WO2020220903A1 - 通信方法和装置 - Google Patents

通信方法和装置 Download PDF

Info

Publication number
WO2020220903A1
WO2020220903A1 PCT/CN2020/082105 CN2020082105W WO2020220903A1 WO 2020220903 A1 WO2020220903 A1 WO 2020220903A1 CN 2020082105 W CN2020082105 W CN 2020082105W WO 2020220903 A1 WO2020220903 A1 WO 2020220903A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
terminal device
shared key
request
authentication
Prior art date
Application number
PCT/CN2020/082105
Other languages
English (en)
French (fr)
Inventor
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020220903A1 publication Critical patent/WO2020220903A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • This application relates to the field of communication technology, and in particular to a communication method and device.
  • the authentication mechanism may specifically be to implement mutual authentication between a user terminal (User Equipment, UE) and an application server through a key or the like.
  • UE User Equipment
  • the authentication method based on the Generic Bootstrapping Architecture can be applied to the third-generation mobile communication (3fifth-generation, 3G) and fourth-generation mobile communications. Communication (4fifth-generation, 4G); With the development of the fifth-generation mobile communication (5fifth-generation, 5G), the authentication suitable for 5G systems is also in the research and exploration stage, for example, based on application-specific authentication and key management (Authentication and Key Management for Applications (AKMA) architecture is the way to implement security authentication.
  • GBA Generic Bootstrapping Architecture
  • the present application provides a communication method and device, so that two authentication architecture systems can achieve intercommunication, thereby improving authentication flexibility.
  • this application provides a communication method, including:
  • the first network element receives a first request from a terminal device; wherein, the first request includes the identification of the terminal device; the first network element sends a second request to the second network element according to the first request; wherein , The second request includes the identification of the terminal device; the first network element receives a first shared key from the second network element; wherein the first shared key is the second network element Determined according to the second shared key, the second shared key is determined by the second network element according to the identification of the terminal device; the first shared key is used for security protection in the first network, so The second shared key is used for security protection in the second network.
  • the first network element and the second network element can communicate with each other. Specifically, after the first network element receives the first request including the identification of the terminal device from the terminal device, the first network element sends the request to the second network element. Sending a second request that includes the identification of the terminal device, the second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element. After receiving the first shared key in a network element, it can further implement first authentication based on the first shared key with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the method further includes: the first network element determines the first temporary identifier of the terminal device The first temporary identifier is calculated by the first network element or the second network element according to the identifier of the terminal device, and the first temporary identifier is used to identify that the terminal device is in the first Temporary identity in the network; the first network element sends the first temporary identity to the terminal device.
  • the method further includes: the first network element determines the validity period of the first shared key Wherein, the validity period of the first shared key is determined by the first network element or the second network element according to the validity period of the second shared key; the validity period of the second shared key is determined by The second network element is determined according to the identifier of the terminal device; the first network element sends the validity period of the first shared key to the terminal device.
  • the second request further includes the first network element identification of the first network element; the first shared key is the second network element according to the second shared key and the The first network element identification is derived.
  • the second shared key is: after the second network element receives the second request, it is obtained by performing second authentication with the terminal device in response to the second request .
  • the present application provides a communication method.
  • the method includes: a second network element receives a second request from a first network element; the second request includes an identifier of a terminal device; and the second network element
  • the identification of the terminal device determines the second shared key; the second network element determines the first shared key according to the second shared key; the second network element sends the first shared key to the first network element Shared key; wherein the first shared key is used for security protection in the first network, and the second shared key is used for security protection in the second network.
  • the second network element determining the second shared key according to the identification of the terminal device includes: the second network element according to the identification of the terminal device and the terminal identification obtained in advance The mapping relationship with the shared key in the second network determines the second shared key corresponding to the identifier of the terminal device.
  • the second network element determining the second shared key according to the identification of the terminal device includes: the second network element communicates with the terminal device in response to the second request The second authentication obtains the second shared key.
  • the method further includes: the second network element determining the second shared key according to the identifier of the terminal device The validity period; the second network element sends the validity period of the second shared key to the first network element; or, the second network element determines the validity period of the second shared key according to the identification of the terminal device Validity period; the second network element determines the validity period of the first shared key according to the validity period of the second shared key; the second network element sends the first shared key to the first network element The validity period.
  • the method further includes: the second network element determining the second temporary identifier of the terminal device according to the identifier of the terminal device; The second network element sends the second temporary identifier to the first network element; the second temporary identifier is used to identify the temporary identity of the terminal device in the second network; or, the first network element
  • the second network element determines the second temporary identification of the terminal device according to the identification of the terminal device; the second network element determines the first temporary identification according to the second temporary identification; the second network element sends the A network element sends the first temporary identifier; the first temporary identifier is used to identify the temporary identity of the terminal device in the first network.
  • the second request further includes the first network element identification of the first network element; the first shared key is the second network element according to the second shared key Derived from the first network element identifier.
  • this application provides a communication method, which includes:
  • the terminal device sends a first request to the first network element; wherein the first request includes the identification of the terminal device; the first request is used to instruct the first network element to obtain the first share from the second network element Key; the terminal device determines the first shared key according to a second shared key; the second shared key is determined when the terminal device performs second authentication in the second network element; The first shared key is used for security protection in the first network, and the second shared key is used for security protection in the second network.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the method further includes: the terminal device receives a first temporary identifier from the first network element; The temporary identifier is calculated by the first network element or the second network element according to the identifier of the terminal device; the first temporary identifier is used to identify the temporary identity of the terminal device in the first network; or The terminal device determines the first temporary identifier according to the second temporary identifier; the second temporary identifier is used to identify the temporary identity of the terminal device in the second network.
  • the method further includes:
  • the terminal device receives the validity period of the first shared key from the first network element; wherein the validity period of the first shared key is the first network element or the second network element according to the The validity period of the second shared key is determined; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device; or, the terminal device is determined according to the validity period of the second shared key The validity period of the first shared key is determined; the validity period of the second shared key is determined when the terminal device performs the second authentication in the second network element.
  • the present application provides a communication method, the method includes: a third network element receives a third request from a fifth network element; wherein the third request is sent by a terminal device to the fifth network element; The third request includes the identification of the terminal device; the third network element sends a fourth request to the fourth network element according to the third request; wherein the fourth request includes the identification of the terminal device; The third network element receives a first authentication vector from the fourth network element; wherein, the first authentication vector is determined by the fourth network element according to a second authentication vector, and the second authentication vector is The fourth network element is determined according to the identification of the terminal device; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the present application provides a communication method, the method includes: a fourth network element receives a fourth request from a third network element; the fourth request includes an identifier of a terminal device; and the fourth network element
  • the identification of the terminal device determines the second authentication vector; the fourth network element determines the first authentication vector according to the second authentication vector; the fourth network element sends the first authentication vector to the third network element;
  • the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the present application provides a communication method, the method includes: a fifth network element receives a third request from a terminal device; wherein, the third request includes an identifier of the terminal device; The third network element sends a third request; the third request is used to instruct the third network element to obtain the first authentication vector from the fourth network element; the first authentication vector is the fourth network element according to the The second authentication vector is determined; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network; the fifth network element is from the fourth network element Receiving the first authentication vector.
  • the present application provides a communication method, the method includes: a terminal device sends a third request to a fifth network element; wherein, the third request includes an identifier of the terminal device; and the third request is used for Instruct the fifth network element to send the third request to the third network element, and instruct the third network element to obtain the first authentication vector from the fourth network element; the terminal device determines the first authentication vector according to the second authentication vector An authentication vector; the second authentication vector is determined when the terminal device performs the second authentication in the fourth network element; the first authentication vector is used for security protection in the first network, and the second The authentication vector is used for security protection in the second network.
  • this application provides a first network element, including: a request receiving module, configured to receive a first request from a terminal device; wherein, the first request includes an identifier of the terminal device; and a sending module configured to Send a second request to the second network element according to the first request; wherein, the second request includes the identification of the terminal device; a shared key receiving module, configured to receive the first shared key from the second network element Key; wherein, the first shared key is determined by the second network element according to a second shared key, and the second shared key is determined by the second network element according to the identification of the terminal device
  • the first shared key is used for security protection in the first network
  • the second shared key is used for security protection in the second network.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the first network element further includes: a temporary identification determining module, configured to determine the first temporary identification of the terminal device; the first temporary identification is the first network element or the The second network element is calculated according to the identity of the terminal device, the first temporary identity is used to identify the temporary identity of the terminal device in the first network; the temporary identity sending module is used to send The terminal device sends the first temporary identifier.
  • a temporary identification determining module configured to determine the first temporary identification of the terminal device; the first temporary identification is the first network element or the The second network element is calculated according to the identity of the terminal device, the first temporary identity is used to identify the temporary identity of the terminal device in the first network; the temporary identity sending module is used to send The terminal device sends the first temporary identifier.
  • the first network element further includes: a validity period determining module, configured to determine the validity period of the first shared key; wherein the validity period of the first shared key is the first The network element or the second network element is determined according to the validity period of the second shared key; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device; the validity period is sent The module is used to send the validity period of the first shared key to the terminal device.
  • a validity period determining module configured to determine the validity period of the first shared key; wherein the validity period of the first shared key is the first The network element or the second network element is determined according to the validity period of the second shared key; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device; the validity period is sent The module is used to send the validity period of the first shared key to the terminal device.
  • the second request further includes the first network element identification of the first network element; the first shared key is the second network element according to the second shared key and the The first network element identification is derived.
  • the second shared key is: after the second network element receives the second request, it is obtained by performing second authentication with the terminal device in response to the second request .
  • this application provides a second network element, and the second network element includes:
  • the request receiving module is configured to receive a second request from the first network element; the second request includes the identification of the terminal device; the second shared key determining module is configured to determine the second shared key according to the identification of the terminal device.
  • the first shared key determining module is used to determine the first shared key according to the second shared key; the first shared key sending module is used to send the first shared key to the first network element Key; wherein the first shared key is used for security protection in the first network, and the second shared key is used for security protection in the second network.
  • the second shared key determining module is further configured to: according to the identification of the terminal device and the mapping relationship between the terminal identification obtained in advance and the shared key in the second network, Determine the second shared key corresponding to the identifier of the terminal device.
  • the second shared key determining module is further configured to: in response to the second request, perform second authentication with the terminal device to obtain the second shared key.
  • the second network element further includes a second validity period determining module, configured to: determine the validity period of the second shared key according to the identification of the terminal device; and report to the first network element Send the validity period of the second shared key; or determine the validity period of the second shared key according to the identification of the terminal device; determine the validity period of the first shared key according to the validity period of the second shared key Validity period; sending the validity period of the first shared key to the first network element.
  • a second validity period determining module configured to: determine the validity period of the second shared key according to the identification of the terminal device; and report to the first network element Send the validity period of the second shared key; or determine the validity period of the second shared key according to the identification of the terminal device; determine the validity period of the first shared key according to the validity period of the second shared key Validity period; sending the validity period of the first shared key to the first network element.
  • the second network element further includes a temporary identifier determining module, configured to: determine the second temporary identifier of the terminal device according to the identifier of the terminal device; and send to the first network element
  • the second temporary identification; the second temporary identification is used to identify the temporary identity of the terminal device in the second network; or, the second temporary identification of the terminal device is determined according to the identification of the terminal device Determine the first temporary identifier according to the second temporary identifier; send the first temporary identifier to the first network element; the first temporary identifier is used to identify the terminal device in the first network Temporary status.
  • the second request further includes the first network element identification of the first network element; the first shared key is the second network element according to the second shared key Derived from the first network element identifier.
  • the present application provides a terminal device, the terminal device includes: a request sending module, configured to send a first request to a first network element; wherein the first request includes an identifier of the terminal device; The first request is used to instruct the first network element to obtain the first shared key from the second network element; the shared key determination module is used for the terminal device to determine the first shared key according to the second shared key; The second shared key is determined when the terminal device performs second authentication in the second network element; the first shared key is used for security protection in the first network, and the second shared key Used for security protection in the second network.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the terminal device further includes a temporary identification determining module, configured to:
  • a first temporary identifier is received from the first network element; the first temporary identifier is calculated by the first network element or the second network element according to the identifier of the terminal device; the first temporary identifier is used for Identify the temporary identity of the terminal device in the first network; or determine the first temporary identity according to the second temporary identity; the second temporary identity is used to identify the terminal device’s temporary identity in the second network Temporary status.
  • the terminal device further includes a validity period determining module, configured to: receive the validity period of the first shared key from the first network element; wherein the validity period of the first shared key Is determined by the first network element or the second network element according to the validity period of the second shared key; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device Determined; or, the validity period of the first shared key is determined according to the validity period of the second shared key; the validity period of the second shared key is determined when the terminal device performs the second authentication in the second network element of.
  • a validity period determining module configured to: receive the validity period of the first shared key from the first network element; wherein the validity period of the first shared key Is determined by the first network element or the second network element according to the validity period of the second shared key; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device Determined; or, the validity period of the first shared key is determined according to the validity period of the second shared key; the validity period of
  • this application provides a third network element, which includes:
  • the request receiving module is configured to receive a third request from the fifth network element; wherein, the third request is sent by the terminal device to the fifth network element; the third request includes the identification of the terminal device; request The sending module is configured to send a fourth request to the fourth network element according to the third request; wherein, the fourth request includes the identification of the terminal device; and the authentication vector receiving module is configured to send a request from the fourth network element Receive a first authentication vector; wherein, the first authentication vector is determined by the fourth network element according to a second authentication vector, and the second authentication vector is determined by the fourth network element according to the identification of the terminal device The first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • this application provides a fourth network element, which includes:
  • the request receiving module is configured to receive the fourth request from the third network element by the fourth network element; the fourth request includes the identification of the terminal device; the second authentication vector determining module is configured to determine the second Authentication vector; a first authentication vector determining module, configured to determine a first authentication vector according to the second authentication vector; a first authentication vector sending module, configured to send the first authentication vector to the third network element; The first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • this application provides a fifth network element, and the fifth network element includes:
  • a request receiving module configured to receive a third request from a terminal device; wherein the third request includes the identification of the terminal device; a request sending module, configured to send a third request to a third network element; the third request Used to instruct the third network element to obtain the first authentication vector from the fourth network element; the first authentication vector is determined by the fourth network element according to the second authentication vector; the first authentication vector is used for For security protection in the first network, the second authentication vector is used for security protection in the second network; an authentication vector receiving module is used for the fifth network element to receive the first authentication vector from the fourth network element .
  • this application provides a terminal device, which includes:
  • the request sending module is configured to send a third request to the fifth network element; wherein, the third request includes the identification of the terminal device; the third request is used to instruct the fifth network element to send the third network element Sending the third request and instructing the third network element to obtain the first authentication vector from the fourth network element; an authentication vector determining module for the terminal device to determine the first authentication vector according to the second authentication vector; The second authentication vector is determined when the terminal device performs second authentication in the fourth network element; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for the first network element. 2. Security protection in the network.
  • a fifteenth aspect of the present application provides a first network element, including a processor, a memory, and a transceiver.
  • the memory is used to store instructions
  • the transceiver is used to communicate with other devices
  • the processor is used to execute the memory. Instructions stored in the first network element, so that the first network element executes any of the methods provided in the first aspect of the present application and the exemplary manners of the various aspects.
  • a sixteenth aspect of the present application provides a second network element, including a processor, a memory, and a transceiver.
  • the memory is used to store instructions
  • the transceiver is used to communicate with other devices
  • the processor is used to execute the memory.
  • the instructions stored in the first network element are configured to execute any one of the methods provided in the second aspect of the present application and the exemplary manners of each aspect.
  • the seventeenth aspect of the present application provides a terminal device UE, which is characterized by comprising a processor, a memory, and a transceiver, the memory is used to store instructions, the transceiver is used to communicate with other devices, and the processor is used to execute The instructions stored in the memory are used to enable the UE to execute any of the methods provided in the third aspect of the present application and the exemplary manners of each aspect.
  • An eighteenth aspect of the present application provides a third network element, including a processor, a memory, and a transceiver.
  • the memory is used to store instructions
  • the transceiver is used to communicate with other devices
  • the processor is used to execute the memory.
  • the instructions stored in the first network element are configured to execute any of the methods provided in the fourth aspect of the present application and the exemplary manners of the various aspects.
  • a nineteenth aspect of the present application provides a fourth network element, including a processor, a memory, and a transceiver.
  • the memory is used to store instructions
  • the transceiver is used to communicate with other devices
  • the processor is used to execute the memory. Instructions stored in the first network element, so that the first network element executes any of the methods provided in the fifth aspect of the present application and the exemplary manners of the various aspects.
  • the twentieth aspect of the present application provides a fifth network element, including a processor, a memory, and a transceiver.
  • the memory is used to store instructions
  • the transceiver is used to communicate with other devices
  • the processor is used to execute the memory.
  • the instructions stored in the first network element are configured to execute any one of the methods provided in the sixth aspect and the exemplary manners of each aspect of the present application.
  • the twenty-first aspect of the present application provides a terminal device UE, which is characterized by comprising a processor, a memory, and a transceiver, the memory is used to store instructions, the transceiver is used to communicate with other devices, and the processor is used to The instructions stored in the memory are executed, so that the UE executes any of the methods provided in the seventh aspect of the present application and the exemplary manners of the aspects.
  • the twenty-second aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the first aspect of the present application and the exemplary Any of the methods provided by the method.
  • a twenty-third aspect of the present application provides a computer-readable storage medium that stores instructions, which when executed, cause a computer to execute the second aspect of the present application and the exemplary Any of the methods provided by the method.
  • the twenty-fourth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the third aspect of the present application and the exemplary Any of the methods provided by the method.
  • the twenty-fifth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the fourth aspect of the present application and the exemplary Any of the methods provided by the method.
  • the twenty-sixth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the fifth aspect of the present application and the exemplary Any of the methods provided by the method.
  • the twenty-seventh aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the sixth aspect of the present application and the exemplary Any of the methods provided by the method.
  • a twenty-eighth aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions are executed, the computer executes the seventh aspect of the present application and the exemplary Any of the methods provided by the method.
  • the twenty-ninth aspect of the present application provides a computer program product.
  • the computer program product includes instructions. When the instructions are executed, the computer executes the methods provided in the first aspect and the exemplary manners of each aspect of the present application. Any of the methods in.
  • a thirtieth aspect of the present application provides a computer program product.
  • the computer program product includes instructions.
  • the instructions executes the methods provided in the second aspect and the exemplary manners of the various aspects of the present application. Any of the methods described.
  • the thirty-first aspect of the present application provides a computer program product.
  • the computer program product includes instructions. When the instructions are executed, the computer executes the methods provided in the third aspect and the exemplary manners of each aspect of the present application. Any of the methods in.
  • the thirty-second aspect of the present application provides a computer program product.
  • the computer program product includes instructions. When the instructions are executed, the computer executes the methods provided in the fourth aspect and the exemplary manners of each aspect of the present application. Any of the methods in.
  • the thirty-third aspect of the present application provides a computer program product.
  • the computer program product includes instructions. When the instructions are executed, the computer executes the methods provided in the fifth aspect and the exemplary manners of each aspect of the present application. Any of the methods in.
  • the thirty-fourth aspect of the present application provides a computer program product, the computer program product includes instructions, when the instructions are executed, the computer executes the methods provided in the sixth aspect of the present application and the exemplary manners of each aspect Any of the methods in.
  • the thirty-fifth aspect of the present application provides a computer program product, the computer program product includes instructions, when the instructions are executed, the computer executes the methods provided in the seventh aspect and the exemplary manners of each aspect of the present application Any of the methods in.
  • the thirty-sixth aspect of the present application provides a system-on-chip or system-on-chip, which can be applied to a first network element, and the system-on-chip or system-on-chip includes: at least one communication interface, at least one A processor, at least one memory, the communication interface, the memory, and the processor are interconnected by a bus, and the processor executes the instructions stored in the memory so that the first network element can execute the first aspect and Any of the methods provided in the exemplary manners of various aspects.
  • the thirty-seventh aspect of the present application provides a system-on-chip or system-on-chip, which can be applied to a second network element, and the system-on-chip or system-on-chip includes: at least one communication interface, at least one A processor, at least one memory, the communication interface, the memory, and the processor are interconnected by a bus, and the processor executes the instructions stored in the memory so that the second network element can execute the second aspect and Any of the methods provided in the exemplary manners of various aspects.
  • the thirty-eighth aspect of the present application provides a system on a chip or a system chip, the system on a chip or a system chip can be applied to a terminal device, the system on a chip or a system chip includes: at least one communication interface, at least one processor , At least one memory, the communication interface, the memory, and the processor are interconnected by a bus, and the processor executes the instructions stored in the memory so that the terminal device can execute the third aspect of the application and the examples of each aspect Any of the methods provided in the sexual mode.
  • the thirty-ninth aspect of the present application provides a system-on-chip or system-on-chip, which can be applied to a third network element, and the system-on-chip or system-on-chip includes: at least one communication interface, at least one A processor, at least one memory, the communication interface, the memory, and the processor are interconnected through a bus, and the processor executes the instructions stored in the memory so that the third network element can execute the fourth aspect and Any of the methods provided in the exemplary manners of various aspects.
  • the fortieth aspect of the present application provides a system-on-chip or system-on-chip, which can be applied to a fourth network element, and the system-on-chip or system-on-chip includes: at least one communication interface, at least one processing The communication interface, the memory, and the processor are interconnected by a bus.
  • the processor executes the instructions stored in the memory so that the fourth network element can execute the fifth aspect and each of the Any of the methods provided in the exemplary manner of the aspect.
  • the forty-first aspect of the present application provides a system-on-chip or system-on-chip, which can be applied to a fifth network element, and the system-on-chip or system-on-chip includes: at least one communication interface, at least one A processor, at least one memory, the communication interface, the memory, and the processor are interconnected by a bus, and the processor executes the instructions stored in the memory so that the fifth network element can execute the sixth aspect and Any of the methods provided in the exemplary manners of various aspects.
  • the forty-second aspect of the present application provides a system on a chip or a system chip, the system on a chip or a system chip can be applied to a terminal device, the system on a chip or a system chip includes: at least one communication interface, at least one processor , At least one memory, the communication interface, the memory, and the processor are interconnected by a bus, and the processor executes the instructions stored in the memory so that the terminal device can execute the seventh aspect of the application and the examples of the various aspects Any of the methods provided in the sexual mode.
  • the first network element and the second network element can communicate with each other. Specifically, after the first network element receives the first request including the identifier of the terminal device from the terminal device, the first network element The element sends a second request including the identification of the terminal device to the second network element. The second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element. Shared key, after receiving the first shared key in the first network element, the first authentication based on the first shared key can be further implemented with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • FIG. 1 is an architecture diagram of a communication system provided by an embodiment of this application.
  • FIG. 2 is a diagram of the GBA architecture provided by an embodiment of the application.
  • Figure 3 is the first AKMA architecture diagram provided by an embodiment of the application.
  • Figure 4 is a second AKMA architecture diagram provided by an embodiment of the application.
  • Figure 5 is a third AKMA architecture diagram provided by an embodiment of the application.
  • FIG. 6 is a schematic flowchart of a communication method provided in Embodiment 1 of this application.
  • FIG. 7 is a schematic diagram of a specific flow of a communication method provided in Embodiment 2 of this application.
  • FIG. 8 is a schematic diagram of another specific flow of a communication method provided in Embodiment 3 of this application.
  • FIG. 9 is a schematic flowchart of a first network element side of a communication method according to Embodiment 4 of this application.
  • FIG. 10 is a schematic flowchart of a second network element side of a communication method according to the fifth embodiment of this application.
  • FIG. 11 is a schematic flowchart of a terminal device side of a communication method according to Embodiment 6 of this application;
  • FIG. 12 is a schematic flowchart of another communication method provided by Embodiment 7 of this application.
  • FIG. 13 is a schematic diagram of a specific flow of another communication method provided in Embodiment 8 of this application.
  • FIG. 14 is a schematic diagram of another specific flow of another communication method according to Embodiment 9 of this application.
  • FIG. 17 is a schematic flowchart of another communication method on the fifth network element side according to Embodiment 12 of this application.
  • FIG. 19 is a schematic structural diagram of a first network element according to Embodiment 14 of this application.
  • FIG. 20 is a schematic structural diagram of a second network element according to Embodiment 15 of this application.
  • FIG. 21 is a schematic structural diagram of a terminal device according to Embodiment 16 of this application.
  • FIG. 22 is a schematic structural diagram of a third network element according to Embodiment 17 of this application.
  • FIG. 23 is a schematic structural diagram of a fourth network element according to Embodiment 18 of this application.
  • FIG. 24 is a schematic structural diagram of a fifth network element according to Embodiment 19 of this application.
  • FIG. 25 is a schematic structural diagram of a terminal device according to Embodiment 20 of this application.
  • FIG. 26 is a schematic structural diagram of a first network element provided by Embodiment 21 of this application.
  • FIG. 27 is a schematic structural diagram of a second network element according to Embodiment 22 of this application.
  • FIG. 28 is a schematic structural diagram of a UE provided in Embodiment 23 of this application.
  • the technical solutions shown in the embodiments of this application can be applied to the interconnection between a GBA-based authentication system and an AKMA-based authentication system.
  • it can be applied to the interconnection and interoperability of 3G systems and 5G systems, and can also be applied to 4G.
  • FIG. 1 is an architecture diagram of a communication system provided by an embodiment of the application.
  • the communication system of the embodiment of the present application may include a terminal device 101, a first network 102, and a second network 103.
  • the communication system may also include multiple terminal devices 101, which are not limited in the embodiment of the present application.
  • the authentication process between each terminal device 101 and the first network 102 and the second network 103 is similar, in the embodiment of the present application, authentication is performed between any terminal device 101 and the first network 102 and the second network 103 The process is explained as an example.
  • the execution subject of the terminal device side method can be the terminal device or the device in the terminal device (it should be noted that the terminal device is described as an example in the embodiment provided in this application) .
  • the device in the terminal device may be a chip system, a circuit, or a module, etc., which is not limited in this application.
  • the execution subject for executing the first network-side method may be the first network device, or may be a device in the first network device.
  • the devices in the first network may be chip systems, circuits, modules, etc., which are not limited in this application.
  • the execution subject of the second network-side method may be the second network device, or may be a device in the second network device.
  • the devices in the second network may be chip systems, circuits, modules, etc., which are not limited in this application.
  • the second network when the first network is authenticated based on GBA, the second network may be authenticated based on AKMA; when the second network is authenticated based on GBA, the first network may be authenticated based on AKMA Authentication; the first network and the second network are authenticated based on different authentication architectures.
  • the terminal device is a user equipment (UE), and a bootstrapping server function (BSF) network element is used to interact with the UE and execute the UE.
  • BSF bootstrapping server function
  • Authentication with BSF; each application can correspond to a network-side application server (Network Application Function, NAF), NAF can be used to provide services for application operation, so BSF and UE may interact with one or more NAFs ; Subscriber Locator Function (Subscriber Locator Function, SLF) network element can store the mapping relationship between UE and home subscriber system (Home Subscriber System, HSS) network element, it can be understood that in the scenario of a single HSS, it may not be set SLF, in multiple HSS scenarios, the BSF can obtain the HSS name corresponding to the UE from the SLF; the HSS can be used to store the subscription information of the UE and generate the authentication vector; there is an interface Zh between the BSF and the HSS, so that the BSF can be obtained from HSS obtain
  • NAF Network Application Function
  • GBA can be used to implement authentication based on the Key Agreement (Authentication and Key Agreement, AKA).
  • AKA Authentication and Key Agreement
  • the specific process can be as follows: the UE sends a HyperText Transport Protocol (HTTP) request to the BSF, and the request carries the user ID (UE ID);
  • the BSF obtains the user root key and authentication vector (authentication vector, AV) of the UE from the HSS through the Zh interface, where AV can include a random number RAND, an authentication token (Authentication token, AUTN), and encryption Key (Cipher Key, CK), Integrity Key (IK) and expected user response (EXpected user RESponse, XRES); and send AV to BSF;
  • BSF sends RAND and AUTN to UE;
  • UE uses RAND Generate a new AUTN and compare it with the AUTN sent by the BSF.
  • the network is successfully authenticated; the UE also uses the AKA algorithm to generate CK, IK, and user response (RES); the UE sends an HTTP request to the BSF ,
  • the request contains a digest AKA response, the response uses RES as the verification code;
  • BSF compares RES with XRES to authenticate the UE; if RES and XRES are the same, the authentication is successful, BSF uses CK and IK to generate a shared secret Key Ks, and generate a Bootstrapping Transaction Identifier (B-TID), where the B-TID can be used as a temporary identifier to identify the authentication event, so that the subsequent NAF can ask the BSF for the relevant results based on the B-TID value Key Ks_NAF; BSF sends B-TID to UE and the key lifetime of Ks; Ks can be generated in UE based on CK and IK to realize key sharing between UE and BSF; later in the GBA-based service access phase, The UE and the
  • FIG. 3 it shows the architecture diagram of the first type of AKMA authentication, in which the AKMA authentication function (AKMA Authentication Function, AAuF) network element may be combined with the unified data management function (Unified Data Management, UDM) network element and authentication server Function (Authentication Server Function, AUSF) network elements and security anchor function (Security Anchor Functionality, SEAF) network elements have interfaces, AAuF can be used to obtain UE authentication related parameters or authenticated keys from UDM/AUSF/SEAF , And then complete the UE authentication through interaction with UDM/AUSF/SEAF; each application can correspond to an AKMA application function (AKMA Application Function, AApF) network element, AApF can be used to provide services for application operation, so AAuF and The UE may interact with one or more AAPF; UDM can be used for user data management, which can specifically include the generation of UE authentication vectors, registration, subscription information management, group management, etc.; AUSF can be used to perform UE authentication procedures
  • UE, AAuF, SEAF/AUSF/UDM can be used as participants to achieve key negotiation of the shared key Ks between UE and AAuF.
  • Figure 3 shows the first step in AKMA authentication.
  • the participants performing AKMA authentication are: UE, AAuF, AUSF, UDM;
  • Figure 4 shows the second possibility in AKMA authentication, participation in performing AKMA authentication
  • the parties are: UE, AAuF, UDM;
  • Figure 5 shows the third possibility in AKMA authentication, and the parties performing AKMA authentication are: UE, AAuF, SEAF, AUSF, UDM.
  • AKMA authentication based on the AKMA authentication architecture of the first possibility can be: UE sends an authentication request to AMF/SEAF to AAuF (It is assumed that the UE needs to interact with AAuF through AMF/SEAF. It is understandable that there are other possibilities.
  • the UE interacts directly with AAuF, or the UE interacts with AAuF through other functional modules); AAuF sends an authentication request to AUSF/UDM and obtains the authentication vector AV; UE and AAuF perform based on EAP-AKA' or 5G AKA or other new definitions AKMA AKA authentication; specifically, the authentication process can be that the UE sends a request to AAuF, which carries the UE ID, the AAuF sends the UEID to AUSF, and the AUSF sends the UE ID to UDM.
  • AUSF obtains the authentication vector from UDM, which includes (RAND, AUTN, XRES, CK', IK') or (RAND, AUTN, XRES, Kausf). Based on this authentication vector, AUSF can complete two-way authentication with UE through AAuF . After the authentication is successful, the authentication vector obtained by AUSF includes Kakma, and then Kakma is sent directly to AAuF. Or AUSF determines Kakma based on CK’ and IK’, or Kausf, and then sends Kakma to AAuF; then AAuF sends an authentication success message to the UE through AMF/SEAF, where the message includes the key validity period key lifetime and temporary identifier temporary ID.
  • the terminal device involved in this application may also be called a terminal.
  • the terminal may be a wireless terminal or a wired terminal.
  • the wireless terminal may be a device that provides voice and/or other service data connectivity to users, a handheld device with wireless connection function, or other processing devices connected to a wireless modem.
  • a wireless terminal can communicate with one or more core networks via a radio access network (RAN).
  • the wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal For example, they can be portable, pocket-sized, handheld, computer-built or vehicle-mounted mobile devices, which exchange language and/or data with the wireless access network.
  • Wireless terminals can also be called systems, subscriber units, subscriber stations, mobile stations, mobile stations, remote stations, remote terminals, and access terminals.
  • the access terminal (access terminal), user terminal (user terminal), user agent (user agent), and UE are not limited here.
  • the terminal device involved in this application may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • This hardware layer includes hardware such as central processing unit (dentral processing unit, CPU), memory management unit (memory management unit, MMU), and memory (also called main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • Both the first network and the second network involved in this application may include an access network (AN) and a core network.
  • AN access network
  • core network may also include a data network (Data Network, DN).
  • the access network device is mainly used to implement wireless physical layer functions, resource scheduling and wireless resource management, wireless access control, and mobility management
  • the core network equipment can include management equipment and gateway equipment, and the management equipment is mainly used for terminals Device registration, security authentication, mobility management and location management of equipment, gateway equipment is mainly used to establish a channel with terminal equipment, and forward data packets between terminal equipment and external data networks on this channel
  • data networks can include networks Equipment (such as servers, routers and other equipment), data networks are mainly used to provide a variety of data business services for terminal equipment.
  • the first network may be an LTE network and the second network may be an NR network, or the first network may be an NR network and the second network may be an LTE network. That is, the method of the embodiment of the present application is suitable for the scenario where the LTE network and the NR network are interconnected.
  • the LTE network adopts the GBA authentication method
  • the NR network adopts the AKMA authentication method.
  • the access network device may be a base station or a transmission reception point (TRP).
  • the base station also known as the radio access network (RAN) equipment, is a device that connects the terminal to the wireless network, which can be global system of mobile communication (GSM) or code division
