WO2021082558A1 - 网络切片的访问控制方法、装置及存储介质 - Google Patents

网络切片的访问控制方法、装置及存储介质 Download PDF

Info

Publication number
WO2021082558A1
WO2021082558A1 PCT/CN2020/104856 CN2020104856W WO2021082558A1 WO 2021082558 A1 WO2021082558 A1 WO 2021082558A1 CN 2020104856 W CN2020104856 W CN 2020104856W WO 2021082558 A1 WO2021082558 A1 WO 2021082558A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
terminal
network
identifier
network element
Prior art date
Application number
PCT/CN2020/104856
Other languages
English (en)
French (fr)
Inventor
欧锻灏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021082558A1 publication Critical patent/WO2021082558A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity

Definitions

  • This application relates to the field of network technology, and in particular to a method, device and storage medium for access control of network slicing.
  • Network slicing is an important resource of the 5th generation mobile networks (5G) system and cannot be accessed at will. Otherwise, it will cause the abuse of network slicing resources, thereby affecting the normal operation of user services. For example, in the Internet of Vehicles scenario, connected vehicles need to communicate through low-latency and high-reliability network slices, but if the communication network slices are tampered with large-link network slices, it will directly affect the driving safety of connected vehicles. It may even cause a traffic accident.
  • 5G 5th generation mobile networks
  • the terminal sends a network slicing request message to the access and mobility management function (AMF) network element in the core network, where the network slicing request message includes : The user permanent identifier (subscription permanent identifier, SUPI) of the terminal and the identifier of the network slice.
  • the AMF judges whether the access control list contains the corresponding cipher text check field according to the identifier of the SUPI and the network slicing.
  • the AMF encrypts the SUPI, the ID of the network slice and the cipher text verification field according to the integrity encryption key of the core network. Obtain the encrypted field, and determine whether the encrypted field is consistent with the cipher text verification field in the access control list; if the encrypted field is consistent with the cipher text verification field in the access control list, the AMF determines that the terminal has the right to access the network slice; If the encryption field is inconsistent with the cipher text check field in the access control list, the AMF determines that the terminal has no right to access the network slice. In addition, if the aforementioned access control list does not include the cipher text check field corresponding to the identifiers of SUPI and the network slice, the AMF also determines that the terminal has no right to access the network slice.
  • the embodiments of the present application provide a method, device and storage medium for access control of network slicing, which solves the problem that if the integrity encryption key of the core network is stolen in the related technology, the attacker can arbitrarily tamper with the access authority of each terminal And technical issues that affect network security.
  • an embodiment of the present application provides an access control method for network slicing, including:
  • the first network element receives a network slicing request message, where the network slicing request message carries the identification of the terminal and the identification of the network slicing;
  • the first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal, and obtains the second access subkey corresponding to the core network CN;
  • the first network element verifies whether the terminal has the right to access the network slice according to the first access subkey and the second access subkey.
  • the first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal carried in the network slicing request message, and obtains the second access subkey corresponding to the core network CN; further Preferably, the first network element verifies whether the terminal has the right to access the network slice requested to be accessed in the network slice request message according to the first access subkey and the second access subkey. It can be seen that, compared to the manner in which the AMF performs access verification based on the integrity encryption key of the core network in the related art, the first network element in the embodiment of the present application needs to be based on the first access subkey corresponding to the terminal and the first access subkey corresponding to the CN.
  • the second access subkey performs access verification, that is, verification can be performed only when the two access subkeys are obtained at the same time, which improves the security of access verification.
  • the first network element to verify whether the terminal has the right to access the network slice according to the first access subkey and the second access subkey includes:
  • the first network element generates an integrity access key according to the first access subkey and the second access subkey
  • the first network element verifies whether the terminal is authorized to access the network slice according to the integrity access key.
  • the first network element to verify whether the terminal has the right to access the network slice according to the integrity access key includes:
  • the first network element decrypts the ciphertext field contained in the access control information corresponding to the terminal identifier according to the integrity access key to obtain decrypted network slice access relationship information, where the decrypted network
  • the slice access relationship information includes: a decrypted terminal identifier and a decrypted network slice identifier;
  • the first network element determines whether the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and the network slice identifier;
  • the first network element determines that the terminal has the right to access the network slice; or, if the decrypted network slice If the terminal identifier and the decrypted network slice identifier do not match the terminal identifier and the network slice identifier, the first network element determines that the terminal has no right to access the network slice.
  • the decrypted network slice access relationship information further includes: subscription information corresponding to the decrypted terminal identifier
  • the first network element determines the decrypted terminal identifier and the decrypted terminal identifier. Before whether the network slice identifier matches the terminal identifier and the network slice identifier, the method further includes:
  • the first network element determines that the subscription information corresponding to the decrypted terminal identifier is valid information.
  • the first network element may directly determine that the terminal is not authorized to access the network slice request message requested
  • the accessed network slice can prevent attackers from overwriting new contract information with invalid or expired contract information, which further improves the security of access verification.
  • the contract information corresponding to the decrypted terminal identity includes: the contract time and the identities of both parties to the contract.
  • the method before the first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal, and obtains the second access subkey corresponding to the core network CN, the method further includes :
  • the first network element determines that the access control information includes a ciphertext field corresponding to the terminal identifier.
  • the first network element determines that the aforementioned access control information does not include the ciphertext field corresponding to the terminal's identity, the first network element can directly determine that the terminal does not have the right to access the network slicing request message. The network slice requested for access.
  • the method further includes:
  • the first network element obtains the network slice access relationship information corresponding to the terminal identifier from the second network element, where the network slice access relationship information includes: the terminal identifier, the network slice identifier, and the terminal identifier location.
  • the network slice access relationship information includes: the terminal identifier, the network slice identifier, and the terminal identifier location.
  • the first network element encrypts the network slice access relationship information according to the first access subkey and the second access subkey to obtain the ciphertext field corresponding to the terminal identifier;
  • the first network element stores the identification of the terminal and the ciphertext field corresponding to the identification of the terminal in association with the access control information.
  • the first network element encrypts the network slice access relationship information corresponding to the terminal identifier according to the first access subkey and the second access subkey to obtain the secret corresponding to the terminal identifier. And store the ciphertext field corresponding to the terminal’s identity and the terminal’s identity in the access control information in association with each other, so that the first network element can verify the terminal when it receives the network slicing request message sent by the terminal Whether you have the right to access the network slice requested in the network slice request message.
  • the access control information in the embodiment of the present application includes the identification of the terminal and the ciphertext field corresponding to the identification of the terminal, it is possible to reduce the information of each network slice that the terminal can request to access and the terminal’s access control information.
  • the leakage risk of the contract information corresponding to the logo is beneficial to improve the security of access verification.
  • the network slice access relationship information is encrypted according to the first access subkey and the second access subkey to obtain the ciphertext field corresponding to the terminal identifier, including:
  • the first network element generates an integrity access key according to the first access subkey and the second access subkey
  • the first network element encrypts the network slice access relationship information according to the integrity access key to obtain the ciphertext field corresponding to the terminal identifier.
  • the method further includes:
  • the first network element receives the updated network slice access relationship information sent by the second network element, where the updated network slice access relationship information includes: the terminal's identity, the network slice's identity, and the terminal's identity
  • the updated contract information corresponding to the logo
  • the first network element encrypts the updated network slice access relationship information according to the first access subkey and the second access subkey to obtain the updated ciphertext field corresponding to the terminal identifier;
  • the first network element stores the identification of the terminal and the updated ciphertext field in the access control information in association with each other.
  • the first network element encrypts the updated network slice access relationship information according to the first access subkey and the second access subkey to obtain the updated information corresponding to the terminal's identity Ciphertext field, and store the identification of the terminal and the updated ciphertext field in the access control information in association with each other, so that the information stored in the access control information is accurate and effective, so that the first network element can receive
  • the network slice request message sent by the terminal can accurately verify whether the terminal has the right to access the network slice requested in the network slice request message.
  • the first network element associates and stores the terminal identifier and the updated ciphertext field before the access control information, and the method further includes:
  • the first network element deletes the identification of the terminal and the ciphertext field corresponding to the identification of the terminal from the access control information, so that the information stored in the access control information is accurate and effective.
  • the contract information corresponding to the terminal identifier includes: the contract time and the identifiers of both parties to the contract.
  • the first access subkey corresponding to the terminal is the same as the authentication key of the terminal during identity authentication, and the terminal can reuse the authentication key for access verification without storing the authentication secret.
  • the key also additionally stores the first access subkey or the master key used to generate the corresponding first access subkey.
  • the first access subkey corresponding to the terminal is different from the access subkey corresponding to other terminals, which can avoid the access subkey corresponding to any other terminal and the second access subkey corresponding to the CN.
  • the access subkey is leaked at the same time, the access security of the terminal is affected, and the security of access verification is further improved.
  • an embodiment of the present application provides a network element, the network element is a first network element, and the first network element includes:
  • the first receiving module receives a network slicing request message, where the network slicing request message carries the identification of the terminal and the identification of the network slicing;
  • the first obtaining module is configured to obtain the first access subkey corresponding to the terminal according to the identification of the terminal, and obtain the second access subkey corresponding to the core network CN;
  • the verification module is configured to verify whether the terminal has the right to access the network slice according to the first access subkey and the second access subkey.
  • the verification module includes:
  • a generating unit configured to generate an integrity access key according to the first access subkey and the second access subkey
  • the verification unit is used to verify whether the terminal has the right to access the network slice according to the integrity access key.
  • the verification unit is specifically used for:
  • the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and the network slice identifier, it is determined that the terminal has the right to access the network slice; or, if the decrypted terminal identifier and decrypted network slice If the subsequent network slice identifier does not match the terminal identifier and the network slice identifier, it is determined that the terminal has no right to access the network slice.
  • the verification unit is further configured to:
  • the contract information corresponding to the decrypted terminal identity includes: the contract time and the identities of both parties to the contract.
  • the first network element further includes:
  • the determining module is used to determine that the access control information contains a ciphertext field corresponding to the terminal's identifier.
  • the first network element further includes:
  • the second acquisition module is configured to acquire network slice access relationship information corresponding to the terminal's identity from the second network element, where the network slice access relationship information includes: the terminal's identity, the network slice's identity, and the terminal's identity Sign the contract information corresponding to;
  • the first encryption module is configured to encrypt the network slice access relationship information according to the first access subkey and the second access subkey to obtain the ciphertext field corresponding to the terminal identifier;
  • the first storage module is configured to store the identification of the terminal and the ciphertext field corresponding to the identification of the terminal in association with the access control information.
  • the encryption module includes:
  • a generating unit configured to generate an integrity access key according to the first access subkey and the second access subkey
  • the encryption unit is configured to encrypt the network slice access relationship information according to the integrity access key to obtain the ciphertext field corresponding to the terminal identifier.
  • the first network element further includes:
  • the second receiving module is configured to receive updated network slice access relationship information sent by the second network element, where the updated network slice access relationship information includes: the terminal's identity, the network slice's identity, and the The updated subscription information corresponding to the terminal's identity;
  • the second encryption module is configured to encrypt the updated network slice access relationship information according to the first access subkey and the second access subkey to obtain the updated ciphertext field corresponding to the terminal identifier ;
  • the second storage module is configured to store the identification of the terminal and the updated ciphertext field in the access control information in association with each other.
  • the first network element further includes:
  • the deleting module is used to delete the terminal identifier and the ciphertext field corresponding to the terminal identifier from the access control information.
  • the contract information corresponding to the terminal identifier includes: the contract time and the identifiers of both parties to the contract.
