WO2021087696A1 - 身份认证方法及通信装置 - Google Patents

身份认证方法及通信装置 Download PDF

Info

Publication number
WO2021087696A1
WO2021087696A1 PCT/CN2019/115441 CN2019115441W WO2021087696A1 WO 2021087696 A1 WO2021087696 A1 WO 2021087696A1 CN 2019115441 W CN2019115441 W CN 2019115441W WO 2021087696 A1 WO2021087696 A1 WO 2021087696A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
uas
authentication
network device
network
Prior art date
Application number
PCT/CN2019/115441
Other languages
English (en)
French (fr)
Inventor
雷中定
康鑫
王海光
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/115441 priority Critical patent/WO2021087696A1/zh
Priority to BR112022008022A priority patent/BR112022008022A2/pt
Priority to CN201980101723.1A priority patent/CN114600487B/zh
Priority to EP19951274.0A priority patent/EP4044644A4/en
Publication of WO2021087696A1 publication Critical patent/WO2021087696A1/zh
Priority to US17/736,750 priority patent/US20220272533A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices

Definitions

  • the present invention relates to the field of communication, in particular to an identity authentication method and communication device.
  • the unmanned aerial system is generally composed of two parts of equipment, namely the unmanned aerial vehicle (UAV) and the remote control of the drone (UAV controller).
  • the drone can fly autonomously or by receiving and following the instructions of the remote control.
  • data can also be transmitted between the drone and the remote control.
  • the drone can send photos and videos to the remote control through aerial photography (including data reception and storage functions).
  • the communication (control and data transmission) between the remote control and the UAV is usually carried out through a wireless signal (such as WiFi) point-to-point direct connection.
  • mobile communication networks have many commercial advantages: wide area coverage, high reliability, support for high-speed mobility, etc.
  • UAV systems can achieve high-reliability flights beyond the visual range.
  • the mobile communication network also provides more reliable supervision methods for the regulatory authorities to prevent incidents such as drones interfering with aircraft flight operations and launching terrorist attacks with drones, ensuring the safety of the drone system and the public Safety.
  • the UAV system is introduced into the mobile communication network, how to improve the security of the UAV system equipment access and use the mobile communication network is an urgent problem to be solved at present.
  • the embodiments of the present invention provide an identity authentication method and device, which can perform UAS authentication on equipment in an unmanned aerial vehicle system in a mobile communication network, which is beneficial to improve the security of the unmanned aerial system equipment accessing and using the mobile communication network.
  • an embodiment of the present application provides an identity authentication method.
  • the method includes: a first network device receives a first request sent by a first terminal device, the first request carries first authentication indication information, and the first authentication
  • the instruction information is used to request UAS certification for the first terminal device, which is a device in the UAS; the first network device sends a second request to the first terminal device, and the second request is used to request Obtain the UAS ID of the first terminal device;
  • the first network device receives the UAS ID of the first terminal device sent by the first terminal device, and sends the UAS ID of the first terminal device to the second network device;
  • the second network device is based on the UAS ID UAS authentication is performed on the first terminal device;
  • the second network device sends the UAS authentication result of the first terminal device to the first network device; the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first terminal device can be authenticated based on the UAS identifier of the first terminal device. Since the UAS logo of the first terminal device is the logo configured by the equipment manufacturer for the first terminal device, or the UAS logo of the first terminal device is a UAS service provider/vertical industry is a UAS system user using a UAS system or UAS unmanned The UAV system user/UAS service identification provided by the drone system service/UAS business. Therefore, based on the method described in the first aspect, it is possible to prevent terminal devices produced by equipment manufacturers that have not contracted with operators from using mobile communication networks, or to prevent UAV systems from service providers or vertical industries that have not contracted with operators.
  • the user/unmanned aerial vehicle system service/unmanned aerial vehicle system business uses drones (or remote controllers) to access the mobile communication network, which improves the security of the mobile communication network.
  • the first authentication indication information is registration type information, or UAS type information of the first terminal device
  • the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
  • the first network device may also determine whether to perform UAS authentication on the first terminal device; the first network device is specifically determining whether to perform UAS authentication on the first terminal device.
  • the second request is sent to the first terminal device. Based on this possible implementation, terminal devices that do not meet UAS certification requirements can be screened out first, and UAS certification is only performed on terminal devices that meet UAS certification requirements, which is beneficial to reducing the authentication workload of the second network device.
  • the specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device UAS certification. For example, when the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is not yet authenticated, the first network device determines to perform UAS authentication on the first terminal device. When the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is an authentication success or an authentication failure state, it is determined not to perform UAS authentication on the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device determines whether to The specific implementation manner for the first terminal device to perform UAS authentication is: the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
  • the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
  • the UAS type information corresponding to the SUPI or GPSI of the first terminal device can be understood as the UAS type supported by the core card in the first terminal device.
  • the first network device determines that the UAS type information received by the first network device does not match the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it indicates that the core card (such as the SIM card) in the first terminal device is wrong Used locally or stolen on the first terminal device. Therefore, if the first network device determines that the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, the subsequent UAS authentication process may not be continued. In this way, it can be avoided that the mobile communication network can be used when the first terminal device incorrectly uses the core card or uses the stolen core card.
  • the core card such as the SIM card
  • the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
  • the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
  • the UAS type information corresponding to SUPI or GPSI can be understood as UAS type information that the core card corresponding to SUPI or GPSI does not support.
  • the second network device determines whether to perform UAS authentication on the first terminal device; the second network device performs UAS authentication on the first terminal device.
  • the specific implementation manner is: when the second network device determines to perform UAS authentication on the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the first network device and the second network device.
  • the specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device UAS certification.
  • the specific implementation and beneficial effects of this possible implementation can be found in the specific implementation and beneficial effects that the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device. Go into details.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device may also Send the UAS type information of the first terminal device to the second network device; the specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the terminal device performs UAS authentication.
  • the specific implementation manner and beneficial effects of this possible implementation manner can participate in the foregoing specific implementation manner and beneficial effects of the first network device determining whether to perform UAS authentication on the first terminal device based on the UAS type information, which will not be repeated here.
  • the second request is also used to request to obtain UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
  • the first network device can also receive the UAS type information of the first terminal device sent by the first terminal device, and the first network device sends the information of the first terminal device to the second network device.
  • UAS type information; a specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the specific implementation manner and beneficial effects of this possible implementation manner can participate in the foregoing specific implementation manner and beneficial effects of the first network device determining whether to perform UAS authentication on the first terminal device based on the UAS type information, which will not be repeated here.
  • the first request also carries the SUCI or GUTI of the first terminal device.
  • the first network device can also send the SUPI or GPSI of the first terminal device to the second network device. Or GPSI is obtained based on the SUCI or GUTI of the first terminal device; the second network device determines whether to perform UAS authentication on the first terminal device: the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier and the SUPI or GPSI of the first terminal device Whether to perform UAS authentication on the first terminal device. Based on this possible implementation manner, it is possible to prevent the core card of the first terminal device from being randomly replaced.
  • the first network device and the second network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result. In this way, the UAS authentication status of the first terminal device can be found later.
  • the method further includes the following steps: the second network device determines the UAS identifier of the second terminal device associated with the first terminal device; The second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device; the second network device sends the UAS authentication result of the second terminal device to the first network device; the first network device sends the UAS authentication result of the second terminal device to the first terminal device.
  • the UAS authentication result or association indication information of the second terminal device the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal
  • the UAS authentication result of the device is obtained; the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device, or sends the UAS authentication result of the second terminal device and the association indication information. Based on this
  • the second network device determines whether to allow UAS authentication for the first terminal device and the second terminal device. If UAS authentication is allowed for the first terminal device and the second terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device, and performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device The device is UAS certified.
  • the second network device sends instruction information to the first network device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate ,
  • the first network device sends the instruction information to the first terminal device and the second terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the second network device may specifically determine whether to allow UAS authentication for the first terminal device and the second terminal device based on the location and distance between the first terminal device and the second terminal device.
  • the distance between the first terminal device and the second terminal device may be used as a restriction condition, so that the first terminal device that does not meet the distance restriction condition is rejected for pairing use with the second terminal device. Therefore, there is no need to authenticate the association relationship between the first terminal device and the second terminal device. Based on this possible implementation manner, it is beneficial to enhance security and reduce the authentication workload of the second network device.
  • the method further includes the following steps: the second network device determines the UAS identity or the UAS identity of the second terminal device associated with the first terminal device. SUPI or GPSI; the second network device sends the UAS identity or SUPI or GPSI of the second terminal device associated with the first terminal device to the first network device; the first network device receives the UAS identity or SUPI or GPSI of the second terminal device After that, send the UAS identification of the second terminal device to the second network device; the second network device performs UAS authentication on the second terminal device based on the UAS identification of the second terminal device; the second network device sends the second terminal to the first network device The UAS authentication result of the device; after receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the second terminal device or the association indication information to the first terminal device, and the association indication information is used to indicate the first terminal The association result between the device and the second terminal device, the association indication information
  • the first network device determines whether to perform UAS authentication on the second terminal device. If so, the first network device sends the UAS identifier of the second terminal device to the second network device.
  • the first network device sends instruction information to the first terminal device, and the instruction information indicates that the first terminal device and the second terminal device have failed to associate. For example, the first network device may determine whether to perform UAS authentication on the second terminal device based on whether the second terminal device is powered on. For another example, the first network device may determine whether to perform UAS authentication on the second terminal device based on the location and distance between the first terminal device and the second terminal device.
  • the first request also carries new association indication information.
  • a specific implementation manner for the first network device to send the UAS identification of the first terminal device to the second network device is as follows: the first network device sends the UAS identification of the first terminal device and the new association indication information to the second network device.
  • the method further includes the following step: the second network device sends to the first network device a message for acquiring the first association information of the first terminal device Request; the first network device sends to the first terminal device a request for obtaining the first associated information of the first terminal device; the first network device receives the first associated information of the first terminal device sent by the first terminal device; first The network device sends the first association information of the first terminal device to the second network device; the second network device determines that the first association information matches the second association information.
  • the specific implementation manner for the second network device to send the UAS authentication result of the first terminal device to the first network device is: the second network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first network device.
  • UAS identification or SUPI or GPSI after the first network device receives the UAS authentication result of the first terminal device and the UAS identification or SUPI or GPSI of the second terminal device, the first network device also sends the second terminal device's UAS authentication result or association indication information, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device get.
  • the first network device may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device. Based on this possible implementation manner, UAS authentication can be performed on the first terminal device and the second terminal device, and the newly-added association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
  • the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the second network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be added, then the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the first terminal device. Information indicating that the association failed. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the second network device may also store the association relationship between the first terminal device and the second terminal device.
  • the second network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the first request also carries new association indication information for requesting a new association relationship.
  • the first network device may also perform the following steps: A terminal device sends a request for acquiring the first associated information of the first terminal device; the first network device receives the first associated information sent by the first terminal device; the first network device determines that the first associated information is sent by the second terminal device The second association information matches; the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device, and the association indication information is used to indicate the association result between the first terminal device and the second terminal device.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • UAS authentication can be performed on the first terminal device and the second terminal device, and the newly-added association relationship between the first terminal device and the second terminal
  • the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the first network device may also send the association relationship to the second network device for storage.
  • the method further includes the following steps:
  • the first network device receives the first association request sent by the first terminal device, where the first association request is used to request a new association relationship; the first network device sends the first association request to the second network device; the second network device sends the The first network device sends a first acquisition request; the first network device sends a first acquisition request to the first terminal device; the first network device receives the first association information sent by the first terminal device; the first network device sends the second network device Send the first association information; the first network device receives the second association request sent by the second terminal device, the second association request is used to request a new association relationship; the first network device sends the second association request to the second network device The second network device sends a second acquisition request to the first network device; the first network device sends a second acquisition request to the second terminal device; the first network device receives the second association information sent by the second terminal device; the first network The device sends second association information to the second network device; the second network device determines that the first association information matches the second association information; the second network device sends the
  • the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. After receiving the second association request, the second network device may also determine whether to allow a new association relationship for the second terminal device. If it is determined that it is allowed to add an association relationship for the second terminal device, the second association request is sent to the first network device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the second network device may store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the method further includes the following steps: the first network device receives a first association request from the first terminal device, and the first association request is used to request a connection with the first terminal device.
  • the second terminal device adds an association relationship; the first network device sends the first association request to the second network device; the second network device sends the first association request to the first network device; the first network device sends to the second terminal device The first association request; the first network device receives the association confirmation instruction information sent by the second terminal device; the first network device sends the association confirmation instruction information to the second network device; the second network device sends the association success to the first network device Indication information; the first network device sends the association success indication information to the first terminal device and the second terminal device. Based on this possible implementation manner, the newly-added association relationship between the first terminal device and the second terminal device can be authenticated.
  • the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. Optionally, otherwise, sending indication information for indicating failure of the newly-added association to the first network device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the second network device may store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device.
  • UAS ID sent in response to the second request.
  • the first network device after receiving the first request carrying the first authentication indication information and the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. Based on this possible implementation manner, through one information exchange, the first network device can obtain the first authentication indication information and the UAS identifier of the first terminal device, which facilitates faster UAS authentication of the first terminal device.
  • an embodiment of the present application provides an identity authentication method.
  • the method includes: a first network device receives a first request sent by a first terminal device, the first request carries first authentication indication information, and the first authentication
  • the instruction information is used to request UAS certification for the first terminal device, which is a device in the UAS; the first network device sends a second request to the first terminal device, and the second request is used to request Obtain the UAS ID of the first terminal device;
  • the first network device receives the UAS ID of the first terminal device sent by the first terminal device;
  • the first network device sends the UAS ID of the first terminal device to the second network device;
  • the first network device Receiving the UAS authentication result of the first terminal device sent by the second network device; the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first authentication indication information is registration type information, or UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
  • the first network device may also determine whether to perform UAS authentication on the first terminal device; the first network device sends the first terminal device to the first terminal device.
  • the specific implementation for sending the second request is: when the first network device determines to perform UAS authentication on the first terminal device, the first network device sends the second request to the first terminal device.
  • a specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device. UAS certification.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device determines whether A specific implementation manner of performing UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device may also send The second network device sends the UAS type information of the first terminal device.
  • the second request is also used to request to obtain UAS type information of the first terminal device, where the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
  • the first network device can also receive the UAS type information of the first terminal device sent by the first terminal device; the first network device can also send the first terminal device to the second network device UAS type information of the device.
  • the first network device updates the UAS authentication status of the first terminal device based on the UAS authentication result.
  • the method further includes the following steps: the first network device receives the second network device associated with the first terminal device sent by the second network device.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device As a result, or send the UAS authentication result and association indication information of the second terminal device.
  • UAS authentication can be performed on the first terminal device and the second terminal device, and the stored association relationship between the first terminal device and the second terminal device can be authenticated or authorized, avoiding any two
  • the pairing of devices is helpful to improve the security of the mobile communication network.
  • the method further includes the following step: the first network device receives the second terminal device's UAS ID sent by the second network device UAS ID or SUPI or GPSI; send the UAS ID of the second terminal device to the second network device; after receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the second terminal device to the first terminal device Or association indication information, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; A network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information to the second terminal device.
  • the first network device determines whether to perform UAS authentication on the second terminal device. If so, the first network device sends the UAS identifier of the second terminal device to the second network device.
  • the first network device sends instruction information to the first terminal device, and the instruction information indicates that the first terminal device and the second terminal device have failed to associate. For example, the first network device may determine whether to perform UAS authentication on the second terminal device based on whether the second terminal device is powered on. For another example, the first network device may determine whether to perform UAS authentication on the second terminal device based on the location and distance between the first terminal device and the second terminal device.
  • the first request also carries new association indication information.
  • a specific implementation manner for the first network device to send the UAS identification of the first terminal device to the second network device is as follows: the first network device sends the UAS identification of the first terminal device and the new association indication information to the second network device. After the first network device sends the UAS identifier of the first terminal device and the new association indication information to the second network device, the method further includes the following steps: the first network device sends to the first terminal device the information used to obtain the first terminal device A request for the first association information; the first network device receives the first association information of the first terminal device sent by the first terminal device; the first network device sends the first association information of the first terminal device to the second network device.
  • the specific implementation manner for the first network device to receive the UAS authentication result of the first terminal device sent by the second network device is as follows: the first network device receives the UAS authentication result of the first terminal device and the second terminal sent by the second network device The UAS ID or SUPI or GPSI of the device; after the first network device receives the UAS authentication result of the first terminal device and the UAS ID or SUPI or GPSI of the second terminal device, the first network device also sends the second terminal to the first terminal device
  • the UAS authentication result or association indication information of the device the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the UAS of the second terminal device
  • the certification result is obtained.
  • the first network device may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the first request also carries new association indication information for requesting a new association relationship.
  • the first network device may also perform the following steps: A terminal device sends a request for acquiring the first associated information of the first terminal device; the first network device receives the first associated information sent by the first terminal device; the first network device determines that the first associated information is sent by the second terminal device The second association information matches; the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device, and the association indication information is used to indicate the association result between the first terminal device and the second terminal device.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the first network device may also send the association relationship to the second network device for storage.
  • the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device.
  • UAS ID sent in response to the second request.
  • the first network device after receiving the first request carrying the first authentication indication information and the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. Based on this possible implementation manner, through one information exchange, the first network device can obtain the first authentication indication information and the UAS identifier of the first terminal device, which facilitates faster UAS authentication of the first terminal device.
  • the beneficial effects of the second aspect and the possible implementation manners of the second aspect can be referred to the beneficial effects of the foregoing first aspect and the possible implementation manners of the first aspect, which are not repeated here.
  • an embodiment of the present application provides an identity authentication method.
  • the method includes: a first terminal device sends a first request to a first network device, the first request carries first authentication indication information, and the first authentication indication information is used for To request UAS authentication for the first terminal device; the first terminal device receives the second request sent by the first network device, the second request is used to request the UAS identification of the first terminal device; the first terminal device responds to the second request , Sending the UAS identifier of the first terminal device to the first network device; the first terminal device receives the UAS authentication result of the first terminal device sent by the first network device.
  • the first authentication indication information is registration type information, or UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS .
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
  • the second request is also used to request to obtain the UAS type information of the first terminal device, and the first terminal device may also send the UAS type information of the first terminal device to the first network device.
  • the first terminal device may also receive the UAS authentication result of the second terminal device associated with the first terminal device; the first terminal device is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
  • the UAS authentication result determines the association result between the first terminal device and the second terminal device.
  • the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device.
  • the UAS authentication result of the device is obtained.
  • the first request also carries new association indication information.
  • the first terminal device can also receive the UAS authentication result of the second terminal device; the first terminal device determines the association between the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device result.
  • the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS authentication result of the device is obtained.
  • the first terminal device receives a request sent by the first network device to obtain the first association information of the first terminal device; the first terminal device sends the first terminal device's first associated information to the first network device.
  • One association information the first terminal device can also receive the UAS authentication result of the second terminal device; the first terminal device determines the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device The association result of the terminal device.
  • the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS authentication result of the device is obtained.
  • the first terminal device after the first terminal device passes UAS authentication, the first terminal device sends a first association request to the first network device, and the first association request is used to request a new association relationship; the first terminal device Receive the first acquisition request sent by the first network device; the first terminal device sends the first association information to the first network device; the first terminal device receives the association success indication information, the association success indication information is used to instruct the first terminal device to communicate with The second terminal device is successfully associated.
  • the first terminal device after passing the UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship with the second terminal device; the first terminal The device receives the indication of successful association.
  • the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device. UAS ID sent in response to the second request.
  • the beneficial effects of the third aspect and the possible implementation manners of the third aspect can be referred to the beneficial effects of the foregoing first aspect and the possible implementation manners of the first aspect, which will not be repeated here.
  • a communication device in a fourth aspect, may be a network device, or a device in a network device, or a device that can be used in conjunction with a network device. Wherein, the communication device may also be a chip system.
  • the communication device can perform the method described in the second aspect.
  • the function of the communication device can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • the unit can be software and/or hardware.
  • a communication device may be a terminal device, or a device in a terminal device, or a device that can be matched and used with a terminal device.
  • the communication device may also be a chip system.
  • the communication device can perform the method described in the third aspect.
  • the function of the communication device can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • the unit can be software and/or hardware.
  • the communication device may be a network device, a device in a network device, or a device that can be matched and used with the network device. Or it can be a chip in a network device.
  • the communication device includes a communication interface and a processor, and the communication interface is used for communication between the device and other devices, such as sending and receiving data or signals.
  • the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, and other devices may be terminal devices or network devices.
  • the processor is used to call a set of programs, instructions or data to execute the method described in the second aspect above.
  • the device may also include a memory for storing programs, instructions or data called by the processor. The memory is coupled with the processor, and when the processor executes instructions or data stored in the memory, the method described in the second aspect can be implemented.
  • an embodiment of the present application provides a communication device.
  • the communication device may be a terminal device, or a device in a terminal device, or a device that can be matched and used with the terminal device. Or it can be a chip in a terminal device.
  • the communication device includes a communication interface and a processor, and the communication interface is used for communication between the device and other devices, such as sending and receiving data or signals.
  • the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, and other devices may be network devices.
  • the processor is used to call a set of programs, instructions or data to execute the method described in the third aspect.
  • the device may also include a memory for storing programs, instructions or data called by the processor. The memory is coupled with the processor, and when the processor executes instructions or data stored in the memory, the method described in the third aspect can be implemented.
  • an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, configured to implement the method described in the second or third aspect.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store instructions, and when the instructions are executed, the method described in the first aspect or the third aspect is achieve.
  • embodiments of the present application provide a computer program product including instructions, which when executed, enable the method described in the first aspect or the third aspect to be implemented.
  • FIG. 1 is a schematic diagram of a 5G system architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a UAV system based on a mobile communication network provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 15 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 16 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 17 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 18 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 21a is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 21b is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA broadband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE Time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • the network architecture shown in Fig. 1 is based on the 5G network architecture based on the service-oriented architecture defined in the 3GPP standardization process as an example.
  • the network architecture may include three parts, namely a terminal device part, an operator network, and a data network (DN).
  • the terminal equipment part includes terminal equipment 110, which may also be referred to as user equipment (UE).
  • the terminal device 110 in the embodiment of the present application is a device with a wireless transceiver function, which can be connected to one or more core networks (CN) via the access network device in the access network (AN) 140 To communicate.
  • the terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless network device, a user agent, or a user device.
  • the terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air (such as a plane, a balloon, a satellite, etc.).
  • the terminal device 110 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, or a wireless local loop (WLL).
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDAs personal digital assistants
  • PDAs personal digital assistants
  • vehicle-mounted devices wearable devices, drones, or the Internet of Things
  • car Terminals in networking fifth generation (5G) networks, and terminals of any form in future networks, relay user equipment, or future evolution of public land mobile network (PLMN) A terminal, etc.
  • PLMN public land mobile network
  • the relay user equipment may be, for example, a 5G residential gateway (RG).
  • RG 5G residential gateway
  • the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving (self-driving), and a remote Wireless terminals in medical (remote medical), wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, and smart homes Wireless terminal and so on.
  • VR virtual reality
  • AR augmented reality
  • WLAN remote Wireless terminals in medical
  • the part of various communication systems operated by operators can be referred to as operator networks.
  • the operator’s network can also be called the public land mobile network (PLMN) network. It is a network established and operated by the government or an operator approved by it to provide land mobile communication services to the public, mainly mobile A mobile network operator (MNO) is a public network that provides users with mobile broadband access services.
  • the operator network or PLMN network described in the embodiments of this application may specifically be a network that meets the requirements of the 3rd generation partnership project (3rd generation partnership project, 3GPP) standard, referred to as the 3GPP network.
  • 3rd generation partnership project 3rd generation partnership project
  • 3GPP networks are operated by operators, including but not limited to fifth-generation mobile communication (5th-generation, 5G) networks (referred to as 5G networks), and fourth-generation mobile communication (4th-generation, 4G) networks (referred to as 4G networks) , Third-generation mobile communication technology (3rd-generation, 3G) network (referred to as 3G network) and second-generation wireless telephone technology (2nd-generation wireless telephone technology, 2G) network (referred to as 2G network), etc.
  • 5G networks fifth-generation mobile communication
  • 4G networks fourth-generation mobile communication (4th-generation, 4G) networks
  • 3G network Third-generation mobile communication technology
  • 2G network second-generation wireless telephone technology
  • an operator network ie, an MNO network
  • the operator network can include network exposure function (NEF) 131, network storage function (network function repository function, NRF) 132, policy control function (PCF) 133, unified data management (unified data management, UDM) network element 134, application function (AF) 135, authentication server function (authentication server function, AUSF) 136, access and mobility management function (AMF) 137, session management function ( session management function (SMF) 138, user plane function (UPF) 139, (radio) access network ((radio) access network, (R) AN) 140, etc.
  • the part other than the (wireless) access network 140 part may be referred to as a core network (core network, CN) part or a core network part.
  • core network core network
  • CN core network
  • the data network DN 120 may also be referred to as a packet data network (PDN), and is usually a network outside the operator's network, such as a third-party network.
  • the operator network can access multiple data network DN 120, and multiple services can be deployed on the data network DN 120, which can provide services such as data and/or voice for the terminal device 110.
  • the data network DN 120 may be a private network of a smart factory, the sensors installed in the workshop of the smart factory may be terminal devices 110, and the data network DN 120 may have a sensor control server deployed, and the control server may provide services for the sensors.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • the data network DN 120 may be the internal office network of a company.
  • the mobile phone or computer of the company's employee can be the terminal device 110, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.
  • the terminal device 110 may establish a connection with the operator's network through an interface (such as N1, etc.) provided by the operator's network, and use services such as data and/or voice provided by the operator's network.
  • the terminal device 110 may also access the data network DN 120 through the operator network, and use the operator services deployed on the data network DN 120, and/or services provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and the terminal device 110, and may provide other data and/or voice services for the terminal device 110.
  • the specific form of expression of the above-mentioned third party can be determined according to actual application scenarios, and is not limited here.
  • the access network RAN 140 is a sub-network of the operator's network, and is an implementation system between the service node and the terminal device 110 in the operator's network. To access the operator's network, the terminal device 110 first passes through the RAN 140, and then can connect to the service node of the operator's network through the RAN 140.
  • the access network equipment (RAN equipment) in the embodiments of the present application is a type of equipment that provides wireless communication functions for the terminal equipment 110, and may also be referred to as a network equipment.
  • the RAN equipment includes but is not limited to: the next generation base station in the 5G system Node (next generation node basestation, gNB), evolved node B (evolved node B, eNB) in long term evolution (LTE), radio network controller (RNC), node B (node B) , NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseband unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), small cell equipment (pico), mobile switching center, or network equipment in the future network, etc.
  • next generation base station in the 5G system Node
  • gNB next generation node basestation
  • eNB evolved node B
  • LTE long term evolution
  • RNC radio network controller
  • node B node B
  • BSC base station controller
  • BTS base transcei
  • access network devices In systems using different wireless access technologies, the names of devices with access network device functions may be different. For the convenience of description, in all the embodiments of the present application, the above-mentioned devices that provide wireless communication functions for the terminal device 110 are collectively referred to as access network devices.
  • Access and mobility management function AMF also known as AMF network function or AMF network function entity
  • AMF network function or AMF network function entity is a control plane network function provided by the operator's network, responsible for the access control and mobility of terminal equipment 110 accessing the operator's network Sexual management, for example, includes functions such as mobile status management, assigning user temporary identities, and authenticating and authorizing users.
  • the session management function SMF (also referred to as SMF network function or SMF network function entity) 138 is a control plane network function provided by the operator network, and is responsible for managing the protocol data unit (PDU) session of the terminal device 110.
  • the PDU session is a channel used to transmit PDUs, and the terminal device needs to transmit PDUs to each other through the PDU session and the data network DN 120.
  • the SMF network function 138 is responsible for establishing, maintaining, and deleting PDU sessions.
  • the SMF network function 138 includes session management (such as session establishment, modification, and release, including the maintenance of the tunnel between the user plane function UPF 139 and the access network AN 140), the selection and control of the UPF network function 139, service and session continuity ( service and session continuity (SSC) mode selection, roaming and other session-related functions.
  • session management such as session establishment, modification, and release, including the maintenance of the tunnel between the user plane function UPF 139 and the access network AN 140
  • SSC service and session continuity
  • the user plane function UPF (also referred to as UPF network function or UPF network function entity) 139 is a gateway provided by the operator, and is a gateway for communication between the operator's network and the data network DN 120.
  • the UPF network function 139 includes user plane-related functions such as data packet routing and transmission, packet inspection, service usage reporting, quality of service (QoS) processing, lawful monitoring, upstream packet inspection, and downstream packet storage.
  • QoS quality of service
  • the unified data management network element UDM also known as UDM network function or UDM network function entity
  • UDM network function entity is a control plane function provided by the operator, and is responsible for storing the subscriber permanent identifier (SUPI) of subscribers in the operator’s network. ), credential, security context, contract data and other information. Among them, SUPI will be encrypted first during transmission, and the encrypted SUPI is called a subscription concealed identifier (SUCI).
  • the information stored in the UDM network function 134 can be used for authentication and authorization of the terminal device 110 accessing the operator's network.
  • the contracted users of the above-mentioned operator's network may specifically be users who use the services provided by the operator's network, such as users who use China Telecom's mobile phone core card, or users who use China Mobile's mobile phone core card.
  • the permanent contract identifier SUPI of the aforementioned subscriber may be the number of the mobile phone core card, etc.
  • the credential and security context of the aforementioned subscriber may be a small file stored such as the encryption key of the mobile phone core card or information related to the encryption of the mobile phone core card for authentication and/or authorization.
  • the aforementioned security context may be data (cookie) or token (token) stored on the user's local terminal (for example, mobile phone).
  • the contract data of the aforementioned subscriber may be the supporting service of the mobile phone core card, such as the data package of the mobile phone core card or the use of the network.
  • permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to information related to authentication and authorization.
  • no distinction or restriction is made for the convenience of description. If no special instructions are given, the embodiments of the present application will be described using a security context as an example, but the embodiments of the present application are also applicable to authentication and/or authorization information in other expression modes.
  • Authentication server function AUSF also called AUSF network function or AUSF network function entity
  • AUSF network function 136 is a control plane function provided by the operator, usually used for level 1 authentication, that is, between the terminal device 110 (subscribed user) and the operator's network Certification.
  • the AUSF network function 136 After the AUSF network function 136 receives the authentication request initiated by the subscriber, it can authenticate and/or authorize the subscriber through the authentication information and/or authorization information stored in the UDM network function 134, or generate the subscriber’s information through the UDM network function 134. Authentication and/or authorization information.
  • the AUSF network function 136 can feed back authentication information and/or authorization information to the subscriber.
  • the network open function NEF (also called NEF network function or NEF network function entity) 131 is a control plane function provided by the operator.
  • the NEF network function 131 opens the external interface of the operator's network to a third party in a secure manner.
  • the SMF network function 138 needs to communicate with a third-party network function
  • the NEF network function 131 can serve as a relay for the SMF network function 138 to communicate with a third-party network entity.
  • the NEF network function 131 is used as a relay, it can be used as the translation of the identification information of the subscriber and the translation of the identification information of the third-party network function.
  • the NEF network function 131 when the NEF network function 131 sends the SUPI of the subscriber from the operator network to the third party, it can translate the SUPI into its corresponding external identity (identity, ID). Conversely, when the NEF network function 131 sends the external ID (third party's network entity ID) to the operator's network, it can be translated into SUPI.
  • ID identity
  • the NEF network function 131 sends the external ID (third party's network entity ID) to the operator's network, it can be translated into SUPI.
  • the policy control function PCF (also referred to as a PCF network function or a PCF network function entity) 133 is a control plane function provided by an operator, and is used to provide the SMF network function 138 with a policy for a PDU session.
  • Policies can include charging-related policies, QoS-related policies, and authorization-related policies.
  • the network slice selection function (NSSF) (not shown in the figure) is responsible for determining the network slice instance, selecting the AMF network function 137, and so on.
  • Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
  • the meaning of these interface serial numbers can be referred to the meaning defined in the 3GPP standard protocol, which is not limited here.
  • the terminal device 110 is used as an example for the UE.
  • the name of the interface between the various network functions in FIG. 1 is only an example. In a specific implementation, the name of the interface of the system architecture It may also be other names, which are not specifically limited in the embodiments of the present application.
  • the mobility management network function in the embodiment of the present application may be the AMF network function 137 shown in FIG. 1, or may be other network functions having the aforementioned AMF network function 137 in the future communication system.
  • the mobility management network function in this application may also be a mobility management entity (MME) in long term evolution (LTE), etc.
  • MME mobility management entity
  • the mobility management network function is the AMF network function 137 as an example for description.
  • the AMF network function 137 is referred to as AMF for short, and the terminal device 110 is referred to as the UE. That is, the AMF described later in the embodiments of the present application can be replaced with a mobility management network function, and the UE can be replaced with a terminal device.
  • the network architecture shown in Figure 1 (such as the 5G network architecture) adopts a service-based architecture and common interfaces.
  • the traditional network element functions are split into several self-contained and self-managed based on network function virtualization (NFV) technology.
  • NFV network function virtualization
  • Reusable network function service module by flexibly defining the service module collection, customized network function reconstruction can be realized, and the business process can be formed through a unified service call interface externally.
  • the schematic diagram of the network architecture shown in FIG. 1 can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario. For roaming scenarios, the embodiments of this application are also applicable.
  • mobile communication networks have many commercial advantages: wide area coverage, high reliability, support for high-speed mobility, etc. Through the use of network connections, UAV systems can achieve high-reliability flights beyond the visual range.
  • the mobile communication network also provides more reliable supervision methods for the regulatory authorities to prevent incidents such as drones interfering with aircraft flight operations and launching terrorist attacks with drones, ensuring the safety of the drone system and the public Safety.
  • the terminal equipment of the UAV system using the mobile communication network needs to be authenticated, or the UAV system users using the terminal equipment need to be authenticated, or An unmanned aerial system service/unmanned aerial system business that uses terminal equipment is required to be certified. After the certification is passed, the terminal device or UAV system user or the UAV system service/UAS business can use the mobile communication network.
  • the core network equipment in the mobile communication network authenticates the terminal equipment based on the terminal identification (such as SUPI) pre-configured by the PLMN and the corresponding credential.
  • the terminal identification pre-configured in the PLMN corresponds to a core card (such as a SIM card, or a Subscriber Identification Module card, also called a subscriber identification module/card) in a one-to-one correspondence.
  • a core card such as a SIM card, or a Subscriber Identification Module card, also called a subscriber identification module/card
  • the same SIM card is configured in any terminal device, and the authentication result is the same in the same situation. That is, the terminal identification pre-configured by the PLMN and the corresponding credential have no direct relationship with the terminal device itself.
  • the terminal device 1 can pass the identity authentication based on the terminal identification (such as SUPI) corresponding to the SIM card.
  • the SIM card is configured in the terminal device 2, and the terminal device 2 can also pass the identity authentication based on the terminal identification (such as SUPI) corresponding to the SIM card. Therefore, terminal equipment is authenticated through the existing equipment authentication process, and drones or remote control terminal equipment produced by equipment manufacturers that have not contracted with operators can also be connected to the mobile communication network, which has an impact on the security of the mobile communication network. The impact.
  • the embodiments of the present application provide an identity authentication method and device, which can perform identity authentication on the terminal device based on the UAS identity of the terminal device (drone or remote control).
  • the UAS identity of the terminal device can be 1) Equipment manufacturer The identity assigned to the equipment itself; 2) UAS service providers/vertical industry provides UAS users/UAS users who use UAS systems or UAS services/UAS businesses System service/unmanned aerial vehicle system business identification; 3) other identifications related to unmanned aerial vehicle system different from SIM card.
  • the UAS identification of the terminal device, or the user identification of the UAS system, or the service/service identification, etc. are user identifications that are different from the SIM card identification.
  • the identification of the terminal device based on the UAS identification of the terminal device can prevent the drone (or remote control) produced by the equipment manufacturer that has not contracted with the operator from accessing the mobile communication network, or can prevent the operator from not signing the contract with the operator Of service providers or UAV system users/UAV system services/UAV system businesses in vertical industries use UAVs (or remote controls) to access mobile communication networks, which improves the security of mobile communication networks.
  • the identity authentication of the terminal equipment based on the UAS identification of the terminal equipment can also enable the UAV equipment manufacturer/UAS system service provider/vertical industry to access the UAS equipment produced/serviced/owned by it. Access to the mobile communication network has certain control and management rights.
  • identification described in the present invention is not limited to being issued by entities such as equipment manufacturers, service providers, and vertical industries, and may also be any other entity.
  • the following description only takes the identification issued by the equipment manufacturer for the device as an example.
  • the embodiments of the present application are also applicable.
  • FIG. 2 is a system architecture of an unmanned aerial vehicle system based on a mobile communication network provided by an embodiment of the present application.
  • the system architecture includes an unmanned aerial vehicle, an unmanned aerial vehicle remote control, a radio access network (RAN), a core network (CN), and a second network device.
  • the core network includes the first network device.
  • the second network device may be located in the core network or outside the core network.
  • the mobile communication network may be the network of the above-mentioned communication system, such as: global system of mobile communication (GSM) system, code division multiple access (CDMA) system, broadband code division Multiple access (wideband code division multiple access, WCDMA) system, general packet radio service (general packet radio service, GPRS), long term evolution (LTE) system, LTE frequency division duplex (frequency division duplex) , FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) system or mobile communication network in new radio (NR) and future communication systems.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA broadband code division Multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • LTE frequency division duplex frequency division duplex
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • UMTS universal mobile telecommunication system
  • RAN1 and RAN2 provide services for remote controllers and drones respectively. If the remote control and the drone are covered by the same RAN, the two RANs can also refer to the same RAN. Similarly, CN1 and CN2 provide services to RAN1 and RAN2 respectively. If the RAN (RAN1 and RAN2 can be the same or different) accessed by the drone and the remote control are served by the same CN, then these two core networks can also refer to Generation of the same core network. Two first network devices may refer to the same first network device. In the system shown in Figure 2, the drone remote control controls the drone through the network, and communicates and interacts with the drone.
  • the command from the remote controller is sent to the drone via RAN1, CN1, CN2, and RAN2.
  • the mobile communication system is a 5G communication system
  • the Unmanned Aerial Vehicle (UAV) and the drone remote control in the Unmanned Aerial System (UAS) respectively correspond to the two different UEs 110 in FIG. 1.
  • the RAN here corresponds to the two access networks AN140 in Figure 1 respectively.
  • unmanned aerial vehicles can also be called unmanned aerial vehicles or aerial vehicles.
  • the drone remote control may be a device specially produced for remotely controlling drones, or it may be any of the aforementioned terminal devices 110 such as a smart phone or a wearable device.
  • the first network device may be an access and mobility management function (AMF) or a security anchor function (SEAF) or other core network devices.
  • AMF access and mobility management function
  • SEAF security anchor function
  • AMF For the description of AMF, please refer to the above description of AMF in Figure 1, which will not be repeated here.
  • SEAF The authentication function that interacts with AUSF and NG-UE in the core network, and accepts the intermediate key (intermediate key) generated in the NG-UE authentication process from AUSF. SEAF will also interact with MM functions and SCMF. It is located in the security environment of the operator's network and will not be exposed to unauthorized access. In the roaming scenario, the SEAF is located on the visited network.
  • the second network device may be located in the core network or outside the core network.
  • the second network device may be an Unmaned Aerial Vehicle Traffic Management (UTM) device, or may be other core network devices or non-core network devices.
  • UDM Unmaned Aerial Vehicle Traffic Management
  • the second network device stores the relevant information of the drone and the remote control, for example, it stores the UAS identification and credential assigned to the drone (or remote control) by the contracted device manufacturer at the factory.
  • Each drone (or remote control) has a unique (one or more) UAS identification and corresponding credentials configured at the factory. Different drones (or remote controllers) correspond to different UAS logos and credentials.
  • the second network device can perform the control on the drone (or remote control) based on the UAS identification of the drone (or remote control) and the corresponding credential. Authentication. The identity authentication of the drone (or remote control) fails, and the drone (or remote control) cannot use the mobile communication network.
  • the UAS identifier of the terminal device may be an identity identifier assigned to the device by the device manufacturer
  • the UAS identifier of the terminal device is the identifier of the device itself. Therefore, performing identity authentication on the terminal device based on the UAS identification of the terminal device can prevent drones (or remote controls) produced by equipment manufacturers that have not contracted with the operator from accessing the mobile communication network, thereby improving the security of the mobile communication network.
  • UAS logos and credentials can also be issued and configured by entities such as UAS service providers and vertical industries. When initializing UAS services and services by service providers and vertical industries, it is possible to configure unique (one or more) UAS identifiers and corresponding credentials for UAS users/UAS/UAS services.
  • the drone cannot use the mobile communication network without the identity authentication of the second network device based on the identity provided by the drone system service provider or the vertical industry and the corresponding credential. Therefore, the identification of the terminal device based on the UAS identification of the terminal device can prevent the service provider who has not contracted with the mobile communication network operator or the UAV system user/UAS system service/UAV system business of the vertical industry.
  • the use of drones (or remote controllers) to access the mobile communication network improves the security of the mobile communication network.
  • FIG. 3 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
  • the identity authentication method includes the following steps 301 to 307.
  • the subject of the method execution shown in FIG. 3 may be the first terminal device, the first network device, and the second network device.
  • the method execution subject shown in FIG. 3 may be the chip in the first terminal device, the chip in the first network device, and the chip in the second network device.
  • FIG. 3 uses the first terminal device, the first network device, and the second network device as the execution body of the method as an example for description.
  • the first terminal device is a device in an unmanned aerial vehicle system, for example, it may be an unmanned aerial vehicle or a remote control of an unmanned aerial vehicle.
  • the first network device may be AMF or SEAF or other core network devices.
  • the second network device may be UTM or other network devices that can authenticate the UAV system.
  • the execution subject of the identity authentication method shown in the other figures of the embodiment of the present application is the same, and will not be repeated hereafter. among them:
  • the first terminal device sends a first request to the first network device.
  • the first request may be a registration request (registration request) or a service request (service request), or other types of requests.
  • the first request carries first authentication indication information, and the first authentication indication information is used to request UAS authentication for the first terminal device.