  • GSM global system of mobile communication
  • BTS base transceiver station
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • evolutional node B, eNB or eNodeB or relay station or access point in long term evolution (LTE) is not limited in this application.
  • the first network may include a first network element, and the first network element may be a BSF or AAuF, which is used to perform at least one of authentication of the first authentication network, generation and distribution of temporary identities, key generation and key life cycle determination. item.
  • the second network may include a second network element, and the second network element may be a BSF or AAuF, which is used to perform at least one of authentication of the second authentication network, generation and distribution of temporary identities, key generation and key life cycle determination. item.
  • the second network element may be a BSF or AAuF, which is used to perform at least one of authentication of the second authentication network, generation and distribution of temporary identities, key generation and key life cycle determination. item.
  • the first shared key involved in the embodiments of this application is generated by the terminal device for first authentication based on the authentication architecture of the first network.
  • the terminal device and the first network can perform subsequent key distribution between the UE and the AF based on the first shared key.
  • the specific key distribution process between the UE and the AF is not described in detail in the embodiment of this application.
  • the validity period of the first shared key involved in the embodiments of the present application represents the life cycle of the first shared key. After the limited period of the first key is exceeded, the first shared key cannot be used continuously.
  • the first temporary identity involved in the embodiments of the present application is a temporary identity that can be generated when the terminal device performs first authentication based on the authentication architecture of the first network.
  • the first shared key search can be performed based on the first temporary identity.
  • the second shared key involved in the embodiments of this application is generated by the terminal device for second authentication based on the authentication architecture of the second network.
  • the second shared key is shared between the second network element and the terminal device Later, the terminal device and the second network can perform subsequent key distribution between the UE and the AF based on the second shared key.
  • the specific key distribution process between the UE and the AF is not described in detail in the embodiment of this application.
  • the validity period of the second shared key involved in the embodiment of the present application represents the life cycle of the second shared key. After the limited period of the second key is exceeded, the second shared key cannot be used any more.
  • the second temporary identifier involved in the embodiments of the present application is a temporary identity that can be generated when the terminal device performs second authentication based on the authentication architecture of the second network.
  • the second shared key search can be performed based on the second temporary identifier.
  • the first network element, the third network element, and the fifth network element involved in the embodiment of the present application may work in the first network.
  • the second network element and the fourth network element involved in the embodiment of the present application may work in the second network.
  • FIG. 6 is a schematic flowchart of a communication method in Embodiment 1 of this application; the method in this embodiment of this application may include:
  • Step S201 The terminal device sends a first request to the first network element; wherein the first request includes the identification of the terminal device.
  • the identity of the terminal device may be the terminal's subscriber permanent identity (Subscription Permanent Identifier, SUPI), or the terminal’s International Mobile Subscriber Identity (IMSI), or the terminal’s IP multimedia private identity (IP Multimedia Private Identity, IMPI), or the terminal’s Globally Unique Temporary Identifier (GUTI), or the terminal’s IP Multimedia Public Identity (IMPU), or the terminal’s temporary mobile user identifier ( Temporary Mobile Subscriber Identity, TMSI) (such as: System Architecture Evolution Temporary Mobile Subscriber Identifier (S-TMSI) or Mobility Management Function Temporary Mobile Subscriber Identifier (M-TMSI) or Packet Domain User Temporary Identifier (P-TMSI)) , Or the International Mobile Station Equipment Identity (IMEI) of the terminal, or the User Sealed Identifier (Subscription Concealed Identifier, SUCI) of the terminal, etc., which are not restricted.
  • SUCI can be an encrypted encapsulation of SUPI.
  • the first network element is a network element in the first network that performs first authentication based on the first authentication architecture.
  • the first authentication architecture may be GBA, and the first authentication architecture may also be AKMA; the first request is used for Instruct the first network element to obtain the first shared key from the second network element; the second network element is a network element in the second network that performs the second authentication based on the second authentication architecture, the second authentication architecture may be GBA, and the second authentication
  • the architecture can also be AKMA; in specific applications, when the first authentication architecture is GBA, the first network element is BSF, the second authentication architecture is AKMA, and the second network element is AAuf; the first authentication architecture is AKMA In this case, the first network element is AAvem, the second authentication architecture is GBA, and the second network element is BSF; an interface can be set between the first network element and the second network element through the first network element and the second network element The interface between the first network element and the second network element realizes data transmission.
  • the second shared key, the second temporary identifier, and the second network element can be shared between the terminal device and the second network element.
  • Validity period of the shared key the terminal device sends a first request to the first network element to indicate that the terminal device hopes to establish parameter negotiation with the first network element through the existing authentication parameters in the second network element.
  • the terminal device if the terminal device is not authenticated in the second network element, there is no authentication parameter shared between the terminal device and the second network element; Sending the first request indicates that the terminal device wants to trigger the second network element to perform the second authentication with the terminal device through the first network element, and establishes the authentication parameters generated when the second network element and the terminal device perform the second authentication.
  • Sending the first request indicates that the terminal device wants to trigger the second network element to perform the second authentication with the terminal device through the first network element, and establishes the authentication parameters generated when the second network element and the terminal device perform the second authentication.
  • the first request further includes at least one of the following: first indication information, integrity protection information, and a replay identifier of the first request; the first indication information is used to instruct the first network element to follow The first shared key in the first network is obtained in the second network, the integrity protection information is used to verify the legitimacy of the terminal device; the replay identifier of the first request is used to verify Whether the first request is a replay message.
  • the first indication information may be information related to the second network, and is used to instruct the first network element to obtain the first shared key of the first network from the second network.
  • the first indication message may be a GBA indicator or an AKMA indicator.
  • the integrity protection information may be a message authentication code (Message Authentication Code, MAC), and the MAC may be based on the second shared key (or it may be based on the second shared key and the first integrity protection information input parameter ), calculated by using the integrity protection algorithm to protect the integrity of the entire message, the second network element can verify whether the terminal device is a legitimate terminal according to the message verification code, thereby improving the safety factor of communication.
  • the integrity protection algorithm may be a hash operation, which is not specifically limited in the embodiment of the present application.
  • the replay identifier of the first request may be the first freshness parameter, specifically it may be a counter, a random number, etc.
  • the first freshness parameter is used for the input of the integrity protection information, which can prevent the integrity protection information Replay attacks to improve the safety factor of communication.
  • Step S202 The first network element sends a second request to the second network element according to the first request, where the second request includes the identifier of the terminal device.
  • the first network element may send a second request including the identifier of the terminal device to the second network element according to the first request.
  • the identifier of the second network element may be determined from the second temporary identity of the terminal device sent by the terminal device, or determined from the first indication information received by the terminal device.
  • the second request is used to request the first shared key from the second network element.
  • the second request further includes at least one of the following: a first network element identifier, the integrity protection information, and the first integrity protection information input parameter; wherein the first network element identifier is used To identify the address and identity information of the first network element.
  • the second network element may determine the address and identity information of the first network element according to the first network element identifier, and subsequently may perform data transmission with the first network element according to the first network element identifier.
  • the first network element may forward the second request including the integrity protection information and the input parameters of the first integrity protection information sent by the terminal device to the second network element, so as to improve the safety factor of communication, which is not repeated here.
  • Step S203 The second network element determines a second shared key according to the identification of the terminal device, and determines a first shared key according to the second shared key.
  • the second network element can match the second shared secret corresponding to the identification of the terminal device in the pre-made storage space. Key; wherein, the mapping relationship between the identification of the terminal device and the second shared key is stored in the prefabricated storage space.
  • the second network element may respond to the second request and perform second authentication with the terminal device to obtain the second Shared key.
  • the second network element and the terminal device in response to the second request, can perform a second authentication based on the second authentication architecture.
  • the second authentication can be a GBA conventional authentication or an AKMA conventional authentication It may also be an authentication method such as 5G AKA or EAP AKA'. This authentication method is not restricted in the embodiment of this application, and the second authentication is not described here.
  • the second request is sent by the first network element, namely In the second authentication, the first network element participates in the execution of parameter transfer, so that the authentication process between the terminal device of this application and the second network element is different from the existing authentication process.
  • the manner in which the second network element determines the first shared key according to the second shared key may be:
  • the second network element obtains the first shared key by using a key derivation function according to the second shared key.
  • the parameters based on it may include at least one of the following parameters: the identification of the first network element, the indication of the interconnection between AKMA and GBA, and the second freshness Parameters, the identification of the terminal device, and the identification of the second authentication framework.
  • the identity of the first network element is used to bind this key to the first network element.
  • AKMA and GBA interconnection and intercommunication instructions are used to indicate the scenario where the key is used for intercommunication.
  • the second freshness parameter is used to ensure the freshness of the key, and may be a counter or a random number randomly selected.
  • the identification of the terminal device may be the received second temporary identification or a permanent identification; or a permanent identification of the terminal device determined according to the packaging identification of the terminal device.
  • the second authentication architecture identifier is used to indicate that the key is related to the second authentication architecture.
  • the identifier of the first network element in the embodiment of the present application may be sent by the first network element to the second network element, or may be determined by the second network element according to its interface connection with the first network element.
  • the second fresh parameter may be sent to the terminal device through the first network element.
  • the second network element may verify the reception according to the second shared key and the first freshness parameter through the message verification code algorithm. Whether the received message verification code is correct. If the verification is correct, continue to execute, otherwise, reject the second request, and optionally, send a rejection response message or rejection instruction to the first network element to inform the first network element that the verification of the message verification code has failed; optional After receiving the rejection response message or rejection instruction, the first network element sends a rejection response message or rejection instruction to the terminal device to inform the terminal that the verification of the message verification code has failed. It is understandable that if the first fresh parameter is shared between the terminal device and the second network element, the terminal may not send the first fresh parameter to the first network element, and the first network element does not need to send the first fresh parameter to the first network element. Two network elements.
  • Step S204 The second network element sends the first shared key to the first network element.
  • the second network element sends the first shared key to the first network element, and the terminal device realizes the establishment of parameter negotiation with the first network element through the existing authentication parameters in the second network element.
  • the second fresh parameter is also sent.
  • At least one of an indication of the interconnection between AKMA and GBA, or an identifier of the second authentication framework is also sent.
  • Step S205 The first network element sends a first response message to the terminal device.
  • the first response message is used to indicate that the first network element has obtained the first shared key.
  • the first response message includes at least one of a second freshness parameter, an indication of the interconnection between AKMA and GBA, and an identifier of the second authentication architecture.
  • the first response message includes: the first temporary identifier and/or the validity period of the first shared key.
  • the validity period of the first temporary identifier and/or the first shared key may be calculated by the first network element or the second network element, and then the first network element will The temporary identification and/or the validity period of the first shared key are sent to the terminal device.
  • the specific implementation of determining the first temporary identifier by the first network element may be: the first network element receives the second temporary identifier from the second network element; The first temporary identifier is obtained by calculation; wherein, the second temporary identifier is a temporary identifier obtained by the terminal device performing second authentication in the second network element.
  • the second temporary identifier usually includes the temporary identity identifier of the terminal device and the second network element identifier of the second network element.
  • the first network element may replace the second network element identifier in the second temporary identifier with the first network element identifier.
  • the optional second temporary identification further includes a second authentication architecture identification, and the first network element may replace the second authentication architecture identification in the second temporary identification with the first authentication architecture identification or directly remove the second authentication architecture identification.
  • the specific implementation for the first network element to determine the validity period of the first shared key may be: the first network element receives the validity period of the second shared key from the second network element; The validity period of the second shared key is calculated to obtain the validity period of the first shared key. Specifically, the first network element may determine the validity period of the first shared key according to the remaining lifetime of the validity period of the second shared key; the first network element may also refer to other local policies (such as the validity period of the first shared key) at the same time. No more than 1 hour) to determine the validity period of the first shared key, which is not limited in this application.
  • the specific implementation of determining the validity period of the first shared key by the first network element may also be: the first network element receives the validity period of the first shared key from the second network element; wherein, the first shared key The validity period of is calculated by the second network element according to the validity period of the second shared key.
  • the second network element may determine the validity period of the first shared key according to the remaining life cycle of the validity period of the second shared key; the second network element may also refer to other local policies (such as the validity period of the first shared key) at the same time. No more than 1 hour) to determine the validity period of the first shared key, which is not limited in this application, and then the second network element sends the first temporary identifier to the first network element.
  • the first network element or the second network element calculates the validity period of the first temporary identifier and/or the first shared key, and the terminal device also calculates the first temporary identifier And/or the validity period of the first shared key, the first network element does not need to send the first temporary identifier and/or the validity period of the first shared key to the terminal device.
  • the specific implementation of the terminal device determining the validity period of the first shared key may be: the terminal device can determine the validity period of the first shared key according to the remaining life cycle of the validity period of the second shared key; the terminal device can also refer to other local policies at the same time (For example, the validity period of the first shared key does not exceed 1 hour) The validity period of the first shared key is determined, which is not limited in this application.
  • Step S206 The terminal device determines the first shared key according to the second shared key.
  • the manner in which the terminal device determines the first shared key according to the second shared key may use the same manner as the second network element to derive the first shared key, which is not repeated here.
  • the second freshness parameter may not be sent in steps 204 and 205.
  • the terminal device if it lacks any derivation parameter for determining the first shared key based on the second shared key, it can be sent by the second network element to the first network element, and the first network element is sending further To the terminal equipment.
  • the terminal device and the first network element After the terminal device and the first network element share the first shared key, and the first temporary identification and/or the validity period of the first shared key, the terminal device and the first network element can be based on the first shared key Perform subsequent security procedures and other operations.
  • the terminal device may execute the process of step S206 after receiving the first response message; the terminal device may also execute the process of step S206 before receiving the first response message; this embodiment of the application does not limit this; The embodiment of the present application also does not limit the specific location of the terminal device to determine the first shared key according to the second shared key.
  • the communication method of the embodiment of the present application may include two implementation modes: in the first implementation manner, the first network element is BSF and the second network element is AAuF; in the second implementation manner, the first network element It is AAuF, and the second network element is BSF.
  • the first network element is BSF and the second network element is AAuF as an example to illustrate the process of obtaining the first shared key ks in GBA based on the second shared key kakma in AKMA.
  • the first temporary identifier is B-TID
  • the first shared key is Ks
  • the validity period of the first shared key is keylifetime1
  • the second temporary identifier is Temporary ID
  • the second shared key It is Kakma
  • the validity period of the second shared key is keylifetime2.
  • the method may include:
  • Step S2011 the UE sends a first request to the BSF; wherein the first request includes the identification of the terminal device.
  • the embodiments of this application may include two application scenarios.
  • the terminal device performs AKMA authentication in the 5G network, and the UE and AAuF share Kakma, Temporary ID, and key lifetime2; in the second application scenario If the terminal device does not perform AKMA authentication in the 5G network, the UE and AAuF do not share Kakma, temporary ID, and key lifetime2.
  • the identification of the terminal device can be the temporary identification Temporary ID, which contains both the AAuF identification and the identification of the terminal device; the first request can also include the permanent identification of the terminal device and the first The AAuF identifier of the indication information, so that the BSF can use the AAuF identifier to determine that the first request corresponds to the AKMA request.
  • the specific AAuF identifier may include: AAuF address information AAuF domain name/address, or AKMA authentication indication AKMA indicator, used to indicate
  • the first request is based on the result of the existing AKMA authentication; the first request may also include the temporary identity identifier Temporary ID and the AAuF identifier of the terminal device; this embodiment of the application does not specifically limit this.
  • the first request may include the permanent identity of the terminal device and the AAuF identifier, so that the BSF can use the AAuF identifier to determine that the first request corresponds to the AKMA request.
  • the specific AAuF identifier may include: AAuF Address information AAuF domain name/address.
  • the first request may also include the package identifier of the permanent identity of the terminal device and the AAuF identifier; the first request may also include the package identifier of the permanent identity of the terminal device or the permanent identity of the terminal device.
  • the first request may include: the message verification code MAC.
  • the MAC may be calculated based on Kakma's integrity protection of the entire message, In this way, the AAuF can verify the MAC to determine that this message is sent by a legitimate UE.
  • the first request may include: fresh parameter 1, input for MAC calculation to prevent MAC replay attacks, fresh parameter 1 may be Counter, random number, nonce, etc.
  • the first request may include first indication information: AKMA indicator (AKMA indicator), used to indicate that the first request is related to AKMA of.
  • AKMA indicator used to indicate that the first request is related to AKMA of.
  • Step S2021 The BSF sends a second request to the AAuF according to the first request, where the second request includes the identifier of the terminal device.
  • the BSF can determine the specific AAuF through Temporary ID and/or AAuF domain name/address; the identification of the terminal device can be the Temporary ID or the permanent identity of the terminal device. It is also possible that the BSF determines the specific AAuF through the permanent identity of the terminal device. For example, the first identity includes the information of the network where the AAuF is located. In the above-mentioned second application scenario, the BSF can determine the specific AAuF through the AAuF domain name/address; the identification of the terminal device may be the permanent identity of the terminal device or the encapsulation of the permanent identity of the terminal device.
  • the BSF determines the specific AAuF through the permanent identity of the terminal device or the package identity of the permanent identity of the terminal device.
  • the permanent identity of the terminal device or the package identity of the permanent identity of the terminal device includes the information of the network where the AAuF is located.
  • the BSF determines that the request is related to AKMA.
  • the BSF may also determine that the request is related to AKMA through the identification of the terminal device and/or the AAuF domain name/address.
  • the second request may also include the BSF identifier, and/or the message verification code MAC, and/or the freshness parameter 1.
  • the BSF identifier can be the address information BSF domain name of the BSF, so that AauF can subsequently interact with the BSF based on the BSF identifier; the MAC can be calculated based on the integrity protection of the entire message based on Kakma, so that the AAuF can determine this by verifying the MAC
  • the message is sent by a legitimate UE; the fresh parameter 1 is used for the input of MAC calculation to prevent MAC replay attacks.
  • the fresh parameter 1 can be a counter, random number, nonce, etc.
  • Step S2031 AAuF determines Kakma according to the identification of the terminal device; generates Ks according to Kakma, and can also determine key lifetime1 according to keylifetime2.
  • AAuF stores the mapping relationship between Temporary ID, Kakma, and key lifetime2.
  • AAuF can determine Kakma and key lifetime2 according to Temporary ID; further, AAuF derives Ks from Kakma, and derives Ks.
  • the parameters may also include at least one of the following parameters: BSF domainname, indication of the interconnection and intercommunication between AKMA and GBA, fresh parameter 2, identification of the terminal device, and identification of the second authentication architecture. Refer to the derived expression of step S203, which will not be repeated here.
  • the BSF domain name can be BSF sent to AAuF, or AAuF can determine the BSF domain name according to its interface connection with the BSF; AAuF can determine key lifetime1 according to keylifetime2.
  • the life cycle of key lifetime1 can be determined according to the remaining life cycle of keylifetime2; in addition, the validity period of keylifetime1 can also be determined by referring to other local policies (for example, keylifetime1 does not exceed 1 hour).
  • AAuF can check whether the received message verification code is correct according to Kakma and the first freshness parameter through the message verification code algorithm. . If the verification is correct, continue to execute, otherwise, reject the second request, and optionally, send a rejection response message or rejection instruction to the BSF to inform the BSF that the verification code of the message has failed; optionally, the BSF receives a rejection response After the message or rejection instruction, a rejection response message or rejection instruction is sent to the terminal device to inform the terminal that the verification of the message verification code has failed. It can be understood that if the first freshness parameter is shared between the terminal device and the AAuF, the terminal may not send the first freshness parameter to the BSF, and the BSF does not need to send the first freshness parameter to the AAuF.
  • the AAuF can respond to the second request and perform AKMA two-way authentication with the terminal device in real time, so that the AAuF shares the temporary ID, Kakma, and Kakma with the UE. key lifetime2, specifically, AAuF can be based on the above-mentioned AKMA architecture, through AUSF/UDM and terminal equipment to perform AKMA two-way authentication, which will not be repeated here; then AAuF can perform the process of determining Ks in the first application scenario , I won’t repeat it here.
  • AAuF can send key lifetime 2 to BSF.
  • Step S2041 AAuF sends Ks to BSF, and may also send Temporary ID and/or keylifetime1.
  • AAuF can send Ks to the BSF, and can also send the Temporary ID and/or keylifetime1.
  • AAuF can also send fresh parameter 2 to the BSF to prevent repeated attacks.
  • Fresh parameter 2 can be a counter, random number, nonce, etc.
  • the AAuF may also send an indication of the interconnection between AKMA and GBA, or the identification of the second authentication architecture, to the BSF.
  • Step S2051 The BSF determines the B-TID according to the Temporary ID.
  • the B-TID may be generated by the BSF, or may be determined by the BSF according to the received temporary ID.
  • the way for the BSF to determine the B-TID according to the Temporary ID may be to replace the domain name following the temporary ID with the BSF domain name; so that the final B-TID includes the temporary identity of the UE in the temporary ID and the BSF domain name.
  • the process of determining the B-TID according to the Temporary ID can also be implemented by AAuF, and the AAuF can send the B-TID to the BSF.
  • Step S2061 The BSF sends the B-TID and keylifetime1 to the UE.
  • the BSF may also send at least one of the freshness parameter 2, the indication of the interconnection and intercommunication between AKMA and GBA, and the identifier of the second authentication architecture to the UE.
  • the UE may also determine the B-TID and keylifetime1 according to the Temporary ID, Kakma, and keylifetime2 stored in the UE, and the BSF does not need to send the B-TID and keylifetime1 to the UE.
  • Step S2071 The UE determines Ks according to Kakma.
  • the manner in which the UE determines Ks according to Kakma is the same as the manner in which AAuF generates Ks, which will not be repeated here. It should be noted that if AAuF adopts fresh parameter 2, the UE will also receive fresh parameter 2 from the BSF.
  • the second fresh parameter may not be sent in the above step.
  • the terminal device if it lacks any derived parameter for determining Ks according to Kakma, it can be sent to the BSF by AAuF, and the BSF is further sent to the UE.
  • the UE and the BSF have completed the sharing of Ks, B-TID, and Keylifetime1, and the subsequent UE and AF can perform key distribution processes based on Ks, B-TID, and Keylifetime1, which are not described in detail in the embodiment of this application.
  • the first network element is AAuF and the second network element is BSF as an example to illustrate the process of obtaining Kakma in AKMA based on ks in GBA.
  • the first temporary identifier is Temporary ID
  • the first shared key is Kakma
  • the validity period of the first shared key is key lifetime1
  • the second temporary identifier is B-TID
  • the validity period of the second shared key is keylifetime2.
  • the method may include:
  • Step S2012 The UE sends a first request to AAuF; wherein, the first request includes the identification of the terminal device.
  • the embodiments of this application may include two application scenarios.
  • the terminal device performs GBA authentication on the 4G network, and the UE and the BSF share B-TID, Ks, and keylifetime2; the second application scenario If the terminal device does not perform GBA authentication in the 4G network, the UE and the BSF do not share the B-TID, Ks, and key lifetime2.
  • the identification of the terminal device may be the temporary identification B-TID, which contains both the BSF identification and the identification of the terminal device; the first request may also include the permanent identification and function of the terminal device
  • the BSF identifier of the first indication information allows the BSF to determine that the first request corresponds to a GBA request through the BSF identifier.
  • the specific BSF identifier may include: BSF address information BSF domain name/address, which is used to indicate that the first request is based on GBA has the result of the authentication; the first request may also include the Temporary ID and the AAuF identifier of the terminal device; this embodiment of the application does not specifically limit this.
  • the first request may include the permanent identity of the terminal device and the BSF identifier, so that the BSF can use the BSF identifier to determine that the first request corresponds to a GBA request.
  • the specific BSF identifier may include: BSF Address information BSF domain name/address
  • the first request may also include the package identifier of the permanent identity of the terminal device and the BSF identifier; the first request may also include the package identifier of the permanent identity of the terminal device or the permanent identity of the terminal device .
  • the first request may include: the message verification code MAC.
  • the MAC may be calculated based on Ks to protect the integrity of the entire message, In this way, the BSF can verify the MAC to determine that this message is sent by a legitimate UE.
  • the first request may include: fresh parameter 1, input for MAC calculation to prevent MAC replay attacks, fresh parameter 1 may be Counter, random number, nonce, etc.
  • the first request may include first indication information: GBA indicator (GBA indicator), used to indicate the first request It is related to AKMA.
  • GBA indicator GBA indicator
  • Step S2022 AAuF sends a second request to the BSF according to the BSF identifier, where the second request includes the terminal device identifier, and the second request may also include the BSF identifier and/or the message verification code MAC.
  • AAuF can determine the specific BSF through B-TID and/or BSF domain name/address; the identification of the terminal device can be the B-TID or the permanent identity of the terminal device. . It is also possible that the AAuF determines the specific BSF through the permanent identity of the terminal device. For example, the first identity includes the information of the network where the BSF is located.
  • AAuF can determine the specific BSF through the BSF domain name/address or GBA indicator; the terminal device's identity can be the terminal device's permanent identity identity or the terminal device's permanent identity identity encapsulation identity. It is also possible that the AAuF determines the specific BSF through the permanent identity of the terminal device or the package identity of the permanent identity of the terminal device.
  • the permanent identity of the terminal device or the package identity of the permanent identity of the terminal device includes information about the network where the BSF is located.
  • AAuF determines that this request is related to GBA.
  • AAuF can also determine that this request is related to GBA through the identification of the terminal device and/or the BSF domain name/address. .
  • the second request may also include the AAuF identifier, and/or the message verification code MAC, and/or the freshness parameter 1.
  • the AAuF identifier can be the address information AAuF domain name of the AAuF, so that the BSF can subsequently interact with the AAuF based on the AAuF identifier; the MAC can be calculated based on Ks to protect the integrity of the entire message, so that the BSF can determine this by verifying the MAC
  • the message is sent by a legitimate UE; the fresh parameter 1 is used for the input of MAC calculation to prevent MAC replay attacks.
  • the fresh parameter 1 can be a counter, random number, nonce, etc.
  • Step S2032 The BSF determines Ks according to the identification of the terminal device; generates Kakma according to Ks, and may also determine keylifetime1 according to keylifetime2.
  • the mapping relationship between B-TID, Ks and keylifetime2 is stored in the BSF, and AAuF can determine Ks and keylifetime2 according to the B-TID; further, BSF derives Kakma from Ks, which is derived
  • the parameters of Kakma may also include at least one of the following parameters: AAuF domainname, indication of the interconnection between AKMA and GBA, fresh parameter 2, terminal device identification, and second authentication framework identification. Refer to the derived expression of step S203, which will not be repeated here.
  • the AAuF domain name can be AAuF sent to the BSF, or the BSF can determine the AAuF domain name according to its interface connection with AAuF; the BSF can determine the key lifetime1 according to keylifetime2.
  • the life cycle of key lifetime1 can be determined according to the remaining life cycle of keylifetime2; in addition, the validity period of keylifetime1 can also be determined by referring to other local policies (for example, keylifetime1 does not exceed 1 hour).
  • the BSF can check whether the received message verification code is correct according to Ks and the first freshness parameter through the message verification code algorithm. . If the verification is correct, continue to execute, otherwise, reject the second request, and optionally send a rejection response message or rejection instruction to AAuF to inform the AAuF message that the verification code verification failed; optionally, AAuF receives a rejection response After the message or rejection instruction, a rejection response message or rejection instruction is sent to the terminal device to inform the terminal that the verification of the message verification code has failed. It can be understood that if the first freshness parameter is shared between the terminal device and the BSF, the terminal may not send the first freshness parameter to AAuF, and AAuF does not need to send the first freshness parameter to the BSF.
  • the BSF can respond to the second request and perform GBA two-way authentication with the terminal device in real time, so that the B-TID and Ks are shared with the UE in the BSF. And keylifetime2, specifically, the BSF can perform GBA bidirectional authentication between the HSS and the terminal device based on the aforementioned GBA architecture, which will not be repeated here; then the BSF can perform the process of determining Kakma in the first application scenario, I won't repeat them here.
  • the process of determining key lifetime1 according to key lifetime2 can also be implemented by AAuF, and the BSF can send key lifetime2 to AAuF.
  • Step S2042 The BSF sends Kakma to AAuF, and may also send B-TID and keylifetime1.
  • the BSF can send Kakma to AAuF, and can also send B-TID and keylifetime1.
  • the BSF can also send fresh parameter 2 to the AAuF to prevent repeated attacks.
  • the fresh parameter 2 can be a counter, a random number, a nonce, etc.
  • Step S2052 AAuF determines the Temporary ID according to the B-TID.
  • the Temporary ID may be generated by AAuF, or may be determined by AAuF according to the received B-TID.
  • the AAuF method for determining the Temporary ID according to the B-TID may be replacing the domain name following the B-TID with AAuF domain name; so that the final Temporary ID includes the temporary identity of the UE in the B-TID and the AAuF domain name.
  • the Temporary ID may also include an indication to indicate that the Temporary ID is related to AKMA.
  • the process of determining the Temporary ID according to the B-TID can also be implemented by the BSF, and the BSF can send the B-TID to AAuF.
  • Step S2062 AAuF sends the Temporary ID and keylifetime1 to the UE.
  • the AAuF may also send at least one of the freshness parameter 2, the indication of the interconnection and intercommunication between AKMA and GBA, and the identifier of the second authentication architecture to the UE.
  • the UE may also determine the Temporary ID and key lifetime1 according to the B-TID, Ks, and key lifetime2 stored in the UE, and the AAuF does not need to send the Temporary ID and key lifetime1 to the UE.
  • Step S2072 The UE determines Kakma according to Ks.
  • the manner in which the UE determines the Kakma according to Ks is the same as the manner in which the BSF generates the Kakma, which will not be repeated here. It should be noted that if the BSF adopts fresh parameter 2, the UE will also receive fresh parameter 2 from the BSF.
  • the second freshness parameter may not be sent in the above step.
  • the terminal device if it lacks any derived parameter for determining Kakma based on Ks, it can be sent by the BSF to the AAuF, and the AAuF is further sent to the UE.
  • AAuF has an interface with SEAF/AUSF/UDM.
  • the shared key between SEAF/AUSF/UDM is called the third shared key and the identification of the third shared key.
  • the third shared key generation method is not limited by the prior art, such as AUSF key, SEAF key, AMF key, UDM key; the corresponding identification can be AUSF key identification, SEAF key identification, AMF key Identification, UDM key identification.
  • SEAF/AUSF/UDM can derive the second shared key based on the third shared key; and send the second shared key and the third shared key identifier to AAUF.
  • the subsequent process is the same as the above-mentioned embodiment, except that AAuF needs to transfer the third shared key identifier to the UE.
  • the UE determines the third shared key according to the third shared key identifier, and determines the second shared key according to the third shared key.
  • the procedures of other UEs are similar to the foregoing embodiment, and will not be repeated here. If the UE cannot determine the third shared key according to the received third shared key identifier (for example, the third shared key identifier is not stored locally), then this procedure is rejected.
  • the UE sends an error indication to AAuF, indicating that the context corresponding to the third shared key identifier is found.
  • SEAF/AUSF/UDM represents the relationship of OR.
  • the UE and AAuF have completed the sharing of Kakma, Temporary ID, and Keylifetime1, and subsequent UE and AF can perform key distribution processes based on Kakma, Temporary ID, and Keylifetime1, which are not described in detail in this embodiment of the application.
  • the first network element after the first network element receives the first request including the identification of the terminal device from the terminal device, the first network element sends the second request including the identification of the terminal device to the second network element,
  • the second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element, and the first shared key is received in the first network element
  • the first authentication based on the first shared key can be further implemented with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • the method may specifically include:
  • Step S301 The first network element receives a first request from a terminal device; where the first request includes the identification of the terminal device.
  • Step S302 The first network element sends a second request to a second network element according to the first request; wherein, the second request includes the identification of the terminal device.
  • Step S303 The first network element receives a first shared key from the second network element; wherein, the first shared key is determined by the second network element according to the second shared key, and the The second shared key is determined by the second network element according to the identification of the terminal device; the first shared key is used for security protection in the first network, and the second shared key is used for the second network Security protection.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain the first share in the first network from the second network. Key.
  • Optional also includes:
  • the first network element determines the first temporary identity of the terminal device; the first temporary identity is calculated by the first network element or the second network element according to the identity of the terminal device, the The first temporary identifier is used to identify the temporary identity of the terminal device in the first network;
  • the first network element sends the first temporary identifier to the terminal device.
  • Optional also includes:
  • the first network element determines the validity period of the first shared key; wherein the validity period of the first shared key is that the first network element or the second network element is based on the second shared key
  • the validity period of the second shared key is determined; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device;
  • the first network element sends the validity period of the first shared key to the terminal device.
  • the second request further includes a first network element identifier of the first network element; wherein, the first network element identifier is used to identify the identity of the first network element;
  • the first shared key is derived by the second network element according to the second shared key and the first network element identifier.
  • the second shared key is obtained by the second network element after receiving the second request and performing second authentication with the terminal device in real time in response to the second request.
  • the first network element can correspondingly receive the request.
  • the execution principle is similar, and the method in which the first network element is the execution subject is not repeated here.
  • the first network element after the first network element receives the first request including the identification of the terminal device from the terminal device, the first network element sends the second request including the identification of the terminal device to the second network element,
  • the second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element, and the first shared key is received in the first network element
  • the first authentication based on the first shared key can be further implemented with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • the method may specifically include:
  • Step S401 The second network element receives a second request from the first network element; the second request includes the identification of the terminal device.
  • Step S402 The second network element determines a second shared key according to the identification of the terminal device.
  • Step S403 The second network element determines a first shared key according to the second shared key.
  • Step S404 The second network element sends the first shared key to the first network element; wherein, the first shared key is used for security protection in the first network, and the second shared key Used for security protection in the second network.
  • the second network element determining the second shared key according to the identification of the terminal device includes:
  • the second network element determines the second shared key corresponding to the identification of the terminal device according to the identification of the terminal device and the mapping relationship between the identification of the terminal and the shared key in the second network obtained in advance.
  • the second network element determining the second shared key according to the identification of the terminal device includes:
  • the second network element performs second authentication with the terminal device to obtain the second shared key.
  • Optional also includes:
  • the second network element determines the validity period of the second shared key according to the identifier of the terminal device; the second network element sends the validity period of the second shared key to the first network element;
  • the second network element determines the validity period of the second shared key according to the identification of the terminal device; the second network element determines the validity period of the first shared key according to the validity period of the second shared key; The second network element sends the validity period of the first shared key to the first network element.
  • Optional also includes:
  • the second network element determines the second temporary identifier of the terminal device according to the identifier of the terminal device; the second network element sends the second temporary identifier to the first network element; the second temporary The identifier is used to identify the temporary identity of the terminal device in the second network;
  • the second network element determines the second temporary identifier of the terminal device according to the identifier of the terminal device; the second network element determines the first temporary identifier according to the second temporary identifier; the second network element directs The first network element sends the first temporary identifier; the first temporary identifier is used to identify the temporary identity of the terminal device in the first network.
  • the second request further includes a first network element identifier of the first network element; wherein, the first network element identifier is used to identify the identity of the first network element;
  • the first shared key is derived by the second network element according to the second shared key and the first network element identifier.
  • the second network element can correspondingly receive the request.
  • the execution principle is similar, and the method in which the second network element is the execution subject is not repeated here.
  • the first network element after the first network element receives the first request including the identification of the terminal device from the terminal device, the first network element sends the second request including the identification of the terminal device to the second network element,
  • the second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element, and the first shared key is received in the first network element
  • the first authentication based on the first shared key can be further implemented with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • FIG. 11 shows a schematic diagram of a communication flow on the terminal device side according to Embodiment 6 of the present application.
  • the method may specifically include:
