WO2021148027A1

WO2021148027A1 - Communication method, apparatus and system

Info

Publication number: WO2021148027A1
Application number: PCT/CN2021/073594
Authority: WO
Inventors: 李�赫; 吴�荣
Original assignee: 华为技术有限公司
Priority date: 2020-01-23
Filing date: 2021-01-25
Publication date: 2021-07-29
Also published as: CN113163402B; CN113163402A

Abstract

Provided are a communication method, apparatus and system for solving the problem in the prior art of user data interruptions caused by application key updating. The principle of the method is: before a key expires, an application server obtaining, in advance, key identifier information corresponding to a new key; and when the key expires, the application server being able to directly use the key identifier information to request the new key from an AKMA anchor network element, such that the service continuity is ensured.

Description

Communication method, device and system

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on January 23, 2020, the application number is 202010078309.8, and the application name is "a communication method, device and system", the entire content of which is incorporated into this application by reference middle.

Technical field

The embodiments of the present application relate to the field of communication technology, and in particular to a communication method, device, and system.

Background technique

Currently, terminal devices can support application authentication and key management (authentication and key management for applications, AKMA) services. Generally, the terminal equipment is authenticated by AKMA in the following manner: after the terminal equipment is successfully registered and the master authentication is completed, the AKMA authentication of the terminal equipment is completed at the same time. After AKMA authentication, the terminal device and the authentication server function (Authentication Server Function, AUSF) respectively generate the application's identity verification and key management root key Kakma and key identification information key identifier. The terminal device will request the session service from the application service network element (Application function, AF), and the application service network element will use the key identification information sent by the terminal device to verify the identity of the application and the key management anchor function network element (AKMA). anchor function, AAnF) request to apply the key Kaf. AAnF continues to carry the key identification information to request Kakma from AUSF. AUSF determines Kakma according to the key identification information, and sends the Kakma to AAnF. Finally, the application service network element will obtain the application key and the validity period of the application key from the anchor function network element for application authentication and key management.

Because Kakma is the input parameter to generate kaf. Kaf has a clear validity period, but the validity period of kakma is bound to the master authentication. That is, when the master authentication occurs, Kakma needs to be regenerated, and the key identification information is also regenerated. But regenerating kakma will not affect the kaf being used. In other words, the refresh of Kaf and the refresh of Kakma are independent of each other. Therefore, when the validity period of Kaf expires, Kakma may have been refreshed, and the key identification information has also been refreshed. Refreshing the key identification information will cause AUSF to fail to recognize the old key identification, and therefore will cause AF to fail when requesting the Kaf key update using the old key identification, which will interrupt the service.

Summary of the invention

The embodiments of the present application provide a communication method, device, and system to ensure that after the master authentication occurs, when the terminal and the AUSF key identifier are updated, the UE and the AF perform the Kaf key update when the service is not the terminal.

The embodiments provided in this application include any one of the following Figures 2 to 6 (the numbers of the embodiments provided in this section do not have a clear correspondence with the numbers of the embodiments provided in other parts of this document, only that this part is in Convenience in presentation).

The embodiments of the present application provide a network device, which has a function of implementing the behavior of the network device in any of the foregoing method embodiments. The functions described can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to each sub-function of the above-mentioned functions. The network device may be an application function network element AF, an application authentication and key management service network element AAnF, or an authentication service network element AUSF.

The embodiment of the present application provides a terminal device, which has a function of implementing the behavior of the terminal device in any of the foregoing method embodiments. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to each sub-function of the above-mentioned functions. The terminal device may be user equipment.

An embodiment of the present application also provides a communication system, which includes the network device and the terminal device described in any of the foregoing embodiments.

The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the method process related to the terminal device in any of the foregoing method embodiments is implemented. Specifically, the computer may be the aforementioned terminal device.

The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a computer, the method process related to the network device in any of the above method embodiments is implemented. Specifically, the computer may be the aforementioned network device.

The embodiment of the present application also provides a computer program or a computer program product including a computer program. When the computer program is executed on a computer, the computer will realize the interaction with the terminal device in any of the above-mentioned method embodiments. Related method flow. Specifically, the computer may be the aforementioned terminal device.

The embodiments of the present application also provide a computer program or a computer program product including a computer program. When the computer program is executed on a computer, the computer will enable the computer to realize the connection with the network device in any of the above-mentioned method embodiments. Related method flow. Specifically, the computer may be the aforementioned network device.

The embodiment of the present application also provides a device, which is applied to a terminal device, and the device is coupled with a memory, and is used to read and execute instructions stored in the memory, so that the terminal device can execute any of the foregoing method implementations. The method flow related to the terminal equipment in the example. The memory may be integrated in the processor or independent of the processor. The device may be a chip on the user terminal (such as a System on a Chip (SoC)).

The embodiment of the present application also provides a device, which is applied to a network device, and the device is coupled with a memory, and is used to read and execute instructions stored in the memory, so that the network device can execute any of the above method implementations. The method flow related to the network equipment in the example. The memory may be integrated in the processor or independent of the processor. The device may be a chip on the network device (such as a System on a Chip (SoC)).