  • the so-called UAS authentication refers to the identity authentication of the equipment in the UAS based on the UAS identification of the equipment. If the UAS authentication is passed, it indicates that the identity of the UAS device is legal. If the UAS authentication fails, it indicates that the UAS device identity is illegal and cannot access the mobile communication network.
  • the UAS logo is the identity identifier (ID) assigned by the drone manufacturer to the drone and the remote control when it leaves the factory. Different drones and remote controllers correspond to different UAS logos. Each drone and remote control has a unique (one or more) UAS identification and corresponding credentials configured at the factory. Alternatively, the UAS logo and credential can also be assigned or configured by UAS service providers or vertical industries. For the description of the UAS logo, please refer to the above description, which is not limited here.
  • the first authentication indication information may have the following three forms: a, b, and c:
  • the first authentication indication information is the registration type (RegistrationType) information in the first request.
  • the first request may be a registration request.
  • the registration type information is a parameter or information element (InformationElement) existing in the existing registration request.
  • InformationElement InformationElement
  • a value can be added to the registration type information.
  • the value of the newly added registration type information may be UAS registration or UAS authentication.
  • the registration type information represents the first authentication indication information, which is used to request UAS authentication for the first terminal device. Using the registration type information to request UAS authentication for the first terminal device can avoid adding a new parameter or information element to request UAS authentication for the first terminal device, and can reduce changes to the existing communication process.
  • the first authentication indication information is UAS type information of the first terminal device.
  • the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
  • the UAS type information may be a drone type or a remote control type.
  • the UAS type information of the first terminal device by using the UAS type information of the first terminal device as the first authentication indication information, it can notify the first network device of the UAS type of the first terminal device and request the first network device for UAS authentication. , That is, two goals can be achieved by sending one type of information, which is beneficial to saving signaling overhead.
  • the first authentication indication information is indication information other than registration type information and UAS type information. For example, additional information elements or parameters may be added to the first request to indicate the first authentication indication information.
  • the first request carries UAS type information of the first terminal device.
  • the first request may also carry UAS type information of the first terminal device.
  • the first authentication instruction information is in form b.
  • the first network device can also send the UAS type information of the first terminal device to the second network device, so that the second network device can use the corresponding authentication method to authenticate the first terminal device based on the UAS type information of the first terminal device.
  • the terminal device performs UAS authentication.
  • the second network device may use different authentication methods for UAS certification for the drone and the remote control, or the security strength or security process required for UAS certification for the drone and the remote control may be different.
  • the first request also carries the subscription concealed identifier (SUCI) of the first terminal device or the globally unique temporary UE identity (GUTI).
  • SUCI subscription concealed identifier
  • GUI globally unique temporary UE identity
  • the first network device sends a second request to the first terminal device.
  • the first network device after receiving the first request, sends the second request to the first terminal device.
  • the second request is used to request to obtain the UAS identifier of the first terminal device.
  • the first network device may first perform the first authentication with the first terminal device, and establish NAS security with the first terminal device. After the first authentication with the first terminal device is passed, and after the NAS security with the first terminal device is established, the second request is sent to the first terminal device.
  • the first authentication refers to the two-way authentication performed by the network and the first terminal device.
  • the first authentication includes two authentication procedures: 5G-AKA (AKA: Authentication and Key Agreement) and EAP-AKA’. These two types of authentication are based on the terminal identifier (such as SUPI in the 5G system) pre-configured in the PLMN network and the corresponding credential (Credentails) to authenticate the first terminal device.
  • 5G-AKA AKA: Authentication and Key Agreement
  • EAP-AKA EAP-AKA
  • the messages exchanged between the first terminal device and the first network device are protected by security, for example, with encryption protection and integrity protection. Therefore, after NAS security is established between the first network device and the first terminal device, obtaining the UAS identifier from the first terminal device is beneficial to prevent the UAS identifier from being leaked and tampered with.
  • the first network device may also first detect whether it needs to perform the first authentication with the first terminal device. If it is necessary to perform the first authentication with the first terminal device, perform the first authentication with the first terminal device, and establish NAS security with the first terminal device.
  • EAP extensible authentication protocol
  • the first network device may carry the second request in an EAP message and send it.
  • the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
  • the first terminal device after receiving the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
  • the EAP mechanism to perform UAS authentication on the first terminal device as an example.
  • the first terminal device may carry the UAS identifier in the EAP message and send it to the first network device.
  • the UAS logo can be transmitted through EAP messages.
  • the first terminal in response to the second request, may also send the UAS type of the first terminal device to the first network device.
  • UAS type messages cannot usually be carried in EAP messages and need to be sent in other ways. That is to say, in a possible implementation, the first terminal device needs to use different messages or different positions (or methods) in the same message to send the UAS ID and UAS type (for example, the UAS ID is placed in the EAP container, and the UAS The type is placed outside the EAP container).
  • the first device may directly obtain the UAS identifier according to the first request in step 301.
  • steps 302 and 303 are optional and do not need to be performed.
  • the first request optionally includes the terminal's subscription identifier SUCI or GUTI, and the first network device obtains SUPI based on SUCI or GUTI. If the first network device stores the corresponding relationship between the terminal identifier SUPI and the UAS identifier, then The first network may also directly obtain the UAS identifier through the corresponding relationship.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the first network device after obtaining the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the first network device may also send the UAS type of the first terminal device or/and the identifier of the terminal device (such as SUPI or GPSI) to the second network device.
  • the UAS type and the identifier of the terminal device usually cannot be carried in the EAP message and need to be sent in other ways. That is, in a possible implementation, the first network device needs to use different messages or different locations (or methods) in the same message to send the UAS identifier and the UAS type (and/or the identifier of the terminal device).
  • the UAS identifier can be placed in the EAP container, and the UAS type (and/or the terminal device identifier) is placed outside the EAP container for transmission.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the second network device after receiving the UAS identifier of the first terminal device, performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the corresponding credential.
  • the second network device may use the EAP mechanism to perform UAS authentication on the first terminal device.
  • the EAP-TLS authentication method using the EAP mechanism performs UAS authentication on the first terminal device based on the UAS identifier.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the second network device after the second network device performs UAS authentication on the first terminal device based on the UAS identifier, the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the second network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
  • the UAS authentication status identifier is used to indicate the UAS authentication status.
  • the UAS authentication status of the first terminal device may include four states: UAS authentication passed, UAS authentication failed, UAS authentication pending and not yet authenticated. For example, when the UAS authentication status flag is 01, it indicates that the authentication is passed. When the UAS authentication status flag is 00, it indicates that the authentication has failed. When the UAS authentication status is marked as 10, it indicates the status of authentication to be completed. When the UAS authentication status is marked as 11, it indicates that it is not yet authenticated.
  • UAS certification results include UAS certification passed and UAS certification failure. For example, if the UAS authentication result is that the UAS authentication is passed, the UAS authentication status flag can be updated to 01.
  • the UAS authentication status can be updated to 00.
  • the second network device can update the UAS authentication status of the first terminal device, so that the UAS authentication status of the first terminal device can be subsequently checked.
  • the authentication status of UAS authentication passed or UAS authentication failed and the validity period and other information can be attached to indicate the validity period of the authentication status. If the authentication status is passed or failed and is within the validity period, there is no need to re-authenticate; if After this period, the certification status is no longer valid and needs to be updated. This patent does not limit the validity period and so on.
  • the second network device stores a corresponding relationship between the UAS authentication status identifier and the UAS identifier of the first terminal device or the subscriber permanent identifier (SUPI) or the general public subscription identifier GPSI.
  • the second network device finds the UAS authentication status identifier of the first terminal device according to the UAS identifier or SUPI or GPSI of the first terminal device, and updates the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
  • the second network device obtains the UAS authentication status identifier of the first terminal device according to the UAS authentication result, and stores the UAS authentication status identifier of the first terminal device Correspondence with the UAS identifier or SUPI or GPSI of the first terminal device, so that the UAS authentication status identifier of the first terminal device can be found subsequently based on the UAS identifier or SUPI or GPSI of the first terminal device.
  • the first request sent by the first terminal device in step 301 carries the user subscription identifier (subscription concealed identifier, SUCI) (or GUTI) of the first terminal device.
  • the first network device may obtain the SUPI or GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then send the SUPI or GPSI of the first terminal device to the second network device. If the second network device can store the corresponding relationship between the UAS authentication status identifier and the SUPI or GPSI of the first terminal device, the second network device searches, stores, or updates the UAS of the first terminal device according to the SUPI or GPSI sent by the first terminal device Authentication status identifier.
  • the first network device obtains the SUPI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then sends it to the first terminal device.
  • the second network device sends the SUPI of the first terminal device.
  • the first network device obtains the GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and sends the GPSI of the first terminal device to the second network device.
  • the first network device may send the SUCI (or GUTI) of the first terminal device to UDM, and the UDM converts the SUCI (or GUTI) of the first terminal device into the first
  • the SUPI or GPSI of the terminal device then sends the SUPI or GPSI of the first terminal device to the first network device.
  • the second network device may store the first terminal device after passing the authentication of the first terminal device. Correspondence between the UAS ID of the terminal equipment and SUPI or GPSI.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first network device After receiving the UAS authentication result of the first terminal device, the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first terminal device can receive the UAS authentication result of the first terminal device.
  • the subsequent first terminal device can use the mobile communication network. If the UAS authentication result is that the authentication fails, the subsequent first terminal device cannot use the mobile communication network.
  • the first network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
  • the second network device may send the UAS authentication result of the first terminal device and the SUPI or GPSI of the first terminal device to the first network device.
  • the first network device receives the UAS authentication result of the first terminal device and the SUPI or GPSI of the first terminal device, it can find the UAS authentication status identifier of the first terminal device according to the SUPI or GPSI of the first terminal device, and based on the first terminal device's SUPI or GPSI.
  • the UAS authentication result of the terminal device updates the UAS authentication status identifier of the first terminal device.
  • the first network device obtains the UAS authentication status identifier of the first terminal device according to the UAS authentication result, and stores the UAS authentication status identifier of the first terminal device Correspondence with the SUPI or GPSI of the first terminal device, so that the UAS authentication status identifier of the first terminal device can be found subsequently based on the SUPI or GPSI of the first terminal device.
  • the UAS identifier is carried in the EAP message for transmission, and the first network device (such as AMF) does not parse the EAP message in the usual implementation manner. In this case, the first network device will not obtain or store the UAS identification information. Therefore, the storage mode of the UAS authentication status identifier in the first network device should use the terminal ID (SUPI or GPSI) as the identifier instead of the UAS identifier.
  • the second network device can send the UAS authentication result of the first terminal device and the UAS identifier carried in the EAP message to the first network device.
  • the first network device reads the UAS identifier in the EAP message, and then stores the corresponding relationship between the UAS authentication status identifier and the UAS identifier of the first terminal device, or searches for the UAS authentication status identifier based on the UAS identifier, and updates the UAS authentication status identifier.
  • the first network device can also store the correspondence between the UAS identifier of the first terminal device and the SUPI or GPSI.
  • step 307 may not be performed.
  • the foregoing steps 301 to 307 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 301 to 307.
  • the second network device can authenticate the identity of the first terminal device based on the UAS identity of the first terminal device. Since the UAS identity of the first terminal device is configured by the equipment manufacturer, the UAS identity of the first terminal device is the identity of the first terminal device itself. Therefore, the authentication of the first terminal device based on the UAS identification of the first terminal device can prevent the first terminal device produced by a device manufacturer that has not contracted with the operator from using the mobile communication network, or can prevent services that have not been contracted with the operator Providers or UAV system users/unmanned aerial systems services/unmanned aerial systems services of vertical industries use drones (or remote controllers) to access mobile communication networks, which improves the security of mobile communication networks. At the same time, the implementation of the embodiments of this application can enable drone equipment manufacturers/UAS service providers/vertical industries to have certain control over whether the drone system equipment they produce/service/own can access the mobile communication network. Management rights.
  • FIG. 4 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in FIG. 4 is an optimization of the identity authentication method shown in FIG. 3.
  • the difference between the identity authentication method shown in FIG. 4 and FIG. 3 is that the first network device in FIG. 4 needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the first network device sends a second request to the first terminal device. And the second network device also needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the identity authentication method includes the following steps 401 to 410. among them:
  • the first terminal device sends a first request to the first network device.
  • the first request may be a registration request (registration request) or a service request (service request), or other types of requests.
  • the first request carries first authentication indication information.
  • the first authentication indication information is used to request UAS authentication for the first terminal device. For related descriptions of the first request and the first authentication indication information, please refer to the description under 301 above, which will not be repeated here.
  • the first network device performs the first authentication with the first terminal device, and establishes NAS security with the first terminal device.
  • the first network device determines whether to perform UAS authentication on the first terminal device.
  • step 402 may not be executed.
  • step 402 may be performed after step 403.
  • the first network device determines whether to perform UAS authentication on the first terminal device.
  • step 404 is executed.
  • step 403 may not be executed. That is, after the first network device receives the first request, when the first network device determines to perform UAS authentication on the first terminal device, step 404 is executed.
  • the first network device when it determines not to perform UAS authentication on the first terminal device, it may send a UAS authentication failure message to the first terminal device, or send a message indicating that it is not necessary to perform UAS authentication on the first terminal device.
  • the indication message for UAS authentication, or other indication messages to be sent, is not limited in the embodiment of the present application.
  • the following describes four ways for the first network device to determine whether to perform UAS authentication on the first terminal device.
  • the first network device can also determine whether to perform UAS authentication on the first terminal device in other ways. Make restrictions, where:
  • the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
  • the first network device determines to perform UAS authentication on the first terminal device.
  • the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is an authentication success state or an authentication failure state, it is determined not to perform UAS authentication on the first terminal device.
  • the first network device may store the UAS authentication status identifier of the first terminal device.
  • the UAS authentication status identifier is used to indicate the UAS authentication status.
  • the UAS authentication status may include authentication success, authentication failure, not yet authenticated, and pending authentication status. For example, when the UAS authentication status flag is 01, it indicates that the authentication is successful. When the UAS authentication status flag is 00, it indicates that the authentication has failed. When the UAS authentication status flag is 10, it indicates the authentication status to be completed. When the UAS authentication status is marked as 11, it indicates that it is not yet authenticated. If the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is authentication success or authentication failure, it is proved that the previous UAS authentication is still valid.
  • step 404 may be performed to perform subsequent operations on the first terminal device. UAS certification process.
  • the first network device may store the corresponding relationship between the SUPI or GPSI of the first terminal device and the UAS authentication status identifier of the first terminal device.
  • the first request sent by the first terminal device may also carry the SUCI (or GUTI) of the first terminal device.
  • the first network device obtains the SUPI or GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then obtains the UAS authentication state identifier corresponding to the SUPI or GPSI of the first terminal device from the stored UAS authentication state.
  • the first network device may directly send the UAS authentication status of the first terminal device to the first terminal device .
  • the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the first request carries UAS type information of the first terminal device. If the first authentication indication information is information other than UAS type information, for example, it may be registration type information, then the first request may carry the first authentication indication information and UAS type information. If the first authentication indication information is UAS type information, the first request carries the first authentication indication information.
  • Fig. 5 takes the first request carrying the first authentication indication information and UAS type information as an example.
  • the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
  • the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
  • the UAS type information corresponding to the SUPI or GPSI of the first terminal device may be stored in the first network device.
  • the UAS type information corresponding to the SUPI or GPSI of the first terminal device may be understood as the UAS type information supported by the core card (such as a SIM card) corresponding to the SUPI or GPSI of the first terminal device.
  • the first request may also carry SUCI, and the first network device obtains the SUPI or GPSI of the first terminal device based on the SUCI.
  • the first network device obtains corresponding UAS type information according to the SUPI or GPSI of the first terminal device.
  • the first network device stores the corresponding relationship between SUPI and UAS type information shown in Table 1 below.
  • the UAS type information corresponding to SUPI1 is a drone
  • the UAS type information corresponding to SUPI2 is a drone
  • the UAS type information corresponding to SUPI3 is a remote control.
  • SUPI1 and SUPI2 belong to the SUPI corresponding to the first type of SIM card
  • SUPI3 belongs to the SUPI corresponding to the second type of SIM card.
  • the first type of SIM card can only be configured on the drone
  • the second type of SIM card can only be configured on the remote control.
  • SUPI1 and SUPI2 correspond to the drone type
  • SUPI3 corresponds to the remote control type.
  • the received SUCI is SUCI1.
  • the first network device obtains SUPI1 based on SUCI1.
  • the first network device determines the drone type corresponding to SUPI1 according to Table 1 above. Therefore, the first network device determines that the UAS type information received by the first network device is UAS type information corresponding to the SUPI or GPSI of the first terminal device.
  • the received SUCI is SUCI1.
  • the first network device obtains SUPI1 based on SUCI1.
  • the first network device determines the drone type corresponding to SUPI1 according to Table 1 above. Therefore, the first network device determines that the UAS type information received by the first network device is not UAS type information corresponding to the SUPI or GPSI of the first terminal device. This indicates that the first type of SIM card that should be deployed on the drone has been misused or stolen on the remote control. Therefore, if the first network device determines that the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, the subsequent UAS authentication process may not be continued. In this way, it can be avoided that the mobile communication network can be used when the first terminal device incorrectly uses the core card or uses the stolen core card.
  • the UAS type information received by the first network device is not the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
  • the UAS type information received by the first network device is UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
  • the UAS type information corresponding to SUPI or GPSI can be understood as UAS type information that is not supported by the core card corresponding to SUPI or GPSI.
  • the first network device can obtain the first terminal device's information from the UDM or the second network device.
  • UAS type information corresponding to SUPI or GPSI.
  • the first network device may also send a notification to the first terminal device.
  • the terminal device sends a message indicating that the UAS authentication fails.
  • the first terminal device may be notified that the UAS type information of the first terminal device carried in the first request is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device. In this way, after receiving the notification, the first terminal device can prompt the user that the configuration of the core card (such as the SIM card) is incorrect.
  • the first network device determines whether the first terminal device exists in the list of devices allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device. In this way, it can also be understood that the first network device stores a list of devices that are allowed to perform UAS authentication.
  • the list of devices allowed to perform UAS authentication stored by the first network device is specifically a SUPI list of devices allowed to perform UAS authentication.
  • the first request also carries the SUCI of the first terminal device.
  • the first network device can obtain the SUPI of the first terminal device based on the SUCI of the first terminal device.
  • the first network device determines whether the SUPI of the first terminal device exists in the stored SUPI list of devices that are allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined that UAS authentication does not need to be performed on the first terminal device. In a possible implementation, not requiring UAS authentication is equivalent to successful authentication. In another possible implementation, not requiring UAS authentication is equivalent to authentication failure.
  • the SUPI list of the first terminal device that is allowed to perform UAS authentication stored by the first network device is shown in Table 2 below.
  • the first terminal device 1 to the first terminal device 3 are the first terminal devices that perform UAS authentication.
  • the SUPIs of the first terminal device 1 to the first terminal device 3 are SUPI1 to SUPI3, respectively.
  • the first network device converts the SUCI carried in the first request to SUPI4. If SUPI4 is the same as any one of SUPI1 to SUPI3, the first network device determines to perform UAS authentication on the first terminal device.
  • SUPI4 is the same as SUPI1, it is proved that the first terminal device that sent the first request is the first terminal device 1, and the first network device determines to perform UAS authentication on the first terminal device that sent the first request.
  • SUPI4 is different from any one of SUPI1 to SUPI3, the first network device determines not to perform UAS authentication on the first terminal device.
  • the first network device determines whether the first terminal device exists in the list of devices that are not allowed to perform UAS authentication. If yes, it is determined not to perform UAS authentication on the first terminal device. If not, it is determined to perform UAS authentication on the first terminal device. In this way, it can also be understood that the first network device stores a blacklist of devices that are not allowed to perform UAS authentication.
  • the list of devices that are not allowed to perform UAS authentication stored by the first network device is specifically a SUPI list of devices that are not allowed to perform UAS authentication.
  • the first request also carries the SUCI of the first terminal device.
  • the first network device can obtain the SUCI of the first terminal device based on the SUCI of the first terminal device. If the SUPI of the first terminal device exists in the SUPI list of devices that are not allowed to perform UAS authentication stored by the first network device, the first network device determines not to perform UAS authentication on the first terminal device.
  • the first network device determines to perform UAS authentication on the first terminal device. In a possible implementation, it is determined in way 4 that UAS authentication is not performed on the first terminal device, which is equivalent to UAS authentication failure.
  • the first network device may also send the received SUCI to UDM.
  • the UDM receives the SUCI, it can convert the SUCI to SUPI.
  • the UDM determines whether to perform UAS authentication on the first terminal device.
  • the specific implementation manner for the UDM to determine whether to perform UAS authentication on the first terminal device is the same as the specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device in the foregoing manners 3 to 4, and will not be repeated here.
  • the UDM may send the determined result to the first network device, and the first network device determines whether to perform UAS authentication for the first terminal device or not to perform UAS authentication for the first terminal device according to the determination result sent by the UDM.
  • the first network device may send a message for indicating the UAS authentication result to the first terminal device.
  • the first network device may also combine multiple methods in the foregoing manner 1 to manner 4 to determine whether to perform UAS authentication on the first terminal device.
  • the first network device may also determine whether to perform UAS authentication on the first terminal device in another manner, which is not limited in the embodiment of the present application.
  • the first network device sends a second request to the first terminal device.
  • the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • step 404 to step 406 refer to the specific implementation manners of step 302 to step 304, and details are not described herein.
  • the second network device determines whether to perform UAS authentication on the first terminal device.
  • the second network device determines whether to perform UAS authentication on the first terminal device.
  • step 407 may not be executed. That is, after the second network device receives the UAS identifier of the first terminal device, when the second network device determines to perform UAS authentication on the first terminal device, step 408 is executed.
  • the second network device when the second network device determines not to perform UAS authentication on the first terminal device, it can send a UAS authentication failure message to the first network device, and the first network device sends UAS authentication failure to the first terminal device. news.
  • the second network device may send to the first network device indication information indicating that the first terminal device is not to be authenticated (or successfully authenticated) by the first network device. Sending to the first terminal device indication information for indicating that UAS authentication is not performed on the first terminal device (or the authentication is successful).
  • the second network device determines not to perform UAS authentication on the first terminal device, it may send other indication information to the first network device, and the first network device sends it to the first terminal device.
  • the following introduces five ways for the second network device to determine whether to perform UAS authentication on the first terminal device.
  • the second network device can also determine whether to perform UAS authentication on the first terminal device in other ways. Make restrictions, where:
  • Manner 1 The second network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
  • Mode 1 of the second network device please refer to the specific implementation principle of Mode 1 of the first network device, which will not be repeated here.
  • the second network device may also store the corresponding relationship between the UAS identifier of the first terminal device and the UAS authentication status identifier of the first terminal device.
  • the first network device obtains the UAS authentication state identifier corresponding to the UAS identifier of the first terminal device from the stored UAS authentication state. Then, based on the obtained UAS authentication status identifier, it is determined whether to perform UAS authentication on the first terminal device.
  • Manner 2 The second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
  • the first request also carries UAS type information of the first terminal device. If the first authentication indication information is information other than UAS type information, for example, it may be registration type information, then the first request may carry the first authentication indication information and UAS type information. If the first authentication indication information is UAS type information, the first request carries the first authentication indication information. Fig. 5 takes the first request carrying the first authentication indication information and UAS type information as an example.
  • the first network device may also send the UAS type information of the first terminal device to the second network device.
  • the second request is also used to request to obtain UAS type information of the first terminal device.
  • the first terminal device After receiving the second request, the first terminal device also sends UAS type information to the first network device.
  • the first terminal device may send the UAS type information of the first terminal device and the UAS identifier to the first network device together, or send the two pieces of information to the first network device separately.
  • the first network device After receiving the UAS type information and UAS identifier sent by the first terminal device, the first network device sends the UAS type information and UAS identifier of the first terminal device to the second network device.
  • the UAS type information can be sent to the second network device together with the UAS identifier, or the two can be sent separately.
  • the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information and the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information. Principle The same is not repeated here.
  • the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device.
  • the first request also carries the SUCI (or GUTI) of the first terminal device.
  • the first network device also sends the SUPI or GPSI of the first terminal device to the second network device.
  • the SUPI or GPSI of the first terminal device can be sent together with the UAS ID of the first terminal device, or sent separately from the UAS ID of the first terminal device, for example, sent in two different messages or different in the same message Location, different methods (one in the container, one outside the container), different cells or different containers to send, etc.
  • the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device.
  • the specific implementation manner is: the second network device It is determined whether the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device have a corresponding relationship (or binding relationship). If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device.
  • the UAS identifier has a corresponding relationship with SUPI or GPSI, which means that the core card (such as a SIM card) corresponding to the SUPI or GPSI needs to be bound to the terminal device corresponding to the UAS identifier.
  • the UAS ID of the first terminal device has a corresponding relationship with the SUPI or GPSI of the first terminal device, it means that the core card (such as the SIM card) installed in the first terminal device is bound to the UAS ID of the first terminal device. Core card. Otherwise, it means that the core card (such as a SIM card) installed in the first terminal device is not a core card used in binding with the UAS identifier of the first terminal device. Therefore, by implementing this possible implementation, when the core card (such as a SIM card) installed in the first terminal device is a core card that is bound to the first terminal device, the second network device will perform the operation on the first terminal device. UAS certification.
  • the second network device When the core card (such as a SIM card) installed in the first terminal device is not a core card bound to the first terminal device, the second network device will not perform UAS authentication on the first terminal device (or equivalent to authentication failure). Therefore, when the core card installed in the first terminal device is not a core card bound to the first terminal device, the first terminal device cannot use the mobile communication network. This can prevent random replacement and embezzlement of the core card of the first terminal device.
  • the core card such as a SIM card
  • the corresponding relationship between the UAS identifier and SUPI stored by the second network device is shown in Table 3 below. If the first terminal device is the first terminal device 1, and the first network device sends the UAS identifier 1 and SUPI2 to the second network device, the second network device determines that the UAS identifier 1 of the first terminal device 1 and SUPI2 do not have a corresponding relationship , The second network device determines that the UAS authentication of the first terminal device is an authentication failure. If the first network device sends UAS ID 1 and SUPI1 to the second network device, the second network device determines that the UAS ID of the first terminal device 1 has a corresponding relationship with SUPI, and the second network device continues to perform UAS on the first terminal device. Certification. The second network device determines whether the UAS identifier of the first terminal device has a corresponding relationship with the GPSI in the same principle, which is not repeated here.
  • the second network device may send to the first terminal device via the first network device a message indicating UAS authentication failure news.
  • the first network device may be notified to the first terminal device that its UAS identifier does not have a corresponding relationship with SUPI or GPSI.
  • Manner 4 The second network device determines whether the first terminal device exists in the list of devices allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device.
  • the second network device determines whether the first terminal device exists in the list of devices that are not allowed to perform UAS authentication. If yes, it is determined not to perform UAS authentication on the first terminal device. If not, it is determined to perform UAS authentication on the first terminal device.
  • the second network device may also determine whether to perform UAS authentication on the first terminal device according to the UAS identification or GPSI of the first terminal device in the manner 4 to manner 5.
  • the implementation principle is the same as the implementation principle in which the first network device determines whether to perform UAS authentication on the first terminal device according to the SUPI of the first terminal device in the foregoing manner 3 to manner 4, and will not be repeated here.
  • the second network device may also combine multiple methods in the foregoing manner 1 to manner 5 to determine whether to perform UAS authentication on the first terminal device.
  • the second network device may also determine whether to perform UAS authentication on the first terminal device in another manner, which is not limited in the embodiment of the present application.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • step 408 to step 410 can participate in the specific implementation manners of the above-mentioned 305 to step 307, which will not be repeated here.
  • step 403 and step 407 may be executed, or only step 403 may be executed, or only step 407 may be executed.
  • Step 404 and step 405 may not be executed, and the description is similar to step 302 and step 303, and will not be repeated here.
  • Step 410 may not be executed.
  • the foregoing steps 401 to 410 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 401 to 410.
  • terminal devices that do not meet UAS certification requirements can be screened out first, and UAS certification is only performed on terminal devices that meet the certification requirements, which is beneficial to reducing the authentication workload of the second network device.
  • FIG. 7 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in FIG. 7 and the identity authentication method shown in FIG. 3 are parallel solutions.
  • the difference between the identity authentication method shown in FIG. 7 and FIG. 3 is that in FIG. 3, the UAS identifier of the first terminal device is obtained by the first network device through a second request.
  • the first request in FIG. 7 also carries the UAS identifier of the first terminal device.
  • the identity authentication method includes the following steps 701 to 705. among them:
  • the first terminal device sends a first request to the first network device.
  • the first request carries the first authentication indication information and the UAS identifier of the first terminal device.
  • the first authentication indication information please refer to the description under step 301, which will not be repeated here.
  • the first request carries UAS type information of the first terminal device.
  • the first request also carries the user subscription identifier (subscription concealed identifier, SUCI) of the first terminal device.
  • the first terminal device before step 701 is performed, performs the first authentication with the first network device, and establishes NAS security with the first network device. After the first terminal device passes the first authentication and establishes NAS security with the first network device, the messages exchanged between the first terminal device and the first network device are securely protected, for example, with encryption protection and integrity sexual protection. Therefore, the first terminal device can carry the UAS identifier of the first terminal device in the first request, and the UAS identifier of the first terminal device will not be leaked.
  • the first network device can avoid the additional steps of sending the second request (step 302 and step 303 in FIG. 3) to obtain the UAS identifier, thereby improving efficiency And save network resources.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the first network device after receiving the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the first network device may carry the UAS identifier in the EAP message and send it to the second network device.
  • the first network device may also send the UAS type or/and the identifier SUPI (or GPSI) of the first terminal device to the second network device. Similar to the description of step 303, the UAS type and SUPI (or GPSI) need to be sent through a different location (or method) in a message different from sending the UAS identification or in the same message for sending the UAS identification.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • step 703 to step 705 please refer to the specific implementation manners of the above-mentioned 305 to step 307, which will not be repeated here.
  • step 704 when the second network device sends the UAS authentication result of the first network device to the first network device, it needs to carry the UAS identifier, or/and the UAS type, or/and the SUPI (or GPSI) ).
  • the first network device can store and update the UAS authentication status and identity (UAS identity, UAS type, SUPI (or SUPI)) of the first terminal device.
  • the foregoing step 705 may not be performed.
  • the foregoing steps 701 to 705 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 701 to 705.
  • FIG. 8 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in FIG. 8 is an optimization of the identity authentication method shown in FIG. 7.
  • the difference between the identity authentication method shown in FIG. 8 and FIG. 7 is that in FIG. 8 the first network device needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. And the second network device also needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the identity authentication method includes the following steps 801 to 808. among them:
  • the first network device performs first authentication with the first terminal device, and establishes NAS security with the first terminal device.
  • the first terminal device sends a first request to the first network device.
  • the first request carries the first authentication indication information and the UAS identifier of the first terminal device.
  • the first authentication indication information please refer to the description under step 301, which will not be repeated here.
  • the network will assign a globally unique temporary UE identity (GUTI) to the terminal. Therefore, the first request may also carry the GUTI of the first terminal device.
  • the SUPI or GPSI of the first terminal device subsequently used by the first network device may be obtained based on the GUTI of the first terminal device.
  • the first network device determines whether to perform UAS authentication on the first terminal device. When the first network device determines to perform UAS authentication on the first terminal device, step 804 is executed.
  • step 803 refer to the specific implementation of step 403 above.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the first network device may also send the UAS type or/and the identifier SUPI (or GPSI) of the first terminal device to the second network device. Similar to the description of step 303, the UAS type and SUPI (or GPSI) need to be sent through a different location (or method) in a message different from sending the UAS identification or in the same message for sending the UAS identification.
  • the second network device determines whether to perform UAS authentication on the first terminal device. When the second network device determines to perform UAS authentication on the first terminal device, step 806 is executed.
  • step 804 to step 805 refer to the specific implementation of step 406 to step 407 above.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • step 806 to step 808 please refer to the specific implementation manners of step 305 to step 307, which will not be repeated here.
  • step 807 when the second network device sends the UAS authentication result of the first network device to the first network device, it may carry the UAS identifier, or/and the UAS type, or/and the SUPI (or GPSI) ).
  • the first network device can store and update the UAS authentication status and identity (UAS identity, UAS type, SUPI (or GPSI)) of the first terminal.
  • both step 803 and step 805 may be executed, or one of them may be executed.
  • the above step 808 may not be performed.
  • the foregoing steps 801 to 808 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing steps 801 to 808.
  • the terminal devices that do not meet the certification requirements can be screened out first, and UAS certification is only performed on the terminal devices that meet the certification requirements, which is conducive to reducing the certification work of the first network device and the second network device the amount.
  • FIG. 9 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in FIG. 9 is an optimization of the identity authentication method shown in FIG. 3.
  • the difference between the identity authentication method shown in FIG. 9 and FIG. 3 is that the second network device in FIG. 9 stores an association relationship (or a pairing relationship or a corresponding relationship or a binding relationship between the first terminal device and the second terminal device). ).
  • the second network device in FIG. 9 stores an association relationship (or a pairing relationship or a corresponding relationship or a binding relationship between the first terminal device and the second terminal device). ).
  • it is also necessary to authorize or authenticate the association relationship between the first terminal device and the second terminal device that is, to determine the first terminal device. Whether the association relationship between the device and the second terminal device is available or valid.
  • the first terminal device and the second terminal device can be paired for use. Otherwise, the first terminal device and the second terminal device cannot be paired for use.
  • the first terminal device may be a drone, and the second terminal device may be a remote controller of the drone.
  • the first terminal device may be a remote controller of a drone, and the second terminal device may be a drone.
  • the UAS type information of the first terminal device and the second terminal device are different.
  • the identity authentication method includes the following steps 901 to 912. among them:
  • the first terminal device sends a first request to the first network device.
  • the first request carries first authentication indication information.
  • the first authentication indication information is used to request UAS authentication for the first terminal device.
  • the first network device sends a second request to the first terminal device.
  • the first network device after receiving the first request, sends the second request to the first terminal device.
  • the second request is used to request to obtain the UAS identifier of the first terminal device.
  • the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • step 901 to step 907 can be referred to the specific implementation manners of step 301 to step 307 above, which will not be repeated here.
  • the second network device determines the UAS identifier of the second terminal device associated with the first terminal device.
  • step 908 to step 910 may be performed after step 904 and before step 905 or step 906.
  • step 908 to step 910 may be performed after step 906.
  • the steps in step 908 to step 910 may be executed simultaneously with step 905 or step 906.
  • FIG. 9 takes the execution of step 908 after step 906 as an example.
  • the second network device pre-stores the association relationship between the first terminal device and the second terminal device.
  • the association relationship may also be referred to as a correspondence relationship or a pairing relationship or a binding relationship.
  • the association relationship is described below.
  • the association relationship between the first terminal device and the second terminal device stored by the second network device may be configured in the second network device when the first terminal device and the second terminal device leave the factory.
  • the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the first terminal device and the second terminal device are successfully associated before.
  • association relationship between the first terminal device and the second terminal device may be stored in the second network device after the association is made when the UAS service provider signs a contract with the network operator.
  • the present invention does not limit how the association relationship is configured in the second network, and it will not be listed here.
  • the second network device stores the association relationship between the first terminal device and the second terminal device in the form of storing the association relationship between the UAS identifier of the first terminal device and the UAS identifier of the second terminal device. Therefore, the second network device can determine the UAS identity of the second terminal device according to the UAS identity of the first terminal device. Further, the second network device can determine the SUPI or GPSI of the second terminal device according to the binding relationship between the UAS identifier and the terminal identifier SUPI or GPSI (for example, as described in Table 3).
  • the association relationship between the drone and the remote controller stored in the second network device may be as shown in Table 4 below.
  • one remote controller can be associated with one or more drones, and one drone can also be associated with one or more remote controllers.
  • remote control 1 has an association relationship with UAV 1 and UAV 2
  • remote control 2 has an association relationship with UAV 3.
  • the second network device stores the relationship between the UAS ID 4 of the remote control 1 and the UAS ID 1 of the drone 1 and the UAS ID 2 of the drone 2, and stores the UAS ID 5 of the remote control 2 and the drone 3
  • the UAS identifies the 3 association relationship.
  • the first terminal device is UAV 1, according to the association relationship in Table 4 below, it can be determined that the UAS identifier of the second terminal device is UAS identifier 4. If the first terminal device is the remote controller 1, then there are two second terminal devices, namely the UAV 1 and the UAV 2. According to the association relationship in Table 4 below, based on UAS ID 4, UAS ID 1 of UAV 1 and UAS ID 2 of UAV 2 can be obtained. If the UAS ID and SUPI have an association relationship as shown in Table 3, according to the association relationship in Table 4 below, based on the UAS ID 4, the SUPI ID 1 of UAV 1 and the SUPI ID 2 of UAV 2 can be obtained.
  • the first request also carries device indication information, and the device indication information is used to determine the second terminal device.
  • the device indication information may indicate the number or serial number or name of the second terminal devices that need to be associated, so as to determine the first terminal device from the multiple second terminal devices.
  • a terminal device needs to be associated with a second terminal device.
  • the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • the second network device determines the UAS identity (and the second terminal identity SUPI) of the second terminal device associated with the first terminal device, it is based on the UAS identity (and the second terminal identity of the second terminal device) of the second terminal device.
  • SUPI Perform UAS authentication on the second terminal device.
  • the principle that the second network device performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device is the same as the principle that the first network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device. Go into details.
  • the second network device sends the UAS authentication result of the second terminal device to the first network device.
  • the second network device after the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device, it sends the UAS authentication result of the second terminal device to the first network device.
  • the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The UAS authentication result received by the first network device is the UAS authentication result of the first terminal device.
  • the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to instruct the first network device to receive The UAS authentication result of is the UAS authentication result of the second terminal device.
  • the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to indicate The first terminal device is associated with the second terminal device. And/or, when the second network device sends the UAS authentication result of the second terminal device to the first network device, it may also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate the first terminal device Associated with the second terminal device. Therefore, the first network device knows that the UAS authentication result of the first terminal device is also sent to the second terminal device, and the UAS authentication result of the second terminal device is also sent to the first terminal device. In addition, the first network device may save the association relationship between the first terminal device and the second terminal device.
  • the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
  • the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends it to the first terminal device (the first terminal device is determined according to the SUPI or UAS identification of the first terminal) UAS authentication result or association indication information of the second terminal device.
  • the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
  • the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the first terminal device itself determines the first terminal based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the device and the second terminal device are successfully associated.
  • the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device.
  • the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device. As a result, or send the UAS authentication result and association indication information of the second terminal device to the second terminal device.
  • step 906 and step 910 can be performed at the same time, that is, the second network device can transfer the UAS authentication result of the first terminal device to the UAS authentication result of the second terminal device.
  • the UAS authentication result and the UAS authentication result of the second terminal device are carried in the same message and sent to the first network device.
  • the first network device then sends the message to the first terminal device and the second terminal device.
  • the message may also include the UAS identity or SUPI or GPSI of the first terminal device, and the UAS identity or SUPI or GPSI of the second terminal device.
  • the UAS ID or SUPI or GPSI of the first terminal device is used to determine the first terminal device and distinguish the UAS authentication result of the first terminal device
  • the UAS ID or SUPI or GPSI of the second terminal device is used to determine the second terminal device and distinguish the first terminal device.
  • the second network device may determine the SUPI or GPSI of the second terminal device based on the SUPI or GPSI of the first terminal device.
  • the second network device may determine the SUPI or GPSI of the second terminal device based on the UAS identifier of the second terminal device.
  • the first network device may first send the UAS authentication result of the first terminal device to the first terminal device. . After receiving the UAS authentication result of the second terminal device, the UAS authentication result or association indication information of the second terminal device is sent to the first terminal device. Alternatively, after receiving the UAS authentication result of the first terminal device, the first network device first does not send the UAS authentication result of the first terminal device. When receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information to the first terminal device in the same message. When the first network device receives the UAS authentication result of the second terminal device, it can send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device in the same message. .
  • the first network device may first send the UAS authentication result of the second terminal device to the second terminal device .
  • the UAS authentication result or association indication information of the first terminal device is sent to the second terminal device.
  • the first network device first does not send the UAS authentication result of the second terminal device.
  • the first network device receives the UAS authentication result of the first terminal device, it sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device in the same message.
  • the first network device receives the UAS authentication result of the first terminal device, it can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device in the same message.
  • step 906 is performed before step 910, and in step 907, a UAS authentication status identifier for indicating that the UAS authentication status of the second terminal device is the authentication status to be completed is also sent.
  • step 906 is performed after step 910, in step 912, the first network device sends the UAS authentication result of the second terminal device to the second terminal device and is used to indicate that the UAS authentication status of the first terminal device is pending authentication.
  • the UAS authentication status identifier of the status is performed before step 910, and in step 907, a UAS authentication status identifier for indicating that the UAS authentication status of the second terminal device is the authentication status to be completed is also sent.
  • step 912 the first network device sends the UAS authentication result of the second terminal device to the second terminal device and is used to indicate that the UAS authentication status of the first terminal device is pending authentication.
  • the UAS authentication status identifier of the status is performed before step 910, and in step 907, a UAS authentication status identifier for indicating
  • step 905 before step 905 is executed, it may be determined whether to perform UAS authentication on the second terminal device. If it is determined to perform UAS authentication on the second terminal device, step 905 is executed. Optionally, the second network device may also determine whether to perform UAS authentication on the second terminal device before performing UAS authentication on the second terminal device based on the UAS identifier of the second terminal device. If it is determined to perform UAS authentication on the second terminal device, step 909 is executed.
  • the second network device determining whether to perform UAS authentication on the first terminal device or the second terminal device refer to the specific implementation of the second network device determining whether to perform UAS authentication on the first terminal device in the embodiment corresponding to FIG. 4 above. Method to realize.
  • the second network device sends instruction information to the first network device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate ,
  • the first network device sends the instruction information to the first terminal device and the second terminal device.
  • step 908 may be performed first, that is, to determine the UAS identifier of the second terminal device associated with the first terminal device.
  • the second network device determines whether to perform UAS authentication on the first terminal device and the second terminal device based on the position and distance between the first terminal device and the second terminal device. For example, if the distance between the first terminal device and the second terminal device is less than or equal to the preset distance, it is determined to perform UAS authentication on the first terminal device and the second terminal device, and the first network device executes step 905 and step 909.
  • the second network device may send instruction information to the first network device, and the instruction information may indicate that the first terminal device is associated with the second terminal device Failed or invalid.
  • the first network device sends the instruction information to the first terminal device and the second terminal device.
  • the first network device may not send the first terminal device and the second terminal device to the first terminal device.
  • the UAS authentication result of the first terminal device and the second terminal device are not sent to the second terminal device.
  • the first network device may send association indication information to the first terminal device and the second terminal device to indicate the second terminal device. Whether the association between the first terminal device and the second terminal device is successful.
  • the second terminal device may also actively initiate UAS authentication.
  • the process of the second terminal device actively initiating UAS authentication is similar to step 901 to step 906, that is, the first terminal device in step 901 to step 906 is replaced with the second terminal device.
  • the first network device may store the association relationship between the first terminal device and the second terminal device. After receiving the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device, the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device, And sending the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device.
  • the association relationship between the first terminal device and the second terminal device may also be stored by the second network device.
  • the second network device sends the UAS authentication result of the first terminal device, it indicates the identity of the second terminal device (such as UAS ID or SUPI or GPSI), and when the second network device sends the UAS authentication result of the second terminal device, it indicates The identity of the first terminal device (such as UAS identity or SUPI or GPSI).
  • the first network device After receiving the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device, the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device , And sending the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device.
  • steps 901 to 903 in the solution shown in FIG. 9 can also be replaced with step 701 in FIG. 7 to improve efficiency and save network resources.
  • the foregoing steps 901 to 912 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 901 to 912.
  • UAS authentication can be performed on the first terminal device and the second terminal device, and the stored association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
  • FIG. 10 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in FIG. 10 and the identity authentication method shown in FIG. 9 are parallel solutions.
  • the difference between the identity authentication method shown in FIG. 10 and FIG. 9 is that in the identity authentication method shown in FIG. 9, the second network device initiates the authentication of the second terminal device.
  • the first network device initiates the authentication of the second terminal device.
  • the identity authentication method includes the following steps 1001 to 1013. among them:
  • the first terminal device sends a first request to the first network device.
  • the first request carries first authentication indication information.
  • the first authentication indication information is used to request UAS authentication for the first terminal device.
  • the first network device sends a second request to the first terminal device.
  • the first network device after receiving the first request, sends the second request to the first terminal device.
  • the second request is used to request to obtain the UAS identifier of the first terminal device.
  • the first terminal device sends the UAS identifier of the first terminal device to the first network device.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • step 1001 to step 1005 please refer to the specific implementation manners of step 301 to step 305, which will not be repeated here.