  • Step S501 The terminal device sends a first request to a first network element; wherein, the first request includes the identification of the terminal device; the first request is used to instruct the first network element to obtain from a second network element The first shared key;
  • Step S502 The terminal device determines a first shared key according to a second shared key; the second shared key is determined when the terminal device performs second authentication in the second network element; The first shared key is used for security protection in the first network, and the second shared key is used for security protection in the second network.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain the first share in the first network from the second network. Key.
  • the method further includes: the terminal device receives a first temporary identifier from the first network element; the first temporary identifier is The first network element or the second network element is calculated according to the identification of the terminal device; the identification of the terminal device is used to identify the terminal device, and the first temporary identification is used to identify the terminal device in the The temporary identity in the first network; or, the terminal device determines the first temporary identity according to the second temporary identity; the second temporary identity is used to identify the temporary identity of the terminal device in the second network.
  • the method before the terminal device determines the first shared key according to the second shared key, the method further includes:
  • the terminal device receives the validity period of the first shared key from the first network element; wherein the validity period of the first shared key is the first network element or the second network element according to the The validity period of the second shared key is determined; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device; or, the terminal device is determined according to the validity period of the second shared key The validity period of the first shared key is determined; the validity period of the second shared key is determined when the terminal device performs the second authentication in the second network element.
  • the terminal device can receive the request accordingly.
  • the execution principle is similar, and the method in which the terminal device is the execution subject is not repeated here.
  • the first network element after the first network element receives the first request including the identification of the terminal device from the terminal device, the first network element sends the second request including the identification of the terminal device to the second network element,
  • the second network element may determine the first shared key according to the second shared key in response to the second request, and send the first shared key to the first network element, and the first shared key is received in the first network element
  • the first authentication based on the first shared key can be further implemented with the terminal device. That is, the first network element can implement the first authentication of the terminal device based on the second shared key in the second network element, thereby enabling intercommunication between the first authentication architecture and the second authentication architecture and improving communication flexibility.
  • the characteristics of generating and distributing the first shared key to the first network element, the characteristics of determining the first temporary identifier, and the characteristics of determining the validity period of the first shared key can belong to three independent features, the three features can be three independent steps, any two can be combined into one step, or the three can be combined to form a step flow for implementation; the embodiment of the present application does not limit this.
  • Embodiment 7 of the present application a schematic flowchart of another communication method according to Embodiment 7 of the present application is shown.
  • the embodiments of this application may include:
  • Step S601 The terminal device sends a third request to the fifth network element; where the third request includes the identification of the terminal device.
  • the identification of the terminal device may be the permanent identity of the terminal device or the encapsulation identification of the permanent identity of the terminal device; the identification of the terminal device may also be the second temporary identification of the terminal device, which will not be repeated here.
  • the third network element is a network element that performs first authentication based on the first authentication architecture.
  • the first authentication architecture may be GBA, and the first authentication architecture may also be AKMA; the fourth network element identifier is used to identify the first authentication architecture.
  • the fourth network element is a network element that performs second authentication based on the second authentication architecture.
  • the second authentication architecture can be GBA, and the second authentication architecture can also be AKMA; in specific applications, the first authentication architecture is GBA In the case of AKMA, the third network element is HSS, the second authentication framework is AKMA, and the fourth network element is SEAF/AUSF/UDM; when the first authentication framework is AKMA, the third network element is SEAF/AUSF/UDM ,
  • the second authentication architecture is GBA, and the fourth network element is HSS; an interface can be set between the third network element and the fourth network element, and the third network element can be connected to the third network element through the interface between the third network element and the fourth network element. Data transmission between the element and the fourth network element.
  • the second authentication vector can be shared between the terminal device and the fourth network element, and the second authentication vector can include The second shared key; the terminal device sends the third request to the fifth network element, indicating that the terminal device hopes to establish parameter negotiation with the fifth network element through the authentication parameters already in the fourth network element.
  • Step S602 The fifth network element sends the third request to the third network element.
  • the fifth network element needs to establish a communication connection with the fourth network element through the third network element. Therefore, the fifth network element sends a request to the fifth network element, and the request includes the identification of the terminal device.
  • the request further includes the identification of the fourth network element.
  • Step S603 The third network element sends a fourth request to the fourth network element according to the third request; wherein, the fourth request includes the identification of the terminal device.
  • the third network element may determine the identity of the fourth network element according to the identity of the terminal device.
  • the fourth request may further include the fourth network element identifier, and the third network element may send the fourth request including the identifier of the terminal device to the fourth network element according to the fourth network element identifier.
  • the fourth request is used to request the first authentication vector from the fourth network element.
  • the fourth request further includes: a third network element identifier, so that the fourth network element can determine the identity or address information of the third network element according to the third network element identifier, and subsequently can be combined with the third network element identifier
  • the third network element performs data transmission.
  • Step S604 The fourth network element determines a second authentication vector according to the identification of the terminal device; determines a first authentication vector according to the second authentication vector.
  • the fourth network element determines the second authentication vector according to the identification of the terminal device, and the specific confirmation method may be the second authentication of the existing second network, which is not limited.
  • the fourth network element and the terminal device can perform a second authentication based on the second authentication architecture.
  • the second authentication can be GBA conventional authentication or AKMA conventional authentication It may also be an authentication method such as 5G AKA or EAP AKA'. This authentication method is not restricted in the embodiment of this application, and the second authentication is not described here.
  • the fourth request is sent by the third network element, that is, In the second authentication, the third network element participates in the execution of parameter transfer, so that the authentication process between the terminal device of the present application and the fourth network element is different from the existing authentication process.
  • the specific implementation of the fourth network element determining the first authentication vector according to the second authentication vector may be: the fourth network element uses the key derivation function to derive the first authentication vector according to the second authentication vector.
  • Step S605 The fourth network element sends the first authentication vector to the third network element.
  • Step S606 The third network element sends the first authentication vector to the fifth network element.
  • the third network element forwards the first authentication vector of the fourth network element to the fifth network element, and the terminal device realizes the establishment of a connection with the fifth network element through the existing authentication parameters in the fourth network element.
  • Parameter negotiation In the embodiment of the present application, the third network element forwards the first authentication vector of the fourth network element to the fifth network element, and the terminal device realizes the establishment of a connection with the fifth network element through the existing authentication parameters in the fourth network element. Parameter negotiation.
  • Step S607 The fifth network element performs mutual authentication with the terminal device according to the first authentication vector, and determines the first shared key.
  • the first authentication vector may include the first shared key.
  • the fifth network element may also send an authentication instruction to the terminal device.
  • Step S608 The terminal device determines the first shared key according to the first authentication vector.
  • the terminal device may first determine the first authentication vector according to the second authentication vector, and then obtain the first shared key from the first authentication vector.
  • the manner in which the terminal device determines the first authentication vector according to the second authentication vector may adopt the same manner as that of the fourth network element, which is not repeated here.
  • the terminal device and the fifth network element can perform subsequent security procedures and other operations based on the first shared key.
  • the terminal device and the fifth network element may also share the first temporary identifier and the validity period of the first shared key.
  • the validity period of the first temporary identification and the first shared key may be calculated by the fifth network element, and then the fifth network element combines the first temporary identification and the first shared secret. The validity period of the key is sent to the terminal device.
  • the specific implementation for the fifth network element to determine the first temporary identifier may be: the fifth network element receives the second temporary identifier from the third network element; the fifth network element is based on the second temporary identifier The first temporary identifier is obtained by calculation; wherein, the second temporary identifier is a temporary identifier obtained by the terminal device performing second authentication in the fourth network element.
  • the second temporary identification usually includes the second authentication architecture identification, and the fifth network element may replace the second authentication architecture identification in the second temporary identification with the first authentication architecture identification.
  • the specific implementation of determining the first temporary identifier by the fifth network element may also be: the fifth network element receives the first temporary identifier from the third network element; wherein the first temporary identifier is the fourth network element Calculated according to the second temporary identifier; the second temporary identifier is a temporary identifier obtained by the terminal device through authentication in the fourth network element.
  • the second temporary identification usually includes the second authentication architecture identification
  • the fourth network element may replace the second authentication architecture identification in the second temporary identification with the first authentication architecture identification to obtain the first temporary identification, and then the fourth network element The element sends the first temporary identifier to the fifth network element through the third network element.
  • the specific implementation of the fifth network element determining the validity period of the first shared key may be: the fifth network element receives the validity period of the second shared key from the third network element; The validity period of the second shared key is calculated to obtain the validity period of the first shared key. Specifically, the fifth network element may determine the validity period of the first shared key according to the remaining lifetime of the validity period of the second shared key; the fifth network element may also refer to other local policies (such as the validity period of the first shared key) at the same time. No more than 1 hour) to determine the validity period of the first shared key, which is not limited in this application.
  • the specific implementation of determining the validity period of the first shared key by the fifth network element may also be: the fifth network element receives the validity period of the first shared key from the third network element; wherein, the first shared key The validity period of is calculated by the fourth network element according to the validity period of the second shared key. Specifically, the fourth network element may determine the validity period of the first shared key according to the remaining lifetime of the validity period of the second shared key; the fourth network element may also refer to other local policies (such as the validity period of the first shared key) at the same time. No more than 1 hour) to determine the validity period of the first shared key, which is not limited in this application, and then the fourth network element sends the first temporary identifier to the fifth network element through the third network element.
  • the fifth network element calculates the validity period of the first temporary identification and the first shared key, and the terminal device also calculates the validity period of the first temporary identification and the first shared key. Valid period, the fifth network element does not need to send the first temporary identifier and the valid period of the first shared key to the terminal device.
  • the fifth network element may also determine the validity period of the first key and/or the first temporary identifier through a local policy.
  • the specific implementation of the terminal device determining the first temporary identifier may be: the terminal device replaces the second authentication architecture identifier in the second temporary identifier with the first authentication architecture identifier to obtain the first temporary identifier.
  • the specific implementation of the terminal device determining the validity period of the first shared key may be: the terminal device can determine the validity period of the first shared key according to the remaining life cycle of the validity period of the second shared key; the terminal device can also refer to other local policies at the same time (For example, the validity period of the first shared key does not exceed 1 hour) The validity period of the first shared key is determined, which is not limited in this application.
  • the communication method of the embodiment of the present application may include two implementation modes: in the first implementation mode, the third network element is HSS, the fourth network element is SEAF/AUSF/UDM, and the fifth network element is BSF; In the second implementation manner, the third network element is SEAF/AUSF/UDM, the fourth network element is HSS, and the fifth network element is AAuF.
  • the third network element is HSS
  • the fourth network element is SEAF/AUSF/UDM
  • the fifth network element is BSF as an example to illustrate the process of obtaining GBA AV based on AKMA AV.
  • the first authentication vector is GBA AV
  • the first temporary identifier is B-TID
  • the first shared key is Ks
  • the validity period of the first shared key is key lifetime1
  • the second authentication vector is AKMA AV
  • the second temporary identifier is Temporary ID
  • the second shared key is Kakma
  • the validity period of the second shared key is key lifetime2.
  • the method may include:
  • the third request includes a SEAF/AUSF/UDM identifier and an identifier used to identify the terminal device.
  • Step S6011 The terminal device sends a third request to the BSF; where the third request includes an identifier for the terminal device.
  • the third request may include the permanent identity of the terminal device, or the packaging identity of the permanent identity of the terminal device.
  • AKMA authentication indicator AKMA indicator which is used to indicate that the third request is related to AKM A.
  • Step S6021 The BSF sends the third request to the HSS.
  • the BSF needs to communicate with SEAF/AUSF/UDM through the HSS.
  • the third request may also include the BSF domain name.
  • the third request includes an AKMA indicator, it is determined to be related to AKMA.
  • Step S6031 The HSS sends a fourth request to SEAF/AUSF/UDM according to the third request; wherein, the fourth request includes the identification of the terminal device.
  • the identification of SEAF/AUSF/UDM may be received from the BSF or determined according to the identification of the terminal device.
  • the specific determination method is the prior art, which is not limited in the embodiment of the present application.
  • the fourth network element may be SEAF or AUSF or UDM, so the HSS may send the fourth request to SEAF/AUSF/UDM corresponding to the SEAF/AUSF/UDM identifier.
  • Step S6041 SEAF/AUSF/UDM determines AKMA AV according to the identifier of the terminal device; determines GBA AV according to the AKMA AV.
  • 5G UDM can generate three authentication vectors: 5G AKA vector (CK', IK', RAND, AUTN, XRES), EAP AKA' authentication vector (Kausf, RAND, AUTN, XRES) ), AKMA certification vector (Kakma, RAND, AUTN, XRES).
  • UDM determines the GBA authentication vector GBA AV (Ks, RAND, AUTN, XRES) according to at least one of the above three authentication vectors.
  • the generation of Ks can be based on CK', IK' or Kausf or Kakma.
  • the generation of Ks may also include at least one of the following parameters: BSF domain name, an indication of the interconnection between AKMA and GBA (optional, it can also be received AKMA indicator), fresh parameter 2, the identification of the terminal device and the identification of the second authentication architecture.
  • BSF domain name can be sent from the HSS to UDM, or UDM can determine the BSF domain name according to its interface connection with the HSS.
  • Ks can also be CK, and IK.
  • the current 5G AUSF can have three authentication vectors: 5G AKA vector (Kausf, RAND, AUTN, XRES), EAP AKA' authentication vector (Kausf, RAND, AUTN, XRES), AKMA authentication vector (Kakma, RAND, AUTN, XRES).
  • UDM determines the GBA authentication vector (Ks, RAND, AUTN, XRES) according to at least one of the above three authentication vectors, and generates Ks based on Kausf.
  • Ks can also be CK, and IK.
  • the current 5G SEAF can have three authentication vectors: 5G AKA vector (Kseaf, RAND, AUTN, XRES), EAP AKA' authentication vector (Kseaf, RAND, AUTN, XRES), AKMA authentication vector (Kseaf, RAND, AUTN, XRES).
  • UDM determines the GBA authentication vector (Ks, RAND, AUTN, XRES) according to at least one of the above three authentication vectors, and generates Ks based on Kseaf.
  • Ks can also be CK, and IK.
  • SEAF/AUSF/UDM can also determine keylifetime1 according to keylifetime2.
  • the life cycle of key lifetime1 can be determined according to the remaining life cycle of keylifetime2; in addition, the validity period of keylifetime1 can also be determined by referring to other local policies (for example, keylifetime1 does not exceed 1 hour).
  • SEAF/AUSF/UDM can perform AKMA mutual authentication with the terminal device in real time in response to the second request, so that the SEAF/AUSF/UDM shares AKMA AV, temporary ID, Kakma, and key lifetime2 with the UE.
  • SEAF /AUSF/UDM can be based on the above-mentioned AKMA architecture, through AAuF and terminal equipment to perform AKMA two-way authentication, I will not repeat it here; then SEAF/AUSF/UDM can perform the process of determining GBA AV in the first application scenario , I won’t repeat it here.
  • the process of determining key lifetime 1 based on key lifetime 2 can also be implemented by BSF, and SEAF/AUSF/UDM can send key lifetime 2 to BSF.
  • AKMA AV can also be implemented by HSS, and SEAF/AUSF/UDM can send AKMA A to HSS.
  • Step S6051 SEAF/AUSF/UDM sends the GBA AV to the HSS.
  • SEAF/AUSF/UDM can send GBA AV to HSS, and possibly Temporary ID and/or key lifetime1.
  • the SEAF/AUSF/UDM may also send an authentication indicator (indicator) to the HSS.
  • the authentication indicator may indicate which authentication vector is used to generate the GBA authentication parameter, or indicate the GBA authentication parameter determined based on the AKMA mechanism.
  • SEAF/AUSF/UDM may also send freshness parameter 2 to the HSS to ensure the freshness of key derivation.
  • Freshness parameter 2 may be a counter, random number, nonce, etc.
  • Step S6061 The HSS sends the GBA AV to the BSF.
  • the HSS may also send an authentication indication indicator to the BSF.
  • Step S6071 The BSF performs mutual authentication with the terminal device according to the GBA AV and determines Ks.
  • the BSF may also send an authentication indicator to the terminal device.
  • Step S6081 The terminal device determines Ks according to the GBA AV.
  • the terminal device can determine which authentication vector is used to generate the authentication parameters according to the authentication indicator, or determine the GBA authentication parameters determined based on the AKMA mechanism according to the authentication indicator, and generate Ks in the same way as SEAF or AUSF or UDM. .
  • the BSF may also send the B-TID and Keylifetime1 to the terminal equipment UE.
  • the UE can also determine the B-TID and Keylifetime1 by itself.
  • the fifth network element may not receive the B-TID and Keylifetime1 from the third network element or the fourth network element, and the fifth network element may determine the fifth network element by itself according to the local policy.
  • the UE and the BSF have completed the sharing of Ks, B-TID, and Keylifetime1, and the subsequent UE and AF can perform key distribution processes based on Ks, B-TID, and Keylifetime1, which are not described in detail in the embodiment of this application.
  • the third network element is SEAF/AUSF/UDM
  • the fourth network element is HSS
  • the fifth network element is AAuF as an example to illustrate the process of obtaining KMA AV based on GBA AVA.
  • the embodiment corresponding to FIG. 14 the third network element is SEAF/AUSF/UDM
  • the fourth network element is HSS
  • the fifth network element is AAuF as an example to illustrate the process of obtaining KMA AV based on GBA AVA.
  • the first authentication vector is AKMA AV
  • the first temporary identifier is Temporary ID
  • the first shared key is Kakma
  • the validity period of the first shared key is key lifetime1
  • the second authentication vector is GBA AV
  • the second temporary identifier is B-TID
  • the second shared key is Ks
  • the validity period of the second shared key is keylifetime2.
  • the method may include:
  • Step S6012 The terminal device sends a third request to AAuF; wherein, the third request includes the identification of the terminal device.
  • Step S6022 AAuF sends the third request to SEAF/AUSF/UDM.
  • Step S6032 SEAF/AUSF/UDM sends a fourth request to the HSS according to the third request; wherein, the fourth request includes the identification of the terminal device.
  • SEAF/AUSF/UDM can determine the HSS according to the identification of the terminal device, and the specific determination method is not limited by the existing technology.
  • Step S6042 The HSS determines the GBA AV according to the identifier of the terminal device; and determines the AKMA AV according to the GBA AV.
  • Step S6052 HSS sends the AKMA AV to SEAF/AUSF/UDM.
  • Step S6062 SEAF/AUSF/UDM sends the AKMA AV to AAuF.
  • Step S6072 AAuF performs mutual authentication with the terminal device according to the AKMA AV, and determines Kakma.
  • Step S6082 The terminal device performs mutual authentication with the terminal device according to the AKMA AV and determines the Kakma.
  • the UE accesses AAuF, and the AAuF accesses the HSS through SEAF/AUSF/UDM, thereby obtaining the authentication vector of AKMA, and when AAuF has an interface with SEAF, SEAF passes AUSF And/or UDM interacts with HSS; when AAuF has an interface with AUSF, AUSF interacts with HSS through UDM, or AUSF directly interacts with HSS; when AAuF has an interface with UDM, UDM directly interacts with HSS.
  • the UE and AAuF have completed the sharing of Kakma, Temporary ID, and Keylifetime1, and subsequent UE and AF can perform key distribution processes based on Kakma, Temporary ID, and Keylifetime1, which are not described in detail in this embodiment of the application.
  • the third network element after the third network element receives the third request including the identification of the terminal device from the fifth network element, the third network element sends the fourth network element that includes the identification of the terminal device to the fourth network element.
  • the fourth network element may determine the first authentication vector according to the second authentication vector in response to the fourth request, and send the first authentication vector to the third network element, and after receiving the first authentication vector in the third network element ,
  • the first authentication based on the first authentication vector can be further implemented through the fifth network element and the terminal device. That is, the fifth network element can implement the first authentication of the terminal device based on the second authentication vector in the fourth network element, so that intercommunication between the first authentication architecture and the second authentication architecture is realized, and communication flexibility is improved.
  • the method may specifically include:
  • Step S701 A third network element receives a third request from a fifth network element; wherein, the third request is sent by a terminal device to the fifth network element; and the third request includes an identifier of the terminal device.
  • Step S702 The third network element sends a fourth request to the fourth network element according to the third request; wherein, the fourth request includes the identification of the terminal device.
  • Step S703 The third network element receives a first authentication vector from the fourth network element; wherein, the first authentication vector is determined by the fourth network element according to the second authentication vector, and the second authentication vector The vector is determined by the fourth network element according to the identification of the terminal device; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the third network element can correspondingly receive the request.
  • the execution principle is similar, and the method in which the third network element is the executor is not repeated here.
  • the third network element after the third network element receives the third request including the identification of the terminal device from the fifth network element, the third network element sends the fourth network element that includes the identification of the terminal device to the fourth network element.
  • the fourth network element may determine the first authentication vector according to the second authentication vector in response to the fourth request, and send the first authentication vector to the third network element, and after receiving the first authentication vector in the third network element ,
  • the first authentication based on the first authentication vector can be further implemented through the fifth network element and the terminal device. That is, the fifth network element can implement the first authentication of the terminal device based on the second authentication vector in the fourth network element, so that intercommunication between the first authentication architecture and the second authentication architecture is realized, and communication flexibility is improved.
  • FIG. 16 shows a schematic diagram of the communication process on the fourth network element side of the eleventh embodiment of the present application.
  • the method may specifically include:
  • Step S801 The fourth network element receives a fourth request from the third network element; the fourth request includes the identification of the terminal device.
  • Step S802 The fourth network element determines a second authentication vector according to the identification of the terminal device.
  • Step S803 The fourth network element determines a first authentication vector according to the second authentication vector.
  • Step S804 The fourth network element sends the first authentication vector to the third network element; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for the second network Security protection.
  • the fourth network element can correspondingly receive the request.
  • the execution principle is similar, and the method in which the fourth network element is the execution subject is not repeated here.
  • the third network element after the third network element receives the third request including the identification of the terminal device from the fifth network element, the third network element sends the fourth network element that includes the identification of the terminal device to the fourth network element.
  • the fourth network element may determine the first authentication vector according to the second authentication vector in response to the fourth request, and send the first authentication vector to the third network element, and after receiving the first authentication vector in the third network element ,
  • the first authentication based on the first authentication vector can be further implemented through the fifth network element and the terminal device. That is, the fifth network element can implement the first authentication of the terminal device based on the second authentication vector in the fourth network element, so that intercommunication between the first authentication architecture and the second authentication architecture is realized, and communication flexibility is improved.
  • the method may specifically include:
  • Step S901 The fifth network element receives a third request from a terminal device; where the third request includes the identification of the terminal device.
  • Step S902 The fifth network element sends a third request to the third network element; the third request is used to instruct the third network element to obtain the first authentication vector from the fourth network element; the first authentication The vector is determined by the fourth network element according to the second authentication vector; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • Step S903 The fifth network element receives the first authentication vector from the fourth network element.
  • the fifth network element can correspondingly receive the request.
  • the execution principle is similar, and the method of the fifth network element as the execution subject will not be repeated here.
  • the third network element after the third network element receives the third request including the identification of the terminal device from the fifth network element, the third network element sends the fourth network element that includes the identification of the terminal device to the fourth network element.
  • the fourth network element may determine the first authentication vector according to the second authentication vector in response to the fourth request, and send the first authentication vector to the third network element, and after receiving the first authentication vector in the third network element ,
  • the first authentication based on the first authentication vector can be further implemented through the fifth network element and the terminal device. That is, the fifth network element can implement the first authentication of the terminal device based on the second authentication vector in the fourth network element, so that intercommunication between the first authentication architecture and the second authentication architecture is realized, and communication flexibility is improved.
  • the method may specifically include:
  • Step S1001 The terminal device sends a third request to the fifth network element; wherein, the third request includes the identification of the terminal device; the third request is used to instruct the fifth network element to send to the third network element The third request and instruct the third network element to obtain the first authentication vector from the fourth network element.
  • Step S1002 The terminal device determines the first authentication vector according to the second authentication vector; the second authentication vector is determined when the terminal device performs the second authentication in the fourth network element; the first authentication The vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the terminal device can receive the request accordingly.
  • the execution principle is similar, and the method in which the terminal device is the execution subject is not repeated here.
  • the third network element after the third network element receives the third request including the identification of the terminal device from the fifth network element, the third network element sends the fourth network element that includes the identification of the terminal device to the fourth network element.
  • the fourth network element may determine the first authentication vector according to the second authentication vector in response to the fourth request, and send the first authentication vector to the third network element, and after receiving the first authentication vector in the third network element ,
  • the first authentication based on the first authentication vector can be further implemented through the fifth network element and the terminal device. That is, the fifth network element can implement the first authentication of the terminal device based on the second authentication vector in the fourth network element, so that intercommunication between the first authentication architecture and the second authentication architecture is realized, and communication flexibility is improved.
  • FIG. 19 is a schematic structural diagram of a first network element according to Embodiment 14 of this application. As shown in FIG. 19, the first network element includes:
  • the request receiving module 11 is configured to receive a first request from a terminal device; wherein the first request includes the identification of the terminal device;
  • the sending module 12 is configured to send a second request to a second network element according to the first request; wherein, the second request includes the identification of the terminal device;
  • the shared key receiving module 13 is configured to receive a first shared key from the second network element; wherein, the first shared key is determined by the second network element according to the second shared key, and The second shared key is determined by the second network element according to the identification of the terminal device; the first shared key is used for security protection in the first network, and the second shared key is used for the second network Security protection.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the first network element further includes:
  • the temporary identification determining module is configured to determine the first temporary identification of the terminal device; the first temporary identification is calculated by the first network element or the second network element according to the identification of the terminal device, so The first temporary identifier is used to identify the temporary identity of the terminal device in the first network;
  • the temporary identifier sending module is configured to send the first temporary identifier to the terminal device.
  • the first network element further includes:
  • the validity period determining module is configured to determine the validity period of the first shared key; wherein, the validity period of the first shared key is the first network element or the second network element according to the second shared key The validity period of the second shared key is determined; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device;
  • the validity period sending module is configured to send the validity period of the first shared key to the terminal device.
  • the second request further includes the first network element identifier of the first network element
  • the first shared key is derived by the second network element according to the second shared key and the first network element identifier.
  • the second shared key is: after the second network element receives the second request, it is obtained by performing second authentication with the terminal device in response to the second request .
  • the first network element in this embodiment can be used to implement the method implemented by the first network element in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 20 is a schematic structural diagram of a second network element according to Embodiment 15 of this application. As shown in FIG. 20, the second network element includes:
  • the request receiving module 21 is configured to receive a second request from the first network element; the second request includes the identification of the terminal device; the second shared key determining module 22 is configured to determine the second shared key according to the identification of the terminal device Key; a first shared key determining module 23, configured to determine a first shared key according to the second shared key; a first shared key sending module 24, configured to send the first network element A first shared key; wherein the first shared key is used for security protection in a first network, and the second shared key is used for security protection in a second network.
  • the second shared key determination module is further configured to:
  • the second shared key corresponding to the identification of the terminal device is determined.
  • the second shared key determination module is further configured to:
  • the second network element further includes a second validity period determining module, configured to:
  • the validity period of the second shared key is determined according to the identification of the terminal device; the validity period of the second shared key is sent to the first network element; or the second shared key is determined according to the identification of the terminal device.
  • the validity period of the shared key determine the validity period of the first shared key according to the validity period of the second shared key; send the validity period of the first shared key to the first network element.
  • the second network element further includes a temporary identification determining module, configured to:
  • Temporary identity in the network or, determine the second temporary identity of the terminal device according to the identity of the terminal device; determine the first temporary identity according to the second temporary identity; send the first temporary identity to the first network element The first temporary identifier; the first temporary identifier is used to identify the temporary identity of the terminal device in the first network.
  • the second request further includes the first network element identification of the first network element; the first shared key is the second network element according to the second shared key Derived from the first network element identifier.
  • the second network element in this embodiment can be used to implement the method implemented by the second network element in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 21 is a schematic structural diagram of a terminal device according to Embodiment 16 of this application. As shown in FIG. 21, the terminal device includes:
  • the request sending module 31 is configured to send a first request to a first network element; wherein, the first request includes the identification of the terminal device; the first request is used to instruct the first network element to access the second network Yuan obtains the first shared key;
  • the shared key determining module 32 is used for the terminal device to determine the first shared key according to the second shared key; the second shared key is for the terminal device to perform second authentication in the second network element Time determined; the first shared key is used for security protection in the first network, and the second shared key is used for security protection in the second network.
  • the first request further includes first indication information, and the first indication information is used to instruct the first network element to obtain information from the first network from the second network.
  • the first shared key is used to instruct the first network element to obtain information from the first network from the second network.
  • the terminal device further includes a temporary identification determining module, configured to:
  • a first temporary identifier is received from the first network element; the first temporary identifier is calculated by the first network element or the second network element according to the identifier of the terminal device; the first temporary identifier is used for Identify the temporary identity of the terminal device in the first network; or determine the first temporary identity according to the second temporary identity; the second temporary identity is used to identify the terminal device’s temporary identity in the second network Temporary status.
  • the terminal device further includes a validity period determining module, configured to:
  • the validity period of the first shared key is received from the first network element; wherein, the validity period of the first shared key is the first network element or the second network element according to the second shared secret
  • the validity period of the key is determined; the validity period of the second shared key is determined by the second network element according to the identification of the terminal device; or, the validity period of the first shared key is determined according to the validity period of the second shared key
  • the validity period of the second shared key is determined when the terminal device performs second authentication in the second network element.
  • the terminal device of this embodiment can be used to execute the method implemented by the terminal device in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 22 is a schematic structural diagram of a third network element according to Embodiment 17 of this application. As shown in FIG. 22, the third network element includes:
  • the request receiving module 41 is configured to receive a third request from a fifth network element; wherein, the third request is sent by a terminal device to the fifth network element; the third request includes an identifier of the terminal device;
  • the request sending module 42 is configured to send a fourth request to a fourth network element according to the third request; wherein, the fourth request includes the identification of the terminal device;
  • the authentication vector receiving module 43 is configured to receive a first authentication vector from the fourth network element; wherein, the first authentication vector is determined by the fourth network element according to the second authentication vector, and the second authentication vector It is determined by the fourth network element according to the identification of the terminal device; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the third network element in this embodiment can be used to implement the method implemented by the third network element in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 23 is a schematic structural diagram of a fourth network element according to Embodiment 18 of this application. As shown in FIG. 23, the fourth network element includes:
  • the request receiving module 51 is configured to receive a fourth request from the third network element by the fourth network element; the fourth request includes the identification of the terminal device;
  • the second authentication vector determining module 52 is configured to determine the second authentication vector according to the identification of the terminal device
  • the first authentication vector determining module 53 is configured to determine the first authentication vector according to the second authentication vector
  • the first authentication vector sending module 54 is configured to send the first authentication vector to the third network element; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for the second Security protection in the network.
  • the fourth network element in this embodiment can be used to implement the method implemented by the fourth network element in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 24 is a schematic structural diagram of a fifth network element according to Embodiment 19 of this application. As shown in FIG. 24, the fifth network element includes:
  • the request receiving module 61 is configured to receive a third request from a terminal device; wherein the third request includes the identification of the terminal device;
  • the request sending module 62 is configured to send a third request to a third network element; the third request is used to instruct the third network element to obtain a first authentication vector from a fourth network element; the first authentication vector is The fourth network element is determined according to a second authentication vector; the first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network;
  • the authentication vector receiving module 63 is configured to receive the first authentication vector from the fourth network element by the fifth network element.
  • the fifth network element in this embodiment can be used to implement the implementation method described by the fifth network element in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 25 is a schematic structural diagram of a terminal device according to Embodiment 20 of this application. As shown in FIG. 25, the terminal device includes:
  • the request sending module 71 is configured to send a third request to the fifth network element; wherein, the third request includes the identification of the terminal device; the third request is used to instruct the fifth network element to send a third network element Sending the third request and instructing the third network element to obtain the first authentication vector from the fourth network element;
  • An authentication vector determining module 72 configured for the terminal device to determine a first authentication vector according to a second authentication vector; the second authentication vector is determined when the terminal device performs second authentication in the fourth network element; The first authentication vector is used for security protection in the first network, and the second authentication vector is used for security protection in the second network.
  • the terminal device of this embodiment can be used to execute the method implemented by the terminal device in the foregoing embodiment.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 26 is a schematic structural diagram of a first network element provided by Embodiment 21 of this application.
  • the first network element 800 includes a processor 81, a memory 82, and a transceiver 83.
  • the memory 82 uses To store instructions, the transceiver 83 is used to communicate with other devices, and the processor 81 is used to execute the instructions stored in the memory, so that the first network element 800 executes the first The method performed by the network element.
  • FIG. 27 is a schematic structural diagram of a second network element according to Embodiment 22 of this application.
  • the second network element 900 includes a processor 91, a memory 92, and a transceiver 93.
  • the memory 92 is used for In order to store instructions, the transceiver 93 is used to communicate with other devices, and the processor 91 is used to execute the instructions stored in the memory, so that the second network element 900 executes the second The method performed by the network element.
  • FIG. 28 is a schematic structural diagram of a UE provided by Embodiment 23 of this application.
  • the UE 1000 includes: a processor 101, a memory 102, and a transceiver 103.
  • the memory 102 is used to store instructions.
  • the transceiver 103 is used to communicate with other devices, and the processor 101 is used to execute instructions stored in the memory, so that the UE 1000 executes the method performed by the UE in the foregoing method embodiment.
  • the embodiments of the present application also provide a storage medium, where the storage medium is used to store a computer program, and the computer program is used to implement the communication method described in the foregoing embodiment.
  • the processor in the embodiment of the present application may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other Programming logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination for realizing computing functions, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the bus described in the embodiments of the present application may be an Industry Standard Architecture (ISA) bus, Peripheral Component (PCI) bus, or Extended Industry Standard Architecture (EISA) bus, etc. .
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into address bus, data bus, control bus, etc.
  • the buses in the drawings of this application are not limited to only one bus or one type of bus.
  • the disclosed device and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.
  • the above-mentioned integrated unit implemented in the form of a software functional unit may be stored in a computer readable storage medium.
  • the above-mentioned software functional unit is stored in a storage medium and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor execute the method described in the various embodiments of the present application. Part of the steps.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种通信方法和装置，该方法包括：第一网元从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一网元根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识；所述第一网元从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。本申请实施例第一认证架构和第二认证架构可以实现互通，提升了通信灵活性。