  • the first access subkey corresponding to the terminal is the same as the authentication key of the terminal during identity authentication.
  • the first access subkey corresponding to the terminal is different from the access subkeys corresponding to other terminals.
  • an embodiment of the present application provides a network element, the network element is a first network element, and the first network element includes: a processor and a memory;
  • the memory is used to store program instructions
  • the processor is configured to call and execute the program instructions stored in the memory.
  • the first network element is configured to execute the method described in any implementation manner of the first aspect above .
  • an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium.
  • the instructions When the instructions are run on a computer, the computer executes any of the above-mentioned implementations of the first aspect. Methods.
  • an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, configured to implement the method described in any implementation manner of the first aspect.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • an embodiment of the present application provides a program, which is used to execute the method described in any implementation manner of the first aspect when the program is executed by a processor.
  • embodiments of the present application provide a computer program product containing instructions, which when run on a computer, cause the computer to execute the method described in any implementation manner of the first aspect.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the application
  • FIG. 2 is a schematic flowchart of a method for access control of network slicing provided by an embodiment of this application;
  • FIG. 3 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application;
  • FIG. 4 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application.
  • FIG. 5 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of this application.
  • FIG. 6 is a schematic flow chart of a method for access control of network slicing provided by another embodiment of this application.
  • FIG. 7 is a schematic flow chart of a method for access control of network slicing provided by another embodiment of this application.
  • FIG. 8 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of this application.
  • FIG. 9 is a schematic structural diagram of a network element provided by an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of a network element provided by another embodiment of this application.
  • Fig. 1 is a schematic diagram of an application scenario provided by an embodiment of the application.
  • the embodiments of this application can be applied to application scenarios when a terminal requests a network slicing service.
  • the network elements that need to be involved can include but are not limited to: AMF, unified data management (UDM), and network slicing Selection function (network slice Selection function, NSSF).
  • AMF unified data management
  • NSSF network slicing Selection function
  • the AMF can obtain the network slice access relationship information corresponding to the terminal’s identity from the UDM according to the terminal’s identity, and encrypt and store it in the access control information, so that the terminal can continue to request the network after the authentication is passed.
  • the AMF When slicing the service, verify whether the terminal has the right to access the network slicing. When the AMF verifies that the terminal has the right to access the network slice, the AMF informs the NSSF to allocate a network slice that meets the policy and subscription for the terminal for communication.
  • the AMF verifies whether the terminal has the right to access the network slice, it needs to be based on the first access subkey corresponding to the terminal, the second access subkey corresponding to the core network (CN), and the preset It can be seen that only two access sub-keys can be obtained at the same time to verify the access control information, which improves the security of access verification and solves the problem that if the integrity encryption key of the core network is stolen in related technologies, Attackers can arbitrarily tamper with the access authority of each terminal to affect the technical issues of network security.
  • the terminal involved in this application may also be referred to as a terminal device.
  • the terminal may be a wireless terminal or a wired terminal.
  • a wireless terminal may be a device that provides voice and/or other service data connectivity to users, a handheld device with wireless connection function, or other processing devices connected to a wireless modem.
  • a wireless terminal can communicate with one or more core networks via a radio access network (RAN).
  • the wireless terminal can be a mobile terminal, such as a mobile phone (or “cellular” phone) and a computer with a mobile terminal. For example, they can be portable, pocket-sized, handheld, computer-built or vehicle-mounted mobile devices that exchange language and/or data with the wireless access network.
  • a wireless terminal can also be called a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, and a remote terminal.
  • Access terminal access terminal
  • user terminal user terminal
  • user agent user agent
  • user equipment user device or user equipment, UE
  • the terminal involved in this application may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (dentral processing unit, CPU), a memory management unit (memory management unit, MMU), and memory (also referred to as main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating systems, Unix operating systems, Android operating systems, iOS operating systems or windows operating systems.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • At least one refers to one or more, and “multiple” refers to two or more.
  • “And/or” describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • the following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one item (a) of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • FIG. 2 is a schematic flowchart of a method for access control of network slicing provided by an embodiment of the application. As shown in Figure 2, the method of the embodiment of the present application may include:
  • Step S201 The first network element receives a network slicing request message.
  • the first network element involved in the embodiments of the present application may refer to the AMF on the CN side.
  • the first network element may also be other network elements with AMF functions.
  • the first network element may receive a network slicing request message sent by the terminal after the authentication is passed, where the network slicing request message carries the identity of the terminal and the identity of the network slice that the terminal requests to access.
  • the identification of the terminal may include, but is not limited to: the SUPI of the terminal.
  • the terminal has pre-stored the identification of the terminal and the identification of each network slice that the terminal can request to access.
  • Step S202 The first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal, and obtains the second access subkey corresponding to the core network CN.
  • the corresponding first access subkey is preset in the terminal, or a master key used to generate the corresponding first access subkey.
  • the first access subkey corresponding to the terminal may be the same as or different from the authentication key of the terminal during identity authentication. It should be noted that if the first access subkey corresponding to the terminal is different from the authentication key of the terminal during identity authentication, the terminal needs to store the first access subkey while storing the authentication key. Or the master key used to generate the corresponding first access subkey; if the first access subkey corresponding to the terminal is the same as the authentication key of the terminal during identity authentication, the terminal can reuse the authentication key For access verification, there is no need to store the first access subkey or the master key used to generate the corresponding first access subkey while storing the authentication key.
  • the first access subkey corresponding to the terminal and the access subkey corresponding to other terminals may be the same or different. It should be noted that the first access subkey corresponding to the terminal is different from the access subkey corresponding to other terminals, which can avoid the access subkey corresponding to any other terminal and the second access subkey corresponding to the CN. At the same time, it affects the access security of the terminal when it is leaked, and further improves the security of access verification.
  • the first network element may obtain the first access subkey from the terminal according to the identification of the terminal, or may obtain the first access subkey from a memory.
  • the first network element may search from the memory according to the identification of the terminal whether the corresponding first access subkey is included. If the memory contains the first access subkey corresponding to the identification of the terminal, the first network element may directly obtain the first access subkey corresponding to the terminal from the memory. Alternatively, if the memory does not contain the first access subkey corresponding to the identification of the terminal, the first network element may obtain the corresponding first access subkey from the terminal according to the identification of the terminal. It should be noted that the first access subkey corresponding to the terminal contained in the memory of the first network element may be stored when the first network element performs historical access verification on the terminal.
  • the first network element may also obtain the first access subkey corresponding to the terminal in other ways, which will not be described one by one in the embodiment of the present application.
  • the first network element may obtain the second access subkey corresponding to the core network CN from the second network element, or may obtain the second access subkey from the memory. For example, the first network element may search for whether the second access subkey is contained in the memory. If the second access subkey is contained in the memory, the first network element may directly obtain the second access subkey from the memory. Or, if the second access subkey is not contained in the memory, the first network element may obtain the second access subkey from the second network element. It should be noted that the second access subkey contained in the memory of the first network element may be stored when the first network element makes a historical request to the second network element.
  • the second network element involved in the embodiment of the present application may refer to the UDM on the CN side.
  • the second network element may also be other network elements with UDM functions.
  • the first network element may also obtain the second access subkey corresponding to the CN in other ways, which will not be described one by one in the embodiment of the present application.
  • Step S203 The first network element verifies whether the terminal has the right to access the network slice according to the first access subkey and the second access subkey.
  • the first network element verifies whether the terminal is authorized according to the first access subkey, the second access subkey, and the ciphertext field corresponding to the terminal identifier in the preset access control information
  • the network slice requested to be accessed in the network slice request message is the network slice corresponding to the network slice identifier carried in the network slice request message.
  • the first network element may notify a third network element to allocate the network slice requested to be accessed in the network slice request message for the terminal, wherein the third network element It may refer to the NSSF on the CN side.
  • the third network element may also be another network element with NSSF function; if it is determined that the terminal has no right to access the network slice, the first network element rejects the network slice request message.
  • the first network element in the embodiment of this application needs to be based on the first access subkey corresponding to the terminal and the first access subkey corresponding to the CN.
  • Two access sub-keys for access verification that is, verification can be performed only when these two access sub-keys are obtained at the same time, which improves the security of access verification and solves the problem of the core network integrity encryption key in related technologies.
  • the attacker can arbitrarily tamper with the access authority of each terminal and affect the technical problem of network security.
  • access control information is preset in the first network element, and the access control information includes the identification of at least one terminal and the ciphertext field corresponding to the identification of each terminal.
  • the access control information includes: terminal identification 1 and corresponding cipher text field 1, terminal identification 2 and corresponding cipher text field 2, terminal identification 3 and corresponding cipher text field 3. It should be understood that the access control information can be stored in a list form, of course, it can also be stored in other forms.
  • the identifier of any terminal in the access control information and the corresponding ciphertext field may be obtained by the first network element from the second network element when the terminal is registered to access the network and correspond to the identifier of the arbitrary terminal
  • the network slice is encrypted and stored after accessing the relationship information.
  • the first network element may generate an integrity access key according to a preset key derivation algorithm according to the first access subkey and the second access subkey, wherein the preset secret
  • the key derivation algorithm may include, but is not limited to, password-based key derivation function 2 (PBKDF2); or, the first network element may be based on the first access subkey and the second access subkey.
  • PBKDF2 password-based key derivation function 2
  • the key performs an exclusive OR operation to generate an integrity access key.
  • the first network element may also generate the above-mentioned integrity access key in other ways according to the first access subkey and the second access subkey.
  • the first network element may verify whether the terminal has the right to access the network slicing request message according to the generated integrity access key and the ciphertext field corresponding to the terminal identifier in the preset access control information The network slice requested to be accessed in.
  • the embodiment of the present application may further include: the first network element determines that the foregoing access control information includes a ciphertext field corresponding to the identification of the terminal. It should be noted that if the first network element determines that the aforementioned access control information does not include the ciphertext field corresponding to the terminal's identity, the first network element can directly determine that the terminal does not have the right to access the network slicing request message. The network slice requested for access.
  • the first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal carried in the network slicing request message, and obtains the second access subkey corresponding to the core network CN; further Preferably, the first network element verifies whether the terminal has the right to access the network slice requested to be accessed in the network slice request message according to the first access subkey and the second access subkey. It can be seen that, compared to the manner in which the AMF performs access verification based on the integrity encryption key of the core network in the related art, the first network element in the embodiment of the present application needs to be based on the first access subkey corresponding to the terminal and the first access subkey corresponding to the CN.
  • the second access subkey performs access verification, that is, verification can be performed only when the two access subkeys are obtained at the same time, which improves the security of access verification.
  • FIG. 3 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application.
  • the embodiment of the present application introduces the above-mentioned implementable way of "the first network element verifies whether the terminal has access to the network slice according to the integrity access key".
  • the method of the embodiment of the present application may include:
  • Step S301 The first network element decrypts the ciphertext field corresponding to the terminal identifier included in the access control information according to the integrity access key to obtain the decrypted network slice access relationship information.
  • the first network element reversibly decrypts the ciphertext field corresponding to the terminal identifier contained in the preset access control information according to the preset encryption and decryption algorithm according to the generated integrity access key , Obtain the decrypted network slice access relationship information, where the decrypted network slice access relationship information may include, but is not limited to: a decrypted terminal identifier and a decrypted network slice identifier.
  • the preset encryption and decryption algorithm may include but is not limited to: advanced encryption standard (AES)-galois/counter mode (GCM), AES-cipher block link (cipher block) chaining, CBC), triple data encryption algorithm (TDEA).
