WO2020238595A1 - 获取安全上下文的方法、装置和通信系统 - Google Patents

获取安全上下文的方法、装置和通信系统 Download PDF

Info

Publication number
WO2020238595A1
WO2020238595A1 PCT/CN2020/089621 CN2020089621W WO2020238595A1 WO 2020238595 A1 WO2020238595 A1 WO 2020238595A1 CN 2020089621 W CN2020089621 W CN 2020089621W WO 2020238595 A1 WO2020238595 A1 WO 2020238595A1
Authority
WO
WIPO (PCT)
Prior art keywords
amf
request message
security context
registration request
user equipment
Prior art date
Application number
PCT/CN2020/089621
Other languages
English (en)
French (fr)
Other versions
WO2020238595A8 (zh
Inventor
李飞
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to SG11202112749TA priority Critical patent/SG11202112749TA/en
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020217043061A priority patent/KR102568230B1/ko
Priority to CN202080036772.4A priority patent/CN114145032B/zh
Priority to CA3141367A priority patent/CA3141367A1/en
Priority to BR112021024023A priority patent/BR112021024023A2/pt
Priority to EP20814989.8A priority patent/EP3796696B1/en
Priority to MX2021014521A priority patent/MX2021014521A/es
Priority to JP2021570947A priority patent/JP7210779B2/ja
Priority to AU2020284886A priority patent/AU2020284886B2/en
Publication of WO2020238595A1 publication Critical patent/WO2020238595A1/zh
Priority to US17/114,812 priority patent/US11818578B2/en
Publication of WO2020238595A8 publication Critical patent/WO2020238595A8/zh
Priority to US18/485,137 priority patent/US20240040380A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/65—Environment-dependent, e.g. using captured environmental data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/14—Reselecting a network or an air interface
    • H04W36/144—Reselecting a network or an air interface over a different radio air interface technology
    • H04W36/1443—Reselecting a network or an air interface over a different radio air interface technology between licensed networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems

Definitions

  • the present invention relates to the field of communication, and more specifically, to a method, device, and communication system for obtaining a security context.
  • a possible handover scenario is that the user equipment is switched from the 4th generation (4G) communication system to the 5G communication system.
  • the access network equipment is partially connected to the 4G network.
  • the equipment is switched to 5G access network equipment, and the core network equipment part is switched from 4G core network equipment to 5G core network equipment.
  • the handover of the core network equipment part includes the core network elements that provide mobile management services for user equipment.
  • the handover is from the mobility management entity (MME) in the 4G communication system to the access and mobility management function (AMF) in the 5G communication system.
  • MME mobility management entity
  • AMF mobility management function
  • the 5G communication system When the existing user equipment switches from a 4G communication system to a 5G communication system, in addition to the AMF (first AMF) selected by the MME, the 5G communication system also includes an AMF (second AMF) that stores the security context of the user equipment. AMF). At this time, how the first AMF obtains the security context of the user equipment from the second AMF becomes an urgent problem to be solved.
  • AMF AMF
  • the present application provides a method, device, and communication system for obtaining a security context, which protects the integrity of the second registration request message sent by the first AMF to the second AMF based on the local security context between the user equipment and the second AMF , So that the second AMF can verify the integrity of the second registration request message based on the local security context between the user equipment and the second AMF, thereby improving the possibility that the second AMF will successfully verify the second registration request message. If the verification is successful, the first AMF can successfully obtain the security context of the user equipment from the second AMF.
  • a method for obtaining a security context including: a first access and mobility management function AMF receives a first registration request message sent by a user equipment, and the first registration request message carries a second registration request message , The second registration request message is integrity protected by a first security context, and the first security context is a local security context between the user equipment and a second AMF, and the first AMF is After the user equipment is switched from the 4G communication system to the 5G communication system, the AMF that provides access and mobility management services for the user equipment; the first AMF sends the second registration request message to the second AMF; The second AMF verifies the integrity of the second registration request message; if the second AMF successfully verifies the integrity of the second registration request message, the second AMF sends to the first AMF The security context of the user equipment.
  • the security context of the user equipment is saved between the user equipment and the second AMF before the switching, and the user equipment switches from the 4G After the communication system is switched to the 5G communication system, the first AMF provides access and mobility management services for the user equipment.
  • the first AMF needs to obtain the aforementioned user equipment security context from the second AMF.
  • the user equipment may be After receiving the handover command, perform integrity protection on the fourth registration request message based on the security context stored locally with the second AMF, generate a second registration request message, send the first registration request message to the first AMF, and The second registration request message is carried in the first registration request message so that the first AMF can forward the second registration request message to the second AMF, and the second AMF can verify the integrity of the second registration request message, After the second AMF successfully verifies the integrity of the second registration request message, it can return the security context of the user equipment to the first AMF, which can improve the possibility that the first AMF successfully obtains the security context of the user equipment from the second AMF .
  • the security context of the user equipment includes: the first security context, or a second security context acquired based on the first security context.
  • the security context of the user equipment may be the local security context between the user equipment and the second AMF, or, when the second AMF performs key derivation, a new key is generated
  • the above-mentioned security context of the user equipment may also be a second security context generated by key derivation based on the first security context.
  • the sending of the second registration request message by the first AMF to the second AMF includes: sending by the first AMF to the second AMF A user equipment context transmission service invocation request, where the user equipment context transmission service invocation request carries the second registration request message.
  • the first AMF sending the above-mentioned second registration request message to the second AMF may include the second registration in the user equipment context transmission service invocation request sent by the first AMF to the second AMF Request message.
  • the second AMF sending the security context of the user equipment to the first AMF includes: sending the second AMF to the first AMF A first response message, where the first response message carries the security context of the user equipment.
  • the second AMF when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the security context of the user device when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the method further includes: when the first AMF receives a message that the second AMF fails to verify the integrity of the second registration request message At this time, the first AMF continues to use the mapped security context or initiates initial authentication to the user equipment.
  • the first AMF when the first AMF fails to obtain the security context of the user equipment from the second AMF, the first AMF may continue to use the mapped security context generated through negotiation with the user equipment Or, the first AMF may initiate initial authentication to the user equipment to generate a security context between the first AMF and the user equipment.
  • the mapped security context is obtained according to the security context between the mobility management entity MME and the user equipment; wherein the MME is the 4G communication The network elements of the system.
  • the mapped security context involved in the method for acquiring the security context refers to the security context generated by the user equipment and the first AMF based on the security context between the user equipment and the MME, respectively.
  • the second AMF checking the integrity of the second registration request message includes: the second AMF checks the integrity of the second AMF with the The local security context between the user equipment verifies the integrity of the second registration request message.
  • a method for obtaining a security context including: a second access and mobility management function AMF receives a second registration request message sent by a first AMF, and the second registration request message is performed by the first security context Over integrity protection, the first security context is the local security context between the user equipment and the second AMF, and the first AMF is the user equipment after the user equipment switches from the 4G communication system to the 5G communication system.
  • the user equipment provides an AMF for access and mobility management services; the second AMF verifies the integrity of the second registration request message; if the second AMF verifies the integrity of the second registration request message successfully , The second AMF sends the security context of the user equipment to the first AMF.
  • the first AMF provides access and mobility management services for the user equipment.
  • the first AMF needs to obtain the aforementioned user equipment security context from the second AMF.
  • the user equipment may be After receiving the handover command, the fourth registration request message is integrity protected based on the security context stored locally with the second AMF, and then the second registration request message is generated.
  • the UE sends the first registration request to the first AMF.
  • the message carries the second registration request message, so that the first AMF can forward the second registration request message to the second AMF, and the second AMF can verify the integrity of the second registration request message and verify the second registration. If the integrity of the request message is successful, sending the security context of the user equipment to the first AMF can improve the possibility that the first AMF successfully obtains the security context of the user equipment from the second AMF.
  • the security context of the user equipment includes: the first security context, or the second security generated by key derivation based on the first security context Context.
  • the security context of the user equipment may be the local security context between the user equipment and the second AMF, or, when the second AMF performs key derivation, a new key is generated
  • the above-mentioned security context of the user equipment may also be a second security context generated by key derivation based on the first security context.
  • the second AMF receiving the second registration request message sent by the first AMF includes: the second AMF receiving the first AMF The sent user equipment context transmission service invocation request, where the user equipment context transmission service invocation request carries the second registration request message.
  • the first AMF sending the above-mentioned second registration request message to the second AMF may include the second registration in the user equipment context transmission service invocation request sent by the first AMF to the second AMF Request message.
  • the second AMF sending the security context of the user equipment to the first AMF includes: sending the second AMF to the first AMF A first response message, where the first response message carries the security context of the user equipment.
  • the second AMF when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the security context of the user device when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the second AMF checking the integrity of the second registration request message includes: the second AMF checks the integrity of the second registration request message according to the first security context. The integrity of the second registration request message is verified.
  • a method for obtaining a security context which includes: a user equipment determines that a second registration request message is integrity protected, and the second registration request message is integrity protected by the first security context, wherein The first security context is the local security context between the user equipment and the second access and mobility management function AMF; the user equipment sends a first registration request message to the first access and mobility management function AMF, and The first registration request message carries a second registration request message, where the first AMF is an AMF that provides access and mobility management services for the user equipment after the user equipment switches from a 4G communication system to a 5G communication system .
  • the security context of the user equipment is stored between the user equipment and the second AMF before the handover, and the security of the user equipment is Context
  • the user equipment may, after receiving the handover command, perform integrity protection on the fourth registration request message based on the security context stored locally with the second AMF, and then generate the second registration request message, and the UE may send a message to the first
  • the first registration request message sent by the AMF carries the second registration request message, so that the first AMF can forward the second registration request message to the second AMF, and the second AMF can verify the integrity of the second registration request message After successfully verifying the integrity of the second registration request message, the second AMF
  • the method further includes: if a non-access stratum security mode command NAS SMC message sent by the first AMF is received, performing an operation on the NAS SMC Complete verification; if the verification is successful, a non-access stratum security mode completion message is sent to the first AMF.
  • the user equipment if the user equipment receives the NAS SMC message sent by the first AMF, and the user equipment successfully verifies the NAS SMC message, the user equipment sends the non-access layer security to the first AMF Mode complete message.
  • a method for obtaining a security context including: a first access and mobility management function AMF receives a first registration request message sent by a user equipment, and the first registration request message carries a second registration request message , The second registration request message is integrity protected by a first security context, and the first security context is a local security context between the user equipment and a second AMF, and the first AMF is After the user equipment is switched from the 4G communication system to the 5G communication system, the AMF that provides access and mobility management services for the user equipment; the first AMF sends the second registration request message to the second AMF; if If the second AMF successfully verifies the integrity of the second registration request message, the first AMF receives the security context of the user equipment sent by the second AMF.
  • the first AMF provides access and mobility management services for the user equipment.
  • the first AMF needs to obtain the aforementioned user equipment security context from the second AMF.
  • the user equipment may be After receiving the handover command, the fourth registration request message is integrity protected based on the security context stored locally with the second AMF, and then the second registration request message is generated.
  • the UE sends the first registration request to the first AMF.
  • the message carries the second registration request message, so that the first AMF can forward the second registration request message to the second AMF, the second AMF can verify the integrity of the second registration request message, and the second AMF can verify the integrity of the second registration request message. 2.
  • the security context of the user equipment can be returned to the first AMF, which can improve the possibility that the first AMF successfully obtains the security context of the user equipment from the second AMF.
  • the security context of the user equipment includes: the first security context, or the second security generated by key derivation based on the first security context Context.
  • the security context of the user equipment may be the local security context between the user equipment and the second AMF, or, when the second AMF performs key derivation, a new key is generated
  • the above-mentioned security context of the user equipment may also be a second security context generated by key derivation based on the first security context.
  • the sending of the second registration request message by the first AMF to the second AMF includes: sending by the first AMF to the second AMF A user equipment context transmission service invocation request, where the user equipment context transmission service invocation request carries the second registration request message.
  • the first AMF sending the above-mentioned second registration request message to the second AMF may include the second registration in the user equipment context transmission service invocation request sent by the first AMF to the second AMF Request message.
  • the receiving, by the first AMF, the security context of the user equipment sent by the second AMF includes: receiving the second AMF by the first AMF A sent first response message, where the first response message carries the security context of the user equipment.
  • the second AMF when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the security context of the user device when the second AMF returns the aforementioned security context of the user equipment to the first AMF, it may send a first response message to the first AMF, and carry the foregoing in the first response message.
  • the method further includes: when the first AMF receives a message that the second AMF fails to verify the integrity of the second registration request message At this time, the first AMF continues to use the mapped security context or initiates initial authentication to the user equipment.
  • the first AMF when the first AMF fails to obtain the security context of the user equipment from the second AMF, the first AMF may continue to use the mapped security context generated through negotiation with the user equipment Or, the first AMF may initiate initial authentication to the user equipment to generate a security context between the first AMF and the user equipment.
  • the mapped security context is obtained according to the security context between the mobility management entity MME and the user equipment, where the MME is the 4G Network element in the communication system.
  • the mapped security context involved in the method for acquiring the security context refers to the security context generated by the user equipment and the first AMF based on the security context between the user equipment and the MME, respectively.
  • a method for obtaining a security context including: the first access and mobility management function AMF sends a user equipment context transmission service invocation request to the second AMF, and the user equipment context transmission service invocation request is used to obtain The security context of the user equipment, the user equipment context transmission service invocation request carries indication information, and the indication information is used to indicate that the user equipment is a legal user equipment, wherein the first AMF is the user equipment slave After the 4G communication system is switched to the 5G communication system, the AMF that provides access and mobility management services for the user equipment; the first AMF receives the second response message sent by the second AMF, and the second response message Carry the security context of the user equipment.
  • the first AMF carries the UE indication information indicating that the UE is legitimate in the user equipment context transmission service invocation request sent to the second AMF, which can prevent the second AMF from verifying the UE Failure causes the second AMF not to send the security context of the UE to the first AMF, which improves the possibility that the first AMF successfully obtains the security context of the user equipment from the second AMF.
  • the indication information used to indicate that the user equipment is a legitimate user equipment includes: the indication information used to indicate that the registration request message completes the integrity check; Wherein, the registration request message is received by the first AMF from the user equipment.
  • the indication information sent by the first AMF to the second AMF indicating that the UE is a legitimate UE may be the first AMF notifying the second AMF to verify the integrity of the registration request message sent by the UE. Passing the inspection provides a flexible and optional solution for instructing the UE to be a legitimate UE.
  • the method before the first AMF sends the user equipment context transmission service invocation request to the second AMF, the method further includes: the first AMF successfully verifies Integrity protection of the registration request message, wherein the registration request message is received by the first AMF from the user equipment; and/or the first AMF determines that the registration request message is the The registration request message sent after the user equipment switches from the 4G communication system to the 5G communication system.
  • the first AMF is based on the result of the successful verification of the registration request message, and/or the received registration request message, for the user equipment to switch from the 4G communication system to the 5G communication
  • the registration request message sent by the system later determines the user equipment context transmission service invocation request that can be sent to the second AMF.
  • the user equipment context transfer service invocation request carries the user equipment identifier.
  • the user equipment in order for the first AMF to know that the second AMF needs to obtain the security context of the user equipment of a certain user equipment, the user equipment is carried in the context transmission service invocation request.
  • the identification of the device in order for the first AMF to know that the second AMF needs to obtain the security context of the user equipment of a certain user equipment.
  • the user equipment context transmission service invocation request carries the uplink non-access stratum counter UL NAS COUNT of the user equipment.
  • the second AMF in order for the first AMF to obtain the UL NAS COUNT, may carry the UL NAS COUNT in the context transmission service invocation request.
  • the UL NAS COUNT carried in the user equipment context transmission service invocation request includes: the user equipment context transmission service invocation request carries a registration request message in plain text
  • the registration request message in plain text includes the UL NAS COUNT, where the registration request message is received by the first AMF from the user equipment.
  • the UL NAS COUNT carried in the user equipment context transmission service invocation request can be achieved by carrying a clear text registration request message in the user equipment context transmission service invocation request.
  • Including the UL NAS COUNT provides a flexible and optional solution for the first AMF to send the UL NAS COUNT to the second AMF.
  • a method for obtaining a security context including: a second access and mobility management function AMF receives a user equipment context transmission service invocation request sent by a first AMF, and the user equipment context transmission service invocation request is used for Acquire the security context of the user equipment, the user equipment context transmission service invocation request carries indication information, and the indication information is used to indicate that the user equipment is a legitimate user equipment, where the first AMF is the user equipment After switching from a 4G communication system to a 5G communication system, an AMF that provides access and mobility management services for the user equipment; the second AMF sends a second response message to the first AMF, and the second response message contains Carry the security context of the user equipment.
  • the second AMF receives the user equipment context transmission service invocation request sent by the first AMF and carries the UE indication information indicating that the UE is legal.
  • the second AMF does not need to be based on the indication information. Verifying the UE can prevent the second AMF from failing to verify the UE without sending the security context of the UE to the first AMF, and improve the possibility that the first AMF successfully obtains the security context of the user equipment from the second AMF.
  • the indication information used to indicate that the user equipment is a legitimate user equipment includes: the indication information used to indicate that the registration request message completes the integrity check; Wherein, the registration request message is received by the first AMF from the user equipment.
  • the indication information sent by the first AMF received by the second AMF indicating that the UE is a legitimate UE may be the complete registration request message sent by the UE from the first AMF to notify the second AMF Passing the sexual verification provides a flexible and optional solution for instructing the UE to be a legitimate UE.
  • the user equipment context transmission service invocation request carries the identifier of the user equipment.
  • the second AMF may determine that what the first AMF needs to obtain is the security context of the user equipment of the user equipment based on the identity of the user equipment carried in the context transmission service invocation request.
  • the user equipment context transmission service invocation request carries the uplink non-access stratum counter UL NAS COUNT of the user equipment.
  • the second AMF may obtain the UL NAS COUNT carried in the service invocation request based on the context transmission.
  • the UL NAS COUNT carried in the user equipment context transmission service invocation request includes: a registration request message in plain text carried in the user equipment context transmission service invocation request
  • the registration request message in plain text includes the UL NAS COUNT, where the registration request message is received by the first AMF from the user equipment.
  • the UL NAS COUNT carried in the user equipment context transmission service invocation request can be achieved by carrying a clear text registration request message in the user equipment context transmission service invocation request.
  • Including the UL NAS COUNT provides a flexible and optional solution for the first AMF to send the UL NAS COUNT to the second AMF.
  • the method further includes: the second AMF performs key derivation based on the UL NAS COUNT.
  • the second AMF may perform key derivation based on the received UL NAS COUNT.
  • a communication system in a seventh aspect, includes the above-mentioned first AMF and second AMF, which can be used to implement the first aspect and the first AMF and the first AMF in any possible implementation of the first aspect. 2. Operation of AMF. Specifically, the communication system may include the steps or functions corresponding to the steps or functions described in the first aspect and any possible implementation of the first aspect, which may be the first AMF and the first aspect of the first aspect. Two AMF or chips or functional modules inside the first AMF and the second AMF. The steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.
  • a device for acquiring a security context which can be used to perform the operation of the first AMF in any possible implementation of the fifth and fourth aspects and the fifth and fourth aspects .
  • the device for acquiring a security context may include means corresponding to the steps or functions described in the fifth and fourth aspects and any possible implementation of the first and fourth aspects. It may be the first AMF of the fifth aspect and the fourth aspect or the chip or functional module inside the first AMF.
  • the steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.
  • a device for acquiring a security context which can be used to perform the second AMF operation in the second aspect and the sixth aspect and any possible implementation of the second and sixth aspects .
  • the device for acquiring a security context may include means corresponding to the steps or functions described in the foregoing second aspect and sixth aspect, and any possible implementation of the second aspect and sixth aspect. It may be the second AMF of the second aspect and the sixth aspect or the chip or functional module inside the second AMF.
  • the steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.
  • an apparatus for acquiring a security context is provided, and the apparatus can be used to perform the operation of the user equipment in the third aspect.
  • the device for acquiring the security context may include a component (means) for executing the steps or functions described in the third aspect above, which may be the user equipment in the third aspect or a chip or functional module inside the user equipment.
  • the steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.
  • a communication device including a processor, a transceiver, and a memory
  • the memory is used to store a computer program
  • the transceiver is used to execute any one of the possible implementation manners of the first to fifth aspects
  • the processor is used to call and run the computer program from the memory, so that the communication device executes the acquiring security context in any one of the possible implementation manners of the first to sixth aspects The device method.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory and the processor may be provided separately.
  • the transceiver includes a transmitter (transmitter) and a receiver (receiver).
  • a system in a twelfth aspect, includes the devices for acquiring security context provided in the eighth and ninth aspects.
  • a computer program product includes: a computer program (also called code, or instruction), which when the computer program is executed, causes the computer to execute any of the first to sixth aspects.
  • a computer program also called code, or instruction
  • a computer-readable medium stores a computer program (also called code, or instruction) when it runs on a computer, so that the computer executes the first to sixth aspects above Any one of the possible implementation methods.
  • a chip system including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory so that the communication device installed with the chip system executes The method in any one of the possible implementation manners of the foregoing first to sixth aspects.
  • Figure 1 is a network architecture suitable for an embodiment of the present application.
  • Figure 2 is a schematic flow chart of a communication system handover.
  • Fig. 3 is a schematic diagram of a method for obtaining a security context provided by an embodiment of the present application.
  • Fig. 4 is a schematic diagram of another method for obtaining a security context provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an apparatus 50 for acquiring a security context provided by an embodiment of the application.
  • FIG. 6 is a schematic structural diagram of a user equipment 60 applicable to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of an apparatus 70 for acquiring a security context provided by an embodiment of the application.
  • FIG. 8 is a schematic structural diagram of a first AMF 80 applicable to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a device 90 for acquiring a security context provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of a second AMF 100 applicable to an embodiment of the present application.
  • GSM global system for mobile communications
  • CDMA code division multiple access
  • WCDMA broadband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE Time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • FIG. 1 is a network architecture suitable for an embodiment of the present application. As shown in Figure 1, the various parts involved in the network architecture are described below.
  • User equipment (UE) 110 It can include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of terminals.
  • Mobile station mobile station, MS
  • terminal terminal
  • soft terminal etc.
  • water meters electricity meters, sensors, etc.
  • (Radio access network, (R)AN) network element 120 used to provide network access functions for authorized user equipment in a specific area, and can use different qualities according to the level of user equipment, service requirements, etc. Transmission tunnel.
  • (R)AN network elements can manage wireless resources, provide access services for user equipment, and then complete the forwarding of control signals and user equipment data between user equipment and the core network.
  • (R)AN network elements can also be understood as traditional networks Base station in.
  • User plane network element 130 used for packet routing and forwarding and quality of service (QoS) processing of user plane data, etc.
  • QoS quality of service
  • the user plane network element may be a user plane function (UPF) network element.
  • UPF user plane function
  • the user plane network element may still be a UPF network element, or may also have other names, which is not limited in this application.
  • Data network element 140 used to provide a network for transmitting data.
  • the data network element may be a data network (DN) network element.
  • DN data network
  • the data network network element may still be a DN network element, or may also have other names, which is not limited in this application.
  • Access and mobility management network element 150 Mainly used for mobility management and access management, etc., and can be used to implement other functions other than session management in the mobility management entity (mobility management entity, MME) function, such as , Legal monitoring and access authorization/authentication functions.
  • mobility management entity MME
  • the access and mobility management network element may be an access and mobility management function (AMF).
  • AMF access and mobility management function
  • the access and mobility management equipment may still be AMF, or may also have other names, which are not limited by this application.
  • Session management network element 160 Mainly used for session management, user equipment Internet Protocol (IP) address allocation and management, selection of end points that can manage user plane functions, policy control and charging function interfaces, and downlink Data notification, etc.
  • IP Internet Protocol
  • the session management network element may be a session management function (session management function, SMF) network element.
  • SMF session management function
  • the session management network element may still be an SMF network element, or may also have other names, which is not limited in this application.
  • Policy control network element 170 a unified policy framework used to guide network behavior, and provide policy rule information for control plane function network elements (such as AMF, SMF network elements, etc.).
  • the policy control network element may be a policy and charging rules function (PCRF) network element.
  • the policy control network element may be a policy control function (PCF) network element.
  • PCF policy control function
  • the policy control network element may still be a PCF network element, or may also have other names, which is not limited in this application.
  • Authentication server 180 used for authentication services, generating keys to realize two-way authentication of user equipment, and supporting a unified authentication framework.
  • the authentication server may be an authentication server function (authentication server function, AUSF) network element.
  • the authentication server function network element may still be an AUSF network element, or may have other names, which is not limited by this application.
  • Data management network element 190 used to process user equipment identification, access authentication, registration, and mobility management.
  • the data management network element may be a unified data management (UDM) network element; in a 4G communication system, the data management network element may be a home subscriber server (HSS) network In the future communication system, the unified data management can still be a UDM network element, or it can have other names, which is not limited in this application.
  • UDM unified data management
  • HSS home subscriber server
  • Application network element 1100 used for data routing affected by applications, access to network open function network elements, interaction with policy frameworks for policy control, etc.
  • the application network element may be an application function (AF) network element.
  • AF application function
  • the application network element may still be an AF network element, or may also have other names, which is not limited in this application.
  • Network storage network element used to maintain real-time information of all network functions and services in the network.
  • the network storage network element may be a network repository function (NRF) network element.
  • NRF network repository function
  • the network storage network element may still be an NRF network element, or may also have other names, which are not limited by this application.
  • the foregoing network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (for example, a cloud platform).
  • the access and mobility management device is the AMF
  • the data management network element is the UDM network element
  • the session management network element is the SMF network element
  • the user plane network element is the UPF network element.
  • the device is an AMF entity and a UDM entity as examples to describe the method for establishing a session.
  • the implementation method of the device being a chip in the AMF entity and a chip in the UDM entity, refer to The specific descriptions of the devices being the AMF entity and the UDM entity will not be repeated.
  • the user equipment is connected to the AMF through the N1 interface
  • (R)AN is connected to the AMF through the N2 interface
  • (R)AN is connected to the UPF through the N3 interface
  • UPF is connected through the N9 interface
  • UPF is interconnected through the N6 interface DN.
  • SMF controls UPF through the N4 interface.
  • AMF interfaces with SMF through N11 interface.
  • AMF obtains user equipment subscription data from the UDM unit through the N8 interface
  • SMF obtains user equipment subscription data from the UDM unit through the N10 interface.
  • network function network element entities such as AMF, SMF network elements, PCF network elements, BSF network elements, and UDM network elements are all called network function (NF) network elements; or, in another
  • NF network function
  • a collection of network elements such as AMF, SMF network elements, PCF network elements, BSF network elements, and UDM network elements can all be called control plane function network elements.
  • the user equipment in the embodiments of this application may refer to an access terminal, a user unit, a user station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal (user terminal), and terminal equipment (terminal equipment) , Terminal, wireless communication equipment, user agent or user device.
  • the user equipment can also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, user equipment in the future 5G network or future evolution of the public land mobile network (PLMN) User equipment, etc., which are not limited in this embodiment of the present application.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the network device in the embodiment of the present application may be any device with wireless transceiver function used to communicate with user equipment.
  • This equipment includes but is not limited to: evolved Node B (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC) , Base transceiver station (base transceiver station, BTS), home base station (home evolved NodeB, or home Node B, HNB), baseband unit (baseBand unit, BBU), wireless fidelity (wireless fidelity, WIFI) system access Point (access point, AP), wireless relay node, wireless backhaul node, transmission point (transmission point, TP) or transmission and reception point (transmission and reception point, TRP), etc., can also be 5G, such as NR, system GNB, or transmission point (TRP or TP), one or a group of antenna panels (including multiple antenna panels) of the base station in the 5G system, or, it can also be a network node that constitutes a gNB or transmission point, such as base
  • the gNB may include a centralized unit (CU) and a DU.
  • the gNB may also include an active antenna unit (AAU).
  • CU implements part of the functions of gNB
  • DU implements part of the functions of gNB.
  • the CU is responsible for processing non-real-time protocols and services, and implements radio resource control (radio resource control, RRC), packet data convergence protocol (packet data convergence protocol, PDCP) layer functions.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • the DU is responsible for processing physical layer protocols and real-time services, and realizes the functions of the radio link control (RLC) layer, media access control (MAC) layer, and physical (PHY) layer.
  • RLC radio link control
  • MAC media access control
  • PHY physical
  • the network device may be a device that includes one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into network equipment in an access network (radio access network, RAN), or the CU can be divided into network equipment in a core network (core network, CN), which is not limited in this application.
  • the user equipment or network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also referred to as main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiments of the application do not specifically limit the specific structure of the execution subject of the methods provided in the embodiments of the application, as long as the program that records the codes of the methods provided in the embodiments of the application can be provided according to the embodiments of the application.
  • the execution subject of the method provided in the embodiments of the present application may be user equipment or network equipment, or a functional module in the user equipment or network equipment that can call and execute programs.
  • various aspects or features of the present application can be implemented as methods, devices, or products using standard programming and/or engineering techniques.
  • article of manufacture as used in this application encompasses a computer program accessible from any computer-readable device, carrier, or medium.
  • computer-readable media may include, but are not limited to: magnetic storage devices (for example, hard disks, floppy disks, or tapes, etc.), optical disks (for example, compact discs (CD), digital versatile discs (DVD)) Etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.).
  • various storage media described herein may represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable storage medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.
  • the embodiments of the present application mainly relate to the mobility management entity MME when the network architecture shown in FIG. 1 is a 4G network architecture, and the access and mobility management functions AMF and UE when the network architecture shown in FIG. 1 is a 5G network architecture.
  • this application involves the first AMF and the second AMF.
  • the first AMF involved in this application refers to the process in which the user equipment is switched from the 4G communication system to the 5G communication system.
  • the MME in the 4G communication system provides the core for the UE selected from the 5G communication system.
  • Network service AMF; the second AMF involved in this application refers to the process of user equipment handover from the 4G communication system to the 5G communication system, except for the first AMF in the 5G communication system, which saves the security context of the UE AMF.
  • first and second in this application are only used for distinguishing description, and should not constitute any limitation to this application.
  • first AMF and second AMF only distinguish different AMFs.
  • FIG. 2 is a schematic flowchart of a communication system switching. Including UE, MME, first AMF and second AMF.
  • the communication system handover includes the following steps:
  • the MME sends a forward relocation request (forward relocation request) message to the first AMF.
  • the MME in the 4G communication system learns that the user equipment is switched from the 4G communication system to the 5G communication system, and needs to select the first AMF in the 5G communication system for the UE to continue to provide access and mobility management services for the UE.
  • the UE accesses in the 4G communication system
  • the UE and the MME will get the same key K ASME .
  • the MME selects the first AMF and combines the K ASME with the next The hop parameter (next hop parameter, NH) is sent to the first AMF, that is, the aforementioned forwarding reallocation request message carries parameters such as K ASME and NH.
  • the MME learns that the system handover has occurred.
  • the base station in the 4G communication system may send a handover request to the MME, so that the MME knows that the user equipment needs to be handed over from the 4G communication system to the 5G communication system.
  • the MME stores at least one AMF configured by the operator, and when the MME learns that the user equipment needs to switch from a 4G communication system to a 5G communication system, the MME selects the aforementioned first AMF from the at least one AMF.
  • the first AMF determines a mapped security context.
  • the first AMF derives the mapped security context according to parameters such as K ASME and NH carried in the received reallocation request message, and the mapped security context is included in the mapped context of the UE.
  • the mapping context involved in this application refers to the first AMF and the UE respectively based on the context generated by negotiation between the UE and the MME in the 4G communication system to derive the security context of the UE, and how to derive based on the 4G context You can refer to the provisions of the existing protocol. This application does not limit this process.
  • the mapped security context refers to the security context obtained by the first AMF and the UE respectively according to the security context between the MME and the user equipment.
  • the context negotiated between the UE and the MME in the 4G communication system involved in this application includes the security context between the UE and the MME, which can also be referred to as the 4G context of the UE in order to distinguish;
  • the UE Before the UE involved is switched from the 4G communication system to the 5G communication system, the UE’s security context stored in the UE and the second AMF refers to the context negotiated between the UE and the second AMF in the 5G communication system, including the context between the UE and the AMF In order to distinguish the security context, it can also be called the 5G context of the UE.
  • the security context derived by the first AMF and the UE respectively according to the security context between the MME and the user equipment is referred to as the mapped security context
  • the security context between the second AMF and the UE is referred to as Native (native) security context.
  • the embodiments of this application mainly involve the second AMF sending the security context of the UE to the first AMF, and the security context of the UE, as a part of the context of the UE, can be passed along with the transfer of the context of the UE, so
  • the description in the embodiment of this application may be the context of the sending UE, or the description in the embodiment of this application may be the security context of the sending UE, which is merely a simplification of description and does not constitute the protection scope of the embodiments of this application. Any restrictions.
  • the above-mentioned first AMF derives the mapped security context of the UE according to parameters such as K ASME and NH carried in the received reallocation request message, including the first AMF deriving the key K AMF1 based on K ASME and NH.
  • the first AMF calculates the integrity protection key K NASint1 and the confidentiality protection key K NASenc1 based on the key K AMF1 and the security algorithm negotiated with the UE, where K AMF1 , K NASint1 and K NASenc1 are included in the UE’s security context K AMF1 , K NASint1, and K NASenc1 are derived based on K ASME and NH.
  • K ASME and NH are the security contexts between UE and MME, so K AMF1 , K NASint1, and K NASenc1 are called UE mapping Security context.