Description of the drawings

FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of this application;

FIG. 2 is a schematic diagram of Kaf key distribution provided by an embodiment of this application;

FIG. 3 is a schematic diagram of Kaf key distribution provided by an embodiment of this application;

FIG. 4 is a schematic diagram of Kaf key distribution provided by an embodiment of this application;

FIG. 5 is a schematic diagram of Kaf key distribution provided by an embodiment of this application;

FIG. 6 is a schematic diagram of Kaf key distribution provided by an embodiment of this application;

7 to 8 are schematic diagrams of communication devices provided by embodiments of this application;

FIG. 9 is a schematic structural diagram of a communication device provided by an embodiment of the application.

Detailed ways

The embodiments of this application may be applicable to 4G (fourth generation mobile communication system) evolution systems, such as long term evolution (long term evolution, LTE) systems, or may also be 5G (fifth generation mobile communication systems) systems, such as adopting new wireless Access technology (new radio access technology, New RAT) access network; cloud radio access network (cloud radio access network, CRAN), etc., or even future communication systems such as 6G (sixth generation mobile communication system).

Referring to FIG. 1, the network architecture provided by this embodiment of the application at least includes a terminal device, an access network (AN), a core network, and a data service network. It can be understood that FIG. 1 is only a schematic illustration, and is not intended to limit the application.

Among them, a terminal device can be referred to as a terminal for short, which is a device with a wireless transceiver function. The terminal device can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as ships); Deployed in the air (for example, on airplanes, balloons, satellites, etc.). The terminal device may be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver function, virtual reality (VR) terminal equipment, augmented reality (AR) terminal equipment, industrial control ( Wireless terminal equipment in industrial control, wireless terminal equipment in self-driving, wireless terminal equipment in remote medical, wireless terminal equipment in smart grid, transportation safety (transportation) Wireless terminal equipment in safety), wireless terminal equipment in a smart city (smart city), wireless terminal equipment in a smart home (smart home), and may also include user equipment (UE), etc. The terminal equipment can also be a cellular phone, a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (personal digital assistant, PDA), with wireless communication Functional handheld devices, computing devices, or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the 5th generation (5G) network in the future, or public land mobile communication networks that will evolve in the future ( Public land mobile network (PLMN) terminal equipment, etc. Terminal equipment can sometimes be called terminal equipment, user equipment (UE), access terminal equipment, vehicle terminal equipment, industrial control terminal equipment, UE unit, UE station, mobile station, mobile station, remote station, remote terminal Equipment, mobile equipment, UE terminal equipment, terminal equipment, wireless communication equipment, UE agent or UE device, etc. The terminal device can also be fixed or mobile. The embodiments of the present application are not limited thereto.

The access network AN can adopt different types of access technologies. For example, the access network may adopt the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) access technology (for example, the wireless access technology used in 3G, 4G, or 5G systems). Or, non-3rd Generation Partnership Project (none 3rd Generation Partnership Project, non-3GPP) access technology. Among them, the access network adopting the 3GPP access technology is called a radio access network (RAN). For example, the access network equipment in the 5G system is called next generation Node Basestation (gNB) and so on. Non-3GPP access technologies refer to access technologies that do not comply with 3GPP standard specifications, for example, air interface technologies represented by wireless fidelity access points (WIFI AP).

The core network may include authentication server function network elements, mobile management network elements, session function network elements, application authentication and key management (authentication and key management for applications, AKMA) anchor point function network elements, unified data management network One or more of the element or user plane function network element, etc. Among them, the user plane function network element is the user plane data export, which is mainly used to connect to the external network. The authentication function server network element is a functional entity for the network to authenticate the UE, and is mainly used for the network to verify the authenticity of the UE. Mobility management network element, mainly responsible for mobility management. The session function network element is mainly used to allocate session resources for the user plane. The unified data management network element is used to store the user's subscription data, and to generate a long-term key used to authenticate the user. The AKMA anchor function network element is mainly used to provide the function of Kaf and Kaf validity period to the AKMA application function network element.

It should be noted that in different communication systems, the network elements in the above-mentioned core network may have different names. For example, in the fourth-generation mobile communication system, the above-mentioned mobility management network element may be referred to as a mobility management entity (MME). In the fifth-generation mobile communication system, the above-mentioned mobility management network element may be referred to as an access and mobility management function (AMF), etc. In the embodiments of the present application, the fifth generation mobile communication system is taken as an example to introduce the above-mentioned core network network elements, which is not a limitation to the embodiments of the present application. For example, in the fifth-generation mobile communication system, the user plane function network element may be called the user plane function (UPF), and the authentication server function network element may be called the authentication server function (authentication server function, AUSF), Mobility management network element can be called AMF, session management function network element can be called session management function (session management function, SMF), unified data management network element can be called unified data management (UDM), anchor of AKMA The point function network element, which can also become the authentication function network element of AKMA, can be called AKMA authentication function (AKMA authentication function, AAuF) and so on.

