send a response to the UE authentication and acquisition request service to AUSF. The response includes the converted 5G authentication vector, which is a five-tuple including XRES, AUTN, CK, IK, and RAND. Then trigger the subsequent authentication process.

Exemplarily, the subsequent authentication process may include: AUSF may send a UE authentication request service response to AMF, and the response includes AUTN and RAND. Subsequently, the AMF sends an authentication request message to the UE, and the obtained RAND and AUTN are forwarded to the UE through the authentication request message. After the UE receives the authentication request message, it first verifies the freshness of the authentication vector by checking whether the AUTN can be received. If the AUTN is acceptable, it means that the UE has successfully authenticated the network, and the UE calculates an authentication response RES. Subsequently, the UE sends an authentication request response to the AMF, and the authentication request response includes the RES. After the AMF receives the authentication request response, it sends an authentication request message to AUSF. The authentication request message includes the RES returned by the UE. AUSF verifies whether the RES is consistent with the stored XRES. If they are consistent, the UE authentication is considered successful. . AUSF can also calculate the authentication service key Kausf based on CK’ and IK’, and notify UDM of the authentication result of the UE.

In this way, the UDM calculates the second encryption key CK' and the second integrity key IK' according to the quintuple sent by the HSS, which can effectively reduce the amount of calculation in the process of generating the 5G authentication vector by the HSS, and also change the HSS. Smaller.

An embodiment of the present application also provides a communication device. Please refer to FIG. 4, which is a schematic structural diagram of a communication device provided in an embodiment of this application. The communication device 400 includes a transceiver module 410 and a processing module 420. The communication device can be used as a data management network element to implement the functions of any of the foregoing method embodiments related to data management network elements, and the communication device can also be used as a home user server to implement any of the foregoing method embodiments related to home The function of the user server.

When the communication device is used as a data management network element to execute the method embodiment shown in FIG. 2, the transceiver module 410 is configured to send an authentication vector acquisition request to the home user server and receive the authentication vector sent by the home user server. Operation: The processing module 420 is used to perform the operation of generating an authentication vector acquisition request.

When the communication device serves as the home user server and executes the method embodiment shown in FIG. 2, the transceiver module 410 is configured to receive the authentication vector acquisition request sent by the data management network element, and send the generated authentication vector to the data Manage the operation of the network element; the processing module 420 is configured to perform the operation of generating an authentication vector according to the authentication type information.

It should be understood that the processing module 420 involved in the communication device provided in the embodiments of the present application may be implemented by a processor or processor-related circuit components, and the transceiver module 410 may be implemented by a transceiver or transceiver-related circuit components.

It should be noted that the communication device 400 provided in the embodiment of the present application may correspond to the data management network element in the data transmission method S201 to S203 provided in the embodiment of the present application or the data transmission method provided in the embodiment of the present application. For the home user server in S201 to S203, the operation and/or function of each module in the communication device is to implement the corresponding process of the method shown in FIG. 2 respectively. For the sake of brevity, details are not repeated here.

Please refer to FIG. 5, which is another schematic structural diagram of the communication device provided in the embodiment of the application. As shown in FIG. 5, the communication device 500 includes a processor 510, a memory 520, and a communication interface 530. Optionally, the communication apparatus 500 further includes an input device 540, an output device 550, and a bus 560. The processor 510, the memory 520, the communication interface 530, the input device 540, and the output device 550 are connected to each other through a bus 560. The memory 520 stores instructions or programs, and the processor 510 is configured to execute the instructions or programs stored in the memory 520. When the instructions or programs stored in the memory 520 are executed, the processor 510 is used to perform the operations performed by the processing module 420 in the foregoing method embodiment, and the communication interface 530 is used to perform the operations performed by the transceiver module 410 in the foregoing embodiment.

It should be noted that the communication device 500 provided by the embodiment of the present application may correspond to the data management network element or the home user server that executes the authentication methods S201 to S203 provided by the embodiment of the present invention, and the communication device 500 has the function of each module. The operations and/or functions are used to implement the corresponding procedures of the methods shown in FIG. 2 or FIG. 3a, and FIG. 3b respectively. For the sake of brevity, they will not be repeated here.

An embodiment of the present application also provides a chip system, including: a processor, the processor is coupled with a memory, the memory is used to store a program or instruction, when the program or instruction is executed by the processor, the The chip system implements the method in any of the foregoing method embodiments.

Optionally, there may be one or more processors in the chip system. The processor can be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented by software, the processor may be a general-purpose processor, which is implemented by reading software codes stored in the memory.

Exemplarily, the chip system may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a system on chip (SoC). It can also be a central processor unit (CPU), a network processor (NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (microcontroller). The controller unit, MCU), may also be a programmable controller (programmable logic device, PLD) or other integrated chips.

It should be understood that each step in the foregoing method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

The embodiment of the present application also provides a computer-readable storage medium, which stores computer-readable instructions, and when the computer reads and executes the computer-readable instructions, the computer is caused to execute any of the foregoing method embodiments Method in.

The embodiments of the present application also provide a computer program product. When the computer reads and executes the computer program product, the computer is caused to execute the method in any of the foregoing method embodiments.

The embodiments of the present application also provide a communication system, which includes one or more of the data management network elements and the home user server described in the foregoing method embodiments.