  • AES advanced encryption standard
  • GCM GCM
  • AES-cipher block link cipher block chaining
  • CBC triple data encryption algorithm
  • TDEA triple data encryption algorithm
  • the algorithm used in the decryption phase corresponds to the algorithm used in the encryption phase.
  • the default encryption and decryption algorithm used in the encryption phase is AES-GCM
  • the default encryption and decryption algorithm used in the decryption phase is also AES-GCM
  • the default encryption and decryption algorithm used in the encryption phase is AES-CBC
  • the default encryption and decryption algorithm used in the decryption stage is also AES-CBC.
  • the first network element can directly determine the The terminal does not have the right to access the network slice requested in the network slice request message.
  • Step S302 The first network element determines whether the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and the network slice identifier.
  • the first network element determines whether the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and network slice identifier carried in the network slice request message. For example, the first network element determines whether the decrypted terminal identifier is consistent with the terminal identifier carried in the network slicing request message, and whether the decrypted network slice identifier is consistent with the network slicing request message.
  • the identifier of the network slice is the same; if the decrypted terminal identifier is consistent with the terminal identifier carried in the network slice request message, and the decrypted network slice identifier is consistent with the network slice identifier carried in the network slice request message If the identifiers are consistent, the first network element determines that the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and network slice identifier carried in the network slice request message; if the decrypted terminal identifier and the network slice identifier match; The terminal identifier of the network slice is inconsistent with the terminal identifier carried in the network slice request message, and/or the decrypted network slice identifier is inconsistent with the network slice identifier carried in the network slice request message, then the first The network element determines that the decrypted terminal identifier and the decrypted network slice identifier do not match the terminal identifier and network slice identifier carried in the network slice request message.
  • step S303 is performed; if it is determined that the decrypted terminal If the identifier and the decrypted network slice identifier do not match the terminal identifier and the network slice identifier carried in the network slice request message, step S304 is executed.
  • Step S303 The first network element determines that the terminal has the right to access the network slice.
  • the first network element It is determined that the terminal has the right to access the network slice requested in the network slice request message, that is, the network slice corresponding to the network slice identifier carried in the network slice request message.
  • Step S304 The first network element determines that the terminal has no right to access the network slice.
  • the first network element It is determined that the terminal is not authorized to access the network slice requested in the network slice request message.
  • the embodiment of the present application may further include: the first network element determines the The contract information corresponding to the decrypted terminal identifier is valid information.
  • the contract information corresponding to the decrypted terminal identification in the embodiment of the application may include, but is not limited to: the contract time and the identification of both parties to the contract; where the contract time is used to indicate the validity time of the contract information; Indicates the identity of the contract object corresponding to the contract information.
  • the first network element determines where the decrypted terminal identity is located.
  • the corresponding contract information is valid information; if the contract time in the contract information corresponding to the decrypted terminal ID has expired, and/or the ID of the contracting parties does not include the ID of the terminal, then the first network element It is determined that the contract information corresponding to the decrypted terminal identifier does not belong to valid information.
  • the first network element may directly determine that the terminal is not authorized to access the network slice request message requested
  • the accessed network slice can prevent attackers from overwriting new contract information with invalid or expired contract information, which further improves the security of access verification.
  • FIG. 4 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application.
  • the embodiment of the present application introduces an achievable manner for the first network element to verify whether the terminal has the right to access the network slice.
  • the method of the embodiment of the present application may include:
  • Step S401 The first network element judges whether the preset access control information contains a ciphertext field corresponding to the identifier of the terminal.
  • step S402 is executed; if the access control information does not contain a ciphertext field corresponding to the terminal's identity, step S408 is executed.
  • Step S402 The first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal, and obtains the second access subkey corresponding to the core network CN.
  • Step S403 The first network element generates an integrity access key according to the first access subkey and the second access subkey.
  • Step S404 The first network element decrypts the ciphertext field corresponding to the terminal identifier included in the access control information according to the integrity access key to obtain the decrypted network slice access relationship information.
  • the decrypted network slice access relationship information may include, but is not limited to: a decrypted terminal identifier, a decrypted network slice identifier, and a contract information corresponding to the decrypted terminal identifier.
  • Step S405 The first network element judges whether the contract information corresponding to the decrypted terminal identifier is valid information.
  • step S406 is executed; if the contract information corresponding to the decrypted terminal identification is not valid information, step S408 is executed.
  • Step S406 The first network element determines whether the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and network slice identifier carried in the network slice request message.
  • step S407 is executed; if the decrypted terminal identifier and the network slice identifier match If the decrypted network slice identifier does not match the terminal identifier and the network slice identifier carried in the network slice request message, step S408 is executed.
  • Step S407 The first network element determines that the terminal has the right to access the network slice requested in the network slice request message.
  • Step S408 The first network element determines that the terminal is not authorized to access the network slice requested in the network slice request message.
  • the first network element needs to perform access verification according to the first access subkey corresponding to the terminal and the second access subkey corresponding to the CN, that is, only when these two are obtained at the same time. Only the access subkey can be verified, which improves the security of access verification.
  • the decrypted network slice access relationship information also includes the contract information corresponding to the decrypted terminal identifier, and the first network element determines whether the contract information corresponding to the decrypted terminal identifier is valid information. It can also prevent attackers from overwriting new contract information with invalid or expired contract information, further improving the security of access verification.
  • FIG. 5 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application.
  • the foregoing embodiment of the application combines the foregoing terminal, the foregoing first network element, the foregoing second network element, and the foregoing third network element to introduce the foregoing network slicing access control method.
  • the method of the embodiment of the present application may include:
  • Step S501 The terminal sends a network slicing request message to the first network element.
  • the network slice request message carries the identity of the terminal and the identity of the network slice that the terminal requests to access.
  • Step S502 The first network element determines whether the preset access control information includes a ciphertext field corresponding to the terminal identifier.
  • step S503 is executed, where step S503 includes step S503A and step S503B (the order of execution of the two is not limited); if the aforementioned access control information If the ciphertext field corresponding to the identification of the terminal is not included in the ciphertext field, the first network element determines that the terminal is not authorized to access the network slice requested in the network slice request message, and executes step S509.
  • Step S503A The first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal.
  • Step S503B The first network element obtains the second access subkey corresponding to the core network CN from the second network element.
  • Step S504 The first network element generates an integrity access key according to the first access subkey and the second access subkey.
  • Step S505 The first network element decrypts the ciphertext field corresponding to the terminal identifier included in the access control information according to the integrity access key to obtain the decrypted network slice access relationship information.
  • the decrypted network slice access relationship information may include, but is not limited to: a decrypted terminal identifier, a decrypted network slice identifier, and a contract information corresponding to the decrypted terminal identifier.
  • Step S506 The first network element judges whether the contract information corresponding to the decrypted terminal identifier is valid information.
  • step S507 is executed; if the contract information corresponding to the decrypted terminal identification is not valid information, the first network element determines that the terminal has no right to access The network slice requested to be accessed in the network slice request message, and step S509 is executed.
  • Step S507 The first network element determines whether the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and network slice identifier carried in the network slice request message.
  • the first network element determines that the terminal has the right to access the network slice.
  • the network slice requested to be accessed in the network slicing request message, and step S508 is executed; if the decrypted terminal identifier and the decrypted network slice identifier are the same as the terminal’s identifier and network slice’s identifier carried in the network slice request message If the identifiers do not match, the first network element determines that the terminal is not authorized to access the network slice requested in the network slice request message, and executes step S509.
  • Step S508 The first network element notifies the third network element to allocate the network slice requested to be accessed in the network slice request message for the terminal.
  • Step S509 The first network element rejects the network slicing request message.
  • the first network element obtains the first access subkey corresponding to the terminal and the second access subkey corresponding to the core network CN according to the terminal identifier carried in the network slicing request message sent by the terminal. Key, and generate an integrity access key according to the first access subkey and the second access subkey; further, the first network element decrypts the preset access control information according to the integrity access key Obtain the decrypted network slice access relationship information, and use the decrypted network slice access relationship information to verify whether the terminal has the right to access the network slice requested in the network slice request message, where the decrypted network slice
  • the access relationship information also includes the contract information corresponding to the decrypted terminal identifier.
  • the first network element in the embodiment of the present application needs to perform access verification based on the first access subkey corresponding to the terminal and the second access subkey corresponding to the CN, that is, only the two access subkeys can be obtained at the same time It can be verified, and by judging whether the contract information corresponding to the decrypted terminal ID is valid information, it can also prevent attackers from overwriting new contract information with invalid or expired contract information, thereby greatly improving the security of access verification. Sex.
  • FIG. 6 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of this application.
  • the method of the embodiment of the present application may include:
  • Step S601 The first network element obtains network slice access relationship information corresponding to the terminal identifier from the second network element.
  • the terminal may send a network slice information acquisition request to the first network element after the authentication at the time of registration and access to the network is passed, where the network slice information acquisition request is used to request to acquire each terminal that the terminal can request to access.
  • the network slice information (for example, the identifier of each network slice), the network slice information acquisition request may include, but is not limited to, the terminal identifier.
  • the first network element may, after receiving the network slice information acquisition request, forward the network slice information acquisition request to the second network element, so that the second network element can query the subscription information corresponding to the terminal identifier , And determine the information of each network slice (for example, the identifier of each network slice) that the terminal can request to access according to the subscription information corresponding to the terminal's identity and the preset slice restriction policy, and then access the network slice corresponding to the terminal
  • the relationship information is returned to the first network element; wherein, the network slice access relationship information may include, but is not limited to: the identification of the terminal, the information of each network slice that the terminal can request to access (including at least the above network slice request The identity corresponding to the network slice requested to be accessed in the message) and the subscription information corresponding to the identity of the terminal.
  • the subscription information corresponding to the terminal identifier in the embodiment of the present application may include, but is not limited to: the contract time and the identifiers of both parties to the contract, so that the first network element receives the network slicing request message sent by the terminal.
  • Step S602 The first network element encrypts the network slice access relationship information according to the first access subkey and the second access subkey to obtain the ciphertext field corresponding to the terminal identifier.
  • the first network element may generate the integrity access key according to the first access subkey and the second access subkey according to the foregoing preset key derivation algorithm; or, the first network element
  • the above-mentioned integrity access key can be generated by performing an exclusive OR operation based on the first access subkey and the second access subkey.
  • the first network element may encrypt the network slice access relationship information according to the above-mentioned preset encryption and decryption algorithm according to the generated integrity access key to obtain the ciphertext field corresponding to the terminal identifier.
  • Step S603 The first network element associates and stores the identification of the terminal and the ciphertext field corresponding to the identification of the terminal to the access control information.
  • the first network element associates the identification of the terminal and the ciphertext field corresponding to the identification of the terminal to the access control information, so that the first network element receives the network slicing request sent by the terminal.
  • the message is sent, it is verified whether the terminal has the right to access the network slice requested in the network slice request message.
  • the access control information in the embodiment of the present application includes the identification of the terminal and the ciphertext field corresponding to the identification of the terminal, it is possible to reduce the information of each network slice that the terminal can request to access and the terminal’s access control information.
  • the leakage risk of the contract information corresponding to the logo is beneficial to improve the security of access verification.
  • FIG. 7 is a schematic flowchart of a method for access control for network slicing provided by another embodiment of the application.