  • the second network device determines the SUPI or GPSI or UAS identifier of the second terminal device associated with the first terminal device.
  • step 1006 can be performed before or after step 1005.
  • the second network device pre-stores the association relationship between the first terminal device and the second terminal device.
  • This association relationship may also be referred to as a correspondence relationship or a pairing relationship.
  • the association relationship between the first terminal device and the second terminal device stored by the second network device may be configured in the second network device when the first terminal device and the second terminal device leave the factory.
  • the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the first terminal device and the second terminal device are successfully associated before.
  • the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the association is made when the UAS service provider signs a contract with the network operator.
  • the present invention does not limit how the association relationship is configured in the second network, and it will not be listed here.
  • the second network device stores the association relationship between the first terminal device and the second terminal device in the form of storing the association between the UAS identifier or SUPI or GPSI of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device. relationship. Therefore, the second network device can determine the UAS identity or SUPI or GPSI of the second terminal device according to the UAS identity or SUPI or GPSI of the first terminal device.
  • the first request also carries device indication information, and the device indication information is used to determine the second terminal device.
  • the device indication information may indicate the number or serial number or name of the second terminal devices that need to be associated.
  • the second network device sends the UAS authentication result of the first terminal device and the SUPI or GPSI or UAS identifier of the second terminal device to the first network device.
  • the UAS authentication result of the first terminal device and the SUPI or GPSI or UAS identifier of the second terminal device may be carried in the same message or in different messages.
  • the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first network device after receiving the UAS authentication result of the first terminal device from the second network device, the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
  • the first network device after the first network device receives the SUPI or GPSI or UAS identifier of the second terminal device, it can also obtain the UAS authentication status identifier of the second terminal device, and send the second terminal device to the first terminal device.
  • the UAS certification status identifier if the obtained UAS authentication status identifier indicates that it has not been authenticated, step 1009 is executed. If the obtained UAS authentication status identifier indicates the authentication success or authentication failure status, step 1009 to step 1011 may not be performed, and the first network device can directly perform steps 1012 and 1013 to combine the UAS authentication status identifier of the second terminal device with the first The UAS authentication results of the terminal device are respectively sent to the first terminal device and the second terminal device.
  • the first network device sends the UAS identifier of the second terminal device to the second network device.
  • the first network device after the first network device receives the SUPI or GPSI or UAS identifier of the second terminal device, it can send the UAS identifier of the second terminal device to the second network device, that is, the first network device initiates a connection to the second network device. UAS certification of the device.
  • the first network device also needs to request the second terminal device to obtain the UAS identifier of the second terminal device. After the UAS identifier of the second terminal device is acquired, the UAS identifier of the second terminal device is sent to the second network device. Alternatively, if the corresponding relationship between the SUPI or GPSI of the second terminal device and the UAS identifier of the second terminal device is stored in the first network device, the first network device may also obtain the second terminal device based on the SUPI or GPSI of the second terminal device. The UAS ID of the terminal device.
  • step 1005 it may be determined whether to perform UAS authentication for the first terminal device. If it is determined to perform UAS authentication for the first terminal device, step 1005 is executed.
  • the second network device may also determine whether to perform UAS authentication on the first terminal device based on the position and distance between the first terminal device and the second terminal device. For the specific implementation manner, refer to the corresponding description in the embodiment corresponding to Fig. 9 and will not be repeated here.
  • the first network device may first determine whether to perform UAS authentication on the second terminal device. If it is determined to perform UAS authentication on the second terminal device, the UAS identifier of the second terminal device is sent to the second network device. Otherwise, optionally, the first network device may send instruction information to the first terminal device and the second terminal device, the instruction information indicating that the first terminal device fails to associate with the second terminal device.
  • the first network device can be based on whether the second terminal device is turned on, the distance between the first terminal device and the second terminal device, the UAS authentication status of the second terminal device, and the UAS type of the second terminal device One or more of information, etc., to determine whether to perform UAS authentication on the second terminal device. For example, if the second terminal device is not in the powered-on state, it is determined not to perform UAS authentication on the second terminal device. If the second terminal device is in the powered-on state, it is determined to perform UAS authentication on the second terminal device, and step 1009 is executed.
  • the distance between the first terminal device and the second terminal device, the UAS authentication status of the second terminal device, and the UAS type information of the second terminal device to determine whether to perform UAS authentication on the terminal device can be referred to the above description for specific implementations. , I won’t repeat it here.
  • the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • the second network device after receiving the UAS identifier of the second terminal device, performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • the principle that the second network device performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device is the same as the principle that the first network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device. Go into details.
  • the second network device sends the UAS authentication result of the second terminal device to the first network device.
  • the second network device after the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device, it sends the UAS authentication result of the second terminal device to the first network device.
  • the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
  • the first network device after receiving the UAS authentication result of the second terminal device, sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
  • the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
  • the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the terminal device itself determines the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the second terminal device is successfully associated.
  • the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device.
  • the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device. As a result, or, send the UAS authentication result of the first terminal device and the association indication information to the second terminal device.
  • the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device together, or separately send the UAS authentication result of the first terminal device and the second terminal device to the second terminal device. 2.
  • UAS authentication result of the terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device together, or separately send the UAS authentication result of the first terminal device and the UAS authentication result of the first terminal device to the first terminal device.
  • UAS authentication result of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device together, or separately send the UAS authentication result of the first terminal device and the UAS authentication result of the first terminal device to the first terminal device.
  • the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The UAS authentication result received by the first network device is the UAS authentication result of the first terminal device.
  • the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to instruct the first network device to receive The UAS authentication result of is the UAS authentication result of the second terminal device.
  • the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The first terminal device is associated with the second terminal device. Therefore, the first network device knows that the UAS authentication result of the first terminal device is also sent to the second terminal device, and the UAS authentication result of the second terminal device is also sent to the first terminal device.
  • step 1006 may not be executed.
  • step 1007 the UAS identifier or SUPI or GPSI of the second terminal device is not carried.
  • the first network device stores the association relationship between the first terminal device and the second terminal device. For example, the association relationship between the UAS identifier of the first terminal device and the UAS identifier of the second terminal device is stored.
  • the first network device determines the UAS identifier of the second terminal device associated with the first terminal device.
  • the subsequent steps 1010 to 1013 are executed.
  • steps 1001 to 1003 in the solution shown in FIG. 10 can also be replaced with step 701 in FIG. 7.
  • the foregoing step 1001 to step 1013 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1001 to step 1013.
  • the first terminal device and the second terminal device can be authenticated, and the association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
  • FIG. 11 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the difference between the identity authentication method shown in FIG. 11 and the identity authentication method shown in FIG. 9 and FIG. 10 is that the solutions shown in FIG. 9 and FIG. The association relationship is authorized or authenticated.
  • the second network device does not store the association relationship between the first terminal device and the second terminal device.
  • the solution shown in FIG. 11 is to authorize or authenticate the newly-added association relationship between the first terminal device and the second terminal device.
  • the identity authentication method includes the following steps 1101 to 1116. among them:
  • the second terminal device sends a third request to the first network device.
  • the third request carries second authentication indication information and newly added association indication information.
  • the second authentication indication information is used to request UAS authentication for the second terminal device.
  • the newly-added association instruction information is used to request the newly-added association relationship.
  • the first network device sends a fourth request to the second terminal device.
  • the first network device after receiving the third request, sends the fourth request to the second terminal device.
  • the fourth request is used to request to obtain the UAS identifier of the second terminal device.
  • the second terminal device sends the UAS identifier of the second terminal device to the first network device.
  • the first network device sends the UAS identifier of the second terminal device and the new association indication information to the second network device.
  • the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • step 1101 to step 1105 please refer to the specific implementation manners of step 301 to step 305 above, and details are not described herein.
  • step 1102 and step 1103 may not be performed to improve efficiency and save network resources.
  • the second network device sends a request for obtaining second association information of the second terminal device to the first network device.
  • the first network device sends a request for obtaining second association information of the second terminal device to the second terminal device.
  • the second terminal device sends the second association information of the second terminal device to the first network device.
  • the first network device sends the second association information of the second terminal device to the second network device.
  • step 11051 to step 11054 may be executed in a process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • steps 11051 to 11054 may be performed after step 1104 and before step 1105.
  • step 11051 to step 11054 can be performed after step 1105.
  • FIG. 11 takes as an example that steps 11051 to 11054 are performed in the process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
  • the second network device sends the UAS authentication result of the second terminal device to the first network device.
  • the first network device sends the UAS authentication result of the second terminal device to the second terminal device.
  • step 1101 to step 1107 can refer to the specific implementation manners of step 301 to step 307 above, and details are not described herein.
  • the second terminal device sends the first request to the first network device.
  • the first request carries first authentication indication information and newly added association indication information.
  • the first authentication indication information is used to request UAS authentication for the first terminal device.
  • the newly-added association instruction information is used to request the newly-added association relationship.
  • the first network device sends a second request to the first terminal device.
  • the first network device after receiving the first request, sends the second request to the first terminal device.
  • the second request is used to request to obtain the UAS identifier of the first terminal device.
  • step 1109 and step 1110 may not be performed to improve efficiency and save network resources.
  • the first terminal device In response to the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device.
  • the first network device sends the UAS identifier of the first terminal device and the new association indication information to the second network device.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the second network device sends a request for acquiring the first association information of the first terminal device to the first network device.
  • the first network device sends a request for obtaining first association information of the first terminal device to the first terminal device.
  • the first terminal device sends the first association information of the first terminal device to the first network device.
  • the first network device sends the first association information of the first terminal device to the second network device.
  • step 11121 to step 11124 may be executed in a process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • step 11121 to step 11124 may be executed after step 1111 and before step 1112.
  • step 11121 to step 11124 may be executed after step 1112.
  • FIG. 11 takes as an example the execution of steps 11121 to 11124 in the process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the first association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
  • the second network device determines that the first association information matches the second association information.
  • the second network device After receiving the first associated information, the second network device will search for associated information that matches the first associated information. In this embodiment of the application, the second network device finds that the first association information matches the second association information.
  • the matching of the first associated information with the second associated information may mean that the first associated information is the same as the second associated information. For example, the first associated information is the password "12345", and the second associated information is also the password "12345", then the first associated information matches the second associated information. If the first association information sent by the first terminal device matches the second association information sent by the second terminal device, the second network device determines the terminal device with which the first terminal device and the second terminal device want to establish an association relationship.
  • the second network device sends the UAS authentication result of the first terminal device and the UAS identification or SUPI or GPSI of the second terminal device to the first network device.
  • the UAS identifier or SUPI or GPSI of the second terminal device is used to indicate that the second terminal device wants to establish an association relationship with the first terminal device.
  • the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device, and send the UAS authentication result of the first terminal device to the second terminal device Or association indication information to indicate the association result between the first terminal device and the second terminal device.
  • the SUPI or GPSI of the second terminal device in the second network device may be sent by the first network device to the second network device or stored in the second network device with the UAS identifier of the second terminal device.
  • the SUPI or GPSI of the associated second terminal device may be sent by the first network device to the second network device or stored in the second network device with the UAS identifier of the second terminal device.
  • the second network device sends the UAS authentication result of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device to the first network device.
  • the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device.
  • the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
  • the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
  • the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the first terminal device itself determines the first terminal based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the device and the second terminal device are successfully associated.
  • the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the UAS of the first terminal device to the first terminal device
  • the authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information together to the second terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
  • the UAS authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
  • the first network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, step 1203 is executed, that is, a fourth request is sent to the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be newly added, then the indication information for indicating the failure of the newly-added association is sent to the second terminal device.
  • the first network device may store an identification list (such as a SUPI list or a GPSI list) of terminal devices that allow new association relationships, and if the second terminal device is in the identification list, it is determined that the association of the second terminal device is allowed to be added relationship. If the second terminal device is not in the identification list, it is determined that the association relationship of the second terminal device is not allowed to be added.
  • an identification list such as a SUPI list or a GPSI list
  • the first network device may store an identification list (such as a SUPI list or GPSI list) of terminal devices that are not allowed to add association relationships, and if the second terminal device is in the identification list, it is determined that the second terminal is not allowed to be added The association relationship of the device. If the second terminal device is not in the identification list, it is determined that the association relationship of the second terminal device is allowed to be added.
  • an identification list such as a SUPI list or GPSI list
  • the second network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, the UAS authentication is performed on the second terminal device based on the UAS identifier of the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be added, the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the second terminal device. Information indicating that the association failed.
  • the specific implementation principle please refer to the foregoing description, which will not be repeated here.
  • the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, step 1211 is executed, that is, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
  • the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
  • the second network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the UAS authentication is performed on the first terminal device based on the UAS identifier of the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be added, then the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the first terminal device. Information indicating that the association failed. For the specific implementation principle, please refer to the foregoing description, which is not repeated here.
  • the second network device may also store the association relationship between the first terminal device and the second terminal device.
  • step 1219 can be performed before step 1216 or after step 1216.
  • the second network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the foregoing step 1101 to step 1116 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1101 to step 1116.
  • FIG. 13 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the difference between the identity authentication method shown in FIG. 13 and the identity authentication method shown in FIG. 11 is that FIG. 11 is determined by the second network device that the first associated information matches the second associated information, and FIG. 13 is determined by the first network device It is determined that the first associated information and the second associated information match.
  • the identity authentication method includes the following steps 1131 to 1116. among them:
  • the second terminal device sends a third request to the first network device.
  • the third request carries the second authentication indication information and the newly added association indication information.
  • the second authentication indication information is used to request UAS authentication for the second terminal device.
  • the first network device sends a fourth request to the second terminal device.
  • the first network device after receiving the third request, sends the fourth request to the second terminal device.
  • the fourth request is used to request to obtain the UAS identifier of the second terminal device.
  • the second terminal device sends the UAS identifier of the second terminal device to the first network device.
  • the first network device sends the UAS identifier of the second terminal device to the second network device.
  • the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • the first network device sends a request for obtaining second association information of the second terminal device to the second terminal device.
  • the second terminal device sends the second association information of the second terminal device to the first network device.
  • step 13051 to step 13052 may be executed in a process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
  • steps 13051 to 13052 may be performed after step 1304 and before step 1305.
  • step 13051 to step 13052 may be performed after step 1305, or after step 1306, or after step 1307.
  • FIG. 13 takes as an example that steps 13051 to 13052 are performed during the UAS authentication of the second terminal device by the second network device based on the UAS identifier of the second terminal device.
  • the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
  • the second network device sends the UAS authentication result of the second terminal device to the first network device.
  • the first network device sends the UAS authentication result of the second terminal device to the second terminal device.
  • step 1301 to step 1307 please refer to the specific implementation manners of step 301 to step 307 above, which will not be repeated here.
  • step 1302 and step 1303 may not be performed to improve efficiency and save network resources.
  • the second terminal device sends the first request to the first network device.
  • the first request carries the first authentication indication information and the newly added association indication information.
  • the first authentication indication information is used to request UAS authentication for the first terminal device.
  • the newly-added association instruction information is used to request the newly-added association relationship.
  • the first network device sends a second request to the first terminal device.
  • the first network device after receiving the first request, sends the second request to the first terminal device.
  • the second request is used to request to obtain the UAS identifier of the first terminal device.
  • the first terminal device In response to the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device.
  • steps 1309 and 1310 may not be executed to improve efficiency and save network resources.
  • the first network device sends the UAS identifier of the first terminal device to the second network device.
  • the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the first network device sends a request for acquiring first association information of the first terminal device to the first terminal device.
  • the first terminal device sends the first association information of the first terminal device to the first network device.
  • step 13121 to step 13122 may be executed in a process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • step 13121 to step 13122 may be performed after step 1311 and before step 1312.
  • step 13121 to step 13122 may be performed after step 1312.
  • FIG. 11 takes as an example that steps 13121 to 13122 are performed in the process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
  • the first association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
  • the second network device sends the UAS authentication result of the first terminal device to the first network device.
  • the first network device determines that the first association information matches the second association information.
  • the first network device After receiving the first associated information, the first network device will search for associated information that matches the first associated information. In this embodiment of the application, the first network device finds that the first association information matches the second association information. Then, the first network device determines that the first terminal device and the second terminal device need to establish an association relationship. Therefore, the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device, and send the UAS authentication result of the first terminal device to the second terminal device Or associated instructions.
  • association indication information please refer to the previous description, which is not repeated here.
  • step 1314 may be performed before or after the first network device receives the UAS authentication result of the first terminal device.
  • the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device.
  • the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the UAS of the first terminal device to the first terminal device
  • the authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information together to the second terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
  • the UAS authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
  • the first network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, a fourth request is sent to the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be newly added, then the indication information for indicating the failure of the newly-added association is sent to the second terminal device.
  • the specific implementation principle please refer to the foregoing description, which will not be repeated here.
  • the first network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
  • the specific implementation principle please refer to the foregoing description, which will not be repeated here.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • step 1419 can be performed before step 1417 or after step 1417.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the first network device may also send the association relationship to the second network device for storage.
  • the foregoing steps 1301 to 1316 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing steps 1301 to 1316.
  • the first terminal device and the second terminal device can be authenticated, and the newly established association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
  • FIG. 15 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in Fig. 15 is different from Figs. 11-14 in that Figs. 11-14 are for authorizing or authenticating the newly-added association relationship during the UAS authentication process of the terminal device.
  • FIG. 15 shows the authorization or authentication of the newly-added association relationship after the UAS authentication of the first terminal device and the second terminal device are passed.
  • the identity authentication method includes the following steps 1501 to 1518. among them:
  • the first terminal device passes UAS authentication.
  • the second terminal device passes UAS authentication.
  • step 1503 and step 1505 are executed after step 1501 and step 1502, respectively.
  • the first terminal device sends a first association request to the first network device, where the first association request is used to request a new association relationship.
  • the first association request may carry the UAS identifier of the first terminal device, the terminal identifier (such as SUCI or GUTI), and the UAS type information of the first terminal device.
  • the UAS type information is used to indicate the device type of the first terminal device in the UAS.
  • the first network device sends the first association request to the second network device.
  • the first network device after receiving the first association request, sends the first association request to the second network device.
  • the first terminal device sends a second association request to the first network device, where the second association request is used to request a new association relationship.
  • the second association request may carry the UAS identifier of the second terminal device, the terminal identifier (such as SUCI or GUTI), and the UAS type information of the second terminal device.
  • the UAS type information is used to indicate the device type of the second terminal device in the UAS.
  • the first network device forwards the second association request to the second network device.
  • the first network device after receiving the second association request, sends the second association request to the second network device.
  • the second network device sends a first acquisition request to the first network device, where the first acquisition request is used to acquire the first association information.
  • the second network device after receiving the first association request, sends the first acquisition request to the first network device.
  • the first network device sends the first acquisition request to the first terminal device.
  • the first network device after receiving the first acquisition request, the first network device sends the first acquisition request to the first terminal device.
  • the second network device sends a second acquisition request to the first network device, where the second acquisition request is used to acquire second association information.
  • the second network device after receiving the second association request, sends the second acquisition request to the first network device.
  • the first network device sends the second acquisition request to the second terminal device.
  • the first network device after receiving the second acquisition request, the first network device sends the second acquisition request to the second terminal device.
  • the first terminal device sends the first association information to the first network device.
  • the first terminal device after receiving the first acquisition request, the first terminal device sends the first association information to the first network device.
  • the first association information and the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
  • the first network device sends the first association information to the second network device.
  • the first network device after receiving the first association information, the first network device sends the first association information to the second network device.
  • the second terminal device sends second association information to the first network device.
  • the second terminal device after receiving the second acquisition request, the second terminal device sends the second association information to the first network device.
  • the first network device sends second association information to the second network device.
  • the first network device after receiving the second association information, the first network device sends the second association information to the second network device.
  • the second network device determines that the first association information matches the second association information.
  • the second network device sends the association success indication information to the first network device.
  • the association success indication information is used to indicate that the first terminal device and the second terminal device are successfully associated.
  • the second network device after receiving the first association information and the second association information, the second network device can determine whether the first association information and the second association information match. If they match, step 1516 is executed, that is, the association success indication information is sent to the first network device. If the first association information matches the second association information, it indicates that the first terminal device and the second terminal device want to establish an association relationship. Since both the first terminal device and the second terminal device have passed UAS authentication, the second network device may send the association success indication information to the first network device.
  • the second network device may send the association failure indication information to the first network device, and the first network device sends the association failure indication information to the first network device.
  • the terminal device and the second terminal device may send the association failure indication information to the first network device, and the first network device sends the association failure indication information to the first network device.
  • step 1516 if the first association information matches the second association information, it is also possible to determine whether to perform step 1516 based on the UAS type information of the first terminal device and the UAS type information of the second terminal device. For example, if the UAS type information of the first terminal device and the UAS type information of the second terminal device are not the same, step 1516 is executed. If the UAS type information of the first terminal device and the UAS type information of the second terminal device are the same, the second network device sends association failure indication information to the first network device to indicate that the first terminal device and the second terminal device fail to associate. And the first network device sends the association failure indication information to the first terminal device and the second terminal device.
  • the first network device sends the association success indication information to the first terminal device.
  • the first network device sends the association success indication information to the second terminal device.
  • step 1501, step 1503, step 1504, step 1507, step 1508, step 1511, step 1512 are messages for the first terminal device
  • step 1502, step 1505, step 1506, step 1509, step 1510, Steps 1513 and 1514 are messages for the second terminal.
  • the present invention does not limit the sequence of executing the message directed to the first terminal device and executing the message directed to the second terminal device.
  • the message of the first terminal device and the message of the second terminal device are alternately performed, or the steps of the first terminal device may be executed first, and then the steps of the second terminal device may be executed, or various combinations may be used.
  • the sequence of step 1517 and step 1518 can also be interchanged.
  • the foregoing step 1501 to step 1518 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1501 to step 1518.
  • the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first acquisition request is sent to the first network device. Optionally, otherwise, sending indication information for indicating failure of the newly-added association to the first network device. The first network device sends the instruction information to the first terminal device. For how to determine whether to allow a new association relationship for the first terminal device, refer to the foregoing description.
  • the first network device may also determine whether to allow a new association relationship for the first terminal device. After receiving the first association request, the first network device determines whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the second network device. Otherwise, sending indication information for indicating failure of the newly added association to the first terminal device.
  • the second network device may store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the association relationship between the first terminal device and the second terminal device can be authenticated.
  • FIG. 17 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
  • the identity authentication method shown in Fig. 17 is different from Figs. 11-14 in that Figs. 11-14 are in the process of UAS authentication performed by the terminal device to authorize or authenticate the newly-added association relationship.
  • FIG. 17 shows the authorization or authentication of the newly-added association relationship after the UAS authentication of the first terminal device and the second terminal device are passed.
  • the identity authentication method includes the following steps 1701 to 1700. among them:
  • the first terminal device passes UAS authentication.
  • the second terminal device passes UAS authentication.
  • step 1703 and step 1705 are executed after step 1701 and step 1702, respectively.
  • the first terminal device sends a first association request to the first network device, where the first association request is used to request a new association relationship with the second terminal device.
  • the first association request may carry the UAS identifier of the first terminal device, the terminal identifier of the first terminal device (such as SUCI or GUTI), and the UAS type information of the first terminal device.
  • the first association request may also carry the UAS identifier of the second terminal device, the terminal identifier of the second terminal device (such as SUCI or GUTI), and the UAS type information of the second terminal device.
  • the UAS type information is used to indicate the device type of the device in the UAS.
  • the first network device sends the first association request to the second network device.
  • the first network device after receiving the first association request, sends the first association request to the second network device.
  • the second network device sends the first association request to the first network device.
  • the second network device after receiving the first association request, sends the first association request to the first network device.
  • the first network device sends the first association request to the second terminal device.
  • the first network device after receiving the first association request, sends the first association request to the second terminal device.
  • the second terminal device sends association confirmation instruction information to the first network device.
  • the second terminal device after receiving the first association request, sends the association confirmation instruction information to the first network device.
  • the second terminal device may also send association rejection indication information to the first network device, which is used to indicate rejection of association with the first terminal device. For example, after receiving the first association request, the second terminal device may output prompt information to prompt whether to accept the association request of the first terminal device.
  • the second terminal device After receiving the association confirmation operation, sends the association confirmation instruction information to the first network device.
  • the second terminal device After receiving the association rejection operation, sends the association rejection indication information to the first network device.
  • the first network device sends the association confirmation instruction information to the second network device.
  • the first network device after receiving the association confirmation instruction information, the first network device sends the association confirmation instruction information to the second network device.
  • the second network device sends the association success indication information to the first network device.
  • the second network device receives the association confirmation indication information, and sends the association success indication information to the first network device.
  • the association success indication information is used to indicate that the first terminal device and the second terminal device are successfully associated.
  • the second network device may also send the association failure indication information to the first network device, which is used to instruct the first terminal device and The second terminal device fails to associate. After receiving the association failure indication information, the first network device sends the association failure indication information to the first terminal device and the second terminal device.
  • the first network device sends the association success indication information to the first terminal device.
  • the first network device sends the association success indication information to the second terminal device.
  • the first network device after receiving the association success indication information, the first network device sends the association success indication information to the first terminal device and the second terminal device.
  • the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. Optionally, otherwise, sending indication information for indicating the failure of the newly-added association to the first network device. For how to determine whether to allow a new association relationship for the first terminal device, refer to the foregoing description.
  • the second network device may store the association relationship between the first terminal device and the second terminal device.
  • the first network device may also store the association relationship between the first terminal device and the second terminal device.
  • the foregoing step 1701 to step 1711 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1701 to step 1711.
  • the association relationship between the first terminal device and the second terminal device can be authenticated.
  • FIG. 19 shows a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the communication device shown in FIG. 19 may be used to perform part or all of the functions of the first network device in the method embodiments described in FIG. 3 to FIG. 17.
  • the device can be a network device, a device in a network device, or a device that can be matched and used with the network device.
  • the communication device may also be a chip system.
  • the communication device shown in FIG. 19 may include a receiving unit 1901 and a sending unit 1902. among them:
  • the receiving unit 1901 is configured to receive a first request sent by a first terminal device, the first request carries first authentication instruction information, and the first authentication instruction information is used to request UAS authentication for the first terminal device.
  • the terminal device is a device in the UAS;
  • the sending unit 1902 is used to send a second request to the first terminal device, the second request is used to request to obtain the UAS identifier of the first terminal device;
  • the receiving unit 1901 is also used to receive the first terminal device The UAS identifier of the first terminal device sent by the device;
  • the sending unit 1902 is also used to send the UAS identifier of the first terminal device to the second network device;
  • the receiving unit 1901 is also used to receive the first terminal device sent by the second network device
  • the sending unit 1902 is also used to send the UAS authentication result of the first terminal device to the first terminal device.
  • the first authentication indication information is registration type information or UAS type information of the first terminal device
  • the UAS type information indicates the device type of the first terminal device in the UAS.
  • the communication device further includes: a processing unit, configured to determine whether to perform UAS authentication for the first terminal device; the sending unit 1902 sends the second request to the first terminal device in a specific manner: When a terminal device performs UAS authentication, it sends a second request to the first terminal device.
  • a processing unit configured to determine whether to perform UAS authentication for the first terminal device
  • the sending unit 1902 sends the second request to the first terminal device in a specific manner: When a terminal device performs UAS authentication, it sends a second request to the first terminal device.
  • the method for the processing unit to determine whether to perform UAS authentication on the first terminal device is specifically: determining whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
  • the method for the device to perform UAS authentication is specifically: determining whether to perform UAS authentication for the first terminal device based on the received UAS type information.
  • the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type of the first terminal device in the UAS; the sending unit 1902 is further configured to send the first terminal device to the second network device.
  • UAS type information of a terminal device UAS type information of a terminal device.
  • the second request is also used to request to obtain the UAS type information of the first terminal device, and the UAS type information indicates the device type of the first terminal device in the UAS;
  • the receiving unit 1901 is also used to receive the first terminal device.
  • the sending unit 1902 is further configured to send the UAS type information of the first terminal device to the second network device.
  • the first network device further includes a processing unit configured to update the UAS authentication status of the first terminal device based on the UAS authentication result.
  • the receiving unit 1901 may also receive the UAS authentication result of the second terminal device associated with the first terminal device sent by the second network device;
  • the sending unit 1902 is further configured to send the UAS authentication result or association indication information of the second terminal device to the first terminal device, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information Obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device;
  • the sending unit 1902 is further configured to send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device , Or send the UAS authentication result and association indication information of the second terminal device.
  • the receiving unit 1901 may also receive the UAS identifier or SUPI or GPSI of the second terminal device sent by the second network device; Send the UAS identification of the second terminal device to the second network device; after the receiving unit 1901 receives the UAS authentication result of the second terminal device, the sending unit 1902 is further configured to send the UAS authentication result of the second terminal device to the first terminal device or Association indication information, the association indication information is used to indicate an association result between the first terminal device and the second terminal device, the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the sending unit 1902. It is also used to send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information to the second terminal device.
  • the first network device further includes a processing unit, which is used to determine whether the second terminal device is associated with the first terminal device after the receiving unit 1901 receives the UAS identifier or SUPI or GPSI of the second terminal device. The terminal device performs UAS authentication. If so, the sending unit 1902 sends the UAS identifier of the second terminal device to the second network device. Optionally, if it is determined that UAS authentication for the second terminal device is not allowed, the sending unit 1902 sends instruction information to the first terminal device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate.
  • a processing unit which is used to determine whether the second terminal device is associated with the first terminal device after the receiving unit 1901 receives the UAS identifier or SUPI or GPSI of the second terminal device. The terminal device performs UAS authentication. If so, the sending unit 1902 sends the UAS identifier of the second terminal device to the second network device. Optionally, if it is determined that UAS authentication for the second terminal device is not allowed, the sending unit 19
  • the first request also carries new association indication information.
  • the specific implementation manner of the sending unit 1902 sending the UAS identifier of the first terminal device to the second network device is: sending the UAS identifier of the first terminal device and the newly added association indication information to the second network device.
  • the sending unit 1902 sends to the first terminal device a request for acquiring the first association information of the first terminal device; receiving unit 1901 receives the first association information of the first terminal device sent by the first terminal device; the sending unit 1902 sends the first association information of the first terminal device to the second network device.
  • the specific implementation manner of the receiving unit 1901 receiving the UAS authentication result of the first terminal device sent by the second network device is: receiving the UAS authentication result of the first terminal device and the UAS identification of the second terminal device sent by the second network device or SUPI or GPSI; after the receiving unit 1901 receives the UAS authentication result of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device, the sending unit 1902 also sends the UAS authentication result or association of the second terminal device to the first terminal device Indication information, the association indication information is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
  • the sending unit 1902 may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the receiving unit 1901 may determine whether to allow the new association relationship of the first terminal device to be added. If it is allowed to add the association relationship of the first terminal device, the sending unit 1902 sends a second request to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, the sending unit 1902 sends to the first terminal device indication information for indicating that the newly-added association fails.
  • the first request also carries new association indication information, which is used to request a new association relationship.
  • the sending unit 1902 sends to the first terminal device for obtaining the first terminal device.
  • a request for the first association information of a terminal device the receiving unit 1901 receives the first association information sent by the first terminal device; the processing unit determines that the first association information matches the second association information sent by the second terminal device; the sending unit 1902 Send the UAS authentication result or association indication information of the second terminal device to the first terminal device, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS of the first terminal device
  • the authentication result and the UAS authentication result of the second terminal device are obtained; the sending unit 1902 sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
  • the processing unit may determine whether to allow the new association relationship of the first terminal device to be added. If it is allowed to add the association relationship of the first terminal device, the sending unit 1902 sends a second request to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, the sending unit 1902 sends to the first terminal device indication information for indicating that the newly-added association fails.
  • the processing unit may also store the association relationship between the first terminal device and the second terminal device.
  • the processing unit may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
  • the first request may also carry the UAS identifier of the first terminal device, so that the sending unit 1902 does not need to send the second request to the first terminal device, and the receiving unit 1901 does not need to receive the first terminal device.
  • FIG. 19 shows a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the communication device shown in FIG. 19 may be used to perform part or all of the functions of the first terminal device in the method embodiments described in FIG. 3 to FIG. 17.
  • the device may be a terminal device, a device in a terminal device, or a device that can be matched and used with the terminal device.
  • the communication device may also be a chip system.
  • the communication device shown in FIG. 19 may include a receiving unit 1901 and a sending unit 1902. among them:
  • the sending unit 1902 is configured to send a first request to a first network device, where the first request carries first authentication indication information, and the first authentication indication information is used to request UAS authentication for the communication device;
  • the receiving unit 1901 is configured to receive a second request sent by the first network device, where the second request is used to request to obtain the UAS identifier of the communication device;
  • the sending unit 1902 is further configured to send the UAS identifier of the communication device to the first network device in response to the second request;
  • the receiving unit 1901 is further configured to receive the UAS authentication result of the communication device sent by the first network device.
  • the first authentication indication information is registration type information, or UAS type information of the communication device, and the UAS type information indicates the device type of the communication device in the UAS.
  • the first request carries UAS type information of the communication device, and the UAS type information indicates the device type, service type, or service type of the communication device in the UAS.
  • the second request is also used to request to obtain UAS type information of the communication device
  • the sending unit 1902 is further configured to send UAS type information of the communication device to the first network device.
  • the receiving unit 1901 may also receive the UAS authentication result of the second terminal device associated with the first terminal device; the processing unit is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Determine the association result between the first terminal device and the second terminal device.
  • the receiving unit 1901 may also receive association indication information, where the association indication information is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information.
  • the first request also carries new association indication information.
  • the receiving unit 1901 may also receive the UAS authentication result of the second terminal device; the processing unit determines the association result of the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
  • the receiving unit 1901 may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS certification result was obtained.
  • the receiving unit 1901 receives a request sent by the first network device for obtaining the first association information of the first terminal device; the sending unit 1902 sends the first association information of the first terminal device to the first network device Information; the receiving unit 1901 may also receive the UAS authentication result of the second terminal device; the first terminal device determines the UAS authentication result of the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device Association results. Alternatively, the receiving unit 1901 may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS certification result was obtained.
  • the sending unit 1902 after passing UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship; the receiving unit 1901 receives the first network device's sending The sending unit 1902 sends the first association information to the first network device; the receiving unit 1901 receives the association success indication information, the association success indication information is used to indicate that the first terminal device is successfully associated with the second terminal device.
  • the sending unit 1902 after passing UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship with the second terminal device; the receiving unit 1901 receives Indication of successful association.
  • FIG. 20 shows a communication device 200 provided by an embodiment of this application, which is used to implement the function of the first network device in the foregoing method.
  • the device may be a network device or a device for a network device.
  • the network device can be AMF, SEAF, and so on.
  • the device used for the network device may be a chip system or a chip in the network device. Among them, the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the communication device 200 includes at least one processor 2020, configured to implement the data processing function of the first network device in the method provided in the embodiment of the present application.
  • the apparatus 200 may further include a communication interface 2010, which is used to implement the transceiving operation of the first network device in the method provided in the embodiment of the present application.
  • the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, which is used to communicate with other devices through a transmission medium.
  • the communication interface 2010 is used for the device in the device 200 to communicate with other devices.
  • the processor 2020 uses the communication interface 2010 to send and receive data, and is used to implement the method described in the foregoing method embodiment.
  • the device 200 may further include at least one memory 2030 for storing program instructions and/or data.
  • the memory 2030 and the processor 2020 are coupled.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • the processor 2020 may cooperate with the memory 2030 to operate.
  • the processor 2020 may execute program instructions stored in the memory 2030. At least one of the at least one memory may be included in the processor.
  • connection medium between the aforementioned communication interface 2010, the processor 2020, and the memory 2030 is not limited in the embodiment of the present application.
  • the memory 2030, the communication interface 2020, and the communication interface 2010 are connected by a bus 2040.
  • the bus is represented by a thick line in FIG. 20.
  • the connection mode between other components is only for schematic illustration. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used to represent in FIG. 20, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 2010 may output or receive a baseband signal.
  • the apparatus 200 is specifically the first network device, what the communication interface 2010 outputs or receives may be a radio frequency signal.
  • the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, which may implement or Perform the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • FIG. 21a shows a communication device 210 provided by an embodiment of the application, which is used to implement the function of the first terminal device in the foregoing method.
  • the device may be a terminal device or a device for terminal devices.
  • the terminal device may be a mobile phone, a wearable device, or a tablet computer.
  • the device used for the terminal device may be a chip system or a chip in the terminal device. Among them, the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the apparatus 210 includes at least one processor 2121, configured to implement the data processing function of the first terminal device in the method provided in the embodiment of the present application.
  • the apparatus 210 may further include a communication interface 2110, which is used to implement the receiving and sending operations of the first terminal device in the method provided in the embodiment of the present application.
  • the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces, which are used to communicate with other devices through a transmission medium.
  • the communication interface 2110 is used for the device in the device 210 to communicate with other devices.
  • the processor 2121 uses the communication interface 2110 to send and receive data, and is used to implement the method described in the foregoing method embodiment.
  • the device 210 may also include at least one memory 2130 for storing program instructions and/or data.
  • the memory 2130 and the processor 2121 are coupled.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • the processor 2121 may cooperate with the memory 2130.
  • the processor 2121 may execute program instructions stored in the memory 2130. At least one of the at least one memory may be included in the processor.
  • the embodiment of the present application does not limit the specific connection medium between the communication interface 2110, the processor 2121, and the memory 2130.
  • the memory 2130, the communication interface 2121, and the communication interface 2110 are connected by a bus 2140.
  • the bus is represented by a thick line in FIG. 21a.
  • the connection mode between other components is only for schematic illustration. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used to represent in FIG. 21a, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 2110 may output or receive a baseband signal.
  • the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, which may implement or Perform the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • FIG. 21b is a schematic structural diagram of another terminal device 2100 provided in an embodiment of this application.
  • the terminal device can perform the operations performed by the first terminal device in the foregoing method embodiment.
  • FIG. 21b only shows the main components of the terminal device.
  • the terminal device 2100 includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program, for example, to support the terminal device to execute the processes described in FIGS. 3-17.
  • the memory is mainly used to store software programs and data.
  • the radio frequency circuit is mainly used for the conversion of baseband signal and radio frequency signal and the processing of radio frequency signal.
  • the antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • the terminal device 2100 may also include input and output devices, such as a touch screen, a display screen, a keyboard, etc., which are mainly used to receive data input by the user and output data to the user. It should be noted that some types of terminal devices may not have input and output devices.
  • the processor can read the software program in the storage unit, interpret and execute the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal to the outside in the form of electromagnetic waves through the antenna.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 21b shows only one memory and a processor. In an actual terminal device, there may be multiple processors and memories.
  • the memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.
  • the processor may include a baseband processor and a central processing unit (CPU).
  • the baseband processor is mainly used to process communication protocols and communication data, and the CPU is mainly used to process the entire terminal.
  • the equipment controls, executes the software program, and processes the data of the software program.
  • the processor may also be a network processor (network processor, NP) or a combination of CPU and NP.
  • the processor may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
  • the memory may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include non-volatile memory (non-volatile memory), such as flash memory (flash memory) , Hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); the memory may also include a combination of the above types of memory.
  • the antenna and radio frequency circuit with the transceiver function can be regarded as the communication unit 2101 of the terminal device 2100, and the processor with the processing function can be regarded as the terminal device 2100.
  • the communication unit 2101 may also be called a transceiver, a transceiver, a transceiving device, etc., and is used to implement a transceiving function.
  • the device for implementing the receiving function in the communication unit 2101 can be regarded as the receiving unit, and the device for implementing the sending function in the communication unit 2101 as the sending unit, that is, the communication unit 2101 includes a receiving unit and a sending unit.
  • the receiving unit may also be called a receiver, a receiver, a receiving circuit, etc.
  • the sending unit may be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the communication unit 2101 and the processing unit 2102 may be integrated into one device or separated into different devices.
  • the processor and the memory may also be integrated into one device or separate into different devices.
  • the communication unit 2101 may be used to perform the transceiving operation of the first terminal device in the foregoing method embodiment.
  • the processing unit 2102 may be used to perform the data processing operation of the first terminal device in the foregoing method embodiment.
  • the embodiment of the present invention also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when it runs on a processor, the method flow of the foregoing method embodiment is realized.
  • the embodiment of the present invention also provides a computer program product.
  • the computer program product runs on a processor, the method flow of the above method embodiment is realized.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种身份认证方法，包括：第一网络设备接收第一终端设备发送的第一认证指示信息；第一网络设备向第一终端设备发送第二请求，用于请求获取第一终端设备的UAS标识；第一网络设备接收第一终端设备发送的第一终端设备的UAS标识，并向第二网络设备发送第一终端设备的UAS标识；第二网络设备基于UAS标识对第一终端设备进行UAS认证，并向第一网络设备发送第一终端设备的UAS认证结果。通过实施本申请实施例，能够防止未与移动通信网络运营商签约的无人机设备厂商生产的终端设备使用移动通信网络。

