WO2021218851A1 - 一种安全通信方法及装置 - Google Patents

一种安全通信方法及装置 Download PDF

Info

Publication number
WO2021218851A1
WO2021218851A1 PCT/CN2021/089589 CN2021089589W WO2021218851A1 WO 2021218851 A1 WO2021218851 A1 WO 2021218851A1 CN 2021089589 W CN2021089589 W CN 2021089589W WO 2021218851 A1 WO2021218851 A1 WO 2021218851A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
request message
user
level
credibility
Prior art date
Application number
PCT/CN2021/089589
Other languages
English (en)
French (fr)
Inventor
周艳
何承东
林青春
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202010389032.0A external-priority patent/CN113645621B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21796960.9A priority Critical patent/EP4135376A4/en
Publication of WO2021218851A1 publication Critical patent/WO2021218851A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains

Definitions

  • This application relates to the field of communication technology, and in particular to a secure communication method and device.
  • a terminal device can communicate with one or more core devices through an access device in the wireless access network.
  • a message sent from the terminal device may pass through multiple core devices, such as a first network function (NF), a second NF, or a third NF, etc., to reach the application server.
  • NF network function
  • second NF second NF
  • third NF third NF
  • 5G fifth-generation communication system
  • 5G fifth-generation communication system
  • the present application provides a secure communication method and device, which can effectively improve the security of information interaction between terminal equipment and NF.
  • the present application provides a secure communication method, the method includes: a first network function (network function, NF) sends a first request message to a third NF, the first request message carrying a first user identity of the terminal device
  • NF network function
  • the third NF determines the credible attribute of the first user ID; if the credible attribute of the first user ID meets the preset conditions, the third NF reports to the first NF Send a first response message, the first response message carrying the second pseudonym information of the first user identification.
  • the trusted attribute of the first user identifier shown above meets the preset condition, and it can also be understood that the trusted attribute of the terminal device meets the preset condition.
  • the first user ID can exist between different NFs in a pseudonymous manner, which prevents the first user ID from being untrusted Or insecure NF tampering or interception, etc., effectively protect the first user identification and improve the security of the first user identification.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the first NF matches the preset level, the third NF sends the first response message to the first NF .
  • the preset level is used to measure the credibility levels of different NFs.
  • the credibility level includes a strong credibility level, a weak credibility level, and an untrustworthy level
  • the preset level may be a weak credibility level or an untrustworthy level.
  • the preset level may be a low credibility level or an untrustworthy level. That is, when the credibility of the first NF is low, in order to protect the first user identity, the third NF may send the pseudonym information of the first user identity (that is, the second pseudonym information) to the first NF.
  • the method further includes: if the credibility level of the first NF does not match the preset level, the third NF sends a response message carrying the first user identifier to the first NF.
  • the third NF can trust the first NF, and thus can send the real user identification, such as the first user identification, to the first NF.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the security domain in which the first NF is located matches the preset level, the third NF sends the first NF to the first NF. A response message.
  • different NFs can distinguish the trustworthiness levels, and at the same time, the trustworthiness levels of different security domains can be distinguished.
  • a first security domain, a second security domain, etc. can be distinguished, and the trust level of the first security domain is different from the trust level of the second security domain.
  • the third NF may send the second pseudonym information of the first user identification to the first NF.
  • the credibility level of the first security domain is relatively strong (for example, it does not match the preset level)
  • the third NF may send the real user identification, such as the first user identification, to the first NF.
  • the third NF determining the credible attribute of the first user identity includes: the third NF determines the credible attribute of the first user identity according to the subscription level of the first user identity; or, the third NF Determine the trusted attribute of the first user identifier according to the session attribute of the first user identifier; or, the third NF determines the trusted attribute of the first user identifier according to industry requirements of the first user identifier.
  • the subscription level, session attributes, or industry requirements of the first user identification shown above can also be understood as the subscription level, session attributes, or industry requirements of the terminal device.
  • the trusted attribute of the first user ID may be used to indicate whether the first user ID needs to be pseudonymized.
  • the trusted attribute of the first user identity may be used to indicate whether the first user identity needs to be protected, and so on.
  • the method before the third NF sends the first response message to the first NF, the method further includes: the third NF obtains the first user ID according to the first pseudonym information, and generates the first user ID according to the first user ID The second pseudonym information.
  • the third NF may obtain the first user identification according to the correspondence between the first user identification and the first pseudonym information, and the first pseudonym information. That is to say, the corresponding relationship between the first user identification and the first pseudonym information is stored in the third NF.
  • the corresponding relationship may also be understood as a mapping relationship, etc., which is not limited in the embodiment of the present application.
  • the method further includes: the third NF stores the correspondence between the second pseudonym information and the first user identifier.
  • the method before the third NF sends the first response message to the first NF, the method further includes: the third NF sends a second request message to the fourth NF, the second request message carrying the first pseudonym Information; In response to the second request message, the fourth NF obtains the first user identification according to the first pseudonym information, and generates second pseudonym information according to the first user identification; the fourth NF sends the second pseudonym information to the third NF, the first The third NF receives the second pseudonym information.
  • the correspondence relationship between the first user identification and the first pseudonym information may also be stored in the fourth NF. Therefore, after the third NF determines that the trusted attribute of the first user ID meets the preset condition, the third NF requests the second pseudonym information from the fourth NF.
  • the third NF determines the trusted attribute of the first user identity.
  • the fourth NF may also store the subscription level of the first user identity, etc.
  • the first NF may also send the first request message to the fourth NF, and the fourth NF determines the trusted attribute of the first user identity and when the trusted attribute of the first user identity meets the preset condition, the first request message The fourth NF sends a first response message to the first NF.
  • the present application provides a secure communication method.
  • the method includes: a first NF sends a first request message to a third NF, the first request message carrying first pseudonym information of a first user identifier of a terminal device; The first NF receives a first response message from the third NF, and the first response message carries the second pseudonym information of the first user identification.
  • the first NF after receiving the first response message, can generate the root key (Kamf) according to the second pseudonym information carried in the first response message. ).
  • the first response message may also carry the root key.
  • the terminal device may generate the root key according to the first user ID. It is guaranteed that there is no impact on the terminal equipment. Therefore, the third NF (or the fourth NF) generates the key deduction algorithm 1 (such as KDF1) of the second pseudonym information according to the first user ID, and generates the root secret based on the second pseudonym information
  • the key derivation algorithm 2 (such as KDF2) of the key needs to meet the following conditions: the root key generated by the third NF (or the fourth NF) is the same as the root key generated by the terminal device.
  • the first response message may also carry third indication information, and the third indication information is used to instruct the first NF to generate the root secret according to the second pseudonym information. key.
  • the root key generated by the terminal device according to the first user identification also needs to be the same as the root key generated by the first NF according to the second pseudonym information.
  • the terminal device can still generate the root key according to the first user ID.
  • the embodiment of the present application also provides a method, for example, the terminal device generates a root key according to the second pseudonym information. As follows:
  • the first response message further carries first indication information and/or second indication information, and the first indication information is used to indicate the generation of the second pseudonym information And/or the root key, the second indication information is used to instruct to generate the user plane key.
  • the method further includes: if the first response message carries the first indication information, the first NF generates the root key according to the second pseudonym information; and The first NF sends first indication information to the terminal device.
  • the first indication information may be used to instruct the terminal device to generate the second pseudonym information.
  • the first indication information may be used to instruct the terminal device to generate the root key according to the second pseudonym information.
  • the method further includes: if the first response message carries the second indication information, the first NF generates the user plane key according to the second pseudonym information; And the first NF sends second indication information to the terminal device.
  • the second indication information may be used to instruct the terminal device to generate a user plane key.
  • the method further includes: the first NF sends the user plane key to the user plane function.
  • the user plane function can interact with the terminal device according to the user plane key.
  • the user plane key is obtained based on the second pseudonym information, which not only protects the first user identity, but also protects the data between the terminal device and the user plane function according to the user plane key, which improves the security of information interaction .
  • the present application provides a secure communication method, the method includes: a third NF receives a first request message from a first NF, the first request message carrying first pseudonym information of a first user identifier of a terminal device; In response to the first request message, the third NF determines the trusted attribute of the first user ID; if the trusted attribute of the first user ID meets the preset condition, the third NF sends a first response message to the first NF, the The first response message carries the second pseudonym information identified by the first user.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the first NF matches the preset level, the third NF sends the first response message to the first NF .
  • the method further includes: if the credibility level of the first NF does not match the preset level, the third NF sends a response message carrying the first user identifier to the first NF.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the security domain in which the first NF is located matches the preset level, the third NF sends the first NF to the first NF. A response message.
  • the third NF determining the credible attribute of the first user identity includes: the third NF determines the credible attribute of the first user identity according to the subscription level of the first user identity; or, the third NF Determine the trusted attribute of the first user identifier according to the session attribute of the first user identifier; or, the third NF determines the trusted attribute of the first user identifier according to industry requirements of the first user identifier.
  • the method before the third NF sends the first response message to the first NF, the method further includes: the third NF obtains the first user ID according to the first pseudonym information, and generates the first user ID according to the first user ID The second pseudonym information.
  • the method further includes: the third NF stores the correspondence between the second pseudonym information and the first user identifier.
  • the method before the third NF sends the first response message to the first NF, the method further includes: the third NF sends a second request message to the fourth NF, the second request message carrying the first pseudonym Information; the third NF receives the second pseudonym information from the fourth NF.
  • the method executed by the third NF shown above may also be executed by the fourth NF.
  • the fourth NF may receive the first pseudonym information of the first user ID of the terminal device; then determine the trusted attribute of the first user ID; if the trusted attribute of the first user ID meets the preset condition, then the first user ID
  • Four NFs can send second pseudonym information.
  • the fourth NF may directly receive the first request message, etc. from the first NF; or, the fourth NF may also receive the request message, etc. from the third NF.
  • the fourth NF may also generate second pseudonym information, and store the corresponding relationship between the second pseudonym information and the first user ID.
  • the present application provides a secure communication method, the method includes: a fourth NF receives a second request message from a third NF, the second request message carrying the first pseudonym information of the first user identifier of the terminal device; In response to the second request message, the fourth NF obtains the first user identification according to the first pseudonym information, and generates second pseudonym information according to the first user identification; the fourth NF sends the second pseudonym information to the third NF.
  • the fourth NF stores the correspondence between the second pseudonym information and the first user identity.
  • the present application provides a secure communication method, the method includes: a terminal device receives first indication information sent by a first NF, the first indication information is used to instruct the terminal device to generate second pseudonym information and/or root secret Key; the terminal device generates second pseudonym information according to the first user ID; the terminal device generates the root key according to the second pseudonym information; the terminal device generates the access layer key and/or the non-access layer key according to the root key
  • the access layer key is used to protect data and/or signaling between the terminal device and the access device, and the non-access layer key is used to protect the data and/or signaling between the terminal device and the first NF. Or signaling for protection.
  • the present application provides a secure communication method.
  • the method includes: a terminal device receives second instruction information sent by a first NF, where the second instruction information is used to instruct the terminal device to generate a user plane key; A user ID generates the second pseudonym information; the terminal device generates a root key based on the second pseudonym information; the terminal device generates a user plane key based on the root key, and the user plane key is used to communicate between the terminal device and the user plane function Data is protected.
  • this application provides a secure communication method, the method includes: a first network function (network function, NF) sends a third request message to a network storage function (network function repository function, NRF), the third request message Carry the credibility level; in response to the third request message, the NRF determines the second NF according to the credibility level; the NRF sends the identification information of the second NF to the first NF.
  • NF network function
  • NRF network function repository function
  • the NRF may determine the second NF according to the stored correspondence between the identification information of the NF and the credibility level of the NF.
  • the NRF may store the correspondence between the identification information of one or more NFs and the credibility levels of the one or more NFs.
  • the NRF determines the second NF according to the credibility level, so that the first NF can receive the identification information of the second NF. Therefore, the first NF can interact with the NF corresponding to the credibility level (ie, the second NF). On the one hand, it can meet the credibility level requirements of the user identity corresponding to the terminal device. On the other hand, the first NF can interact with the credibility level.
  • the high-level NF (such as the second NF) performs data and/or signaling interaction, which improves the security of the interaction between the first NF and the second NF.
  • the method before the NRF determines the second NF according to the credibility level, the method further includes: the NRF receives a registration request message sent by the second NF, the registration request message carrying the credibility level of the second NF; NRF The corresponding relationship between the identification information of the second NF and the credibility level of the second NF is stored.
  • the NRF can receive a registration request message sent by one or more NFs, the registration request message carries the trust level of the NF, and the NRF can store the identification information of the one or more NFs and the one or more NFs Correspondence of the trustworthiness level of, the one or more NFs include the second NF.
  • the NRF determining the second NF according to the credibility level includes: the NRF according to the stored correspondence between the identification information of the second NF and the credibility level of the second NF, and the third request message carries The credibility level of, determines the second NF.
  • the NRF stores the corresponding relationship between the identification information of one or more NFs and the credibility level of the one or more NFs. Therefore, the NRF can be based on the stored corresponding relationship and the credibility level carried in the third message. , Determine the second NF. In other words, the NRF can obtain the second NF corresponding to the credibility level (that is, the credibility level carried in the third message) from the stored correspondence.
  • the method further includes: NRF pre-configures the trust level of one or more NFs; and saves the correspondence between the identification information of the one or more NFs and the trust level .
  • the NRF can also determine the second NF according to the pre-configuration information and the credibility level (that is, the credibility level carried in the third message), and the pre-configuration information includes the identification information of one or more NFs and the one Correspondence of the credibility levels of or multiple NFs.
  • the method before the first NF sends the third request message to the NRF, the method further includes: the first NF obtains the trusted attribute of the first user identity from the third NF; The trustworthiness attribute determines the trustworthiness level.
  • the credibility level carried in the third request message may be determined according to the credibility attribute of the first user identifier. For example, if the credibility attribute of the first user ID meets a preset condition, the credibility level is higher.
  • the trusted attribute of the first user identifier refer to the method shown in the first aspect, which will not be described in detail here.
  • the method before the first NF sends the third request message to the NRF, the method further includes: the first NF sends a fourth request message to the NSSF, the fourth request message carrying identification information of the first slice NSSF sends a fourth response message to the first NF, where the fourth response message carries the credibility level of the first slice.
  • the identification information of the first slice may come from the terminal device, that is, when the terminal device sends a related request message to the first NF, the related request message may carry the identification information of the first slice.
  • the method before the NSSF sends the fourth response message to the first NF, the method further includes: the NSSF determines the availability of the first slice according to the first pre-configuration information and the identification information of the first slice.
  • Trust level the first pre-configuration information includes a correspondence between the trust level of the first slice and the identification information of the first slice.
  • the first pre-configuration information may be configured by the operator, or configured by other NFs, etc., which is not limited in this application.
  • the identification information of the slice and the credibility level of the slice may be stored in the first pre-configuration information.
  • the first pre-configuration information may store the corresponding relationship between the identification information of one or more slices and the credibility level.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the first slice, and the third request message also carries the identifier of the first slice Information; NRF determining the second NF according to the credibility level includes: the NRF determines the second NF set corresponding to the first slice according to the identification information of the first slice; according to the saved identification information of the NF and the trustworthiness of the NF The level correspondence and the credibility level of the first slice determine the second NF from the second NF set.
  • the NRF may determine the second NF corresponding to the credibility level of the first slice from the second NF set according to the stored correspondence between the identification information of one or more NFs and the credibility level.
  • the method before the first NF sends the third request message to the NRF, the method further includes: the first NF sends a fourth request message to the NSSF, the fourth request message carrying identification information of the first slice ; NSSF sends a fourth response message to the first NF, the fourth response message carries the identification information of the second NF set and the credibility level of the second NF set, the second NF set is corresponding to the first slice NF collection.
  • the method before the NSSF sends the fourth response message to the first NF, the method further includes: the NSSF determines the authenticity of the second NF set according to the second pre-configuration information and the identification information of the first slice. Level.
  • the second pre-configuration information includes the correspondence between the identification information of the second NF set and the credibility level of the second NF set.
  • the second pre-configuration information may also include a correspondence between the identification information of the first slice and the identification information of the second NF set.
  • the NSSF may determine the second set of NFs corresponding to the first slice from the foregoing correspondence, and then determine the credibility level corresponding to the second set of NFs from the foregoing correspondence.
  • the second pre-configuration information may store the correspondence between one or more slices and the NF set, and the correspondence between one or more NF sets and the credibility level.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the second NF set; and the third request message also carries the identification information of the second NF set; NRF Determining the second NF according to the credibility level includes: the NRF determines the second NF from the second NF set according to the correspondence between the stored identification information of the NF and the credibility level of the NF, and the credibility level of the second NF set.
  • the above-mentioned NRF determining the second NF according to the credibility level includes: the NRF according to the correspondence between the stored identification information of the NF and the credibility level of the NF, the correspondence between the identification information of the NF and the identification information of the set where the NF is located, and the second set of NFs
  • the credibility level of, and the identification information of the second NF set determine the second NF from the second NF set.
  • the NRF can obtain one or more NFs corresponding to the second NF set according to the stored correspondence between the identification information of the NF and the identification information of the set where the NF is located, and the identification information of the second NF set. And according to the stored correspondence between the identification information of the NF and the credibility level of the NF, the credibility level of the one or more NFs mentioned above is obtained. And according to the credibility level of the second NF set and the credibility level corresponding to the one or more NFs, the second NF is determined from the one or more NFs.
  • the embodiment of the present application does not limit the number of NFs included in the second NF set.
  • the second NF set may include one NF; or, the second NF set may also include multiple NFs.
  • the second NF set includes the second NF.
  • the credibility level of the second NF is equal to or higher than the credibility level carried in the third request message.
  • the present application provides a secure communication method.
  • the method includes: a first NF sends a third request message to an NRF, the third request message carrying a credibility level; and the first NF receives a third response from the NRF Message, the third response message carries the identification information of the second NF; the first NF performs data and/or signaling interaction with the second NF.
  • the method before the first NF sends the third request message to the NRF, the method further includes: the first NF obtains the trusted attribute of the first user identity from the third NF; The trustworthiness attribute determines the trustworthiness level.
  • the method before the first NF sends the third request message to the NRF, the method further includes: the first NF sends a fourth request message to the NSSF, the fourth request message carrying identification information of the first slice ; The first NF receives a fourth response message from the NSSF, the fourth response message carries the credibility level of the first slice; or, the fourth response message carries the credibility level of the second NF set.
  • the third request message when the fourth response message carries the credibility level of the first slice, the third request message carries the credibility level of the first slice and the identification information of the first slice; or, When the fourth response message carries the credibility level of the second NF set, the third request message carries the credibility level of the second NF set and the identification information of the second NF set.
  • the method further includes: the first NF sends a registration request message to the NRF, where the registration request message carries the credibility level of the first NF.
  • the registration request message may also carry identification information of the NF set where the first NF is located.
  • the present application provides a secure communication method, the method includes: NRF receives a third request message from a first NF, the third request message carries a credibility level; in response to the third request message, the NRF can The information level determines the second NF; the NRF sends a third response message to the first NF, and the third response message carries the identification information of the second NF.
  • the method before the NRF determines the second NF according to the credibility level, the method further includes: the NRF receives a registration request message sent by the second NF, the registration request message carrying the credibility level of the second NF; NRF The corresponding relationship between the identification information of the second NF and the credibility level of the second NF is stored.
  • the registration request message may also carry identification information of the NF set where the second NF is located.
  • the NRF determining the second NF according to the credibility level includes: the NRF according to the stored correspondence between the identification information of the second NF and the credibility level of the second NF, and the third request message carries The credibility level of, determines the second NF.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the first slice, and the third request message also carries the identifier of the first slice Information; NRF determining the second NF according to the credibility level includes: the NRF determines the second NF set corresponding to the first slice according to the identification information of the first slice; according to the saved identification information of the NF and the trustworthiness of the NF The level correspondence and the credibility level of the first slice determine the second NF from the second NF set.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the second NF set; and the third request message also carries the identification information of the second NF set; NRF Determining the second NF according to the credibility level includes: the NRF determines the second NF from the second NF set according to the correspondence between the stored identification information of the NF and the credibility level of the NF, and the credibility level of the second NF set.
  • the above-mentioned NRF determining the second NF according to the credibility level includes: the NRF according to the correspondence between the stored identification information of the NF and the credibility level of the NF, the correspondence between the identification information of the NF and the identification information of the set where the NF is located, and the second set of NFs
  • the credibility level of, and the identification information of the second NF set determine the second NF from the second NF set.
  • the method further includes: the NRF receives a registration request message from the first NF, and the registration request message carries the credibility level of the first NF; and the NRF stores the identification information of the first NF and the first NF. Correspondence of the credibility level of a NF.
  • the registration request message may also carry identification information of the NF set where the first NF is located.
  • the present application provides a secure communication method.
  • the method includes: NSSF receives a fourth request message sent by a first NF, where the fourth request message carries identification information of a first slice; and NSSF sends a first slice to the first NF.
  • the fourth response message carries the credibility level of the first slice; or, the fourth response message carries the identification information of the second NF set and the credibility level of the second NF set, the second NF set Is the NF set corresponding to the first slice.
  • the method before the NSSF sends the fourth response message to the first NF, the method further includes: the NSSF determines the availability of the first slice according to the first pre-configuration information and the identification information of the first slice.
  • Trust level the first pre-configuration information includes a correspondence between the trust level of the first slice and the identification information of the first slice.
  • the method before the NSSF sends the fourth response message to the first NF, the method further includes: the NSSF determines the authenticity of the second NF set according to the second pre-configuration information and the identification information of the first slice. Level.
  • the second pre-configuration information includes the correspondence between the identification information of the second NF set and the credibility level of the second NF set.
  • the first NF may include AMF, SMF, or the like.
  • this application provides a secure communication method, the method includes: a domain name system (domain name system, DNS) receives a fifth request message from a first network function (network function, NF), the fifth request message Carry the domain name information and the credibility level; in response to the fifth request message, the DNS determines the second NF according to the domain name information and the credibility level; the DNS sends the identification information of the second NF to the first NF.
  • DNS domain name system
  • the DNS may determine the second NF according to the stored correspondence between the domain name information and the identification information, and the correspondence between the identification information and the credibility level (or the correspondence between the domain name information and the credibility level, etc.). For example, a correspondence relationship between the domain name information (or identification information) of one or more NFs and the trustworthiness level of the one or more NFs can be configured in the DNS.
  • the DNS determines the second NF according to the credibility level, so that the first NF can receive the identification information of the second NF, and the identification information of the second NF can include the IP address of the second NF and so on. Therefore, the first NF can interact with the NF corresponding to the credibility level (ie, the second NF).
  • the first NF can interact with the credibility level.
  • the high-level NF (such as the second NF) performs data and/or signaling interaction, which improves the security of the interaction between the first NF and the second NF.
  • the present application provides a communication device.
  • the communication device includes a corresponding unit that executes the second aspect or the method in any possible implementation manner of the second aspect.
  • the communication device includes a corresponding unit that executes the third aspect or the method in any possible implementation manner of the third aspect.
  • the communication device includes a corresponding unit capable of executing the fourth aspect or the method in any possible implementation manner of the fourth aspect.
  • the communication device includes a corresponding unit that executes the eighth aspect or the method in any possible implementation manner of the eighth aspect.
  • the communication device includes a corresponding unit capable of executing the ninth aspect or the method in any possible implementation manner of the ninth aspect. In yet another possible implementation manner, the communication device includes a corresponding unit capable of executing the tenth aspect or the method in any possible implementation manner of the tenth aspect. In yet another possible implementation manner, the communication device includes a corresponding unit that executes the method shown in the eleventh aspect.
  • the aforementioned communication device includes a transceiving unit and a processing unit.
  • the present application provides a communication device that includes a processor for executing a program stored in a memory; in a possible implementation manner, when the program is executed, the communication device is caused to execute The method shown in the foregoing second aspect or any possible implementation of the second aspect.
  • the communication device when the program is executed, the communication device is caused to execute the method shown in the foregoing third aspect or any possible implementation manner of the third aspect.
  • the communication device when the program is executed, the communication device is caused to execute the method shown in the foregoing fourth aspect or any possible implementation manner of the fourth aspect.
  • the communication device when the program is executed, the communication device is caused to execute the method shown in the foregoing eighth aspect or any possible implementation manner of the eighth aspect.
  • the communication device when the program is executed, the communication device is caused to execute the method shown in the foregoing ninth aspect or any possible implementation manner of the ninth aspect. In yet another possible implementation manner, when the program is executed, the communication device is caused to execute the method shown in the foregoing tenth aspect or any possible implementation manner of the tenth aspect. In yet another possible implementation manner, when the program is executed, the communication device is caused to execute the method shown in the above-mentioned eleventh aspect.
  • the memory is located outside the aforementioned communication device.
  • the memory is located in the aforementioned network device.
  • the network device further includes a transceiver, and the transceiver is used to receive a signal or send a signal.
  • the transceiver is used to receive a signal or send a signal.
  • the specific implementation of the transceiver and the processor will not be detailed here.
  • the present application provides a communication device that includes a processing circuit and an interface circuit.
  • the interface circuit is used to receive computer code and transmit it to the processor; the processor runs the computer code to execute the above-mentioned Method of execution.
  • the specific implementation of the interface circuit and the processing circuit will not be described in detail here.
  • the present application provides a communication device, which includes a corresponding unit that executes the fifth aspect or the method in any possible implementation manner of the fifth aspect.
  • the communication device includes a corresponding unit capable of executing the method in the sixth aspect or any possible implementation manner of the sixth aspect.
  • the communication device includes a transceiving unit and a processing unit.
  • the present application provides a communication device including a processor for executing a program stored in a memory, and when the program is executed, the communication device is caused to execute the fifth aspect or the fifth aspect described above. Or, when the program is executed, the communication device is caused to execute the method shown in the sixth aspect or any possible implementation manner of the sixth aspect.
  • the memory is located outside the aforementioned communication device.
  • the present application provides a communication device that includes a processor, a memory, and a program stored in the memory and executable on the processor.
  • the communication device is made to execute as described above
  • this application provides a communication device that includes a processor, a memory, and a transceiver.
  • the transceiver is used to receive or send signals; the memory is used to store computer codes; and the processor is used to execute
  • the computer code is used to make the communication device execute the method shown in any possible implementation of the fifth aspect or the fifth aspect; or the processor is used to execute the computer code to make the communication device execute the sixth aspect or the sixth aspect. Any possible implementation of the method shown.
  • the present application provides a communication device that includes a processing circuit and an interface circuit, the interface circuit is used to obtain first instruction information, and the first instruction information is used to instruct the communication device to generate second pseudonym information
  • the processing circuit is used to generate second pseudonym information according to the first user ID, and generate a root key according to the second pseudonym information, and generate an access layer key and/or a non-access layer secret according to the root key
  • the access layer key is used to protect the data and/or signaling between the communication device and the access device
  • the non-access layer key is used to protect the data and/or signaling between the communication device and the first NF. / Or signaling for protection.
  • the interface circuit is used to obtain second indication information, the second indication information is used to instruct the communication device to generate a user plane key; the processing circuit is used to generate second pseudonym information according to the first user ID, and according to the second pseudonym information A root key is generated, and a user plane key is generated according to the root key.
  • the user plane key is used to protect data between the communication device and the user plane function.
  • this application provides a computer-readable storage medium for storing a computer program.
  • the computer program runs on a computer
  • the second The method shown in any possible implementation of the aspect or the second aspect is executed.
  • the method shown in the foregoing third aspect or any possible implementation manner of the third aspect is executed.
  • the method shown in the foregoing fourth aspect or any possible implementation manner of the fourth aspect is executed.
  • the computer program runs on the computer
  • the method shown in the foregoing fifth aspect or any possible implementation manner of the fifth aspect is executed.
  • this application provides a computer program product, the computer program product includes a computer program or computer code, when it runs on a computer, the above aspects or any possible implementation manners of each aspect are shown in The method is executed.
  • the present application provides a computer program.
  • the computer program runs on a computer, the above aspects or the methods shown in any possible implementation manners of the aspects are executed.
  • the present application provides a communication device, in a possible implementation manner, for executing the method shown in the second aspect or any possible implementation manner of the second aspect.
  • it is used to execute the method shown in the third aspect or any possible implementation manner of the third aspect.
  • it is used to execute the method shown in the fourth aspect or any possible implementation manner of the fourth aspect.
  • it is used to execute the method shown in the fourth aspect or any possible implementation manner of the fourth aspect.
  • it is used to execute the method shown in the fifth aspect or any possible implementation manner of the fifth aspect.
  • it is used to execute the method shown in the sixth aspect or any possible implementation manner of the sixth aspect.
  • the present application provides a wireless communication system.
  • the wireless communication system includes a first NF and a third NF.
  • the first NF is used to implement the foregoing second aspect or any possible implementation manner of the second aspect.
  • the third NF is used to execute the method shown in the foregoing third aspect or any possible implementation manner of the third aspect.
  • the wireless communication system further includes a fourth NF, and the fourth NF is configured to execute the foregoing fourth aspect or the method shown in any possible implementation manner of the fourth aspect.
  • the first NF may also be used to execute the above-mentioned eighth aspect or the method shown in any possible implementation manner of the eighth aspect.
  • the wireless communication system further includes an NRF, and the NRF is used to execute the foregoing ninth aspect or the method shown in any possible implementation manner of the ninth aspect.
  • the wireless communication system further includes an NSSF, and the NSSF is configured to execute the above tenth aspect or the method shown in any possible implementation manner of the tenth aspect.
  • the wireless communication system further includes a terminal device configured to execute the method shown in the fifth aspect or any possible implementation manner of the fifth aspect; or, the terminal device may also be used For implementing the method shown in the sixth aspect or any possible implementation manner of the sixth aspect.
  • FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a secure communication method provided by an embodiment of the present application
  • Figure 3a is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 3b is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a scenario of a secure communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 6a is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 6b is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 6c is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • FIG. 6d is a schematic flowchart of a secure communication method provided by an embodiment of the present application.
  • Figure 7a is a schematic diagram of a secure communication network architecture provided by an embodiment of the present application.
  • Figure 7b is a schematic diagram of a secure communication network architecture provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a wireless communication system provided by an embodiment of the present application.
  • At least one (item) refers to one or more
  • “multiple” refers to two or more than two
  • “at least two (item)” refers to two or three and three
  • “and/or” is used to describe the association relationship of associated objects, which means that there can be three kinds of relationships.
  • a and/or B can mean: there is only A, only B, and both A and B. In this case, A and B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • "The following at least one item (a)” or similar expressions refers to any combination of these items.
  • at least one of a, b, or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c” ".
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • new radio new radio
  • the network architecture shown in Fig. 1 is an example of a 5G network architecture based on a service-oriented architecture defined in the 3rd generation partnership project (3rd generation partnership project, 3GPP) standardization process.
  • the network architecture may include at least three parts, namely a terminal equipment part, an operator network part, and a data network (DN) part.
  • the terminal equipment part may include a terminal equipment 110, and the terminal equipment 110 may also be referred to as user equipment (UE).
  • the terminal device 110 in this application is a device with a wireless transceiver function, which can be connected to one or more access network devices (or can also be referred to as access devices) in a radio access network (RAN) 140.
  • a core network (core network, CN) device (or may also be referred to as a core device) communicates.
  • the terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a user agent, or a user device.
  • the terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons, and Satellite class).
  • the terminal device 110 may be a handheld device with wireless communication function, a vehicle-mounted device, a wearable device or the Internet of Things, a terminal in the Internet of Vehicles, a 5G network, and a terminal of any shape in the future network, etc. , This application is not limited to this.
  • the operator's network is mainly a public network through which mobile network operators (MNO) provide users with mobile broadband access services.
  • MNO mobile network operators
  • the operator network or PLMN network in this application may also be a network that meets the requirements of the 3GPP standard, referred to as the 3GPP network.
  • 3GPP networks can be operated by operators, including but not limited to fifth-generation mobile communication (5th-generation, 5G) networks (referred to as 5G networks), and fourth-generation mobile communication (4th-generation, 4G) networks (referred to as 4G). Network) and so on.
  • 5G fifth-generation mobile communication
  • 4G fourth-generation mobile communication
  • 4G fourth-generation mobile communication
  • the operator network may include: network exposure function (NEF) 131, network storage function (network function repository function, NRF) 132, policy control function (PCF) 133, Unified data management (UDM) 134, application function (AF) 135, authentication server function (AUSF) 136, access and mobility management function (AMF) 137. Session management function (SMF) 138, user plane function (UPF) 139, (radio) access network ((radio) access network, (R) AN) 140, etc.
  • NEF network exposure function
  • PCF policy control function
  • UDM Unified data management
  • AF application function
  • AUSF authentication server function
  • AMF access and mobility management function
  • Session management function (SMF) 138, user plane function (UPF) 139, (radio) access network ((radio) access network, (R) AN) 140 etc.
  • parts other than the (wireless) access network 140 part may be referred to as a core network (core network, CN) part or
  • the data network DN 120 may also be referred to as a packet data network (packet data network, PDN), and is usually a network outside the operator's network, such as a third-party network.
  • PDN packet data network
  • the operator network can access multiple data network DN 120, and multiple services can be deployed on the data network DN 120, so as to provide services such as data and/or voice for the terminal device 110.
  • the specific manifestation of the above-mentioned third-party network can be specifically determined according to actual application scenarios, which is not limited in this application.
  • (R) AN140 is a sub-network of the operator's network, and is an implementation system between the service node and the terminal device 110 in the operator's network.
  • the terminal device 110 To access the operator's network, the terminal device 110 first passes through the (R)AN140, and then connects with the network function in the operator's network through the (R)AN140.
  • the access network device in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 110, and may also be referred to as an access device or (R)AN device, etc.
  • the (R)AN device includes but is not limited to: 5G Next generation base station (next generation node basestation, gNB) in the system, evolved node B (eNB) in the LTE system, radio network controller (RNC), node B (node B, NB) , Base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (home evolved nodeB, or home node B, HNB), base band unit (BBU), transmission and reception Point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), small cell equipment (pico), mobile switching center, or network equipment in the future network, etc. It is understandable that this application does not limit the specific type of access network equipment. In systems using different wireless access technologies, the names of devices with access network device functions may be different. For ease of description, the (R)AN140 will be described below with an access device as an example.
  • the access device may include a centralized unit (CU) and a distributed unit (DU).
  • the CU can also be divided into CU-control plane (CP) and CU-user plan (UP).
  • the access device may also be an open radio access network (openradioaccess network, ORAN) architecture, etc.
  • ORAN open radio access network
  • the network open function NEF (also referred to as NEF network function or NEF network function entity) 131 is a control plane function provided by the operator.
  • the NEF network function 131 opens the external interface of the operator's network to a third party in a secure manner.
  • the SMF network function 138 needs to communicate with a third-party network function
  • the NEF network function 131 can serve as a relay for the SMF network function 138 to communicate with a third-party network entity.
  • the NEF network function 131 is used as a relay, it can be used as the translation of the identification information of the subscriber and the translation of the identification information of the third-party network function.
  • the NEF network function 131 when the NEF network function 131 sends the SUPI of the subscriber from the operator network to the third party, it can translate the SUPI into its corresponding external identity (identity, ID). Conversely, when the NEF network function 131 sends the external ID (third-party network entity ID) to the operator's network, it can translate it into SUPI.
  • ID identity
  • the NEF network function 131 sends the external ID (third-party network entity ID) to the operator's network, it can translate it into SUPI.
  • the network storage function NRF132 can be used to maintain real-time information of all network functions and services in the network.
  • the network storage function NRF 132 may store identification information and credibility levels of one or more NFs.
  • the NRF may store the identification information of the second network function (network function, NF) and the credibility level of the second NF.
  • the policy control function PCF133 is a control plane function provided by the operator, which is used to provide the session management function SMF138 with a PDU session policy.
  • Policies can include charging-related policies, QoS-related policies, and authorization-related policies.
  • Unified data management UDM134 is a control plane function provided by operators, and is responsible for storing subscriber permanent identifier (SUPI), security context (security context), subscription data and other information of subscribers in the operator's network.
  • the subscribers of the above-mentioned operator's network may specifically be users who use the services provided by the operator's network, such as users who use China Telecom's terminal equipment core card, or users who use China Mobile's terminal equipment core card.
  • the SUPI of the subscriber may be the number of the core card of the terminal device, etc.
  • the aforementioned security context may be data (cookie) or token (token) stored on a local terminal device (for example, a mobile phone).
  • the contract data of the aforementioned subscriber may be a supporting service of the core card of the terminal device, for example, a flow package of the core card of the mobile phone.
  • the subscription data of the subscriber may also include the subscription level of the subscriber.
  • the subscriber is a normal user or a very important person (VIP).
  • the unified data management UDM 134 can not only save the subscription data of the subscriber, but also determine the trusted attribute of the subscriber according to the subscription level of the subscriber.
  • Application function (AF) 135 is used for data routing affected by applications, access to network opening functions, and interaction with policy frameworks for policy control.
  • the authentication server function AUSF136 is a control plane function provided by the operator, and is usually used for first-level authentication, that is, the authentication between the terminal device 110 (subscribed user) and the operator's network.
  • Access and mobility management function AMF137 is a control plane network function provided by the operator’s network. It is responsible for the access control and mobility management of the terminal device 110 accessing the operator’s network, including, for example, mobility status management, assigning user temporary identities, Functions such as authentication and authorization of users.
  • the session management function SMF138 is a control plane network function provided by the operator network, and is responsible for managing the protocol data unit (PDU) session of the terminal device 110.
  • the PDU session is a channel used to transmit PDUs, and the terminal device needs to transmit PDUs to each other with the DN 120 through the PDU session.
  • PDU session can be established, maintained and deleted by SMF138.
  • SMF138 includes session management (such as session establishment, modification and release, including tunnel maintenance between UPF139 and (R)AN140, etc.), selection and control of UPF139, service and session continuity (SSC) mode selection , Roaming and other session-related functions.
  • session management such as session establishment, modification and release, including tunnel maintenance between UPF139 and (R)AN140, etc.
  • SSC service and session continuity
  • UPF139 is a gateway provided by the operator, and a gateway for the operator's network to communicate with DN 120.
  • UPF139 includes user plane-related functions such as data packet routing and transmission, packet inspection, service usage reporting, quality of service (QoS) processing, lawful monitoring, upstream packet inspection, and downstream data packet storage.
  • QoS quality of service
  • the network functions in the operator network shown in Fig. 1 may also include a network slice selection function (NSSF) (not shown in Fig. 1), which is responsible for determining the network slice instance, selecting the AMF network function 137, etc. .
  • NSSF network slice selection function
  • the identification information of the slice and the credibility level of the slice can be stored in the NSSF.
  • the identification information of one or more slices and the credibility level of the one or more slices may be stored in the NSSF, where one slice corresponds to a credibility level.
  • the identification information of the first slice and the credibility level of the first slice may be stored in the NSSF.
  • the identification information of the slice and the NF set corresponding to the slice may also be stored in the NSSF.
  • the identification information of one or more slices and the NF set corresponding to the one or more slices may be stored in the NSSF, where one slice corresponds to one NF set; or, multiple slices correspond to one NF set.
  • the identification information of the first slice and the identification information of the second NF set corresponding to the first slice may be stored in the NSSF.
  • the identification information of the slice may include network slice selection assistance information (NSSAI) or single network slice selection assistance information (S-NSSAI), etc., in this embodiment of the application
  • NSSAI network slice selection assistance information
  • S-NSSAI single network slice selection assistance information
  • the identification information of the first slice shown above and the identification information of the second NF set corresponding to the first slice can also be understood as the correspondence between the first slice and the second NF set; or , The corresponding relationship between the identification information of the first slice and the second NF set corresponding to the first slice, etc.
  • the embodiment of the present application does not limit how to describe the relationship between the first slice and the second NF set.
  • a slice can be composed of a set of network functions and sub-networks.
  • the sub-network (R) AN 140, AMF 137, SMF138, and UPF139 in Figure 1 can form a slice.
  • each type of network function in Figure 1 is schematically drawn only one, but in actual network deployment, each type of network function or sub-network can have multiple, tens or hundreds, etc.
  • Many slices can be deployed in the network, and each slice can have different performance to meet the needs of different applications and different vertical industries. It is understandable that the slices shown in this application may also be referred to as network slices or network slice examples, and the application does not limit the name thereof.
  • the network function in the operator network shown in FIG. 1 may also include a unified data repository (UDR), and the function of the UDR may refer to UDM, which will not be described in detail here.