  • the method of the embodiment of the present application may include:
  • Step S701 The first network element receives updated network slice access relationship information sent by the second network element.
  • the second network element when the subscription information corresponding to the terminal identifier in the second network element changes, the second network element sends the updated network slice access relationship information corresponding to the terminal to the first network.
  • the updated network slice access relationship information may include, but is not limited to: the identification of the terminal, the information of each network slice that the terminal can request to access (including at least the access requested in the network slice request message) The identifier corresponding to the network slice of the terminal) and the updated subscription information corresponding to the identifier of the terminal.
  • the first network element receives the updated network slice access relationship information sent by the second network element.
  • Step S702 The first network element encrypts the updated network slice access relationship information according to the first access subkey and the second access subkey to obtain the updated cipher text corresponding to the terminal identifier segment.
  • the first network element may generate the integrity access key according to the first access subkey and the second access subkey according to the foregoing preset key derivation algorithm; or, the first network element The above-mentioned integrity access key can be generated by performing an exclusive OR operation based on the first access subkey and the second access subkey. Further, the first network element may encrypt the updated network slice access relationship information according to the generated integrity access key according to the above-mentioned preset encryption and decryption algorithm to obtain the updated information corresponding to the terminal's identity The ciphertext field.
  • Step S703 The first network element stores the identification of the terminal and the updated ciphertext field in the aforementioned access control information in association with each other.
  • the first network element stores the identification of the terminal and the updated ciphertext field in the access control information in association with each other, so that the information stored in the access control information is accurate and effective, so as to facilitate the first network
  • the element receives the network slice request message sent by the terminal, it can accurately verify whether the terminal has the right to access the network slice requested in the network slice request message.
  • the method of the embodiment of the present application may further include: the first network element deletes the terminal identifier and the ciphertext field corresponding to the terminal identifier from the above access control information, so that The information stored in the access control information is accurate and effective.
  • FIG. 8 is a schematic flowchart of a method for access control of network slicing provided by another embodiment of the application.
  • the embodiment of this application combines the terminal, the first network element, and the second network element to generate and update the ciphertext field corresponding to the terminal's identity in the access control information. Introduction.
  • the method of the embodiment of the present application may include:
  • Step S801 The terminal sends a network slice information acquisition request to the first network element.
  • the network slice information acquisition request is used to request to acquire the information of each network slice (for example, the identifier of each network slice) that the terminal can request to access, and the network slice information acquisition request may include, but is not limited to, the terminal identifier .
  • Step S802 The first network element forwards the network slice information acquisition request to the second network element.
  • Step S803 The second network element determines network slice access relationship information corresponding to the terminal according to the network slice information acquisition request.
  • the second network element queries the subscription information corresponding to the terminal identifier, and determines the information of each network slice that the terminal can request to access according to the subscription information corresponding to the terminal identifier and a preset slice restriction policy (For example, the identification of each network slice), thereby obtaining the network slice access relationship information corresponding to the terminal; where the network slice access relationship information may include, but is not limited to: the identification of the terminal, and each network to which the terminal can request access The slice information (including at least the identifier corresponding to the network slice requested to be accessed in the network slice request message) and the subscription information corresponding to the terminal identifier.
  • Step S804 The second network element returns the network slice access relationship information corresponding to the terminal to the first network element.
  • Step S805A The first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal.
  • Step S805B The first network element obtains the second access subkey corresponding to the core network CN from the second network element.
  • Step S806 The first network element generates an integrity access key according to the first access subkey and the second access subkey.
  • Step S807 The first network element encrypts the network slice access relationship information according to the integrity access key to obtain the ciphertext field corresponding to the terminal identifier.
  • Step S808 The first network element associates the identification of the terminal and the ciphertext field corresponding to the identification of the terminal to the access control information.
  • Step S809 The first network element sends the identification of the terminal and the information of each network slice that the terminal can request to access to the terminal.
  • Step S810 When the subscription information corresponding to the identifier of the terminal in the second network element changes, the second network element sends the updated network slice access relationship information corresponding to the terminal to the first network element.
  • Step S811 The first network element deletes the identification of the terminal and the ciphertext field corresponding to the identification of the terminal from the access control information.
  • Step S812 The first network element obtains the first access subkey corresponding to the terminal according to the identification of the terminal, and obtains the second access subkey corresponding to the core network CN.
  • Step S813 The first network element generates an integrity access key according to the first access subkey and the second access subkey.
  • Step S814 The first network element encrypts the updated network slice access relationship information according to the integrity access key to obtain the updated ciphertext field corresponding to the terminal identifier.
  • Step S815 The first network element associates and stores the identification of the terminal and the updated ciphertext field in the aforementioned access control information.
  • the first network element obtains the network slice access relationship information corresponding to the terminal from the second network element, it is based on the first access subkey corresponding to the terminal and the second access subkey corresponding to the core network CN.
  • the access subkey encrypts and stores the network slice access relationship information corresponding to the terminal. Since the access control information in the embodiment of the present application includes the identification of the terminal and the ciphertext field corresponding to the identification of the terminal, the information of each network slice that the terminal can request to access and the identification of the terminal can be reduced. The leakage risk of the corresponding contract information helps to improve the security of access verification.
  • the first network element may update and store the identification of the terminal and the updated ciphertext field corresponding to the terminal into the access control information, so that the access control information
  • the stored information is accurate and effective, so that when the first network element receives the network slice request message sent by the terminal, it can accurately verify whether the terminal has the right to access the network slice requested in the network slice request message.
  • FIG. 9 is a schematic structural diagram of a network element provided by an embodiment of this application.
  • the network element provided in the embodiment of the present application may be the first network element.
  • the first network element 90 of the embodiment of the present application may include: a first receiving module 901, a first obtaining module 902, and a verification module 903.
  • the first receiving module 901 receives a network slicing request message, where the network slicing request message carries the identification of the terminal and the identification of the network slicing;
  • the first obtaining module 902 is configured to obtain the first access subkey corresponding to the terminal according to the identification of the terminal, and obtain the second access subkey corresponding to the core network CN;
  • the verification module 903 is configured to verify whether the terminal has the right to access the network slice according to the first access subkey and the second access subkey.
  • the verification module 903 includes:
  • a generating unit configured to generate an integrity access key according to the first access subkey and the second access subkey
  • the verification unit is used to verify whether the terminal has the right to access the network slice according to the integrity access key.
  • the verification unit is specifically used for:
  • the decrypted terminal identifier and the decrypted network slice identifier match the terminal identifier and the network slice identifier, it is determined that the terminal has the right to access the network slice; or, if the decrypted terminal identifier and decrypted network slice If the subsequent network slice identifier does not match the terminal identifier and the network slice identifier, it is determined that the terminal has no right to access the network slice.
  • the verification unit is further configured to:
  • the contract information corresponding to the decrypted terminal identity includes: the contract time and the identities of both parties to the contract.
  • the first network element 90 further includes:
  • the determining module is used to determine that the access control information contains a ciphertext field corresponding to the terminal's identifier.
  • the first network element 90 further includes:
  • the second acquisition module is configured to acquire network slice access relationship information corresponding to the terminal's identity from the second network element, where the network slice access relationship information includes: the terminal's identity, the network slice's identity, and the terminal's identity Sign the contract information corresponding to;
  • the first encryption module is configured to encrypt the network slice access relationship information according to the first access subkey and the second access subkey to obtain the ciphertext field corresponding to the terminal identifier;
  • the first storage module is configured to store the identification of the terminal and the ciphertext field corresponding to the identification of the terminal in association with the access control information.
  • the encryption module includes:
  • a generating unit configured to generate an integrity access key according to the first access subkey and the second access subkey
  • the encryption unit is configured to encrypt the network slice access relationship information according to the integrity access key to obtain the ciphertext field corresponding to the terminal identifier.
  • the first network element 90 further includes:
  • the second receiving module is configured to receive updated network slice access relationship information sent by the second network element, where the updated network slice access relationship information includes: the terminal's identity, the network slice's identity, and the The updated subscription information corresponding to the terminal's identity;
  • the second encryption module is configured to encrypt the updated network slice access relationship information according to the first access subkey and the second access subkey to obtain the updated ciphertext field corresponding to the terminal identifier ;
  • the second storage module is configured to store the identification of the terminal and the updated ciphertext field in the access control information in association with each other.
  • the first network element 90 further includes:
  • the deleting module is used to delete the terminal identifier and the ciphertext field corresponding to the terminal identifier from the access control information.
  • the contract information corresponding to the terminal identifier includes: the contract time and the identifiers of both parties to the contract.
  • the first access subkey corresponding to the terminal is the same as the authentication key of the terminal during identity authentication.
  • the first access subkey corresponding to the terminal is different from the access subkeys corresponding to other terminals.
  • the first network element 90 provided by the embodiment of the present application can be used to implement the technical solution for the first network element in the above-mentioned embodiment of the access control method for network slicing of the present application.
  • the implementation principles and technical effects are similar, and will not be repeated here. .
  • FIG. 10 is a schematic structural diagram of a network element provided by another embodiment of this application.
  • the network element provided in the embodiment of the present application may be the first network element.
  • the first network element 100 of this embodiment may include: a processor 1001 and a memory 1002.
  • the first network element 100 may further include a transceiver 1003 for sending and receiving information and/or messages.
  • the memory 1002 is used to store program instructions; the processor 1001 is used to call and execute the program instructions stored in the memory 1002.
  • the processor 1001 executes the program instructions stored in the memory 1002, the first network element 100
  • the implementation principles and technical effects of the technical solutions for the first network element in the embodiment of the access control method for implementing the foregoing network slicing of the present application are similar, and will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the instructions run on a computer, the computer executes the above-mentioned network slice access control method embodiment of the present application.
  • the implementation principles and technical effects of the technical solutions for the first network element in the above are similar, and will not be repeated here.
  • the embodiment of the present application also provides a chip system.
  • the chip system includes a processor and may also include a memory, which is used to implement the technical solution of the first network element in the foregoing embodiment of the network slice access control method of the present application, and its implementation principle It is similar to the technical effect and will not be repeated here.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • the embodiment of the present application also provides a program, when the program is executed by a processor, it is used to execute the technical solution of the first network element in the above-mentioned embodiment of the access control method for network slicing of the present application, and its implementation principles and technical effects are similar. I won't repeat them here.
  • the embodiment of the present application also provides a computer program product containing instructions, which when running on a computer, causes the computer to execute the technical solution of the first network element in the above-mentioned embodiment of the access control method for network slicing in this application, and its implementation principle It is similar to the technical effect, so I won't repeat it here.
  • the processors involved in the embodiments of the present application may be general-purpose processors, digital signal processors, application specific integrated circuits, field programmable gate arrays or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and may implement or Perform the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • the memory involved in the embodiments of the present application may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), for example Random-access memory (random-access memory, RAM).
  • the memory is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the disclosed device and method can be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.
  • all or part of the implementation may be implemented by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state hard disk).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种网络切片的访问控制方法、装置及存储介质，该方法包括：第一网元根据网络切片请求消息中所携带的终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；进一步地，该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片请求消息中所请求访问的该网络切片。本申请实施例中该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证,由于在获取到这两个访问子密钥才能进行通过验证，从而提高了访问验证的安全性。

