WO2021027916A1

WO2021027916A1 - Method, device and system for accessing closed access group

Info

Publication number: WO2021027916A1
Application number: PCT/CN2020/109116
Authority: WO
Inventors: 彭锦; 游世林; 林兆骥; 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-08-15
Filing date: 2020-08-14
Publication date: 2021-02-18
Also published as: CN110536293A

Abstract

Disclosed are a method, device and system for accessing a closed access group. The method for accessing a closed access group comprises: performing encryption on a CAG ID requested to access, and obtaining an encrypted CAG ID requested to access; and sending a registration request message, the registration request message comprising the encrypted CAG ID requested to access and the SUCI of the terminal.

Description

Method, device and system for accessing closed access group

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office with application number 201910754388.7 on August 15, 2019. The entire content of this application is incorporated into this application by reference.

Technical field

This application relates to a wireless communication network, for example, to a method, device, and system for accessing a closed access group.

Background technique

The 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) has formulated various mobile network specifications. Among them, in order to support private networks through public networks, 3GPP has defined a Closed Access Group (CAG) mechanism.

A closed access group includes a group of users who can visit one or more CAG cells. A closed access group has a closed access group identity (CG ID). Using the closed access group mechanism, access control can be performed on the terminal to access the private network.

The solution for access control to the private network is to configure the CAG ID that allows access in the mobile terminal. The network carries a list of CAG IDs supported by the cell in the broadcast system message. After the terminal receives the broadcast message, it selects the matching CAG ID as the request CAG ID of the visit. The terminal carries the CAG ID requested for access in the registration request message sent to the network to complete the registration process.

However, the CAG ID in the registration request message is carried in plain text and sent through the air interface, which is easy to be intercepted and leaked, which may affect the security of the private network.

Summary of the invention

The present application provides a method, device and system for accessing a closed access group to improve the security of the closed access group.

The embodiment of the present application provides a method for accessing a closed access group, including:

Encrypt the CAG ID requesting access to obtain the encrypted CAG ID requesting access;

Send a registration request message. The registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal.

Receive the registration request message sent by the terminal, the registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal;

Analyze the SUCI of the terminal into the SUPI of the terminal, and decrypt the encrypted CAG ID that requests access to the CAG ID that requests access;

Obtain the first CAG ID list from the terminal's home network according to the SUPI of the terminal;

It is determined whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

Encrypt the CAG ID requesting access to obtain the first encrypted CAG ID requesting access;

Send a registration request message, and the registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal.

Receive a registration request message sent by the terminal, where the registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal;

According to the 5G-GUTI of the terminal, judge whether the current AMF is a historical AMF that has served the terminal;

If the current AMF is a historical AMF that has served the terminal, and the SUPI of the terminal is stored in the current AMF, the first CAG ID list is obtained from the terminal's home network according to the SUPI of the terminal, and the first encrypted CAG ID requested to be accessed Decrypt it into the CAG ID of the request;

An embodiment of the present application provides an apparatus for accessing a closed access group, including:

The encryption module is set to encrypt the CAG ID that requests access to obtain the encrypted CAG ID that requests access;

The sending module is configured to send a registration request message. The registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal.

The receiving module is configured to receive the registration request message sent by the terminal, and the registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal;

The decryption module is set to parse the SUCI of the terminal into the SUPI of the terminal, and decrypt the encrypted CAG ID requesting access to the CAG ID requesting access;

The obtaining module is configured to obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

The judging module is configured to judge whether the CAG ID requested to access and the first CAG ID list match, and if they match, send a registration acceptance message to the terminal.

The encryption module is set to encrypt the CAG ID that requests access to obtain the first encrypted CAG ID that requests access;

The sending module is configured to send a registration request message, and the registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal.

The receiving module is configured to receive a registration request message sent by the terminal, and the registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal;

The decryption module is set to determine whether the current AMF is a historical AMF that has served the terminal according to the 5G-GUTI of the terminal;

The obtaining module is set to obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal if the current AMF is a historical AMF that has served the terminal once, and the SUPI of the terminal is stored in the current AMF, and the first encrypted The CAG ID requesting access is decrypted into the CAG ID requesting access;

The embodiment of the present application provides a system for accessing a closed access group, including a terminal and a network device;

The terminal includes a device for accessing a closed access group as shown in the embodiment in FIG. 11;

The network equipment includes a device for accessing a closed access group as shown in the embodiment of FIG. 12.

The terminal includes a device for accessing a closed access group as shown in the embodiment in FIG. 13;

The network equipment includes the device for accessing the closed access group as shown in the embodiment of FIG. 14.

Description of the drawings

FIG. 1 is a schematic diagram of a private network access control process provided by an embodiment of this application;

FIG. 2 is a flowchart of a method for accessing a closed access group according to an embodiment;

FIG. 3 is a flowchart of another method for accessing a closed access group according to an embodiment;

4 is a flowchart of another method for accessing a closed access group provided by an embodiment;

FIG. 5 is a flowchart of another method for accessing a closed access group according to an embodiment;

FIG. 6 is a flowchart of another method for accessing a closed access group according to an embodiment;

FIG. 7 is a flowchart of another method for accessing a closed access group according to an embodiment;

FIG. 8 is a flowchart of another method for accessing a closed access group according to an embodiment;

FIG. 9 is an interaction flowchart of a method for accessing a closed access group according to an embodiment;

FIG. 10 is an interaction flowchart of another method for accessing a closed access group according to an embodiment;

FIG. 11 is a schematic structural diagram of an apparatus for accessing a closed access group according to an embodiment;

FIG. 12 is a schematic structural diagram of another device for accessing a closed access group according to an embodiment;

FIG. 13 is a schematic structural diagram of another device for accessing a closed access group according to an embodiment;

FIG. 14 is a schematic structural diagram of another device for accessing a closed access group according to an embodiment;

FIG. 15 is a schematic structural diagram of a terminal provided by an embodiment.

detailed description

Hereinafter, the embodiments of the present application will be described with reference to the drawings.

Figure 1 is a schematic diagram of a private network access control process provided by an embodiment of this application. As shown in Figure 1, traditional private network access is mainly determined by the access and mobility management function (AMF) in the network. ), Unified Data Management (UDM), Subscription Identifier De-concealing Function (SIDF), Authentication Server Function (AUthentication Server Function, AUSF) complete the authentication of the mobile terminal (terminal for short) And security verification. Among them, AMF, UDM or SIDF, AUSF are network elements that implement authentication and security verification in the network, which can be physical devices deployed in the network, or functional modules deployed in any one or more physical network elements in the network .

As shown in Figure 1, in step S1010, a list of CAG IDs allowed to be accessed is configured on the terminal. The list of allowed CAG IDs indicates that the terminal can only access the private network corresponding to the CAG ID in the list, for example, the allowed access The list of CAG IDs is {2,3,4,5}.

In step S1020, the base station in the network carries the CAG ID list supported by the cell in the broadcast system message, and the CAG ID list supported by the cell indicates the private network that the terminal in the cell is allowed to access. A terminal that accesses the network through the base station can receive the broadcast system message, thereby obtaining a list of CAG IDs supported by the cell. The list of CAG IDs supported by the cell is, for example, {1,2,3}.

In step S1030, when the terminal receives the broadcast system message, it compares the CAG ID list that it has configured to allow access with the CAG ID list supported by the received cell, and selects one of the CAG IDs that match as the request CAG ID of the visit. For example, after comparing here, the matching CAG ID is {2,3}, and {2} is selected as the CAG ID for requesting access.

In step S1040, after determining the CAG ID requesting access, the terminal can start the access process in the private network corresponding to the CAG ID requesting access. The terminal sends a registration request message to the network. The registration request message carries the CAG ID requested to be accessed in plain text, and the registration request message also carries the user hidden identifier (SUCI) of the terminal. After receiving the registration request message sent by the terminal, the base station sends the registration request message to the AMF to realize the authentication and security verification of the terminal's access to the private network.

In step S1050, each network element AMF, AUSF, UDM, or SIDF that implements terminal authentication and security verification in the network performs authentication and security verification procedures for the terminal, where UDM or SIDF parses the terminal’s SUCI into the terminal’s permanent user Identifier (Subscription Permanent Identifier, SUPI) and returns the SUPI of the terminal to the AMF.

In step S1060, the AMF sends a request message to the home network of the terminal to obtain a list of CAG IDs allowed to be accessed in the home network. The request message includes the SUPI of the terminal. The home network returns to the AMF a list of CAG IDs that are allowed to be accessed, here, for example, {2,3,4,5}.