  • the first AMF sends a forward relocation response (forward relocation response) message to the MME.
  • the first AMF determines the mapped security context, it sends a forwarding reallocation response message to the MME, where the forwarding reallocation response message is used to notify the MME that the first AMF can be used as a UE to switch from a 4G communication system to a 5G communication system, AMF that provides access and mobility management services for UEs in 5G communication systems.
  • S240 The MME sends a handover command (handover command) message to the UE.
  • the MME After the MME receives the forwarding redistribution response message sent by the first AMF, and knows that the first AMF can provide access and mobility management services for the UE, the MME sends a handover command message to the UE so that the UE knows that it can switch from the 4G communication system to 5G Communication Systems.
  • S250 The UE determines the mapped security context.
  • the UE After the UE receives the handover command message, it calculates the key K AMF1 based on the preset derivation formula for the keys K ASME and NH stored in the UE.
  • the specific derivation process is shown in the above S220, which will not be repeated here.
  • the same key K AMF1 is obtained between the UE and the first AMF, and the key K AMF1 can be used for the subsequent derivation of other keys.
  • the UE and the first AMF obtain the same key K AMF1 , and then based on K AMF1 , and the non-access stratum (NAS) integrity protection algorithm and confidentiality negotiated between the UE and the first AMF
  • the UE and the first AMF generate an integrity protection key K NASint1 and a confidentiality protection key K NASenc1 for the protection of NAS messages (such as registration request messages).
  • K NASint1 and K NASenc1 is as follows:
  • the UE After the handover is completed, the UE initiates mobility registration, that is, performs S260.
  • the UE sends a registration request (registration request) message to the first AMF, and the UE uses the mapped security context derived from the above-generated K AMF1 to register the
  • the request message is secured, where the security protection includes encryption protection and/or integrity protection.
  • the message sent by the UE to the core network device can be forwarded by the access network device. Since the function of the access device is not limited in the embodiment of this application, the access network device can forward the message between the UE and the first AMF. For convenience, the description in this application is that the UE sends a registration request message to the first AMF, and the MME sends a message to the UE.
  • the registration request message sent by the UE also includes the globally unique temporary user equipment identifier in the context of the mapping. (Globally unique temporary user equipment identity, GUTI).
  • the GUTI is used by the access network device to determine to forward the registration request message to the first AMF. Since the GUTI is included in the context of the mapping, the GUTI can be called the mapped GUTI.
  • the UE when the UE sends a registration request message to the first AMF, the UE’s security context with other AMFs (second AMF) and the 5G global unique temporary user equipment identifier (5th) of the user equipment are stored in the UE.
  • Second AMF AMF
  • 5th 5G global unique temporary user equipment identifier
  • the UE carries the 5G-GUTI in the aforementioned registration request message.
  • this application mainly involve the process of how the first AMF successfully obtains the security context of the UE from the second AMF. Therefore, this application mainly considers that when the UE sends a registration request message to the first AMF, the UE The security context and 5G-GUTI situation of the UE negotiated with the second AMF are stored in it.
  • the reason why the security context and 5G-GUTI of the UE are stored between the UE and the second AMF in the embodiment of the present application is not limited, and it may be a condition specified in the existing protocol. For example, it may be that the UE has switched from the 5G network communication system to the 4G communication system before the UE switches from the 4G communication system to the 5G communication system; or, the UE that supports dual connectivity accesses the 5G communication system through non-3GPP and at the same time through 3GPP After accessing the 4G communication system, the connection state switch from 4G communication system to 5G communication system occurs.
  • the first AMF needs to obtain the UE's security context from the second AMF. Specifically, the first AMF obtains the UE from the second AMF.
  • the security context of is determined based on the 5G-GUTI carried in the registration request message received from the UE.
  • the 5G-GUTI is configured by the second AMF for the UE and can be used to identify the UE and the second AMF.
  • the protocol stipulates that when the security context of the UE exists in the 5G communication system, the security context of the UE is preferentially used instead of the security context of the mapping determined through negotiation between the first AMF and the UE, because the security context of the mapping is based on the 4G communication system
  • the UE security context mapping between the UE and the MME is obtained, that is, the process shown in FIG. 2 also includes S270.
  • the first AMF initiates a user equipment context transfer service invocation request (Namf_Communication_UEContextTransfer).
  • the first AMF receives the registration request message sent by the UE, and initiates a user equipment context transmission service invocation request to the second AMF according to the 5G-GUTI carried in the registration request message, and the user equipment context transmission service invocation request carries the foregoing The registration request message.
  • the aforementioned registration request message is based on the security context of the mapping between the UE and the first AMF.
  • the second AMF determines whether to return the security of the UE to the first AMF according to the verification result of the registration request message. Context. That is, S290 is executed, and the second AMF verifies the registration request message.
  • a possible implementation is that the second AMF fails to verify the registration request message, and the second AMF will not return the security context of the UE to the first AMF, which eventually causes the first AMF to fail to obtain the security context of the UE from the second AMF. , The first AMF is unable to preferentially use the security context of the UE, which does not comply with the provisions of the protocol.
  • the second AMF transfers the security context of the UE to the first AMF and executes S291.
  • the second AMF sends the security context of the UE to the first AMF.
  • the second AMF can be described as the second AMF sending the UE context to the first AMF.
  • the UE context includes the UE’s security context determined through negotiation between the second AMF and the UE, and the UE’s security context includes the key K AMF2 and Non-access stratum count (NAS COUNT), etc.
  • the second AMF may perform key derivation on the key K AMF2 according to the local policy before transferring the security context of the UE. If the second AMF performs key derivation on K AMF2 , the derivation key K AMF2 'will be sent to the first AMF while carrying the derivation instruction information to indicate that the second AMF performed key derivation on K AMF2 play.
  • the key derivation described in this application may be horizontal key derivation
  • K AMF2 is generated as K AMF2 'through horizontal key deduction
  • K AMF2 ' HMAC-SHA-256(Key, S);
  • L0 length of P0(i.e.0x00 0x01);
  • L1 length of P1(i.e.0x00 0x04);
  • the key deduction described in this application may be a key deduction manner agreed between different network elements.
  • the first AMF and the second AMF agree that the key derivation method is a preset key derivation method.
  • the first AMF can determine The received key in the security context of the UE is obtained by the second AMF through key derivation through a preset key derivation method.
  • the first AMF After the first AMF receives the deduction instruction information, it will also send the deduction instruction information to the UE, instructing the UE to perform key deduction on the key K AMF2 to obtain the key K AMF2 ', so that the UE and the network side key agree , It should be understood that the UE can determine that the key K AMF2 is to be deduced instead of K AMF , because the UE has received the key identifier indicating the key K AMF2 , because this application identifies the key The symbol does not involve improvement, and the key identifier is not described in detail here.
  • an embodiment of the present application provides a method for obtaining the security context.
  • the first AMF carries indication information when obtaining the security context of the UE from the second AMF.
  • the indication information indicates that the UE has passed the verification, and the second AMF does not need to verify the UE according to the indication information, and just returns the security context of the UE directly, thereby avoiding the above-mentioned possibility of failure in obtaining the security context of the UE.
  • the verification of the UE involved in this application refers to the integrity check of the registration request message sent by the UE, for example, decrypting the registration request message and/or verifying the integrity of the registration request message. Since the prerequisite for passing the integrity verification of the registration request message is to successfully decrypt the registration request message, in the embodiment of the present application, the UE passing verification is described as passing the integrity verification of the registration request message.
  • Fig. 3 is a schematic diagram of a method for obtaining a security context provided by an embodiment of the present application.
  • the schematic diagram includes UE, MME, first AMF, and second AMF.
  • the method for obtaining a security context includes the following steps:
  • S310 The first AMF sends a second request message to the second AMF.
  • the second request message is used to request to obtain the security context of the UE, and the second request message carries indication information, and the indication information is used to indicate that the UE is a legitimate UE.
  • the indication information may be referred to as a cause value (value).
  • the first AMF determines that the UE is a legitimate UE mainly to determine whether the registration request message received from the UE meets a preset condition. It should be understood that before the first AMF sends the second request message to the second AMF, Figure 3 The method flow shown also includes S311-S316:
  • S311 The MME sends a forwarding redistribution request message to the first AMF, which is similar to S210 in FIG. 2, and will not be repeated here;
  • S312 The first AMF determines the mapped security context, which is similar to S220 in FIG. 2, and will not be repeated here;
  • the first AMF sends a forwarding redistribution response message to the MME, which is similar to S230 in FIG. 2, and will not be repeated here;
  • S314 The MME sends a handover command message to the UE, which is similar to S240 in FIG. 2, and will not be repeated here;
  • S315 The UE determines the mapped security context, which is similar to S250 in FIG. 2, and will not be repeated here;
  • S316 The UE sends a registration request message to the first AMF, which is similar to S260 in FIG. 2, and will not be repeated here.
  • the first AMF determining that the registration request message meets a preset condition includes:
  • the first AMF successfully verifies the integrity protection of the registration request message; or,
  • the first AMF determines that the registration request message is a registration request message sent after the UE switches from the 4G communication system to the 5G communication system. For example, if the first AMF receives the forwarding reallocation request message sent by the MME before receiving the registration request message sent by the UE, the first AMF can learn the currently received registration request message, which is received from the UE during the handover process The registration request message.
  • the first AMF successfully verifies the integrity protection of the registration request message can also be referred to as the first AMF to verify the UE successfully, that is, the method flow shown in FIG. 3 also includes S317, the first AMF verifies the UE.
  • the second request message is the user equipment context transfer service call request (Namf_Communication_UEContextTransfer) initiated by the first AMF shown in FIG. 2, which is different from the user equipment context transfer service call request shown in FIG.
  • an information element (information element, IE)-indication information is added to the user equipment context transmission service invocation request.
  • the second request message is another possible second request message sent by the first AMF to the second AMF for acquiring the security context of the UE.
  • the specific form of the second request message in this application is not limited. It may be the above-mentioned indication information added to the existing signaling between the first AMF and the second AMF, or it may be the first AMF. Newly added signaling between and the second AMF.
  • the first AMF needs to send the above-mentioned indication information to the second AMF before sending the user equipment context transmission service invocation request to the second AMF, that is, the first AMF An AMF can directly send indication information to the second AMF without the indication information being carried in the above-mentioned second request message.
  • This possible implementation is not shown in FIG. 3.
  • the indication information may be to reuse the 5G-GUTI of the above-mentioned UE.
  • the 5G-GUTI may identify the UE and may also be used to indicate that the UE is a legitimate UE.
  • IE adds a new indication function, which can notify the second AMF that the 5G-GUTI has a new function in a predefined way; another possible implementation is that the indication information can be at least one newly added bit.
  • the bit value is set to 1, indicating that the UE is a legal UE.
  • the above indication information is to explicitly indicate that the UE is a legal UE; or, as another possible implementation, the above indication information is to implicitly indicate that the UE is a legal UE, for example,
  • the indication information indicates that the integrity check of the registration request message received by the first AMF from the UE is passed.
  • the second request message also needs to carry the identity of the UE.
  • the identity of the UE may be the above-mentioned 5G-GUTI;
  • the identity of the UE may be a subscriber permanent identity (SUPI).
  • SUPI subscriber permanent identity
  • the first AMF receives the UE's 5G-GUTI from the UE, and determines that it needs to obtain the UE's security context from the second AMF, it can choose to continue to carry the UE's 5G-GUTI in the second request message, or, Carry the SUPI of the UE, or carry the 5G-GUTI of the UE and the SUPI of the UE.
  • the second request message carries a registration request in plain text.
  • the plaintext registration request message includes UL NAS COUNT; or, a possible implementation is that the foregoing second request message carries UL NAS COUNT.
  • the second AMF learns that the UE is a legitimate UE based on the indication information, the second AMF does not need to perform UE verification, that is, performs S320, and the second AMF determines that it does not need to be verification.
  • S330 The second AMF sends a second response message to the first AMF.
  • the second response message carries the security context of the UE.
  • the second AMF does not need to verify the UE. After receiving the second request message sent by the first AMF, the security context of the UE is directly returned to the first AMF. As a result, the first AMF fails to obtain the security context of the UE.
  • the second AMF can obtain the UL NAS COUNT.
  • the registration request message in plain text is an unsecured registration request message
  • the second AMF does not need to verify the registration request message in plain text, and can directly obtain the UL NAS COUNT from the registration request message in plain text.
  • the second AMF can perform key derivation on the first key in the security context of the UE according to the UL NAS COUNT.
  • the second AMF returns the key in the security context of the UE of the first AMF The second key obtained by key derivation for the first key.
  • the second AMF when the key in the security context sent by the second AMF to the UE of the first AMF is the aforementioned second key, the second AMF also needs to send key derivation instruction information to the first AMF to indicate the second The key is the key obtained by key deduction.
  • the process after the first AMF obtains the UE's security context is similar to the process after the first AMF obtains the UE's security context in the existing UE handover from a 4G communication system to a 5G communication system. You can refer to the existing process. , I won’t repeat it here.
  • the method for acquiring the security context shown in FIG. 3 is mainly to carry indication information in the second request message sent by the first AMF to the second AMF, and the indication information is used to indicate that the UE is a legitimate UE. Therefore, the second AMF can determine that the UE is a legitimate UE based on the indication information. The second AMF does not need to verify the UE. After receiving the second request message carrying the indication information, the second AMF directly returns the security context of the UE to the first AMF. Therefore, it is avoided that the second AMF fails to verify the UE and causes the first AMF to fail to obtain the security context of the UE.
  • This application also provides another method for obtaining the security context, the second AMF verifies the UE, but this method can increase the possibility of the second AMF verifying the UE successfully, thereby improving the security of the first AMF successfully obtaining the user equipment from the second AMF Possibility of context.
  • Fig. 4 is a schematic diagram of another method for obtaining a security context provided by an embodiment of the present application.
  • the schematic diagram includes UE, MME, first AMF, and second AMF.
  • the method for obtaining a security context includes the following steps:
  • S410 The UE determines the first registration request message.
  • the first registration request message carries a second registration request message, where the second registration request message is integrity protected by a first security context, and the first security context is between the UE and the second AMF The native security context.
  • the UE determining that the first registration request message mainly involves the UE determining the second registration request message.
  • the second registration request message is a message after the UE uses native security context integrity protection for the fourth registration request message.
  • the fourth registration request The message includes the GUTI in the context of the UE between the UE and the second AMF, the key identifier (ngKSI) information, and the UL NAS COUNT.
  • the GUTI can be called local GUTI
  • the key identifier can be called It is the local key identifier.
  • the fourth registration request message may be in the following possible situations:
  • the fourth registration request message is a message generated by the UE based on the aforementioned local GUTI, local key identifier, and UL NAS COUNT.
  • the fourth registration request message can also be called the fourth message or other possible names.
  • the name of the message is not limited in the embodiment of this application.
  • the fourth registration request message generated by the UE based on the UE context between the UE and the second AMF may also be in other forms.
  • the fourth registration request message generated by the UE includes the aforementioned local GUTI and local key.
  • the identifier and UL NAS COUNT also include other information elements (information element, IE).
  • the UE performing integrity protection on the fourth registration request message based on the first security context includes: the UE performing integrity protection on the fourth registration request message based on the first security context to generate a first MAC. Therefore, carrying the second registration request message in the first registration request message can also be understood as: carrying the first MAC and the fourth registration request message in the first registration request message.
  • the UE determining that the first registration request message includes the following steps:
  • the fourth registration request message constructed by the UE
  • the UE performs integrity protection on the fourth registration request message based on the security context between the UE and the second AMF, and generates the first MAC;
  • the UE performs integrity protection on the third registration request message and the second registration request message (RR2) based on the security context of the mapping between the UE and the first AMF, and generates a fifth MAC, where the third registration request message is
  • the first registration request message includes the fourth registration request message (RR4), the third registration request message (RR3), the fifth MAC (MAC5) and the first MAC (MAC1), where MAC1 is the pair RR4 uses the local security context for integrity protection to obtain the MAC value, and MAC5 is the MAC value obtained by fully protecting the mapped security context of RR3 and RR2 (or, MAC5 is the completed security context of RR3, RR4, and MAC1. It can also be understood that the first registration request message is a message that performs integrity protection based on the native security context and the mapped security context in sequence.
  • the fourth registration request message is a registration request message after the UE performs integrity protection on the third registration request message based on the mapped security context.
  • the UE performing integrity protection on the fourth registration request message based on the first security context includes: the UE performing integrity protection on the fourth registration request message based on the first security context to generate the first MAC. Therefore, carrying the second registration request message in the first registration request message can also be understood as: carrying the first MAC and the fourth registration request message in the first registration request message.
  • the UE determining the first registration request message includes the following steps:
  • the UE performs integrity protection on the third registration request message based on the security context of the mapping between the UE and the first AMF, and generates a third MAC;
  • the UE Based on the native security context between the UE and the second AMF, the UE performs the integrity protection on the third registration request message after the integrity protection of the mapping-based security context in step 1, and generates the first MAC again;
  • the first registration request message includes the third registration request message (RR3), the third MAC (MAC3), and the first MAC (MAC1), where MAC3 is the integrity of the security context mapped by RR3 Protect the obtained MAC value, MAC1 is the MAC value obtained by integrity protection of RR3 and MAC3 with the local security context; it can also be understood that the first registration request message is a message for integrity protection based on the mapped security context and the native security context in turn .
  • the fourth registration request message is: the third registration request message, where the third registration request message is the registration request message sent by the UE to the first AMF in the method flow S260 shown in FIG. 2.
  • the UE performing integrity protection on the fourth registration request message based on the first security context includes: the UE performing integrity protection on the fourth registration request message based on the first security context to generate the first MAC. Therefore, carrying the second registration request message in the first registration request message can also be understood as: carrying the first MAC and the fourth registration request message in the first registration request message.
  • the UE determining that the first registration request message includes the following steps:
  • the UE performs integrity protection on the third registration request message based on the native security context between the UE and the second AMF, and generates the first MAC;
  • the UE performs integrity protection again on the third registration request message after integrity protection based on the native security context in step 1, based on the security context mapped between the UE and the first AMF, and generates a fourth MAC;
  • the first registration request message includes the third registration request message (RR3), the first MAC (MAC1) and the fourth MAC (MAC4), where MAC1 is obtained by performing integrity protection on RR3 using the local security context MAC value, MAC4 is the MAC value obtained by performing integrity protection on RR3 and MAC1 using the mapped security context; it can also be understood that the first registration request message is a message for integrity protection based on the native security context and the mapped security context in turn .
  • the first AMF can determine to send the second registration request message protected by the native security context integrity to the second AMF according to the mapped GUITI and the local GUTI carried in the first registration request message sent by the UE.
  • case 1-case 3 are only examples of the possible situations of the second registration request message, and how the UE determines the above-mentioned first registration request message, and other possible forms of the second registration request not listed.
  • fourth registration request message is other possible messages that the UE may constitute based on the native context.
  • the UE sends a first registration request message to the first AMF.
  • the UE sends the first registration request message determined in S410 to the first AMF.
  • the UE sending the first registration request message to the first AMF may be forwarded by the access network device.
  • the function of the access network device is not limited in this application, so it can be directly described as the UE sending the first registration request message to the first AMF. Registration request message.
  • the method flow shown in FIG. 4 further includes S411 -S414:
  • S411 The MME sends a forwarding redistribution request message to the first AMF, which is similar to S210 in FIG. 2, and will not be repeated here;
  • S412 The first AMF determines the mapped security context, which is similar to S220 in FIG. 2, and will not be repeated here;
  • the first AMF sends a forwarding redistribution response message to the MME, which is similar to S230 in FIG. 2, and will not be repeated here;
  • S414 The MME sends a handover command message to the UE, which is similar to S240 in FIG. 2 and will not be repeated here;
  • the UE after receiving the handover command message, the UE derives the mapped security context. Furthermore, the UE uses the native security context and the mapped security context to securely protect the first registration request message.
  • S430 The first AMF verifies the UE.
  • the first AMF determines that the UE is a legitimate UE mainly to determine whether the first registration request message received from the UE meets a preset condition.
  • the first AMF determining that the first registration request message satisfies a preset condition includes:
  • the first AMF successfully verifies the integrity protection of the first registration request message based on the mapped security context; or,
  • the first AMF determines that the first registration request message is a registration request message sent after the UE switches from the 4G communication system to the 5G communication system. For example, if the first AMF receives the forwarding redistribution request message sent by the MME before receiving the first registration request message sent by the UE, the first AMF can learn that the first registration request message currently received is in the handover process. The registration request message received from the UE.
  • the first AMF After the first AMF verifies that the UE is a legitimate UE, the first AMF sends a second registration request message to the second AMF, and the second registration request message is used for the second AMF to verify the UE. That is, the method flow shown in FIG. 4 further includes S440, the first AMF sends a second registration request message to the second AMF.
  • the second registration request message is carried in the first request message, and is sent by the first AMF to the second AMF.
  • the first request message is a user equipment context transfer service call request (Namf_Communication_UEContextTransfer) initiated by the first AMF shown in FIG. 2, which is different from the user equipment context transfer service call request shown in FIG. It is that the first MAC is added to the user equipment context transmission service invocation request in the embodiment of the present application.
  • Namf_Communication_UEContextTransfer user equipment context transfer service call request
  • the first request message is another possible first request message sent by the first AMF to the second AMF for acquiring the security context of the UE.
  • first request message in this application is not limited. It may be the first MAC in the existing signaling between the first AMF and the second AMF, or the first MAC. Newly added signaling between the AMF and the second AMF.
  • the first request message also carries the identity of the UE. Specifically, the identity of the UE is included in the second registration request message sent by the first AMF to the second AMF.
  • the identity of the UE may be the above-mentioned mapped GUTI
  • the identity of the UE may be the aforementioned local GUTI
  • the identity of the UE may be SUPI.
  • the first AMF may choose to continue to carry the mapped GUTI of the UE in the first request message, or, Carry the SUPI of the UE, or carry the mapped GUTI of the UE and the SUPI of the UE.
  • the first registration request message received by the first AMF is the case shown in S410, the first registration request message carries the second registration request message, and the second registration request message includes There is a local GUTI, then in this case, the first AMF may choose to carry the local GUTI of the UE in the first request message.
  • the foregoing second registration request message also includes the UL NAS COUNT of the UE, so that the second AMF can obtain the UL NAS COUNT of the UE.
  • the second AMF determines whether the UE is a legitimate UE based on the integrity check result of the second registration request message, that is, performs S450, the second AMF calibration Verify the integrity of the second registration request message.
  • the second AMF performs an integrity check on the second registration request message according to the security context between the second AMF and the user equipment. For example, the second AMF generates a second MAC based on the locally stored security context, and compares the first MAC with the second MAC. When the first MAC and the second MAC are equal, the second AMF verifies the UE successfully and determines the UE as a legitimate UE , The second AMF sends the security context of the UE to the first AMF.
  • the above-mentioned first MAC is a MAC generated by the UE based on the security context of the UE negotiated between the UE and the second AMF
  • the second MAC is a MAC generated by the second AMF based on the security context of the UE negotiated between the UE and the second AMF MAC
  • the second AMF with a high probability that the first MAC and the second MAC are equal can verify the success of the UE and return the UE’s security context to the first AMF, unless a small probability event of transmission error occurs, resulting in the second AMF verification failed.
  • the method for acquiring the security context shown in FIG. 4 improves the possibility that the first AMF successfully acquires the security context of the user equipment from the second AMF.
  • S460 is executed, and the second AMF sends the security context of the UE to the first AMF.
  • the security context of the UE is carried in the first response message.
  • the second AMF may send the context of the UE to the first AMF.
  • the second AMF can perform key derivation on the first key in the security context of the UE according to the UL NAS COUNT.
  • the second AMF returns the key in the security context of the UE of the first AMF The second key obtained by key derivation for the first key.
  • the security context of the UE including the second key generated by the key derivation may be called the second security context, that is to say, the security context of the UE sent by the second AMF to the first AMF may be Without key derivation, the security context of the UE between the second AMF and the UE stored locally in the second AMF, or when the second AMF controls the UE’s security context between the second AMF and the UE stored locally according to the local policy
  • the key in the security context in the case that the key derivation has been performed to generate the derived key, the security context of the UE sent by the second AMF to the first AMF may be the aforementioned second security context.
  • the second AMF when the key in the security context sent by the second AMF to the UE of the first AMF is the aforementioned second key, the second AMF also needs to send key derivation instruction information to the first AMF to indicate the second The key is the key obtained by key deduction.
  • the process after the first AMF obtains the UE's security context is similar to the process after the first AMF obtains the UE's security context in the existing UE handover from a 4G communication system to a 5G communication system. You can refer to the existing process. , I won’t repeat it here.
  • the first AMF sends a non-access layer secure mode command (NAS SMC) message to the UE, and the UE responds to The NAS SMC message performs integrity verification. After the UE successfully verifies the NAS SMC, the UE sends a non-access layer security mode complete message to the first AMF.
  • NAS SMC non-access layer secure mode command
  • the second AMF when the second AMF fails to verify the integrity of the second registration request message, the second AMF sends failure indication information to the first AMF to notify the first AMF that the second AMF The integrity verification of the second registration request message failed.
  • the first AMF determines based on the local policy that the first AMF can continue to use the mapped security context, or , The first AMF determines to initiate initial authentication to the UE based on the local policy, and generates a new security context between the first AMF and the UE.
  • FIG. 5 is a schematic diagram of an apparatus 50 for acquiring a security context proposed in the present application.
  • the device 50 includes a sending unit 510, a processing unit 520, and a receiving unit 530.
  • the sending unit 510 is configured to send a first registration request message to the first AMF;
  • the processing unit 520 is configured to determine the first registration request message
  • the receiving unit 530 is configured to receive a handover command message sent by the MME.
  • the apparatus 50 completely corresponds to the user equipment in the method embodiment, and the apparatus 50 may be the user equipment in the method embodiment, or a chip or functional module inside the user equipment in the method embodiment.
  • the corresponding units of the apparatus 50 are used to execute the corresponding steps executed by the user equipment in the method embodiments shown in FIGS. 3 and 4.
  • the sending unit 510 in the apparatus 50 executes the steps sent by the user equipment in the method embodiment. For example, perform step S316 of sending a registration request message to the first AMF in FIG. 3 and perform step S420 of sending a first registration request message to the first AMF in FIG. 4;
  • the processing unit 520 executes steps implemented or processed inside the user equipment in the method embodiment. For example, perform step S315 of determining the mapped security context in FIG. 3 and perform step S410 of determining the first registration request message in FIG. 4;
  • the receiving unit 530 executes the steps received by the user equipment in the method embodiment. For example, step S314 of receiving the handover command message sent by the MME in FIG. 3 and step S414 of receiving the handover command message sent by the MME in FIG. 4 are executed.
  • the sending unit 510 and the receiving unit 530 shown in the device 50 may constitute a transceiver unit, and have both receiving and sending functions.
  • the processing unit 520 may be a processor.
  • the sending unit 510 may be a transmitter, and the receiving unit 530 may be a receiver.
  • the receiver and transmitter can be integrated to form a transceiver.
  • FIG. 6 is a schematic structural diagram of a user equipment 60 applicable to an embodiment of the present application.
  • the user equipment 60 can be applied to the system shown in FIG. 1.
  • FIG. 6 only shows the main components of the user equipment.
  • the user equipment 60 includes a processor (corresponding to the processing unit 520 shown in FIG. 5), a memory, a control circuit, an antenna, and an input/output device (corresponding to the sending unit 510 and receiving unit 510 shown in FIG. 5).
  • Unit 530 correspond to the sending unit 510 and receiving unit 510 shown in FIG. 5.
  • the processor is used to control the antenna and the input and output devices to send and receive signals
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory to execute the corresponding method executed by the user equipment in the method for obtaining security context proposed in this application. Process and/or operation. I won't repeat them here.
  • FIG. 6 only shows a memory and a processor. In actual user equipment, there may be multiple processors and memories.
  • the memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.
  • FIG. 7 is a schematic diagram of a device 70 for acquiring a security context proposed in this application.
  • the apparatus 70 includes a receiving unit 710, a processing unit 720, and a sending unit 730.
  • the receiving unit 710 is configured to receive a first registration request message sent by a user equipment, where the first registration request message carries a second registration request message, where the second registration request message is completed by the first security context. Protection, the first security context is the local security context between the user equipment and the second AMF, and the first AMF is the user equipment after the user equipment switches from the 4G communication system to the 5G communication system AMF that provides access and mobility management services;
  • the processing unit 720 is configured to determine the security context of the mapping
  • the sending unit 730 is configured to send a second registration request message to the second AMF.
  • the device 70 completely corresponds to the first AMF in the method embodiment, and the device 70 may be the first AMF in the method embodiment, or a chip or functional module inside the first AMF in the method embodiment.
  • the corresponding units of the device 70 are used to execute the corresponding steps performed by the first AMF in the method embodiments shown in FIGS. 3 and 4.
  • the receiving unit 710 in the device 70 executes the first AMF receiving step in the method embodiment. For example, perform step S311 in FIG. 3 for receiving the forwarding redistribution request message sent by the MME, perform step S411 for receiving the forwarding redistribution request message sent by the MME in FIG. 4, and perform step S316 for receiving the registration request message sent by the UE in FIG. 3
  • Execute step S420 of receiving the first registration request message sent by the UE in Figure 3 perform step S330 of receiving the second response message sent by the second AMF in Figure 3, and perform the security context of the UE sent by the second AMF in Figure 4 ⁇ S460.
  • the processing unit 720 executes the steps implemented or processed inside the first AMF in the method embodiment. For example, step S312 of determining the mapped security context in FIG. 3 is performed, step S412 of determining the mapped security context in FIG. 4 is performed, step S317 of verifying the UE in FIG. 3 is performed, and step S430 of verifying the UE in FIG. 4 is performed.
  • the sending unit 730 executes the steps of sending the first AMF in the method embodiment. For example, perform step S313 of sending a forwarding redistribution response message to the MME in Figure 3, perform step S413 of sending a forwarding redistribution response message to the MME in Figure 4, and perform step S310 of sending a second request message to the second AMF in Figure 3 Execute step S440 of sending a second registration request message to the second AMF in FIG. 4.
  • the receiving unit 710 and the sending unit 730 may constitute a transceiver unit, and have both receiving and sending functions.
  • the processing unit 720 may be a processor.
  • the sending unit 730 may be a transmitter.
  • the receiving unit 710 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.
  • an embodiment of the present application also provides a first AMF 80.
  • the first AMF 80 includes a processor 810, a memory 820, and a transceiver 830.
  • the memory 820 stores instructions or programs, and the processor 830 Used to execute instructions or programs stored in the memory 820.
  • the transceiver 830 is configured to perform operations performed by the receiving unit 710 and the sending unit 730 in the apparatus 70 shown in FIG. 7.
  • FIG. 9 is a schematic diagram of a device 90 for acquiring a security context proposed in this application.
  • the device 90 includes a receiving unit 910, a processing unit 920, and a sending unit 930.
  • the receiving unit 910 is configured to receive a second registration request message sent by the first AMF, where the second registration request message has been integrity protected by a first security context, and the first security context is the user equipment and The local security context between the second AMF;
  • the processing unit 920 is configured to verify the integrity of the second registration request message
  • the sending unit 930 when the processing unit 920 successfully verifies the integrity of the second registration request message, sends the security context of the user equipment to the first AMF.
  • the device 90 completely corresponds to the second AMF in the method embodiment, and the device 90 may be the second AMF in the method embodiment, or a chip or functional module inside the second AMF in the method embodiment.
  • the corresponding units of the device 80 are used to execute the corresponding steps performed by the second AMF in the method embodiments shown in FIGS. 3 and 4.
  • the receiving unit 910 in the device 90 executes the steps of receiving the second AMF in the method embodiment. For example, step S310 of receiving the second request message sent by the first AMF in FIG. 3 and step S440 of receiving the second registration request message sent by the first AMF in FIG. 4 are executed.
  • the processing unit 920 executes internal implementation or processing steps of the second AMF in the method embodiment. For example, perform step S320 in FIG. 3 that determines that the UE does not need to be verified, and perform step S450 in FIG. 4 to verify the integrity of the second registration request message.
  • the sending unit 930 executes the steps of sending the second AMF in the method embodiment. For example, step S330 of sending the second response message to the first AMF in FIG. 3 and step S460 of sending the security context of the UE to the first AMF in FIG. 4 are performed.
  • the receiving unit 910 and the sending unit 930 may constitute a transceiving unit and have the functions of receiving and sending at the same time.
  • the processing unit 920 may be a processor.
  • the sending unit 930 may be a transmitter, and the receiving unit 910 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.
  • an embodiment of the present application also provides a second AMF 100.
  • the second AMF 100 includes a processor 1010, a memory 1020, and a transceiver 1030.
  • the memory 1020 stores instructions or programs, and the processor 1030 Used to execute instructions or programs stored in the memory 1020.
  • the transceiver 1030 is used to execute the operations performed by the receiving unit 910 and the sending unit 930 in the device 90 shown in FIG. 9.
  • the embodiment of the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium.
  • the computer executes the methods shown in FIGS. 3 and 4 above. The steps performed by the first AMF.
  • the embodiment of the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium.
  • the computer executes the methods shown in FIGS. 3 and 4 above. The steps performed by the second AMF.
  • the embodiments of the present application also provide a computer program product containing instructions.
  • the computer program product runs on a computer, the computer executes the steps performed by the first AMF in the methods shown in FIGS. 3 and 4.
  • the embodiment of the present application also provides a computer program product containing instructions.
  • the computer program product runs on a computer, the computer executes the steps performed by the second AMF in the method shown in FIG. 3 and FIG. 4.
  • An embodiment of the present application also provides a chip including a processor.
  • the processor is used to read and run the computer program stored in the memory to execute the corresponding operation and/or process performed by the second AMF in the method for acquiring the security context provided in this application.
  • the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information.
  • the communication interface can be an input and output interface.
  • This application also provides a chip including a processor.
  • the processor is used to call and run a computer program stored in the memory to execute the corresponding operation and/or process performed by the first AMF in the method for obtaining a security context provided by this application.
  • the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory.
  • the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information.
  • the communication interface can be an input and output interface.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory ((R) ANdom Access Memory, RAM), magnetic disks or optical disks, etc., which can store programs The medium of the code.
  • the term "and/or” in this application is only an association relationship describing the associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A alone exists, and both A and B exist. , There are three cases of B alone.
  • the character "/" in this text generally means that the associated objects before and after are in an "or” relationship; the term “at least one” in this application can mean “one” and "two or more", for example, A At least one of, B and C can mean: A alone exists, B alone exists, C exists alone, A and B exist alone, A and C exist simultaneously, C and B exist simultaneously, and A and B and C exist simultaneously, this Seven situations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Environmental & Geological Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本申请实施例提供了一种获取安全上下文的方法，用户设备UE从4G通信系统切换至5G通信系统后，5G系统中的为UE提供接入和移动管理服务的第一AMF可通过该方法从5G通信系统中的第二AMF中获取该UE的安全上下文，该方法包括：UE向第一AMF发送第一注册请求消息，第一注册请求消息中携带第二注册请求消息；第一AMF向第二AMF发送第二注册请求消息，第二注册请求消息被UE与第二AMF之间的本地安全上下文进行过完整性保护，第二AMF验证第二注册请求消息的完整性成功之后，向第一AMF返回UE的安全上下文。该方法能够提高第一AMF成功从第二AMF处获取UE的安全上下文的可能性。