Description

网络切片的访问控制方法、装置及存储介质
本申请要求于2019年10月31日提交中国专利局、申请号为201911054670.0、申请名称为“网络切片的访问控制方法、装置及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，尤其涉及一种网络切片的访问控制方法、装置及存储介质。
背景技术
网络切片是第五代移动通信技术(5th generation mobile networks，5G)系统的重要资源，不能被随意访问，否则，会造成网络切片资源的滥用，从而影响用户业务的正常运行。例如，在车联网场景中，联网的车辆需要通过低时延高可靠的网络切片进行通信，但如果通信的网络切片被篡改成大链接型的网络切片，则将直接影响联网车辆的行驶安全，甚至会酿成交通事故。
相关技术中，当终端的身份鉴权通过后，终端通过向核心网中的接入移动管理功能(access and mobility management function，AMF)网元发送网络切片请求消息，其中，网络切片请求消息中包括：终端的用户永久标识(subscription permanent identifier，SUPI)和网络切片的标识。AMF在接收到网络切片请求消息后，根据SUPI和网络切片的标识判断访问控制列表中是否包含有对应的密文校验字段。若访问控制列表中包含有与SUPI和网络切片的标识对应的密文校验字段，则AMF根据核心网的完整性加密密钥对SUPI、网络切片的标识和该密文校验字段进行加密，得到加密字段，并判断加密字段与访问控制列表中的该密文校验字段是否一致；若加密字段与访问控制列表中的该密文校验字段一致，则AMF确定终端有权访问网络切片；若加密字段与访问控制列表中的该密文校验字段不一致，则AMF确定终端无权访问网络切片。另外，若上述访问控制列表中不包含与SUPI和网络切片的标识对应的密文校验字段，则AMF也确定终端无权访问网络切片。
相关技术中，如果核心网的完整性加密密钥一旦被窃取，则攻击者可以任意地篡改每个终端的访问权限，从而会影响网络安全。
发明内容
本申请实施例提供一种网络切片的访问控制方法、装置及存储介质，解决了相关技术中如果核心网的完整性加密密钥一旦被窃取，则攻击者可以任意地篡改每个终端的访问权限而影响网络安全的技术问题。
第一方面，本申请实施例提供一种网络切片的访问控制方法，包括：
第一网元接收网络切片请求消息，其中，该网络切片请求消息中携带有终端的标识和网络切片的标识；
该第一网元根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对 应的第二访问子密钥；
该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片。
本申请实施例中，该第一网元根据网络切片请求消息中所携带的终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；进一步地，该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片请求消息中所请求访问的该网络切片。可见，相对于相关技术中AMF根据核心网的完整性加密密钥进行访问验证的方式，本申请实施例中该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证，即只有同时获取到这两个访问子密钥才能进行验证，提高了访问验证的安全性。
在一种可能的实现方式中，该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片，包括：
该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
该第一网元根据该完整性访问密钥验证该终端是否有权访问该网络切片。
在一种可能的实现方式中，该第一网元根据该完整性访问密钥验证该终端是否有权访问该网络切片，包括：
该第一网元根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息，其中，该解密后的网络切片访问关系信息中包括：解密后的终端标识、解密后的网络切片标识；
该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该终端的标识和网络切片的标识相匹配；
若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识相匹配，则该第一网元确定该终端有权访问该网络切片；或者，若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识不匹配，则该第一网元确定该终端无权访问该网络切片。
在一种可能的实现方式中，若该解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，则该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该终端的标识和网络切片的标识相匹配之前，该方法还包括：
该第一网元确定该解密后的终端标识所对应的签约信息属于有效信息。
需要说明的是，如果该第一网元确定该解密后的终端标识所对应的签约信息不属于有效信息，则该第一网元可以直接确定该终端无权访问该网络切片请求消息中所请求访问的网络切片，从而可以避免攻击者通过无效或过期的签约信息覆盖新签约信息，进一步提高了访问验证的安全性。
在一种可能的实现方式中，该解密后的终端标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该第一网元根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥之前，该方法还包括：
该第一网元确定访问控制信息中包含有与该终端的标识对应的密文字段。
需要说明的是，如果该第一网元确定上述访问控制信息中未包含与该终端的标识对应 的密文字段，则该第一网元可以直接确定该终端无权访问该网络切片请求消息中所请求访问的网络切片。
在一种可能的实现方式中，该方法还包括：
该第一网元从第二网元获取该终端的标识对应的网络切片访问关系信息，其中，该网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的签约信息；
该第一网元根据该第一访问子密钥和该第二访问子密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段；
该第一网元将该终端的标识以及该终端的标识所对应的密文字段关联存储到访问控制信息。
本实现方式中，该第一网元根据该第一访问子密钥和该第二访问子密钥对该终端的标识对应的网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段，并将该终端的标识以及该终端的标识所对应的密文字段关联存储到该访问控制信息，以便于该第一网元在接收到该终端发送的网络切片请求消息时验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片。另外，由于本申请实施例中的该访问控制信息中包括该终端的标识以及该终端的标识所对应的密文字段，因此，可以降低该终端可以请求访问的各网络切片的信息和该终端的标识所对应的签约信息的泄露风险，有利于提高访问验证的安全性。
在一种可能的实现方式中，该根据该第一访问子密钥和该第二访问子密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段，包括：
该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
该第一网元根据该完整性访问密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
在一种可能的实现方式中，该方法还包括：
该第一网元接收该第二网元发送的更新后的网络切片访问关系信息，其中，该更新后的网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的更新后的签约信息；
该第一网元根据该第一访问子密钥和该第二访问子密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段；
该第一网元将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息。
本实现方式中，该第一网元根据该第一访问子密钥和该第二访问子密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段，并将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息，使得该访问控制信息中存储的信息为准确有效的，以便于该第一网元在接收到该终端发送的网络切片请求消息时可以准确地验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片。
在一种可能的实现方式中，该第一网元将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息之前，该方法还包括：
该第一网元将该终端的标识和该终端的标识所对应的密文字段从该访问控制信息中删除，使得该访问控制信息中存储的信息均为准确有效的。
在一种可能的实现方式中，该终端的标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该终端对应的第一访问子密钥与该终端在身份鉴权时的认证密钥相同，则该终端可以复用认证密钥进行访问验证，无需在存储认证密钥的同时还额外存储第一访问子密钥或用于生成对应的第一访问子密钥的主密钥。
在一种可能的实现方式中，该终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同，可以避免在其它任一终端对应的访问子密钥和CN对应的第二访问子密钥同时泄露时影响该终端的访问安全，进一步提高了访问验证的安全性。
第二方面，本申请实施例提供一种网元，该网元为第一网元，该第一网元包括：
第一接收模块，接收网络切片请求消息，其中，该网络切片请求消息中携带有终端的标识和网络切片的标识；
第一获取模块，用于根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；
验证模块，用于根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片。
在一种可能的实现方式中，该验证模块，包括：
生成单元，用于根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
验证单元，用于根据该完整性访问密钥验证该终端是否有权访问该网络切片。
在一种可能的实现方式中，该验证单元具体用于：
根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息，其中，该解密后的网络切片访问关系信息中包括：解密后的终端标识、解密后的网络切片标识；
判断该解密后的终端标识和解密后的网络切片标识，是否与该终端的标识和网络切片的标识相匹配；
若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识相匹配，则确定该终端有权访问该网络切片；或者，若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识不匹配，则确定该终端无权访问该网络切片。
在一种可能的实现方式中，若该解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，则该验证单元还用于：
确定该解密后的终端标识所对应的签约信息属于有效信息。
在一种可能的实现方式中，该解密后的终端标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该第一网元还包括：
确定模块，用于确定访问控制信息中包含有与该终端的标识对应的密文字段。
在一种可能的实现方式中，该第一网元还包括：
第二获取模块，用于从第二网元获取该终端的标识对应的网络切片访问关系信息，其中，该网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的签约信息；
第一加密模块，用于根据该第一访问子密钥和该第二访问子密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段；
第一存储模块，用于将该终端的标识以及该终端的标识所对应的密文字段关联存储到访问控制信息。
在一种可能的实现方式中，该加密模块包括：
生成单元，用于根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
加密单元，用于根据该完整性访问密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
在一种可能的实现方式中，该第一网元还包括：
第二接收模块，用于接收该第二网元发送的更新后的网络切片访问关系信息，其中，该更新后的网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的更新后的签约信息；
第二加密模块，用于根据该第一访问子密钥和该第二访问子密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段；
第二存储模块，用于将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息。
在一种可能的实现方式中，该第一网元还包括：
删除模块，用于将该终端的标识和该终端的标识所对应的密文字段从该访问控制信息中删除。
在一种可能的实现方式中，该终端的标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该终端对应的第一访问子密钥与该终端在身份鉴权时的认证密钥相同。
在一种可能的实现方式中，该终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同。
第三方面，本申请实施例提供一种网元，该网元为第一网元，该第一网元包括：处理器和存储器；
其中，该存储器，用于存储程序指令；
该处理器，用于调用并执行该存储器中存储的程序指令，当该处理器执行该存储器存储的程序指令时，该第一网元用于执行上述第一方面的任意实现方式所述的方法。
第四方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行上述第一方面的任意实现方式所述的方法。
第五方面，本申请实施例提供一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现上述第一方面的任意实现方式所述的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
第六方面，本申请实施例提供一种程序，该程序在被处理器执行时用于执行上述第一方面的任意实现方式所述的方法。
第七方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行 时，使得计算机执行上述第一方面的任意实现方式所述的方法。
附图说明
图1为本申请实施例提供的应用场景的示意图；
图2为本申请一实施例提供的网络切片的访问控制方法的流程示意图；
图3为本申请另一实施例提供的网络切片的访问控制方法的流程示意图；
图4为本申请另一实施例提供的网络切片的访问控制方法的流程示意图；
图5为本申请另一实施例提供的网络切片的访问控制方法的流程示意图；
图6为本申请另一实施例提供的网络切片的访问控制方法的流程示意；
图7为本申请另一实施例提供的网络切片的访问控制方法的流程示意；
图8为本申请另一实施例提供的网络切片的访问控制方法的流程示意图；
图9为本申请一实施例提供的网元的结构示意图；
图10为本申请另一实施例提供的网元的结构示意图。
具体实施方式
首先，对本申请实施例所涉及的应用场景和部分词汇进行解释说明。
图1为本申请实施例提供的应用场景的示意图。如图1所示，本申请实施例可以应用于终端请求网络切片服务时的应用场景，需要涉及到的网元可以包括但不限于：AMF、统一数据管理(unified data management，UDM)和网络切片选择功能(network slice Selection function，NSSF)。其中，AMF在终端注册入网时，可以根据终端的标识从UDM获取与该终端的标识对应的网络切片访问关系信息，并加密存储到访问控制信息，以便于该终端在鉴权通过后继续请求网络切片服务时，验证该终端是否有权访问网络切片。当AMF验证该终端有权访问网络切片时，AMF通知NSSF为该终端分配满足策略和签约的网络切片用于通信。
本申请实施例中，AMF在验证该终端是否有权访问网络切片时，需要根据该终端对应的第一访问子密钥、核心网(core network，CN)对应的第二访问子密钥以及预设的访问控制信息进行验证，可见只有同时获取两个访问子密钥才能进行验证，提高了访问验证的安全性，从而解决了相关技术中如果核心网的完整性加密密钥一旦被窃取，则攻击者可以任意地篡改每个终端的访问权限而影响网络安全的技术问题。
本申请涉及的终端，或者可以称为终端设备。终端可以是无线终端也可以是有线终端，无线终端可以是指向用户提供语音和/或其他业务数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。无线终端可以经无线接入网(radio access network，RAN)与一个或多个核心网进行通信，无线终端可以是移动终端，如移动电话(或称为“蜂窝”电话)和具有移动终端的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。无线终端也可以称为系统、订户单元(subscriber unit)、订户站(subscriber station)，移动 站(mobile station)、移动台(mobile)、远程站(remote station)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、用户设备(user device or user equipment，UE)，在此不作限定。