In step S1070, the AFM determines whether the terminal is allowed to access the CAG requested to access, that is, the AMF determines whether the CAG ID requested for access in the registration request message is included in the CAG ID list that is allowed to be accessed from the home network, and if so, it can be accessed. Otherwise it cannot be accessed. Here, the CAG ID requested to access is {2}, which is included in the CAG ID list {2,3,4,5} that is allowed to access obtained from the home network, so the terminal is allowed to access the private network.

In step S1080, the AMF feeds back a registration acceptance message to the terminal, that is, allows the terminal to access the private network.

If in step S1070, the AMF determines that the terminal does not allow access to the CAG requested to be accessed, then in step S1090, the AMF sends a registration rejection message to the terminal.

It can be seen from the embodiment shown in Figure 1 that when the terminal requests access to the private network, the CAG ID requested for access is carried in the registration request message in plain text, and the registration request message is sent through the air interface, which may cause CAG ID leakage may affect the security of private networks.

FIG. 2 is a flowchart of a method for accessing a closed access group according to an embodiment. As shown in FIG. 2, the method provided in this embodiment includes the following steps.

Step S2010: encrypt the CAG ID that requests access to obtain the encrypted CAG ID that requests access.

The method for accessing a closed access group provided in this embodiment is applied to a terminal device in a mobile communication system, referred to as a terminal. When the terminal needs to access the private network, that is, when the access group is closed, it needs to send the CAG ID requesting access to the authentication and security verification device in the network, and because the CAG ID is sent in plain text, and the registration request message carrying the CAG ID is passed It is sent over the air interface, so the CAG ID is easy to leak, which affects the security of the closed access group.

In order to solve the above problem, in this embodiment, when the terminal needs to access a closed access group, after determining the CAG ID requesting access, first encrypt the CAG ID requesting access to obtain the encrypted CAG ID requesting access. The encryption method used for encrypting the CAG ID can adopt any encryption method, and it corresponds to the decryption method in the network element that performs authentication and security verification on the terminal. The secret key used to encrypt the CAG ID may also be one or more possible ways, and correspond to the secret key in the network element that authenticates and securely verify the terminal.

Step S2020: Send a registration request message. The registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal.

After obtaining the encrypted CAG ID requesting access, the terminal can send a registration request message. The registration request message includes the encrypted CAG ID requesting access and the terminal's SUCI. The terminal sends a registration request message through the air interface, and the base station accessed by the terminal or the serving base station of the cell where the terminal is located will receive the registration request message. The base station that receives the registration request message will send the registration request message to the network elements that perform authentication and security verification on the terminal, including AMF, AUSF, UDM/SIDF, etc. The above-mentioned network elements can determine the home network of the terminal according to the SUCI of the terminal, and decrypt the encrypted CAG ID of the request to access, obtain the CAG ID of the terminal, and then follow the step S1050-step in the embodiment shown in FIG. 1 S1090 performs authentication and security verification on the terminal to determine whether the terminal can access the CAG corresponding to the CAG ID requested to be accessed. When the terminal is allowed to access the CAG corresponding to the CAG ID requested to be accessed, the terminal will receive the registration acceptance message, and the terminal is not allowed to access the CAG corresponding to the CAG ID requested to access, the terminal will receive the registration rejection message.

In the method for accessing a closed access group provided in this embodiment, after encrypting the CAG ID requesting access to obtain the encrypted CAG ID requesting access, a registration request message is sent. The registration request message includes the encrypted CAG ID requesting access and The SUCI of the terminal provides a closed access group access method that protects the closed access group. Since the CAG ID requested for access is encrypted, the CAG ID leakage caused by the registration request message sent through the air interface is avoided. Improved the security of access to CAG.

In an embodiment, the method for encrypting the CAG ID that requests access may be to use the public key of the terminal's home network to encrypt the CAG ID that requests access to obtain the encrypted CAG ID that requests access. Then after the terminal sends the registration request message, since the registration request message includes both the encrypted CAG ID for requesting access and the SUCI of the terminal, the network element that has received the registration request message can authenticate and verify the security of the terminal according to the terminal’s When SUCI knows the terminal’s home network, the network element that authenticates and secures the terminal can obtain the public key of the terminal’s home network. Therefore, the obtained public key can be used to decrypt the encrypted CAG ID that requests access to obtain the request CAG ID of the visit.

In an embodiment, the method for encrypting the CAG ID requested to access may be to use the public key of the home network to jointly encrypt the CAG ID requested to access and the SUCI of the terminal to obtain the extended SUCI of the terminal. Then after the terminal sends the registration request message, the network element that authenticates and secures the terminal after receiving the registration request message can learn the home network of the terminal according to the relevant information of the terminal, then the network element that authenticates and secures the terminal is The public key of the terminal's home network can be obtained, so the extended SUCI can be decrypted with the obtained public key, and the CAG ID of the requesting access and the SUCI of the terminal can be obtained.

FIG. 3 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in FIG. 3, the method provided by this embodiment includes the following steps.

Step S3010: Receive the system broadcast message carrying the first CAG ID list.

When the terminal needs to access the CAG, it first needs to determine the CAG that the terminal is allowed to access. The base station broadcasts a system broadcast message carrying the first CAG ID list, and a terminal accessing the base station or a terminal located within the coverage of the base station will receive the system broadcast message. The first CAG ID list includes at least one CAG ID that the terminal is allowed to access.

Step S3020: Match the second CAG ID list configured by itself and the first CAG ID list, and determine the CAG ID that the terminal requests to access.

On the terminal, a CAG ID list is also configured, called a second CAG ID list, and the second CAG ID list includes the ID of at least one CAG that the terminal is allowed to access. The second CAG ID list is preset on the terminal, and may be pre-configured in the terminal, or configured by the network device for the terminal when the terminal is registered in the network. The terminal matches the first CAG ID list and the second CAG ID list to determine the CAG ID that the terminal requests to access.

The method for matching the second CAG ID list configured by itself and the first CAG ID list may be to determine that the same CAG ID in the second CAG ID list and the first CAG ID list is the CAG ID for which access is requested. There may be one or more identical CAG IDs in the first CAG ID list and the second CAG ID list, or the first CAG ID list and the second CAG ID list do not have the same CAG ID. If the first CAG ID list and the second CAG ID list do not have the same CAG ID, the terminal will not be allowed to access the CAG. Therefore, the terminal will not be able to determine the CAG ID requested to access, and therefore the terminal will not proceed with the subsequent process. If the first CAG ID list and the second CAG ID list have only one CAG ID that is the same, then this same CAG ID can be used as the CAG ID for requesting access. If the first CAG ID list and the second CAG ID list have two or more identical CAG IDs, then one of the two or more identical CAG IDs can be selected as the CAG ID requested for access, or According to a preset rule, one is selected from two or more identical CAG IDs as the CAG ID for requesting access.

Before receiving the system broadcast message carrying the first CAG ID list, a second CAG ID list may also be configured in the terminal, and the second CAG ID list includes at least one CAG ID that is allowed to be accessed.

Step S3030: Encrypt the CAG ID requesting access to obtain the encrypted CAG ID requesting access.

Step S3040: Send a registration request message. The registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal.

Step S3030 and step S3040 are similar to step S2010 and step S2020, and will not be repeated here.

Fig. 4 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in Fig. 4, the method provided by this embodiment includes the following steps.

Step S4010: Receive a registration request message sent by the terminal. The registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal.

The method for accessing a closed access group provided in this embodiment is applied to network devices in a mobile communication system. These network devices are network elements that authenticate and securely verify terminals, including but not limited to one of AMF, AUSF, UDM/SIDF Or more. When the terminal needs to access the private network, that is, when the access group is closed, it needs to send the CAG ID requesting access to the authentication and security verification device in the network, and because the CAG ID is sent in plain text, and the registration request message carrying the CAG ID is passed It is sent over the air interface, so the CAG ID is easy to leak, which affects the security of the closed access group.