It can be understood that the core network element in FIG. 1 is only a schematic illustration and is not meant to be a limitation. For example, in the embodiment of this application, the core network may include the network slice selection function (NSSF) and the network exposure function (NEF) in addition to the core network elements shown in FIG. One or more network elements of network storage function (Network Repository Function, NRF), Policy Control Function (PCF), Application Function (AF), or SCP.

The data service network may specifically be a data network (DN), etc. The AKMA application function (AKMA application function, AApF) network element, which can also be directly called an application function (Application, Function), can be deployed in one or more servers in the DN to provide data services for 3GPP user terminals. It is understandable that the AKMA application function network element can be deployed in the server of the DN, and can also be deployed in the core network, without limitation. In the embodiment of the present application, the AKMA application network element is deployed in the server of the DN as an example for description.

With respect to the architecture shown in FIG. 1, the embodiment of the present application provides an application scenario in which the terminal device can support AKMA service, and the core network device can perform AKMA authentication on the terminal device. As shown in Figure 2, an AKMA key distribution process is provided, in which the UE can be specifically the terminal device in the architecture shown in Figure 1 above, and the AAnF can be specifically the AKMA authentication function in the architecture shown in Figure 1 above Network element, AUSF can be specifically the authentication function serving network element in the architecture shown in Figure 1 above, and the process includes:

S201: The UE and the authentication service network element AUSF complete the main authentication process. The main authentication process can also be called the two-way authentication process, which is defined in Chapter 6 of the standard TS33.501. The role of the primary authentication is to complete the two-way authentication between the UE and the network. It is defined according to the TS33.501 standard. A two-way authentication is performed between the AUSF and the UE, and the two-way authentication can be specifically an extensible authentication protocol (extensible authentication protocol, EAP) exchange (exchange). The specific method is EAP-AKA', or 5G authentication and key management Agreement (5G authentication and key management, 5G AkA). If the UE and AUSF two-way authentication succeeds, it can be considered that the AKMA authentication of the terminal device is successful.

S202: After the master authentication is completed, the AUSF will obtain Kausf, and the UE will generate Kausf by itself. These two Kausf are the same. After that, the UE and AUSF respectively use Kausf to generate the authentication and key management root key Kakma-1 of the first application and the first key identification information Keyidentifier-1. The specific method of generating Kakma and Keyidentifier has nothing to do with the present invention, and will not be explained too much here.

Specifically, the key identification information is used to identify the authentication and key management root key Kakma of the UE's application program, and Kakma is used as the root key to generate other AKMA keys (for example, application keys of different applications corresponding to the UE). ). The key identification information can also be used for the AF and AAnF to identify the UE, and the key identification information is the identification of the specific UE that the AF and AAnF determine in the 5GC.

S203: After the UE and AUSF respectively generate Kakma-1 and Keyidentifier-1, when the UE wants to use a service, the UE sends an application session establishment request (Application session establishment request) message to the AF. The message carries the first key identification information Keyidentifier-1.

S204: After the AF determines that there is no application key Kaf corresponding to the first key identification information locally, it will send a key request (key request) to the application's identity verification and key management service network element (AKMA anchor function, AAnF) information. The message carries the first key identification information and the AF identity information AF ID.

S205: AAnF sends an authentication and key management key request (AKMA Key Notification Request) message of the application to AUSF, and the message carries the first key identification information.

S206: AUSF replies to the authentication and key management key response (AKMA Key Notification Response) message of the application. The message carries the authentication and key management root key Kakma-1 of the first application program of the first application service.

S207: AAnF generates the first application key Kaf-1 for the UE according to the received Kakma-1, and determines the validity period of the first key.

S208: AAnF replies with a key response (key response) message. The message carries the first application key Kaf-1 and the validity period of the first application key.

S209: The AF replies to an application session establishment response (Application session establishment response) message.

S210: AUSF receives the authentication request message. The authentication request message is used to trigger the two-way authentication between the network and the UE.

S211: After the authentication succeeds, the AUSF generates the authentication and key management root key Kakma-2 of the second application service and the second key identification information keyidentifier-2.

S212: Optionally, the generation of Kakma-2 and keyidentifier-2 does not need to affect the use of Kaf-1. Therefore, there is no need to notify the AF to update the key.

S213: When the Kaf-1 key expires, the AF deletes Kaf-1.

Through the above method, it can be found that the update of Kakma is independent of the update of Kaf. Kaf will be deleted directly after the key expires. If the UE and AF have ongoing services, the services will be interrupted due to the expiration of the key. This will affect the UE experience.

Based on this, the present application provides a communication method. The principle of the communication method is to allow the AF to obtain the latest key Identifier of the UE before the key Kaf expires, and the AF can request the AUSF to update the Kaf based on the latest key identifier. This can ensure that the services of the UE and the AF are not interrupted, and the user experience is improved.

It should be noted that in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing description, and cannot be understood as indicating or implying relative importance, nor shall they be understood as indicating or implying. Sequence, for example, "first request message" and "second request message", etc. "And/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be single or multiple. At least one of a, b, or c can represent: a; b; c; a and b; a and c; b and c; or a, b and c. Among them, a, b, and c may be single or multiple.