本申请所涉及的终端可以包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(dentral processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
下面以具体地实施例对本申请的技术方案进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。
图2为本申请一实施例提供的网络切片的访问控制方法的流程示意图。如图2所示，本申请实施例的方法可以包括：
步骤S201、第一网元接收网络切片请求消息。
示例性地，本申请实施例中涉及的第一网元可以是指CN侧的AMF，当然，该第一网元也可以是具有AMF功能的其它网元。
本步骤中，该第一网元可以接收终端在鉴权通过后发送的网络切片请求消息，其中，该网络切片请求消息中携带有该终端的标识和该终端所请求访问的网络切片的标识。示例性地，该终端的标识可以包括但不限于：该终端的SUPI。
需要说明的是，该终端中预存储有该终端的标识以及该终端可以请求访问的各网络切片的标识。
步骤S202、该第一网元根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥。
本申请实施例中，该终端中预设有对应的第一访问子密钥，或者用于生成对应的第一访问子密钥的主密钥。
示例性地，该终端对应的第一访问子密钥可以与该终端在身份鉴权时的认证密钥相同，也可以不相同。需要说明的是，如果该终端对应的第一访问子密钥与该终端在身份鉴权时的认证密钥不相同，则该终端在存储认证密钥的同时，需要额外存储第一访问子密钥或用于生成对应的第一访问子密钥的主密钥；如果该终端对应的第一访问子密钥与该终端在身份鉴权时的认证密钥相同，则该终端可以复用认证密钥进行访问验证，无需在存储认证密钥的同时还额外存储第一访问子密钥或用于生成对应的第一访问子密钥的主密钥。
示例性地，该终端对应的第一访问子密钥与其它终端对应的访问子密钥可以相同，也 可以不相同。需要说明的是，该终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同，可以避免在其它任一终端对应的访问子密钥和CN对应的第二访问子密钥同时泄露时影响该终端的访问安全，进一步提高了访问验证的安全性。
本申请实施例中，该第一网元可以根据该终端的标识从该终端获取该第一访问子密钥，或者可以从内存中获取该第一访问子密钥。例如，该第一网元可以根据该终端的标识从内存中搜索是否包含有对应的第一访问子密钥。若内存中包含有该终端的标识对应的第一访问子密钥，则该第一网元可以直接从内存中获取该终端对应的第一访问子密钥。或者，若内存中未包含有该终端的标识对应的第一访问子密钥，则该第一网元可以根据该终端的标识向该终端获取对应的第一访问子密钥。需要说明的是，该第一网元的内存中所包含的该终端对应的第一访问子密钥可以是该第一网元对该终端进行历史访问验证时存储的。
当然，该第一网元还可以通过其它方式获取该终端对应的第一访问子密钥，本申请实施例中对此不再一一说明。
本申请实施例中，该第一网元可以从第二网元获取核心网CN对应的第二访问子密钥，或者可以从内存中获取该第二访问子密钥。例如，该第一网元可以从内存中搜索是否包含有该第二访问子密钥。若内存中包含有该第二访问子密钥，则该第一网元可以直接从内存中获取该第二访问子密钥。或者，若内存中未包含有该第二访问子密钥，则该第一网元可以向该第二网元获取该第二访问子密钥。需要说明的是，该第一网元的内存中所包含的该第二访问子密钥可以是该第一网元向该第二网元历史请求获取时存储的。
示例性地，本申请实施例中涉及的该第二网元可以是指CN侧的UDM，当然，该第二网元也可以是具有UDM功能的其它网元。
当然，该第一网元还可以通过其它方式获取该CN对应的第二访问子密钥，本申请实施例中对此不再一一说明。
步骤S203、该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片。
本步骤中，该第一网元根据该第一访问子密钥、该第二访问子密钥以及预设的访问控制信息中与该终端的标识对应的密文字段，验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片，即该网络切片请求消息中所携带的网络切片的标识所对应的网络切片。进一步地，若确定该终端有权访问该网络切片，则该第一网元可以通知第三网元为该终端分配该网络切片请求消息中所请求访问的网络切片，其中，该第三网元可以是指CN侧的NSSF，当然，该第三网元也可以是具有NSSF功能的其它网元；若确定该终端无权访问该网络切片，则该第一网元拒绝该网络切片请求消息。
可见，相对于相关技术中AMF根据核心网的完整性加密密钥进行访问验证的方式，本申请实施例中该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证，即只有同时获取到这两个访问子密钥才能进行验证，提高了访问验证的安全性，从而解决了相关技术中如果核心网的完整性加密密钥一旦被窃取，则攻击者可以任意地篡改每个终端的访问权限而影响网络安全的技术问题。
本申请实施例中，该第一网元中预设有访问控制信息，该访问控制信息中包括有至少一个终端的标识以及每个终端的标识分别对应的密文字段。例如，该访问控制信息中包括：终端的标识1以及对应的密文字段1、终端的标识2以及对应的密文字段2、终端的标识3 以及对应的密文字段3。应理解，该访问控制信息可以列表形式存储，当然还可以其它形式存储。
示例性地，该访问控制信息中的任意终端的标识以及对应的密文字段，可以为该第一网元在该任意终端注册入网时从该第二网元获取到与该任意终端的标识对应的网络切片访问关系信息后加密存储的。
可选地，本步骤中该第一网元可以根据该第一访问子密钥和该第二访问子密钥按照预设密钥导出算法，生成完整性访问密钥，其中，该预设密钥导出算法可以包括但不限于基于密码的密钥派生功能2(password-based key derivation function 2，PBKDF2)；或者，该第一网元可以根据该第一访问子密钥和该第二访问子密钥进行异或操作，生成完整性访问密钥。需要说明的是，本申请实施例中，该第一网元根据该第一访问子密钥和该第二访问子密钥还可以通过其它方式生成上述完整性访问密钥。
进一步地，该第一网元可以根据所生成的该完整性访问密钥以及预设的访问控制信息中与该终端的标识对应的密文字段，验证该终端是否有权访问该网络切片请求消息中所请求访问的该网络切片。
可选地，在上述步骤S202之前，本申请实施例还可以包括：该第一网元确定上述访问控制信息中包含有与该终端的标识对应的密文字段。需要说明的是，如果该第一网元确定上述访问控制信息中未包含与该终端的标识对应的密文字段，则该第一网元可以直接确定该终端无权访问该网络切片请求消息中所请求访问的网络切片。
本申请实施例中，该第一网元根据网络切片请求消息中所携带的终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；进一步地，该第一网元根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片请求消息中所请求访问的该网络切片。可见，相对于相关技术中AMF根据核心网的完整性加密密钥进行访问验证的方式，本申请实施例中该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证，即只有同时获取到这两个访问子密钥才能进行验证，提高了访问验证的安全性。
图3为本申请另一实施例提供的网络切片的访问控制方法的流程示意图。在上述实施例的基础上，本申请实施例中对上述“第一网元根据完整性访问密钥验证该终端是否有权访问网络切片”的可实现方式进行介绍。如图2所示，本申请实施例的方法可以包括：
步骤S301、该第一网元根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息。
本步骤中，该第一网元根据所生成的该完整性访问密钥按照预设加解密算法，对预设的访问控制信息中所包含的与该终端的标识对应的密文字段进行可逆解密，得到解密后的网络切片访问关系信息，其中，该解密后的网络切片访问关系信息中可以包括但不限于：解密后的终端标识、解密后的网络切片标识。
示例性地，该预设加解密算法可以包括但不限于：高级加密标准(advanced encryption standard，AES)-伽罗瓦/计数器模式(galois/counter mode，GCM)、AES-密码块链接(cipher block chaining，CBC)、三重数据加密算法(triple data encryption algorithm，TDEA)。
应理解，本申请实施例中，解密阶段所采用的算法与加密阶段所采用的算法相对应。例如，如果加密阶段所采用的预设加解密算法为AES-GCM，则解密阶段所采用的预设加解密算法也为AES-GCM；如果加密阶段所采用的预设加解密算法为AES-CBC，则解密阶段所采用的预设加解密算法也为AES-CBC。
需要说明的是，如果该第一网元根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密失败，则该第一网元可以直接确定该终端无权访问该网络切片请求消息中所请求访问的网络切片。
步骤S302、该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该终端的标识和网络切片的标识相匹配。
本步骤中，该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配。例如，该第一网元判断该解密后的终端标识是否与该网络切片请求消息中所携带的该终端的标识一致，以及该解密后的网络切片标识是否与该网络切片请求消息中所携带的网络切片的标识一致；若该解密后的终端标识与该网络切片请求消息中所携带的该终端的标识一致，以及该解密后的网络切片标识与该网络切片请求消息中所携带的网络切片的标识一致，则该第一网元确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配；若该解密后的终端标识与该网络切片请求消息中所携带的该终端的标识不一致，和/或，该解密后的网络切片标识与该网络切片请求消息中所携带的网络切片的标识不一致，则该第一网元确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识不匹配。
若确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配，则执行步骤S303；若确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识不匹配，则执行步骤S304。
步骤S303、该第一网元确定该终端有权访问该网络切片。
本申请实施例中，若确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配，则该第一网元确定该终端有权访问该网络切片请求消息中所请求访问的网络切片，即该网络切片请求消息中所携带的网络切片的标识所对应的网络切片。
步骤S304、该第一网元确定该终端无权访问该网络切片。
本申请实施例中，若确定该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识不匹配，则该第一网元确定该终端无权访问该网络切片请求消息中所请求访问的网络切片。
可选地，若上述解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，在上述步骤S302之前，本申请实施例还可以包括：该第一网元确定该解密后的终端标识所对应的签约信息属于有效信息。
本申请实施例中的该解密后的终端标识所对应的签约信息可以包括但不限于：签约时间和签约双方的标识；其中，签约时间用于指示签约信息的有效时间；签约双方的标识用于指示该签约信息对应的签约对象的标识。
示例性地，若该解密后的终端标识所对应的签约信息中的签约时间未过期，且该签约双方的标识中包括该终端的标识，则该第一网元确定该解密后的终端标识所对应的签约信息属于有效信息；若该解密后的终端标识所对应的签约信息中的签约时间已过期，和/或，该签约双方的标识中不包括该终端的标识，则该第一网元确定该解密后的终端标识所对应的签约信息不属于有效信息。
需要说明的是，如果该第一网元确定该解密后的终端标识所对应的签约信息不属于有效信息，则该第一网元可以直接确定该终端无权访问该网络切片请求消息中所请求访问的网络切片，从而可以避免攻击者通过无效或过期的签约信息覆盖新签约信息，进一步提高了访问验证的安全性。
图4为本申请另一实施例提供的网络切片的访问控制方法的流程示意图。在上述实施例的基础上，本申请实施例对该第一网元验证该终端是否有权访问网络切片的可实现方式进行介绍。如图4所示，本申请实施例的方法可以包括：
步骤S401、第一网元判断预设的访问控制信息中是否包含有与该终端的标识对应的密文字段。
若该访问控制信息中包含有与该终端的标识对应的密文字段，则执行步骤S402；若该访问控制信息中未包含有与该终端的标识对应的密文字段，则执行步骤S408。
步骤S402、该第一网元根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥。
步骤S403、该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥。
步骤S404、该第一网元根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息。
示例性地，该解密后的网络切片访问关系信息中可以包括但不限于：解密后的终端标识、解密后的网络切片标识、解密后的终端标识所对应的签约信息。
步骤S405、该第一网元判断该解密后的终端标识所对应的签约信息是否属于有效信息。
若该解密后的终端标识所对应的签约信息属于有效信息，则执行步骤S406；若该解密后的终端标识所对应的签约信息不属于有效信息，则执行步骤S408。
步骤S406、该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配。
若该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配，则执行步骤S407；若该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识不匹配，则执行步骤S408。
步骤S407、该第一网元确定该终端有权访问该网络切片请求消息中所请求访问的网络切片。
步骤S408、该第一网元确定该终端无权访问上述网络切片请求消息中所请求访问的网络切片。
本申请实施例中的各步骤的具体实现方式，可以参考本申请上述各实施例中的相关内 容，此处不再赘述。
综上所述，本申请实施例中，该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证，即只有同时获取到这两个访问子密钥才能进行验证，提高了访问验证的安全性。另外，该解密后的网络切片访问关系信息中还包括解密后的终端标识所对应的签约信息，该第一网元通过判断该解密后的终端标识所对应的签约信息是否属于有效信息的方式，还可以避免攻击者通过无效或过期的签约信息覆盖新签约信息，进一步提高了访问验证的安全性。
图5为本申请另一实施例提供的网络切片的访问控制方法的流程示意图。在上述实施例的基础上，本申请实施例中结合上述终端、上述第一网元、上述第二网元和上述第三网元，对上述网络切片的访问控制方法进行介绍。如图5所示，本申请实施例的方法可以包括：
步骤S501、该终端向该第一网元发送网络切片请求消息。
其中，该网络切片请求消息中携带有该终端的标识和该终端所请求访问的网络切片的标识。
步骤S502、该第一网元判断预设的访问控制信息中是否包含有与该终端的标识对应的密文字段。
若上述访问控制信息中包含有与该终端的标识对应的密文字段，则执行步骤S503，其中，步骤S503中包括步骤S503A和步骤S503B(二者的执行顺序不限)；若上述访问控制信息中未包含有与该终端的标识对应的密文字段，则该第一网元确定该终端无权访问该网络切片请求消息中所请求访问的网络切片，并执行步骤S509。
步骤S503A、该第一网元根据该终端的标识获取该终端对应的第一访问子密钥。
步骤S503B、该第一网元从该第二网元获取核心网CN对应的第二访问子密钥。
步骤S504、该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥。
步骤S505、该第一网元根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息。
示例性地，该解密后的网络切片访问关系信息中可以包括但不限于：解密后的终端标识、解密后的网络切片标识、解密后的终端标识所对应的签约信息。
步骤S506、该第一网元判断该解密后的终端标识所对应的签约信息是否属于有效信息。
若该解密后的终端标识所对应的签约信息属于有效信息，则执行步骤S507；若该解密后的终端标识所对应的签约信息不属于有效信息，则该第一网元确定该终端无权访问该网络切片请求消息中所请求访问的网络切片，并执行步骤S509。
步骤S507、该第一网元判断该解密后的终端标识和解密后的网络切片标识，是否与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配。