In order to solve the above problem, in this embodiment, the network element that authenticates and secures the terminal receives the registration request message sent by the terminal, and the registration request message includes the encrypted CAG ID for requesting access and the SUCI of the terminal. Among them, the SUCI of the terminal can be parsed to obtain the SUPI of the terminal, so as to know the home network of the terminal, and the encrypted CAG ID of the request for access can be decrypted to obtain the CAG ID of the request for access, then the network for authentication and security verification of the terminal The yuan can authenticate and verify the security of the terminal through the SUPI of the terminal and the CAG ID that requests access, and determine whether the terminal can access the CAG corresponding to the CAG ID that requests access. Wherein, the encryption method used by the terminal for the CAG ID of the encrypted request to access can adopt any encryption method, and it corresponds to the decryption method in the network element that authenticates and secures the terminal. The secret key used by the terminal to encrypt the CAG ID may also be one or more possible ways, and correspond to the secret key in the network element that authenticates and secures the terminal.

Step S4020: parse the SUCI of the terminal into the SUPI of the terminal, and decrypt the encrypted CAG ID requesting access into the CAG ID requesting access.

After receiving the terminal's SUCI and the encrypted CAG ID, the network element that performs authentication and security verification on the terminal can decrypt the encrypted CAG ID requesting access into the CAG ID requesting access, and analyze the terminal's SUCI. For example, UDM/SIDF parses the terminal’s SUCI into the terminal’s SUPI, and UDM/SIDF decrypts the encrypted CAG ID requesting access into the CAG ID requesting access, and then UDM/SIDF combines the terminal’s SUPI and the CAG ID requesting access. Send to AMF.

In an embodiment, the method for the terminal to encrypt the CAG ID that requests access may be to use the public key of the terminal's home network to encrypt the CAG ID that requests access to obtain the encrypted CAG ID that requests access. Then the UDM or SIDF that receives the registration request message parses the SUCI of the terminal into the SUPI of the terminal. After obtaining the SUPI of the terminal, the home network can be determined, so that the public key of the home network of the terminal can be used to decrypt the encrypted CAG ID that requests access It is the CAG ID that requested access.

Step S4030: Obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal.

After obtaining the SUPI of the terminal, the network element that performs authentication and security verification of the terminal can determine the home network of the terminal according to the SUPI of the terminal, and then can obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal. The first CAG ID list includes at least one CAG ID that the terminal is allowed to access. For example, the AMF that receives the SUPI of the terminal and the CAG ID requested to access from the UDM/SIDF obtains the first CAG ID list from the home network of the terminal according to the SUPI of the terminal.

In an embodiment, obtaining the first CAG ID list from the terminal's home network according to the terminal's SUPI includes: sending a CAG ID list request message to the terminal's home network, the CAG ID list request message includes SUPI; the receiving terminal's home network The first CAG ID list sent.

Step S4040: It is judged whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

Then the network element that authenticates and verifies the security of the terminal determines whether the CAG ID requested for access matches the first CAG ID list, and if they match, it is determined that the terminal can access the CAG corresponding to the CAG ID requested to access, so it can send registration acceptance to the terminal news. For example, the AMF determines whether the CAG ID requested for access matches the first CAG ID list, and if there is a match, it sends a registration acceptance message to the terminal.

In an embodiment, judging whether the CAG ID requested for access matches the first CAG ID list may be judging whether the CAG ID requested for access is the same as any CAG ID in the first CAG ID list, and if they are the same, it is determined to request access The CAG ID matches the first CAG ID list. If the CAG ID requested for access is not the same as any CAG ID in the first CAG ID list, it is determined that the CAG ID requested for access does not match the first CAG ID list.

In an embodiment, if it is determined that the CAG ID requested for access does not match the first CAG ID list, then a registration rejection message is sent to the terminal.

Fig. 5 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in Fig. 5, the method provided by this embodiment includes the following steps.

Step S5010: Receive a registration request message sent by the terminal. The registration request message includes the extended SUCI of the terminal. The extended SUCI of the terminal is obtained by using the public key of the terminal's home network to jointly encrypt the CAG ID for access and the SUCI of the terminal.

In the embodiment shown in FIG. 4, the received registration request message sent by the terminal includes the encrypted CAG ID for requesting access and the SUCI of the terminal, and in this embodiment, the received registration request message sent by the terminal Included is the extended SUCI of the terminal. The extended SUCI of the terminal is obtained by using the public key of the terminal's home network to jointly encrypt the CAG ID of the requesting access and the SUCI of the terminal.

In step S5020, the UDM or SIDF uses the public key of the terminal's home network to decrypt the extended SUCI of the terminal into the CAG ID of the requesting access and the SUCI of the terminal, and parse the SUCI of the terminal into the SUPI of the terminal.

After UDM or SIDF receives the extended SUCI, it can know the home network of the terminal according to the relevant information of the terminal, then UDM or SIDF can obtain the public key of the home network of the terminal, so UDM or SIDF can use the obtained public key to extend Decrypt the SUCI to obtain the CAG ID of the requesting access and the SUCI of the terminal. Then UDM or SIDF can also parse the terminal's SUCI into the terminal's SUPI.

In step S5030, the UDM or SIDF sends the SUPI of the terminal and the CAG ID that requests access to the AMF.

Step S5040: The AMF obtains the first CAG ID list from the home network of the terminal according to the SUPI of the terminal.

In step S5050, the AMF judges whether the CAG ID requested for access matches the first CAG ID list, and if they match, sends a registration acceptance message to the terminal.

Step S5030-Step S5050 are similar to the authentication and security verification process in the embodiment shown in FIG. 1, and will not be repeated here.

Fig. 6 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in Fig. 6, the method provided by this embodiment includes the following steps.

Step S6010: encrypt the CAG ID requesting access to obtain the first encrypted CAG ID requesting access.

In order to solve the above problem, in this embodiment, when the terminal needs to access the closed access group, after determining the CAG ID requesting access, first encrypt the CAG ID requesting access to obtain the first encrypted CAG requesting access ID. The encryption method used for encrypting the CAG ID can adopt any encryption method, and it corresponds to the decryption method in the network element that performs authentication and security verification on the terminal. The secret key used to encrypt the CAG ID can also be one or more possible ways, and it corresponds to the secret key in the network element that authenticates and verifies the security of the terminal.

Step S6020: Send a registration request message. The registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal.

After obtaining the first encrypted CAG ID requesting access, the terminal can send a registration request message. The registration request message includes the first encrypted CAG ID requesting access and the terminal’s fifth-generation mobile communication system globally unique temporary user equipment identifier. (the 5th Generation mobile communication system Globally Unique Temporary UE Identity, 5G-GUTI). The terminal sends a registration request message through the air interface, and the base station accessed by the terminal or the serving base station of the cell where the terminal is located will receive the registration request message. The base station that receives the registration request message will send the registration request message to the network elements that perform authentication and security verification on the terminal, including AMF, AUSF, UDM/SIDF, etc. The above-mentioned network elements can determine whether the current network elements are network elements that once served the terminal according to the 5G-GUTI of the terminal. If so, because the network elements that once served the terminal store various information related to the terminal, each network The meta can directly use various information related to the terminal to determine the terminal’s home network, the terminal encrypts the first encrypted CAG ID that requests access, and other related information to decrypt the first encrypted CAG ID that requests access to obtain the requested access CAG ID, and obtain the first CAG ID list that the terminal is allowed to access. Then it is determined whether the terminal can access the CAG corresponding to the CAG ID requested to be accessed. When the terminal is allowed to access the CAG corresponding to the CAG ID requested to be accessed, the terminal will receive the registration acceptance message, and the terminal is not allowed to access the CAG corresponding to the CAG ID requested to access, the terminal will receive the registration rejection message.

In the method for accessing a closed access group provided in this embodiment, after encrypting the CAG ID requesting access to obtain the first encrypted CAG ID requesting access, a registration request message is sent, and the registration request message includes the first encrypted access request The CAG ID and the 5G-GUTI of the terminal provide a closed access group access method that protects the closed access group. Because the CAG ID that requests access is encrypted, it avoids the registration request message sent through the air interface. The leak of CAG ID improves the security of access to CAG.

In one embodiment, encrypting the CAG ID of the request to access to obtain the first encrypted CAG ID of the request to access includes: using the encryption key in the security context corresponding to the terminal's 5G-GUTI to the CAG ID of the request to access Encryption is performed to obtain the first encrypted CAG ID that requests access. Then, after the terminal sends the registration request message, since the registration request message includes both the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal, the network element that receives the registration request message and authenticates and secures the terminal, According to the 5G-GUTI of the terminal, it is possible to know whether the current network element is a network element that once served the terminal. If so, the network element that once served the terminal stores various information related to the terminal, including the 5G-GUTI of the terminal The encryption key in the corresponding security context, so the network element that authenticates and secures the terminal can directly use the encryption key in the security context corresponding to the 5G-GUTI of the terminal to perform the first encrypted CAG ID for access Decrypt and obtain the CAG ID requested to access.