Referring to Figure 3, there is provided a communication method flow. The terminal device in the flow can be the terminal device in the architecture of Figure 1, and the mobility management network element can be the mobility management network element in the architecture of Figure 1. The authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1. The specific process is:

S300: The terminal device and the authentication service network element complete two-way authentication, and obtain the authentication and key management root key Kakma-1 and key identifier-1 of the application program respectively. The UE initiates the service, and the application function network element obtains the validity period of Kaf-1 and Kaf-1. For the specific process, refer to the description of steps S201 to S208.

S301: After AAnF requests Kakma from AUSF, AUSF locally stores a mapping relationship. The mapping relationship is used to reflect which AAnF requests which key identifer corresponds to the Kakma. The function of the storage of this mapping relationship is that when the master authentication occurs, AUSF can notify the AAnF that uses the key identifier- so that AAnF can learn in time that Kakma can no longer be used.

An optional implementation method is: AAnF ID, key identifier, and Kakma are stored internally in AUSF. Among them, the form of AAnF ID is not specified in the present invention. For example, it can be an ID assigned by an operator, a globally unified ID, or an IP address. In short, AUSF can uniquely locate the AAnF that requested Kakma based on the key identifier in the past based on the AAnF ID. Among them, Key identifier and Kakma are generated after the master authentication. In the present invention, AUSF generates key identifier-1 and Kakma-1 after the first authentication. If there is only one AAnF in the network, the AAnF information can be stored in the mapping relationship without being displayed.

S302: AUSF receives the authentication request message. The authentication request message is used to trigger the two-way authentication between the network and the UE.

Optionally, the UE and AUSF will delete Kakma-1 and keyidentifier-1.

S303: AUSF sends an authentication and key management notification request (AKMA key Notification Request) message of the application service to the related AAnF.

Specifically, the AKMA key Notification Request carries key identifier-1. Optionally, the AUSF determines the AAnF that has requested the key identifier-1 according to the mapping relationship saved in step 301. It should be noted that if there is only one AAnF in the network, then AUSF does not need to determine the AAnF according to the mapping relationship, and then sends the message. If the network has multiple AAnFs, AUSF will send KMA key Notification Request messages to different AAnFs. Optionally, the AKMA key Notification Request carries an indication information, which is used to indicate that kakma-1 corresponding to key identifier-1 is no longer valid. The specific form of the indication information is not specified in the present invention. For example, it may be an indicator or a cause value. If the AKMA Key Notification Request message only has the function of notifying AAnF to delete the key, then the indication information does not need to be carried. If the AKMA Key Notification Request message has multiple different functions, then the indication information is mandatory.

S304: AAnF deletes Kakma-1 and Key identifier-1 according to the AKMA key Notification Request, or according to the indication information carried in the AKMA key Notification Request; or marks Kakma-1 and Key identifier-1 as invalid; or Delete Kakma-1 and mark Keyidentifier-1 as invalid.

That is, this embodiment stipulates that the validity period of the key identifier is the same as that of Kakma. Compared with direct deletion, invalid identification can facilitate the subsequent process. Specifically, AAnF can maintain a mapping relationship locally, and the mapping relationship includes at least four items among key identifier-1, Kakma-1, Kaf, and Kaf validity period and AF ID. After AAnF receives the message in step 303, it marks the key identifier-1 and Kakma-1 as invlaid, so that when kaf expires, AAnF can directly reply the identifier expiration indication information in step 309 of the present invention. Then delete the key identifier-1, Kakma-1 and Kaf. If there is no such identifier, AAnF may not know whether the key identifier requested by the AF is wrong or out of date. That is, the cause is unknown. Therefore, keeping the key identifier-1 for a longer period of time and marking it as Invalid can make AAnF know the reason clearly.

S305: After deleting Kakma-1 and Keyidentifier-1, AAnF replies to the authentication and key management notification response (AKMA Key Notification Response) message of the application service.

S306: The UE and AUSF complete the primary authentication, and then generate Kakma-2 and the corresponding key identifier-2. It should be noted that steps S303 to S305 can occur before or after step S306. The invention does not make specific provisions. Steps S303 to S305 occur before step S306 because the authentication takes place and Kakma-1 needs to be deleted, so there is no need to wait for the authentication result. For example, the AUSF may initiate step S303 after sending the authentication vector to the UE. For another example, after receiving the message of step S302, AUSF immediately initiates step S303. Steps S303 to S305 occur after step S306, which will simplify the processing logic of AUSF.

S307: AF determines that Kaf-1 is about to expire.

For example, the AF can determine the time point when Kaf-1 is about to expire according to a preset time period in advance according to the validity of Kaf-1.

S308: The AF sends a key update message to AAnF according to Keyidentifier-1. The message carries key identifier-1. The purpose of this message is to request an updated application key Kaf from AAnF.

S309: If the Key identifier-1 in the AAnF is set as invalid in step 304, the AAnF determines that the key identifier-1 in the key update message is invalid. Or if Keyidentifier-1 is deleted in step 304, AAnF can no longer find the Kakma corresponding to keyidentifier-1.

S310: AAnF replies a key response message to the AF. The message indicates that the Kakma corresponding to key identifier-1 cannot be found, or is invalid or does not carry the updated application key.