Description

获取安全上下文的方法、装置和通信系统
本申请要求于2019年05月31日提交中国专利局、申请号为201910470895.8、申请名称为“获取安全上下文的方法、装置和通信系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，并且更具体地，涉及一种获取安全上下文的方法、装置和通信系统。
背景技术
在第五代(5th generation，5G)通信场景下，由于用户设备的移动，存在为用户设备提供服务的网络设备发生变化的情况。一种可能的切换场景是用户设备由第四代(4th generation，4G)通信系统中切换到了5G通信系统中，这种切换场景下对于用户设备来说就是接入网设备部分由4G接入网设备切换到了5G接入网设备，而核心网设备部分则由4G核心网设备切换到了5G核心网设备，其中，核心网设备部分的切换包括为用户设备提供移动管理服务的核心网网元之间的切换，也就是从4G通信系统中的移动性管理实体(mobility management entity，MME)切换到了5G通信系统中的接入和移动管理功能(access and mobility management function，AMF)。
现有的用户设备从4G通信系统切换至5G通信系统的场景下，在5G通信系统中除了被MME选择的AMF(第一AMF)之外还包括保存有用户设备的安全上下文的AMF(第二AMF)，此时，第一AMF如何从第二AMF中获取用户设备的安全上下文成为亟待解决的问题。
发明内容
本申请提供一种获取安全上下文的方法、装置和通信系统，通过基于用户设备与第二AMF之间的本地安全上下文对第一AMF在向第二AMF发送的第二注册请求消息进行完整性保护，以使得第二AMF能够基于用户设备与第二AMF之间的本地安全上下文校验第二注册请求消息的完整性，从而能够提高第二AMF校验第二注册请求消息成功的可能性，若验证成功，则第一AMF就能够成功的从第二AMF处获取用户设备的安全上下文。
第一方面，提供了一种获取安全上下文的方法，包括：第一接入和移动管理功能AMF接收用户设备发送的第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；所述第一AMF向所述第二AMF发送所述第二注册请求消息；所述第二AMF校验 所述第二注册请求消息的完整性；若所述第二AMF校验所述第二注册请求消息的完整性成功，则所述第二AMF向所述第一AMF发送所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，在用户设备从4G通信系统切换至5G通信系统时，在切换之前用户设备与第二AMF之间保存有用户设备的安全上下文，在用户设备从4G通信系统切换至5G通信系统之后，为用户设备提供接入和移动管理服务为第一AMF，该第一AMF需要从第二AMF处获得上述的用户设备的安全上下文，具体地，用户设备可以在接收到切换命令之后，基于本地保存的与第二AMF之间的安全上下文对第四注册请求消息进行完整性保护，生成第二注册请求消息，在向第一AMF发送第一注册请求消息，并在第一注册请求消息中携带该第二注册请求消息，使得第一AMF可以将该第二注册请求消息转发给第二AMF，则第二AMF可以校验该第二注册请求消息的完整性，第二AMF校验第二注册请求消息的完整性成功之后，可以将上述用户设备的安全上下文返回给第一AMF，能够提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第一方面，在第一方面的某些实现方式中，所述用户设备的安全上下文包括：所述第一安全上下文，或者，基于所述第一安全上下文获取的第二安全上下文。
本申请实施例提供的获取安全上下文的方法，上述用户设备的安全上下文可以是用户设备与第二AMF之间的本地安全上下文，或者，当第二AMF进行密钥推演之后生成了新的密钥的情况下，上述用户设备的安全上下文还可以是基于所述第一安全上下文进行密钥推演生成的第二安全上下文。
结合第一方面，在第一方面的某些实现方式中，所述第一AMF向所述第二AMF发送所述第二注册请求消息，包括：所述第一AMF向所述第二AMF发送用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求中携带所述第二注册请求消息。
本申请实施例提供的获取安全上下文的方法，第一AMF向第二AMF发送上述的第二注册请求消息可以是在第一AMF向第二AMF发送用户设备上下文传输服务调用请求中携带第二注册请求消息。
结合第一方面，在第一方面的某些实现方式中，所述第二AMF向所述第一AMF发送所述用户设备的安全上下文，包括：所述第二AMF向所述第一AMF发送第一响应消息，所述第一响应消息中携带所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，第二AMF向第一AMF返回上述的用户设备的安全上下文时，可以是向第一AMF发送第一响应消息，并在第一响应消息中携带上述用户设备的安全上下文。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：当所述第一AMF接收到所述第二AMF校验所述第二注册请求消息的完整性失败的消息时，所述第一AMF继续使用映射的安全上下文或向所述用户设备发起初始认证。
本申请实施例提供的获取安全上下文的方法，当第一AMF从第二AMF处获取用户设备的安全上下文失败的情况下，第一AMF可以继续使用与用户设备之间协商生成的映射的安全上下文，或者，第一AMF可以向用户设备发起初始认证生成第一AMF与用户设备之间安全上下文。
结合第一方面，在第一方面的某些实现方式中，所述映射的安全上下文是根据移动管理实体MME与所述用户设备之间的安全上下文获得的；其中所述MME为所述4G通信系统的网元。
本申请实施例提供的获取安全上下文的方法中涉及到的映射的安全上下文指的是用户设备和第一AMF分别基于用户设备与MME之间的安全上下文推导生成的安全上下文。
结合第一方面，在第一方面的某些实现方式中，所述第二AMF校验所述第二注册请求消息的完整性，包括：所述第二AMF根据所述第二AMF与所述用户设备之间的本地安全上下文对所述第二注册请求消息的完整性进行校验。
第二方面，提供了一种获取安全上下文的方法，包括：第二接入和移动管理功能AMF接收第一AMF发送的第二注册请求消息，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为用户设备与所述第二AMF之间的本地安全上下文，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；所述第二AMF校验所述第二注册请求消息的完整性；若所述第二AMF校验所述第二注册请求消息的完整性成功，则所述第二AMF向所述第一AMF发送所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，在用户设备从4G通信系统切换至5G通信系统时，在切换之前用户设备与第二AMF之间保存有用户设备的安全上下文，在用户设备从4G通信系统切换至5G通信系统之后，为用户设备提供接入和移动管理服务为第一AMF，该第一AMF需要从第二AMF处获得上述的用户设备的安全上下文，具体地，用户设备可以在接收到切换命令之后，基于本地保存的与第二AMF之间的安全上下文对第四注册请求消息进行完整性保护之后，生成第二注册请求消息，UE在向第一AMF发送的第一注册请求消息中携带该第二注册请求消息，使得第一AMF可以将该第二注册请求消息转发给第二AMF，第二AMF可以校验第二注册请求消息的完整性，并在校验第二注册请求消息的完整性成功的情况下，向第一AMF发送用户设备的安全上下文，能够提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第二方面，在第二方面的某些实现方式中，所述用户设备的安全上下文包括：所述第一安全上下文，或者，基于所述第一安全上下文进行密钥推演生成的第二安全上下文。
本申请实施例提供的获取安全上下文的方法，上述用户设备的安全上下文可以是用户设备与第二AMF之间的本地安全上下文，或者，当第二AMF进行密钥推演之后生成了新的密钥的情况下，上述用户设备的安全上下文还可以是基于所述第一安全上下文进行密钥推演生成的第二安全上下文。
结合第二方面，在第二方面的某些实现方式中，所述第二AMF接收所述第一AMF发送的所述第二注册请求消息，包括：所述第二AMF接收所述第一AMF发送的用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求中携带所述第二注册请求消息。
本申请实施例提供的获取安全上下文的方法，第一AMF向第二AMF发送上述的第二注册请求消息可以是在第一AMF向第二AMF发送用户设备上下文传输服务调用请求中携带第二注册请求消息。
结合第二方面，在第二方面的某些实现方式中，所述第二AMF向所述第一AMF发 送所述用户设备的安全上下文，包括：所述第二AMF向所述第一AMF发送第一响应消息，所述第一响应消息中携带所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，第二AMF向第一AMF返回上述的用户设备的安全上下文时，可以是向第一AMF发送第一响应消息，并在第一响应消息中携带上述用户设备的安全上下文。
结合第二方面，在第二方面的某些实现方式中，所述第二AMF校验所述第二注册请求消息的完整性，包括：所述第二AMF根据所述第一安全上下文对所述第二注册请求消息的完整性进行校验。
第三方面，提供了一种获取安全上下文的方法，包括：用户设备确定第二注册请求消息进行完整性保护，所述第二注册请求消息被第一安全上下文进行过完整性保护，其中，所述第一安全上下文为所述用户设备与第二接入和移动管理功能AMF之间的本地安全上下文；所述用户设备向第一接入和移动管理功能AMF发送第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF。
本申请实施例提供的获取安全上下文的方法，在用户设备从4G通信系统切换至5G通信系统时，在切换之前用户设备与第二AMF之间保存有用户设备的安全上下文，该用户设备的安全上下文，在用户设备从4G通信系统切换至5G通信系统之后，为用户设备提供接入和移动管理服务为第一AMF，该第一AMF需要从第二AMF处获得上述的用户设备的安全上下文，具体地，用户设备可以在接收到切换命令之后，基于本地保存的与第二AMF之间的安全上下文对第四注册请求消息进行完整性保护之后，生成第二注册请求消息，UE在向第一AMF发送的第一注册请求消息中携带该第二注册请求消息，使得第一AMF可以将该第二注册请求消息转发给第二AMF，则第二AMF可以校验该第二注册请求消息的完整性，第二AMF校验该第二注册请求消息的完整性成功之后，可以将上述用户设备的安全上下文返回给第一AMF，能够提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第三方面，在第三方面的某些实现方式中，所述方法还包括：若接收到所述第一AMF发送的非接入层安全模式命令NAS SMC消息，则对所述NAS SMC进行完整校验；若校验成功，则向所述第一AMF发送非接入层安全模式完成消息。
本申请实施例提供的获取安全上下文的方法，如果用户设备接收到第一AMF发送的NAS SMC消息，并且用户设备校验该NAS SMC消息成功，则用户设备向第一AMF发送非接入层安全模式完成消息。
第四方面，提供了一种获取安全上下文的方法，包括：第一接入和移动管理功能AMF接收用户设备发送的第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；所述第一AMF向所述第二AMF发送所述第二注册请求消息；若所述第二AMF校验所述第二注册请求消息的完整性成功，则所述第一AMF接收所述第二AMF发送的所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，在用户设备从4G通信系统切换至5G通信系统时，在切换之前用户设备与第二AMF之间保存有用户设备的安全上下文，在用户设备从4G通信系统切换至5G通信系统之后，为用户设备提供接入和移动管理服务为第一AMF，该第一AMF需要从第二AMF处获得上述的用户设备的安全上下文，具体地，用户设备可以在接收到切换命令之后，基于本地保存的与第二AMF之间的安全上下文对第四注册请求消息进行完整性保护之后，生成第二注册请求消息，UE在向第一AMF发送的第一注册请求消息中携带第二注册请求消息，使得第一AMF可以将该第二注册请求消息转发给第二AMF，则第二AMF可以校验该第二注册请求消息的完整性，第二AMF校验第二注册请求消息的完整性成功之后，可以将上述用户设备的安全上下文返回给第一AMF，能够提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第四方面，在第四方面的某些实现方式中，所述用户设备的安全上下文包括：所述第一安全上下文，或者，基于所述第一安全上下文进行密钥推演生成的第二安全上下文。
本申请实施例提供的获取安全上下文的方法，上述用户设备的安全上下文可以是用户设备与第二AMF之间的本地安全上下文，或者，当第二AMF进行密钥推演之后生成了新的密钥的情况下，上述用户设备的安全上下文还可以是基于所述第一安全上下文进行密钥推演生成的第二安全上下文。
结合第四方面，在第四方面的某些实现方式中，所述第一AMF向所述第二AMF发送所述第二注册请求消息，包括：所述第一AMF向所述第二AMF发送用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求中携带所述第二注册请求消息。
本申请实施例提供的获取安全上下文的方法，第一AMF向第二AMF发送上述的第二注册请求消息可以是在第一AMF向第二AMF发送用户设备上下文传输服务调用请求中携带第二注册请求消息。
结合第四方面，在第四方面的某些实现方式中，所述第一AMF接收所述第二AMF发送的所述用户设备的安全上下文，包括：所述第一AMF接收所述第二AMF发送的第一响应消息，所述第一响应消息中携带所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，第二AMF向第一AMF返回上述的用户设备的安全上下文时，可以是向第一AMF发送第一响应消息，并在第一响应消息中携带上述用户设备的安全上下文。
结合第四方面，在第四方面的某些实现方式中，所述方法还包括：当所述第一AMF接收到所述第二AMF校验所述第二注册请求消息的完整性失败的消息时，所述第一AMF继续使用映射的安全上下文或向所述用户设备发起初始认证。
本申请实施例提供的获取安全上下文的方法，当第一AMF从第二AMF处获取用户设备的安全上下文失败的情况下，第一AMF可以继续使用与用户设备之间协商生成的映射的安全上下文，或者，第一AMF可以向用户设备发起初始认证生成第一AMF与用户设备之间安全上下文。
结合第四方面，在第四方面的某些实现方式中，所述映射的安全上下文是根据移动管理实体MME与所述用户设备之间的安全上下文获得的，其中，所述MME为所述4G通信系统中的网元。
本申请实施例提供的获取安全上下文的方法中涉及到的映射的安全上下文指的是用户设备和第一AMF分别基于用户设备与MME之间的安全上下文推导生成的安全上下文。
第五方面，提供了一种获取安全上下文的方法，包括：第一接入和移动管理功能AMF向第二AMF发送用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求用于获取用户设备的安全上下文，所述用户设备上下文传输服务调用请求中携带指示信息，所述指示信息用于指示所述用户设备为合法的用户设备，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；所述第一AMF接收所述第二AMF发送的第二响应消息，所述第二响应消息中携带所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，通过第一AMF在向第二AMF发送的用户设备上下文传输服务调用请求中携带指示UE为合法的UE指示信息，可以避免第二AMF对UE进行验证失败，导致第二AMF不向第一AMF发送UE的安全上下文，提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第五方面，在第五方面的某些实现方式中，所述指示信息用于指示所述用户设备为合法的用户设备包括：所述指示信息用于指示注册请求消息完整性校验通过，其中，所述注册请求消息为所述第一AMF从所述用户设备处接收到的。
本申请实施例提供的获取安全上下文的方法，第一AMF向第二AMF发送的指示UE为合法的UE的指示信息可以是第一AMF通知第二AMF该UE发送的注册请求消息的完整性校验通过，为指示UE为合法UE提供灵活可选的方案。
结合第五方面，在第五方面的某些实现方式中，在所述第一AMF向第二AMF发送用户设备上下文传输服务调用请求之前，所述方法还包括：所述第一AMF成功校验注册请求消息的完整性保护，其中，所述注册请求消息为所述第一AMF从所述用户设备处接收到的；和/或，所述第一AMF确定所述注册请求消息，为所述用户设备从4G通信系统切换至5G通信系统后发送的注册请求消息。
本申请实施例提供的获取安全上下文的方法，第一AMF基于注册请求消息的成功校验的结果，和/或，接收到的注册请求消息，为所述用户设备从4G通信系统切换至5G通信系统后发送的注册请求消息，判断可以向第二AMF发送的用户设备上下文传输服务调用请求。
结合第五方面，在第五方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述用户设备的标识。
本申请实施例提供的获取安全上下文的方法，第一AMF为了使得第二AMF获知第一AMF需要获取的是某个用户设备的用户设备的安全上下文，在该上下文传输服务调用请求中携带该用户设备的标识。
结合第五方面，在第五方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述用户设备的上行非接入层计数器UL NAS COUNT。
本申请实施例提供的获取安全上下文的方法，第一AMF为了使得第二AMF获知UL NAS COUNT，可以在该上下文传输服务调用请求中携带该UL NAS COUNT。
结合第五方面，在第五方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述UL NAS COUNT包括：所述用户设备上下文传输服务调用请求中携带明文 的注册请求消息，所述明文的注册请求消息中包括所述UL NAS COUNT，其中，所述注册请求消息为所述第一AMF从所述用户设备处接收到的。
本申请实施例提供的获取安全上下文的方法，用户设备上下文传输服务调用请求中携带UL NAS COUNT可以是通过在用户设备上下文传输服务调用请求中携带明文的注册请求消息，该明文的注册请求消息中包括该UL NAS COUNT，为第一AMF向第二AMF发送UL NAS COUNT提供灵活可选的方案。
第六方面，提供了一种获取安全上下文的方法，包括：第二接入和移动管理功能AMF接收第一AMF发送的用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求用于获取用户设备的安全上下文，所述用户设备上下文传输服务调用请求中携带指示信息，所述指示信息用于指示所述用户设备为合法的用户设备，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；所述第二AMF向所述第一AMF发送第二响应消息，所述第二响应消息中携带所述用户设备的安全上下文。
本申请实施例提供的获取安全上下文的方法，通过在第二AMF接收到第一AMF发送的用户设备上下文传输服务调用请求中携带指示UE为合法的UE指示信息，第二AMF基于该指示信息无需对UE进行验证，可以避免第二AMF验证UE失败而不向第一AMF发送UE的安全上下文，提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
结合第六方面，在第六方面的某些实现方式中，所述指示信息用于指示所述用户设备为合法的用户设备包括：所述指示信息用于指示注册请求消息完整性校验通过，其中，所述注册请求消息为所述第一AMF从所述用户设备处接收到的。
本申请实施例提供的获取安全上下文的方法，第二AMF接收到的第一AMF发送的指示UE为合法的UE的指示信息可以是第一AMF通知第二AMF该UE发送的注册请求消息的完整性校验通过，为指示UE为合法UE提供灵活可选的方案。
结合第六方面，在第六方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述用户设备的标识。
本申请实施例提供的获取安全上下文的方法，第二AMF可以基于该上下文传输服务调用请求中携带该用户设备的标识，确定第一AMF需要获取的是该用户设备的用户设备的安全上下文。
结合第六方面，在第六方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述用户设备的上行非接入层计数器UL NAS COUNT。
本申请实施例提供的获取安全上下文的方法，第二AMF可以基于该上下文传输服务调用请求中携带的UL NAS COUNT，获知UL NAS COUNT。
结合第六方面，在第六方面的某些实现方式中，所述用户设备上下文传输服务调用请求中携带所述UL NAS COUNT包括：所述用户设备上下文传输服务调用请求中携带明文的注册请求消息，所述明文的注册请求消息中包括所述UL NAS COUNT，其中，所述注册请求消息为所述第一AMF从所述用户设备处接收到的。
本申请实施例提供的获取安全上下文的方法，用户设备上下文传输服务调用请求中携带UL NAS COUNT可以是通过在用户设备上下文传输服务调用请求中携带明文的注册请 求消息，该明文的注册请求消息中包括该UL NAS COUNT，为第一AMF向第二AMF发送UL NAS COUNT提供灵活可选的方案。
结合第六方面，在第六方面的某些实现方式中，所述方法还包括：所述第二AMF基于所述UL NAS COUNT进行密钥推演。
本申请实施例提供的获取安全上下文的方法，第二AMF可以基于接收到的UL NAS COUNT进行密钥推演。
第七方面，提供了一种通信系统，该通信系统包括上述的第一AMF和第二AMF可以用来用于执行第一方面以及第一方面的任意可能的实现方式中的第一AMF和第二AMF的操作。具体地，该通信系统可以包括用于执行上述第一方面以及第一方面的任意可能的实现方式中所描述的步骤或功能相对应的部件(means)可以是第一方面的第一AMF和第二AMF或第一AMF和第二AMF内部的芯片或功能模块。步骤或功能可以通过软件实现，或硬件实现，或者通过硬件和软件结合来实现。
第八方面，提供了一种获取安全上下文的装置，该装置可以用来用于执行第五方面和第四方面以及第五方面和第四方面的任意可能的实现方式中的第一AMF的操作。具体地，该获取安全上下文的装置可以包括用于执行上述第五方面和第四方面以及第一方面和第四方面的任意可能的实现方式中所描述的步骤或功能相对应的部件(means)可以是第五方面和第四方面的第一AMF或第一AMF内部的芯片或功能模块。步骤或功能可以通过软件实现，或硬件实现，或者通过硬件和软件结合来实现。
第九方面，提供了一种获取安全上下文的装置，该装置可以用来用于执行第二方面和第六方面以及第二方面和第六方面的任意可能的实现方式中的第二AMF的操作。具体地，该获取安全上下文的装置可以包括用于执行上述第二方面和第六方面以及第二方面和第六方面的任意可能的实现方式中所描述的步骤或功能相对应的部件(means)可以是第二方面和第六方面的第二AMF或第二AMF内部的芯片或功能模块。步骤或功能可以通过软件实现，或硬件实现，或者通过硬件和软件结合来实现。
第十方面，提供了一种获取安全上下文的装置，该装置可以用来用于执行第三方面中的用户设备的操作。具体地，该获取安全上下文的装置可以包括用于执行上述第三方面中所描述的步骤或功能相对应的部件(means)可以是第三方面中的用户设备或用户设备内部的芯片或功能模块。步骤或功能可以通过软件实现，或硬件实现，或者通过硬件和软件结合来实现。
第十一方面，提供了一种通信设备，包括，处理器，收发器，存储器，该存储器用于存储计算机程序，该收发器，用于执行第一至第五方面中任一种可能实现方式中的获取安全上下文的装置方法中的收发步骤，该处理器用于从存储器中调用并运行该计算机程序，使得该通信设备执行第一至第六方面中任一种可能实现方式中的获取安全上下文的装置方法。
可选地，处理器为一个或多个，存储器为一个或多个。
可选地，存储器可以与处理器集成在一起，或者存储器与处理器分离设置。
可选的，收发器包括，发射机(发射器)和接收机(接收器)。
第十二方面，提供了一种系统，系统包括第八方面和第九方面提供的获取安全上下文的装置。
第十三方面，提供了一种计算机程序产品，计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当计算机程序被运行时，使得计算机执行上述第一至第六方面中任一种可能实现方式中的方法。
第十四方面，提供了一种计算机可读介质，计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一至第六方面中任一种可能实现方式中的方法。
第十五方面，提供了一种芯片系统，包括存储器和处理器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片系统的通信设备执行上述第一至第六方面中任一种可能实现方式中的方法。
附图说明
图1是适用于本申请实施例的网络架构。
图2是一种通信系统切换的示意性流程图。
图3是本申请实施例提供的一种获取安全上下文的方法示意图。
图4是本申请实施例提供的另一种获取安全上下文的方法示意图。
图5为本申请实施例提供的获取安全上下文的装置50的示意图。
图6是适用于本申请实施例的用户设备60的结构示意图。
图7为本申请实施例提供的获取安全上下文的装置70的示意图。
图8是适用于本申请实施例的第一AMF 80的结构示意图。
图9为本申请实施例提供的获取安全上下文的装置90的示意图。
图10是适用于本申请实施例的第二AMF 100的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通信(global system for mobile communications，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、未来的第五代(5th generation，5G)系统或新无线(new radio，NR)等。