FIG. 7 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in FIG. 7, the method provided by this embodiment includes the following steps.

Step S7010: Encrypt the CAG ID requesting access to obtain the first encrypted CAG ID requesting access.

Step S7020: Send a registration request message. The registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal.

Step S7010 and step S7020 are the same as step S6010 and step S6020, and will not be repeated here.

Step S7030: Receive the identification request message sent by the AMF.

After the terminal sends the registration request message, if the network element that received the registration request message is a network element that once served the terminal, it may save information related to the terminal, so the first encrypted CAG ID that requests access can be performed Decrypt. If the network element receiving the registration request message has not served the terminal, or even if the network element receiving the registration request message has served the terminal but has not saved the relevant information of the terminal, then the CAG that requests access to the first encryption cannot be accessed. ID for decryption. Then the terminal will receive the identification request message sent by the AMF. The identification request message is received after the first encrypted CAG ID requested to be accessed cannot be decrypted through the 5G-GUTI of the terminal.

Step S7040: Use the public key of the home network to encrypt the CAG ID that requests access to obtain the second encrypted CAG ID that requests access.

After the terminal receives the identification request message, it can use the public key of the home network to encrypt the CAG ID that requests access to obtain the second encrypted CAG ID that requests access.

Step S7050: Send an identification response message to the AMF. The identification response message includes the second encrypted CAG ID that requests access and the SUCI of the terminal.

Then the terminal sends an identification response message to the AMF, and the identification response message includes the second encrypted CAG ID for requesting access and the SUCI of the terminal. Since the identification response message includes both the second encrypted CAG ID and the terminal's SUCI, the AMF that receives the identification response message can learn the terminal's home network according to the terminal's SUCI, and the AMF can obtain the terminal's home network information. The public key, so the obtained public key can be used to decrypt the second encrypted CAG ID requesting access to obtain the CAG ID requesting access. In addition, the AMF can also obtain the first CAG ID list that the terminal is allowed to access according to the SUCI of the terminal. Then it is determined whether the terminal can access the CAG corresponding to the CAG ID requested to be accessed. When the terminal is allowed to access the CAG corresponding to the CAG ID requested to be accessed, the terminal will receive the registration acceptance message, and the terminal is not allowed to access the CAG corresponding to the CAG ID requested to access, the terminal will receive the registration rejection message.

In one embodiment, after the terminal receives the identity request message sent by the AMF, it can also use the public key of the home network to encrypt the CAG ID of the requesting access and the SUCI of the terminal to obtain the extended SUCI of the terminal; then the terminal sends the AMF to the AMF. An identification response message is sent, and the identification response message includes the extended SUCI of the terminal. Then after the terminal sends the identification request message, the AMF that receives the identification request message can learn the home network of the terminal according to the relevant information of the terminal, then the AMF can obtain the public key of the home network of the terminal, so the obtained public key pair can be used The extended SUCI is decrypted to obtain the CAG ID of the requesting access and the SUCI of the terminal. In addition, the AMF can also obtain the first CAG ID list that the terminal is allowed to access according to the SUCI of the terminal. Then it is determined whether the terminal can access the CAG corresponding to the CAG ID requested to be accessed. When the terminal is allowed to access the CAG corresponding to the CAG ID requested to be accessed, the terminal will receive the registration acceptance message, and the terminal is not allowed to access the CAG corresponding to the CAG ID requested to access, the terminal will receive the registration rejection message.

In an embodiment, before encrypting the CAG ID requesting access to obtain the first encrypted CAG ID requesting access, the method further includes: receiving a system broadcast message carrying the first CAG ID list; configuring the second CAG ID for itself The ID list and the first CAG ID list are matched to determine the CAG ID that requests access. The first CAG ID list includes at least one CAG ID that the terminal is allowed to access.

In an embodiment, matching the second CAG ID list configured by itself and the first CAG ID list, and determining the CAG ID requesting access, includes: matching the second CAG ID list configured by itself and the first CAG ID list , It is determined that the same CAG ID in the second CAG ID list and the first CAG ID list is the CAG ID for which access is requested. The method for matching the second CAG ID list configured by itself and the first CAG ID list may be to determine that the same CAG ID in the second CAG ID list and the first CAG ID list is the CAG ID for which access is requested. There may be one or more identical CAG IDs in the first CAG ID list and the second CAG ID list, or the first CAG ID list and the second CAG ID list do not have the same CAG ID. If the first CAG ID list and the second CAG ID list do not have the same CAG ID, the terminal will not be allowed to access the CAG. Therefore, the terminal will not be able to determine the CAG ID requested to access, and therefore the terminal will not proceed with the subsequent process. If the first CAG ID list and the second CAG ID list have only one CAG ID that is the same, then this same CAG ID can be used as the CAG ID for requesting access. If the first CAG ID list and the second CAG ID list have two or more identical CAG IDs, then one of the two or more identical CAG IDs can be selected as the CAG ID requested for access, or According to a preset rule, one is selected from two or more identical CAG IDs as the CAG ID for requesting access.

In addition, before receiving the system broadcast message carrying the first CAG ID list, a second CAG ID list may also be configured in the terminal, and the second CAG ID list includes at least one CAG ID that is allowed to be accessed.

FIG. 8 is a flowchart of another method for accessing a closed access group provided by an embodiment. As shown in FIG. 8, the method provided by this embodiment includes the following steps.

Step S8010: Receive a registration request message sent by the terminal. The registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal.

To solve the above problem, in this embodiment, the network element that authenticates and secures the terminal receives the registration request message sent by the terminal, and the registration request message includes the encrypted CAG ID for requesting access and the 5G-GUTI of the terminal. Among them, the network element that performs authentication and security verification on the terminal can determine whether the current network element is a network element that once served the terminal according to the 5G-GUTI of the terminal. Wherein, the encryption method used by the terminal for the CAG ID requested to access the first encryption can adopt any encryption method, and corresponds to the decryption method in the network element that authenticates and secures the terminal. The secret key used by the terminal to encrypt the CAG ID may also be one or more possible ways, and correspond to the secret key in the network element that authenticates and secures the terminal.

Step S8020: Determine whether the current AMF is a historical AMF that has once served the terminal according to the 5G-GUTI of the terminal.

After receiving the 5G-GUTI of the terminal and the first encrypted CAG ID, the network element that performs authentication and security verification of the terminal first determines whether the current AMF is a historical AMF that has served the terminal according to the 5G-GUTI of the terminal. Since the terminal-related information is stored in the historical AMF that has once served the terminal, it can be determined whether the current AMF is the historical AMF that has once served the terminal according to the 5G-GUTI of the terminal.

Step S8030, if the current AMF is a historical AMF that has served the terminal, and the SUPI of the terminal is stored in the current AMF, the first CAG ID list is obtained from the home network of the terminal according to the SUPI of the terminal, and the first encrypted request is accessed The CAG ID is decrypted into the CAG ID that requested access.

If the current AMF is a historical AMF that has served the terminal, the SUPI of the terminal may or may not be saved in the current AMF. If the current AMF is a historical AMF that has served the terminal, and the SUPI of the terminal is stored in the current AMF, the current AMF can obtain the first CAG ID list from the terminal's home network according to the SUPI of the terminal, and request the first encryption The CAG ID of the visit is decrypted into the CAG ID of the request. The secret key and encryption method used by the current AMF to decrypt the first encrypted CAG ID requested to access may be preset in the terminal and the AMF, or may be saved when the current AMF is previously serving the terminal. For example, the security context of the terminal is stored in the current AMF, and the encryption key is included in the security context. Then the terminal can use the encryption key in the security context to encrypt the CAG ID that requests access to obtain the first encrypted CAG ID that requests access. The current AMF may also use the stored encryption key in the security context of the terminal to decrypt the first encrypted CAG ID requesting access to obtain the CAG ID requesting access.

Step S8040: Determine whether the CAG ID requested for access matches the first CAG ID list, and if they match, send a registration acceptance message to the terminal.

This step is the same as step S4040 and will not be repeated here.

Step S8050, if the current AMF is a historical AMF that has served the terminal, and the SUPI of the terminal is not stored in the current AMF, the current AMF sends an identification request message to the terminal.

If the current AMF is a historical AMF that has served the terminal, and the SUPI of the terminal is not stored in the current AMF, the current AMF cannot decrypt the first encrypted CAG ID sent by the terminal to request access. Therefore, the current AMF sends an identification request message to the terminal, requesting the terminal to send the CAG ID that requests access again.