Description

通信方法和装置
本申请要求于2019年04月29日提交中国专利局、申请号为201910356343.4、申请名称为“通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法和装置。
背景技术
随着通信技术的发展，通信过程中对网络业务的可靠性要求越来越高，因此在运营商和用户通常需要通过认证机制来保证网络业务的可靠性。认证机制具体可以是，在用户终端(User Equipment，UE)与应用服务器之间通过密钥等实现双向认证。
目前在UE与应用服务器之间实现认证的方式有：基于通用引导架构(Generic Bootstrapping Architecture，GBA)实现认证的方式，可以适用于第三代移动通信(3fifth-generation，3G)和第四代移动通信(4fifth-generation，4G)；随着第五代移动通信(5fifth-generation，5G)的发展，适用于5G系统的认证也处于研究探索阶段，例如，基于针对应用的认证和密钥管理(Authentication and Key Management for Applications，AKMA)架构实现安全认证的方式。
但是，目前的基于GBA的认证系统与基于AKMA的认证系统之间相互独立，无法互通，导致认证的灵活性较差。
发明内容
本申请提供一种通信方法和装置，使得两种认证架构系统之间可以实现互通，从而可以提高认证灵活性。
第一方面，本申请提供一种通信方法，包括：
第一网元从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一网元根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识；所述第一网元从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
在上述过程中，第一网元与第二网元可以实现互通，具体来说，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述第一网元根据所述第一请求向第二网元发送第二请求之后，还包括：所述第一网元确定所述终端设备的第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据所述终端设备的标识计算得到的，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；所述第一网元向所述终端设备发送所述第一临时标识。
一种示例性的方式中，所述第一网元根据所述第一请求向第二网元发送第二请求之后，还包括：所述第一网元确定所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；所述第一网元向所述终端设备发送所述第一共享密钥的有效期。
一种示例性的方式中，所述第二请求还包括第一网元的第一网元标识；所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
一种示例性的方式中，所述第二共享密钥为：所述第二网元接收到所述第二请求后，响应于所述第二请求与所述终端设备进行第二认证得到的。
第二方面，本申请提供一种通信方法，该方法包括：第二网元从第一网元接收第二请求；所述第二请求包括终端设备的标识；所述第二网元根据所述终端设备的标识确定第二共享密钥；所述第二网元根据所述第二共享密钥确定第一共享密钥；所述第二网元向所述第一网元发送所述第一共享密钥；其中，所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第二网元根据所述终端设备的标识确定第二共享密钥，包括：所述第二网元根据所述终端设备的标识，以及预先获取的终端标识与所述第二网络中的共享密钥的映射关系，确定所述终端设备的标识对应的第二共享密钥。
一种示例性的方式中，所述第二网元根据所述终端设备的标识确定第二共享密钥，包括：所述第二网元响应于所述第二请求，与所述终端设备进行第二认证，得到所述第二共享密钥。
一种示例性的方式中，所述第二网元从第一网元接收第二请求之后，还包括：所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第二网元向所述第一网元发送所述第二共享密钥的有效期；或，所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第二网元根据所述第二共享密钥的有效期确定所述第一共享密钥的有效期；所述第二网元向所述第一网元发送所述第一共享密钥的有效期。
一种示例性的方式中，第二网元从第一网元接收第二请求之后，还包括：所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元向所述第一网元发送所述第二临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份；或，所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元根据所述第二临时标识确定第一临时标识；所述第二网元向所述第一网元发送所述第一临时标识；所述第一临时标识用于标识所述终 端设备在所述第一网络中的临时身份。
一种示例性的方式中，所述第二请求还包括所述第一网元的第一网元标识；所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
第三方面，本申请提供一种通信方法，该方法包括：
终端设备向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一请求用于指示所述第一网元从第二网元获取第一共享密钥；所述终端设备根据第二共享密钥确定所述第一共享密钥；所述第二共享密钥为所述终端设备在所述第二网元中进行第二认证时确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述终端设备根据第二共享密钥确定第一共享密钥之前，还包括：所述终端设备从所述第一网元接收第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据终端设备的标识计算得到的；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；或，所述终端设备根据第二临时标识确定第一临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份。
一种示例性的方式中，所述终端设备向第一网元发送第一请求之后，还包括：
所述终端设备从所述第一网元接收所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；或，所述终端设备根据第二共享密钥的有效期确定第一共享密钥的有效期；所述第二共享密钥的有效期为所述终端设备在所述第二网元中进行第二认证时确定的。
第四方面，本申请提供一种通信方法，该方法包括：第三网元从第五网元接收第三请求；其中，所述第三请求为终端设备向所述第五网元发送的；所述第三请求包括所述终端设备的标识；所述第三网元根据所述第三请求向第四网元发送第四请求；其中，所述第四请求包括所述终端设备的标识；所述第三网元从所述第四网元接收第一认证向量；其中，所述第一认证向量为所述第四网元根据第二认证向量确定的，所述第二认证向量为所述第四网元根据所述终端设备的标识确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
第五方面，本申请提供一种通信方法，该方法包括：第四网元从第三网元接收第四请求；所述第四请求包括终端设备的标识；所述第四网元根据所述终端设备的标识确定第二认证向量；所述第四网元根据所述第二认证向量确定第一认证向量；所述第四网元向所述第三网元发送所述第一认证向量；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
第六方面，本申请提供一种通信方法，该方法包括：第五网元从终端设备接收第三请求；其中，所述第三请求包括所述终端设备的标识；所述第五网元向第三网元发送第三请求；所述第三请求用于指示所述第三网元从第四网元中获取第一认证向量；所述第一认证向量为所述第四网元根据第二认证向量确定的；所述第一认证向量用于 第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护；所述第五网元从所述第四网元接收所述第一认证向量。
第七方面，本申请提供一种通信方法，该方法包括：终端设备向第五网元发送第三请求；其中，所述第三请求包括所述终端设备的标识；所述第三请求用于指示所述第五网元向第三网元发送所述第三请求，以及指示所述第三网元从第四网元中获取第一认证向量；所述终端设备根据第二认证向量确定第一认证向量；所述第二认证向量为所述终端设备在所述第四网元中进行第二认证时确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
第八方面，本申请提供一种第一网元，包括：请求接收模块，用于从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识；发送模块，用于根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识；共享密钥接收模块，用于从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述第一网元还包括：临时标识确定模块，用于确定所述终端设备的第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据所述终端设备的标识计算得到的，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；临时标识发送模块，用于向所述终端设备发送所述第一临时标识。
一种示例性的方式中，所述第一网元还包括：有效期确定模块，用于确定所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；有效期发送模块，用于向所述终端设备发送所述第一共享密钥的有效期。
一种示例性的方式中，所述第二请求还包括第一网元的第一网元标识；所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
一种示例性的方式中，所述第二共享密钥为：所述第二网元接收到所述第二请求后，响应于所述第二请求与所述终端设备进行第二认证得到的。
第九方面，本申请提供一种第二网元，该第二网元包括：
请求接收模块，用于从第一网元接收第二请求；所述第二请求包括终端设备的标识；第二共享密钥确定模块，用于根据所述终端设备的标识确定第二共享密钥；第一共享密钥确定模块，用于根据所述第二共享密钥确定第一共享密钥；第一共享密钥发送模块，用于向所述第一网元发送所述第一共享密钥；其中，所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第二共享密钥确定模块还用于：根据所述终端设备的标识，以及预先获取的终端标识与所述第二网络中的共享密钥的映射关系，确定所述终端设备的标识对应的第二共享密钥。
一种示例性的方式中，所述第二共享密钥确定模块还用于：响应于所述第二请求，与所述终端设备进行第二认证，得到所述第二共享密钥。
一种示例性的方式中，所述第二网元还包括第二有效期确定模块，用于：根据所述终端设备的标识确定所述第二共享密钥的有效期；向所述第一网元发送所述第二共享密钥的有效期；或，根据所述终端设备的标识确定所述第二共享密钥的有效期；根据所述第二共享密钥的有效期确定所述第一共享密钥的有效期；向所述第一网元发送所述第一共享密钥的有效期。
一种示例性的方式中，所述第二网元还包括临时标识确定模块，用于：根据所述终端设备的标识确定所述终端设备的第二临时标识；向所述第一网元发送所述第二临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份；或，根据所述终端设备的标识确定所述终端设备的第二临时标识；根据所述第二临时标识确定第一临时标识；向所述第一网元发送所述第一临时标识；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份。
一种示例性的方式中，所述第二请求还包括所述第一网元的第一网元标识；所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
第十方面，本申请提供一种终端设备，该终端设备包括：请求发送模块，用于向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一请求用于指示所述第一网元从第二网元获取第一共享密钥；共享密钥确定模块，用于终端设备根据第二共享密钥确定所述第一共享密钥；所述第二共享密钥为所述终端设备在所述第二网元中进行第二认证时确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述终端设备还包括临时标识确定模块，用于：
从所述第一网元接收第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据终端设备的标识计算得到的；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；或，根据第二临时标识确定第一临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份。
一种示例性的方式中，所述终端设备还包括有效期确定模块，用于：从所述第一网元接收所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；或，根据第二共享密钥的有效期确定第一共享密钥的有效期；所述第二共享密钥的有效期为所述终端设备在所述第二网元中进行第二认证时确定的。
第十一方面，本申请提供一种第三网元，该第三网元包括：
请求接收模块，用于从第五网元接收第三请求；其中，所述第三请求为终端设备向所述第五网元发送的；所述第三请求包括所述终端设备的标识；请求发送模块，用于根据所述第三请求向第四网元发送第四请求；其中，所述第四请求包括所述终端设备的标识；认证向量接收模块，用于从所述第四网元接收第一认证向量；其中，所述 第一认证向量为所述第四网元根据第二认证向量确定的，所述第二认证向量为所述第四网元根据所述终端设备的标识确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
第十二方面，本申请提供一种第四网元，该第四网元包括：
请求接收模块，用于第四网元从第三网元接收第四请求；所述第四请求包括终端设备的标识；第二认证向量确定模块，用于根据所述终端设备的标识确定第二认证向量；第一认证向量确定模块，用于根据所述第二认证向量确定第一认证向量；第一认证向量发送模块，用于向所述第三网元发送所述第一认证向量；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
第十三方面，本申请提供一种第五网元，该第五网元包括：
请求接收模块，用于从终端设备接收第三请求；其中，所述第三请求包括所述终端设备的标识；请求发送模块，用于向第三网元发送第三请求；所述第三请求用于指示所述第三网元从第四网元中获取第一认证向量；所述第一认证向量为所述第四网元根据第二认证向量确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护；认证向量接收模块，用于所述第五网元从所述第四网元接收所述第一认证向量。
第十四方面，本申请提供一种终端设备，该终端设备包括：
请求发送模块，用于向第五网元发送第三请求；其中，所述第三请求包括所述终端设备的标识；所述第三请求用于指示所述第五网元向第三网元发送所述第三请求，以及指示所述第三网元从第四网元中获取第一认证向量；认证向量确定模块，用于所述终端设备根据第二认证向量确定第一认证向量；所述第二认证向量为所述终端设备在所述第四网元中进行第二认证时确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本申请第十五方面提供一种第一网元，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如本申请第一方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第十六方面提供一种第二网元，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如本申请第二方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第十七方面提供一种终端设备UE，其特征在于，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述UE执行如本申请第三方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第十八方面提供一种第三网元，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如本申请第四方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第十九方面提供一种第四网元，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如本申请第五方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十方面提供一种第五网元，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如本申请第六方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十一方面提供一种终端设备UE，其特征在于，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述UE执行如本申请第七方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十二方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第一方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十三方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第二方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十四方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第三方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十五方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第四方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十六方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第五方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十七方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第六方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十八方面提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被执行时，使得计算机执行如本申请第七方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第二十九方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第一方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第二方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十一方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第三方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十二方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第四方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十三方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第五方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十四方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第六方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十五方面提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令被执行时，使得计算机执行如本申请第七方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十六方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于第一网元，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述第一网元可执行如本申请第一方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十七方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于第二网元，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述第二网元可执行如本申请第二方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十八方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于终端设备，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述终端设备可执行如本申请第三方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第三十九方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于第三网元，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述第三网元可执行如本申请第四方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第四十方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于第四网元，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述第四网元可执行如本申请第五方面以 及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第四十一方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于第五网元，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述第五网元可执行如本申请第六方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请第四十二方面提供一种芯片上系统或系统芯片，所述芯片上系统或系统芯片可应用于终端设备，所述芯片上系统或系统芯片包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器通过执行所述存储器中存储的指令，使得所述终端设备可执行如本申请第七方面以及各方面的示例性方式所提供的方法中的任一所述方法。
本申请实施例提供的通信方法和装置，第一网元与第二网元可以实现互通，具体来说，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
附图说明
图1为本申请实施例提供的一种通信系统的架构图；
图2为本申请实施例提供的GBA架构图；
图3为本申请实施例提供的第一种AKMA架构图；
图4为本申请实施例提供的第二种AKMA架构图；
图5为本申请实施例提供的第三种AKMA架构图；
图6为本申请实施例一提供的一种通信方法流程示意图；
图7为本申请实施例二提供的一种通信方法具体流程示意图；
图8为本申请实施例三提供的一种通信方法另一具体流程示意图；
图9为本申请实施例四提供的一种通信方法第一网元侧的流程示意图；
图10为本申请实施五例提供的一种通信方法第二网元侧的流程示意图；
图11为本申请实施例六提供的一种通信方法终端设备侧的流程示意图；
图12为本申请实施例七提供的另一种通信方法流程示意图；
图13为本申请实施例八提供的另一种通信方法具体流程示意图；
图14为本申请实施例九提供的另一种通信方法另一具体流程示意图；
图15为本申请实施例十提供的另一种通信方法第三网元侧的流程示意图；
图16为本申请实施例十一提供的另一种通信方法第四网元侧的流程示意图；
图17为本申请实施例十二提供的另一种通信方法第五网元侧的流程示意图；
图18为本申请实施例十三提供的另一种通信方法终端设备侧的流程示意图；
图19为本申请实施例十四提供的一种第一网元的结构示意图；
图20为本申请实施例十五提供的一种第二网元的结构示意图；
图21为本申请实施例十六提供的一种终端设备的结构示意图；
图22为本申请实施例十七提供的一种第三网元的结构示意图；
图23为本申请实施例十八提供的一种第四网元的结构示意图；
图24为本申请实施例十九提供的一种第五网元的结构示意图；
图25为本申请实施例二十提供的一种终端设备的结构示意图；
图26为本申请实施例二十一提供的第一网元的结构示意图；
图27为本申请实施例二十二提供的第二网元的结构示意图；
图28为本申请实施例二十三提供的UE的结构示意图。
具体实施方式
首先，对本申请实施例所涉及的通信场景和部分词汇进行解释说明。
本申请实施例所示的技术方案可以应用于基于GBA进行认证的系统与基于AKMA进行认证的系统之间的互联互通，例如，可以应用于3G系统与5G系统的互联互通，也可以应用于4G系统与5G系统的互联互通；还可以应用于其他基于GBA进行认证的系统与基于AKMA进行认证的系统之间的互联互通，本申请实施例对此不作限定。
图1为本申请实施例提供的通信系统的架构图。如图1所示，本申请实施例的通信系统可以包括，终端设备101、第一网络102和第二网络103。当然，该通信系统中还可以包括多个终端设备101，本申请实施例中对此并不作限制。考虑到每个终端设备101与第一网络102和第二网络103之间进行认证的过程类似，本申请实施例中以任一终端设备101与第一网络102和第二网络103之间进行认证的过程为例进行说明。
本申请实施例中，执行终端设备侧方法的执行主体可以是终端设备，也可以是终端设备中的装置(需要说明的是，在本申请提供的实施例中以终端设备为例进行描述的)。示例性地，终端设备中的装置可以是芯片系统、电路或者模块等，本申请不作限制。
本申请实施例中，执行第一网络侧方法的执行主体可以是第一网络设备，也可以是第一网络设备中的装置。示例性地，第一网络中的装置可以是芯片系统、电路或者模块等，本申请不作限制。
本申请实施例中，执行第二网络侧方法的执行主体可以是第二网络设备，也可以是第二网络设备中的装置。示例性地，第二网络中的装置可以是芯片系统、电路或者模块等，本申请不作限制。
本申请实施例中，在第一网络是基于GBA进行认证的情况下，第二网络可以是基于AKMA进行认证；在第二网络是基于GBA进行认证的情况下，第一网络可以是基于AKMA进行认证；使得第一网络与第二网络是基于不同的认证架构实现认证。
具体的，参照图2，示出了GBA认证的架构图，其中，终端设备为用户设备(user equipment，UE)，引导服务功能(Bootstrapping Server Function，BSF)网元用于与UE交互，执行UE与BSF之间的认证；每个应用都可以对应一个网络侧的应用服务器(Network Application Function，NAF)，NAF可以用于为应用运行提供服务，因此BSF和UE可能与一个或多个NAF进行交互；订阅服务器定位器函数(Subscriber Locator Function，SLF)网元中可以存储有UE与归属用户系统(Home Subscriber System， HSS)网元的映射关系，可以理解，在单个HSS的场景下，可以不设置SLF，在多个HSS场景下，BSF可从SLF处得到UE对应的HSS名称；HSS可以用于存储UE的订阅信息，以及生成认证向量等；BSF与HSS之间有接口Zh，使得BSF可以从HSS获得UE认证相关的参数。
GBA可以用于实现基于密钥协商协议(Authentication and Key Agreement，AKA)的认证，具体过程可以为：UE向BSF发送超文本传输协议(Hyper Text Transport Protocol，HTTP)请求，该请求中携带用户标识(UE ID)；BSF通过Zh接口从HSS中获得该UE的用户根密钥和认证向量(authentication vector，AV)，其中，AV可以包括随机数RAND、认证令牌(Authentication token，AUTN)、加密密钥(Cipher Key，CK)、完整性密钥(Integrity Key，IK)和期望的用户响应(EXpected user RESponse，XRES)；并发送AV给BSF；BSF把RAND和AUTN发送给UE；UE利用RAND生成新的AUTN，并与BSF发送过来的AUTN进行比对，对比的结果一致则成功认证网络；UE还利用AKA算法生成CK、IK和用户响应(user RESponse，RES)；UE发送HTTP请求到BSF，该请求包含摘要AKA响应，该响应使用RES作为验证码；BSF将RES与XRES进行比对，从而对UE进行鉴权；如果RES与XRES相同则鉴权成功，BSF利用CK和IK生成共享密钥Ks，并且生成引导交易标识(Bootstrapping Transaction Identifier，B-TID)，其中，B-TID能够作为临时标识来标识该次认证事件，使得后续NAF可以根据该B-TID值向BSF索取达成的相关密钥Ks_NAF；BSF向UE发送B-TID，以及Ks的有效期(Key lifetime)；在UE中可以根据CK和IK产生Ks，实现UE与BSF的密钥共享；后续在基于GBA的业务访问阶段，UE和BSF可以进一步利用Ks生成认证密钥Ks_NAF，并以Ks_NAF作为UE和NAF之间信息交互的认证密钥。
参照图3，示出了第一种AKMA认证的架构图，其中，AKMA认证功能(AKMA Authentication Function，AAuF)网元，可能与统一的数据管理功能(Unified Data Management，UDM)网元、认证服务器功能(Authentication Server Function，AUSF)网元和安全锚点功能(Security Anchor Functionality，SEAF)网元都有接口，AAuF可以用于从UDM/AUSF/SEAF获得UE认证相关的参数或者认证后的密钥，进而通过与UDM/AUSF/SEAF的交互完成对于UE的认证；每个应用都可以对应一个AKMA应用功能(AKMA Application Function，AApF)网元，AApF可以用于为应用运行提供服务，因此AAuF和UE可能与一个或多个AApF进行交互；UDM可以用于用户的数据管理，具体可以包括生成UE的认证向量，注册，订阅信息管理，群组管理等；AUSF可以用于执行UE的认证流程和密钥推衍功能；SEAF可以用于执行UE的认证流程和密钥推衍功能。
具体应用中，在执行AKMA认证时，可以由UE，AAuF，SEAF/AUSF/UDM作为参与方，实现UE与AAuF之间共享密钥Ks的密钥协商，图3示出了AKMA认证中的第一种可能性，在该第一种可能性中，执行AKMA认证的参与方为：UE，AAuF，AUSF，UDM；图4示出了AKMA认证中的第二种可能性，执行AKMA认证的参与方为：UE，AAuF，UDM；图5示出了AKMA认证中的第三种可能性，执行AKMA认证的参与方为：UE，AAuF，SEAF，AUSF，UDM。
可以理解，因为5G中的AKMA认证目前正处于探索阶段，在此对上述三种AKMA 认证可能性的优劣不做评述，本申请实施例中，以图3对应的第一种可能性的AKMA认证过程为例说明AKMA认证的过程。
基于第一种可能性的AKMA认证架构进行AKMA认证的过程可以是：UE发送认证请求至AMF/SEAF至AAuF(这里假定UE需要通过AMF/SEAF与AAuF发生交互，可以理解，也存在其他可能性，例如UE与AAuF直接交互，或者UE通过其他功能模块与AAuF交互)；AAuF发送认证请求至AUSF/UDM，并获得认证向量AV；UE与AAuF执行基于EAP-AKA’或者5G AKA或者其他新定义的AKMA AKA的认证；具体的，认证过程可以为UE发送请求至AAuF，其中携带UE ID，AAuF发送UEID至AUSF，AUSF再发送UE ID至UDM。AUSF从UDM获得认证向量，其中包括(RAND，AUTN，XRES，CK’，IK‘)或者(RAND，AUTN，XRES，Kausf)，AUSF基于此认证向量，可以通过AAuF完成与UE之间的双向认证。认证成功后AUSF得到的认证向量包括Kakma，则直接向AAuF发送Kakma。或者AUSF基于CK’和IK’，或者Kausf确定Kakma，再发送Kakma至AAuF；之后AAuF通过AMF/SEAF发送认证成功消息至UE，其中该消息包括密钥有效期key lifetime，和临时标识temporary ID。
本申请涉及的终端设备，或者可以称为终端。终端可以是无线终端也可以是有线终端，无线终端可以是指向用户提供语音和/或其他业务数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。无线终端可以经无线接入网(radio access network，RAN)与一个或多个核心网进行通信，无线终端可以是移动终端，如移动电话(或称为“蜂窝”电话)和具有移动终端的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。无线终端也可以称为系统、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、UE，在此不作限定。
本申请所涉及的终端设备可以包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(dentral processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
本申请涉及的第一网络和第二网络中均可以包括接入网(access network，AN)和核心网。可选的，还可以包括数据网络(Data Network，DN)。其中，接入网装置主要用于实现无线物理层功能、资源调度和无线资源管理、无线接入控制以及移动性管理等功能；核心网设备可以包含管理设备和网关设备，管理设备主要用于终端设备的设备注册、安全认证、移动性管理和位置管理等，网关设备主要用于与终端设备间建 立通道，在该通道上转发终端设备和外部数据网络之间的数据包；数据网络可以包含网络设备(如：服务器、路由器等设备)，数据网络主要用于为终端设备提供多种数据业务服务。
该第一网络可以为LTE网络，第二网络可以为NR网络，或者，第一网络为NR网络，第二网络为LTE网络。即本申请实施例的方法适用于LTE网络和NR网络互通的场景，目前LTE网络采用GBA认证方式，NR网络采用AKMA认证方式。
其中，接入网装置可以为基站、发送接收点(transmission reception point，TRP)。其中，基站：又称为无线接入网(radio access network，RAN)设备，是一种将终端接入到无线网络的设备，可以是全球移动通讯(global system of mobile communication，GSM)或码分多址(code division multiple access，CDMA)中的基站(base transceiver station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)中的基站(nodeB，NB)，还可以是长期演进(long term evolution，LTE)中的演进型基站(evolutional node B，eNB或eNodeB)，或者中继站或接入点，本申请在此并不限定。
第一网络中可以包括第一网元，第一网元可以为BSF或者AAuF，用于执行第一认证网络的认证，临时身份生成和分发，密钥的生成和密钥生命周期确定的至少一项。
第二网络中可以包括第二网元，第二网元可以为BSF或者AAuF，用于执行第二认证网络的认证，临时身份生成和分发，密钥的生成和密钥生命周期确定的至少一项。
本申请实施例中涉及的第一共享密钥是终端设备基于第一网络的认证架构进行第一认证所生成，具体应用中，在第一网元和终端设备中共享该第一共享密钥后，终端设备和第一网络可以基于第一共享密钥进行后续UE与AF之间的密钥分发。具体UE与AF之间的密钥分发流程，本申请实施例不做具体描述。