图1是适用于本申请实施例的网络架构。如图1所示，下面对该网络架构中涉及的各个部分分别进行说明。
1、用户设备(user equipment，UE)110：可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的终端，移动台(mobile station，MS)，终端(terminal)，软终端等等。例如，水表、电表、传感器等。
2、(无线)接入网络(radio access network，(R)AN)网元120：用于为特定区域的 授权用户设备提供入网功能，并能够根据用户设备的级别，业务的需求等使用不同质量的传输隧道。
(R)AN网元能够管理无线资源，为用户设备提供接入服务，进而完成控制信号和用户设备数据在用户设备和核心网之间的转发，(R)AN网元也可以理解为传统网络中的基站。
3、用户面网元130：用于分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。
在5G通信系统中，该用户面网元可以是用户面功能(user plane function，UPF)网元。在未来通信系统中，用户面网元仍可以是UPF网元，或者，还可以有其它的名称，本申请不做限定。
4、数据网络网元140：用于提供传输数据的网络。
在5G通信系统中，该数据网络网元可以是数据网络(data network，DN)网元。在未来通信系统中，数据网络网元仍可以是DN网元，或者，还可以有其它的名称，本申请不做限定。
5、接入和移动管理网元150：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听以及接入授权/鉴权等功能。
在5G通信系统中，该接入和移动管理网元可以是接入和移动管理功能(access and mobility management function，AMF)。在未来通信系统中，接入和移动管理设备仍可以是AMF，或者，还可以有其它的名称，本申请不做限定。
6、会话管理网元160：主要用于会话管理、用户设备的网络互连协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
在5G通信系统中，该会话管理网元可以是会话管理功能(session management function，SMF)网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。
7、策略控制网元170：用于指导网络行为的统一策略框架，为控制面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
在4G通信系统中，该策略控制网元可以是策略和计费规则功能(policy and charging rules function，PCRF)网元。在5G通信系统中，该策略控制网元可以是策略控制功能(policy control function，PCF)网元。在未来通信系统中，策略控制网元仍可以是PCF网元，或者，还可以有其它的名称，本申请不做限定。
8、认证服务器180：用于鉴权服务、产生密钥实现对用户设备的双向鉴权，支持统一的鉴权框架。
在5G通信系统中，该认证服务器可以是认证服务器功能(authentication server function，AUSF)网元。在未来通信系统中，认证服务器功能网元仍可以是AUSF网元，或者，还可以有其它的名称，本申请不做限定。
9、数据管理网元190：用于处理用户设备标识，接入鉴权，注册以及移动性管理等。
在5G通信系统中，该数据管理网元可以是统一数据管理(unified data management，UDM)网元；在4G通信系统中，该数据管理网元可以是归属用户服务器(home subscriber  server，HSS)网元在未来通信系统中，统一数据管理仍可以是UDM网元，或者，还可以有其它的名称，本申请不做限定。
10、应用网元1100：用于进行应用影响的数据路由，接入网络开放功能网元，与策略框架交互进行策略控制等。
在5G通信系统中，该应用网元可以是应用功能(application function，AF)网元。在未来通信系统中，应用网元仍可以是AF网元，或者，还可以有其它的名称，本申请不做限定。
11、网络存储网元：用于维护网络中所有网络功能服务的实时信息。
在5G通信系统中，该网络存储网元可以是网络注册功能(network repository function，NRF)网元。在未来通信系统中，网络存储网元仍可以是NRF网元，或者，还可以有其它的名称，本申请不做限定。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。为方便说明，本申请后续，以接入和移动管理设备为AMF，数据管理网元为UDM网元，会话管理网元为SMF网元，用户面网元为UPF网元为例进行说明。
为方便说明，本申请实施例中以装置为AMF实体、UDM实体为例，对用于会话建立的方法进行说明，对于装置为AMF实体内的芯片、UDM实体内的芯片的实现方法，可参考装置分别为AMF实体、UDM实体的具体说明，不再重复介绍。
在图1所示的网络架构中，用户设备通过N1接口与AMF连接，(R)AN通过N2接口与AMF连接，(R)AN通过N3接口与UPF连接。UPF之间通过N9接口连接，UPF通过N6接口DN互联。SMF通过N4接口控制UPF。AMF通过N11接口与SMF接口。AMF通过N8接口从UDM单元获取用户设备签约数据，SMF通过N10接口从UDM单元获取用户设备签约数据。
应理解，上述应用于本申请实施例的网络架构仅是一种举例说明，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
例如，在某些网络架构中，AMF、SMF网元、PCF网元、BSF网元以及UDM网元等网络功能网元实体都称为网络功能(network function，NF)网元；或者，在另一些网络架构中，AMF，SMF网元，PCF网元，BSF网元，UDM网元等网元的集合都可以称为控制面功能网元。
本申请实施例中的用户设备可以指接入终端、用户单元、用户站、移动站、移动台、中继站、远方站、远程终端、移动设备、用户终端(user terminal)、终端设备(terminal equipment)、终端(terminal)、无线通信设备、用户代理或用户装置。用户设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的用户设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的用户设备等，本申请实施例对此并不限定。
本申请实施例中的网络设备可以是用于与用户设备通信的任意一种具有无线收发功 能的设备。该设备包括但不限于：演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(home evolved NodeB，或home Node B，HNB)、基带单元(baseBand unit，BBU)，无线保真(wireless fidelity，WIFI)系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G，如，NR，系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)等。
在一些部署中，gNB可以包括集中式单元(centralized unit，CU)和DU。gNB还可以包括有源天线单元(active antenna unit，AAU)。CU实现gNB的部分功能，DU实现gNB的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，网络设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，可以将CU划分为接入网(radio access network，RAN)中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，本申请对此不做限定。
在本申请实施例中，用户设备或网络设备包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。并且，本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是用户设备或网络设备，或者，是用户设备或网络设备中能够调用程序并执行程序的功能模块。
另外，本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读存储介质”可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
本申请实施例中主要涉及到图1所示的网络架构为4G网络架构时的移动性管理实体MME和图1所示的网络架构为5G网络架构时的接入和移动管理功能AMF以及UE。其中，针对AMF本申请中涉及到第一AMF和第二AMF。具体地，本申请中所涉及的第一AMF指的是发生用户设备从4G通信系统切换到5G通信系统的过程中，4G通信系统中的MME为UE从5G通信系统中选择的为UE提供核心网服务的AMF；本申请中所涉及的第二AMF指的是用户设备从4G通信系统切换到5G通信系统的过程中，5G通信系统中除了第一AMF之外的保存有UE的安全上下文的AMF。
应理解本申请中的“第一”、“第二”仅用于区分说明，而不应对本申请构成任何限定。例如，上述的第一AMF和第二AMF只是区分不同的AMF。
为了便于理解本申请实施例提供的获取安全上下文的方法，下面结合图2简单介绍用户设备从4G通信系统切换到5G通信系统的过程，图2是一种通信系统切换的示意性流程图。包括UE、MME、第一AMF和第二AMF。
该通信系统切换包括以下步骤：
S210，MME向第一AMF发送转发重分配请求(forward relocation request)消息。
具体地，4G通信系统中的MME获知发生用户设备从4G通信系统到5G通信系统的切换，需要为UE在5G通信系统中选择第一AMF继续为UE提供接入和移动管理服务。UE在4G通信系统中接入时，UE和MME会得到一个相同的密钥K ASME，当发生UE从4G通信系统到5G通信系统切换时，MME选择第一AMF并将该K ASME和下一跳参数(next hop parameter，NH)发送给第一AMF，即上述的转发重分配请求消息中携带有K ASME和NH等参数。
本申请实施例中对于MME如何获知发生系统切换的并不限制，可以参考现有协议中对于4G通信系统切换到5G通信系统流程中的规定。例如，可以是4G通信系统的中的基站向MME发送切换请求，使得MME获知用户设备需要从4G通信系统切换到5G通信系统。
另外，本申请实施例中对于MME如何选择到第一AMF也不限制，可以参考现有协议中的规定。例如，MME中保存有运营商配置有至少一个AMF，当MME获知用户设备需要从4G通信系统切换至5G通信系统时，MME从该至少一个AMF中选择上述的第一AMF。
S220，第一AMF确定映射的(mapped)安全上下文。
具体地，第一AMF根据接收到的重分配请求消息中携带的K ASME和NH等参数，推导出映射的安全上下文，映射的安全上下文包括在UE的映射的上下文中。应理解，本申请中所涉及的映射的上下文指的是第一AMF和UE分别基于4G通信系统中UE和MME之间协商生成的上下文，推导得到的UE的安全上下文，对于如何基于4G上下文推导可以参考现有协议的规定，本申请对此过程并不限制，映射的安全上下文指的是第一AMF和UE分别根据MME与用户设备之间的安全上下文获得的。另外，本申请中所涉及的4G通信系统中UE和MME之间协商的上下文，包括UE和MME之间的安全上下文，为了区分也可以称之为UE的4G上下文；同理，本申请中所涉及的UE从4G通信系统切换至5G通信系统之前，UE和第二AMF中保存的UE的安全上下文指的是5G通信系统中UE和第二AMF之间协商的上下文，包括UE和AMF之间的安全上下文，为了区分也可以称 之为UE的5G上下文。
其中，为了便于描述，下文中将第一AMF和UE分别根据MME与用户设备之间的安全上下文推导获得的安全上下文称为映射的安全上下文、将第二AMF和UE之间的安全上下文称为本地(native)安全上下文。
还应理解，本申请实施例中主要涉及的是第二AMF向第一AMF发送UE的安全上下文，而UE的安全上下文作为UE的上下文的一部分，可以随着UE的上下文的传递而传递，所以为了便于描述，本申请实施例中描述可以为发送UE的上下文，或者，本申请实施例中描述可以为发送UE的安全上下文，仅仅是描述上的简便，对本申请实施例的保护范围并不构成任何限定。
上述第一AMF根据接收到的重分配请求消息中携带的K ASME和NH等参数，推导出UE的映射的安全上下文包括第一AMF基于K ASME和NH推导密钥K AMF1。
例如，第一AMF接收到上述的K ASME和NH之后，可以利用预设的推导公式，计算得到密钥K AMF1，推导公式包括：K AMF1＝HMAC-SHA-256(Key，FC||P0||L0)，其中，FC＝0x76、P0＝NH value、L0＝length of NH value(i.e.0x00 0x20)、KEY＝K ASME。第一AMF基于该密钥K AMF1以及与UE协商的安全算法计算得到完整性保护密钥K NASint1和机密性保护密钥K NASenc1，其中，K AMF1、K NASint1和K NASenc1包括在UE的安全上下文中，而K AMF1、K NASint1和K NASenc1是基于K ASME和NH推导得到的，K ASME和NH为UE和MME之间的安全上下文，所以K AMF1、K NASint1和K NASenc1称为UE的映射的安全上下文。
S230，第一AMF向MME发送转发重分配响应(forward relocation response)消息。
具体地，第一AMF确定映射的安全上下文之后，向MME发送转发重分配响应消息，该转发重分配响应消息用于通知MME该第一AMF可以作为UE从4G通信系统切换至5G通信系统时，在5G通信系统中为UE提供接入和移动管理服务的AMF。
S240，MME向UE发送切换命令(handover command)消息。
MME接收到第一AMF发送的转发重分配响应消息之后，获知第一AMF可以为UE提供接入和移动管理服务，则MME向UE发送切换命令消息，使得UE获知可以从4G通信系统切换至5G通信系统。
S250，UE确定映射的安全上下文。
UE接收到切换命令消息之后，对UE中保存的密钥K ASME和NH基于预设的推导公式，计算得到密钥K AMF1，具体地推导过程如上述的S220所示，这里不再赘述。
则S250之后，UE和第一AMF之间获得了相同的密钥K AMF1，该密钥K AMF1可以用于后续的其他密钥的推导。
例如，UE和第一AMF得到一个相同的密钥K AMF1，然后基于K AMF1，以及UE和第一AMF之间协商的非接入层(non-access stratum，NAS)完整性保护算法和机密性保护算法，UE和第一AMF生成用于NAS消息(如注册请求消息)保护的完整性保护密钥K NASint1和机密性保护密钥K NASenc1。具体地，计算K NASint1和K NASenc1如下所示：
K NASint1＝HMAC-SHA-256(KEY，S)，其中，S＝FC||P0 1||L0 1||P1 1||L1 1，FC＝0x69，P0 1＝算法类型(algorithm type distinguisher)、L0 1＝算法类型长度(length of algorithm type distinguisher)(i.e.0x00 0x01)、P1 1＝算法标识(algorithm identity)、L1 1＝算法标识长度(length of algorithm identity)(i.e.0x00 0x01)，KEY＝K AMF1；
K NASenc1＝HMAC-SHA-256(KEY，S)，其中，S＝FC||P0||L0||P1||L1，FC＝0x69，P0＝algorithm type distinguisher、L0＝length of algorithm type distinguisher(i.e.0x00 0x01)、P1＝algorithm identity、L1＝length of algorithm identity(i.e.0x00 0x01)、KEY＝K AMF1。
其中，计算K NASint1、K NASenc1的算法类型以及算法标识不一样。
在切换完成之后，UE会发起移动性注册，即执行S260，UE向第一AMF发送注册请求(registration request)消息，且UE会用基于上述生成的K AMF1推导生成的映射的安全上下文对该注册请求消息进行安全保护，其中，安全保护包括加密保护和/或完整性保护。
应理解，UE向核心网设备发送消息可以通过接入网设备转发的，由于在本申请实施例中对于接入设备的功能并不限定，接入网设备可以为UE为第一AMF之间转发消息，为了简便本申请中之间描述为UE向第一AMF发送注册请求消息、MME向UE发送消息，其中，UE发送的注册请求消息中还包括有映射的上下文中的全球唯一临时用户设备标识(globally unique temporary user equipment identity，GUTI)，该GUTI用于接入网设备确定将该注册请求消息转发给第一AMF，由于该GUTI包括在映射的上下文中，可以称该GUTI为映射的GUTI。
可选地，在UE向第一AMF发送注册请求消息的时候，UE中保存有与其他的AMF(第二AMF)之间的UE的安全上下文和用户设备的5G全球唯一临时用户设备标识(5th generation globally unique temporary user equipment identity，5G-GUTI)，则UE在上述的注册请求消息中携带该5G-GUTI。
应理解，本申请实施例中主要涉及第一AMF如何从第二AMF处成功获得UE的安全上下文的过程，因此，本申请中主要考虑UE在UE向第一AMF发送注册请求消息的时候，UE中保存有与第二AMF之间协商的UE的安全上下文和5G-GUTI的情况。
还应理解，本申请实施例中对于UE和第二AMF之间保存有UE的安全上下文和5G-GUTI的原因并不限制，可以是现有协议中规定的情况。例如，可以是UE在从4G通信系统切换至5G通信系统之前，UE是从5G网络通信系统中切换到了4G通信系统；或者，支持双连接的UE通过非3GPP接入5G通信系统，同时通过3GPP接入4G通信系统，发生4G通信系统到5G通信系统的连接态切换。
应理解，在第二AMF上存在与UE之间UE的安全上下文的情况下，第一AMF需要从第二AMF处获得该UE的安全上下文，具体地，第一AMF从第二AMF处获得UE的安全上下文，是基于从UE处接收到的注册请求消息中携带的5G-GUTI确定的，该5G-GUTI是第二AMF为UE配置，可以用于标识UE和第二AMF。协议规定5G通信系统中存在UE的安全上下文时，优先使用该UE的安全上下文，而不是使用第一AMF和UE之间协商确定的映射的安全上下文，因为该映射的安全上下文是基于4G通信系统中UE和MME之间的UE的安全上下文映射得到的，即图2所示的流程还包括S270，第一AMF发起用户设备上下文传输服务调用请求(Namf_Communication_UEContextTransfer)。
具体地，第一AMF接收到UE发送的注册请求消息，并根据注册请求消息中携带的5G-GUTI向第二AMF发起用户设备上下文传输服务调用请求，该用户设备上下文传输服务调用请求中携带上述的注册请求消息。
应理解，上述的注册请求消息是基于UE和第一AMF之间的映射的安全上下文进行安全护的，第二AMF根据对注册请求消息的校验结果，决定是否向第一AMF返回UE的 安全上下文。即执行S290，第二AMF校验注册请求消息。
一种可能的实现方式，第二AMF校验该注册请求消息失败，第二AMF不会将UE的安全上下文返回给第一AMF，最终导致第一AMF从第二AMF处获取UE的安全上下文失败，则导致第一AMF无法优先利用UE的安全上下文，不符合协议的规定。
另一种可能的实现方式，第二AMF校验注册请求消息完整性成功，则第二AMF将UE的安全上下文传递给第一AMF，执行S291，第二AMF向第一AMF发送UE的安全上下文。可选地，可以描述为第二AMF向第一AMF发送UE的上下文，UE的上下文包括第二AMF与UE之间协商确定的UE的安全上下文，该UE的安全上下文中包括密钥K AMF2和非接入层计数(non-access stratum count，NAS COUNT)等。
可选的，第二AMF在传递UE的安全上下文之前，可能会根据本地策略进对密钥K AMF2进行密钥推演。若第二AMF对K AMF2进行了密钥推演，则向第一AMF发送推演之后的密钥K AMF2’的同时还会携带推演指示信息，用来指示第二AMF对K AMF2进行了密钥推演演。
作为一种可能的实现方式，本申请中所述的密钥推演可以为水平密钥推演；
例如，K AMF2经过水平密钥推演生成为K AMF2’的方式为：
K AMF2’＝HMAC-SHA-256(Key，S)；
FC＝0x72；
P0＝0x01；
L0＝length of P0(i.e.0x00 0x01)；
P1＝uplink NAS COUNT；
L1＝length of P1(i.e.0x00 0x04)；
KEY＝K AMF2；
S＝FC||P0||L0||P1||L1。
作为另一种可能的实现方式，本申请中所述的密钥推演可以为不同的网元之间约定的密钥推演方式。例如，第一AMF和第二AMF之间约定密钥推演方式为预设的密钥推演方式，只要第二AMF向第一AMF发送的UE的安全上下文中包括推演指示信息，第一AMF能够确定接收到的UE的安全上下文中的密钥是第二AMF通过预设的密钥推演方式进行密钥推演得到的。
同样地，第一AMF收到推演指示信息后，也会向UE发送推演指示信息，指示UE对密钥K AMF2进行密钥推演得到密钥K AMF2’，使得UE和网络侧的密钥达成一致，应理解，UE能够确定是对密钥K AMF2进行密钥推演而不是对K AMF进行密钥推演，因为UE接到到指示密钥K AMF2的密钥标识符，因为本申请对密钥标识符并不涉及改进，这里不对密钥标识符进行详细说明。
由图2所示的用户设备从4G通信系统切换到5G通信系统的过程可知，在第二AMF校验UE失败的情况下，上述的第一AMF无法从上述的第二AMF中获得UE的安全上下文。为了避免上述的无法成功获取UE的安全上下文的情况发生，本申请实施例提供一种获取安全上下文的方法，通过第一AMF在从第二AMF处获得UE的安全上下文的时候，携带指示信息，该指示信息表示UE已经通过了校验，而第二AMF根据指示信息不需要对UE进行验证，直接返回UE的安全上下文即可，从而可以避免上述的获取UE的安全 上下文失败的可能。
应理解，本申请中涉及到的对UE进行验证，指的是对UE发送的注册请求消息进行完整性校验，例如，解密该注册请求消息和/或验证该注册请求消息的完整性。由于注册请求消息的完整性验证通过的前提是成功解密该注册请求消息，所以本申请中实施例中将UE通过验证描述为注册请求消息的完整性验证通过。
下面，结合图3详细介绍本申请实施例提供的获取安全上下文的方法。图3是本申请实施例提供的一种获取安全上下文的方法示意图。该示意图包括UE、MME、第一AMF和第二AMF。
该获取安全上下文的方法包括以下步骤：
S310，第一AMF向第二AMF发送第二请求消息。
该第二请求消息用于请求获取UE的安全上下文，该第二请求消息中携带指示信息，该指示信息用于指示UE为合法UE。
可选地，指示信息可以称为原因值(value)。
具体地，第一AMF确定UE为合法的UE主要是判断从UE处接收到的注册请求消息是否满足预设的条件，应理解，第一AMF向第二AMF发送第二请求消息之前，图3所示的方法流程还包括S311-S316：
S311，MME向第一AMF发送转发重分配请求消息，与图2中S210类似，这里不再赘述；
S312，第一AMF确定映射的安全上下文，与图2中S220类似，这里不再赘述；
S313，第一AMF向MME发送转发重分配响应消息，与图2中S230类似，这里不再赘述；
S314，MME向UE发送切换命令消息，与图2中S240类似，这里不再赘述；
S315，UE确定映射的安全上下文，与图2中S250类似，这里不再赘述；
S316，UE向第一AMF发送注册请求消息，与图2中S260类似，这里不再赘述。
进一步地，第一AMF确定所述注册请求消息满足预设条件包括：
第一AMF成功校验注册请求消息的完整性保护；或者，
第一AMF确定注册请求消息，为UE从4G通信系统切换至5G通信系统后发送的注册请求消息。例如，第一AMF在接收到UE发送的注册请求消息之前，接收到MME发送的转发重分配请求消息，则第一AMF能够获知当前接收到的注册请求消息，是在切换过程中从UE接收到的注册请求消息。
具体地，第一AMF成功校验注册请求消息的完整性保护也可以称之为第一AMF验证UE成功，即图3所示的方法流程还包括S317，第一AMF验证UE。
作为一种可能的实现方式，该第二请求消息为图2中所示的第一AMF发起用户设备上下文传输服务调用请求(Namf_Communication_UEContextTransfer)，与图2中所示的用户设备上下文传输服务调用请求不同的是，本申请实施例中的用户设备上下文传输服务调用请求中新增信息元素(information element，IE)-指示信息。
作为另一种可能的实现方式，第二请求消息为第一AMF向第二AMF发送的用于获取UE的安全上下文的其他可能的第二请求消息。
应理解，本申请中对于第二请求消息的具体形式并不限制，可以是在第一AMF和第 二AMF之间已有的信令中，新增上述的指示信息，还可以是第一AMF和第二AMF之间新增的信令。
作为另一种可能的实现方式，本申请实施例中只限定第一AMF需要在向第二AMF发送用户设备上下文传输服务调用请求之前，将上述的指示信息发送给第二AMF，也就是说第一AMF可以直接向第二AMF发送指示信息，无需将该指示信息携带在上述的第二请求消息中，该可能的实现方式在图3中并未示出。
还应理解，本申请中对于上述指示信息具体如何指示UE为合法UE并不限制。一种可能的实现方式，指示信息可以是复用上述UE的5G-GUTI，则该5G-GUTI可以标识该UE还可以用于表示该UE为合法UE，在这种实现方式下，对现有的IE增加了新的指示功能，可以通过预定义的方式通知第二AMF该5G-GUTI具有新的功能；另一种可能的实现方式，指示信息可以是新增的至少一个比特位，该比特位值设为1，表示UE为合法的UE。上述的可能的实现方式仅仅是举例说明，对本申请的保护范围不构成任何限定。