Step S8060: Receive an identification response message sent by the terminal. The identification response message includes the CAG ID of the second encrypted access request that is encrypted by the terminal using the public key of the home network and the SUCI of the terminal.

After the terminal receives the identification request message, in order to ensure the security of the CAG ID, the terminal can use the public key of the home network to encrypt the CAG ID requested for access to obtain the second encrypted CAG ID requested for access. Then the current AFM will receive the identification response message sent by the terminal, and the identification response message includes the CAG ID of the second encrypted access request encrypted by the terminal using the public key of the home network and the SUCI of the terminal.

In step S8070, the UDM or SIDF parses the SUCI of the terminal into the SUPI of the terminal, and uses the public key of the terminal's home network to decrypt the second encrypted CAG ID requesting access to the CAG ID requesting access.

Step S8080: Obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal.

Step S8090: It is judged whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

Step S8070-step S8090 are similar to step S4020-step S4040 in the embodiment shown in FIG. 4, and will not be repeated here.

In an embodiment, the identification response message includes the extended SUCI obtained after the terminal uses the public key of the home network to jointly encrypt the CAG ID that the terminal requests to access and the SUCI of the terminal. The extended SUCI of the terminal is obtained by using the public key of the terminal's home network to jointly encrypt the CAG ID of the requesting access and the SUCI of the terminal. Then UDM or SIDF uses the public key of the terminal's home network to decrypt the extended SUCI of the terminal into the CAG ID of the requesting access and the SUCI of the terminal, and parse the SUCI of the terminal into the SUPI of the terminal. UDM or SIDF parses the SUCI of the terminal into the SUPI of the terminal, and obtains the first CAG ID list from the home network of the terminal according to the SUPI of the terminal. It is determined whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

Step S8100, if the current AMF has not served the terminal, the current AMF determines the historical AMF that has served the terminal according to the 5G-GUTI of the terminal, and sends the context transmission request message of the terminal to the historical AMF. The context transmission request message of the terminal includes the terminal’s 5G-GUTI.

If the current AMF has not served the terminal, the relevant information of the terminal will not be stored in the current AMF. Then, since the current AMF has also received the 5G-GUTI of the terminal, the current AMF can determine the historical AMF that has served the terminal according to the 5G-GUTI of the terminal. Then the current AMF sends the context transmission request message of the terminal to the historical AMF, and the context transmission request message of the terminal includes the 5G-GUTI of the terminal.

Step S8110: The current AMF receives the context transmission response message sent by the historical AMF, and the context transmission response message includes the security context of the terminal and the first CAG ID list.

After the current AMF receives the context transmission response message sent by the historical AMF, it can learn the security context of the terminal and can obtain the first CAG ID list.

Step S8120: The current AMF uses the private key in the security context of the terminal to decrypt the first encrypted CAG ID requesting access into the CAG ID requesting access.

Step S8130: It is judged whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

If the security context corresponding to the terminal is stored in the historical AMF serving the terminal, the current AMF can receive the security context of the terminal sent by the historical AMF, and the current AMF can directly use the key pair in the received security context. The encrypted CAG ID requesting access is decrypted. And if the historical AMF serving the terminal does not store related information about the terminal, the current AMF needs to be processed in other ways.

Step S8140: If the current AMF does not receive the context transmission response message of the terminal sent by the historical AMF, the current AMF sends an identification request message to the terminal.

If the current AMF does not receive the context transmission response message of the terminal sent by the historical AMF, the current AMF will send an identification request message to the terminal, requesting the terminal to resend the CAG ID that the current AMF can decrypt.

Step S8150: Receive an identification response message sent by the terminal. The identification response message includes the CAG ID of the second encrypted access request encrypted by the terminal using the public key of the home network and the SUCI of the terminal.

In step S8160, the UDM or SIDF parses the SUCI of the terminal into the SUPI of the terminal, and uses the public key of the terminal's home network to decrypt the second encrypted CAG ID requesting access to the CAG ID requesting access.

Step S8170: Obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal.

Step S8180: Determine whether the CAG ID requested for access matches the first CAG ID list, and if they match, send a registration acceptance message to the terminal.

Step S8150-step S8180 are the same as step S8060-step S8090, and will not be repeated here.

In an embodiment, the identification response message includes the extended SUCI obtained after the terminal uses the public key of the home network to jointly encrypt the CAG ID that the terminal requests to access and the SUCI of the terminal. The extended SUCI of the terminal is obtained by using the public key of the terminal's home network to jointly encrypt the CAG ID of the requesting access and the SUCI of the terminal. Then UDM or SIDF uses the public key of the terminal's home network to decrypt the extended SUCI of the terminal into the CAG ID of the requesting access and the SUCI of the terminal, and parse the SUCI of the terminal into the SUPI of the terminal. UDM or SIDF parses the SUCI of the terminal into SUPI of the terminal, and obtains the first CAG ID list from the home network of the terminal according to the SUPI of the terminal. It is determined whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

In one embodiment, judging whether the CAG ID requested for access matches the first CAG ID list includes: judging whether the CAG ID requested for access is the same as any CAG ID in the first CAG ID list, and if they are the same, determining the request The visited CAG ID matches the first CAG ID list.

In an embodiment, after judging whether the CAG ID requested for access matches the first CAG ID list, it further includes: if there is no match, sending a registration rejection message to the terminal.

FIG. 9 is an interaction flowchart of a method for accessing a closed access group provided by an embodiment. As shown in FIG. 9, the method provided in this embodiment includes the following steps.

Step S9010: Configure a list of CAG IDs allowed to be accessed on the mobile terminal, for example {2,3,4,5}.

Step S9020: The network carries a list of CAG IDs supported by the cell in the broadcast system message, such as {1,2,3}.

Step S9030: After receiving the message, the terminal compares the two lists, and selects one of the matched CAG IDs as the CAG ID for requesting access, for example, selects 2 from {2, 3}.

Step S9040: The terminal uses the public key of the home network to encrypt the CAG ID requesting access to obtain the encrypted CAG ID for the access request; the terminal can also use the public key of the home network to encrypt the CAG ID requesting access together with SUPI to obtain an extended SUCI: The terminal sends a registration request message to the network, which carries the encrypted CAG ID for requesting access, and the request message also carries SUCI; in the case of common encryption, the request message carries the extended SUCI(2).

Step S9050: Authentication and security process, where UDM/SIDF parses SUCI into SUPI, UDM/SIDF also parses the encrypted CAG ID that requests access to CAG ID that requests access; UDM/SIDF parses SUPI and CAG ID that requests access Return to AMF.

Step S9060: The AMF obtains the list of CAG IDs allowed to be accessed from the home network, and the request message carries the SUPI parameter, such as {2, 3, 4, 5}.

Step S9070 (Access Control): The AMF determines whether the terminal is allowed to access the CAG, and the AMF determines whether the CAG ID received from the registration message is included in the list of CAG IDs that are allowed to be accessed from the home network. If so, it can be accessed, such as If not, it cannot be accessed. For example, if 2 is in {2,3,4,5}, it can be accessed.

Step S9080: If it is accessible, the AMF returns a registration acceptance message to the terminal.

Step S9090: If the access is not available, the AMF returns a registration rejection message to the terminal.

FIG. 10 is an interaction flowchart of another method for accessing a closed access group provided by an embodiment. As shown in FIG. 10, the method provided by this embodiment includes the following steps.

Step S10010: Configure a list of CAG IDs allowed to be accessed on the mobile terminal, such as {2,3,4,5}.

Step S10020: The network carries a list of CAG IDs supported by the cell in the broadcast system message, such as {1,2,3}.

Step S10030: After receiving the message, the terminal compares the two lists, and selects one of the matched CAG IDs as the CAG ID for requesting access, for example, 2 is selected from {2, 3}.

Step S10040: If the terminal has the temporary user identification 5G-GUTI and the security context of the visited network requesting registration, the terminal uses the encryption key in the security context to encrypt the CAG ID requested to access to obtain the encrypted CAG ID requesting access ; The terminal sends a registration request message to the network, which carries the encrypted CAG ID requesting access, and the request message also carries 5G-GUTI.

Step S10050: If the current AMF (new AMF) of the received registration message is the historical AMF (old AMF) that served the terminal last time, and the SUPI and security context of the terminal still exist, then the encryption key in the security context is used The key decrypts and encrypts the CAG ID of the requested access to obtain the CAG ID of the requested access; if the new AMF is not the old AMF that served the terminal last time, the new AMF sends a terminal context transmission request message to the old AMF, and the message carries 5G-GUTI.