Description

身份认证方法及通信装置 技术领域
本发明涉及通信领域，尤其涉及一种身份认证方法及通信装置。
背景技术
无人机系统(unmanned aerial system，UAS)一般是由2部分设备组成，即无人机(unmanned aerial vehicle，UAV)和无人机的遥控器(UAV controller)。无人机可以自主或通过接收、遵从遥控器的指令进行飞行。另外，无人机和遥控器之间还可以传输数据，比如无人机通过航拍实施将照片、视频发送给遥控器(包括数据接收存储功能)。遥控器和无人机之间的通信(控制和数据传输)通常是通过无线信号(如WiFi)点到点直接连接进行的。
最近，有关使用移动通信网络来实现无人机和遥控器之间通信的观点引起了广泛关注。一方面，移动通信网络具有许多商业上的优势：广域覆盖，高可靠性，支撑高速移动性等，通过使用网络连接，无人机系统可以实现超视距高可靠的飞行。另一方面，移动通信网络也为监管部门提供了更为可靠的监管方式，防止出现类似无人机干扰飞机航班运营、以无人机发起恐怖袭击等事件，保障无人机系统的安全以及公共安全。然而将无人机系统引入移动通信网络之后，如何提高无人机系统设备接入、使用移动通信网络的安全性是目前亟待解决的问题。
发明内容
本发明实施例提供一种身份认证方法及装置，能够在移动通信网络中对无人机系统中的设备进行UAS认证，有利于提高无人机系统设备接入、使用移动通信网络的安全性。
第一方面，本申请实施例提供了一种身份认证方法，该方法包括：第一网络设备接收第一终端设备发送的第一请求，该第一请求携带第一认证指示信息，该第一认证指示信息用于请求对第一终端设备进行无人机系统UAS认证，该第一终端设备为UAS中的设备；第一网络设备向第一终端设备发送第二请求，该第二请求用于请求获取第一终端设备的UAS标识；第一网络设备接收第一终端设备发送的第一终端设备的UAS标识，并向第二网络设备发送第一终端设备的UAS标识；第二网络设备基于UAS标识对第一终端设备进行UAS认证；第二网络设备向第一网络设备发送第一终端设备的UAS认证结果；第一网络设备向第一终端设备发送第一终端设备的UAS认证结果。
可见，在第一方面所描述的方法中，能够基于第一终端设备的UAS标识来对第一终端设备进行认证。由于第一终端设备的UAS标识是设备厂商为第一终端设备配置的标识，或第一终端设备的UAS标识为UAS服务提供商/垂直行业为使用UAS系统的无人机系统用户或者UAS无人机系统服务/无人机系统业务提供的无人机系统用户/无人机系统服务标识。因此，基于第一方面所描述的方法，能够防止未与运营商签约的设备厂商生产的终端设备使用移动通信网络，或能够防止与运营商未签约的服务提供商或垂直行业的无人机系统用户/无人机系统服务/无人机系统业务在使用无人机(或遥控器)接入移动通信网络，提高了移动通信网络的安全性。
在一种可能的实现中，第一认证指示信息为注册类型信息，或第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型。通过注册类型信息来请求对第一终端设备进行UAS认证，能够避免新增一种信息来请求对第一终端设备进行UAS认证，可以减小对现有通信流程的改动。通过将第一终端设备的UAS类型信息作为第一认证指示信息，这样既能向第一网络设备通知第一终端设备的UAS类型，又能向第一网络设备请求进行UAS认证，即通过发送一种信息就能达到两个目的，有利于节省信令开销。
在一种可能的实现中，第一网络设备接收第一终端设备发送的第一请求之后，还可确定是否对第一终端设备进行UAS认证；第一网络设备具体在确定对第一终端设备进行UAS认证时，向第一终端设备发送第二请求。基于该可能的实现方式，可以先将不符合UAS认证要求的终端设备筛除，只对符合UAS认证要求的终端设备进行UAS认证，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第一网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第一网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证。例如，当第一终端设备的UAS认证状态标识指示的UAS认证状态为尚未认证状态时，第一网络设备确定对第一终端设备进行UAS认证。当第一终端设备的UAS认证状态标识指示的UAS认证状态为认证成功或认证失败状态时，确定不对第一终端设备进行UAS认证。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第一网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。
例如，当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息一致时，确定对第一终端设备进行UAS认证。当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致时，确定不对第一终端设备进行UAS认证。与第一终端设备的SUPI或GPSI对应的UAS类型信息可以理解为第一终端设备内的芯卡支持的UAS类型。如果第一网络设备确定第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不相匹配，则表明第一终端设备中的芯卡(如SIM卡)被错误地使用或被盗用在第一终端设备上。因此，如果第一网络设备确定第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致时，可以不继续后续的UAS认证流程。这样可以避免在第一终端设备错误地使用芯卡或使用被盗用的芯卡时，能够使用移动通信网络。
再如，当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致时，确定对第一终端设备进行UAS认证。当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息一致时，确定不对第一终端设备进行UAS认证。其中，SUPI或GPSI对应的UAS类型信息可以理解为SUPI或GPSI对应的芯卡不支持的UAS类型信息。
在一种可能的实现中，第二网络设备接收第一网络设备发送的UAS标识之后，第二网络设备确定是否对第一终端设备进行UAS认证；第二网络设备对第一终端设备进行UAS 认证的具体实现方式为：当第二网络设备确定对第一终端设备进行UAS认证时，第二网络设备基于UAS标识对第一终端设备进行UAS认证。基于该可能的实现方式，有利于减小第一网络设备和第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第二网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证。该可能的实现方式的具体实现方式和有益效果可参加上述第一网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证的具体实现方式和有益效果，在此不赘述。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，该UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备还可向第二网络设备发送第一终端设备的UAS类型信息；第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第二网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。该可能的实现方式的具体实现方式和有益效果可参加上述第一网络设备基于UAS类型信息确定是否对第一终端设备进行UAS认证的具体实现方式和有益效果，在此不赘述。
在一种可能的实现中，第二请求还用于请求获取第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备向第一终端设备发送第二请求之后，第一网络设备还可接收第一终端设备发送的第一终端设备的UAS类型信息，以及第一网络设备向第二网络设备发送第一终端设备的UAS类型信息；第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第二网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。该可能的实现方式的具体实现方式和有益效果可参加上述第一网络设备基于UAS类型信息确定是否对第一终端设备进行UAS认证的具体实现方式和有益效果，在此不赘述。
在一种可能的实现中，第一请求还携带第一终端设备的SUCI或GUTI，第一网络设备还可向第二网络设备发送第一终端设备的SUPI或GPSI，该第一终端设备的SUPI或GPSI根据第一终端设备的SUCI或GUTI得到；第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式为：第二网络设备基于UAS标识与第一终端设备的SUPI或GPSI确定是否对第一终端设备进行UAS认证。基于该可能的实现方式，可以防止随意更换第一终端设备的芯卡。
在一种可能的实现中，第一网络设备和第二网络设备还可基于UAS认证结果更新第一终端设备的UAS认证状态标识。这样后续就可以查找到第一终端设备的UAS认证状态。
在一种可能的实现中，第二网络设备接收第一终端设备的UAS标识之后，该方法还包括以下步骤：第二网络设备确定与第一终端设备相关联的第二终端设备的UAS标识；第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证；第二网络设备向第一网络设备发送第二终端设备的UAS认证结果；第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果，或发送第二终端设备的UAS认证结果和关联指示信息。基于该可能的实现方式，能够对第一终端设备和第二终端设备进行UAS认证， 并对存储的第一终端设备和第二终端设备之间的关联关系进行认证。
在一种可能的实现中，第二网络设备确定与第一终端设备相关联的第二终端设备的UAS标识之后，确定是否允许对第一终端设备和第二终端设备进行UAS认证。若允许对第一终端设备和第二终端设备进行UAS认证，则第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证，基于第二终端设备的UAS标识对第二终端设备进行UAS认证。可选的，确定不允许对第一终端设备和第二终端设备进行UAS认证，则第二网络设备向第一网络设备发送指示信息，该指示信息指示第一终端设备和第二终端设备关联失败，第一网络设备向第一终端设备和第二终端设备发送该指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备具体可以基于第一终端设备与第二终端设备之间的位置、距离确定是否允许对第一终端设备和第二终端设备进行UAS认证。第一终端设备与第二终端设备之间可以通过距离远近作为限制条件，从而拒绝不满足距离限制条件的第一终端设备与第二终端设备进行配对使用。因此，不需要认证第一终端设备与第二终端设备的关联关系，基于该可能的实现方式，有利于增强安全性、减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备接收第一终端设备的UAS标识之后，该方法还包括以下步骤：第二网络设备确定与第一终端设备相关联的第二终端设备的UAS标识或SUPI或GPSI；第二网络设备向第一网络设备发送与第一终端设备相关联的第二终端设备的UAS标识或SUPI或GPSI；第一网络设备接收第二终端设备的UAS标识或SUPI或GPSI之后，向第二网络设备发送第二终端设备的UAS标识；第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证；第二网络设备向第一网络设备发送第二终端设备的UAS认证结果；第一网络设备接收第二终端设备的UAS认证结果之后，向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或该关联指示信息。基于该可能的实现方式，能够对第一终端设备和第二终端设备进行UAS认证，并对存储的第一终端设备和第二终端设备之间的关联关系进行认证。
在一种可能的实现中，第一网络设备在接收与第一终端设备相关联的第二终端设备的UAS标识或SUPI或GPSI之后，确定是否对第二终端设备进行UAS认证。若是，则第一网络设备向第二网络设备发送第二终端设备的UAS标识。可选的，确定不允许对第二终端设备进行UAS认证，则第一网络设备向第一终端设备发送指示信息，该指示信息指示第一终端设备和第二终端设备关联失败。例如，第一网络设备可基于第二终端设备是否开机确定是否对第二终端设备进行UAS认证。再如，第一网络设备可基于第一终端设备与第二终端设备之间的位置、距离确定是否对第二终端设备进行UAS认证。
在一种可能的实现中，该第一请求还携带新增关联指示信息。第一网络设备向第二网络设备发送第一终端设备的UAS标识的具体实施方式为：第一网络设备向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息。第二网络设备接收第一终端设备的UAS标识和新增关联指示信息之后，该方法还包括以下步骤：第二网络设备向第一网络设备发送用于获取第一终端设备的第一关联信息的请求；第一网络设备向第一终端设备发送 用于获取第一终端设备的第一关联信息的请求；第一网络设备接收第一终端设备发送的第一终端设备的第一关联信息；第一网络设备向第二网络设备发送第一终端设备的第一关联信息；第二网络设备确定第一关联信息与第二关联信息相匹配。其中，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果的具体实施方式为：第二网络设备向第一网络设备发送第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI；第一网络设备接收第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI之后，第一网络设备还向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。第一网络设备还可向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。基于该可能的实现方式，能够对第一终端设备和第二终端设备进行UAS认证，并对新增的第一终端设备和第二终端设备之间的关联关系进行认证或授权。
在一种可能的实现中，第一网络设备接收该第一请求之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备接收第一终端设备的UAS标识和新增关联指示信息之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。可选的，如果不允许新增第一终端设备的关联关系，则向第一网络设备发送用于指示新增关联失败的指示信息，并由第一网络设备向第一终端设备发送该新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。可选的，第二网络设备还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省配对时间。
在一种可能的实现中，第一请求中还携带新增关联指示信息，用于请求新增关联关系，第一网络设备接收第一请求之后，第一网络设备还可执行以下步骤：向第一终端设备发送用于获取第一终端设备的第一关联信息的请求；第一网络设备接收第一终端设备发送的第一关联信息；第一网络设备确定第一关联信息与第二终端设备发送的第二关联信息相匹配；第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。基于该可能的实现方式，能够对第一终端设备和第二终端设备进行UAS认证，并对新增的第一终端设备和第二终端设备之间的关联关系进行认证。
在一种可能的实现中，第一网络设备接收该第一请求之后，可确定是否允许新增第一 终端设备的关联关系。如果允许新增第一终端设备的关联关系，则向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第一网络设备确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。可选的，第一网络设备还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。可选的，第一网络设备还可将该关联关系发送给第二网络设备进行存储。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省配对时间。
在一种可能的实现中，在第一终端设备UAS认证通过之后，该方法还包括以下步骤：
第一网络设备接收第一终端设备发送的第一关联请求，该第一关联请求用于请求新增关联关系；第一网络设备向第二网络设备发送该第一关联请求；第二网络设备向第一网络设备发送第一获取请求；第一网络设备向第一终端设备发送第一获取请求；第一网络设备接收第一终端设备发送的第一关联信息；第一网络设备向第二网络设备发送第一关联信息；第一网络设备接收第二终端设备发送的第二关联请求，该第二关联请求用于请求新增关联关系；第一网络设备向第二网络设备发送该第二关联请求；第二网络设备向第一网络设备发送第二获取请求；第一网络设备向第二终端设备发送第二获取请求；第一网络设备接收第二终端设备发送的第二关联信息；第一网络设备向第二网络设备发送第二关联信息；第二网络设备确定第一关联信息与第二关联信息相匹配；第二网络设备相第一网络设备发送关联成功指示信息；第一网络设备向第一终端设备和第二终端设备发送该关联成功指示信息。基于该可能的实现方式，能够对新增的第一终端设备和第二终端设备之间的关联关系进行认证或授权，避免了任意两个设备进行配对使用，有利于提高移动通信网络的安全性。
在一种可能的实现中，第二网络设备接收第一关联请求之后，还可确定是否允许为第一终端设备新增关联关系。若确定允许为第一终端设备新增关联关系，则向第一网络设备发送该第一关联请求。第二网络设备接收第二关联请求之后，还可确定是否允许为第二终端设备新增关联关系。若确定允许为第二终端设备新增关联关系，则向第一网络设备发送该第二关联请求。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备确定第一关联信息与第二关联信息相匹配之后，可以存储第一终端设备和第二终端设备的关联关系。或者，第一网络设备接收关联指示信息之后，也可以存储第一终端设备和第二终端设备的关联关系。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省关联或配对时间。
在一种可能的实现中，在第一终端设备UAS认证通过之后，该方法还包括以下步骤：第一网络设备从第一终端设备接收第一关联请求，该第一关联请求用于请求与第二终端设备新增关联关系；第一网络设备向第二网络设备发送该第一关联请求；第二网络设备向第一网络设备发送该第一关联请求；第一网络设备向第二终端设备发送该第一关联请求；第一网络设备接收第二终端设备发送的关联确认指示信息；第一网络设备向第二网络设备发送该关联确认指示信息；第二网络设备向第一网络设备发送关联成功指示信息；第一网络 设备向第一终端设备和第二终端设备发送关联成功指示信息。基于该可能的实现方式，能够对新增的第一终端设备和第二终端设备之间的关联关系进行认证。
在一种可能的实现中，第二网络设备接收第一关联请求之后，还可确定是否允许为第一终端设备新增关联关系。若确定允许为第一终端设备新增关联关系，则向第一网络设备发送该第一关联请求。可选的，否则，向第一网络设备发送用于指示新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第二网络设备接收到关联确认指示信息之后，可以存储第一终端设备和第二终端设备的关联关系。
在一种可能的实现中，第一网络设备接收关联成功指示信息之后，也可以存储第一终端设备和第二终端设备的关联关系。
在一种可能的实现中，第一请求也可以还携带第一终端设备的UAS标识，这样第一网络设备就不需要再向第一终端设备发送第二请求，以及不需要接收第一终端设备响应第二请求发送的UAS标识。在该可能的实现方式中，第一网络设备接收携带第一认证指示信息和第一终端设备的UAS标识的第一请求之后，向第二网络设备发送第一终端设备的UAS标识。基于该可能的实现方式，通过一次信息交互，第一网络设备就可以获取第一认证指示信息和第一终端设备的UAS标识，有利于更快地对第一终端设备进行UAS认证。
第二方面，本申请实施例提供了一种身份认证方法，该方法包括：第一网络设备接收第一终端设备发送的第一请求，该第一请求携带第一认证指示信息，该第一认证指示信息用于请求对第一终端设备进行无人机系统UAS认证，该第一终端设备为UAS中的设备；第一网络设备向第一终端设备发送第二请求，该第二请求用于请求获取第一终端设备的UAS标识；第一网络设备接收第一终端设备发送的第一终端设备的UAS标识；第一网络设备向第二网络设备发送第一终端设备的UAS标识；第一网络设备接收第二网络设备发送的第一终端设备的UAS认证结果；第一网络设备向第一终端设备发送第一终端设备的UAS认证结果。
在一种可能的实现中，第一认证指示信息为注册类型信息，或第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型。
在一种可能的实现中，第一网络设备接收第一终端设备发送的第一请求之后，第一网络设备还可确定是否对第一终端设备进行UAS认证；第一网络设备向第一终端设备发送第二请求的具体实施方式为：当第一网络设备确定对第一终端设备进行UAS认证时，第一网络设备向第一终端设备发送第二请求。
在一种可能的实现中，第一网络设备确定是否对第一终端设备进行UAS认证的具体实施方式为：第一网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，该UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备确定是否对第一终端设备进行UAS认证的具体实施方式为：第一网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备还可 向第二网络设备发送第一终端设备的UAS类型信息。
在一种可能的实现中，第二请求还用于请求获取第一终端设备的UAS类型信息，该UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型；第一网络设备向第一终端设备发送第二请求之后，第一网络设备还可接收第一终端设备发送的第一终端设备的UAS类型信息；第一网络设备还可向第二网络设备发送第一终端设备的UAS类型信息。
在一种可能的实现中，第一网络设备基于UAS认证结果更新第一终端设备的UAS认证状态。
在一种可能的实现中，第二网络设备接收第一终端设备的UAS标识之后，该方法还包括以下步骤：第一网络设备接收第二网络设备发送的与第一终端设备相关联的第二终端设备的UAS认证结果；第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果，或发送第二终端设备的UAS认证结果和关联指示信息。基于该可能的实现方式，能够对第一终端设备和第二终端设备进行UAS认证，并对存储的第一终端设备和第二终端设备之间的关联关系进行认证或授权，避免了任意两个设备进行配对使用，有利于提高移动通信网络的安全性。
在一种可能的实现中，第一网络设备向第二网络设备发送第一终端设备的UAS标识之后，该方法还包括以下步骤：第一网络设备接收第二网络设备发送的第二终端设备的UAS标识或SUPI或GPSI；向第二网络设备发送第二终端设备的UAS标识；第一网络设备接收第二终端设备的UAS认证结果之后，向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或该关联指示信息。
在一种可能的实现中，第一网络设备在接收与第一终端设备相关联的第二终端设备的UAS标识或SUPI或GPSI之后，确定是否对第二终端设备进行UAS认证。若是，则第一网络设备向第二网络设备发送第二终端设备的UAS标识。可选的，确定不允许对第二终端设备进行UAS认证，则第一网络设备向第一终端设备发送指示信息，该指示信息指示第一终端设备和第二终端设备关联失败。例如，第一网络设备可基于第二终端设备是否开机确定是否对第二终端设备进行UAS认证。再如，第一网络设备可基于第一终端设备与第二终端设备之间的位置、距离确定是否对第二终端设备进行UAS认证。
在一种可能的实现中，该第一请求还携带新增关联指示信息。第一网络设备向第二网络设备发送第一终端设备的UAS标识的具体实施方式为：第一网络设备向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息。第一网络设备向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息之后，该方法还包括以下步骤：第一网络设备向第一终端设备发送用于获取第一终端设备的第一关联信息的请求；第一网络设备接收第一终端设备发送的第一终端设备的第一关联信息；第一网络设备向第二网络设备发送第一终端设备的第一关联信息。其中，第一网络设备接收第二网络设备发送的第一终端设 备的UAS认证结果的具体实施方式为：第一网络设备接收第二网络设备发送的第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI；第一网络设备接收第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI之后，第一网络设备还向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。第一网络设备还可向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，第一网络设备接收该第一请求之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第一请求中还携带新增关联指示信息，用于请求新增关联关系，第一网络设备接收第一请求之后，第一网络设备还可执行以下步骤：向第一终端设备发送用于获取第一终端设备的第一关联信息的请求；第一网络设备接收第一终端设备发送的第一关联信息；第一网络设备确定第一关联信息与第二终端设备发送的第二关联信息相匹配；第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；第一网络设备向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，第一网络设备接收该第一请求之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。基于该可能的实现方式，有利于减小第二网络设备的认证工作量。
在一种可能的实现中，第一网络设备确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。可选的，第一网络设备还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。可选的，第一网络设备还可将该关联关系发送给第二网络设备进行存储。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省配对时间。
在一种可能的实现中，第一请求也可以还携带第一终端设备的UAS标识，这样第一网络设备就不需要再向第一终端设备发送第二请求，以及不需要接收第一终端设备响应第二请求发送的UAS标识。在该可能的实现方式中，第一网络设备接收携带第一认证指示信息和第一终端设备的UAS标识的第一请求之后，向第二网络设备发送第一终端设备的UAS标识。基于该可能的实现方式，通过一次信息交互，第一网络设备就可以获取第一认证指示信息和第一终端设备的UAS标识，有利于更快地对第一终端设备进行UAS认证。
其中，第二方面和第二方面的可能的实现方式的有益效果，可参见上述第一方面和第一方面的可能的实现方式的有益效果，在此不赘述。
第三方面，本申请实施例提供了一种身份认证方法，该方法包括：第一终端设备向第一网络设备发送第一请求，第一请求携带第一认证指示信息，第一认证指示信息用于请求对第一终端设备进行UAS认证；第一终端设备接收第一网络设备发送的第二请求，第二请求用于请求获取第一终端设备的UAS标识；第一终端设备响应于第二请求，向第一网络设备发送第一终端设备的UAS标识；第一终端设备接收第一网络设备发送的第一终端设备的UAS认证结果。
在一种可能的实现中，第一认证指示信息为注册类型信息，或第一终端设备的UAS类型信息，该UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，该UAS类型信息指示第一终端设备在UAS中的设备类型、业务类型、或者服务类型。
在一种可能的实现中，第二请求还用于请求获取第一终端设备的UAS类型信息，第一终端设备还可向第一网络设备发送第一终端设备的UAS类型信息。
在一种可能的实现中，第一终端设备还可接收与第一终端设备关联的第二终端设备的UAS认证结果；第一终端设备基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，第一终端设备还可接收关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。
在一种可能的实现中，第一请求还携带新增关联指示信息。第一终端设备还可接收第二终端设备的UAS认证结果；第一终端设备基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，第一终端设备还可接收关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。
在一种可能的实现中，第一终端设备接收第一网络设备发送的用于获取第一终端设备的第一关联信息的请求；第一终端设备向第一网络设备发送第一终端设备的第一关联信息；第一终端设备还可接收第二终端设备的UAS认证结果；第一终端设备基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，第一终端设备还可接收关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。
在一种可能的实现中，第一终端设备在通过UAS认证之后，第一终端设备向第一网络设备发送第一关联请求，该第一关联请求用于请求新增关联关系；第一终端设备接收第一网络设备发送的第一获取请求；第一终端设备向第一网络设备发送第一关联信息；第一终端设备接收关联成功指示信息，该关联成功指示信息用于指示第一终端设备与第二终端设备关联成功。
在一种可能的实现中，第一终端设备在通过UAS认证之后，向第一网络设备发送第一关联请求，该第一关联请求用于请求与第二终端设备新增关联关系；第一终端设备接收关联成功指示信息。
在一种可能的实现中，第一请求也可以还携带第一终端设备的UAS标识，这样第一 网络设备就不需要再向第一终端设备发送第二请求，以及不需要接收第一终端设备响应第二请求发送的UAS标识。
其中，第三方面和第三方面的可能的实现方式的有益效果，可参见上述第一方面和第一方面的可能的实现方式的有益效果，在此不赘述。
第四方面，提供了一种通信装置，该装置可以是网络设备，也可以是网络设备中的装置，或者是能够和网络设备匹配使用的装置。其中，该通信装置还可以为芯片系统。该通信装置可执行第二方面所述的方法。该通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元。该单元可以是软件和/或硬件。该通信装置执行的操作及有益效果可以参见上述第二方面所述的方法以及有益效果，重复之处不再赘述。
第五方面，提供了一种通信装置，该装置可以是终端设备，也可以是终端设备中的装置，或者是能够和终端设备匹配使用的装置。其中，该通信装置还可以为芯片系统。该通信装置可执行第三方面所述的方法。该通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元。该单元可以是软件和/或硬件。该通信装置执行的操作及有益效果可以参见上述第三方面所述的方法以及有益效果，重复之处不再赘述。
第六方面，本申请实施例提供一种通信装置，该通信装置可以为网络设备，也可以是网络设备中的装置，或者是能够和网络设备匹配使用的装置。或可以为网络设备内的芯片。所述通信装置包括包括通信接口和处理器，所述通信接口用于该装置与其它设备进行通信，例如数据或信号的收发。示例性的，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口，其它设备可以为终端设备或网络设备。处理器用于调用一组程序、指令或数据，执行上述第二方面描述的方法。所述装置还可以包括存储器，用于存储处理器调用的程序、指令或数据。所述存储器与所述处理器耦合，所述处理器执行所述存储器中存储的、指令或数据时，可以实现上述第二方面描述的方法。
第七方面，本申请实施例提供一种通信装置，该通信装置可以为终端设备，也可以是终端设备中的装置，或者是能够和终端设备匹配使用的装置。或可以为终端设备内的芯片。所述通信装置包括包括通信接口和处理器，所述通信接口用于该装置与其它设备进行通信，例如数据或信号的收发。示例性的，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口，其它设备可以为网络设备。处理器用于调用一组程序、指令或数据，执行上述第三方面描述的方法。所述装置还可以包括存储器，用于存储处理器调用的程序、指令或数据。所述存储器与所述处理器耦合，所述处理器执行所述存储器中存储的、指令或数据时，可以实现上述第三方面描述的方法。
第八方面，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，还可以包括存储器，用于实现上述第二方面或第三方面所述的方法。该芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。
第九方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质用于存储指令，当所述指令被执行时，使得第一方面或第三方面所述的方法被实现。
第十方面，本申请实施例提供一种包括指令的计算机程序产品，当所述指令被执行时，使得第一方面或第三方面所述的方法被实现。
附图说明
图1是本申请实施例提供的一种5G系统架构的示意图；
图2是本申请实施例提供的一种基于移动通信网络的无人机系统的流程示意图；
图3是本申请实施例提供的一种身份认证方法的流程示意图；
图4是本申请实施例提供的另一种身份认证方法的流程示意图；
图5是本申请实施例提供的又一种身份认证方法的流程示意图；
图6是本申请实施例提供的又一种身份认证方法的流程示意图；
图7是本申请实施例提供的又一种身份认证方法的流程示意图；
图8是本申请实施例提供的又一种身份认证方法的流程示意图；
图9是本申请实施例提供的又一种身份认证方法的流程示意图；
图10是本申请实施例提供的又一种身份认证方法的流程示意图；
图11是本申请实施例提供的又一种身份认证方法的流程示意图；
图12是本申请实施例提供的又一种身份认证方法的流程示意图；
图13是本申请实施例提供的又一种身份认证方法的流程示意图；
图14是本申请实施例提供的又一种身份认证方法的流程示意图；
图15是本申请实施例提供的又一种身份认证方法的流程示意图；
图16是本申请实施例提供的又一种身份认证方法的流程示意图；
图17是本申请实施例提供的又一种身份认证方法的流程示意图；
图18是本申请实施例提供的又一种身份认证方法的流程示意图；
图19是本申请实施例提供的一种通信装置的结构示意图；
图20是本申请实施例提供的另一种通信装置的结构示意图；
图21a是本申请实施例提供的又一种通信装置的结构示意图；
图21b是本申请实施例提供的又一种通信装置的结构示意图。
具体实施方式
下面结合附图对本申请具体实施例作进一步的详细描述。
下面首先对本申请实施例应用的通信系统进行介绍：
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(global system of mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或新无线(new radio，NR)以及未来的通信系统等。
以本申请实施例应用于5G系统为例，以下对5G系统中的相关网元进行详细介绍：
请参见图1，图1示出的网络架构以3GPP标准化过程中定义的基于服务化架构的5G网络架构为例。如图1所示，该网络架构可以包括三部分，分别是终端设备部分、运营商网络和数据网络(data network，DN)。
终端设备部分包括终端设备110，终端设备110也可以称为用户设备(user equipment，UE)。本申请实施例中的终端设备110是一种具有无线收发功能的设备，可以经接入网(access network，AN)140中的接入网设备与一个或多个核心网(core network，CN)进行通信。终端设备110也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线网络设备、用户代理或用户装置等。终端设备110可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端设备110可以是蜂窝电话(cellular phone)、无绳电话、会话启动协议(session initiation protocol，SIP)电话、智能电话(smart phone)、手机(mobile phone)、无线本地环路(wireless localloop，WLL)站、个人数字处理(personal digital assistant，PDA)，可以是具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它设备、车载设备、可穿戴设备、无人机设备或物联网、车联网中的终端、第五代移动通信(fifth generation，5G)网络以及未来网络中的任意形态的终端、中继用户设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端等，其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。例如终端设备110可以是虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。本申请实施例对此并不限定。
各种通信系统中由运营者运营的部分可称为运营商网络。运营商网络也可称为公共陆地移动网络(public land mobile network，PLMN)网络，是由政府或它所批准的经营者，为公众提供陆地移动通信业务目的而建立和经营的网络，主要是移动网络运营商(mobile network operator，MNO)为用户提供移动宽带接入服务的公共网络。本申请实施例中所描述的运营商网络或PLMN网络，具体可为符合第三代合作伙伴项目(3rd generation partnership project，3GPP)标准要求的网络，简称3GPP网络。通常3GPP网络由运营商来运营，包括但不限于第五代移动通信(5th-generation，5G)网络(简称5G网络)、第四代移动通信(4th-generation，4G)网络(简称4G网络)、第三代移动通信技术(3rd-generation，3G)网络(简称3G网络)和第二代无线电话技术(2nd-generation wireless telephone technology，2G)网络(简称2G网络)等。为了方便描述，本申请实施例中将以运营商网络(即MNO网络)为例进行说明。
运营商网络可以包括网络开放功能(network exposure function，NEF)131、网络存储功能(network function repository function，NRF)132、策略控制功能(policy control function，PCF)133、统一数据管理(unified data management，UDM)网元134、应用功能(application function，AF)135、认证服务器功能(authentication server function，AUSF)136、接入与移动性管理功能(access and mobility management function，AMF)137、会话管理功能(session management function，SMF)138、用户面功能(user plane function，UPF)139以及(无线)接入网((radio)access network，(R)AN)140等。上述运营商网络中，除(无线)接入网140部分之外的部分可以称为核心网络(core network，CN)部分或核心网部分。为方便说明，本申请实施例中以(R)AN 140为RAN为例进行说明。
数据网络DN 120，也可以称为分组数据网络(packet data network，PDN)，通常是位 于运营商网络之外的网络，例如第三方网络。运营商网络可以接入多个数据网络DN 120，数据网络DN 120上可部署多种业务，可为终端设备110提供数据和/或语音等服务。例如，数据网络DN 120可以是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备110，数据网络DN 120中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，数据网络DN 120可以是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备110，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
终端设备110可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备110还可通过运营商网络访问数据网络DN 120，使用数据网络DN 120上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为运营商网络和终端设备110之外的服务方，可为终端设备110提供其他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
下面对运营商网络中的网络功能进行简要介绍。
接入网RAN 140是运营商网络的子网络，是运营商网络中业务节点与终端设备110之间的实施系统。终端设备110要接入运营商网络，首先是经过RAN 140，进而可通过RAN140与运营商网络的业务节点连接。本申请实施例中的接入网设备(RAN设备)，是一种为终端设备110提供无线通信功能的设备，也可以称为网络设备，RAN设备包括但不限于：5G系统中的下一代基站节点(next generation node basestation，gNB)、长期演进(long term evolution，LTE)中的演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。应理解，本文对接入网设备的具体类型不作限定。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。为方便描述，本申请所有实施例中，上述为终端设备110提供无线通信功能的装置统称为接入网设备。
接入与移动性管理功能AMF(也可以称为AMF网络功能或AMF网络功能实体)137是由运营商网络提供的控制面网络功能，负责终端设备110接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
会话管理功能SMF(也可以称为SMF网络功能或SMF网络功能实体)138是由运营商网络提供的控制面网络功能，负责管理终端设备110的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与数据网络DN 120互相传送PDU。PDU会话由SMF网络功能138负责建立、维护和删除等。SMF网络功能138包括会话管理(如会话建立、修改和释放，包含用户面功能UPF 139和接入网AN 140之间的隧道维护)、UPF网络功能139的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
用户面功能UPF(也可以称为UPF网络功能或UPF网络功能实体)139是由运营商提供的网关，是运营商网络与数据网络DN 120通信的网关。UPF网络功能139包括数据 包路由和传输、包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
统一数据管理网元UDM(也可以称为UDM网络功能或UDM网络功能实体)134是由运营商提供的控制面功能，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、信任状(credential)、安全上下文(security context)、签约数据等信息。其中SUPI在传输过程中会先进行加密，加密后的SUPI被称为隐藏的用户签约标识符(subscription concealed identifier，SUCI)。UDM网络功能134所存储的这些信息可用于终端设备110接入运营商网络的认证和授权。其中，上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的手机芯卡的用户，或者使用中国移动的手机芯卡的用户等。上述签约用户的永久签约标识SUPI可为该手机芯卡的号码等。上述签约用户的信任状、安全上下文可为该手机芯卡的加密密钥或者跟该手机芯卡加密相关的信息等存储的小文件，用于认证和/或授权。上述安全上下文可为存储在用户本地终端(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可为该手机芯卡的配套业务，例如该手机芯卡的流量套餐或者使用网络等。需要说明的是，永久标识符、信任状、安全上下文、认证数据(cookie)、以及令牌等同认证、授权相关的信息，在本申请实施例中，为了描述方便起见不做区分、限制。如果不做特殊说明，本申请实施例将以用安全上下文为例来进行描述，但本申请实施例同样适用于其他表述方式的认证、和/或授权信息。
认证服务器功能AUSF(也可以称为AUSF网络功能或AUSF网络功能实体)136是由运营商提供的控制面功能，通常用于一级认证，即终端设备110(签约用户)与运营商网络之间的认证。AUSF网络功能136接收到签约用户发起的认证请求之后，可通过UDM网络功能134中存储的认证信息和/或授权信息对签约用户进行认证和/或授权，或者通过UDM网络功能134生成签约用户的认证和/或授权信息。AUSF网络功能136可向签约用户反馈认证信息和/或授权信息。
网络开放功能NEF(也可以称为NEF网络功能或NEF网络功能实体)131是由运营商提供控制面功能。NEF网络功能131以安全的方式对第三方开放运营商网络的对外接口。在SMF网络功能138需要与第三方的网络功能通信时，NEF网络功能131可作为SMF网络功能138与第三方的网络实体通信的中继。NEF网络功能131作为中继时，可作为签约用户的标识信息的翻译，以及第三方的网络功能的标识信息的翻译。比如，NEF网络功能131将签约用户的SUPI从运营商网络发送到第三方时，可以将SUPI翻译成其对应的外部身份标识(identity，ID)。反之，NEF网络功能131将外部ID(第三方的网络实体ID)发送到运营商网络时，可将其翻译成SUPI。
策略控制功能PCF(也可以称为PCF网络功能或PCF网络功能实体)133是由运营商提供的控制面功能，用于向SMF网络功能138提供PDU会话的策略。策略可以包括计费相关策略、QoS相关策略和授权相关策略等。
网络切片选择功能(network slice selection function，NSSF)(图中未示出)，负责确定网络切片实例，选择AMF网络功能137等。
图1中Nnef、Nausf、Nnrf、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号。这些接口序列号的含义可参见3GPP标准协议中定义的含义，在此不做限制。需要说明的是，图1中仅以终端设备110为UE作出了示例性说明，图1中 的各个网络功能之间的接口名称也仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请实施例对此不做具体限定。
本申请实施例中的移动性管理网络功能可以是图1所示的AMF网络功能137，也可以是未来通信系统中的具有上述AMF网络功能137的其他网络功能。或者，本申请中的移动性管理网络功能还可以是长期演进(long term evolution，LTE)中的移动性管理实体(mobility management entity，MME)等。
为方便说明，本申请实施例中以移动性管理网络功能为AMF网络功能137为例进行说明。进一步地，将AMF网络功能137简称为AMF，将终端设备110称为UE，即本申请实施例中后文所描述的AMF均可替换为移动性管理网络功能，UE均可替换为终端设备。
图1中示出的网络架构(例如5G网络架构)采用基于服务的架构和通用接口，传统网元功能基于网络功能虚拟化(network function virtualization，NFV)技术拆分成若干个自包含、自管理、可重用的网络功能服务模块，通过灵活定义服务模块集合，可以实现定制化的网络功能重构，对外通过统一的服务调用接口组成业务流程。图1中示出的网络架构示意图可以理解为一种非漫游场景下基于服务的5G网络架构示意图。对于漫游场景，本申请实施例同样适用。
最近，有关使用移动通信网络来实现无人机和遥控器之间通信的观点引起了广泛关注。一方面，移动通信网络具有许多商业上的优势：广域覆盖，高可靠性，支撑高速移动性等，通过使用网络连接，无人机系统可以实现超视距高可靠的飞行。另一方面，移动通信网络也为监管部门提供了更为可靠的监管方式，防止出现类似无人机干扰飞机航班运营、以无人机发起恐怖袭击等事件，保障无人机系统的安全以及公共安全。
为了提高无人机接入或使用移动通信网络的安全性，需要对使用移动通信网络的无人机系统的终端设备进行认证，或者需要对使用终端设备的无人机系统用户进行认证，再或者需要对利用终端设备进行的一项无人机系统服务/无人机系统业务进行认证。认证通过之后，终端设备或者无人机系统用户或者该项无人机系统服务/无人机系统业务才能使用移动通信网络。在现有的设备认证流程中，移动通信网络中的核心网设备是基于PLMN预先配置的终端标识(如SUPI)和对应的信任状对终端设备进行身份认证。然而PLMN预先配置的终端标识是与芯卡(如SIM卡，或Subscriber Identification Module卡，也称为签约用户身份识别模块/卡)一一对应的。同一张SIM卡配置于任何一个终端设备中，在相同情况下的认证结果均相同。即PLMN预先配置的终端标识和对应的信任状和终端设备本身没有直接的关系。例如，如果将SIM卡配置于终端设备1中，终端设备1基于该SIM卡对应的终端标识(如SUPI)能够通过身份认证。那么在相同的情况下，将SIM卡配置于终端设备2中，终端设备2基于该SIM卡对应的终端标识(如SUPI)也可以通过身份认证。因此，通过现有的设备认证流程对终端设备进行认证，与运营商未签约的设备厂商生产的无人机或遥控器终端设备也可以接入移动通信网络，这对移动通信网络的安全性造成了影响。类似地，通过现有的设备认证流程对终端设备进行认证，与移动通信网络运营商未签约的服务提供商或垂直行业的无人机系统用户使用无人机或遥控器时(通过了现有的基于SIM卡的设备认证)也可以接入移动通信网络，与移动通信网络运营商未签约的服务提供商或垂直行业的无人机系统服务/无人机系统业务在使用无人机或遥控器时(通过了现有的基于SIM卡的设备认证)也可以接入移动通信网络，这对移动通信网络的安全性造成了影 响。
为此，本申请实施例提供了一种身份认证方法及装置，能够基于终端设备(无人机或遥控器)的UAS标识对终端设备进行身份认证，终端设备的UAS标识可以是1)设备厂商为设备本身分配的身份标识；2)UAS服务提供商/垂直行业为使用UAS系统的无人机系统用户或者无人机系统服务/无人机系统业务提供的无人机系统用户/无人机系统服务/无人机系统业务的标识；3)其他与无人机系统相关的不同于SIM卡的标识。终端设备的UAS标识、或者UAS系统的用户标识、或者服务/业务标识等是不同于SIM卡标识的用户标识。因此，基于终端设备的UAS标识对终端设备进行身份认证，能够防止与运营商未签约的设备厂商生产的无人机(或遥控器)接入移动通信网络，或者，能够防止与运营商未签约的服务提供商或垂直行业的无人机系统用户/无人机系统服务/无人机系统业务使用无人机(或遥控器)接入移动通信网络，提高了移动通信网络的安全性。同时，基于终端设备的UAS标识对终端设备进行身份认证，还能够让无人机设备厂商/无人机系统服务提供商/垂直行业对其生产/服务/拥有的无人机系统设备能否接入移动通信网络具有一定的控制管理权。
需要说明的是，在本发明所述的标识，不局限于设备厂商、服务提供商、垂直行业等实体进行颁发，还可以是其他任意实体。下面仅以设备厂商为设备颁发的标识为例进行描述，对于其他标识，本申请实施例同样适用。
下面对本申请实施例的系统架构进行介绍：
请参见图2，图2是本申请实施例提供的一种基于移动通信网络的无人机系统的系统架构。如图2所示，该系统架构中包括无人机、无人机遥控器、无线接入网(radioaccess network，RAN)、核心网(core network，CN)和第二网络设备。其中，核心网中包括第一网络设备。第二网络设备可以位于核心网内，也可以位于核心网之外。
其中，移动通信网络可以为上述介绍的通信系统的网络，例如可以为：全球移动通讯(global system of mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线无人机系统业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或新无线(new radio，NR)以及未来的通信系统等中的移动通信网络。
其中，RAN1和RAN2分别为遥控器和无人机提供服务。如果遥控器和无人机在同一个RAN覆盖下，那么这2个RAN也可以指代同一个RAN。类似地，CN1和CN2分别向RAN1和RAN2提供服务，如果无人机和遥控器接入的RAN(RAN1和RAN2可以相同或不同)由同一个CN提供服务，那么这2个核心网也可以指代同一个核心网。两个第一网络设备可以指代同一个第一网络设备。在图2所示的系统中，无人机遥控器通过网络对无人机进行控制，与无人机进行通信交互。如遥控器发出指令是经过RAN1、CN1、CN2、RAN2发送到达无人机。当移动通信系统为5G通信系统时，与图1相对照，在图2中，无人机系统(Unmanned Aerial System，UAS)中的无人机(Unmanned Aerial Vehicle，UAV)和无人机遥控器(UAV controller)分别对应于图1中的2个不同的UE110。这里的RAN 分别对应于图1中2个接入网AN140。
其中，无人机也可称为无人飞行器或飞行器等。无人机遥控器可以是专为遥控无人机而生产的设备，或者可以是智能手机、穿戴设备等上述描述的终端设备110中的任意一项。
其中，第一网络设备可以为接入与移动性管理功能(access and mobility management function，AMF)或安全锚点功能(Security Anchor Function，SEAF)或其他核心网设备。
AMF：关于AMF的描述可参见上述对图1中AMF的描述，在此不赘述。
SEAF：核心网中与AUSF以及NG-UE交互的认证功能，并且从AUSF接受NG-UE认证过程中产生的中间密钥(intermediate key)。SEAF还会与MM功能以及SCMF进行交互。它位于运营商网络的安全环境中，不会暴露给非授权的访问。漫游场景中，SEAF位于拜访网络。
其中，第二网络设备可以位于核心网内，也可以位于核心网之外。第二网络设备可以为无人机流量管理(Unmaned Aerial Vehicle Traffic Management，UTM)设备，或可以为其他核心网设备或非核心网设备。
本申请实施例中，第二网络设备中存储有无人机和遥控器的相关信息，例如，存储有签约的设备厂商在出厂时为无人机(或遥控器)分配的UAS标识和信任状。每个无人机(或遥控器)都有出厂时配置的唯一(一个或多个)UAS标识和相应的信任状(credentials)。不同的无人机(或遥控器)对应不同的UAS标识和信任状。在无人机(或遥控器)需要接入移动通信网络时，第二网络设备基于无人机(或遥控器)的UAS标识和对应的信任状就可对无人机(或遥控器)进行身份认证。无人机(或遥控器)的身份认证不通过，无人机(或遥控器)不可使用移动通信网络。由于终端设备的UAS标识可以是设备厂商为设备分配的身份标识，终端设备的UAS标识是设备本身的标识。因此，基于终端设备的UAS标识对终端设备进行身份认证，能够防止与运营商未签约的设备厂商生产的无人机(或遥控器)接入移动通信网络，提高了移动通信网络的安全性。类似地，UAS标识和信任状也可以由无人机系统服务提供商、垂直行业等实体来颁发、配置。在服务提供商、垂直行业初始化无人机服务、业务时可以为无人机系统用户/无人机系统服务/无人机系统业务配置唯一(一个或多个)UAS标识和相应的信任状。无人机(或遥控器)不通过第二网络设备基于无人机系统服务提供商或垂直行业提供的标识和对应的信任状进行的身份认证，就不可使用移动通信网络。因此，基于终端设备的UAS标识对终端设备进行身份认证，能够防止与移动通信网络运营商未签约的服务提供商或垂直行业的无人机系统用户/无人机系统服务/无人机系统业务使用无人机(或遥控器)接入移动通信网络，提高了移动通信网络的安全性。
下面对本申请提供的身份认证方法及装置进一步进行介绍：
请参见图3，图3是本申请实施例提供的一种身份认证方法的流程示意图。如图3所示，该身份认证方法包括如下步骤301～步骤307。图3所示的方法执行主语可以为第一终端设备、第一网络设备和第二网络设备。或者图3所示的方法执行主语可以为第一终端设备中的芯片、第一网络设备中的芯片和第二网络设备中的芯片。图3以第一终端设备、第一网络设备和第二网络设备为方法的执行主体为例进行说明。其中，第一终端设备为无人机系统中的设备，例如，可以是无人机或无人机的遥控器。第一网络设备可以为AMF或SEAF或其他核心网设备。第二网络设备可以为UTM或其他可以对无人机系统进行认证的网络设备。本申请实施例的其他附图所示的身份认证方法的执行主语同理，后文不再赘述。 其中：
301、第一终端设备向第一网络设备发送第一请求。
