WO2021233286A1 - 数据处理方法、装置、网络设备及终端 - Google Patents

数据处理方法、装置、网络设备及终端 Download PDF

Info

Publication number
WO2021233286A1
WO2021233286A1 PCT/CN2021/094335 CN2021094335W WO2021233286A1 WO 2021233286 A1 WO2021233286 A1 WO 2021233286A1 CN 2021094335 W CN2021094335 W CN 2021094335W WO 2021233286 A1 WO2021233286 A1 WO 2021233286A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
contract
information
subscription
terminal
Prior art date
Application number
PCT/CN2021/094335
Other languages
English (en)
French (fr)
Inventor
张鹏飞
康艳超
韩鲁峰
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2021233286A1 publication Critical patent/WO2021233286A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • This application belongs to the field of communication technology, and in particular relates to a data processing method, device, network device, and terminal.
  • a terminal User Equipment, UE
  • UDM unified data management entity
  • HPLMN Home Public Land Mobile Network
  • VPLMN Public Land Mobile Network
  • the subscription data may include subscription information of different subscription types such as Closed Access Group (CAG) information.
  • CAG information When the CAG information is transmitted to the terminal, it may be tampered with by the VPLMN, resulting in the terminal being unable to receive the correct CAG information of the HPLMN. Since the terminal cannot determine whether the received CAG information has been tampered with, the terminal may appear to perform services on the wrong network.
  • CAG Closed Access Group
  • the purpose of the embodiments of this application is to provide a data processing method, device, network equipment, and terminal, which can solve the problem that the terminal cannot judge whether the received CAG information has been tampered with, so that the terminal may perform services on the wrong network. problem.
  • a data processing method is provided, which is applied to a network device, including:
  • the registration acceptance message carrying second subscription data and protection data, and the protection data is used to verify whether the second subscription data is the subscription data after the first subscription data is tampered with .
  • a data processing method which is applied to a terminal, and includes:
  • the registration acceptance message carrying second subscription data and protection data
  • the second contract data is the contract data after the first contract data is tampered with, and the first contract data is stored by the unified data management entity UDM entity or stored by the third-party application function AF
  • the subscription data corresponding to the terminal is stored by the unified data management entity UDM entity or stored by the third-party application function AF.
  • a data processing device in a third aspect, includes:
  • the first receiving module is configured to receive a registration request message sent by the terminal
  • An obtaining module configured to obtain, based on the registration request message, the first contract data corresponding to the terminal stored by the unified data management entity UDM entity or stored by the third-party application function AF;
  • the first sending module is configured to send a registration acceptance message to the terminal, the registration acceptance message carrying second subscription data and protection data, and the protection data is used to verify whether the second subscription data is the first The contract data after the contract data has been tampered with.
  • a data processing device including:
  • the second sending module is used to send a registration request message to the network device
  • a second receiving module configured to receive a registration acceptance message sent by the network device based on the registration request message, where the registration acceptance message carries second subscription data and protection data;
  • the verification module is configured to determine, based on the second contract data and protection data, whether the second contract data is contract data after the first contract data is tampered with, the first contract data is stored by the unified data management entity UDM entity or The contract data corresponding to the terminal stored in the third-party application function AF.
  • a terminal in a fifth aspect, includes a processor, a memory, and a program or instruction that is stored on the memory and can run on the processor.
  • the program or instruction When the program or instruction is executed by the processor, Implement the steps of the method as described in the second aspect.
  • a network device in a sixth aspect, includes a processor, a memory, and a program or instruction that is stored on the memory and can run on the processor, and the program or instruction is executed by the processor. When executed, the steps of the method described in the first aspect are realized.
  • a readable storage medium is provided, and a program or instruction is stored on the readable storage medium.
  • the program or instruction When executed by a processor, it implements the steps of the method described in the first aspect, or implements The steps of the method described in the second aspect.
  • an embodiment of the present application provides a chip.
  • the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a network device program or instruction to implement the following:
  • the method described in one aspect may implement the method described in the second aspect.
  • embodiments of the present invention also provide a computer program product, which is stored in a readable storage medium, and the computer program product is executed by at least one processor to implement the method described in the first aspect or to implement the method described in the first aspect. The method described in the two aspects.
  • an embodiment of the present invention also provides a communication device, wherein the communication device is configured to execute the method described in the first aspect or implement the method described in the second aspect.
  • the registration request message sent by the terminal is received; based on the registration request message, the first subscription data corresponding to the terminal stored in the unified data management entity UDM entity or stored in the third-party application function AF is obtained; Sending a registration acceptance message, the registration acceptance message carrying second subscription data and protection data, and the protection data is used to verify whether the second subscription data is the subscription data after the first subscription data is tampered with.
  • the terminal can verify whether the second contract data is the contract data tampered with the first contract data based on the second contract data and the protection data, it is solved that the terminal cannot judge whether the received CAG information has been tampered with, thereby making the terminal There may be a problem of performing business on the wrong network.
  • FIG. 1 is a structural diagram of a network system applicable to an embodiment of the present application
  • FIG. 2 is one of the flowcharts of a data processing method provided by an embodiment of the present application
  • FIG. 3 is the second flowchart of a data processing method provided by an embodiment of the present application.
  • FIG. 4 is the third flowchart of a data processing method provided by an embodiment of the present application.
  • FIG. 5 is the fourth flowchart of a data processing method provided by an embodiment of the present application.
  • FIG. 6 is the fifth flowchart of a data processing method provided by an embodiment of the present application.
  • FIG. 7 is a structural diagram of a network device provided by an embodiment of the present application.
  • FIG. 8 is a structural diagram of a terminal provided by an embodiment of the present application.
  • FIG. 9 is a structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 10 is a structural diagram of another terminal provided by an embodiment of the present application.
  • FIG. 11 is a structural diagram of another communication device provided by an embodiment of the present application.
  • first and second in the specification and claims of this application are used to distinguish similar objects, but not to describe a specific sequence or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first” and “second” It is usually one type, and the number of objects is not limited.
  • the first object may be one or multiple.
  • “and/or” in the specification and claims represents at least one of the connected objects, and the character “/" generally indicates that the associated objects before and after are in an "or” relationship.
  • LTE Long Term Evolution
  • LTE-A Long Term Evolution-Advanced
  • CDMA Code Division Multiple Access
  • TDMA Time Division Multiple Access
  • FDMA Frequency Division Multiple Access
  • OFDMA Orthogonal Frequency Division Multiple Access
  • SC-FDMA Single-carrier Frequency-Division Multiple Access
  • system and “network” in the embodiments of this application are often used interchangeably, and the described technology can be used for the above-mentioned systems and radio technologies, as well as other systems and radio technologies.
  • NR New Radio
  • 6G 6th Generation
  • Fig. 1 shows a block diagram of a wireless communication system to which an embodiment of the present application can be applied.
  • the wireless communication system includes a terminal 11 and a network side device 12.
  • the terminal 11 may also be called a terminal device or a user terminal (User Equipment, UE), and the terminal 11 may be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), or a notebook computer or a personal digital device.
  • UE User Equipment
  • PDA Personal Digital Assistant
  • handheld computer netbook, ultra-mobile personal computer (UMPC), mobile Internet device (Mobile Internet Device, MID), wearable device (Wearable Device) or vehicle-mounted device (VUE), pedestrian terminal (PUE) and other terminal side devices
  • UMPC ultra-mobile personal computer
  • MID mobile Internet device
  • Wearable Device Wearable Device
  • VUE vehicle-mounted device
  • PUE pedestrian terminal
  • other terminal side devices wearable devices include: bracelets, earphones, glasses, etc. It should be noted that the embodiment of the present application does not limit the specific type of the terminal 11.
  • the network side device 12 may be a base station or a core network, where the base station may be called Node B, Evolved Node B, Access Point, Base Transceiver Station (BTS), radio base station, radio transceiver, basic service Set (Basic Service Set, BSS), Extended Service Set (Extended Service Set, ESS), Node B, Evolved Node B (eNB), Home Node B, Home Evolved Node B, WLAN Access Point, WiFi Node, Sending The receiving point (Transmitting Receiving Point, TRP) or some other appropriate term in the field, as long as the same technical effect is achieved, the base station is not limited to a specific technical vocabulary. It should be noted that, in the embodiments of this application, only The base station in the NR system is taken as an example, but the specific type of the base station is not limited.
  • CAG information list (information list) information processing.
  • the terminal sends a Registration Request (Registration Request) message
  • AMF Access and Mobility Management Function
  • the terminal sends a Registration Complete message to the network device
  • the AMF can send a Registration Reject (Registration Reject) message.
  • the content of the information can be as shown in Table 1 below.
  • FIG. 2 is a flowchart of a data processing method provided by an embodiment of the present application. The method is applied to a network device. As shown in FIG. 2, it includes the following steps:
  • Step 201 Receive a registration request message sent by a terminal
  • Step 202 Obtain the first subscription data corresponding to the terminal stored in a unified data management entity UDM entity or stored in a third-party application function (Application Function, AF) based on the registration request message;
  • AF Application Function
  • Step 203 Send a registration acceptance message to the terminal, where the registration acceptance message carries second subscription data and protection data, and the protection data is used to verify whether the second subscription data is tampered with the first subscription data. ’S contract data.
  • the terminal may send a registration request message to the AMF (V-AMF) where the VPLMN is visited when the VPLMN initiates registration.
  • V-AMF can register with the local UDM (H-UDM), for example, it can register with the H-UDM by calling the Nudm_UECM_Registration message of the H-UDM.
  • V-AMF can request the first subscription data from H-UDM through the first acquisition request message.
  • H-UDM can provide the first subscription data and the protection data corresponding to the first subscription data to V-AMF, and the V-AMF
  • the AMF sends and transparently transmits the received first subscription data and protection data to the terminal through the registration acceptance message.
  • the first acquisition request message may be referred to as a Nudm_SDM_Get request message.
  • the above-mentioned H-UDM may determine whether to provide the first subscription data to the V-AMF according to the first subscription data corresponding to the terminal or the local policy.
  • the first subscription data may be Stored locations have different behaviors.
  • the first contract data can be stored in the H-UDM or in the third-party AF.
  • the H-UDM may obtain the first contract data stored by the main body, or send a request to the third-party AF to obtain the first contract data stored by the third-party AF.
  • the VPLMN can tamper with or not tamper with the first contract data.
  • the second contract data is different from the first contract data; when the first contract data is not tampered with, the second contract data is the same as the first contract data.
  • the second contract data is the first contract data.
  • the above-mentioned first subscription data includes subscription information of N types of subscriptions, and N is a positive integer.
  • the modification of the first subscription data by the VPLMN can be understood as the modification of the specific value in the first subscription data by the VPLMN.
  • the above-mentioned second contract data includes contract information of the contract type in N, and the contract information is all the contract information of the terminal.
  • the type of contract information included in the first contract data can be set according to actual needs.
  • the type of subscription information may be referred to as a subscription type.
  • the subscription type may include CAG, that is, the above-mentioned first subscription data includes CAG information.
  • the first contract data is CAG information as an example for detailed description.
  • the terminal may determine, based on the second subscription data and the protection data, whether the second subscription data is the subscription data after the first subscription data is tampered with.
  • the registration request message sent by the terminal is received; based on the registration request message, the first subscription data corresponding to the terminal stored in the unified data management entity UDM entity or stored in the third-party application function AF is obtained; Sending a registration acceptance message, the registration acceptance message carrying second subscription data and protection data, and the protection data is used to verify whether the second subscription data is the subscription data after the first subscription data is tampered with.
  • the terminal can verify whether the second contract data is the contract data tampered with the first contract data based on the second contract data and the protection data, it is solved that the terminal cannot judge whether the received CAG information has been tampered with, thereby making the terminal There may be a problem of performing business on the wrong network.
  • the method before sending a registration acceptance message to the terminal based on the registration request message, the method further includes:
  • the H-UDM after the H-UDM receives the Nudm_SDM_Get request message sent by the V-AMF and decides to provide the first subscription data to the V-AMF, it can call the local authentication service function (Authentication Server Function, H-AUSF)
  • H-AUSF Authentication Server Function
  • the protection data is generated, and after the protection data is generated by the H-AUSF, the protection data is returned to the H-UDM.
  • H-UDM may send a protection request message to H-AUSF.
  • H-AUSF After receiving the protection request message, H-AUSF may generate the protection data, and send the generated protection data to H-UDM through a protection response message.
  • the protection request message may be referred to as a Nausf_CAGProtection request message
  • the protection response message may be referred to as a Nausf_CAGProtection Response message.
  • the aforementioned protection data may include first verification information and counter information.
  • the counter information is a parameter for calculating the verification information
  • the first verification information is used to verify the second subscription. Whether the data is contract data after the first contract data is tampered with.
  • the foregoing first verification information may be referred to as CAG-MAC-IAUSF, and the foregoing counter information may be referred to as Counter_cag.
  • the calculation method of the first verification information can be set according to actual needs.
  • the determining the protection data based on the first subscription data includes:
  • the first verification information can be generated based on the Key Authentication Server Function (KAUSF). Specifically, when the first verification information is generated, the following parameters can be used to form the key derivation function (Key derivation function, KDF) input:
  • KDF Key derivation function
  • FC Function calculation
  • L0 the length of the header information of the first subscription data
  • L1 length of counter information
  • P2 the list information of the contract information of the N types of contract
  • L2 the length of the list information of the contract information of the N types of contract.
  • the first check information is identified by the 128 least significant bits output by the KDF.
  • the counter information can be determined by a counter maintained in the terminal and UDM respectively.
  • obtaining the first subscription data corresponding to the terminal and stored by the third-party application function AF includes:
  • the first subscription data is acquired according to the identity of the public land mobile network of the visited place, the permanent contract identity of the terminal, and the contract type.
  • the H-UDM may send a second acquisition request message to the third-party AF, and the second acquisition request message may carry the public land mobile network identifier of the visitor, the terminal’s permanent subscription identifier and the type of subscription, and through the The second acquisition request message acquires the first subscription data of the terminal from the third AF.
  • the third AF determines the first subscription data according to the public land mobile network identifier of the visited place, the permanent subscription identifier of the terminal, and the subscription type, and passes the first subscription data through the second acquisition request