  • UDR unified data repository
  • the network function in the operator network shown in Figure 1 may also include a domain name system (domain name system, DNS) (not shown in Figure 1), which can be used to configure (or define) the Internet between physical network elements Protocol (Internet protocol, IP) addressing, such as IP addressing between the base station and the AMF, etc.
  • DNS domain name system
  • Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are the interface serial numbers and are the interface serial numbers.
  • the meaning of the aforementioned interface serial number can be referred to the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the aforementioned interface serial number.
  • the terminal device 110 is used as an example for the UE.
  • the name of the interface between the various network functions in FIG. 1 is only an example. In a specific implementation, the name of the interface of the system architecture It may also be other names, which are not limited in this application.
  • the mobility management network function in this application may be the AMF137 shown in FIG. 1, or may be other network functions with the access and mobility management functions AMF137 in the future communication system.
  • the mobility management network function in this application may also be a mobility management entity (mobility management entity, MME) in the LTE system.
  • MME mobility management entity
  • the access and mobility management function AMF137 is abbreviated as AMF
  • the unified data management UDM134 is abbreviated as UDM
  • the terminal device 110 is referred to as UE, which is described later in the embodiments of this application.
  • AMF access and mobility management function
  • UDM unified data management
  • UE terminal equipment
  • the network architecture shown in Figure 1 (such as the 5G network architecture) adopts a service-based architecture and common interfaces.
  • the traditional network element functions are split into several self-contained and self-managed based on network function virtualization (NFV) technology.
  • NFV network function virtualization
  • Reusable network function service module The schematic diagram of the network architecture shown in FIG. 1 can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario. For roaming scenarios, this application is also applicable.
  • the first NF may include AMF (such as default AMF (default AMF)) or SMF.
  • the third NF includes UDM, UDR or PCF and so on.
  • the fourth NF may include UDR.
  • the second NF can be any NF or network function.
  • User plane functions can include UPF.
  • the steps or functions performed by the first NF shown in this application may be implemented by AMF or SMF; the steps or functions performed by the third NF may be performed by UDM; alternatively, they may also be performed by UDR.
  • the method provided in this application is not limited to the following examples.
  • the first NF may include defaultAMF, and the second NF may include an AMF that can be interacted by a terminal device.
  • the first NF may include SMF, and the second NF may include UPF.
  • the first NF may include AMF, and the second NF may include SMF.
  • the NF involved in this application can also be understood as a network element, a node, or a network device.
  • NFs with a high credibility level can transmit data and/or signaling, which prevents NFs with a low credibility level from contacting sensitive data, improves the security of service interaction between NFs, and improves The security of the network is improved, and the deployment feasibility is high.
  • FIG. 2 is a schematic flowchart of a secure communication method provided by an embodiment of the present application. The method can be applied to the communication system shown in FIG. 1. As shown in FIG. 2, the secure communication method includes:
  • the first NF sends a first request message to the third NF, where the first request message carries the first pseudonym information of the first user identifier of the terminal device.
  • the third NF receives the first request message.
  • the first user ID may include SUPI
  • the first pseudonym information may be used to indicate the pseudonym of the first user ID (anonymous); or, the first pseudonym information may be used to indicate that the first user ID is different from the first user ID.
  • processed identification information can be obtained by the pseudonymization process of the first user ID.
  • the first pseudonym information may include a subscription concealed identifier (SUCI); or, the first pseudonym information may include a pseudonym identifier generated according to SUPI, such as SUPI*.
  • the "pseudonym information" shown in the embodiments of this application can also be replaced with "replacement information", "user pseudonym information", “anonymous information” or “pseudonym”, etc.
  • the embodiments of this application do not use the name of the pseudonym information. limited.
  • the first user identifier including SUPI shown in the embodiment of the present application is only an example. In a specific implementation, the first user identifier may also be other identifiers of the terminal device, etc., which is not limited in the embodiment of the present application.
  • the third NF determines the trusted attribute of the first user identity.
  • the trusted attribute of the first user ID can be used to indicate whether the first user ID needs to be pseudonymized, for example, whether the third NF needs to perform pseudonym processing on the first user ID; or, the first user
  • the trusted attribute of the identity can be used to indicate whether the first user identity needs to be protected. Since the terminal device can interact with the core device and/or the access device through the first user identification, as an understanding way, the third NF determines the trusted attribute of the first user identification, which can also be understood as: the third NF Determine the trusted attributes of the terminal device. Wherein, the terminal device is a device using the above-mentioned first user identifier. For this way of understanding, other embodiments herein are also applicable.
  • the third NF may determine the trusted attribute of the first user identity according to the subscription level of the first user identity.
  • the subscription level of the first user ID may be included in the subscription data of the first user ID.
  • the subscription level can be used to distinguish different types of users.
  • the subscription level of the first user identification may be a VIP user or a normal user.
  • the subscription level of the first user identification may be a user with high privacy requirements or a user with low privacy requirements. It can be understood that the contract levels shown above are only examples, and in practical applications, there may be more distinguishing methods, etc. The embodiment of the present application does not limit the specific division method of the contract level.
  • the third NF may determine the trusted attribute of the first user identifier according to the session attribute of the first user identifier.
  • the session attribute may be used to distinguish different session attributes performed by the first user identifier.
  • the session attribute of the first user identification may be an audio and video attribute.
  • the session attribute of the first user identification may be a time-frequency conference or a voice call.
  • the session attribute of the first user identifier may be a session that requires high security of data communication.
  • the embodiment of the present application does not limit the specific division method of the session attribute.
  • the third NF determines the trusted attribute of the first user identification according to the industry requirements of the first user identification.
  • the data and/or signaling when the first user identifier is used to exchange data and/or signaling, the data and/or signaling can be determined according to different industries as to whether it needs to be protected.
  • the security of the data and/or signaling can be determined according to different industries.
  • the research and development industry or the financial industry can be protected. Therefore, when data and/or signaling related to the industry is involved, the data and/or signaling can be protected.
  • the industry requirement may also be that data and/or signaling in the target area (or target security domain) need to be protected. For example, in a certain park, the data and/or signaling may be protected; but not in the certain park, whether the data and/or signaling is protected may not be limited.
  • the embodiments of the present application do not limit the specific division of the industry requirements.
  • the third NF may also determine the trusted attribute of the first user identifier according to the trusted attribute of the slice to which the first user identifier belongs.
  • the third NF may store the first user ID, the slice ID corresponding to the first user ID, and the credibility level corresponding to the slice ID, so that the third NF can be based on the credibility level corresponding to the slice ID. To determine the trusted attribute of the first user ID.
  • the third NF sends a first response message to the first NF, where the first response message carries the second pseudonym information of the first user ID.
  • the first NF receives the first response message.
  • the preset conditions may include user level conditions, identity privacy protection conditions, industry data security protection conditions, and so on.
  • the preset condition can be used to distinguish different levels of trusted attributes. Therefore, the embodiment of the present application does not limit the specific way of distinguishing the preset condition.
  • the preset condition may be determined according to the way of determining the trusted attribute.
  • the trusted attribute of the first user ID is determined by the subscription level of the first user ID
  • the preset condition may be that the subscription level is a VIP user or a user with high privacy requirements.
  • the preset condition may be a session that requires high data communication security, such as a video conference.
  • the preset condition may be a user with high industry data security. It can be understood that the embodiment of the present application does not limit the specific content of the preset condition.
  • the second pseudonym information may be used to represent the anonymous name of the first user identification; or, the second pseudonym information may be used to represent processed identification information that is different from the first user identification. If the trusted attribute of the first user ID meets the preset condition, the first user ID can be pseudonymized when interacting between different network elements or network functions, so as to ensure the security of the first user ID. In other words, if the trusted attribute of the first user ID meets the preset condition, the first user ID can interact between different network elements or network functions in the form of second pseudonym information.
  • the second pseudonym information may include SUPI*.
  • the first user ID includes SUPI
  • the first pseudonym information includes SUPI*
  • the second pseudonym information may include new SUPI*.
  • the first user ID includes SUPI
  • the first pseudonym information includes SUPI*
  • the second pseudonym information may also include SUPI*.
  • the third NF sends a first response message to the first NF, and the first response message carries the first user ID.
  • the first NF receives the first response message.
  • the trusted attribute of the first user ID indicates that the first user ID is a normal user, or the trusted attribute of the first user ID indicates that the first user ID has a lower requirement for a session, then the first user When the identifier is interacted between network elements or network functions, pseudonymization processing may not be performed. It is understandable that the embodiment of the present application does not limit whether the first user ID is pseudonymized when the trusted attribute of the first user ID does not meet the preset condition.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the first NF matches the preset level, the third NF sends the first response message to the first NF .
  • the preset level is used to measure the credibility levels of different NFs, and the specific level of the preset level is not limited.
  • the credibility level includes a strong credibility level, a weak credibility level, and an untrusted level, and the preset level may be a weak credibility level or an untrusted level.
  • the credibility level includes a high credibility level, a low credibility level, and an untrusted level, and the preset level may be a low credibility level or an untrusted level. That is, when the credibility of the first NF is low, in order to protect the first user identity, the third NF may send the pseudonym information of the first user identity (that is, the second pseudonym information) to the first NF.
  • the embodiment of the present application does not limit the specific way of dividing the credibility level, and the preset level may vary according to the way of dividing the credibility level.
  • the third NF sends a response message carrying the first user identifier to the first NF. That is to say, when the credibility of the first NF is high, the third NF can trust the first NF, and thus can send the real user identification, such as the first user identification, to the first NF.
  • the third NF can send the second pseudonym information of the first user identity to the first NF with a lower credibility level.
  • the third NF can report to the first NF. The NF sends the first user identification.
  • the third NF sending the first response message to the first NF includes: if the credibility level of the security domain to which the first NF belongs matches the preset level, the third NF sends the first NF to the first NF. A response message.
  • different NFs can distinguish the trustworthiness levels, and at the same time, the trustworthiness levels of different security domains can be distinguished.
  • a first security domain, a second security domain, etc. may be distinguished, and the trust level of the first security domain is different from the trust level of the second security domain. If the first NF is located in the first security domain, and the trust level of the first security domain is weak, it means that the security domain in which the first NF is located cannot be fully trusted, and the third NF can send the first user to the first NF Identifies the second pseudonym information.
  • the credibility level of the first zone is strong (for example, it does not match the preset level), it means that the security domain in which the first NF is located can be trusted, so the third NF can send the real user to the first NF
  • the identifier is the first user identifier.
  • a third security domain and the like may also be included.
  • the credibility levels of the first security domain, the second security domain, and the third security domain are different.
  • the embodiment of the present application does not limit how to divide the security domain. And how to divide the trust level corresponding to each security domain is not limited.
  • the method shown in FIG. 2 may further include:
  • the third NF may obtain the first user identification according to the first pseudonym information, and generate the second pseudonym information according to the first user identification.
  • the third NF may obtain SUPI according to SUCI, and then generate new second pseudonym information such as new SUPI* according to the SUPI.
  • the third NF may obtain the SUPI according to the corresponding relationship between SUPI* and SUPI, and then generate new second pseudonym information such as new SUPI* according to the SUPI.
  • the first response message may also carry the SUPI*, that is, the third NF may continue to use the existing SUPI*.
  • the third NF may determine whether to continue to use the existing SUPI* or to use the new SUPI* according to the local policy.
  • the local policy such as SUPI* can have a certain validity period.
  • the third NF can continue to use the SUPI*; and if it is not within the validity period of the SUPI*, the third NF can use the new SUPI* *.
  • the embodiment of the present application does not limit the specific manner of the local policy. It can be understood that the description of SUPI* and the new SUPI* is also applicable to the following embodiments.
  • SUPI* is only one form of pseudonym shown, and the pseudonym information of the first user ID can be in other forms, etc., which is not limited in the embodiment of the present application.
  • the random number can be a random number in the authentication vector.
  • the parameters for generating SUPI* may also include the key Kausf in the authentication vector or Kausf derived from the authentication vector, where Kausf will be shared between the UE and the home network AUSF/UDM, etc.
  • the third NF stores the correspondence between the first pseudonym information and the first user identification, and the third NF may also store the correspondence between the second pseudonym information and the first user identification.
  • the third NF saves the corresponding relationship, so that when the first NF or another NF sends the pseudonym information of the first user identifier to the third NF, the third NF can obtain the first user identifier according to the corresponding relationship.
  • the method shown in FIG. 2 may further include:
  • the third NF may send a second request message to the fourth NF, where the second request message carries the first pseudonym information.
  • the fourth NF receives the second request message.
  • the fourth NF obtains the first user identification according to the first pseudonym information, and generates second pseudonym information according to the first user identification.
  • the fourth NF may store the correspondence between the first user ID and the pseudonym information of the first user ID. Therefore, the third NF sends the second request message to the fourth NF to make the first user ID The fourth NF responds to the second request message to generate second pseudonym information.
  • the fourth NF may obtain SUPI according to SUCI, and then generate new second pseudonym information such as new SUPI* according to the SUPI.
  • the fourth NF may obtain the SUPI according to the corresponding relationship between SUPI* and SUPI, and then generate new second pseudonym information such as new SUPI* according to the SUPI.
  • the fourth NF can continue to use the existing SUPI* according to the local policy.
  • the method for generating new second pseudonym information such as new SUPI* by the fourth NF according to the first user identifier such as SUPI can refer to the method for generating the third NF, which will not be described in detail here.
  • the fourth NF sends the second pseudonym information to the third NF, and correspondingly, the third NF receives the second pseudonym information.
  • the fourth NF may also send the correspondence between the first pseudonym information and the first user identity to the third NF. Therefore, after receiving the correspondence, the third NF can obtain the first user ID according to the correspondence, and then generate the second pseudonym information according to the first user ID.
  • the corresponding relationship between the first user ID and the first pseudonym information, and/or the first user ID and the second user ID can be stored in the UDM.
  • the UDR may also store the correspondence between the first user identification and the first pseudonym information, and/or the correspondence between the first user identification and the second pseudonym information.
  • whether the third NF performs the above-mentioned step 2031 or the above-mentioned step 2032 to step 2034 is not limited in the embodiment of the present application.
  • the third NF may perform step 2031 or perform step 2032 to step 2034 according to the difference of the NF storing the above-mentioned corresponding relationship.
  • the first response message carries the second pseudonym information.
  • the first response message may also carry other information.
  • the embodiment of the present application also provides several methods:
  • the KDF algorithm may use a key derivation algorithm that has been defined in the 3GPP standard, such as the HMAC-SHA256 algorithm, and the embodiment of the application does not limit the KDF algorithm.
  • KDF2 needs to meet the following conditions :
  • KDF2 and KDF1 may be the same or different, which is not limited in the embodiment of the present application. It can be understood that the method for generating the root key shown above is only an example, and it should not be construed as a limitation to the embodiment of the present application.
  • the method shown in FIG. 2 may further include: if the root key Kamf is also carried in the first response message, the first NF may also generate a user plane key according to the root key.
  • the method of how the first NF applies the root key is not limited.
  • the foregoing first response message may also carry third indication information; where the third indication information is used to instruct the first NF to generate the root key according to the second pseudonym information.
  • the embodiment of the present application does not limit the specific indication form of the third indication information.
  • 1-bit information may be used to indicate that the first response message carries third indication information.
  • "1" may indicate that the first response message carries third indication information.
  • 2-bit information may also be used to indicate whether the first response message carries indication information, and the carried indication information is third indication information. It can be understood that the above is only an example, and this application does not limit it.
  • the method shown in FIG. 2 may further include: if the first response message also carries third indication information, the first NF generates the root key Kamf according to the second pseudonym information.
  • Kamf KDF2(SUPI*, other parameter 2)
  • the other parameter 2 is not limited in this embodiment of the application.
  • the third NF (or fourth NF) is required to generate SUPI* based on SUPI* key derivation algorithm KDF1 and the first NF based on SUPI* to generate the root key Kamf key derivation algorithm KDF2 need to meet the following conditions :
  • the KDF algorithm here uses the key derivation algorithm that has been defined in the 3GPP standard, such as the HMAC-SHA256 algorithm. At this
  • the first NF After the first NF generates the root key, it can also generate a user plane key based on the root key.
  • the embodiment of the present application does not limit how the first NF applies the root key.
  • the method shown in FIG. 2 may further include: the first NF After receiving the first response message, the root key Kamf is generated according to the second pseudonym information.
  • Kamf KDF2(SUPI*, other parameter 2)
  • the other parameter 2 is not limited in this embodiment of the application.
  • the third NF (or fourth NF) is required to generate the SUPI* key deduction algorithm KDF1 according to SUPI and the first NF generates the root key Kamf key deduction algorithm KDF2 according to SUPI* to meet the following conditions :
  • the KDF algorithm here uses the key derivation algorithm that has been defined in the 3GPP standard, such as the HMAC-SHA256 algorithm. At this time, KDF2 and K
  • the first NF After the first NF generates the root key, it can also generate a user plane key based on the root key.
  • the embodiment of the present application does not limit how the first NF applies the root key.
  • the above methods 1 to 3 have no effect on the UE, that is, the UE can remain unchanged.
  • the fact that the UE shown here can remain unchanged is relative to the fourth method.
  • the UE also needs to receive the first indication information and/or the second indication information. Therefore, it should not be understood that the UE shown in the embodiment of the present application remains unchanged as a limitation of the embodiment of the present application.
  • the above-mentioned first response message also carries first indication information and/or second indication information; wherein, the first indication information is used to indicate the generation of the second pseudonym information, and the second indication information Used to indicate the generation of the user plane key.
  • the embodiment of the present application does not limit the specific instruction form of the first instruction information and the second instruction information.
  • 1-bit information may be used to indicate whether the first indication information or the second indication information is carried in the first response message.
  • “1" may indicate that the first response message carries the first indication information
  • "0" may indicate that the first response message carries the second indication information.
  • 2-bit information may also be used to indicate whether the first response message carries indication information, and whether the carried indication information is the first indication information or the second indication information. It can be understood that the above is only an example, and this application does not limit it.
  • the method shown in FIG. 2 may further include:
  • the first NF If the first response message includes the first indication information, the first NF generates a root key according to the second pseudonym information.
  • the first NF After the first NF generates the root key, it may also generate a user plane key etc. according to the root key.
  • the embodiment of the present application does not limit the method for the first NF to apply the root key.
  • you can refer to related standards or protocols. For example, Kamf KDF(SUPI*, other parameters), and other parameters are not limited in this embodiment of the application.
  • the first NF sends first indication information to a terminal device, and correspondingly, the terminal device receives the first indication information.
  • FIG. 3a is a schematic flowchart of a secure communication method provided in an embodiment of the present application, and the method can be applied to a terminal device. As shown in Figure 3a, the method includes:
  • the terminal device receives the first indication information sent by the first NF (AMF); where the first indication information is used to instruct the terminal device to generate second pseudonym information.
  • AMF first NF
  • the first indication information may also be used to instruct the terminal device to generate a root key.
  • the terminal device generates second pseudonym information according to the first user ID.
  • the terminal device generates a root key according to the second pseudonym information.
  • the terminal device generates an access layer key and/or a non-access layer key according to the root key; where the access layer key is used to perform data and/or signaling between the terminal device and the access device Protection, the non-access stratum key is used to protect the data and/or signaling between the terminal device and the first NF.
  • the method of generating the second pseudonym information and the method of generating the root key by the terminal device according to the first user ID refer to the method of generating the second pseudonym information by the third NF and the method of generating the root key by the third NF The method is not detailed here.
  • the access layer key and/or the non-access layer key are generated according to the second pseudonym information, which can effectively improve the security level of data and/or signaling, and protect the transmission of data and/or signaling.
  • the method shown in FIG. 2 may further include:
  • the first NF If the first response message includes the second indication information, the first NF generates a user plane key according to the second pseudonym information.
  • the embodiment of the present application does not limit the method for the terminal device to generate the user plane key.
  • the first NF sends second indication information to the terminal device, and correspondingly, the terminal device receives the second indication information.
  • the first NF sends the user plane key to the user plane function, and correspondingly, the user plane function receives the user plane key.
  • FIG. 3b is a schematic flowchart of a secure communication method provided in an embodiment of the present application, and the method can be applied to a terminal device. As shown in Figure 3b, the method includes:
  • the terminal device receives second instruction information sent by the first NF; where the second instruction information is used to instruct the terminal device to generate a user plane protection key.
  • the terminal device generates second pseudonym information according to the first user ID.
  • the terminal device generates a root key according to the second pseudonym information.
  • the terminal device generates a user plane key according to the root key; wherein the user plane key is used to protect data between the terminal device and the user plane function.
  • the user plane key can be used to protect data.
  • the data is prevented from being tampered with or intercepted by other network elements or network functions, and the security of the data is guaranteed.
  • the terminal device can be understood as a device that uses the first user identifier.
  • the first user ID such as SUPI
  • SUPI can be a user ID or number stored in the core card of the terminal device.
  • the method shown above takes the first user identification as an example, but in specific applications, it may also include a second user identification, a third user identification, and so on.
  • the second user identification or the third user identification may also apply the methods shown in FIG. 2, FIG. 3a, and FIG. 3b.
  • the third NF can determine whether to pseudonymize the first user ID according to the trusted attribute of the first user ID, so that when the trusted attribute of the first user ID meets the preset conditions ,
  • the third NF sends the pseudonymized first user identification, that is, the second pseudonym information to the first NF.
  • the first user ID exists between different NFs in a pseudonymized manner, which prevents the first user ID from being tampered with or intercepted by insecure or untrusted network elements or network functions, and effectively protects the first user ID. The security of the first user identification is improved.
  • FIG. 4 is a schematic diagram of a scenario of a secure communication method provided by an embodiment of the present application.
  • This method can be applied to the network architecture shown in Figure 1. It can be understood that the method is shown with the terminal device as the UE, the first NF as the AMF, and the third NF as the UDM.
  • the network function involved in the method is such as AUSF, and the user plane function is such as UPF.
  • the first user identifier includes SUPI.
  • subscription data with one or more user identifications is pre-stored in the UDM, and the subscription data includes the subscription level.
  • the UDM is pre-configured with one or more user-identified subscription levels.
  • the secure communication method includes:
  • the UE sends a registration request message to the AMF, and the registration request message carries SUCI or a 5G global user temporary identity (5G global user temporary identity, 5G GUTI).
  • the AMF receives the registration request message.
  • the registration request message may carry SUCI.
  • the registration request message may carry GUTI.
  • the UE sends a registration request message to the AMF for the first time, which can be referred to as first registration; the UE sends a registration request message to the AMF for the non-first time, and can be referred to as non-first registration.
  • the AMF sends an authentication request message to AUSF, and the authentication request message carries SUCI or SUPI*.
  • AUSF receives the authentication request message.
  • the authentication request message When registering for the first time, the authentication request message can carry SUCI; when not registering for the first time, the authentication request message can carry SUPI*.
  • the authentication request message may also carry an identification (ID) of the service network.
  • ID of the service network may be the ID of the network where the AMF is located.
  • AUSF sends the aforementioned authentication request message to UDM, and accordingly, UDM receives the authentication request message.
  • UDM performs pseudonymization processing on SUPI according to the trusted attributes of SUPI, and obtains a new pseudonymized user identifier such as SUPI*.
  • UDM sends an authentication response message to AUSF, and the authentication response message carries a new pseudonymized user identifier such as SUPI*.
  • the AUSF receives the authentication response message.
  • UDM can obtain SUPI according to the SUCI. Then a new SUPI* is generated based on the SUPI.
  • UDM can obtain SUPI according to the previously saved correspondence (SUPI, SUPI*), and then generate a new SUPI* according to SUPI.
  • UDM can also continue to use the existing SUPI* (such as SUPI* carried in the authentication request message) according to the local policy.
  • the authentication response message may also carry the first indication information and/or the second indication information.
  • the first indication information may also be understood as pseudonymization protection indication information; the second indication information may be understood as or terminal-to-core network protection indication information.
  • UDM may perform the following processing according to the trusted attribute of the contract (such as the trusted attribute of the SUPI of the contract):
  • UDM can determine that SUPI needs pseudonymization protection. For another example, if the trusted attributes in the contract meet the industry data security protection requirements, UDM determines that SUPI needs pseudonymization protection. For another example, if the trusted attribute in the subscription indicates that SUPI is a normal user, UDM can process according to the normal process. The normal process can refer to related standards or protocols. For example, UDM may not pseudonymize SUPI. For another example, if the trusted attribute in the subscription indicates that SUPI is a VIP user, UDM determines that SUPI needs pseudonymization protection.
  • the UDM may also send the authentication request message to the UDR, and the UDR pseudonyms the SUPI according to the trusted attributes of the SUPI to obtain a new SUPI*. Therefore, the UDR sends an authentication response message to the UDM, and the authentication response message carries the new SUPI*.
  • the UDR can directly pseudonymize the SUPI to obtain a new SUPI*. Therefore, the UDR sends an authentication response message to the UDM, and the authentication response message carries the new SUPI*.
  • the authentication response message sent by the UDR to the UDM may also carry a new correspondence between SUPI* and SUPI. In this case, both UDM and UDR can obtain real user identifications such as SUPI.
  • UDR can obtain SUPI according to the SUCI, and then generate a new SUPI* according to the SUPI.
  • the UDR can obtain SUPI according to the previously saved correspondence (SUPI, SUPI*), and then generate a new SUPI* according to SUPI.
  • the UDR can also continue to use the existing SUPI* (such as the SUPI* carried in the authentication request message) according to the local policy.
  • AUSF continues to perform the authentication process for the UE through the AMF.
  • AUSF confirms that the authentication is successful.
  • AUSF sends an authentication response message to AMF, and the authentication response message carries a new SUPI*.
  • the AMF receives the authentication response message.
  • the authentication response message may also carry an anchor key.
  • the authentication response message may also carry first indication information and/or second indication information.
  • the first indication information and/or the second indication information may also be integrity protected by a shared key, so as to prevent the first indication information and/or the second indication information from being maliciously tampered with.
  • the shared key can be understood as the shared key between the UE and the AUSF during the authentication process.
  • the first indication information and/or the second indication information may be integrity protected by restoring a message authentication code (MAC) value.
  • MAC message authentication code
  • the AMF generates a root key (Kamf) according to the new SUPI* and anchor key.
  • the AMF generates a user plane key according to the root key.
  • the user plane key may also be called a terminal-to-core network protection key.
  • the network protection key may include an end-to-core network encryption key and an end-to-core network integrity protection key.
  • the UDM when the UDM generates a new SUPI*, the UDM may also generate a root key according to the new SUPI*. Therefore, the root key can also be carried in the authentication response message, so that when the AMF receives the authentication response message, the root key can be obtained.
  • the AUSF may also generate a root key according to the new SUPI*.
  • the AMF sends the first indication information and/or the second indication information to the UE.
  • the UE generates a new SUPI* according to the SUPI.
  • the UE can also use the same method as the AUSF to generate the anchor key.
  • the UE may use the shared key between the UE and the AUSF to perform an integrity protection check on the first indication information, and then the UE generates a new SUPI*.
  • the method for the UE to generate a new SUPI* may be the same as the method for UDM to generate a new SUPI*.
  • the UE may also generate the root key Kamf according to the new SUPI*.
  • the UE may also generate a user plane key according to the root key.
  • first indication information and/or the second indication information shown above may also be included in the tenth message, etc.
  • the embodiment of the present application does not affect the manner in which the AMF sends the first indication information and/or the second indication information. limited.
  • the AMF sends a registration response message to the UE.
  • the UE receives the registration response message.
  • the registration response message may include a registration acceptance message.
  • the AMF sends the terminal-to-core network protection key to the UPF through the SMF.
  • the data can be encrypted or integrity protected by the terminal to the core network protection key, thereby preventing the data from being learned by weakly trusted or untrusted NFs and improving The security of data transmission is improved.
  • the root key Kamf is generated by the AMF according to the new SUPI* carried in the authentication response message.
  • the UE uses the same method as UDM to generate a new SUPI*, and then generates the root key Kamf according to the new SUPI*.
  • the UDM may also generate the root key Kamf according to the new SUPI*.
  • the authentication response message can include the new SUPI* and the root key Kamf, so the AMF can directly receive the root key Kamf.
  • the UE can also use the same method as UDM to generate a new SUPI*, and then generate the root key Kamf according to the new SUPI*.
  • the UDM can use the security algorithm f1 to generate a new SUPI*; at the same time, the authentication response message includes the new SUPI*, and the AMF uses the security algorithm f2 and the new SUPI* to generate the root key Kamf.
  • the security algorithm f1, f2 is used to ensure that the root key Kamf generated by the UE according to the new SUPI* is equal to the root key Kamf generated by the AMF.
  • the first request message in FIG. 2 may be understood as the authentication request message in FIG. 4, and the first response message in FIG. 2 may be understood as the authentication response message in FIG. 4.
  • the first indication information in FIG. 2 may be understood as the pseudonymization protection indication information in FIG. 4
  • the second indication information in FIG. 2 may be understood as the terminal-to-core network protection indication information in FIG.
  • the user plane key shown in FIG. 2 can be understood as the terminal-to-core network protection key in FIG. 4.
  • the technical solution provided by the embodiments of the present application prevents the SUPI from being tampered with or intercepted by insecure or untrusted network elements or network functions, effectively protects the SUPI, and improves the security of the SUPI.
  • the security of data interaction between the UE and the UPF is improved.
  • the methods shown in Figs. 2 to 4 are based on whether the trusted attribute of the user ID meets the preset conditions, to determine whether to perform pseudonymization processing on the user ID.
  • the embodiment of the present application also provides a secure communication method, in which the relevant network element or network function can be determined according to the credibility level, so as to provide services for the terminal device through the relevant network element or network function.
  • FIG. 5 is a schematic flowchart of a secure communication method provided by an embodiment of the present application, and the method can be applied to the network architecture shown in FIG. 1.
  • the secure communication method includes:
  • a first network function (network function, NF) sends a third request message to an NRF, where the third request message carries a credibility level.
  • the NRF receives the third request message.
  • the first NF can also be understood as a consumer (consumerNF).
  • the credibility level can be used to indicate the credibility of the network element or the network function. According to the different level of trust, the trustworthiness of NF is different.
  • the credibility level can be directly proportional to the credibility level.
  • the credibility level can be classified into strong credibility, weak credibility, or untrustworthy.
  • the credibility level can be divided into level 1, level 2, level 3, etc. The higher the level, the higher the credibility.
  • the embodiment of the present application does not limit the specific way of dividing the credibility level.
  • the credibility level shown above may be the credibility level of NF.
  • the credibility level shown above may also be the credibility level of the slice.
  • the embodiments of the present application provide several different methods, as shown in FIG. 6a to FIG. 6c, respectively.
  • the third request message may be, for example, a message requesting to query the NF that the terminal device can access, and the NF that the terminal device can access may include AMF, SMF, UPF, and so on.
  • the NRF determines the second NF according to the credibility level.
  • the second NF can also be understood as a producer (producer NF); or, it can also be understood as a target NF (target NF).
  • the second NF may represent one NF, or the second NF may also represent multiple NFs.
  • the second NF may be one or more NFs corresponding to the credibility level.
  • the second NF may also be one or more NFs corresponding to the trusted level and the type of NF requested by the first NF.
  • the method of determining the second NF by NRF is also different, which can be shown in Fig. 6a to Fig. 6c respectively.
  • the NRF sends the identification information of the second NF to the first NF.
  • the first NF receives the identification information of the second NF.
  • the identification information of the second NF may include the type of the second NF (NF type), the instance of the second NF (NF instance), the identification of the second NF set (NF set ID), or the IP address of the second NF, etc.
  • NF type the type of the second NF
  • NF instance the instance of the second NF
  • NF set ID the identification of the second NF set
  • IP address the IP address of the second NF
  • the identification information of the second NF may be included in the third response message.
  • the NRF determines the second NF according to the credibility level, so that after the first NF receives the identification information of the second NF, the first NF and the second NF exchange data and/or signaling. Therefore, the first NF can interact with the NF corresponding to the credibility level (that is, the second NF). On the one hand, it can meet the credibility requirements of the first NF. On the other hand, the first NF can interact with the credibility level of the first NF.
  • the NF (such as the second NF) performs data and/or signaling interaction, which improves the security of the interaction between the first NF and the second NF.
  • the embodiment of the present application also provides several methods, which are as follows:
  • Fig. 6a is a schematic flowchart of a secure communication method provided by an embodiment of the present application. As shown in Fig. 6a, the method includes:
  • the NRF in this method stores the credibility levels of one or more NFs (including the second NF).
  • the second NF is used as an example to illustrate the method provided in the embodiment of the present application.
  • the method shown below is not only applicable to the second NF, but also applicable to other NFs and the like.
  • the method for storing the credibility levels of one or more NFs in the NRF includes step 601 and step 602.
  • the NRF receives a registration request message sent by the second NF, where the registration request message carries the credibility level of the second NF. Correspondingly, the NRF receives the registration request message.
  • the registration request message also carries the identification information of the second NF.
  • the NRF saves the credibility level of the second NF.
  • the second NF may send the trust level of the second NF to the NRF when sending the registration request message to the NRF.
  • the method of dividing the credibility level refer to the method shown in FIG. 5, which will not be described in detail here.
  • the embodiment of the present application does not limit how the NRF saves the credibility level of the second NF and the location where the credibility level of the second NF is saved.
  • the NRF may store the corresponding relationship between the identification information of the second NF and the credibility level, such as (NF instance, NF type, credibility level).
  • the credibility level of the NF may be stored in the NRF in a manner that one NF corresponds to a credibility level.
  • the NRF may also store the credibility levels of the multiple NFs in a manner in which multiple NFs correspond to one credibility level.
  • the above is a method for dynamically obtaining the credibility level of NF provided by the embodiments of the present application.
  • the embodiment of the present application also provides a method for statically obtaining the credibility level of the NF, for example, the NRF preconfigures the credibility level of one or more NFs, and saves the credibility level of the one or more NFs.
  • the NRF pre-configures the credibility level of the second NF, and saves the credibility level of the second NF.
  • the operator may pre-configure the trust level of the second NF for the NRF. It can be understood that the embodiment of the present application does not limit the method for configuring the trust level of one or more NFs in the NRF.
  • the identification information of one or more NFs and the credibility level of the one or more NFs can be stored in the NRF.
  • the identification information of the NCa and the credibility level of the NCa can be stored in the NRF.
  • the NRF may also store the identification information of the NFb and the credibility level of the NFb.
  • the NRF may also store the identification information of the NFc and the credibility level of the NFc.
  • NFa, NFb, and NFc are only used to distinguish different NFs and do not have other specific meanings.
  • the identification information of one or more NFs and the credibility level of the one or more NFs can be stored in the NRF shown above, and it can also be understood as storing one or more NFs and the one or more NFs in the NRF. Or, it can also be understood that the corresponding relationship between the identification information of one or more NFs and the credibility level is stored in the NRF, and the embodiment of the present application does not limit the specific description method.
  • the first NF obtains the credibility attribute of the first user ID from the third NF, and determines the credibility level according to the credibility attribute of the first user ID.
  • the trusted attribute of the first user ID can be used to indicate whether the first user ID needs to be pseudonymized. Therefore, it is necessary to perform pseudonymization processing on the first user identification, which indicates that the credibility level required for the first user identification is higher. Therefore, after the third NF obtains the credibility attribute of the first user ID, it can determine the credibility level according to the credible attribute of the first user ID. For how the third NF obtains the trusted attribute of the first user ID, refer to the method shown in FIG. 2, which will not be described in detail here.
  • the first NF may perform step 603 when receiving a message requesting network access sent by the terminal device.
  • the first NF may also perform step 603 when receiving a message requesting a session establishment request sent by the terminal device.
  • the first NF may also execute step 603 and so on in other scenarios, which is not limited in the embodiment of the present application.
  • the first NF sends a third request message to the NRF, where the third request message carries the credibility level.
  • the NRF receives the third request message.
  • the NRF determines the second NF according to the stored correspondence between the identification information of the second NF and the credibility level of the second NF, and the credibility level carried in the third request message.
  • the NRF stores the identification information and credibility levels of one or more NFs; or, it can also be understood that the NRF stores the correspondence between the identification information of one or more NFs and the credibility levels of the one or more NFs ; Or, it can also be understood that the identification information of the NF and the credibility level of the NF are stored in the NRF.
  • the method for storing the identification information of the NF and the credibility level of the NF in the NRF reference may be made to the related descriptions of step 601 and step 602, which will not be described in detail here.
  • the credibility level of the second NF may be equal to the credibility level carried in the third request message. In other implementations, the credibility level of the second NF may also be higher than the credibility level carried in the third request message, etc., which is not limited in this application.
  • NF2, credibility level such as high can be stored in NRF.
  • the credibility level carried in the third request message is a high credibility level.
  • the NRF can determine the NF with a high credibility level, such as NF2 and/or NF3, as the second NF from the credibility level of the stored NF.
  • NF2, NF3, NF4, and NF5 in the examples shown above may be the same type of NF.
  • the credibility levels of various different types of NFs may be stored in the NRF.
  • the NRF determines the second NF
  • the second NF may also be determined according to the NF type requested by the first NF.
  • the first NF needs to request an AMF that the terminal device can access, and the second NF is the NF corresponding to the credibility level carried in the third request message.
  • the credibility level of the second NF may weakly correspond to the credibility level; or, the credibility level of the second NF may also be Higher than the credibility level is weak.
  • the credibility level of the NF can also be understood as the credibility level corresponding to the NF identifier.
  • the NRF sends the identification information of the second NF to the first NF, and correspondingly, the first NF receives the identification information of the second NF.
  • the first NF by storing the credibility level of each NF (including the second NF) in the NRF, the first NF can request the NF with a high credibility level from the NRF. Therefore, the first NF can interact with the NF with a high credibility level (such as the second NF) for data and/or signaling interaction, ensuring the security of data and/or signaling.
  • a high credibility level such as the second NF
  • Fig. 6b is a schematic flowchart of a secure communication method provided by an embodiment of the present application. As shown in Fig. 6b, the method includes:
  • the first NF sends a fourth request message to the NSSF, where the fourth request message carries identification information of the first slice.
  • the NSSF receives the fourth request message.
  • the specific type of the fourth request message is not limited in the embodiment of the present application.
  • the NSSF determines the credibility level of the first slice according to the first pre-configuration information and the identification information of the first slice carried in the fourth request message.
  • the first pre-configuration information is configured by the operator, or configured by other NFs, which is not limited in this application.
  • the identification information of the slice and the credibility level of the slice may be stored in the first pre-configuration information.
  • the first pre-configuration information may store the corresponding relationship between the identification information of one or more slices and the credibility level.
  • the first pre-configuration information includes the identification information of the first slice and the credibility level of the first slice.
  • the credibility level of the first slice may also be understood as the credibility level corresponding to the identification information of the first slice.
  • the credibility level of multiple slices can also be understood as the credibility level corresponding to the identification information of the multiple slices.
  • the multiple slices may correspond to one credibility level, or the multiple slices may also correspond to multiple credibility levels. For example, one slice corresponds to one credibility level, or two slices correspond to one credibility level, etc.
  • the embodiment of the present application does not limit how the NSSF saves the relationship between the slice and the credibility level.
  • the NSSF can search for the credibility level corresponding to the first slice according to the identification information of the first slice from among the saved credibility levels of one or more slices, so as to obtain the first slice.
  • the confidence level of the slice is the confidence level of the slice.
  • the NSSF sends a fourth response message to the first NF, where the fourth response message carries the credibility level of the first slice.
  • the first NF receives the fourth response message.
  • the credibility level of the first slice carried in the fourth response message can also be understood as the credibility level corresponding to the identification information of the first slice carried in the fourth response message.
  • the fourth response message also carries identification information of the first slice.
  • the first NF sends a third request message to the NRF, where the third request message carries the credibility level of the first slice and the identification information of the first slice.
  • the NRF receives the third request message.
  • the NRF determines the second set of NFs corresponding to the first slice according to the identification information of the first slice; according to the correspondence between the saved identification information of the NF and the credibility level of the NF, and The confidence level of the first slice determines the second NF from the second set of NFs.
  • the NRF may store the corresponding relationship between the identification information of one or more NFs and the credibility level.
  • the identification information of one or more NFs and the credibility level of the one or more NFs are stored in the NRF. Therefore, the NRF can determine the second NF from the second NF set according to the credibility level of the first slice.
  • the embodiment of the present application does not limit the number of NFs included in the second NF set.
  • the second NF set may include one NF such as a second NF; for another example, the second NF set may also include multiple NFs, etc., and the multiple NFs include the second NF. It can be understood that the description of the second NF set is also applicable to other embodiments of the present application.
  • the NRF sends the identification information of the second NF to the first NF, and correspondingly, the first NF receives the identification information of the second NF.
  • the method shown in FIG. 6b may further include:
  • the NRF receives a registration request message sent by the second NF, where the registration request message carries the credibility level of the second NF. Correspondingly, the NRF receives the registration request message.
  • the registration request message also carries the identification information of the second NF.
  • the NRF saves the credibility level of the second NF.
  • step 617 and step 618 reference may be made to step 601 and step 602 shown in FIG. 6a, which will not be described in detail here.
  • FIG. 6c is a schematic flowchart of a secure communication method provided by an embodiment of the present application. As shown in FIG. 6c, the method includes:
  • the first NF sends a fourth request message to the NSSF, where the fourth request message carries identification information of the first slice.
  • the NSSF receives the fourth request message.
  • the specific type of the fourth request message is not limited in the embodiment of the present application.
  • the NSSF determines the credibility level of the second NF set according to the second pre-configuration information and the identification information of the first slice.
  • the second pre-configuration information is configured by the operator, or configured by other NFs, etc., which is not limited in this application.
  • the second pre-configuration information includes the identification information of the NF set and the credibility level of the NF set.
  • the second pre-configuration information may include the correspondence between the identification information of the second NF set and the credibility level of the second NF set.
  • the second pre-configuration information may also include the identification information of the slice and the identification information of the NF set.
  • the second pre-configuration information may include a correspondence between the identification information of the first slice and the identification information of the second NF set.
  • one slice may correspond to one or more NF sets, and one NF set may correspond to one credibility level.
  • the NSSF may determine the NF set corresponding to the first slice, such as the second NF set, according to the identification information of the first slice carried in the fourth request message; and then determine that the second NF set corresponds to The level of trustworthiness.
  • the NSSF sends a fourth response message to the first NF, where the fourth response message carries the identification information of the second NF set and the credibility level of the second NF set.
  • the first NF receives the fourth response message.
  • the first NF sends a third request message to the NRF, where the third request message carries the credibility level of the second NF set and the identification information of the second NF set.
  • the NRF receives the third request message.
  • the NRF determines the second NF from the second NF set according to the stored correspondence between the identification information of the NF and the credibility level of the NF, and the credibility level of the second NF set.
  • the NRF sends the identification information of the second NF to the first NF, and correspondingly, the first NF receives the identification information of the second NF.
  • the method shown in FIG. 6b may further include:
  • the NRF receives a registration request message sent by the second NF, where the registration request message carries the credibility level of the second NF. Correspondingly, the NRF receives the registration request message.