若该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识相匹配，则该第一网元确定该终端有权访问该网络切片请求消息中所请求访问的网络切片，并执行步骤S508；若该解密后的终端标识和解密后的网络切片标识，与该网络切片请求消息中所携带的该终端的标识和网络切片的标识不匹配， 则该第一网元确定该终端无权访问该网络切片请求消息中所请求访问的网络切片，并执行步骤S509。
步骤S508、该第一网元通知该第三网元为该终端分配该网络切片请求消息中所请求访问的网络切片。
步骤S509、该第一网元拒绝该网络切片请求消息。
本申请实施例中的各步骤的具体实现方式，可以参考本申请上述各实施例中的相关内容，此处不再赘述。
本申请实施例中，该第一网元根据该终端发送的网络切片请求消息中所携带的终端的标识获取该终端对应的第一访问子密钥、获取核心网CN对应的第二访问子密钥，并根据该第一访问子密钥和该第二访问子密钥生成完整性访问密钥；进一步地，该第一网元根据该完整性访问密钥对预设的访问控制信息进行解密得到解密后的网络切片访问关系信息，并通过该解密后的网络切片访问关系信息验证该终端是否有权访问该网络切片请求消息中所请求访问的该网络切片，其中，该解密后的网络切片访问关系信息中还包括解密后的终端标识所对应的签约信息。可见，本申请实施例中该第一网元需要根据该终端对应的第一访问子密钥以及CN对应的第二访问子密钥进行访问验证，即只有同时获取到这两个访问子密钥才能进行验证，并且通过判断该解密后的终端标识所对应的签约信息是否属于有效信息的方式，还可以避免攻击者通过无效或过期的签约信息覆盖新签约信息，从而大大提高了访问验证的安全性。
图6为本申请另一实施例提供的网络切片的访问控制方法的流程示意。在上述实施例的基础上，本申请实施例中对“上述第一网元在终端注册入网时，根据终端的标识从第二网元获取与该终端的标识对应的网络切片访问关系信息，并加密存储到访问控制信息以对该网络切片访问关系信息进行保护”的可实现方式进行介绍。如图6所示，本申请实施例的方法可以包括：
步骤S601、该第一网元从该第二网元获取该终端的标识对应的网络切片访问关系信息。
本申请实施例中，该终端在注册入网时的鉴权通过后可以向该第一网元发送网络切片信息获取请求，其中，该网络切片信息获取请求用于请求获取该终端可以请求访问的各网络切片的信息(例如，各网络切片的标识)，该网络切片信息的获取请求中可以包括但不限于该终端的标识。
对应地，该第一网元可以在接收到该网络切片信息获取请求后，向该第二网元转发该网络切片信息获取请求，以便该第二网元查询该终端的标识所对应的签约信息，并根据该终端的标识所对应的签约信息和预设的切片限制策略确定该终端可以请求访问的各网络切片的信息(例如，各网络切片的标识)，然后将该终端对应的网络切片访问关系信息返回给该第一网元；其中，该网络切片访问关系信息中可以包括但不限于：该终端的标识、该终端可以请求访问的各网络切片的信息(其中，至少包括上述网络切片请求消息中所请求访问的网络切片对应的标识)和该终端的标识所对应的签约信息。
示例性地，本申请实施例中的终端的标识所对应的签约信息可以包括但不限于：签约时间和签约双方的标识，以便于该第一网元在接收到该终端发送的网络切片请求消息时，还可以通过判断解密后的终端标识所对应的签约信息是否属于有效信息的方式，以避免攻 击者通过无效或过期的签约信息覆盖新签约信息，从而可以提高访问验证的安全性。
步骤S602、该第一网元根据上述第一访问子密钥和上述第二访问子密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
本步骤中的该第一访问子密钥和该第二访问子密钥的相关内容，可以参考本申请上述实施例中关于步骤S202的相关内容，此处不再赘述。
可选地，该第一网元可以根据该第一访问子密钥和该第二访问子密钥按照上述预设密钥导出算法，生成上述完整性访问密钥；或者，该第一网元可以根据该第一访问子密钥和该第二访问子密钥进行异或操作，生成上述完整性访问密钥。进一步地，该第一网元可以根据所生成的该完整性访问密钥按照上述预设加解密算法，对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
步骤S603、该第一网元将该终端的标识以及该终端的标识所对应的密文字段关联存储到该访问控制信息。
本步骤中，该第一网元将该终端的标识以及该终端的标识所对应的密文字段关联存储到该访问控制信息，以便于该第一网元在接收到该终端发送的网络切片请求消息时验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片。另外，由于本申请实施例中的该访问控制信息中包括该终端的标识以及该终端的标识所对应的密文字段，因此，可以降低该终端可以请求访问的各网络切片的信息和该终端的标识所对应的签约信息的泄露风险，有利于提高访问验证的安全性。
图7为本申请另一实施例提供的网络切片的访问控制方法的流程示意。在上述实施例的基础上，本申请实施例中对“当该终端的标识所对应的签约信息发生改变时，第一网元更新访问控制信息中与该终端的标识所对应的密文字段”的可实现方式进行介绍。如图7所示，本申请实施例的方法可以包括：
步骤S701、该第一网元接收该第二网元发送的更新后的网络切片访问关系信息。
本申请实施例中，当该第二网元中的该终端的标识对应的签约信息发生改变时，该第二网元将该终端对应的更新后的网络切片访问关系信息发送给该第一网元；其中，该更新后的网络切片访问关系信息中可以包括但不限于：该终端的标识、该终端可以请求访问的各网络切片的信息(其中，至少包括上述网络切片请求消息中所请求访问的网络切片对应的标识)和该终端的标识所对应的更新后的签约信息。对应地，该第一网元接收该第二网元发送的该更新后的网络切片访问关系信息。
步骤S702、该第一网元根据上述第一访问子密钥和上述第二访问子密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段。
本步骤中的该第一访问子密钥和该第二访问子密钥的相关内容，可以参考本申请上述实施例中关于步骤S202的相关内容，此处不再赘述。
可选地，该第一网元可以根据该第一访问子密钥和该第二访问子密钥按照上述预设密钥导出算法，生成上述完整性访问密钥；或者，该第一网元可以根据该第一访问子密钥和该第二访问子密钥进行异或操作，生成上述完整性访问密钥。进一步地，该第一网元可以根据所生成的该完整性访问密钥按照上述预设加解密算法，对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段。
步骤S703、该第一网元将该终端的标识以及该更新后的密文字段关联存储到上述访问控制信息。
本步骤中，该第一网元将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息，使得该访问控制信息中存储的信息为准确有效的，以便于该第一网元在接收到该终端发送的网络切片请求消息时可以准确地验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片。
需要说明的是，上述步骤S703之前，本申请实施例的方法还可以包括：该第一网元将该终端的标识和该终端的标识所对应的密文字段从上述访问控制信息中删除，使得该访问控制信息中存储的信息均为准确有效的。
图8为本申请另一实施例提供的网络切片的访问控制方法的流程示意图。在上述实施例的基础上，本申请实施例中结合终端、第一网元和第二网元，对生成以及更新访问控制信息中与该终端的标识所对应的密文字段的可实现方式进行介绍。如图8所示，本申请实施例的方法可以包括：
步骤S801、该终端向该第一网元发送网络切片信息获取请求。
其中，该网络切片信息获取请求用于请求获取该终端可以请求访问的各网络切片的信息(例如，各网络切片的标识)，该网络切片信息的获取请求中可以包括但不限于该终端的标识。
步骤S802、该第一网元向该第二网元转发该网络切片信息获取请求。
步骤S803、该第二网元根据该网络切片信息获取请求确定该终端对应的网络切片访问关系信息。
示例性地，该第二网元查询该终端的标识所对应的签约信息，并根据该终端的标识所对应的签约信息和预设的切片限制策略确定该终端可以请求访问的各网络切片的信息(例如，各网络切片的标识)，从而得到该终端对应的网络切片访问关系信息；其中，该网络切片访问关系信息中可以包括但不限于：该终端的标识、该终端可以请求访问的各网络切片的信息(其中，至少包括上述网络切片请求消息中所请求访问的网络切片对应的标识)和该终端的标识所对应的签约信息。
步骤S804、该第二网元将该终端对应的网络切片访问关系信息返回给该第一网元。
步骤S805A、该第一网元根据该终端的标识获取该终端对应的第一访问子密钥。
步骤S805B、该第一网元从该第二网元获取核心网CN对应的第二访问子密钥。
步骤S806、该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥。
步骤S807、该第一网元根据该完整性访问密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
步骤S808、该第一网元将该终端的标识以及该终端的标识所对应的密文字段关联存储到该访问控制信息。
步骤S809、该第一网元将该终端的标识和该终端可以请求访问的各网络切片的信息发送给该终端。
步骤S810、当该第二网元中的该终端的标识对应的签约信息发生改变时，该第二网元 将该终端对应的更新后的网络切片访问关系信息发送给该第一网元。
步骤S811、该第一网元将该终端的标识和该终端的标识所对应的密文字段从该访问控制信息中删除。
步骤S812、该第一网元根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥。
步骤S813、该第一网元根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥。
步骤S814、该第一网元根据该完整性访问密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段。
步骤S815、该第一网元将该终端的标识以及该更新后的密文字段关联存储到上述访问控制信息。
本申请实施例中的各步骤的具体实现方式，可以参考本申请上述各实施例中的相关内容，此处不再赘述。
本申请实施例中，该第一网元在从该第二网元获取到该终端对应的网络切片访问关系信息后，根据该终端对应的第一访问子密钥和核心网CN对应的第二访问子密钥对该终端对应的网络切片访问关系信息进行加密存储。由于本申请实施例中的该访问控制信息中包括该终端的标识以及该终端的标识所对应的密文字段，因此，可以降低该终端可以请求访问的各网络切片的信息和该终端的标识所对应的签约信息的泄露风险，有利于提高访问验证的安全性。进一步地，当该终端对应的签约信息发生改变时，该第一网元可以将该终端的标识以及该终端对应的更新后的密文字段更新存储到上述访问控制信息，使得该访问控制信息中存储的信息为准确有效的，以便于该第一网元在接收到该终端发送的网络切片请求消息时可以准确地验证该终端是否有权访问该网络切片请求消息中所请求访问的网络切片。
需要说明的是，本领域普通技术人员可以理解，在本申请的上述各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
图9为本申请一实施例提供的网元的结构示意图。可选地，本申请实施例提供的网元可以为第一网元。如图9所示，本申请实施例的第一网元90可以包括：第一接收模块901、第一获取模块902以及验证模块903。
其中，第一接收模块901，接收网络切片请求消息，其中，该网络切片请求消息中携带有终端的标识和网络切片的标识；
第一获取模块902，用于根据该终端的标识获取该终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；
验证模块903，用于根据该第一访问子密钥和该第二访问子密钥，验证该终端是否有权访问该网络切片。
在一种可能的实现方式中，该验证模块903，包括：
生成单元，用于根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
验证单元，用于根据该完整性访问密钥验证该终端是否有权访问该网络切片。
在一种可能的实现方式中，该验证单元具体用于：
根据该完整性访问密钥对访问控制信息中所包含的与该终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息，其中，该解密后的网络切片访问关系信息中包括：解密后的终端标识、解密后的网络切片标识；
判断该解密后的终端标识和解密后的网络切片标识，是否与该终端的标识和网络切片的标识相匹配；
若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识相匹配，则确定该终端有权访问该网络切片；或者，若该解密后的终端标识和解密后的网络切片标识，与该终端的标识和网络切片的标识不匹配，则确定该终端无权访问该网络切片。
在一种可能的实现方式中，若该解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，则该验证单元还用于：
确定该解密后的终端标识所对应的签约信息属于有效信息。
在一种可能的实现方式中，该解密后的终端标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该第一网元90还包括：
确定模块，用于确定访问控制信息中包含有与该终端的标识对应的密文字段。
在一种可能的实现方式中，该第一网元90还包括：
第二获取模块，用于从第二网元获取该终端的标识对应的网络切片访问关系信息，其中，该网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的签约信息；
第一加密模块，用于根据该第一访问子密钥和该第二访问子密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段；
第一存储模块，用于将该终端的标识以及该终端的标识所对应的密文字段关联存储到访问控制信息。
在一种可能的实现方式中，该加密模块包括：
生成单元，用于根据该第一访问子密钥和该第二访问子密钥，生成完整性访问密钥；
加密单元，用于根据该完整性访问密钥对该网络切片访问关系信息进行加密，得到该终端的标识所对应的密文字段。
在一种可能的实现方式中，该第一网元90还包括：
第二接收模块，用于接收该第二网元发送的更新后的网络切片访问关系信息，其中，该更新后的网络切片访问关系信息中包括：该终端的标识、该网络切片的标识和该终端的标识所对应的更新后的签约信息；
第二加密模块，用于根据该第一访问子密钥和该第二访问子密钥对该更新后的网络切片访问关系信息进行加密，得到该终端的标识所对应的更新后的密文字段；
第二存储模块，用于将该终端的标识以及该更新后的密文字段关联存储到该访问控制信息。
在一种可能的实现方式中，该第一网元90还包括：
删除模块，用于将该终端的标识和该终端的标识所对应的密文字段从该访问控制信息 中删除。
在一种可能的实现方式中，该终端的标识所对应的签约信息包括：签约时间和签约双方的标识。
在一种可能的实现方式中，该终端对应的第一访问子密钥与该终端在身份鉴权时的认证密钥相同。
在一种可能的实现方式中，该终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同。
本申请实施例提供的第一网元90，可以用于执行本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。
图10为本申请另一实施例提供的网元的结构示意图。可选地，本申请实施例提供的网元可以为第一网元。如图10所示，本实施例的第一网元100可以包括：处理器1001和存储器1002。可选地，该第一网元100还可以包括用于收发信息和/或消息的收发器1003。其中，该存储器1002用于存储程序指令；该处理器1001用于调用并执行该存储器1002中存储的程序指令，当该处理器1001执行该存储器1002存储的程序指令时，该第一网元100用于执行本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得计算机执行本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。
本申请实施例还提供一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例还提供一种程序，该程序在被处理器执行时用于执行本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。
本申请实施例还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行本申请上述网络切片的访问控制方法实施例中关于第一网元的技术方案，其实现原理和技术效果类似，此处不再赘述。
本申请实施例中涉及的处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
本申请实施例中涉及的存储器可以是非易失性存储器，比如硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)等，还可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)。存储器是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于 此。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
在上述各实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘)等。