本申请实施例中所涉及的第一共享密钥的有效期代表第一共享密钥的生命周期，超出第一密钥有限期后，第一共享密钥将不能继续使用。
本申请实施例中涉及的第一临时标识是终端设备基于第一网络的认证架构进行第一认证时可以产生的临时身份，具体应用中，可以基于第一临时标识进行第一共享密钥检索。
本申请实施例中涉及的第二共享密钥是终端设备基于第二网络的认证架构进行第二认证所生成的，具体应用中，在第二网元和终端设备中共享该第二共享密钥后，终端设备和第二网络可以基于第二共享密钥进行后续UE与AF之间的密钥分发。具体UE与AF之间的密钥分发流程，本申请实施例不做具体描述。
本申请实施例中所涉及的第二共享密钥的有效期代表第二共享密钥的生命周期，超出第二密钥有限期后，第二共享密钥将不能继续使用。
本申请实施例中涉及的第二临时标识是终端设备基于第二网络的认证架构进行第二认证时可以产生的临时身份，具体应用中，可以基于第二临时标识进行第二共享密钥检索。
本申请实施例所涉及的第一网元、第三网元和第五网元可以工作于第一网络中。
本申请实施例所涉及的第二网元和第四网元可以工作于第二网络中。
下面以具体地实施例对本申请的技术方案以及本申请的技术方案如何解决上述技 术问题进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
参照图6，图6为本申请实施例一的一种通信方法的流程示意图；本申请实施例的方法可以包括：
步骤S201：终端设备向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识。
在本申请实施例中，终端设备的标识可以是终端的用户永久标识(Subscription Permanent Identifier，SUPI)，或者终端的国际移动用户识别码(International Mobile Subscriber Identity，IMSI)，或者终端的IP多媒体私有标识(IP Multimedia Private Identity，IMPI)，或者终端的全球唯一临时标识(Globally Unique Temporary Identifier，GUTI)，或者终端的IP多媒体共有标识(IP Multimedia Public Identity，IMPU)，或者终端的临时移动用户标识符(Temporary Mobile Subscriber Identity，TMSI)(如：系统架构演进临时移动用户标识符(S-TMSI)或者移动管理功能临时移动用户标识符(M-TMSI)或者分组域用户临时标识符(P-TMSI))，或者终端的国际移动台设备标识(International Mobile Station Equipment Identity，IMEI)，或者终端的用户密封标识(Subscription Concealed Identifier，SUCI)等，不予限制。SUCI可以是对SUPI的加密封装。本申请实施例中终端设备的标识也可以为第二临时标识，本申请实施例对终端设备的标识不作限定。
本申请实施例中，第一网元是第一网络中基于第一认证架构进行第一认证的网元，第一认证架构可以是GBA，第一认证架构也可以是AKMA；第一请求用于指示第一网元从第二网元获取第一共享密钥；第二网元是第二网络中基于第二认证架构进行第二认证的网元，第二认证架构可以是GBA，第二认证架构也可以是AKMA；具体应用中，在第一认证架构为GBA的情况下，第一网元为BSF，第二认证架构为AKMA，第二网元为AAuf；在第一认证架构为AKMA的情况下，第一网元为AAuf，第二认证架构为GBA，第二网元为BSF；可以在第一网元和第二网元之间设置接口，通过第一网元和第二网元之间的接口，在第一网元和第二网元之间实现数据传输。
在本申请实施例的一种可选实现方式中，终端设备在第二网元中已有认证，则在终端设备与第二网元中可以共享第二共享密钥、第二临时标识和第二共享密钥的有效期；终端设备通过向第一网元发送第一请求，表明终端设备希望通过在第二网元中已有的认证参数，建立与第一网元的参数协商。
在本申请实施例的另一种可选实现方式中，终端设备在第二网元中没有认证，则在终端设备与第二网元中没有共享的认证参数；终端设备通过向第一网元发送第一请求，表明终端设备希望通过第一网元触发第二网元与终端设备进行第二认证，并在第二网元与终端设备进行第二认证时产生的认证参数，建立与第一网元的参数协商。
可选的，所述第一请求还包括以下至少一种：第一指示信息、完整性保护信息和第一请求的重放标识；所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥，所述完整性保护信息用于校验所述终端设备的合法性；所述第一请求的重放标识用于验证所述第一请求是否为重放消息。
本申请实施例中，第一指示信息可以是与第二网络相关的信息，用于指示第一网 元从第二网络中获取第一网络的第一共享密钥。示例的，第一指示消息可以是GBA indicator或AKMA indicator。
本申请实施例中，完整性保护信息可以是消息验证码(Message Authentication Code，MAC)，MAC可以是基于第二共享密钥(也可以基于第二共享密钥和第一完整性保护信息输入参数)，采用完整性保护算法对整条消息完整性保护计算得到的，第二网元可以根据消息验证码校验该终端设备是否为合法终端，提升通信的安全系数。具体的，完整性保护算法可以为哈希运算，本申请实施例不做具体限制。
本申请实施例中，第一请求的重放标识可以是第一新鲜参数，具体的可以为计数器、随机数等，将第一新鲜参数用于完整性保护信息的输入，可以防止完整性保护信息的重放攻击，提升通信的安全系数。
步骤S202：第一网元根据所述第一请求向第二网元发送第二请求，所述第二请求包括所述终端设备的标识。
本申请实施例中，第一网元可以根据第一请求向第二网元发送包括终端设备的标识的第二请求。具体应用中，第二网元的标识可以为：从终端设备发送的终端设备的第二临时身份确定的，或者从终端设备接收到的第一指示信息确定的。
本申请实施例中，第二请求用于向第二网元请求第一共享密钥。
可选的，所述第二请求还包括以下至少一种：第一网元标识、所述完整性保护信息和所述第一完整性保护信息输入参数；其中，所述第一网元标识用于标识所述第一网元的地址和身份信息。
本申请实施例中，第二网元可以根据第一网元标识确定第一网元的地址和身份信息，后续可以根据第一网元标识与第一网元进行数据传输。
第一网元可以向第二网元转发终端设备发送的包括完整性保护信息和所述第一完整性保护信息输入参数的第二请求，以提升通信的安全系数，在此不做赘述。
步骤S203：第二网元根据所述终端设备的标识确定第二共享密钥，并根据所述第二共享密钥确定第一共享密钥。
在本申请实施例的一种可选实现方式中，终端设备在第二网元中已有认证，则第二网元可以在预制存储空间中匹配所述终端设备的标识对应的第二共享密钥；其中，预制存储空间中存储有终端设备的标识与第二共享密钥的映射关系。
在本申请实施例的另一种可选实现方式中，终端设备在第二网元中没有认证，则第二网元可以响应于该第二请求，与终端设备进行第二认证，得到第二共享密钥。
具体应用中，响应于第二请求，第二网元与终端设备可以进行基于第二认证架构的第二认证，可以理解，该第二认证可以为GBA的常规认证，也可以为AKMA的常规认证，也可以为5G AKA或者EAP AKA’等认证方式，本申请实施例对此认证方式不做限制，在此对第二认证不做赘述。需要说明的是，虽然本申请实施例中，响应于第二请求，第二网元与终端设备之间采用的是常规的第二认证，但是该第二请求是第一网元发送的，即该第二认证是有第一网元参与执行参数传递的，使得本申请的终端设备与第二网元的认证过程不同于现有的认证过程。
具体应用中，第二网元根据第二共享密钥确定第一共享密钥的方式可以是：
第二网元根据第二共享密钥采用密钥推衍函数得到第一共享密钥。具体应用中， 采用密钥推衍函数推衍第一共享密钥时，依据的参数可以包括以下参数的至少一项：第一网元的标识，AKMA与GBA的互联互通的指示，第二新鲜参数，终端设备的标识，第二认证架构的标识。第一网元的标识用于将此密钥与第一网元绑定。AKMA与GBA的互联互通的指示，用于指示密钥用于互通的场景。第二新鲜参数用于确保密钥的新鲜性，可以为计数器，或者随机选择的随机数。终端设备的标识可以为接收到的第二临时标识，或者永久标识；或者根据终端设备的封装标识确定的终端设备的永久标识。第二认证架构标识用于指示密钥与第二认证架构相关。本申请实施例第一网元的标识可以为第一网元发送给第二网元的，也可以第二网元根据其与第一网元的接口连接确定的。第二新鲜参数可以通过第一网元发送给终端设备。
需要说明的是，若第二请求还包括所述消息验证码和所述第一新鲜参数，则第二网元可以根据第二共享密钥和第一新鲜参数，通过消息验证码算法校验接收到的消息验证码是否正确。如果校验正确则继续执行，否则则拒绝第二请求，并可选的，发送拒绝响应消息或拒绝指示至第一网元，以告知第一网元消息校验码校验失败；可选的，第一网元接收到拒绝响应消息或拒绝指示后，发送拒绝响应消息或拒绝指示至终端设备，以告知终端消息校验码校验失败。可以理解，如果终端设备与第二网元之间共享有第一新鲜参数，则终端也可以不发送第一新鲜参数至第一网元，第一网元也不需要发送第一新鲜参数至第二网元。
步骤S204：所述第二网元向所述第一网元发送所述第一共享密钥。
本申请实施例中，第二网元向第一网元发送第一共享密钥，则终端设备实现了通过在第二网元中已有的认证参数，建立与第一网元的参数协商。
可选的，还发送第二新鲜参数。
可选的，还发送AKMA与GBA的互联互通的指示，或者第二认证架构的标识的至少一项。
步骤S205：第一网元发送第一响应消息至终端设备。
本申请实施例中，第一响应消息用于指示第一网元已获取第一共享密钥。
可选的，所述第一响应消息包括第二新鲜参数、AKMA与GBA的互联互通的指示和第二认证架构的标识的至少一项。
可选的，第一响应消息包括：第一临时标识和/或第一共享密钥的有效期。
在本申请实施例一种可选的实现方式中，第一临时标识和/或第一共享密钥的有效期可以由第一网元或第二网元计算得到，然后第一网元将第一临时标识和/或第一共享密钥的有效期发送给终端设备。
具体的，第一网元确定第一临时标识的具体实现可以是：所述第一网元从所述第二网元接收第二临时标识；所述第一网元根据所述第二临时标识计算得到所述第一临时标识；其中，所述第二临时标识为所述终端设备在所述第二网元中进行第二认证得到的临时标识。具体的，第二临时标识通常包括终端设备的临时身份标识和第二网元的第二网元标识。第一网元可以将第二临时标识中的第二网元标识替换为第一网元标识。可选的第二临时标识还包括第二认证架构标识，第一网元可以将第二临时标识中的第二认证架构标识替换为第一认证架构标识或者直接去掉第二认证架构标识。
第一网元确定第一临时标识的具体实现还可以是：所述第一网元从所述第二网元 接收第一临时标识；其中，所述第一临时标识为所述第二网元根据所述第二临时标识计算得到的；具体第二网元确定第一临时标识的方式参加上述描述，然后第二网元将第一临时标识发送给第一网元。
第一网元确定第一共享密钥的有效期的具体实现可以是：所述第一网元从所述第二网元接收所述第二共享密钥的有效期；所述第一网元根据所述第二共享密钥的有效期计算得到所述第一共享密钥的有效期。具体的，第一网元可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；第一网元也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定。
第一网元确定第一共享密钥的有效期的具体实现还可以是：所述第一网元从所述第二网元接收第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第二网元根据所述第二共享密钥的有效期计算得到的。具体的，第二网元可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；第二网元也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定，然后第二网元将第一临时标识发送给第一网元。
在本申请实施例另一种可选的实现方式中，第一网元或第二网元计算得到第一临时标识和/或第一共享密钥的有效期，终端设备也计算得到第一临时标识和/或第一共享密钥的有效期，则第一网元不需要向终端设备发送第一临时标识和/或第一共享密钥的有效期。
终端设备确定第一临时标识的具体实现可以参考上述确定方式。
终端设备确定第一共享密钥的有效期的具体实现可以是：终端设备可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；终端设备也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定。
步骤S206：终端设备根据第二共享密钥确定第一共享密钥。
具体应用中，终端设备根据第二共享密钥确定第一共享密钥的方式可以采用与第二网元相同的方式推衍得到第一共享密钥，在此不再赘述。
可选的，如果终端设备与第二网元共享有第二新鲜参数，第二新鲜参数也可以不在步骤204和205发送。
可选的，若终端设备中缺少任何用于根据第二共享密钥确定第一共享密钥的推衍参数，都可以由第二网元发送给第一网元，第一网元在进一步发送给终端设备。
在终端设备和第一网元中共享了第一共享密钥，以及第一临时标识和/或第一共享密钥的有效期之后，终端设备和第一网元就可以基于该第一共享密钥进行后续的安全流程等操作。
具体应用中，终端设备可以在接收到第一响应消息后，执行步骤S206的流程；终端设备也可以在接收到第一响应消息之前，执行步骤S206的流程；本申请实施例对此不作限定；本申请实施例对终端设备根据第二共享密钥确定第一共享密钥的具体位置也不做限定。
具体应用中，本申请实施例的通信方法可以包括两种实现方式：第一种实现方式 中，第一网元为BSF，第二网元为AAuF；第二种实现方式中，第一网元为AAuF，第二网元为BSF。
参照图7，示出了本申请实施例二的通信方法的第一种实现方式的具体流程示意图。本申请实施例以第一网元为BSF，第二网元为AAuF为例，说明基于AKMA中的第二共享密钥kakma获得GBA中的第一共享密钥ks的流程。在图7对应的实施例中，第一临时标识为B-TID，第一共享密钥为Ks，第一共享密钥的有效期为key lifetime1，第二临时标识为Temporary ID，第二共享密钥为Kakma，第二共享密钥的有效期为key lifetime2。在本申请实施例中，该方法可以包括：
步骤S2011:UE向BSF发送第一请求；其中，所述第一请求包括所述终端设备的标识。
本申请实施例中，可以包括两种应用场景，第一种应用场景中，终端设备在5G网络中执行了AKMA认证，则UE与AAuF共享Kakma、Temporary ID和key lifetime2；第二种应用场景中，终端设备在5G网络中没有执行AKMA认证，则UE与AAuF没有共享Kakma、temporary ID和key lifetime2。
在第一种应用场景中，终端设备的标识可以为临时标识Temporary ID，Temporary ID中既包含AAuF标识也包含终端设备的标识；第一请求中还可以包括终端设备的永久身份标识和作为第一指示信息的AAuF标识，使得BSF可以通过该AAuF标识确定第一请求对应的为AKMA的请求，具体的AAuF标识可以包括：AAuF地址信息AAuF domain name/address，或AKMA认证指示AKMA indicator，用于指示第一请求是基于AKMA已有认证的结果；第一请求中还可以包括终端设备的临时身份标识Temporary ID和AAuF标识；本申请实施例对此不作具体限定。
在第二种应用场景中，第一请求中可以包括终端设备的永久身份标识和AAuF标识，使得BSF可以通过该AAuF标识确定第一请求对应的为AKMA的请求，具体的AAuF标识可以包括：AAuF地址信息AAuF domain name/address。第一请求中还可以包括终端设备的永久身份标识的封装标识和AAuF标识；第一请求中还可以包括终端设备的永久身份标识的封装标识或终端设备的永久身份标识。
可选的，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括：消息验证码MAC，具体的，MAC可以是基于Kakma对整条消息完整性保护计算的，以使AAuF通过校验MAC，确定此消息为合法UE发送来。
可选的，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括：新鲜参数1，用于MAC计算的输入，防止MAC的重放攻击，新鲜参数1可以为计数器，随机数，nonce等。
可选的，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括第一指示信息：AKMA指示(AKMA indicator)，用于指示所述第一请求是与AKMA相关的。
步骤S2021:BSF根据所述第一请求向AAuF发送第二请求，其中所述第二请求包括所述终端设备的标识。
在上述的第一种应用场景中，BSF可以通过Temporary ID和/或AAuF domain name/address，确定具体的AAuF；终端设备的标识可以为Temporary ID，也可以为终 端设备的永久身份标识。也可能，BSF通过终端设备的永久身份标识确定具体的AAuF，例如第一身份标识包括AAuF所在网络的信息。在上述的第二种应用场景中，BSF可以通过AAuF domain name/address确定具体的AAuF；终端设备的标识可以为终端设备的永久身份标识或终端设备的永久身份标识的封装标识。也可能，BSF通过终端设备的永久身份标识或终端设备的永久身份标识的封装标识确定具体的AAuF，例如终端设备的永久身份标识或终端设备的永久身份标识的封装标识包括AAuF所在网络的信息。
若BSF接收到AKMA indicator，BSF确定此请求与AKMA相关。
另外，可选的，BSF也可以通过终端设备的标识，和/或AAuF domain name/address确定此请求与AKMA相关。
可选的，第二请求还可包括BSF标识，和/或，消息验证码MAC，和/或，新鲜参数1。
BSF标识可以是BSF的地址信息BSF domain name等，使得AauF后续能够根据BSF标识与BSF发生交互；MAC可以是基于Kakma对整条消息完整性保护计算的，以使AAuF通过校验MAC，确定此消息为合法UE发送来；新鲜参数1，用于MAC计算的输入，防止MAC的重放攻击，新鲜参数1可以为计数器，随机数，nonce等。
步骤S2031:AAuF根据终端设备的标识确定Kakma；根据Kakma生成Ks，还可以根据key lifetime2确定key lifetime1。
在上述的第一种应用场景中，AAuF中存储有Temporary ID、Kakma和key lifetime2的映射关系，AAuF可以根据Temporary ID确定Kakma和key lifetime2；进而，AAuF根据Kakma推衍得到Ks，推衍Ks的参数除了Kakma之外，还可能包括以下参数的至少一项：BSF domainname，AKMA与GBA的互联互通的指示，新鲜参数2，终端设备的标识，第二认证架构的标识。参照步骤S203的推衍表述，在此不再赘述。这里BSF domain name可以为BSF发送给AAuF，也可以AAuF根据其与BSF的接口连接确定BSF domain name；AAuF根据key lifetime2确定key lifetime1。例如，可以为根据key lifetime2剩余的生命周期，确定key lifetime1的生命周期；另外也可以同时参考其他本地策略(如key lifetime1不超过1个小时)确定key lifetime1的有效期。
需要说明的是，若第二请求还包括所述消息验证码和所述第一新鲜参数，则AAuF可以根据Kakma和第一新鲜参数，通过消息验证码算法校验接收到的消息验证码是否正确。如果校验正确则继续执行，否则则拒绝第二请求，并可选的，发送拒绝响应消息或拒绝指示至BSF，以告知BSF消息校验码校验失败；可选的，BSF接收到拒绝响应消息或拒绝指示后，发送拒绝响应消息或拒绝指示至终端设备，以告知终端消息校验码校验失败。可以理解，如果终端设备与AAuF之间共享有第一新鲜参数，则终端也可以不发送第一新鲜参数至BSF，BSF也不需要发送第一新鲜参数至AAuF。
在上述的第二种应用场景中，终端设备与AAuF没有进行第二认证，则AAuF可以响应于第二请求，实时与终端设备进行AKMA的双向认证，使得AAuF中与UE共享temporary ID、Kakma和key lifetime2，具体的，AAuF可以基于上述的AKMA架构，通过AUSF/UDM与终端设备进行AKMA的双向认证，在此不做赘述；然后AAuF可以执行如第一中应用场景中的确定Ks等的过程，在此不做赘述。
需要说明的是，根据key lifetime2确定key lifetime1的过程也可以由BSF实现，则AAuF可以发送key lifetime2给BSF。
步骤S2041:AAuF向BSF发送Ks，还可以发送Temporary ID和/或key lifetime1。
在上述第一种应用场景和第二种应用场景中，AAuF都可以向BSF发送Ks，还可以发送Temporary ID和/或key lifetime1。
可选的，AAuF向BSF还可以发送新鲜参数2，用于防止重复攻击，新鲜参数2可以为计数器，随机数，nonce等。可选的，AAuF向BSF还可以发送AKMA与GBA的互联互通的指示，或者第二认证架构的标识等。
步骤S2051:BSF根据Temporary ID确定B-TID。
本申请实施例中，B-TID可以为BSF生成的的，也可能为BSF根据接收到temporary ID确定的。示例的，BSF根据Temporary ID确定B-TID的确定方式可以为将temporary ID后面的domain name替换为BSF domain name；使得最终B-TID包括temporary ID中UE的临时身份，以及BSF domain name。
需要说明的是，根据Temporary ID确定B-TID的过程也可以由AAuF实现，则AAuF可以发送B-TID给BSF。
步骤S2061:BSF向UE发送B-TID和key lifetime1。
可选的，BSF还可以向UE发送新鲜参数2、AKMA与GBA的互联互通的指示，和第二认证架构的标识的至少一项。
可选的，UE也可以根据UE中存储的Temporary ID、Kakma和key lifetime2确定B-TID和key lifetime1，则BSF不需要向UE发送B-TID和key lifetime1。
步骤S2071:UE根据Kakma确定Ks。
本申请实施例中，UE根据Kakma确定Ks的方式与AAuF生成Ks的方式相同在此不再赘述。需要说明的是，如果AAuF采用的了新鲜参数2，则UE也会从BSF接收到新鲜参数2。
可选的，如果终端设备与AAuF共享有第二新鲜参数，第二新鲜参数也可以不在上述步骤发送。
可选的，若终端设备中缺少任何用于根据Kakma确定Ks的推衍参数，都可以由AAuF发送给BSF，BSF在进一步发送给UE。
则UE与BSF完成了Ks、B-TID和Key lifetime1的共享，后续UE与AF可以基于Ks、B-TID和Key lifetime1进行密钥分发等流程，本申请实施例不做具体描述。
参照图8，示出了本申请实施例三的通信方法的第二种实现方式的具体流程示意图。本申请实施例以第一网元为AAuF，第二网元为BSF为例，说明基于GBA中的ks获得AKMA中的Kakma的流程。在图8对应的实施例中，第一临时标识为Temporary ID，第一共享密钥为Kakma，第一共享密钥的有效期为key lifetime1，第二临时标识为B-TID，第二共享密钥为Ks，第二共享密钥的有效期为key lifetime2。在本申请实施例中，该方法可以包括：
步骤S2012:UE向AAuF发送第一请求；其中，所述第一请求包括终端设备的标识。
本申请实施例中，可以包括两种应用场景，第一种应用场景中，终端设备在4G 网络中执行了GBA认证，则UE与BSF共享B-TID、Ks和key lifetime2；第二种应用场景中，终端设备在4G网络中没有执行GBA认证，则UE与BSF没有共享B-TID、Ks和key lifetime2。
在第一种应用场景中，终端设备的标识可以为临时标识B-TID，B-TID中既包含BSF标识也包含终端设备的标识；第一请求中还可以包括终端设备的永久身份标识和作为第一指示信息的BSF标识，使得BSF可以通过该BSF标识确定第一请求对应的为GBA的请求，具体的BSF标识可以包括：BSF地址信息BSF domain name/address，用于指示第一请求是基于GBA已有认证的结果；第一请求中还可以包括终端设备的临时身份标识Temporary ID和AAuF标识；本申请实施例对此不作具体限定。
在第二种应用场景中，第一请求中可以包括终端设备的永久身份标识和BSF标识，使得BSF可以通过该BSF标识确定第一请求对应的为GBA的请求，具体的BSF标识可以包括：BSF地址信息BSF domain name/address第一请求中还可以包括终端设备的永久身份标识的封装标识和BSF标识；第一请求中还可以包括终端设备的永久身份标识的封装标识或终端设备的永久身份标识。
可选的，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括：消息验证码MAC，具体的，MAC可以是基于Ks对整条消息完整性保护计算的，以使BSF通过校验MAC，确定此消息为合法UE发送来。
可选的，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括：新鲜参数1，用于MAC计算的输入，防止MAC的重放攻击，新鲜参数1可以为计数器，随机数，nonce等。
可选的两种场景下，在上述第一种应用场景和第二种应用场景中，第一请求中都可以包括第一指示信息：GBA指示(GBA indicator)，用于指示所述第一请求是与AKMA相关的。
步骤S2022:AAuF根据所述BSF标识向BSF发送第二请求，其中所述第二请求包括所述终端设备的标识，第二请求还可包括BSF标识，和/或，消息验证码MAC。
在上述的第一种应用场景中，AAuF可以通过B-TID和/或BSF domain name/address确定具体的BSF；终端设备的标识可以为B-TID，也可以为终端设备的永久身份标识。。也可能，AAuF通过终端设备的永久身份标识确定具体的BSF，例如第一身份标识包括BSF所在网络的信息。
在上述的第二种应用场景中，AAuF可以通过BSF domain name/address，或GBA indicator确定具体的BSF；终端设备的标识可以为终端设备的永久身份标识或终端设备的永久身份标识的封装标识。也可能，AAuF通过终端设备的永久身份标识或终端设备的永久身份标识的封装标识确定具体的BSF，例如终端设备的永久身份标识或终端设备的永久身份标识的封装标识包括BSF所在网络的信息。
若AAuF接收到GBA indicator，AAuF确定此请求与GBA相关。
另外，可选的，AAuF也可以通过终端设备的标识，和/或BSF domain name/address确定此请求与GBA相关。。
可选的，第二请求还可包括AAuF标识，和/或，消息验证码MAC，和/或，新鲜参数1。
AAuF标识可以是AAuF的地址信息AAuF domain name等，使得BSF后续能够根据AAuF标识与AAuF发生交互；MAC可以是基于Ks对整条消息完整性保护计算的，以使BSF通过校验MAC，确定此消息为合法UE发送来；新鲜参数1，用于MAC计算的输入，防止MAC的重放攻击，新鲜参数1可以为计数器，随机数，nonce等。
步骤S2032:BSF根据终端设备的标识确定Ks；根据Ks生成Kakma，还可以根据key lifetime2确定key lifetime1。
在上述的第一种应用场景中，BSF中存储有B-TID、Ks和key lifetime2的映射关系，AAuF可以根据B-TID确定Ks和key lifetime2；进而，BSF根据Ks推衍得到Kakma，推衍Kakma的参数除了Ks之外，还可能包括以下参数的至少一项：AAuF domainname，AKMA与GBA的互联互通的指示，新鲜参数2，终端设备的标识，第二认证架构的标识。参照步骤S203的推衍表述，在此不再赘述。这里AAuF domain name可以为AAuF发送给BSF，也可以BSF根据其与AAuF的接口连接确定AAuF domain name；BSF根据key lifetime2确定key lifetime1。例如，可以为根据key lifetime2剩余的生命周期，确定key lifetime1的生命周期；另外也可以同时参考其他本地策略(如key lifetime1不超过1个小时)确定key lifetime1的有效期。
需要说明的是，若第二请求还包括所述消息验证码和所述第一新鲜参数，则BSF可以根据Ks和第一新鲜参数，通过消息验证码算法校验接收到的消息验证码是否正确。如果校验正确则继续执行，否则则拒绝第二请求，并可选的，发送拒绝响应消息或拒绝指示至AAuF，以告知AAuF消息校验码校验失败；可选的，AAuF接收到拒绝响应消息或拒绝指示后，发送拒绝响应消息或拒绝指示至终端设备，以告知终端消息校验码校验失败。可以理解，如果终端设备与BSF之间共享有第一新鲜参数，则终端也可以不发送第一新鲜参数至AAuF，AAuF也不需要发送第一新鲜参数至BSF。
在上述的第二种应用场景中，终端设备与BSF没有进行第二认证，则BSF可以响应于第二请求，实时与终端设备进行GBA的双向认证，使得BSF中与UE共享B-TID、Ks和key lifetime2，具体的，BSF可以基于上述的GBA架构，通过HSS与终端设备进行GBA的双向认证，在此不做赘述；然后BSF可以执行如第一中应用场景中的确定Kakma等的过程，在此不做赘述。
需要说明的是，根据key lifetime2确定key lifetime1的过程也可以由AAuF实现，则BSF可以发送key lifetime2给AAuF。
步骤S2042:BSF向AAuF发送Kakma，还可以发送B-TID和key lifetime1。
在上述第一种应用场景和第二种应用场景中，BSF都可以向AAuF发送Kakma，还可以发送B-TID和key lifetime1。
可选的，BSF向AAuF还可以发送新鲜参数2，用于防止重复攻击，新鲜参数2可以为计数器，随机数，nonce等。
步骤S2052:AAuF根据B-TID确定Temporary ID。
本申请实施例中，Temporary ID可以为AAuF生成的的，也可能为AAuF根据接收到B-TID确定的。示例的，AAuF根据B-TID确定Temporary ID的确定方式可以为将B-TID后面的domain name替换为AAuF domain name；使得最终Temporary ID包括B-TID中UE的临时身份，以及AAuF domain name。可选的，Temporary ID还可以 包括一个指示，用于指示此temporary ID与AKMA相关。
需要说明的是，根据B-TID确定Temporary ID的过程也可以由BSF实现，则BSF可以发送B-TID给AAuF。
步骤S2062:AAuF向UE发送Temporary ID和key lifetime1。
可选的，AAuF还可以向UE发送新鲜参数2、AKMA与GBA的互联互通的指示，和第二认证架构的标识的至少一项。
可选的，UE也可以根据UE中存储的B-TID、Ks和key lifetime2确定Temporary ID和key lifetime1，则AAuF不需要向UE发送Temporary ID和key lifetime1。
步骤S2072::UE根据Ks确定Kakma。
本申请实施例中，UE根据Ks确定Kakma的方式与BSF生成Kakma的方式相同在此不再赘述。需要说明的是，如果BSF采用的了新鲜参数2，则UE也会从BSF接收到新鲜参数2。
可选的，如果终端设备与BSF共享有第二新鲜参数，第二新鲜参数也可以不在上述步骤发送。
可选的，若终端设备中缺少任何用于根据Ks确定Kakma的推衍参数，都可以由BSF发送给AAuF，AAuF在进一步发送给UE。
在一种可选的实施例方式中，AAuF与SEAF/AUSF/UDM有接口。UE与
SEAF/AUSF/UDM之间共享密钥，称之为第三共享密钥，以及第三共享密钥的标识。第三共享密钥的生成方法为现有技术不做限制，例如AUSF密钥，SEAF密钥，AMF密钥，UDM密钥；对应标识可以为AUSF密钥标识，SEAF密钥标识，AMF密钥标识，UDM密钥标识。SEAF/AUSF/UDM可以基于第三共享密钥推衍得到第二共享密钥；并发送第二共享密钥和第三共享密钥标识至AAUF。之后流程与上述实施例相同，不同点在于AAuF需要传递第三共享密钥标识至UE。以使UE根据第三共享密钥标识确定第三共享密钥，并且根据第三共享密钥确定第二共享密钥。其他UE的流程与上述实施例相似，在此不做赘述。如果UE根据接收到的第三共享密钥标识不能确定第三共享密钥(如，本地未保存第三共享密钥标识)，则拒绝此流程。可选的UE发送错误指示至AAuF，指示为找到第三共享密钥标识对应上下文。这里SEAF/AUSF/UDM代表或的关系。
则UE与AAuF完成了Kakma、Temporary ID和Key lifetime1的共享，后续UE与AF可以基于Kakma、Temporary ID和Key lifetime1进行密钥分发等流程，本申请实施例不做具体描述。
综上所述，本申请实施例中，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图9，示出了本申请实施例四的第一网元侧的通信流程示意图，该方法具体 可以包括：
步骤S301：第一网元从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识。
步骤S302：所述第一网元根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识。
步骤S303：所述第一网元从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
可选的，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
可选的，还包括：
所述第一网元确定所述终端设备的第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据所述终端设备的标识计算得到的，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；
所述第一网元向所述终端设备发送所述第一临时标识。
可选的，还包括：
所述第一网元确定所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；
所述第一网元向所述终端设备发送所述第一共享密钥的有效期。
可选的，所述第二请求还包括第一网元的第一网元标识；其中，所述第一网元标识用于标识所述第一网元的身份；
所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
可选的，所述第二共享密钥为：所述第二网元接收到所述第二请求后，响应于所述第二请求与所述终端设备实时进行第二认证得到的。
本申请实施例的具体执行过程可以参照图6至图8对应的实施例中第一网元所执行的动作，本申请实施例与图6至图8对应的实施例所不同的是：在其他执行主体向第一网元发送请求时，第一网元可以相应的接收请求，其执行原理相似，在此对第一网元为执行主体的方法不再赘述。
综上所述，本申请实施例中，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图10，示出了本申请实施例五的第二网元侧的通信流程示意图，该方法具体 可以包括：
步骤S401：第二网元从第一网元接收第二请求；所述第二请求包括终端设备的标识。
步骤S402：所述第二网元根据所述终端设备的标识确定第二共享密钥。
步骤S403：所述第二网元根据所述第二共享密钥确定第一共享密钥。
步骤S404：所述第二网元向所述第一网元发送所述第一共享密钥；其中，所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
可选的，所述第二网元根据所述终端设备的标识确定第二共享密钥，包括：
所述第二网元根据所述终端设备的标识，以及预先获取的终端标识与所述第二网络中的共享密钥的映射关系，确定所述终端设备的标识对应的第二共享密钥。
可选的，所述第二网元根据所述终端设备的标识确定第二共享密钥，包括：
所述第二网元响应于所述第二请求，与所述终端设备进行第二认证，得到所述第二共享密钥。
可选的，还包括：
所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第二网元向所述第一网元发送所述第二共享密钥的有效期；
或，
所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第二网元根据所述第二共享密钥的有效期确定第一共享密钥的有效期；所述第二网元向所述第一网元发送所述第一共享密钥的有效期。
可选的，还包括：
所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元向所述第一网元发送所述第二临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份；
或，
所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元根据所述第二临时标识确定第一临时标识；所述第二网元向所述第一网元发送所述第一临时标识；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份。
可选的，所述第二请求还包括所述第一网元的第一网元标识；其中，所述第一网元标识用于标识所述第一网元的身份；