其中，第一请求可以为注册请求(registration request)或服务请求(service request)，或其他类型的请求。第一请求中携带第一认证指示信息，该第一认证指示信息用于请求对第一终端设备进行UAS认证。所谓UAS认证是指基于设备的UAS标识对UAS中的设备进行身份认证。如果UAS认证通过，则表明UAS设备身份合法。如果UAS认证失败，则表明UAS设备身份不合法，不能接入移动通信网络。
UAS标识为无人机厂商在出厂时为无人机和遥控器分配的身份标识(ID)。不同的无人机和遥控器对应不同的UAS标识。每个无人机和遥控器都有出厂时配置的唯一(一个或多个)UAS标识和相应的信任状(credentials)。或者，UAS标识和信任状也可以由无人机系统服务提供商或垂直行业来分配或配置。关于UAS标识的描述可参见上文描述，在此不做限定。
其中，第一认证指示信息可以有以下a、b和c三种形式：
a、第一认证指示信息为第一请求中的注册类型(RegistrationType)信息。在形式a中，第一请求可以为注册请求。注册类型信息为现有的注册请求中存在的参数或信元(InformationElement)，在形式a中，可以对注册类型信息新增一种值。例如，新增的注册类型信息的值可以为UAS注册或UAS认证。当注册请求中的注册类型信息的值为UAS注册或UAS认证时，该注册类型信息表示第一认证指示信息，用于请求对第一终端设备进行UAS认证。通过注册类型信息来请求对第一终端设备进行UAS认证，能够避免新增一种参数或信元来请求对第一终端设备进行UAS认证，可以减小对现有通信流程的改动。
b、第一认证指示信息为第一终端设备的UAS类型信息。其中，该UAS类型信息指示第一终端设备在UAS中的设备类型、服务类型或业务类型。例如，UAS类型信息可以为无人机类型或遥控器类型。在形式b中，通过将第一终端设备的UAS类型信息作为第一认证指示信息，这样既能向第一网络设备通知第一终端设备的UAS类型，又能向第一网络设备请求进行UAS认证，即通过发送一种信息就能达到两个目的，有利于节省信令开销。
c、第一认证指示信息为除注册类型信息和UAS类型信息之外的指示信息。例如，可在第一请求额外增加信元或参数来表示第一认证指示信息。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息。例如，如果第一认证指示信息为形式a和形式c时，第一请求还可携带第一终端设备的UAS类型信息。或者，第一认证指示信息为形式b。在后续步骤304中，第一网络设备还可发送第一终端设备的UAS类型信息至第二网络设备，从而第二网络设备可基于第一终端设备的UAS类型信息采用对应的认证方法对第一终端设备进行UAS认证。例如，第二网络设备对无人机和遥控器可以采用不同的认证方法进行UAS认证，或者，对无人机和遥控器进行UAS认证所需的安全强度或安全流程可以不相同。
在一种可能的实现中，第一请求还携带第一终端设备的用户签约标识符(subscription concealed identifier，SUCI)或全球唯一临时UE标识(globally unique temporary UE identity，GUTI)。
302、第一网络设备向第一终端设备发送第二请求。
本申请实施例中，第一网络设备接收第一请求之后，向第一终端设备发送第二请求。 其中，该第二请求用于请求获取第一终端设备的UAS标识。
在一种可能的实现中，第一网络设备接收第一请求之后，可以先进行与第一终端设备之间的首次认证，并建立与第一终端设备之间的NAS安全。在与第一终端设备之间的首次认证通过之后，并且建立与第一终端设备之间的NAS安全之后，向第一终端设备发送第二请求。
其中，首次认证是指网络和第一终端设备进行的双向认证。在5G标准中，首次认证包括2种认证流程：5G-AKA(AKA：Authentication and Key Agreement)和EAP-AKA’。这2种认证都是基于PLMN网络预先配备的终端标识符(如5G系统中的SUPI)以及相对应的信任状(Credentails)对第一终端设备进行认证。
在第一网络设备与第一终端设备之间建立NAS安全之后，第一终端设备与第一网络设备之间交换的消息是有安全保护的，例如，具有加密保护和完整性保护。因此，在第一网络设备与第一终端设备之间建立NAS安全之后，再从第一终端设备获取UAS标识，有利于防止UAS标识被泄露和篡改。
在一种可能的实现中，第一网络设备在接收第一请求之后，还可先检测是否需要与第一终端设备进行首次认证。如果需要与第一终端设备进行首次认证，则进行与第一终端设备的首次认证，并建立与第一终端设备的NAS安全。
在一种可能的实现中，以采用可扩展身份认证协议(extensible authentication portocol，EAP)机制对第一终端设备进行UAS认证为例。第一网络设备可以将第二请求携带于EAP消息中发送。
303、第一终端设备响应于第二请求，向第一网络设备发送第一终端设备的UAS标识。
本申请实施例中，第一终端设备接收第二请求之后，响应于第二请求，向第一网络设备发送第一终端设备的UAS标识。
在一种可能的实现中，以采用EAP机制对第一终端设备进行UAS认证为例。第一终端设备可以将UAS标识携带于EAP消息中向第一网络设备发送。后文同理，UAS标识均可通过EAP消息来进行传输。
在一种可能的实现中，响应于第二请求，第一终端还可以向第一网络设备发送第一终端设备的UAS类型。需要指出的是，UAS类型消息通常不能携带于EAP消息中，需要通过其他方式来发送。也就是说，在一种可能的实现中，第一终端设备需要使用不同消息或同一消息中的不同位置(或方式)来发送UAS标识和UAS类型(如UAS标识放在EAP容器中，而UAS类型放在EAP容器之外)。
在另一种可能的实现中，第一设备可以根据步骤301中的第一请求直接获取UAS标识。在这种情况，步骤302和303为可选步骤，不必执行。例如，在第一请求中可选地包括终端的签约标识符SUCI或GUTI，第一网络设备基于SUCI或GUTI得到SUPI，如果第一网络设备存储了终端标识符SUPI与UAS标识的对应关系，那么第一网络也可以直接通过对应关系获取UAS标识。
304、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
本申请实施例中，第一网络设备获取到第一终端设备的UAS标识之后，向第二网络设备发送第一终端设备的UAS标识。
在一种可能的实现中，第一网络设备还可以向第二网络设备发送第一终端设备的UAS类型或/和终端设备的标识符(如SUPI或GPSI)。需要说明的是，UAS类型、终端设备的 标识符通常不能携带于EAP消息中，需要通过其他方式来发送。也就是说，在一种可能的实现中，第一网络设备需要使用不同消息或同一消息中的不同位置(或方式)来发送UAS标识和UAS类型(和/或终端设备的标识符)。例如，在一种可能的实现中，UAS标识可以放在EAP容器中，而UAS类型(和/或终端设备的标识符)是放在EAP容器之外进行发送的。
305、第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。
本申请实施例中，第二网络设备接收第一终端设备的UAS标识之后，基于第一终端设备的UAS标识对第一终端设备进行UAS认证。其中，第二网络设备是基于第一终端设备的UAS标识和对应的信任状对第一终端设备进行UAS认证。例如，第二网络设备可以采取EAP机制对第一终端设备进行UAS认证。例如，采用EAP机制的EAP-TLS认证方法基于UAS标识对第一终端设备进行UAS认证。
306、第二网络设备向第一网络设备发送第一终端设备的UAS认证结果。
本申请实施例中，第二网络设备基于UAS标识对第一终端设备进行UAS认证之后，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果。
在一种可能的实现方式中，第二网络设备还可基于第一终端设备的UAS认证结果更新第一终端设备的UAS认证状态标识。
其中，UAS认证状态标识用于指示UAS认证状态。第一终端设备的UAS认证状态可以包括UAS认证通过、UAS认证失败、UAS认证待完成和尚未认证四种状态。例如，UAS认证状态标识为01时，指示认证通过。UAS认证状态标识为00时，指示认证失败。UAS认证状态标识为10时，指示认证待完成状态。UAS认证状态标识为11时，指示尚未认证状态。UAS认证结果包括UAS认证通过和UAS认证失败。例如，如果UAS认证结果为UAS认证通过，则可将UAS认证状态标识更新为01。同理，UAS认证结果为UAS认证失败时，可将UAS认证状态更新为00。基于该可选的方式，第二网络设备可以更新第一终端设备的UAS认证状态，以便后续可以查看第一终端设备的UAS认证状态。需要说明的是UAS认证通过或者UAS认证失败的认证状态，可以附带有效期限等信息，指示该认证状态持续有效的期限，如果认证状态为通过或失败并在有效期内，则不必再次进行认证；如果超过该期限，认证状态不再有效，需要更新。本专利不限定设定多长的有效期限等。
在一种可能的实现方式中，第二网络设备存储有UAS认证状态标识和第一终端设备的UAS标识或用户永久标识符(subscriber permanent identifier，SUPI)或通用公共签约标识GPSI的对应关系。第二网络设备根据第一终端设备的UAS标识或SUPI或GPSI查找到第一终端设备的UAS认证状态标识，并基于第一终端设备的UAS认证结果更新第一终端设备的UAS认证状态标识。或者，如果第二网络设备未存储第一终端设备的UAS认证状态标识，则第二网络设备根据UAS认证结果得到第一终端设备的UAS认证状态标识，并存储第一终端设备的UAS认证状态标识与第一终端设备的UAS标识或SUPI或GPSI的对应关系，以便后续可基于第一终端设备的UAS标识或SUPI或GPSI查找到第一终端设备的UAS认证状态标识。
在一种可能的实现中，第一终端设备在步骤301发送的第一请求中携带第一终端设备的用户签约标识符(subscription concealed identifier，SUCI)(或GUTI)。第一网络设备接收第一请求之后，可基于第一终端设备的SUCI(或GUTI)得到第一终端设备的SUPI或GPSI，然后向第二网络设备发送第一终端设备的SUPI或GPSI。如果第二网络设备可以存储UAS 认证状态标识和第一终端设备的SUPI或GPSI的对应关系，那么第二网络设备根据第一终端设备发送的SUPI或GPSI查找、存储或更新第一终端设备的UAS认证状态标识。如果第二网络设备处于核心网内或者第一网络设备和第二网络设备同属一个安全域，则第一网络设备基于第一终端设备的SUCI(或GUTI)得到第一终端设备的SUPI，向第二网络设备发送该第一终端设备的SUPI。否则，第一网络设备基于第一终端设备的SUCI(或GUTI)得到第一终端设备的GPSI，向第二网络设备发送该第一终端设备的GPSI。可选的，如果第一网络设备是AMF，则第一网络设备可以将第一终端设备的SUCI(或GUTI)发送至UDM，由UDM将第一终端设备的SUCI(或GUTI)转换为第一终端设备的SUPI或GPSI，再将该第一终端设备的SUPI或GPSI发送至第一网络设备。
在一种可能的实现中，如果第二网络设备中未存储第一终端设备的UAS标识和SUPI或GPSI的对应关系，则第二网络设备在对第一终端设备认证通过之后，可以存储第一终端设备的UAS标识和SUPI或GPSI的对应关系。
307、第一网络设备向第一终端设备发送第一终端设备的UAS认证结果。
具体地，第一网络设备接收第一终端设备的UAS认证结果之后，向第一终端设备发送第一终端设备的UAS认证结果。相应地，第一终端设备可接收第一终端设备的UAS认证结果。在一种可能的实现中，如果UAS认证结果为认证通过，则后续第一终端设备可使用移动通信网络。如果UAS认证结果为认证失败，则后续第一终端设备不可使用移动通信网络。
在一种可能的实现中，第一网络设备还可基于第一终端设备的UAS认证结果更新第一终端设备的UAS认证状态标识。
在一种可能的实现方式中，第二网络设备可以向第一网络设备发送第一终端设备的UAS认证结果和第一终端设备的SUPI或GPSI。第一网络设备接收第一终端设备的UAS认证结果和第一终端设备的SUPI或GPSI之后，可根据第一终端设备的SUPI或GPSI查找到第一终端设备的UAS认证状态标识，并基于第一终端设备的UAS认证结果更新第一终端设备的UAS认证状态标识。或者，如果第一网络设备未存储第一终端设备的UAS认证状态标识，则第一网络设备根据UAS认证结果得到第一终端设备的UAS认证状态标识，并存储第一终端设备的UAS认证状态标识与第一终端设备的SUPI或GPSI的对应关系，以便后续可基于第一终端设备的SUPI或GPSI查找到第一终端设备的UAS认证状态标识。
需要说明的是，在EAP框架下UAS标识携带于EAP消息中进行传输，第一网络设备(如AMF)在通常实现方式中不解析EAP消息。这种情况下，第一网络设备也不会获取、存储UAS标识的信息。因此，UAS认证状态标识在第一网络设备的存储方式，应该以终端ID(SUPI或GPSI)为识别符，而不是以UAS标识。不过，在可选实现中，如果第一网络设备可以读取EAP消息，那么第二网络设备可向第一网络设备发送第一终端设备的UAS认证结果和携带于EAP消息中的UAS标识。第一网络设备读取EAP消息中的UAS标识，然后存储UAS认证状态标识和第一终端设备的UAS标识的对应关系，或基于UAS标识查找UAS认证状态标识，并对UAS认证状态标识进行更新。
在一种可能的实现中，如果第一网络设备中未存储第一终端设备的UAS标识和SUPI或GPSI的对应关系，则第一网络设备接收第一终端设备的UAS认证结果之后，如果UAS认证结果为认证通过，第一网络设备还可以存储第一终端设备的UAS标识和SUPI或GPSI的对应关系。
在一种可能的实现中，步骤307也可以不执行。在一种可能的实现中，上述步骤301～步骤307还可以有其他的执行顺序，本申请对上述步骤301～步骤307中各个步骤之间的执行顺序不做限定。
可见，通过实施图3所描述的方法，第二网络设备可以基于第一终端设备的UAS标识对第一终端设备的身份进行认证。由于第一终端设备的UAS标识是设备厂商配置的，第一终端设备的UAS标识是第一终端设备本身的标识。因此，基于第一终端设备的UAS标识来对第一终端设备进行认证，能够防止未与运营商签约的设备厂商生产的第一终端设备使用移动通信网络，或能够防止与运营商未签约的服务提供商或垂直行业的无人机系统用户/无人机系统服务/无人机系统业务使用无人机(或遥控器)接入移动通信网络，提高了移动通信网络的安全性。同时，实施本申请实施例，能够使得无人机设备厂商/无人机系统服务提供商/垂直行业对其生产/服务/拥有的无人机系统设备是否能够接入移动通信网络具有一定的控制管理权。
请参见图4，图4是本申请实施例提供的一种身份认证方法的流程示意图。图4所示的身份认证方法是对图3所示的身份认证方法的优化。图4与图3所示的身份认证方法的区别在于，在图4中第一网络设备需要确定是否对第一终端设备进行认证。如果确定对第一终端设备进行认证，则第一网络设备向第一终端设备发送第二请求。并且第二网络设备也需要确定是否对第一终端设备进行认证。如果确定对第一终端设备进行认证，则第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。如图4所示，该身份认证方法包括如下步骤401～步骤410。其中：
401、第一终端设备向第一网络设备发送第一请求。
其中，该第一请求可以为注册请求(registration request)或服务请求(service request)，或其他类型的请求。该第一请求中携带第一认证指示信息。该第一认证指示信息用于请求对第一终端设备进行UAS认证。关于第一请求和第一认证指示信息的相关描述请参见上述301下的描述，在此不赘述。
402、第一网络设备与第一终端设备进行首次认证，并与第一终端设备建立NAS安全。
本申请实施例中，第一网络设备与第一终端设备进行首次认证，并与第一终端设备建立NAS安全之后，第一网络设备确定是否对第一终端设备进行UAS认证。或者，也可以不执行步骤402。可选地，步骤402可以在步骤403之后执行。
403、第一网络设备确定是否对第一终端设备进行UAS认证。当第一网络设备确定对第一终端设备进行UAS认证时，执行步骤404。
本申请实施例中，也可以不执行步骤403。即第一网络设备接收第一请求之后，第一网络设备确定对第一终端设备进行UAS认证时，执行步骤404。
在一种可能的实现方式中，当第一网络设备确定不对第一终端设备进行UAS认证时，可以向第一终端设备发送UAS认证失败消息，或发送用于指示不需要对第一终端设备进行UAS认证的指示消息，或发送其他指示消息，本申请实施例不做限定。
下面对第一网络设备确定是否对第一终端设备进行UAS认证的4种方式进行介绍，当然第一网络设备还可通过其他方式确定是否对第一终端设备进行UAS认证，本申请实施例不做限定，其中：
方式1：第一网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设 备进行UAS认证。
在一种可能的实现中，当第一终端设备的UAS认证状态标识指示的UAS认证状态为尚未认证状态时，第一网络设备确定对第一终端设备进行UAS认证。当第一终端设备的UAS认证状态标识指示的UAS认证状态为认证成功状态或认证失败状态时，确定不对第一终端设备进行UAS认证。
第一网络设备可存储第一终端设备的UAS认证状态标识。UAS认证状态标识用于指示UAS认证状态。该UAS认证状态可以包括认证成功、认证失败、尚未认证和待完成认证状态。例如，UAS认证状态标识为01时，指示认证成功。UAS认证状态标识为00时，指示认证失败。UAS认证状态标识为10时，指示待完成认证状态。UAS认证状态标识为11时，指示尚未认证状态。如果第一终端设备的UAS认证状态标识指示的UAS认证状态为认证成功或认证失败，则证明上一次的UAS认证仍然有效。因此，如果第一终端设备的UAS认证状态为认证成功或认证失败，可以不执行后面的UAS认证流程。如果第一终端设备的UAS认证状态标识指示的UAS认证状态为尚未认证状态，则证明尚未进行UAS认证或者上一次的UAS认证失效，因此，可执行步骤404，以对第一终端设备进行后续的UAS认证流程。
在方式1中，第一网络设备可以存储第一终端设备的SUPI或GPSI与第一终端设备的UAS认证状态标识的对应关系。第一终端设备发送的第一请求中还可携带第一终端设备的SUCI(或GUTI)。第一网络设备基于第一终端设备的SUCI(或GUTI)得到第一终端设备的SUPI或GPSI，再从存储的UAS认证状态中获取第一终端设备的SUPI或GPSI对应的UAS认证状态标识。
在一种可能的实现方式中，如果第一终端设备的UAS认证状态为有效的认证成功状态或认证失败状态，则第一网络设备可以直接发送第一终端设备的UAS认证状态至第一终端设备。
方式2：第一网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。
在方式2中，如图5所示，第一请求中携带第一终端设备的UAS类型信息。如果第一认证指示信息为除UAS类型信息之外的信息，例如可以为注册类型信息，则第一请求中可携带第一认证指示信息和UAS类型信息。如果第一认证指示信息为UAS类型信息，则第一请求中携带第一认证指示信息。图5以第一请求携带第一认证指示信息和UAS类型信息为例。
在一种可能的实现方式中，当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息一致时，确定对第一终端设备进行UAS认证。当第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致时，确定不对第一终端设备进行UAS认证。
在该可能的实现方式中，第一网络设备中可以存储第一终端设备的SUPI或GPSI对应的UAS类型信息。可选的，第一终端设备的SUPI或GPSI对应的UAS类型信息可以理解为第一终端设备的SUPI或GPSI对应的芯卡(如SIM卡)支持的UAS类型信息。第一请求中还可携带SUCI，第一网络设备基于SUCI得到第一终端设备的SUPI或GPSI。第一网络设备根据第一终端设备的SUPI或GPSI获取对应的UAS类型信息。
例如，第一网络设备存储了下表1所示的SUPI与UAS类型信息的对应关系。如下表 1所示，SUPI1对应的UAS类型信息是无人机，SUPI2对应的UAS类型信息是无人机，SUPI3对应的UAS类型信息是遥控器。SUPI1和SUPI2属于第一类SIM卡对应的SUPI，SUPI3属于第二类SIM卡对应的SUPI。第一类SIM卡只能配置于无人机上，第二类SIM卡只能配置于遥控器上。那么SUPI1和SUPI2对应无人机类型，SUPI3对应遥控器类型。
表1
终端设备的SUPI UAS类型信息
终端设备1的SUPI1 无人机类型
终端设备2的SUPI2 无人机类型
终端设备3的SUPI3 遥控器类型
如果第一网络设备接收的第一终端设备的UAS类型信息为无人机类型，接收的SUCI为SUCI1。第一网络设备基于SUCI1得到SUPI1。第一网络设备根据上表1确定SUPI1对应无人机类型。因此，第一网络设备确定第一网络设备接收的UAS类型信息为第一终端设备的SUPI或GPSI对应的UAS类型信息。
如果第一网络设备接收的UAS类型信息为遥控器类型，接收的SUCI为SUCI1。第一网络设备基于SUCI1得到SUPI1。第一网络设备根据上表1确定SUPI1对应无人机类型。因此，第一网络设备确定第一网络设备接收的UAS类型信息不为第一终端设备的SUPI或GPSI对应的UAS类型信息。这表明应该配置于无人机的第一类SIM卡被错误地使用或盗用在遥控器上。因此，如果第一网络设备确定第一网络设备接收的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致时，可以不继续后续的UAS认证流程。这样可以避免在第一终端设备错误地使用芯卡或使用被盗用的芯卡时，能够使用移动通信网络。
在另一种可能的实现方式中，当第一网络设备接收的UAS类型信息不为第一终端设备的SUPI或GPSI对应的UAS类型信息时，确定对第一终端设备进行UAS认证。当第一网络设备接收的UAS类型信息为第一终端设备的SUPI或GPSI对应的UAS类型信息时，确定不对第一终端设备进行UAS认证。在该可能的实现方式中，SUPI或GPSI对应的UAS类型信息可以理解为SUPI或GPSI对应的芯卡不支持的UAS类型信息。
在一种可能的实现方式中，如果第一网络设备未存储第一终端设备的SUPI或GPSI对应的UAS类型信息，第一网络设备可以从UDM中或第二网络设备中获取第一终端设备的SUPI或GPSI对应的UAS类型信息。
在一种可能的实现方式中，如果确定第一请求携带的第一终端设备的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致，则第一网络设备还可向第一终端设备发送用于指示UAS认证失败的消息。或者，可以通知第一终端设备第一请求携带的第一终端设备的UAS类型信息与第一终端设备的SUPI或GPSI对应的UAS类型信息不一致。这样第一终端设备接收到该通知之后，可以提示用户芯卡(如SIM卡)配置错误。
方式3：第一网络设备确定允许进行UAS认证的设备列表中是否存在第一终端设备。若是，则确定对第一终端设备进行UAS认证。若否，则确定不对第一终端设备进行UAS认证。这种方式也可以理解为第一网络设备存储了允许进行UAS认证的设备的名单。
在一种可能的实现中，第一网络设备存储的允许进行UAS认证的设备列表具体为允许进行UAS认证的设备的SUPI列表。第一请求中还携带第一终端设备的SUCI，第一网 络设备接收第一终端设备的SUCI之后，可以基于第一终端设备的SUCI得到第一终端设备的SUPI。第一网络设备确定存储的允许进行UAS认证的设备的SUPI列表中是否存在第一终端设备的SUPI。若是，则确定对第一终端设备进行UAS认证。若否，则确定不需要对第一终端设备进行UAS认证。在一种可能的实现中，不需要进行UAS认证相当于认证成功。在另一种可能的实现中，不需要进行UAS认证相当于认证失败。
举例来说，第一网络设备存储的允许进行UAS认证的第一终端设备的SUPI列表如下表2所示。如下表2所示，第一终端设备1～第一终端设备3为进行UAS认证的第一终端设备。第一终端设备1～第一终端设备3的SUPI分别为SUPI1～SUPI3。第一网络设备将第一请求携带的SUCI转换为SUPI4。如果SUPI4与SUPI1～SUPI3中的任何一个相同，则第一网络设备确定对第一终端设备进行UAS认证。例如，如果SUPI4与SUPI1相同，则证明发送第一请求的第一终端设备为第一终端设备1，那么第一网络设备确定对发送第一请求的第一终端设备进行UAS认证。当然，如果SUPI4与SUPI1～SUPI3中的任何一个不相同，则第一网络设备确定不对第一终端设备进行UAS认证。
表2
序号 进行UAS认证的终端设备的SUPI
1 终端设备1的SUPI1
2 终端设备2的SUPI2
3 终端设备3的SUPI3
方式4：第一网络设备确定不允许进行UAS认证的设备列表中是否存在第一终端设备。若是，则确定对第一终端设备不进行UAS认证。若否，则确定对第一终端设备进行UAS认证。这种方式也可以理解为第一网络设备存储了不允许进行UAS认证的设备的黑名单。
在一种可能的实现中，第一网络设备存储的不允许进行UAS认证的设备列表具体为不允许进行UAS认证的设备的SUPI列表。第一请求中还携带第一终端设备的SUCI，第一网络设备接收第一终端设备的SUCI之后，可以基于第一终端设备的SUCI得到第一终端设备的SUPI。如果第一网络设备存储的不允许进行UAS认证的设备的SUPI列表中存在第一终端设备的SUPI，则第一网络设备确定不对该第一终端设备进行UAS认证。如果第一网络设备存储的不允许进行UAS认证的设备的SUPI列表中不存在该第一终端设备的SUPI，则第一网络设备确定对该第一终端设备进行UAS认证。在一种可能的实现中，在方式4中确定对第一终端设备不进行UAS认证，相当于UAS认证失败。
在一种可能的实现中，第一网络设备也可以将接收到的SUCI发送至UDM。UDM接收该SUCI之后，可以将该SUCI转换为SUPI。由UDM确定是否对该第一终端设备进行UAS认证。UDM确定是否对该第一终端设备进行UAS认证的具体实现方式与上述方式3～方式4中第一网络设备确定是否对该第一终端设备进行UAS认证的具体实现方式相同，在此不赘述。UDM可以发送确定的结果至第一网络设备，第一网络设备根据UDM发送的确定结果来确定对第一终端设备进行UAS认证或不对第一终端设备进行UAS认证。
在方式3～方式4中，如果第一网络设备确定不对第一终端设备进行UAS认证，则第一网络设备可以向第一终端设备发送用于指示UAS认证结果的消息。
在一种可能的实现方式中，第一网络设备还可将上述方式1～方式4中多种方式相结合来确定是否对第一终端设备进行UAS认证。或者，第一网络设备还可通过其他方式来确定是否对第一终端设备进行UAS认证，本申请实施例不做限定。
404、第一网络设备向第一终端设备发送第二请求。
405、第一终端设备响应于该第二请求，向第一网络设备发送第一终端设备的UAS标识。
406、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
步骤404～步骤406的具体实现方式具体可参见步骤302～步骤304的具体实现方式，在此不赘述。
407、第二网络设备确定是否对第一终端设备进行UAS认证。
本申请实施例中，第二网络设备接收第一终端设备的UAS标识之后，确定是否对第一终端设备进行UAS认证。
本申请实施例中，也可以不执行步骤407。即第二网络设备接收第一终端设备的UAS标识之后，当第二网络设备确定对第一终端设备进行UAS认证时，执行步骤408。
在一种可能的实现中，当第二网络设备确定不对第一终端设备进行UAS认证时，可以向第一网络设备发送UAS认证失败消息，由第一网络设备向第一终端设备发送UAS认证失败消息。或者，当第二网络设备确定不对第一终端设备进行UAS认证时，可以向第一网络设备发送用于指示不对第一终端设备进行UAS认证(或认证成功)的指示信息，由第一网络设备向第一终端设备发送用于指示不对第一终端设备进行UAS认证(或认证成功)的指示信息。或者，当第二网络设备确定不对第一终端设备进行UAS认证时，可以发送其他指示信息至第一网络设备，由第一网络设备发送至第一终端设备。
下面对第二网络设备确定是否对第一终端设备进行UAS认证的5种方式进行介绍，当然第二网络设备还可通过其他方式确定是否对第一终端设备进行UAS认证，本申请实施例不做限定，其中：
方式1：第二网络设备基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证。
第二网络设备的方式1的具体实现原理可参见第一网络设备的方式1的具体实现原理，在此不赘述。
需要注意的是，在方式1中，第二网络设备也可以存储第一终端设备的UAS标识与第一终端设备的UAS认证状态标识的对应关系。第一网络设备从存储的UAS认证状态中获取第一终端设备的UAS标识对应的UAS认证状态标识。然后再基于获取的UAS认证状态标识确定是否对第一终端设备进行UAS认证。
方式2：第二网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。
如图5所示，第一请求中还携带第一终端设备的UAS类型信息。如果第一认证指示信息为除UAS类型信息之外的信息，例如可以为注册类型信息，则第一请求中可携带第一认证指示信息和UAS类型信息。如果第一认证指示信息为UAS类型信息，则第一请求中携带第一认证指示信息。图5以第一请求携带第一认证指示信息和UAS类型信息为例。第一网络设备还可以发送第一终端设备的UAS类型信息至第二网络设备。
或者，如图6所示，第二请求还用于请求获取第一终端设备的UAS类型信息。第一终端设备接收第二请求之后，还向第一网络设备发送UAS类型信息。第一终端设备可以将第一终端设备的UAS类型信息和UAS标识一起发送至第一网络设备，或者将两个信息分开发送至第一网络设备。第一网络设备接收第一终端设备发送的UAS类型信息和UAS 标识之后，发送第一终端设备的UAS类型信息和UAS标识至第二网络设备。UAS类型信息可以与UAS标识一起发送至第二网络设备，或者二者可以分开发送。
第二网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证的具体实现方式与第一网络设备基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证的具体实现方式原理相同，在此不赘述。
方式3：第二网络设备基于第一终端设备的UAS标识与第一终端设备的SUPI或GPSI确定是否对第一终端设备进行UAS认证。在方式3中，第一请求还携带第一终端设备的SUCI(或GUTI)。第一网络设备还向第二网络设备发送第一终端设备的SUPI或GPSI。第一终端设备的SUPI或GPSI可以与第一终端设备的UAS标识一起发送，或者与第一终端设备的UAS标识分开发送，例如分别放在2条不同的消息中发送或者同一条消息中的不同位置、不同方式(一个在容器container中，一个在容器外)、不同信元或不同容器中发送等等。
在一种可能的实现方式中，第二网络设备基于第一终端设备的UAS标识与第一终端设备的SUPI或GPSI确定是否对第一终端设备进行UAS认证的具体实施方式为：第二网络设备确定第一终端设备的UAS标识与第一终端设备的SUPI或GPSI是否具有对应关系(或绑定关系)。若是，则确定对第一终端设备进行UAS认证。若否，则确定不对第一终端设备进行UAS认证。UAS标识与SUPI或GPSI具有对应关系，则表示SUPI或GPSI对应的芯卡(如SIM卡)需要与UAS标识对应的终端设备绑定使用。
如果第一终端设备的UAS标识与第一终端设备的SUPI或GPSI具有对应关系，则表示第一终端设备中安装的芯卡(如SIM卡)是与第一终端设备的UAS标识绑定使用的芯卡。否则，则表示第一终端设备中安装的芯卡(如SIM卡)不是与第一终端设备的UAS标识绑定使用的芯卡。因此，通过实施该可能的实现方式，在第一终端设备中安装的芯卡(如SIM卡)是与第一终端设备绑定的芯卡时，第二网络设备才会对第一终端设备进行UAS认证。在第一终端设备中安装的芯卡(如SIM卡)不是与第一终端设备绑定的芯卡时，第二网络设备不会对第一终端设备进行UAS认证(或等同于认证失败)。因此，当第一终端设备中安装的芯卡不是与第一终端设备绑定的芯卡时，第一终端设备不能使用移动通信网络。这样可以防止随意更换、盗用第一终端设备的芯卡。
例如，第二网络设备存储的UAS标识和SUPI的对应关系如下表3所示。如果第一终端设备为第一终端设备1，第一网络设备向第二网络设备发送了UAS标识1和SUPI2，则第二网络设备确定第一终端设备1的UAS标识1与SUPI2不具有对应关系，第二网络设备确定第一终端设备的UAS认证为认证失败。如果第一网络设备向第二网络设备发送了UAS标识1和SUPI1，则第二网络设备确定第一终端设备1的UAS标识与SUPI具有对应关系，第二网络设备对第一终端设备继续进行UAS认证。第二网络设备确定第一终端设备的UAS标识与GPSI是否具有对应关系的原理相同，在此不赘述。
表3
UAS标识 SUPI
终端设备1的UAS标识1 SUPI1
终端设备2的UAS标识2 SUPI2
终端设备3的UAS标识3 SUPI3
可选的，如果第二网络设备确定第一终端设备的UAS标识与SUPI或GPSI不具有对应关系，则第二网络设备可以通过第一网络设备向第一终端设备发送用于指示UAS认证失败的消息。或者，可以通过第一网络设备通知第一终端设备其UAS标识与SUPI或GPSI不具有对应关系。
方式4：第二网络设备确定允许进行UAS认证的设备列表中是否存在第一终端设备。若是，则确定对第一终端设备进行UAS认证。若否，则确定不对第一终端设备进行UAS认证。
方式5：第二网络设备确定不允许进行UAS认证的设备列表中是否存在第一终端设备。若是，则确定对第一终端设备不进行UAS认证。若否，则确定对第一终端设备进行UAS认证。
其中，第二网络设备确定是否对第一终端设备进行UAS认证的方式4～方式5的实现原理，可参见第一网络设备确定是否对该第一终端设备进行UAS认证的方式3～方式4下的描述，在此不赘述。需要注意的是，第二网络设备在方式4～方式5中也可根据第一终端设备的UAS标识或GPSI来确定是否对该第一终端设备进行UAS认证。其实现原理与上述第一网络设备在方式3～方式4中根据第一终端设备的SUPI来确定是否对该第一终端设备进行UAS认证的实现原理相同，在此不赘述。
在一种可能的实现方式中，第二网络设备还可将上述方式1～方式5中多种方式相结合来确定是否对第一终端设备进行UAS认证。或者，第二网络设备还可通过其他方式来确定是否对第一终端设备进行UAS认证，本申请实施例不做限定。
408、第二网络设备基于UAS标识对第一终端设备进行UAS认证。
409、第二网络设备发送第一终端设备的UAS认证结果至第一网络设备。
410、第一网络设备发送第一终端设备的UAS认证结果至第一终端设备。
其中，步骤408～步骤410的具体实现方式可参加上述305～步骤307的具体实现方式，在此不赘述。
在一种可能的实现中，步骤403和步骤407可以都执行，或者只执行步骤403，或者只执行步骤407。步骤404和步骤405也可以不执行，其描述类似步骤302和步骤303，这里不再赘述。步骤410也可以不执行。
在一种可能的实现中，上述步骤401～步骤410还可以有其他的执行顺序，本申请对上述步骤401～步骤410中各个步骤之间的执行顺序不做限定。
通过实施图4所描述的方法，可以先将不符合UAS认证要求的终端设备筛除，只对符合认证要求的终端设备进行UAS认证，有利于减小第二网络设备的认证工作量。
请参见图7，图7是本申请实施例提供的又一种身份认证方法的流程示意图。图7所示的身份认证方法与图3所示的身份认证方法是并列的方案。图7与图3所示的身份认证方法的区别在于，在图3中，第一终端设备的UAS标识是由第一网络设备通过第二请求获取的。图7中的第一请求还携带第一终端设备的UAS标识。如图7所示，该身份认证方法包括如下步骤701～步骤705。其中：
701、第一终端设备向第一网络设备发送第一请求。
其中，该第一请求携带第一认证指示信息和第一终端设备的UAS标识。关于第一认证指示信息的相关描述可参加步骤301下的描述，在此不赘述。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息。
在一种可能的实现中，第一请求还携带第一终端设备的用户签约标识符(subscription concealed identifier，SUCI)。
在一种可能的实现中，在执行步骤701之前，第一终端设备与第一网络设备进行首次认证，并建立与第一网络设备之间的NAS安全。在第一终端设备通过首次认证，并建立与第一网络设备之间的NAS安全之后，第一终端设备与第一网络设备之间交换的消息是有安全保护的，例如，具有加密保护和完整性保护。因此，第一终端设备可以在第一请求中携带第一终端设备的UAS标识，第一终端设备的UAS标识不会被泄露。
需要说明的是，本实施例第一请求中如果包括了UAS标识，第一网络设备可以避免通过发送第二请求的额外步骤(图3中的步骤302和步骤303)来获取UAS标识，提升效率和节省网络资源。
702、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
本申请实施例中，第一网络设备接收第一终端设备的UAS标识之后，向第二网络设备发送第一终端设备的UAS标识。
在一种可能的实现中，第一网络设备可将UAS标识携带于EAP消息中向第二网络设备发送。可选的，第一网络设备还可向第二网络设备发送第一终端设备的UAS类型或/和标识符SUPI(或GPSI)。类似于步骤303的描述，UAS类型、SUPI(或GPSI)需要通过不同于发送UAS标识的消息或需要在发送UAS标识的同一消息中的不同位置(或方式)来发送。
703、第二网络设备基于UAS标识对第一终端设备进行UAS认证。
704、第二网络设备发送第一终端设备的UAS认证结果至第一网络设备。
705、第一网络设备发送第一终端设备的UAS认证结果至第一终端设备。
其中，步骤703～步骤705的具体实现方式可参见上述305～步骤307的具体实现方式，在此不赘述。
在一种可能的实现中，在步骤704，第二网络设备向第一网络设备发送第一网络设备的UAS认证结果时，需要携带UAS标识、或/和UAS类型、或/和SUPI(或GPSI)。第一网络设备可以存储、更新有关第一终端设备的UAS认证状态及标识(UAS标识、UAS类型、SUPI(或SUPI))。
在一种可能的实现中，上述步骤705也可以不执行。上述步骤701～步骤705还可以有其他的执行顺序，本申请对上述步骤701～步骤705中各个步骤之间的执行顺序不做限定。
请参见图8，图8是本申请实施例提供的又一种身份认证方法的流程示意图。图8所示的身份认证方法是对图7所示的身份认证方法的优化。图8与图7所示的身份认证方法的区别在于，在图8中第一网络设备需要确定是否对第一终端设备进行认证。如果确定对第一终端设备进行认证，则第一网络设备向第二网络设备发送第一终端设备的UAS标识。并且第二网络设备也需要确定是否对第一终端设备进行认证。如果确定对第一终端设备进行认证，则第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。如图8所示，该身份认证方法包括如下步骤801～步骤808。其中：
801、第一网络设备与第一终端设备进行首次认证，并与第一终端设备之间建立NAS安全。
802、第一终端设备向第一网络设备发送第一请求。
其中，该第一请求携带第一认证指示信息和第一终端设备的UAS标识。关于第一认证指示信息的相关描述可参加步骤301下的描述，在此不赘述。可选的，首次认证通过，网络会给终端分配一个全球唯一临时UE标识(globally unique temporary UE identity，GUTI)，因此，第一请求还可携带第一终端设备的GUTI。第一网络设备后续所使用的第一终端设备的SUPI或GPSI可基于第一终端设备的GUTI得到。
803、第一网络设备确定是否对第一终端设备进行UAS认证。当第一网络设备确定对第一终端设备进行UAS认证时，执行步骤804。
其中，步骤803的具体实现方式可参见上述步骤403的具体实现方式。
804、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
在一种可能的实现中，第一网络设备还可向第二网络设备发送第一终端设备的UAS类型或/和标识符SUPI(或GPSI)。类似于步骤303的描述，UAS类型、SUPI(或GPSI)需要通过不同于发送UAS标识的消息或需要在发送UAS标识的同一消息中的不同位置(或方式)来发送。
805、第二网络设备确定是否对第一终端设备进行UAS认证。当第二网络设备确定对第一终端设备进行UAS认证时，执行步骤806。
其中，步骤804～步骤805的具体实现方式可参见上述步骤406～步骤407的具体实现方式。
806、第二网络设备基于UAS标识对第一终端设备进行UAS认证。
807、第二网络设备发送第一终端设备的UAS认证结果至第一网络设备。
808、第一网络设备发送第一终端设备的UAS认证结果至第一终端设备。
其中，步骤806～步骤808的具体实现方式可参见上述305～步骤307的具体实现方式，在此不赘述。
在一种可能的实现中，在步骤807，第二网络设备向第一网络设备发送第一网络设备的UAS认证结果时，可携带UAS标识、或/和UAS类型、或/和SUPI(或GPSI)。第一网络设备可以存储、更新有关第一终端的UAS认证状态及标识(UAS标识、UAS类型、SUPI(或GPSI))。
在一种可能的实现中，步骤803和步骤805可以都执行，或者执行其中的一个。
在一种可能的实现中，上述步骤808也可以不执行。上述步骤801～步骤808还可以有其他的执行顺序，本申请对上述步骤801～步骤808中各个步骤之间的执行顺序不做限定。
通过实施图8所描述的方法，可以先将不符合认证要求的终端设备筛除，只对符合认证要求的终端设备进行UAS认证，有利于减小第一网络设备和第二网络设备的认证工作量。
请参见图9，图9是本申请实施例提供的又一种身份认证方法的流程示意图。图9所示的身份认证方法是对图3所示的身份认证方法的优化。图9与图3所示的身份认证方法的区别在于，在图9中第二网络设备存储有第一终端设备和第二终端设备之间的关联关系(或配对关系或对应关系或绑定关系)。在图9所示的方案中除需要对第一终端设备和第二终端设备进行认证，还需要对第一终端设备和第二终端设备之间的关联关系进行授权或认证，即确定第一终端设备和第二终端设备之间的关联关系是否可用或有效。第一终端设 备和第二终端设备之间的关联关系授权或认证成功，则第一终端设备和第二终端设备可以配对使用。否则，第一终端设备和第二终端设备不可以配对使用。其中，第一终端设备可以为无人机，第二终端设备可以为无人机的遥控器。或者，第一终端设备可以为无人机的遥控器，第二终端设备可以为无人机。第一终端设备和第二终端设备的UAS类型信息不同。如图9所示，该身份认证方法包括如下步骤901～步骤912。其中：
901、第一终端设备向第一网络设备发送第一请求。
其中，第一请求携带第一认证指示信息。该第一认证指示信息用于请求对第一终端设备进行UAS认证。
902、第一网络设备向第一终端设备发送第二请求。
本申请实施例中，第一网络设备接收第一请求之后，向第一终端设备发送第二请求。其中，该第二请求用于请求获取第一终端设备的UAS标识。
903、第一终端设备响应于该第二请求，向第一网络设备发送第一终端设备的UAS标识。
904、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
905、第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。
906、第二网络设备向第一网络设备发送第一终端设备的UAS认证结果。
907、第一网络设备向第一终端设备发送第一终端设备的UAS认证结果。
其中，步骤901～步骤907的具体实现方式可参见上述步骤301～步骤307的具体实现方式，在此不赘述。
908、第二网络设备确定与第一终端设备相关联的第二终端设备的UAS标识。
本申请实施例中，第二网络设备接收第一终端设备的UAS标识之后，确定与第一终端设备相关联的第二终端设备的UAS标识。其中，步骤908～步骤910可以在步骤904之后，在步骤905或者步骤906之前执行。或者，步骤908～步骤910可以在步骤906之后执行。或者，步骤908～步骤910中的步骤可以与步骤905或步骤906同时执行。本申请实施例不作限定。图9以步骤908在步骤906之后执行为例。
在本申请实施例中，第二网络设备预先存储了第一终端设备与第二终端设备之间的关联关系。该关联关系也可以称为对应关系或配对关系或绑定关系，为便于描述，下文以关联关系进行描述。可选的，第二网络设备存储的第一终端设备与第二终端设备之间的关联关系，可以是在第一终端设备和第二终端设备出厂时配置于第二网络设备中的。或者，第一终端设备与第二终端设备之间的关联关系可以是第一终端设备和第二终端设备之前关联成功之后存储在第二网络设备中的。再或者，第一终端设备与第二终端设备之间的关联关系可以是UAS服务商在同网络运营商签约时，进行关联之后存储在第二网络设备中的。本发明对关联关系如何配置在第二网络中不作限制，这里不一一列出。
第二网络设备存储第一终端设备与第二终端设备的关联关系的形式可以为：存储第一终端设备的UAS标识与第二终端设备的UAS标识之间的关联关系。因此，第二网络设备根据第一终端设备的UAS标识就可确定第二终端设备的UAS标识。进一步，第二网络设备根据UAS标识与终端标识SUPI或GPSI的绑定关系(例如表3所描述)，就可确定第二终端设备的SUPI或GPSI。
例如，第二网设备存储的无人机与遥控器之间的关联关系可如下表4所示。其中，一个遥控器可以关联一个或多个无人机，一个无人机也可以被一个或多个遥控器关联。如下 表4所示，遥控器1与无人机1和无人机2具有关联关系，遥控器2与无人机3具有关联关系。第二网络设备存储了遥控器1的UAS标识4与无人机1的UAS标识1和无人机2的UAS标识2的关联关系，并存储了遥控器2的UAS标识5与无人机3的UAS标识3的关联关系。因此，如果第一终端设备为无人机1，根据下表4的关联关系，就可确定第二终端设备的UAS标识为UAS标识4。如果第一终端设备为遥控器1，那么第二终端设备具有两个，分别为无人机1和无人机2。根据下表4的关联关系，基于UAS标识4就可以得到无人机1的UAS标识1和无人机2的UAS标识2。如果UAS标识与SUPI有如表3所示关联关系，根据下表4的关联关系，基于UAS标识4就可以得到无人机1的SUPI标识1和无人机2的SUPI标识2。
表4
Figure PCTCN2019115441-appb-000001
可选的，第一请求中还携带设备指示信息，该设备指示信息用于确定第二终端设备。例如，与第一终端设备关联的第二终端设备具有多个，该设备指示信息可以指示需要关联的第二终端设备的数量或序号或名称等，以从多个第二终端设备中确定出第一终端设备需要关联的第二终端设备。
909、第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证。
本申请实施例中，第二网络设备确定与第一终端设备相关联的第二终端设备的UAS标识(和第二终端标识SUPI)之后，基于第二终端设备的UAS标识(和第二终端标识SUPI)对第二终端设备进行UAS认证。第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的原理与第一网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的原理相同，在此不赘述。
910、第二网络设备向第一网络设备发送第二终端设备的UAS认证结果。
本申请实施例中，第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证之后，向第一网络设备发送第二终端设备的UAS认证结果。
在一种可能的实现中，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果时，还可向第一网络设备发送第一终端设备的UAS标识或SUPI或GPSI，以指示第一网络设备接收的UAS认证结果是第一终端设备的UAS认证结果。同理，第二网络设备向第一网络设备发送第二终端设备的UAS认证结果时，还可向第一网络设备发送第二终端设备的UAS标识或SUPI或GPSI，以指示第一网络设备接收的UAS认证结果是第二终端设备的UAS认证结果。
在一种可能的实现中，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果时，还可向第一网络设备发送第二终端设备的UAS标识或SUPI或GPSI，以指示第一终端设备与第二终端设备关联。和/或，第二网络设备向第一网络设备发送第二终端设备的UAS认证结果时，还可向第一网络设备发送第一终端设备的UAS标识或SUPI或GPSI，以指示第一终端设备与第二终端设备关联。从而第一网络设备知道将第一终端设备的UAS认证结果也发送给第二终端设备，并将第二终端设备的UAS认证结果也发送给第一终端设备。并且，第一网络设备可以保存第一终端设备和第二终端设备的关联关系。
911、第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息。
本申请实施例中，第一网络设备接收到第二网络设备发送的第二终端设备的UAS认证结果之后，向第一终端设备(根据第一终端的SUPI或UAS标识确定第一终端设备)发送第二终端设备的UAS认证结果或关联指示信息。
该关联指示信息用于指示第一终端设备和第二终端设备是否关联成功。该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。例如，如果第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过，则该关联指示信息用于指示第一终端设备和第二终端设备关联成功。否则，该关联指示信息用于指示第一终端设备和第二终端设备关联失败。第一网络设备也可直接向第一终端设备发送第二终端设备的UAS认证结果，由第一终端设备自己根据第一终端设备的UAS认证结果和第二终端设备的UAS认证结果确定第一终端设备和第二终端设备是否关联成功。
912、第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息。
本申请实施例中，第一网络设备接收到第二网络设备发送的第二终端设备的UAS认证结果之后，向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果，或向第二终端设备发送第二终端设备的UAS认证结果和关联指示信息。
在一种可能的实现中，步骤906和步骤910可以同时执行，即第二网络设备可以在得到第一终端设备的UAS认证结果和第二终端设备的UAS认证结果之后，将第一终端设备的UAS认证结果和第二终端设备的UAS认证结果携带于同一个消息中发送至第一网络设备。第一网络设备再将该消息发送至第一终端设备和第二终端设备。该消息中还可包括第一终端设备的UAS标识或SUPI或GPSI，以及第二终端设备的UAS标识或SUPI或GPSI。第一终端设备的UAS标识或SUPI或GPSI用于确定第一终端设备并区分第一终端设备的UAS认证结果，第二终端设备的UAS标识或SUPI或GPSI用于确定第二终端设备并区分第二终端设备的UAS认证结果。其中，第二网络设备可基于第一终端设备的SUPI或GPSI确定第二终端设备的SUPI或GPSI。或者，第二网络设备可基于第二终端设备的UAS标识确定第二终端设备的SUPI或GPSI。
在一种可能的实现中，步骤906在步骤910之前执行时，第一网络设备在接收到第一终端设备的UAS认证结果之后，可以先向第一终端设备发送第一终端设备的UAS认证结果。在接收到第二终端设备的UAS认证结果之后，再向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息。或者，第一网络设备在接收到第一终端设备的UAS认证结果之后，先不发送第一终端设备的UAS认证结果。第一网络设备接收到第二终端设备的UAS认证结果时，再在同一个消息中发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息至第一终端设备。第一网络设备在接收到第二终端设备的UAS认证结果时，可在同一个消息中发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息至第二终端设备。
在一种可能的实现中，步骤906在步骤910之后执行时，第一网络设备在接收到第二终端设备的UAS认证结果之后，可以先向第二终端设备发送第二终端设备的UAS认证结果。在接收到第一终端设备的UAS认证结果之后，再向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。或者，第一网络设备在接收到第二终端设备的UAS认 证结果之后，先不发送第二终端设备的UAS认证结果。第一网络设备接收到第一终端设备的UAS认证结果时，再在同一个消息中发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息至第二终端设备。第一网络设备在接收到第一终端设备的UAS认证结果时，可在同一个消息中发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息至第一终端设备。
在一种可能的实现中，步骤906在步骤910之前执行，步骤907中还发送用于指示第二终端设备的UAS认证状态为待完成认证状态的UAS认证状态标识。同理，如果步骤906在步骤910之后执行，在步骤912中第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和用于指示第一终端设备的UAS认证状态为待完成认证状态的UAS认证状态标识。
在一种可能的实现中，执行步骤905之前，可确定是否对第二终端设备进行UAS认证。若确定对第二终端设备进行UAS认证，执行步骤905。可选的，第二网络设备在基于第二终端设备的UAS标识对第二终端设备进行UAS认证之前，还可确定是否对第二终端设备进行UAS认证。如果确定对第二终端设备进行UAS认证，则执行步骤909。第二网络设备确定是否对第一终端设备或第二终端设备进行UAS认证的具体实现方式，可参见上述图4对应的实施例中第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式。可选的，确定不允许对第一终端设备和第二终端设备进行UAS认证，则第二网络设备向第一网络设备发送指示信息，该指示信息指示第一终端设备和第二终端设备关联失败，第一网络设备向第一终端设备和第二终端设备发送该指示信息。
在一种可能的实现中，第二网络设备接收第一终端设备UAS标识之后，可以先执行步骤908，即确定与第一终端设备相关联的第二终端设备的UAS标识。执行步骤908之后，第二网络设备基于第一终端设备和第二终端设备之间的位置、距离来确定是否对第一终端设备和第二终端设备进行UAS认证。例如，如果第一终端设备和第二终端设备之间的距离小于或等于预设距离，则确定对第一终端设备和第二终端设备进行UAS认证，第一网络设备执行步骤905和步骤909。如果第一终端设备和第二终端设备之间的距离大于预设距离，则确定不对第一终端设备和第二终端设备进行UAS认证。可选的，在确定不对第一终端设备和第二终端设备进行UAS认证时，第二网络设备可向第一网设备发送指示信息，该指示信息可以指示第一终端设备与第二终端设备关联失败或无效。第一网络设备发送该指示信息至第一终端设备和第二终端设备。
在一种可能的实现中，第一网络设备接收第一终端设备的UAS认证结果和第二终端设备的UAS认证结果之后，还可以不向第一终端设备发送第一终端设备和第二终端设备的UAS认证结果，也不向第二终端设备发送第一终端设备和第二终端设备的UAS认证结果，第一网络设备可以向第一终端设备和第二终端设备发送关联指示信息，以指示第一终端设备和第二终端设备之间的关联是否成功。
在一种可能的实现中，也可以由第二终端设备主动发起UAS认证。第二终端设备主动发起UAS认证的流程类似步骤901～步骤906，即将步骤901～步骤906中的第一终端设备替换为第二终端设备。第一网络设备可以存储第一终端设备与第二终端设备的关联关系。第一网络设备接收到第一终端设备的UAS认证结果和第二终端设备的UAS认证结果之后，可以向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果，以及向第二终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果。 或者，第一终端设备与第二终端设备的关联关系也可由第二网络设备存储。第二网络设备在发送第一终端设备的UAS认证结果时，指示第二终端设备的标识(如UAS标识或SUPI或GPSI)，第二网络设备在发送第二终端设备的UAS认证结果时，指示第一终端设备的标识(如UAS标识或SUPI或GPSI)。第一网络设备接收到第一终端设备的UAS认证结果和第二终端设备的UAS认证结果之后，就可以向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果，以及向第二终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果。
需要注意的是，图9所示的方案中步骤901～步骤903也可以替换为图7中的步骤701，以提升效率和节省网络资源。
在一种可能的实现中，上述步骤901～步骤912还可以有其他的执行顺序，本申请对上述步骤901～步骤912中各个步骤之间的执行顺序不做限定。
通过实施图9所描述的方法，能够对第一终端设备和第二终端设备进行UAS认证，并对存储的第一终端设备和第二终端设备之间的关联关系进行认证或授权。
请参见图10，图10是本申请实施例提供的又一种身份认证方法的流程示意图。图10所示的身份认证方法与图9所示的身份认证方法是并列的方案。图10与图9所示的身份认证方法的区别在于，在图9所示的身份认证方法中是由第二网络设备发起对第二终端设备的认证。在图10所示的身份认证方法中是由第一网络设备发起对第二终端设备的认证。如图10所示，该身份认证方法包括如下步骤1001～步骤1013。其中：
1001、第一终端设备向第一网络设备发送第一请求。
其中，第一请求携带第一认证指示信息。该第一认证指示信息用于请求对第一终端设备进行UAS认证。
1002、第一网络设备向第一终端设备发送第二请求。
本申请实施例中，第一网络设备接收第一请求之后，向第一终端设备发送第二请求。其中，该第二请求用于请求获取第一终端设备的UAS标识。
1003、第一终端设备响应于该第二请求，向第一网络设备发送第一终端设备的UAS标识。
1004、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