作为一种可能的实现方式，上述的指示信息为显示地指示UE为合法的UE；或者，作为另一种可能的实现方式，上述的指示信息为隐式地指示UE为合法的UE，例如，指示信息指示第一AMF从UE处接收到的注册请求消息完整性校验通过。
进一步地，为了使得第二AMF确定第一AMF是需要获得UE的安全上下文，上述第二请求消息中还需要携带UE的标识。
作为一种可能的实现方式，UE的标识可以是上述的5G-GUTI；
作为另一种可能的实现方式，UE的标识可以是用户永久标识(subscriber permanent identity，SUPI)。
应理解，第一AMF从UE处接收到UE的5G-GUTI之后，确定需要从第二AMF处获得UE的安全上下文，则可以选择继续在第二请求消息中携带UE的5G-GUTI，或者，携带UE的SUPI，或者，携带UE的5G-GUTI和UE的SUPI。
可选地，为了使得第二AMF能够获得UE的上行非接入层计数器(uplink non-access stratum count，UL NAS COUNT)，一种可能的实现方式是上述第二请求消息中携带明文的注册请求消息，该明文的注册请求消息中包括UL NAS COUNT；或者，一种可能的实现方式是上述第二请求消息中携带UL NAS COUNT。
进一步地，第二AMF接收到第一AMF发送的第二请求消息之后，第二AMF基于指示信息获知UE为合法的UE，第二AMF无需进行UE验证，即执行S320，第二AMF确定无需进行验证。
S330，第二AMF向第一AMF发送第二响应消息。
该第二响应消息中携带UE的安全上下文。
本申请实施例中第二AMF无需对UE进行验证，接收到第一AMF发送的第二请求消息之后，直接将UE的安全上下文返回给第一AMF，则不存在由于第二AMF验证UE失败而导致的第一AMF获取UE的安全上下文失败。
可选地，当第二请求消息中携带明文的注册请求消息，或者，第二请求消息中携带UL NAS COUNT的情况下，第二AMF能够获得UL NAS COUNT。例如，由于明文的注册请求消息为未安全保护的注册请求消息，第二AMF无需验证该明文的注册请求消息，可以直接从明文的注册请求消息中获得UL NAS COUNT。
进一步地，第二AMF能够根据该UL NAS COUNT对UE的安全上下文中的第一密钥进行密钥推演，在此情况下，第二AMF返回给第一AMF的UE的安全上下文中的密钥为第一密钥进行密钥推演得到的第二密钥。
具体地，第二AMF发送给第一AMF的UE的安全上下文中的密钥为上述的第二密钥时，第二AMF还需要向第一AMF发送密钥推演指示信息，用于指示第二密钥为进行密钥推演得到的密钥。
应理解，第一AMF获得UE的安全上下文之后的流程与现有中的UE从4G通信系统切换至5G通信系统流程中第一AMF获得UE的安全上下文之后的流程类似，参考现有流程即可，这里不再赘述。
图3所示的获取安全上下文的方法，主要是在第一AMF向第二AMF发送的第二请求消息中携带指示信息，该指示信息用于指示UE为合法UE。从而第二AMF可以基于该指示信息判断UE为合法的UE，第二AMF无需验证UE，第二AMF在接收到携带指示信息的第二请求消息之后，直接将UE的安全上下文返回给第一AMF，从而避免了第二AMF验证UE失败导致第一AMF获取UE的安全上下文失败。本申请还提供另外一种获取安全上下文的方法，第二AMF验证UE，但是该方法能够提高第二AMF验证UE成功的可能性，从而提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
下面，结合图4详细介绍该获取安全上下文的方法。图4是本申请实施例提供的另一种获取安全上下文的方法示意图。该示意图包括UE、MME、第一AMF和第二AMF。
该获取安全上下文的方法包括以下步骤：
S410，UE确定第一注册请求消息。
该第一注册请求消息中携带第二注册请求消息，其中，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述UE与第二AMF之间的本地(native)安全上下文。
具体地，UE确定第一注册请求消息主要涉及UE确定第二注册请求消息，该第二注册请求消息为UE对第四注册请求消息用native安全上下文完整性保护之后的消息，该第四注册请求消息中包括UE与第二AMF之间的UE的上下文中的GUTI、密钥标识符(ngKSI)信息、UL NAS COUNT，为了便于区分该GUTI可以称之为本地GUTI、该密钥标识符可以称之为本地密钥标识符。
可选地，第四注册请求消息可以为以下几种可能的情况：
情况一：
第四注册请求消息为UE基于上述的本地GUTI、本地密钥标识符和UL NAS COUNT生成的一个消息，在该情况一下第四注册请求消息还可以称之为第四消息或其他可能的名称，本申请实施例中对于消息的名称并不做限定。
应理解，UE基于UE与第二AMF之间的UE的上下文生成第四注册请求消息还可以是其他的形式，例如，UE生成的第四注册请求消息中除了包括上述的本地GUTI、本地密钥标识符和UL NAS COUNT还包括其他的信息元素(information element，IE)。
在情况一下，UE基于第一安全上下文对第四注册请求消息进行完整性保护包括：UE基于所述第一安全上下文对该第四注册请求消息进行完整性保护，生成第一MAC。因此，在第一注册请求消息中携带第二注册请求消息也可以理解为：在第一注册请求消息中携带 第一MAC以及所述第四注册请求消息。
进一步地，在情况一下，UE确定第一注册请求消息包括以下步骤：
步骤一：
UE构造的第四注册请求消息；
步骤二：
UE基于所述UE与第二AMF之间的安全上下文对第四注册请求消息进行完整性保护，生成第一MAC；
步骤三：
UE基于所述UE与第一AMF之间的映射的安全上下文对第三注册请求消息和第二注册请求消息(RR2)，进行完整性保护，生成第五MAC，其中，第三注册请求消息为图2所示的方法流程S260中UE向第一AMF发送的注册请求消息，具体地，该第三注册请求消息中包括UE与第一AMF之间的映射的上下文中的GUTI、密钥标识符信息，为了便于区分该GUTI可以称之为映射的GUTI、该密钥标识符可以称之为映射的密钥标识符。
则在该情况下，第一注册请求消息中包括第四注册请求消息(RR4)、第三注册请求消息(RR3)，第五MAC(MAC5)和第一MAC(MAC1)，其中，MAC1为对RR4用本地安全上下文进行完整性保护得到的MAC值，MAC5为对RR3和RR2用映射的安全上下文进行完保得到的MAC值(或者，MAC5为对RR3、RR4和MAC1用映射的安全上下文进行完保得到的MAC值)；也可以理解为第一注册请求消息为依次基于native安全上下文和映射的安全上下文进行完整性保护的消息。
情况二：
第四注册请求消息为UE基于映射的安全上下文对第三注册请求消息进行完整性保护之后的注册请求消息。
在情况二下，UE基于第一安全上下文对第四注册请求消息进行完整性保护包括：UE基于所述第一安全上下文对该第四注册请求消息进行完整性保护，生成第一MAC。因此，在第一注册请求消息中携带第二注册请求消息也可以理解为：在第一注册请求消息中携带第一MAC和所述第四注册请求消息。
进一步地，在情况二下，UE确定第一注册请求消息包括以下步骤：
步骤一：
UE基于UE与第一AMF之间的映射的安全上下文对第三注册请求消息进行完整性保护，生成第三MAC；
步骤二：
UE基于所述UE与第二AMF之间的native安全上下文，对步骤一中的基于映射的安全上下文进行完整性保护之后的第三注册请求消息，再次进行完整性保护，生成第一MAC；
则在该情况下，第一注册请求消息中包括第三注册请求消息(RR3)、第三MAC(MAC3)和第一MAC(MAC1)，其中，MAC3为对RR3用映射的安全上下文进行完整性保护得到的MAC值，MAC1为对RR3和MAC3用本地安全上下文进行完整性保护得到的MAC值；也可以理解为第一注册请求消息为依次基于映射的安全上下文和native安全上下文完整性保护的消息。
情况三：
第四注册请求消息为：第三注册请求消息，其中，第三注册请求消息为图2所示的方法流程S260中UE向第一AMF发送的注册请求消息。
在情况二下，UE基于第一安全上下文对第四注册请求消息进行完整性保护包括：UE基于所述第一安全上下文对该第四注册请求消息进行完整性保护，生成第一MAC。因此，在第一注册请求消息中携带第二注册请求消息也可以理解为：在第一注册请求消息中携带第一MAC和所述第四注册请求消息。
进一步地，在情况三下，UE确定第一注册请求消息包括以下步骤：
步骤一：
UE基于UE与第二AMF之间的native安全上下文对第三注册请求消息进行完整性保护，生成第一MAC；
步骤二：
UE基于所述UE与第一AMF之间的映射的安全上下文，对步骤一中的基于native安全上下文进行完整性保护之后的第三注册请求消息，再次进行完整性保护，生成第四MAC；
则在该情况下，第一注册请求消息中包括第三注册请求消息(RR3)、第一MAC(MAC1)和第四MAC(MAC4)其中，MAC1为对RR3用本地安全上下文进行完整性保护得到的MAC值，MAC4为对RR3和MAC1用映射的安全上下文进行完整性保护得到的MAC值，；也可以理解为第一注册请求消息为依次基于native安全上下文和映射的安全上下文完整性保护的消息。
应理解，在情况一下，第一AMF能够根据UE发送的第一注册请求消息中同时携带映射的GUITI和本地GUTI确定将经由native安全上下文完整性保护的第二注册请求消息发送给第二AMF。
还应理解，上述的情况一-情况三只是以举例的形式说明第二注册请求消息可能的情况，以及UE如何确定上述的第一注册请求消息，其他未列举出的第二注册请求可能的形式也在本申请的保护范围之内，例如，上述第四注册请求消息为UE基于native上下文构成其他的可能的消息。
S420，UE向第一AMF发送第一注册请求消息。
具体地，UE将S410中确定的第一注册请求消息发送给第一AMF。
应理解，UE向第一AMF发送第一注册请求消息可以经由接入网设备的转发，本申请中对接入网设备的功能并不限定，因此可以直接描述为UE向第一AMF发送第一注册请求消息。
还应理解，UE在向第一AMF发送第一注册请求消息之前，UE需要确定映射的安全上下文，则UE向第一AMF发送第一注册请求消息之前，图4所示的方法流程还包括S411-S414：
S411，MME向第一AMF发送转发重分配请求消息，与图2中S210类似，这里不再赘述；
S412，第一AMF确定映射的安全上下文，与图2中S220类似，这里不再赘述；
S413，第一AMF向MME发送转发重分配响应消息，与图2中S230类似，这里不再 赘述；
S414，MME向UE发送切换命令消息，与图2中S240类似，这里不再赘述；
具体地，UE收到切换命令消息后，推导出映射的安全上下文。进而，UE利用native安全上下文和mapped安全上下文对上述的第一注册请求消息进行安全保护。
S430，第一AMF验证UE。
具体地，第一AMF确定UE为合法的UE主要是判断从UE处接收到的第一注册请求消息是否满足预设的条件。第一AMF确定所述第一注册请求消息满足预设条件包括：
第一AMF基于映射的安全上下文成功校验第一注册请求消息的完整性保护；或者，
第一AMF确定第一注册请求消息，为UE从4G通信系统切换至5G通信系统后发送的注册请求消息。例如，第一AMF在接收到UE发送的第一注册请求消息之前，接收到MME发送的转发重分配请求消息，则第一AMF能够获知当前接收到的第一注册请求消息，是在切换过程中从UE接收到的注册请求消息。
第一AMF验证UE为合法的UE之后，第一AMF向第二AMF发送第二注册请求消息，该第二注册请求消息用于第二AMF验证UE。即图4所示的方法流程还包括S440，第一AMF向第二AMF发送第二注册请求消息。
可选地，第二注册请求消息携带在第一请求消息中，由第一AMF发送给第二AMF。
作为一种可能的实现方式，该第一请求消息为图2中所示的第一AMF发起用户设备上下文传输服务调用请求(Namf_Communication_UEContextTransfer)，与图2中所示的用户设备上下文传输服务调用请求不同的是，本申请实施例中的用户设备上下文传输服务调用请求中新增信元-第一MAC。
作为另一种可能的实现方式，第一请求消息为第一AMF向第二AMF发送的用于获取UE的安全上下文的其他可能的第一请求消息。
应理解，本申请中对于第一请求消息的具体形式并不限制，可以是在第一AMF和第二AMF之间已有的信令中，新增上述的第一MAC，还可以是第一AMF和第二AMF之间新增的信令。
进一步地，为了使得第二AMF确定第一AMF是需要获得UE的安全上下文，上述第一请求消息中还携带有UE的标识。具体地，该UE的标识包括在上述第一AMF向第二AMF发送的第二注册请求消息中。
作为一种可能的实现方式，UE的标识可以是上述的映射的GUTI；
作为一种可能的实现方式，UE的标识可以是上述的本地GUTI；
作为另一种可能的实现方式，UE的标识可以是SUPI。
应理解，第一AMF从UE处接收到UE的映射的GUTI之后，确定需要从第二AMF处获得UE的安全上下文，则可以选择继续在第一请求消息中携带UE的映射的GUTI，或者，携带UE的SUPI，或者，携带UE的映射的GUTI和UE的SUPI。
还应理解，当第一AMF接收到的第一注册请求消息为S410中情况一所示的情况下，则第一注册请求消息中携带有第二注册请求消息，而第二注册请求消息中包括有本地GUTI，那么在该情况下，第一AMF可以选择在第一请求消息中携带UE的本地GUTI。
进一步地，上述的第二注册请求消息中还包括UE的UL NAS COUNT，使得第二AMF能够获得UE的UL NAS COUNT。
进一步地，第二AMF接收到第一AMF发送的第一请求消息之后，第二AMF基于第二注册请求消息的完整性校验结果判断UE是否为合法的UE，即执行S450，第二AMF校验第二注册请求消息的完整性。
所述第二AMF根据所述第二AMF与所述用户设备之间的安全上下文对所述第二注册请求消息进行完整性校验。例如，第二AMF基于本地保存的安全上下文生成第二MAC，对比第一MAC和第二MAC，当第一MAC和第二MAC相等的情况下，第二AMF验证UE成功，确定UE合法的UE，则第二AMF向第一AMF发送UE的安全上下文。
应理解，上述的第一MAC为UE基于UE和第二AMF之间协商的UE的安全上下文生成的MAC、第二MAC为第二AMF基于UE和第二AMF之间协商的UE的安全上下文生成的MAC，所以大概率下第一MAC和第二MAC是相等的第二AMF能够验证UE成功，向第一AMF返回UE的安全上下文，除非发生传输错误的小概率事件发生，而导致第二AMF验证失败。图4所示的获取安全上下文的方法与图2中所示的方法流程相比提高第一AMF成功从第二AMF处获取用户设备的安全上下文的可能性。
在第二AMF校验第二注册请求消息的完整性成功之后，执行S460，第二AMF向第一AMF发送UE的安全上下文。
可选地，该UE的安全上下文携带在第一响应消息中。
进一步地，该UE的安全上下文包括在UE的上下文中，则第二AMF可以向第一AMF发送UE的上下文。
可选地，第二AMF能够根据UL NAS COUNT对UE的安全上下文中的第一密钥进行密钥推演，在此情况下，第二AMF返回给第一AMF的UE的安全上下文中的密钥为第一密钥进行密钥推演得到的第二密钥。其中，本申请实施例中可以将包括该进行密钥推演生成的第二密钥的UE的安全上下文称为第二安全上下文，也就是说第二AMF向第一AMF发送UE的安全上下文可以是未经过密钥推演的，第二AMF中本地保存的第二AMF和UE之间的UE的安全上下文，或者，当第二AMF根据本地策略对本地保存的第二AMF和UE之间的UE的安全上下文中的密钥，进行过密钥推演生成了推演后的密钥的情况下，第二AMF向第一AMF发送UE的安全上下文可以是上述的第二安全上下文。
具体地，第二AMF发送给第一AMF的UE的安全上下文中的密钥为上述的第二密钥时，第二AMF还需要向第一AMF发送密钥推演指示信息，用于指示第二密钥为进行密钥推演得到的密钥。
应理解，第一AMF获得UE的安全上下文之后的流程与现有中的UE从4G通信系统切换至5G通信系统流程中第一AMF获得UE的安全上下文之后的流程类似，参考现有流程即可，这里不再赘述。
例如，后续UE和第一AMF之间协商使用上述的native安全上下文，具体地，第一AMF向UE发送非接入层安全模式命令(non-access layer secure mode command，NAS SMC)消息，UE对NAS SMC消息进行完整性校验，当UE校验NAS SMC成功之后，UE向第一AMF发送非接入层安全模式完成(non-access layer security mode complete)消息。
作为一种可能的实现方式，当第二AMF校验第二注册请求消息的完整性失败的情况下，第二AMF向第一AMF发送失败指示信息，用于通知第一AMF，该第二AMF校验 第二注册请求消息的完整性失败。
进一步地，第一AMF在接收到指示第二AMF校验第二注册请求消息的完整性失败的失败指示信息之后，第一AMF基于本地策略确定第一AMF可以继续使用上述映射的安全上下文，或者，第一AMF基于本地策略确向UE发起初始认证，生成新的第一AMF和UE之间的安全上下文。
应理解，上述方法实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
上面结合图3和图4详细介绍了本申请实施例提供的获取安全上下文的方法，下面结合图5-图10详细介绍本申请实施例提供的获取安全上下文的装置。
参见图5，图5是本申请提出的获取安全上下文的装置50的示意图。如图5所示，装置50包括发送单元510、处理单元520和接收单元530。
发送单元510，用于向第一AMF发送第一注册请求消息；
处理单元520，用于确定第一注册请求消息；
接收单元530，用于接收MME发送的切换命令消息。
装置50和方法实施例中的用户设备完全对应，装置50可以是方法实施例中的用户设备，或者方法实施例中的用户设备内部的芯片或功能模块。装置50的相应单元用于执行图3和图4所示的方法实施例中由用户设备执行的相应步骤。
其中，装置50中的发送单元510执行方法实施例中用户设备发送的步骤。例如，执行图3中向第一AMF发送发送注册请求消息的步骤S316和执行图4中向第一AMF发送发送第一注册请求消息的步骤S420；
处理单元520执行方法实施例中用户设备内部实现或处理的步骤。例如，执行图3中确定映射的安全上下文的步骤S315和执行图4中确定第一注册请求消息的步骤S410；
接收单元530执行方法实施例中用户设备接收的步骤。例如，执行图3中接收MME发送的切换命令消息的步骤S314和执行图4中接收MME发送的切换命令消息的步骤S414。
装置50中所示发送单元510和接收单元530可以组成收发单元，同时具有接收和发送的功能。其中，处理单元520可以是处理器。发送单元510可以是发射器，接收单元530可以是接收器。接收器和发射器可以集成在一起组成收发器。
参见图6，图6是适用于本申请实施例的用户设备60的结构示意图。该用户设备60可应用于图1所示出的系统中。为了便于说明，图6仅示出了用户设备的主要部件。如图6所示，用户设备60包括处理器(对应于图5中所示的处理单元520)、存储器、控制电路、天线以及输入输出装置(对应于图5中所示的发送单元510和接收单元530)。处理器用于控制天线以及输入输出装置收发信号，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，以执行本申请提出的获取安全上下文的方法中由用户设备执行的相应流程和/或操作。此处不再赘述。
本领域技术人员可以理解，为了便于说明，图6仅示出了一个存储器和处理器。在实际的用户设备中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
参见图7，图7是本申请提出的获取安全上下文的装置70的示意图。如图7所示，装置70包括接收单元710、处理单元720和发送单元730。
接收单元710，用于接收用户设备发送的第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，其中，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；
处理单元720，用于确定映射的安全上下文；
发送单元730，用于向第二AMF发送第二注册请求消息。
装置70和方法实施例中的第一AMF完全对应，装置70可以是方法实施例中的第一AMF，或者方法实施例中的第一AMF内部的芯片或功能模块。装置70的相应单元用于执行图3和图4所示的方法实施例中由第一AMF执行的相应步骤。
其中，装置70中的接收单元710执行方法实施例中第一AMF接收的步骤。例如，执行图3中接收MME发送的转发重分配请求消息的步骤S311、执行图4中接收MME发送的转发重分配请求消息的步骤S411、执行图3中接收UE发送的注册请求消息的步骤S316、执行图3中接收UE发送的第一注册请求消息的步骤S420、执行图3中接收第二AMF发送的第二响应消息的步骤S330、执行图4中接收第二AMF发送的UE的安全上下文的步骤S460。
处理单元720执行方法实施例中第一AMF内部实现或处理的步骤。例如，执行图3中确定映射的安全上下文的步骤S312、执行图4中确定映射的安全上下文的步骤S412、执行图3中验证UE的步骤S317、执行图4中验证UE的步骤S430。
发送单元730执行方法实施例中第一AMF发送的步骤。例如，执行图3中向MME发送转发重分配响应消息的步骤S313、执行图4中向MME发送转发重分配响应消息的步骤S413、执行图3中向第二AMF发送第二请求消息的步骤S310、执行图4中向第二AMF发送第二注册请求消息的步骤S440。
接收单元710和发送单元730可以组成收发单元，同时具有接收和发送的功能。其中，处理单元720可以是处理器。发送单元730可以是发射器。接收单元710可以是接收器。接收器和发射器可以集成在一起组成收发器。
如图8所示，本申请实施例还提供了一种第一AMF 80，该第一AMF 80包括处理器810，存储器820与收发器830，其中，存储器820中存储指令或程序，处理器830用于执行存储器820中存储的指令或程序。存储器820中存储的指令或程序被执行时，收发器830用于执行图7所示的装置70中的接收单元710与发送单元730执行的操作。
参见图9，图9是本申请提出的获取安全上下文的装置90的示意图。如图9所示，装置90包括接收单元910、处理单元920和发送单元930。
接收单元910，用于接收第一AMF发送的第二注册请求消息，其中，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文；
处理单元920，用于校验所述第二注册请求消息的完整性；
发送单元930，当处理单元920校验所述第二注册请求消息的完整性成功，向所述第 一AMF发送所述用户设备的安全上下文。
装置90和方法实施例中的第二AMF完全对应，装置90可以是方法实施例中的第二AMF，或者方法实施例中的第二AMF内部的芯片或功能模块。装置80的相应单元用于执行图3和图4所示的方法实施例中由第二AMF执行的相应步骤。
其中，装置90中的接收单元910执行方法实施例中第二AMF接收的步骤。例如，执行图3中接收第一AMF发送的第二请求消息的步骤S310、执行图4中接收第一AMF发送的第二注册请求消息的步骤S440。
处理单元920执行方法实施例中第二AMF内部实现或处理的步骤。例如，执行图3中确定无需验证UE的步骤S320、执行图4中校验第二注册请求消息的完整性的步骤S450。
发送单元930执行方法实施例中第二AMF发送的步骤。例如，执行图3中向第一AMF发送第二响应消息的步骤S330、执行图4中向第一AMF发送UE的安全上下文的步骤S460。
接收单元910和发送单元930可以组成收发单元，同时具有接收和发送的功能。其中，处理单元920可以是处理器。发送单元930可以是发射器，接收单元910可以是接收器。接收器和发射器可以集成在一起组成收发器。
如图10所示，本申请实施例还提供了一种第二AMF 100，该第二AMF 100包括处理器1010，存储器1020与收发器1030，其中，存储器1020中存储指令或程序，处理器1030用于执行存储器1020中存储的指令或程序。存储器1020中存储的指令或程序被执行时，收发器1030用于执行图9所示的装置90中的接收单元910与发送单元930执行的操作。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图3和图4所示的方法中第一AMF执行的各个步骤。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述如图3和图4所示的方法中第二AMF执行的各个步骤。
本申请实施例还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图3和图4所示的方法中第一AMF执行的各个步骤。
本申请实施例还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如图3和图4所示的方法中第二AMF执行的各个步骤。
本申请实施例还提供一种芯片，包括处理器。该处理器用于读取并运行存储器中存储的计算机程序，以执行本申请提供的获取安全上下文的方法中由第二AMF执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连接，处理器用于读取并执行该存储器中的计算机程序。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是输入输出接口。
本申请还提供一种芯片，包括处理器。该处理器用于调用并运行存储器中存储的计算机程序，以执行本申请提供的获取安全上下文的方法中由第一AMF执行的相应操作和/或流程。可选地，该芯片还包括存储器，该存储器与该处理器通过电路或电线与存储器连 接，处理器用于读取并执行该存储器中的计算机程序。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理。该通信接口可以是输入输出接口。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器((R)ANdom Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
另外，本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系；本申请中术语“至少一个”，可以表示“一个”和“两个或两个以上”，例如，A、B和C中至少一个，可以表示：单独存在A，单独存在B，单独存在C、同时存在A和B，同时存在A和C，同时存在C和B，同时存在A和B和C，这七种情况。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (47)