所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
本申请实施例的具体执行过程可以参照图6至图8对应的实施例中第二网元所执行的动作，本申请实施例与图6至图8对应的实施例所不同的是：在其他执行主体向第二网元发送请求时，第二网元可以相应的接收请求，其执行原理相似，在此对第二网元为执行主体的方法不再赘述。
综上所述，本申请实施例中，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以 响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图11，示出了本申请实施例六的终端设备侧的通信流程示意图，该方法具体可以包括：
步骤S501：终端设备向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一请求用于指示所述第一网元从第二网元获取第一共享密钥；
步骤S502：所述终端设备根据第二共享密钥确定第一共享密钥；所述第二共享密钥为所述终端设备在所述第二网元中进行第二认证时确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
可选的，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
可选的，所述终端设备根据第二共享密钥确定第一共享密钥之前，还包括：所述终端设备从所述第一网元接收第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据终端设备的标识计算得到的；所述终端设备的标识用于标识所述终端设备，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；或，所述终端设备根据第二临时标识确定第一临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份。
可选的，所述终端设备根据第二共享密钥确定第一共享密钥之前，还包括：
所述终端设备从所述第一网元接收所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；或，所述终端设备根据第二共享密钥的有效期确定第一共享密钥的有效期；所述第二共享密钥的有效期为所述终端设备在所述第二网元中进行第二认证时确定的。
本申请实施例的具体执行过程可以参照图6至图8对应的实施例中终端设备所执行的动作，本申请实施例与图6至图8对应的实施例所不同的是：在其他执行主体向终端设备发送请求时，终端设备可以相应的接收请求，其执行原理相似，在此对终端设备为执行主体的方法不再赘述。
综上所述，本申请实施例中，第一网元从终端设备接收包括终端设备的标识的第一请求后，第一网元向第二网元发送包括终端设备的标识的第二请求，第二网元可以响应于该第二请求根据第二共享密钥确定第一共享密钥，并向第一网元发送第一共享密钥，在第一网元中接收到该第一共享密钥后，就可以进一步与终端设备实现基于该第一共享密钥的第一认证。即第一网元可以基于第二网元中的第二共享密钥实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
需要说明的是，针对本申请上述的实施例，对于生成并分发第一共享密钥至第一网元的特征，以及确定第一临时标识的特征，以及确定第一共享密钥的有效期的特征 可以属于三个独立的特征，三个特征可以为三个独立的步骤，也可以将任意两个组合为一个步骤，或者三个组合形成一个步骤流程实现；本申请实施例对此不做限制。
参照图12，示出了本申请实施例七的另一种通信方法的流程示意图。本申请实施例的可以包括：
步骤S601：终端设备向第五网元发送第三请求；其中，所述第三请求包括所述终端设备的标识。
本申请实施例中，终端设备的标识可以为终端设备的永久身份或终端设备的永久身份的封装标识；终端设备的标识也可以为终端设备的第二临时标识，在此不做赘述。
本申请实施例中，第三网元是基于第一认证架构进行第一认证的网元，第一认证架构可以是GBA，第一认证架构也可以是AKMA；第四网元标识用于标识第四网元，第四网元是基于第二认证架构进行第二认证的网元，第二认证架构可以是GBA，第二认证架构也可以是AKMA；具体应用中，在第一认证架构为GBA的情况下，第三网元为HSS，第二认证架构为AKMA，第四网元为SEAF/AUSF/UDM；在第一认证架构为AKMA的情况下，第三网元为SEAF/AUSF/UDM，第二认证架构为GBA，第四网元为HSS；可以在第三网元和第四网元之间设置接口，通过第三网元和第四网元之间的接口，在第三网元和第四网元之间实现数据传输。
在本申请实施例的一种可选实现方式中，终端设备在第四网元中已有认证，则在终端设备与第四网元中可以共享第二认证向量，第二认证向量中可以包括第二共享密钥；终端设备通过向第五网元发送包括第三请求，表明终端设备希望通过在第四网元中已有的认证参数，建立与第五网元的参数协商。
步骤S602：第五网元向第三网元发送所述第三请求。
本申请实施例中，第五网元需要通过第三网元与第四网元建立通信连接，因此，第五网元发送请求给第五网元，所述请求包括终端设备的标识。
可选的所述请求还包括第四网元的标识。
步骤S603：第三网元根据所述第三请求向第四网元发送第四请求；其中，所述第四请求包括所述终端设备的标识。
第三网元可以根据终端设备的标识确定第四网元的标识。
本申请实施例中，第四请求中还可以包括第四网元标识，第三网元可以根据第四网元标识向第四网元发送包括终端设备的标识的第四请求。
本申请实施例中，第四请求用于向第四网元请求第一认证向量。
可选的，所述第四请求还包括：第三网元标识，使得第四网元可以根据第三网元标识确定第三网元的身份或地址信息，后续可以根据第三网元标识与第三网元进行数据传输。
步骤S604：第四网元根据所述终端设备的标识确定第二认证向量；根据所述第二认证向量确定第一认证向量。
在本申请实施例的一种可选实现方式中，第四网元根据终端设备的标识确定第二认证向量，具体的确认方式可以为已有第二网络的第二认证，不做限制。
具体应用中，响应于第四请求，第四网元与终端设备可以进行基于第二认证架构的第二认证，可以理解，该第二认证可以为GBA的常规认证，也可以为AKMA的常 规认证，也可以为5G AKA或者EAP AKA’等认证方式，本申请实施例对此认证方式不做限制，在此对第二认证不做赘述。需要说明的是，虽然本申请实施例中，响应于第四请求，第四网元与终端设备之间采用的是常规的第二认证，但是该第四请求是第三网元发送的，即该第二认证是有第三网元参与执行参数传递的，使得本申请的终端设备与第四网元的认证过程不同于现有的认证过程。
具体应用中，第四网元根据第二认证向量确定第一认证向量的具体实现可以是：第四网元根据第二认证向量，利用密钥推演函数推衍得到第一认证向量。
步骤S605：第四网元向第三网元发送所述第一认证向量。
步骤S606：第三网元向第五网元发送所述第一认证向量。
本申请实施例中，第三网元向第五网元转发第四网元的第一认证向量，则终端设备实现了通过在第四网元中已有的认证参数，建立与第五网元的参数协商。
步骤S607：第五网元根据所述第一认证向量与终端设备执行双向认证，并确定第一共享密钥。
本申请实施例中，第一认证向量中可以包括第一共享密钥。认证过程中第五网元还可以向终端设备发送认证指示。
步骤S608：终端设备根据所述第一认证向量确定第一共享密钥。
具体应用中，终端设备可以首先根据第二认证向量确定第一认证向量，然后在第一认证向量中获取第一共享密钥。终端设备根据第二认证向量确定第一认证向量的方式可以采用与第四网元相同的方式，在此不再赘述。
在终端设备和第五网元中共享了第一共享密钥之后，终端设备和第五网元就可以基于该第一共享密钥进行后续的安全流程等操作。
在上述流程，可选的，终端设备和第五网元还可以共享第一临时标识和第一共享密钥的有效期。
在本申请实施例一种可选的实现方式中，第一临时标识和第一共享密钥的有效期可以由第五网元计算得到，然后第五网元将第一临时标识和第一共享密钥的有效期发送给终端设备。
具体的，第五网元确定第一临时标识的具体实现可以是：所述第五网元从所述第三网元接收第二临时标识；所述第五网元根据所述第二临时标识计算得到所述第一临时标识；其中，所述第二临时标识为所述终端设备在所述第四网元中进行第二认证得到的临时标识。具体的，第二临时标识通常包括第二认证架构标识，第五网元可以将第二临时标识中的第二认证架构标识替换为第一认证架构标识。
第五网元确定第一临时标识的具体实现还可以是：所述第五网元从所述第三网元接收第一临时标识；其中，所述第一临时标识为所述第四网元根据所述第二临时标识计算得到的；所述第二临时标识为所述终端设备在所述第四网元中进行认证得到的临时标识。具体的，第二临时标识通常包括第二认证架构标识，第四网元可以将第二临时标识中的第二认证架构标识替换为第一认证架构标识，得到第一临时标识，然后第四网元通过第三网元将第一临时标识发送给第五网元。
第五网元确定第一共享密钥的有效期的具体实现可以是：所述第五网元从所述第三网元接收所述第二共享密钥的有效期；所述第五网元根据所述第二共享密钥的有效 期计算得到所述第一共享密钥的有效期。具体的，第五网元可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；第五网元也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定。
第五网元确定第一共享密钥的有效期的具体实现还可以是：所述第五网元从所述第三网元接收第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第四网元根据所述第二共享密钥的有效期计算得到的。具体的，第四网元可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；第四网元也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定，然后第四网元通过第三网元将第一临时标识发送给第五网元。
在本申请实施例另一种可选的实现方式中，第五网元计算得到第一临时标识和第一共享密钥的有效期，终端设备也计算得到第一临时标识和第一共享密钥的有效期，则第五网元不需要向终端设备发送第一临时标识和第一共享密钥的有效期。
第五网元也可以通过本地策略确定第一密钥的有效期和/或第一临时标识。
终端设备确定第一临时标识的具体实现可以是：终端设备将第二临时标识中的第二认证架构标识替换为第一认证架构标识，得到第一临时标识。
终端设备确定第一共享密钥的有效期的具体实现可以是：终端设备可以根据第二共享密钥的有效期剩余的生命周期，确定第一共享密钥的有效期；终端设备也可以同时参考其他本地策略(如第一共享密钥的有效期不超过1个小时)确定第一共享密钥的有效期，本申请对此不作限定。
具体应用中，本申请实施例的通信方法可以包括两种实现方式：第一种实现方式中，第三网元为HSS，第四网元为SEAF/AUSF/UDM，第五网元为BSF；第二种实现方式中，第三网元为SEAF/AUSF/UDM，第四网元为HSS，第五网元为AAuF。
参照图13，示出了本申请实施例八的通信方法的第一种实现方式的具体流程示意图。本申请实施例以第三网元为HSS，第四网元为SEAF/AUSF/UDM，第五网元为BSF为例，说明基于AKMA AV获得GBA AV的流程。在图13对应的实施例中，第一认证向量为GBA AV，第一临时标识为B-TID，第一共享密钥为Ks，第一共享密钥的有效期为key lifetime1，第二认证向量为AKMA AV，第二临时标识为Temporary ID，第二共享密钥为Kakma，第二共享密钥的有效期为key lifetime2。在本申请实施例中，该方法可以包括：
其中，所述第三请求包括SEAF/AUSF/UDM标识和用于标识所述终端设备的标识。
步骤S6011：终端设备向BSF发送第三请求；其中，所述第三请求包括用于所述终端设备的标识。
第三请求中可以包括终端设备的永久身份标识，或者终端设备的永久身份标识的封装标识。
还可能包括SEAF/AUSF/UDM路由标识，使得BSF可以通过该SEAF/AUSF/UDM路由标识确定第三请求对应的为AKMA的请求。
可选的，还包括AKMA认证指示AKMA indicator，用于指示该第三请求时与AKM  A相关的。
步骤S6021：BSF向所述HSS发送所述第三请求。
本申请实施例中，BSF需要通过HSS与SEAF/AUSF/UDM进行通信。
可选的，第三请求中还可以包括BSF domain name。
还可能包括SEAF/AUSF/UDM路由标识，使得BSF可以通过该SEAF/AUSF/UDM路由标识确定第三请求对应的为AKMA的请求。
可选的，若第三请求包括AKMA indicator，确定是与AKMA相关。
步骤S6031：HSS根据第三请求向SEAF/AUSF/UDM发送第四请求；其中，所述第四请求包括所述终端设备的标识。
SEAF/AUSF/UDM的标识可以为从BSF接收到的，或者根据终端设备的标识确定的。具体的确定方式为已有技术，本申请实施例不做限制。
本申请实施例中，第四网元可以是SEAF或AUSF或UDM，因此HSS可以根据SEAF/AUSF/UDM标识对应的向SEAF/AUSF/UDM发送第四请求。
步骤S6041：SEAF/AUSF/UDM根据所述终端设备的标识确定AKMA AV；根据所述AKMA AV确定GBA AV。
在HSS于UDM有接口的情况下，当前5G UDM可以生成三个认证向量：5G AKA向量(CK’，IK’，RAND，AUTN，XRES)，EAP AKA‘认证向量(Kausf，RAND，AUTN，XRES)，AKMA认证向量(Kakma，RAND，AUTN，XRES)。UDM根据上述三个认证向量的至少一项确定GBA认证向量GBA AV(Ks，RAND，AUTN，XRES)。Ks的生成可以基于CK’，IK’或者Kausf或者Kakma生成，Ks的生成还可能包括以下参数的至少一项：BSF domain name，AKMA与GBA的互联互通的指示(可选的，也可以为接收到的AKMA indicator)，新鲜参数2，终端设备的标识和第二认证架构的标识。这里BSF domain name可以为HSS发送给UDM，也可以UDM根据其与HSS的接口连接确定BSF domain name。这里Ks也可以为CK，和IK。
在HSS与AUSF有接口的情况下，当前5G AUSF可以有三个认证向量：5G AKA向量(Kausf，RAND，AUTN，XRES)，EAP AKA‘认证向量(Kausf，RAND，AUTN，XRES)，AKMA认证向量(Kakma，RAND，AUTN，XRES)。UDM根据上述三个认证向量的至少一项确定GBA认证向量(Ks，RAND，AUTN，XRES)，基于Kausf生成Ks。这里Ks也可以为CK，和IK。
在HSS与SEAF有接口的情况下，当前5G SEAF可以有三个认证向量：5G AKA向量(Kseaf，RAND，AUTN，XRES)，EAP AKA‘认证向量(Kseaf，RAND，AUTN，XRES)，AKMA认证向量(Kseaf，RAND，AUTN，XRES)。UDM根据上述三个认证向量的至少一项确定GBA认证向量(Ks，RAND，AUTN，XRES)，基于Kseaf生成Ks。这里Ks也可以为CK，和IK。
可选的，SEAF/AUSF/UDM还可以根据key lifetime2确定key lifetime1。例如，可以为根据key lifetime2剩余的生命周期，确定key lifetime1的生命周期；另外也可以同时参考其他本地策略(如key lifetime1不超过1个小时)确定key lifetime1的有效期。
也可能，SEAF/AUSF/UDM可以响应于第二请求，实时与终端设备进行AKMA的 双向认证，使得SEAF/AUSF/UDM中与UE共享AKMA AV、temporary ID、Kakma和key lifetime2，具体的，SEAF/AUSF/UDM可以基于上述的AKMA架构，通过AAuF与终端设备进行AKMA的双向认证，在此不做赘述；然后SEAF/AUSF/UDM可以执行如第一中应用场景中的确定GBA AV等的过程，在此不做赘述。
需要说明的是，根据key lifetime2确定key lifetime1的过程也可以由BSF实现，则SEAF/AUSF/UDM可以发送key lifetime2给BSF。
需要说明的是，根据AKMA AV确定GBA AV的过程也可以由HSS实现，则SEAF/AUSF/UDM可以发送AKMA A给HSS。
步骤S6051：SEAF/AUSF/UDM向HSS发送所述GBA AV。
SEAF/AUSF/UDM都可以向HSS发送GBA AV，还可能发送Temporary ID和/或key lifetime1。
可选的，SEAF/AUSF/UDM向HSS还可以发送认证指示(indicator)，认证indicator可以指示采用的哪一个认证向量生成的GBA认证参数，或者指示基于AKMA机制确定的GBA认证参数。
可选的，SEAF/AUSF/UDM向HSS还可以发送新鲜参数2，用于保证密钥推衍的新鲜性，新鲜参数2可以为计数器，随机数，nonce等。
步骤S6061：HSS向BSF发送所述GBA AV。
可选的，HSS还可以向BSF发送认证指示indicator。
步骤S6071：BSF根据所述GBA AV与终端设备执行双向认证，确定Ks。
可选的，BSF还可以向终端设备发送认证indicator。
步骤S6081：终端设备根据所述GBA AV确定Ks。
本申请实施例中，终端设备可以根据认证indicator确定采用的哪一个认证向量生成的认证参数，或者根据认证indicator确定基于AKMA机制确定的GBA认证参数，采用与SEAF或者AUSF或者UDM相同的方式生成Ks。
可选的，认证结束后，BSF还可以发送B-TID，和Key lifetime1至终端设备UE。
可选的，UE也可以自己确定B-TID，和Key lifetime1。
可选的，第五网元也可以不从第三网元或第四网元接收B-TID，和Key lifetime1，第五网元可以自己根据本地策略确定第五网元。
则UE与BSF完成了Ks、B-TID和Key lifetime1的共享，后续UE与AF可以基于Ks、B-TID和Key lifetime1进行密钥分发等流程，本申请实施例不做具体描述。
参照图14，示出了本申请实施例九的通信方法的第二种实现方式的具体流程示意图。本申请实施例以第三网元为SEAF/AUSF/UDM，第四网元为HSS，第五网元为AAuF为例，说明基于GBA AVA获得KMA AV的流程。在图14对应的实施例中，第一认证向量为AKMA AV，第一临时标识为Temporary ID，第一共享密钥为Kakma，第一共享密钥的有效期为key lifetime1，第二认证向量为GBA AV，第二临时标识为B-TID，第二共享密钥为Ks，第二共享密钥的有效期为key lifetime2。在本申请实施例中，该方法可以包括：
步骤S6012：终端设备向AAuF发送第三请求；其中，所述第三请求包括所述终端设备的标识。
步骤S6022：AAuF向SEAF/AUSF/UDM发送所述第三请求。
步骤S6032：SEAF/AUSF/UDM根据第三请求向HSS发送第四请求；其中，所述第四请求包括所述终端设备的标识。SEAF/AUSF/UDM可以根据终端设备的标识确定HSS，具体确定方式已有技术不做限制。
步骤S6042：HSS根据所述终端设备的标识确定GBA AV；根据所述GBA AV确定AKMA AV。
步骤S6052：HSS向SEAF/AUSF/UDM发送所述AKMA AV。
步骤S6062：SEAF/AUSF/UDM向AAuF发送所述AKMA AV。
步骤S6072：AAuF根据所述AKMA AV执行与终端设备的双向认证，并确定Kakma。
步骤S6082：终端设备根据所述AKMA AV与终端设备执行双向认证，并确定Kakma。
本申请与图13的实施例的区别在于，UE接入AAuF，由AAuF通过SEAF/AUSF/UDM接入HSS，从而获得AKMA的认证向量，且在AAuF与SEAF有接口的情况下，SEAF通过AUSF和/或UDM与HSS交互；在AAuF与AUSF有接口的情况下，AUSF通过UDM与HSS交互，或者AUSF直接与HSS交互；在AAuF与UDM有接口的情况下，UDM与HSS直接交互。
本申请实施例具体的处理方式，类似于图13的实施例的方式，在此不再赘述详细实现过程。
则UE与AAuF完成了Kakma、Temporary ID和Key lifetime1的共享，后续UE与AF可以基于Kakma、Temporary ID和Key lifetime1进行密钥分发等流程，本申请实施例不做具体描述。
综上所述，本申请实施例中，第三网元从第五网元接收包括终端设备的标识的第三请求后，第三网元向第四网元发送包括终端设备的标识的第四请求，第四网元可以响应于该第四请求根据第二认证向量确定第一认证向量，并向第三网元发送第一认证向量，在第三网元中接收到该第一认证向量后，就可以进一步通过第五网元与终端设备实现基于该第一认证向量的第一认证。即第五网元可以基于第四网元中的第二认证向量实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图15，示出了本申请是实施例十的第三网元侧的通信流程示意图，该方法具体可以包括：
步骤S701：第三网元从第五网元接收第三请求；其中，所述第三请求为终端设备向所述第五网元发送的；所述第三请求包括所述终端设备的标识。
步骤S702：所述第三网元根据所述第三请求向第四网元发送第四请求；其中，所述第四请求包括所述终端设备的标识。
步骤S703：所述第三网元从所述第四网元接收第一认证向量；其中，所述第一认证向量为所述第四网元根据第二认证向量确定的，所述第二认证向量为所述第四网元根据所述终端设备的标识确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本申请实施例的具体执行过程可以参照图12至图14对应的实施例中第三网元所执行的动作，本申请实施例与图12至图14对应的实施例所不同的是：在其他执行主体向第三网元发送请求时，第三网元可以相应的接收请求，其执行原理相似，在此对第三网元为执行主体的方法不再赘述。
综上所述，本申请实施例中，第三网元从第五网元接收包括终端设备的标识的第三请求后，第三网元向第四网元发送包括终端设备的标识的第四请求，第四网元可以响应于该第四请求根据第二认证向量确定第一认证向量，并向第三网元发送第一认证向量，在第三网元中接收到该第一认证向量后，就可以进一步通过第五网元与终端设备实现基于该第一认证向量的第一认证。即第五网元可以基于第四网元中的第二认证向量实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图16，示出了本申请是实施例十一的第四网元侧的通信流程示意图，该方法具体可以包括：
步骤S801：第四网元从第三网元接收第四请求；所述第四请求包括终端设备的标识。
步骤S802：所述第四网元根据所述终端设备的标识确定第二认证向量。
步骤S803：所述第四网元根据所述第二认证向量确定第一认证向量。
步骤S804：所述第四网元向所述第三网元发送所述第一认证向量；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本申请实施例的具体执行过程可以参照图12至图14对应的实施例中第四网元所执行的动作，本申请实施例与图12至图14对应的实施例所不同的是：在其他执行主体向第四网元发送请求时，第四网元可以相应的接收请求，其执行原理相似，在此对第四网元为执行主体的方法不再赘述。
综上所述，本申请实施例中，第三网元从第五网元接收包括终端设备的标识的第三请求后，第三网元向第四网元发送包括终端设备的标识的第四请求，第四网元可以响应于该第四请求根据第二认证向量确定第一认证向量，并向第三网元发送第一认证向量，在第三网元中接收到该第一认证向量后，就可以进一步通过第五网元与终端设备实现基于该第一认证向量的第一认证。即第五网元可以基于第四网元中的第二认证向量实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图17，示出了本申请实施例十二的第五网元侧的通信流程示意图，该方法具体可以包括：
步骤S901：第五网元从终端设备接收第三请求；其中，所述第三请求包括所述终端设备的标识。
步骤S902：所述第五网元向第三网元发送第三请求；所述第三请求用于指示所述第三网元从第四网元中获取第一认证向量；所述第一认证向量为所述第四网元根据第二认证向量确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
步骤S903：所述第五网元从所述第四网元接收所述第一认证向量。
本申请实施例的具体执行过程可以参照图12至图14对应的实施例中第五网元所执行的动作，本申请实施例与图12至图14对应的实施例所不同的是：在其他执行主体向第五网元发送请求时，第五网元可以相应的接收请求，其执行原理相似，在此对第五网元为执行主体的方法不再赘述。
综上所述，本申请实施例中，第三网元从第五网元接收包括终端设备的标识的第三请求后，第三网元向第四网元发送包括终端设备的标识的第四请求，第四网元可以响应于该第四请求根据第二认证向量确定第一认证向量，并向第三网元发送第一认证向量，在第三网元中接收到该第一认证向量后，就可以进一步通过第五网元与终端设备实现基于该第一认证向量的第一认证。即第五网元可以基于第四网元中的第二认证向量实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
参照图18，示出了本申请实施例十三的终端设备侧的通信流程示意图，该方法具体可以包括：
步骤S1001：终端设备向第五网元发送第三请求；其中，所述第三请求包括所述终端设备的标识；所述第三请求用于指示所述第五网元向第三网元发送所述第三请求，以及指示所述第三网元从第四网元中获取第一认证向量。
步骤S1002：所述终端设备根据第二认证向量确定第一认证向量；所述第二认证向量为所述终端设备在所述第四网元中进行第二认证时确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本申请实施例的具体执行过程可以参照图12至图14对应的实施例中终端设备所执行的动作，本申请实施例与图12至图14对应的实施例所不同的是：在其他执行主体向终端设备发送请求时，终端设备可以相应的接收请求，其执行原理相似，在此对终端设备为执行主体的方法不再赘述。
综上所述，本申请实施例中，第三网元从第五网元接收包括终端设备的标识的第三请求后，第三网元向第四网元发送包括终端设备的标识的第四请求，第四网元可以响应于该第四请求根据第二认证向量确定第一认证向量，并向第三网元发送第一认证向量，在第三网元中接收到该第一认证向量后，就可以进一步通过第五网元与终端设备实现基于该第一认证向量的第一认证。即第五网元可以基于第四网元中的第二认证向量实现对终端设备的第一认证，从而使得第一认证架构和第二认证架构之间实现了互通，提升了通信灵活性。
图19为本申请实施例十四提供的一种第一网元的结构示意图，如图19所示，所述第一网元包括：
请求接收模块11，用于从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识；
发送模块12，用于根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识；
共享密钥接收模块13，用于从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所 述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述第一网元还包括：
临时标识确定模块，用于确定所述终端设备的第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据所述终端设备的标识计算得到的，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；
临时标识发送模块，用于向所述终端设备发送所述第一临时标识。
一种示例性的方式中，所述第一网元还包括：
有效期确定模块，用于确定所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；
有效期发送模块，用于向所述终端设备发送所述第一共享密钥的有效期。
一种示例性的方式中，所述第二请求还包括第一网元的第一网元标识；
所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
一种示例性的方式中，所述第二共享密钥为：所述第二网元接收到所述第二请求后，响应于所述第二请求与所述终端设备进行第二认证得到的。
本实施例的第一网元，可用于执行上述实施例中第一网元所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图20为本申请实施例十五提供的一种第二网元的结构示意图，如图20所示，所述第二网元包括：
请求接收模块21，用于从第一网元接收第二请求；所述第二请求包括终端设备的标识；第二共享密钥确定模块22，用于根据所述终端设备的标识确定第二共享密钥；第一共享密钥确定模块23，用于根据所述第二共享密钥确定第一共享密钥；第一共享密钥发送模块24，用于向所述第一网元发送所述第一共享密钥；其中，所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第二共享密钥确定模块还用于：
根据所述终端设备的标识，以及预先获取的终端标识与所述第二网络中的共享密钥的映射关系，确定所述终端设备的标识对应的第二共享密钥。
一种示例性的方式中，所述第二共享密钥确定模块还用于：
响应于所述第二请求，与所述终端设备进行第二认证，得到所述第二共享密钥。
一种示例性的方式中，所述第二网元还包括第二有效期确定模块，用于：
根据所述终端设备的标识确定所述第二共享密钥的有效期；向所述第一网元发送所述第二共享密钥的有效期；或，根据所述终端设备的标识确定所述第二共享密钥的有效期；根据所述第二共享密钥的有效期确定所述第一共享密钥的有效期；向所述第一网元发送所述第一共享密钥的有效期。
一种示例性的方式中，所述第二网元还包括临时标识确定模块，用于：
根据所述终端设备的标识确定所述终端设备的第二临时标识；向所述第一网元发 送所述第二临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份；或，根据所述终端设备的标识确定所述终端设备的第二临时标识；根据所述第二临时标识确定第一临时标识；向所述第一网元发送所述第一临时标识；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份。
一种示例性的方式中，所述第二请求还包括所述第一网元的第一网元标识；所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
本实施例的第二网元，可用于执行上述实施例中第二网元所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图21为本申请实施例十六提供的一种终端设备的结构示意图，如图21所示，所述终端设备包括：
请求发送模块31，用于向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一请求用于指示所述第一网元从第二网元获取第一共享密钥；
共享密钥确定模块32，用于终端设备根据第二共享密钥确定所述第一共享密钥；所述第二共享密钥为所述终端设备在所述第二网元中进行第二认证时确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
一种示例性的方式中，所述第一请求中还包括第一指示信息，所述第一指示信息用于指示所述第一网元从所述第二网络中获取所述第一网络中的第一共享密钥。
一种示例性的方式中，所述终端设备还包括临时标识确定模块，用于：
从所述第一网元接收第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据终端设备的标识计算得到的；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；或，根据第二临时标识确定第一临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份。
一种示例性的方式中，所述终端设备还包括有效期确定模块，用于：
从所述第一网元接收所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；或，根据第二共享密钥的有效期确定第一共享密钥的有效期；所述第二共享密钥的有效期为所述终端设备在所述第二网元中进行第二认证时确定的。
本实施例的终端设备，可用于执行上述实施例中终端设备所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图22为本申请实施例十七提供的一种第三网元的结构示意图，如图22所示，所述第三网元包括：
请求接收模块41，用于从第五网元接收第三请求；其中，所述第三请求为终端设备向所述第五网元发送的；所述第三请求包括所述终端设备的标识；
请求发送模块42，用于根据所述第三请求向第四网元发送第四请求；其中，所述第四请求包括所述终端设备的标识；
认证向量接收模块43，用于从所述第四网元接收第一认证向量；其中，所述第一认证向量为所述第四网元根据第二认证向量确定的，所述第二认证向量为所述第四网元根据所述终端设备的标识确定的；所述第一认证向量用于第一网络中安全保护，所 述第二认证向量用于第二网络中的安全保护。
本实施例的第三网元，可用于执行上述实施例中第三网元所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图23为本申请实施例十八提供的一种第四网元的结构示意图，如图23所示，所述第四网元包括：
请求接收模块51，用于第四网元从第三网元接收第四请求；所述第四请求包括终端设备的标识；
第二认证向量确定模块52，用于根据所述终端设备的标识确定第二认证向量；
第一认证向量确定模块53，用于根据所述第二认证向量确定第一认证向量；
第一认证向量发送模块54，用于向所述第三网元发送所述第一认证向量；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本实施例的第四网元，可用于执行上述实施例中第四网元所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图24为本申请实施例十九提供的一种第五网元的结构示意图，如图24所示，所述第五网元包括：
请求接收模块61，用于从终端设备接收第三请求；其中，所述第三请求包括所述终端设备的标识；
请求发送模块62，用于向第三网元发送第三请求；所述第三请求用于指示所述第三网元从第四网元中获取第一认证向量；所述第一认证向量为所述第四网元根据第二认证向量确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护；
认证向量接收模块63，用于所述第五网元从所述第四网元接收所述第一认证向量。
本实施例的第五网元，可用于执行上述实施例中第五网元所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图25为本申请实施例二十提供的一种终端设备的结构示意图，如图25所示，所述终端设备包括：
请求发送模块71，用于向第五网元发送第三请求；其中，所述第三请求包括所述终端设备的标识；所述第三请求用于指示所述第五网元向第三网元发送所述第三请求，以及指示所述第三网元从第四网元中获取第一认证向量；
认证向量确定模块72，用于所述终端设备根据第二认证向量确定第一认证向量；所述第二认证向量为所述终端设备在所述第四网元中进行第二认证时确定的；所述第一认证向量用于第一网络中安全保护，所述第二认证向量用于第二网络中的安全保护。
本实施例的终端设备，可用于执行上述实施例中终端设备所述实现的方法，具体实现方式和技术效果类似，这里不再赘述。
图26为本申请实施例二十一提供的第一网元的结构示意图，如图26所示，该第一网元800包括：处理器81、存储器82和收发器83，所述存储器82用于存储指令，所述收发器83用于和其他设备通信，所述处理器81用于执行所述存储器中存储的指令，以使所述第一网元800执行如上述方法实施例中第一网元执行的方法。
图27为本申请实施例二十二提供的第二网元的结构示意图，如图27所示，该第 二网元900包括：处理器91、存储器92和收发器93，所述存储器92用于存储指令，所述收发器93用于和其他设备通信，所述处理器91用于执行所述存储器中存储的指令，以使所述第二网元900执行如上述方法实施例中第二网元执行的方法。
图28为本申请实施例二十三提供的UE的结构示意图，如图28所示，该UE 1000包括：处理器101、存储器102和收发器103，所述存储器102用于存储指令，所述收发器103用于和其他设备通信，所述处理器101用于执行所述存储器中存储的指令，以使所述UE 1000执行如上述方法实施例中UE执行的方法。
本申请实施例还提供存储介质，所述存储介质用于存储计算机程序，所述计算机程序用于实现上述实施例所述的通信方法。
可以理解，本申请实施例中的处理器可以是中央处理器(CPU)，通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)，现场可编程门阵列(FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
本申请实施例所述的总线可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部设备互连(Peripheral Component，PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，本申请附图中的总线并不限定仅有一根总线或一种类型的总线。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (14)