Step S10060: The old AMF returns the SUPI and security context of the terminal to the new AMF. The new AMF can use the encryption key in the security context to decrypt the encrypted CAG ID of the access request to obtain the CAG ID of the request access; the return message also includes A list of CAG IDs that are allowed to be accessed, for example {2,3,4,5}.

Step S10070: If the SUPI and context of the terminal are not stored on the old AMF, the new AMF sends an identification request message to the terminal.

Step S10080: The terminal uses the public key of the home network to encrypt the CAG ID requesting access to obtain the encrypted CAG ID of the request access; the terminal can also use the public key of the home network to encrypt the CAG ID requesting access together with SUPI to obtain an extended SUCI: The terminal returns an identification response message to the new AMF, which carries the encrypted CAG ID for requesting access, and the request message also carries SUCI; in the case of common encryption, the request message carries the extended SUCI(2).

Step S10090: Authentication and security process. If step S10060 successfully returns SUPI, it does not need to include SUCI analysis and CAG ID analysis; if step S10060 is unsuccessful, UDM/SIDF will parse SUCI into SUPI, UDM during this step /SIDF also parses the encrypted CAG ID of the requested access into the CAG ID of the requested access; UDM/SIDF returns the SUPI and the CAG ID of the requested access to AMF.

Step S10100: If step S10060 is unsuccessful, the AMF obtains a list of CAG IDs allowed to be accessed from the home network, and the request message carries the SUPI parameter, such as {2,3,4,5}.

Step S10110 (Access Control): The AMF determines whether the terminal is allowed to access the CAG, and the AMF determines whether the CAG ID received from the registration message is included in the CAG ID list that is allowed to be accessed from the home network. If so, it can be accessed, such as If not, it cannot be accessed. For example, if 2 is in {2,3,4,5}, it can be accessed.

Step S10120: If it is accessible, the AMF returns a registration acceptance message to the terminal.

Step S10130: If access is not available, the AMF returns a registration rejection message to the terminal.

FIG. 11 is a schematic structural diagram of an apparatus for accessing a closed access group provided by an embodiment. As shown in FIG. 11, the apparatus for accessing a closed access group provided by this embodiment includes: an encryption module 111, which is set to CAG for requesting access The ID is encrypted to obtain the encrypted CAG ID requesting access; the sending module 112 is configured to send a registration request message, and the registration request message includes the encrypted CAG ID requesting access and the SUCI of the terminal.

The apparatus for accessing a closed access group provided in this embodiment is used to implement the method for accessing a closed access group in the embodiment shown in FIG. 2. The implementation principle and technical effect of the apparatus for accessing a closed access group provided in this embodiment are similar, and will not be omitted here. Repeat.

FIG. 12 is a schematic structural diagram of another apparatus for accessing a closed access group provided by an embodiment. As shown in FIG. 12, the apparatus for accessing a closed access group provided by this embodiment includes: a receiving module 121, which is configured to receive information sent by a terminal Registration request message. The registration request message includes the encrypted CAG ID of the request to access and the SUCI of the terminal; the decryption module 122 is set to parse the SUCI of the terminal into the SUPI of the terminal, and decrypt the encrypted CAG ID of the request to access into the request for access The acquiring module 123 is configured to acquire the first CAG ID list from the terminal’s home network according to the SUPI of the terminal; the determining module 124 is configured to determine whether the CAG ID requested for access matches the first CAG ID list, and if it matches, Send a registration acceptance message to the terminal.

The apparatus for accessing a closed access group provided in this embodiment is used to implement the method for accessing a closed access group in the embodiment shown in FIG. 4. The implementation principles and technical effects of the apparatus for accessing a closed access group provided in this embodiment are similar, and will not be omitted here. Repeat.

FIG. 13 is a schematic structural diagram of another apparatus for accessing a closed access group provided by an embodiment. As shown in FIG. 13, the apparatus for accessing a closed access group provided by this embodiment includes: an encryption module 131, which is configured to request access to The CAG ID is encrypted to obtain the first encrypted CAG ID requesting access; the sending module 132 is configured to send a registration request message, and the registration request message includes the first encrypted CAG ID requesting access and the 5G-GUTI of the terminal.

The apparatus for accessing a closed access group provided in this embodiment is used to implement the method for accessing a closed access group in the embodiment shown in FIG. 6. The implementation principles and technical effects of the apparatus for accessing a closed access group provided in this embodiment are similar, and will not be omitted here. Repeat.

FIG. 14 is a schematic structural diagram of another apparatus for accessing a closed access group provided by an embodiment. As shown in FIG. 14, the apparatus for accessing a closed access group provided by this embodiment includes: a receiving module 141, which is configured to receive information sent by a terminal The registration request message includes the first encrypted CAG ID for requesting access and the 5G-GUTI of the terminal; the decryption module 142 is configured to determine whether the current AMF is a historical AMF that has served the terminal according to the 5G-GUTI of the terminal; The obtaining module 143 is configured to obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal if the current AMF is a historical AMF that used to serve the terminal, and the SUPI of the terminal is stored in the current AMF, and encrypt the first The CAG ID requested for access is decrypted into the CAG ID requested for access; the determining module 144 is configured to determine whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

The apparatus for accessing a closed access group provided in this embodiment is used to implement the method for accessing a closed access group in the embodiment shown in FIG. 8. The implementation principle and technical effect of the apparatus for accessing a closed access group provided in this embodiment are similar, and will not be omitted here. Repeat.

An embodiment of the present application also provides a system for accessing a closed access group, including a terminal and a network device. The terminal includes the device for accessing the closed access group as shown in the embodiment of FIG. 11, and the network device includes the access device as shown in the embodiment of FIG. Close the device of the access group.

An embodiment of the present application also provides a system for accessing a closed access group, including a terminal and a network device. The terminal includes the device for accessing the closed access group as shown in the embodiment of FIG. 13, and the network device includes the access device as shown in the embodiment of FIG. Close the device of the access group.

FIG. 15 is a schematic structural diagram of a terminal provided by an embodiment. As shown in FIG. 15, the terminal includes a processor 151, a memory 152, a transmitter 153, and a receiver 154; the number of processors 151 in the terminal may be one or There are multiple. One processor 151 is taken as an example in FIG. 15; the processor 151 and the memory 152, the transmitter 1543 and the receiver 154 in the terminal can be connected by a bus or other methods.

The memory 152, as a computer-readable storage medium, can be configured to store software programs, computer-executable programs, and modules, such as those corresponding to the method of accessing the closed access group in the embodiments of Figure 2-Figure 3 or Figure 6-Figure 7 of this application Program instructions/modules (for example, access the encryption module 111 and the sending module 112 in the closed access group device or access the encryption module 131 and the sending module 132 in the closed access group device). The processor 151 runs the software programs, instructions, and modules stored in the memory 152 to terminal at least one functional application and data processing, that is, to implement the closed access group method of FIGS. 2 to 3 or 6 to 7.

The memory 152 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and an application program required for at least one function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 152 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

The transmitter 153 is a module or a combination of devices capable of transmitting radio frequency signals into space, for example, a combination of radio frequency transmitters, antennas, and other devices. The receiver 154 is a module or a combination of devices capable of receiving radio frequency signals from space, for example, a combination of radio frequency receivers, antennas, and other devices.

The embodiment of the present application also provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, they are used to execute a method for accessing a closed access group. The method includes: requesting access to the CAG ID Encryption is performed to obtain the encrypted CAG ID requesting access; a registration request message is sent, and the registration request message includes the encrypted CAG ID requesting access and the SUCI of the terminal.

An embodiment of the present application also provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, they are used to execute a method for accessing a closed access group. The method includes: receiving a registration request sent by a terminal Message, the registration request message includes the encrypted CAG ID requesting access and the terminal's SUCI; the terminal's SUCI is parsed into the terminal's SUPI, and the encrypted CAG ID for requesting access is decrypted into the CAG ID for requesting access; according to the terminal's SUPI Obtain the first CAG ID list from the terminal's home network; determine whether the CAG ID requested for access matches the first CAG ID list, and if they match, send a registration acceptance message to the terminal.

The embodiment of the present application also provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, they are used to execute a method for accessing a closed access group. The method includes: requesting access to the CAG ID Encryption is performed to obtain the first encrypted CAG ID requesting access; a registration request message is sent, and the registration request message includes the first encrypted CAG ID requesting access and the 5G-GUTI of the terminal.