  1. 一种获取安全上下文的方法，其特征在于，包括：
    第一接入和移动管理功能AMF接收用户设备发送的第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，
    其中，所述第二注册请求消息被第一安全上下文进行过完整性保护，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；
    所述第一AMF向所述第二AMF发送所述第二注册请求消息；
    所述第二AMF校验所述第二注册请求消息的完整性；
    若所述第二AMF校验所述第二注册请求消息的完整性成功，则所述第二AMF向所述第一AMF发送所述用户设备的安全上下文。
  2. 根据权利要求1所述的方法，其特征在于，所述用户设备的安全上下文包括：
    所述第一安全上下文，或者，基于所述第一安全上下文获得的第二安全上下文。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一AMF向所述第二AMF发送所述第二注册请求消息，包括：
    所述第一AMF向所述第二AMF发送用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求中携带所述第二注册请求消息。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述第二AMF向所述第一AMF发送所述用户设备的安全上下文，包括：
    所述第二AMF向所述第一AMF发送第一响应消息，所述第一响应消息中携带所述用户设备的安全上下文。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    当所述第一AMF接收到所述第二AMF校验所述第二注册请求消息的完整性失败的消息时，所述第一AMF继续使用映射的安全上下文或向所述用户设备发起初始认证。
  6. 根据权利要求5中所述的方法，其特征在于，所述映射的安全上下文是根据移动管理实体MME与所述用户设备之间的安全上下文获得的，其中，所述MME为所述4G通信系统中的网元。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第二AMF校验所述第二注册请求消息的完整性，包括：
    所述第二AMF根据所述第一安全上下文对所述第二注册请求消息的完整性进行校验。
  8. 一种获取安全上下文的方法，其特征在于，包括：
    用户设备确定第二注册请求消息，所述第二注册请求消息被第一安全上下文进行过完整性保护，其中，所述第一安全上下文为所述用户设备与第二接入和移动管理功能AMF之间的本地安全上下文；
    所述用户设备向第一AMF发送第一注册请求消息，所述第一注册请求消息中携带所 述第二注册请求消息，
    其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF。
  9. 根据权利要求8所述方法，其特征在于，所述方法还包括：
    若接收到所述第一AMF发送的非接入层安全模式命令NAS SMC消息，则对所述NAS SMC进行完整校验；
    若校验成功，则向所述第一AMF发送非接入层安全模式完成消息。
  10. 一种通信系统，其特征在于，所述通信系统中包括第一接入和移动管理功能AMF和第一AMF，
    所述第一AMF，用于接收用户设备发送的第一注册请求消息，所述第一注册请求消息中携带第二注册请求消息，其中，所述第二注册请求消息被第一安全上下文进行过完整性保护，其中，所述第一安全上下文为所述用户设备与第二AMF之间的本地安全上下文，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF；
    所述第一AMF，还用于向所述第二AMF发送所述第二注册请求消息；
    所述第二AMF，用于校验所述第二注册请求消息的完整性；
    所述第二AMF，还用于若校验所述第二注册请求消息的完整性成功，则向所述第一AMF发送所述用户设备的安全上下文。
  11. 根据权利要求10所述的通信系统，其特征在于，所述用户设备的安全上下文包括：
    所述第一安全上下文，或者，基于所述第一安全上下文获得的第二安全上下文。
  12. 根据权利要求10或11所述的通信系统，其特征在于，
    所述第一AMF，具体用于向所述第二AMF发送用户设备上下文传输服务调用请求，所述用户设备上下文传输服务调用请求中携带所述第二注册请求消息。
  13. 根据权利要求10至12中任一项所述的通信系统，其特征在于，
    所述第二AMF，具体用于向所述第一AMF发送第一响应消息，所述第一响应消息中携带所述用户设备的安全上下文。
  14. 根据权利要求10至13中任一项所述的通信系统，其特征在于，
    所述第一AMF，还用于当接收到所述第二AMF校验所述第二注册请求消息的完整性失败的消息时，继续使用映射的安全上下文或向所述用户设备发起初始认证。
  15. 根据权利要求14所述的通信系统，其特征在于，所述映射的安全上下文是根据移动管理实体MME与所述用户设备之间的安全上下文获得的，其中，所述MME为所述4G通信系统中的网元。
  16. 根据权利要求10至15中任一项所述的通信系统，其特征在于，
    所述第二AMF，具体用于根据所述第一安全上下文对所述第二注册请求消息进行完整性校验。
  17. 一种获取安全上下文的装置，其特征在于，包括：
    处理单元，用于确定第二注册请求消息，所述第二注册请求消息被第一安全上下文进行过完整性保护，其中，所述第一安全上下文为所述用户设备与第二接入和移动管理功能 AMF之间的本地安全上下文；
    发送单元，用于向第一AMF发送第一注册请求消息，所述第一注册请求消息中携带所述第二注册请求消息，其中，所述第一AMF为所述用户设备从4G通信系统切换至5G通信系统后，为所述用户设备提供接入和移动管理服务的AMF。
  18. 根据权利要求17所述装置，其特征在于，所述装置还包括接收单元；
    所述处理单元，用于若所述接收单元接收到所述第一AMF发送的非接入层安全模式命令NAS SMC消息，则对所述NAS SMC进行完整校验；
    所述发送单元，还用于若所述校验成功，则向所述第一AMF发送非接入层安全模式完成消息。
  19. 一种计算机可读存储介质，其特征在于，包括：所述计算机可读介质存储有计算机程序；所述计算机程序在计算机上运行时，使得计算机执行权利要求1-9中任一项项所述的方法。
  20. 一种获取安全上下文的方法，其特征在于，所述方法包括：
    第一接入和移动管理功能AMF接收用户设备UE发送的第一注册请求消息；
    所述第一AMF对所述第一注册请求消息进行进行完整性保护校验；
    若所述第一AMF成功校验所述第一注册请求消息的完整性保护，则所述第一AMF向第二AMF发送第二请求消息；
    所述第二AMF接收所述第二请求消息；
    若所述第二请求消息中携带指示信息且所述指示信息用于指示所述UE为合法UE，所述第二AMF向所述第一AMF发送所述UE的安全上下文。
  21. 根据权利要求20所述的方法，其特征在于，所述方法还包括：
    移动管理网元MME向所述第一AMF发送转发重分配请求消息，所述转发重分配请求消息包括所述UE和所述MME之间的安全上下文；
    所述第一AMF根据所述用户设备和所述MME之间的安全上下文确定映射的安全上下文；
    所述第一AMF对所述第一注册请求消息进行进行完整性保护校验，包括：
    所述第一AMF利用所述映射的安全上下文对所述第一注册请求消息进行进行完整性保护校验。
  22. 根据权利要求20或21所述的方法，其特征在于，所述第一注册请求消息中还包括所述用户设备的标识5G-GUTI。
  23. 根据权利权利要求22所述的方法，其特征在于，所述指示信息为所述5G-GUTI。
  24. 根据权利要求20至22任一所述的方法，其特征在于，所述指示信息为原因值。
  25. 一种获取安全上下文的系统，其特征在于，所述系统包括第一接入和移动管理功能AMF和第二AMF；
    所述第一AMF，用于接收用户设备UE发送的第一注册请求消息；对所述第一注册请求消息进行进行完整性保护校验；若成功校验所述第一注册请求消息的完整性保护，则向第二AMF发送第二请求消息；
    所述第二AMF，用于接收所述第二请求消息；若所述第二请求消息中携带指示信息且所述指示信息用于指示所述UE为合法UE，则向所述第一AMF发送UE的安全上下文。
  26. 根据权利要求25所述的系统，其特征在于，所述系统还包括移动管理网元MME；
    所述MME，用于向所述第一AMF发送转发重分配请求消息，所述转发重分配请求消息包括所述UE和所述MME之间的安全上下文；
    所述第一AMF，还用于根据所述用户设备和所述MME之间的安全上下文确定映射的安全上下文；
    其中，所述对所述第一注册请求消息进行进行完整性保护校验，包括：
    利用所述映射的安全上下文对所述第一注册请求消息进行进行完整性保护校验。
  27. 根据权利要求25或26所述的系统，其特征在于，所述第一注册请求消息中还包括所述用户设备的标识5G-GUTI。
  28. 根据权利权利要求27所述的系统，其特征在于，所述指示信息为所述5G-GUTI。
  29. 根据权利要求25至27任一所述的系统，其特征在于，所述指示信息为原因值。
  30. 一种获取安全上下文的方法，其特征在于，所述方法包括：
    第一接入和移动管理功能AMF接收用户设备UE发送的第一注册请求消息；
    所述第一AMF对所述第一注册请求消息进行进行完整性保护校验；
    若所述第一AMF成功校验所述第一注册请求消息的完整性保护，则所述第一AMF向第二AMF发送第二请求消息；所述第二请求消息中携带指示信息且所述指示信息用于指示所述UE为合法UE。
  31. 根据权利要求30所述的方法，其特征在于，所述方法还包括：
    所述第一AMF接收移动管理网元MME发送的转发重分配请求消息，所述转发重分配请求消息包括所述用户设备和所述MME之间的安全上下文；
    所述第一AMF根据所述UE和所述MME之间的安全上下文确定映射的安全上下文；
    所述第一AMF对所述第一注册请求消息进行进行完整性保护校验，包括：
    所述第一AMF利用所述映射的安全上下文对所述第一注册请求消息进行进行完整性保护校验。
  32. 根据权利要求30或31所述的方法，其特征在于，所述第一注册请求消息中还包括所述用户设备的标识5G-GUTI。
  33. 根据权利权利要求32所述的方法，其特征在于，所述指示信息为所述5G-GUTI。
  34. 根据权利要求30至32任一所述的方法，其特征在于，所述指示信息为原因值。
  35. 一种获取安全上下文的方法，其特征在于，所述方法包括：
    第二接入和移动管理功能AMF接收第一AMF发送的请求消息；
    若所述请求消息中携带指示信息且所述指示信息用于指示用户设备UE为合法UE，所述第二AMF向所述第一AMF发送所述UE的安全上下文。
  36. 根据权利要求35所述的方法，其特征在于，所述第二AMF向所述第一AMF发送所述UE的安全上下文之前，所述方法还包括：
    所述第二AMF跳过对所述UE的认证。
  37. 根据权利权利要求35或36所述的方法，其特征在于，所述指示信息为所述5G-GUTI。
  38. 根据权利要求35或36所述的方法，其特征在于，所述指示信息为原因值。
  39. 一种通信装置，其特征在于，所述装置包括括处理器，存储器与收发器；所述存 储器中存储指令，所述处理器与所述收发器耦合；当所述存储器中存储的指令被执行时，所述处理器执行以下操作：
    接收用户设备UE发送的第一注册请求消息；
    对所述第一注册请求消息进行进行完整性保护校验；
    若成功校验所述第一注册请求消息的完整性保护，则向第二AMF发送第二请求消息；所述第二请求消息中携带指示信息且所述指示信息用于指示所述UE为合法UE。
  40. 根据权利要求39所述的通信装置，其特征在于，所述处理器还执行以下操作：
    接收移动管理网元MME发送的转发重分配请求消息，所述转发重分配请求消息包括所述用户设备和所述MME之间的安全上下文；
    根据所述UE和所述MME之间的安全上下文确定映射的安全上下文；
    所述对所述第一注册请求消息进行进行完整性保护校验，包括：利用所述映射的安全上下文对所述第一注册请求消息进行进行完整性保护校验。
  41. 根据权利要求39或40所述的通信装置，其特征在于，所述第一注册请求消息中还包括所述用户设备的标识5G-GUTI。
  42. 根据权利权利要求41所述的通信装置，其特征在于，所述指示信息为所述5G-GUTI。
  43. 根据权利要求39至41任一所述的通信装置，其特征在于，所述指示信息为原因值。
  44. 一种通信装置，其特征在于，所述装置包括括处理器，存储器与收发器；所述存储器中存储指令，所述处理器与所述收发器耦合；当所述存储器中存储的指令被执行时，所述处理器执行以下操作：
    接收第一AMF发送的请求消息；
    若所述请求消息中携带指示信息且所述指示信息用于指示用户设备UE为合法UE，向所述第一AMF发送所述UE的安全上下文。
  45. 根据权利要求44所述的通信装置，其特征在于，所述处理器还执行以下操作；
    跳过对所述UE的认证。
  46. 根据权利权利要求44或45所述的通信装置，其特征在于，所述指示信息为所述5G-GUTI。
  47. 根据权利要求44或45所述的通信装置，其特征在于，所述指示信息为原因值。
PCT/CN2020/089621 2019-05-31 2020-05-11 获取安全上下文的方法、装置和通信系统 WO2020238595A1 (zh)