When the key response message sent by AAnF to the AF does not carry the updated application key, it can implicitly indicate that the Kakma corresponding to key identifier-1 cannot be found or is invalid.

S311: The AF sends a key identification information request (AKMA Identifier Request) message of the application service to the UE. The function of this message is to let the UE know that Kaf-1 has expired and needs to generate a new Kaf-2. This message can also trigger the UE to send a new key identifier to the AF. The name of the message is not specifically limited in the present invention, that is, it does not need to be called AKMA Identifier Request. Optionally, the message carries indication information, and the indication information is used to inform the UE that the key identifier-1 used in the past has expired and/or Kaf-1 has expired. The form of the indication information is not limited in the present invention. For example, it may be an indicator or a cause value.

Optionally, the message carries key identifier-1.

Optionally, the message carries AF ID. Because the UE and the AF have interacted before and provided the AF ID, it is not necessary to provide the AF ID in the message.

S312: The UE sends a key identification information response (AKMA Identifier Response) message of the application service to the AF. The message carries the latest Key identifier-2.

Here, the latest refers to if multiple primary authentications have occurred before the UE receives the 11th step message. Then, after receiving the message of step S311, the UE sends the key identifier generated by the last primary authentication to the AF. In this embodiment, because the primary authentication has only occurred once, the latest one is Keyidentifier-2.

Optionally, before step S312 occurs, the UE needs to determine kaf-2. If Kaf-2 has been obtained through Kakma-2, the UE can directly determine that this kaf-2 will be used. If Kaf-2 has not been obtained before, Kakma-2 generates a new Kaf-2. Ready to use Kaf-2. Optionally, if the message carries Key identifier-1, the UE determines kakma-1 corresponding to key identifier-1. If the key identifier-1 cannot be found, the UE determines the latest key identifier-2.

Refer to steps S204 to S208 for the process of S313 to S317. The difference is that the S313 process uses the latest key identification message received from the UE.

S318: After acquiring the new Kaf-2, the AF sends an Application key update Request message to the UE, so that the UE starts to use Kaf-2 synchronously. If the UE has not generated Kaf-2 before, then Kaf-2 is newly generated. If Kaf-2 was generated before, use it directly.

S319: The UE replies the Application key update Acknowledge message to the AF.

It should be noted that step S318 and step S319 can be replaced by application layer messages that execute specific security protocols. For example, TLS-related application layer messages.

Through the above method, when the key expires, the AF can request the AAnF to update the Kaf through the latest key identifier of the terminal device. This ensures business continuity between the terminal equipment and the AF.

In the embodiment of the present application, after the primary authentication occurs, the AUSF and the UE respectively update the authentication and key management root key Kakma-new and key identification information key identifier-new of the application corresponding to the UE. AUSF notifies AAnFkey that the authentication and key management root key of the application corresponding to the identifier-old is invalid/expired, and AAnF sets the correspondence between the previously saved keyidentifier-old and Kakma-old to be invalid or deleted.

Later, when the AF determines that the UE’s application key Kaf is about to expire, the AF uses the key identifier-old to request AAnF to update the application key. Since AAnF has deleted the key identifier-old or set the key identifier-old to be invalid, AAnF cannot Update the application key for AF. At this time, AAnF notifies the AF that the key update fails, and optionally can carry the value of the reason for the key update failure. When the AF determines that the application key update fails, it requests the UE to obtain new key identifier information keyidentifier-new, and uses the key identifier-new to request the update of the application key from AAnF again. After obtaining the new application key and the corresponding validity period from AAnF, the UE is triggered to also update the application key.

Referring to Figure 4, there is provided a communication method flow. The terminal device in the flow can be the terminal device in the architecture of Figure 1, and the mobility management network element can be the mobility management network element in the architecture of Figure 1. The authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1. The specific process is:

S401 is the same as S301 in the embodiment in FIG. 3. For related steps, please refer to the related description in the embodiment in FIG. 3, which will not be repeated here.

S402 is the same as S209 in the embodiment of FIG. 2. For related steps, please refer to the related description of the embodiment of FIG. 2. The difference here is that the AF will send the validity period of Kaf-1 to the terminal device.

Optionally, before step 402, related steps from step 201 to step 208 are further included.

S403-S407 are the same as S302-S306 in the embodiment of FIG. 3. For related steps, please refer to the related description of the embodiment of FIG. 3, which will not be repeated here.

S408 When the UE discovers that Kaf-1 is about to expire, the UE actively triggers the key identification information update request message of the application service.

For example, the UE may determine the time point at which Kaf-1 is about to expire according to a preset duration in advance according to the validity period of Kaf-1.

S409: The UE sends a key identification information update request (AKMA Identifier Update Request) message of the application service to the AF. The message carries the latest key identifier. The function of this message is to let AF know the latest key identifier. The present invention takes Keyidentifier-2 as an example. The name of the message is not specifically limited in the present invention, that is, it does not need to be called AKMA Identifier Request. Optionally, the message also carries Key identifier-1.

If the UE and the network have performed multiple primary authentications before the expiration of Kaf-1, and the services of the UE and AF are still in use, the UE will carry the latest key identifier in the message in this step.