An embodiment of the present application also provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, they are used to execute a method for accessing a closed access group. The method includes: receiving a registration request sent by a terminal Message, the registration request message includes the first encrypted CAG ID and the terminal’s 5G-GUTI; according to the terminal’s 5G-GUTI, it is judged whether the current AMF is a historical AMF that has served the terminal; if the current AMF is a terminal that has served According to the historical AMF of the terminal, and the SUPI of the terminal is stored in the current AMF, the first CAG ID list is obtained from the home network of the terminal according to the SUPI of the terminal, and the first encrypted CAG ID requesting access is decrypted into the CAG ID requesting access; It is determined whether the CAG ID requested for access matches the first CAG ID list, and if they match, a registration acceptance message is sent to the terminal.

The term user terminal encompasses any suitable type of wireless user equipment, such as mobile phones, portable data processing devices, portable web browsers, or vehicular mobile stations.

In general, the various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor or other computing device, although the application is not limited thereto.

The embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example, in a processor entity, or by hardware, or by a combination of software and hardware. Computer program instructions can be assembly instructions, Instruction Set Architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, status setting data, or written in any combination of one or more programming languages Source code or object code.

The block diagram of any logical flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program steps and logic circuits, modules, and functions. The computer program can be stored on the memory. The memory can be of any type suitable for the local technical environment and can be implemented by any suitable data storage technology, such as but not limited to read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), optical Memory devices and systems (Digital Video Disc (DVD) or Compact Disc (CD)), etc. Computer-readable media may include non-transitory storage media. The data processor can be any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microprocessors, digital signal processors (Digital Signal Processing, DSP), application specific integrated circuits (ASICs) ), programmable logic devices (Field-Programmable Gate Array, FPGA) and processors based on multi-core processor architecture.

Claims

A method of accessing a closed access group includes:

Encrypt the CAG ID of the closed access group requesting access to obtain the encrypted CAG ID of the requesting access;

Send a registration request message, and the registration request message includes the encrypted CAG ID for requesting access and the user hidden identifier SUCI of the terminal.
The method according to claim 1, wherein said encrypting the CAG ID requesting access to obtain the encrypted CAG ID requesting access comprises:

Use the public key of the home network to encrypt the CAG ID that requests access to obtain the encrypted CAG ID that requests access.
The method according to claim 1, wherein said encrypting the CAG ID requesting access to obtain the encrypted CAG ID requesting access comprises:

Use the public key of the home network to jointly encrypt the CAG ID of the access request and the SUCI of the terminal to obtain the extended SUCI of the terminal;

The sending of the registration request message, the registration request message including the encrypted CAG ID for requesting access and the SUCI of the terminal, includes:

Send the registration request message, and the registration request message includes the extended SUCI of the terminal.
The method according to any one of claims 1 to 3, before said encrypting the CAG ID requested for access, further comprising:

Receive the system broadcast message carrying the first CAG ID list;

Match the second CAG ID list configured by itself and the first CAG ID list, and determine the CAG ID requested to be accessed by the terminal.
The method according to claim 4, wherein the matching the second CAG ID list configured by itself and the first CAG ID list to determine the CAG ID requested to be accessed by the terminal comprises:

Match the second CAG ID list configured by itself and the first CAG ID list, and determine that the same CAG ID in the second CAG ID list and the first CAG ID list is the one requested to access CAG ID.
The method according to claim 4, before said receiving the system broadcast message carrying the first CAG ID list, further comprising:

The second CAG ID list is configured, and the second CAG ID list includes at least one CAG ID that is allowed to be accessed.
A method of accessing a closed access group includes:

Receiving a registration request message sent by a terminal, where the registration request message includes an encrypted closed access group identification CAG ID for requesting access and a user hidden identifier SUCI of the terminal;

Parse the SUCI of the terminal into the user permanent identification SUPI of the terminal, and decrypt the encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

Acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to claim 7, wherein the parsing the SUCI into SUPI and decrypting the encrypted CAG ID requesting access into the decrypted CAG ID requesting access comprises:

The unified data management UDM or subscription identifier hiding function SIDF parses the SUCI of the terminal into the SUPI of the terminal, and decrypts the encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

The UDM or the SIDF sends the SUPI of the terminal and the decrypted CAG ID requesting access to the mobility management function AMF;

The acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal includes:

The AMF obtains the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Said determining whether the decrypted CAG ID requested to access and the first CAG ID list match, and if the decrypted CAG ID requesting access matches the first CAG ID list, report to the terminal Send registration acceptance message, including:

The AMF judges whether the decrypted CAG ID requested for access matches the first CAG ID list, and in the case that the decrypted CAG ID requested for access matches the first CAG ID list, the The terminal sends the registration acceptance message.
The method according to claim 8, wherein the UDM or the SIDF parses the SUCI of the terminal into the SUPI of the terminal, and decrypts the encrypted CAG ID requesting access into the decrypted request Visited CAG ID, including:

The UDM or the SIDF parses the SUCI of the terminal into the SUPI of the terminal, and uses the public key of the home network of the terminal to decrypt the encrypted CAG ID of the access request into the decrypted access request The CAG ID.
The method according to claim 8, wherein the receiving the registration request message sent by the terminal, the registration request message including the encrypted CAG ID for requesting access and the SUCI of the terminal, including:

Receiving the registration request message sent by the terminal, the registration request message including the extended SUCI of the terminal, the extended SUCI of the terminal is decrypted by using the public key of the home network of the terminal The CAG ID requesting access and the SUCI of the terminal are jointly encrypted;

The UDM or SIDF parses the SUCI of the terminal into the SUPI of the terminal, and decrypts the encrypted CAG ID requesting access into the decrypted CAG ID requesting access, including:

The UDM or the SIDF uses the public key of the home network of the terminal to decrypt the extended SUCI of the terminal into the CAG ID of the decrypted access request and the SUCI of the terminal, and the SUCI of the terminal Resolve to the SUPI of the terminal.
The method according to any one of claims 7 to 10, wherein the judging whether the decrypted CAG ID requested for access matches the first CAG ID list comprises:

Determine whether the CAG ID of the decrypted access request is the same as a CAG ID in the first CAG ID list, and the CAG ID of the decrypted access request is the same as a CAG ID in the first CAG ID list In the case of, it is determined that the decrypted CAG ID requested for access matches the first CAG ID list.
The method according to any one of claims 7 to 10, wherein the obtaining the first CAG ID list from the home network of the terminal according to the SUPI of the terminal comprises:

Sending a CAG ID list request message to the home network of the terminal, where the CAG ID list request message includes the SUPI of the terminal;

Receiving the first CAG ID list sent by the home network of the terminal.
The method according to any one of claims 7 to 10, after determining whether the decrypted CAG ID requested for access matches the first CAG ID list, further comprising:

In the case that the decrypted CAG ID requested for access does not match the first CAG ID list, a registration rejection message is sent to the terminal.
A method of accessing a closed access group includes:

Encrypt the CAG ID of the closed access group requesting access to obtain the first encrypted CAG ID of the requesting access;

Send a registration request message, where the registration request message includes the first encrypted CAG ID for requesting access and the fifth-generation mobile communication system globally unique temporary user equipment identifier 5G-GUTI of the terminal.
The method according to claim 14, wherein said encrypting the CAG ID requesting access to obtain the first encrypted CAG ID requesting access comprises:

Use the encryption key in the security context corresponding to the 5G-GUTI of the terminal to encrypt the CAG ID that requests access to obtain the first encrypted CAG ID that requests access.
The method according to claim 14, after the sending the registration request message, further comprising:

Receive the identification request message sent by the mobility management function AMF;

Use the public key of the home network to encrypt the CAG ID that requests access to obtain the second encrypted CAG ID that requests access;

An identification response message is sent to the AMF, where the identification response message includes the second encrypted CAG ID for requesting access and the user hidden identifier SUCI of the terminal.
The method according to claim 14, after the sending the registration request message, further comprising:

Receive the identification request message sent by AMF;

Use the public key of the home network to jointly encrypt the CAG ID of the access request and the SUCI of the terminal to obtain the extended SUCI of the terminal;

Send an identification response message to the AMF, where the identification response message includes the extended SUCI of the terminal.
The method according to any one of claims 14 to 17, before encrypting the CAG ID requesting access to obtain the first encrypted CAG ID requesting access, further comprising:

Receive the system broadcast message carrying the first CAG ID list;