It should be understood that the processor mentioned in the embodiments of this application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), or application specific integrated circuits ( application specific integrated circuit (ASIC), ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electronic Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) ) And direct memory bus random access memory (direct rambus RAM, DR RAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) is integrated in the processor.

It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that, in the various embodiments of the present application, the size of the sequence number of the foregoing processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not be used in the embodiments of the present invention The implementation process constitutes any limitation.

A person of ordinary skill in the art may be aware that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the above-described system, device, and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

An authentication method, characterized in that the method includes:

The data management network element sends an authentication vector acquisition request to the home user server, where the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the requested authentication vector;

The data management network element receives an authentication vector sent by the home user server, where the authentication vector is generated by the home user server according to the authentication type information.
The method according to claim 1, wherein the authentication vector includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
The method according to claim 1, wherein the authentication vector includes a second expected response XRES, a second authentication token AUTN, a first encryption key CK, a first integrity key IK, and a random number RAND , The AMF indicator bit of the authentication management domain of the second AUTN is a set value;

The method also includes:

The data management network element determines a second encryption key CK' and a second integrity key IK' according to the CK and the IK.
The method according to any one of claims 1 to 3, wherein the authentication vector acquisition request includes the international mobile subscriber identity IMSI of the terminal device, and the IMSI is used to instruct the home user server to provide For the authentication vector corresponding to the terminal device, the IMSI is obtained by the data management network element according to the user permanent identity SUPI of the terminal device.
The method according to any one of claims 1 to 4, wherein the authentication type information includes any one of the following types of information:

Access mode type information, service network type information, authentication vector type information, and authentication network element type information.
An authentication method, characterized in that the method includes:

The home user server receives an authentication vector acquisition request sent by a data management network element, where the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the requested authentication vector;

The home user server generates an authentication vector according to the authentication type information, and sends the authentication vector to the data management network element.
The method according to claim 6, wherein the authentication vector includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
The method according to claim 6, wherein the authentication vector includes a second expected response XRES, a second authentication token AUTN, a first encryption key CK, a first integrity key IK, and a random number RAND The AMF indicator bit of the authentication management field of the second AUTN is a set value, and the CK and IK are used by the data management network element to determine the second encryption key CK' and the second integrity key IK'.
The method according to any one of claims 6 to 8, wherein the authentication vector acquisition request includes the international mobile subscriber identity code IMSI of the terminal device, and the IMSI is used to instruct the home subscriber server to provide For the authentication vector corresponding to the terminal device, the IMSI is obtained by the data management network element according to the user permanent identity SUPI of the terminal device.
The method according to any one of claims 6 to 9, wherein the authentication type information includes any one of the following types of information:

Access mode type information, service network type information, authentication vector type information, and authentication network element type information.
A communication device, characterized in that the communication device includes:

Processing module, used to generate authentication vector acquisition request;

A transceiver module, configured to send the authentication vector acquisition request to the home user server, the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the authentication vector requested;

The transceiver module is further configured to receive an authentication vector sent by the home user server, where the authentication vector is generated by the home user server according to the authentication type information.
The communication device according to claim 11, wherein the authentication vector includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
The communication device according to claim 11, wherein the authentication vector includes a second expected response XRES, a second authentication token AUTN, a first encryption key CK, a first integrity key IK, and a random number RAND, the AMF indicator bit of the authentication management domain of the second AUTN is a set value;

The processing module is also used for:

According to the CK and the IK, the second encryption key CK' and the second integrity key IK' are determined.
The communication device according to any one of claims 11 to 13, wherein the authentication vector acquisition request includes the international mobile subscriber identity IMSI of the terminal device, and the IMSI is used to indicate the home user The server provides an authentication vector corresponding to the terminal device, and the IMSI is obtained by the processing module according to the user permanent identity SUPI of the terminal device.
The communication device according to any one of claims 11 to 14, wherein the authentication type information includes any one of the following types of information:

Access mode type information, service network type information, authentication vector type information, and authentication network element type information.
A communication device, characterized in that the communication device includes:

A transceiver module, configured to receive an authentication vector acquisition request sent by a data management network element, where the authentication vector acquisition request includes authentication type information, and the authentication type information is used to indicate the type of the requested authentication vector;

The processing module is configured to generate an authentication vector according to the authentication type information, and send the authentication vector to the data management network element through the transceiver module.
The communication device according to claim 16, wherein the authentication vector includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
The communication device according to claim 16, wherein the authentication vector includes a second expected response XRES, a second authentication token AUTN, a first encryption key CK, a first integrity key IK, and a random number RAND, the AMF indicator of the authentication management domain of the second AUTN is a set value, and the CK and IK are used by the data management network element to determine the second encryption key CK' and the second integrity key IK' .
The communication device according to any one of claims 16 to 18, wherein the authentication vector acquisition request includes the International Mobile Subscriber Identity (IMSI) of the terminal device, and the IMSI is used to indicate the communication device An authentication vector corresponding to the terminal device is provided, and the IMSI is obtained by the data management network element according to the user permanent identity SUPI of the terminal device.
The communication device according to any one of claims 16 to 19, wherein the authentication type information includes any one of the following types of information:

Access mode type information, service network type information, authentication vector type information, and authentication network element type information.