  • the registration request message also carries the identification information of the second NF.
  • the NRF saves the credibility level of the second NF.
  • step 627 and step 628 reference may be made to step 601 and step 602 shown in FIG. 6a, which will not be described in detail here.
  • Fig. 6d is a schematic flowchart of a secure communication method provided by an embodiment of the present application. As shown in Fig. 6d, the method includes:
  • the first NF sends a fourth request message to the NSSF, where the fourth request message carries identification information of the first slice.
  • the NSSF receives the fourth request message.
  • the NSSF determines one or more NFs corresponding to the first slice and the credibility level corresponding to the one or more NFs according to the third pre-configuration information and the identification information of the first slice.
  • the third pre-configuration information includes the corresponding relationship between the identification information of the slice and the identification information of the NF.
  • the third pre-configuration information may include the correspondence between one or more slices and NF.
  • one slice can correspond to one or more NFs
  • one NF can correspond to one credibility level.
  • the credibility levels corresponding to the foregoing multiple NFs are the same, or the credibility levels corresponding to the foregoing multiple NFs are different, etc., which is not limited in the embodiment of the present application.
  • the first slice may correspond to NF7 (high credibility level), NF8 (high credibility level), and NF9 (high credibility level).
  • the first slice may correspond to NF7 (high credibility level), NF8 (high credibility level), and NF10 (weak credibility level).
  • the NSSF sends a fourth response message to the first NF, where the fourth response message carries the identification information of one or more NFs and the credibility level of the one or more NFs.
  • the first NF receives the fourth response message.
  • the method shown in this embodiment of the application is different from FIG. 6c in that the fourth response message in FIG. 6c carries the credibility level of the second NF set, and the fourth response message in FIG. 6d carries one or more The trustworthiness level of NF.
  • the credibility level in FIG. 6c is for a set.
  • the embodiment of the present application does not limit it. That is, the credibility level of the NF included in the second NF set may also be lower than the credibility level carried in the third request message.
  • the fourth response message directly carries the identification information of one or more NFs and the credibility level of the one or more NFs.
  • the first NF can directly obtain information from the one or more NFs. Choose one NF as the second NF. That is, after the first NF receives the fourth response message, the first NF may determine the second NF that interacts with the first NF according to the credibility levels of one or more NFs.
  • the NSSF sends the credibility level of one or more NFs to the first NF, so that the first NF can quickly determine the second NF, which is simple to implement and has high efficiency.
  • the first NF and the second NF shown above are only an example. In practical applications, in scenarios where the terminal device needs to access the network or establish a session connection, more NFs may be involved. In other words, the technical solutions provided by the embodiments of the present application can be applied to more NFs.
  • the terminal device when the terminal device is accessing the network or establishing a session connection, the first NF interacts with the NRF or NSSF to obtain a high level of credibility that interacts with the first NF The second NF.
  • the security of business interaction is guaranteed.
  • This application also provides a secure communication method, which is as follows:
  • the first network function sends a fifth request message to the domain name system (DNS), and the fifth request message carries the domain name information and the credibility level; correspondingly, the DNS receives the fifth request information.
  • DNS domain name system
  • the DNS determines the second NF according to the domain name information and the credibility level; the DNS sends the identification information of the second NF to the first NF.
  • the DNS may determine the second NF according to the stored correspondence between the domain name information and the identification information, and the correspondence between the identification information and the credibility level (or the correspondence between the domain name information and the credibility level, etc.). For example, a correspondence relationship between the domain name information (or identification information) of one or more NFs and the trustworthiness level of the one or more NFs can be configured in the DNS.
  • the DNS determines the second NF according to the credibility level, so that the first NF can receive the identification information of the second NF, and the identification information of the second NF can include the IP address of the second NF and so on. Therefore, the first NF can interact with the NF corresponding to the credibility level (ie, the second NF).
  • the first NF can interact with the credibility level.
  • the high-level NF (such as the second NF) performs data and/or signaling interaction, which improves the security of the interaction between the first NF and the second NF.
  • identification information of the second NF may be carried in the fifth response message, etc., which is not limited in the embodiment of the present application.
  • the first NF may also include an access device and the like
  • the second NF may include AMF and the like.
  • the method shown in FIGS. 5 to 6d above can also be combined with the method shown in FIGS. 2 to 4.
  • the first user ID may exist between different NFs in a pseudonymized manner.
  • the first NF can not only select the NF with a high level of credibility, such as the second NF, to interact; and when the first NF interacts with the second NF, the first user identity can also be a pseudonym
  • the mode of transformation (or real user identification) exists between the first NF and the second NF.
  • the security of the first user identification is not only improved, but also the security or reliability of data and/or signaling interaction is effectively guaranteed.
  • the data and/or signaling can also be encrypted by the user plane key, so as to ensure the security of the data and/or signaling.
  • the secure communication method provided in this application can be considered from the perspectives of user identification security, communication network topology security, terminal to core network protection security, etc., to reduce privacy leakage or weak links being used by others, and reduce policy reasons in various regions. And the excessive worry caused.
  • hierarchical settings a small number of sensitive network elements are controlled, and sub-node credit is performed, so that most of the network element equipment can not involve sensitive data or reduce the security level requirements, and the feasibility of existing network deployment is greatly improved.
  • the following will take a specific NF as an example to illustrate the secure communication method provided by this application.
  • This method implements methods such as grading, pseudonymization, and separable NF credit, which improves the feasibility of network deployment and data security.
  • the credibility level of the NF shown above may include, for example, trusted NF, weakly trusted NF, and untrusted NF.
  • the trusted NF may include trusted data NF, trusted control NF, and trusted support NF, as shown in Table 1.
  • the trusted data NF can be used to store subscription data, etc.; the trusted data NF can include the third NF and the fourth NF shown above.
  • the trusted control NF can be used to address the NF, etc.; the trusted control NF can include the first NF, NRF, or NSSF shown above.
  • the trusted support NF may include the user plane functions shown above, and the trusted support NF may include UPF, MEC, and so on.
  • the trusted support NF may be a user plane network element authorized by the operator.
  • the trusted support NF can perform data non-uploading according to industry data requirements (supporting agreed inspections); or, according to the access network conditions, start the terminal to the core network protection (that is, use the user plane key to encrypt the data ); Or, start the protection between trusted stents and NFs according to network conditions.
  • the trusted data NF may include 5GUDM, 4G UDM, HSS, PCF in the mobile network, etc., or may also be the user database part in the aforementioned network element.
  • the credible data NF is credible because the credible data NF needs to store sensitive user information such as user IDs, keys, and subscription data. In other words, the high sensitivity of the trusted data NF is that the trusted data NF needs to store the above-mentioned user sensitive information.
  • the trusted control NF can include 5G NRF, DNS, and 4G DNS.
  • the addressing between NFs is controlled by NRF, DNS, etc., and can perform topology hiding and directional offloading.
  • the high sensitivity of the trusted control NF is that the trusted control NF needs to store data information such as network topology control.
  • the DNS is used to configure IP addressing between physical network elements (for example, between the access device and the AMF).
  • NRF is used to configure addressing between virtual network functions (virtual network functions, VNFs) (for example, between AMF and SMF in the same physical data center).
  • VNFs virtual network functions
  • the NRF can also be configured with a trusted support NF and a weak trust support NF.
  • the trusted control NF may also contain SCP, which is used to process the indirect addressing process and the topology hiding process specified in the 3GPP standard.
  • SCP which is used to process the indirect addressing process and the topology hiding process specified in the 3GPP standard.
  • the AMF2 as shown in Fig. 7b can be indirectly addressed to the SMF2 through the SCP, and then the AMF2 can communicate with the SMF2 indirectly through the SCP.
  • the SMF can pre-configure some trusted support NFs to be trusted for all UEs.
  • the trusted control NF may also include default AMF (or default AMF such as default AMF) and NSSF, which are used to obtain the user's real subscription data before slice selection.
  • default AMF or default AMF such as default AMF
  • NSSF which are used to obtain the user's real subscription data before slice selection.
  • the trusted support NF may include a UPF, and the UPF may be a UPF for decrypting and viewing data, and may not be all UPFs in the network.
  • the trusted support NF may also include multi-access edge computing (multi-edge computing, MEC).
  • MEC multi-access edge computing
  • the MEC and the UPF may be two different NFs, or the MEC and the UPF may also be integrated into one NF.
  • the trusted data NF, the trusted control NF, and the trusted support NF shown above can be configured by the operator, that is, the trusted NF in the network is configured in a static manner.
  • the relevant information of the trusted NF can be stored in the trusted data NF.
  • the relevant information (such as pre-configuration information) of the trusted NF may also be stored in NRF or NSSF.
  • the trusted NF shown above may also be determined by a trusted control NF (such as NRF).
  • the NRF may determine the second NF that interacts with the first NF.
  • the trusted control NF can be configured with some trusted support NFs according to the preset NF types (such as AMF, SMF, UPF, etc.), which can be trusted for all UEs; or, some trusted support NFs can also be configured. Some UEs are trustworthy.
  • UPF1 can be used as a trusted support NF.
  • the trusted support NF interacting with the UE5 is not necessarily UPF1.
  • the trusted control NF can be configured with some trusted stents NF, which are trusted for all UEs; or, the trusted stents NF are only trusted for certain UEs, and so on.
  • the trusted data NF can be configured with the trusted support NF according to the following method. Exemplary, such as:
  • the trusted support NF Configure the trusted support NF, weakly trusted support NF, or untrusted support NF according to the user type identified by the user (for example, ordinary user, VIP user). For example, for VIP users, all NFs configured for them may be trusted NFs. For ordinary users, ordinary NF or weakly trusted NF can be configured for them.
  • a trusted support NF for example, MEC and MEC1 and MEC4 built together with UPF1 and UPF4.
  • a trusted support NF can be configured for it.
  • the trusted support NF corresponding to the slice can provide a trusted service for the user ID.
  • the trusted data NF can also be configured with the trusted support NF according to the following manner.
  • Table 2 shows examples of the trusted attributes of the user ID in the trusted data NF and the network configuration strategy.
  • the trusted attribute in Table 2 refers to the trusted attribute of the user identifier (such as the first user identifier), or can also be understood as the trusted attribute of the terminal device to which the user identifier is applied.
  • the trusted data NF may refer to an NF that stores information such as subscription data of the user identification.
  • the trusted data NF in Table 2 can be understood as the third NF and/or the fourth NF involved in this application.
  • the trusted control NF means the first NF, NRF, NSSF, etc. that can be understood as this application.
  • the trusted NF credited according to the policy rules in Table 2 may represent the NF providing services for the terminal device, and the trusted NF may be understood as the second NF involved in this application.
  • the policy rule may indicate that the NF providing services for the VIP user is a trusted NF.
  • the trusted NF may include a trusted control NF such as SMF And/or AMF, and trusted support NF such as UPF, etc.
  • UE1 can interact with the application server via a trusted access network, a trusted transmission network, a trusted support NF such as UPF1, a trusted control NF, a trusted data NF, and a trusted support NF such as UPF4.
  • the user ID of the VIP user may also be pseudonymized, thereby protecting the user ID.
  • the UE can interact with UPF1 and UPF4 through a user plane key.
  • the policy rule may process the user identification for pseudonymization.
  • the policy rule may also include that the UE interacts with the UPF by using the user plane key. If the UE does not support interaction with the UPF through the user plane key (that is, the UE does not support terminal-to-core network protection), the UE can also interact with the trusted UPF.
  • the UE2 or UE3 can pass through a trusted support node such as UPF4, so as to achieve network hop by HOP encryption or integrity protection (that is, UE2 or UE3 to UPF4 Encryption, and UPF4 to the application server encryption) and so on.
  • a trusted support node such as UPF4
  • Table 3 shows the functions of each trusted control node.
  • the credibility level of the NF the credibility level of the NF set, or the credibility level of a slice, etc. can be stored in the credibility control NF.
  • Table 4 shows different network topology configuration strategies and requirements for different user identifications. It is understandable that Table 4 can also be understood as a supplementary description of Table 3.
  • FIG. 7a and FIG. 7b are schematic diagrams of a secure communication network architecture provided by an embodiment of the present application.
  • the trusted data NF included in the network architecture can be UDM1 as shown in Figure 7a; the trusted control NF can be NRF/DNS/default AMF/NSSF as shown in Figure 7a; the trusted support NF can be as shown in Figure 7a UPF1 and UPF4.
  • the NFs in the remaining 5GC can be weakly credible general NFs (or can also be called ordinary NFs).
  • AMF2, AMF3, SMF2, SMF3, UPF2, UPF3, etc. in FIG. 7b may be universal NFs.
  • the terminal device to which FIG. 7a and FIG. 7b are applied may be any type of device, and the embodiment of the present application does not limit the specific type of the terminal device.
  • the weak trust NF cannot obtain the real user identity of the terminal device.
  • AMF2 and AMF3 can obtain the pseudonymized user identities of UE2 and UE3 from the trusted data NF of the operator, and perform service processing through the pseudonymized user identities (also can be understood as data and/or signaling processing, etc.) .
  • AMF2 and AMF3 do not need to perceive the real user ID; further, AMF2 and AMF3 can generate the root key based on the pseudonymized user ID, and further generate the user plane key based on the root key, through SMF (such as SMF2, SMF3) and The trusted support node UPF4 interacts.
  • the weakly trusted support node in the middle UPF2 or UPF3 cannot learn the true data of the UE.
  • the untrusted NF can be an access device such as WiFi that easily monitors the air interface, or a risky transmission NF such as a wide area network.
  • a risky transmission NF such as a wide area network.
  • user data passes through these untrusted NFs, it must be a data stream that passes through the terminal device to the trusted support NF encryption or integrity protection, or e2e application layer protection.
  • untrusted NFs (such as UPF2 or UPF3) cannot know the real data of the UE.
  • the trusted attributes of UE1 meet the preset conditions, and the trusted attributes of UE2 and UE3 do not meet the preset conditions.
  • the subscription data of UE1, UE2, and UE3, etc. can be stored in the trusted data NF.
  • UE1, UE2, UE3 subscribe to the operator AN1, and the operator AN1 stores the real user ID, real subscription data, real key, etc. in the trusted data NF (trusted UDM, trusted PCF, or trusted database therein) medium).
  • UE1 is a VIP user, so the NF interacting with the UE1 may be an NF with a high credibility level, such as a credible NF.
  • the UE1 may interact with the application server through a trusted access network, a trusted transmission network, and a trusted fifth-generation mobile communication core network (5G core, 5GC).
  • 5G core 5G core
  • the user identity of the UE1 can traverse different NFs in a pseudonymized manner.
  • the user identity of the UE1 can also traverse different NFs (or traverse in a trusted security domain) with a real user identity.
  • UE2 or UE3 can pass through an untrusted access network or a weakly trusted access network, an untrusted transmission network or a weakly trusted transmission network, a weakly trusted 5GC, and a trusted support node such as UPF4 interacts with the application server.
  • the user identity of UE2 or UE3 can be pseudonymized.
  • the user data of UE2 or UE3 may also be encrypted for transmission.
  • the data flow of UE2 can be protected at the e2e application layer according to business needs, and can also be terminal to trusted Support data protection between NFs (such as UPF4).
  • NFs such as UPF4
  • the user IDs of UE2 and UE3 traverse untrusted areas (ie untrusted domains) such as UPF2 or UPF3 to reach UPF4, they will be protected by the pseudonymization scheme in this application; they can also be protected by the terminal in this application to the trusted support NF (Such as UPF4) the user plane key between the user plane data encryption and integrity protection.
  • UPF4 trusted support NF
  • FIG. 7a and FIG. 7b are only examples, and should not be construed as limiting the embodiments of the present application.
  • trusted NFs such as trusted data NF, trusted control NF, and trusted support NF can be deployed.
  • the trusted NF can obtain real data (such as real user identification or user data). Etc.) and network topology, while other NFs do not need to know these contents, the deployment is simple and efficient, and the feasibility of network construction is improved.
  • the communication device provided in the embodiment of the present application will be described in detail below.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device can be used to perform operations performed by a terminal device in the foregoing method embodiments.
  • the communication device may be used to perform the method shown in FIG. 3a and/or FIG. 3b.
  • the communication device includes a transceiver unit 801 and a processing unit 802.
  • the transceiver unit 801 is configured to receive the first indication information sent by the first NF; where the first indication information is used to instruct the terminal device to generate the second pseudonym information and/or the root key;
  • the processing unit 802 is configured to generate second pseudonym information according to the first user ID; and generate a root key according to the second pseudonym information; and generate an access layer key and/or a non-access layer key according to the root key; wherein
  • the access layer key is used to protect the data and/or signaling between the terminal device and the access device, and the non-access layer key is used to protect the data and/or signaling between the terminal device and the first NF. Order for protection.
  • the transceiver unit 801 is configured to receive the second indication information sent by the first NF; where the second indication information is used to instruct the terminal device to generate a user plane protection key;
  • the processing unit 802 is configured to generate second pseudonym information according to the first user ID; and generate a root key according to the second pseudonym information; and generate a user plane key according to the root key; wherein, the user plane key is used for the terminal device The data between and the user plane function is protected.
  • the processing unit 802 may be one or more processors, and the transceiver unit 801 may be a transceiver, or the transceiver unit 801 may also be The sending unit and the receiving unit.
  • the sending unit may be a transmitter and the receiving unit may be a receiver.
  • the sending unit and the receiving unit are integrated into one device, such as a transceiver.
  • the processing unit 802 may be one or more processors, or the processing unit 802 may be a processing circuit or the like.
  • the transceiving unit 801 may be an input/output interface, also called a communication interface, or an interface circuit, or an interface, and so on.
  • the transceiver unit 801 may also be a sending unit and a receiving unit, the sending unit may be an output interface, and the receiving unit may be an input interface, and the sending unit and the receiving unit are integrated into one unit, such as an input/output interface.
  • the communication device in the embodiment of the present application can perform any function performed by the terminal device in the above method embodiment.
  • the foregoing communication device may be a terminal device in each of the foregoing method embodiments.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and a transceiver 910. The processor and the transceiver can be used to perform the functions or operations performed by the above-mentioned terminal device.
  • the transceiver may be used to receive the first indication information sent by the first NF.
  • the processor may be configured to generate second pseudonym information according to the first user ID; generate a root key according to the second pseudonym information; generate an access layer key and/or a non-access layer key according to the root key, etc. .
  • the transceiver may be used to receive the second indication information sent by the first NF.
  • the processor may be configured to generate second pseudonym information according to the first user identification; or, generate a root key based on the second pseudonym information; or, generate a user plane key based on the root key.
  • the transceiver may include a receiver and a transmitter.
  • the receiver is used to perform the function (or operation) of receiving, and the transmitter is used to perform the function (or operation) of transmitting. ).
  • the transceiver is used to communicate with other devices/devices through the transmission medium.
  • the processor 920 transmits and receives data and/or signaling through the transceiver 910, and is used to implement the corresponding method described in FIG. 3a and/or FIG. 3b in the foregoing method embodiment.
  • the communication device 90 may further include one or more memories 930 for storing program instructions and/or data.
  • the memory 930 and the processor 920 are coupled.
  • the memory 930 may be used to store a root key, an access stratum key, or a non-access stratum key, and the like.
  • the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
  • the processor 920 may cooperate with the memory 930 to operate.
  • the processor 920 may execute program instructions stored in the memory 930.
  • at least one of the foregoing one or more memories may be included in the processor.
  • the specific connection medium between the foregoing transceiver 910, the processor 920, and the memory 930 is not limited in the embodiment of the present application.
  • the memory 930, the processor 920, and the transceiver 910 are connected by a bus 940 in FIG. 9.
  • the bus is represented by a thick line in FIG. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.
  • the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., which can be implemented Or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as execution and completion by a hardware processor, or execution and completion by a combination of hardware and software modules in the processor, and so on.
  • the terminal device shown in FIG. 9 may also have more components than that shown in FIG. 9.
  • the terminal device shown in FIG. 9 may also include an antenna, etc. This is not limited.
  • the core device may be any device of the third NF, the fourth NF, NRF, NSSF, or DNS.
  • the aforementioned communication device may be a circuit system in a terminal device.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the processing circuit 1002 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • the interface circuit 1001 may be a communication interface, an input/output interface, and the like.
  • the interface circuit may be used to obtain the first indication information and/or the second indication information.
  • the processing circuit may be used to generate second pseudonym information based on the first user ID; generate a root key based on the second pseudonym information; generate an access layer key and/or a non-access layer key based on the root key Wait.
  • the processing circuit may also be used to generate second pseudonym information based on the first user ID; generate a root key based on the second pseudonym information; generate a user plane key based on the root key, and so on.
  • the processing circuit may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., which can be implemented Or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application. It can be understood that, for the description of the processing circuit, the circuit systems shown below are all applicable. For example, the circuit system is any one of the third NF, the fourth NF, NRF, NSSF, or DNS.
  • Figure 8 is reused.
  • Figure 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be used to perform operations performed by the first NF in the foregoing method embodiments.
  • the communication device can be used to execute the method executed by the first NF in FIG. 2 to FIG. 6d.
  • the communication device may also be used to execute the method executed by the trusted control NF in FIG. 7a.
  • the communication device includes a transceiver unit 801 and a processing unit 802.
  • the transceiver unit 801 is configured to send a first request message to the third NF, where the first request message carries the first pseudonym information of the first user identifier of the terminal device;
  • the transceiver unit 801 is further configured to receive a first response message from the third NF, where the first response message carries the second pseudonym information of the first user identifier.
  • the first response message also carries first indication information and/or second indication information.
  • the first indication information is used to instruct to generate the second pseudonym information and/or the root key.
  • the second instruction information is used to instruct to generate the user plane key.
  • the processing unit 802 is further configured to, if the first response message carries the first indication information, generate a root key according to the second pseudonym information;
  • the transceiver unit 801 is further configured to send first indication information to the terminal device.
  • the processing unit 802 is further configured to, if the first response message carries the second indication information, generate the user plane key according to the second pseudonym information;
  • the transceiver unit 801 is further configured to send second indication information to the terminal device.
  • the transceiver unit 801 is also used to send the user plane key to the user plane function.
  • the transceiver unit 801 is configured to send a third request message to the NRF, the third request message carrying a credibility level; and to receive a third response message from the NRF, the third response message carrying Identification information of the second NF; the communication device exchanges data and/or signaling with the second NF through the transceiver unit 801.
  • the processing unit 802 is configured to obtain the credible attribute of the first user ID; and determine the credibility level according to the credible attribute of the first user ID.
  • the transceiver unit 801 is further configured to send a fourth request message to the NSSF, the fourth request message carrying identification information of the first slice; and to receive a fourth response message from the NSSF, the first Fourth, the response message carries the credibility level of the first slice; or, the fourth response message carries the credibility level of the second NF set.
  • the third request message when the fourth response message carries the credibility level of the first slice, the third request message carries the credibility level of the first slice and the identification information of the first slice; or, When the fourth response message carries the credibility level of the second NF set, the third request message carries the credibility level of the second NF set and the identification information of the second NF set.
  • the transceiver unit 801 is further configured to send a registration request message to the NRF, where the registration request message carries the credibility level of the first NF.
  • the transceiver unit 801 is further configured to send a fifth request message to the DNS, the fifth request message carrying domain name information and a credibility level; and the transceiver unit 801 may also be configured to receive the first request message from the DNS. 2. Identification information of the NF. The identification information of the second NF may be carried in the fifth response message or the like.
  • the processing unit 802 may be one or more processors, and the transceiving unit 801 may be The transceiver, or the transceiver unit 801, may also be a sending unit and a receiving unit, the sending unit may be a transmitter, and the receiving unit may be a receiver, and the sending unit and the receiving unit are integrated into one device, such as a transceiver.
  • the processing unit 802 may be one or more processors, or the processing unit 802 may be a processing circuit or the like.
  • the transceiving unit 801 may be an input/output interface, also called a communication interface, or an interface circuit, or an interface, and so on.
  • the transceiver unit 801 may also be a sending unit and a receiving unit, the sending unit may be an output interface, and the receiving unit may be an input interface, and the sending unit and the receiving unit are integrated into one unit, such as an input/output interface. It can be understood that when the communication device is any one of the third NF, the fourth NF, NRF, NSSF, or DNS, for this description, all the communication devices shown below are applicable.
  • the communication device of the embodiment of the present application can perform any function performed by the first NF in the above method embodiment.
  • any function performed by the first NF in the above method embodiment please refer to the detailed description in the above method embodiment, which is only briefly summarized here. No longer.
  • the foregoing communication device may be the first NF in the foregoing method embodiments, and the first NF may be a core device.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and transceivers 910. The processor and the transceiver may be used to perform the functions or operations performed by the above-mentioned first NF.
  • the transceiver may be used to send a first request message to the third NF and receive a first response message from the third NF.
  • the processor may be used to generate the root key according to the second pseudonym information if the first response message carries the first indication information; or the processor may be used to generate the root key according to the second pseudonym information if the first response message carries the second indication information,
  • the user plane key is generated according to the second pseudonym information.
  • the transceiver may also be used to send the first indication information and/or the second indication information to the terminal device.
  • the transceiver can also be used to send the user plane key to the user plane function.
  • the transceiver may be used to send a third request message to the NRF and receive a third response message from the NRF.
  • the processor may be used to obtain the trustworthy attribute of the first user identification; and determine the trustworthiness level according to the trustworthy attribute of the first user identification.
  • the transceiver may also be used to send a fourth request message to the NSSF and receive a fourth response message sent by the NSSF.
  • the transceiver may also be used to send a registration request message to the NRF.
  • the transceiver may also be used to send a fifth request message to the DNS and receive identification information of the second NF from the DNS.
  • FIGS. 2 to 7b For specific descriptions of the first request message, the first response message, the first indication information, the second indication information, the third request message, etc., reference may be made to FIGS. 2 to 7b. Further, for the specific implementation of the processor and the transceiver, reference may be made to the methods shown in FIG. 2 to FIG. 7b, which will not be described in detail here.
  • the communication device may refer to the description of the foregoing embodiment.
  • the description of FIG. 9 when the communication device is a terminal device, which will not be described in detail here.
  • the core device when the communication device shown in FIG. 9 is a core device, the core device may also have more components than that shown in FIG. 9.
  • the core device shown in FIG. 9 may also include an antenna, etc. This is not limited.
  • the aforementioned communication device may be a circuit system in the first NF.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the processing circuit 1002 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • the interface circuit 1001 may be a communication interface, an input/output interface, and the like.
  • the interface circuit may be used to obtain the first response message, the third response message, or the fourth response message.
  • the interface circuit may be used to obtain the identification information of the second NF.
  • the interface circuit can be used to output the first request message, the first indication information, the second indication information, the user plane key, the third request message, the fourth request message, the fifth request message, or the registration request message.
  • the processing circuit can be used to generate a root key or a user plane key based on the second pseudonym information.
  • the processing circuit can also be used to obtain the credible attribute of the first user ID; and determine the credibility level according to the credible attribute of the first user ID.
  • Figure 8 is reused.
  • Figure 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be used to perform operations performed by the third NF in the foregoing method embodiments.
  • the communication device can be used to execute the method performed by the third NF in FIG. 2 to FIG. 6d.
  • the communication device may also be used to execute the method executed by the trusted data NF in FIG. 7a.
  • the communication device includes a transceiver unit 801 and a processing unit 802.
  • the transceiving unit 801 can be used to receive the first request message from the first NF; the processing unit 802 can be used to determine the trusted attribute of the first user identity; the transceiving unit 801 can also be used to send a message to the first NF Send the first response message.
  • the processing unit 802 may also be configured to obtain a first user identification according to the first pseudonym information, and generate second pseudonym information according to the first user identification.
  • processing unit 802 may also be configured to control the memory to save the correspondence between the second pseudonym information and the first user identifier.
  • the transceiver unit 801 may also be used to send a second request message to the fourth NF, and receive second pseudonym information from the fourth NF.
  • the processing unit 802 may be one or more processors, and the transceiving unit 801 may be The transceiver, or the transceiver unit 801, may also be a sending unit and a receiving unit, the sending unit may be a transmitter, and the receiving unit may be a receiver, and the sending unit and the receiving unit are integrated into one device, such as a transceiver.
  • the processing unit 802 may be one or more processors, or the processing unit 802 may be a processing circuit or the like.
  • the transceiving unit 801 may be an input/output interface, also called a communication interface, or an interface circuit, or an interface, and so on.
  • the transceiver unit 801 may also be a sending unit and a receiving unit, the sending unit may be an output interface, and the receiving unit may be an input interface, and the sending unit and the receiving unit are integrated into one unit, such as an input/output interface.
  • the foregoing communication device may be the third NF in the foregoing method embodiments, and the third NF may be a core device.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and transceivers 910. The processor and the transceiver can be used to perform the functions or operations performed by the third NF.
  • the transceiver may be used to receive the first request message from the first NF; the processor may be used to determine the trusted attribute of the first user identity; the transceiver may also be used to send the first request message to the first NF. Response message.
  • the processor may also be configured to obtain a first user identification according to the first pseudonym information, and generate second pseudonym information according to the first user identification.
  • the processor may also be used to control the memory to save the corresponding relationship between the second pseudonym information and the first user identifier.
  • the memory may directly store the correspondence between the second pseudonym information and the first user identification, etc.
  • the transceiver may also be used to send a second request message to the fourth NF, and receive second pseudonym information from the fourth NF.
  • the aforementioned communication device may be a circuit system (or a chip, an integrated circuit, etc.) in the third NF.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the processing circuit 1002 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • the interface circuit 1001 may be a communication interface, an input/output interface, and the like.
  • the interface circuit can be used to obtain the first request message; the processing circuit can be used to determine the trusted attribute of the first user identification; the interface circuit can also be used to output the first response message.
  • the processing circuit may also be used to obtain a first user identification according to the first pseudonym information, and to generate second pseudonym information according to the first user identification.
  • the processing circuit may also be used to control the memory to save the corresponding relationship between the second pseudonym information and the first user identification.
  • the interface circuit can also be used to output the second request message, obtain the second pseudonym information, and so on.
  • the communication device of the embodiment of the present application can perform any function performed by the third NF in the foregoing method embodiment.
  • any function performed by the third NF in the foregoing method embodiment please refer to the detailed description in the foregoing method embodiment, which is only briefly summarized here. No longer.
  • Figure 8 is reused.
  • Figure 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be used to perform the operations performed by the fourth NF in the foregoing method embodiments.
  • the communication device can be used to execute the method performed by the fourth NF in FIGS. 2 to 6d.
  • the communication device may also be used to execute the method executed by the trusted data NF in FIG. 7a.
  • the communication device includes a transceiver unit 801 and a processing unit 802.
  • the transceiver unit 801 is configured to receive a second request message from a third NF, where the second request message carries the first pseudonym information of the first user identifier of the terminal device;
  • the processing unit 802 is configured to obtain a first user ID according to the first pseudonym information in response to the second request message, and generate second pseudonym information according to the first user ID;
  • the transceiver unit 801 can also be used to send the second pseudonym information to the third NF.
  • the processing unit 802 may also be used to save the correspondence between the second pseudonym information and the first user identifier.
  • the foregoing communication device may be the fourth NF (such as a core device) in the foregoing method embodiments.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and a transceiver 910. The processor and the transceiver can be used to perform the functions or operations performed by the fourth NF.
  • the transceiver is used to receive a second request message from the third NF, the second request message carrying the first pseudonym information of the first user identification of the terminal device; the processor is used to respond to the second request message, according to The first pseudonym information obtains the first user identification, and the second pseudonym information is generated according to the first user identification; the transceiver can also be used to send the second pseudonym information to the third NF.
  • the processor may also be used to control the memory to save the corresponding relationship between the second pseudonym information and the first user identifier.
  • the aforementioned communication device may be a circuit system in the fourth NF.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the interface circuit may be used to obtain a second request message, the second request message carrying the first pseudonym information of the first user identification of the terminal device; the processing circuit may be used to respond to the second request message according to the first pseudonym The information obtains the first user identification, and the second pseudonym information is generated according to the first user identification; the interface circuit can also be used to output the second pseudonym information.
  • the processing circuit may also be used to control the memory to save the corresponding relationship between the second pseudonym information and the first user identification.
  • the memory may directly store the corresponding relationship between the second pseudonym information and the first user identification.
  • the communication device can be used to perform the operations performed by the NRF in the foregoing method embodiments.
  • the communication device can be used to execute the method performed by the NRF in FIGS. 2 to 6d.
  • the communication device may also be used to execute the method executed by the trusted control NF in FIG. 7a.
  • the communication device includes a transceiver unit 801 and a processing unit 802.
  • the transceiving unit 801 can be used to receive the third request message from the first NF; the processing unit 802 can be used to determine the second NF according to the credibility level; the transceiving unit 801 can also be used to send the third request message to the first NF Response message.
  • the transceiving unit 801 can also be used to receive the registration request message sent by the second NF; the processing unit 802 can also be used to store the correspondence between the identification information of the second NF and the trust level of the second NF relation.
  • the processing unit 802 is specifically configured to store the corresponding relationship between the stored identification information of the second NF and the credibility level of the second NF, and the credibility level carried in the third request message, Determine the second NF.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the first slice, and the third request message also carries the identifier of the first slice Information; the processing unit 802 is specifically configured to determine a second set of NFs corresponding to the first slice according to the identification information of the first slice; according to the correspondence between the saved identification information of the NF and the credibility level of the NF, and For the credibility level of the first slice, the second NF is determined from the second NF set.
  • the third request message carrying the credibility level includes: the third request message carries the credibility level of the second NF set; and the third request message also carries the identification information of the second NF set; processing
  • the unit 802 is specifically configured to determine the second NF from the second NF set according to the stored correspondence between the identification information of the NF and the credibility level of the NF, and the credibility level of the second NF set.
  • the transceiver unit 801 can also be used to receive a registration request message from the first NF, and the registration request message carries the credibility level of the first NF; the processing unit 802 can also be used to save the first NF. Correspondence between the identification information of the NF and the credibility level of the first NF.
  • the foregoing communication device may be the NRF in each of the foregoing method embodiments, and the NRF may be a core device.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and transceivers 910. The processor and transceiver can be used to perform the functions or operations performed by the above-mentioned NRF.
  • the transceiver can be used to receive the third request message from the first NF; the processor can be used to determine the second NF according to the credibility level; the transceiver can also be used to send the third response to the first NF information.
  • the transceiver can also be used to receive a registration request message sent by the second NF; the processor can also be used to store the correspondence between the identification information of the second NF and the trust level of the second NF.
  • the transceiver can also be used to receive a registration request message from the first NF, and the registration request message carries the credibility level of the first NF; the processor can also be used to store the identification information of the first NF and the first NF. Correspondence of the credibility level of NF.
  • the above-mentioned communication device may be a circuit system in the NRF.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the processing circuit 1002 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • the interface circuit 1001 may be a communication interface, an input/output interface, and the like.
  • the interface circuit can be used to obtain the third request message; the processing circuit can be used to determine the second NF according to the credibility level; the interface circuit can also be used to output the third response message.
  • the interface circuit can also be used to obtain registration request messages.
  • the communication device can be used to perform the operations performed by the NSSF in the foregoing method embodiments.
  • the communication device can be used to perform the method performed by the NSSF in FIGS. 2 to 6d.
  • the communication device may also be used to execute the method executed by the trusted control NF in FIG. 7a.
  • the communication device includes a transceiver unit 801 and a processing unit 802. in,
  • the transceiver unit 801 may be configured to receive a fourth request message sent by the first NF, where the fourth request message carries identification information of the first slice; and send a fourth response message to the first NF, where the fourth response message carries the first slice.
  • the credibility level of the slice; or, the fourth response message carries the identification information of the second NF set and the credibility level of the second NF set, and the second NF set is the NF set corresponding to the first slice.
  • the processing unit 802 may be configured to determine the credibility level of the first slice according to the first pre-configuration information and the identification information of the first slice.
  • the first pre-configuration information includes the first slice. Correspondence between the credibility level of a slice and the identification information of the first slice.
  • the processing unit 802 may be further configured to determine the credibility level of the second NF set according to the second pre-configuration information and the identification information of the first slice.
  • the second pre-configuration information includes the first slice. The corresponding relationship between the identification information of the second NF set and the credibility level of the second NF set.
  • the foregoing communication device may be the NSSF in the foregoing method embodiments, and the NSSF may be a core device.
  • the foregoing transceiver unit 801 may be implemented by a transceiver
  • the foregoing processing unit 802 may be implemented by a processor.
  • the communication device 90 includes one or more processors 920 and transceivers 910. The processor and transceiver can be used to perform the functions or operations performed by the above-mentioned NSSF.
  • a transceiver may be used to receive a fourth request message sent by the first NF, the fourth request message carrying identification information of the first slice; and send a fourth response message to the first NF, the fourth request message
  • the response message carries the credibility level of the first slice; or, the fourth response message carries the identification information of the second NF set and the credibility level of the second NF set, and the second NF set corresponds to the first slice NF collection.
  • the processor 802 may be configured to determine the credibility level of the first slice according to the first pre-configuration information and the identification information of the first slice, and the first pre-configuration information includes the credibility of the first slice. Correspondence between the level and the identification information of the first slice.
  • the processor 802 may be further configured to determine the credibility level of the second NF set according to the second pre-configuration information and the identification information of the first slice.
  • the second pre-configuration information includes the identification information of the second NF set. Correspondence with the credibility level of the second NF set.
  • the above-mentioned communication device may be a circuit system in the NSSF.
  • the above-mentioned processing unit 802 may be realized by a processing circuit
  • the transceiver unit 801 may be realized by an interface circuit.
  • the communication device may include a processing circuit 1002 and an interface circuit 1001.
  • the processing circuit 1002 may be a chip, a logic circuit, an integrated circuit, a processing circuit, or a system on chip (SoC) chip, etc.
  • the interface circuit 1001 may be a communication interface, an input/output interface, and the like.
  • the interface circuit may be used to obtain the fourth request message and output the fourth response message.
  • the processing circuit can be used to determine the credibility level of the first slice or the credibility level of the second NF set, and so on.
  • the communication device can also be used to perform the operations performed by the DNS in the foregoing method embodiments.
  • the transceiving unit 801 may be used to receive a fifth request message from the first NF, the fifth request message carrying domain name information and a credibility level; the processing unit 802 may be used to respond to the fifth request message, according to the domain name information and The credibility level determines the second NF; and the transceiver unit 801 may also be used to send the identification information of the second NF to the first NF.
  • the processing unit 802 may be implemented by a processor, and the transceiver unit 801 may be implemented by a transceiver.
  • the processor and the transceiver can be used to perform the functions or operations performed by the DNS.
  • the transceiver may be used to receive the fifth request message; the processor may be used to determine the second NF according to the domain name information and the credibility level; and the transceiver may also be used to send the second NF to the first NF ⁇ identification information.
  • the processing unit 802 can also be implemented with a processing circuit
  • the transceiver unit 801 can also be implemented with an interface circuit.
  • the interface circuit can be used to obtain the fifth request message
  • the processing circuit can be used to determine the second NF according to the domain name information and the credibility level
  • the interface circuit can also be used to output the identification of the second NF information.
  • the communication device in the embodiment of the present application can perform any function performed by the DNS in the above method embodiment.
  • FIG. 11 is a schematic diagram of a wireless communication system provided by an embodiment of the present application.
  • the wireless communication system may include a first NF, a third NF, NRF, and NSSF. Further, the wireless communication system may also include a fourth NF (not shown in FIG. 11), a terminal device (not shown in FIG. 11), a second NF, and so on. Further, the wireless communication system may also include DNS (not shown in FIG. 11) and the like.
  • the wireless communication system may also include DNS (not shown in FIG. 11) and the like.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the technical effects of the solutions provided by the embodiments of the present application.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the storage medium includes several instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned readable storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks, etc., which can store program codes. Medium.
  • this application also provides a computer program, which is used to implement the operations and/or processing performed by the first NF in the secure communication method provided by this application.
  • This application also provides a computer program, which is used to implement the operations and/or processing performed by the third NF in the secure communication method provided by this application.
  • the present application also provides a computer program, which is used to implement the operations and/or processing performed by the NRF in the secure communication method provided by the present application.
  • This application also provides a computer program, which is used to implement the operations and/or processing performed by the NSSF in the secure communication method provided by this application.
  • the present application also provides a computer program, which is used to implement the operations and/or processing performed by the terminal device in the secure communication method provided by the present application.
  • the present application also provides a computer program, which is used to implement the operations and/or processing performed by the fourth NF in the secure communication method provided by the present application.
  • This application also provides a computer program, which is used to implement the operations and/or processing performed by the DNS in the secure communication method provided by this application.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer executes the security communication method provided in this application by the first NF. Operation and/or processing.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer can execute the security communication method provided by this application by the third NF. Operation and/or processing.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer can execute the operations and operations performed by the NRF in the secure communication method provided in this application. /Or processing.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer can execute the operations and operations performed by the NSSF in the secure communication method provided in this application. /Or processing.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer can execute the operations performed by the terminal device in the secure communication method provided in this application. And/or processing.
  • This application also provides a computer-readable storage medium in which computer code is stored.
  • the computer code runs on a computer, the computer executes the security communication method provided in this application by the fourth NF. Operation and/or processing.
  • This application also provides a computer-readable storage medium with computer code stored therein, which when the computer code runs on a computer, causes the computer to perform the operations and operations performed by the DNS in the secure communication method provided in this application. /Or processing.
  • This application also provides a computer program product.
  • the computer program product includes computer code or computer program.
  • the operation performed by the first NF in the secure communication method provided in this application is caused And/or processing is achieved.
  • This application also provides a computer program product.
  • the computer program product includes computer code or computer program.
  • the operation performed by the third NF in the secure communication method provided in this application is caused And/or processing is achieved.
  • the computer program product includes computer code or computer program.
  • the computer code or computer program runs on a computer, the operation and/ Or processing is achieved.
  • the computer program product includes computer code or computer program.
  • the computer code or computer program runs on a computer, the operation and/ Or processing is achieved.
  • the application also provides a computer program product.
  • the computer program product includes computer code or computer program.
  • the operations performed by the terminal device in the secure communication method provided in this application are /Or processing is achieved.
  • This application also provides a computer program product.
  • the computer program product includes computer code or computer program.
  • the operation performed by the fourth NF in the secure communication method provided in this application is caused And/or processing is achieved.
  • the computer program product includes computer code or computer program.
  • the computer code or computer program runs on a computer, the operation and/ Or processing is achieved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开一种安全通信方法及装置，该方法包括：第一NF向第三NF发送第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息；响应于第一请求消息，该第三NF确定第一用户标识的可信属性；若该第一用户标识的可信属性符合预设条件，则该第三NF向第一NF发送第一响应消息，该第一响应消息携带第一用户标识的第二假名信息。该方法中第一用户标识以假名化的方式存在于不同NF之间，避免了第一用户标识被不被信任的NF篡改或截获等，提高了第一用户标识的安全性。