  • the response message is returned to H-UDM.
  • the form of the first contract data stored in the third AF can be set according to actual needs.
  • the first contract data is unencrypted contract data.
  • the first contract data is unencrypted.
  • the contract data is encrypted contract data.
  • the second acquisition request response message received by the H-UDM carries the subscription information list or the secured packet.
  • the foregoing second acquisition request message may be called Ncagaf_CAG_Obtain request message
  • the second acquisition request response message may be called Ncagaf_CAG_Obtain response message
  • the foregoing subscription information list may be called CAG information list. (the list of CAG information).
  • the second subscription data is the encrypted first subscription data, or the encrypted first subscription data
  • USIM Universal Subscriber Identity Module
  • the H-UDM may also perform encryption processing on the acquired first contract data.
  • the obtained first contract data is encrypted contract data
  • the first contract data will be encrypted twice; if the obtained first contract data is not in plaintext, that is, the unencrypted contract data, then the first contract will be The data is encrypted once.
  • the encrypted first contract data and protection data are sent to V-AMF.
  • the second contract data sent to the terminal can be understood as the encrypted first contract data; after the encrypted first contract data is tampered, it is sent to The second contract data of the terminal can be understood as the contract data obtained by tampering with the encrypted first contract data. Since the terminal stores the contract data in the USIM, the first contract data is encrypted, which improves the security of the use of the contract data.
  • the method further includes:
  • the terminal has successfully updated the first subscription data.
  • the terminal may first calculate the second verification based on the terminal's permanent subscription identifier, the header information of the second subscription data, the list information of the subscription information of the N types of subscriptions, and the counter information. Information; and then compare the first verification information and the second verification information to determine whether the second contract data is the contract data after the first contract data is tampered with.
  • the second contract data is the first contract data, or in other words, the second contract data is the contract data that has not been tampered with
  • the second contract data is the first contract data that has not been tampered with
  • the second contract data is the contract data after the first contract data has been tampered with, or in other words, the second contract data is the contract that has been tampered with data.
  • the calculation method of the terminal for the first identification value is the same as the calculation method of the network device for the second identification value.
  • a first identification value is sent based on the second subscription data, and the first identification value is used to indicate the second subscription The data is updated successfully.
  • the network device may compare the first identification value with a pre-stored second identification value to determine whether the terminal has successfully updated the first subscription data.
  • the second identification value is an identification value generated based on the first subscription data when the protection data is generated.
  • the terminal may send the first identification value to the V-AMF through a registration complete message (Registration Complete message), and the V-AMF may send the received first identification value to the H-UDM through the information message.
  • the UDM compares the first identification value and the second representation value to determine whether the terminal successfully receives the first subscription data, thereby determining whether the terminal successfully updates the first subscription data.
  • the transmission mode of the second subscription data and the protection data can be set according to actual needs.
  • the second subscription data and the protection data belong to the same information element, or the second subscription data Data and protection data belong to two independent cells respectively.
  • the IE in each row is used to indicate a cell.
  • the above-mentioned second subscription data and the protection data belong to two independent information elements, which can be understood as: the above-mentioned protection data can be transmitted as an independent information element.
  • the information element indication corresponding to the protection data can be added in the above table 1: the protection information of the contract data list.
  • the information element indication corresponding to the protection data may be expressed as CAG information list protection information. Specifically, it can be shown in Table 2 below.
  • the format of CAG information list protection information can adopt the following format:
  • the above-mentioned second subscription data and the protection data belong to the same information element, which can be understood as: adding the protection data to the information element corresponding to the second subscription data.
  • the information element to which the CAG information and the protection data belong can be expressed as a CAG transparent container. Specifically, it can be as shown in Table 3 below.
  • the coding format of the CAG transparent transmission container is as follows:
  • the information elements of the downlink CAG transparent transmission container containing the security packet include:
  • the CAG transparent transmission container can be replaced with a protected CAG information list (Protected CAG information list), and the format of the Protected CAG information list refers to the following embodiments.
  • Embodiment 1 After the V-AMF receives the protected CAG Information list from the H-UDM, it puts the protected CAG Information list in the CAG transparent container in the registration acceptance message and delivers it to the UE.
  • a method similar to SOR can be used to obtain the protected CAG Information list. As shown in Figure 3, the specific process is as follows:
  • Step 301 The UE initiates registration in the VPLMN and initiates a registration request to the V-AMF;
  • the V-AMF performs primary authentication (primary authentication), and after successful authentication, initiates a non-access layer security mode command (None Access Stratem Security Mode Command, NAS SMC) process.
  • primary authentication primary authentication
  • NAS SMC non-access layer security mode command
  • the V-AMF registers with the H-UDM by invoking the registration request message.
  • the registration request message is the Nudm_UECM_Registration message of the H-UDM.
  • Step 306 The V-AMF requests CAG information from the H-UDM through a first acquisition request message, and the first acquisition request message is a Nudm_SDM_Get request message.
  • the H-UDM decides to provide CAG information to the V-AMF according to the subscription information or the local policy.
  • the H-UDM requests the H-AUSF to generate the protection information of the CAG information by invoking the protection request service of the H-AUSF.
  • the protection request service of H-AUSF can be invoked through a protection request message.
  • the protection request message can be a Nausf_CAGProtection message.
  • the message can carry SUPI, the header information of the first subscription data, and the list of subscription information, where the first subscription
  • the header information of the data can be expressed as: CAG header, and the list information of the subscription information can be expressed as [List].
  • H-UDM requests the H-AUSF to generate protection information of CAG information by calling the Nausf_CAGProtection (SUPI, CAG header, [List]) protection request service of H-AUSF.
  • the H-AUSF After the H-AUSF generates the protection information of the CAG information, the H-AUSF returns the protection information of the CAG information to the H-UDM through a protection request response message.
  • the protection request response message may include CAG-MAC-IAUSF, Counter_cag, and the protection request response may be expressed as Nausf_CAG Protection Response.
  • H-AUSF returns the protection information of CAG information to H-UDM through Nausf_CAG Protection Response (CAG-MAC-IAUSF, Counter_cag). in:
  • the design method of CAG header is as follows:
  • CAG-MAC-IAUSF can be generated based on KAUSF. Specifically, when CAG-MAC-IAUSF is generated, the following parameters can be used to form KDF input:
  • FC indicates the function of calculating the key, such as 0x77;
  • L0 the length of the CAG header
  • L1 length of counter information
  • P2 CAG Information list information
  • L2 length of CAG Information list.
  • the first check information is the 128 least significant bit identifiers output by the KDF.
  • the counter information can be determined by a counter maintained in the terminal and UDM respectively.
  • Step 310 The H-UDM sends the CAG information and the protection letter to the V-AMF through the first acquisition response message.
  • the first acquisition response message may carry [List], CAG Header, CAG-MAC-IAUSF, and Counter_cag, and the first acquisition response message may indicate Nudm_SDM_Get_Response.
  • H-UDM sends CAG information and protection information to V-AMF through Nudm_SDM_Get_Response ([List], CAG Header, CAG-MAC-IAUSF, Counter_cag) message.
  • Step 311 After receiving the protected CAG Information list from the H-UDM, the V-AMF puts the protected CAG Information list in the CAG transparent container in the registration acceptance message and delivers it to the UE.
  • the content of the IE is shown in Table 3 above. .
  • step 312 the UE calculates CAG-MAC-IAUSF according to the received CAG Information list information, CAG Header, CAG-MAC-IAUSF, and Counter_cag using the same method in step 309. Determine whether the received CAG-MAC-IAUSF is equal to the calculated CAG-MAC-IAUSF.
  • the UE processes the newly received CAG Information list that is successfully checked in the same manner as the existing processing method, and executes step 313. If they are not equal, it is considered that the VPLMN has tampered with the CAG Information list sent by the HPLMN, and the process proceeds to step 314.
  • Step 313 Send a registration complete message (Registration Complete message) to the serving AMF to complete the registration process.
  • Step 314 Send a Registration Complete message to the serving AMF.
  • the UE discards the received CAG Information list and sets the current VPLMN as the network with the lowest priority during CAG selection; releases the current N1NAS signaling connection (signalling connection).
  • the priority during CAG selection can be understood as preset priority information.
  • Step 315 After the UE enters IDLE on the current network, it selects another network to try to apply for the service.
  • Other networks can be understood as at least one of the following: PLMN, TA area, CAG cell, or non-CAG cell.
  • Embodiment 2 H-UDM obtains CAG Information list from AF, and obtains CAG Information list protection information from H-AUSF. This AF may also become CAG-AF.
  • CAG Information list is stored on the AF. As shown in Figure 4, it specifically includes the following steps:
  • Steps 401-406 are the same as steps 301-306 in the first embodiment.
  • the H-UDM decides to provide CAG information to the V-AMF according to the subscription information or the local policy. If the HPLMN policy includes CAG-AF assistance information (CAG-AF invocation), it is necessary to obtain CAG information from CAG-AF. Then go to step 407a.
  • CAG-AF assistance information CAG-AF invocation
  • the H-UDM obtains CAG information from the CAG-AF through the second obtaining request message.
  • the second acquisition request message may carry the VPLMN identification (ID), the amount SUPI of the terminal, and the subscription type, and the second acquisition request message may be expressed as Ncagaf_CAG_Obtain request.
  • H-UDM can obtain CAG information from CAG-AF through Ncagaf_CAG_Obtain request (VPLMN ID, SUPI of the UE, CAG Type) message.
  • Step 407b CAG-AF returns CAG information to H-UDM through a second acquisition request response message.
  • the second acquisition request response message may carry [List], and the second acquisition request response message may be expressed as Ncagaf_CAG_Obtain response.
  • CAG-AF can return CAG information to H-UDM through Ncagaf_CAG_Obtain response ([List]) message.
  • Steps 408-415 are the same as steps 308-315 in the first embodiment.
  • Embodiment 3 H-UDM requires the UE to confirm the CAG information update result. As shown in Figure 5, it includes the following steps:
  • Steps 501-507 are the same as steps 301-307 in the first embodiment.
  • Step 508 H-UDM can send the Nausf_CAGProtection(SUPI, CAG header, [List]) message of H-AUSF, and use the information element CAG header to determine whether the UE needs to return an ack message after successfully updating the CAG information .
  • H-AUSF needs to return CAG-XMAC-IUE, CAG-MAC-IAUSF and Counter_cag to H-UDM in the Nausf_CAGProtection Response (CAG-MAC-IAUSF, Counter_cag) message. It is not sent to the UE, but stored in UDM for ack verification.
  • CAG-MAC-IAUSF can be generated based on KAUSF.
  • KDF input the following parameters can be used to form KDF input:
  • L1 length of counter information
  • CAG-MAC-IUE is identified by the 128 least significant bits output by KDF.
  • Steps 509-512 are the same as steps 309-3012 in the first embodiment.
  • Step 513a After the verification is successful, the UE calculates the CAG-MAC-IUE and sends it to the V-AMF through the Registration Complete message. Among them: CAG-XMAC-IUE and CAG-MAC-IUE have the same calculation method.
  • Step 514 V-AMF sends CAG-MAC-IUE to H-UDM through an information message.
  • the information message can be expressed as Nudm_SDM_Info message.
  • V-AMF can send CAG-MAC-IUE to H-UDM through Nudm_SDM_Info message. -UDM.
  • Step 516 The H-UDM compares the received CAG-MAC-IUE with the stored CAG-XMAC-IUE to determine whether the UE successfully receives the CAG information.
  • steps are the same as steps 314 and 315 in the first embodiment.
  • Embodiment 4 H-UDM updates CAG information while updating SOR information. Specifically, as shown in FIG. 6, in this embodiment, compared with the first embodiment, only steps 108 and 111 in the first embodiment are different, and the rest are the same. Step 108 and step 111 will be described in detail below.
  • step 108 if the subscription data type requested by Nudm_SDM_Get in step 106 contains CAG information, then in step 108, H-UDM can call AUSF's Nausf_SORProtection(SUPI, SOR header, [[SOR info],[CAG info,... .], [ACK Indication])
  • the service encrypts information such as CAG, that is, obtains protection information such as SOR-MAC-IAUSF, [SOR-XMAC-IUE] and CounterSOR.
  • SOR-MAC-IAUSF can be generated based on KAUSF. Specifically, when generating SOR-MAC-IAUSF, the following parameters can be used to form KDF input (When deriving a SOR-MAC-IAUSF from KAUSF, the following parameters shall be used to form the input S to the KDF):
  • FC indicates the function of calculating the key, such as 0x77;
  • L0 the length of the SOR header
  • P2 list information
  • the list information includes at least one of the following: SOR parameters, CAG information (list which including at least one of the following: PLMN ID and access technology, CAG information).
  • L2 length of SOR information list data (length of SOR Information list data).
  • the input key KEY is KAUSF (The input key KEY shall be KAUSF).
  • SOR-MAC-IAUSF is the 128 least significant bit flags output by KDF.
  • Step 111 The V-AMF sends information such as CAG and its protection information to the UE through a Registration Accept message.
  • the encoding format of the parameters of the Registration Accept message is as follows:
  • the SOR transparent transmission container information list is as follows:
  • Embodiment 5 After the V-AMF receives the protected CAG Information list from the H-UDM, it puts the CAG Information list and its protection information in the registration acceptance message and delivers it to the UE in the registration acceptance message.
  • the protection information can belong to an independent information element, that is, a CAG information list protection information (CAG information list protection information) is added to the IE content of the registration acceptance message.
  • CAG information list protection information CAG information list protection information
  • Embodiment 6 After the V-AMF receives the protected CAG Information list from the H-UDM, it adds the protection information to the IE CAG Information list, and then sends it to the UE in the registration acceptance message.
  • the protection information and the CAG information belong to one cell. It is the protected CAG information list (Protected CAG information list). As shown in the following table:
  • the format of the protected CAG information list (Protected CAG information list) is as follows:
  • the information element (CAG information list information element) of the information list is as follows:
  • the above MCC can be understood as a mobile country code (mobile country code).
  • the above-mentioned MCC number 1 can be expressed as MCC digit 1.
  • CAG-ID can be understood as the index or identification of CAG.
  • Embodiment 7 security packet.
  • the cell [List] represents security packet (that is, protected CAG information), and the security packet is protected by UDM through a preset encryption method .
  • FIG. 6 is a flowchart of another data processing method provided by an embodiment of the present application. The method is applied to a terminal, as shown in FIG. 6, and includes the following steps:
  • Step 601 Send a registration request message to the network device
  • Step 602 Receive a registration acceptance message sent by the network device based on the registration request message, where the registration acceptance message carries second subscription data and protection data;
  • Step 603 Determine, based on the second contract data and the protection data, whether the second contract data is contract data after the first contract data is tampered with, and the first contract data is stored by a unified data management entity UDM entity or a third-party application The subscription data corresponding to the terminal stored in the function AF.
  • the second subscription data includes subscription information of N types of subscriptions, and N is a positive integer.
  • the protection data includes first check information and counter information
  • the counter information is a parameter for calculating the check information
  • the check information is used to check whether the second subscription data is The contract data after the first contract data is tampered with.
  • the determining whether the second contract data is the contract data after the first contract data is tampered with based on the second contract data and the protection data includes:
  • the second subscription data is encrypted first subscription data, or the encrypted first subscription data has been tampered with After the contract data.