Priority Applications (11)

Application Number Priority Date Filing Date Title
EP20814989.8A EP3796696B1 (en) 2019-05-31 2020-05-11 Method and apparatus for acquiring security context, and communication system
KR1020217043061A KR102568230B1 (ko) 2019-05-31 2020-05-11 보안 컨텍스트를 취득하기 위한 방법 및 장치와 통신 시스템
CN202080036772.4A CN114145032B (zh) 2019-05-31 2020-05-11 获取安全上下文的方法、装置和通信系统
CA3141367A CA3141367A1 (en) 2019-05-31 2020-05-11 Security context obtaining method and apparatus, and communications system
BR112021024023A BR112021024023A2 (pt) 2019-05-31 2020-05-11 Método e aparelho de obtenção de contexto de segurança, e sistema de comunicações
SG11202112749TA SG11202112749TA (en) 2019-05-31 2020-05-11 Security context obtaining method and apparatus, and communications system
MX2021014521A MX2021014521A (es) 2019-05-31 2020-05-11 Metodo y aparato de obtencion de contexto de seguridad, y sistema de comunicaciones.
JP2021570947A JP7210779B2 (ja) 2019-05-31 2020-05-11 セキュリティコンテキスト取得方法および装置、ならびに通信システム
AU2020284886A AU2020284886B2 (en) 2019-05-31 2020-05-11 Security context obtaining method and apparatus, and communications system
US17/114,812 US11818578B2 (en) 2019-05-31 2020-12-08 Security context obtaining method and apparatus, and communications system
US18/485,137 US20240040380A1 (en) 2019-05-31 2023-10-11 Security Context Obtaining Method and Apparatus, and Communications System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910470895.8 2019-05-31
CN201910470895.8A CN112020067B (zh) 2019-05-31 2019-05-31 获取安全上下文的方法、装置和通信系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/114,812 Continuation US11818578B2 (en) 2019-05-31 2020-12-08 Security context obtaining method and apparatus, and communications system

Publications (2)

Publication Number Publication Date
WO2020238595A1 true WO2020238595A1 (zh) 2020-12-03
WO2020238595A8 WO2020238595A8 (zh) 2021-12-23

Family

ID=73502110

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/089621 WO2020238595A1 (zh) 2019-05-31 2020-05-11 获取安全上下文的方法、装置和通信系统

Country Status (11)

Country Link
US (2) US11818578B2 (zh)
EP (1) EP3796696B1 (zh)
JP (2) JP7210779B2 (zh)
KR (1) KR102568230B1 (zh)
CN (4) CN114513789B (zh)
AU (1) AU2020284886B2 (zh)
BR (1) BR112021024023A2 (zh)
CA (1) CA3141367A1 (zh)
MX (2) MX2021014521A (zh)
SG (1) SG11202112749TA (zh)
WO (1) WO2020238595A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112153647B (zh) * 2019-06-29 2022-04-22 华为技术有限公司 通信方法和相关设备
CN113260015B (zh) * 2021-05-11 2022-11-18 中国联合网络通信集团有限公司 任务处理方法及接入和移动性管理功能实体
CN116074828A (zh) * 2021-10-30 2023-05-05 华为技术有限公司 管理安全上下文的方法和装置
US11785509B2 (en) 2021-11-18 2023-10-10 Cisco Technology, Inc. Inter access and mobility management function idle mode mobility optimization

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018138381A1 (en) * 2017-01-30 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Wireless communications
CN109587688A (zh) * 2017-09-29 2019-04-05 诺基亚技术有限公司 系统间移动性中的安全性

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9084110B2 (en) 2010-04-15 2015-07-14 Qualcomm Incorporated Apparatus and method for transitioning enhanced security context from a UTRAN/GERAN-based serving network to an E-UTRAN-based serving network
US8681740B2 (en) * 2010-12-21 2014-03-25 Tektronix, Inc. LTE network call correlation during User Equipment mobility
US10433161B2 (en) 2012-01-30 2019-10-01 Telefonaktiebolaget Lm Ericsson (Publ) Call handover between cellular communication system nodes that support different security contexts
US9984205B2 (en) 2013-11-27 2018-05-29 General Electric Company Cloud-based clinical information systems and methods of use
KR102201279B1 (ko) * 2016-11-27 2021-01-11 엘지전자 주식회사 무선 통신 시스템에서의 등록 해제 방법 및 이를 위한 장치
KR102549946B1 (ko) * 2017-01-09 2023-06-30 삼성전자주식회사 이동통신 환경에서 단말의 초기 접속 요청 메시지를 라우팅하는 방법 및 관련 파라미터
EP4114065A1 (en) * 2017-01-09 2023-01-04 LG Electronics, Inc. Method for interworking between networks in wireless communication system and apparatus therefor
PL3574669T3 (pl) * 2017-01-30 2022-02-21 Telefonaktiebolaget Lm Ericsson (Publ) Obsługa kontekstu bezpieczeństwa w 5G w trybie połączonym
US11558745B2 (en) 2017-01-30 2023-01-17 Telefonaktiebolaget Lm Ericsson (Publ) Methods for integrity protection of user plane data
EP3577952B1 (en) * 2017-02-03 2022-11-30 Nokia Technologies Oy Method and system for selection of an access and mobility management function in an access network environment
US10397892B2 (en) * 2017-02-06 2019-08-27 Huawei Technologies Co., Ltd. Network registration and network slice selection system and method
CN108401269A (zh) * 2017-02-07 2018-08-14 中兴通讯股份有限公司 跨系统的切换方法和装置
WO2018157551A1 (zh) * 2017-03-01 2018-09-07 华为技术有限公司 数据传输的方法与装置
US11452001B2 (en) 2017-04-17 2022-09-20 Apple Inc. Group based context and security for massive internet of things devices
US10764951B2 (en) 2017-06-17 2020-09-01 Lg Electronics Inc. Registration method of user terminal in wireless communication system and apparatus therefor
WO2019011751A1 (en) * 2017-07-14 2019-01-17 Telefonaktiebolaget Lm Ericsson (Publ) AUTHENTICATION CONTROL IN A HOME NETWORK
US10743221B2 (en) 2017-09-28 2020-08-11 Ofinno, Llc SMF, AMF and UPF relocation during UE registration
US11006316B2 (en) 2017-10-16 2021-05-11 Ofinno, Llc Header compression for ethernet frame
CN111357339B (zh) * 2017-11-13 2022-12-20 Lg电子株式会社 在无线通信系统中发送和接收与切换接入有关的信号的方法及其设备
US10542428B2 (en) * 2017-11-20 2020-01-21 Telefonaktiebolaget Lm Ericsson (Publ) Security context handling in 5G during handover
US10805973B2 (en) * 2018-02-15 2020-10-13 Apple Inc. Apparatus, system, and method for performing GUTI reallocation
KR102577006B1 (ko) * 2018-08-13 2023-09-11 삼성전자 주식회사 4g 및 5g 네트워크 이동 시 네트워크 슬라이스 지원 방법 및 장치
CN111328455B (zh) * 2018-10-17 2023-06-23 联发科技（新加坡）私人有限公司 移动性更新时的用户设备密钥推导方法及用户设备

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018138381A1 (en) * 2017-01-30 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Wireless communications
CN109587688A (zh) * 2017-09-29 2019-04-05 诺基亚技术有限公司 系统间移动性中的安全性

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI ET AL.: "Clafication on retrievial of the security context from old AMF", 3GPP TSG-WG2 MEETING #128 S2-187381, 6 July 2018 (2018-07-06), XP051538775 *

Also Published As

Publication number Publication date
KR20220016189A (ko) 2022-02-08
EP3796696A1 (en) 2021-03-24
SG11202112749TA (en) 2021-12-30
US20210092608A1 (en) 2021-03-25
EP3796696A4 (en) 2022-01-12
BR112021024023A2 (pt) 2022-02-01
MX2021014521A (es) 2022-09-13
MX2022011363A (es) 2022-10-07
CN114513789A (zh) 2022-05-17
CN112020067A (zh) 2020-12-01
CN112020067B (zh) 2021-12-10
JP7210779B2 (ja) 2023-01-23
CN114513790A (zh) 2022-05-17
JP7472331B2 (ja) 2024-04-22
CA3141367A1 (en) 2020-12-03
EP3796696B1 (en) 2024-05-01
JP2023052294A (ja) 2023-04-11
CN114145032A (zh) 2022-03-04
JP2022534120A (ja) 2022-07-27
US11818578B2 (en) 2023-11-14
CN114513790B (zh) 2023-10-10
AU2020284886B2 (en) 2023-11-09
US20240040380A1 (en) 2024-02-01
WO2020238595A8 (zh) 2021-12-23
KR102568230B1 (ko) 2023-08-22
CN114513789B (zh) 2023-09-01
CN114145032B (zh) 2023-09-15
AU2020284886A1 (en) 2021-12-23

Similar Documents

Publication Publication Date Title
WO2020238595A1 (zh) 获取安全上下文的方法、装置和通信系统
US10798082B2 (en) Network authentication triggering method and related device
CN111328112B (zh) 一种安全上下文隔离的方法、装置及系统
CN109691154B (zh) 基于密钥刷新的按需网络功能重新认证
CN109906624B (zh) 支持无线通信网络中的认证的方法以及相关网络节点和无线终端
US11576092B2 (en) Handover handling method and apparatus
US11622268B2 (en) Secure communication method and secure communications apparatus
US11751160B2 (en) Method and apparatus for mobility registration
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
US11606768B2 (en) Method and apparatus for registration
WO2020151710A1 (zh) 一种确定安全保护方式的方法、装置及系统
WO2021254172A1 (zh) 一种通信方法以及相关装置
KR102642804B1 (ko) 다중 대역 통신 방법 및 장치
WO2020164510A1 (zh) 通信方法、通信装置和计算机可读存储介质
RU2793801C1 (ru) Способ и устройство получения контекста безопасности и система связи
WO2021057456A1 (zh) 用于注册的方法和装置
WO2019213925A1 (zh) 密钥更新方法、设备和存储介质
WO2022228455A1 (zh) 一种通信方法以及相关装置
WO2022147846A1 (zh) 一种生成设备间通信的密钥的方法、系统和装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2020814989

Country of ref document: EP

Effective date: 20201218

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20814989

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3141367

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2021570947

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112021024023

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2020284886

Country of ref document: AU

Date of ref document: 20200511

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20217043061

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112021024023

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20211129