Description

一种安全通信方法及装置
本申请要求于2020年04月27日提交中国专利局、申请号为202010345953.7、申请名称为“一种安全通信方法及装置”的中国专利申请的优先权，本申请要求于2020年05月09日提交中国专利局、申请号为202010389032.0、申请名称“一种安全通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种安全通信方法及装置。
背景技术
在无线通信系统中，终端设备可以通过无线接入网中的接入设备与一个或多个核心设备进行通信。示例性的，终端设备与应用服务器通信时，从终端设备发出的消息，可以经过多个核心设备如第一网络功能(network function，NF)、第二NF或第三NF等，从而到达该应用服务器。
同时，各国运营商和政府机构对第五代通信系统(5th-generation，5G)的安全问题比较关注。比如网络部署中可能会存在恶意泄露用户隐私和数据的风险。
因此，如何提升网络的可信安全程度，降低风险，薄弱环节不被任何人利用，安全威胁能够被有效应对是本领域技术人员正在研究的问题。
发明内容
本申请提供一种安全通信方法及装置，能够有效提高终端设备与NF之间信息交互的安全性。
第一方面，本申请提供一种安全通信方法，该方法包括：第一网络功能(network function，NF)向第三NF发送第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息；响应于该第一请求消息，第三NF确定第一用户标识的可信属性；若该第一用户标识的可信属性符合预设条件，则第三NF向第一NF发送第一响应消息，该第一响应消息携带第一用户标识的第二假名信息。
以上所示的第一用户标识的可信属性符合预设条件，也可以理解为终端设备的可信属性符合预设条件。本申请实施例中，若第一用户标识的可信属性符合预设条件，则该第一用户标识可以以假名化的方式存在于不同NF之间，避免了该第一用户标识被不被信任或不安全的NF篡改或截获等，有效保护了该第一用户标识，提高了该第一用户标识的安全性。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF的可信级别匹配预设级别，则该第三NF向第一NF发送第一响应消息。
本申请实施例中，预设级别用于衡量不同NF的可信级别。例如，可信级别包括强可信级别、弱可信级别和不可信级别，则该预设级别可以为弱可信级别或不可信等。又例如，可信级别包括高可信级别、低可信级别和不可信级别，则该预设级别可以为低可信级别或不可信等。也就是说，第一NF的可信级别较低时，为保护第一用户标识，第三NF可以向 第一NF发送该第一用户标识的假名信息(即第二假名信息)。
在一种可能的实现方式中，所述方法还包括：若第一NF的可信级别不匹配预设级别，则该第三NF向第一NF发送携带第一用户标识的响应消息。
也就是说，第一NF的可信级别较高时，则第三NF可以信任该第一NF，由此可以向该第一NF发送真实的用户标识如第一用户标识。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF所在的安全域的可信级别匹配预设级别，则第三NF向第一NF发送第一响应消息。
本申请实施例中，不同NF之间可以区分可信级别，同时可以区分不同安全域的可信级别。示例性的，本申请提供的方法中可以区分第一安全域、第二安全域等，该第一安全域的可信级别与第二安全域的可信级别不同。如果第一NF位于第一安全域，且该第一安全域的可信级别较弱，则该第三NF可以向第一NF发送第一用户标识的第二假名信息。或者，若第一安全域的可信级别较强(如不匹配预设级别)，则第三NF可以向第一NF发送真实的用户标识如第一用户标识。
在一种可能的实现方式中，第三NF确定第一用户标识的可信属性包括：第三NF根据第一用户标识的签约等级确定该第一用户标识的可信属性；或者，第三NF根据第一用户标识的会话属性确定该第一用户标识的可信属性；或者，第三NF根据第一用户标识的行业要求确定该第一用户标识的可信属性。
以上所示的第一用户标识的签约等级、会话属性或行业要求等，也可以理解为终端设备的签约等级、会话属性或行业要求等。第一用户标识的可信属性可以用于指示该第一用户标识是否需要被假名化处理。或者，该第一用户标识的可信属性可以用于指示该第一用户标识是否需要被保护等。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，该方法还包括：第三NF根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。
本申请实施例中，第三NF可以根据第一用户标识和第一假名信息的对应关系，以及第一假名信息得到该第一用户标识。也就是说，该第三NF中保存有第一用户标识和第一假名信息的对应关系。该对应关系也可以理解为映射关系等，本申请实施例对此不作限定。
在一种可能的实现方式中，该方法还包括：第三NF保存第二假名信息和第一用户标识的对应关系。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，该方法还包括：第三NF向第四NF发送第二请求消息，该第二请求消息携带第一假名信息；响应于第二请求消息，第四NF根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息；第四NF向第三NF发送第二假名信息，第三NF接收该第二假名信息。
本申请实施例中，第四NF中也可以保存有第一用户标识和第一假名信息的对应关系。从而第三NF确定了第一用户标识的可信属性符合预设条件之后，该第三NF向第四NF请求第二假名信息。
可选的，以上所示方法中描述的是第三NF确定第一用户标识的可信属性。可选的，第四NF中也可以保存第一用户标识的签约等级等。换句话说，第一NF还可以向第四NF 发送第一请求消息，该第四NF确定第一用户标识的可信属性以及在该第一用户标识的可信属性符合预设条件时，第四NF向第一NF发送第一响应消息。
可理解，对于第三NF或第四NF如何生成第二假名信息，本申请实施例不作限定。
第二方面，本申请提供一种安全通信方法，该方法包括：第一NF向第三NF发送第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息；该第一NF接收来自第三NF的第一响应消息，该第一响应消息携带第一用户标识的第二假名信息。
结合第一方面或第二方面，在一种可能的实现方式中，第一NF接收到第一响应消息之后，便可以根据该第一响应消息中携带的第二假名信息生成根密钥(Kamf)。
结合第一方面或第二方面，在一种可能的实现方式中，第一响应消息中还可以携带根密钥。该情况下，终端设备可以根据第一用户标识生成该根密钥。保证对终端设备没有影响，由此，第三NF(或第四NF)根据第一用户标识生成第二假名信息的密钥推演算法1(如KDF1)，以及根据该第二假名信息生成根密钥的密钥推演算法2(如KDF2)需要满足如下条件：第三NF(或第四NF)生成的根密钥与终端设备生成的根密钥相同。
结合第一方面或第二方面，在一种可能的实现方式中，第一响应消息中还可以携带第三指示信息，该第三指示信息用于指示第一NF根据第二假名信息生成根密钥。该情况下，终端设备根据第一用户标识生成的根密钥也需要与第一NF根据第二假名信息生成的根密钥相同。
可理解，以上所示的方法中，终端设备仍可以根据第一用户标识生成根密钥。本申请实施例还提供了一种方法，如终端设备根据第二假名信息生成根密钥。如下所示：
结合第一方面或第二方面，在一种可能的实现方式中，第一响应消息中还携带第一指示信息和/或第二指示信息，该第一指示信息用于指示生成第二假名信息和/或根密钥，该第二指示信息用于指示生成用户面密钥。
结合第一方面或第二方面，在一种可能的实现方式中，该方法还包括：若第一响应消息中携带第一指示信息，则第一NF根据第二假名信息生成根密钥；以及该第一NF向终端设备发送第一指示信息。
其中，该第一指示信息可以用于指示终端设备生成第二假名信息。或者，该第一指示信息可以用于指示终端设备根据第二假名信息生成根密钥。
结合第一方面或第二方面，在一种可能的实现方式中，该方法还包括：若第一响应消息中携带第二指示信息，则第一NF根据第二假名信息生成用户面密钥；以及该第一NF向终端设备发送第二指示信息。
其中，该第二指示信息可以用于指示终端设备生成用户面密钥。
结合第一方面或第二方面，在一种可能的实现方式中，该方法还包括：第一NF向用户面功能发送用户面密钥。
接收到该用户面密钥之后，用户面功能可以根据该用户面密钥与终端设备进行交互。该用户面密钥根据第二假名信息得到，由此不仅保护了第一用户标识，而且还根据该用户面密钥保护了终端设备与用户面功能之间的数据，提高了信息交互的安全性。
第三方面，本申请提供一种安全通信方法，该方法包括：第三NF接收来自第一NF的第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息；响应于该 第一请求消息，第三NF确定第一用户标识的可信属性；若第一用户标识的可信属性符合预设条件，则第三NF向第一NF发送第一响应消息，该第一响应消息携带第一用户标识的第二假名信息。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF的可信级别匹配预设级别，则该第三NF向第一NF发送第一响应消息。
在一种可能的实现方式中，所述方法还包括：若第一NF的可信级别不匹配预设级别，则该第三NF向第一NF发送携带第一用户标识的响应消息。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF所在的安全域的可信级别匹配预设级别，则第三NF向第一NF发送第一响应消息。
在一种可能的实现方式中，第三NF确定第一用户标识的可信属性包括：第三NF根据第一用户标识的签约等级确定该第一用户标识的可信属性；或者，第三NF根据第一用户标识的会话属性确定该第一用户标识的可信属性；或者，第三NF根据第一用户标识的行业要求确定该第一用户标识的可信属性。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，该方法还包括：第三NF根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。
在一种可能的实现方式中，该方法还包括：第三NF保存第二假名信息和第一用户标识的对应关系。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，该方法还包括：第三NF向第四NF发送第二请求消息，该第二请求消息携带第一假名信息；第三NF接收来自第四NF的第二假名信息。
可理解，以上所示的第三NF所执行的方法，也可以由第四NF执行。例如，第四NF可以接收终端设备的第一用户标识的第一假名信息；然后确定该第一用户标识的可信属性；若该第一用户标识的可信属性符合预设条件，则该第四NF可以发送第二假名信息。示例性的，该第四NF可以直接接收来自第一NF的第一请求消息等；或者，该第四NF也可以接收来自第三NF的请求消息等。又例如，该第四NF还可以生成第二假名信息，以及保存第二假名信息和第一用户标识的对应关系等。
第四方面，本申请提供一种安全通信方法，该方法包括：第四NF接收来自第三NF的第二请求消息，该第二请求消息携带终端设备的第一用户标识的第一假名信息；响应于第二请求消息，该第四NF根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息；该第四NF向第三NF发送第二假名信息。
在一种可能的实现方式中，该第四NF保存第二假名信息和第一用户标识的对应关系。
第五方面，本申请提供一种安全通信方法，该方法包括：终端设备接收第一NF发送的第一指示信息，该第一指示信息用于指示终端设备生成第二假名信息和/或根密钥；终端设备根据第一用户标识生成第二假名信息；终端设备根据该第二假名信息生成根密钥；终端设备根据该根密钥生成接入层密钥和/或非接入层密钥，该接入层密钥用于对终端设备与接入设备之间的数据和/或信令进行保护，该非接入层密钥用于对终端设备与第一NF之间的数据和/或信令进行保护。
第六方面，本申请提供一种安全通信方法，该方法包括：终端设备接收第一NF发送的第二指示信息，该第二指示信息用于指示终端设备生成用户面密钥；终端设备根据第一用户标识生成第二假名信息；终端设备根据第二假名信息生成根密钥；终端设备根据根密钥生成用户面密钥，该用户面密钥用于对终端设备与用户面功能之间的数据进行保护。
第七方面，本申请提供一种安全通信方法，该方法包括：第一网络功能(network function，NF)向网络存储功能(network function repository function，NRF)发送第三请求消息，该第三请求消息携带可信级别；响应于第三请求消息，NRF根据可信级别确定第二NF；NRF向第一NF发送该第二NF的标识信息。
其中，NRF可以根据保存的NF的标识信息和NF的可信级别的对应关系确定该第二NF。例如，NRF中可以保存一个或多个NF的标识信息和该一个或多个NF的可信级别的对应关系。本申请实施例中，NRF根据可信级别确定第二NF，可使得第一NF接收到该第二NF的标识信息。从而第一NF可以与可信级别相对应的NF(即第二NF)进行交互，一方面，可满足终端设备对应的用户标识对可信级别的要求，另一方面，第一NF与可信级别高的NF(如第二NF)进行数据和/或信令交互，提高了第一NF和第二NF交互的安全性。
在一种可能的实现方式中，NRF根据可信级别确定第二NF之前，该方法还包括：NRF接收第二NF发送的注册请求消息，该注册请求消息携带第二NF的可信级别；NRF保存该第二NF的标识信息和该第二NF的可信级别的对应关系。
换句话说，NRF可以接收一个或多个NF发送的注册请求消息，该注册请求消息携带NF的可信级别，以及该NRF可以保存该一个或多个NF的标识信息和该一个或多个NF的可信级别的对应关系，该一个或多个NF中包括第二NF。
在一种可能的实现方式中，NRF根据可信级别确定第二NF包括：NRF根据保存的第二NF的标识信息和该第二NF的可信级别的对应关系，以及第三请求消息中携带的可信级别，确定该第二NF。
NRF中保存有一个或多个NF的标识信息和该一个或多个NF的可信级别的对应关系，由此，该NRF可以根据保存的上述对应关系，以及第三消息中携带的可信级别，确定第二NF。换句话说，NRF可以从保存的上述对应关系中得到与可信级别(即第三消息中携带的可信级别)对应的第二NF。
可选的，NRF根据可信级别确定第二NF之前，该方法还包括：NRF预配置一个或多个NF的可信级别；保存该一个或多个NF的标识信息和可信级别的对应关系。也就是说，该NRF还可以根据预配置信息以及可信级别(即第三消息中携带的可信级别)确定第二NF，该预配置信息中包括一个或多个NF的标识信息和该一个或多个NF的可信级别的对应关系。
在一种可能的实现方式中，第一NF向NRF发送第三请求消息之前，该方法还包括：第一NF从第三NF获取第一用户标识的可信属性；根据该第一用户标识的可信属性确定可信级别。
也就是说，第三请求消息中携带的可信级别可以根据第一用户标识的可信属性确定。例如，该第一用户标识的可信属性符合预设条件，则该可信级别越高。对于该第一用户标 识的可信属性的相关描述，可参考第一方面所示的方法，这里不再详述。
在一种可能的实现方式中，第一NF向NRF发送第三请求消息之前，该方法还包括：第一NF向NSSF发送第四请求消息，该第四请求消息携带第一切片的标识信息，NSSF向第一NF发送第四响应消息，该第四响应消息携带第一切片的可信级别。
该第一切片的标识信息可以来自于终端设备，也就是说，终端设备向第一NF发送相关请求消息时，该相关请求消息中可以携带第一切片的标识信息。
在一种可能的实现方式中，NSSF向第一NF发送第四响应消息之前，该方法还包括：NSSF根据第一预配置信息和第一切片的标识信息，确定该第一切片的可信级别，该第一预配置信息中包括第一切片的可信级别和该第一切片的标识信息的对应关系。
其中，第一预配置信息可以由运营商配置，或者，由其他NF配置等，本申请对此不作限定。该第一预配置信息中可以保存切片的标识信息和该切片的可信级别。例如，该第一预配置信息中可以保存一个或多个切片的标识信息和可信级别的对应关系。
在一种可能的实现方式中，第三请求消息携带可信级别包括：该第三请求消息携带第一切片的可信级别，以及该第三请求消息中还携带该第一切片的标识信息；NRF根据可信级别确定第二NF包括：该NRF根据第一切片的标识信息确定与该第一切片对应的第二NF集合；根据保存的NF的标识信息和该NF的可信级别的对应关系，以及该第一切片的可信级别，从第二NF集合中确定第二NF。
换句话说，NRF可以根据保存的一个或多个NF的标识信息和可信级别的对应关系，从第二NF集合中确定与第一切片的可信级别对应的第二NF。
在一种可能的实现方式中，第一NF向NRF发送第三请求消息之前，该方法还包括：第一NF向NSSF发送第四请求消息，该第四请求消息携带第一切片的标识信息；NSSF向第一NF发送第四响应消息，该第四响应消息中携带第二NF集合的标识信息和该第二NF集合的可信级别，该第二NF集合为与第一切片对应的NF集合。
在一种可能的实现方式中，NSSF向第一NF发送第四响应消息之前，该方法还包括：NSSF根据第二预配置信息和第一切片的标识信息，确定第二NF集合的可信级别，该第二预配置信息中包括第二NF集合的标识信息和第二NF集合的可信级别的对应关系。
该第二预配置信息中还可以包括第一切片的标识信息和第二NF集合的标识信息的对应关系。换句话说，NSSF可以从上述对应关系中确定与第一切片对应的第二NF集合，然后从上述对应关系确定与第二NF集合对应的可信级别。该第二预配置信息中可以保存有一个或多个切片和NF集合的对应关系，以及一个或多个NF集合和可信级别的对应关系。
在一种可能的实现方式中，第三请求消息携带可信级别包括：第三请求消息携带第二NF集合的可信级别；以及该第三请求消息还携带第二NF集合的标识信息；NRF根据可信级别确定第二NF包括：NRF根据保存的NF的标识信息和NF的可信级别的对应关系，以及第二NF集合的可信级别，从该第二NF集合中确定第二NF。
上述NRF根据可信级别确定第二NF包括：NRF根据保存的NF的标识信息和NF的可信级别的对应关系，NF的标识信息和NF所在集合的标识信息的对应关系，以及第二NF集合的可信级别、第二NF集合的标识信息，从该第二NF集合中确定第二NF。
换句话说，NRF可以根据保存的NF的标识信息和NF所在集合的标识信息的对应关 系，以及第二NF集合的标识信息得到该第二NF集合对应的一个或多个NF。以及根据保存的NF的标识信息和NF的可信级别的对应关系，得到上述一个或多个NF的可信级别。以及根据第二NF集合的可信级别和上述一个或多个NF对应的可信级别从该一个或多个NF中确定第二NF。
本申请实施例对于第二NF集合中包括的NF个数不作限定，例如，该第二NF集合中可以包括一个NF；或者，该第二NF集合中还可以包括多个NF。该第二NF集合中包括第二NF。可选的，第二NF的可信级别等于或高于第三请求消息中携带的可信级别。
第八方面，本申请提供一种安全通信方法，该方法包括：第一NF向NRF发送第三请求消息，该第三请求消息携带可信级别；该第一NF接收来自该NRF的第三响应消息，该第三响应消息携带第二NF的标识信息；该第一NF与该第二NF进行数据和/或信令交互。
在一种可能的实现方式中，第一NF向NRF发送第三请求消息之前，该方法还包括：第一NF从第三NF获取第一用户标识的可信属性；根据该第一用户标识的可信属性确定可信级别。
在一种可能的实现方式中，第一NF向NRF发送第三请求消息之前，该方法还包括：第一NF向NSSF发送第四请求消息，该第四请求消息携带第一切片的标识信息；该第一NF接收来自NSSF的第四响应消息，该第四响应消息携带该第一切片的可信级别；或者，该第四响应消息携带第二NF集合的可信级别。
在一种可能的实现方式中，第四响应消息携带该第一切片的可信级别时，第三请求消息携带第一切片的可信级别和该第一切片的标识信息；或者，第四响应消息携带第二NF集合的可信级别时，该第三请求消息携带第二NF集合的可信级别和该第二NF集合的标识信息。
在一种可能的实现方式中，该方法还包括：第一NF向NRF发送注册请求消息，该注册请求消息携带第一NF的可信级别。
可选的，注册请求消息还可以携带第一NF所在的NF集合的标识信息。
第九方面，本申请提供一种安全通信方法，该方法包括：NRF接收来自第一NF的第三请求消息，该第三请求消息携带可信级别；响应于该第三请求消息，NRF根据可信级别确定第二NF；该NRF向第一NF发送第三响应消息，该第三响应消息携带第二NF的标识信息。
在一种可能的实现方式中，NRF根据可信级别确定第二NF之前，该方法还包括：NRF接收第二NF发送的注册请求消息，该注册请求消息携带第二NF的可信级别；NRF保存该第二NF的标识信息和该第二NF的可信级别的对应关系。
可选的，该注册请求消息还可以携带第二NF所在的NF集合的标识信息。
在一种可能的实现方式中，NRF根据可信级别确定第二NF包括：NRF根据保存的第二NF的标识信息和该第二NF的可信级别的对应关系，以及第三请求消息中携带的可信级别，确定该第二NF。
在一种可能的实现方式中，第三请求消息携带可信级别包括：该第三请求消息携带第一切片的可信级别，以及该第三请求消息中还携带该第一切片的标识信息；NRF根据可信级别确定第二NF包括：该NRF根据第一切片的标识信息确定与该第一切片对应的第二NF 集合；根据保存的NF的标识信息和该NF的可信级别的对应关系，以及该第一切片的可信级别，从第二NF集合中确定第二NF。
在一种可能的实现方式中，第三请求消息携带可信级别包括：第三请求消息携带第二NF集合的可信级别；以及该第三请求消息还携带第二NF集合的标识信息；NRF根据可信级别确定第二NF包括：NRF根据保存的NF的标识信息和NF的可信级别的对应关系，以及第二NF集合的可信级别，从该第二NF集合中确定第二NF。
上述NRF根据可信级别确定第二NF包括：NRF根据保存的NF的标识信息和NF的可信级别的对应关系，NF的标识信息和NF所在集合的标识信息的对应关系，以及第二NF集合的可信级别、第二NF集合的标识信息，从该第二NF集合中确定第二NF。
在一种可能的实现方式中，该方法还包括：NRF接收来自第一NF的注册请求消息，该注册请求消息携带第一NF的可信级别；NRF保存该第一NF的标识信息和该第一NF的可信级别的对应关系。
可选的，该注册请求消息还可以携带第一NF所在的NF集合的标识信息。
第十方面，本申请提供一种安全通信方法，该方法包括：NSSF接收第一NF发送的第四请求消息，该第四请求消息携带第一切片的标识信息；NSSF向第一NF发送第四响应消息，该第四响应消息携带第一切片的可信级别；或者，该第四响应消息携带第二NF集合的标识信息和该第二NF集合的可信级别，该第二NF集合为与第一切片对应的NF集合。
在一种可能的实现方式中，NSSF向第一NF发送第四响应消息之前，该方法还包括：NSSF根据第一预配置信息和第一切片的标识信息，确定该第一切片的可信级别，该第一预配置信息中包括第一切片的可信级别和该第一切片的标识信息的对应关系。
在一种可能的实现方式中，NSSF向第一NF发送第四响应消息之前，该方法还包括：NSSF根据第二预配置信息和第一切片的标识信息，确定第二NF集合的可信级别，该第二预配置信息中包括第二NF集合的标识信息和第二NF集合的可信级别的对应关系。
可理解，第一方面至第十方面中，第一NF可以包括AMF或SMF等。
第十一方面，本申请提供一种安全通信方法，该方法包括：域名系统(domain name system，DNS)接收来自第一网络功能(network function，NF)的第五请求消息，该第五请求消息携带域名信息和可信级别；响应于第五请求消息，DNS根据该域名信息和可信级别确定第二NF；DNS向第一NF发送该第二NF的标识信息。
本申请实施例中，DNS可以根据保存的域名信息和标识信息的对应关系，以及标识信息和可信级别的对应关系(或域名信息和可信级别的对应关系等)确定该第二NF。例如，DNS中可以配置一个或多个NF的域名信息(或标识信息)和该一个或多个NF的可信级别的对应关系。DNS根据可信级别确定第二NF，可使得第一NF接收该第二NF的标识信息，该第二NF的标识信息可以包括该第二NF的IP地址等。从而第一NF可以与可信级别相对应的NF(即第二NF)进行交互，一方面，可满足终端设备对应的用户标识对可信级别的要求，另一方面，第一NF与可信级别高的NF(如第二NF)进行数据和/或信令交互，提高了第一NF和第二NF交互的安全性。
第十二方面，本申请提供一种通信装置，在一种可能的实现方式中，该通信装置包括具有执行第二方面或第二方面的任意可能的实现方式中的方法的相应单元。在另一种可能 的实现方式中，该通信装置包括具有执行第三方面或第三方面的任意可能的实现方式中的方法的相应单元。在又一种可能的实现方式中，该通信装置包括具有执行第四方面或第四方面的任意可能的实现方式中的方法的相应单元。在又一种可能的实现方式中，该通信装置包括具有执行第八方面或第八方面的任意可能的实现方式中的方法的相应单元。在又一种可能的实现方式中，该通信装置包括具有执行第九方面或第九方面的任意可能的实现方式中的方法的相应单元。在又一种可能的实现方式中，该通信装置包括具有执行第十方面或第十方面的任意可能的实现方式中的方法的相应单元。在又一种可能的实现方式中，该通信装置包括具有执行第十一方面所示的方法的相应单元。
例如，上述通信装置包括收发单元和处理单元。
第十三方面，本申请提供一种通信装置，该通信装置包括处理器，用于执行存储器中存储的程序；在一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第二方面或第二方面的任意可能的实现方式所示的方法。在另一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第三方面或第三方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第四方面或第四方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第八方面或第八方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第九方面或第九方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第十方面或第十方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，当该程序被执行时，使得该通信装置执行如上述第十一方面所示的方法。
在一种可能的实现方式中，存储器位于上述通信装置之外。
在一种可能的实现方式中，存储器位于上述网络设备之内。
在一种可能的实现方式中，网络设备还包括收发器，该收发器，用于接收信号或发送信号。对于收发器和处理器的具体实现方式，这里先不详述。
第十四方面，本申请提供一种通信装置，该通信装置包括处理电路和接口电路，接口电路，用于接收计算机代码并传输至处理器；处理器运行计算机代码以执行上述示出的由NF执行的方法。对于接口电路和处理电路的具体实现方式，这里先不详述。
第十五方面，本申请提供一种通信装置，该通信装置包括具有执行第五方面或第五方面的任意可能的实现方式中的方法的相应单元。或者，该通信装置包括具有执行第六方面或第六方面的任意可能的实现方式中的方法的相应单元。
例如，该通信装置包括收发单元和处理单元。
第十六方面，本申请提供一种通信装置，该通信装置包括处理器，用于执行存储器中存储的程序，当该程序被执行时，使得该通信装置执行如上述第五方面或第五方面的任意可能的实现方式所示的方法；或者，当该程序被执行时，使得该通信装置执行如上述第六方面或第六方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，存储器位于上述通信装置之外。
第十七方面，本申请提供一种通信装置，该通信装置包括处理器、存储器以及存储在 存储器上并可在处理器上运行的程序，当该程序被运行时，使得该通信装置执行如上述第五方面或第五方面的任意可能的实现方式中所示的方法；或者，当该程序被运行时，使得该通信装置执行如上述第六方面或第六方面的任意可能的实现方式中所示的方法。
第十八方面，本申请提供一种通信装置，该通信装置包括处理器、存储器和收发器，收发器，用于接收信号或者发送信号；存储器，用于存储计算机代码；处理器，用于执行计算机代码，使通信装置执行上述第五方面或第五方面的任意可能的实现方式所示的方法；或者，处理器，用于执行计算机代码，使通信装置执行上述第六方面或第六方面的任意可能的实现方式所示的方法。
第十九方面，本申请提供一种通信装置，该通信装置包括处理电路和接口电路，该接口电路，用于获取第一指示信息，该第一指示信息用于指示通信装置生成第二假名信息；该处理电路，用于根据第一用户标识生成第二假名信息，以及根据该第二假名信息生成根密钥，以及根据该根密钥生成接入层密钥和/或非接入层密钥，该接入层密钥用于对通信装置与接入设备之间的数据和/或信令进行保护，该非接入层密钥用于对通信装置与第一NF之间的数据和/或信令进行保护。
或者，接口电路用于获取第二指示信息，该第二指示信息用于指示通信装置生成用户面密钥；处理电路，用于根据第一用户标识生成第二假名信息，以及根据第二假名信息生成根密钥，以及根据根密钥生成用户面密钥，该用户面密钥用于对通信装置与用户面功能之间的数据进行保护。
第二十方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质用于存储计算机程序，在一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第二方面或第二方面的任意可能的实现方式所示的方法被执行。在另一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第三方面或第三方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第四方面或第四方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第五方面或第五方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第六方面或第六方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第八方面或第八方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第九方面或第九方面的任意可能的实现方式所示的方法被执行。在又一种可能的实现方式中，当计算机程序在计算机上运行时，使得上述第十方面或第十方面的任意可能的实现方式所示的方法被执行。
第二十一方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或计算机代码，当其在计算机上运行时，使得上述各个方面或各个方面的任意可能的实现方式所示的方法被执行。
第二十二方面，本申请提供一种计算机程序，该计算机程序在计算机上运行时，上述各个方面或各个方面的任意可能的实现方式所示的方法被执行。
第二十三方面，本申请提供一种通信装置，在一种可能的实现方式中，用于执行如第 二方面或第二方面的任意可能的实现方式所示的方法。在另一种可能的实现方式中，用于执行如第三方面或第三方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第四方面或第四方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第四方面或第四方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第五方面或第五方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第六方面或第六方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第七方面或第七方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第八方面或第八方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第九方面或第九方面的任意可能的实现方式所示的方法。在又一种可能的实现方式中，用于执行如第十方面或第十方面的任意可能的实现方式所示的方法。
第二十四方面，本申请提供一种无线通信系统，该无线通信系统包括第一NF和第三NF，该第一NF用于执行上述第二方面或第二方面的任意可能的实现方式所示的方法，该第三NF用于执行上述第三方面或第三方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，该无线通信系统还包括第四NF，该第四NF用于执行上述第四方面或第四方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，该第一NF还可以用于执行上述第八方面或第八方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，该无线通信系统还包括NRF，该NRF用于执行上述第九方面或第九方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，该无线通信系统还包括NSSF，该NSSF用于执行上述第十方面或第十方面的任意可能的实现方式所示的方法。
在一种可能的实现方式中，该无线通信系统还包括终端设备，该终端设备用于执行第五方面或第五方面的任意可能的实现方式所示的方法；或者，该终端设备还可以用于执行第六方面或第六方面的任意可能的实现方式所示的方法。
附图说明
图1是本申请实施例提供的一种网络架构的示意图；
图2是本申请实施例提供的一种安全通信方法的流程示意图；
图3a是本申请实施例提供的一种安全通信方法的流程示意图；
图3b是本申请实施例提供的一种安全通信方法的流程示意图；
图4是本申请实施例提供的一种安全通信方法的场景示意图；
图5是本申请实施例提供的一种安全通信方法的流程示意图；
图6a是本申请实施例提供的一种安全通信方法的流程示意图；
图6b是本申请实施例提供的一种安全通信方法的流程示意图；
图6c是本申请实施例提供的一种安全通信方法的流程示意图；
图6d是本申请实施例提供的一种安全通信方法的流程示意图；
图7a是本申请实施例提供的一种安全通信的网络架构示意图；
图7b是本申请实施例提供的一种安全通信的网络架构示意图；
图8是本申请实施例提供的一种通信装置的结构示意图；
图9是本申请实施例提供的一种通信装置的结构示意图；
图10是本申请实施例提供的一种通信装置的结构示意图；
图11是本申请实施例提供的一种无线通信系统的示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。
本申请的说明书、权利要求书及附图中的术语“第一”和“第二”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上，“至少两个(项)”是指两个或三个及三个以上，“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，“a和b”，“a和c”，“b和c”，或“a和b和c”。
下面首先对本申请应用的通信系统进行介绍：
本申请提供的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)通信系统或新无线(new radio，NR)以及未来的其他通信系统如6G等。
示例性的，以本申请应用于5G通信系统为例，以下对5G系统中的网络功能进行示例性介绍：
请参见图1，图1示出的网络架构是以第三代合作伙伴项目(3rd generation partnership project，3GPP)标准化过程中定义的基于服务化架构的5G网络架构为例。如图1所示，该网络架构至少可以包括三部分，分别是终端设备部分、运营商网络部分和数据网络(data network，DN)部分等。
其中，终端设备部分可以包括终端设备110，该终端设备110也可以称为用户设备(user equipment，UE)。本申请中的终端设备110是一种具有无线收发功能的设备，可以经无线接入网(radioaccess network，RAN)140中的接入网设备(或者也可以称为接入设备)与一个或多个核心网(core network，CN)设备(或者也可以称为核心设备)进行通信。终端设备110也可称为接入终端、终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、用户代理或用户装置等。在一种可能的实现方式中，终端设备110可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。在一种可能的实现方式中，终端设备110可以是具有无线通信功能的手持设备、车载设备、可穿戴设备或物联网、车联网中的终端、5G网络以及未来网络中的任意形态的终端等，本申请对此并不限定。
其中，各种通信系统中由运营者运营的部分可称为运营商网络或PLMN网络等。该运营商网络主要是移动网络运营商(mobile network operator，MNO)为用户提供移动宽带接入服务的公共网络。示例性的，本申请中的运营商网络或PLMN网络，还可以为符合3GPP标准要求的网络，简称3GPP网络。通常的，3GPP网络可以由运营商运营，包括但不限于第五代移动通信(5th-generation，5G)网络(简称5G网络)、第四代移动通信(4th-generation，4G)网络(简称4G网络)等。
如图1所示，该运营商网络可以包括：网络开放功能(network exposure function，NEF)131、网络存储功能(network function repository function，NRF)132、策略控制功能(policy control function，PCF)133、统一数据管理(unified data management，UDM)134、应用功能(application function，AF)135、认证服务器功能(authentication server function，AUSF)136、接入与移动性管理功能(access and mobility management function，AMF)137、会话管理功能(session management function，SMF)138、用户面功能(user plane function，UPF)139以及(无线)接入网((radio)access network，(R)AN)140等。上述运营商网络中，除(无线)接入网140部分之外的部分可以称为核心网络(core network，CN)部分或核心网部分。
数据网络DN 120，也可以称为分组数据网络(packet data network，PDN)，通常是位于运营商网络之外的网络，例如第三方网络。示例性的，运营商网络可以接入多个数据网络DN 120，数据网络DN 120上可部署多种业务，从而为终端设备110提供数据和/或语音等服务。上述第三方网络的具体表现形式，具体可根据实际应用场景确定，本申请对此不作限定。
示例性的，下面对运营商网络中的网络功能进行简要介绍。
(R)AN140是运营商网络的子网络，是运营商网络中业务节点与终端设备110之间的实施系统。终端设备110要接入运营商网络，首先是经过(R)AN140，进而通过(R)AN140与运营商网络中的网络功能连接。本申请实施例中的接入网设备是一种为终端设备110提供无线通信功能的设备，也可以称为接入设备或(R)AN设备等，(R)AN设备包括但不限于：5G系统中的下一代基站(next generation node basestation，gNB)、LTE系统中的演进型基站(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver  station，BTS)、家庭基站(home evolved nodeB，或home node B，HNB)、基带单元(base band unit，BBU)、传输接收点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、小基站设备(pico)、移动交换中心，或者未来网络中的网络设备等。可理解，本申请对接入网设备的具体类型不作限定。采用不同无线接入技术的系统中，具备接入网设备功能的设备的名称可能会有所不同。为便于描述，下文中将以接入设备为例说明该(R)AN140。
可选的，在接入设备的一些部署中，接入设备可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)等。在接入设备的另一些部署中，CU还可以划分为CU-控制面(control plane，CP)和CU-用户面(user plan，UP)等。在接入设备的又一些部署中，接入设备还可以是开放的无线接入网(openradioaccessnetwork，ORAN)架构等，本申请对于接入设备的具体部署方式不作限定。
网络开放功能NEF(也可以称为NEF网络功能或NEF网络功能实体)131是由运营商提供控制面功能。NEF网络功能131以安全的方式对第三方开放运营商网络的对外接口。在SMF网络功能138需要与第三方的网络功能通信时，NEF网络功能131可作为SMF网络功能138与第三方的网络实体通信的中继。NEF网络功能131作为中继时，可作为签约用户的标识信息的翻译，以及第三方的网络功能的标识信息的翻译。比如，NEF网络功能131将签约用户的SUPI从运营商网络发送到第三方时，可以将SUPI翻译成其对应的外部身份标识(identity，ID)。反之，NEF网络功能131将外部ID(第三方的网络实体ID)发送到运营商网络时，可将其翻译成SUPI。
网络存储功能NRF132，可用于维护网络中所有网络功能服务的实时信息。
本申请实施例中，网络存储功能NRF 132中可以保存一个或多个NF的标识信息和可信级别。例如，该NRF中可以保存第二网络功能(network function，NF)的标识信息和该第二NF的可信级别。
策略控制功能PCF133是由运营商提供的控制面功能，用于向会话管理功能SMF138提供PDU会话的策略。策略可以包括计费相关策略、QoS相关策略和授权相关策略等。
统一数据管理UDM134是由运营商提供的控制面功能，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、安全上下文(security context)、签约数据等信息。上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的终端设备芯卡的用户，或者使用中国移动的终端设备芯卡的用户等。示例性的，签约用户的SUPI可为终端设备芯卡的号码等。上述安全上下文可以为存储在本地终端设备(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可以为该终端设备芯卡的配套业务，例如该手机芯卡的流量套餐等。
本申请实施例中，签约用户的签约数据中还可以包括该签约用户的签约等级。例如，该签约用户为普通用户或重要用户(very important person，VIP)。本申请实施例中，统一数据管理UDM 134中不仅可以保存签约用户的签约数据，还可以根据该签约用户的签约等级确定该签约用户的可信属性。
应用功能(application function，AF)135，用于进行应用影响的数据路由，接入网络开放功能，与策略框架交互进行策略控制等。
认证服务器功能AUSF136是由运营商提供的控制面功能，通常用于一级认证，即终端设备110(签约用户)与运营商网络之间的认证。
接入与移动性管理功能AMF137是由运营商网络提供的控制面网络功能，负责终端设备110接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
会话管理功能SMF138是由运营商网络提供的控制面网络功能，负责管理终端设备110的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与DN 120互相传输PDU。PDU会话可以由SMF138负责建立、维护和删除等。SMF138包括会话管理(如会话建立、修改和释放，包含UPF 139和(R)AN140之间的隧道维护等)、UPF139的选择和控制、业务和会话连续性(service and session continuity，SSC)模式选择、漫游等会话相关的功能。
UPF139是由运营商提供的网关，是运营商网络与DN 120通信的网关。UPF139包括数据包路由和传输、包检测、业务用量上报、服务质量(quality of service，QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
图1所示的运营商网络中的网络功能还可以包括网络切片选择功能(network slice selection function，NSSF)(图1中未示出)，用于负责确定网络切片实例，选择AMF网络功能137等。
本申请实施例中，在一些实现方式中，NSSF中可以保存切片的标识信息和该切片的可信级别。例如，该NSSF中可以保存一个或多个切片的标识信息和该一个或多个切片的可信级别，其中一个切片对应一个可信级别。示例性的，该NSSF中可以保存第一切片的标识信息和该第一切片的可信级别。在另一些实现方式中，NSSF中还可以保存切片的标识信息和该切片对应的NF集合。例如该NSSF中可以保存一个或多个切片的标识信息和该一个或多个切片对应的NF集合，其中，一个切片对应一个NF集合；或者，多个切片对应一个NF集合等。示例性的，该NSSF中可以保存第一切片的标识信息和该第一切片对应的第二NF集合的标识信息。示例性的，切片的标识信息可以包括网络切片选择辅助信息集合(network slice selection assistance information，NSSAI)或者单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)等，本申请实施例对于切片的标识信息的具体方式不作限定。
可理解，以上所示的第一切片的标识信息和与该第一切片对应的第二NF集合的标识信息，也可以理解为第一切片和该第二NF集合的对应关系；或者，第一切片的标识信息和与该第一切片对应的第二NF集合的对应关系等，本申请实施例对如何描述第一切片和第二NF集合的关系不作限定。
为便于理解，但是不限于此，本申请中切片简单理解就是将运营商的物理网络切割成多个虚拟的端到端的网络，每个虚拟网络之间(如包括网络内的设备、接入、传输和核心网)是逻辑独立的，任何一个虚拟网络发生故障都不会影响到其它虚拟网络。为了满足多样性需求和切片间的隔离，需要业务间相对独立的管理和运维，并提供量身定做的业务功能和分析能力。不同业务类型的实例可以部署在不同的网络切片上，相同业务类型的不同实例也可部署在不同的网络切片上。切片可以由一组网络功能、子网络构成。例如，图1 中的子网络(R)AN 140、AMF 137、SMF138、UPF139可以组成一个切片。图1中的每种网络功能只示意性地画出了一个，而在实际网络部署中，每种网络功能或子网络可以有多个、数十个或上百个等。网络中可以部署很多切片，每个切片可以有不同的性能来满足不同应用、不同垂直行业的需求。可理解，本申请示出的切片还可以称为网络切片或网络切片实例等，本申请对其名称不作限定。
图1所示的运营商网络中的网络功能还可以包括统一数据存储(unified data repository，UDR)，该UDR的功能可以参考UDM，这里不再详述。
图1所示的运营商网络中的网络功能还可以包括域名系统(domain name system，DNS)(图1中未示出)，该DNS可以用于配置(或定义)物理网元之间的互联网协议(internet protocol，IP)寻址，例如基站和AMF之间的IP寻址等。