  • the first subscription data includes closed access group CAG information.
  • the method further includes:
  • a first identification value is sent based on the second contract data, and the first identification value is used to indicate that the second contract data is successfully updated.
  • the method further includes:
  • the first operation includes at least one of the following: discarding the second subscription data; setting the preset priority information of the public land mobile network of the visited place to the lowest priority, and the preset priority information is used to indicate the subscription-based The priority information of the data selection network; release the connection and enter the idle state.
  • the method further includes:
  • the second subscription data and the protection data belong to the same cell, or the second subscription data and the protection data belong to two independent cells.
  • this embodiment is used as an implementation manner of the terminal corresponding to the embodiment shown in FIG. 2.
  • specific implementation manners please refer to the related description of the embodiment shown in FIG. Note, I won’t repeat it here.
  • the execution subject of the data processing method provided in the embodiments of the present application may be a data processing device, or a control module for executing the data processing method in the data processing device.
  • a method for performing data processing by a data processing apparatus is taken as an example to illustrate the data processing apparatus provided in the embodiment of the present application.
  • FIG. 7 is a structural diagram of a network device provided by an embodiment of the present application. As shown in FIG. 7, the network device 700 includes:
  • the first receiving module 701 is configured to receive a registration request message sent by the terminal;
  • the obtaining module 702 is configured to obtain, based on the registration request message, the first contract data corresponding to the terminal stored by the unified data management entity UDM entity or stored by the third-party application function AF;
  • the first sending module 703 is configured to send a registration acceptance message to the terminal, where the registration acceptance message carries second subscription data and protection data, and the protection data is used to verify whether the second subscription data is the first 1. Contract data after the contract data has been tampered with.
  • the first subscription data includes subscription information of N types of subscriptions, and N is a positive integer.
  • the network device 700 further includes:
  • the first determining module is configured to determine the protection data based on the first subscription data.
  • the protection data includes first check information and counter information
  • the counter information is a parameter for calculating the check information
  • the first check information is used to check whether the second subscription data is It is the contract data after the first contract data is tampered with.
  • the first determining module is specifically configured to, according to the terminal's contract permanent identification, the header information of the first contract data, the list information of the contract information of the N types of contract types, and the counter information, Calculate the first verification information.
  • the acquiring module 702 is specifically configured to acquire the first subscription data according to the public land mobile network identifier of the visited place, the permanent subscription identifier of the terminal, and the subscription type.
  • the second subscription data is encrypted first subscription data, or the encrypted first subscription data has been tampered with After the contract data.
  • the first subscription data includes closed access group CAG information.
  • the network device 700 further includes a second determining module, where:
  • the first receiving module 701 is further configured to receive a first identification value sent by the terminal based on the second contract data in a case where the terminal determines that the second contract data is contract data that has not been tampered with;
  • the second determining module is configured to determine that the terminal updates the first subscription data when the first identification value is the same as the second identification value stored by the network device and corresponding to the first subscription data. success.
  • the second subscription data and the protection data belong to the same cell, or the second subscription data and the protection data belong to two independent cells.
  • the network device provided in the embodiment of the present application can implement each process implemented by the network device in the method embodiment in FIG. 2. To avoid repetition, details are not described herein again.
  • FIG. 8 is a structural diagram of a terminal provided by an embodiment of the present application. As shown in FIG. 8, a terminal 800 includes:
  • the second sending module 801 is configured to send a registration request message to a network device
  • the second receiving module 802 is configured to receive a registration acceptance message sent by the network device based on the registration request message, where the registration acceptance message carries second subscription data and protection data;
  • the verification module 803 is configured to determine, based on the second contract data and protection data, whether the second contract data is contract data tampered with the first contract data, and the first contract data is stored by the unified data management entity UDM entity Or the contract data corresponding to the terminal stored in the third-party application function AF.
  • the second subscription data includes subscription information of N types of subscriptions, and N is a positive integer.
  • the protection data includes first check information and counter information
  • the counter information is a parameter for calculating the check information
  • the check information is used to check whether the second subscription data is The contract data after the first contract data is tampered with.
  • the verification module 803 includes:
  • a calculation unit configured to calculate the second verification information according to the terminal's permanent subscription identifier, the header information of the second subscription data, the list information of the subscription information of the N types of subscriptions, and the counter information;
  • the comparing unit is configured to compare the first verification information and the second verification information, and determine whether the second contract data is contract data after the first contract data is tampered with.
  • the second subscription data is encrypted first subscription data, or the encrypted first subscription data has been tampered with After the contract data.
  • the first subscription data includes closed access group CAG information.
  • the second sending module 801 is further configured to send a first identification value based on the second contract data in a case where it is determined that the second contract data is contract data that has not been tampered with, and the first identification value is An identification value is used to indicate that the second subscription data is updated successfully.
  • the terminal 800 further includes:
  • a processing module configured to perform a first operation in a case where it is determined that the second contract data is the contract data that has been tampered with;
  • the first operation includes at least one of the following: discarding the second subscription data; setting the preset priority information of the public land mobile network of the visited place to the lowest priority, and the preset priority information is used to indicate the subscription-based The priority information of the data selection network; release the connection and enter the idle state.
  • the terminal 800 further includes:
  • the processing module is used for reselecting the public land mobile network after the terminal enters the idle state.
  • the second subscription data and the protection data belong to the same cell, or the second subscription data and the protection data belong to two independent cells.
  • the terminal provided in the embodiment of the present application can implement each process implemented by the terminal in the method embodiment of FIG. 6, and to avoid repetition, details are not described herein again.
  • the data processing device in the embodiment of the present application may be a device, or a component, integrated circuit, or chip in a terminal.
  • the device can be a mobile terminal or a non-mobile terminal.
  • the mobile terminal may include, but is not limited to, the types of terminals listed above.
  • the non-mobile terminal may be a server, a network attached storage (NAS), a personal computer (PC), and a television (television). , TV), teller machines or self-service kiosks, etc., the embodiments of this application do not make specific limitations.
  • the data processing device in the embodiment of the present application may be a device with an operating system.
  • the operating system may be an Android operating system, an ios operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.
  • the data processing device provided in the embodiment of the present application can implement each process implemented by the method embodiment in FIG. 6 and achieve the same technical effect. To avoid repetition, details are not described herein again.
  • an embodiment of the present application further provides a communication device 900, including a processor 901, a memory 902, and a program or instruction that is stored in the memory 902 and can run on the processor 901,
  • a communication device 900 including a processor 901, a memory 902, and a program or instruction that is stored in the memory 902 and can run on the processor 901
  • the communication device 900 is a terminal
  • the program or instruction is executed by the processor 901
  • each process of the foregoing data processing method embodiment is implemented, and the same technical effect can be achieved.
  • the communication device 900 is a network-side device
  • the program or instruction is executed by the processor 901
  • each process of the foregoing data processing method embodiment is realized, and the same technical effect can be achieved. To avoid repetition, details are not described herein again.
  • FIG. 10 is a schematic diagram of the hardware structure of a terminal that implements each embodiment of the present application.
  • the terminal 1000 includes but is not limited to: a radio frequency unit 1001, a network module 1002, an audio output unit 1003, an input unit 1004, a sensor 1005, a display unit 1006, a user input unit 1007, an interface unit 1008, a memory 1009, a processor 1010 and other components.
  • the terminal 1000 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 1010 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. Management and other functions.
  • a power source such as a battery
  • the terminal structure shown in FIG. 10 does not constitute a limitation on the terminal.
  • the terminal may include more or less components than shown in the figure, or combine some components, or different component arrangements, which will not be repeated here.
  • the input unit 1004 may include a graphics processing unit (GPU) 10041 and a microphone 10042.
  • the graphics processor 10041 is paired by the image capture device ( For example, the image data of the still picture or video obtained by the camera is processed.
  • the display unit 1006 may include a display panel 10061, and the display panel 10061 may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like.
  • the user input unit 1007 includes a touch panel 10071 and other input devices 10072.
  • the touch panel 10071 is also called a touch screen.
  • the touch panel 10071 may include two parts, a touch detection device and a touch controller.
  • Other input devices 10072 may include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackball, mouse, and joystick, which will not be repeated here.
  • the radio frequency unit 1001 receives the downlink data from the network-side device and sends it to the processor 1010 for processing; in addition, it sends the uplink data to the network device.
  • the radio frequency unit 1001 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.
  • the memory 1009 can be used to store software programs or instructions and various data.
  • the memory 109 may mainly include a storage program or instruction area and a data storage area.
  • the storage program or instruction area may store an operating system, an application program or instruction required by at least one function (such as a sound playback function, an image playback function, etc.).
  • the memory 1009 may include a high-speed random access memory, and may also include a non-volatile memory, where the non-volatile memory may be a read-only memory (Read-Only Memory, ROM) or a programmable read-only memory (Programmable ROM).
  • PROM erasable programmable read-only memory
  • Erasable PROM EPROM
  • Electrically erasable programmable read-only memory Electrically EPROM, EEPROM
  • flash memory For example, at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • the processor 1010 may include one or more processing units; optionally, the processor 1010 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, and application programs or instructions, etc.
  • the modem processor mainly deals with wireless communication, such as a baseband processor. It can be understood that the foregoing modem processor may not be integrated into the processor 1010.
  • the radio frequency unit 1001 is configured to send a registration request message to a network device; receive a registration acceptance message sent by the network device based on the registration request message, the registration acceptance message carrying second subscription data and protection data;
  • the processor 1010 is configured to determine, based on the second contract data and the protection data, whether the second contract data is contract data tampered with the first contract data, the first contract data being stored by a unified data management entity UDM entity, or The contract data corresponding to the terminal stored in the third-party application function AF.
  • processor 1010 and radio frequency unit 1001 can implement various processes implemented by the terminal in the method embodiment of FIG.
  • the embodiment of the present application also provides a network side device.
  • the network equipment 1100 includes: an antenna 1101, a radio frequency device 1102, and a baseband device 1103.
  • the antenna 1101 is connected to the radio frequency device 1102.
  • the radio frequency device 1102 receives information through the antenna 1101, and sends the received information to the baseband device 1103 for processing.
  • the baseband device 1103 processes the information to be sent and sends it to the radio frequency device 1102, and the radio frequency device 1102 processes the received information and sends it out via the antenna 1101.
  • the foregoing frequency band processing apparatus may be located in the baseband apparatus 1103, and the method executed by the network side device in the above embodiment may be implemented in the baseband apparatus 1103.
  • the baseband apparatus 1103 includes a processor 1104 and a memory 1105.
  • the baseband device 1103 may include, for example, at least one baseband board, and multiple chips are arranged on the baseband board, as shown in FIG.
  • the network device shown in the above method embodiment operates.
  • the baseband device 1103 may also include a network interface 1106 for exchanging information with the radio frequency device 1102.
  • the interface is, for example, a common public radio interface (CPRI).
  • CPRI common public radio interface
  • the network side device of the embodiment of the present invention further includes: instructions or programs stored in the memory 1105 and capable of running on the processor 1104, and the processor 1104 calls the instructions or programs in the memory 1105 to execute the modules shown in FIG. 2
  • the embodiment of the present application also provides a readable storage medium with a program or instruction stored on the readable storage medium.
  • the program or instruction is executed by a processor, each process of the foregoing data processing method embodiment is realized, and the same can be achieved. In order to avoid repetition, I won’t repeat them here.
  • the processor is the processor in the electronic device described in the foregoing embodiment.
  • the readable storage medium includes a computer readable storage medium, such as a computer read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk, or optical disk.
  • An embodiment of the present application further provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a network device program or instruction to implement the foregoing data processing method
  • the chip includes a processor and a communication interface
  • the communication interface is coupled to the processor
  • the processor is used to run a network device program or instruction to implement the foregoing data processing method
  • chips mentioned in the embodiments of the present application may also be referred to as system-level chips, system-on-chips, system-on-chips, or system-on-chips.
  • the embodiment of the present invention also provides a computer program product, which is stored in a readable storage medium, and the computer program product is executed by at least one processor to implement each process of the foregoing data processing method embodiment, and can achieve the same technology The effect, in order to avoid repetition, will not be repeated here.
  • the embodiment of the present invention also provides a communication device, wherein the communication device is used to execute each process of the foregoing data processing method embodiment, and can achieve the same technical effect. In order to avoid repetition, it will not be repeated here.
  • modules, units, sub-modules, sub-units, etc. can be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (Digital Signal Processing, DSP), digital signal processing equipment ( DSP Device, DSPD), Programmable Logic Device (PLD), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), general-purpose processors, controllers, microcontrollers, microprocessors, Other electronic units or combinations thereof that perform the functions described in this application.
  • ASICs application specific integrated circuits
  • DSP Digital Signal Processing
  • DSP Device digital signal processing equipment
  • PLD Programmable Logic Device
  • Field-Programmable Gate Array Field-Programmable Gate Array
  • FPGA Field-Programmable Gate Array
  • the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, The optical disc) includes several instructions to make a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a base station, etc.) execute the methods described in the various embodiments of the present application.
  • a terminal which can be a mobile phone, a computer, a server, an air conditioner, or a base station, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种数据处理方法、装置、网络设备及终端，该方法包括：接收终端发送的注册请求消息；基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。