1005、第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。
步骤1001～步骤1005的具体实现方式，可参见步骤301～步骤305的具体实现方式，在此不赘述。
1006、第二网络设备确定与第一终端设备相关联的第二终端设备的SUPI或GPSI或UAS标识。
本申请实施例中，第二网络设备接收第一终端设备的UAS标识之后，第二网络设备确定与第一终端设备相关联的第二终端设备的SUPI或GPSI或UAS标识。其中，步骤1006可以在步骤1005之前或之后执行。
其中，第二网络设备预先存储了第一终端设备与第二终端设备之间的关联关系。该关联关系也可以称为对应关系或配对关系。可选的，第二网络设备存储的第一终端设备与第二终端设备之间的关联关系可以是在第一终端设备和第二终端设备出厂时配置于第二网络设备中的。或者，第一终端设备与第二终端设备之间的关联关系可以是第一终端设备和 第二终端设备之前关联成功之后存储在第二网络设备中的。再或者，第一终端设备与第二终端设备之间的关联关系可以是UAS服务商在同网络运营商签约时，进行关联之后存储在第二网络设备中的。本发明对关联关系如何配置在第二网络中不作限制，这里不一一列出。
第二网络设备存储第一终端设备与第二终端设备的关联关系的形式可以为：存储第一终端设备的UAS标识或SUPI或GPSI与第二终端设备的UAS标识或SUPI或GPSI之间的关联关系。因此，第二网络设备根据第一终端设备的UAS标识或SUPI或GPSI就可确定第二终端设备的UAS标识或SUPI或GPSI。
在一种可能的实现中，第一请求中还携带设备指示信息，该设备指示信息用于确定第二终端设备。例如，与第一终端设备关联的第二终端设备具有多个，该设备指示信息可以指示需要关联的第二终端设备的数量或序号或名称等。
1007、第二网络设备向第一网络设备发送第一终端设备的UAS认证结果和第二终端设备的SUPI或GPSI或UAS标识。
本申请实施例中，第一终端设备的UAS认证结果和第二终端设备的SUPI或GPSI或UAS标识可以携带于同一个消息中，或者携带于不同的消息中。
1008、第一网络设备向第一终端设备发送第一终端设备的UAS认证结果。
本申请实施例中，第一网络设备从第二网络设备接收第一终端设备的UAS认证结果之后，向第一终端设备发送第一终端设备的UAS认证结果。
在一种可能的实现中，第一网络设备接收第二终端设备的SUPI或GPSI或UAS标识之后，还可获取第二终端设备的UAS认证状态标识，并向第一终端设备发送第二终端设备的UAS认证状态标识。可选的，如果获取的UAS认证状态标识指示尚未认证状态，才执行步骤1009。如果获取的UAS认证状态标识指示认证成功或认证失败状态，则可不执行步骤1009～步骤1011，第一网络设备可以直接执行步骤1012、步骤1013，将第二终端设备的UAS认证状态标识和第一终端设备的UAS认证结果分别发送至第一终端设备和第二终端设备。
1009、第一网络设备向第二网络设备发送第二终端设备的UAS标识。
本申请实施例中，第一网络设备接收到第二终端设备的SUPI或GPSI或UAS标识之后，可以向第二网络设备发送第二终端设备的UAS标识，即第一网络设备发起对第二网络设备的UAS认证。
如果在步骤1007中，第二网络设备发送的是第二终端设备的SUPI或GPSI，则第一网络设备还需要向第二终端设备请求获取第二终端设备的UAS标识。在获取到第二终端设备的UAS标识之后，再发送第二终端设备的UAS标识至第二网络设备。或者，如果第一网络设备中存储了第二终端设备的SUPI或GPSI与第二终端设备的UAS标识的对应关系，则第一网络设备也可基于第二终端设备的SUPI或GPSI获取到第二终端设备的UAS标识。
可选的，执行步骤1005之前，可确定是否对第一终端设备进行UAS认证。若确定对第一终端设备进行UAS认证，执行步骤1005。第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式，可参见上述图4对应的实施例中第二网络设备确定是否对第一终端设备进行UAS认证的具体实现方式。或者，第二网络设备也可基于第一终端设备和第二终端设备之间的位置、距离来确定是否对第一终端设备进行UAS认证。其具体 的实现方式可参见图9对应的实施例中相应的描述，在此不赘述。
可选的，第一网络设备向第二网络设备发送第二终端设备的UAS标识之前，还可以先确定是否对第二终端设备进行UAS认证。若确定对第二终端设备进行UAS认证，则向第二网络设备发送第二终端设备的UAS标识。否则，可选的，第一网络设备可以向第一终端设备和第二终端设备发送指示信息，该指示信息指示第一终端设备与第二终端设备关联失败。
可选的，如果第一网络设备可基于第二终端设备是否为开机状态、第一终端设备与第二终端设备之间的距离、第二终端设备的UAS认证状态、第二终端设备的UAS类型信息等中的一种或多种，来确定是否对第二终端设备进行UAS认证。例如，如果第二终端设备不为开机状态，则确定不对第二终端设备进行UAS认证。如果第二终端设备为开机状态，则确定对第二终端设备进行UAS认证，则执行步骤1009。第一终端设备与第二终端设备之间的距离、第二终端设备的UAS认证状态、第二终端设备的UAS类型信息来确定是否对终端设备进行UAS认证的具体实现方式可参见上文的描述，在此不赘述。
1010、第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证。
本申请实施例中，第二网络设备接收第二终端设备的UAS标识之后，基于第二终端设备的UAS标识对第二终端设备进行UAS认证。第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的原理与第一网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的原理相同，在此不赘述。
1011、第二网络设备向第一网络设备发送第二终端设备的UAS认证结果。
本申请实施例中，第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证之后，向第一网络设备发送第二终端设备的UAS认证结果。
1012、第一网络设备向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息。
本申请实施例中，第一网络设备接收第二终端设备的UAS认证结果之后，向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息。其中，该关联指示信息用于指示第一终端设备和第二终端设备是否关联成功。该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。例如，如果第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过，则该关联指示信息用于指示第一终端设备和第二终端设备关联成功。否则，该关联指示信息用于指示第一终端设备和第二终端设备关联失败。第一网络设备也可直接向第一终端设备发送第二终端设备的UAS认证结果，由终端设备自己根据第一终端设备的UAS认证结果和第二终端设备的UAS认证结果确定第一终端设备和第二终端设备是否关联成功。
1013、第一网络设备向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息。
本申请实施例中，第一网络设备接收到第二网络设备发送的第二终端设备的UAS认证结果之后，向第二终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果，或者，向第二终端设备发送第一终端设备的UAS认证结果和关联指示信息。
其中，第一网络设备可以向第二终端设备一起发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果，或向第二终端设备分开发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果。同理，第一网络设备可以向第一终端设备一起发送 第一终端设备的UAS认证结果和第二终端设备的UAS认证结果，或向第一终端设备分开发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果。
在一种可能的实现中，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果时，还可向第一网络设备发送第一终端设备的UAS标识或SUPI或GPSI，以指示第一网络设备接收的UAS认证结果是第一终端设备的UAS认证结果。同理，第二网络设备向第一网络设备发送第二终端设备的UAS认证结果时，还可向第一网络设备发送第二终端设备的UAS标识或SUPI或GPSI，以指示第一网络设备接收的UAS认证结果是第二终端设备的UAS认证结果。
在一种可能的实现中，第二网络设备向第一网络设备发送第二终端设备的UAS认证结果时，还可向第一网络设备发送第一终端设备的UAS标识或SUPI或GPSI，以指示第一终端设备与第二终端设备关联。从而第一网络设备知道将第一终端设备的UAS认证结果也发送给第二终端设备，并将第二终端设备的UAS认证结果也发送给第一终端设备。
在一种可能的实现中，也可以不执行步骤1006。步骤1007中不携带第二终端设备的UAS标识或SUPI或GPSI。第一网络设备存储了第一终端设备与第二终端设备之间的关联关系。例如，存储了第一终端设备的UAS标识与第二终端设备的UAS标识之间的关联关系。在第一网络设备接收到第一终端设备的UAS认证结果之后，第一网络设备确定与第一终端设备相关联的第二终端设备的UAS标识。第一网络设备确定与第一终端设备相关联的第二终端设备的UAS标识之后，执行后续步骤1010～步骤1013。
需要注意的是，图10所示的方案中步骤1001～步骤1003也可以替换为图7中的步骤701。
在一种可能的实现中，上述步骤1001～步骤1013还可以有其他的执行顺序，本申请对上述步骤1001～步骤1013中各个步骤之间的执行顺序不做限定。
通过实施图10所描述的方法，能够对进行第一终端设备和第二终端设备进行认证，并对第一终端设备和第二终端设备之间的关联关系进行认证或授权。
请参见图11，图11是本申请实施例提供的又一种身份认证方法的流程示意图。图11所示的身份认证方法与图9和图10所示的身份认证方法的区别在于，图9和图10所示的方案是对已存储的第一终端设备与第二终端设备之间的关联关系进行授权或认证。在图11所示的方案中第二网络设备未存储第一终端设备与第二终端设备之间的关联关系。图11所示的方案是对新增的第一终端设备与第二终端设备之间的关联关系进行授权或认证。如图11所示，该身份认证方法包括如下步骤1101～步骤1116。其中：
1101、第二终端设备向第一网络设备发送第三请求。
其中，该第三请求携带第二认证指示信息和新增关联指示信息。该第二认证指示信息用于请求对第二终端设备进行UAS认证。该新增关联指示信息用于请求新增关联关系。
1102、第一网络设备向第二终端设备发送第四请求。
本申请实施例中，第一网络设备接收第三请求之后，向第二终端设备发送第四请求。其中，该第四请求用于请求获取第二终端设备的UAS标识。
1103、第二终端设备响应于该第四请求，向第一网络设备发送第二终端设备的UAS标识。
1104、第一网络设备向第二网络设备发送第二终端设备的UAS标识和新增关联指示信 息。
1105、第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证。
其中，步骤1101～步骤1105的具体实现方式可参见上述步骤301～步骤305的具体实现方式，在此不赘述。在一种可能的实现中，如果步骤1101中的第三请求中包括了UAS标识，那么类似图7中的实现方式，可以不执行步骤1102和步骤1103，以提升效率和节省网络资源。
11051、第二网络设备向第一网络设备发送用于获取第二终端设备的第二关联信息的请求。
11052、第一网络设备向第二终端设备发送用于获取第二终端设备的第二关联信息的请求。
11053、第二终端设备向第一网络设备发送第二终端设备的第二关联信息。
11054、第一网络设备向第二网络设备发送第二终端设备的第二关联信息。
其中，步骤11051～步骤11054可以在第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的过程中执行。或者，步骤11051～步骤11054可以在步骤1104之后，在步骤1105之前执行。或者，步骤11051～步骤11054可以在步骤1105之后执行。图11以步骤11051～步骤11054在第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的过程中执行为例。
本申请实施例中，第二关联信息可以为密码(password)、密码短语(pass phrase)、信任状等用于建立关联关系的信息。
1106、第二网络设备向第一网络设备发送第二终端设备的UAS认证结果。
1107、第一网络设备向第二终端设备发送第二终端设备的UAS认证结果。
其中，步骤1101～步骤1107的具体实现方式可参见上述步骤301～步骤307的具体实现方式，在此不赘述。
1108、第二终端设备向第一网络设备发送第一请求。
其中，该第一请求携带第一认证指示信息和新增关联指示信息。该第一认证指示信息用于请求对第一终端设备进行UAS认证。该新增关联指示信息用于请求新增关联关系。
1109、第一网络设备向第一终端设备发送第二请求。
本申请实施例中，第一网络设备接收第一请求之后，向第一终端设备发送第二请求。其中，该第二请求用于请求获取第一终端设备的UAS标识。
在一种可能的实现中，如果步骤1108中的第一请求中包括了UAS标识，那么类似图7中的实现方式，可以不执行步骤1109和步骤1110，以提升效率和节省网络资源。
1110、第一终端设备响应于该第二请求，向第一网络设备发送第一终端设备的UAS标识。
1111、第一网络设备向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息。
1112、第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。
11121、第二网络设备向第一网络设备发送用于获取第一终端设备的第一关联信息的请求。
11122、第一网络设备向第一终端设备发送用于获取第一终端设备的第一关联信息的请求。
11123、第一终端设备向第一网络设备发送第一终端设备的第一关联信息。
11124、第一网络设备向第二网络设备发送第一终端设备的第一关联信息。
其中，步骤11121～步骤11124可以在第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的过程中执行。或者，步骤11121～步骤11124可以在步骤1111之后，在步骤1112之前执行。或者，步骤11121～步骤11124可以在步骤1112之后执行。图11以步骤11121～步骤11124在第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的过程中执行为例。
本申请实施例中，第一关联信息可以为密码(password)、密码短语(pass phrase)、信任状等用于建立关联关系的信息。
1113、第二网络设备确定第一关联信息与第二关联信息相匹配。
第二网络设备接收到第一关联信息之后，会查找与第一关联信息相匹配的关联信息。在本申请实施例中，第二网络设备查找到第一关联信息与第二关联信息相匹配。第一关联信息与第二关联信息相匹配可以指第一关联信息与第二关联信息相同。例如第一关联信息为密码“12345”，第二关联信息也为密码“12345”，则第一关联信息与第二关联信息相匹配。如果第一终端设备发送的第一关联信息与第二终端设备发送的第二关联信息相匹配，那么，第二网络设备确定第一终端设备和第二终端设备想要建立关联关系的终端设备。因此，第二网络设备向第一网络设备发送第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI。其中，第二终端设备的UAS标识或SUPI或GPSI用于指示第二终端设备要与第一终端设备要建立关联关系。这样第一网络设备就可向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息，并向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息，以指示第一终端设备和第二终端设备的关联结果。
如前文实施例所述，第二网络设备中第二终端设备的SUPI或GPSI可以是第一网络设备发送至第二网络设备的或者是第二网络设备中存储的与第二终端设备的UAS标识所关联的第二终端设备的SUPI或GPSI。
1114、第二网络设备向第一网络设备发送第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI。
1115、第一网络设备向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。
其中，该关联指示信息用于指示第一终端设备和第二终端设备是否关联成功。该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。例如，如果第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过，则该关联指示信息用于指示第一终端设备和第二终端设备关联成功。否则，该关联指示信息用于指示第一终端设备和第二终端设备关联失败。第一网络设备也可直接向第一终端设备发送第二终端设备的UAS认证结果，由第一终端设备自己根据第一终端设备的UAS认证结果和第二终端设备的UAS认证结果确定第一终端设备和第二终端设备是否关联成功。
1116、第一网络设备向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
其中，第一网络设备可以向第一终端设备一起发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息，或向第一终端设备分开发送第一终端设 备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。同理，第一网络设备可以向第二终端设备一起发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息，或向第二终端设备分开发送第二终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，如图12所示，第一网络设备接收该第三请求之后，可确定是否允许新增第二终端设备的关联关系。如果允许新增第二终端设备的关联关系，则执行步骤1203，即向第二终端设备发送第四请求。可选的，如果不允许新增第二终端设备的关联关系，则向第二终端设备发送用于指示新增关联失败的指示信息。
例如，第一网络设备可存储允许新增关联关系的终端设备的标识列表(如SUPI列表或GPSI列表)，若第二终端设备处于该标识列表中，则确定允许新增第二终端设备的关联关系。若第二终端设备不处于该标识列表中，则确定不允许新增第二终端设备的关联关系。
再如，第一网络设备可存储不允许新增关联关系的终端设备的标识列表(如SUPI列表或GPSI列表)，若第二终端设备处于该标识列表中，则确定不允许新增第二终端设备的关联关系。若第二终端设备不处于该标识列表中，则确定允许新增第二终端设备的关联关系。
在一种可能的实现中，第二网络设备接收第二终端设备的UAS标识和新增关联指示信息之后，可确定是否允许新增第二终端设备的关联关系。如果允许新增第二终端设备的关联关系，则基于第二终端设备的UAS标识对第二终端设备进行UAS认证。可选的，如果不允许新增第二终端设备的关联关系，则向第一网络设备发送用于指示新增关联失败的指示信息，并由第一网络设备向第二终端设备发送该新增关联失败的指示信息。具体实现原理可参见前文描述，在此不赘述。
在一种可能的实现中，如图12所示，第一网络设备接收该第一请求之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则执行步骤1211，即向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。具体实现原理可参见前文描述，在此不赘述。
在一种可能的实现中，第二网络设备接收第一终端设备的UAS标识和新增关联指示信息之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则基于第一终端设备的UAS标识对第一终端设备进行UAS认证。可选的，如果不允许新增第一终端设备的关联关系，则向第一网络设备发送用于指示新增关联失败的指示信息，并由第一网络设备向第一终端设备发送该新增关联失败的指示信息。具体实现原理可参见前文描述，在此不赘述。
在一种可能的实现中，如图12所示，第二网络设备确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。其中，步骤1219可在步骤1216之前执行，或在步骤1216之后执行。可选的，第二网络设备还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省关联或配对时间。
在一种可能的实现中，上述步骤1101～步骤1116还可以有其他的执行顺序，本申请对 上述步骤1101～步骤1116中各个步骤之间的执行顺序不做限定。
请参见图13，图13是本申请实施例提供的又一种身份认证方法的流程示意图。图13所示的身份认证方法与图11所示的身份认证方法的区别在于，图11是由第二网络设备确定第一关联信息和第二关联信息相匹配，图13是由第一网络设备确定第一关联信息和第二关联信息相匹配。如图13所示，该身份认证方法包括如下步骤1131～步骤1116。其中：
1301、第二终端设备向第一网络设备发送第三请求。
其中，第三请求携带第二认证指示信息和新增关联指示信息。该第二认证指示信息用于请求对第二终端设备进行UAS认证。
1302、第一网络设备向第二终端设备发送第四请求。
本申请实施例中，第一网络设备接收第三请求之后，向第二终端设备发送第四请求。其中，该第四请求用于请求获取第二终端设备的UAS标识。
1303、第二终端设备响应于该第四请求，向第一网络设备发送第二终端设备的UAS标识。
1304、第一网络设备向第二网络设备发送第二终端设备的UAS标识。
1305、第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证。
13051、第一网络设备向第二终端设备发送用于获取第二终端设备的第二关联信息的请求。
13052、第二终端设备向第一网络设备发送第二终端设备的第二关联信息。
其中，步骤13051～步骤13052可以在第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的过程中执行。或者，步骤13051～步骤13052可以在步骤1304之后，在步骤1305之前执行。或者，步骤13051～步骤13052可以在步骤1305之后、或者步骤1306之后、或者步骤1307之后执行。图13以步骤13051～步骤13052在第二网络设备基于第二终端设备的UAS标识对第二终端设备进行UAS认证的过程中执行为例。
本申请实施例中，第二关联信息可以为密码(password)、密码短语(pass phrase)、信任状等用于建立关联关系的信息。
1306、第二网络设备向第一网络设备发送第二终端设备的UAS认证结果。
1307、第一网络设备向第二终端设备发送第二终端设备的UAS认证结果。
其中，步骤1301～步骤1307的具体实现方式可参见上述步骤301～步骤307的具体实现方式，在此不赘述。在一种可能的实现中，如果步骤1301中的第三请求中包括了UAS标识，那么类似图7中的实现方式，可以不执行步骤1302和步骤1303，以提升效率和节省网络资源。
1308、第二终端设备向第一网络设备发送第一请求。
其中，第一请求携带第一认证指示信息和新增关联指示信息。该第一认证指示信息用于请求对第一终端设备进行UAS认证。该新增关联指示信息用于请求新增关联关系。
1309、第一网络设备向第一终端设备发送第二请求。
本申请实施例中，第一网络设备接收第一请求之后，向第一终端设备发送第二请求。其中，该第二请求用于请求获取第一终端设备的UAS标识。
1310、第一终端设备响应于该第二请求，向第一网络设备发送第一终端设备的UAS标识。
在一种可能的实现中，如果步骤1308中的第一请求中包括了UAS标识，那么类似图7中的实现方式，可以不执行步骤1309和步骤1310，以提升效率和节省网络资源。
1311、第一网络设备向第二网络设备发送第一终端设备的UAS标识。
1312、第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证。
13121、第一网络设备向第一终端设备发送用于获取第一终端设备的第一关联信息的请求。
13122、第一终端设备向第一网络设备发送第一终端设备的第一关联信息。
其中，步骤13121～步骤13122可以在第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的过程中执行。或者，步骤13121～步骤13122可以在步骤1311之后，在步骤1312之前执行。或者，步骤13121～步骤13122可以在步骤1312之后执行。图11以步骤13121～步骤13122在第二网络设备基于第一终端设备的UAS标识对第一终端设备进行UAS认证的过程中执行为例。
本申请实施例中，第一关联信息可以为密码(password)、密码短语(pass phrase)、信任状等用于建立关联关系的信息。
1313、第二网络设备向第一网络设备发送第一终端设备的UAS认证结果。
1314、第一网络设备确定第一关联信息与第二关联信息相匹配。
第一网络设备接收到第一关联信息之后，会查找与第一关联信息相匹配的关联信息。在本申请实施例中，第一网络设备查找到第一关联信息与第二关联信息相匹配。那么，第一网络设备确定第一终端设备和第二终端设备需要建立关联关系。因此，第一网络设备可向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息，并向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。其中，关于关联指示信息的描述可参见前文中的描述，在此不赘述。
其中，步骤1314可以在第一网络设备接收第一终端设备的UAS认证结果之前执行，或之后执行。
1315、第一网络设备向第一终端设备发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。
1316、第一网络设备向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
其中，第一网络设备可以向第一终端设备一起发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息，或向第一终端设备分开发送第一终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。同理，第一网络设备可以向第二终端设备一起发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或关联指示信息，或向第二终端设备分开发送第二终端设备的UAS认证结果和第二终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，如图14所示，第一网络设备接收该第三请求之后，可确定是否允许新增第二终端设备的关联关系。如果允许新增第二终端设备的关联关系，则向第二终端设备发送第四请求。可选的，如果不允许新增第二终端设备的关联关系，则向第二终端设备发送用于指示新增关联失败的指示信息。具体实现原理可参见前文描述，在此不赘述。
在一种可能的实现中，如图14所示，第一网络设备接收该第一请求之后，可确定是 否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则向第一终端设备发送用于指示新增关联失败的指示信息。具体实现原理可参见前文描述，在此不赘述。
在一种可能的实现中，如图14所示，第一网络设备确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。其中，步骤1419可在步骤1417之前执行，或在步骤1417之后执行。可选的，第一网络设备还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。可选的，第一网络设备还可将该关联关系发送给第二网络设备进行存储。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省配对时间。
在一种可能的实现中，上述步骤1301～步骤1316还可以有其他的执行顺序，本申请对上述步骤1301～步骤1316中各个步骤之间的执行顺序不做限定。
通过实施图13所描述的方法，能够对进行第一终端设备和第二终端设备进行认证，并对新建第一终端设备和第二终端设备的关联关系进行认证或授权。
请参见图15，图15是本申请实施例提供的又一种身份认证方法的流程示意图。图15所示的身份认证方法与图11～图14的区别在于，图11～图14是在终端设备进行UAS认证的过程中，对新增的关联关系进行授权或认证。图15是在第一终端设备和第二终端设备UAS认证通过之后，对新增的关联关系进行授权或认证。如图15所示，该身份认证方法包括如下步骤1501～步骤1518。其中：
1501、第一终端设备通过UAS认证。
1502、第二终端设备通过UAS认证。
其中，步骤1503和步骤1505分别是在步骤1501和步骤1502之后执行的。
1503、第一终端设备向第一网络设备发送第一关联请求，该第一关联请求用于请求新增关联关系。
在一种可能的实现中，第一关联请求可携带第一终端设备的UAS标识、终端标识(如SUCI或GUTI)和第一终端设备的UAS类型信息。该UAS类型信息用于指示第一终端设备在UAS中的设备类型。
1504、第一网络设备向第二网络设备发送该第一关联请求。
本申请实施例中，第一网络设备接收第一关联请求之后，向第二网络设备发送该第一关联请求。
1505、第一终端设备向第一网络设备发送第二关联请求，该第二关联请求用于请求新增关联关系。
在一种可能的实现中，第二关联请求可携带第二终端设备的UAS标识、终端标识(如SUCI或GUTI)和第二终端设备的UAS类型信息。该UAS类型信息用于指示第二终端设备在UAS中的设备类型。
1506、第一网络设备向第二网络设备转送该第二关联请求。
本申请实施例中，第一网络设备接收第二关联请求之后，向第二网络设备发送该第二关联请求。
1507、第二网络设备向第一网络设备发送第一获取请求，该第一获取请求用于获取第一关联信息。
本申请实施例中，第二网络设备接收第一关联请求之后，向第一网络设备发送第一获取请求。
1508、第一网络设备向第一终端设备送发该第一获取请求。
本申请实施例中，第一网络设备接收第一获取请求之后，向第一终端设备发送该第一获取请求。
1509、第二网络设备向第一网络设备发送第二获取请求，该第二获取请求用于获取第二关联信息。
本申请实施例中，第二网络设备接收第二关联请求之后，向第一网络设备发送第二获取请求。
1510、第一网络设备向第二终端设备发送该第二获取请求。
本申请实施例中，第一网络设备接收第二获取请求之后，向第二终端设备发送该第二获取请求。
1511、第一终端设备向第一网络设备发送第一关联信息。
本申请实施例中，第一终端设备接收第一获取请求之后，向第一网络设备发送第一关联信息。
本申请实施例中，第一关联信息和第二关联信息可以为密码(password)、密码短语(pass phrase)、信任状等用于建立关联关系的信息。
1512、第一网络设备向第二网络设备发送第一关联信息。
本申请实施例中，第一网络设备接收第一关联信息之后，向第二网络设备发送第一关联信息。
1513、第二终端设备向第一网络设备发送第二关联信息。
本申请实施例中，第二终端设备接收第二获取请求之后，向第一网络设备发送第二关联信息。
1514、第一网络设备向第二网络设备发送第二关联信息。
本申请实施例中，第一网络设备接收第二关联信息之后，向第二网络设备送发第二关联信息。
1515、第二网络设备确定第一关联信息与第二关联信息相匹配。
1516、第二网络设备向第一网络设备发送关联成功指示信息。其中，该关联成功指示信息用于指示第一终端设备和第二终端设备关联成功。
本申请实施例中，第二网络设备接收第一关联信息和第二关联信息之后，可以确定第一关联信息和第二关联信息是否相匹配。如果相匹配，则执行步骤1516，即向第一网络设备发送关联成功指示信息。第一关联信息与第二关联信息相匹配，则表明第一终端设备和第二终端设备想要建立关联关系。由于第一终端设备和第二终端设备都已通过UAS认证，因此，第二网络设备可以向第一网络设备发送关联成功指示信息。
可选的，如果第一关联信息和第二关联信息不相匹配，则第二网络设备可向第一网络设备发送关联失败指示信息，并由第一网络设备发送该关联失败指示信息至第一终端设备和第二终端设备。
在一种可能的实现中，如果第一关联信息与第二关联信息相匹配，则还可基于第一终 端设备的UAS类型信息和第二终端设备的UAS类型信息确定是否执行步骤1516。例如，如果第一终端设备的UAS类型信息和第二终端设备的UAS类型信息不相同，则执行步骤1516。如果第一终端设备的UAS类型信息和第二终端设备的UAS类型信息相同，则第二网络设备向第一网络设备发送关联失败指示信息，以指示第一终端设备和第二终端设备关联失败。并由第一网络设备将该关联失败指示信息发送给第一终端设备和第二终端设备。
1517、第一网络设备向第一终端设备发送关联成功指示信息。
1518、第一网络设备向第二终端设备发送关联成功指示信息。
需要说明的是，步骤1501、步骤1503、步骤1504、步骤1507、步骤1508、步骤1511、步骤1512是针对第一终端设备的消息，而步骤1502、步骤1505、步骤1506、步骤1509、步骤1510、步骤1513、步骤1514是针对第二终端的消息。本发明对执行针对第一终端设备的消息和执行针对第二终端设备的消息的先后顺序不作限定。本实施例是以第一终端设备消息和第二终端设备消息交替进行的，也可以是先执行完第一终端设备步骤，再执行第二终端设备步骤，或者是各种不同组合。同样步骤1517和步骤1518的先后顺序也可以互换。在一种可能的实现中，上述步骤1501～步骤1518还可以有其他的执行顺序，本申请对上述步骤1501～步骤1518中各个步骤之间的执行顺序不做限定。
在一种可能的实现中，如图16所示，第二网络设备接收第一关联请求之后，还可确定是否允许为第一终端设备新增关联关系。若确定允许为第一终端设备新增关联关系，则向第一网络设备发送该第一获取请求。可选的，否则，向第一网络设备发送用于指示新增关联失败的指示信息。第一网络设备向第一终端设备发送该指示信息。如何确定是否允许为第一终端设备新增关联关系可参见前文的描述。
或者，也可以由第一网络设备来确定是否允许为第一终端设备新增关联关系。第一网络设备接收第一关联请求之后，确定是否允许为第一终端设备新增关联关系。若确定允许为第一终端设备新增关联关系，则向第二网络设备发送该第一关联请求。否则，向第一终端设备发送用于指示新增关联失败的指示信息。
第一网络设备和第二网络设备接收到第二关联请求之后同理，在此不赘述。
在一种可能的实现中，如图16所示，第二网络设备确定第一关联信息与第二关联信息相匹配之后，可以存储第一终端设备和第二终端设备的关联关系。或者，第一网络设备接收关联指示信息之后，也可以存储第一终端设备和第二终端设备的关联关系。通过存储第一终端设备和第二终端设备的关联关系，下次第一终端设备和第二终端设备需要配对使用时，就不需要重新建立关联关系，有利于节省关联或配对时间。
通过实施图15所描述的方法，能够对第一终端设备和第二终端设备之间的关联关系进行认证。
请参见图17，图17是本申请实施例提供的又一种身份认证方法的流程示意图。图17所示的身份认证方法与图11～图14的区别在于，图11～图14是在终端设备进行UAS认证的过程中，对新增的关联关系进行授权或认证。图17是在第一终端设备和第二终端设备UAS认证通过之后，对新增的关联关系进行授权或认证。如图17所示，该身份认证方法包括如下步骤1701～步骤1700。其中：
1701、第一终端设备通过UAS认证。
1702、第二终端设备通过UAS认证。
其中，步骤1703和步骤1705分别是在步骤1701和步骤1702之后执行的。
1703、第一终端设备向第一网络设备发送第一关联请求，该第一关联请求用于请求与第二终端设备新增关联关系。
在一种可能的实现中，第一关联请求可携带第一终端设备的UAS标识、第一终端设备的终端标识(如SUCI或GUTI)和第一终端设备的UAS类型信息。该第一关联请求还可携带第二终端设备的UAS标识、第二终端设备的终端标识(如SUCI或GUTI)和第二终端设备的UAS类型信息。该UAS类型信息用于指示设备在UAS中的设备类型。
1704、第一网络设备向第二网络设备发送该第一关联请求。
本申请实施例中，第一网络设备接收第一关联请求之后，向第二网络设备发送该第一关联请求。
1705、第二网络设备向第一网络设备发送该第一关联请求。
本申请实施例中，第二网络设备接收第一关联请求之后，向第一网络设备发送该第一关联请求。
1706、第一网络设备向第二终端设备发送该第一关联请求。
本申请实施例中，第一网络设备接收该第一关联请求之后，向第二终端设备发送该第一关联请求。
1707、第二终端设备向第一网络设备发送关联确认指示信息。
本申请实施例中，第二终端设备接收第一关联请求之后，向第一网络设备发送关联确认指示信息。或者，第二终端设备还可向第一网络设备发送关联拒绝指示信息，用于指示拒绝与第一终端设备进行关联。例如，第二终端设备接收第一关联请求之后，可以输出提示信息，提示是否接受第一终端设备的关联请求。第二终端设备接收到确认关联操作之后，向第一网络设备发送关联确认指示信息。第二终端设备接收到拒绝关联操作之后，向第一网络设备发送关联拒绝指示信息。
1708、第一网络设备向第二网络设备发送该关联确认指示信息。
本申请实施例中，第一网络设备接收该关联确认指示信息之后，向第二网络设备发送该关联确认指示信息。
1709、第二网络设备向第一网络设备发送关联成功指示信息。
本申请实施例中，第二网络设备接收该关联确认指示信息，向第一网络设备发送关联成功指示信息。其中，关联成功指示信息用于指示第一终端设备和第二终端设备关联成功。
在一种可能的实现中，如果第二网络设备接收到第二终端设备的关联拒绝指示信息，第二网络设备还可向第一网络设备发送关联失败指示信息，用于指示第一终端设备和第二终端设备关联失败。第一网络设备接收该关联失败指示信息之后，向第一终端设备和第二终端设备发送该关联失败指示信息。
1710、第一网络设备向第一终端设备发送关联成功指示信息。
1711、第一网络设备向第二终端设备发送关联成功指示信息。
本申请实施例中，第一网络设备接收关联成功指示信息之后，向第一终端设备和第二终端设备发送关联成功指示信息。
在一种可能的实现中，如图18所示，第二网络设备接收第一关联请求之后，还可确定是否允许为第一终端设备新增关联关系。若确定允许为第一终端设备新增关联关系，则向第一网络设备发送该第一关联请求。可选的，否则，向第一网络设备发送用于指示新增 关联失败的指示信息。如何确定是否允许为第一终端设备新增关联关系可参见前文的描述。
在一种可能的实现中，第二网络设备接收到关联确认指示信息之后，可以存储第一终端设备和第二终端设备的关联关系。
在一种可能的实现中，第一网络设备接收关联成功指示信息之后，也可以存储第一终端设备和第二终端设备的关联关系。
在一种可能的实现中，上述步骤1701～步骤1711还可以有其他的执行顺序，本申请对上述步骤1701～步骤1711中各个步骤之间的执行顺序不做限定。
通过实施图17所描述的方法，能够对第一终端设备和第二终端设备之间的关联关系进行认证。
请参见图19，图19示出了本申请实施例的一种通信装置的结构示意图。图19所示的通信装置可以用于执行上述图3～图17所描述的方法实施例中第一网络设备的部分或全部功能。该装置可以是网络设备，也可以是网络设备中的装置，或者是能够和网络设备匹配使用的装置。其中，该通信装置还可以为芯片系统。图19所示的通信装置可以包括接收单元1901和发送单元1902。其中：
接收单元1901，用于接收第一终端设备发送的第一请求，第一请求携带第一认证指示信息，第一认证指示信息用于请求对第一终端设备进行无人机系统UAS认证，第一终端设备为UAS中的设备；发送单元1902，用于向第一终端设备发送第二请求，第二请求用于请求获取第一终端设备的UAS标识；接收单元1901，还用于接收第一终端设备发送的第一终端设备的UAS标识；发送单元1902，还用于向第二网络设备发送第一终端设备的UAS标识；接收单元1901，还用于接收第二网络设备发送的第一终端设备的UAS认证结果；发送单元1902，还用于向第一终端设备发送第一终端设备的UAS认证结果。
在一种可能的实现中，第一认证指示信息为注册类型信息，或第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型。
在一种可能的实现中，通信装置还包括：处理单元，用于确定是否对第一终端设备进行UAS认证；发送单元1902向第一终端设备发送第二请求的方式具体为：当确定对第一终端设备进行UAS认证时，向第一终端设备发送第二请求。
在一种可能的实现中，处理单元确定是否对第一终端设备进行UAS认证的方式具体为：基于第一终端设备的UAS认证状态标识确定是否对第一终端设备进行UAS认证。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型、服务类型或业务类型；处理单元确定是否对第一终端设备进行UAS认证的方式具体为：基于接收的UAS类型信息确定是否对第一终端设备进行UAS认证。
在一种可能的实现中，第一请求携带第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型；发送单元1902，还用于向第二网络设备发送第一终端设备的UAS类型信息。
在一种可能的实现中，第二请求还用于请求获取第一终端设备的UAS类型信息，UAS类型信息指示第一终端设备在UAS中的设备类型；接收单元1901，还用于接收第一终端设备发送的第一终端设备的UAS类型信息；发送单元1902，还用于向第二网络设备发送第一终端设备的UAS类型信息。
在一种可能的实现中，第一网络设备还包括处理单元，用于基于UAS认证结果更新第一终端设备的UAS认证状态。
在一种可能的实现中，接收单元1901接收第一终端设备的UAS标识之后，接收单元1901还可接收第二网络设备发送的与第一终端设备相关联的第二终端设备的UAS认证结果；发送单元1902，还用于向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；发送单元1902，还用于向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果，或发送第二终端设备的UAS认证结果和关联指示信息。
在一种可能的实现中，发送单元1902向第二网络设备发送第一终端设备的UAS标识之后，接收单元1901还可接收第二网络设备发送的第二终端设备的UAS标识或SUPI或GPSI；向第二网络设备发送第二终端设备的UAS标识；接收单元1901接收第二终端设备的UAS认证结果之后，发送单元1902，还用于向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；发送单元1902，还用于向第二终端设备发送第二终端设备的UAS认证结果和第一终端设备的UAS认证结果或该关联指示信息。
在一种可能的实现中，第一网络设备还包括处理单元，用于在接收单元1901接收与第一终端设备相关联的第二终端设备的UAS标识或SUPI或GPSI之后，确定是否对第二终端设备进行UAS认证。若是，则发送单元1902向第二网络设备发送第二终端设备的UAS标识。可选的，确定不允许对第二终端设备进行UAS认证，则发送单元1902向第一终端设备发送指示信息，该指示信息指示第一终端设备和第二终端设备关联失败。
在一种可能的实现中，该第一请求还携带新增关联指示信息。发送单元1902向第二网络设备发送第一终端设备的UAS标识的具体实施方式为：向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息。发送单元1902向第二网络设备发送第一终端设备的UAS标识和新增关联指示信息之后，发送单元1902向第一终端设备发送用于获取第一终端设备的第一关联信息的请求；接收单元1901接收第一终端设备发送的第一终端设备的第一关联信息；发送单元1902向第二网络设备发送第一终端设备的第一关联信息。其中，接收单元1901接收第二网络设备发送的第一终端设备的UAS认证结果的具体实施方式为：接收第二网络设备发送的第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI；接收单元1901接收第一终端设备的UAS认证结果和第二终端设备的UAS标识或SUPI或GPSI之后，发送单元1902还向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。发送单元1902还可向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，接收单元1901接收该第一请求之后，可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则发送单元1902向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则发送单元1902向第一终端设备发送用于指示新增关联失败的指示信息。
在一种可能的实现中，第一请求中还携带新增关联指示信息，用于请求新增关联关系，接收单元1901接收第一请求之后，发送单元1902向第一终端设备发送用于获取第一终端设备的第一关联信息的请求；接收单元1901接收第一终端设备发送的第一关联信息；处理单元确定第一关联信息与第二终端设备发送的第二关联信息相匹配；发送单元1902向第一终端设备发送第二终端设备的UAS认证结果或关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到；发送单元1902向第二终端设备发送第一终端设备的UAS认证结果或关联指示信息。
在一种可能的实现中，接收单元1901接收该第一请求之后，处理单元可确定是否允许新增第一终端设备的关联关系。如果允许新增第一终端设备的关联关系，则发送单元1902向第一终端设备发送第二请求。可选的，如果不允许新增第一终端设备的关联关系，则发送单元1902向第一终端设备发送用于指示新增关联失败的指示信息。
在一种可能的实现中，处理单元确定第一关联信息与第二关联信息相匹配之后，还可存储第一终端设备和第二终端设备的关联关系。可选的，处理单元还可在确定第一终端设备的UAS认证结果和第二终端设备的UAS认证结果均为认证通过时，才存储第一终端设备和第二终端设备的关联关系。
在一种可能的实现中，第一请求也可以还携带第一终端设备的UAS标识，这样发送单元1902就不需要再向第一终端设备发送第二请求，以及接收单元1901不需要接收第一终端设备响应第二请求发送的UAS标识。
请参见图19，图19示出了本申请实施例的一种通信装置的结构示意图。图19所示的通信装置可以用于执行上述图3～图17所描述的方法实施例中第一终端设备的部分或全部功能。该装置可以是终端设备，也可以是终端设备中的装置，或者是能够和终端设备匹配使用的装置。其中，该通信装置还可以为芯片系统。图19所示的通信装置可以包括接收单元1901和发送单元1902。其中：
发送单元1902，用于向第一网络设备发送第一请求，第一请求携带第一认证指示信息，第一认证指示信息用于请求对通信装置进行UAS认证；
接收单元1901，用于接收第一网络设备发送的第二请求，第二请求用于请求获取通信装置的UAS标识；
发送单元1902，还用于响应于第二请求，向第一网络设备发送通信装置的UAS标识；
接收单元1901，还用于接收第一网络设备发送的通信装置的UAS认证结果。
在一种可能的实现中，第一认证指示信息为注册类型信息，或通信装置的UAS类型信息，UAS类型信息指示通信装置在UAS中的设备类型。
在一种可能的实现中，第一请求携带通信装置的UAS类型信息，UAS类型信息指示通信装置在UAS中的设备类型、业务类型、或者服务类型。
在一种可能的实现中，第二请求还用于请求获取通信装置的UAS类型信息，
发送单元1902，还用于向第一网络设备发送通信装置的UAS类型信息。
在一种可能的实现中，接收单元1901还可接收与第一终端设备关联的第二终端设备的UAS认证结果；处理单元基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，接收单元1901还可接收 关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息。
在一种可能的实现中，第一请求还携带新增关联指示信息。接收单元1901还可接收第二终端设备的UAS认证结果；处理单元基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，接收单元1901还可接收关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。
在一种可能的实现中，接收单元1901接收第一网络设备发送的用于获取第一终端设备的第一关联信息的请求；发送单元1902向第一网络设备发送第一终端设备的第一关联信息；接收单元1901还可接收第二终端设备的UAS认证结果；第一终端设备基于第一终端设备的UAS认证结果以及第二终端设备的UAS认证结果确定第一终端设备和第二终端设备的关联结果。或者，接收单元1901还可接收关联指示信息，该关联指示信息用于指示第一终端设备与第二终端设备的关联结果，该关联指示信息基于第一终端设备的UAS认证结果和第二终端设备的UAS认证结果得到。
在一种可能的实现中，在通过UAS认证之后，发送单元1902向第一网络设备发送第一关联请求，该第一关联请求用于请求新增关联关系；接收单元1901接收第一网络设备发送的第一获取请求；发送单元1902向第一网络设备发送第一关联信息；接收单元1901接收关联成功指示信息，该关联成功指示信息用于指示第一终端设备与第二终端设备关联成功。
在一种可能的实现中，在通过UAS认证之后，发送单元1902向第一网络设备发送第一关联请求，该第一关联请求用于请求与第二终端设备新增关联关系；接收单元1901接收关联成功指示信息。
如图20所示为本申请实施例提供的一种通信装置200，用于实现上述方法中第一网络设备的功能。该装置可以是网络设备或用于网络设备的装置。例如，网络设备可以是AMF、SEAF等。用于网络设备的装置可以为网络设备内的芯片系统或芯片。其中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。通信装置200包括至少一个处理器2020，用于实现本申请实施例提供的方法中第一网络设备的数据处理功能。装置200还可以包括通信接口2010，用于实现本申请实施例提供的方法中第一网络设备的收发操作。在本申请实施例中，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口，用于通过传输介质和其它设备进行通信。例如，通信接口2010用于装置200中的装置可以和其它设备进行通信。处理器2020利用通信接口2010收发数据，并用于实现上述方法实施例所述的方法。
装置200还可以包括至少一个存储器2030，用于存储程序指令和/或数据。存储器2030和处理器2020耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器2020可能和存储器2030协同操作。处理器2020可能执行存储器2030中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
本申请实施例中不限定上述通信接口2010、处理器2020以及存储器2030之间的具体 连接介质。本申请实施例在图20中以存储器2030、通信接口2020以及通信接口2010之间通过总线2040连接，总线在图20中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图20中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
装置200具体是用于第一网络设备的装置时，例如装置200具体是芯片或者芯片系统时，通信接口2010所输出或接收的可以是基带信号。装置200具体是第一网络设备时，通信接口2010所输出或接收的可以是射频信号。在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
如图21a所示为本申请实施例提供的一种通信装置210，用于实现上述方法中第一终端设备的功能。该装置可以是终端设备或用于终端设备的装置。例如，终端设备可以是手机、穿戴式设备或平板电脑等。用于终端设备的装置可以为终端设备内的芯片系统或芯片。其中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。装置210包括至少一个处理器2121，用于实现本申请实施例提供的方法中第一终端设备的数据处理功能。装置210还可以包括通信接口2110，用于实现本申请实施例提供的方法中第一终端设备的收发操作。在本申请实施例中，通信接口可以是收发器、电路、总线、模块或其它类型的通信接口，用于通过传输介质和其它设备进行通信。例如，通信接口2110用于装置210中的装置可以和其它设备进行通信。处理器2121利用通信接口2110收发数据，并用于实现上述方法实施例所述的方法。
装置210还可以包括至少一个存储器2130，用于存储程序指令和/或数据。存储器2130和处理器2121耦合。本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器2121可能和存储器2130协同操作。处理器2121可能执行存储器2130中存储的程序指令。所述至少一个存储器中的至少一个可以包括于处理器中。
本申请实施例中不限定上述通信接口2110、处理器2121以及存储器2130之间的具体连接介质。本申请实施例在图21a中以存储器2130、通信接口2121以及通信接口2110之间通过总线2140连接，总线在图21a中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图21a中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
装置210具体是用于终端设备的装置时，例如装置210具体是芯片或者芯片系统时，通信接口2110所输出或接收的可以是基带信号。装置210具体是终端设备时，通信接口2110所输出或接收的可以是射频信号。在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件 模块组合执行完成。
作为示例，图21b为本申请实施例提供的另一种终端设备2100的结构示意图。该终端设备可执行上述方法实施例中第一终端设备所执行的操作。
为了便于说明，图21b仅示出了终端设备的主要部件。如图21b所示，终端设备2100包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端设备进行控制，执行软件程序，处理软件程序的数据，例如用于支持终端设备执行图3～图17所描述的流程。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。终端设备2100还可以包括输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当终端设备开机后，处理器可以读取存储单元中的软件程序，解释并执行软件程序的，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
本领域技术人员可以理解，为了便于说明，图21b仅示出了一个存储器和处理器。在实际的终端设备中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器(central processing unit，CPU)，基带处理器主要用于对通信协议以及通信数据进行处理，CPU主要用于对整个终端设备进行控制，执行软件程序，处理软件程序的数据。可选的，该处理器还可以是网络处理器(network processor，NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。存储器可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合。
示例性的，在本申请实施例中，如图21b所示，可以将具有收发功能的天线和射频电路视为终端设备2100的通信单元2101，将具有处理功能的处理器视为终端设备2100的处理单元2102。
通信单元2101也可以称为收发器、收发机、收发装置等，用于实现收发功能。可选的，可以将通信单元2101中用于实现接收功能的器件视为接收单元，将通信单元2101中用于实现发送功能的器件视为发送单元，即通信单元2101包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、 发射器或者发射电路等。
在一些实施例中，通信单元2101、处理单元2102可能集成为一个器件，也可以分离为不同的器件，此外，处理器与存储器也可以集成为一个器件，或分立为不同器件。
其中，通信单元2101可用于执行上述方法实施例中第一终端设备的收发操作。处理单元2102可用于执行上述方法实施例中第一终端设备的数据处理操作。
本发明实施例还提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在处理器上运行时，上述方法实施例的方法流程得以实现。
本发明实施例还提供一种计算机程序产品，当所述计算机程序产品在处理器上运行时，上述方法实施例的方法流程得以实现。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
本申请提供的各实施例的描述可以相互参照，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。为描述的方便和简洁，例如关于本申请实施例提供的各装置、设备的功能以及执行的步骤可以参照本申请方法实施例的相关描述，各方法实施例之间、各装置实施例之间也可以互相参考、结合或引用。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (36)