Claims (28)

  1. 一种网络切片的访问控制方法，其特征在于，包括：
    第一网元接收网络切片请求消息，其中，所述网络切片请求消息中携带有终端的标识和网络切片的标识；
    所述第一网元根据所述终端的标识获取所述终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；
    所述第一网元根据所述第一访问子密钥和所述第二访问子密钥，验证所述终端是否有权访问所述网络切片。
  2. 根据权利要求1所述的方法，其特征在于，所述第一网元根据所述第一访问子密钥和所述第二访问子密钥，验证所述终端是否有权访问所述网络切片，包括：
    所述第一网元根据所述第一访问子密钥和所述第二访问子密钥，生成完整性访问密钥；
    所述第一网元根据所述完整性访问密钥验证所述终端是否有权访问所述网络切片。
  3. 根据权利要求2所述的方法，其特征在于，所述第一网元根据所述完整性访问密钥验证所述终端是否有权访问所述网络切片，包括：
    所述第一网元根据所述完整性访问密钥对访问控制信息中所包含的与所述终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息，其中，所述解密后的网络切片访问关系信息中包括：解密后的终端标识、解密后的网络切片标识；
    所述第一网元判断所述解密后的终端标识和解密后的网络切片标识，是否与所述终端的标识和网络切片的标识相匹配；
    若所述解密后的终端标识和解密后的网络切片标识，与所述终端的标识和网络切片的标识相匹配，则所述第一网元确定所述终端有权访问所述网络切片；或者，若所述解密后的终端标识和解密后的网络切片标识，与所述终端的标识和网络切片的标识不匹配，则所述第一网元确定所述终端无权访问所述网络切片。
  4. 根据权利要求3所述的方法，其特征在于，若所述解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，则所述第一网元判断所述解密后的终端标识和解密后的网络切片标识，是否与所述终端的标识和网络切片的标识相匹配之前，所述方法还包括：
    所述第一网元确定所述解密后的终端标识所对应的签约信息属于有效信息。
  5. 根据权利要求4所述的方法，其特征在于，所述解密后的终端标识所对应的签约信息包括：签约时间和签约双方的标识。
  6. 根据权利要求1-5中任一项所述的方法，其特征在于，所述第一网元根据所述终端的标识获取所述终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥之前，所述方法还包括：
    所述第一网元确定访问控制信息中包含有与所述终端的标识对应的密文字段。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一网元从第二网元获取所述终端的标识对应的网络切片访问关系信息，其中，所述网络切片访问关系信息中包括：所述终端的标识、所述网络切片的标识和所述终端的标识所对应的签约信息；
    所述第一网元根据所述第一访问子密钥和所述第二访问子密钥对所述网络切片访问关 系信息进行加密，得到所述终端的标识所对应的密文字段；
    所述第一网元将所述终端的标识以及所述终端的标识所对应的密文字段关联存储到访问控制信息。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述第一访问子密钥和所述第二访问子密钥对所述网络切片访问关系信息进行加密，得到所述终端的标识所对应的密文字段，包括：
    所述第一网元根据所述第一访问子密钥和所述第二访问子密钥，生成完整性访问密钥；
    所述第一网元根据所述完整性访问密钥对所述网络切片访问关系信息进行加密，得到所述终端的标识所对应的密文字段。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    所述第一网元接收所述第二网元发送的更新后的网络切片访问关系信息，其中，所述更新后的网络切片访问关系信息中包括：所述终端的标识、所述网络切片的标识和所述终端的标识所对应的更新后的签约信息；
    所述第一网元根据所述第一访问子密钥和所述第二访问子密钥对所述更新后的网络切片访问关系信息进行加密，得到所述终端的标识所对应的更新后的密文字段；
    所述第一网元将所述终端的标识以及所述更新后的密文字段关联存储到所述访问控制信息。
  10. 根据权利要求9所述的方法，其特征在于，所述第一网元将所述终端的标识以及所述更新后的密文字段关联存储到所述访问控制信息之前，所述方法还包括：
    所述第一网元将所述终端的标识和所述终端的标识所对应的密文字段从所述访问控制信息中删除。
  11. 根据权利要求7-10中任一项所述的方法，其特征在于，所述终端的标识所对应的签约信息包括：签约时间和签约双方的标识。
  12. 根据权利要求1-11中任一项所述的方法，其特征在于，所述终端对应的第一访问子密钥与所述终端在身份鉴权时的认证密钥相同。
  13. 根据权利要求1-12中任一项所述的方法，其特征在于，所述终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同。
  14. 一种网元，其特征在于，所述网元为第一网元，所述第一网元包括：
    第一接收模块，接收网络切片请求消息，其中，所述网络切片请求消息中携带有终端的标识和网络切片的标识；
    第一获取模块，用于根据所述终端的标识获取所述终端对应的第一访问子密钥，并获取核心网CN对应的第二访问子密钥；
    验证模块，用于根据所述第一访问子密钥和所述第二访问子密钥，验证所述终端是否有权访问所述网络切片。
  15. 根据权利要求14所述的第一网元，其特征在于，所述验证模块，包括：
    生成单元，用于根据所述第一访问子密钥和所述第二访问子密钥，生成完整性访问密钥；
    验证单元，用于根据所述完整性访问密钥验证所述终端是否有权访问所述网络切片。
  16. 根据权利要求15所述的第一网元，其特征在于，所述验证单元具体用于：
    根据所述完整性访问密钥对访问控制信息中所包含的与所述终端的标识对应的密文字段进行解密，得到解密后的网络切片访问关系信息，其中，所述解密后的网络切片访问关系信息中包括：解密后的终端标识、解密后的网络切片标识；
    判断所述解密后的终端标识和解密后的网络切片标识，是否与所述终端的标识和网络切片的标识相匹配；
    若所述解密后的终端标识和解密后的网络切片标识，与所述终端的标识和网络切片的标识相匹配，则确定所述终端有权访问所述网络切片；或者，若所述解密后的终端标识和解密后的网络切片标识，与所述终端的标识和网络切片的标识不匹配，则确定所述终端无权访问所述网络切片。
  17. 根据权利要求16所述的第一网元，其特征在于，若所述解密后的网络切片访问关系信息中还包括：解密后的终端标识所对应的签约信息，则所述验证单元还用于：
    确定所述解密后的终端标识所对应的签约信息属于有效信息。
  18. 根据权利要求17所述的第一网元，其特征在于，所述解密后的终端标识所对应的签约信息包括：签约时间和签约双方的标识。
  19. 根据权利要求14-18中任一项所述的第一网元，其特征在于，所述第一网元还包括：
    确定模块，用于确定访问控制信息中包含有与所述终端的标识对应的密文字段。
  20. 根据权利要求14-19中任一项所述的第一网元，其特征在于，所述第一网元还包括：
    第二获取模块，用于从第二网元获取所述终端的标识对应的网络切片访问关系信息，其中，所述网络切片访问关系信息中包括：所述终端的标识、所述网络切片的标识和所述终端的标识所对应的签约信息；
    第一加密模块，用于根据所述第一访问子密钥和所述第二访问子密钥对所述网络切片访问关系信息进行加密，得到所述终端的标识所对应的密文字段；
    第一存储模块，用于将所述终端的标识以及所述终端的标识所对应的密文字段关联存储到访问控制信息。
  21. 根据权利要求20所述的第一网元，其特征在于，所述加密模块包括：
    生成单元，用于根据所述第一访问子密钥和所述第二访问子密钥，生成完整性访问密钥；
    加密单元，用于根据所述完整性访问密钥对所述网络切片访问关系信息进行加密，得到所述终端的标识所对应的密文字段。
  22. 根据权利要求20或21所述的第一网元，其特征在于，所述第一网元还包括：
    第二接收模块，用于接收所述第二网元发送的更新后的网络切片访问关系信息，其中，所述更新后的网络切片访问关系信息中包括：所述终端的标识、所述网络切片的标识和所述终端的标识所对应的更新后的签约信息；
    第二加密模块，用于根据所述第一访问子密钥和所述第二访问子密钥对所述更新后的网络切片访问关系信息进行加密，得到所述终端的标识所对应的更新后的密文字段；
    第二存储模块，用于将所述终端的标识以及所述更新后的密文字段关联存储到所述访问控制信息。
  23. 根据权利要求22所述的第一网元，其特征在于，所述第一网元还包括：
    删除模块，用于将所述终端的标识和所述终端的标识所对应的密文字段从所述访问控制信息中删除。
  24. 根据权利要求20-23中任一项所述的第一网元，其特征在于，所述终端的标识所对应的签约信息包括：签约时间和签约双方的标识。
  25. 根据权利要求14-24中任一项所述的第一网元，其特征在于，所述终端对应的第一访问子密钥与所述终端在身份鉴权时的认证密钥相同。
  26. 根据权利要求14-25中任一项所述的第一网元，其特征在于，所述终端对应的第一访问子密钥与其它终端对应的访问子密钥不相同。
  27. 一种网元，其特征在于，所述网元为第一网元，所述第一网元包括：处理器和存储器；
    其中，所述存储器，用于存储程序指令；
    所述处理器，用于调用并执行所述存储器中存储的程序指令，当所述处理器执行所述存储器存储的程序指令时，所述第一网元用于执行如权利要求1至13中任一项所述的方法。
  28. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至13中任一项所述的方法。
PCT/CN2020/104856 2019-10-31 2020-07-27 网络切片的访问控制方法、装置及存储介质 WO2021082558A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911054670.0A CN112752265B (zh) 2019-10-31 2019-10-31 网络切片的访问控制方法、装置及存储介质
CN201911054670.0 2019-10-31

Publications (1)

Publication Number Publication Date
WO2021082558A1 true WO2021082558A1 (zh) 2021-05-06

Family

ID=75644686

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/104856 WO2021082558A1 (zh) 2019-10-31 2020-07-27 网络切片的访问控制方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN112752265B (zh)
WO (1) WO2021082558A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114760090B (zh) * 2022-02-25 2023-07-28 全球能源互联网研究院有限公司 一种电力5g网络切片的通信安全认证方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180007552A1 (en) * 2016-07-04 2018-01-04 Samsung Electronics Co., Ltd. Method and device for managing security according to service in wireless communication system
CN108463969A (zh) * 2016-01-14 2018-08-28 瑞典爱立信有限公司 建立与至少两个网络实例相关的密钥的方法、节点和通信设备
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107094127B (zh) * 2016-02-18 2020-02-28 电信科学技术研究院 安全信息的处理方法及装置、获取方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108463969A (zh) * 2016-01-14 2018-08-28 瑞典爱立信有限公司 建立与至少两个网络实例相关的密钥的方法、节点和通信设备
US20180007552A1 (en) * 2016-07-04 2018-01-04 Samsung Electronics Co., Ltd. Method and device for managing security according to service in wireless communication system
CN109104726A (zh) * 2017-06-20 2018-12-28 上海中兴软件有限责任公司 网络切片的认证方法及相应装置、系统和介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "EAP based slice-specific authentication procedure", 3GPP DRAFT; S3-193403-SLICE-SPECIFIC AUTHENTICATION, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. Chongqing, China; 20191014 - 20191018, 7 October 2019 (2019-10-07), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051796152 *
NEC: "pCR to TR 33.899: Proposal of solution for key issue of network slicing security", 3GPP DRAFT; S3-161265 SLICE SECURITY SEPARATION REVISION OF S3-160953, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. Chennai, India; 20160725 - 20160729, 29 July 2016 (2016-07-29), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051131099 *

Also Published As

Publication number Publication date
CN112752265B (zh) 2023-09-22
CN112752265A (zh) 2021-05-04

Similar Documents

Publication Publication Date Title
CN110971415B (zh) 一种天地一体化空间信息网络匿名接入认证方法及系统
US11974132B2 (en) Routing method, apparatus, and system
WO2018050081A1 (zh) 设备身份认证的方法、装置、电子设备及存储介质
US9077690B2 (en) Preservation of user data privacy in a network
US20180294949A1 (en) EMBEDDED UNIVERSAL INTEGRATED CIRCUIT CARD (eUICC) PROFILE CONTENT MANAGEMENT
WO2018076740A1 (zh) 数据传输方法及相关设备
JP5855127B2 (ja) 無線通信システムにおける短文データの暗号化方法及び装置
US20230283475A1 (en) Identity authentication system, method, apparatus, and device, and computer-readable storage medium
WO2019214351A1 (zh) 消息处理方法及装置
US11863977B2 (en) Key generation method, device, and system
CN112512045B (zh) 一种通信系统、方法及装置
WO2020020007A1 (zh) 网络接入方法、装置、终端、基站和可读存储介质
WO2021089035A1 (zh) 一种签约数据的管理方法、装置
US20190149326A1 (en) Key obtaining method and apparatus
WO2021082558A1 (zh) 网络切片的访问控制方法、装置及存储介质
CN109586899B (zh) 信令操作及其指示方法、装置及计算机存储介质
CN111835691B (zh) 一种认证信息处理方法、终端和网络设备
US11258871B2 (en) Message push method and terminal
CN111836260A (zh) 一种认证信息处理方法、终端和网络设备
KR101329789B1 (ko) 모바일 디바이스의 데이터베이스 암호화 방법
CN112637169B (zh) 一种无源nfc云锁加密方法
WO2021129012A1 (zh) 隐私信息传输方法、装置、计算机设备及计算机可读介质
CN114257424A (zh) 基于电力专用芯片的数据包接收处理方法及装置
US20240357360A1 (en) Communication method integrated with trusted measurement and apparatus
CN109905213A (zh) 数据安全传输方法及节点设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20880573

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20880573

Country of ref document: EP

Kind code of ref document: A1