Description

数据处理方法、装置、网络设备及终端
相关申请的交叉引用
本申请主张在2020年5月22日在中国提交的中国专利申请号No.202010443863.1的优先权，其全部内容通过引用包含于此。
技术领域
本申请属于通信技术领域，尤其涉及一种数据处理方法、装置、网络设备及终端。
背景技术
众所周知，终端(User Equipment，UE)在漫游地注册时，通常需要从本地公共陆地移动网络(Home Public Land Mobile Network，HPLMN)的统一数据管理实体(Unified Data Management，UDM)获取签约数据，访问地公共陆地移动网络(Visited Public Land Mobile Network，VPLMN)。该签约数据可以包括封闭接入组(Closed Access Group，CAG)信息等不同的签约类型的签约信息，CAG信息传输到终端时，可能会被VPLMN篡改，导致终端无法接收到HPLMN的正确CAG信息。由于终端无法对接收到的CAG信息是否被篡改进行判断，从而使得终端可能出现在错误的网络上执行业务。
发明内容
本申请实施例的目的是提供一种数据处理方法、装置、网络设备及终端，能够解决终端无法对接收到的CAG信息是否被篡改进行判断，从而使得终端可能出现在错误的网络上执行业务的问题。
为了解决上述技术问题，本申请是这样实现的：
第一方面，提供了一种数据处理方法，应用于网络设备，包括：
接收终端发送的注册请求消息；
基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；
向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
第二方面，提供了一种数据处理方法，应用于终端，包括：
向网络设备发送注册请求消息；
接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的签约数据。
第三方面，提供了一种数据处理装置，所述数据处理装置包括：
第一接收模块，用于接收终端发送的注册请求消息；
获取模块，用于基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；
第一发送模块，用于向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
第四方面，提供了一种数据处理装置，包括：
第二发送模块，用于向网络设备发送注册请求消息；
第二接收模块，用于接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
校验模块，用于基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的终端对应的签约数据。
第五方面，提供了一种终端，该终端包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第二方面所述的方法的步骤。
第六方面，提供了一种网络设备，该网络设备包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令 被所述处理器执行时实现如第一方面所述的方法的步骤。
第七方面，提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面所述的方法的步骤，或者实现如第二方面所述的方法的步骤。
第八方面，本申请实施例提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行网络设备程序或指令，实现如第一方面所述的方法或者实现如第二方面所述的方法。
第九方面，本发明实施例还提供了一种计算机程序产品，存储在可读存储介质中，所述计算机程序产品被至少一个处理器执行以实现如第一方面所述的方法或者实现如第二方面所述的方法。
第十方面，本发明实施例还提供了一种通信设备，其中，所述通信设备用于执行如第一方面所述的方法或者实现如第二方面所述的方法。
本申请实施例通过接收终端发送的注册请求消息；基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。这样，由于终端可以基于第二签约数据和保护数据验证第二签约数据是否为第一签约数据篡改后的签约数据，从而解决了终端无法对接收到的CAG信息是否被篡改进行判断，从而使得终端可能出现在错误的网络上执行业务的问题。
附图说明
图1是本申请实施例可应用的一种网络系统的结构图；
图2是本申请实施例提供的一种数据处理方法的流程图之一；
图3是本申请实施例提供的一种数据处理方法的流程图之二；
图4是本申请实施例提供的一种数据处理方法的流程图之三；
图5是本申请实施例提供的一种数据处理方法的流程图之四；
图6是本申请实施例提供的一种数据处理方法的流程图之五；
图7是本申请实施例提供的一种网络设备的结构图；
图8是本申请实施例提供的一种终端的结构图；
图9是本申请实施例提供的一种通信设备的结构图；
图10是本申请实施例提供的另一种终端的结构图；
图11是本申请实施例提供的另一种通信设备的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”所区别的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”一般表示前后关联对象是一种“或”的关系。
值得指出的是，本申请实施例所描述的技术不限于长期演进型(Long Term Evolution，LTE)/LTE的演进(LTE-Advanced，LTE-A)系统，还可用于其他无线通信系统，诸如码分多址(Code Division Multiple Access，CDMA)、时分多址(Time Division Multiple Access，TDMA)、频分多址(Frequency Division Multiple Access，FDMA)、正交频分多址(Orthogonal Frequency Division Multiple Access，OFDMA)、单载波频分多址(Single-carrier Frequency-Division Multiple Access，SC-FDMA)和其他系统。本申请实施例中的术语“系统”和“网络”常被可互换地使用，所描述的技术既可用于以上提及的系统和无 线电技术，也可用于其他系统和无线电技术。然而，以下描述出于示例目的描述了新空口(New Radio，NR)系统，并且在以下大部分描述中使用NR术语，尽管这些技术也可应用于NR系统应用以外的应用，如第6代(6th Generation，6G)通信系统。
图1示出本申请实施例可应用的一种无线通信系统的框图。无线通信系统包括终端11和网络侧设备12。其中，终端11也可以称作终端设备或者用户终端(User Equipment，UE)，终端11可以是手机、平板电脑(Tablet Personal Computer)、膝上型电脑(Laptop Computer)或称为笔记本电脑、个人数字助理(Personal Digital Assistant，PDA)、掌上电脑、上网本、超级移动个人计算机(ultra-mobile personal computer，UMPC)、移动上网装置(Mobile Internet Device，MID)、可穿戴式设备(Wearable Device)或车载设备(VUE)、行人终端(PUE)等终端侧设备，可穿戴式设备包括：手环、耳机、眼镜等。需要说明的是，在本申请实施例并不限定终端11的具体类型。网络侧设备12可以是基站或核心网，其中，基站可被称为节点B、演进节点B、接入点、基收发机站(Base Transceiver Station，BTS)、无线电基站、无线电收发机、基本服务集(Basic Service Set，BSS)、扩展服务集(Extended Service Set，ESS)、B节点、演进型B节点(eNB)、家用B节点、家用演进型B节点、WLAN接入点、WiFi节点、发送接收点(Transmitting Receiving Point，TRP)或所述领域中其他某个合适的术语，只要达到相同的技术效果，所述基站不限于特定技术词汇，需要说明的是，在本申请实施例中仅以NR系统中的基站为例，但是并不限定基站的具体类型。
为了方便理解，以下对本发明实施例涉及的一些内容进行说明：
CAG信息列表(information list)信息的处理。
一、注册过程
1.1终端发送注册请求(Registration Request)消息；
1.2接入和移动管理功能(Access and Mobility Management Function，AMF)通过注册成功(Registration Accept)消息向终端发送CAG information list信息，该注册成功消息可以理解为注册接受消息；
1.3终端向网络设备发送注册完成(Registration Complete)消息
在1.2中，当网络设备拒绝终端注册时，AMF可以发送注册拒绝(Registration Reject)消息。
二、注册接受
在注册接受时，信息内容可以如下表一所示。
表一：
Figure PCTCN2021094335-appb-000001
在表一中，对涉及的名词的解释如下：信元指示(Information Element Indication，IEI)；信元(Information Element，IE)；类型(Type)；参考(Reference)；状态(Presence)；格式(Format)；长度(Length)；扩展协议鉴别器(Extended protocol discriminator)；安全头类型(Security header type)；备用半个字节(Spare half octet)；注册接受消息标识(Registration accept message identity)；消息类型(Message type)；服务操作请求透传容器(Service operation request transparent container，SOR transparent container)。在表一中，省略号可以标识中间还有其他的信元，具体可以参照相关技术。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的数据处理方法进行详细地说明。
请参见图2，图2是本申请实施例提供的一种数据处理方法的流程图， 该方法应用于网络设备，如图2所示，包括以下步骤：
步骤201，接收终端发送的注册请求消息；
步骤202，基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能(Application Function，AF)储存的所述终端对应的第一签约数据；
步骤203，向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
本发明实施例中，终端可以在VPLMN发起注册时，可以向VPLMND的访问地AMF(V-AMF)发送注册请求消息。V-AMF可以向本地UDM(H-UDM)注册，例如，可以通过调用H-UDM的Nudm_UECM_Registration消息向H-UDM注册。V-AMF可以通过第一获取请求消息向H-UDM请求第一签约数据，H-UDM可以将第一签约数据和所述第一签约数据对应的保护数据提供给V-AMF，并由V-AMF通过注册接受消息将接收到的第一签约数据和保护数据发送透传给终端。该第一获取请求消息可以称之为Nudm_SDM_Get request消息。
应理解，上述H-UDM可以根据终端对应的第一签约数据或者本地策略决定是否向V-AMF提供第一签约数据，当确定向V-AMF提供第一签约数据后，可以根据第一签约数据存储的位置具有不同的行为。该第一签约数据可以存储在H-UDM中，也可以存储在第三方AF中。具体的，当存储在H-UDM时，H-UDM可以获取本体存储的第一签约数据，或者向第三方AF发送请求，以获取第三方AF存储的第一签约数据。
在进行透传时，VPLMN可以对第一签约数据进行篡改，也可以不对第一签约数据进行篡改。其中，当对第一签约数据进行篡改时，该第二签约数据与第一签约数据不同；当未对第一签约数据进行篡改时，则该第二签约数据与第一签约数据相同，此时第二签约数据即为第一签约数据。
可选的，上述第一签约数据包括N种签约类型的签约信息，N为正整数。应理解，VPLMN对第一签约数据进行篡改可以理解为，VPLMN对第一签约数据中具体的数值进行修改。也就是说，上述第二签约数据包括N中签约类 型的签约信息，该签约信息均为终端的签约信息。第一签约数据所包括的签约信息的类型可以根据实际需要进行设置。签约信息的类型可以称之为签约类型，例如，在一实施例中，签约类型可以包括CAG，即上述第一签约数据包括CAG信息。以下各实施例中，以第一签约数据为CAG信息为例进行详细说明。
终端在接收到VPLMN的V-AMF发送的注册接受消息后，可以基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据。
本申请实施例通过接收终端发送的注册请求消息；基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。这样，由于终端可以基于第二签约数据和保护数据验证第二签约数据是否为第一签约数据篡改后的签约数据，从而解决了终端无法对接收到的CAG信息是否被篡改进行判断，从而使得终端可能出现在错误的网络上执行业务的问题。
可选的，一实施例中，所述基于所述注册请求消息，向所述终端发送注册接受消息之前，所述方法还包括：
基于所述第一签约数据，确定所述保护数据。
本实施例中，在H-UDM收到V-AMF发送的Nudm_SDM_Get request消息，并决定向V-AMF提供第一签约数据以后，可以通过调用本地鉴权服务功能(Authentication Server Function，H-AUSF)生成所述保护数据，在H-AUSF生成该保护数据后，将该保护数据返回给H-UDM。例如，H-UDM可以向H-AUSF发送保护请求消息，H-AUSF收到该保护请求消息消息后，可以生成该保护数据，并通过保护应答消息将生成的保护数据发送给H-UDM。以上述第一签约数据为CAG信息为例，该保护请求消息可以称之为Nausf_CAGProtection请求消息，保护应答消息可以称之为Nausf_CAGProtection Response消息。
在一实施例中，上述保护数据可以包括第一校验信息和计数器信息，所 述计数器信息为计算所述校验信息的参数，所述第一校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，当第一签约数据为CAG信息时，上述第一校验信息可以称之为CAG-MAC-IAUSF，上述计数器信息可以称之为Counter_cag。
可选的，上述第一校验信息的计算方式可以根据实际需要进行设置，例如，在一实施例中，所述基于所述第一签约数据，确定所述保护数据包括：
根据终端的签约永久标识(Subscription Permanent Identifier，SUPI)、所述第一签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算所述第一校验信息。
本实施例中，可以基于秘钥鉴权服务功能(Key Authentication Server Function，KAUSF)生成第一校验信息，具体在生成第一校验信息时，可以采用以下参数形成密钥导出函数(Key derivation function，KDF)的输入：
函数计算(Function calculation，FC)＝指示计算密钥的函数，例如0x77；
P0＝第一签约数据的头部信息(header)；
L0＝第一签约数据的头部信息的长度；
P1＝计数器信息；
L1＝计数器信息的长度；
P2＝所述N种签约类型的签约信息的列表信息；
L2＝所述N种签约类型的签约信息的列表信息的长度。
输入密钥KEY为KAUSF。第一校验信息由KDF输出的128个最低有效位标识。其中，计数器信息可以由终端和UDM中各自维护的一个计数器确定。
可选的，获取第三方应用功能AF储存的所述终端对应的第一签约数据包括：
根据访问地公共陆地移动网络标识、所述终端的签约永久标识和签约类型获取所述第一签约数据。
本实施例中，H-UDM可以向第三方AF发送第二获取请求消息，该第二获取请求消息中可以携带访问地公共陆地移动网络标识、所述终端的签约永久标识和签约类型，通过该第二获取请求消息向第三AF获取所述终端的第 一签约数据。第三AF收到该第二获取请求消息后，根据访问地公共陆地移动网络标识、所述终端的签约永久标识和签约类型确定第一签约数据，并将该第一签约数据通过第二获取请求应答消息返回给H-UDM。该第三AF中存储的第一签约数据的形式可以根据实际需要进行设置，例如，在一实施例中，该第一签约数据为未加密的签约数据，在另一实施例中，该第一签约数据为加密的签约数据。也就是说，H-UDM接收到的第二获取请求应答消息携带的是签约信息列表或安全包(the secured packet)。以第一签约数据为CAG信息为例，上述第二获取请求消息可以称之为Ncagaf_CAG_Obtain request消息，第二获取请求应答消息可以称之为Ncagaf_CAG_Obtain response消息，上述签约信息列表可以称之为CAG信息列表(the list of CAG information)。