图1中Nnef、Nausf、Nnrf、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4，以及N6为接口序列号为接口序列号。示例性的，上述接口序列号的含义可参见3GPP标准协议中定义的含义，本申请对于上述接口序列号的含义不做限制。需要说明的是，图1中仅以终端设备110为UE作出了示例性说明，图1中的各个网络功能之间的接口名称也仅仅是一个示例，在具体实现中，该系统架构的接口名称还可能为其他名称，本申请对此不作限定。
本申请中的移动性管理网络功能可以是图1所示的AMF137，也可以是未来通信系统中的具有上述接入与移动性管理功能AMF137的其他网络功能。或者，本申请中的移动性管理网络功能还可以是LTE系统中的移动管理实体(mobility management entity，MME)等。
为方便说明，本申请实施例中将接入与移动性管理功能AMF137简称为AMF，将统一数据管理UDM 134简称为UDM，将终端设备110称为UE，即本申请实施例中后文所描述的AMF均可替换为移动性管理网络功能，UDM均可替换为统一数据管理，UE均可替换为终端设备。可理解，其他未示出的网络功能同样适用该替换方法。
图1中示出的网络架构(例如5G网络架构)采用基于服务的架构和通用接口，传统网元功能基于网络功能虚拟化(network function virtualization，NFV)技术拆分成若干个自包含、自管理、可重用的网络功能服务模块。图1中示出的网络架构示意图可以理解为一种非漫游场景下基于服务的5G网络架构示意图。对于漫游场景，本申请同样适用。
可理解，本申请示出的安全通信方法中，第一NF可以包括AMF(如默认AMF(default AMF))或SMF等。第三NF包括UDM、UDR或PCF等。第四NF可以包括UDR。第二NF可以为任意NF或网络功能。用户面功能可以包括UPF。示例性的，本申请示出的由第一NF执行的步骤或功能，可以由AMF或SMF实现；第三NF执行的步骤或功能，可以由UDM执行；或者，也可以由UDR执行等。作为举例，但本申请所提供的方法不限于以下举例，如在一些实施例中，第一NF可以包括defaultAMF，第二NF可以包括终端设备可以交互的AMF。在另一些实施例中，第一NF可以包括SMF，第二NF可以包括UPF。在又一些实施例中，第一NF可以包括AMF，第二NF可以包括SMF。
可理解，本申请涉及的NF还可以理解为网元、节点或网络设备等。
本申请提供的技术方案，可以有效提升5G系统的可信安全程度。在本申请的一些实施例中，用户标识可以以假名的方式在NF之间传输，减少了用户标识在NF之间广泛传播的机会，提高了用户标识的安全性。在本申请的另一些实施例中，可信级别高的NF可以传输数据和/或信令，避免了可信级别不高的NF接触敏感数据，提高了NF之间业务交互的安全性，提高了网络的安全性，且部署可行性较高。
参见图2，图2是本申请实施例提供的一种安全通信方法的流程示意图，该方法可应用于图1所示的通信系统，如图2所示，该安全通信方法包括：
201、第一NF向第三NF发送第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息。相应的，第三NF接收该第一请求消息。
本申请实施例中，第一用户标识可以包括SUPI，第一假名信息可以用于表示该第一用户标识的假名(anonymous)；或者，该第一假名信息可以用于表示与第一用户标识不同且经过处理的标识信息。换句话说，第一假名信息可由第一用户标识经过假名化处理后得到。可选的，第一假名信息可包括隐藏的用户签约标识符(subscription concealed identifier，SUCI)；或者，该第一假名信息可包括根据SUPI生成的假名标识如SUPI*。可理解，本申请实施例所示的“假名信息”还可以替换为“替换信息”、“用户假名信息”、“匿名信息”或“假名”等，本申请实施例对于该假名信息的名称不作限定。可理解，本申请实施例所示的第一用户标识包括SUPI仅为示例，在具体实现中，第一用户标识还可以为终端设备的其他标识等，本申请实施例对此不作限定。
202、第三NF确定第一用户标识的可信属性。
本申请实施例中，第一用户标识的可信属性可用于指示该第一用户标识是否需要被假名化处理，如第三NF是否需要对第一用户标识进行假名处理；或者，该第一用户标识的可信属性可用于指示是否需要保护该第一用户标识。由于终端设备可以通过该第一用户标识与核心设备和/或接入设备交互，因此，作为一种理解方式，第三NF确定第一用户标识的可信属性，也可以理解为：第三NF确定终端设备的可信属性。其中，该终端设备为使用上述第一用户标识的设备。对于该种理解方式，本文其他实施例同样适用。
在一种可能的实现方式中，第三NF可以根据第一用户标识的签约等级确定该第一用户标识的可信属性。
本申请实施例中，第一用户标识的签约等级可以包含于该第一用户标识的签约数据中。该签约等级可以用于区分不同种类的用户。例如，该第一用户标识的签约等级可以为VIP用户或普通用户。又例如，该第一用户标识的签约等级可以为隐私要求高的用户或隐私要求低的用户。可理解，以上所示的签约等级仅为示例，在实际应用中，还可以存在更多的区分方法等。本申请实施例对于该签约等级的具体划分方式不作限定。
在一种可能的实现方式中，第三NF可以根据第一用户标识的会话属性确定该第一用户标识的可信属性。
本申请实施例中，该会话属性可以用于区分第一用户标识进行的不同会话属性。例如，该第一用户标识的会话属性可以是音视频属性。又例如，该第一用户标识的会话属性可以是时频会议或语音通话等。又例如，该第一用户标识的会话属性可以是对数据通信的安全性要求较高的会话等。本申请实施例对于该会话属性的具体划分方式不作限定。
在一种可能的实现方式中，第三NF根据第一用户标识的行业要求确定第一用户标识的可信属性。
本申请实施例中，在利用该第一用户标识交互数据和/或信令时，该数据和/或信令可以根据行业的不同确定是否需要被保护。换句话说，该数据和/或信令可以根据行业的不同确定其安全性。例如，研发行业或金融行业等可以被保护。因此是涉及该行业的数据和/或信令时，该数据和/或信令可以被保护。可选的，该行业要求还可以为在目标区域(或目标安全域)数据和/或信令需要被保护。例如，在某一园区之内，该数据和/或信令可以被保护；而非该某一园区内，该数据和/或信令是否被保护可以不受限定。本申请实施例对于该行业要求的具体划分不作限定。
可选的，第三NF还可以根据第一用户标识所属的切片的可信属性确定该第一用户标识的可信属性。例如，该第三NF中可以存储第一用户标识、与该第一用户标识对应的切片标识以及与该切片标识对应的可信级别，从而该第三NF可以根据该切片标识对应的可信级别来确定该第一用户标识的可信属性。
204、若第一用户标识的可信属性符合预设条件，则第三NF向第一NF发送第一响应消息，该第一响应消息携带该第一用户标识的第二假名信息。相应的，该第一NF接收该第一响应消息。
本申请实施例中，预设条件可以包括用户等级条件、身份隐私保护条件、行业数据安全保护条件等。该预设条件可以用于区分不同等级的可信属性，因此，本申请实施例对于该预设条件的具体区分方式不作限定。示例性的，该预设条件可以根据可信属性的确定方式而定。例如，该第一用户标识的可信属性由该第一用户标识的签约等级确定，则该预设条件可以为签约等级为VIP用户或隐私要求高的用户等。又例如，该第一用户标识的可信属性由该第一用户标识的会话属性确定，则该预设条件可以为对数据通信的安全性要求较高的会话，如视频会议等。又例如，该第一用户标识的可信属性由该第一用户标识的行业要求确定，则该预设条件可以为行业数据安全性高的用户。可理解，本申请实施例对于该预设条件的具体内容不作限定。
本申请实施例中，第二假名信息可以用于表示第一用户标识的假名(anonymous)；或者，该第二假名信息可以用于表示与第一用户标识不同且经过处理的标识信息。若第一用户标识的可信属性符合预设条件，则不同网元或网络功能之间交互时，可将该第一用户标识假名化处理，从而来保证该第一用户标识的安全性。换句话说，若第一用户标识的可信属性符合预设条件，则第一用户标识可以以第二假名信息的方式在不同网元或网络功能之间交互。
在一些实施例中，第一用户标识包括SUPI，第一假名信息包括SUCI时，该第二假名信息可以包括SUPI*。在另一些实施例中，第一用户标识包括SUPI，第一假名信息包括SUPI*，第二假名信息可以包括新的SUPI*。在又一些实施例中，第一用户标识包括SUPI，第一假名信息包括SUPI*，第二假名信息也可以包括SUPI*。对于第一响应消息中携带的SUPI*与第一请求消息中携带的SUPI*是否相同，本申请实施例不作限定。对于该说明，本申请其他实施例同样适用。
可选的，若第一用户标识的可信属性不符合预设条件，则第三NF向第一NF发送第一 响应消息，该第一响应消息携带该第一用户标识。相应的，该第一NF接收该第一响应消息。例如，若第一用户标识的可信属性表示该第一用户标识为普通用户，或者，该第一用户标识的可信属性表示该第一用户标识进行的会话要求较低，则该第一用户标识在网元或网络功能之间交互时，可以不进行假名化处理。可理解，本申请实施例对于该第一用户标识的可信属性不符合预设条件时，第一用户标识是否进行假名化处理不作限定。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF的可信级别匹配预设级别，则该第三NF向第一NF发送第一响应消息。
本申请实施例中，预设级别用于衡量不同NF的可信级别，对于该预设级别的具体级别不作限定。例如，可信级别包括强可信级别、弱可信级别和不可信级别，该预设级别可以为弱可信级别或不可信级别等。又例如，可信级别包括高可信级别、低可信级别和不可信级别，该预设级别可以为低可信级别或不可信级别等。也就是说，第一NF的可信级别较低时，为保护第一用户标识，第三NF可以向第一NF发送该第一用户标识的假名信息(即第二假名信息)。可理解，本申请实施例对于可信级别的具体划分方式不作限定，以及预设级别可以随着该可信级别的划分方式而有所变化等。
可选的，若第一NF的可信级别不匹配预设级别，则该第三NF向第一NF发送携带第一用户标识的响应消息。也就是说，第一NF的可信级别较高时，则第三NF可以信任该第一NF，由此可以向该第一NF发送真实的用户标识如第一用户标识。
当第一用户标识的可信属性符合预设条件，且第一NF的可信级别匹配预设级别，则说明第一NF不可完全信任。由此，第三NF为保护该第一用户标识，且提高用户标识的安全性，可以向可信级别较低的第一NF发送该第一用户标识的第二假名信息。然而，当第一用户标识的可信属性符合预设条件，且第一NF的可信级别不匹配预设级别，则说明第一NF是可信任的，由此，第三NF可以向第一NF发送该第一用户标识。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息包括：若第一NF所属的安全域的可信级别匹配预设级别，则第三NF向第一NF发送第一响应消息。
本申请实施例中，不同NF之间可以区分可信级别，同时可以区分不同安全域的可信级别。示例性的，可以区分第一安全域、第二安全域等，该第一安全域的可信级别与第二安全域的可信级别不同。如果第一NF位于第一安全域，且该第一安全域的可信级别较弱，则说明第一NF所在的安全域不可完全信任，则该第三NF可以向第一NF发送第一用户标识的第二假名信息。或者，若第一区域的可信级别较强(如不匹配预设级别)，则说明该第一NF所在的安全域是可以信任的，由此第三NF可以向第一NF发送真实的用户标识如第一用户标识。
可选的，除了以上示出的第一安全域和第二安全域，还可以包括第三安全域等。该第一安全域、第二安全域和第三安全域的可信级别不同。本申请实施例对于具体如何划分安全域不作限定。以及各个安全域对应的可信级别具体如何划分也不作限定。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，图2所示的方法还可以包括：
2031、该第三NF可以根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成该第二假名信息。
可选的，当第一假名信息为SUCI时，第三NF可以根据SUCI得到SUPI，然后根据该SUPI生成新的第二假名信息如新的SUPI*。可选的，当第一假名信息为SUPI*时，该第三NF可以根据SUPI*与SUPI的对应关系得到该SUPI，然后根据该SUPI生成新的第二假名信息如新的SUPI*。可选的，当第一假名信息为SUPI*时，第一响应消息中还可以携带该SUPI*，即第三NF还可以继续使用已有的SUPI*。示例性的，第三NF可以根据本地策略确定继续使用已有的SUPI*还是使用新的SUPI*。该本地策略如SUPI*可以有一定的有效期，在该SUPI*的有效期内，第三NF可以继续使用该SUPI*；而若不在该SUPI*的有效期内，则该第三NF可以使用新的SUPI*。可理解，本申请实施例对于本地策略的具体方式不作限定。可理解，关于SUPI*和新的SUPI*的说明，以下实施例同样适用。
其中，SUPI*仅为示出的一种假名形式，该第一用户标识的假名信息可以是其他形式等，本申请实施例对此不作限定。该第三NF根据第一用户标识生成第二假名信息的方法，示例性的，如SUPI*＝KDF(SUPI，随机数)；或者，SUPI*＝KDF(SUPI，随机数，服务网络ID)。该随机数可以是鉴权矢量中的随机数。可选的，生成SUPI*的参数中还可以包括鉴权矢量中的密钥Kausf或者根据鉴权矢量推导的Kausf，其中Kausf将在UE和归属网络AUSF/UDM等之间共享。
本申请实施例中，第三NF中保存有第一假名信息和第一用户标识的对应关系，以及该第三NF还可以保存第二假名信息和第一用户标识的对应关系。第三NF通过保存对应关系，可使得第一NF或其他NF再向该第三NF发送第一用户标识的假名信息时，该第三NF能够根据该对应关系得到该第一用户标识。
可理解，本申请中示出的“对应关系”也可以理解为“映射关系”、“对应列表”或“映射列表”等，本申请对此不作限定。
在一种可能的实现方式中，第三NF向第一NF发送第一响应消息之前，图2所示的方法还可以包括：
2032、该第三NF可以向第四NF发送第二请求消息，该第二请求消息携带第一假名信息。相应的，该第四NF接收该第二请求消息。
2033、响应于该第二请求消息，第四NF根据该第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。
本申请实施例中，第四NF中可以保存第一用户标识和该第一用户标识的假名信息的对应关系，由此，第三NF通过向第四NF发送第二请求消息，可使得该第四NF响应该第二请求消息，生成第二假名信息。可选的，当第一假名信息为SUCI时，第四NF可以根据SUCI得到SUPI，然后根据该SUPI生成新的第二假名信息如新的SUPI*。可选的，当第一假名信息为SUPI*时，该第四NF可以根据SUPI*与SUPI的对应关系得到该SUPI，然后根据该SUPI生成新的第二假名信息如新的SUPI*。可选地，第四NF还可根据本地策略继续使用已有的SUPI*。可理解，对于该第四NF根据第一用户标识如SUPI生成新的第二假名信息如新的SUPI*的方法，可参照第三NF的生成方法，这里不再详述。
2034、第四NF向第三NF发送该第二假名信息，相应的，该第三NF接收该第二假名信息。
可选的，第三NF向第四NF发送第二请求消息之后，该第四NF还可以将第一假名信 息和第一用户标识的对应关系发送给该第三NF。从而该第三NF接收到该对应关系后，可以根据该对应关系得到第一用户标识，进而根据该第一用户标识生成第二假名信息。
结合以上所示的第三NF生成第二假名信息的方法，本申请实施例中，UDM中可以保存第一用户标识和第一假名信息的对应关系，和/或，第一用户标识和第二假名信息的对应关系。UDR中也可以保存第一用户标识和第一假名信息的对应关系，和/或，第一用户标识和第二假名信息的对应关系。可选的，当UDM和UDR中均保存有上述对应关系时，对于第三NF执行以上所示的步骤2031还是执行以上所示的步骤2032至步骤2034，本申请实施例不作限定。可选的，当UDM或UDR中保存有上述对应关系时，该第三NF可以根据保存上述对应关系的NF的不同，执行步骤2031或者执行步骤2032至步骤2034。
以上示出的是第一响应消息中携带第二假名信息，可选的，该第一响应消息中还可以携带其他信息。根据第一响应消息中携带的其他信息的不同，本申请实施例还提供了几种方法：
方法一、
上述第一响应消息中还可以携带根密钥Kamf；该根密钥由第三NF根据SUPI生成，例如Kamf＝KDF(SUPI，其他参数)，对于其他参数本申请实施例不作限定。由于UE也是根据SUPI生成根密钥，例如Kamf＝KDF(SUPI，其他参数)，因此此时不影响UE。此处KDF算法可以采用3GPP标准中已经定义的密钥推演算法等，例如HMAC-SHA256算法，本申请实施例对于该KDF算法不作限定。
该根密钥也可以由第三NF根据SUPI*生成，例如Kamf＝KDF2(SUPI*，其他参数2)，对于其他参数2本申请实施例不作限定。由于UE是根据SUPI生成根密钥，例如Kamf＝KDF(SUPI，其他参数1)。为保证不影响UE，这里要求第三NF(或第四NF)根据SUPI生成SUPI*的密钥推演算法KDF1和第三NF根据SUPI*生成根密钥Kamf的密钥推演算法KDF2需要满足如下条件：第三NF根据SUPI*生成的根密钥Kamf和UE根据SUPI生成的根密钥Kamf是相等的，即Kamf＝KDF(SUPI，其他参数1)＝KDF2(SUPI*，其他参数2)＝KDF2(KDF1(SUPI，其他参数1)，其他参数2)。此时KDF2与KDF1可以相同，也可以不同，本申请实施例不作限定。可理解，以上示出的生成根密钥的方法仅为示例，不应将其理解为对本申请实施例的限定。
该情况下，图2所示的方法还可以包括：若第一响应消息中还携带根密钥Kamf，则第一NF还可以根据该根密钥生成用户面密钥等，本申请实施例对于该第一NF如何应用根密钥的方法不作限定。
方法二、
上述第一响应消息中还可以携带第三指示信息；其中，该第三指示信息用于指示第一NF根据第二假名信息生成根密钥。
本申请实施例对于该第三指示信息的具体指示形式不作限定。示例性的，可以用1比特的信息来表示第一响应消息中携带的是第三指示信息。例如，“1”可以表示该第一响应消息中携带的是第三指示信息。示例性的，还可以用2比特的信息来表示该第一响应消息中是否携带了指示信息，以及携带的指示信息是第三指示信息。可理解，以上仅为示例，本申请对此不作限定。
结合第三指示信息，图2所示的方法还可以包括：若第一响应消息中还携带第三指示信息，则第一NF根据第二假名信息生成根密钥Kamf。
例如，Kamf＝KDF2(SUPI*，其他参数2)，对于其他参数2本申请实施例不作限定。由于UE是根据SUPI生成根密钥，例如Kamf＝KDF(SUPI，其他参数1)。为保证不影响UE，这里要求第三NF(或第四NF)根据SUPI生成SUPI*的密钥推演算法KDF1和第一NF根据SUPI*生成根密钥Kamf的密钥推演算法KDF2需要满足如下条件：第一NF根据SUPI*生成的根密钥Kamf和UE根据SUPI生成的根密钥Kamf是相等的，即Kamf＝KDF(SUPI，其他参数1)＝KDF2(SUPI*，其他参数2)＝KDF2(KDF1(SUPI，其他参数1)，其他参数2)。此处KDF算法采用3GPP标准中已经定义的密钥推演算法，例如HMAC-SHA256算法。此时KDF2与KDF1可以相同，也可以不同，本申请实施例不作限定。
该第一NF生成该根密钥后，还可以根据该根密钥生成用户面密钥等，本申请实施例对于该第一NF如何应用根密钥的方法不作限定。
方法三、
可理解，当第一响应消息中携带第二假名信息，而不携带上述方法一和方法二示出的根密钥或第三指示信息时，图2所示的方法还可以包括：第一NF收到第一响应消息后，根据第二假名信息生成根密钥Kamf。
例如，Kamf＝KDF2(SUPI*，其他参数2)，对于其他参数2本申请实施例不作限定。由于UE是根据SUPI生成根密钥，例如Kamf＝KDF(SUPI，其他参数1)。为保证不影响UE，这里要求第三NF(或第四NF)根据SUPI生成SUPI*的密钥推演算法KDF1和第一NF根据SUPI*生成根密钥Kamf的密钥推演算法KDF2需要满足如下条件：第一NF根据SUPI*生成的根密钥Kamf和UE根据SUPI生成的根密钥Kamf是相等的，即Kamf＝KDF(SUPI，其他参数1)＝KDF2(SUPI*，其他参数2)＝KDF2(KDF1(SUPI，其他参数1)，其他参数2)。此处KDF算法采用3GPP标准中已经定义的密钥推演算法，例如HMAC-SHA256算法。此时KDF2与KDF1可以相同，也可以不同，本申请实施例不作限定。
该第一NF生成该根密钥后，还可以根据该根密钥生成用户面密钥等，本申请实施例对于该第一NF如何应用根密钥的方法不作限定。
可理解，对于方法一至方法三的具体实现方式，本申请其他实施例同样适用。
上述方法一至方法三对于UE是没有影响的，即UE可以保持不变。例如UE根据SUPI生成根密钥Kamf，例如Kamf＝KDF(SUPI，其他参数1)，进而可以根据该根密钥生成用户面密钥。可理解，这里所示的UE可以保持不变是相对于方法四来说的，方法四中UE还需要接收第一指示信息和/或第二指示信息等。因此，不应将本申请实施例示出的UE保持不变理解为对本申请实施例的限定。
方法四、
在一种可能的实现方式中，上述第一响应消息中还携带第一指示信息和/或第二指示信息；其中，该第一指示信息用于指示生成第二假名信息，该第二指示信息用于指示生成用户面密钥。
本申请实施例对于该第一指示信息和该第二指示信息的具体指示形式不作限定。示例性的，可以用1比特的信息来表示第一响应消息中携带的是第一指示信息还是第二指示信息。例如，“1”可以表示该第一响应消息中携带的是第一指示信息，“0”可以表示该第一响应消息中携带的是第二指示信息。示例性的，还可以用2比特的信息来表示该第一响应消息中是否携带了指示信息，以及携带的指示信息是第一指示信息还是第二指示信息。可理解，以上仅为示例，本申请对此不作限定。
结合第一指示信息，图2所示的方法还可以包括：
2051、若第一响应消息中包括第一指示信息，则第一NF根据第二假名信息生成根密钥。
该第一NF生成该根密钥后，还可以根据该根密钥生成用户面密钥等，本申请实施例对于该第一NF应用根密钥的方法不作限定。对于该第一NF如何应用根密钥，可以参考相关标准或协议等。例如，Kamf＝KDF(SUPI*，其他参数)，对于其他参数本申请实施例不作限定。
2061、第一NF向终端设备发送第一指示信息，相应的，该终端设备接收该第一指示信息。
对于该终端设备接收到第一指示信息后执行的步骤，参见图3a，图3a是本申请实施例提供的一种安全通信方法的流程示意图，该方法可应用于终端设备。如图3a所示，该方法包括：
3011、终端设备接收第一NF(AMF)发送的第一指示信息；其中，第一指示信息用于指示终端设备生成第二假名信息。
可选的，第一指示信息还可以用于指示终端设备生成根密钥。
3012、终端设备根据第一用户标识生成第二假名信息。
3013、终端设备根据第二假名信息生成根密钥。
3014、终端设备根据根密钥生成接入层密钥和/或非接入层密钥；其中，接入层密钥用于对终端设备与接入设备之间的数据和/或信令进行保护，非接入层密钥用于对终端设备与第一NF之间的数据和/或信令进行保护。
本申请实施例中，对于终端设备根据第一用户标识生成第二假名信息的方法以及生成根密钥的方法，可参照第三NF生成第二假名信息的方法以及第三NF生成根密钥的方法，这里不再详述。
本申请实施例对于终端设备生成接入层密钥的方法不作限定，例如接入层密钥＝KDF(Kamf，其他参数)。
实施本申请实施例，根据第二假名信息生成接入层密钥和/或非接入层密钥，可有效提高数据和/或信令的安全级别，保护数据和/或信令的传输。
结合第二指示信息，图2所示的方法还可以包括：
2052、若第一响应消息中包括第二指示信息，则第一NF根据第二假名信息生成用户面密钥。
本申请实施例对于终端设备生成用户面密钥的方法不作限定。
2062、第一NF向终端设备发送第二指示信息，相应的，该终端设备接收该第二指示 信息。
2072、第一NF向用户面功能发送用户面密钥，相应的，该用户面功能接收该用户面密钥。
可理解，对于步骤2062和步骤2072的先后顺序，本申请实施例不作限定。
对于终端设备接收到第二指示信息后执行的步骤，参见图3b，图3b是本申请实施例提供的一种安全通信方法的流程示意图，该方法可应用于终端设备。如图3b所示，该方法包括：
3021、终端设备接收第一NF发送的第二指示信息；其中，第二指示信息用于指示终端设备生成用户面保护密钥。
3022、终端设备根据第一用户标识生成第二假名信息。
3023、终端设备根据第二假名信息生成根密钥。
3024、终端设备根据根密钥生成用户面密钥；其中，用户面密钥用于对终端设备与用户面功能之间的数据进行保护。
本申请实施例中，终端设备生成用户面密钥之后，该终端设备与用户面功能交互时，可以利用该用户面密钥对数据进行保护。避免了该数据被其他网元或网络功能篡改或截获等，保证了该数据的安全性。
可理解，图3a和图3b所示的安全通信方法中，终端设备可理解为使用了第一用户标识的设备。换句话说，第一用户标识如SUPI可为终端设备芯卡保存的用户标识或号码等。
可理解，以上所示的方法中是以第一用户标识为例示出的，但是具体应用中，还可能包括第二用户标识、第三用户标识等。该第二用户标识或该第三用户标识也可以应用图2、图3a和图3b所示的方法。
实施图2所示的方法，第三NF可以根据第一用户标识的可信属性来确定是否对第一用户标识进行假名化处理，从而在该第一用户标识的可信属性符合预设条件时，该第三NF向第一NF发送假名化处理的第一用户标识即第二假名信息。第一用户标识以假名化的方式存在于不同NF之间，避免了该第一用户标识被不安全或不被信任的网元或网络功能篡改或截获等，有效保护了该第一用户标识，提高了该第一用户标识的安全性。
为更形象的理解图2所示的方法，以下将具体示出本申请实施例提供的安全通信方法。
参见图4，图4是本申请实施例提供的一种安全通信方法的场景示意图。该方法可应用于图1所示的网络架构。可理解，该方法是以终端设备为UE，第一NF为AMF，第三NF为UDM示出，同时，该方法中还涉及到的网络功能如AUSF，用户面功能如UPF。该方法中第一用户标识包括SUPI。可选的，UDM中预先保存有一或多个用户标识的签约数据，且该签约数据中包括签约等级。换句话说，该UDM中预先配置有一个或多个用户标识的签约等级。
如图4所示，该安全通信方法包括：
401、UE向AMF发送注册请求消息，该注册请求消息中携带SUCI或5G全球用户临时标识(5G global user temporary identity，5G GUTI)。相应的，该AMF接收该注册请求消息。
UE首次向AMF发送注册请求消息时，该注册请求消息中可以携带SUCI。UE非首次向AMF发送注册请求消息时，该注册请求消息中可以携带GUTI。为便于描述，UE首次向AMF发送注册请求消息，可简称为首次注册；UE非首次向AMF发送注册请求消息，可简称为非首次注册。
402、AMF向AUSF发送鉴权请求消息，该鉴权请求消息中携带SUCI或SUPI*。相应的，AUSF接收该鉴权请求消息。
首次注册时，该鉴权请求消息中可以携带SUCI；非首次注册时，该鉴权请求消息中可以携带SUPI*。
可选的，该鉴权请求消息中还可以携带服务网络的标识(identification，ID)。该服务网络的ID可以为AMF所在的网络的ID。
403、AUSF向UDM发送上述鉴权请求消息，相应的，UDM接收该鉴权请求消息。
404、UDM根据SUPI的可信属性对SUPI进行假名化处理，得到新的假名化用户标识如SUPI*。
可理解，对于UDM假名化处理的方法可参考图2所示的方法，这里不再详述。
405、UDM向AUSF发送鉴权响应消息，该鉴权响应消息中携带新的假名化用户标识如SUPI*。相应的，该AUSF接收该鉴权响应消息。
示例性的，如鉴权请求消息中携带的是SUCI，则UDM可以根据该SUCI得到SUPI。然后根据该SUPI生成新的SUPI*。示例性的，若鉴权请求消息中携带的是SUPI*，则UDM可以根据之前保存的对应关系(SUPI，SUPI*)得到SUPI，然后根据SUPI生成新的SUPI*。可选地，UDM还可以根据本地策略继续使用已有的SUPI*(如鉴权请求消息中携带的SUPI*)。
可选的，鉴权响应消息中还可以携带第一指示信息和/或第二指示信息。其中，该第一指示信息也可以理解为假名化保护指示信息；该第二指示信息可以理解为或终端到核心网保护指示信息。
示例性的，对于步骤404，UDM根据签约的可信属性(如签约的SUPI的可信属性)可以进行如下处理：
例如，若签约中的可信属性符合身份隐私保护要求，则UDM可以确定SUPI需要假名化保护。又例如，若签约中的可信属性符合行业数据安全保护要求，则UDM确定SUPI需要假名化保护。又例如，若签约中的可信属性表示SUPI为普通用户，则UDM可以按照正常流程处理。该正常流程可参考相关标准或协议，如UDM可以不对SUPI进行假名化处理等。又例如，若签约中的可信属性表示SUPI为VIP用户，则UDM确定SUPI需要假名化保护。
可选的，UDM接收到鉴权请求消息之后，该UDM还可以将该鉴权请求消息发送给UDR，该UDR根据SUPI的可信属性对SUPI进行假名化处理，得到新的SUPI*。从而该UDR向UDM发送鉴权响应消息，该鉴权响应消息携带新的SUPI*。可选的，该UDR在接收到鉴权请求消息之后，可以直接对SUPI进行假名化处理，得到新的SUPI*。从而该UDR向UDM发送鉴权响应消息，该鉴权响应消息携带新的SUPI*。可选的，UDR向UDM发送的鉴权响应消息中还可以携带新的SUPI*和SUPI的对应关系。该情况下，UDM和UDR 均可以获得真实的用户标识如SUPI。
UDR得到SUPI*的方式可以如下所示：例如，鉴权请求消息中携带的是SUCI，则UDR可以根据该SUCI得到SUPI，然后根据该SUPI生成新的SUPI*。可选的，若鉴权请求消息中携带的是SUPI*，则UDR可以根据之前保存的对应关系(SUPI，SUPI*)得到SUPI，然后根据SUPI生成新的SUPI*。可选地，UDR还可以根据本地策略继续使用已有的SUPI*(如鉴权请求消息中携带的SUPI*)。
406、AUSF通过AMF继续执行对于UE的鉴权流程。
可理解，对于步骤406所示的鉴权流程，可以参照相关标准或协议等，本申请实施例对此不作限定。
407、AUSF确认鉴权成功。
408、AUSF向AMF发送鉴权响应消息，该鉴权响应消息中携带新的SUPI*。相应的，该AMF接收该鉴权响应消息。
可选的，该鉴权响应消息中还可以携带锚点密钥。可选的，该鉴权响应消息中还可以携带第一指示信息和/或第二指示信息。可选的，该第一指示信息和/或该第二指示信息还可以通过共享密钥进行完整性保护，以防止该第一指示信息和/或该第二指示信息被恶意篡改等。其中，共享密钥可理解为鉴权过程中UE与AUSF之间的共享密钥。换句话说，该第一指示信息和/或第二指示信息可以通过恢复消息认证码(message authentication code，MAC)值进行完整性保护。
409、AMF根据新的SUPI*和锚点密钥生成根密钥(Kamf)。
可选的，若鉴权响应消息中携带第二指示信息，则该AMF根据根密钥生成用户面密钥，该用户面密钥也可以称为终端到核心网保护密钥，该终端到核心网保护密钥可以包括终端到核心网加密密钥和终端到核心网完整性保护密钥。
可选的，在UDM生成新的SUPI*时，该UDM还可以根据该新的SUPI*生成根密钥。从而鉴权响应消息中还可以携带该根密钥，从而AMF接收到该鉴权响应消息时，可以得到该根密钥。
可选的，AUSF接收到鉴权响应消息后，该AUSF还可以根据新的SUPI*生成根密钥。
410、AMF向UE发送第一指示信息和/或第二指示信息。
411、UE根据SUPI生成新的SUPI*。
在鉴权流程结束后，该UE还可以利用和AUSF相同的方法生成锚点密钥。可选的，若UE接收到第一指示信息，则UE可以利用UE和AUSF之间的共享密钥对该第一指示信息进行完整性保护校验，然后该UE生成新的SUPI*。可理解，该UE生成新的SUPI*的方法可以与UDM生成新的SUPI*的方法相同。进一步的，该UE还可以根据该新的SUPI*生成根密钥Kamf。可选的，若UE接收到第二指示信息，则UE还可以根据根密钥生成用户面密钥。
可理解，以上所示的第一指示信息和/或第二指示信息还可以包含于第十消息中等，本申请实施例对于AMF发送该第一指示信息和/或该第二指示信息的方式不作限定。
412、AMF向UE发送注册响应消息。相应的，该UE接收该注册响应消息。
该注册响应消息可以包括注册接受消息。
413、AMF通过SMF将终端到核心网保护密钥发送给UPF。
本申请实施例中，在UE与UPF传输数据过程中，该数据可以通过终端到核心网保护密钥进行加密或完整性保护，由此避免了数据被弱可信或不可信的NF获知，提高了数据传输的安全性。
图4所示的方法中，根密钥Kamf是由AMF根据鉴权响应消息中携带的新的SUPI*生成的。以及UE是利用与UDM相同的方法生成新的SUPI*，然后根据新的SUPI*生成根密钥Kamf。
可选的，在UDM生成新的SUPI*后，该UDM还可以根据新的SUPI*生成根密钥Kamf。同时，鉴权响应消息中可以包括新的SUPI*和根密钥Kamf，由此AMF可以直接接收到根密钥Kamf。该情况下，UE也可以利用与UDM相同的方法生成新的SUPI*，然后根据新的SUPI*生成根密钥Kamf。可选的，UDM可以利用安全算法f1生成新的SUPI*；同时，鉴权响应消息中包括新的SUPI*，AMF利用安全算法f2，以及该新的SUPI*生成根密钥Kamf。通过安全算法f1,f2保证UE根据新的SUPI*生成的根密钥Kamf和AMF生成的根密钥Kamf相等。
可理解，图2中的第一请求消息可理解为图4中鉴权请求消息，图2中第一响应消息可理解为图4中的鉴权响应消息。图2中的第一指示信息可理解为图4中的假名化保护指示信息，图2中的第二指示信息可理解为图4中的终端到核心网保护指示信息。图2所示的用户面密钥可理解为图4中的终端到核心网保护密钥。
本申请实施例提供的技术方案，一方面，避免了SUPI被不安全或不被信任的网元或网络功能篡改或截获等，有效保护了SUPI，提高了该SUPI的安全性。另一方面，鉴权响应消息中通过包括终端到核心网保护指示信息，提高了UE与UPF之间数据交互的安全性。
图2至图4所示的方法是以用户标识的可信属性是否符合预设条件，确定是否对该用户标识进行假名化处理。本申请实施例还提供了一种安全通信方法，该方法中可以根据可信级别来确定相关网元或网络功能，从而通过该相关网元或网络功能为终端设备提供服务。
图5是本申请实施例提供的一种安全通信方法的流程示意图，该方法可应用于图1所示的网络架构。如图5所示，该安全通信方法包括：
501、第一网络功能(network function，NF)向NRF发送第三请求消息，该第三请求消息携带可信级别。相应的，该NRF接收该第三请求消息。
第一NF还可以理解为消费者(consumerNF)。
本申请实施例中，可信级别可用于表示网元或网络功能的可信程度。根据该可信级别的不同，如NF的可信程度就不同。可选的，可信级别与可信程度可以成正比。例如，该可信级别可以分为强可信、弱可信或不可信等。又例如，该可信级别可以分为级别1、级别2、级别3等，级别越高，代表可信程度越高。本申请实施例对于可信级别的具体划分方式不作限定。
可选的，上述所示的可信级别可以是NF的可信级别。或者，上述所示的可信级别还可以是切片的可信级别等。根据可信级别的不同，本申请实施例提供了几种不同的方法，分别如图6a至图6c。
本申请实施例中，第三请求消息如可以为请求查询终端设备可以接入的NF的消息，该终端设备可以接入的NF可以包括AMF、SMF或UPF等。
502、响应于第三请求消息，NRF根据可信级别确定第二NF。
第二NF还可以理解为生产者(producer NF)；或者，还可以理解为目标NF(target NF)等。
该第二NF可以表示一个NF，或者，该第二NF还可以表示多个NF。
可选的，第二NF可以为与可信级别对应的一个或多个NF。或者，该第二NF还可以为与可信级别，以及第一NF请求的NF类型对应的一个或多个NF。
根据可信级别的不同，NRF确定第二NF的方法也不同，可以分别如图6a至图6c所示。
503、NRF向第一NF发送第二NF的标识信息。相应的，该第一NF接收该第二NF的标识信息。
第二NF的标识信息，例如可以包括该第二NF的类型(NF type)、第二NF的实例(NF instance)、第二NF集合的标识(NF set ID)或第二NF的IP地址等，本申请实施例对于该标识信息具体是哪些标识不作限定。接收到该第二NF的标识信息之后，第一NF可以与该第二NF进行业务交互。
可选的，该第二NF的标识信息可以包含于第三响应消息中。
本申请实施例中，NRF根据可信级别确定第二NF，可使得第一NF接收到该第二NF的标识信息之后，该第一NF与该第二NF进行数据和/或信令交互。从而第一NF可以与可信级别相对应的NF(即第二NF)进行交互，一方面，可满足第一NF对可信级别的需求，另一方面，第一NF与可信级别高的NF(如第二NF)进行数据和/或信令交互，提高了第一NF和第二NF交互的安全性。
根据图5所示的可信级别的不同，本申请实施例还提供了几种方法，分别如下所示：
方法一、
参见图6a，图6a是本申请实施例提供的一种安全通信方法的流程示意图，如图6a所示，该方法包括：
可理解，该方法中NRF中保存有一个或多个NF(包括第二NF)的可信级别，以下以第二NF为例示出本申请实施例提供的方法。但是以下所示的方法不仅适用于第二NF，还可以适用于其他NF等。如图6a所示，NRF中保存一个或多个NF的可信级别的方法包括步骤601和步骤602。
601、NRF接收第二NF发送的注册请求消息，该注册请求消息携带第二NF的可信级别。相应的，NRF接收该注册请求消息。
该注册请求消息中还携带第二NF的标识信息。
602、NRF保存该第二NF的可信级别。
该方法中，第二NF可以在向NRF发送注册请求消息时，将该第二NF的可信级别发送给该NRF。对于可信级别的划分方法可参照图5所示的方法，这里不再详述。
对于该NRF如何保存该第二NF的可信级别，以及该第二NF的可信级别具体保存的位置，本申请实施例不作限定。示例性的，NRF可以保存该第二NF的标识信息和可信级 别的对应关系如(NF instance，NF type，可信级别)等。示例性的，NRF中可以以一个NF对应一个可信级别的方式保存该NF的可信级别。或者，NRF也可以以多个NF对应一个可信级别的方式保存该多个NF的可信级别等。
以上是本申请实施例提供的一种动态获取NF的可信级别的方法。本申请实施例还提供了一种静态获取NF的可信级别的方法，如NRF预配置一个或多个NF的可信级别，并保存该一个或多个NF的可信级别。示例性的，该NRF预配置第二NF的可信级别，并保存该第二NF的可信级别。例如，运营商可以为NRF预配置第二NF的可信级别等。可理解，本申请实施例对于NRF中配置一个或多个NF的可信级别的方法，不作限定。
以上所示的静态或动态获取NF的可信级别的方法中，NRF中可以保存一个或多个NF的标识信息和该一个或多个NF的可信级别。示例性的，该NRF中可以保存NFa的标识信息和NFa的可信级别。或者，该NRF中还可以保存NFb的标识信息和NFb的可信级别。或者，该NRF中还可以保存NFc的标识信息和NFc的可信级别。其中，NFa、NFb和NFc仅用于区分不同的NF，并不具有其他特定含义。可理解，以上所示的NRF中可以保存一个或多个NF的标识信息和该一个或多个NF的可信级别，也可以理解为NRF中保存一个或多个NF和该一个或多个NF的可信级别；或者，也可以理解为该NRF中保存一个或多个NF的标识信息和可信级别的对应关系等，本申请实施例对于具体的描述方法不作限定。
可理解，以上关于NRF中保存NF的标识信息和该NF的可信级别的描述，本申请其他实施例同样适用。
603、第一NF从第三NF中获取第一用户标识的可信属性，根据该第一用户标识的可信属性确定可信级别。
本申请实施例中，第一用户标识的可信属性可用于指示是否需要对该第一用户标识进行假名化处理等。由此需要对该第一用户标识进行假名化处理，则表示该第一用户标识需要的可信级别越高。因此，第三NF得到第一用户标识的可信属性后，便可以根据该第一用户标识的可信属性确定可信级别。对于第三NF如何得到该第一用户标识的可信属性，可参照图2所示的方法，这里不再详述。
示例性的，第一NF可以在接收到终端设备发送的请求接入网络的消息时，该第一NF执行步骤603。示例性的，该第一NF还可以在接收到终端设备发送的请求建立会话请求的消息时，该第一NF执行步骤603。该第一NF还可以在其他场景下，执行步骤603等，本申请实施例对此不作限定。
604、第一NF向NRF发送第三请求消息，该第三请求消息携带可信级别。相应的，该NRF接收该第三请求消息。
605、响应于第三请求消息，NRF根据保存的第二NF的标识信息和该第二NF的可信级别的对应关系，以及第三请求消息中携带的可信级别，确定第二NF。
该NRF中保存一个或多个NF的标识信息和可信级别；或者，也可以理解为该NRF中保存有一个或多个NF的标识信息和该一个或多个NF的可信级别的对应关系；或者，也可以理解为该NRF中保存NF的标识信息和该NF的可信级别。对于该NRF中保存NF的标识信息和该NF的可信级别的方法，可参考步骤601和步骤602的相关描述，这里不再详述。
在一些实现方式中，第二NF的可信级别可以等于第三请求消息中携带的可信级别。在另一些实现方式中，该第二NF的可信级别还可以高于第三请求消息中携带的可信级别等，本申请对此不作限定。
例如，NRF中可以保存(NF2，可信级别如高)、(NF3，可信级别如高)、(NF4，可信级别如弱)、(NF5，可信级别如不可信)。第三请求消息中携带的可信级别为可信级别高。则该NRF可以从保存的NF的可信级别中确定可信级别高的NF如NF2和/或NF3作为第二NF。可理解，以上所示的例子中NF2、NF3、NF4和NF5可以为同一种类型的NF。
可选的，NRF中还可以保存各种不同类型的NF的可信级别，该情况下，NRF确定第二NF时，还可以根据第一NF请求的NF类型来确定第二NF。例如，第一NF需要请求终端设备可以接入的AMF，则第二NF为与第三请求消息中携带的可信级别对应的NF。
可选的，在第三请求消息中携带的可信级别为可信级别弱的情况下，第二NF的可信级别可以与可信级别弱对应；或者，第二NF的可信级别还可以高于该可信级别弱。
可理解，本申请实施例中，NF的可信级别也可以理解为该NF的标识对应的可信级别。
606、NRF向第一NF发送第二NF的标识信息，相应的，该第一NF接收该第二NF的标识信息。
本申请实施例中，NRF中通过保存各个NF(包括第二NF)的可信级别，可使得第一NF向该NRF请求可信级别高的NF。从而该第一NF可以与可信级别高的NF(如第二NF)进行数据和/或信令交互，保证了数据和/或信令的安全性。
方法二、
参见图6b，图6b是本申请实施例提供的一种安全通信方法的流程示意图，如图6b所示，该方法包括：
611、第一NF向NSSF发送第四请求消息，该第四请求消息中携带第一切片的标识信息。相应的，该NSSF接收该第四请求消息。
对于第四请求消息的具体类型，本申请实施例不作限定。
612、NSSF根据第一预配置信息和第四请求消息中携带的第一切片的标识信息，确定该第一切片的可信级别。
该第一预配置信息由运营商配置，或者，由其他NF配置等，本申请对此不作限定。该第一预配置信息中可以保存切片的标识信息和该切片的可信级别。例如，该第一预配置信息中可以保存一个或多个切片的标识信息和可信级别的对应关系。其中，该第一预配置信息中包括第一切片的标识信息和该第一切片的可信级别。
本申请实施例中，第一切片的可信级别也可以理解为第一切片的标识信息对应的可信级别。多个切片的可信级别，也可以理解为多个切片的标识信息对应的可信级别。该多个切片可对应一个可信级别，或者，该多个切片也可对应多个可信级别。例如一个切片对应一个可信级别，或者，两个切片对应一个可信级别等，本申请实施例对于NSSF如何保存切片和可信级别的关系不作限定。
NSSF接收到第四请求消息之后，该NSSF可以从保存的一个或多个切片的可信级别中，根据第一切片的标识信息查找第一切片对应的可信级别，从而得到该第一切片的可信级别。
613、NSSF向第一NF发送第四响应消息，该第四响应消息中携带第一切片的可信级 别。相应的，该第一NF接收该第四响应消息。
第四响应消息中携带第一切片的可信级别也可以理解为该第四响应消息中携带与第一切片的标识信息对应的可信级别。该第四响应消息中还携带第一切片的标识信息。
614、第一NF向NRF发送第三请求消息，该第三请求消息中携带第一切片的可信级别和该第一切片的标识信息。相应的，该NRF接收该第三请求消息。
615、响应于第三请求消息，NRF根据第一切片的标识信息确定与第一切片对应的第二NF集合；根据保存的NF的标识信息和该NF的可信级别的对应关系，以及该第一切片的可信级别从第二NF集合中确定第二NF。
本申请实施例中，该NRF中可以保存一个或多个NF的标识信息和可信级别的对应关系。或者，也可以理解为该NRF中保存有一个或多个NF的标识信息和该一个或多个NF的可信级别。从而，NRF可以根据第一切片的可信级别，从第二NF集合中确定第二NF。可理解，本申请实施例对于该第二NF集合中包括的NF的个数不作限定。例如，该第二NF集合中可以包括一个NF如第二NF；又例如，该第二NF集合中还可以包括多个NF等，该多个NF中包括第二NF。可理解，关于第二NF集合的描述，本申请其他实施例同样适用。
616、NRF向第一NF发送第二NF的标识信息，相应的，该第一NF接收该第二NF的标识信息。
在一种可能的实现方式中，在步骤615之前，图6b所示的方法还可以包括：
617、NRF接收第二NF发送的注册请求消息，该注册请求消息携带第二NF的可信级别。相应的，NRF接收该注册请求消息。
该注册请求消息中还携带第二NF的标识信息。
618、NRF保存该第二NF的可信级别。
可理解，对于步骤617和步骤618的具体实现方式，可参照图6a所示的步骤601和步骤602，这里不再详述。
可理解，本申请实施例中未详尽描述的方法，可参考图5和图6a所示的方法，这里不再详述。
方法三、
参见图6c，图6c是本申请实施例提供的一种安全通信方法的流程示意图，如图6c所示，该方法包括：
621、第一NF向NSSF发送第四请求消息，该第四请求消息中携带第一切片的标识信息。相应的，该NSSF接收该第四请求消息。
对于第四请求消息的具体类型，本申请实施例不作限定。
622、NSSF根据第二预配置信息和第一切片的标识信息确定第二NF集合的可信级别。
该第二预配置信息由运营商配置，或者，由其他NF配置等，本申请对此不作限定。该第二预配置信息中包括NF集合的标识信息和该NF集合的可信级别。例如，该第二预配置信息中可以包括第二NF集合的标识信息和该第二NF集合的可信级别的对应关系。以及该第二预配置信息中还可以包括切片的标识信息和NF集合的标识信息。例如，该第二预配置信息中可以包括第一切片的标识信息和该第二NF集合的标识信息的对应关系。
可选的，一个切片可以对应一个或多个NF集合，一个NF集合可以对应一个可信级别。
NSSF接收到第四请求消息之后，可以根据该第四请求消息中携带的第一切片的标识信息确定该第一切片对应的NF集合如第二NF集合；然后确定该第二NF集合对应的可信级别。
623、NSSF向第一NF发送第四响应消息，该第四响应消息携带第二NF集合的标识信息和该第二NF集合的可信级别。相应的，该第一NF接收该第四响应消息。
624、第一NF向NRF发送第三请求消息，该第三请求消息中携带第二NF集合的可信级别和该第二NF集合的标识信息。相应的，该NRF接收该第三请求消息。
625、响应于第三请求消息，NRF根据保存的NF的标识信息和该NF的可信级别的对应关系，以及第二NF集合的可信级别，从该第二NF集合中确定第二NF。
626、NRF向第一NF发送第二NF的标识信息，相应的，该第一NF接收该第二NF的标识信息。
在一种可能的实现方式中，在步骤625之前，图6b所示的方法还可以包括：
627、NRF接收第二NF发送的注册请求消息，该注册请求消息携带第二NF的可信级别。相应的，NRF接收该注册请求消息。