  1. 一种通信方法，其特征在于，包括：
    第一网元从终端设备接收第一请求；其中，所述第一请求包括所述终端设备的标识；
    所述第一网元根据所述第一请求向第二网元发送第二请求；其中，所述第二请求包括所述终端设备的标识；
    所述第一网元从所述第二网元接收第一共享密钥；其中，所述第一共享密钥为所述第二网元根据第二共享密钥确定的，所述第二共享密钥为所述第二网元根据所述终端设备的标识确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网元根据所述第一请求向第二网元发送第二请求之后，还包括：
    所述第一网元确定所述终端设备的第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据所述终端设备的标识计算得到的，所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；
    所述第一网元向所述终端设备发送所述第一临时标识。
  3. 根据权利要求1至2任一项所述的方法，其特征在于，所述第一网元根据所述第一请求向第二网元发送第二请求之后，还包括：
    所述第一网元确定所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；
    所述第一网元向所述终端设备发送所述第一共享密钥的有效期。
  4. 根据权利要求1至2任一项所述的方法，其特征在于，所述第二请求还包括第一网元的第一网元标识；
    所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
  5. 一种通信方法，其特征在于，包括：
    第二网元从第一网元接收第二请求；所述第二请求包括终端设备的标识；
    所述第二网元根据所述终端设备的标识确定第二共享密钥；
    所述第二网元根据所述第二共享密钥确定第一共享密钥；
    所述第二网元向所述第一网元发送所述第一共享密钥；其中，所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
  6. 根据权利要求5所述的方法，其特征在于，所述第二网元从第一网元接收第二请求之后，还包括：
    所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第二网元向所述第一网元发送所述第二共享密钥的有效期；
    或，
    所述第二网元根据所述终端设备的标识确定所述第二共享密钥的有效期；所述第 二网元根据所述第二共享密钥的有效期确定所述第一共享密钥的有效期；所述第二网元向所述第一网元发送所述第一共享密钥的有效期。
  7. 根据权利要求5至6任一项所述的方法，其特征在于，第二网元从第一网元接收第二请求之后，还包括：
    所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元向所述第一网元发送所述第二临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份；
    或，
    所述第二网元根据所述终端设备的标识确定所述终端设备的第二临时标识；所述第二网元根据所述第二临时标识确定第一临时标识；所述第二网元向所述第一网元发送所述第一临时标识；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份。
  8. 根据权利要求5至6所述的方法，其特征在于，所述第二请求还包括所述第一网元的第一网元标识；
    所述第一共享密钥为所述第二网元根据所述第二共享密钥和所述第一网元标识推衍得到的。
  9. 一种通信方法，其特征在于，包括：
    终端设备向第一网元发送第一请求；其中，所述第一请求包括所述终端设备的标识；所述第一请求用于指示所述第一网元从第二网元获取第一共享密钥；
    所述终端设备根据第二共享密钥确定所述第一共享密钥；所述第二共享密钥为所述终端设备在所述第二网元中进行第二认证时确定的；所述第一共享密钥用于第一网络中安全保护，所述第二共享密钥用于第二网络中的安全保护。
  10. 根据权利要求9所述的方法，其特征在于，所述终端设备向第一网元发送第一请求之后，还包括：
    所述终端设备从所述第一网元接收第一临时标识；所述第一临时标识为所述第一网元或所述第二网元根据终端设备的标识计算得到的；所述第一临时标识用于标识所述终端设备在所述第一网络中的临时身份；
    或，
    所述终端设备根据第二临时标识确定第一临时标识；所述第二临时标识用于标识所述终端设备在所述第二网络中的临时身份。
  11. 根据权利要求9所述的方法，其特征在于，所述终端设备向第一网元发送第一请求之后，还包括：
    所述终端设备从所述第一网元接收所述第一共享密钥的有效期；其中，所述第一共享密钥的有效期为所述第一网元或所述第二网元根据所述第二共享密钥的有效期确定的；所述第二共享密钥的有效期为所述第二网元根据所述终端设备的标识确定的；
    或，
    所述终端设备根据第二共享密钥的有效期确定第一共享密钥的有效期；所述第二共享密钥的有效期为所述终端设备在所述第二网元中进行第二认证时确定的。
  12. 一种第一网元，其特征在于，包括处理器、存储器和收发器，所述存储器用 于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如权利要求1-4中任一项所述的方法。
  13. 一种第二网元，其特征在于，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述第一网元执行如权利要求5-8中任一项所述的方法。
  14. 一种终端设备UE，其特征在于，包括处理器、存储器和收发器，所述存储器用于存储指令，所述收发器用于和其他设备通信，所述处理器用于执行所述存储器中存储的指令，以使所述UE执行如权利要求9-11中任一项所述的方法。
PCT/CN2020/082105 2019-04-29 2020-03-30 通信方法和装置 WO2020220903A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910356343.4A CN111866871B (zh) 2019-04-29 2019-04-29 通信方法和装置
CN201910356343.4 2019-04-29