进一步的，在所述终端将签约数据存储在全球用户识别(Universal Subscriber Identity Module，USIM)卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
本实施例中，当终端将签约数据存储在USIM内的情况下，H-UDM还可以对获取到的第一签约数据进行加密处理。此时若获取到的第一签约数据为加密的签约数据，则对第一签约数据进行二次加密；若获取到的第一签约数据未明文，即未加密的签约数据，则对第一签约数据进行一次加密处理。最后将加密后的第一签约数据和保护数据发送给V-AMF。具体的，在未对加密后的第一签约数据进行篡改，发送给终端的第二签约数据可以理解为加密后的第一签约数据；在对加密后的第一签约数据进行篡改后，发送给终端的第二签约数据可以理解为对加密后的第一签约数据篡改后的签约数据。由于在终端将签约数据存储在USIM内的情况下，对第一签约数据进行了加密，这样提高了签约数据使用的安全性。
进一步的，在一实施例中，所述向所述终端发送注册接受消息之后，所述方法还包括：
接收所述终端在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送的第一标识值；
在所述第一标识值和网络设备储存与所述第一签约数据对应的第二标识值相同的情况下，确定所述终端针对所述第一签约数据更新成功。
本申请实施例中，终端可以首先根据终端的签约永久标识、所述第二签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算第二校验信息；然后比较所述第一校验信息和所述第二校验信息，确定所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
具体的，当该第一校验信息和第二校验信息相同的情况下，确定该第二签约数据为所述第一签约数据，或者说，该第二签约数据是未被篡改的签约数据，还可以说，第二签约数据为未被篡改的第一签约数据。当该第一校验信息和第二校验信息不同的情况下，确定该第二签约数据为所述第一签约数据篡改后的签约数据，或者说，该第二签约数据为被篡改的签约数据。
应理解，终端针对第一标识值的计算方法和网络设备针对第二标识值的计算方法相同。可选的，在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送第一标识值，所述第一标识值用于指示所述第二签约数据更新成功。本实施例中，网络设备接收到该第一标识值后，可以将该第一标识值和预先存储的第二标识值进行比较，以确定终端对第一签约数据是否更新成功。该第二标识值为生成保护数据时，基于第一签约数据生成的标识值。
本实施例中，终端可以通过注册完成消息(Registration Complete message)将第一标识值发送给V-AMF，V-AMF可以通过信息消息将接收到的第一标识值发送给H-UDM，H-UDM通过比对第一标识值和第二表示值从而确定终端是否成功收到第一签约数据，从而确定终端是否对第一签约数据更新成功。
应理解，对于第二签约数据和保护数据传输的方式可以根据实际需要进行设置，例如，在一实施例中，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。如表一所示，每一行的IE用于指示一个信元。
一实施例中，上述第二签约数据和保护数据分别归属于两个独立的信元可以理解为：上述保护数据可以作为一个独立的信元传输。此时在上述表一中可以增加保护数据对应的信元指示：签约数据列表保护信息。例如，当第一签约数据为CAG信息时，保护数据对应的信元指示可以表示为CAG信息列表保护信息(CAG information list protection information)。具体的，可以如 以下表二所示。
表二：
Figure PCTCN2021094335-appb-000002
在上述表二中，CAG information list protection information的格式可以采用以下格式：
Figure PCTCN2021094335-appb-000003
在另一实施例中，上述第二签约数据和保护数据归属于同一信元可以理解为：在第二签约数据对应的信元中加入保护数据。如，当第一签约数据为CAG信息时，CAG信息和保护数据归属的信元可以表示为CAG透传容器(CAG transparent container)。具体的，可以如以下表三所示。
表三：
Figure PCTCN2021094335-appb-000004
在上述表三中，CAG透传容器的编码格式如下：
Figure PCTCN2021094335-appb-000005
其中包含安全包的下行CAG透传容器信息元素包括：
Figure PCTCN2021094335-appb-000006
当然在其他实施例中，上述表二中，CAG透传容器可以替换为应采用受保护的CAG信息列表(Protected CAG information list)，该Protected CAG  information list的格式参照以下实施例。
为了更好的理解本发明的实现，以下对本发明的具体实现过程进行详细说明。
实施例一：V-AMF从H-UDM收到被保护的CAG Information list以后，在注册接受消息中将被保护的CAG Information list放在CAG transparent container中传递给UE。本实施例中，可以采用类似SOR的方法获取被保护的CAG Information list。如图3所示，具体流程如下：
步骤301，UE在VPLMN发起注册，向V-AMF发起注册请求；
步骤302和303，V-AMF执行初次认证(primary authentication)，并在鉴权成功以后发起非接入层安全模式指令(None Access Stratem Security Mode Command，NAS SMC)流程。
步骤304和305，V-AMF通过调用注册请求消息向H-UDM注册，例如该注册请求消息为H-UDM的Nudm_UECM_Registration消息。
步骤306，V-AMF通过第一获取请求消息向H-UDM请求CAG信息，该第一获取请求消息为Nudm_SDM_Get request消息。
步骤307，H-UDM根据签约信息或者本地策略决定向V-AMF提供CAG信息。
步骤308和309，H-UDM通过调用H-AUSF的保护请求服务，请求H-AUSF生成CAG信息的保护信息。例如通过保护请求消息调用H-AUSF的保护请求服务，该保护请求消息可以为Nausf_CAGProtection消息，该消息中可以携带SUPI、第一签约数据的头部信息和签约信息的列表信息，其中，第一签约数据的头部信息可以表示为：CAG header，签约信息的列表信息可以表示为[List]。换句话说，H-UDM通过调用H-AUSF的Nausf_CAGProtection(SUPI，CAG header，[List])保护请求服务，请求H-AUSF生成CAG信息的保护信息。在H-AUSF生成CAG信息的保护信息后，H-AUSF通过保护请求应答消息向H-UDM返回CAG信息的保护信息。该保护请求应答消息可以包括CAG-MAC-IAUSF，Counter_cag，该保护请求应答可以表示为Nausf_CAGProtection Response。换句话说，H-AUSF通过Nausf_CAGProtection Response(CAG-MAC-IAUSF，Counter_cag)向H-UDM返回CAG信息的保护 信息。其中：
CAG header的设计方法如下：
Figure PCTCN2021094335-appb-000007
本实施例中，可以基于KAUSF生成CAG-MAC-IAUSF，具体在生成CAG-MAC-IAUSF时，可以采用以下参数形成KDF的输入：
FC＝指示计算密钥的函数，例如0x77；
P0＝CAG header；
L0＝CAG header的长度；
P1＝计数器信息(Counter_cag)；
L1＝计数器信息的长度；
P2＝CAG Information list信息；
L2＝CAG Information list信息的长度。
输入密钥KEY为KAUSF。第一校验信息为KDF输出的128个最低有效位标识。其中，计数器信息可以由终端和UDM中各自维护的一个计数器确定。
步骤310，H-UDM通过第一获取应答消息向V-AMF发送CAG信息和保护信。第一获取应答消息可以携带有[List]、CAG Header、CAG-MAC-IAUSF和Counter_cag，该第一获取应答消息可以表示Nudm_SDM_Get_Response。换句话说H-UDM通过Nudm_SDM_Get_Response([List]，CAG Header，CAG-MAC-IAUSF，Counter_cag)消息向V-AMF发送CAG信息和保护信息。
步骤311，V-AMF从H-UDM收到被保护的CAG Information list以后，在注册接受消息中将被保护的CAG Information list放在CAG transparent container中传递给UE，其中IE内容如上表三所示。
步骤312，UE根据收到的CAG Information list信息，CAG Header,CAG-MAC-IAUSF,Counter_cag使用步骤309中相同的方法计算CAG-MAC-IAUSF。判断接收的CAG-MAC-IAUSF与计算的CAG-MAC-IAUSF是否相等。
若相等，则认为VPLMN没有篡改HPLMN发来的CAG Information list信息。UE对新收到的检查成功的CAG Information list的处理方式同现有的处理方式，并执行步骤313，若不相等，则认为VPLMN篡改了HPLMN发来的CAG Information list信息，进入步骤314。
步骤313，发送注册完成消息(Registration Complete message)给服务(serving)AMF完成注册流程。
步骤314，发送注册完成消息(Registration Complete message)给服务(serving)AMF，此外，UE丢弃收到的CAG Information list信息，并把当前的VPLMN设置为CAG选择时的最低优先级的网络；释放当前的N1NAS信令连接(signalling connection)。以下实施例中，该CAG选择时的优先可以理解为预设优先级信息。
步骤315，当UE在当前网络进入IDLE后，选择其他网络尝试申请服务。其他网络可以理解为以下至少之一：PLMN、TA区、CAG小区或非CAG小区。
实施例二：H-UDM从AF获取CAG Information list,并从H-AUSF获取CAG Information list的保护信息。该AF也可以成为CAG-AF。
本实施例与实施例一的区别在于CAG Information list存储在AF上。如图4所示，具体包括以下步骤：
步骤401-406与实施例一中的步骤301-306相同。
步骤407，H-UDM根据签约信息或者本地策略决定向V-AMF提供CAG信息。如果HPLMN的策略中包含CAG-AF协助信息(CAG-AF invocation)，即需要从CAG-AF获取CAG信息。则进入步骤407a。
步骤407a，H-UDM通过第二获取请求消息向CAG-AF获取CAG信息。该第二获取请求消息可以携带有VPLMN标识(ID)、终端的额SUPI和签约类型，该第二获取请求消息可以表示为Ncagaf_CAG_Obtain request。换句话说，H-UDM可以通过Ncagaf_CAG_Obtain request(VPLMN ID，SUPI of the UE，CAG Type)消息向CAG-AF获取CAG信息。
步骤407b，CAG-AF通过第二获取请求应答消息向H-UDM返回CAG信息，该第二获取请求应答消息可以携带有[List]，第二获取请求应答消息可以 表示为Ncagaf_CAG_Obtain response。换句话说，CAG-AF可以通过Ncagaf_CAG_Obtain response([List])消息向H-UDM返回CAG信息。
步骤408-415与实施例一中的步骤308-315相同。
实施例三：H-UDM要求UE对CAG信息更新结果进行确认。具体如图5所示，包括以下步骤：
步骤501-507与实施例一中的步骤301-307相同。
步骤508，该步骤中H-UDM可以发送给H-AUSF的Nausf_CAGProtection(SUPI,CAG header,[List])消息，并通过信元CAG header来决定UE在成功更新CAG信息以后，是否需要返回ack消息。接到指示以后，H-AUSF在Nausf_CAGProtection Response(CAG-MAC-IAUSF,Counter_cag)消息中，需要向H-UDM返回CAG-XMAC-IUE、CAG-MAC-IAUSF和Counter_cag，其中CAG-XMAC-IUE并不发送给UE，而是保存在UDM中，用作ack校验。
其中，CAG-MAC-IUE和CAG-XMAC-IUE的计算方法如下。本实施例中，可以基于KAUSF生成CAG-MAC-IAUSF，具体在生成CAG-MAC-IAUSF时，可以采用以下参数形成KDF的输入：
FC＝0x78；
P0＝0x01(CAG确认：已成功验证CAG信息列表数据)；
L0＝CAG确认的长度；
P1＝计数器信息；
L1＝计数器信息的长度。
输入密钥KEY为KAUSF。CAG-MAC-IUE由KDF输出的128个最低有效位标识得到。
步骤509-512与实施例一中的步骤309-3012相同。
步骤513a，在校验成功以后，UE计算CAG-MAC-IUE，并通过Registration Complete message发送给V-AMF。其中：CAG-XMAC-IUE和CAG-MAC-IUE的计算方法相同。
步骤514，V-AMF通过信息消息将CAG-MAC-IUE发送给H-UDM，该信息消息可以表示为Nudm_SDM_Info消息，换句话说，V-AMF可以通过Nudm_SDM_Info消息将CAG-MAC-IUE发送给H-UDM。
步骤516，H-UDM通过对比收到的CAG-MAC-IUE和存储的CAG-XMAC-IUE判断UE的是否成功收到CAG信息。
在校验失败后，步骤与实施例一中的步骤314和315相同。
实施例四：H-UDM在更新SOR信息的同时更新CAG信息。具体如图6所示，本实施例中，与实施例一相比，仅实施例一中步骤108和111不同，其余均相同。以下对步骤108和步骤111进行详细说明。
步骤108，如果步骤106中Nudm_SDM_Get请求的签约数据类型包含CAG信息时，那么步骤108中，H-UDM可以通过调用AUSF的Nausf_SORProtection(SUPI，SOR header，[[SOR info],[CAG info,...]，[ACK Indication])服务为CAG等信息加密，即获取SOR-MAC-IAUSF，[SOR-XMAC-IUE]和CounterSOR等保护信息。
其中，SOR-MAC-IAUSF的计算方法如下：
本实施例中，可以基于KAUSF生成SOR-MAC-IAUSF，具体在生成SOR-MAC-IAUSF时，可以采用以下参数形成KDF的输入(When deriving a SOR-MAC-IAUSF from KAUSF,the following parameters shall be used to form the input S to the KDF)：
FC＝指示计算密钥的函数，例如0x77；
P0＝SOR header；
L0＝SOR header的长度；
P1＝Counter SOR；
L1＝Counter SOR的长度
P2＝列表信息，该列表信息至少包括以下一项：SOR参数，CAG信息(list which including at least one of the following:PLMN ID and access technology,CAG information)。
L2＝SOR信息列表数据的长度(length of SOR Information list data)。
输入密钥KEY为KAUSF(The input key KEY shall be KAUSF)。SOR-MAC-IAUSF为KDF输出的128个最低有效位标识。
步骤111，V-AMF通过Registration Accept消息将CAG等信息，及其保护信息发送给UE。其中，Registration Accept消息的参数的编码格式如下：
Figure PCTCN2021094335-appb-000008
在上表中，删除IE CAG information list，对SOR transparent container扩展如下：
Figure PCTCN2021094335-appb-000009
其中，SOR透传容器信息列表如下：
Figure PCTCN2021094335-appb-000010
Figure PCTCN2021094335-appb-000011