该注册请求消息中还携带第二NF的标识信息。
628、NRF保存该第二NF的可信级别。
可理解，对于步骤627和步骤628的具体实现方式，可参照图6a所示的步骤601和步骤602，这里不再详述。
可理解，本申请实施例中未详尽描述的方法，可参考图5-图6b所示的方法，这里不再详述。
方法四、
参见图6d，图6d是本申请实施例提供的一种安全通信方法的流程示意图，如图6d所示，该方法包括：
631、第一NF向NSSF发送第四请求消息，该第四请求消息中携带第一切片的标识信息。相应的，该NSSF接收该第四请求消息。
632、NSSF根据第三预配置信息以及第一切片的标识信息确定该第一切片对应的一个或多个NF，以及该一个或多个NF对应的可信级别。
第三预配置信息中包括切片的标识信息和NF的标识信息的对应关系。换句话说，该第三预配置信息中可以包括一个或多个切片和NF的对应关系。可选的，一个切片可以对应一个或多个NF，一个NF可以对应一个可信级别。
可选的，上述多个NF对应的可信级别相同，或者，上述多个NF对应的可信级别不同等，本申请实施例对此不作限定。例如，第一切片可以对应NF7(可信级别高)、NF8(可信级别高)和NF9(可信级别高)。又例如，该第一切片可以对应NF7(可信级别高)、NF8(可信级别高)和NF10(可信级别弱)。
633、NSSF向第一NF发送第四响应消息，该第四响应消息携带一个或多个NF的标识信息和该一个或多个NF的可信级别。相应的，该第一NF接收该第四响应消息。
本申请实施例所示的方法，与图6c不同的是，图6c中第四响应消息中携带的是第二 NF集合的可信级别，图6d中第四响应消息携带的是一个或多个NF的可信级别。换句话说，图6c中的可信级别是针对集合而言的，至于该第二NF集合中对应的一个或多个NF的可信级别是否相同，本申请实施例不作限定。即该第二NF集合中包括的NF的可信级别也可能低于第三请求消息中携带的可信级别。而图6d中，第四响应消息中直接携带了一个或多个NF的标识信息和该一个或多个NF的可信级别，由此，第一NF便可以直接从该一个或多个NF中选择一个NF作为第二NF。即该第一NF接收到该第四响应消息之后，该第一NF可以根据一个或多个NF的可信级别确定与该第一NF交互的第二NF。
本申请实施例中，NSSF通过向第一NF发送一个或多个NF的可信级别，使得该第一NF可以很快的确定出第二NF，实现简单，且效率高。
可理解，以上所示的第一NF和第二NF仅为一种示例，在实际应用中，终端设备需要接入网络或建立会话连接等场景中，可能会涉及更多的NF。换句话说，本申请实施例所提供的技术方案可以适用于更多的NF。
实施图5至图6d提供的技术方案，终端设备在接入网络，或者建立会话连接等场景下，第一NF通过与NRF或NSSF交互，可以获得与该第一NF交互的可信级别高的第二NF。在处理相关处理时，保证了业务交互的安全性。
本申请还提供了一种安全通信方法，该方法如下所示：
1)第一网络功能(network function，NF)向域名系统(domain name system，DNS)发送第五请求消息，该第五请求消息携带域名信息和可信级别；相应的，DNS接收该第五请求消息。
2)响应于第五请求消息，DNS根据该域名信息和可信级别确定第二NF；DNS向第一NF发送该第二NF的标识信息。
本申请实施例中，DNS可以根据保存的域名信息和标识信息的对应关系，以及标识信息和可信级别的对应关系(或域名信息和可信级别的对应关系等)确定该第二NF。例如，DNS中可以配置一个或多个NF的域名信息(或标识信息)和该一个或多个NF的可信级别的对应关系。DNS根据可信级别确定第二NF，可使得第一NF接收该第二NF的标识信息，该第二NF的标识信息可以包括该第二NF的IP地址等。从而第一NF可以与可信级别相对应的NF(即第二NF)进行交互，一方面，可满足终端设备对应的用户标识对可信级别的要求，另一方面，第一NF与可信级别高的NF(如第二NF)进行数据和/或信令交互，提高了第一NF和第二NF交互的安全性。
可理解，第二NF的标识信息可以携带于第五响应消息中等，本申请实施例对此不作限定。
本申请实施例中，第一NF还可以包括接入设备等，第二NF可以包括AMF等。
可理解，以上所示的图5至图6d的方法，还可以与图2至图4所示的方法结合。例如，第一用户标识的可信属性符合预设条件时，该第一用户标识可以以假名化的方式存在于不同NF之间。同时，UE与不同的NF交互时，第一NF不仅可以选择可信级别高的NF如第二NF进行交互；而且该第一NF和该第二NF交互时，第一用户标识还可以以假名化的方 式(或真实的用户标识)存在于第一NF和第二NF之间。由此，不仅提高了第一用户标识的安全性，还有效保证了数据和/或信令交互的安全性或可靠性。进一步的，UE与UPF交互时，数据和/或信令还可以通过用户面密钥进行加密，从而保证数据和/或信令的安全性。
换句话说，本申请提供的安全通信方法，可以从用户标识安全、通信网拓扑安全、终端到核心网保护安全等角度考虑，减少隐私泄露或薄弱环节被人利用等，减少各个区域因政策原因而引发的过度担忧。通过分级设置，控制少量敏感网元，进行分节点授信，使得大部分网元设备可以不涉及敏感数据或者降低安全等级要求，现网部署可行性大大提升。
以下将以具体NF为例示出本申请提供的安全通信方法。该方法实现了可分级、可假名化、可分NF授信等方式，提高了网络部署的可行性、数据安全性等。
以上所示的NF的可信级别，例如可以包括可信NF、弱可信NF和不可信NF。该可信NF可以包括可信数据NF、可信控制NF和可信支架NF，如表1所示。其中，该可信数据NF可以用于保存签约数据等；该可信数据NF可以包括以上所示的第三NF、第四NF。可信控制NF可以用于寻址NF等；该可信控制NF可以包括以上所示的第一NF、NRF或NSSF等。可信支架NF可以包括以上所示的用户面功能，该可信支架NF可以包括UPF、MEC等。该可信支架NF可以为运营商授权的用户面网元。可选的，该可信支架NF根据行业数据要求可以执行数据不上传(支持约定好的检查)；或者，根据接入网情况启动终端到核心网保护(即利用用户面密钥对数据进行加密)；或者，根据网络条件启动可信支架NF间的保护等。
表1
Figure PCTCN2021089589-appb-000001
以下详细介绍可信网元：
可信数据NF可以包括5GUDM、4G UDM、HSS、移动网络中的PCF等，或者也可以是上述网元中的用户数据库部分等。可信数据NF之所以是可信的，是因为该可信数据NF需要保存用户ID、密钥和签约数据等用户敏感信息。换句话说，可信数据NF的高敏感性在于该可信数据NF需要保存上述用户敏感信息。
可信控制NF可以包括5G NRF、DNS，以及4G DNS等。NF之间的寻址被NRF、DNS等控制，可以执行拓扑隐藏和定向分流等。可信控制NF的高敏感度在于该可信控制NF需要保存网络拓扑控制等数据信息。
示例性的，DNS用于配置物理网元之间的IP寻址(例如接入设备和AMF之间)。NRF用于配置虚拟网络功能(virtual network function，VNF)之间的寻址(例如同一物理数据中心的AMF和SMF之间等)。该NRF还可以配置可信支架NF和弱信任支架NF等。
该可信控制NF还可以包含SCP，用于处理3GPP标准中规定的间接寻址过程和拓扑隐 藏过程。示例性的，如图7b中的AMF2可以通过SCP间接寻址到SMF2，然后该AMF2可以通过SCP与SMF2间接通信。
可选的，SMF可以预配置一些可信支架NF对所有UE都可信。
可信控制NF还可以包括缺省AMF(或默认AMF如default AMF)、NSSF，用于在切片选择前获取用户的真实签约数据。如图7a中，UE1(VIP用户)在通过可信接入网注册(或附着)到移动通信网络时，default AMF使用的是从可信UDM获取的UE1的真实ID(如第一用户标识)。
可信支架NF可以包括UPF，该UPF可以是解密查看数据的UPF，可以不是网络中所有的UPF。或者，该可信支架NF还可以包括多接入边缘计算(multi edge compute，MEC)。该MEC与该UPF可以为两个不同的NF，或者，该MEC和该UPF还可以集成为一个NF。
在一些实现方式中，以上所示的可信数据NF、可信控制NF和可信支架NF可以由运营商配置等，即以静态的方式配置网络中的可信NF。相应的，该可信NF的相关信息可以保存于可信数据NF中。或者，该可信NF的相关信息(如预配置信息)还可以保存于NRF或NSSF中等。
在另一些实现方式中，以上所示的可信NF还可以由可信控制NF(如NRF)确定等。示例性的，如NRF可以确定与第一NF交互的第二NF。可选的，可信控制NF可以按照预置的NF类型(如AMF、SMF、UPF等类型)配置一些可信支架NF可以对所有UE都可信；或者，也可以配置一些可信支架NF对某些UE可信。如图7a中，对于UE1，UPF1可以作为可信支架NF。然而对于UE5(图7a中未示出)，与该UE5交互的可信支架NF不一定是UPF1。换句话说，可信控制NF可以配置一些可信支架NF，该可信支架NF对所有UE都可信；或者，该可信支架NF仅对某些UE可信等。
结合图2至图6d所示的方法，可信数据NF可以根据以下方法配置可信支架NF。示例性的，如：
1)按照用户标识(如第一用户标识等)签约数据的可信属性，配置可信支架NF、弱可信支架NF或不可信支架NF等。
2)按照用户标识的用户类型(例如普通用户，VIP用户)，配置可信支架NF、弱可信支架NF或不可信支架NF等。例如，对于VIP用户，为其配置的NF可以均为可信NF。对于普通用户，可以为其配置普通NF或弱可信NF等。
3)按照行业属性/数据不出园区等要求，为其配置可信支架NF；例如MEC和UPF1、UPF4共建的MEC1、MEC4等。
4)按照用户标识的会话属性，例如音视频通话或数据通信对安全要求高，或者此次会话要求高安全等级，则可以为其配置可信支架NF。
5)按照用户标识所属的切片，该切片对应的可信支架NF可为该用户标识提供可信服务。
在一种可能的实现方式中，可信数据NF还可以根据以下方式配置可信支架NF。
6)按照网络的安全管控需求，符合某种条件的必须经过某些可信支架NF检查；
7)按照网络的负载均衡，允许在某些可信支架NF之间分担；
8)按照网络的实时监控，认为某终端风险上升，调整可信支架NF和管控措施；
9)按照网络的边界防护措施，例如有抗病毒或者防火墙功能与否，来承担某一类用户的可信支架NF；
10)按照网络物理部署位置，选择合适的可信支架NF；
11)按照漫游协议、计费协议，选择合适的可信支架NF。
如表2，表2中示出了可信数据NF中用户标识的可信属性与网络配置策略的例子。
表2
Figure PCTCN2021089589-appb-000002
Figure PCTCN2021089589-appb-000003
表2中可信属性即表示用户标识(如第一用户标识)的可信属性，或者也可以理解为应用该用户标识的终端设备的可信属性。可信数据NF可表示保存用户标识的签约数据等信息的NF。表2中的可信数据NF可理解为本申请涉及的第三NF和/或第四NF。可信控制NF表示可理解为本申请涉及的第一NF、NRF或NSSF等。表2中的根据策略规则授信的可信NF可表示为终端设备提供服务的NF，该可信NF可理解为本申请涉及的第二NF。
示例性的，当用户标识的可信属性为VIP用户时，该策略规则可表示为为该VIP用户提供服务的NF是可信NF，该情况下，可信NF可以包括可信控制NF如SMF和/或AMF，以及可信支架NF如UPF等。如图7a中，UE1可以经过可信接入网、可信传输网、可信支架NF如UPF1、可信控制NF、可信数据NF以及可信支架NF如UPF4，与应用服务器进行交互。可选的，该VIP用户的用户标识还可以被假名化处理，从而保护该用户标识。进一步的，UE可以通过用户面密钥与UPF1、UPF4交互。
示例性的，当用户标识的可信属性为行业数据安全保护属性时，该策略规则可以为假名化处理该用户标识。如图7b中，UE2或UE3在接入网络时，可以将真实的用户标识进行加密或假名化处理等。可选的，该策略规则还可以包括UE利用用户面密钥与UPF交互。若该UE不支持通过用户面密钥与UPF交互(即UE不支持终端到核心网保护)，则该UE还可以与可信UPF交互。如图7b所示，UE2或UE3与应用服务器交互时，该UE2或UE3可以经过可信支架节点如UPF4，从而实现网络逐跳(HOP by HOP)加密或完整性保护(即UE2或UE3到UPF4的加密，以及UPF4到应用服务器的加密)等。
表3示出的是各个可信控制节点的功能。示例性的，该可信控制NF中可以保存NF的可信级别、NF集合的可信级别或切片的可信级别等。
表3
Figure PCTCN2021089589-appb-000004
Figure PCTCN2021089589-appb-000005
如表4所示，表4示出的是不同网络拓扑配置策略以及对不同用户标识的要求。可理解，表4还可以理解为表3的一种补充说明。
表4
Figure PCTCN2021089589-appb-000006
Figure PCTCN2021089589-appb-000007
如图7a和图7b所示，图7a和图7b是本申请实施例提供的一种安全通信的网络架构示意图。示例性的，网络架构中包括的可信数据NF可以如图7a中的UDM1；可信控制NF可以如图7a中的NRF/DNS/default AMF/NSSF；可信支架NF可以如图7a中的UPF1和UPF4。其余5GC中的NF(如AMF、SMF、UPF等)可以是弱可信的通用NF(或也可以称为普通NF)。例如，图7b中的AMF2、AMF3、SMF2、SMF3、UPF2或UPF3等可以是通用NF。通过部署一些可信NF，其余NF是通用NF，该种方式实现简单，且能够快速部署网络架构。应用图7a和图7b的终端设备可以为任意类型的设备，本申请实施例对于该终端设备的具体类型不作限定。
弱信任NF无法得到终端设备的真实用户标识。例如AMF2和AMF3可以从运营商的可信数据NF中获得UE2和UE3的假名化的用户标识，并通过该假名化的用户标识进行业务处理(也可以理解为数据和/或信令处理等)。AMF2和AMF3不需要感知真实的用户标识；进一步地，AMF2和AMF3可以根据假名化的用户标识生成根密钥，并进一步根据根密钥生成用户面密钥，通过SMF(如SMF2、SMF3)与可信支架节点UPF4交互。UE的用户面数据通过弱可信支架节点UPF2或UPF3发给可信支架UPF4节点时，由于该用户面数据可以通过UE与UPF4之间的用户面密钥加密，所以中间的弱可信支架节点UPF2或UPF3无法获知该UE的真实数据。
不可信NF可以是WiFi等容易监听空口的接入设备、或者广域网等有风险的传输NF等。用户数据在经过这些不可信NF时，必须是经过终端设备到可信支架NF加密或完整性保护的数据流、或e2e应用层保护。从而使得不可信NF(如UPF2或UPF3)无法知道UE的真实数据。
其中，UE1的可信属性符合预设条件，UE2和UE3的可信属性不符合预设条件。该UE1、UE2和UE3的签约数据等，可以保存于可信数据NF中。UE1、UE2、UE3签约运营商AN1，运营商AN1将真实的用户标识和真实的签约数据、真实的密钥等存放在可信数据NF(可信UDM、可信PCF、或者其中的可信数据库中等)。
图7a中，UE1为VIP用户，由此与该UE1交互的NF可以为可信级别高的NF如可信NF。示例性的，UE1可以经过可信接入网、可信传输网、可信第五代移动通信核心网(5G core，5GC)与应用服务器交互。该情况下，可选的，该UE1的用户标识可以以假名化的方式穿越不同NF。可选的，该UE1的用户标识还可以以真实的用户标识穿越不同的NF(或者在可信安全域中穿越)。
图7b中，UE2或UE3(如为普通用户等)可以经过不可信接入网或弱可信接入网、不可信传输网或弱可信传输网、弱可信5GC、可信支架节点如UPF4与应用服务器交互。该情况下，UE2或UE3的用户标识可以被假名化处理。或者，该UE2或UE3的用户数据还 可以被加密传输等。
示例性的，如图7b中UE2经过弱信任的接入网或不可信任的接入网接入5GC时，UE2的数据流可以根据业务需要可以进行e2e应用层保护、也可进行终端到可信支架NF(如UPF4)之间的数据保护。对于UE2和UE3的用户ID穿越不可信任区域(即不可信任域)如UPF2或UPF3到达UPF4时，将通过本申请中的假名化方案进行保护；也可通过本申请中的终端到可信支架NF(如UPF4)之间的用户面密钥进行用户面的数据加密和完整性保护。如果应用层数据保护，由于数据无法监管，要约定内容如若违法的责任。
图7b中UE3的具体描述可参考上述UE2，这里不再详述。
可理解，图7a和图7b所示的网络架构仅为示例，不应理解为对本申请实施例的限定。
由于一些国家对5GNF可信度的担心，使得大量的5GNF需要增加是否可信的监管措施，网络建设负担加重。实施本申请提供的安全通信方法，可以通过部署少量的可信NF如可信数据NF、可信控制NF和可信支架NF，该可信NF可以获得真实数据(如真实的用户标识或用户数据等)和网络拓扑，而其他NF则不需要知道这些内容，部署简单且效率高，提升了网络建设的可行性。
以下将详细介绍本申请实施例提供的通信装置。
图8是本申请实施例提供的一种通信装置的结构示意图，该通信装置可用于执行上述方法实施例中由终端设备执行的操作。例如，该通信装置可以用于执行图3a和/或图3b所示的方法。
如图8所示，该通信装置包括收发单元801和处理单元802。
其中，在一些实现方式中，收发单元801，用于接收第一NF发送的第一指示信息；其中，第一指示信息用于指示终端设备生成第二假名信息和/根密钥；
处理单元802，用于根据第一用户标识生成第二假名信息；以及根据第二假名信息生成根密钥；以及根据根密钥生成接入层密钥和/或非接入层密钥；其中，接入层密钥用于对终端设备与接入设备之间的数据和/或信令进行保护，非接入层密钥用于对终端设备与第一NF之间的数据和/或信令进行保护。
在另一些实现方式中，收发单元801，用于接收第一NF发送的第二指示信息；其中，第二指示信息用于指示终端设备生成用户面保护密钥；
处理单元802，用于根据第一用户标识生成第二假名信息；以及根据第二假名信息生成根密钥；以及根据根密钥生成用户面密钥；其中，用户面密钥用于对终端设备与用户面功能之间的数据进行保护。
本申请实施例中，对于第一用户标识、第二假名信息、根密钥或用户面密钥等的具体描述，可参考图2至图7b，这里不再一一详述。
需要理解的是，当上述通信装置是终端设备或终端设备中实现上述功能的部件时，处理单元802可以是一个或多个处理器，收发单元801可以是收发器，或者收发单元801还可以是发送单元和接收单元，发送单元可以是发送器，接收单元可以是接收器，该发送单元和接收单元集成于一个器件，例如收发器。
当上述通信装置是电路系统如芯片时，处理单元802可以是一个或多个处理器，或者 处理单元802可以是处理电路等。收发单元801可以是输入输出接口，又或者称为通信接口，或者接口电路，或接口等等。或者收发单元801还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。
本申请实施例的通信装置可执行上述方法实施例中由终端设备所执行的任意功能，具体可执行的步骤和/或功能可以参考上述方法实施例中的详细描述，此处仅简要概述，不再赘述。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的终端设备。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述终端设备所执行的功能或操作等。
例如，收发器可用于接收第一NF发送的第一指示信息。例如，处理器可以用于根据第一用户标识生成第二假名信息；根据该第二假名信息生成根密钥；根据该根密钥生成接入层密钥和/或非接入层密钥等。
又例如，收发器可用于接收第一NF发送的第二指示信息。例如，处理器可用于根据第一用户标识生成第二假名信息；或者，根据第二假名信息生成根密钥；或者，根据根密钥生成用户面密钥等。
对于处理器和收发器的具体实现方式，可参考图2至图7b所示的方法，这里不再一一详述。
在图9所示的通信装置的各个实现方式中，收发器可以包括接收机和发射机，该接收机用于执行接收的功能(或操作)，该发射机用于执行发射的功能(或操作)。以及收发器用于通过传输介质和其他设备/装置进行通信。处理器920通过收发器910收发数据和/或信令，并用于实现上述方法实施例中图3a和/或图3b所述的相应的方法等。
可选的，通信装置90还可以包括一个或多个存储器930，用于存储程序指令和/或数据。存储器930和处理器920耦合。示例性的，存储器930可以用于存储根密钥、接入层密钥或非接入层密钥等。
本申请实施例中的耦合是装置、单元或模块之间的间接耦合或通信连接，可以是电性，机械或其它的形式，用于装置、单元或模块之间的信息交互。处理器920可能和存储器930协同操作。处理器920可能执行存储器930中存储的程序指令。可选的，上述一个或多个存储器中的至少一个可以包括于处理器中。
本申请实施例中不限定上述收发器910、处理器920以及存储器930之间的具体连接介质。本申请实施例在图9中以存储器930、处理器920以及收发器910之间通过总线940连接，总线在图9中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在本申请实施例中，处理器可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是 微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成等。
可理解，在图9所示的通信装置为终端设备时，终端设备还可以具有比图9更多的元器件，例如，图9所示的终端设备还可以包括天线等，本申请实施例对此不作限定。
可理解，以上所示的处理器和收发器所执行的方法仅为示例，对于该处理器和收发器具体所执行的步骤可参照上文介绍的方法。
可理解，以上关于处理器、收发器和存储器之间连接关系的说明，以及该处理器的说明等，以下示出的核心设备均适用。例如该核心设备可以为第三NF、第四NF、NRF、NSSF或DNS等中的任一设备。
在另一些实现方式中，上述通信装置可以为终端设备中的电路系统。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。该处理电路1002可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接口电路1001可以为通信接口、输入输出接口等。
例如，接口电路，可以用于获取第一指示信息和/或第二指示信息。例如，处理电路，可以用于根据第一用户标识生成第二假名信息；根据该第二假名信息生成根密钥；根据该根密钥生成接入层密钥和/或非接入层密钥等。又例如，处理电路，还可以用于根据第一用户标识生成第二假名信息；根据第二假名信息生成根密钥；根据根密钥生成用户面密钥等。
对于处理电路和接口电路的具体实现方式，可参考图2至图7b所示的方法，这里不再一一详述。
在本申请实施例中，处理电路可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。可理解，对于处理电路的说明，以下示出的电路系统均适用，例如，对于电路系统为第三NF、第四NF、NRF、NSSF或DNS中任一NF的电路系统。
可理解，以上所示的接口电路和处理电路所执行的方法仅为示例，对于该接口电路和处理电路具体所执行的步骤可参照上文介绍的方法。
复用图8，图8是本申请实施例提供的一种通信装置的结构示意图，该通信装置可以用于执行上述方法实施例中由第一NF执行的操作。例如，该通信装置可用于执行图2至图6d中第一NF执行的方法。又例如，该通信装置还可以用于执行图7a中由可信控制NF执行的方法等。如图8所示，该通信装置包括收发单元801和处理单元802。
其中，在一些实现方式中，收发单元801，用于向第三NF发送第一请求消息，该第一请求消息携带终端设备的第一用户标识的第一假名信息；
收发单元801，还用于接收来自第三NF的第一响应消息，该第一响应消息携带第一用户标识的第二假名信息。
在一种可能的实现方式中，第一响应消息中还携带第一指示信息和/或第二指示信息，该第一指示信息用于指示生成第二假名信息和/或根密钥，该第二指示信息用于指示生成用 户面密钥。
在一种可能的实现方式中，处理单元802，还用于若第一响应消息中携带第一指示信息，则根据第二假名信息生成根密钥；
收发单元801，还用于向终端设备发送第一指示信息。
在一种可能的实现方式中，处理单元802，还用于若第一响应消息中携带第二指示信息，则根据第二假名信息生成用户面密钥；
收发单元801，还用于向终端设备发送第二指示信息。
在一种可能的实现方式中，收发单元801，还用于向用户面功能发送用户面密钥。
其中，在另一些实现方式中，收发单元801，用于向NRF发送第三请求消息，该第三请求消息携带可信级别；以及接收来自该NRF的第三响应消息，该第三响应消息携带第二NF的标识信息；该通信装置通过收发单元801与该第二NF进行数据和/或信令交互。
在一种可能的实现方式中，处理单元802，用于获取第一用户标识的可信属性；根据该第一用户标识的可信属性确定可信级别。
在一种可能的实现方式中，收发单元801，还用于向NSSF发送第四请求消息，该第四请求消息携带第一切片的标识信息；以及接收来自NSSF的第四响应消息，该第四响应消息携带该第一切片的可信级别；或者，该第四响应消息携带第二NF集合的可信级别。
在一种可能的实现方式中，第四响应消息携带该第一切片的可信级别时，第三请求消息携带第一切片的可信级别和该第一切片的标识信息；或者，第四响应消息携带第二NF集合的可信级别时，该第三请求消息携带第二NF集合的可信级别和该第二NF集合的标识信息。
在一种可能的实现方式中，收发单元801，还用于向NRF发送注册请求消息，该注册请求消息携带第一NF的可信级别。
在又一些实现方式中，收发单元801，还用于向DNS发送第五请求消息，该第五请求消息携带域名信息和可信级别；以及该收发单元801，还可以用于接收来自DNS的第二NF的标识信息。该第二NF的标识信息可以携带于第五响应消息中等。
需要理解的是，当上述通信装置是第一NF或第一NF(如核心设备或网元)中实现上述功能的部件时，处理单元802可以是一个或多个处理器，收发单元801可以是收发器，或者收发单元801还可以是发送单元和接收单元，发送单元可以是发送器，接收单元可以是接收器，该发送单元和接收单元集成于一个器件，例如收发器。
当上述通信装置是电路系统如芯片时，处理单元802可以是一个或多个处理器，或者处理单元802可以是处理电路等。收发单元801可以是输入输出接口，又或者称为通信接口，或者接口电路，或接口等等。或者收发单元801还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。可理解，通信装置为第三NF、第四NF、NRF、NSSF或DNS中的任一种时，对于该说明，以下示出的各通信装置均适用。
本申请实施例的通信装置可执行上述方法实施例中由第一NF所执行的任意功能，具体可执行的步骤和/或功能可以参考上述方法实施例中的详细描述，此处仅简要概述，不再赘述。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的第一NF，该第一NF可以为核心设备。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。复用图9，如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述第一NF所执行的功能或操作等。
示例性的，例如，收发器可用于向第三NF发送第一请求消息，以及接收来自第三NF的第一响应消息。例如，处理器，可用于若第一响应消息中携带第一指示信息，则根据第二假名信息生成根密钥；或者，处理器，可用于若第一响应消息中携带第二指示信息，则根据第二假名信息生成用户面密钥。又例如，收发器，还可用于向终端设备发送第一指示信息和/或第二指示信息。又例如，收发器，还可用于向用户面功能发送用户面密钥。
示例性的，例如，收发器可用于向NRF发送第三请求消息，以及接收来自NRF的第三响应消息。例如，处理器可用于获取第一用户标识的可信属性；根据该第一用户标识的可信属性确定可信级别。又例如，收发器还可用于向NSSF发送第四请求消息，以及接收NSSF发送的第四响应消息。又例如，收发器还可用于向NRF发送注册请求消息。
示例性的，例如，收发器还可以用于向DNS发送第五请求消息，以及接收来自DNS的第二NF的标识信息等。
可理解，对于第一请求消息、第一响应消息、第一指示信息、第二指示信息、第三请求消息等的具体描述，可参考图2至图7b。进一步的，对于处理器和收发器的具体实现方式，可参考图2至图7b所示的方法，这里不再一一详述。
可理解，该通信装置为第一NF的更多介绍，可参考前述实施例的描述，例如，可参考通信装置为终端设备时关于图9的描述，这里不再详述。可理解，在图9所示的通信装置为核心设备时，核心设备还可以具有比图9更多的元器件，例如，图9所示的核心设备还可以包括天线等，本申请实施例对此不作限定。
可理解，以上所示的处理器和收发器所执行的方法仅为示例，对于该处理器和收发器具体所执行的步骤可参照上文介绍的方法。
在另一些实现方式中，上述通信装置可以为第一NF中的电路系统。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。该处理电路1002可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接口电路1001可以为通信接口、输入输出接口等。
示例性的，例如，接口电路，可以用于获取第一响应消息、第三响应消息或第四响应消息等。或者，该接口电路，可以用于获取第二NF的标识信息。例如，接口电路，可以用于输出第一请求消息、第一指示信息、第二指示信息、用户面密钥、第三请求消息、第四请求消息、第五请求消息或注册请求消息等。例如，处理电路，可用于根据第二假名信息生成根密钥或用户面密钥等。又例如，处理电路，还可用于获取第一用户标识的可信属性；根据该第一用户标识的可信属性确定可信级别。
对于处理电路和接口电路的具体实现方式，可参考图2至图7b所示的方法，这里不再一一详述。可理解，该通信装置为第一NF的电路系统的更多介绍，可参考通信装置为终端设备的电路系统的描述，这里不再详述。
复用图8，图8是本申请实施例提供的一种通信装置的结构示意图，该通信装置可以用于执行上述方法实施例中由第三NF执行的操作。例如，该通信装置可用于执行图2至图6d中第三NF执行的方法。又例如，该通信装置还可以用于执行图7a中由可信数据NF执行的方法等。如图8所示，该通信装置包括收发单元801和处理单元802。
示例性的，例如，收发单元801，可用于接收来自第一NF的第一请求消息；处理单元802，可用于确定第一用户标识的可信属性；收发单元801，还用于向第一NF发送第一响应消息。
又例如，处理单元802，还可用于根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。
又例如，处理单元802还可用于控制存储器保存第二假名信息和第一用户标识的对应关系。
又例如，收发单元801，还可用于向第四NF发送第二请求消息，以及接收来自第四NF的第二假名信息等。
需要理解的是，当上述通信装置是第三NF或第三NF(如核心设备或网元)中实现上述功能的部件时，处理单元802可以是一个或多个处理器，收发单元801可以是收发器，或者收发单元801还可以是发送单元和接收单元，发送单元可以是发送器，接收单元可以是接收器，该发送单元和接收单元集成于一个器件，例如收发器。
当上述通信装置是电路系统如芯片时，处理单元802可以是一个或多个处理器，或者处理单元802可以是处理电路等。收发单元801可以是输入输出接口，又或者称为通信接口，或者接口电路，或接口等等。或者收发单元801还可以是发送单元和接收单元，发送单元可以是输出接口，接收单元可以是输入接口，该发送单元和接收单元集成于一个单元，例如输入输出接口。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的第三NF，该第三NF可以为核心设备。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。复用图9，如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述第三NF所执行的功能或操作等。
示例性的，例如，收发器，可用于接收来自第一NF的第一请求消息；处理器，可用于确定第一用户标识的可信属性；收发器，还用于向第一NF发送第一响应消息。又例如，处理器，还可用于根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。又例如，处理器还可用于控制存储器保存第二假名信息和第一用户标识的对应关系。或者，存储器，可以直接保存第二假名信息和第一用户标识的对应关系等。又例如，收发器还可用于向第四NF发送第二请求消息，以及接收来自第四NF的第二假名信息等。
在另一些实现方式中，上述通信装置可以为第三NF中的电路系统(或芯片、集成电路等)。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。该处理电路1002可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接 口电路1001可以为通信接口、输入输出接口等。
示例性的，例如，接口电路，可用于获取第一请求消息；处理电路，可用于确定第一用户标识的可信属性；接口电路，还用于输出第一响应消息。又例如，处理电路，还可用于根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息。又例如，处理电路还可用于控制存储器保存第二假名信息和第一用户标识的对应关系。又例如，接口电路还可用于输出第二请求消息，以及获取第二假名信息等。
本申请实施例的通信装置可执行上述方法实施例中由第三NF所执行的任意功能，具体可执行的步骤和/或功能可以参考上述方法实施例中的详细描述，此处仅简要概述，不再赘述。
复用图8，图8是本申请实施例提供的一种通信装置的结构示意图，该通信装置可以用于执行上述方法实施例中由第四NF执行的操作。例如，该通信装置可用于执行图2至图6d中第四NF执行的方法。又例如，该通信装置还可以用于执行图7a中由可信数据NF执行的方法等。如图8所示，该通信装置包括收发单元801和处理单元802。
示例性的，收发单元801，用于接收来自第三NF的第二请求消息，该第二请求消息携带终端设备的第一用户标识的第一假名信息；
处理单元802，用于响应于第二请求消息，根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息；
收发单元801，还可用于向第三NF发送第二假名信息。
在一种可能的实现方式中，处理单元802，还可用于保存第二假名信息和第一用户标识的对应关系。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的第四NF(如核心设备)。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述第四NF所执行的功能或操作等。
示例性的，例如，收发器用于接收来自第三NF的第二请求消息，该第二请求消息携带终端设备的第一用户标识的第一假名信息；处理器用于响应于第二请求消息，根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息；收发器还可用于向第三NF发送第二假名信息。又例如，处理器还可用于控制存储器保存第二假名信息和第一用户标识的对应关系。
可理解，对于以上各个消息等的具体描述，以及处理器和收发器的具体实现方式，可参考图2至图7b，这里不再一一详述。
在另一些实现方式中，上述通信装置可以为第四NF中的电路系统。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。
示例性的，例如，接口电路可用于获取第二请求消息，该第二请求消息携带终端设备的第一用户标识的第一假名信息；处理电路可用于响应于第二请求消息，根据第一假名信息得到第一用户标识，以及根据该第一用户标识生成第二假名信息；接口电路还可用于输 出第二假名信息。
又例如，处理电路还可用于控制存储器保存第二假名信息和第一用户标识的对应关系。或者，存储器可以直接保存第二假名信息和第一用户标识的对应关系等。
对于处理电路和接口电路的具体实现方式，以及对于以上示出的各个消息等的说明，可参考图2至图7b所示的方法，这里不再一一详述。
复用图8，该通信装置可以用于执行上述方法实施例中由NRF执行的操作。例如，该通信装置可用于执行图2至图6d中NRF执行的方法。又例如，该通信装置还可以用于执行图7a中由可信控制NF执行的方法等。如图8所示，该通信装置包括收发单元801和处理单元802。
示例性的，收发单元801，可用于接收来自第一NF的第三请求消息；处理单元802，可用于根据可信级别确定第二NF；收发单元801，还可用于向第一NF发送第三响应消息。
在一种可能的实现方式中，收发单元801，还可用于接收第二NF发送的注册请求消息；处理单元802，还可用于保存第二NF的标识信息和第二NF的可信级别的对应关系。
在一种可能的实现方式中，处理单元802，具体用于根据保存的第二NF的标识信息和该第二NF的可信级别的对应关系，以及第三请求消息中携带的可信级别，确定该第二NF。
在一种可能的实现方式中，第三请求消息携带可信级别包括：该第三请求消息携带第一切片的可信级别，以及该第三请求消息中还携带该第一切片的标识信息；处理单元802，具体用于根据第一切片的标识信息确定与该第一切片对应的第二NF集合；根据保存的NF的标识信息和该NF的可信级别的对应关系，以及该第一切片的可信级别，从第二NF集合中确定第二NF。
在一种可能的实现方式中，第三请求消息携带可信级别包括：第三请求消息携带第二NF集合的可信级别；以及该第三请求消息还携带第二NF集合的标识信息；处理单元802，具体用于根据保存的NF的标识信息和NF的可信级别的对应关系，以及第二NF集合的可信级别，从该第二NF集合中确定第二NF。
在一种可能的实现方式中，收发单元801，还可用于接收来自第一NF的注册请求消息，该注册请求消息携带第一NF的可信级别；处理单元802，还可用于保存该第一NF的标识信息和该第一NF的可信级别的对应关系。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的NRF，该NRF可以为核心设备。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。复用图9，如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述NRF所执行的功能或操作等。
示例性的，例如，收发器，可用于接收来自第一NF的第三请求消息；处理器，可用于根据可信级别确定第二NF；收发器，还可用于向第一NF发送第三响应消息。
又例如，收发器，还可用于接收第二NF发送的注册请求消息；处理器，还可用于保存第二NF的标识信息和第二NF的可信级别的对应关系。
又例如，收发器，还可用于接收来自第一NF的注册请求消息，该注册请求消息携带第一NF的可信级别；处理器，还可用于保存该第一NF的标识信息和该第一NF的可信级 别的对应关系。
在另一些实现方式中，上述通信装置可以为NRF中的电路系统。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。该处理电路1002可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接口电路1001可以为通信接口、输入输出接口等。
示例性的，例如，接口电路可用于获取第三请求消息；处理电路可用于根据可信级别确定第二NF；接口电路还可用于输出第三响应消息。
又例如，接口电路还可用于获取注册请求消息等。
可理解，关于NRF或NRF中的电路系统的具体实现方式以及以上各个消息的介绍等，可参考前述实施例，这里不再一一详述。
复用图8，该通信装置可以用于执行上述方法实施例中由NSSF执行的操作。例如，该通信装置可用于执行图2至图6d中NSSF执行的方法。又例如，该通信装置还可以用于执行图7a中由可信控制NF执行的方法等。如图8所示，该通信装置包括收发单元801和处理单元802。其中，
收发单元801，可用于接收第一NF发送的第四请求消息，该第四请求消息携带第一切片的标识信息；以及向第一NF发送第四响应消息，该第四响应消息携带第一切片的可信级别；或者，该第四响应消息携带第二NF集合的标识信息和该第二NF集合的可信级别，该第二NF集合为与第一切片对应的NF集合。
在一种可能的实现方式中，处理单元802，可用于根据第一预配置信息和第一切片的标识信息，确定该第一切片的可信级别，该第一预配置信息中包括第一切片的可信级别和该第一切片的标识信息的对应关系。
在一种可能的实现方式中，处理单元802，还可用于根据第二预配置信息和第一切片的标识信息，确定第二NF集合的可信级别，该第二预配置信息中包括第二NF集合的标识信息和第二NF集合的可信级别的对应关系。
在一些实现方式中，上述通信装置可以为上述各个方法实施例中的NSSF，该NSSF可以为核心设备。该情况下，上述收发单元801可以用收发器实现，上述处理单元802可以用处理器实现。复用图9，如图9所示，该通信装置90包括一个或多个处理器920和收发器910。该处理器和收发器可以用于执行上述NSSF所执行的功能或操作等。
示例性的，例如，收发器，可用于接收第一NF发送的第四请求消息，该第四请求消息携带第一切片的标识信息；以及向第一NF发送第四响应消息，该第四响应消息携带第一切片的可信级别；或者，该第四响应消息携带第二NF集合的标识信息和该第二NF集合的可信级别，该第二NF集合为与第一切片对应的NF集合。
又例如，处理器802，可用于根据第一预配置信息和第一切片的标识信息，确定该第一切片的可信级别，该第一预配置信息中包括第一切片的可信级别和该第一切片的标识信息的对应关系。
又例如，处理器802，还可用于根据第二预配置信息和第一切片的标识信息，确定第 二NF集合的可信级别，该第二预配置信息中包括第二NF集合的标识信息和第二NF集合的可信级别的对应关系。
在另一些实现方式中，上述通信装置可以为NSSF中的电路系统。该情况下，上述处理单元802可以用处理电路实现，收发单元801用接口电路实现。如图10所示，通信装置可以包括处理电路1002和接口电路1001。该处理电路1002可以为芯片、逻辑电路、集成电路、处理电路或片上系统(system on chip，SoC)芯片等，接口电路1001可以为通信接口、输入输出接口等。
示例性的，接口电路可用于获取第四请求消息，以及输出第四响应消息。处理电路可用于确定第一切片的可信级别或第二NF集合的可信级别等。
可理解，关于NSSF或NSSF中的电路系统的具体实现方式，以及以上各个消息的介绍等，可参考前述实施例，这里不再一一详述。
复用图8，该通信装置还可以用于执行上述方法实施例中由DNS执行的操作。例如，收发单元801可以用于接收来自第一NF的第五请求消息，该第五请求消息携带域名信息和可信级别；处理单元802可以用于响应于第五请求消息，根据该域名信息和可信级别确定第二NF；以及收发单元801还可以用于向第一NF发送该第二NF的标识信息。
在一些实现方式中，处理单元802可以用处理器实现，收发单元801可以用收发器实现。如图9所示，该处理器和收发器可以用于执行上述DNS执行的功能或操作等。示例性的，收发器，可以用于接收第五请求消息；处理器可以用于根据该域名信息和可信级别确定第二NF；以及收发器还可以用于向第一NF发送该第二NF的标识信息。
在另一些实现方式中，处理单元802还可以用处理电路实现，收发单元801还可以用接口电路实现。如图10所示，该接口电路可以用于获取第五请求消息，处理电路可以用于根据该域名信息和可信级别确定第二NF，该接口电路还可以用于输出该第二NF的标识信息。
本申请实施例的通信装置可执行上述方法实施例中由DNS所执行的任意功能，具体可执行的步骤和/或功能可以参考上述方法实施例中的详细描述，此处仅简要概述，不再赘述。
图11是本申请实施例提供的一种无线通信系统的示意图，如图11所示，该无线通信系统可以包括第一NF、第三NF、NRF和NSSF。进一步的，该无线通信系统还可以包括第四NF(图11中未示出)、终端设备(图11中未示出)和第二NF等。进一步的，该无线通信系统还可以包括DNS(图11中未示出)等。对于各个NF执行的步骤或功能，可参考前述实施例，这里不再详述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例提供的方案的技术效果。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个可读存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的可读存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由第一NF执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由第三NF执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由NRF执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由NSSF执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由终端设备执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由第四NF执行的操作和/或处理。
本申请还提供一种计算机程序，该计算机程序用于实现本申请提供的安全通信方法中由DNS执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由第一NF执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由第三NF执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由NRF执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由NSSF执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由终端设备执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由第四NF执行的操作和/或处理。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机代码，当计算机代码在计算机上运行时，使得计算机执行本申请提供的安全通信方法中由DNS执行的操作和/或处理。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由第一NF执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由第三NF执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由NRF执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由NSSF执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由终端设备执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由第四NF执行的操作和/或处理被实现。
本申请还提供一种计算机程序产品，该计算机程序产品包括计算机代码或计算机程序，当该计算机代码或计算机程序在计算机上运行时，使得本申请提供的安全通信方法中由DNS执行的操作和/或处理被实现。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (45)