Match the second CAG ID list configured by itself and the first CAG ID list, and determine the CAG ID for which access is requested.
The method according to claim 18, wherein the matching the second CAG ID list configured by itself and the first CAG ID list to determine the CAG ID for which access is requested comprises:

Match the second CAG ID list configured by itself and the first CAG ID list, and determine that the same CAG ID in the second CAG ID list and the first CAG ID list is the one requested to access CAG ID.
The method according to claim 18, before said receiving the system broadcast message carrying the first CAG ID list, further comprising:

The second CAG ID list is configured, and the second CAG ID list includes at least one CAG ID that is allowed to be accessed.
A method of accessing a closed access group includes:

Receiving a registration request message sent by a terminal, the registration request message including the first encrypted closed access group identification CAG ID for requesting access and the fifth-generation mobile communication system globally unique temporary user equipment identification 5G-GUTI of the terminal;

Judging whether the current mobility management function AMF is a historical AMF serving the terminal according to the 5G-GUTI of the terminal;

In the case that the current AMF is a historical AMF serving the terminal, and the permanent user identification SUPI of the terminal is stored in the current AMF, the second terminal is obtained from the home network of the terminal according to the SUPI of the terminal. A CAG ID list, and decrypt the first encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to claim 21, after judging whether the current AMF is a historical AMF serving the terminal according to the 5G-GUTI of the terminal, further comprising:

In a case where the current AMF is a historical AMF serving the terminal, and the SUPI of the terminal is not stored in the current AMF, the current AMF sends an identification request message to the terminal;

Receiving an identification response message sent by the terminal, where the identification response message includes a second encrypted CAG ID that is encrypted by the terminal using the public key of the home network and the user hidden identifier SUCI of the terminal;

The unified data management UDM or the subscription identifier hiding function SIDF parses the SUCI of the terminal into the SUPI of the terminal, and uses the public key of the home network of the terminal to decrypt the second encrypted CAG ID that requests access to The decrypted CAG ID that requests access;

Acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to claim 21, after judging whether the current AMF is a historical AMF serving the terminal according to the 5G-GUTI of the terminal, further comprising:

In a case where the current AMF is a historical AMF serving the terminal, and the SUPI of the terminal is not stored in the current AMF, the current AMF sends an identification request message to the terminal;

Receive an identification response message sent by the terminal, where the identification response message includes the extended CAG ID that the terminal requests to access the terminal using the public key of the home network and the SUCI of the terminal are jointly encrypted SUCI;

UDM or SIDF uses the public key of the terminal’s home network to decrypt the extended SUCI of the terminal into the decrypted CAG ID of the access request and the SUCI of the terminal, and parse the SUCI of the terminal into the SUPI of the terminal;

Acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to claim 21, after judging whether the current AMF is a historical AMF serving the terminal according to the 5G-GUTI of the terminal, further comprising:

In the case that the current AMF is not the historical AMF serving the terminal, the current AMF is determined to be the historical AMF served by the terminal according to the 5G-GUTI of the terminal, and sends the terminal to the historical AMF The context transmission request message of the terminal includes the 5G-GUTI of the terminal;

Receiving, by the current AMF, a context transmission response message sent by the historical AMF, the context transmission response message including the security context of the terminal and the first CAG ID list;

The current AMF uses the private key in the security context of the terminal to decrypt the first encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

Determine whether the CAG ID of the decryption request access matches the first CAG ID list, and if the CAG ID of the decryption request access matches the first CAG ID list, send a registration acceptance to the terminal news.
The method according to claim 24, in the case where the current AMF is not a historical AMF serving the terminal, the current AMF is determined to be the historical AMF served by the terminal according to the 5G-GUTI of the terminal AMF, and after sending the context transmission request message of the terminal to the historical AMF, it further includes:

In the case that the current AMF does not receive the context transmission response message of the terminal sent by the historical AMF, the current AMF sends an identification request message to the terminal;

Receiving an identification response message sent by the terminal, where the identification response message includes a second encrypted CAG ID that is encrypted by the terminal using the public key of the home network and the SUCI of the terminal;

UDM or SIDF parses the SUCI of the terminal into the SUPI of the terminal, and uses the public key of the home network of the terminal to decrypt the second encrypted CAG ID that requests access to the decrypted CAG that requests access ID;

Acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to claim 24, in the case where the current AMF is not a historical AMF serving the terminal, the current AMF is determined to be the historical AMF served by the terminal according to the 5G-GUTI of the terminal AMF, and after sending the context transmission request message of the terminal to the historical AMF, it further includes:

In the case that the current AMF does not receive the context transmission response message of the terminal sent by the historical AMF, the current AMF sends an identification request message to the terminal;

Receive an identification response message sent by the terminal, where the identification response message includes the extended CAG ID that the terminal requests to access the terminal using the public key of the home network and the SUCI of the terminal are jointly encrypted SUCI;

UDM or SIDF uses the public key of the home network of the terminal to decrypt the extended SUCI of the terminal into the decrypted CAG ID of the access request and the SUCI of the terminal, and parse the SUCI of the terminal into the SUPI of the terminal;

Acquiring the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

Determine whether the decrypted CAG ID that requests access matches the first CAG ID list, and if the decrypted CAG ID that requests access matches the first CAG ID list, send a registration to the terminal Accept the message.
The method according to any one of claims 21 to 26, wherein the judging whether the decrypted CAG ID requested for access matches the first CAG ID list comprises:

Determine whether the CAG ID of the decrypted access request is the same as a CAG ID in the first CAG ID list, and the CAG ID of the decrypted access request is the same as a CAG ID in the first CAG ID list In the case of, it is determined that the decrypted CAG ID requested for access matches the first CAG ID list.
The method according to any one of claims 21 to 26, after the judging whether the decrypted CAG ID requested to access and the first CAG ID list match, further comprising:

In the case that the decrypted CAG ID requested for access does not match the first CAG ID list, a registration rejection message is sent to the terminal.
A device for accessing a closed access group, including:

The encryption module is set to encrypt the CAG ID of the closed access group requesting access to obtain the encrypted CAG ID of the requesting access;

The sending module is configured to send a registration request message, and the registration request message includes the encrypted CAG ID for requesting access and the user hidden identifier SUCI of the terminal.
A device for accessing a closed access group, including:

A receiving module, configured to receive a registration request message sent by a terminal, the registration request message including the encrypted closed access group identification CAG ID for requesting access and the user hidden identifier SUCI of the terminal;

The decryption module is configured to parse the SUCI of the terminal into the permanent user identification SUPI of the terminal, and decrypt the encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

An obtaining module, configured to obtain the first CAG ID list from the home network of the terminal according to the SUPI of the terminal;

The judging module is configured to judge whether the decrypted CAG ID requested to access and the first CAG ID list match, and when the decrypted CAG ID requested to access matches the first CAG ID list, it will report to the terminal Send a registration acceptance message.
A device for accessing a closed access group, including:

The encryption module is set to encrypt the CAG ID of the closed access group requesting access to obtain the first encrypted CAG ID of the requesting access;

The sending module is configured to send a registration request message. The registration request message includes the first encrypted CAG ID for requesting access and the fifth-generation mobile communication system globally unique temporary user equipment identifier 5G-GUTI of the terminal.
A device for accessing a closed access group, including:

The receiving module is configured to receive a registration request message sent by the terminal, the registration request message including the first encrypted closed access group identification CAG ID for requesting access and the fifth-generation mobile communication system globally unique temporary user equipment identification of the terminal 5G-GUTI;

The decryption module is configured to determine whether the current mobility management function AMF is a historical AMF serving the terminal according to the 5G-GUTI of the terminal;

The acquiring module is configured to, when the current AMF is a historical AMF serving the terminal, and the user permanent identity SUPI of the terminal is stored in the current AMF, from the terminal according to the SUPI of the terminal Acquires the first CAG ID list, and decrypts the first encrypted CAG ID requesting access into the decrypted CAG ID requesting access;

The judging module is configured to judge whether the decrypted CAG ID requested to access matches the first CAG ID list, and when the decrypted CAG ID requested to access matches the first CAG ID list, The terminal sends a registration acceptance message.
A system for accessing closed access groups, including terminals and network equipment;

The terminal includes the device for accessing a closed access group according to claim 29;

The network device includes the device for accessing a closed access group according to claim 30.
A system for accessing closed access groups, including terminals and network equipment;

The terminal includes the device for accessing a closed access group according to claim 31;

The network device includes the device for accessing a closed access group according to claim 32.