S410: The AF saves the received new key identifier-2. Optionally, the AF marks the key identifier-1 as invalid, or deletes the key identifier-1.

S411: The AF sends a key identification information update response (AKMA Identifier Response) message of the application service to the UE.

S412: AF determines that Kaf-1 is about to expire.

It should be noted that the UE side judges that the time when kaf-1 is about to expire is earlier than the AF side. For example, the expiration time of Kaf-1 sent by AF is earlier than that received from AAnF, which facilitates early triggering on the UE side. For another example, the timing of triggering step S409 on the UE side through specific configuration is earlier than the timing of triggering Kaf-1 on the AF side (for example, the advance time when the AF determines that Kaf-1 is about to expire is less than the time when the UE determines that Kaf-1 is about to expire Time ahead). The specific implementation method is not specified in the present invention.

S413-S420 are the same as S313-S319 in the embodiment in FIG. 3. For related steps, please refer to related descriptions in the embodiment in FIG. 3, and details are not repeated here.

Since in the prior art, the Kaf expiration time is sent to the UE, so that the UE side sends the latest key identifier to the AF before the expiration, the whole process is smoother, and the time delay is further reduced compared with the embodiment in FIG. 3.

In the embodiment of the present application, during the process of the UE establishing a session with the AF, the AF informs the UE of the validity period of the UE's application key. After the primary authentication occurs, the AUSF and the UE respectively update the authentication and key management root key Kakma-new of the application program corresponding to the UE and the key identification information key identifier-new. AUSF notifies AAnFkey that the authentication and key management root key of the application corresponding to the identifier-old is invalid/expired, and AAnF sets the correspondence between the previously saved keyidentifier-old and Kakma-old to be invalid or deleted. When the UE determines that its application key is about to expire, the UE actively notifies the key identifier-new to the AF. Subsequently, when the application key Kaf corresponding to the UE is about to expire, the AF uses Kakma-new to request an updated application key from AAnF, and after obtaining the updated application key and the corresponding validity period from AAnF, the UE is triggered to also update the application key.

Referring to Figure 5, there is provided a communication method flow. The terminal device in the flow can be the terminal device in the architecture of Figure 1, and the mobility management network element can be the mobility management network element in the architecture of Figure 1. The authentication server functions The network element can be the authentication server function network element in the architecture of Figure 1, and the unified data management network element can be the unified data management network element in the architecture of Figure 1. The specific process is:

S501-S506 are the same as S301-S306 in the embodiment in FIG. 3. For related steps, please refer to the related description of the embodiment in FIG. 3, which will not be repeated here.

S507-S509 are the same as S409-S411 in the embodiment in Figure 4. For related steps, please refer to the description of the embodiment in Figure 4. The difference is that when the UE finds that the master authentication is completed and generates new key identification information, it actively initiates the AKMA identifier update process , And send the latest identifier to AF. Specifically, if multiple primary authentications occur before the Kaf expires, the UE must send the latest key identifier to the AF every time. In this embodiment, only one master authentication occurs, so the AKMA identifier update process is triggered only once.

S510-S517 are the same as S412-S419 in the embodiment of FIG. 4. For related steps, please refer to the related description of the embodiment of FIG. 4. The difference is that the key identifier used is the latest key identifier sent by the UE side. Optionally, the AF only retains the latest key identification information in step S508.

It should be noted that, in the embodiment of the present application, the AF needs to obtain the latest key identification information from the terminal device through the above-mentioned methods in FIG. 3, FIG. 4, and FIG. In Figure 6 below, the description will be continued. The method by which the AF can obtain the latest key identification information from the AAnF to ensure business continuity between the UE and the AF. .

In the embodiment of the present application, after the master authentication occurs, the AUSF updates the authentication and key management root key Kakma-new and key identification information key identifier-new of the application corresponding to the UE. AUSF notifies AAnFkey that the authentication and key management root key of the application corresponding to the identifier-old is invalid/expired, and AAnF sets the correspondence between the previously saved keyidentifier-old and Kakma-old to be invalid or deleted. After the UE generates a new application authentication and key management root key Kakma-new core key identification information key identifier-new, the UE actively notifies the key identifier-new to the AF. Subsequently, when the application key Kaf corresponding to the UE is about to expire, the AF uses Kakma-new to request an updated application key from AAnF, and after obtaining the updated application key and the corresponding validity period from AAnF, the UE is triggered to also update the application key. S601-S602 are the same as S301-S302 in the embodiment of FIG. 3. For related steps, please refer to the related description of the embodiment of FIG. 3, which will not be repeated here.

S603: The authentication service network element sends an authentication success message to the terminal device.

S604 is the same as S306 in the embodiment in FIG. 3. For related steps, please refer to the related description in the embodiment in FIG. 3, which will not be repeated here.

S605: AUSF sends an authentication and key management notification request (AKMA key Notification Request) message of the application service to the related AAnF. The message carries key identifier-1, key identifier-2 and Kakma-2 generated by S604.