实施例五：V-AMF从H-UDM收到被保护的CAG Information list以后，在注册接受消息中将CAG Information list及其保护信息放在注册接受消息中传递给UE。
本实施例中，保护信息可以归属于一个独立的信元，即在注册接受消息的IE内容中增加一个信元CAG信息列表保护信息(CAG information list protection information)。具体如上述表二所示。
实施例六：V-AMF从H-UDM收到被保护的CAG Information list以后，在IE CAG Information list中添加保护信息，然后放在注册接受消息中传递给UE。
本实施例中，保护信息和CAG信息归属于一个信元。即为保护的CAG信息列表(Protected CAG information list)。如下表所示：
Figure PCTCN2021094335-appb-000012
在表中，受保护的CAG信息列表(Protected CAG information list)的格式如下：
Figure PCTCN2021094335-appb-000013
Figure PCTCN2021094335-appb-000014
其中，信息列表的信息元素(CAG information list information element)如下：
Figure PCTCN2021094335-appb-000015
上述MCC可以理解为移动国家代码(mobile country code)。上述MCC数字1可以表示为MCC digit 1。CAG-ID可以理解为CAG的索引或标识。
实施例七：安全包(security packet)。
若终端将CAG Information list信息写入USIM卡中，则上述实施例中，信元[List]表示security packet(即被保护过的CAG信息)，该security packet由UDM通过预设的加密方式进行保护。
请参见图6，图6是本申请实施例提供的另一种数据处理方法的流程图，该方法应用于终端，如图6所示，包括以下步骤：
步骤601，向网络设备发送注册请求消息；
步骤602，接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
步骤603，基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的签约数据。
可选的，所述第二签约数据包括N种签约类型的签约信息，N为正整数。
可选的，所述保护数据包括第一校验信息和计数器信息，所述计数器信 息为计算所述校验信息的参数，所述校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，所述基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据包括：
根据终端的签约永久标识、所述第二签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算第二校验信息；
比较所述第一校验信息和所述第二校验信息，确定所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，在所述终端将签约数据存储在全球用户识别卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
可选的，所述第一签约数据包括封闭接入组CAG信息。
可选的，所述方法还包括：
在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送第一标识值，所述第一标识值用于指示所述第二签约数据更新成功。
可选的，所述方法还包括：
在确定所述第二签约数据是被篡改的签约数据的情况下，执行第一操作；
所述第一操作包括以下至少一项：丢弃所述第二签约数据；将访问地公共陆地移动网络的预设优先级信息设置为最低优先级，所述预设优先级信息用于表示基于签约数据选择网络的优先级信息；释放连接，进入空闲态。
可选的，所述方法还包括：
在所述终端进入空闲态后，进行公共陆地移动网络重选。
可选的，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。
需要说明的是，本实施例作为图2所示的实施例对应的终端的实施方式，其具体的实施方式可以参见图2所示的实施例相关说明，以及达到相同的有益效果，为了避免重复说明，此处不再赘述。
需要说明的是，本申请实施例提供的数据处理方法方法，执行主体可以 为数据处理装置，或者，该数据处理装置中的用于执行数据处理的方法的控制模块。本申请实施例中以数据处理装置执行数据处理的方法为例，说明本申请实施例提供的数据处理的装置。
请参见图7，图7是本申请实施例提供的一种网络设备的结构图，如图7所示，网络设备700包括：
第一接收模块701，用于接收终端发送的注册请求消息；
获取模块702，用于基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；
第一发送模块703，用于向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，所述第一签约数据包括N种签约类型的签约信息，N为正整数。
可选的，所述网络设备700还包括：
第一确定模块，用于基于所述第一签约数据，确定所述保护数据。
可选的，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述第一校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，所述第一确定模块具体用于，根据终端的签约永久标识、所述第一签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算所述第一校验信息。
可选的，所述获取模块702具体用于，根据访问地公共陆地移动网络标识、所述终端的签约永久标识和签约类型获取所述第一签约数据。
可选的，在所述终端将签约数据存储在全球用户识别卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
可选的，所述第一签约数据包括封闭接入组CAG信息。
可选的，所述网络设备700还包括第二确定模块，其中，
所述第一接收模块701还用于，接收所述终端在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送的第一标识值；
所述第二确定模块，用于在所述第一标识值和网络设备储存与所述第一签约数据对应的第二标识值相同的情况下，确定所述终端针对所述第一签约数据更新成功。
可选的，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。
本申请实施例提供的网络设备能够实现图2的方法实施例中网络设备实现的各个过程，为避免重复，这里不再赘述。
请参见图8，图8是本申请实施例提供的一种终端的结构图，如图8所示，终端800包括：
第二发送模块801，用于向网络设备发送注册请求消息；
第二接收模块802，用于接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
校验模块803，用于基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的终端对应的签约数据。
可选的，所述第二签约数据包括N种签约类型的签约信息，N为正整数。
可选的，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，所述校验模块803包括：
计算单元，用于根据终端的签约永久标识、所述第二签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算第二校验信息；
比较单元，用于比较所述第一校验信息和所述第二校验信息，确定所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
可选的，在所述终端将签约数据存储在全球用户识别卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
可选的，所述第一签约数据包括封闭接入组CAG信息。
可选的，所述第二发送模块801，还用于在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送第一标识值，所述第一标识值用于指示所述第二签约数据更新成功。
可选的，所述终端800还包括：
处理模块，用于在确定所述第二签约数据是被篡改的签约数据的情况下，执行第一操作；
所述第一操作包括以下至少一项：丢弃所述第二签约数据；将访问地公共陆地移动网络的预设优先级信息设置为最低优先级，所述预设优先级信息用于表示基于签约数据选择网络的优先级信息；释放连接，进入空闲态。
可选的，所述述终端800还包括：
处理模块，用于在所述终端进入空闲态后，进行公共陆地移动网络重选。
可选的，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。
本申请实施例提供的终端能够实现图6的方法实施例中终端实现的各个过程，为避免重复，这里不再赘述。
本申请实施例中的数据处理装置可以是装置，也可以是终端中的部件、集成电路、或芯片。该装置可以是移动终端，也可以为非移动终端。示例性的，移动终端可以包括但不限于上述所列举的终端的类型，非移动终端可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的数据处理装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为ios操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的数据处理装置能够实现图6的方法实施例实现的各个过程，并达到相同的技术效果，为避免重复，这里不再赘述。
可选的，如图9所示，本申请实施例还提供一种通信设备900，包括处理器901，存储器902，存储在存储器902上并可在所述处理器901上运行的程 序或指令，例如，该通信设备900为终端时，该程序或指令被处理器901执行时实现上述数据处理方法实施例的各个过程，且能达到相同的技术效果。该通信设备900为网络侧设备时，该程序或指令被处理器901执行时实现上述数据处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
图10为实现本申请各个实施例的一种终端的硬件结构示意图。
该终端1000包括但不限于：射频单元1001、网络模块1002、音频输出单元1003、输入单元1004、传感器1005、显示单元1006、用户输入单元1007、接口单元1008、存储器1009以及处理器1010等部件。
本领域技术人员可以理解，终端1000还可以包括给各个部件供电的电源(比如电池)，电源可以通过电源管理系统与处理器1010逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图10中示出的终端结构并不构成对终端的限定，终端可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
应理解的是，本申请实施例中，输入单元1004可以包括图形处理器(Graphics Processing Unit，GPU)10041和麦克风10042，图形处理器10041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元1006可包括显示面板10061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板10061。用户输入单元1007包括触控面板10071以及其他输入设备10072。触控面板10071，也称为触摸屏。触控面板10071可包括触摸检测装置和触摸控制器两个部分。其他输入设备10072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。
本申请实施例中，射频单元1001将来自网络侧设备的下行数据接收后，给处理器1010处理；另外，将上行的数据发送给网络设备。通常，射频单元1001包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器、双工器等。
存储器1009可用于存储软件程序或指令以及各种数据。存储器109可主要包括存储程序或指令区和存储数据区，其中，存储程序或指令区可存储操 作系统、至少一个功能所需的应用程序或指令(比如声音播放功能、图像播放功能等)等。此外，存储器1009可以包括高速随机存取存储器，还可以包括非易失性存储器，其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。
处理器1010可包括一个或多个处理单元；可选的，处理器1010可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序或指令等，调制解调处理器主要处理无线通信，如基带处理器。可以理解的是，上述调制解调处理器也可以不集成到处理器1010中。
其中，射频单元1001，用于向网络设备发送注册请求消息；接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
处理器1010，用于基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的签约数据。
应理解，本实施例中，上述处理器1010和射频单元1001能够实现图6的方法实施例中终端实现的各个过程，为避免重复，这里不再赘述。
具体地，本申请实施例还提供了一种网络侧设备。如图11所示，该网络设备1100包括：天线1101、射频装置1102、基带装置1103。天线1101与射频装置1102连接。在上行方向上，射频装置1102通过天线1101接收信息，将接收的信息发送给基带装置1103进行处理。在下行方向上，基带装置1103对要发送的信息进行处理，并发送给射频装置1102，射频装置1102对收到的信息进行处理后经过天线1101发送出去。
上述频带处理装置可以位于基带装置1103中，以上实施例中网络侧设备执行的方法可以在基带装置1103中实现，该基带装置1103包括处理器1104和存储器1105。
基带装置1103例如可以包括至少一个基带板，该基带板上设置有多个芯片，如图11所示，其中一个芯片例如为处理器1104，与存储器1105连接，以调用存储器1105中的程序，执行以上方法实施例中所示的网络设备操作。
该基带装置1103还可以包括网络接口1106，用于与射频装置1102交互信息，该接口例如为通用公共无线接口(common public radio interface，CPRI)。
具体地，本发明实施例的网络侧设备还包括：存储在存储器1105上并可在处理器1104上运行的指令或程序，处理器1104调用存储器1105中的指令或程序执行图2所示各模块执行的方法，并达到相同的技术效果，为避免重复，故不在此赘述。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述数据处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的电子设备中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行网络设备程序或指令，实现上述数据处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片、系统芯片、芯片系统或片上系统芯片等。
本发明实施例还提供了一种计算机程序产品，存储在可读存储介质中，所述计算机程序产品被至少一个处理器执行以实现上述数据处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本发明实施例还提供了一种通信设备，其中，所述通信设备用于执行上述数据处理方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
可以理解的是，本公开描述的这些实施例可以用硬件、软件、固件、中间 件、微码或其组合来实现。对于硬件实现，模块、单元、子模块、子单元等可以实现在一个或多个专用集成电路(Application Specific Integrated Circuits，ASIC)、数字信号处理器(Digital Signal Processing，DSP)、数字信号处理设备(DSP Device，DSPD)、可编程逻辑设备(Programmable Logic Device，PLD)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)、通用处理器、控制器、微控制器、微处理器、用于执行本申请所述功能的其它电子单元或其组合中。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者基站等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (35)