  1. 一种身份认证方法，其特征在于，所述方法包括：
    第一网络设备接收第一终端设备发送的第一请求，所述第一请求携带所述第一认证指示信息，所述第一认证指示信息用于请求对所述第一终端设备进行无人机系统UAS认证；
    所述第一网络设备向所述第一终端设备发送第二请求，所述第二请求用于请求获取所述第一终端设备的UAS标识；
    所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS标识，并向第二网络设备发送所述第一终端设备的UAS标识；
    所述第二网络设备基于所述UAS标识对所述第一终端设备进行UAS认证；
    所述第二网络设备向所述第一网络设备发送所述第一终端设备的UAS认证结果；
    所述第一网络设备向所述第一终端设备发送所述第一终端设备的UAS认证结果。
  2. 根据权利要求1所述的方法，其特征在于，所述第一认证指示信息为注册类型信息，或所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一网络设备接收第一终端设备发送的第一请求之后，所述方法还包括：
    所述第一网络设备确定是否对所述第一终端设备进行UAS认证；
    所述第一网络设备向所述第一终端设备发送第二请求，包括：
    当所述第一网络设备确定对所述第一终端设备进行UAS认证时，所述第一网络设备向所述第一终端设备发送第二请求。
  4. 根据权利要求3所述的方法，其特征在于，所述第一网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第一网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
  5. 根据权利要求3所述的方法，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；
    所述第一网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第一网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
  6. 根据权利要求1～5中任意一项所述的方法，其特征在于，所述第二网络设备接收所述第一网络设备发送的UAS标识之后，所述方法还包括：
    所述第二网络设备确定是否对所述第一终端设备进行UAS认证；
    所述第二网络设备对所述第一终端设备进行UAS认证，包括：
    当所述第二网络设备确定对所述第一终端设备进行UAS认证时，所述第二网络设备基于所述UAS标识对所述第一终端设备进行UAS认证。
  7. 根据权利要求6所述的方法，其特征在于，所述第二网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第二网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
  8. 根据权利要求6所述的方法，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型；所述方法还包括：
    所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息；
    所述第二网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第二网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
  9. 根据权利要求6所述的方法，其特征在于，所述第二请求还用于请求获取所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型；所述第一网络设备向所述第一终端设备发送第二请求之后，所述方法还包括：
    所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS类型信息；
    所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息；
    所述第二网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第二网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
  10. 根据权利要求6所述的方法，其特征在于，所述第一请求还携带所述第一终端设备的SUCI或GUTI，所述方法还包括：
    所述第一网络设备向所述第二网络设备发送所述第一终端设备的SUPI或GPSI，所述第一终端设备的SUPI或GPSI根据所述第一终端设备的SUCI或GUTI得到；
    所述第二网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第二网络设备基于所述UAS标识与所述第一终端设备的SUPI或GPSI确定是否对所述第一终端设备进行UAS认证。
  11. 根据权利要求1～10中任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备和所述第二网络设备基于所述UAS认证结果更新所述第一终端设备的UAS认证状态标识。
  12. 一种身份认证方法，其特征在于，所述方法包括：
    第一网络设备接收第一终端设备发送的第一请求，所述第一请求携带所述第一认证指示信息，所述第一认证指示信息用于请求对所述第一终端设备进行无人机系统UAS认证， 所述第一终端设备为UAS中的设备；
    所述第一网络设备向所述第一终端设备发送第二请求，所述第二请求用于请求获取所述第一终端设备的UAS标识；
    所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS标识；
    所述第一网络设备向第二网络设备发送所述第一终端设备的UAS标识；
    所述第一网络设备接收所述第二网络设备发送的所述第一终端设备的UAS认证结果；
    所述第一网络设备向所述第一终端设备发送所述第一终端设备的UAS认证结果。
  13. 根据权利要求12所述的方法，其特征在于，所述第一认证指示信息为注册类型信息，或所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
  14. 根据权利要求12或13所述的方法，其特征在于，所述第一网络设备接收第一终端设备发送的第一请求之后，所述方法还包括：
    所述第一网络设备确定是否对所述第一终端设备进行UAS认证；
    所述第一网络设备向所述第一终端设备发送第二请求，包括：
    当所述第一网络设备确定对所述第一终端设备进行UAS认证时，所述第一网络设备向所述第一终端设备发送第二请求。
  15. 根据权利要求14所述的方法，其特征在于，所述第一网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第一网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
  16. 根据权利要求14所述的方法，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；
    所述第一网络设备确定是否对所述第一终端设备进行UAS认证，包括：
    所述第一网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
  17. 根据权利要求12～16中任意一项所述的方法，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；所述方法还包括：
    所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息。
  18. 根据权利要求12～16中任意一项所述的方法，其特征在于，所述第二请求还用于请求获取所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；所述第一网络设备向所述第一终端设备发送第二请求之后，所述方法还包括：
    所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS类型信息；
    所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息。
  19. 根据权利要求12～18中任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备基于所述UAS认证结果更新所述第一终端设备的UAS认证状态。
  20. 一种身份认证方法，其特征在于，应用于第一终端设备，所述第一终端设备为无人机系统UAS中的设备，所述方法包括：
    所述第一终端设备向第一网络设备发送第一请求，所述第一请求携带第一认证指示信息，所述第一认证指示信息用于请求对所述第一终端设备进行UAS认证；
    所述第一终端设备接收所述第一网络设备发送的第二请求，所述第二请求用于请求获取所述第一终端设备的UAS标识；
    所述第一终端设备响应于所述第二请求，向所述第一网络设备发送所述第一终端设备的UAS标识；
    所述第一终端设备接收所述第一网络设备发送的所述第一终端设备的UAS认证结果。
  21. 根据权利要求20所述的方法，其特征在于，所述第一认证指示信息为注册类型信息，或所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
  22. 根据权利要求20或21所述的方法，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
  23. 根据权利要求20所述的方法，其特征在于，所述第二请求还用于请求获取所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型；所述方法还包括：
    所述第一终端设备向所述第一网络设备发送所述第一终端设备的UAS类型信息。
  24. 一种通信装置，其特征在于，所述通信装置包括：
    接收单元，用于接收第一终端设备发送的第一请求，所述第一请求携带所述第一认证指示信息，所述第一认证指示信息用于请求对所述第一终端设备进行无人机系统UAS认证，所述第一终端设备为UAS中的设备；
    发送单元，用于向所述第一终端设备发送第二请求，所述第二请求用于请求获取所述第一终端设备的UAS标识；
    所述接收单元，还用于接收所述第一终端设备发送的所述第一终端设备的UAS标识；
    所述发送单元，还用于向第二网络设备发送所述第一终端设备的UAS标识；
    所述接收单元，还用于接收所述第二网络设备发送的所述第一终端设备的UAS认证结果；
    所述发送单元，还用于向所述第一终端设备发送所述第一终端设备的UAS认证结果。
  25. 根据权利要求24所述的通信装置，其特征在于，所述第一认证指示信息为注册类型信息，或所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
  26. 根据权利要求24或25所述的通信装置，其特征在于，所述通信装置还包括：
    所述处理单元，用于确定是否对所述第一终端设备进行UAS认证；
    所述发送单元向所述第一终端设备发送第二请求的方式具体为：
    当确定对所述第一终端设备进行UAS认证时，向所述第一终端设备发送第二请求。
  27. 根据权利要求26所述的通信装置，其特征在于，所述处理单元确定是否对所述第一终端设备进行UAS认证的方式具体为：
    基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
  28. 根据权利要求26所述的通信装置，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；
    所述处理单元确定是否对所述第一终端设备进行UAS认证的方式具体为：
    基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
  29. 根据权利要求24～28中任意一项所述的通信装置，其特征在于，所述第一请求携带所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；
    所述发送单元，还用于向所述第二网络设备发送所述第一终端设备的UAS类型信息。
  30. 根据权利要求24～28中任意一项所述的通信装置，其特征在于，所述第二请求还用于请求获取所述第一终端设备的UAS类型信息，所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型；
    所述接收单元，还用于接收所述第一终端设备发送的所述第一终端设备的UAS类型信息；
    所述发送单元，还用于向所述第二网络设备发送所述第一终端设备的UAS类型信息。
  31. 一种通信装置，其特征在于，所述通信装置包括：
    发送单元，用于向第一网络设备发送第一请求，所述第一请求携带第一认证指示信息，所述第一认证指示信息用于请求对所述通信装置进行UAS认证；
    接收单元，用于接收所述第一网络设备发送的第二请求，所述第二请求用于请求获取所述通信装置的UAS标识；
    所述发送单元，还用于响应于所述第二请求，向所述第一网络设备发送所述通信装置的UAS标识；
    所述接收单元，还用于接收所述第一网络设备发送的所述通信装置的UAS认证结果。
  32. 根据权利要求31所述的通信装置，其特征在于，所述第一认证指示信息为注册类型信息，或所述通信装置的UAS类型信息，所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型。
  33. 根据权利要求31或32所述的通信装置，其特征在于，所述第一请求携带所述通信装置的UAS类型信息，所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型。
  34. 根据权利要求31所述的通信装置，其特征在于，所述第二请求还用于请求获取所述通信装置的UAS类型信息，所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型；
    所述发送单元，还用于向所述第一网络设备发送所述通信装置的UAS类型信息。
  35. 一种通信装置，其特征在于，包括处理器和通信接口，所述通信接口用于与其它通信装置进行通信；所述处理器用于运行程序，以使得所述通信装置以实现权利要求12至19中任一项所述的方法或使得所述通信装置以实现权利要求20至23中任一项所述的方法。
  36. 一种计算机可读存储介质，其特征在于，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述权利要求12至19中任意一项所述的方法或上述权利要求20至23中任意一项所述的方法。
PCT/CN2019/115441 2019-11-04 2019-11-04 身份认证方法及通信装置 WO2021087696A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
PCT/CN2019/115441 WO2021087696A1 (zh) 2019-11-04 2019-11-04 身份认证方法及通信装置
BR112022008022A BR112022008022A2 (pt) 2019-11-04 2019-11-04 Método de autenticação de identidade e aparelho de comunicações
CN201980101723.1A CN114600487B (zh) 2019-11-04 2019-11-04 身份认证方法及通信装置
EP19951274.0A EP4044644A4 (en) 2019-11-04 2019-11-04 IDENTITY AUTHENTICATION PROCESS AND COMMUNICATION DEVICE
US17/736,750 US20220272533A1 (en) 2019-11-04 2022-05-04 Identity authentication method and communications apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/115441 WO2021087696A1 (zh) 2019-11-04 2019-11-04 身份认证方法及通信装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/736,750 Continuation US20220272533A1 (en) 2019-11-04 2022-05-04 Identity authentication method and communications apparatus