S606: AAnF saves the newly received Keyidentifier-2 and Kakma-2. Optionally, the AF may save the Key identifier-2 and Kakma-2, continue to save the Key identifier-1 and Kakma-1, and mark them as invalid (invalid). Or, continue to save Keyidentifier-1 and mark it as invalid, and delete kakma-1.

S607: AAnF replies to the authentication and key management notification response (AKMA key Notification Response) message of the application service.

S608: Kaf-1 on the AF side is about to expire.

For example, the AF can determine the time point when Kaf-1 is about to expire according to a preset time period in advance according to the validity period of Kaf-1.

S609: The AF sends a key update message to AAnF according to Keyidentifier-1. The message carries key identifier-1. The purpose of this message is to request AAnF to update the application key Kaf.

S610: AAnF determines Kakma-2 according to Keyidentifier-1, and deletes Keyidentifier-1. AAnF generates Kaf-2 based on Kakma-2 and determines the validity period of Kaf-2.

S611: AAnF replies a key response message to the AF. The message carries the second application key Kaf-2 and the validity period of Kaf-2.

S612-S613 are the same as S318-S319 in the embodiment in FIG. 3. For related steps, please refer to the related description of the embodiment in FIG.

In the embodiment of the present application, after the master authentication occurs, the AUSF updates the authentication and key management root key Kakma-new and key identification information key identifier-new of the application corresponding to the UE. AUSF sends the updated Kakma-new, keyidentifier-new and the old key identifier-old corresponding to the UE to AAnF together. After AAnF receives the key identifier-new, Kakma-new, and key identifier-old sent by AUSF, it saves the correspondence between key identifier-new, Kakma-new, and key identifier-old. Optionally, AAnF invalidates or deletes the previously maintained correspondence between key identifier-old and Kakma-old. When the subsequent AF determines that the UE's application key Kaf is about to expire, it uses the key identifier-old to request an application key update from AAnF. AAnF can determine the authentication and key management root key Kakma-new of the updated application program of the UE according to the key identifier-old and the correspondence between key identifier-new, Kakma-new, and key identifier-old maintained by itself. , And use Kakma-new to generate a new application key Kaf_new, and determine the validity period corresponding to Kaf_new. AAnF sends the new application key Kaf_new and the corresponding validity period to AF. After the AF receives the new application key Kaf_new and the corresponding validity period, it triggers the UE to update the corresponding application key Kaf.

Based on the same inventive concept as the method embodiment, an embodiment of the present application further provides a device 800 for executing the method executed by the terminal device in the method embodiment shown in FIG. 3 to FIG. 6. For related features, please refer to the above method embodiment. , I won’t repeat it here. As an example, as shown in FIG. 7, the device 800 includes a transceiver module 801 and a processing module 802.

Regarding the specific functions of the transceiver module 801 and the processing module 802, please refer to the records in the foregoing method embodiment, which will not be described here.

Based on the same inventive concept as the method embodiment, an embodiment of the present application further provides a device 900 for executing other network elements (such as application function network element AF, application authentication As for the method executed by the key management service network element AAnF or the authentication service network element AUSF), the relevant features can be referred to the above method embodiment, which will not be repeated here. As an example, as shown in FIG. 8, the device 900 includes a transceiver module 901 and a processing module 902.

Regarding the specific functions of the transceiver module 901 and the processing module 902, reference may be made to the record in the foregoing method embodiment, which will not be described here.

No more explanation here. The division of units in the embodiments of this application is illustrative, and is only a logical function division. In actual implementation, there may be other division methods. In addition, the functional units in the various embodiments of this application can be integrated into one processing unit. In the device, it can also exist alone physically, or two or more units can be integrated into one module. The above-mentioned integrated unit can be realized in the form of hardware or software function module.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to enable a terminal device (which may be a personal computer, a mobile phone, or a network device, etc.) or a processor to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

In the embodiments of the present application, the terminal device, the application function network element AF, the application authentication and key management service network element AAnF, or the authentication service network element AUSF can all be presented in the form of dividing each functional module in an integrated manner. The "module" here can refer to a specific ASIC, circuit, processor and memory that executes one or more software or firmware programs, integrated logic circuit, and/or other devices that can provide the above-mentioned functions.

In a simple embodiment, the communication device 1200 shown in FIG. 9 includes at least one processor 1201, a memory 1202, and optionally, a communication interface 1203.

The memory 1202 may be a volatile memory, such as random access memory; the memory may also be a non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD) or solid-state drive (solid-state drive, SSD) or the memory 1202 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 1202 may be a combination of the above-mentioned memories.

The specific connection medium between the foregoing processor 1201 and the memory 1202 is not limited in the embodiment of the present application. In the embodiment of the present application, the memory 1202 and the processor 1201 are connected by a bus 1204 in the figure. The bus 1204 is represented by a thick line in the figure. Is limited. The bus 1204 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.

The processor 1201 may have a data transceiving function and can communicate with other devices. In the device shown in Figure 9, an independent data transceiving module, such as a communication interface 1203, may be used to send and receive data; the processor 1201 is communicating with other devices. During communication, data transmission can be performed through the communication interface 1203.