  1. 一种数据处理方法，应用于网络设备，包括：
    接收终端发送的注册请求消息；
    基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；
    向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  2. 根据权利要求1所述的方法，其中，所述第一签约数据包括N种签约类型的签约信息，N为正整数。
  3. 根据权利要求2所述的方法，其中，所述基于所述注册请求消息，向所述终端发送注册接受消息之前，所述方法还包括：
    基于所述第一签约数据，确定所述保护数据。
  4. 根据权利要求3所述的方法，其中，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述第一校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  5. 根据权利要求4所述的方法，其中，所述基于所述第一签约数据，确定所述保护数据包括：
    根据终端的签约永久标识、所述第一签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算所述第一校验信息。
  6. 根据权利要求1所述的方法，其中，获取第三方应用功能AF储存的所述终端对应的第一签约数据包括：
    根据访问地公共陆地移动网络标识、所述终端的签约永久标识和签约类型获取所述第一签约数据。
  7. 根据权利要求1所述的方法，其中，在所述终端将签约数据存储在全球用户识别卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
  8. 根据权利要求1所述的方法，其中，所述第一签约数据包括封闭接入组 CAG信息。
  9. 根据权利要求1所述的方法，其中，所述向所述终端发送注册接受消息之后，所述方法还包括：
    接收所述终端在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送的第一标识值；
    在所述第一标识值和网络设备储存与所述第一签约数据对应的第二标识值相同的情况下，确定所述终端针对所述第一签约数据更新成功。
  10. 根据权利要求1所述的方法，其中，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。
  11. 一种数据处理方法，应用于终端，包括：
    向网络设备发送注册请求消息；
    接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
    基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的签约数据。
  12. 根据权利要求11所述的方法，其中，所述第二签约数据包括N种签约类型的签约信息，N为正整数。
  13. 根据权利要求12所述的方法，其中，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  14. 根据权利要求13所述的方法，其中，所述基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据包括：
    根据终端的签约永久标识、所述第二签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算第二校验信息；
    比较所述第一校验信息和所述第二校验信息，确定所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  15. 根据权利要求11所述的方法，其中，在所述终端将签约数据存储在全 球用户识别卡内的情况下，所述第二签约数据为加密后的第一签约数据，或者对所述加密后的第一签约数据被篡改后的签约数据。
  16. 根据权利要求11所述的方法，其中，所述第一签约数据包括封闭接入组CAG信息。
  17. 根据权利要求11所述的方法，还包括：
    在确定所述第二签约数据是未被篡改的签约数据的情况下，基于所述第二签约数据发送第一标识值，所述第一标识值用于指示所述第二签约数据更新成功。
  18. 根据权利要求11所述的方法，还包括：
    在确定所述第二签约数据是被篡改的签约数据的情况下，执行第一操作；
    所述第一操作包括以下至少一项：丢弃所述第二签约数据；将访问地公共陆地移动网络的预设优先级信息设置为最低优先级，所述预设优先级信息用于表示基于签约数据选择网络的优先级信息；释放连接，进入空闲态。
  19. 根据权利要求18所述的方法，还包括：
    在所述终端进入空闲态后，进行公共陆地移动网络重选。
  20. 根据权利要求11所述的方法，其中，所述第二签约数据和保护数据归属于同一信元，或者所述第二签约数据和保护数据分别归属于两个独立的信元。
  21. 一种数据处理装置，包括：
    第一接收模块，用于接收终端发送的注册请求消息；
    获取模块，用于基于所述注册请求消息，获取统一数据管理实体UDM实体储存或者第三方应用功能AF储存的所述终端对应的第一签约数据；
    第一发送模块，用于向所述终端发送注册接受消息，所述注册接受消息携带有第二签约数据和保护数据，所述保护数据用于验证所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  22. 根据权利要求21所述的数据处理装置，其中，所述第一签约数据包括N种签约类型的签约信息，N为正整数。
  23. 根据权利要求22所述的数据处理装置，还包括：
    第一确定模块，用于基于所述第一签约数据，确定所述保护数据。
  24. 根据权利要求23所述的数据处理装置，其中，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述第一校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  25. 根据权利要求24所述的数据处理装置，其中，所述第一确定模块具体用于：根据终端的签约永久标识、所述第一签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算所述第一校验信息。
  26. 一种数据处理装置，包括：
    第二发送模块，用于向网络设备发送注册请求消息；
    第二接收模块，用于接收所述网络设备基于所述注册请求消息发送的注册接受消息，所述注册接受消息携带有第二签约数据和保护数据；
    校验模块，用于基于所述第二签约数据和保护数据确定所述第二签约数据是否为第一签约数据篡改后的签约数据，所述第一签约数据为统一数据管理实体UDM实体储存或者第三方应用功能AF储存的终端对应的签约数据。
  27. 根据权利要求26所述的数据处理装置，其中，所述第二签约数据包括N种签约类型的签约信息，N为正整数。
  28. 根据权利要求27所述的数据处理装置，其中，所述保护数据包括第一校验信息和计数器信息，所述计数器信息为计算所述校验信息的参数，所述校验信息用于校验所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  29. 根据权利要求28所述的数据处理装置，其中，所述校验模块包括：
    计算单元，用于根据终端的签约永久标识、所述第二签约数据的头部信息、所述N种签约类型的签约信息的列表信息和所述计数器信息，计算第二校验信息；
    比较单元，用于比较所述第一校验信息和所述第二校验信息，确定所述第二签约数据是否为所述第一签约数据篡改后的签约数据。
  30. 一种终端，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序，所述程序被所述处理器执行时实现如权利要求11至20中任一项所述的数据处理方法中的步骤。
  31. 一种网络设备，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1至10中任一项所述的数据处理方法中的步骤。
  32. 一种可读存储介质，其中，所述可读存储介质上存储程序或指令，所述程序或指被处理器执行时实现如权利要求1至20中任一项所述的数据处理方法的步骤。
  33. 一种芯片，包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行网络设备程序或指令，实现如权利要求1至20中任一项所述的数据处理方法的步骤。
  34. 一种计算机程序产品，存储在可读存储介质中，所述计算机程序产品被至少一个处理器执行以实现如权利要求1至20中任一项所述的数据处理方法的步骤。
  35. 一种通信设备，其中，所述通信设备用于执行如权利要求1至20中任一项所述的数据处理方法的步骤。
PCT/CN2021/094335 2020-05-22 2021-05-18 数据处理方法、装置、网络设备及终端 WO2021233286A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010443863.1A CN113709729B (zh) 2020-05-22 2020-05-22 数据处理方法、装置、网络设备及终端
CN202010443863.1 2020-05-22