Publications (1)

Publication Number Publication Date
WO2021087696A1 true WO2021087696A1 (zh) 2021-05-14

Family

ID=75848610

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/115441 WO2021087696A1 (zh) 2019-11-04 2019-11-04 身份认证方法及通信装置

Country Status (5)

Country Link
US (1) US20220272533A1 (zh)
EP (1) EP4044644A4 (zh)
CN (1) CN114600487B (zh)
BR (1) BR112022008022A2 (zh)
WO (1) WO2021087696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024114431A1 (zh) * 2022-11-29 2024-06-06 中移(成都)信息通信科技有限公司 通信系统、方法、装置、相关设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230379696A1 (en) * 2022-05-19 2023-11-23 Verizon Patent And Licensing Inc. On-demand subscription concealed identifier (suci) deconcealment for select applications
CN115603982B (zh) * 2022-09-30 2024-05-28 重庆长安汽车股份有限公司 车载终端安全认证方法及装置、电子设备、存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180090013A1 (en) * 2016-09-23 2018-03-29 Sharp Laboratories Of America, Inc. Unmanned aircraft and operation thereof
US20180281946A1 (en) * 2017-03-31 2018-10-04 T-Mobile U.S.A., Inc. Authorizing drone access to fulfillment centers
CN108702356A (zh) * 2017-05-19 2018-10-23 深圳市大疆创新科技有限公司 身份验证方法、设备、机器可读存储介质以及系统
WO2019028746A1 (zh) * 2017-08-10 2019-02-14 北京小米移动软件有限公司 无人机接入方法及装置
WO2019047066A1 (zh) * 2017-09-06 2019-03-14 北京小米移动软件有限公司 无人机接入方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101521660B (zh) * 2008-02-27 2012-10-03 华为技术有限公司 会话发起协议注册方法、认证及授权方法、系统及设备
WO2016154943A1 (en) * 2015-03-31 2016-10-06 SZ DJI Technology Co., Ltd. Systems and methods for geo-fencing device communications
US20180253092A1 (en) * 2015-09-09 2018-09-06 Tecteco Security Systems, S.L. Secure control of unmanned vehicles
CN109511115B (zh) * 2017-09-14 2020-09-29 华为技术有限公司 一种授权方法和网元
CN109561429B (zh) * 2017-09-25 2020-11-17 华为技术有限公司 一种鉴权方法及设备
CN115133975B (zh) * 2017-11-03 2024-06-25 北京小米移动软件有限公司 无人机认证方法及装置
WO2021041143A1 (en) * 2019-08-23 2021-03-04 Idac Holdings, Inc. Authentication and authorization to access a network by an unmanned aerial vehicle

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180090013A1 (en) * 2016-09-23 2018-03-29 Sharp Laboratories Of America, Inc. Unmanned aircraft and operation thereof
US20180281946A1 (en) * 2017-03-31 2018-10-04 T-Mobile U.S.A., Inc. Authorizing drone access to fulfillment centers
CN108702356A (zh) * 2017-05-19 2018-10-23 深圳市大疆创新科技有限公司 身份验证方法、设备、机器可读存储介质以及系统
WO2019028746A1 (zh) * 2017-08-10 2019-02-14 北京小米移动软件有限公司 无人机接入方法及装置
WO2019047066A1 (zh) * 2017-09-06 2019-03-14 北京小米移动软件有限公司 无人机接入方法及装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Unmanned Aerial System support in 3GPP; Stage 1; Release 16", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 22.125, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V1.0.0, 4 December 2018 (2018-12-04), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 9, XP051591010 *
See also references of EP4044644A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024114431A1 (zh) * 2022-11-29 2024-06-06 中移(成都)信息通信科技有限公司 通信系统、方法、装置、相关设备及存储介质

Also Published As

Publication number Publication date
BR112022008022A2 (pt) 2022-07-12
US20220272533A1 (en) 2022-08-25
CN114600487B (zh) 2023-12-08
CN114600487A (zh) 2022-06-07
EP4044644A1 (en) 2022-08-17
EP4044644A4 (en) 2022-10-19

Similar Documents

Publication Publication Date Title
US10798767B2 (en) Method and apparatus for relaying user data between a secure connection and a data connection
JP2022502922A (ja) ３ｇｐｐプライベートｌａｎ
WO2016085001A1 (ko) 스몰셀 환경을 지원하는 무선 접속 시스템에서 위치 비밀성 보호를 지원하는 방법 및 장치
WO2021136211A1 (zh) 授权结果的确定方法及装置
WO2020056611A1 (zh) 用于网络切片鉴权的方法和设备
US20220272533A1 (en) Identity authentication method and communications apparatus
US20220086145A1 (en) Secondary Authentication Method And Apparatus
US20230048066A1 (en) Slice authentication method and apparatus
TWI799064B (zh) 一種金鑰標識的生成方法以及相關裝置
WO2023160199A1 (zh) 一种接入通信网络的方法和装置
WO2021063298A1 (zh) 实现外部认证的方法、通信装置及通信系统
US20240137762A1 (en) Base station providing virtual wireless router
US20220264435A1 (en) Access control method and communications apparatus
US20240129710A1 (en) Methods and apparatus for subscription authorization enhancement
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2021195816A1 (zh) 一种通信方法、装置及系统
US20240163670A1 (en) Wireless communication method and apparatus
US20240187856A1 (en) Registration authentication based on a capability
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
WO2023246457A1 (zh) 安全决策协商方法及网元
US20240179519A1 (en) Communication method and related apparatus
WO2022237898A1 (zh) 用于在线签约的方法、通信装置、介质及芯片
WO2020215272A1 (zh) 通信方法、通信装置和通信系统
CN117796043A (zh) 向受制于准入控制的网络切片的注册
CN117242810A (zh) 无线通信系统中的终端操作方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19951274

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112022008022

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2019951274

Country of ref document: EP

Effective date: 20220513

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112022008022

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20220427