In an example, when the terminal device adopts the form shown in FIG. 9, the processor in FIG. 9 can call the computer execution instructions stored in the memory 1202, so that the terminal device executes any of the foregoing method embodiments. The method executed by the terminal device.

Specifically, the functions/implementation processes of the processing module and the transceiver module in FIG. 7 can all be implemented by the processor 1201 in FIG. 9 calling a computer execution instruction stored in the memory 1202. Alternatively, the function/implementation process of the processing module in FIG. 7 may be implemented by the processor 1201 in FIG. 9 calling computer execution instructions stored in the memory 1202, and the function/implementation process of the transceiver module in FIG. 7 may be implemented through the communication in FIG. 9 Interface 1203 is implemented.

In another example, when the application function network element AF, the application authentication and key management service network element AAnF, or the authentication service network element AUSF adopts the form shown in FIG. 9, the processor in FIG. 9 may call The computer-executed instructions stored in the memory 1202 cause the authentication server function to execute the method executed by the authentication server function in any of the foregoing method embodiments.

An embodiment of the present application also provides a communication system, which may include at least one of an application function network element AF, an application authentication and key management service network element AAnF, or an authentication service network element AUSF.

Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

This application is described with reference to flowcharts and/or block diagrams of methods, equipment (systems), and computer program products according to this application. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the scope of the application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, then this application is also intended to include these modifications and variations.

Claims

A key update method, characterized in that the method includes:

The application function network element receives the second key identification information sent by the terminal device;

The application function network element sends a first application authentication and key management key update request message to the application authentication and key management anchor function entity, and the first application authentication and key management key update request message Carries the second key identification information;

The application function network element receives a first application authentication and key management key update response message from an application authentication and key management anchor function entity, and the first application authentication and key management key update response message Carrying the second application key corresponding to the second key identification information;

The application function network element initiates an application key update procedure to the UE, and the application function network element deletes the first application key and starts to use the second application key.
The method according to claim 1, wherein before the first application function network element accepts the latest second key identification information sent by the terminal, the method comprises:

The application function network element sends an application authentication and key management identifier request message to the terminal device, where the message is used to request the latest key identification information from the terminal device;

The application function network element receives an application authentication and key management identifier response message sent by the terminal device, where the response message includes the second key identification information.
The method according to claim 2, wherein before the application function network element sends an application authentication and key management identifier request message to the terminal device, the method comprises:

The application function network element sends a second application authentication and key management key update request message to the application authentication and key management anchor function entity, and the second application authentication and key management key update The request message carries the first key identification information.

The application function network element receives a second application authentication and key management key update response message sent by the application authentication and key management anchor function entity, where the response message does not carry the updated application key.
The method according to claim 1, characterized in that, before the first application function network element accepts the latest second key identification information sent by the terminal, the method comprises:

The application function network element receives the application authentication and key management identifier request message sent by the terminal device. The applied authentication and key management identifier request message includes the second key identification information.

The application function network element sends an application authentication and key management identifier response message to the terminal device.
The method according to claim 4, characterized in that, before the application function network element receives the application authentication and key management identifier request message sent by the terminal device, the method comprises:

The application function network element sends the expiration time of the first application key corresponding to the first key identifier to the terminal.
The method of claim 4, wherein:

The application network element saves the second key identification information; deletes the first key identification information.
A key update method, characterized in that the method includes:

Acquiring the second key identification information by the terminal device;

The terminal device sends the second key identification information to the application function network element;

Acquiring, by the terminal device, the second application key corresponding to the second key identifier;

The terminal device deletes the first application key and uses the second application key.
The method according to claim 7, before the terminal device sends the second key identification information to the application function network element, the method comprises:

The terminal device accepts the first application authentication and key management key update request message sent by the application function network element, and the request message is used to request the latest key identification information of the terminal device.
The method according to claim 7, before the terminal device sends the second key identification information to the application function network element, the method comprises:

Receiving, by the terminal device, the expiration time of the first application key corresponding to the first key identifier sent by the application network element;

Determining, by the terminal, that the first application key is about to expire according to the expiration time of the first application key;

The terminal device sends a first application authentication and key management key update request message to the application function network element, and the first application authentication and key management key update request message carries the second key Identification information.
According to claims 8 to 9, the method further comprises:

The terminal device obtains the second application key corresponding to the second key identification information.
According to claims 7-10, the method further comprises:

After the terminal device accepts the application key update message sent by the application function network element, the terminal device starts to use the second application key corresponding to the second key identification information.
A communication device, characterized in that it comprises a module for implementing any one of the above methods 1-11.
A network device, characterized in that the network device includes:

Memory, used to store instructions;

The processor is configured to call and execute instructions in the memory, so that the network device executes the method according to any one of claims 1-6.
A terminal device, characterized in that, the terminal device includes:

Memory, used to store instructions;

The processor is configured to call and execute instructions in the memory, so that the terminal device executes the method according to any one of claims 7-11.
A computer program product, characterized in that, when the computer program product is executed on a computer, it will enable the computer to implement the method according to any one of claims 1-11.
A computer-readable program, characterized in that, when the computer-readable program is executed on a computer, it will enable the computer to implement the method according to any one of claims 1-11.