Publications (1)

Publication Number Publication Date
WO2020220903A1 true WO2020220903A1 (zh) 2020-11-05

Family

ID=72965375

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/082105 WO2020220903A1 (zh) 2019-04-29 2020-03-30 通信方法和装置

Country Status (2)

Country Link
CN (1) CN111866871B (zh)
WO (1) WO2020220903A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112311543A (zh) * 2020-11-17 2021-02-02 中国联合网络通信集团有限公司 Gba的密钥生成方法、终端和naf网元
WO2022174729A1 (zh) * 2021-02-20 2022-08-25 华为技术有限公司 保护身份标识隐私的方法与通信装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112672345B (zh) * 2019-09-30 2023-02-10 华为技术有限公司 通信认证方法和相关设备
WO2023245388A1 (zh) * 2022-06-20 2023-12-28 北京小米移动软件有限公司 安全通信方法及装置
CN118139044A (zh) * 2022-12-02 2024-06-04 中国移动通信有限公司研究院 终端认证验证方法及终端认证验证装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101656956A (zh) * 2008-08-22 2010-02-24 华为技术有限公司 一种接入3gpp网络的方法、系统和网关
WO2017209746A1 (en) * 2016-06-01 2017-12-07 Intel IP Corporation User equipment (ue) and methods for reception of downlink data services

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI20050384A0 (fi) * 2005-04-14 2005-04-14 Nokia Corp Geneerisen todentamisarkkitehtuurin käyttö Internet-käytäntöavainten jakeluun matkaviestimissä
US7626963B2 (en) * 2005-10-25 2009-12-01 Cisco Technology, Inc. EAP/SIM authentication for mobile IP to leverage GSM/SIM authentication infrastructure
US9350550B2 (en) * 2013-09-10 2016-05-24 M2M And Iot Technologies, Llc Power management and security for wireless modules in “machine-to-machine” communications
CN109089288B (zh) * 2017-06-14 2020-12-25 华为技术有限公司 一种数据传输的方法和设备
CN109560919B (zh) * 2017-09-27 2021-02-09 华为技术有限公司 一种密钥衍生算法的协商方法及装置

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101656956A (zh) * 2008-08-22 2010-02-24 华为技术有限公司 一种接入3gpp网络的方法、系统和网关
WO2017209746A1 (en) * 2016-06-01 2017-12-07 Intel IP Corporation User equipment (ue) and methods for reception of downlink data services

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on authentication and key management for applications; based on 3GPP credential in 5G (Release 16", 3GPP TR 33.835, 31 March 2019 (2019-03-31), pages 9 - 10; 24-29, Retrieved from the Internet <URL:www.3gpp.org> *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112311543A (zh) * 2020-11-17 2021-02-02 中国联合网络通信集团有限公司 Gba的密钥生成方法、终端和naf网元
CN112311543B (zh) * 2020-11-17 2023-04-18 中国联合网络通信集团有限公司 Gba的密钥生成方法、终端和naf网元
WO2022174729A1 (zh) * 2021-02-20 2022-08-25 华为技术有限公司 保护身份标识隐私的方法与通信装置

Also Published As

Publication number Publication date
CN111866871A (zh) 2020-10-30
CN111866871B (zh) 2021-11-26

Similar Documents

Publication Publication Date Title
WO2020220903A1 (zh) 通信方法和装置
US20200213290A1 (en) Authorization method and network element
JP6371644B2 (ja) 単一の登録手順を使用するクライアントのグループの安全な登録
RU2663972C1 (ru) Обеспечение безопасности при связи между устройством связи и сетевым устройством
EP3668042B1 (en) Registration method and apparatus based on service-oriented architecture
US10694376B2 (en) Network authentication method, network device, terminal device, and storage medium
CN110891271B (zh) 一种鉴权方法及装置
WO2020088026A1 (zh) 一种基于通用引导架构gba的认证方法及相关设备
US8908865B2 (en) Session key generation and distribution with multiple security associations per protocol instance
US20080016230A1 (en) User equipment credential system
WO2015061977A1 (en) User authentication
KR20200003108A (ko) 키 생성 방법, 사용자 장비, 장치, 컴퓨터 판독가능 저장 매체, 및 통신 시스템
US20070124587A1 (en) Re-Keying in a Generic Bootstrapping Architecture Following Handover of a Mobile Terminal
US20210165885A1 (en) Extended Authentication Method And Apparatus For Generic Bootstrapping Architecture, And Storage Medium
CN116546491A (zh) 在通信网络中用于与服务应用的加密通信的锚密钥生成和管理的方法、设备和系统
TW202142010A (zh) 用戶資料更新方法、裝置、節點和儲存媒體
WO2021063304A1 (zh) 通信认证方法和相关设备
CN114946153A (zh) 与服务应用进行加密通信的通信网络中的应用密钥生成与管理的方法、设备及系统
Sharma et al. Improved IP multimedia subsystem authentication mechanism for 3G-WLAN networks
Ouaissa et al. An efficient and secure authentication and key agreement protocol of LTE mobile network for an IoT system
US8571211B2 (en) Method and apparatus for generating security key in a mobile communication system
CN110881020B (zh) 一种用户签约数据的鉴权方法及数据管理网元
US8036222B1 (en) Method for obtaining a mobile internet protocol address
US20190149326A1 (en) Key obtaining method and apparatus
US20240073685A1 (en) Method for authentication for nswo service, device, and storage medium

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20799234

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20799234

Country of ref document: EP

Kind code of ref document: A1