Publications (1)

Publication Number Publication Date
WO2021233286A1 true WO2021233286A1 (zh) 2021-11-25

Family

ID=78646652

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/094335 WO2021233286A1 (zh) 2020-05-22 2021-05-18 数据处理方法、装置、网络设备及终端

Country Status (2)

Country Link
CN (1) CN113709729B (zh)
WO (1) WO2021233286A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023122917A1 (zh) * 2021-12-27 2023-07-06 北京小米移动软件有限公司 一种信息处理方法、装置、通信设备及存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103369500A (zh) * 2012-04-09 2013-10-23 电信科学技术研究院 一种csg签约信息的传输方法和设备
CN109699072A (zh) * 2018-04-09 2019-04-30 华为技术有限公司 通信方法、装置和系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10986602B2 (en) * 2018-02-09 2021-04-20 Intel Corporation Technologies to authorize user equipment use of local area data network features and control the size of local area data network information in access and mobility management function
CN110366241A (zh) * 2018-04-09 2019-10-22 华为技术有限公司 通信方法、装置和系统
CN110475247A (zh) * 2018-05-11 2019-11-19 电信科学技术研究院有限公司 消息处理方法及装置
WO2020071689A1 (ko) * 2018-10-05 2020-04-09 삼성전자 주식회사 사설 이동통신망 및 사업자 이동통신망 접속을 지원하는 장치 및 방법
CN110730444A (zh) * 2019-10-18 2020-01-24 中国联合网络通信集团有限公司 基于终端的通信网络接入方法及装置

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103369500A (zh) * 2012-04-09 2013-10-23 电信科学技术研究院 一种csg签约信息的传输方法和设备
CN109699072A (zh) * 2018-04-09 2019-04-30 华为技术有限公司 通信方法、装置和系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
3GPP CT1: "S2-2003535, LS on manipulation of CAG Information element by a VPLMN", SA WG2 MEETING #S2-139E, 29 April 2020 (2020-04-29), XP051879060 *
NOKIA ET AL.: "C1-202862, Manual CAG selection", 3GPP TSG-CT WG1 MEETING #123-E, 23 April 2020 (2020-04-23), XP051878075 *

Also Published As

Publication number Publication date
CN113709729A (zh) 2021-11-26
CN113709729B (zh) 2023-05-23

Similar Documents

Publication Publication Date Title
US11354136B2 (en) Machine-to-machine bootstrapping
WO2019184728A1 (zh) 终端设备的位置确定方法和设备
WO2018161796A1 (zh) 多接入场景中的连接处理方法和装置
US20190253403A1 (en) Network Authentication Triggering Method and Related Device
CN112512045B (zh) 一种通信系统、方法及装置
US20220225095A1 (en) External Authentication Method, Communication Apparatus, and Communication System
US20230096402A1 (en) Service obtaining method and apparatus, and communication device and readable storage medium
CN114357497A (zh) 信息配置方法、通信设备和存储介质
US20240073685A1 (en) Method for authentication for nswo service, device, and storage medium
WO2021233286A1 (zh) 数据处理方法、装置、网络设备及终端
CN114450991A (zh) 用于注册程序的无线通信方法
WO2021129803A1 (zh) 一种信息处理方法及通信装置
US10959097B1 (en) Method and system for accessing private network services
CN110830421B (zh) 数据传输方法和设备
CN113411804A (zh) 传输控制方法
US10492056B2 (en) Enhanced mobile subscriber privacy in telecommunications networks
US20220053326A1 (en) Communication method and apparatus
WO2021195816A1 (zh) 一种通信方法、装置及系统
CN116074821A (zh) 一种通信方法及装置
CN111372250A (zh) 基站的判断方法及装置、存储介质和电子装置
WO2024061207A1 (zh) 用户级数据的管理方法、装置、通信设备及可读存储介质
WO2023072271A1 (zh) 管理安全上下文的方法和装置
US20240080665A1 (en) Communication method and communication apparatus
WO2023055342A1 (en) Enabling distributed non-access stratum terminations
CN117835239A (zh) 终端鉴权方法、终端及网络侧设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21807597

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 26.04.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21807597

Country of ref document: EP

Kind code of ref document: A1