  1. 一种安全通信方法，其特征在于，所述方法包括：
    第一网络功能NF向第三NF发送第一请求消息，所述第一请求消息携带终端设备的第一用户标识的第一假名信息；
    响应于所述第一请求消息，所述第三NF确定所述第一用户标识的可信属性；
    若所述第一用户标识的可信属性符合预设条件，则所述第三NF向所述第一NF发送第一响应消息，所述第一响应消息携带所述第一用户标识的第二假名信息。
  2. 根据权利要求1所述的方法，其特征在于，所述第三NF向所述第一NF发送第一响应消息，包括：
    若所述第一NF的可信级别匹配预设级别，则所述第三NF向所述第一NF发送所述第一响应消息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第三NF向所述第一NF发送第一响应消息，包括：
    若所述第一NF所在的安全域的可信级别匹配预设级别，则所述第三NF向所述第一NF发送所述第一响应消息。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第三NF确定所述第一用户标识的可信属性，包括：
    所述第三NF根据所述第一用户标识的签约等级确定所述第一用户标识的可信属性；或者，
    所述第三NF根据所述第一用户标识的会话属性确定所述第一用户标识的可信属性；或者，
    所述第三NF根据所述第一用户标识的行业要求确定所述第一用户标识的可信属性。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第三NF向所述第一NF发送第一响应消息之前，所述方法还包括：
    所述第三NF根据所述第一假名信息得到所述第一用户标识，以及根据所述第一用户标识生成所述第二假名信息。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述第三NF保存所述第二假名信息和所述第一用户标识的对应关系。
  7. 根据权利要求1-4任一项所述的方法，其特征在于，所述第三NF向所述第一NF发送第一响应消息之前，所述方法还包括：
    所述第三NF向第四NF发送第二请求消息，所述第二请求消息携带所述第一假名信息；
    响应于所述第二请求消息，所述第四NF根据所述第一假名信息得到所述第一用户标识，以及根据所述第一用户标识生成所述第二假名信息；
    所述第四NF向所述第三NF发送所述第二假名信息，所述第三NF接收所述第二假名信息。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述第一响应消息中还携带第一指示信息和/或第二指示信息，所述第一指示信息用于指示生成所述第二假名信息和/或根密钥，所述第二指示信息用于指示生成用户面密钥。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    若所述第一响应消息中包括所述第一指示信息，则所述第一NF根据所述第二假名信息生成所述根密钥；
    所述第一NF向所述终端设备发送所述第一指示信息。
  10. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    若所述第一响应消息中包括所述第二指示信息，则所述第一NF根据所述第二假名信息生成所述用户面密钥；
    所述第一NF向所述终端设备发送所述第二指示信息。
  11. 根据权利要求10述的方法，其特征在于，所述方法还包括：
    所述第一NF向用户面功能发送所述用户面密钥。
  12. 一种安全通信方法，其特征在于，所述方法包括：
    终端设备接收第一网络功能NF发送的第一指示信息；其中，所述第一指示信息用于指示所述终端设备生成第二假名信息和/或根密钥；
    所述终端设备根据第一用户标识生成所述第二假名信息；
    所述终端设备根据所述第二假名信息生成所述根密钥；
    所述终端设备根据所述根密钥生成接入层密钥和/或非接入层密钥；其中，所述接入层密钥用于对所述终端设备与接入设备之间的数据和/或信令进行保护，所述非接入层密钥用于对所述终端设备与所述第一NF之间的数据和/或信令进行保护。
  13. 一种安全通信方法，其特征在于，所述方法包括：
    终端设备接收第一NF发送的第二指示信息，所述第二指示信息用于指示所述终端设备生成用户面密钥；
    所述终端设备根据第一用户标识生成第二假名信息；
    所述终端设备根据所述第二假名信息生成根密钥；
    所述终端设备根据所述根密钥生成所述用户面密钥，所述用户面密钥用于对所述终端设备与用户面功能之间的数据进行保护。
  14. 一种安全通信方法，其特征在于，所述方法包括：
    第一网络功能NF向网络存储功能NRF发送第三请求消息，所述第三请求消息携带可信级别；
    响应于所述第三请求消息，所述NRF根据所述可信级别确定第二NF；
    所述NRF向所述第一NF发送所述第二NF的标识信息。
  15. 根据权利要求14所述的方法，其特征在于，所述NRF根据所述可信级别确定第二NF之前，所述方法还包括：
    所述NRF接收所述第二NF发送的注册请求消息，所述注册请求消息携带所述第二NF的可信级别；
    所述NRF保存所述第二NF的标识信息和所述第二NF的可信级别的对应关系。
  16. 根据权利要求15所述的方法，其特征在于，所述NRF根据所述可信级别确定第二NF，包括：
    所述NRF根据保存的所述第二NF的标识信息和所述第二NF的可信级别的对应关系， 以及所述第三请求消息中携带的所述可信级别，确定所述第二NF。
  17. 根据权利要求14-16任一项所述的方法，其特征在于，所述第一网络功能NF向网络存储功能NRF发送第三请求消息之前，所述方法还包括：
    所述第一NF从第三NF获取第一用户标识的可信属性；
    所述第一NF根据所述第一用户标识的可信属性确定所述可信级别。
  18. 根据权利要求14或15所述的方法，其特征在于，所述第一网络功能NF向网络存储功能NRF发送第三请求消息之前，所述方法还包括：
    所述第一NF向网络切片选择功能NSSF发送第四请求消息，所述第四请求消息携带第一切片的标识信息；
    所述NSSF向所述第一NF发送第四响应消息，所述第四响应消息中携带所述第一切片的可信级别。
  19. 根据权利要求18所述的方法，其特征在于，所述NSSF向所述第一NF发送第四响应消息之前，所述方法还包括：
    所述NSSF根据第一预配置信息和所述第一切片的标识信息，确定所述第一切片的可信级别，所述第一预配置信息中包括所述第一切片的可信级别和所述第一切片的标识信息的对应关系。
  20. 根据权利要求19所述的方法，其特征在于，所述第三请求消息携带可信级别包括：所述第三请求消息携带所述第一切片的可信级别；以及所述第三请求消息中还携带所述第一切片的标识信息；
    所述NRF根据所述可信级别确定第二NF，包括：
    所述NRF根据所述第一切片的标识信息确定与所述第一切片对应的第二NF集合；
    所述NRF根据保存的NF的标识信息和所述NF的可信级别的对应关系，以及所述第一切片的可信级别，从所述第二NF集合中确定所述第二NF。
  21. 根据权利要求14或15所述的方法，其特征在于，所述第一网络功能NF向网络存储功能NRF发送第三请求消息之前，所述方法还包括：
    所述第一NF向网络切片选择功能NSSF发送第四请求消息，所述第四请求消息携带第一切片的标识信息；
    所述NSSF向所述第一NF发送第四响应消息，所述第四响应消息中携带第二NF集合的标识信息和所述第二NF集合的可信级别，所述第二NF集合为与所述第一切片对应的NF集合。
  22. 根据权利要求21所述的方法，其特征在于，所述NSSF向所述第一NF发送第四响应消息之前，所述方法还包括：
    所述NSSF根据第二预配置信息和所述第一切片的标识信息，确定所述第二NF集合的可信级别，所述第二预配置信息中包括所述第二NF集合的标识信息和所述第二NF集合的可信级别的对应关系。
  23. 根据权利要求22所述的方法，其特征在于，所述第三请求消息携带可信级别包括：所述第三请求消息携带所述第二NF集合的可信级别；以及所述第三请求消息还携带所述第二NF集合的标识信息；
    所述NRF根据所述可信级别确定第二NF，包括：
    所述NRF根据保存的NF的标识信息和所述NF的可信级别的对应关系，以及所述第二NF集合的可信级别，从所述第二NF集合中确定所述第二NF。
  24. 一种安全通信方法，其特征在于，所述方法包括：
    域名系统DNS接收来自第一网络功能NF的第五请求消息，所述第五请求消息携带域名信息和可信级别；
    响应于所述第五请求消息，所述DNS根据所述域名信息和所述可信级别确定第二NF；
    所述DNS向所述第一NF发送所述第二NF的标识信息。
  25. 一种无线通信系统，其特征在于，所述系统包括：
    第一网络功能NF，用于向第三NF发送第一请求消息，所述第一请求消息携带终端设备的第一用户标识的第一假名信息；
    所述第三NF，用于响应于所述第一请求消息，确定所述第一用户标识的可信属性；以及若所述第一用户标识的可信属性符合预设条件，则向所述第一NF发送第一响应消息，所述第一响应消息携带所述第一用户标识的第二假名信息。
  26. 根据权利要求25所述的系统，其特征在于，
    所述第三NF，具体用于若所述第一NF的可信级别匹配预设级别，则向所述第一NF发送所述第一响应消息。
  27. 根据权利要求25或26所述的系统，其特征在于，
    所述第三NF，具体用于若所述第一NF所在的安全域的可信级别匹配预设级别，则向所述第一NF发送所述第一响应消息。
  28. 根据权利要求25-27任一项所述的系统，其特征在于，
    所述第三NF，具体用于根据所述第一用户标识的签约等级确定所述第一用户标识的可信属性；或者，
    所述第三NF，具体用于根据所述第一用户标识的会话属性确定所述第一用户标识的可信属性；或者，
    所述第三NF，具体用于根据所述第一用户标识的行业要求确定所述第一用户标识的可信属性。
  29. 根据权利要求25-28任一项所述的系统，其特征在于，
    所述第三NF，还用于根据所述第一假名信息得到所述第一用户标识，以及根据所述第一用户标识生成所述第二假名信息。
  30. 根据权利要求29所述的系统，其特征在于，
    所述第三NF，还用于保存所述第二假名信息和所述第一用户标识的对应关系。
  31. 根据权利要求25-28任一项所述的系统，其特征在于，
    所述第三NF，还用于向第四NF发送第二请求消息，所述第二请求消息携带所述第一假名信息；
    所述系统还包括：
    所述第四NF，用于响应于所述第二请求消息，根据所述第一假名信息得到所述第一用户标识，以及根据所述第一用户标识生成所述第二假名信息；以及向所述第三NF发送所 述第二假名信息；
    所述第三NF，还用于接收所述第二假名信息。
  32. 根据权利要求25-31任一项所述的系统，其特征在于，所述第一响应消息中还携带第一指示信息和/或第二指示信息，所述第一指示信息用于指示生成所述第二假名信息和/或根密钥，所述第二指示信息用于指示生成用户面密钥。
  33. 根据权利要求32所述的系统，其特征在于，
    所述第一NF，还用于若所述第一响应消息中包括所述第一指示信息，则根据所述第二假名信息生成所述根密钥；以及向所述终端设备发送所述第一指示信息。
  34. 根据权利要求32所述的系统，其特征在于，
    所述第一NF，还用于若所述第一响应消息中包括所述第二指示信息，则根据所述第二假名信息生成所述用户面密钥；以及向所述终端设备发送所述第二指示信息。
  35. 根据权利要求34所述的系统，其特征在于，
    所述第一NF，还用于向用户面功能发送所述用户面密钥。
  36. 一种无线通信系统，其特征在于，所述系统包括：
    第一网络功能NF，用于向网络存储功能NRF发送第三请求消息，所述第三请求消息携带可信级别；
    所述NRF，用于响应于所述第三请求消息，根据所述可信级别确定第二NF；以及向所述第一NF发送所述第二NF的标识信息。
  37. 根据权利要求36所述的系统，其特征在于，
    所述NRF，还用于接收所述第二NF发送的注册请求消息，所述注册请求消息携带所述第二NF的可信级别；以及保存所述第二NF的标识信息和所述第二NF的可信级别的对应关系。
  38. 根据权利要求37所述的系统，其特征在于，
    所述NRF，具体用于根据保存的所述第二NF的标识信息和所述第二NF的可信级别的对应关系，以及所述第三请求消息中携带的所述可信级别，确定所述第二NF。
  39. 根据权利要求36-38任一项所述的系统，其特征在于，
    所述第一NF，还用于从第三NF获取第一用户标识的可信属性；以及根据所述第一用户标识的可信属性确定所述可信级别。
  40. 根据权利要求36或37所述的系统，其特征在于，
    所述第一NF，还用于向网络切片选择功能NSSF发送第四请求消息，所述第四请求消息携带第一切片的标识信息；
    所述系统还包括：
    所述NSSF，用于向所述第一NF发送第四响应消息，所述第四响应消息中携带所述第一切片的可信级别。
  41. 根据权利要求40所述的系统，其特征在于，
    所述NSSF，还用于根据第一预配置信息和所述第一切片的标识信息，确定所述第一切片的可信级别，所述第一预配置信息中包括所述第一切片的可信级别和所述第一切片的标识信息的对应关系。
  42. 根据权利要求40所述的系统，其特征在于，所述第三请求消息携带可信级别包括：所述第三请求消息携带所述第一切片的可信级别；以及所述第三请求消息中还携带所述第一切片的标识信息；
    所述NRF，具体用于根据所述第一切片的标识信息确定与所述第一切片对应的第二NF集合；根据保存的NF的标识信息和所述NF的可信级别的对应关系，以及所述第一切片的可信级别，从所述第二NF集合中确定所述第二NF。
  43. 根据权利要求36或37所述的系统，其特征在于，
    所述第一NF，还用于向网络切片选择功能NSSF发送第四请求消息，所述第四请求消息携带第一切片的标识信息；
    所述系统还包括：
    所述NSSF，用于向所述第一NF发送第四响应消息，所述第四响应消息中携带第二NF集合的标识信息和所述第二NF集合的可信级别，所述第二NF集合为与所述第一切片对应的NF集合。
  44. 根据权利要求43所述的系统，其特征在于，
    所述NSSF，还用于根据第二预配置信息和所述第一切片的标识信息，确定所述第二NF集合的可信级别，所述第二预配置信息中包括所述第二NF集合的标识信息和所述第二NF集合的可信级别的对应关系。
  45. 根据权利要求44所述的系统，其特征在于，所述第三请求消息携带可信级别包括：所述第三请求消息携带所述第二NF集合的可信级别；以及所述第三请求消息还携带所述第二NF集合的标识信息；
    所述NRF，具体用于根据保存的NF的标识信息和所述NF的可信级别的对应关系，以及所述第二NF集合的可信级别，从所述第二NF集合中确定所述第二NF。
PCT/CN2021/089589 2020-04-27 2021-04-25 一种安全通信方法及装置 WO2021218851A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21796960.9A EP4135376A4 (en) 2020-04-27 2021-04-25 SECURE COMMUNICATION METHOD AND DEVICE

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202010345953.7 2020-04-27
CN202010345953 2020-04-27
CN202010389032.0A CN113645621B (zh) 2020-04-27 2020-05-09 一种安全通信方法及装置
CN202010389032.0 2020-05-09

Publications (1)

Publication Number Publication Date
WO2021218851A1 true WO2021218851A1 (zh) 2021-11-04

Family

ID=78374064

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/089589 WO2021218851A1 (zh) 2020-04-27 2021-04-25 一种安全通信方法及装置

Country Status (2)

Country Link
EP (1) EP4135376A4 (zh)
WO (1) WO2021218851A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115460270A (zh) * 2022-08-10 2022-12-09 深圳震有科技股份有限公司 一种5g upf违规业务阻断方法及相关设备
WO2024043812A1 (en) * 2022-08-26 2024-02-29 Telefonaktiebolaget Lm Ericsson (Publ) Trust based access control in communication network
CN117692902A (zh) * 2024-02-02 2024-03-12 深圳市迈腾电子有限公司 一种基于嵌入式家庭网关的智能家居的交互方法及系统
CN115460270B (zh) * 2022-08-10 2024-05-31 深圳震有科技股份有限公司 一种5g upf违规业务阻断方法及相关设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190007376A1 (en) * 2015-06-23 2019-01-03 Telefonaktiebolaget Lm Ericsson (Publ) Methods, network nodes, mobile entity, computer programs and computer program products for protecting privacy of a mobile entity
CN109673037A (zh) * 2017-10-17 2019-04-23 华为技术有限公司 一种网络功能发现方法及设备
CN109729522A (zh) * 2017-10-27 2019-05-07 普天信息技术有限公司 故障弱化模式下的空口加密方法及装置
WO2020057416A1 (zh) * 2018-09-17 2020-03-26 华为技术有限公司 信令传输的接口兼容方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190007376A1 (en) * 2015-06-23 2019-01-03 Telefonaktiebolaget Lm Ericsson (Publ) Methods, network nodes, mobile entity, computer programs and computer program products for protecting privacy of a mobile entity
CN109673037A (zh) * 2017-10-17 2019-04-23 华为技术有限公司 一种网络功能发现方法及设备
CN109729522A (zh) * 2017-10-27 2019-05-07 普天信息技术有限公司 故障弱化模式下的空口加密方法及装置
WO2020057416A1 (zh) * 2018-09-17 2020-03-26 华为技术有限公司 信令传输的接口兼容方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4135376A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115460270A (zh) * 2022-08-10 2022-12-09 深圳震有科技股份有限公司 一种5g upf违规业务阻断方法及相关设备
CN115460270B (zh) * 2022-08-10 2024-05-31 深圳震有科技股份有限公司 一种5g upf违规业务阻断方法及相关设备
WO2024043812A1 (en) * 2022-08-26 2024-02-29 Telefonaktiebolaget Lm Ericsson (Publ) Trust based access control in communication network
CN117692902A (zh) * 2024-02-02 2024-03-12 深圳市迈腾电子有限公司 一种基于嵌入式家庭网关的智能家居的交互方法及系统

Also Published As

Publication number Publication date
EP4135376A4 (en) 2024-01-03
EP4135376A1 (en) 2023-02-15

Similar Documents

Publication Publication Date Title
WO2021017550A1 (zh) 一种事件报告的发送方法、装置及系统
JP2014233078A (ja) ポリシー管理のための方法
US11871223B2 (en) Authentication method and apparatus and device
US20230014494A1 (en) Communication method, apparatus, and system
WO2021218851A1 (zh) 一种安全通信方法及装置
US20210127265A1 (en) Communication system
WO2021218878A1 (zh) 切片认证方法及装置
WO2021063298A1 (zh) 实现外部认证的方法、通信装置及通信系统
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
TW202203110A (zh) 關於區塊鏈啟用無線系統中的交易管理的方法、架構、設備、及系統
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
US11956715B2 (en) Communications method and apparatus
US20220086145A1 (en) Secondary Authentication Method And Apparatus
WO2023016160A1 (zh) 一种会话建立方法和相关装置
WO2023011630A1 (zh) 授权验证的方法及装置
CN113645621B (zh) 一种安全通信方法及装置
CN115379531A (zh) 通信方法和通信装置
US11432158B2 (en) Systems and methods for using a unique routing indicator to connect to a network
Pejanović-Djurišić et al. 5G security landscape: concept and remaining challenges
WO2021249325A1 (zh) 切片服务验证方法及其装置
US20240163670A1 (en) Wireless communication method and apparatus
WO2024032226A1 (zh) 通信方法和通信装置
WO2022021198A1 (zh) 通信方法及其装置
WO2024092443A1 (zh) 一种通信的方法和装置
WO2024032218A1 (zh) 通信方法和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21796960

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021796960

Country of ref document: EP

Effective date: 20221111

NENP Non-entry into the national phase

Ref country code: DE